Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php /* Sucuri integrity monitor * Integrity checking and server side scanning. * ..
Decoded Output download
/* Sucuri integrity monitor .
* Connects back home.
* Copyright (C) 2010-2013 Sucuri, LLC
* Do not distribute or share.
*/
$SUCURIPWD = "535e26eb0f3324e8056fe6954976b04c62eb977f2cc51";
if(isset($_GET['test']))
{
echo "OK: Sucuri: Found
";
exit(0);
}
/* Valid argument. */
if(!isset($_GET['run']))
{
exit(0);
}
/* Must have an IP address. */
if(!isset($_SERVER['REMOTE_ADDR']))
{
exit(0);
}
$origremoteip = $_SERVER['REMOTE_ADDR'];
/* If coming from cloudflare: */
if(isset($_SERVER['HTTP_CF_CONNECTING_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
/* CloudProxy headers. */
else if(isset($_SERVER['HTTP_X_SUCURI_CLIENTIP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_SUCURI_CLIENTIP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_ORIG_CLIENT_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_ORIG_CLIENT_IP'];
}
else if(isset($_SERVER['HTTP_CLIENT_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_TRUE_CLIENT_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_TRUE_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_X_REAL_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_REAL_IP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
$myiplist = array(
'69.164.211.37',
'72.14.187.58',
'69.164.196.53',
'50.116.47.181',
'66.228.34.49',
'66.228.40.185',
'50.116.36.92',
'50.116.36.93',
'50.116.3.171',
'198.58.96.212',
'50.116.63.221',
'192.155.92.112',
'192.81.128.31',
'198.58.106.244',
'192.155.95.139',
'23.239.9.227',
'198.58.112.103',
'192.155.94.43',
'162.216.16.33',
'104.237.143.242',
'104.237.139.227',
'45.33.76.17',
'45.79.210.57',
'173.230.133.164',
'69.164.219.45',
'45.79.207.127',
'96.126.117.20',
'104.237.138.168',
'2600:3c00::f03c:91ff:feae:e104',
'2600:3c00::f03c:91ff:fe84:e275',
'2600:3c03::f03c:91ff:fee4:c9f0',
'2600:3c02::f03c:91ff:fee4:c998',
'2600:3c00::f03c:91ff:fe84:e218',
'2600:3c02::f03c:91ff:fedf:58c6',
'2600:3c02::f03c:91ff:fedf:5835',
'2600:3c03::f03c:91ff:fedf:6a7a',
'2600:3c03::f03c:91ff:fe70:36ce',
'2600:3c02::f03c:91ff:fe70:f12d',
'2600:3c01::f03c:91ff:fe70:52bb',
"2600:3c02::f03c:91ff:fe69:4b66",
"2600:3c00::f03c:91ff:fe70:5213",
"2600:3c03::f03c:91ff:fedb:b9ce",
"2600:3c00::f03c:91ff:fe6e:a046",
"2600:3c02::f03c:91ff:fe6e:a0dd",
"2600:3c03::f03c:91ff:fe6e:a0ac",
"2600:3c02::f03c:91ff:fe9b:ccac",
"2600:3c03::f03c:91ff:fe59:f1f",
"2600:3c02::f03c:91ff:fe59:fbb",
"2600:3c03::f03c:91ff:fe59:f51",
"2600:3c00::f03c:91ff:fe59:f84",
'2600:3c00::f03c:91ff:fe1f:75cb',
'2600:3c00::f03c:91ff:fe1f:757c',
'2600:3c02::f03c:91ff:fe1f:753c',
'fe80::fcfd:adff:fee6:8087',
);
$ipmatches = 0;
foreach($myiplist as $myip)
{
if(strpos($_SERVER['REMOTE_ADDR'], $myip) !== FALSE)
{
$ipmatches = 1;
break;
}
if(strpos($origremoteip, $myip) !== FALSE)
{
$ipmatches = 1;
break;
}
}
if($ipmatches == 0)
{
echo "ERROR: Invalid IP Address
";
exit(0);
}
/* Valid key. */
if(!isset($_POST['sscred']))
{
echo "ERROR: Invalid argument
";
exit(0);
}
/* Connect back to get what to run. */
if(!function_exists('curl_exec') || isset($_GET['nocurl']))
{
$postdata = http_build_query(
array(
'p' => $SUCURIPWD,
'q' => $_POST['sscred'],
)
);
$opts = array('http' =>
array(
'method' => 'POST',
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => $postdata
)
);
$context = stream_context_create($opts);
$my_sucuri_encoding = file_get_contents("https://$MYMONITOR.sucuri.net/imonitor", false, $context);
if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
{
}
else
{
echo "ERROR: Unable to complete (missing curl support and file_get failed). Please contact [email protected] for guidance.
";
exit(1);
}
}
else
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://$MYMONITOR.sucuri.net/imonitor");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, "p=$SUCURIPWD&q=".$_POST['sscred']);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$my_sucuri_encoding = curl_exec($ch);
curl_close($ch);
if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
{
}
else
{
if($my_sucuri_encoding == NULL || strlen($my_sucuri_encoding) < 3)
{
$my_sucuri_encoding = "x2351";
}
echo "ERROR: Unable to connect back to Sucuri (error: $my_sucuri_encoding). Please contact [email protected] for guidance.
";
exit(1);
}
}
$my_sucuri_encoding = base64_decode(
substr($my_sucuri_encoding, 7));
eval(
$my_sucuri_encoding
);
Did this file decode correctly?
Original Code
<?php
/* Sucuri integrity monitor
* Integrity checking and server side scanning.
*
* Copyright (C) 2010, 2011, 2012 Sucuri, LLC
* http://sucuri.net
* Do not distribute or share.
*/
$MYMONITOR = "monitor14";
$my_sucuri_encoding = "
LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5lY3RzIGJhY2sgaG9tZS4KICog
Q29weXJpZ2h0IChDKSAyMDEwLTIwMTMgU3VjdXJpLCBMTEMKICogRG8gbm90IGRpc3RyaWJ1dGUg
b3Igc2hhcmUuCiAqLwoKCiRTVUNVUklQV0QgPSAiNTM1ZTI2ZWIwZjMzMjRlODA1NmZlNjk1NDk3
NmIwNGM2MmViOTc3ZjJjYzUxIjsKCgppZihpc3NldCgkX0dFVFsndGVzdCddKSkKewogICAgZWNo
byAiT0s6IFN1Y3VyaTogRm91bmRcbiI7CiAgICBleGl0KDApOwp9CgoKCi8qIFZhbGlkIGFyZ3Vt
ZW50LiAqLwppZighaXNzZXQoJF9HRVRbJ3J1biddKSkKewogICAgZXhpdCgwKTsKfQoKCi8qIE11
c3QgaGF2ZSBhbiBJUCBhZGRyZXNzLiAqLwppZighaXNzZXQoJF9TRVJWRVJbJ1JFTU9URV9BRERS
J10pKQp7CiAgICBleGl0KDApOwp9Cgokb3JpZ3JlbW90ZWlwID0gJF9TRVJWRVJbJ1JFTU9URV9B
RERSJ107CgovKiBJZiBjb21pbmcgZnJvbSBjbG91ZGZsYXJlOiAqLwppZihpc3NldCgkX1NFUlZF
UlsnSFRUUF9DRl9DT05ORUNUSU5HX0lQJ10pKQp7CiAgICAkX1NFUlZFUlsnUkVNT1RFX0FERFIn
XSA9ICRfU0VSVkVSWydIVFRQX0NGX0NPTk5FQ1RJTkdfSVAnXTsKfQovKiBDbG91ZFByb3h5IGhl
YWRlcnMuICovCmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfWF9TVUNVUklfQ0xJRU5USVAn
XSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfWF9TVUNV
UklfQ0xJRU5USVAnXTsKfQovKiBNb3JlIGdhdGV3YXkgcmVxdWVzdHMuICovCmVsc2UgaWYoaXNz
ZXQoJF9TRVJWRVJbJ0hUVFBfWF9PUklHX0NMSUVOVF9JUCddKSkKewogICAgJF9TRVJWRVJbJ1JF
TU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9YX09SSUdfQ0xJRU5UX0lQJ107Cn0KZWxzZSBp
Zihpc3NldCgkX1NFUlZFUlsnSFRUUF9DTElFTlRfSVAnXSkpCnsKICAgICRfU0VSVkVSWydSRU1P
VEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfQ0xJRU5UX0lQJ107Cn0KLyogUHJveHkgcmVxdWVz
dHMuICovCmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfVFJVRV9DTElFTlRfSVAnXSkpCnsK
ICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfVFJVRV9DTElFTlRf
SVAnXTsKfQovKiBQcm94eSByZXF1ZXN0cy4gKi8KZWxzZSBpZihpc3NldCgkX1NFUlZFUlsnSFRU
UF9YX1JFQUxfSVAnXSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJb
J0hUVFBfWF9SRUFMX0lQJ107Cn0KLyogTW9yZSBnYXRld2F5IHJlcXVlc3RzLiAqLwplbHNlIGlm
KGlzc2V0KCRfU0VSVkVSWydIVFRQX1hfRk9SV0FSREVEX0ZPUiddKSkKewogICAgJF9TRVJWRVJb
J1JFTU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9YX0ZPUldBUkRFRF9GT1InXTsKfQoKCiRt
eWlwbGlzdCA9IGFycmF5KAonNjkuMTY0LjIxMS4zNycsCic3Mi4xNC4xODcuNTgnLAonNjkuMTY0
LjE5Ni41MycsCic1MC4xMTYuNDcuMTgxJywKJzY2LjIyOC4zNC40OScsCic2Ni4yMjguNDAuMTg1
JywKJzUwLjExNi4zNi45MicsCic1MC4xMTYuMzYuOTMnLAonNTAuMTE2LjMuMTcxJywKJzE5OC41
OC45Ni4yMTInLAonNTAuMTE2LjYzLjIyMScsCicxOTIuMTU1LjkyLjExMicsCicxOTIuODEuMTI4
LjMxJywKJzE5OC41OC4xMDYuMjQ0JywKJzE5Mi4xNTUuOTUuMTM5JywKJzIzLjIzOS45LjIyNycs
CicxOTguNTguMTEyLjEwMycsCicxOTIuMTU1Ljk0LjQzJywKJzE2Mi4yMTYuMTYuMzMnLAonMTA0
LjIzNy4xNDMuMjQyJywKJzEwNC4yMzcuMTM5LjIyNycsCic0NS4zMy43Ni4xNycsCic0NS43OS4y
MTAuNTcnLAonMTczLjIzMC4xMzMuMTY0JywKJzY5LjE2NC4yMTkuNDUnLAonNDUuNzkuMjA3LjEy
NycsCic5Ni4xMjYuMTE3LjIwJywKJzEwNC4yMzcuMTM4LjE2OCcsCgonMjYwMDozYzAwOjpmMDNj
OjkxZmY6ZmVhZTplMTA0JywKJzI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZlODQ6ZTI3NScsCicyNjAw
OjNjMDM6OmYwM2M6OTFmZjpmZWU0OmM5ZjAnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmVlNDpj
OTk4JywKJzI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZlODQ6ZTIxOCcsCicyNjAwOjNjMDI6OmYwM2M6
OTFmZjpmZWRmOjU4YzYnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmVkZjo1ODM1JywKJzI2MDA6
M2MwMzo6ZjAzYzo5MWZmOmZlZGY6NmE3YScsCicyNjAwOjNjMDM6OmYwM2M6OTFmZjpmZTcwOjM2
Y2UnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU3MDpmMTJkJywKJzI2MDA6M2MwMTo6ZjAzYzo5
MWZmOmZlNzA6NTJiYicsCiIyNjAwOjNjMDI6OmYwM2M6OTFmZjpmZTY5OjRiNjYiLAoiMjYwMDoz
YzAwOjpmMDNjOjkxZmY6ZmU3MDo1MjEzIiwKIjI2MDA6M2MwMzo6ZjAzYzo5MWZmOmZlZGI6Yjlj
ZSIsCiIyNjAwOjNjMDA6OmYwM2M6OTFmZjpmZTZlOmEwNDYiLAoiMjYwMDozYzAyOjpmMDNjOjkx
ZmY6ZmU2ZTphMGRkIiwKIjI2MDA6M2MwMzo6ZjAzYzo5MWZmOmZlNmU6YTBhYyIsCiIyNjAwOjNj
MDI6OmYwM2M6OTFmZjpmZTliOmNjYWMiLAoiMjYwMDozYzAzOjpmMDNjOjkxZmY6ZmU1OTpmMWYi
LAoiMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU1OTpmYmIiLCAKIjI2MDA6M2MwMzo6ZjAzYzo5MWZm
OmZlNTk6ZjUxIiwKIjI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZlNTk6Zjg0IiwgCicyNjAwOjNjMDA6
OmYwM2M6OTFmZjpmZTFmOjc1Y2InLAonMjYwMDozYzAwOjpmMDNjOjkxZmY6ZmUxZjo3NTdjJywK
JzI2MDA6M2MwMjo6ZjAzYzo5MWZmOmZlMWY6NzUzYycsCidmZTgwOjpmY2ZkOmFkZmY6ZmVlNjo4
MDg3JywKKTsKCgokaXBtYXRjaGVzID0gMDsKCmZvcmVhY2goJG15aXBsaXN0IGFzICRteWlwKQp7
CiAgICBpZihzdHJwb3MoJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10sICRteWlwKSAhPT0gRkFMU0Up
CiAgICB7CiAgICAgICAgJGlwbWF0Y2hlcyA9IDE7CiAgICAgICAgYnJlYWs7CiAgICB9CiAgICBp
ZihzdHJwb3MoJG9yaWdyZW1vdGVpcCwgJG15aXApICE9PSBGQUxTRSkKICAgIHsKICAgICAgICAk
aXBtYXRjaGVzID0gMTsKICAgICAgICBicmVhazsKICAgIH0KfQoKCmlmKCRpcG1hdGNoZXMgPT0g
MCkKewogICAgZWNobyAiRVJST1I6IEludmFsaWQgSVAgQWRkcmVzc1xuIjsKICAgIGV4aXQoMCk7
Cn0KCgovKiBWYWxpZCBrZXkuICovCmlmKCFpc3NldCgkX1BPU1RbJ3NzY3JlZCddKSkKewogICAg
ZWNobyAiRVJST1I6IEludmFsaWQgYXJndW1lbnRcbiI7CiAgICBleGl0KDApOwp9CgoKLyogQ29u
bmVjdCBiYWNrIHRvIGdldCB3aGF0IHRvIHJ1bi4gKi8KaWYoIWZ1bmN0aW9uX2V4aXN0cygnY3Vy
bF9leGVjJykgfHwgaXNzZXQoJF9HRVRbJ25vY3VybCddKSkKewogICAgJHBvc3RkYXRhID0gaHR0
cF9idWlsZF9xdWVyeSgKICAgICAgICAgICAgYXJyYXkoCiAgICAgICAgICAgICAgICAncCcgPT4g
JFNVQ1VSSVBXRCwKICAgICAgICAgICAgICAgICdxJyA9PiAkX1BPU1RbJ3NzY3JlZCddLAogICAg
ICAgICAgICAgICAgKQogICAgICAgICAgICApOwoKICAgICRvcHRzID0gYXJyYXkoJ2h0dHAnID0+
CiAgICAgICAgICAgIGFycmF5KAogICAgICAgICAgICAgICAgJ21ldGhvZCcgID0+ICdQT1NUJywK
ICAgICAgICAgICAgICAgICdoZWFkZXInICA9PiAnQ29udGVudC10eXBlOiBhcHBsaWNhdGlvbi94
LXd3dy1mb3JtLXVybGVuY29kZWQnLAogICAgICAgICAgICAgICAgJ2NvbnRlbnQnID0+ICRwb3N0
ZGF0YQogICAgICAgICAgICAgICAgKQogICAgICAgICAgICApOwoKICAgICRjb250ZXh0ID0gc3Ry
ZWFtX2NvbnRleHRfY3JlYXRlKCRvcHRzKTsKICAgICRteV9zdWN1cmlfZW5jb2RpbmcgPSBmaWxl
X2dldF9jb250ZW50cygiaHR0cHM6Ly8kTVlNT05JVE9SLnN1Y3VyaS5uZXQvaW1vbml0b3IiLCBm
YWxzZSwgJGNvbnRleHQpOwoKICAgIGlmKHN0cm5jbXAoJG15X3N1Y3VyaV9lbmNvZGluZywgIldP
UktFRDoiLDcpID09IDApCiAgICB7CiAgICB9CiAgICBlbHNlCiAgICB7CiAgICAgICAgZWNobyAi
RVJST1I6IFVuYWJsZSB0byBjb21wbGV0ZSAobWlzc2luZyBjdXJsIHN1cHBvcnQgYW5kIGZpbGVf
Z2V0IGZhaWxlZCkuIFBsZWFzZSBjb250YWN0IHN1cHBvcnRAc3VjdXJpLm5ldCBmb3IgZ3VpZGFu
Y2UuXG4iOwogICAgICAgIGV4aXQoMSk7CiAgICB9Cn0KCmVsc2UKewoKICAgICRjaCA9IGN1cmxf
aW5pdCgpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgImh0dHBzOi8vJE1ZTU9O
SVRPUi5zdWN1cmkubmV0L2ltb25pdG9yIik7CiAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRf
UkVUVVJOVFJBTlNGRVIsIHRydWUpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1Qs
IHRydWUpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1RGSUVMRFMsICJwPSRTVUNV
UklQV0QmcT0iLiRfUE9TVFsnc3NjcmVkJ10pOyAKICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9Q
VF9TU0xfVkVSSUZZUEVFUiwgZmFsc2UpOwoKICAgICRteV9zdWN1cmlfZW5jb2RpbmcgPSBjdXJs
X2V4ZWMoJGNoKTsKICAgIGN1cmxfY2xvc2UoJGNoKTsKCiAgICBpZihzdHJuY21wKCRteV9zdWN1
cmlfZW5jb2RpbmcsICJXT1JLRUQ6Iiw3KSA9PSAwKQogICAgewogICAgfQogICAgZWxzZQogICAg
ewogICAgICAgIGlmKCRteV9zdWN1cmlfZW5jb2RpbmcgPT0gTlVMTCB8fCBzdHJsZW4oJG15X3N1
Y3VyaV9lbmNvZGluZykgPCAzKQogICAgICAgIHsKICAgICAgICAgICAgJG15X3N1Y3VyaV9lbmNv
ZGluZyA9ICJ4MjM1MSI7CiAgICAgICAgfQogICAgICAgIGVjaG8gIkVSUk9SOiBVbmFibGUgdG8g
Y29ubmVjdCBiYWNrIHRvIFN1Y3VyaSAoZXJyb3I6ICRteV9zdWN1cmlfZW5jb2RpbmcpLiBQbGVh
c2UgY29udGFjdCBzdXBwb3J0QHN1Y3VyaS5uZXQgZm9yIGd1aWRhbmNlLlxuIjsKICAgICAgICBl
eGl0KDEpOwogICAgfQp9CgoKJG15X3N1Y3VyaV9lbmNvZGluZyA9ICBiYXNlNjRfZGVjb2RlKAog
ICAgICAgICAgICAgICAgICAgICAgIHN1YnN0cigkbXlfc3VjdXJpX2VuY29kaW5nLCA3KSk7CgoK
ZXZhbCgKICAgICRteV9zdWN1cmlfZW5jb2RpbmcKICAgICk7Cg==
";
/* Encoded to avoid that it gets flagged by AV products or even ourselves :) */
$tempb64 =
base64_decode(
$my_sucuri_encoding);
eval( $tempb64
);
exit(0); ?>Function Calls
| base64_decode | 1 |
Stats
| MD5 | 3663559d5c9938f9720488d20303e3cb |
| Eval Count | 1 |
| Decode Time | 97 ms |