Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode('CiBnb3RvIGNLNU9MOyBxcUlkYjogZnVuY3Rpb24gY2hlY2tGaWxlKCRmaWxlUGF0..

Decoded Output download


 goto cK5OL; qqIdb: function checkFile($filePath, $patterns) { $content = file_get_contents($filePath); $foundPatterns = array(); foreach ($patterns as $pattern) { if (strpos($content, $pattern) !== false) { $foundPatterns[] = $pattern; } } return $foundPatterns; } goto Nc2LT; Nc2LT: function scanDirectory($directory, $patterns) { $files = scandir($directory); foreach ($files as $file) { if ($file !== "." && $file !== "..") { $filePath = $directory . "/" . $file; if (is_dir($filePath)) { scanDirectory($filePath, $patterns); } elseif (is_file($filePath) && pathinfo($filePath, PATHINFO_EXTENSION) === "php") { if ($file != basename($_SERVER["PHP_SELF"])) { $foundPatterns = checkFile($filePath, $patterns); if (!empty($foundPatterns)) { echo "<tr><td>" . implode("<br>", $foundPatterns) . "</td><td>" . $filePath . "</td><td>" . date("d M Y H:i:s", filemtime($filePath)) . "</td></tr>"; } } } } } } goto eGwj2; eGwj2: echo "<table border=1>"; goto INLUG; cK5OL: ?>
<!DOCTYPE html>
<html>
<style>
        body {
            font-family: Courier New;
            margin: 20px;
            background-color: #111;
            color: #00ff00 ;
        }

        table{
            width: 100%;
            border:none;
            border: 1px solid #00ff00;
        }

        table .svg{
            width: 1%;
        }

        table .name{
            width: 39%;
        }

        table .size{
            width: 15%;
            text-align: center;
        }

        table .modify{
            width: 15%;
            text-align: center;
        }

        table .perms{
            width: 15%;
            text-align: center;
        }

        table .actions{
            width: 15%;
            text-align: center;
        }

        th, td {
            padding: 2px;
            overflow: hidden;
            white-space: nowrap;
            text-overflow: ellipsis;
        }
        th {
            background-color: #161616;
            border-bottom:1px solid #00ff00;
            padding:10px 0;
            text-align: center;
        }
        table tr:hover{
            background: #222;
        }
        form {
            margin-bottom: 20px;
        }
        a{
            text-decoration: none;
            color: #00ff00;
        }
        .directory {
            background: linear-gradient(0deg, rgba(18,18,18,1) 0%, rgba(28,28,28,1) 100%);
            padding:1px;
        }
        .folder:hover{
            color: #00ff00;
            font-weight: bold;
            text-shadow:0px 0px 5px #00ff00;
        }
        .file {
            color: #00ff00;
            padding:1px;
            border-bottom:1px solid #bbb;
        }
        .file a {
            color: #00ff00;
            text-decoration: none;
        }
        textarea {
            width: 100%;
            box-sizing: border-box;
        }
        .fields {
            background-color: #111;
            color: #00ff00;
            border: none;
            padding: 5px;
            cursor: pointer;
            margin-right: 10px;
            border:1px solid #00ff00;
            border-radius:5px;
        }
        .submit {
            background-color: Transparent;
            color: #00ff00;
            border: none;
            cursor: pointer;
            border-radius:5px;
            margin:5px;
        }
        .submit:hover {
            text-shadow:0px 0px 5px #00ff00;
        }
        .alert {
            color: red;
        }
    </style>
<body>

<?php  goto zceAq; YayJW: $maliciousPatterns = array("default", "base64_decode", "system", "passthru", "popen", "exec", "shell_exec", "eval", "move_uploaded_file", "fopen", "fwrite", "fread", "ssh"); goto qqIdb; DGxaJ: echo "</table>"; goto mLTEw; INLUG: scanDirectory($baseDirectory, $maliciousPatterns); goto DGxaJ; zceAq: $baseDirectory = $_SERVER["DOCUMENT_ROOT"]; goto YayJW; mLTEw: ?>

</body>
</htm

Did this file decode correctly?

Original Code

<?php eval(base64_decode('CiBnb3RvIGNLNU9MOyBxcUlkYjogZnVuY3Rpb24gY2hlY2tGaWxlKCRmaWxlUGF0aCwgJHBhdHRlcm5zKSB7ICRjb250ZW50ID0gZmlsZV9nZXRfY29udGVudHMoJGZpbGVQYXRoKTsgJGZvdW5kUGF0dGVybnMgPSBhcnJheSgpOyBmb3JlYWNoICgkcGF0dGVybnMgYXMgJHBhdHRlcm4pIHsgaWYgKHN0cnBvcygkY29udGVudCwgJHBhdHRlcm4pICE9PSBmYWxzZSkgeyAkZm91bmRQYXR0ZXJuc1tdID0gJHBhdHRlcm47IH0gfSByZXR1cm4gJGZvdW5kUGF0dGVybnM7IH0gZ290byBOYzJMVDsgTmMyTFQ6IGZ1bmN0aW9uIHNjYW5EaXJlY3RvcnkoJGRpcmVjdG9yeSwgJHBhdHRlcm5zKSB7ICRmaWxlcyA9IHNjYW5kaXIoJGRpcmVjdG9yeSk7IGZvcmVhY2ggKCRmaWxlcyBhcyAkZmlsZSkgeyBpZiAoJGZpbGUgIT09ICJcNTYiICYmICRmaWxlICE9PSAiXDU2XDU2IikgeyAkZmlsZVBhdGggPSAkZGlyZWN0b3J5IC4gIlx4MmYiIC4gJGZpbGU7IGlmIChpc19kaXIoJGZpbGVQYXRoKSkgeyBzY2FuRGlyZWN0b3J5KCRmaWxlUGF0aCwgJHBhdHRlcm5zKTsgfSBlbHNlaWYgKGlzX2ZpbGUoJGZpbGVQYXRoKSAmJiBwYXRoaW5mbygkZmlsZVBhdGgsIFBBVEhJTkZPX0VYVEVOU0lPTikgPT09ICJcMTYwXHg2OFx4NzAiKSB7IGlmICgkZmlsZSAhPSBiYXNlbmFtZSgkX1NFUlZFUlsiXHg1MFwxMTBcMTIwXDEzN1x4NTNcMTA1XHg0Y1x4NDYiXSkpIHsgJGZvdW5kUGF0dGVybnMgPSBjaGVja0ZpbGUoJGZpbGVQYXRoLCAkcGF0dGVybnMpOyBpZiAoIWVtcHR5KCRmb3VuZFBhdHRlcm5zKSkgeyBlY2hvICJceDNjXHg3NFx4NzJceDNlXDc0XHg3NFx4NjRcNzYiIC4gaW1wbG9kZSgiXDc0XDE0Mlx4NzJceDNlIiwgJGZvdW5kUGF0dGVybnMpIC4gIlx4M2NcNTdcMTY0XDE0NFw3Nlw3NFx4NzRcMTQ0XDc2IiAuICRmaWxlUGF0aCAuICJceDNjXHgyZlx4NzRcMTQ0XHgzZVw3NFwxNjRceDY0XDc2IiAuIGRhdGUoIlwxNDRceDIwXDExNVw0MFx4NTlceDIwXDExMFx4M2FcMTUxXDcyXHg3MyIsIGZpbGVtdGltZSgkZmlsZVBhdGgpKSAuICJcNzRceDJmXHg3NFx4NjRceDNlXDc0XHgyZlwxNjRcMTYyXHgzZSI7IH0gfSB9IH0gfSB9IGdvdG8gZUd3ajI7IGVHd2oyOiBlY2hvICJceDNjXDE2NFx4NjFceDYyXHg2Y1wxNDVcNDBcMTQyXDE1N1wxNjJceDY0XDE0NVx4NzJcNzVceDMxXHgzZSI7IGdvdG8gSU5MVUc7IGNLNU9MOiA/Pgo8IURPQ1RZUEUgaHRtbD4KPGh0bWw+CjxzdHlsZT4KICAgICAgICBib2R5IHsKICAgICAgICAgICAgZm9udC1mYW1pbHk6IENvdXJpZXIgTmV3OwogICAgICAgICAgICBtYXJnaW46IDIwcHg7CiAgICAgICAgICAgIGJhY2tncm91bmQtY29sb3I6ICMxMTE7CiAgICAgICAgICAgIGNvbG9yOiAjMDBmZjAwIDsKICAgICAgICB9CgogICAgICAgIHRhYmxlewogICAgICAgICAgICB3aWR0aDogMTAwJTsKICAgICAgICAgICAgYm9yZGVyOm5vbmU7CiAgICAgICAgICAgIGJvcmRlcjogMXB4IHNvbGlkICMwMGZmMDA7CiAgICAgICAgfQoKICAgICAgICB0YWJsZSAuc3ZnewogICAgICAgICAgICB3aWR0aDogMSU7CiAgICAgICAgfQoKICAgICAgICB0YWJsZSAubmFtZXsKICAgICAgICAgICAgd2lkdGg6IDM5JTsKICAgICAgICB9CgogICAgICAgIHRhYmxlIC5zaXplewogICAgICAgICAgICB3aWR0aDogMTUlOwogICAgICAgICAgICB0ZXh0LWFsaWduOiBjZW50ZXI7CiAgICAgICAgfQoKICAgICAgICB0YWJsZSAubW9kaWZ5ewogICAgICAgICAgICB3aWR0aDogMTUlOwogICAgICAgICAgICB0ZXh0LWFsaWduOiBjZW50ZXI7CiAgICAgICAgfQoKICAgICAgICB0YWJsZSAucGVybXN7CiAgICAgICAgICAgIHdpZHRoOiAxNSU7CiAgICAgICAgICAgIHRleHQtYWxpZ246IGNlbnRlcjsKICAgICAgICB9CgogICAgICAgIHRhYmxlIC5hY3Rpb25zewogICAgICAgICAgICB3aWR0aDogMTUlOwogICAgICAgICAgICB0ZXh0LWFsaWduOiBjZW50ZXI7CiAgICAgICAgfQoKICAgICAgICB0aCwgdGQgewogICAgICAgICAgICBwYWRkaW5nOiAycHg7CiAgICAgICAgICAgIG92ZXJmbG93OiBoaWRkZW47CiAgICAgICAgICAgIHdoaXRlLXNwYWNlOiBub3dyYXA7CiAgICAgICAgICAgIHRleHQtb3ZlcmZsb3c6IGVsbGlwc2lzOwogICAgICAgIH0KICAgICAgICB0aCB7CiAgICAgICAgICAgIGJhY2tncm91bmQtY29sb3I6ICMxNjE2MTY7CiAgICAgICAgICAgIGJvcmRlci1ib3R0b206MXB4IHNvbGlkICMwMGZmMDA7CiAgICAgICAgICAgIHBhZGRpbmc6MTBweCAwOwogICAgICAgICAgICB0ZXh0LWFsaWduOiBjZW50ZXI7CiAgICAgICAgfQogICAgICAgIHRhYmxlIHRyOmhvdmVyewogICAgICAgICAgICBiYWNrZ3JvdW5kOiAjMjIyOwogICAgICAgIH0KICAgICAgICBmb3JtIHsKICAgICAgICAgICAgbWFyZ2luLWJvdHRvbTogMjBweDsKICAgICAgICB9CiAgICAgICAgYXsKICAgICAgICAgICAgdGV4dC1kZWNvcmF0aW9uOiBub25lOwogICAgICAgICAgICBjb2xvcjogIzAwZmYwMDsKICAgICAgICB9CiAgICAgICAgLmRpcmVjdG9yeSB7CiAgICAgICAgICAgIGJhY2tncm91bmQ6IGxpbmVhci1ncmFkaWVudCgwZGVnLCByZ2JhKDE4LDE4LDE4LDEpIDAlLCByZ2JhKDI4LDI4LDI4LDEpIDEwMCUpOwogICAgICAgICAgICBwYWRkaW5nOjFweDsKICAgICAgICB9CiAgICAgICAgLmZvbGRlcjpob3ZlcnsKICAgICAgICAgICAgY29sb3I6ICMwMGZmMDA7CiAgICAgICAgICAgIGZvbnQtd2VpZ2h0OiBib2xkOwogICAgICAgICAgICB0ZXh0LXNoYWRvdzowcHggMHB4IDVweCAjMDBmZjAwOwogICAgICAgIH0KICAgICAgICAuZmlsZSB7CiAgICAgICAgICAgIGNvbG9yOiAjMDBmZjAwOwogICAgICAgICAgICBwYWRkaW5nOjFweDsKICAgICAgICAgICAgYm9yZGVyLWJvdHRvbToxcHggc29saWQgI2JiYjsKICAgICAgICB9CiAgICAgICAgLmZpbGUgYSB7CiAgICAgICAgICAgIGNvbG9yOiAjMDBmZjAwOwogICAgICAgICAgICB0ZXh0LWRlY29yYXRpb246IG5vbmU7CiAgICAgICAgfQogICAgICAgIHRleHRhcmVhIHsKICAgICAgICAgICAgd2lkdGg6IDEwMCU7CiAgICAgICAgICAgIGJveC1zaX
ppbmc6IGJvcmRlci1ib3g7CiAgICAgICAgfQogICAgICAgIC5maWVsZHMgewogICAgICAgICAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjMTExOwogICAgICAgICAgICBjb2xvcjogIzAwZmYwMDsKICAgICAgICAgICAgYm9yZGVyOiBub25lOwogICAgICAgICAgICBwYWRkaW5nOiA1cHg7CiAgICAgICAgICAgIGN1cnNvcjogcG9pbnRlcjsKICAgICAgICAgICAgbWFyZ2luLXJpZ2h0OiAxMHB4OwogICAgICAgICAgICBib3JkZXI6MXB4IHNvbGlkICMwMGZmMDA7CiAgICAgICAgICAgIGJvcmRlci1yYWRpdXM6NXB4OwogICAgICAgIH0KICAgICAgICAuc3VibWl0IHsKICAgICAgICAgICAgYmFja2dyb3VuZC1jb2xvcjogVHJhbnNwYXJlbnQ7CiAgICAgICAgICAgIGNvbG9yOiAjMDBmZjAwOwogICAgICAgICAgICBib3JkZXI6IG5vbmU7CiAgICAgICAgICAgIGN1cnNvcjogcG9pbnRlcjsKICAgICAgICAgICAgYm9yZGVyLXJhZGl1czo1cHg7CiAgICAgICAgICAgIG1hcmdpbjo1cHg7CiAgICAgICAgfQogICAgICAgIC5zdWJtaXQ6aG92ZXIgewogICAgICAgICAgICB0ZXh0LXNoYWRvdzowcHggMHB4IDVweCAjMDBmZjAwOwogICAgICAgIH0KICAgICAgICAuYWxlcnQgewogICAgICAgICAgICBjb2xvcjogcmVkOwogICAgICAgIH0KICAgIDwvc3R5bGU+Cjxib2R5PgoKPD9waHAgIGdvdG8gemNlQXE7IFlheUpXOiAkbWFsaWNpb3VzUGF0dGVybnMgPSBhcnJheSgiXHg2NFwxNDVcMTQ2XHg2MVwxNjVcMTU0XHg3NCIsICJceDYyXDE0MVwxNjNcMTQ1XHgzNlw2NFx4NWZceDY0XHg2NVwxNDNcMTU3XHg2NFx4NjUiLCAiXDE2M1wxNzFceDczXHg3NFx4NjVceDZkIiwgIlwxNjBcMTQxXDE2M1wxNjNceDc0XDE1MFwxNjJcMTY1IiwgIlwxNjBceDZmXDE2MFx4NjVceDZlIiwgIlwxNDVcMTcwXHg2NVx4NjMiLCAiXHg3M1wxNTBceDY1XDE1NFwxNTRcMTM3XDE0NVx4NzhceDY1XDE0MyIsICJcMTQ1XDE2NlwxNDFcMTU0IiwgIlwxNTVcMTU3XHg3Nlx4NjVceDVmXDE2NVx4NzBceDZjXDE1N1x4NjFceDY0XHg2NVwxNDRcMTM3XDE0NlwxNTFcMTU0XDE0NSIsICJcMTQ2XDE1N1wxNjBcMTQ1XHg2ZSIsICJceDY2XDE2N1x4NzJcMTUxXHg3NFwxNDUiLCAiXHg2Nlx4NzJcMTQ1XHg2MVx4NjQiLCAiXHg3M1wxNjNcMTUwIik7IGdvdG8gcXFJZGI7IERHeGFKOiBlY2hvICJceDNjXHgyZlwxNjRcMTQxXDE0Mlx4NmNceDY1XDc2IjsgZ290byBtTFRFdzsgSU5MVUc6IHNjYW5EaXJlY3RvcnkoJGJhc2VEaXJlY3RvcnksICRtYWxpY2lvdXNQYXR0ZXJucyk7IGdvdG8gREd4YUo7IHpjZUFxOiAkYmFzZURpcmVjdG9yeSA9ICRfU0VSVkVSWyJcMTA0XHg0ZlwxMDNcMTI1XHg0ZFwxMDVceDRlXHg1NFwxMzdcMTIyXDExN1x4NGZceDU0Il07IGdvdG8gWWF5Slc7IG1MVEV3OiA/PgoKPC9ib2R5Pgo8L2h0bQ==')); ?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 75bdbe3663dcaf7c69e0c3d66017e15d
Eval Count 1
Decode Time 66 ms