Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php /* Sucuri integrity monitor * Integrity checking and server side scanning. * ..
Decoded Output download
/* Sucuri integrity monitor .
* Connects back home.
* Copyright (C) 2010-2013 Sucuri, LLC
* Do not distribute or share.
*/
$SUCURIPWD = "535e26eb0f3324e8056fe6954976b04c62eb977f2cc51";
if(isset($_GET['test']))
{
echo "OK: Sucuri: Found
";
exit(0);
}
/* Valid argument. */
if(!isset($_GET['run']))
{
exit(0);
}
/* Must have an IP address. */
if(!isset($_SERVER['REMOTE_ADDR']))
{
exit(0);
}
$origremoteip = $_SERVER['REMOTE_ADDR'];
/* If coming from cloudflare: */
if(isset($_SERVER['HTTP_CF_CONNECTING_IP']) && $_SERVER['REMOTE_ADDR'] !== $_SERVER['HTTP_CF_CONNECTING_IP'])
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
/* CloudProxy headers. */
else if(isset($_SERVER['HTTP_X_SUCURI_CLIENTIP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_SUCURI_CLIENTIP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_ORIG_CLIENT_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_ORIG_CLIENT_IP'];
}
else if(isset($_SERVER['HTTP_CLIENT_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_TRUE_CLIENT_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_TRUE_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_X_REAL_IP']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_REAL_IP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
$myiplist = array(
'69.164.211.37',
'72.14.187.58',
'69.164.196.53',
'50.116.47.181',
'66.228.34.49',
'66.228.40.185',
'50.116.36.92',
'50.116.36.93',
'50.116.3.171',
'198.58.96.212',
'50.116.63.221',
'192.155.92.112',
'192.81.128.31',
'198.58.106.244',
'192.155.95.139',
'23.239.9.227',
'198.58.112.103',
'192.155.94.43',
'162.216.16.33',
'104.237.143.242',
'104.237.139.227',
'45.33.76.17',
'45.79.210.57',
'173.230.133.164',
'69.164.219.45',
'45.79.207.127',
'96.126.117.20',
'104.237.138.168',
'45.33.99.88',
'66.228.45.197',
'2600:3c00::f03c:91ff:feae:e104',
'2600:3c00::f03c:91ff:fe84:e275',
'2600:3c03::f03c:91ff:fee4:c9f0',
'2600:3c02::f03c:91ff:fee4:c998',
'2600:3c00::f03c:91ff:fe84:e218',
'2600:3c02::f03c:91ff:fedf:58c6',
'2600:3c02::f03c:91ff:fedf:5835',
'2600:3c03::f03c:91ff:fedf:6a7a',
'2600:3c03::f03c:91ff:fe70:36ce',
'2600:3c02::f03c:91ff:fe70:f12d',
'2600:3c01::f03c:91ff:fe70:52bb',
"2600:3c02::f03c:91ff:fe69:4b66",
"2600:3c00::f03c:91ff:fe70:5213",
"2600:3c03::f03c:91ff:fedb:b9ce",
"2600:3c00::f03c:91ff:fe6e:a046",
"2600:3c02::f03c:91ff:fe6e:a0dd",
"2600:3c03::f03c:91ff:fe6e:a0ac",
"2600:3c02::f03c:91ff:fe9b:ccac",
"2600:3c03::f03c:91ff:fe59:f1f",
"2600:3c02::f03c:91ff:fe59:fbb",
"2600:3c03::f03c:91ff:fe59:f51",
"2600:3c00::f03c:91ff:fe59:f84",
'2600:3c00::f03c:91ff:fe1f:75cb',
'2600:3c00::f03c:91ff:fe1f:757c',
'2600:3c02::f03c:91ff:fe1f:753c',
'fe80::fcfd:adff:fee6:8087',
'2600:3c02::f03c:91ff:fee9:64fa',
'2600:3c03::f03c:91ff:fee9:6417',
);
$ipmatches = 0;
foreach($myiplist as $myip)
{
if(strpos($_SERVER['REMOTE_ADDR'], $myip) !== FALSE)
{
$ipmatches = 1;
break;
}
if(strpos($origremoteip, $myip) !== FALSE)
{
$ipmatches = 1;
break;
}
}
if($ipmatches == 0)
{
echo "ERROR: Invalid IP Address
";
exit(0);
}
/* Valid key. */
if(!isset($_POST['sscred']))
{
echo "ERROR: Invalid argument
";
exit(0);
}
/* Connect back to get what to run. */
if(!function_exists('curl_exec') || isset($_GET['nocurl']))
{
$postdata = http_build_query(
array(
'p' => $SUCURIPWD,
'q' => $_POST['sscred'],
)
);
$opts = array('http' =>
array(
'method' => 'POST',
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => $postdata
)
);
$context = stream_context_create($opts);
$my_sucuri_encoding = file_get_contents("https://$MYMONITOR.sucuri.net/imonitor", false, $context);
if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
{
}
else
{
echo "ERROR: Unable to complete (missing curl support and file_get failed). Please contact [email protected] for guidance.
";
exit(1);
}
}
else
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://$MYMONITOR.sucuri.net/imonitor");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, "p=$SUCURIPWD&q=".$_POST['sscred']);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$my_sucuri_encoding = curl_exec($ch);
curl_close($ch);
if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
{
}
else
{
if($my_sucuri_encoding == NULL || strlen($my_sucuri_encoding) < 3)
{
$my_sucuri_encoding = "x2351";
}
echo "ERROR: Unable to connect back to Sucuri (error: $my_sucuri_encoding). Please contact [email protected] for guidance.
";
exit(1);
}
}
$my_sucuri_encoding = base64_decode(
substr($my_sucuri_encoding, 7));
eval(
$my_sucuri_encoding
);
Did this file decode correctly?
Original Code
<?php
/* Sucuri integrity monitor
* Integrity checking and server side scanning.
*
* Copyright (C) 2010, 2011, 2012 Sucuri, LLC
* http://sucuri.net
* Do not distribute or share.
*/
$MYMONITOR = "monitor21";
$my_sucuri_encoding = "
LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5lY3RzIGJhY2sgaG9tZS4KICog
Q29weXJpZ2h0IChDKSAyMDEwLTIwMTMgU3VjdXJpLCBMTEMKICogRG8gbm90IGRpc3RyaWJ1dGUg
b3Igc2hhcmUuCiAqLwoKCiRTVUNVUklQV0QgPSAiNTM1ZTI2ZWIwZjMzMjRlODA1NmZlNjk1NDk3
NmIwNGM2MmViOTc3ZjJjYzUxIjsKCgppZihpc3NldCgkX0dFVFsndGVzdCddKSkKewogICAgZWNo
byAiT0s6IFN1Y3VyaTogRm91bmRcbiI7CiAgICBleGl0KDApOwp9CgoKCi8qIFZhbGlkIGFyZ3Vt
ZW50LiAqLwppZighaXNzZXQoJF9HRVRbJ3J1biddKSkKewogICAgZXhpdCgwKTsKfQoKCi8qIE11
c3QgaGF2ZSBhbiBJUCBhZGRyZXNzLiAqLwppZighaXNzZXQoJF9TRVJWRVJbJ1JFTU9URV9BRERS
J10pKQp7CiAgICBleGl0KDApOwp9Cgokb3JpZ3JlbW90ZWlwID0gJF9TRVJWRVJbJ1JFTU9URV9B
RERSJ107CgovKiBJZiBjb21pbmcgZnJvbSBjbG91ZGZsYXJlOiAqLwppZihpc3NldCgkX1NFUlZF
UlsnSFRUUF9DRl9DT05ORUNUSU5HX0lQJ10pICYmICRfU0VSVkVSWydSRU1PVEVfQUREUiddICE9
PSAkX1NFUlZFUlsnSFRUUF9DRl9DT05ORUNUSU5HX0lQJ10pCnsKICAgICRfU0VSVkVSWydSRU1P
VEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfQ0ZfQ09OTkVDVElOR19JUCddOwp9Ci8qIENsb3Vk
UHJveHkgaGVhZGVycy4gKi8KZWxzZSBpZihpc3NldCgkX1NFUlZFUlsnSFRUUF9YX1NVQ1VSSV9D
TElFTlRJUCddKSkKewogICAgJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRU
UF9YX1NVQ1VSSV9DTElFTlRJUCddOwp9Ci8qIE1vcmUgZ2F0ZXdheSByZXF1ZXN0cy4gKi8KZWxz
ZSBpZihpc3NldCgkX1NFUlZFUlsnSFRUUF9YX09SSUdfQ0xJRU5UX0lQJ10pKQp7CiAgICAkX1NF
UlZFUlsnUkVNT1RFX0FERFInXSA9ICRfU0VSVkVSWydIVFRQX1hfT1JJR19DTElFTlRfSVAnXTsK
fQplbHNlIGlmKGlzc2V0KCRfU0VSVkVSWydIVFRQX0NMSUVOVF9JUCddKSkKewogICAgJF9TRVJW
RVJbJ1JFTU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9DTElFTlRfSVAnXTsKfQovKiBQcm94
eSByZXF1ZXN0cy4gKi8KZWxzZSBpZihpc3NldCgkX1NFUlZFUlsnSFRUUF9UUlVFX0NMSUVOVF9J
UCddKSkKewogICAgJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9UUlVF
X0NMSUVOVF9JUCddOwp9Ci8qIFByb3h5IHJlcXVlc3RzLiAqLwplbHNlIGlmKGlzc2V0KCRfU0VS
VkVSWydIVFRQX1hfUkVBTF9JUCddKSkKewogICAgJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10gPSAk
X1NFUlZFUlsnSFRUUF9YX1JFQUxfSVAnXTsKfQovKiBNb3JlIGdhdGV3YXkgcmVxdWVzdHMuICov
CmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfWF9GT1JXQVJERURfRk9SJ10pKQp7CiAgICAk
X1NFUlZFUlsnUkVNT1RFX0FERFInXSA9ICRfU0VSVkVSWydIVFRQX1hfRk9SV0FSREVEX0ZPUidd
Owp9CgoKJG15aXBsaXN0ID0gYXJyYXkoCic2OS4xNjQuMjExLjM3JywKJzcyLjE0LjE4Ny41OCcs
Cic2OS4xNjQuMTk2LjUzJywKJzUwLjExNi40Ny4xODEnLAonNjYuMjI4LjM0LjQ5JywKJzY2LjIy
OC40MC4xODUnLAonNTAuMTE2LjM2LjkyJywKJzUwLjExNi4zNi45MycsCic1MC4xMTYuMy4xNzEn
LAonMTk4LjU4Ljk2LjIxMicsCic1MC4xMTYuNjMuMjIxJywKJzE5Mi4xNTUuOTIuMTEyJywKJzE5
Mi44MS4xMjguMzEnLAonMTk4LjU4LjEwNi4yNDQnLAonMTkyLjE1NS45NS4xMzknLAonMjMuMjM5
LjkuMjI3JywKJzE5OC41OC4xMTIuMTAzJywKJzE5Mi4xNTUuOTQuNDMnLAonMTYyLjIxNi4xNi4z
MycsCicxMDQuMjM3LjE0My4yNDInLAonMTA0LjIzNy4xMzkuMjI3JywKJzQ1LjMzLjc2LjE3JywK
JzQ1Ljc5LjIxMC41NycsCicxNzMuMjMwLjEzMy4xNjQnLAonNjkuMTY0LjIxOS40NScsCic0NS43
OS4yMDcuMTI3JywKJzk2LjEyNi4xMTcuMjAnLAonMTA0LjIzNy4xMzguMTY4JywKJzQ1LjMzLjk5
Ljg4JywKJzY2LjIyOC40NS4xOTcnLAoKJzI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZlYWU6ZTEwNCcs
CicyNjAwOjNjMDA6OmYwM2M6OTFmZjpmZTg0OmUyNzUnLAonMjYwMDozYzAzOjpmMDNjOjkxZmY6
ZmVlNDpjOWYwJywKJzI2MDA6M2MwMjo6ZjAzYzo5MWZmOmZlZTQ6Yzk5OCcsCicyNjAwOjNjMDA6
OmYwM2M6OTFmZjpmZTg0OmUyMTgnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmVkZjo1OGM2JywK
JzI2MDA6M2MwMjo6ZjAzYzo5MWZmOmZlZGY6NTgzNScsCicyNjAwOjNjMDM6OmYwM2M6OTFmZjpm
ZWRmOjZhN2EnLAonMjYwMDozYzAzOjpmMDNjOjkxZmY6ZmU3MDozNmNlJywKJzI2MDA6M2MwMjo6
ZjAzYzo5MWZmOmZlNzA6ZjEyZCcsCicyNjAwOjNjMDE6OmYwM2M6OTFmZjpmZTcwOjUyYmInLAoi
MjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU2OTo0YjY2IiwKIjI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZl
NzA6NTIxMyIsCiIyNjAwOjNjMDM6OmYwM2M6OTFmZjpmZWRiOmI5Y2UiLAoiMjYwMDozYzAwOjpm
MDNjOjkxZmY6ZmU2ZTphMDQ2IiwKIjI2MDA6M2MwMjo6ZjAzYzo5MWZmOmZlNmU6YTBkZCIsCiIy
NjAwOjNjMDM6OmYwM2M6OTFmZjpmZTZlOmEwYWMiLAoiMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU5
YjpjY2FjIiwKIjI2MDA6M2MwMzo6ZjAzYzo5MWZmOmZlNTk6ZjFmIiwKIjI2MDA6M2MwMjo6ZjAz
Yzo5MWZmOmZlNTk6ZmJiIiwgCiIyNjAwOjNjMDM6OmYwM2M6OTFmZjpmZTU5OmY1MSIsCiIyNjAw
OjNjMDA6OmYwM2M6OTFmZjpmZTU5OmY4NCIsIAonMjYwMDozYzAwOjpmMDNjOjkxZmY6ZmUxZjo3
NWNiJywKJzI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZlMWY6NzU3YycsCicyNjAwOjNjMDI6OmYwM2M6
OTFmZjpmZTFmOjc1M2MnLAonZmU4MDo6ZmNmZDphZGZmOmZlZTY6ODA4NycsCicyNjAwOjNjMDI6
OmYwM2M6OTFmZjpmZWU5OjY0ZmEnLAonMjYwMDozYzAzOjpmMDNjOjkxZmY6ZmVlOTo2NDE3JywK
KTsKCgokaXBtYXRjaGVzID0gMDsKCmZvcmVhY2goJG15aXBsaXN0IGFzICRteWlwKQp7CiAgICBp
ZihzdHJwb3MoJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10sICRteWlwKSAhPT0gRkFMU0UpCiAgICB7
CiAgICAgICAgJGlwbWF0Y2hlcyA9IDE7CiAgICAgICAgYnJlYWs7CiAgICB9CiAgICBpZihzdHJw
b3MoJG9yaWdyZW1vdGVpcCwgJG15aXApICE9PSBGQUxTRSkKICAgIHsKICAgICAgICAkaXBtYXRj
aGVzID0gMTsKICAgICAgICBicmVhazsKICAgIH0KfQoKCmlmKCRpcG1hdGNoZXMgPT0gMCkKewog
ICAgZWNobyAiRVJST1I6IEludmFsaWQgSVAgQWRkcmVzc1xuIjsKICAgIGV4aXQoMCk7Cn0KCgov
KiBWYWxpZCBrZXkuICovCmlmKCFpc3NldCgkX1BPU1RbJ3NzY3JlZCddKSkKewogICAgZWNobyAi
RVJST1I6IEludmFsaWQgYXJndW1lbnRcbiI7CiAgICBleGl0KDApOwp9CgoKLyogQ29ubmVjdCBi
YWNrIHRvIGdldCB3aGF0IHRvIHJ1bi4gKi8KaWYoIWZ1bmN0aW9uX2V4aXN0cygnY3VybF9leGVj
JykgfHwgaXNzZXQoJF9HRVRbJ25vY3VybCddKSkKewogICAgJHBvc3RkYXRhID0gaHR0cF9idWls
ZF9xdWVyeSgKICAgICAgICAgICAgYXJyYXkoCiAgICAgICAgICAgICAgICAncCcgPT4gJFNVQ1VS
SVBXRCwKICAgICAgICAgICAgICAgICdxJyA9PiAkX1BPU1RbJ3NzY3JlZCddLAogICAgICAgICAg
ICAgICAgKQogICAgICAgICAgICApOwoKICAgICRvcHRzID0gYXJyYXkoJ2h0dHAnID0+CiAgICAg
ICAgICAgIGFycmF5KAogICAgICAgICAgICAgICAgJ21ldGhvZCcgID0+ICdQT1NUJywKICAgICAg
ICAgICAgICAgICdoZWFkZXInICA9PiAnQ29udGVudC10eXBlOiBhcHBsaWNhdGlvbi94LXd3dy1m
b3JtLXVybGVuY29kZWQnLAogICAgICAgICAgICAgICAgJ2NvbnRlbnQnID0+ICRwb3N0ZGF0YQog
ICAgICAgICAgICAgICAgKQogICAgICAgICAgICApOwoKICAgICRjb250ZXh0ID0gc3RyZWFtX2Nv
bnRleHRfY3JlYXRlKCRvcHRzKTsKICAgICRteV9zdWN1cmlfZW5jb2RpbmcgPSBmaWxlX2dldF9j
b250ZW50cygiaHR0cHM6Ly8kTVlNT05JVE9SLnN1Y3VyaS5uZXQvaW1vbml0b3IiLCBmYWxzZSwg
JGNvbnRleHQpOwoKICAgIGlmKHN0cm5jbXAoJG15X3N1Y3VyaV9lbmNvZGluZywgIldPUktFRDoi
LDcpID09IDApCiAgICB7CiAgICB9CiAgICBlbHNlCiAgICB7CiAgICAgICAgZWNobyAiRVJST1I6
IFVuYWJsZSB0byBjb21wbGV0ZSAobWlzc2luZyBjdXJsIHN1cHBvcnQgYW5kIGZpbGVfZ2V0IGZh
aWxlZCkuIFBsZWFzZSBjb250YWN0IHN1cHBvcnRAc3VjdXJpLm5ldCBmb3IgZ3VpZGFuY2UuXG4i
OwogICAgICAgIGV4aXQoMSk7CiAgICB9Cn0KCmVsc2UKewoKICAgICRjaCA9IGN1cmxfaW5pdCgp
OwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgImh0dHBzOi8vJE1ZTU9OSVRPUi5z
dWN1cmkubmV0L2ltb25pdG9yIik7CiAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJO
VFJBTlNGRVIsIHRydWUpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1QsIHRydWUp
OwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1RGSUVMRFMsICJwPSRTVUNVUklQV0Qm
cT0iLiRfUE9TVFsnc3NjcmVkJ10pOyAKICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9TU0xf
VkVSSUZZUEVFUiwgZmFsc2UpOwoKICAgICRteV9zdWN1cmlfZW5jb2RpbmcgPSBjdXJsX2V4ZWMo
JGNoKTsKICAgIGN1cmxfY2xvc2UoJGNoKTsKCiAgICBpZihzdHJuY21wKCRteV9zdWN1cmlfZW5j
b2RpbmcsICJXT1JLRUQ6Iiw3KSA9PSAwKQogICAgewogICAgfQogICAgZWxzZQogICAgewogICAg
ICAgIGlmKCRteV9zdWN1cmlfZW5jb2RpbmcgPT0gTlVMTCB8fCBzdHJsZW4oJG15X3N1Y3VyaV9l
bmNvZGluZykgPCAzKQogICAgICAgIHsKICAgICAgICAgICAgJG15X3N1Y3VyaV9lbmNvZGluZyA9
ICJ4MjM1MSI7CiAgICAgICAgfQogICAgICAgIGVjaG8gIkVSUk9SOiBVbmFibGUgdG8gY29ubmVj
dCBiYWNrIHRvIFN1Y3VyaSAoZXJyb3I6ICRteV9zdWN1cmlfZW5jb2RpbmcpLiBQbGVhc2UgY29u
dGFjdCBzdXBwb3J0QHN1Y3VyaS5uZXQgZm9yIGd1aWRhbmNlLlxuIjsKICAgICAgICBleGl0KDEp
OwogICAgfQp9CgoKJG15X3N1Y3VyaV9lbmNvZGluZyA9ICBiYXNlNjRfZGVjb2RlKAogICAgICAg
ICAgICAgICAgICAgICAgIHN1YnN0cigkbXlfc3VjdXJpX2VuY29kaW5nLCA3KSk7CgoKZXZhbCgK
ICAgICRteV9zdWN1cmlfZW5jb2RpbmcKICAgICk7Cg==
";
/* Encoded to avoid that it gets flagged by AV products or even ourselves :) */
$tempb64 =
base64_decode(
$my_sucuri_encoding);
eval( $tempb64
);
exit(0); ?>
Function Calls
| base64_decode | 1 |
Stats
| MD5 | 7f7da78789fe1fb5bd4c896be979bb0e |
| Eval Count | 1 |
| Decode Time | 107 ms |