Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php /* Sucuri integrity monitor * Integrity checking and server side scanning. * ..

Decoded Output download

/* Sucuri integrity monitor . 
 * Connects back home.
 * Copyright (C) 2010-2013 Sucuri, LLC
 * Do not distribute or share.
 */


$SUCURIPWD = "535e26eb0f3324e8056fe6954976b04c62eb977f2cc51";


if(isset($_GET['test']))
{
    echo "OK: Sucuri: Found
";
    exit(0);
}



/* Valid argument. */
if(!isset($_GET['run']))
{
    exit(0);
}


/* Must have an IP address. */
if(!isset($_SERVER['REMOTE_ADDR']))
{
    exit(0);
}

$origremoteip = $_SERVER['REMOTE_ADDR'];

/* If coming from cloudflare: */
if(isset($_SERVER['HTTP_CF_CONNECTING_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
/* CloudProxy headers. */
else if(isset($_SERVER['HTTP_X_SUCURI_CLIENTIP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_SUCURI_CLIENTIP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_ORIG_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_ORIG_CLIENT_IP'];
}
else if(isset($_SERVER['HTTP_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_TRUE_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_TRUE_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_X_REAL_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_REAL_IP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}


$myiplist = array(
'97.74.127.171',
'69.164.203.172',
'173.230.128.135',
'66.228.34.49',
'66.228.40.185',
'50.116.3.171',
'50.116.36.92',
'198.58.96.212',
'50.116.63.221',
'192.155.92.112',
'192.81.128.31',
'198.58.106.244',
'2600:3c00::f03c:91ff:feae:e104',
'2600:3c02::f03c:91ff:fedf:58c6',
'2600:3c02::f03c:91ff:fedf:5835',
'2600:3c03::f03c:91ff:fedf:6a7a',
'fe80::fcfd:adff:fee6:8087',
'2600:3c03::f03c:91ff:fe70:36ce',
'2600:3c02::f03c:91ff:fe70:f12d',
'2600:3c01::f03c:91ff:fe70:52bb',
'50.116.36.93',
"192.155.95.139",
"2600:3c02::f03c:91ff:fe69:4b66",
"2600:3c00::f03c:91ff:fe70:5213",
"2600:3c03::f03c:91ff:fedb:b9ce",
"23.239.9.227",
"198.58.112.103",
"192.155.94.43",
"162.216.16.33",
"2600:3c00::f03c:91ff:fe6e:a046",
"2600:3c02::f03c:91ff:fe6e:a0dd",
"2600:3c03::f03c:91ff:fe6e:a0ac",
);


$ipmatches = 0;

foreach($myiplist as $myip)
{
    if(strpos($_SERVER['REMOTE_ADDR'], $myip) !== FALSE)
    {
        $ipmatches = 1;
        break;
    }
    if(strpos($origremoteip, $myip) !== FALSE)
    {
        $ipmatches = 1;
        break;
    }
}


if($ipmatches == 0)
{
    echo "ERROR: Invalid IP Address
";
    exit(0);
}


/* Valid key. */
if(!isset($_POST['sscred']))
{
    echo "ERROR: Invalid argument
";
    exit(0);
}


/* Connect back to get what to run. */
if(!function_exists('curl_exec') || isset($_GET['nocurl']))
{
    $postdata = http_build_query(
            array(
                'p' => $SUCURIPWD,
                'q' => $_POST['sscred'],
                )
            );

    $opts = array('http' =>
            array(
                'method'  => 'POST',
                'header'  => 'Content-type: application/x-www-form-urlencoded',
                'content' => $postdata
                )
            );

    $context = stream_context_create($opts);
    $my_sucuri_encoding = file_get_contents("https://$MYMONITOR.sucuri.net/imonitor", false, $context);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
    }
    else
    {
        echo "ERROR: Unable to complete (missing curl support and file_get failed). Please contact [email protected] for guidance.
";
        exit(1);
    }
}

else
{

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "https://$MYMONITOR.sucuri.net/imonitor");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "p=$SUCURIPWD&q=".$_POST['sscred']); 
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

    $my_sucuri_encoding = curl_exec($ch);
    curl_close($ch);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
    }
    else
    {
        if($my_sucuri_encoding == NULL || strlen($my_sucuri_encoding) < 3)
        {
            $my_sucuri_encoding = "x2351";
        }
        echo "ERROR: Unable to connect back to Sucuri (error: $my_sucuri_encoding). Please contact [email protected] for guidance.
";
        exit(1);
    }
}


$my_sucuri_encoding =  base64_decode(
                       substr($my_sucuri_encoding, 7));


eval(
    $my_sucuri_encoding
    );

Did this file decode correctly?

Original Code

<?php
/* Sucuri integrity monitor
 * Integrity checking and server side scanning.
 *
 * Copyright (C) 2010, 2011, 2012 Sucuri, LLC
 * http://sucuri.net
 * Do not distribute or share.
 */

$MYMONITOR = "monitor17";
$my_sucuri_encoding = "



LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5lY3RzIGJhY2sgaG9tZS4KICog
Q29weXJpZ2h0IChDKSAyMDEwLTIwMTMgU3VjdXJpLCBMTEMKICogRG8gbm90IGRpc3RyaWJ1dGUg
b3Igc2hhcmUuCiAqLwoKCiRTVUNVUklQV0QgPSAiNTM1ZTI2ZWIwZjMzMjRlODA1NmZlNjk1NDk3
NmIwNGM2MmViOTc3ZjJjYzUxIjsKCgppZihpc3NldCgkX0dFVFsndGVzdCddKSkKewogICAgZWNo
byAiT0s6IFN1Y3VyaTogRm91bmRcbiI7CiAgICBleGl0KDApOwp9CgoKCi8qIFZhbGlkIGFyZ3Vt
ZW50LiAqLwppZighaXNzZXQoJF9HRVRbJ3J1biddKSkKewogICAgZXhpdCgwKTsKfQoKCi8qIE11
c3QgaGF2ZSBhbiBJUCBhZGRyZXNzLiAqLwppZighaXNzZXQoJF9TRVJWRVJbJ1JFTU9URV9BRERS
J10pKQp7CiAgICBleGl0KDApOwp9Cgokb3JpZ3JlbW90ZWlwID0gJF9TRVJWRVJbJ1JFTU9URV9B
RERSJ107CgovKiBJZiBjb21pbmcgZnJvbSBjbG91ZGZsYXJlOiAqLwppZihpc3NldCgkX1NFUlZF
UlsnSFRUUF9DRl9DT05ORUNUSU5HX0lQJ10pKQp7CiAgICAkX1NFUlZFUlsnUkVNT1RFX0FERFIn
XSA9ICRfU0VSVkVSWydIVFRQX0NGX0NPTk5FQ1RJTkdfSVAnXTsKfQovKiBDbG91ZFByb3h5IGhl
YWRlcnMuICovCmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfWF9TVUNVUklfQ0xJRU5USVAn
XSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfWF9TVUNV
UklfQ0xJRU5USVAnXTsKfQovKiBNb3JlIGdhdGV3YXkgcmVxdWVzdHMuICovCmVsc2UgaWYoaXNz
ZXQoJF9TRVJWRVJbJ0hUVFBfWF9PUklHX0NMSUVOVF9JUCddKSkKewogICAgJF9TRVJWRVJbJ1JF
TU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9YX09SSUdfQ0xJRU5UX0lQJ107Cn0KZWxzZSBp
Zihpc3NldCgkX1NFUlZFUlsnSFRUUF9DTElFTlRfSVAnXSkpCnsKICAgICRfU0VSVkVSWydSRU1P
VEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfQ0xJRU5UX0lQJ107Cn0KLyogUHJveHkgcmVxdWVz
dHMuICovCmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfVFJVRV9DTElFTlRfSVAnXSkpCnsK
ICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfVFJVRV9DTElFTlRf
SVAnXTsKfQovKiBQcm94eSByZXF1ZXN0cy4gKi8KZWxzZSBpZihpc3NldCgkX1NFUlZFUlsnSFRU
UF9YX1JFQUxfSVAnXSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJb
J0hUVFBfWF9SRUFMX0lQJ107Cn0KLyogTW9yZSBnYXRld2F5IHJlcXVlc3RzLiAqLwplbHNlIGlm
KGlzc2V0KCRfU0VSVkVSWydIVFRQX1hfRk9SV0FSREVEX0ZPUiddKSkKewogICAgJF9TRVJWRVJb
J1JFTU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9YX0ZPUldBUkRFRF9GT1InXTsKfQoKCiRt
eWlwbGlzdCA9IGFycmF5KAonOTcuNzQuMTI3LjE3MScsCic2OS4xNjQuMjAzLjE3MicsCicxNzMu
MjMwLjEyOC4xMzUnLAonNjYuMjI4LjM0LjQ5JywKJzY2LjIyOC40MC4xODUnLAonNTAuMTE2LjMu
MTcxJywKJzUwLjExNi4zNi45MicsCicxOTguNTguOTYuMjEyJywKJzUwLjExNi42My4yMjEnLAon
MTkyLjE1NS45Mi4xMTInLAonMTkyLjgxLjEyOC4zMScsCicxOTguNTguMTA2LjI0NCcsCicyNjAw
OjNjMDA6OmYwM2M6OTFmZjpmZWFlOmUxMDQnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmVkZjo1
OGM2JywKJzI2MDA6M2MwMjo6ZjAzYzo5MWZmOmZlZGY6NTgzNScsCicyNjAwOjNjMDM6OmYwM2M6
OTFmZjpmZWRmOjZhN2EnLAonZmU4MDo6ZmNmZDphZGZmOmZlZTY6ODA4NycsCicyNjAwOjNjMDM6
OmYwM2M6OTFmZjpmZTcwOjM2Y2UnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU3MDpmMTJkJywK
JzI2MDA6M2MwMTo6ZjAzYzo5MWZmOmZlNzA6NTJiYicsCic1MC4xMTYuMzYuOTMnLAoiMTkyLjE1
NS45NS4xMzkiLAoiMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU2OTo0YjY2IiwKIjI2MDA6M2MwMDo6
ZjAzYzo5MWZmOmZlNzA6NTIxMyIsCiIyNjAwOjNjMDM6OmYwM2M6OTFmZjpmZWRiOmI5Y2UiLAoi
MjMuMjM5LjkuMjI3IiwKIjE5OC41OC4xMTIuMTAzIiwKIjE5Mi4xNTUuOTQuNDMiLAoiMTYyLjIx
Ni4xNi4zMyIsCiIyNjAwOjNjMDA6OmYwM2M6OTFmZjpmZTZlOmEwNDYiLAoiMjYwMDozYzAyOjpm
MDNjOjkxZmY6ZmU2ZTphMGRkIiwKIjI2MDA6M2MwMzo6ZjAzYzo5MWZmOmZlNmU6YTBhYyIsCik7
CgoKJGlwbWF0Y2hlcyA9IDA7Cgpmb3JlYWNoKCRteWlwbGlzdCBhcyAkbXlpcCkKewogICAgaWYo
c3RycG9zKCRfU0VSVkVSWydSRU1PVEVfQUREUiddLCAkbXlpcCkgIT09IEZBTFNFKQogICAgewog
ICAgICAgICRpcG1hdGNoZXMgPSAxOwogICAgICAgIGJyZWFrOwogICAgfQogICAgaWYoc3RycG9z
KCRvcmlncmVtb3RlaXAsICRteWlwKSAhPT0gRkFMU0UpCiAgICB7CiAgICAgICAgJGlwbWF0Y2hl
cyA9IDE7CiAgICAgICAgYnJlYWs7CiAgICB9Cn0KCgppZigkaXBtYXRjaGVzID09IDApCnsKICAg
IGVjaG8gIkVSUk9SOiBJbnZhbGlkIElQIEFkZHJlc3NcbiI7CiAgICBleGl0KDApOwp9CgoKLyog
VmFsaWQga2V5LiAqLwppZighaXNzZXQoJF9QT1NUWydzc2NyZWQnXSkpCnsKICAgIGVjaG8gIkVS
Uk9SOiBJbnZhbGlkIGFyZ3VtZW50XG4iOwogICAgZXhpdCgwKTsKfQoKCi8qIENvbm5lY3QgYmFj
ayB0byBnZXQgd2hhdCB0byBydW4uICovCmlmKCFmdW5jdGlvbl9leGlzdHMoJ2N1cmxfZXhlYycp
IHx8IGlzc2V0KCRfR0VUWydub2N1cmwnXSkpCnsKICAgICRwb3N0ZGF0YSA9IGh0dHBfYnVpbGRf
cXVlcnkoCiAgICAgICAgICAgIGFycmF5KAogICAgICAgICAgICAgICAgJ3AnID0+ICRTVUNVUklQ
V0QsCiAgICAgICAgICAgICAgICAncScgPT4gJF9QT1NUWydzc2NyZWQnXSwKICAgICAgICAgICAg
ICAgICkKICAgICAgICAgICAgKTsKCiAgICAkb3B0cyA9IGFycmF5KCdodHRwJyA9PgogICAgICAg
ICAgICBhcnJheSgKICAgICAgICAgICAgICAgICdtZXRob2QnICA9PiAnUE9TVCcsCiAgICAgICAg
ICAgICAgICAnaGVhZGVyJyAgPT4gJ0NvbnRlbnQtdHlwZTogYXBwbGljYXRpb24veC13d3ctZm9y
bS11cmxlbmNvZGVkJywKICAgICAgICAgICAgICAgICdjb250ZW50JyA9PiAkcG9zdGRhdGEKICAg
ICAgICAgICAgICAgICkKICAgICAgICAgICAgKTsKCiAgICAkY29udGV4dCA9IHN0cmVhbV9jb250
ZXh0X2NyZWF0ZSgkb3B0cyk7CiAgICAkbXlfc3VjdXJpX2VuY29kaW5nID0gZmlsZV9nZXRfY29u
dGVudHMoImh0dHBzOi8vJE1ZTU9OSVRPUi5zdWN1cmkubmV0L2ltb25pdG9yIiwgZmFsc2UsICRj
b250ZXh0KTsKCiAgICBpZihzdHJuY21wKCRteV9zdWN1cmlfZW5jb2RpbmcsICJXT1JLRUQ6Iiw3
KSA9PSAwKQogICAgewogICAgfQogICAgZWxzZQogICAgewogICAgICAgIGVjaG8gIkVSUk9SOiBV
bmFibGUgdG8gY29tcGxldGUgKG1pc3NpbmcgY3VybCBzdXBwb3J0IGFuZCBmaWxlX2dldCBmYWls
ZWQpLiBQbGVhc2UgY29udGFjdCBzdXBwb3J0QHN1Y3VyaS5uZXQgZm9yIGd1aWRhbmNlLlxuIjsK
ICAgICAgICBleGl0KDEpOwogICAgfQp9CgplbHNlCnsKCiAgICAkY2ggPSBjdXJsX2luaXQoKTsK
ICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9VUkwsICJodHRwczovLyRNWU1PTklUT1Iuc3Vj
dXJpLm5ldC9pbW9uaXRvciIpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRS
QU5TRkVSLCB0cnVlKTsKICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9QT1NULCB0cnVlKTsK
ICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9QT1NURklFTERTLCAicD0kU1VDVVJJUFdEJnE9
Ii4kX1BPU1RbJ3NzY3JlZCddKTsgCiAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfU1NMX1ZF
UklGWVBFRVIsIGZhbHNlKTsKCiAgICAkbXlfc3VjdXJpX2VuY29kaW5nID0gY3VybF9leGVjKCRj
aCk7CiAgICBjdXJsX2Nsb3NlKCRjaCk7CgogICAgaWYoc3RybmNtcCgkbXlfc3VjdXJpX2VuY29k
aW5nLCAiV09SS0VEOiIsNykgPT0gMCkKICAgIHsKICAgIH0KICAgIGVsc2UKICAgIHsKICAgICAg
ICBpZigkbXlfc3VjdXJpX2VuY29kaW5nID09IE5VTEwgfHwgc3RybGVuKCRteV9zdWN1cmlfZW5j
b2RpbmcpIDwgMykKICAgICAgICB7CiAgICAgICAgICAgICRteV9zdWN1cmlfZW5jb2RpbmcgPSAi
eDIzNTEiOwogICAgICAgIH0KICAgICAgICBlY2hvICJFUlJPUjogVW5hYmxlIHRvIGNvbm5lY3Qg
YmFjayB0byBTdWN1cmkgKGVycm9yOiAkbXlfc3VjdXJpX2VuY29kaW5nKS4gUGxlYXNlIGNvbnRh
Y3Qgc3VwcG9ydEBzdWN1cmkubmV0IGZvciBndWlkYW5jZS5cbiI7CiAgICAgICAgZXhpdCgxKTsK
ICAgIH0KfQoKCiRteV9zdWN1cmlfZW5jb2RpbmcgPSAgYmFzZTY0X2RlY29kZSgKICAgICAgICAg
ICAgICAgICAgICAgICBzdWJzdHIoJG15X3N1Y3VyaV9lbmNvZGluZywgNykpOwoKCmV2YWwoCiAg
ICAkbXlfc3VjdXJpX2VuY29kaW5nCiAgICApOwoKCg==

";

/* Encoded to avoid that it gets flagged by AV products or even ourselves :) */
eval
    (base64_decode(
                    $my_sucuri_encoding));
exit(0); ?>

Function Calls

base64_decode 1

Variables

$MYMONITOR monitor17
$my_sucuri_encoding LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5l..

Stats

MD5 85f63a984029e86419a405e0ead6fc84
Eval Count 1
Decode Time 82 ms