Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php if(isset($_GET['action']) && $_GET['action'] == 'loghunter'){ echo "<c..

Decoded Output download

<center><h1>Log Hunter</h1></center><br>
		echo "<Center>
"; 
echo "<form action=\"\" method=\"post\">
"; 
?><br>Dir :<input type="text" value="<?=getcwd();?>" name="shc_dir"><?php
echo "<input type=\"submit\" name=\"submit\" value=\"Scan Now!\"/>
"; 
echo "</form>
"; 
echo "<pre style=\"text-align: left;\">
";
error_reporting(0);
/*
Name    : Log Hunter (Grab Email)
Date    : 26/03/2016 05:53 PM
Link    : http://facebook.com/bug7sec
Link    : http://pastebin.com/u/shor7cut
Author  : Shor7cut
*/
 
 
if($_POST['submit']){
function tampilkan($shcdirs){
foreach(scandir($shcdirs) as $shc)
    {
        if($shc!='.' && $shc!='..')
        {
            $shc = $shcdirs.DIRECTORY_SEPARATOR.$shc;
            if( !is_dir($shc) && !eregi("css", $shc) ){
 
                $fgt    = file_get_contents($shc);
                $ifgt   = exif_read_data($shc);
                $jembut = "COMPUTED";
                $taik   = "UserComment";
                $shcm = "/mail['(']/";
                if($ifgt[$jembut][$taik]){
                    echo "[<font color=#00FFD0>Stegano</font>] <font color=#2196F3>".$shc."</font><br>";
                }
                preg_match_all('#[A-Z0-9a-z._%+-]+@[A-Za-z0-9.+-]+#',$fgt,$cocok);
                $hcs  = "/base64_decode/";
                $exif = "/exif_read_data/";
                preg_match($shcm, addslashes($fgt), $mailshc);
                preg_match($hcs,  addslashes($fgt), $shcmar);
                preg_match($exif, addslashes($fgt), $shcxif);
                if(eregi('HTTP Cookie File', $fgt) || eregi('PHP Warning:', $fgt) ){
                }
                if(eregi('tmp_name', $fgt)){
                    echo "[<font color=#FAFF14>Uploader</font>] <font color=#2196F3>".$shc."</font><br>";
                }
                if($shcmar[0]){
                    echo "[<font color=#FF3D00>Base64</font>] <font color=#2196F3>".$shc."</font><br>";
                }
                if($mailshc[0]){
                    echo "[<font color=#E6004E>MailFunc</font>] <font color=#2196F3>".$shc."</font><br>";
                }
                if($shcxif[0]){
                    echo "[<font color=#00FFD0>Stegano</font>] <font color=#2196F3>".$shc."</font> </font><font color=red>{Manual Check}</font><br>";
                }
                if(eregi("js", $shc)){
                            echo "[<font color=red>Javascript</font>] <font color=#2196F3>".$shc."</font> { <a href=http://www.unphp.net target=_blank>CheckJS</a> }<br>";
                }
                if($cocok[0]){
                    foreach ($cocok[0] as $key => $shcmail) {
                        if (filter_var($shcmail, FILTER_VALIDATE_EMAIL)) {
                            echo "[<font color=greenyellow>SendMail</font>] <font color=#2196F3>".$shc."</font> { ".$shcmail." }<br>";
                        }
                    }
                }
           
            }else{
                tampilkan($shc);
            }
        }
    }
}
tampilkan($_POST['shc_dir']);
}
echo "</pre>
"; 
echo "</Center>
";
	

Did this file decode correctly?

Original Code

<?php
if(isset($_GET['action']) && $_GET['action'] == 'loghunter'){
            echo "<center><h1>Log Hunter</h1></center><br>";
        eval(str_rot13(gzinflate(str_rot13(base64_decode(("tUl7YtpVEP87VXyHiZMr0BLsPJqqgJ14QyBquuNrXEUlEExeeL2E5hZ7wS5pmu9+s7ZWgDM5RCmWJXt0f7Pz3JnJ52lphOsTQ+odbjFOjaGl1CCfWIlGTyPgLguIpQ+VoQKRYD7x8N8mDhsqC/iZRJ9DoxtDqNYDyx4xYA+20BUmvjEF7mw4wlL9WZ8J5o69b6lpcyhg8Qipju+aXkAVo35z+/az5KVGhoozmlEBilhLltbJyVCl6WULvpDx7kNE11lDpQ14NJsKY9hQKEyligc8DHNJFU8xcrXUKgRGV6hWhVooC6xMRCshRH2fz31OLQCfKtyQGVyNpOOg+DflE+hSPAhY+VyXsxRlZ6p3x+qRaWsK2sfqx3B13OZmN4E1QrZ9xuyqqkG5KyaEzCsuidTJdfbJEWEGzOYOE5PAim4j1fEJ/eSOSz7XHm5cqFE2n3bv1XwO4jeYFvfNxmyzNSgkrivclR7zuenIilALjFRpEM65SNzHY2A0nGubQ8Fdv+igZpH2sgfcAblAO6Vpj8lUPkUQYezqhVcB3r2DxaJFKL2AlvDykRjQbmRtpXt90eu0zi/+MJu9U/uijb8VuUxbclBEsBs45k+zkpS3K6iYBVLFaBylnOgI0hRL5Y3FQXRZfmiYBqEwMTNal2AkLeYk59Uya4KEVgfxLZhvd2PP9Djjmxm+i3WCbKyD0jm/ely2bV0lC8ZrMI/PSC4dTjskikOPWSQKiiRBlYk2KBQLancWQQZPKjtVNbgbxDLisK9w5ZNcjAFea4uBWE9P9T1a6/e7mtFxb8YtIi+SxYw7S8EcHX4+7R8bVxyhipKCcTHI0urpvyS8ijMz4sz1Wh6GxcLeoH3wp2nwmR/8RjF/+WNj9+FKVsElEitlvUooy9iV913ikmym133XiZ2pQbgjQUJZQrjEE5mO2peRjLGrIc0EvygbVDwqA/c8J+SOLzB2Q6kSJp0MzIZnS+ZUHcuQxS8P5vT/2KW2meKRHbey2DEnkutEuHe1GtDBZRMI6HD2F8rxaCjBjx+QTxpKDfidRgsLX/VsOyt7Mm/6IohStil49uKEetKv3+73D0KMWDsk3BP0jfIvrUvo8YG21e3o94+7mnP8FXTYGyqXptOW2vVBNe2kdNwiZh+r/Ns6D/N6WPV+vrTAT8slKBWe8WvLrREPoeMLav70RqakveP7ZuvYcdErllZIvvJ77rg0sNlJhj1PnYNCxUdCm/1rPK6MLByKKpbARIhG7ES6OQm5NTdvM7826yo34HbLiMVo85WApX0fXpBkw5+LB9CNtD7hkLPex0rFQBHbKs5S5j2nxQVCGfrXN63ehflb++a622H1zN56+/qm9OpMGzw9o09LDyIMydh1CsuTqb6lvxOKR6yiefbiK97cQF4lre4/idARGdaujmDr5XvpxPQXP/guZC3mu3GcxgGvFiMWRjD2jvXBa3biz+dp/gU="))))));
}
?>

Function Calls

gzinflate 1
str_rot13 2
base64_decode 1

Variables

None

Stats

MD5 914c274302211caabea1c6fdacccf466
Eval Count 1
Decode Time 92 ms