Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php if(isset($_GET['action']) && $_GET['action'] == 'loghunter'){ echo "<c..
Decoded Output download
<center><h1>Log Hunter</h1></center><br>
echo "<Center>
";
echo "<form action=\"\" method=\"post\">
";
?><br>Dir :<input type="text" value="<?=getcwd();?>" name="shc_dir"><?php
echo "<input type=\"submit\" name=\"submit\" value=\"Scan Now!\"/>
";
echo "</form>
";
echo "<pre style=\"text-align: left;\">
";
error_reporting(0);
/*
Name : Log Hunter (Grab Email)
Date : 26/03/2016 05:53 PM
Link : http://facebook.com/bug7sec
Link : http://pastebin.com/u/shor7cut
Author : Shor7cut
*/
if($_POST['submit']){
function tampilkan($shcdirs){
foreach(scandir($shcdirs) as $shc)
{
if($shc!='.' && $shc!='..')
{
$shc = $shcdirs.DIRECTORY_SEPARATOR.$shc;
if( !is_dir($shc) && !eregi("css", $shc) ){
$fgt = file_get_contents($shc);
$ifgt = exif_read_data($shc);
$jembut = "COMPUTED";
$taik = "UserComment";
$shcm = "/mail['(']/";
if($ifgt[$jembut][$taik]){
echo "[<font color=#00FFD0>Stegano</font>] <font color=#2196F3>".$shc."</font><br>";
}
preg_match_all('#[A-Z0-9a-z._%+-]+@[A-Za-z0-9.+-]+#',$fgt,$cocok);
$hcs = "/base64_decode/";
$exif = "/exif_read_data/";
preg_match($shcm, addslashes($fgt), $mailshc);
preg_match($hcs, addslashes($fgt), $shcmar);
preg_match($exif, addslashes($fgt), $shcxif);
if(eregi('HTTP Cookie File', $fgt) || eregi('PHP Warning:', $fgt) ){
}
if(eregi('tmp_name', $fgt)){
echo "[<font color=#FAFF14>Uploader</font>] <font color=#2196F3>".$shc."</font><br>";
}
if($shcmar[0]){
echo "[<font color=#FF3D00>Base64</font>] <font color=#2196F3>".$shc."</font><br>";
}
if($mailshc[0]){
echo "[<font color=#E6004E>MailFunc</font>] <font color=#2196F3>".$shc."</font><br>";
}
if($shcxif[0]){
echo "[<font color=#00FFD0>Stegano</font>] <font color=#2196F3>".$shc."</font> </font><font color=red>{Manual Check}</font><br>";
}
if(eregi("js", $shc)){
echo "[<font color=red>Javascript</font>] <font color=#2196F3>".$shc."</font> { <a href=http://www.unphp.net target=_blank>CheckJS</a> }<br>";
}
if($cocok[0]){
foreach ($cocok[0] as $key => $shcmail) {
if (filter_var($shcmail, FILTER_VALIDATE_EMAIL)) {
echo "[<font color=greenyellow>SendMail</font>] <font color=#2196F3>".$shc."</font> { ".$shcmail." }<br>";
}
}
}
}else{
tampilkan($shc);
}
}
}
}
tampilkan($_POST['shc_dir']);
}
echo "</pre>
";
echo "</Center>
";
Did this file decode correctly?
Original Code
<?php
if(isset($_GET['action']) && $_GET['action'] == 'loghunter'){
echo "<center><h1>Log Hunter</h1></center><br>";
eval(str_rot13(gzinflate(str_rot13(base64_decode(("tUl7YtpVEP87VXyHiZMr0BLsPJqqgJ14QyBquuNrXEUlEExeeL2E5hZ7wS5pmu9+s7ZWgDM5RCmWJXt0f7Pz3JnJ52lphOsTQ+odbjFOjaGl1CCfWIlGTyPgLguIpQ+VoQKRYD7x8N8mDhsqC/iZRJ9DoxtDqNYDyx4xYA+20BUmvjEF7mw4wlL9WZ8J5o69b6lpcyhg8Qipju+aXkAVo35z+/az5KVGhoozmlEBilhLltbJyVCl6WULvpDx7kNE11lDpQ14NJsKY9hQKEyligc8DHNJFU8xcrXUKgRGV6hWhVooC6xMRCshRH2fz31OLQCfKtyQGVyNpOOg+DflE+hSPAhY+VyXsxRlZ6p3x+qRaWsK2sfqx3B13OZmN4E1QrZ9xuyqqkG5KyaEzCsuidTJdfbJEWEGzOYOE5PAim4j1fEJ/eSOSz7XHm5cqFE2n3bv1XwO4jeYFvfNxmyzNSgkrivclR7zuenIilALjFRpEM65SNzHY2A0nGubQ8Fdv+igZpH2sgfcAblAO6Vpj8lUPkUQYezqhVcB3r2DxaJFKL2AlvDykRjQbmRtpXt90eu0zi/+MJu9U/uijb8VuUxbclBEsBs45k+zkpS3K6iYBVLFaBylnOgI0hRL5Y3FQXRZfmiYBqEwMTNal2AkLeYk59Uya4KEVgfxLZhvd2PP9Djjmxm+i3WCbKyD0jm/ely2bV0lC8ZrMI/PSC4dTjskikOPWSQKiiRBlYk2KBQLancWQQZPKjtVNbgbxDLisK9w5ZNcjAFea4uBWE9P9T1a6/e7mtFxb8YtIi+SxYw7S8EcHX4+7R8bVxyhipKCcTHI0urpvyS8ijMz4sz1Wh6GxcLeoH3wp2nwmR/8RjF/+WNj9+FKVsElEitlvUooy9iV913ikmym133XiZ2pQbgjQUJZQrjEE5mO2peRjLGrIc0EvygbVDwqA/c8J+SOLzB2Q6kSJp0MzIZnS+ZUHcuQxS8P5vT/2KW2meKRHbey2DEnkutEuHe1GtDBZRMI6HD2F8rxaCjBjx+QTxpKDfidRgsLX/VsOyt7Mm/6IohStil49uKEetKv3+73D0KMWDsk3BP0jfIvrUvo8YG21e3o94+7mnP8FXTYGyqXptOW2vVBNe2kdNwiZh+r/Ns6D/N6WPV+vrTAT8slKBWe8WvLrREPoeMLav70RqakveP7ZuvYcdErllZIvvJ77rg0sNlJhj1PnYNCxUdCm/1rPK6MLByKKpbARIhG7ES6OQm5NTdvM7826yo34HbLiMVo85WApX0fXpBkw5+LB9CNtD7hkLPex0rFQBHbKs5S5j2nxQVCGfrXN63ehflb++a622H1zN56+/qm9OpMGzw9o09LDyIMydh1CsuTqb6lvxOKR6yiefbiK97cQF4lre4/idARGdaujmDr5XvpxPQXP/guZC3mu3GcxgGvFiMWRjD2jvXBa3biz+dp/gU="))))));
}
?>
Function Calls
| gzinflate | 1 |
| str_rot13 | 2 |
| base64_decode | 1 |
Stats
| MD5 | 914c274302211caabea1c6fdacccf466 |
| Eval Count | 1 |
| Decode Time | 92 ms |