Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $my_sucuri_encoding = " JFNVQ1VSSVBXRD0iYjBhMDE4YzM1MDI1NTM1N2EwNjQ2YTM1MzRlMGI2Y..

Decoded Output download

$SUCURIPWD="b0a018c350255357a0646a3534e0b6b79dfa6f2d";
$URL="9e331c509aba632285da699993989082";
/* Sucuri clean up scripts for sites on shared hosts. 
 * Copyright (C) 2010, 2011, 2012 Sucuri, LLC
 * Do not distribute or share.
 */


if (extension_loaded('xdebug') && !isset($_GET['robot'])) { echo 'debug detected - exiting...'; exit(0); }

if(!isset($_GET['wp-login']) && !isset($_GET['joomla-login']) && !isset($_GET['vbulletin-login']))
{
    echo "<pre>";
}


/* If running via terminal. */
if(!isset($_SERVER['REMOTE_ADDR']) && isset($_SERVER['SHELL']))
{
    parse_str(implode('&', array_slice($argv, 1)), $_GET);
}


$donew = "&donew";
if(isset($_GET['oldscript']))
{
    $donew = "";
}

if(!isset($_GET['srun']))
{
    @unlink("sucuri-cleanup.php");
    @unlink("sucuri-version-check.php");
    @unlink("sucuri-db-clean.php");
    @unlink("sucuri-db-cleanup.php");
    @unlink("sucuri-filemanager.php");
    @unlink("sucuri-wpdb-clean.php");
    @unlink("sucuri_listcleaned.php");
    @unlink('sucuri-toolbox.php');
    @unlink('sucuri-toolbox-client.php');
    @unlink('googlec55310faa35e04c1.html');
    @unlink(__FILE__);
    exit(0);
}



if(!function_exists('curl_exec') || isset($_GET['nocurl']))
{

    $postdata = "p=$SUCURIPWD";
    $opts = array('http' =>
        array(
            'method'  => 'POST',
            'header'  => 'Content-type: application/x-www-form-urlencoded',
            'content' => $postdata
        )
    );

    $context = stream_context_create($opts);
    $my_sucuri_encoding = file_get_contents("https://support.sucuri.net/sig.php?u=$URL$donew", false, $context);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
        if(!isset($_GET['wp-login']) && !isset($_GET['joomla-login']) && !isset($_GET['vbulletin-login']))
        {
            echo "OK: Connected to Sucuri (via file_get) and running the cleanup.
";
        }
    }
    else
    {
        echo "ERROR: Unable to clean (missing curl support and file_get failed). Please escalate ticket for manual review.
";
        exit(1);
    }
}

else
{

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "https://support.sucuri.net/sig.php?u=$URL$donew");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "p=$SUCURIPWD"); 
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

    $my_sucuri_encoding = curl_exec($ch);
    curl_close($ch);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
        if(!isset($_GET['wp-login']) && !isset($_GET['joomla-login']) && !isset($_GET['vbulletin-login']))
        {
            echo "OK: Connected to Sucuri and running the cleanup.
";
        }
    }
    else
    {
        echo "FAILED to run: $my_sucuri_encoding
";
        echo "ERRRO: Unable to clean. Please try to upload the scripts again.
";
        exit(1);
    }
}


$my_sucuri_encoding =  base64_decode(
                                          substr($my_sucuri_encoding, 7));


eval(
       $my_sucuri_encoding
    );


if(!isset($_GET['wp-login']) && !isset($_GET['joomla-login']) && !isset($_GET['vbulletin-login']))
{
    echo "</pre>";
}

Did this file decode correctly?

Original Code

<?php $my_sucuri_encoding = "

JFNVQ1VSSVBXRD0iYjBhMDE4YzM1MDI1NTM1N2EwNjQ2YTM1MzRlMGI2Yjc5ZGZhNmYyZCI7CiRV
Ukw9IjllMzMxYzUwOWFiYTYzMjI4NWRhNjk5OTkzOTg5MDgyIjsKLyogU3VjdXJpIGNsZWFuIHVw
IHNjcmlwdHMgZm9yIHNpdGVzIG9uIHNoYXJlZCBob3N0cy4gCiAqIENvcHlyaWdodCAoQykgMjAx
MCwgMjAxMSwgMjAxMiBTdWN1cmksIExMQwogKiBEbyBub3QgZGlzdHJpYnV0ZSBvciBzaGFyZS4K
ICovCgoKaWYgKGV4dGVuc2lvbl9sb2FkZWQoJ3hkZWJ1ZycpICYmICFpc3NldCgkX0dFVFsncm9i
b3QnXSkpIHsgZWNobyAnZGVidWcgZGV0ZWN0ZWQgLSBleGl0aW5nLi4uJzsgZXhpdCgwKTsgfQoK
aWYoIWlzc2V0KCRfR0VUWyd3cC1sb2dpbiddKSAmJiAhaXNzZXQoJF9HRVRbJ2pvb21sYS1sb2dp
biddKSAmJiAhaXNzZXQoJF9HRVRbJ3ZidWxsZXRpbi1sb2dpbiddKSkKewogICAgZWNobyAiPHBy
ZT4iOwp9CgoKLyogSWYgcnVubmluZyB2aWEgdGVybWluYWwuICovCmlmKCFpc3NldCgkX1NFUlZF
UlsnUkVNT1RFX0FERFInXSkgJiYgaXNzZXQoJF9TRVJWRVJbJ1NIRUxMJ10pKQp7CiAgICBwYXJz
ZV9zdHIoaW1wbG9kZSgnJicsIGFycmF5X3NsaWNlKCRhcmd2LCAxKSksICRfR0VUKTsKfQoKCiRk
b25ldyA9ICImZG9uZXciOwppZihpc3NldCgkX0dFVFsnb2xkc2NyaXB0J10pKQp7CiAgICAkZG9u
ZXcgPSAiIjsKfQoKaWYoIWlzc2V0KCRfR0VUWydzcnVuJ10pKQp7CiAgICBAdW5saW5rKCJzdWN1
cmktY2xlYW51cC5waHAiKTsKICAgIEB1bmxpbmsoInN1Y3VyaS12ZXJzaW9uLWNoZWNrLnBocCIp
OwogICAgQHVubGluaygic3VjdXJpLWRiLWNsZWFuLnBocCIpOwogICAgQHVubGluaygic3VjdXJp
LWRiLWNsZWFudXAucGhwIik7CiAgICBAdW5saW5rKCJzdWN1cmktZmlsZW1hbmFnZXIucGhwIik7
CiAgICBAdW5saW5rKCJzdWN1cmktd3BkYi1jbGVhbi5waHAiKTsKICAgIEB1bmxpbmsoInN1Y3Vy
aV9saXN0Y2xlYW5lZC5waHAiKTsKICAgIEB1bmxpbmsoJ3N1Y3VyaS10b29sYm94LnBocCcpOwog
ICAgQHVubGluaygnc3VjdXJpLXRvb2xib3gtY2xpZW50LnBocCcpOwogICAgQHVubGluaygnZ29v
Z2xlYzU1MzEwZmFhMzVlMDRjMS5odG1sJyk7CiAgICBAdW5saW5rKF9fRklMRV9fKTsKICAgIGV4
aXQoMCk7Cn0KCgoKaWYoIWZ1bmN0aW9uX2V4aXN0cygnY3VybF9leGVjJykgfHwgaXNzZXQoJF9H
RVRbJ25vY3VybCddKSkKewoKICAgICRwb3N0ZGF0YSA9ICJwPSRTVUNVUklQV0QiOwogICAgJG9w
dHMgPSBhcnJheSgnaHR0cCcgPT4KICAgICAgICBhcnJheSgKICAgICAgICAgICAgJ21ldGhvZCcg
ID0+ICdQT1NUJywKICAgICAgICAgICAgJ2hlYWRlcicgID0+ICdDb250ZW50LXR5cGU6IGFwcGxp
Y2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCcsCiAgICAgICAgICAgICdjb250ZW50JyA9PiAk
cG9zdGRhdGEKICAgICAgICApCiAgICApOwoKICAgICRjb250ZXh0ID0gc3RyZWFtX2NvbnRleHRf
Y3JlYXRlKCRvcHRzKTsKICAgICRteV9zdWN1cmlfZW5jb2RpbmcgPSBmaWxlX2dldF9jb250ZW50
cygiaHR0cHM6Ly9zdXBwb3J0LnN1Y3VyaS5uZXQvc2lnLnBocD91PSRVUkwkZG9uZXciLCBmYWxz
ZSwgJGNvbnRleHQpOwoKICAgIGlmKHN0cm5jbXAoJG15X3N1Y3VyaV9lbmNvZGluZywgIldPUktF
RDoiLDcpID09IDApCiAgICB7CiAgICAgICAgaWYoIWlzc2V0KCRfR0VUWyd3cC1sb2dpbiddKSAm
JiAhaXNzZXQoJF9HRVRbJ2pvb21sYS1sb2dpbiddKSAmJiAhaXNzZXQoJF9HRVRbJ3ZidWxsZXRp
bi1sb2dpbiddKSkKICAgICAgICB7CiAgICAgICAgICAgIGVjaG8gIk9LOiBDb25uZWN0ZWQgdG8g
U3VjdXJpICh2aWEgZmlsZV9nZXQpIGFuZCBydW5uaW5nIHRoZSBjbGVhbnVwLlxuIjsKICAgICAg
ICB9CiAgICB9CiAgICBlbHNlCiAgICB7CiAgICAgICAgZWNobyAiRVJST1I6IFVuYWJsZSB0byBj
bGVhbiAobWlzc2luZyBjdXJsIHN1cHBvcnQgYW5kIGZpbGVfZ2V0IGZhaWxlZCkuIFBsZWFzZSBl
c2NhbGF0ZSB0aWNrZXQgZm9yIG1hbnVhbCByZXZpZXcuXG4iOwogICAgICAgIGV4aXQoMSk7CiAg
ICB9Cn0KCmVsc2UKewoKICAgICRjaCA9IGN1cmxfaW5pdCgpOwogICAgY3VybF9zZXRvcHQoJGNo
LCBDVVJMT1BUX1VSTCwgImh0dHBzOi8vc3VwcG9ydC5zdWN1cmkubmV0L3NpZy5waHA/dT0kVVJM
JGRvbmV3Iik7CiAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRy
dWUpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1QsIHRydWUpOwogICAgY3VybF9z
ZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1RGSUVMRFMsICJwPSRTVUNVUklQV0QiKTsgCiAgICBjdXJs
X3NldG9wdCgkY2gsIENVUkxPUFRfU1NMX1ZFUklGWVBFRVIsIGZhbHNlKTsKCiAgICAkbXlfc3Vj
dXJpX2VuY29kaW5nID0gY3VybF9leGVjKCRjaCk7CiAgICBjdXJsX2Nsb3NlKCRjaCk7CgogICAg
aWYoc3RybmNtcCgkbXlfc3VjdXJpX2VuY29kaW5nLCAiV09SS0VEOiIsNykgPT0gMCkKICAgIHsK
ICAgICAgICBpZighaXNzZXQoJF9HRVRbJ3dwLWxvZ2luJ10pICYmICFpc3NldCgkX0dFVFsnam9v
bWxhLWxvZ2luJ10pICYmICFpc3NldCgkX0dFVFsndmJ1bGxldGluLWxvZ2luJ10pKQogICAgICAg
IHsKICAgICAgICAgICAgZWNobyAiT0s6IENvbm5lY3RlZCB0byBTdWN1cmkgYW5kIHJ1bm5pbmcg
dGhlIGNsZWFudXAuXG4iOwogICAgICAgIH0KICAgIH0KICAgIGVsc2UKICAgIHsKICAgICAgICBl
Y2hvICJGQUlMRUQgdG8gcnVuOiAkbXlfc3VjdXJpX2VuY29kaW5nXG4iOwogICAgICAgIGVjaG8g
IkVSUlJPOiBVbmFibGUgdG8gY2xlYW4uIFBsZWFzZSB0cnkgdG8gdXBsb2FkIHRoZSBzY3JpcHRz
IGFnYWluLlxuIjsKICAgICAgICBleGl0KDEpOwogICAgfQp9CgoKJG15X3N1Y3VyaV9lbmNvZGlu
ZyA9ICBiYXNlNjRfZGVjb2RlKAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBzdWJzdHIoJG15X3N1Y3VyaV9lbmNvZGluZywgNykpOwoKCmV2YWwoCiAgICAgICAkbXlf
c3VjdXJpX2VuY29kaW5nCiAgICApOwoKCmlmKCFpc3NldCgkX0dFVFsnd3AtbG9naW4nXSkgJiYg
IWlzc2V0KCRfR0VUWydqb29tbGEtbG9naW4nXSkgJiYgIWlzc2V0KCRfR0VUWyd2YnVsbGV0aW4t
bG9naW4nXSkpCnsKICAgIGVjaG8gIjwvcHJlPiI7Cn0K
";
$my_sucuri_encoding =  base64_decode($my_sucuri_encoding);
eval($my_sucuri_encoding);

Function Calls

base64_decode 1

Variables

$my_sucuri_encoding $SUCURIPWD="b0a018c350255357a0646a3534e0b6b79dfa6f2d"; $URL=..

Stats

MD5 a531a5f26117ddc1801fa590cd670d3b
Eval Count 1
Decode Time 118 ms