Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

eval(base64_decode("LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5lY3RzIGJhY2sgaG9tZS..

Decoded Output download

/* Sucuri integrity monitor . 
 * Connects back home.
 * Copyright (C) 2010-2013 Sucuri, LLC
 * Do not distribute or share.
 */


$SUCURIPWD = "535e26eb0f3324e8056fe6954976b04c62eb977f2cc51";


if(isset($_GET['test']))
{
    echo "OK: Sucuri: Found
";
    exit(0);
}



/* Valid argument. */
if(!isset($_GET['run']))
{
    exit(0);
}


/* Must have an IP address. */
if(!isset($_SERVER['REMOTE_ADDR']))
{
    exit(0);
}


/* If coming from cloudflare: */
if(isset($_SERVER['HTTP_CF_CONNECTING_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_ORIG_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_ORIG_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_TRUE_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_TRUE_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_X_REAL_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_REAL_IP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}


/* Checking if the IP address is valid */
if($_SERVER['REMOTE_ADDR'] !== '97.74.127.171' &&
   $_SERVER['REMOTE_ADDR'] !== '69.164.203.172' &&
   $_SERVER['REMOTE_ADDR'] !== '173.230.128.135' &&
   $_SERVER['REMOTE_ADDR'] !== '66.228.34.49' &&
   $_SERVER['REMOTE_ADDR'] !== '66.228.40.185' &&
   $_SERVER['REMOTE_ADDR'] !== '50.116.3.171' &&
   $_SERVER['REMOTE_ADDR'] !== '50.116.36.92' &&
   $_SERVER['REMOTE_ADDR'] !== '198.58.96.212' &&
   $_SERVER['REMOTE_ADDR'] !== '50.116.63.221' &&

   /* IPV6 */
   $_SERVER['REMOTE_ADDR'] !== '2600:3c00::f03c:91ff:feae:e104' &&
   $_SERVER['REMOTE_ADDR'] !== '2600:3c02::f03c:91ff:fedf:58c6' &&
   $_SERVER['REMOTE_ADDR'] !== '2600:3c02::f03c:91ff:fedf:5835' &&
   $_SERVER['REMOTE_ADDR'] !== '2600:3c03::f03c:91ff:fedf:6a7a' &&
   $_SERVER['REMOTE_ADDR'] !== 'fe80::fcfd:adff:fee6:8087' &&
   $_SERVER['REMOTE_ADDR'] !== '2600:3c03::f03c:91ff:fe70:36ce' &&
   $_SERVER['REMOTE_ADDR'] !== '50.116.36.93')
{
    echo "ERROR: Invalid IP
";
    exit(0);
}


/* Valid key. */
if(!isset($_POST['sscred']))
{
    echo "ERROR: Invalid argument
";
    exit(0);
}


/* Connect back to get what to run. */
if(!function_exists('curl_exec') || isset($_GET['nocurl']))
{
    $postdata = http_build_query(
            array(
                'p' => $SUCURIPWD,
                'q' => $_POST['sscred'],
                )
            );

    $opts = array('http' =>
            array(
                'method'  => 'POST',
                'header'  => 'Content-type: application/x-www-form-urlencoded',
                'content' => $postdata
                )
            );

    $context = stream_context_create($opts);
    $my_sucuri_encoding = file_get_contents("https://$MYMONITOR.sucuri.net/imonitor", false, $context);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
    }
    else
    {
        echo "ERROR: Unable to complete (missing curl support and file_get failed). Please contact [email protected] for guidance.
";
        exit(1);
    }
}

else
{

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "https://$MYMONITOR.sucuri.net/imonitor");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "p=$SUCURIPWD&q=".$_POST['sscred']); 
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

    $my_sucuri_encoding = curl_exec($ch);
    curl_close($ch);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
    }
    else
    {
        if($my_sucuri_encoding == NULL || strlen($my_sucuri_encoding) < 3)
        {
            $my_sucuri_encoding = "x2351";
        }
        echo "ERROR: Unable to connect back to Sucuri (error: $my_sucuri_encoding). Please contact [email protected] for guidance.
";
        exit(1);
    }
}


$my_sucuri_encoding =  base64_decode(
                       substr($my_sucuri_encoding, 7));


eval(
    $my_sucuri_encoding
    );

Did this file decode correctly?

Original Code

eval(base64_decode("LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5lY3RzIGJhY2sgaG9tZS4KICog
Q29weXJpZ2h0IChDKSAyMDEwLTIwMTMgU3VjdXJpLCBMTEMKICogRG8gbm90IGRpc3RyaWJ1dGUg
b3Igc2hhcmUuCiAqLwoKCiRTVUNVUklQV0QgPSAiNTM1ZTI2ZWIwZjMzMjRlODA1NmZlNjk1NDk3
NmIwNGM2MmViOTc3ZjJjYzUxIjsKCgppZihpc3NldCgkX0dFVFsndGVzdCddKSkKewogICAgZWNo
byAiT0s6IFN1Y3VyaTogRm91bmRcbiI7CiAgICBleGl0KDApOwp9CgoKCi8qIFZhbGlkIGFyZ3Vt
ZW50LiAqLwppZighaXNzZXQoJF9HRVRbJ3J1biddKSkKewogICAgZXhpdCgwKTsKfQoKCi8qIE11
c3QgaGF2ZSBhbiBJUCBhZGRyZXNzLiAqLwppZighaXNzZXQoJF9TRVJWRVJbJ1JFTU9URV9BRERS
J10pKQp7CiAgICBleGl0KDApOwp9CgoKLyogSWYgY29taW5nIGZyb20gY2xvdWRmbGFyZTogKi8K
aWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfQ0ZfQ09OTkVDVElOR19JUCddKSkKewogICAgJF9TRVJW
RVJbJ1JFTU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9DRl9DT05ORUNUSU5HX0lQJ107Cn0K
LyogTW9yZSBnYXRld2F5IHJlcXVlc3RzLiAqLwplbHNlIGlmKGlzc2V0KCRfU0VSVkVSWydIVFRQ
X1hfT1JJR19DTElFTlRfSVAnXSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9T
RVJWRVJbJ0hUVFBfWF9PUklHX0NMSUVOVF9JUCddOwp9Ci8qIFByb3h5IHJlcXVlc3RzLiAqLwpl
bHNlIGlmKGlzc2V0KCRfU0VSVkVSWydIVFRQX1RSVUVfQ0xJRU5UX0lQJ10pKQp7CiAgICAkX1NF
UlZFUlsnUkVNT1RFX0FERFInXSA9ICRfU0VSVkVSWydIVFRQX1RSVUVfQ0xJRU5UX0lQJ107Cn0K
LyogUHJveHkgcmVxdWVzdHMuICovCmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfWF9SRUFM
X0lQJ10pKQp7CiAgICAkX1NFUlZFUlsnUkVNT1RFX0FERFInXSA9ICRfU0VSVkVSWydIVFRQX1hf
UkVBTF9JUCddOwp9Ci8qIE1vcmUgZ2F0ZXdheSByZXF1ZXN0cy4gKi8KZWxzZSBpZihpc3NldCgk
X1NFUlZFUlsnSFRUUF9YX0ZPUldBUkRFRF9GT1InXSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVf
QUREUiddID0gJF9TRVJWRVJbJ0hUVFBfWF9GT1JXQVJERURfRk9SJ107Cn0KCgovKiBDaGVja2lu
ZyBpZiB0aGUgSVAgYWRkcmVzcyBpcyB2YWxpZCAqLwppZigkX1NFUlZFUlsnUkVNT1RFX0FERFIn
XSAhPT0gJzk3Ljc0LjEyNy4xNzEnICYmCiAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddICE9PSAn
NjkuMTY0LjIwMy4xNzInICYmCiAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddICE9PSAnMTczLjIz
MC4xMjguMTM1JyAmJgogICAkX1NFUlZFUlsnUkVNT1RFX0FERFInXSAhPT0gJzY2LjIyOC4zNC40
OScgJiYKICAgJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10gIT09ICc2Ni4yMjguNDAuMTg1JyAmJgog
ICAkX1NFUlZFUlsnUkVNT1RFX0FERFInXSAhPT0gJzUwLjExNi4zLjE3MScgJiYKICAgJF9TRVJW
RVJbJ1JFTU9URV9BRERSJ10gIT09ICc1MC4xMTYuMzYuOTInICYmCiAgICRfU0VSVkVSWydSRU1P
VEVfQUREUiddICE9PSAnMTk4LjU4Ljk2LjIxMicgJiYKICAgJF9TRVJWRVJbJ1JFTU9URV9BRERS
J10gIT09ICc1MC4xMTYuNjMuMjIxJyAmJgoKICAgLyogSVBWNiAqLwogICAkX1NFUlZFUlsnUkVN
T1RFX0FERFInXSAhPT0gJzI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZlYWU6ZTEwNCcgJiYKICAgJF9T
RVJWRVJbJ1JFTU9URV9BRERSJ10gIT09ICcyNjAwOjNjMDI6OmYwM2M6OTFmZjpmZWRmOjU4YzYn
ICYmCiAgICRfU0VSVkVSWydSRU1PVEVfQUREUiddICE9PSAnMjYwMDozYzAyOjpmMDNjOjkxZmY6
ZmVkZjo1ODM1JyAmJgogICAkX1NFUlZFUlsnUkVNT1RFX0FERFInXSAhPT0gJzI2MDA6M2MwMzo6
ZjAzYzo5MWZmOmZlZGY6NmE3YScgJiYKICAgJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10gIT09ICdm
ZTgwOjpmY2ZkOmFkZmY6ZmVlNjo4MDg3JyAmJgogICAkX1NFUlZFUlsnUkVNT1RFX0FERFInXSAh
PT0gJzI2MDA6M2MwMzo6ZjAzYzo5MWZmOmZlNzA6MzZjZScgJiYKICAgJF9TRVJWRVJbJ1JFTU9U
RV9BRERSJ10gIT09ICc1MC4xMTYuMzYuOTMnKQp7CiAgICBlY2hvICJFUlJPUjogSW52YWxpZCBJ
UFxuIjsKICAgIGV4aXQoMCk7Cn0KCgovKiBWYWxpZCBrZXkuICovCmlmKCFpc3NldCgkX1BPU1Rb
J3NzY3JlZCddKSkKewogICAgZWNobyAiRVJST1I6IEludmFsaWQgYXJndW1lbnRcbiI7CiAgICBl
eGl0KDApOwp9CgoKLyogQ29ubmVjdCBiYWNrIHRvIGdldCB3aGF0IHRvIHJ1bi4gKi8KaWYoIWZ1
bmN0aW9uX2V4aXN0cygnY3VybF9leGVjJykgfHwgaXNzZXQoJF9HRVRbJ25vY3VybCddKSkKewog
ICAgJHBvc3RkYXRhID0gaHR0cF9idWlsZF9xdWVyeSgKICAgICAgICAgICAgYXJyYXkoCiAgICAg
ICAgICAgICAgICAncCcgPT4gJFNVQ1VSSVBXRCwKICAgICAgICAgICAgICAgICdxJyA9PiAkX1BP
U1RbJ3NzY3JlZCddLAogICAgICAgICAgICAgICAgKQogICAgICAgICAgICApOwoKICAgICRvcHRz
ID0gYXJyYXkoJ2h0dHAnID0+CiAgICAgICAgICAgIGFycmF5KAogICAgICAgICAgICAgICAgJ21l
dGhvZCcgID0+ICdQT1NUJywKICAgICAgICAgICAgICAgICdoZWFkZXInICA9PiAnQ29udGVudC10
eXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQnLAogICAgICAgICAgICAgICAg
J2NvbnRlbnQnID0+ICRwb3N0ZGF0YQogICAgICAgICAgICAgICAgKQogICAgICAgICAgICApOwoK
ICAgICRjb250ZXh0ID0gc3RyZWFtX2NvbnRleHRfY3JlYXRlKCRvcHRzKTsKICAgICRteV9zdWN1
cmlfZW5jb2RpbmcgPSBmaWxlX2dldF9jb250ZW50cygiaHR0cHM6Ly8kTVlNT05JVE9SLnN1Y3Vy
aS5uZXQvaW1vbml0b3IiLCBmYWxzZSwgJGNvbnRleHQpOwoKICAgIGlmKHN0cm5jbXAoJG15X3N1
Y3VyaV9lbmNvZGluZywgIldPUktFRDoiLDcpID09IDApCiAgICB7CiAgICB9CiAgICBlbHNlCiAg
ICB7CiAgICAgICAgZWNobyAiRVJST1I6IFVuYWJsZSB0byBjb21wbGV0ZSAobWlzc2luZyBjdXJs
IHN1cHBvcnQgYW5kIGZpbGVfZ2V0IGZhaWxlZCkuIFBsZWFzZSBjb250YWN0IHN1cHBvcnRAc3Vj
dXJpLm5ldCBmb3IgZ3VpZGFuY2UuXG4iOwogICAgICAgIGV4aXQoMSk7CiAgICB9Cn0KCmVsc2UK
ewoKICAgICRjaCA9IGN1cmxfaW5pdCgpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VS
TCwgImh0dHBzOi8vJE1ZTU9OSVRPUi5zdWN1cmkubmV0L2ltb25pdG9yIik7CiAgICBjdXJsX3Nl
dG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwogICAgY3VybF9zZXRvcHQo
JGNoLCBDVVJMT1BUX1BPU1QsIHRydWUpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BP
U1RGSUVMRFMsICJwPSRTVUNVUklQV0QmcT0iLiRfUE9TVFsnc3NjcmVkJ10pOyAKICAgIGN1cmxf
c2V0b3B0KCRjaCwgQ1VSTE9QVF9TU0xfVkVSSUZZUEVFUiwgZmFsc2UpOwoKICAgICRteV9zdWN1
cmlfZW5jb2RpbmcgPSBjdXJsX2V4ZWMoJGNoKTsKICAgIGN1cmxfY2xvc2UoJGNoKTsKCiAgICBp
ZihzdHJuY21wKCRteV9zdWN1cmlfZW5jb2RpbmcsICJXT1JLRUQ6Iiw3KSA9PSAwKQogICAgewog
ICAgfQogICAgZWxzZQogICAgewogICAgICAgIGlmKCRteV9zdWN1cmlfZW5jb2RpbmcgPT0gTlVM
TCB8fCBzdHJsZW4oJG15X3N1Y3VyaV9lbmNvZGluZykgPCAzKQogICAgICAgIHsKICAgICAgICAg
ICAgJG15X3N1Y3VyaV9lbmNvZGluZyA9ICJ4MjM1MSI7CiAgICAgICAgfQogICAgICAgIGVjaG8g
IkVSUk9SOiBVbmFibGUgdG8gY29ubmVjdCBiYWNrIHRvIFN1Y3VyaSAoZXJyb3I6ICRteV9zdWN1
cmlfZW5jb2RpbmcpLiBQbGVhc2UgY29udGFjdCBzdXBwb3J0QHN1Y3VyaS5uZXQgZm9yIGd1aWRh
bmNlLlxuIjsKICAgICAgICBleGl0KDEpOwogICAgfQp9CgoKJG15X3N1Y3VyaV9lbmNvZGluZyA9
ICBiYXNlNjRfZGVjb2RlKAogICAgICAgICAgICAgICAgICAgICAgIHN1YnN0cigkbXlfc3VjdXJp
X2VuY29kaW5nLCA3KSk7CgoKZXZhbCgKICAgICRteV9zdWN1cmlfZW5jb2RpbmcKICAgICk7CgoK"))

Function Calls

base64_decode 1

Variables

None

Stats

MD5 f5dae0b41b30611c3012e9bbd35bcc7f
Eval Count 1
Decode Time 88 ms