Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php ${"GL\x4fB\x41LS"}["\x79y\x69\x79\x6c\x6a"]="he\x61\x64\x65\x72s";echo "<\x68\x6..
Decoded Output download
<?php ${"GLOBALS"}["yyiylj"]="headers";echo
"<head>\n<center>\n<title>
[s4s] #Procoder'z Team Albanian</
title>\n<STYLE>\ntextarea{backgro
und-color:#105700;color:lim
e;font-weight:bold;font-size: 20px
;font-family: Tahoma; border:
1px solid #000000;}\ninput
{FONT-WEIGHT:normal;background-
color: #105700;font-size:
15px;font-weight:bold;color:
lime; font-family: Tahoma; bo
rder: 1px solid #666666;heigh
t:20}\nbody {\nfont-family: Tahoma\n}\n
tr {\nBORDER: dashed 1px #333;\nco
lor: #FFF;\n}\ntd {\nBORDER: dashed
1px #333;\ncolor: #FFF;\n}\n.
table1 {\nBORDER: 0px Black;\nBA
CKGROUND-COLOR: Black;\ncolor:
#FFF;\n}\n.td1 {\nBORDER: 0px;\n
BORDER-COLOR: #333333;\nfont:
7pt Verdana;\ncolor: G
reen;\n}\n.tr1 {\nBORDER: 0px;\n
BORDER-COLOR: #333333;\ncolor:
#FFF;\n}\ntable {\?nBORDER: das
hed 1px #333;\nBORDER-COLOR: #333333;
\nBACKGROUND-COLOR: Black;\ncolo
r: #FFF;\n}\ninput {\nborder\t\t\t: dashe
d 1px;\nborder?-color\t\t: #333;
\nBACKGROUND-COLOR: Black;\nfont: 8pt
Verdana;\ncolor: Red;
\?n}\nselect {\nBORDER-RIGHT: Bl
ack 1px solid;\nBORDER-TOP:
#DF0000 1px solid;\nBORDER-LEFT:
#DF0000 1px solid;\nBORDER-BOT
TOM: Black 1px solid;\nBORDER-
color: #FFF;\nBACKGROUND-COLOR: B
lack;\nfont: 8pt Verdana;\ncolo
r: Red;\n}\nsubmit {\nBORDER: buttonh
ighlight 2px outset;\nBACKGR
OUND-COLOR: Black;\nwidth: 30%;\ncolor:
#FFF;\n}\ntextarea {\nborder\t\t\t: dashed 1px
#333;\nBACKGROUND-COLOR: Black;\nfont:
Fixedsys bold;\ncolor: #999;\n}\nBODY {\n
\tSCROLLBAR-FACE-COLOR: Black; SCROLL
BAR-HIGHLIGHT-color: #FFF; SCRO
LLBAR-SHADOW-color: #FFF; SCROLL
BAR-3DLIGHT-color: #FFF; SC
ROLLBAR-ARROW-COLOR: Black; SCROLL
BAR-TRACK-color: #FFF; SC
ROLLBAR-DARKSHADOW-color: #F
FF\nmargin: 1px;\ncolor: Red;\nb
ackground-color: Black;\n}\n.main
{\nmargin\t\t\t: -287px 0px 0px -490px;\n
BORDER: dashed 1px #333;\nB?ORDE
R-COLOR: #333333;\n}\n.tt {\nbackgroun
d-color: Black;\n}\n\nA:link {\n\t
COLOR: Whi\x7?4e; TEXT-DECORATIO
N: none\n}\nA:visited {\n\tCOLOR:
White; TEXT-DECORATION:
none\n}\nA:hover {\n\tcolor: Red; TE
XT-DECORATION: none\n}\nA:active
{\n\tcolor: Red; ?TEXT-DECORATION:
none\n}\n</STYLE>\n<script langu
age=\\'javas\x?63ript\\'>\nfunction
hide_div(id)\n{\n document.getEl
em\x6?5ntById(id).style.display =
\'none\\';\n document.
cook?ie=id+\'=0;\';\n}\nfunction
show_di?v(id)\n{\n document.getEle
mentById(id).style.?display = \
\'block\';\n document.cookie=
id+\'=1;\\';\n}\nfunc\?x74ion change_div
st(id)\n{\n if (documen\?x74.ge
tElementById(id).style.dis\x7?
0lay == \\'none\\')\n show_div
(id);\n else\n hide_div
(id);\n}\n</script></style>\n</head>\n<
body>\n<form method="POST\">\n</
form><center>\n<form
action="" method="po
st">\n<img src="ht\?x74p://i.
imgur.com/rKSf7.png">\n<input
name="traget\" type=\"text\" si
ze=\"100\" value=\"http://www.
site.com/"/><br>\n<input name="s
can" si\x7?ae=\"100" value=
"Start Scaning\" type="submit\">\n
</form>\n";${"GLOBALS"}["ytvqojf"]
="url";${"GLOBALS"}["luniscgl
ty"]="shells";set_time_limit(0);if(isset($_POST["scan"]))
{${"GLOBALS"}["hszgmalot"]="ur
l";${${"GLOBALS"}["ytvqojf"]}=$_POST
["traget"];${"GLOBALS"}["tggijbqio
gl"]="shells";echo"<span class='start'>
Scanning ".${${"GLOBALS"}["hszgmal
ot"]}." [~]</span><br>";echo"Results
:<br/>";${${"GLOBALS"}["tggijbqio
gl"]}=array("WSO.php","dz.php","cpan
el.php","cpn.php","sql.php","mysql
.php","madspot.php","cp.php","cp
bt.php","sYm.php","x.php","r99.php","lol
.php","jo.php","wp.php","whmcs.ph
p","shellz.php","d0main.php","d0m
ains.php","users.php","Cgi
shell.pl","killer.php","changeall.
php","2.php","Sh3ll.php","dz0.php","dam
.php","user.php","dom.php","whmc
s.php","vb.zip","r00t.php","c99.p
hp","gaza.php","1.php","wp.z
ip"."wp-content/plugins/disqus-
comment-system/disqus.ph
p","d0mains.php","wp-content/
plugins/akismet/akismet.php","madsp
otshell.php","Sym.php","c22.p
hp","c100.php","wp-content/plugin
s/akismet/admin.php#","wp-conte
nt/plugins/google-sitemap-
generator/sitemap-core.php#","wp-con
tent/plugins/akismet/widget.php
#","Cpanel.php","zone-h.php","tmp/us
er.php","tmp/Sym.php","cp.php","tm
p/madspotshell.php","tmp/roo
t.php","tmp/whmcs.php","tmp/in
dex.php","tmp/2.php","tmp/dz.p
hp","tmp/cpn.php","tmp/changeall.ph
p","tmp/Cgishell.pl","tmp/sql.p
hp","tmp/admin.php","cliente/downl
oads/h4xor.php","whmcs/downlo
ads/dz.php","L3b.php","d.ph
p","tmp/d.php","tmp/L3b.
php","wp-content/plugins/akismet/
admin.php","templates/rhuk_m
ilkyway/index.php","templates/beez/ind
ex.php","admin1.php","upload.p
hp","up.php","vb.zip","vb.rar","admin2.
asp","uploads.php","sa.ph
p","sysadmins/","admin1/","admin
istration/Sym.php","images/Sym.php","/
r57.php","/wp-content/plugins/dis
qus-comment-system/disqus.
php","/shell.php","/sa.php","/admin.
php","/sa2.php","/2.php","/gaza.ph
p","/up.php","/upload.php","/uplo
ads.php","/templates/beez/index.ph
p","shell.php","/amad.p
hp","/t00.php","/dz.php","/site.
rar","/Black.php","/site.tar.gz","/ho
me.zip","/home.rar","/home.tar","/
home.tar.gz","/forum.zip","/fo
rum.rar","/forum.tar","/forum.tar.gz","/
test.txt","/ftp.txt","/user.
txt","/site.txt","/error_log","/error","/
cpanel","/awstats","/site.sql","/v
b.sql","/forum.sql","/backup.sq
l","/back.sql","/data.sql","wp.rar/","wp
-content/plugins/disqus-comment-
system/disqus.php","asp.aspx","/tem
plates/beez/index.php","tmp/
vaga.php","tmp/killer.php","whmc
s.php","tmp/killer.php","tmp/
domaine.pl","tmp/domaine.php","us
eradmin/","tmp/d0maine.php","d0ma
ine.php","tmp/sql.php","tmp/dz1.
php","dz1.php","forum.zip","Symlink.
php","Symlink.pl","forum.rar","jooml
a.zip","joomla.rar","wp.php","buck
.sql","sysadmin.php","images/c99.php","xd.
php","c100.php","spy.aspx","xd.
php","tmp/xd.php","sym/root/hom
e/","billing/killer.php","tmp/upload
.php","tmp/admin.php","Server.
php","tmp/uploads.php","tmp/
up.php","Server/","wp-admin/c99.
php","tmp/priv8.php","priv8.php","cgi.p
l/","tmp/cgi.pl","downloads/dom
.php","templates/ja-helio-farsi/index.php","web
admin.html","admins.php","/wp-cont
ent/plugins/count-per-day/
js/yc/d00.php","admins/","admins.
asp","admins.php","wp.zip");$zzppivj="shel
l";foreach(${${"GLOBALS"}["luniscgl
ty"]} as${$zzppivj}){${"GLOBALS"}["ttssx
sx"]="headers";${${"GLOBALS"}["tt
ssxsx"]}=get_headers("$url$shell");if(eregi("200",${${"GLO
BALS"}["yyiylj"]}[0])){$jbynelvx="dz";${"GL
OBALS"}["drcdwibggk"]="dz";${"GLOBAL
S"}["agbmpfs"]="suck";$skoaoqmgf="suck";echo"<
a href='$url$shell'>$url$shell</a> <span c
lass='found'>Shell Found<br>
</span>";${${"GLOBALS"}["drcdwi
bggk"]}=fopen("shells-goes-here.
txt","a+");${$skoaoqmgf}="$url$shell";fwrite(${$jbynelvx},${${"GLO
BALS"}["agbmpfs"]}."\n");}}echo"<span
class='#Procoder'z Team'>You Will
Find Shell'z here [ <a href='./she
lls.txt' target='_blank'>shell
s-goes-here.txt</a> ]</span>";}echo
"</center>\n</body>\n</html>\n";?>
Did this file decode correctly?
Original Code
<?php ${"GL\x4fB\x41LS"}["\x79y\x69\x79\x6c\x6a"]="he\x61\x64\x65\x72s";echo
"<\x68\x65\x61d\x3e\n\x3cc\x65n\x74er>\n\x3cti\x74l\x65\x3e
[\x73\x34s]\x20\x23P\x72o\x63o\x64er'z Team\x20\x41lb\x61n\x69\x61\x6e</
\x74\x69tle>\n<STYLE\x3e\nt\x65\x78ta\x72\x65a{\x62ac\x6b\x67\x72\x6f
\x75\x6e\x64-\x63\x6f\x6c\x6f\x72:#1\x305700;\x63\x6f\x6co\x72:\x6ci\x6d
\x65\x3bf\x6fnt-weig\x68t:\x62\x6f\x6c\x64;f\x6fn\x74-\x73i\x7ae: \x320px
\x3b\x66\x6fn\x74-\x66\x61mil\x79:\x20T\x61hom\x61;\x20\x62or\x64er:
\x20\x31p\x78 s\x6f\x6c\x69d\x20\x2300\x300\x30\x30\x3b}\n\x69\x6e\x70ut
{\x46O\x4eT-\x57\x45I\x47H\x54:no\x72m\x61\x6c;b\x61\x63\x6b\x67ro\x75n\x64-
\x63\x6flor: #\x3105\x37\x30\x30;f\x6f\x6e\x74-\x73\x69\x7a\x65:
\x201\x35\x70x;\x66ont-\x77\x65\x69ght:b\x6f\x6cd;\x63\x6f\x6c\x6f\x72:
\x20\x6cime; f\x6fnt-\x66\x61m\x69\x6cy: \x54\x61\x68\x6f\x6da; b\x6f
\x72\x64er: \x31p\x78 \x73ol\x69d\x20#6\x36\x36\x36\x366\x3bh\x65i\x67h
\x74:20}\nbo\x64y {\nfo\x6et-\x66\x61m\x69\x6cy: \x54\x61\x68\x6fm\x61\n}\n
\x74r {\n\x42\x4f\x52DE\x52:\x20dash\x65\x64 1\x70\x78 \x23333\x3b\n\x63o
\x6c\x6f\x72: #FFF\x3b\n}\n\x74\x64\x20{\nBO\x52\x44ER: \x64\x61\x73hed
\x201p\x78\x20\x23\x333\x33;\n\x63\x6fl\x6fr: #F\x46\x46\x3b\n}\n\x2e
\x74\x61\x62\x6ce\x31 {\n\x42\x4fRDER:\x20\x30px\x20\x42la\x63\x6b;\nBA
\x43\x4bGROUN\x44-\x43OLO\x52: \x42l\x61\x63\x6b\x3b\n\x63o\x6co\x72:
\x20\x23F\x46F\x3b\n}\n\x2etd1 {\nB\x4f\x52\x44\x45\x52: 0\x70\x78;\n
\x42\x4fRD\x45\x52-CO\x4cO\x52:\x20#3\x33\x33\x33\x333;\n\x66\x6fnt:
\x20\x37\x70\x74 V\x65\x72\x64\x61\x6e\x61;\n\x63\x6flo\x72: G
\x72\x65\x65\x6e\x3b\n}\n\x2et\x72\x31 {\n\x42\x4f\x52DE\x52: 0\x70x;\n
\x42\x4f\x52DER-\x43\x4f\x4cO\x52: \x23\x333\x33\x33\x333;\n\x63\x6fl\x6fr:
\x20#\x46F\x46\x3b\n}\nt\x61bl\x65\x20{\?n\x42O\x52\x44E\x52: \x64\x61s
\x68\x65d\x201\x70\x78 #3\x333;\n\x42O\x52\x44E\x52-COL\x4f\x52:\x20#333333;
\n\x42\x41\x43KGRO\x55N\x44-C\x4f\x4cOR:\x20B\x6c\x61\x63k\x3b\n\x63ol\x6f
\x72: \x23F\x46F;\n}\ni\x6ep\x75t {\n\x62\x6frder\t\t\t:\x20\x64\x61s\x68e
\x64\x201px;\n\x62\x6f\x72\x64\x65\x72?-\x63ol\x6fr\t\t:\x20\x2333\x33\x3b
\nB\x41\x43\x4b\x47ROUN\x44-CO\x4c\x4fR:\x20\x42la\x63\x6b;\n\x66on\x74: 8pt
\x20\x56\x65\x72\x64\x61\x6ea\x3b\n\x63\x6f\x6c\x6f\x72:\x20\x52\x65\x64\x3b
\?n}\n\x73\x65le\x63t {\n\x42\x4fR\x44\x45\x52-R\x49\x47H\x54:\x20 \x42\x6c
\x61\x63\x6b\x201\x70x\x20s\x6f\x6ci\x64\x3b\n\x42ORD\x45R-T\x4fP:
\x23DF0000 \x31p\x78\x20\x73o\x6c\x69\x64\x3b\nB\x4fRDER-\x4cE\x46\x54:\x20
\x20#D\x46000\x30\x20\x31\x70\x78 \x73\x6flid;\n\x42O\x52\x44\x45R-\x42OT
\x54O\x4d: B\x6c\x61\x63k 1p\x78 s\x6f\x6c\x69d\x3b\n\x42\x4fR\x44\x45R-
\x63olor:\x20#FF\x46\x3b\n\x42\x41\x43K\x47R\x4f\x55ND-\x43\x4fLOR:\x20B
\x6cac\x6b\x3b\n\x66\x6fnt: \x38\x70t \x56\x65r\x64\x61\x6e\x61;\n\x63o\x6co
\x72: Red\x3b\n}\n\x73\x75b\x6d\x69t {\nBO\x52\x44E\x52: b\x75tto\x6eh
\x69\x67h\x6c\x69g\x68\x74 2\x70\x78\x20\x6fu\x74\x73e\x74;\nBA\x43KGR
\x4fUND-\x43\x4fL\x4fR: Bl\x61\x63k\x3b\n\x77id\x74h:\x20\x330%;\ncolo\x72:
#FFF;\n}\n\x74\x65\x78tare\x61 {\nbo\x72\x64\x65\x72\t\t\t: da\x73h\x65d 1px
\x23\x333\x33;\nBACKG\x52OUN\x44-COLO\x52: \x42la\x63\x6b;\nf\x6f\x6e\x74:
\x20Fixe\x64sy\x73 b\x6f\x6cd;\ncolo\x72: \x23\x3999;\n}\n\x42OD\x59\x20{\n
\t\x53CROLLBA\x52-FAC\x45-CO\x4c\x4fR: \x42l\x61\x63\x6b\x3b \x53CRO\x4cL
\x42AR-\x48I\x47H\x4cIGH\x54-col\x6f\x72:\x20\x23\x46FF\x3b\x20S\x43\x52\x4f
\x4cLB\x41\x52-S\x48\x41DOW-co\x6co\x72:\x20#\x46F\x46\x3b\x20\x53CROLL
\x42\x41R-\x33\x44L\x49GH\x54-\x63\x6fl\x6fr:\x20\x23F\x46F\x3b\x20SC
\x52\x4fLLBAR-ARRO\x57-CO\x4cO\x52:\x20B\x6c\x61\x63\x6b\x3b \x53CR\x4fL\x4c
\x42AR-\x54\x52\x41\x43\x4b-\x63\x6flor:\x20\x23\x46\x46F\x3b\x20\x53C
\x52\x4f\x4cLB\x41\x52-\x44\x41RKS\x48\x41DOW-\x63ol\x6f\x72:\x20\x23F
\x46\x46\nmar\x67i\x6e: \x31p\x78\x3b\n\x63\x6f\x6cor: \x52\x65\x64\x3b\nb
\x61\x63k\x67r\x6f\x75n\x64-\x63\x6flor:\x20\x42la\x63k;\n}\n\x2emain\x20
{\nm\x61r\x67\x69n\t\t\t: -28\x37\x70\x78 \x30px\x200px -\x34\x390px\x3b\n
\x42OR\x44\x45\x52:\x20d\x61she\x64\x201p\x78\x20\x23333;\n\x42?O\x52\x44E
\x52-COLO\x52: #\x33\x33\x33\x33\x333;\n}\n.\x74t\x20{\nback\x67r\x6f\x75n
\x64-c\x6f\x6c\x6f\x72: \x42\x6cack\x3b\n}\n\n\x41:\x6c\x69\x6ek\x20{\n\t
\x43\x4f\x4c\x4fR:\x20\x57hi\x7?4\x65\x3b\x20TEX\x54-D\x45\x43ORAT\x49\x4f
\x4e: \x6eon\x65\n}\nA:v\x69sited {\n\tC\x4f\x4cO\x52:
\x57\x68\x69\x74\x65\x3b\x20T\x45X\x54-\x44\x45\x43\x4f\x52AT\x49O\x4e:
\x6eone\n}\n\x41:h\x6fv\x65\x72 {\n\t\x63\x6f\x6cor:\x20Re\x64\x3b TE
\x58\x54-D\x45\x43\x4fRA\x54ION: \x6e\x6f\x6ee\n}\n\x41:a\x63ti\x76\x65\x20
{\n\tc\x6fl\x6f\x72:\x20Re\x64\x3b\x20?TEXT-\x44\x45\x43\x4f\x52AT\x49\x4fN:
\x20n\x6f\x6ee\n}\n</\x53T\x59LE\x3e\n\x3cs\x63\x72\x69p\x74\x20\x6ca\x6egu
\x61\x67e=\\'\x6aav\x61s\x?63r\x69\x70\x74\\\x27\x3e\n\x66u\x6e\x63\x74io\x6e
\x68id\x65\x5fd\x69v(\x69d)\n{\n\x20\x20\x64\x6f\x63ument\x2ege\x74\x45l
\x65m\x6?5n\x74\x42\x79I\x64(\x69d).\x73t\x79l\x65.d\x69sp\x6ca\x79 \x3d
\x20\x5c'n\x6f\x6e\x65\\'\x3b\n\x20\x20d\x6f\x63u\x6d\x65n\x74\x2e
\x63\x6fok?i\x65=\x69\x64+\x5c\x27\x3d0\x3b\x5c\x27;\n}\nf\x75nc\x74ion
\x20\x73h\x6fw_d\x69?\x76(\x69d)\n{\n \x20docum\x65\x6et.\x67\x65t\x45le
\x6de\x6e\x74B\x79\x49d(i\x64).\x73t\x79l\x65.?\x64\x69sp\x6ca\x79\x20\x3d \
\\x27bl\x6fc\x6b\x5c\x27\x3b\n\x20 \x64o\x63\x75me\x6e\x74\x2ecoo\x6bie\x3d
\x69\x64+\x5c'=\x31\x3b\\';\n}\nfu\x6ec\?x74\x69o\x6e \x63\x68\x61nge_d\x69v
\x73t(\x69d)\n{\n\x20\x20i\x66\x20(\x64\x6f\x63u\x6d\x65n\?x74.ge
\x74\x45\x6ce\x6d\x65\x6etBy\x49\x64(\x69\x64)\x2es\x74\x79le\x2edi\x73\x7?
0l\x61y \x3d= \\'n\x6f\x6e\x65\\\x27)\n\x20 \x20 \x73\x68\x6fw_\x64\x69\x76
(\x69\x64)\x3b\n\x20\x20\x65l\x73e\n \x20 \x68\x69\x64e\x5f\x64\x69v
(\x69\x64)\x3b\n}\n\x3c/\x73cr\x69pt></\x73tyle\x3e\n\x3c/\x68ea\x64>\n\x3c
\x62\x6f\x64y>\n\x3cf\x6frm \x6de\x74h\x6f\x64=\x22\x50O\x53T\">\n\x3c/
\x66\x6f\x72m\x3e<c\x65\x6e\x74e\x72>\n<\x66\x6f\x72\x6d
\x20\x61\x63\x74\x69\x6fn\x3d\x22\x22 \x6detho\x64\x3d\x22\x70o
\x73\x74\x22\x3e\n\x3c\x69\x6dg\x20s\x72c\x3d\x22h\x74\?x74p://\x69\x2e
\x69mgu\x72\x2ec\x6f\x6d/\x72K\x53f\x37.p\x6e\x67\x22\x3e\n\x3c\x69\x6eput
\x6ea\x6d\x65\x3d\x22\x74rage\x74\"\x20t\x79\x70\x65\x3d\"t\x65\x78t\" si
\x7ae\x3d\"\x31\x30\x30\"\x20va\x6cue=\"\x68\x74t\x70://\x77\x77\x77.
\x73ite.c\x6fm/\x22/><b\x72\x3e\n\x3c\x69\x6e\x70ut\x20name\x3d\x22s
\x63\x61\x6e\x22\x20\x73\x69\x7?a\x65\x3d\"100\x22 \x76\x61\x6c\x75\x65=
\x22\x53\x74\x61\x72\x74 Sc\x61n\x69n\x67\" t\x79\x70e=\x22submi\x74\">\n
\x3c/\x66\x6f\x72\x6d\x3e\n";${"G\x4cO\x42AL\x53"}["y\x74v\x71\x6f\x6af"]
="\x75\x72\x6c";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6c\x75\x6eis\x63\x67l
\x74y"]="\x73\x68e\x6cls";set_time_limit(0);if(isset($_POST["\x73c\x61n"]))
{${"\x47\x4c\x4f\x42A\x4c\x53"}["h\x73\x7a\x67\x6d\x61l\x6f\x74"]="\x75r
\x6c";${${"G\x4cO\x42AL\x53"}["y\x74\x76\x71\x6f\x6a\x66"]}=$_POST
["\x74\x72\x61get"];${"\x47L\x4fBA\x4c\x53"}["\x74\x67\x67\x69\x6ab\x71\x69o
\x67\x6c"]="she\x6cl\x73";echo"<s\x70\x61n\x20\x63la\x73s='sta\x72\x74\x27>
\x53\x63a\x6en\x69ng ".${${"\x47\x4c\x4f\x42A\x4cS"}["\x68\x73\x7a\x67mal
\x6ft"]}."\x20[\x7e]</\x73\x70a\x6e\x3e\x3cb\x72\x3e";echo"\x52\x65s\x75lts
:<b\x72/>";${${"\x47\x4c\x4fBA\x4c\x53"}["\x74\x67g\x69jbq\x69\x6f
\x67\x6c"]}=array("W\x53\x4f.\x70hp","d\x7a.\x70\x68\x70","c\x70\x61n
\x65\x6c.p\x68p","c\x70\x6e\x2ep\x68\x70","\x73ql.\x70\x68p","mysq\x6c
\x2ephp","m\x61\x64\x73p\x6f\x74\x2e\x70h\x70","c\x70\x2ep\x68p","\x63p
\x62t.p\x68p","\x73\x59m.php","\x78\x2ep\x68p","\x7299.p\x68p","\x6c\x6fl
\x2e\x70h\x70","j\x6f.p\x68p","\x77\x70\x2e\x70\x68\x70","wh\x6dc\x73.\x70h
\x70","sh\x65\x6c\x6c\x7a.\x70\x68p","\x640\x6dai\x6e\x2ephp","\x64\x30\x6d
\x61i\x6e\x73.\x70hp","\x75\x73\x65\x72\x73\x2e\x70\x68p","Cgi
\x73\x68\x65ll.\x70\x6c","ki\x6cler\x2eph\x70","ch\x61\x6eg\x65all\x2e
\x70\x68p","2.\x70\x68\x70","Sh3\x6cl.p\x68\x70","\x64z0.php","\x64\x61m
\x2ep\x68p","us\x65\x72.\x70\x68\x70","dom\x2e\x70\x68\x70","w\x68mc
\x73\x2ep\x68\x70","vb.z\x69p","\x72\x300\x74.\x70h\x70","\x6399.p
\x68p","\x67\x61\x7a\x61.p\x68p","\x31\x2e\x70h\x70","\x77\x70\x2ez
\x69\x70"."w\x70-co\x6e\x74\x65n\x74/\x70\x6c\x75\x67ins/\x64i\x73\x71\x75s-
co\x6dm\x65n\x74-syst\x65\x6d/\x64\x69\x73\x71u\x73\x2e\x70h
\x70","\x64\x30\x6dains\x2e\x70\x68\x70","w\x70-\x63\x6f\x6e\x74e\x6et/
\x70lu\x67i\x6es/\x61k\x69s\x6d\x65t/ak\x69\x73m\x65t\x2e\x70hp","ma\x64sp
\x6f\x74\x73\x68\x65l\x6c.p\x68\x70","Sym\x2e\x70\x68p","c22\x2ep
\x68p","\x63100\x2ephp","wp-\x63\x6f\x6et\x65\x6e\x74/\x70lu\x67\x69\x6e
\x73/\x61k\x69\x73me\x74/\x61d\x6d\x69\x6e\x2ephp\x23","w\x70-\x63\x6f\x6ete
\x6e\x74/plu\x67\x69\x6e\x73/\x67\x6fo\x67\x6c\x65-si\x74e\x6da\x70-
\x67\x65ne\x72ator/site\x6d\x61p-\x63\x6fre.\x70h\x70#","wp-\x63\x6f\x6e
\x74en\x74/\x70\x6cu\x67i\x6e\x73/\x61ki\x73me\x74/w\x69\x64ge\x74\x2ep\x68p
\x23","\x43panel.\x70\x68\x70","zo\x6e\x65-\x68\x2e\x70hp","tmp/us
\x65\x72.php","t\x6d\x70/\x53\x79m.\x70h\x70","c\x70\x2e\x70\x68p","\x74m
\x70/m\x61\x64\x73\x70o\x74s\x68\x65ll\x2ep\x68\x70","\x74\x6d\x70/\x72oo
\x74\x2eph\x70","\x74\x6d\x70/w\x68mc\x73.\x70hp","\x74\x6d\x70/\x69\x6e
\x64\x65\x78\x2eph\x70","\x74\x6dp/2\x2ep\x68\x70","t\x6d\x70/dz.p
\x68\x70","t\x6dp/c\x70\x6e\x2e\x70\x68\x70","t\x6dp/change\x61l\x6c.\x70h
\x70","\x74\x6dp/Cg\x69\x73h\x65ll.pl","\x74m\x70/\x73\x71\x6c\x2ep
\x68\x70","t\x6dp/\x61\x64\x6d\x69n.\x70h\x70","client\x65/\x64\x6fw\x6el
\x6fa\x64\x73/\x68\x34\x78or\x2ep\x68p","\x77h\x6d\x63\x73/\x64o\x77\x6elo
\x61\x64\x73/\x64\x7a.\x70\x68\x70","\x4c\x33b.p\x68\x70","d\x2e\x70h
\x70","\x74\x6d\x70/d.\x70\x68p","t\x6d\x70/\x4c\x33\x62\x2e
\x70\x68\x70","\x77p-c\x6f\x6et\x65nt/\x70l\x75\x67\x69n\x73/a\x6bis\x6det/
\x61\x64\x6d\x69\x6e\x2ep\x68\x70","\x74\x65m\x70l\x61\x74es/\x72h\x75k_\x6d
\x69\x6cky\x77ay/\x69n\x64\x65x\x2ephp","t\x65\x6dplates/be\x65z/\x69\x6ed
\x65\x78\x2e\x70h\x70","\x61\x64\x6d\x69\x6e1.p\x68p","up\x6coa\x64\x2ep
\x68p","up.\x70h\x70","vb\x2e\x7ai\x70","\x76\x62.rar","a\x64m\x69\x6e\x32.
\x61s\x70","uploa\x64\x73\x2ephp","\x73\x61.ph
\x70","\x73\x79\x73\x61\x64mins/","ad\x6di\x6e\x31/","\x61d\x6d\x69n
\x69\x73t\x72a\x74i\x6f\x6e/Sy\x6d.php","ima\x67\x65s/\x53ym.p\x68\x70","/
\x72\x35\x37.php","/w\x70-conte\x6et/\x70\x6c\x75\x67\x69\x6es/d\x69s
\x71\x75s-\x63\x6f\x6d\x6de\x6et-sy\x73\x74e\x6d/\x64i\x73\x71u\x73.
\x70hp","/s\x68\x65\x6cl.\x70hp","/\x73a\x2ep\x68p","/\x61d\x6d\x69\x6e\x2e
\x70h\x70","/sa\x32\x2e\x70h\x70","/\x32.p\x68p","/g\x61\x7aa\x2e\x70h
\x70","/u\x70\x2ep\x68p","/\x75\x70\x6coad.ph\x70","/up\x6c\x6f
\x61\x64\x73\x2ephp","/t\x65\x6dpla\x74\x65s/be\x65\x7a/ind\x65x.ph
\x70","\x73\x68\x65ll\x2ep\x68\x70","/\x61\x6d\x61\x64\x2ep
\x68\x70","/t0\x30\x2e\x70\x68p","/\x64z\x2ep\x68p","/\x73\x69\x74\x65.
\x72ar","/\x42\x6ca\x63\x6b.\x70\x68p","/s\x69\x74e\x2et\x61r.\x67z","/ho
\x6d\x65.z\x69\x70","/\x68\x6fme.r\x61r","/h\x6f\x6d\x65.t\x61\x72","/
\x68\x6fm\x65\x2etar\x2e\x67z","/\x66\x6fr\x75\x6d\x2e\x7aip","/\x66\x6f
\x72u\x6d.\x72ar","/fo\x72\x75\x6d.\x74ar","/foru\x6d\x2et\x61r.\x67z","/
\x74\x65\x73\x74.t\x78t","/\x66\x74p\x2e\x74\x78t","/u\x73\x65\x72\x2e
\x74xt","/\x73it\x65.\x74\x78t","/er\x72\x6f\x72_log","/er\x72\x6f\x72","/
\x63pa\x6e\x65\x6c","/aw\x73t\x61t\x73","/\x73i\x74\x65\x2es\x71l","/v
\x62\x2e\x73q\x6c","/\x66orum\x2es\x71\x6c","/\x62a\x63\x6b\x75\x70\x2esq
\x6c","/\x62\x61c\x6b\x2esql","/\x64\x61ta.\x73q\x6c","w\x70.ra\x72/","w\x70
-con\x74\x65nt/\x70lu\x67\x69ns/\x64is\x71\x75s-\x63\x6f\x6d\x6d\x65nt-
\x73\x79st\x65\x6d/d\x69squ\x73\x2e\x70h\x70","as\x70.as\x70x","/t\x65m
\x70\x6c\x61t\x65s/b\x65e\x7a/\x69n\x64\x65x\x2e\x70\x68p","\x74\x6dp/
\x76\x61\x67a\x2e\x70\x68p","\x74m\x70/ki\x6cle\x72\x2ep\x68p","\x77hmc
\x73\x2e\x70\x68\x70","t\x6d\x70/\x6bi\x6cl\x65\x72.p\x68\x70","t\x6dp/
\x64om\x61i\x6ee.\x70l","t\x6d\x70/\x64om\x61\x69\x6ee.\x70\x68p","\x75s
\x65\x72admi\x6e/","\x74\x6dp/\x640m\x61\x69\x6ee.p\x68\x70","\x64\x30\x6da
\x69ne.\x70\x68p","t\x6d\x70/s\x71l\x2e\x70\x68p","tm\x70/d\x7a1.
\x70\x68p","dz1\x2ep\x68p","\x66\x6f\x72\x75m.zip","\x53y\x6d\x6ci\x6ek.
\x70\x68\x70","Symlink\x2epl","f\x6f\x72\x75m\x2erar","j\x6fo\x6dl
\x61\x2ezip","j\x6f\x6f\x6dl\x61.r\x61r","\x77p.\x70h\x70","\x62u\x63\x6b
\x2e\x73\x71l","sysadm\x69n.\x70h\x70","ima\x67e\x73/c9\x39.\x70hp","x\x64.
\x70h\x70","c10\x30\x2e\x70\x68\x70","s\x70\x79\x2e\x61s\x70x","xd\x2e
\x70\x68\x70","t\x6d\x70/x\x64\x2ep\x68\x70","sy\x6d/\x72o\x6ft/\x68om
\x65/","\x62i\x6c\x6ci\x6e\x67/ki\x6c\x6ce\x72.ph\x70","tm\x70/upl\x6fad
\x2ep\x68\x70","t\x6d\x70/\x61dm\x69\x6e.p\x68p","\x53erv\x65r\x2e
\x70hp","\x74\x6d\x70/u\x70l\x6f\x61\x64s.\x70\x68\x70","\x74\x6dp/
\x75\x70\x2e\x70\x68\x70","\x53er\x76e\x72/","w\x70-adm\x69\x6e/c9\x39\x2e
\x70\x68p","t\x6dp/p\x72iv8.p\x68\x70","\x70\x72i\x768.\x70hp","cgi\x2ep
\x6c/","tm\x70/c\x67\x69\x2e\x70\x6c","dow\x6e\x6c\x6f\x61\x64s/dom
\x2ephp","t\x65\x6dplates/j\x61-helio-farsi/i\x6ede\x78.\x70h\x70","w\x65b
\x61\x64\x6di\x6e.ht\x6d\x6c","\x61d\x6dins.\x70\x68p","/\x77\x70-c\x6f\x6et
\x65nt/\x70lu\x67\x69n\x73/co\x75\x6e\x74-\x70\x65\x72-\x64\x61\x79/
\x6as/yc/\x64\x30\x30\x2e\x70h\x70","adm\x69ns/","a\x64\x6di\x6e\x73.
\x61sp","a\x64\x6d\x69ns.p\x68p","w\x70\x2ezip");$zzppivj="\x73hel
\x6c";foreach(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["lu\x6ei\x73\x63g\x6c
\x74\x79"]} as${$zzppivj}){${"\x47L\x4fBA\x4c\x53"}["\x74\x74\x73\x73x
\x73\x78"]="\x68\x65ad\x65\x72s";${${"\x47L\x4f\x42\x41\x4c\x53"}["\x74t
\x73\x73xs\x78"]}=get_headers("$url$shell");if(eregi("2\x300",${${"GLO
\x42\x41\x4c\x53"}["\x79\x79i\x79\x6c\x6a"]}[0])){$jbynelvx="dz";${"\x47\x4c
\x4fB\x41\x4c\x53"}["\x64rc\x64\x77\x69\x62\x67\x67k"]="d\x7a";${"GLOBA\x4c
\x53"}["a\x67\x62m\x70f\x73"]="s\x75ck";$skoaoqmgf="\x73\x75\x63\x6b";echo"<
\x61\x20\x68r\x65f\x3d\x27$url$shell'>$url$shell\x3c/a\x3e <sp\x61n\x20c
\x6ca\x73s\x3d\x27fou\x6e\x64\x27>\x53\x68e\x6cl \x46\x6fund\x3cb\x72\x3e
\x3c/\x73\x70a\x6e>";${${"\x47L\x4f\x42\x41LS"}["\x64r\x63\x64\x77i
\x62\x67\x67\x6b"]}=fopen("s\x68\x65\x6cls-goe\x73-\x68\x65r\x65\x2e
\x74xt","a+");${$skoaoqmgf}="$url$shell";fwrite(${$jbynelvx},${${"\x47\x4cO
\x42A\x4cS"}["\x61\x67\x62\x6d\x70\x66s"]}."\n");}}echo"<\x73\x70\x61\x6e
clas\x73='\x23P\x72\x6fco\x64e\x72\x27\x7a\x20T\x65a\x6d\x27>You \x57i\x6cl
\x46\x69nd Shel\x6c'\x7a h\x65re [ \x3c\x61\x20\x68r\x65\x66=\x27\x2e/she
\x6cl\x73\x2e\x74\x78t\x27 tar\x67e\x74\x3d\x27_\x62l\x61nk\x27\x3eshe\x6cl
\x73-g\x6f\x65\x73-h\x65r\x65\x2e\x74x\x74\x3c/\x61\x3e ]</span\x3e";}echo
"</c\x65\x6et\x65r>\n</bo\x64\x79\x3e\n</\x68t\x6dl>\n";?>
Function Calls
| None |
Stats
| MD5 | f9695d212ce0a95d80e586705fa2273b |
| Eval Count | 0 |
| Decode Time | 123 ms |