Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $my_sucuri_encoding = " JFNVQ1VSSVBXRD0iYWZhZjVhNDkwNDRiNGIwODhlYjNjYzRiNDhlNjk1O..

Decoded Output download

$SUCURIPWD="afaf5a49044b4b088eb3cc4b48e6958ce917d424";
$URL="b13356927a5ad7c8720df285be781a64";
/* Sucuri clean up scripts for sites on shared hosts. 
 * Copyright (C) 2010, 2011, 2012 Sucuri, LLC
 * Do not distribute or share.
 */

echo "<pre>";
if(!function_exists('curl_exec') || isset($_GET['nocurl']))
{

    $postdata = http_build_query(
        array(
            'p' => $SUCURIPWD,
            )
        );

    $opts = array('http' =>
        array(
            'method'  => 'POST',
            'header'  => 'Content-type: application/x-www-form-urlencoded',
            'content' => $postdata
        )
    );

    $context = stream_context_create($opts);
    $my_sucuri_encoding = file_get_contents("https://support.sucuri.net/sig.php?u=$URL", false, $context);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
        echo "OK: Connected to Sucuri (via file_get) and running the cleanup.
";
    }
    else
    {
        echo "ERROR: Unable to clean (missing curl support and file_get failed). Please escalate ticket for manual review.
";
        exit(1);
    }
}

else
{

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "https://support.sucuri.net/sig.php?u=$URL");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "p=$SUCURIPWD"); 
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

    $my_sucuri_encoding = curl_exec($ch);
    curl_close($ch);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
        echo "OK: Connected to Sucuri and running the cleanup.
";
    }
    else
    {
        echo "FAILED to run: $my_sucuri_encoding
";
        echo "ERRRO: Unable to clean. Please try to upload the scripts again.
";
        exit(1);
    }
}


$my_sucuri_encoding =  base64_decode(
                                          substr($my_sucuri_encoding, 7));


eval(
       $my_sucuri_encoding
    );

echo "</pre>";

Did this file decode correctly?

Original Code

<?php $my_sucuri_encoding = "

JFNVQ1VSSVBXRD0iYWZhZjVhNDkwNDRiNGIwODhlYjNjYzRiNDhlNjk1OGNlOTE3ZDQyNCI7CiRV
Ukw9ImIxMzM1NjkyN2E1YWQ3Yzg3MjBkZjI4NWJlNzgxYTY0IjsKLyogU3VjdXJpIGNsZWFuIHVw
IHNjcmlwdHMgZm9yIHNpdGVzIG9uIHNoYXJlZCBob3N0cy4gCiAqIENvcHlyaWdodCAoQykgMjAx
MCwgMjAxMSwgMjAxMiBTdWN1cmksIExMQwogKiBEbyBub3QgZGlzdHJpYnV0ZSBvciBzaGFyZS4K
ICovCgplY2hvICI8cHJlPiI7CmlmKCFmdW5jdGlvbl9leGlzdHMoJ2N1cmxfZXhlYycpIHx8IGlz
c2V0KCRfR0VUWydub2N1cmwnXSkpCnsKCiAgICAkcG9zdGRhdGEgPSBodHRwX2J1aWxkX3F1ZXJ5
KAogICAgICAgIGFycmF5KAogICAgICAgICAgICAncCcgPT4gJFNVQ1VSSVBXRCwKICAgICAgICAg
ICAgKQogICAgICAgICk7CgogICAgJG9wdHMgPSBhcnJheSgnaHR0cCcgPT4KICAgICAgICBhcnJh
eSgKICAgICAgICAgICAgJ21ldGhvZCcgID0+ICdQT1NUJywKICAgICAgICAgICAgJ2hlYWRlcicg
ID0+ICdDb250ZW50LXR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCcsCiAg
ICAgICAgICAgICdjb250ZW50JyA9PiAkcG9zdGRhdGEKICAgICAgICApCiAgICApOwoKICAgICRj
b250ZXh0ID0gc3RyZWFtX2NvbnRleHRfY3JlYXRlKCRvcHRzKTsKICAgICRteV9zdWN1cmlfZW5j
b2RpbmcgPSBmaWxlX2dldF9jb250ZW50cygiaHR0cHM6Ly9zdXBwb3J0LnN1Y3VyaS5uZXQvc2ln
LnBocD91PSRVUkwiLCBmYWxzZSwgJGNvbnRleHQpOwoKICAgIGlmKHN0cm5jbXAoJG15X3N1Y3Vy
aV9lbmNvZGluZywgIldPUktFRDoiLDcpID09IDApCiAgICB7CiAgICAgICAgZWNobyAiT0s6IENv
bm5lY3RlZCB0byBTdWN1cmkgKHZpYSBmaWxlX2dldCkgYW5kIHJ1bm5pbmcgdGhlIGNsZWFudXAu
XG4iOwogICAgfQogICAgZWxzZQogICAgewogICAgICAgIGVjaG8gIkVSUk9SOiBVbmFibGUgdG8g
Y2xlYW4gKG1pc3NpbmcgY3VybCBzdXBwb3J0IGFuZCBmaWxlX2dldCBmYWlsZWQpLiBQbGVhc2Ug
ZXNjYWxhdGUgdGlja2V0IGZvciBtYW51YWwgcmV2aWV3LlxuIjsKICAgICAgICBleGl0KDEpOwog
ICAgfQp9CgplbHNlCnsKCiAgICAkY2ggPSBjdXJsX2luaXQoKTsKICAgIGN1cmxfc2V0b3B0KCRj
aCwgQ1VSTE9QVF9VUkwsICJodHRwczovL3N1cHBvcnQuc3VjdXJpLm5ldC9zaWcucGhwP3U9JFVS
TCIpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCB0cnVlKTsK
ICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9QT1NULCB0cnVlKTsKICAgIGN1cmxfc2V0b3B0
KCRjaCwgQ1VSTE9QVF9QT1NURklFTERTLCAicD0kU1VDVVJJUFdEIik7IAogICAgY3VybF9zZXRv
cHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CgogICAgJG15X3N1Y3VyaV9l
bmNvZGluZyA9IGN1cmxfZXhlYygkY2gpOwogICAgY3VybF9jbG9zZSgkY2gpOwoKICAgIGlmKHN0
cm5jbXAoJG15X3N1Y3VyaV9lbmNvZGluZywgIldPUktFRDoiLDcpID09IDApCiAgICB7CiAgICAg
ICAgZWNobyAiT0s6IENvbm5lY3RlZCB0byBTdWN1cmkgYW5kIHJ1bm5pbmcgdGhlIGNsZWFudXAu
XG4iOwogICAgfQogICAgZWxzZQogICAgewogICAgICAgIGVjaG8gIkZBSUxFRCB0byBydW46ICRt
eV9zdWN1cmlfZW5jb2RpbmdcbiI7CiAgICAgICAgZWNobyAiRVJSUk86IFVuYWJsZSB0byBjbGVh
bi4gUGxlYXNlIHRyeSB0byB1cGxvYWQgdGhlIHNjcmlwdHMgYWdhaW4uXG4iOwogICAgICAgIGV4
aXQoMSk7CiAgICB9Cn0KCgokbXlfc3VjdXJpX2VuY29kaW5nID0gIGJhc2U2NF9kZWNvZGUoCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN1YnN0cigkbXlfc3VjdXJp
X2VuY29kaW5nLCA3KSk7CgoKZXZhbCgKICAgICAgICRteV9zdWN1cmlfZW5jb2RpbmcKICAgICk7
CgplY2hvICI8L3ByZT4iOwo=
";
$my_sucuri_encoding =  base64_decode($my_sucuri_encoding);
eval($my_sucuri_encoding);

Function Calls

base64_decode 1

Variables

$my_sucuri_encoding $SUCURIPWD="afaf5a49044b4b088eb3cc4b48e6958ce917d424"; $URL=..

Stats

MD5 fc3bd8397ef49198995a5f1087ddafc6
Eval Count 1
Decode Time 235 ms