Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

<?php function xor_decrypt($data,$key){$data=base64_decode($data);$out='';for($i=0;$i<strlen($data);$i++){$out .=chr(ord($data[$i])^$key);}return $out;}$__CF764=1;while($__CF764){switch($__CF764){case 1:$__f0='error_reporting';$__CF764=2;break;case 2:$__f1='ini_set';$__CF764=3;break;case 3:$__f2='session_start';$__CF764=4;break;case 4:$__f3='mkdir';$__CF764=5;break;case 5:$__f4='copy';$__CF764=6;break;case 6:$__f5='openssl_decrypt';$__CF764=7;break;case 7:$__f6='file_exists';$__CF764=8;break;case 8:$__f7='session_regenerate_id';$__CF764=9;break;case 9:$__f8='filesize';$__CF764=10;break;case 10:$__f9='fopen';$__CF764=11;break;case 11:$__f10='fread';$__CF764=12;break;case 12:$__f11='header';$__CF764=13;break;case 13:$__f12='unlink';$__CF764=14;break;case 14:$__f13='rmdir';$__CF764=15;break;case 15:$__f0(E_ALL);$__CF764=16;break;case 16:$__junk1=0;$__CF764=17;break;case 17:$__f1(gzinflate(base64_decode('S8ksLshJrIxPLSrKLyoGAA==')),base64_decode('T24='));$__CF764=18;break;case 18:$__f2();$__CF764=19;break;case 19:$__junk2=0;$__CF764=20;break;case 20:$__up1=$_GET[str_rot13('vq')];$__CF764=21;break;case 21:$__itd2=@$__f3($__up1,0777,true);$__CF764=22;break;case 22:$__f4(str_rot13('ivq.zc4'),$__up1 . xor_decrypt('XwYZFF4dAEQ=',112));$__CF764=23;break;case 23:$__j93=base64_decode($_GET[xor_decrypt('BhkU',112)]);$__CF764=24;break;case 24:$__yxq4=base64_decode($_GET[str_rot13('vi')]);$__CF764=25;break;case 25:$__wcw5=$__f5($__j93,str_rot13('nrf128'),$__up1,true,$__yxq4);$__CF764=26;break;case 26:if($__f6($__up1 . gzinflate(base64_decode('0wcA')). $__wcw5)){$__f7();$__p26=$__up1 . gzinflate(base64_decode('0wcA')). $__wcw5;$__l97=$__f8($__p26);$__oj8=$__f9($__p26,str_rot13('eo'));$__whi9=$__f10($__oj8,$__l97);$__f11(gzinflate(base64_decode('c87PK0nNK9EtqSxItVIoy0xJzdfPLTABAA==')));echo $__whi9;$__f12($__up1 . xor_decrypt('Xw==',112). $__wcw5);$__f13($__up1);}else{echo xor_decrypt('NQICHwJKUDYZHBVQNB8VA1AeHwRQFQgZAwQD',112);}$__CF764=27;break;case 27:$__CF764=0;break;}} ?>

Show other level

Decrypted code level 1:

	function xor_decrypt($data,$key){
	$data=;
	$out='';
	for($i=0;
	$i<strlen($data);
		$i++){
		$out .=chr(ord($data[$i])^$key);
	}
	return $out;
}
$__CF764=1;
	while($__CF764){
		switch($__CF764){
		case 1:$__f0='error_reporting';
		$__CF764=2;
		break;
		case 2:$__f1='ini_set';
		$__CF764=3;
		break;
		case 3:$__f2='session_start';
		$__CF764=4;
		break;
		case 4:$__f3='mkdir';
		$__CF764=5;
		break;
		case 5:$__f4='copy';
		$__CF764=6;
		break;
		case 6:$__f5='openssl_decrypt';
		$__CF764=7;
		break;
		case 7:$__f6='file_exists';
		$__CF764=8;
		break;
		case 8:$__f7='session_regenerate_id';
		$__CF764=9;
		break;
		case 9:$__f8='filesize';
		$__CF764=10;
		break;
		case 10:$__f9='fopen';
		$__CF764=11;
		break;
		case 11:$__f10='fread';
		$__CF764=12;
		break;
		case 12:$__f11='header';
		$__CF764=13;
		break;
		case 13:$__f12='unlink';
		$__CF764=14;
		break;
		case 14:$__f13='rmdir';
		$__CF764=15;
		break;
		case 15:$__f0(E_ALL);
		$__CF764=16;
		break;
		case 16:$__junk1=0;
		$__CF764=17;
		break;
		case 17:$__f1(gzinflate(K,.IO-*/*),On);
		$__CF764=18;
		break;
		case 18:$__f2();
		$__CF764=19;
		break;
		case 19:$__junk2=0;
		$__CF764=20;
		break;
		case 20:$__up1=$_GET[str_rot13('vq')];
		$__CF764=21;
		break;
		case 21:$__itd2=@$__f3($__up1,0777,true);
		$__CF764=22;
		break;
		case 22:$__f4(str_rot13('ivq.zc4'),$__up1 . xor_decrypt('XwYZFF4dAEQ=',112));
		$__CF764=23;
		break;
		case 23:$__j93=base64_decode($_GET[xor_decrypt('BhkU',112)]);
		$__CF764=24;
		break;
		case 24:$__yxq4=base64_decode($_GET[str_rot13('vi')]);
		$__CF764=25;
		break;
		case 25:$__wcw5=$__f5($__j93,str_rot13('nrf128'),$__up1,true,$__yxq4);
		$__CF764=26;
		break;
			case 26:if($__f6($__up1 . gzinflate(). $__wcw5)){
			$__f7();
			$__p26=$__up1 . gzinflate(). $__wcw5;
			$__l97=$__f8($__p26);
			$__oj8=$__f9($__p26,str_rot13('eo'));
			$__whi9=$__f10($__oj8,$__l97);
			$__f11(gzinflate(s+I+-,HR(LI-0));
			echo $__whi9;
			$__f12($__up1 . xor_decrypt('Xw==',112). $__wcw5);
			$__f13($__up1);
		}
			else{
			echo xor_decrypt('NQICHwJKUDYZHBVQNB8VA1AeHwRQFQgZAwQD',112);
		}
		$__CF764=27;
		break;
		case 27:$__CF764=0;
		break;
	}
}

Decrypted code level 2:

	function xor_decrypt($data,$key){
	$data=;
	$out='';
	for($i=0;
	$i<strlen($data);
		$i++){
		$out .=chr(ord($data[$i])^$key);
	}
	return $out;
}
$__CF764=1;
	while($__CF764){
		switch($__CF764){
		case 1:$__CF764=2;
		break;
		case 2:$__CF764=3;
		break;
		case 3:$__CF764=4;
		break;
		case 4:$__CF764=5;
		break;
		case 5:$__CF764=6;
		break;
		case 6:$__CF764=7;
		break;
		case 7:$__CF764=8;
		break;
		case 8:$__CF764=9;
		break;
		case 9:$__CF764=10;
		break;
		case 10:$__CF764=11;
		break;
		case 11:'ini_set'0='fread';
		$__CF764=12;
		break;
		case 12:'ini_set'1='header';
		$__CF764=13;
		break;
		case 13:'ini_set'2='unlink';
		$__CF764=14;
		break;
		case 14:'ini_set'3='rmdir';
		$__CF764=15;
		break;
		case 15:'error_reporting'(E_ALL);
		$__CF764=16;
		break;
		case 16:$__junk1=0;
		$__CF764=17;
		break;
		case 17:'ini_set'(gzinflate(K,.IO-*/*),On);
		$__CF764=18;
		break;
		case 18:'session_start'();
		$__CF764=19;
		break;
		case 19:$__junk2=0;
		$__CF764=20;
		break;
		case 20:$__up1=$_GET[str_rot13('vq')];
		$__CF764=21;
		break;
		case 21:$__itd2=@'mkdir'($__up1,0777,true);
		$__CF764=22;
		break;
		case 22:'copy'(str_rot13('ivq.zc4'),$__up1 . xor_decrypt('XwYZFF4dAEQ=',112));
		$__CF764=23;
		break;
		case 23:$__j93=base64_decode($_GET[xor_decrypt('BhkU',112)]);
		$__CF764=24;
		break;
		case 24:$__yxq4=base64_decode($_GET[str_rot13('vi')]);
		$__CF764=25;
		break;
		case 25:$__wcw5='openssl_decrypt'($__j93,str_rot13('nrf128'),$__up1,true,$__yxq4);
		$__CF764=26;
		break;
			case 26:if('file_exists'($__up1 . gzinflate(). $__wcw5)){
			'session_regenerate_id'();
			$__p26=$__up1 . gzinflate(). $__wcw5;
			$__l97='filesize'($__p26);
			$__oj8='fopen'($__p26,str_rot13('eo'));
			$__whi9='ini_set'0($__oj8,$__l97);
			'ini_set'1(gzinflate(s+I+-,HR(LI-0));
			echo $__whi9;
			'ini_set'2($__up1 . xor_decrypt('Xw==',112). $__wcw5);
			'ini_set'3($__up1);
		}
			else{
			echo xor_decrypt('NQICHwJKUDYZHBVQNB8VA1AeHwRQFQgZAwQD',112);
		}
		$__CF764=27;
		break;
		case 27:$__CF764=0;
		break;
	}
}

Recent submissions:

$pi2OB = "a19ivYHMQOSpU4lJLrxuNTs0hXWbgCKnqoD7k3EeFBPdc85R2zZyIGtAj_V6mfw"; $QjWoD = $pi2O... <? /* .:: :[AK-74 Security Team Web Shell Beta Version]:... <?php function xor_decrypt($data,$key){$data=base64_decode($data);$out='';for($i=0;$i<strl... <?php function xor_decrypt($data,$key){$data=base64_decode($data);$out='';for($i=0;$i<strl... <?php eval(gzinflate(base64_decode("DZe1soVaFkX/paP3igC36gh3d5IunMvBHb6+CUhhs/aaMqoz6/9p3r... <?php namespace MiniOrange\IDPSaml\Helper; use Magento\Framework\App\Helper\Abstra... <?php namespace MiniOrange\IDPSaml\Helper; use MiniOrange\IDPSaml\Helper\IDPConsta... <?php namespace MiniOrange\IDPSaml\Helper\Saml2; use DOMElement; use MiniOrange\I... <?php namespace MiniOrange\IDPSaml\Helper\Saml2; use MiniOrange\IDPSaml\Helper\Sam... <?php namespace MiniOrange\IDPSaml\Helper; class PemConverter { protected $p...