For more detailed look here :
<?php //MS4w /* --------------------------------------------------------------------------------- - PHP Encoding by TeleAgent.IR - ResellerCenter.IR - - PHP Encoder Version : 1.0 - - This code was created on : 2018/10/01 at 13:00 - - Checksum : 6fj65a682a445d8cb5734720ed67dae2 - ---------------------------------------------------------------------------------- */ $_CLHHKEE=__FILE__;$_NQRSZPKB=__LINE__;$_CHDAOJMPYXT=__DIR__ ;$_FNMHVDO=__FUNCTION__; function I1IIIIIII11I1II() {return __CLASS__;}function I1IIIIIII() {return __LINE__;} $_CSYPWGZ=__CLASS__;$_TTBLNSD=__TRAIT__ ;$_MDGRSQS=__METHOD__ ;$_NEVYW=__NAMESPACE__; function I1IIIIIII1II() {return __FUNCTION__;}function I1I1IIII() {return __TRAIT__;} function I1IIIIIII11I11II() {return __FILE__;}function I1III1IIII() {return __DIR__;} function I1III11I1I() {return __METHOD__;}function I1II1III() {return __NAMESPACE__;} $_QXXCZD="\142\141\163\x65\x36\64\137\144\145\x63\157\x64\145";@echo("?>".$_QXXCZD("PD9waHAgJF9.
Download script
To execute this script, just execute it and give it your path.
Enjoy.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | ''' File name: PHP Decoder "Encoding by TeleAgent.IR - ResellerCenter.IR".py Author: Ehsan Nezami Date created: 19/11/2018 Web: http://nezami.me/ Python Version: 2.7 ''' import os import re import base64 import zlib def listFiles(path, extension): return [f for f in os.listdir(path) if f.endswith(extension)] path_name = raw_input("What is your path of php files? \n Example : C:\\files\\ \n ") for files in listFiles(path_name, '.php'): print files start = '$_QXXCZD("' end = '"));' f=open(files,'r') for input in f.readlines(): data= re.findall(re.escape(start)+"(.*)"+re.escape(end),input) for x in data: x=base64.b64decode(x) start1 = '.$_ZUI("' end1 = '"));' data1= re.findall(re.escape(start1)+"(.*)"+re.escape(end1),x) for x1 in data1: x1=base64.b64decode(x1) start2 = '$_IRRGRHMF("' end2 = '"));' data2= re.findall(re.escape(start2)+"(.*)"+re.escape(end2),x1) for x2 in data2: x2=base64.b64decode(x2) start3 = '$_EFTYPYA("' end3 = '"));' data3= re.findall(re.escape(start3)+"(.*)"+re.escape(end3),x2) for x3 in data3: x3=base64.b64decode(x3) start4 = '$_AOKDOJCRH("' end4 = '"));' data4= re.findall(re.escape(start4)+"(.*)"+re.escape(end4),x3) for x4 in data4: x4=base64.b64decode(x4) start5 = '$_NZHLDCOUMASYWHUKYETFVEDDJELK("' end5 = '")));' data5= re.findall(re.escape(start5)+"(.*)"+re.escape(end5),x4) for x5 in data5: compressed = base64.b64decode(x5) decoded=zlib.decompress(compressed, -15) print decoded output=file('dec-'+files,'a') output.write(decoded) |
No comments:
Post a Comment