2015-08-04

PHP function_exists("T7FC56270E7A70FA81A5935B72EACBE29")) decoding!

Via this script you can decode PHP file that begin with this signature:

PHP function_exists("T7FC56270E7A70FA81A5935B72EACBE29") ...
Enjoy! 



  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
<style type="text/css">
*{
background-color: lightblue;

border-radius: 8px 8px 8px 8px;
margin-bottom: 5px;
padding: 5px;
}
TD{font-family: Tahoma; font-size: 10pt;}
input,select,textarea{
border:0;
border:1px solid #900;
color:#fff;
background:#000;
margin:0;
padding:2px 4px;
}
input:hover,textarea:hover,select:hover{
background:#200;
border:1px solid #f00;
}


.red{
color:#f00;
}
.white{
color:#fff;
}
a{
text-decoration:none;
}
a:hover{
border-bottom:1px solid #900;
border-top:1px solid #900;
}
#result a{
color:#777;
}
.sign{
color:#222;
}
#box{
margin:10px 0 0 0;
}
</style>

<html>
<body>
<center><br>
<title>PHP function_exists("T7FC56270E7A70FA81A5935B72EACBE29")) decoder by 3H34N</title>
<font size='3'>PHP function_exists("T7FC56270E7A70FA81A5935B72EACBE29")) decoder by 3H34N</font><br><br>
<font size='3'>WebSite:<b><a href="http://nezami.info">nezami.info</a></b><br/></font><br/>
<form name="form" method="post">
<textarea name="code" cols=100 rows=20></textarea>
<br/>
<div class="submit"><br>
<input alt="Submit" title="Send" type="image"><br>
</div>
</form>
<center>
</body>
</html>
<?php
if( isset($_POST['code']) )
{
$subject = $_POST['code'];
$subject=stripslashes($subject);
$pattern = '/eval\\(T7FC56270E7A70FA81A5935B72EACBE29\\("/';
$limit = -1;
$flags = PREG_SPLIT_NO_EMPTY;
$result = preg_split ($pattern, $subject, $limit, $flags);
$resultall= substr($result[1], 0, -8);

if (!function_exists("fn"))  {
   function fn($arg)   {
 $arg = base64_decode($arg);
 $fn = 0;
 $i = 0;
 $j = 0;
 $k = (ord($arg[1]) << 8) + ord($arg[2]);
 $l = 3;
 $m = 0;
 $n = 16;
 $o = "";
 $p = strlen($arg);
 $file = __FILE__;
 $file = file_get_contents($file);
 for (;$l<$p;){
  if ($n == 0){
    $k = (ord($arg[$l++]) << 8);
    $k += ord($arg[$l++]);
    $n = 16;
  }
  if ($k & 0x8000){
   $fn = (ord($arg[$l++]) << 4);
   $fn += (ord($arg[$l]) >> 4);
    if ($fn){
     $i = (ord($arg[$l++]) & 0x0F) + 3;
     for ($j = 0; $j < $i; $j++)
     $o[$m+$j] = $o[$m-$fn+$j];
     $m += $i;
    }else{
     $i = (ord($arg[$l++]) << 8);
     $i += ord($arg[$l++]) + 16;
     for ($j = 0; $j < $i; $o[$m+$j++] = $arg[$l]);
      $l++; $m += $i;
    }
  }
  else $o[$m++] = $arg[$l++];
   $k <<= 1;
   $n--;
  if ($l == $p){
   $file = implode("", $o);
   $file = "?".">".$file."<"."?";
   return $file;
  }
 }
}
}
print 'clear text code: <br/><textarea cols=100 rows=20>'.substr(fn($resultall),2,-2);'</textarea><br/>';
}
?>


No comments:
Subscribe to: Posts (Atom)