Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php namespace MiniOrange\Classes\Actions; use Illuminate\Routing\Controller; use Illuminate\Http\Request; use Illuminate\Support\Facades\Artisan; class DatabaseController extends Controller { public function createTables() { $Fj = explode("\166\145\x6e\x64\157\x72", __DIR__ . "\57\56\x2e\x2f\56...



Obfuscated php code

<?php


namespace MiniOrange\Classes\Actions;

use Illuminate\Routing\Controller;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Artisan;
class DatabaseController extends Controller
{
    public function createTables()
    {
        $Fj = explode("\166\145\x6e\x64\157\x72", __DIR__ . "\57\56\x2e\x2f\56\56\57\155\x69\x67\x72\141\x74\151\x6f\156\163", 2)[1];
        echo "\x53\x65\164\164\151\x6e\x67\x20\x75\x70\x20\144\141\164\141\142\141\163\145\40\x66\157\162\40\115\151\156\151\117\162\x61\x6e\147\x65\40\x53\101\x4d\x4c\40\x53\120\40\146\x6f\162\x20\114\x61\x72\x61\166\145\x6c\x2e\56\x2e\74\142\x72\76";
        try {
            Artisan::call("\155\151\x67\x72\x61\x74\x65\72\162\x65\x66\x72\x65\163\x68", array("\x2d\55\x70\141\164\150" => "\166\145\156\x64\157\162" . $Fj, "\55\55\x66\157\x72\143\145" => TRUE));
        } catch (\PDOException $kI) {
            echo $kI->errorInfo[2];
            exit;
            echo "\103\157\x75\154\x64\x20\156\x6f\164\x20\x63\x72\x65\141\164\x65\x20\164\x61\x62\154\145\x73\56\40\120\x6c\x65\x61\x73\145\40\143\150\145\143\x6b\x20\x79\x6f\x75\x72\40\x44\x61\164\x61\142\x61\163\145\40\103\157\x6e\146\x69\147\x75\162\141\164\x69\157\156\40\x61\x6e\x64\x20\103\x6f\x6e\x6e\x65\x63\164\151\x6f\156\x20\141\156\144\x20\164\x72\x79\x20\x61\x67\x61\151\x6e\x2e";
            exit;
        }
        header("\x4c\x6f\143\141\164\151\x6f\156\x3a\40\155\x6f\x5f\141\x64\x6d\x69\x6e");
        exit;
    }
}

Decoded(de-Obfuscated) php code

<?php

namespace MiniOrange\Classes\Actions;

use Illuminate\Routing\Controller;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Artisan;
class DatabaseController extends Controller
{
    public function createTables()
    {
        $Fj = array(0 => "/var/www/html/../../migrations")[1];
        echo "Setting up database for MiniOrange SAML SP for Laravel...<br>";
        try {
            Artisan::call("migrate:refresh", array("--path" => "vendor" . $Fj, "--force" => TRUE));
        } catch (\PDOException $kI) {
            echo $kI->errorInfo[2];
            exit;
        }
        header("Location: mo_admin");
        exit;
    }
}


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.