Skip to content

Instantly share code, notes, and snippets.

@goesredy
Forked from yireo/evaldecode.php
Created September 25, 2016 02:20
Show Gist options
  • Save goesredy/2374535741900d8b352c75f8969f82b8 to your computer and use it in GitHub Desktop.
Save goesredy/2374535741900d8b352c75f8969f82b8 to your computer and use it in GitHub Desktop.
Decode evil scripts encoded with eval(gzinflate(base64_decode()))
<?php
/*
* Basic script to decrypt files encoded with eval(gzinflate(base64_decode($data)));
*/
$file = 'encrypted.php';
$content = file_get_contents($file);
function evaldecode($content, $step = 0) {
//echo "STEP $step\n";
$step++;
if(preg_match('/^eval\(/', $content)) {
$content = str_replace('eval(', 'print(', $content);
ob_start();
eval($content);
$content = ob_get_contents();
ob_end_clean();
}
$content = trim($content);
if(preg_match('/^eval\(/', $content)) {
$content = evaldecode($content, $step);
}
return $content;
}
echo evaldecode($content)."\n";
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment