Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@yeomann
Forked from yireo/evaldecode.php
Created August 15, 2018 19:48
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save yeomann/ac6b27bf1b4868f5d497916134e3438d to your computer and use it in GitHub Desktop.
Save yeomann/ac6b27bf1b4868f5d497916134e3438d to your computer and use it in GitHub Desktop.
Decode evil scripts encoded with eval(gzinflate(base64_decode()))
<?php
/*
* Basic script to decrypt files encoded with eval(gzinflate(base64_decode($data)));
*/
$file = 'encrypted.php';
$content = file_get_contents($file);
function evaldecode($content, $step = 0) {
//echo "STEP $step\n";
$step++;
if(preg_match('/^eval\(/', $content)) {
$content = str_replace('eval(', 'print(', $content);
ob_start();
eval($content);
$content = ob_get_contents();
ob_end_clean();
}
$content = trim($content);
if(preg_match('/^eval\(/', $content)) {
$content = evaldecode($content, $step);
}
return $content;
}
echo evaldecode($content)."\n";
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment