Skip to content

Instantly share code, notes, and snippets.

@yashodhank
Forked from yireo/evaldecode.php
Created March 6, 2022 01:10
Show Gist options
  • Save yashodhank/4b2734d5d8d867f7c4fefb1c9866d205 to your computer and use it in GitHub Desktop.
Save yashodhank/4b2734d5d8d867f7c4fefb1c9866d205 to your computer and use it in GitHub Desktop.
Decode evil scripts encoded with eval(gzinflate(base64_decode()))
<?php
/*
* Basic script to decrypt files encoded with eval(gzinflate(base64_decode($data)));
*/
$file = 'encrypted.php';
$content = file_get_contents($file);
function evaldecode($content, $step = 0) {
//echo "STEP $step\n";
$step++;
if(preg_match('/^eval\(/', $content)) {
$content = str_replace('eval(', 'print(', $content);
ob_start();
eval($content);
$content = ob_get_contents();
ob_end_clean();
}
$content = trim($content);
if(preg_match('/^eval\(/', $content)) {
$content = evaldecode($content, $step);
}
return $content;
}
echo evaldecode($content)."\n";
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment