fork download
copy 
  1. <?php
  2. /* Sucuri integrity monitor
  3.  * Integrity checking and server side scanning.
  4.  *
  5.  * Copyright (C) 2010, 2011, 2012 Sucuri, LLC
  6.  * http://s...content-available-to-author-only...i.net
  7.  * Do not distribute or share.
  8.  */
  9.  
  10. $MYMONITOR = "monitor13";
  11. $my_sucuri_encoding = "
  12.  
  13.  
  14.  
  15. LyogU3VjdXJpIGludGVncml0eSBtb25pdG9yIC4gCiAqIENvbm5lY3RzIGJhY2sgaG9tZS4KICog
  16. Q29weXJpZ2h0IChDKSAyMDEwLTIwMTMgU3VjdXJpLCBMTEMKICogRG8gbm90IGRpc3RyaWJ1dGUg
  17. b3Igc2hhcmUuCiAqLwoKCiRTVUNVUklQV0QgPSAiNTM1ZTI2ZWIwZjMzMjRlODA1NmZlNjk1NDk3
  18. NmIwNGM2MmViOTc3ZjJjYzUxIjsKCgppZihpc3NldCgkX0dFVFsndGVzdCddKSkKewogICAgZWNo
  19. byAiT0s6IFN1Y3VyaTogRm91bmRcbiI7CiAgICBleGl0KDApOwp9CgoKCi8qIFZhbGlkIGFyZ3Vt
  20. ZW50LiAqLwppZighaXNzZXQoJF9HRVRbJ3J1biddKSkKewogICAgZXhpdCgwKTsKfQoKCi8qIE11
  21. c3QgaGF2ZSBhbiBJUCBhZGRyZXNzLiAqLwppZighaXNzZXQoJF9TRVJWRVJbJ1JFTU9URV9BRERS
  22. J10pKQp7CiAgICBleGl0KDApOwp9Cgokb3JpZ3JlbW90ZWlwID0gJF9TRVJWRVJbJ1JFTU9URV9B
  23. RERSJ107CgovKiBJZiBjb21pbmcgZnJvbSBjbG91ZGZsYXJlOiAqLwppZihpc3NldCgkX1NFUlZF
  24. UlsnSFRUUF9DRl9DT05ORUNUSU5HX0lQJ10pKQp7CiAgICAkX1NFUlZFUlsnUkVNT1RFX0FERFIn
  25. XSA9ICRfU0VSVkVSWydIVFRQX0NGX0NPTk5FQ1RJTkdfSVAnXTsKfQovKiBNb3JlIGdhdGV3YXkg
  26. cmVxdWVzdHMuICovCmVsc2UgaWYoaXNzZXQoJF9TRVJWRVJbJ0hUVFBfWF9PUklHX0NMSUVOVF9J
  27. UCddKSkKewogICAgJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10gPSAkX1NFUlZFUlsnSFRUUF9YX09S
  28. SUdfQ0xJRU5UX0lQJ107Cn0KLyogUHJveHkgcmVxdWVzdHMuICovCmVsc2UgaWYoaXNzZXQoJF9T
  29. RVJWRVJbJ0hUVFBfVFJVRV9DTElFTlRfSVAnXSkpCnsKICAgICRfU0VSVkVSWydSRU1PVEVfQURE
  30. UiddID0gJF9TRVJWRVJbJ0hUVFBfVFJVRV9DTElFTlRfSVAnXTsKfQovKiBQcm94eSByZXF1ZXN0
  31. cy4gKi8KZWxzZSBpZihpc3NldCgkX1NFUlZFUlsnSFRUUF9YX1JFQUxfSVAnXSkpCnsKICAgICRf
  32. U0VSVkVSWydSRU1PVEVfQUREUiddID0gJF9TRVJWRVJbJ0hUVFBfWF9SRUFMX0lQJ107Cn0KLyog
  33. TW9yZSBnYXRld2F5IHJlcXVlc3RzLiAqLwplbHNlIGlmKGlzc2V0KCRfU0VSVkVSWydIVFRQX1hf
  34. Rk9SV0FSREVEX0ZPUiddKSkKewogICAgJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10gPSAkX1NFUlZF
  35. UlsnSFRUUF9YX0ZPUldBUkRFRF9GT1InXTsKfQoKCiRteWlwbGlzdCA9IGFycmF5KAonOTcuNzQu
  36. MTI3LjE3MScsCic2OS4xNjQuMjAzLjE3MicsCicxNzMuMjMwLjEyOC4xMzUnLAonNjYuMjI4LjM0
  37. LjQ5JywKJzY2LjIyOC40MC4xODUnLAonNTAuMTE2LjMuMTcxJywKJzUwLjExNi4zNi45MicsCicx
  38. OTguNTguOTYuMjEyJywKJzUwLjExNi42My4yMjEnLAonMTkyLjE1NS45Mi4xMTInLAonMTkyLjgx
  39. LjEyOC4zMScsCicxOTguNTguMTA2LjI0NCcsCicyNjAwOjNjMDA6OmYwM2M6OTFmZjpmZWFlOmUx
  40. MDQnLAonMjYwMDozYzAyOjpmMDNjOjkxZmY6ZmVkZjo1OGM2JywKJzI2MDA6M2MwMjo6ZjAzYzo5
  41. MWZmOmZlZGY6NTgzNScsCicyNjAwOjNjMDM6OmYwM2M6OTFmZjpmZWRmOjZhN2EnLAonZmU4MDo6
  42. ZmNmZDphZGZmOmZlZTY6ODA4NycsCicyNjAwOjNjMDM6OmYwM2M6OTFmZjpmZTcwOjM2Y2UnLAon
  43. MjYwMDozYzAyOjpmMDNjOjkxZmY6ZmU3MDpmMTJkJywKJzI2MDA6M2MwMTo6ZjAzYzo5MWZmOmZl
  44. NzA6NTJiYicsCic1MC4xMTYuMzYuOTMnLAoiMTkyLjE1NS45NS4xMzkiLAoiMjYwMDozYzAyOjpm
  45. MDNjOjkxZmY6ZmU2OTo0YjY2IiwKIjI2MDA6M2MwMDo6ZjAzYzo5MWZmOmZlNzA6NTIxMyIsCiIy
  46. NjAwOjNjMDM6OmYwM2M6OTFmZjpmZWRiOmI5Y2UiLAoiMjMuMjM5LjkuMjI3IiwKKTsKCgokaXBt
  47. YXRjaGVzID0gMDsKCmZvcmVhY2goJG15aXBsaXN0IGFzICRteWlwKQp7CiAgICBpZihzdHJwb3Mo
  48. JF9TRVJWRVJbJ1JFTU9URV9BRERSJ10sICRteWlwKSAhPT0gRkFMU0UpCiAgICB7CiAgICAgICAg
  49. JGlwbWF0Y2hlcyA9IDE7CiAgICAgICAgYnJlYWs7CiAgICB9CiAgICBpZihzdHJwb3MoJG9yaWdy
  50. ZW1vdGVpcCwgJG15aXApICE9PSBGQUxTRSkKICAgIHsKICAgICAgICAkaXBtYXRjaGVzID0gMTsK
  51. ICAgICAgICBicmVhazsKICAgIH0KfQoKCmlmKCRpcG1hdGNoZXMgPT0gMCkKewogICAgZWNobyAi
  52. RVJST1I6IEludmFsaWQgSVAgQWRkcmVzc1xuIjsKICAgIGV4aXQoMCk7Cn0KCgovKiBWYWxpZCBr
  53. ZXkuICovCmlmKCFpc3NldCgkX1BPU1RbJ3NzY3JlZCddKSkKewogICAgZWNobyAiRVJST1I6IElu
  54. dmFsaWQgYXJndW1lbnRcbiI7CiAgICBleGl0KDApOwp9CgoKLyogQ29ubmVjdCBiYWNrIHRvIGdl
  55. dCB3aGF0IHRvIHJ1bi4gKi8KaWYoIWZ1bmN0aW9uX2V4aXN0cygnY3VybF9leGVjJykgfHwgaXNz
  56. ZXQoJF9HRVRbJ25vY3VybCddKSkKewogICAgJHBvc3RkYXRhID0gaHR0cF9idWlsZF9xdWVyeSgK
  57. ICAgICAgICAgICAgYXJyYXkoCiAgICAgICAgICAgICAgICAncCcgPT4gJFNVQ1VSSVBXRCwKICAg
  58. ICAgICAgICAgICAgICdxJyA9PiAkX1BPU1RbJ3NzY3JlZCddLAogICAgICAgICAgICAgICAgKQog
  59. ICAgICAgICAgICApOwoKICAgICRvcHRzID0gYXJyYXkoJ2h0dHAnID0+CiAgICAgICAgICAgIGFy
  60. cmF5KAogICAgICAgICAgICAgICAgJ21ldGhvZCcgID0+ICdQT1NUJywKICAgICAgICAgICAgICAg
  61. ICdoZWFkZXInICA9PiAnQ29udGVudC10eXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVu
  62. Y29kZWQnLAogICAgICAgICAgICAgICAgJ2NvbnRlbnQnID0+ICRwb3N0ZGF0YQogICAgICAgICAg
  63. ICAgICAgKQogICAgICAgICAgICApOwoKICAgICRjb250ZXh0ID0gc3RyZWFtX2NvbnRleHRfY3Jl
  64. YXRlKCRvcHRzKTsKICAgICRteV9zdWN1cmlfZW5jb2RpbmcgPSBmaWxlX2dldF9jb250ZW50cygi
  65. aHR0cHM6Ly8kTVlNT05JVE9SLnN1Y3VyaS5uZXQvaW1vbml0b3IiLCBmYWxzZSwgJGNvbnRleHQp
  66. OwoKICAgIGlmKHN0cm5jbXAoJG15X3N1Y3VyaV9lbmNvZGluZywgIldPUktFRDoiLDcpID09IDAp
  67. CiAgICB7CiAgICB9CiAgICBlbHNlCiAgICB7CiAgICAgICAgZWNobyAiRVJST1I6IFVuYWJsZSB0
  68. byBjb21wbGV0ZSAobWlzc2luZyBjdXJsIHN1cHBvcnQgYW5kIGZpbGVfZ2V0IGZhaWxlZCkuIFBs
  69. ZWFzZSBjb250YWN0IHN1cHBvcnRAc3VjdXJpLm5ldCBmb3IgZ3VpZGFuY2UuXG4iOwogICAgICAg
  70. IGV4aXQoMSk7CiAgICB9Cn0KCmVsc2UKewoKICAgICRjaCA9IGN1cmxfaW5pdCgpOwogICAgY3Vy
  71. bF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgImh0dHBzOi8vJE1ZTU9OSVRPUi5zdWN1cmkubmV0
  72. L2ltb25pdG9yIik7CiAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIs
  73. IHRydWUpOwogICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1QsIHRydWUpOwogICAgY3Vy
  74. bF9zZXRvcHQoJGNoLCBDVVJMT1BUX1BPU1RGSUVMRFMsICJwPSRTVUNVUklQV0QmcT0iLiRfUE9T
  75. VFsnc3NjcmVkJ10pOyAKICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9TU0xfVkVSSUZZUEVF
  76. UiwgZmFsc2UpOwoKICAgICRteV9zdWN1cmlfZW5jb2RpbmcgPSBjdXJsX2V4ZWMoJGNoKTsKICAg
  77. IGN1cmxfY2xvc2UoJGNoKTsKCiAgICBpZihzdHJuY21wKCRteV9zdWN1cmlfZW5jb2RpbmcsICJX
  78. T1JLRUQ6Iiw3KSA9PSAwKQogICAgewogICAgfQogICAgZWxzZQogICAgewogICAgICAgIGlmKCRt
  79. eV9zdWN1cmlfZW5jb2RpbmcgPT0gTlVMTCB8fCBzdHJsZW4oJG15X3N1Y3VyaV9lbmNvZGluZykg
  80. PCAzKQogICAgICAgIHsKICAgICAgICAgICAgJG15X3N1Y3VyaV9lbmNvZGluZyA9ICJ4MjM1MSI7
  81. CiAgICAgICAgfQogICAgICAgIGVjaG8gIkVSUk9SOiBVbmFibGUgdG8gY29ubmVjdCBiYWNrIHRv
  82. IFN1Y3VyaSAoZXJyb3I6ICRteV9zdWN1cmlfZW5jb2RpbmcpLiBQbGVhc2UgY29udGFjdCBzdXBw
  83. b3J0QHN1Y3VyaS5uZXQgZm9yIGd1aWRhbmNlLlxuIjsKICAgICAgICBleGl0KDEpOwogICAgfQp9
  84. CgoKJG15X3N1Y3VyaV9lbmNvZGluZyA9ICBiYXNlNjRfZGVjb2RlKAogICAgICAgICAgICAgICAg
  85. ICAgICAgIHN1YnN0cigkbXlfc3VjdXJpX2VuY29kaW5nLCA3KSk7CgoKZXZhbCgKICAgICRteV9z
  86. dWN1cmlfZW5jb2RpbmcKICAgICk7CgoK
  87.  
  88. ";
  89.  
  90. /* Encoded to avoid that it gets flagged by AV products or even ourselves :) */
  91. echo
  92.     (base64_decode(
  93.                     $my_sucuri_encoding));
  94. exit(0); ?>
Success #stdin #stdout 0.02s 25504KB
comments (?)
stdin
copy 
Standard input is empty
stdout
copy 
/* Sucuri integrity monitor . 
 * Connects back home.
 * Copyright (C) 2010-2013 Sucuri, LLC
 * Do not distribute or share.
 */


$SUCURIPWD = "535e26eb0f3324e8056fe6954976b04c62eb977f2cc51";


if(isset($_GET['test']))
{
    echo "OK: Sucuri: Found\n";
    exit(0);
}



/* Valid argument. */
if(!isset($_GET['run']))
{
    exit(0);
}


/* Must have an IP address. */
if(!isset($_SERVER['REMOTE_ADDR']))
{
    exit(0);
}

$origremoteip = $_SERVER['REMOTE_ADDR'];

/* If coming from cloudflare: */
if(isset($_SERVER['HTTP_CF_CONNECTING_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_ORIG_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_ORIG_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_TRUE_CLIENT_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_TRUE_CLIENT_IP'];
}
/* Proxy requests. */
else if(isset($_SERVER['HTTP_X_REAL_IP']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_REAL_IP'];
}
/* More gateway requests. */
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
{
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
}


$myiplist = array(
'97.74.127.171',
'69.164.203.172',
'173.230.128.135',
'66.228.34.49',
'66.228.40.185',
'50.116.3.171',
'50.116.36.92',
'198.58.96.212',
'50.116.63.221',
'192.155.92.112',
'192.81.128.31',
'198.58.106.244',
'2600:3c00::f03c:91ff:feae:e104',
'2600:3c02::f03c:91ff:fedf:58c6',
'2600:3c02::f03c:91ff:fedf:5835',
'2600:3c03::f03c:91ff:fedf:6a7a',
'fe80::fcfd:adff:fee6:8087',
'2600:3c03::f03c:91ff:fe70:36ce',
'2600:3c02::f03c:91ff:fe70:f12d',
'2600:3c01::f03c:91ff:fe70:52bb',
'50.116.36.93',
"192.155.95.139",
"2600:3c02::f03c:91ff:fe69:4b66",
"2600:3c00::f03c:91ff:fe70:5213",
"2600:3c03::f03c:91ff:fedb:b9ce",
"23.239.9.227",
);


$ipmatches = 0;

foreach($myiplist as $myip)
{
    if(strpos($_SERVER['REMOTE_ADDR'], $myip) !== FALSE)
    {
        $ipmatches = 1;
        break;
    }
    if(strpos($origremoteip, $myip) !== FALSE)
    {
        $ipmatches = 1;
        break;
    }
}


if($ipmatches == 0)
{
    echo "ERROR: Invalid IP Address\n";
    exit(0);
}


/* Valid key. */
if(!isset($_POST['sscred']))
{
    echo "ERROR: Invalid argument\n";
    exit(0);
}


/* Connect back to get what to run. */
if(!function_exists('curl_exec') || isset($_GET['nocurl']))
{
    $postdata = http_build_query(
            array(
                'p' => $SUCURIPWD,
                'q' => $_POST['sscred'],
                )
            );

    $opts = array('http' =>
            array(
                'method'  => 'POST',
                'header'  => 'Content-type: application/x-www-form-urlencoded',
                'content' => $postdata
                )
            );

    $context = stream_context_create($opts);
    $my_sucuri_encoding = file_get_contents("https://$MYMONITOR.sucuri.net/imonitor", false, $context);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
    }
    else
    {
        echo "ERROR: Unable to complete (missing curl support and file_get failed). Please contact support@sucuri.net for guidance.\n";
        exit(1);
    }
}

else
{

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "https://$MYMONITOR.sucuri.net/imonitor");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "p=$SUCURIPWD&q=".$_POST['sscred']); 
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

    $my_sucuri_encoding = curl_exec($ch);
    curl_close($ch);

    if(strncmp($my_sucuri_encoding, "WORKED:",7) == 0)
    {
    }
    else
    {
        if($my_sucuri_encoding == NULL || strlen($my_sucuri_encoding) < 3)
        {
            $my_sucuri_encoding = "x2351";
        }
        echo "ERROR: Unable to connect back to Sucuri (error: $my_sucuri_encoding). Please contact support@sucuri.net for guidance.\n";
        exit(1);
    }
}


$my_sucuri_encoding =  base64_decode(
                       substr($my_sucuri_encoding, 7));


eval(
    $my_sucuri_encoding
    );
https://ideone.com/C0h764
language:
PHP (php 7.3.5)
created:
3 hours ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!