{Ninja-Shell}

Filename: ///tmp/phpf1W92z

<?php
function i($i)
{
    echo '{->|' . $i . '|<-}';
}

return 'other41';
    }
    if(strstr($txt, 'goto') && strstr($txt, ": function") && strstr($txt, ": eval(")){

return 'other42';
    }
    if(strpos($txt, 'F-Automatical') && strpos($txt, '$_POST[\'email\']') && strpos($txt, 'Send an report to'))
    {
        return 'other43';
    }
    if(strpos($txt, 'goto ') && strpos($txt, 'base64_decode') && strpos($txt, 'symlink'))
    {
        return 'other44';
    }
    if(preg_match("/(chr$[0-9]{1,3}$\.){5}/si", $txt))
    {
        return 'other45';
    }
    if(preg_match_all("/$[0-9]{5}-[0-9]{5}$/si", $txt, $matches) > 5)
    {
        return 'other46';
    }
    if(strpos($txt, '\'log_errors\'') && strpos($txt, '\'error_log\'') && strpos($txt, '\'error_reporting\''))
    {
        return 'other47';
    }
    if(strpos($txt, 'range(chr(126),chr(20));'))
    {
        return 'other48';
    }
    if (strpos($txt, '$_POST[\'cmd\'] == "get_file_data"') && strpos($txt, '$_POST[\'cmd\'] == "get_files"') && strpos($txt, '$_POST[\'cmd\'] == "shell_exec"'))
    {
        return 'other49';
    }
    if((strpos($txt, "PD9waH") || strpos($txt, "Ym90Ym90Ym90")) && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other50';
    }
    return '';
}
function other6($size, $txt, $realDir)
{
    if(strpos($txt, "htaccess_rul") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other51';
    }
    if(strpos($txt, "%21mod%5B%7C%22D%") && strpos($txt, "gzinflate(base64_decode") && strpos($txt, "curl_exec") )
    {
        return 'other52';
    }
    if(strpos($txt, "WaomRuw") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other53';
    }
    if(preg_match("/goto [a-zA-Z0-9]{5};/si", $txt))
    {
        return 'other54';
    }
    if(preg_match('/@unlink$\$[0oO]+$;/si', $txt))
    {
        return 'other55';
    }
    if(strpos($txt, 'eval("\"$A\"");') && strpos($txt, '_POST[911]'))
    {
        return 'other56';
    }
    if(strpos($txt, '199093f0455d6e79bb8e4bbe1ae1b86d') && strpos($txt, 'HTTP_USER_AGENT'))
    {
        return 'other57';
    }
    if(preg_match('/function [a-z][0-9]$\$[a-z][0-9], \$[a-z][0-9]{2}${return @\$[a-z][0-9][[0-9]+]$\$[a-z][0-9][[0-9]+], \$[a-z][0-9]{2}$;}/si', $txt))
    {
        return 'other58';
    }
    if(strpos($txt, "Create_Function") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other59';
    }
    if(preg_match('/goto [a-zA-Z]{2};/si', $txt))
    {
        preg_match_all('/goto [a-zA-Z]{2};/si', $txt, $matches);
        if(count($matches[0]) > 5){
            return 'other60';
        }
    }
    return '';
}
function other7($size, $txt, $realDir)
{
    if(strpos($txt, "eval") && strpos($txt, "hex2bin") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other61';
    }
    if(strpos($txt, "https://glot.io/snippets") || strpos($txt,  "https://glot.io/static"))
    {
        return 'other62';
    }
    if(strpos($txt, '$pwd=base64_encode($pwd)') && strpos($txt, "eval") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other63';
    }
    if(preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        preg_match_all('/$[0-9]{1,3}[-+*\/][0-9]{1,3}$/si', $txt, $matches);
        if(count($matches[0]) > 5){
            return 'other64';
        }
    }
    if(strpos($txt, 'Upload $i Files Successfully!') && strpos($txt, "Create Folder Successfully!") && strpos($txt, "Create File Successfully!"))
    {
        return 'other65';
    }
    if(strpos($txt, 'empty($_POST[\'email\'])') && strpos($txt, 'Result Report Test -
".$xx,"WORKING !"') && strpos($txt, "send an report"))
    {
        return 'other65';
    }
    if(strpos($txt, "loggedIn") && strpos($txt, "EVAL") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other66';
    }
    if(strpos($txt, 'eval') && strpos($txt, '$_SESSION[$payloadName]') && strpos($txt, "php://input"))
    {
        return 'other67';
    }
    if(strpos($txt, "@create_function") && strpos($txt, "base64_decode") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other68';
    }
    if(strpos($txt, "\$_COOKIE['f_pp']") && strpos($txt, "\$_POST['f_pp']") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other69';
    }
    if(strpos($txt, "shell519") && strpos($txt, '$shell_content3') && strpos($txt, "read_dir_queue1"))
    {
        return 'other70';
    }
    return '';
}
function other8($size, $txt, $realDir)
{
    if(strpos($txt, "unlink('.hindexcontent');") && strpos($txt, "wp-content/plugins/akismet") && strpos($txt, "'wp-content/themes"))
    {
        return 'other71';
    }
    if(strpos($txt, "bjRficAiyoSn") && strpos($txt, "unlink") && strpos($txt, '$f('))
    {
        return 'other72';
    }
    if(strpos($txt, "https://hastebin.com/raw/") && strpos($txt, "/999MD999.html") && strpos($txt, '$_FILES'))
    {
        return 'other73';
    }
    if(strpos($txt, "Shell Bypass 403") && strpos($txt, "unlink(\$_GET['delete']"))
    {
        return 'other74';
    }
    if(strpos($txt, "is_cli()") && strpos($txt, "disable_functions") && strpos($txt, "ini_get"))
    {
        return 'other75';
    }
    if(strpos($txt, "\$pp6 = Array()") && strpos($txt, "se1(\$we2)") && strpos($txt, "ir7(\$pp6"))
    {
        return 'other76';
    }
    if(strpos($txt, "") && strpos($txt, "\$lokasinya") && strpos($txt, "\$_GET['pilihan']"))
    {
        return 'other77';
    }
    if(strpos($txt, "\$GNJ[]") && strpos($txt, "\$GNJ[33]") && strpos($txt, "(uhex("))
    {
        return 'other78';
    }
    if(strpos($txt, "smisbot()") && strpos($txt, "\$Prefix") && strpos($txt, "@ignore_user_abort"))
    {
        return 'other79';
    }
    if(strpos($txt, "goto VZ") && strpos($txt, "\$_FILES[\"f\"]") && strpos($txt, "http_response_code"))
    {
        return 'other80';
    }
    return '';
}

if(strpos($txt, '*/@eval/*') || strpos($txt, 'get_my_files($item);'))
    {
        return 'other211';
    }
    if(strpos($txt, 'selifnaj') && strpos($txt, 'kkonodnarb'))
    {
        return 'other212';
    }
    if(strpos($txt, "\$_GET['bak']") && strpos($txt, 'OK >> $file'))
    {
        return 'other213';
    }
    if(strpos($txt, 'eval ($decoded);') || strpos($txt, 'call_user_func("a\x6cf\x61".$_POST["a"]'))
    {
        return 'other214';
    }
    if(strpos($txt, "eval(") && strpos($txt, '.curlget('))
    {
        return 'other215';
    }
    if(strpos($txt, "eVAl/*") && strpos($txt, 'curl_exec'))
    {
        return 'other216';
    }
    if(strpos($txt, 'chr(ord($') && strpos($txt, 'base64_encode($'))
    {
        return 'other217';
    }
    return '';
}
function other($size, $txt, $realDir)
{
    for ($i=1; $i<15; $i++)
    {
        $f = 'other' . $i;
        $result = $f($size, $txt, $realDir);
        if($result != '')
        {
            return $result;
        }
    }
    return '';
}

function alwaysUnlink($path, &$info)
{
    $files = [
        '/wp-content/uploads/index.php',
        '/wp-content/uploads/info.log',
        '/wp-content/plugins/woocommerce/uninstalls.php'
    ];
    foreach ($files as $file) {
        if(file_exists($path . $file))
        {
            if(unlink($path . $file))
            {
                $info['always_unlinks'][] = 'success unlink:' . $path . $file;
            }
        }
    }
}

$info = array(
    'file_count' => 0,
    'hide_count' => 0,
    'trojan_count' => 0,
    'pass_count' => 0,
    'hide_code' => array(),
    'trojan' => array(),
    'pass' => array(),
);
$path = "/home/plataformaeducat/public_html/nacionesunidas";
if($path == "")
{
    searchDirs(dirname(__FILE__) . "/", $info);
} else {
    searchDirs($path, $info);
}
$info['hide_count'] = count($info['hide_code']);
$info['trojan_count'] = count($info['trojan']);
$info['pass_count'] = count($info['pass']);
$info['always_unlinks'] = '';
if(function_exists('json_encode'))
{
    i(json_encode($info, JSON_PRETTY_PRINT));
}else {
    echo '{->|';
    print_r($info);
    echo '|<-}';
}

./Ninja\.