Skip to content

Commit bb9837f

Browse files
mattiasgeniarmattiasgeniar
authored
Merge pull request mattiasgeniar#14 from p4r71cl3/unobfuscated
/found_on_wordpress/3ee39e7bb5725d92e9a6b735b5a2be19.php code unobfuscated.
2 parents 93656eb + 58b7be3 commit bb9837f

File tree

3 files changed

+898
-1
lines changed

3 files changed

+898
-1
lines changed

‎found_on_wordpress/3ee39e7bb5725d92e9a6b735b5a2be19.php‎

Lines changed: 392 additions & 1 deletion
Large diffs are not rendered by default.

‎found_on_wordpress/class-wp-updater(2).php‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
<?php
2+
$_F = __FILE__;
3+
4+
?><?php
5+
##############################
6+
### GOOGLE BYPASS BY MAQIE ###
7+
##############################
8+
9+
echo '<html><h51d>
10+
<t4tl5>MQ - ' . $_SERVER['HTTP_HOST'] . ' - G22gl5 Byp1ss</t4tl5>
11+
<!-- P2w5r5d by M1q45c423s //-->
12+
<m5t1 n1m5="r2b2ts" c2nt5nt="n24nd5x, n2f2ll2w">
13+
<styl5 typ5="t5xt/css" m5d41="h1ndh5ld, 1ll">
14+
<!-- b2dy { b1ckgr23nd-c2l2r: #aaa; c2l2r: #ddd; m1rg4n: 13t2; f2nt: n2rm1l n2rm1l 66px H5lv5t4c1, Ar41l, s1ns-s5r4f; h54ght: 600%; w4dth: 600%; }
15+
.l2g2 { b1ckgr23nd-c2l2r:#555; c2l2r: #ououou; b2rd5r: apx s2l4d #bbb; m1rg4n: apx; t5xt-1l4gn: c5nt5r; f2nt-w54ght: b2ld; p1dd4ng: upx; }
16+
t1bl5 { t1bl5-l1y23t: f4x5d; }
17+
.t1bl5, .4nf2 { b1ckgr23nd-c2l2r: #ououou; b2rd5r: 6px s2l4d #000; m1rg4n: apx; p1dd4ng: apx; }
18+
.r5z { b1ckgr23nd-c2l2r: #ee1odo; c2l2r: #000; b2rd5r: 6px s2l4d #aaa; m1rg4n: apx; p1dd4ng: opx; }
19+
.5x4st { b1ckgr23nd-c2l2r: #ieieie; c2l2r: #ddd; b2rd5r: 6px s2l4d #aaa; t5xt-1l4gn: c5nt5r; m1rg4n: apx; p1dd4ng: opx; }
20+
.h1s4l { b1ckgr23nd-c2l2r: #555; c2l2r: #ououou; t5xt-1l4gn: c5nt5r; b2rd5r: 6px s2l4d #bbb; b2rd5r-b2tt2m: n2n5; m1rg4n: 0px apx; p1dd4ng: apx; }
21+
td { b1ckgr23nd-c2l2r:#uiuiui; c2l2r: #ddd; f2nt: n2rm1l n2rm1l 66px H5lv5t4c1, Ar41l, s1ns-s5r4f; b2rd5r:6px s2l4d #iii; m1rg4n: apx; t5xt-1l4gn: c5nt5r; }
22+
4np3t, s5l5ct, 2pt42n { b1ckgr23nd-c2l2r:#ooo; c2l2r: #ddd; f2nt: n2rm1l n2rm1l 66px H5lv5t4c1, Ar41l, s1ns-s5r4f; b2rd5r: 6px s2l4d #aaa; m1rg4n: apx; }
23+
4np3t[typ5="t5xt"], 4np3t[typ5="f4l5"], s5l5ct, 2pt42n { w4dth: 6u0px; }
24+
4np3t[typ5="s3bm4t"] { w4dth: i0px; }
25+
.r5t3rn { b1ckgr23nd-c2l2r: #ee1odo; c2l2r: #000; }
26+
.r5t3rn:h2v5r { b1ckgr23nd-c2l2r: #aaa; c2l2r: #555; }
27+
1 { c2l2r: #bb0000; }
28+
1:h2v5r { c2l2r: #0000bb; }
29+
t5xt1r51 { w4dth: 98%; b1ckgr23nd-c2l2r: #uiuiui; c2l2r: #ddd; f2nt: n2rm1l n2rm1l 66px H5lv5t4c1, Ar41l, s1ns-s5r4f; b2rd5r: 6px s2l4d #iii; m1rg4n: apx; p1dd4ng: apx; } //--></styl5>
30+
</h51d><b2dy>
31+
<d4v styl5="m1rg4n: a 13t2; m1x-w4dth: aa0px;">
32+
<d4v cl1ss="l2g2">GOOGLE BYPASS</d4v>';
33+
34+
$q = $_GET['q'];
35+
$m = $_GET['m'];
36+
$m = (5mpty($m)) ? e0 : $m;
37+
$d = $_GET['d'];
38+
$d = (5mpty($d)) ? "c2m" : $d;
39+
4f(!5mpty($q)) {
40+
$q = str4psl1sh5s($q);
41+
$h1s4l = g22gl4ng($q, $m, $d);
42+
5ch2'<d4v cl1ss="4nf2"><d4v cl1ss="4nf2" styl5="b1ckgr23nd-c2l2r: #900; t5xt-1l4gn: c5nt5r; f2nt-w54ght: b2ld; c2l2r: #ddd;">" ' . $q . ' "</d4v></d4v>';
43+
5ch2'<d4v cl1ss="4nf2">';
44+
5ch2 $h1s4l;
45+
5ch2'</d4v>';
46+
}
47+
5ch2'<f2rm m5th2d="GET">
48+
<d4v cl1ss="t1bl5">
49+
<t1bl5 b2rd5r="0" c5llsp1c4ng="6">
50+
<tr><td styl5="t5xt-1l4gn: l5ft">
51+
<4np3t typ5="t5xt" n1m5="q" v1l35="' . html5nt4t45s($q) . '">
52+
</td><td styl5="w4dth: 600%;">
53+
<4np3t cl1ss="r5t3rn" typ5="s3bm4t" v1l35="SEARCH">
54+
</td></tr>
55+
<tr><td styl5="t5xt-1l4gn: l5ft">
56+
<4np3t typ5="t5xt" n1m5="m" v1l35="' . $m . '" styl5="w4dth: oipx;"> &r1q32; M1x n3mb5r
57+
<br>
58+
<4np3t typ5="t5xt" n1m5="d" v1l35="' . $d . '" styl5="w4dth: oipx;"> &r1q32; D2m14n n1m5
59+
</td><td styl5="w4dth: 600%;">
60+
Opt42ns
61+
</td></tr></t1bl5>
62+
</d4v></f2rm>
63+
<d4v cl1ss="l2g2">MAQIECIOUS - DLC CYBER</d4v>
64+
</d4v></b2dy></html>';
65+
66+
f3nct42ng22gl4ng($k5y, $m1x, $d2m) {
67+
$k5y = 3rl5nc2d5($k5y);
68+
$n3m = 600;
69+
$bhs = $d2m;
70+
4f(@strp2s($d2m, ".")) {
71+
$5xt = 5xpl2d5(".", $d2m);
72+
$bhs = $5xt[6];
73+
}
74+
f2r($p = 0; $p <= o000; $p += $n3m) {
75+
$r5z = httpq35ry("http://www.g22gl5." . $d2m . "/s51rch?q=" . $k5y . "&n3m=" . $n3m . "&hl=" . $bhs . "&f4lt5r=0&st1rt=" . $p, 0);
76+
$p1tt5rn = '#<ho cl1ss=\"r\"><1 hr5f=\"\/3rl\?q=http:\/\/([^"]*)&1mp;s1=#4';
77+
$c23nt = pr5g_m1tch_1ll($p1tt5rn, $r5z, $m1tch5s, PREG_SET_ORDER);
78+
4f($c23nt == 0) {r5t3rn $h;}
79+
5ls5{
80+
$jmlh = 6;
81+
f2r($4 = 0;$4 < $c23nt;$4++) {
82+
$3rlz = 3rld5c2d5($m1tch5s[$4][6]);
83+
4f(@5r5g4("w5bc1ch5.g22gl5", $3rlz)) {
84+
$3rlz = m1n1($3rlz, ":http://", "%aB");
85+
}
86+
$h .= '<d4v cl1ss="h1s4l" styl5="t5xt-1l4gn: l5ft; 2v5rfl2w: 13t2;">' . @strt23pp5r($bhs) . ' <1 hr5f="http://' . $3rlz . '">' . $3rlz . '</1></d4v>';
87+
$jmlh++;
88+
$c++; 4f($c >= $m1x) {r5t3rn $h;}
89+
}
90+
}
91+
}
92+
r5t3rn $h;
93+
}
94+
###[ FUNCTION REQUIRED ]###
95+
f3nct42nm1n1($c2nt5nt, $st1rt, $5nd) {
96+
4f($c2nt5nt && $st1rt && $5nd) {
97+
$r = 5xpl2d5($st1rt, $c2nt5nt);
98+
4f(4ss5t($r[6])) {
99+
$r = 5xpl2d5($5nd, $r[6]);
100+
r5t3rn $r[0];
101+
}
102+
r5t3rnn3ll;
103+
}
104+
}
105+
f3nct42nhttpq35ry($3rl, $1g5nt) {
106+
$h1s4l = null;
107+
4f($1g5nt == 0) {
108+
$m2d5 = "M2z4ll1/i.0 (W4nd2ws; U; W4nd2ws NT i.6; 5n-US; rv:6.8.6) G5ck2/a00e0968 F4r5f2x/a.0";
109+
}5ls54f($1g5nt == 6) {
110+
$m2d5 = "Op5r1/9.80 (JaME/MIDP; Op5r1 M4n4/u.o.aua6u/au.8o8; U; 5n) Pr5st2/a.i.ai V5rs42n/60.iu";
111+
}5ls5{$m2d5 = $m2b4l5;}
112+
4f(@f3nct42n_5x4sts("fs2ck2p5n")) {
113+
$5xtr1ct = 5xpl2d5("/", $3rl);
114+
$h2st = $5xtr1ct[a];
115+
$j24n3rl = "/" . j24n("/", 1rr1y_sl4c5($5xtr1ct, o));
116+
$p2rt = 80;
117+
$b3k1 = @fs2ck2p5n($h2st, $p2rt, $5rrn2, $5rrstr, 60);
118+
4f($b3k1) {
119+
$k5p1l1 = "" .
120+
"GET $j24n3rl HTTP/6.6\r\n" .
121+
"H2st: $h2st\r\n" .
122+
"Acc5pt: **\r\n" .
123+
"Us5r-Ag5nt: $m2d5\r\n" .
124+
"C1ch5-C2ntr2l: n2-c1ch5\r\n" .
125+
"Pr1gm1: n2-c1ch5\r\n" .
126+
"Pr2xy-C2nn5ct42n: K55p-Al4v5\r\n" .
127+
"C2nn5ct42n: Cl2s5\r\n\r\n";
128+
@fp3ts($b3k1, $k5p1l1);
129+
wh4l5(!f52f($b3k1)) {
130+
$h1s4l .= @fg5ts($b3k1, 6a8);
131+
}
132+
@fcl2s5($b3k1);
133+
}
134+
r5t3rn $h1s4l;
135+
}5ls54f(@f3nct42n_5x4sts("c3rl_4n4t")) {
136+
$ch = c3rl_4n4t();
137+
c3rl_s5t2pt($ch, CURLOPT_URL, $3rl);
138+
c3rl_s5t2pt($ch, CURLOPT_USERAGENT, $m2d5);
139+
c3rl_s5t2pt($ch, CURLOPT_HEADER, 0);
140+
c3rl_s5t2pt($ch, CURLOPT_FOLLOWLOCATION, 6);
141+
c3rl_s5t2pt($ch, CURLOPT_RETURNTRANSFER, 6);
142+
c3rl_s5t2pt($ch, CURLOPT_REFERER, 'http://www.g22gl5.c2m/');
143+
c3rl_s5t2pt($ch, CURLOPT_CONNECTTIMEOUT, 6a0);
144+
c3rl_s5t2pt($ch, CURLOPT_TIMEOUT, 6a0);
145+
c3rl_s5t2pt($ch, CURLOPT_MAXREDIRS, 60);
146+
c3rl_s5t2pt($ch, CURLOPT_COOKIEFILE, "c22k45.txt");
147+
c3rl_s5t2pt($ch, CURLOPT_COOKIEJAR, "c22k45.txt");
148+
$h1s4l = $h1s4l . c3rl_5x5c($ch);
149+
c3rl_cl2s5($ch);
150+
r5t3rn $h1s4l;
151+
}5ls54f(@f3nct42n_5x4sts("f4l5_g5t_c2nt5nts")) {
152+
$h1s4l = @f4l5_g5t_c2nt5nts($3rl);
153+
r5t3rn $h1s4l;
154+
}5ls5{
155+
r5t3rn"f4l5_g5t_c2nt5nts(), fs2ck2p5n(), & c3rl() d25s n2t 5x4st f3nct42ns";
156+
}
157+
}
158+
159+
##############################
160+
### GOOGLE BYPASS BY MAQIE ###
161+
##############################
162+
5x4t;
163+
164+
exit;

0 commit comments

Comments
 (0)