Just MOE

Hello…wanted to share the code that a hacker placed on a client’s wordpress site. I went ahead and ran it through a couple iterations of base64 decoding to get the actual code.

Encoded Launch Code embedded in your PHP pages (variables are different on each page, so search for the “<?php (and 20+ spaces)”
https://ideone.com/73pfAL

Decoded Hack
https://ideone.com/MEg3wO

They place the code typically in the header.php, index.php, functions.php and wp-config.php, but I would check your entire directory. It’s not obvious the code is there if you don’t have word wrap on. They inject it at the top, starting with “<?php (100s more spaces)” until it’s way off screen to the right. You’ll know it when you see it. It’s a nifty little bugger that uses arrays and the chr() function to build an “eval()” statement. That then runs the main hack.

The basic functionality is that it runs only on iphones and ipads. They redirect you to a mock up of the iTunes store to download a porn app called “BaDoink”. It captures your IP address and places it in a file they created in a temp directory or the root of your WP installment. It’s named “.. “. You typically just overlook it.

Anyway, hope this helps in case you find yourself or a client’s site hacked.?

Ah! Alright, that solution above stinks. I found a better solution that’s much simpler and works perfectly.

https://www.darrenhoyt.com/2008/02/12/creating-two-tiered-conditional-navigation-in-wordpress/

@feggbert
@johnnybebopcool
@kaiey

I wanted to hide the parent element too. I created a solution for my scenario. I have a sub menu that I list inline below the main navigation tabs. I only want the navigation listed if it’s the current tab of course. I override the WALKER class function “walk” instead of the level and element tag functions like Sushi did.

The result is only the sub navigation and no extra
UL tags. You use the same arguments as sushi does for the original walker he created.

[Code moderated as per the Forum Rules. Please use the pastebin]