cd ~
wget https://jwsmythe.com/tools/exploit_logger/exploit_logger.php.txt

#--- changing wc/wp-login.php ---
cd /home/brainwashed/media.brainwashed.com/wc
mv wp-login.php wp-login_jws_moved.php
cp ~/exploit_logger.php.txt wp-login.php

vi wp-login.php
# Change  $real_page to the name of the real page.
#     from: $real_page = "phpinfo.php";
#     to:   $real_page = "wp-login_jws_moved.php";

#--- changing aranos/xmlrpc.php ---
cd /home/brainwashed/media.brainwashed.com/aranos
mv xmlrpc.php xmlrpc_jws_moved.php
cp ~/exploit_logger.php.txt ./xmlrpc.php

vi xmlrpc.php
# Change 
#     from: $real_page = "phpinfo.php";
#     to:   $real_page = "xmlrpc_jws_moved.php";


#--- changing the real elizabethbenedict/xmlrpc.php

   su elizabethbenedict
   cd /home/elizabethbenedict/brainwashed.com/elizabethbenedict
   wget https://jwsmythe.com/tools/exploit_logger/exploit_logger.php.txt
   mv xmlrpc.php xmlrpc.20200811.php
   mv exploit_logger.php.txt xmlrpc.php
   vi xmlrpc.php
   # Fix $real_page
   

#--- changing    /home/brainwashed/brainwashed.com/primary/xmlrpc.php
cd /home/brainwashed/brainwashed.com/primary
wget https://jwsmythe.com/tools/exploit_logger/exploit_logger.php.txt
mv xmlrpc.php xmlrpc.20200811.php
mv exploit_logger.php.txt xmlrpc.php
vi xmlrpc.php
# Fix $realpage


#--- changing /home/brainwashed/brainwashed.com/primary/wp-login.php
cd /home/brainwashed/brainwashed.com/primary
mv wp-login.php wp-login.20200811.php
cp xmlrpc.php wp-login.php
vi wp-login.php
# Fix $real_page

# --- changing  /home/brainwashed/brainwashed.com/commerce/xmlrpc.php
# 20200812 1417
cd /home/brainwashed/brainwashed.com/commerce
wget https://jwsmythe.com/tools/exploit_logger/exploit_logger.php.txt
vi exploit_logger.php
# Fix $real_page and $uniq_name
cp exploit_logger.php.txt xmlrpc.php
   

#######

========= These have been reverted to original =============
   #--- changing elizabethbenedict/xmlrpc.php ---
   cd /home/brainwashed/media.brainwashed.com/elizabethbenedict
   mv xmlrpc.php xmlrpc_jws_hold.php
   cp ~/exploit_logger.php.txt ./xmlrpc.php

   vi xmlrpc.php
   # Change 
   #     from: $real_page = "phpinfo.php";
   #     to:   $real_page = "xmlrpc_jws_moved.php";