{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9996360540390015,
        "class": 2
      }
    ],
    "prob": 0.99963605,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.97386664,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99942386,
        "class": 1
      },
      {
        "m": "az/php",
        "prob": 0.99963605,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-08T21:55:57Z"
  },
  "path": "content-post.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₄(C₇CaErI₂)H₅(Cm₂F₅OsPoDb)Md",
        "k": {
          "source.imports[0]": "chmod",
          "source.imports[1]": "copy",
          "source.imports[2]": "error_reporting",
          "source.imports[3]": "explode",
          "source.imports[4]": "fclose",
          "source.imports[5]": "file_get_contents",
          "source.imports[6]": "fileperms",
          "source.imports[7]": "filesize",
          "source.imports[8]": "fopen",
          "source.imports[9]": "fwrite",
          "source.strings[0]": " /\u003e\n        \u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\n        \u003c/tr\u003e",
          "source.strings[1]": " /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value=",
          "source.strings[2]": " action=",
          "source.strings[3]": " name=",
          "source.strings[4]": " value=",
          "source.strings[5]": "\" /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value=\"",
          "source.strings[6]": "\"\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e",
          "source.strings[7]": "\"\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e",
          "source.strings[8]": "\"\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e",
          "source.strings[9]": "$path/$dir",
          "source.has_imports": true,
          "source.imports[10]": "get_magic_quotes_gpc",
          "source.imports[11]": "getcwd",
          "source.imports[12]": "htmlspecialchars",
          "source.imports[13]": "is_dir",
          "source.imports[14]": "is_file",
          "source.imports[15]": "is_readable",
          "source.imports[16]": "is_writable",
          "source.imports[17]": "isset",
          "source.imports[18]": "perms",
          "source.imports[19]": "php_uname",
          "source.imports[20]": "rename",
          "source.imports[21]": "rmdir",
          "source.imports[22]": "round",
          "source.imports[23]": "scandir",
          "source.imports[24]": "set_time_limit",
          "source.imports[25]": "sprintf",
          "source.imports[26]": "str_replace",
          "source.imports[27]": "stripslashes",
          "source.imports[28]": "substr",
          "source.imports[29]": "unlink",
          "source.strings[10]": "$path/$file",
          "source.strings[11]": "$paths[$i]",
          "source.strings[12]": "\u0026path=",
          "source.strings[13]": "\u003c!DOCTYPE HTML\u003e\n\u003cHTML\u003e\n\u003cHEAD\u003e\n\u003clink href=\"\" rel=\"stylesheet\" type=\"text/css\"\u003e\n\t\u003clink rel=\"shortcut icon\" href=\"http://tommiesports.com/images/setup/header_logo.png\" /\u003e\n\n\u003ctitle\u003eMister Spy\u003c/title\u003e\n\u003cstyle\u003e\nbody{\n    font-family: \"Racing Sans One\", cursive;\n    background-color: #e6e6e6;\n    text-shadow:0px 0px 1px #757575;\n}\n#content tr:hover{\n    background-color: #636263;\n    text-shadow:0px 0px 10px #fff;\n}\n#content .first{\n    background-color: silver;\n}\n#content .first:hover{\n    background-color: silver;\n    text-shadow:0px 0px 1px #757575;\n}\ntable{\n    border: 1px #000000 dotted;\n}\nH1{\n    font-family: \"Rye\", cursive;\n}\na{\n    color: #000;\n    text-decoration: none;\n}\na:hover{\n    color: #fff;\n    text-shadow:0px 0px 10px #ffffff;\n}\ninput,select,textarea{\n    border: 1px #000000 solid;\n    -moz-border-radius: 5px;\n    -webkit-border-radius:5px;\n    border-radius:5px;\n}\n\u003c/style\u003e\n\u003c/HEAD\u003e\n\u003cBODY\u003e\n\u003cH1\u003e\u003ccenter\u003e\u003cfont color=\"green\"\u003eWelcome To Our Shell\u003c/center\u003e\u003c/H1\u003e\n\u003ch3\u003e\u003ccenter\u003eMister Spy \u0026 Souheyl Bypass Shell\u003c/font\u003e\u003c/center\u003e\u003c/h3\u003e\n\u003ccenter\u003e\u003cdiv class=\"image\"\u003e\u003cimg src=\"http://65.media.tumblr.com/56f16f51e9df0eae447a33cb0cb02380/tumblr_nwuvlypJUg1u8ixiyo1_1280.jpg\" width=\"558\" height=\"302\"/\u003e\u003c/div\u003e\u003c/center\u003e\n\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\n\u003ctr\u003e\u003ctd\u003eCurrent Path : ",
          "source.strings[14]": "\u003c/a\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[15]": "\u003c/a\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e--\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[16]": "\u003c/center\u003e",
          "source.strings[17]": "\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[18]": "\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method=",
          "source.strings[19]": "\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method=\\\"POST\\\" action=\\\"?option\u0026path=$path\\\"\u003e\n        \u003cselect name=\\\"opt\\\"\u003e\n\t    \u003coption value=\\\"\\\"\u003e\u003c/option\u003e\n        \u003coption value=\\\"delete\\\"\u003eDelete\u003c/option\u003e\n        \u003coption value=\\\"chmod\\\"\u003eChmod\u003c/option\u003e\n        \u003coption value=\\\"rename\\\"\u003eRename\u003c/option\u003e\n        \u003c/select\u003e\n        \u003cinput type=\\\"hidden\\\" name=\\\"type\\\" value=\\\"dir\\\"\u003e\n        \u003cinput type=\\\"hidden\\\" name=\\\"name\\\" value=\\\"$dir\\\"\u003e\n        \u003cinput type=\\\"hidden\\\" name=\\\"path\\\" value=\\\"$path/$dir\\\"\u003e\n        \u003cinput type=\\\"submit\\\" value=\\\"\u003e\\\" /\u003e\n        \u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\n        \u003c/tr\u003e",
          "source.strings[20]": "\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method=\\\"POST\\\" action=\\\"?option\u0026path=$path\\\"\u003e\n        \u003cselect name=\\\"opt\\\"\u003e\n\t    \u003coption value=\\\"\\\"\u003e\u003c/option\u003e\n        \u003coption value=\\\"delete\\\"\u003eDelete\u003c/option\u003e\n        \u003coption value=\\\"chmod\\\"\u003eChmod\u003c/option\u003e\n        \u003coption value=\\\"rename\\\"\u003eRename\u003c/option\u003e\n        \u003coption value=\\\"edit\\\"\u003eEdit\u003c/option\u003e\n        \u003c/select\u003e\n        \u003cinput type=\\\"hidden\\\" name=\\\"type\\\" value=\\\"file\\\"\u003e\n        \u003cinput type=\\\"hidden\\\" name=\\\"name\\\" value=\\\"$file\\\"\u003e\n        \u003cinput type=\\\"hidden\\\" name=\\\"path\\\" value=\\\"$path/$file\\\"\u003e\n        \u003cinput type=\\\"submit\\\" value=\\\"\u003e\\\" /\u003e\n        \u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\n        \u003c/tr\u003e",
          "source.strings[21]": "\u003c/font\u003e",
          "source.strings[22]": "\u003c/pre\u003e",
          "source.strings[23]": "\u003c/table\u003e\n    \u003c/div\u003e",
          "source.strings[24]": "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e",
          "source.strings[25]": "\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e",
          "source.strings[26]": "\u003c/textarea\u003e\u003cbr /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value=",
          "source.strings[27]": "\u003c/textarea\u003e\u003cbr /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value=\"",
          "source.strings[28]": "\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e",
          "source.strings[29]": "\u003ca href=\"?path=",
          "source.strings[30]": "\u003ca href=\"?path=/\"\u003e/\u003c/a\u003e",
          "source.strings[31]": "\u003cb\u003e\u003cbr\u003e",
          "source.strings[32]": "\u003cbr /\u003e\u003cbr /\u003e",
          "source.strings[33]": "\u003cbr /\u003ebypass \u003cfont color=\"red\"\u003e1.0\u003c/font\u003e, Devloped By \u003cfont color=\"red\"\u003eEl Moujahidin (the source has been moved and devloped)\u003c/font\u003e\u003cbr /\u003eEmail: \u003cfont color=\"red\"\u003econtact@elmoujehidin.net\u003c/font\u003e\n\u003c/BODY\u003e\n\u003c/HTML\u003e",
          "source.strings[34]": "\u003cbr\u003e\u003c/b\u003e",
          "source.strings[35]": "\u003cdiv id=\"content\"\u003e\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\n    \u003ctr class=\"first\"\u003e\n        \u003ctd\u003e\u003ccenter\u003eName\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003eSize\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003ePermissions\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003eOptions\u003c/center\u003e\u003c/td\u003e\n    \u003c/tr\u003e",
          "source.strings[36]": "\u003cfont color=\"green\"\u003e",
          "source.strings[37]": "\u003cfont color=\"green\"\u003eChange Name Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[38]": "\u003cfont color=\"green\"\u003eChange Permission Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[39]": "\u003cfont color=\"green\"\u003eDelete Dir Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[40]": "\u003cfont color=\"green\"\u003eDelete File Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[41]": "\u003cfont color=\"green\"\u003eEdit File Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[42]": "\u003cfont color=\"green\"\u003eFile Upload Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[43]": "\u003cfont color=\"red\"\u003e",
          "source.strings[44]": "\u003cfont color=\"red\"\u003eChange Name Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[45]": "\u003cfont color=\"red\"\u003eChange Permission Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[46]": "\u003cfont color=\"red\"\u003eDelete Dir Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[47]": "\u003cfont color=\"red\"\u003eDelete File Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[48]": "\u003cfont color=\"red\"\u003eEdit File Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[49]": "\u003cfont color=\"red\"\u003eFile Upload Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[50]": "\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\nUpload File : \u003cinput type=\"file\" name=\"file\" /\u003e\n\u003cinput type=\"submit\" value=\"upload\" /\u003e\n\u003c/form\u003e\n\u003c/td\u003e\u003c/tr\u003e",
          "source.strings[51]": "\u003cform method=\"POST\"\u003e\n        \u003ctextarea cols=80 rows=20 name=\"src\"\u003e",
          "source.strings[52]": "\u003cform method=\"POST\"\u003e\n        New Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=",
          "source.strings[53]": "\u003cform method=\"POST\"\u003e\n        New Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=\"",
          "source.strings[54]": "\u003cform method=\"POST\"\u003e\n        Permission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=",
          "source.strings[55]": "\u003cform method=\"POST\"\u003e\n        Permission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=\"",
          "source.strings[56]": "\u003ctr class=\"first\"\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003c/tr\u003e",
          "source.strings[57]": "\u003ctr\u003e\n        \u003ctd\u003e\u003ca href=",
          "source.strings[58]": "\u003ctr\u003e\n        \u003ctd\u003e\u003ca href=\\\"?filesrc=$path/$file\u0026path=$path\\\"\u003e$file\u003c/a\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[59]": "\u003ctr\u003e\n        \u003ctd\u003e\u003ca href=\\\"?path=$path/$dir\\\"\u003e$dir\u003c/a\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e--\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[60]": "\u003ctr\u003e\u003ctd\u003eCurrent File : ",
          "source.strings[61]": "\u003e\n\t    \u003coption value=",
          "source.strings[62]": "\u003e\n        \u003cinput type=",
          "source.strings[63]": "\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e",
          "source.strings[64]": "\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e",
          "source.strings[65]": "\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e",
          "source.strings[66]": "\u003e\n        \u003cselect name=",
          "source.strings[67]": "\u003e\u003c/option\u003e\n        \u003coption value=",
          "source.strings[68]": "\u003eChmod\u003c/option\u003e\n        \u003coption value=",
          "source.strings[69]": "\u003eDelete\u003c/option\u003e\n        \u003coption value=",
          "source.strings[70]": "\u003eEdit\u003c/option\u003e\n        \u003c/select\u003e\n        \u003cinput type=",
          "source.strings[71]": "\u003eRename\u003c/option\u003e\n        \u003c/select\u003e\n        \u003cinput type=",
          "source.strings[72]": "\u003eRename\u003c/option\u003e\n        \u003coption value=",
          "source.strings[73]": "?filesrc=",
          "source.strings[74]": "?option\u0026path=",
          "source.strings[75]": "?path=",
          "source.strings[76]": "delete",
          "source.strings[77]": "filesrc",
          "source.strings[78]": "hidden",
          "source.strings[79]": "newname",
          "source.strings[80]": "option",
          "source.strings[81]": "rename",
          "source.strings[82]": "submit",
          "source.strings[83]": "tmp_name",
          "source.functions[0]": "perms"
        },
        "x": 115,
        "id": 0,
        "is": [
          "set_time_limit",
          "error_reporting",
          "get_magic_quotes_gpc",
          "stripslashes",
          "isset",
          "getcwd",
          "str_replace",
          "explode",
          "isset",
          "copy",
          "php_uname",
          "isset",
          "htmlspecialchars",
          "file_get_contents",
          "isset",
          "isset",
          "chmod",
          "substr",
          "sprintf",
          "fileperms",
          "isset",
          "rename",
          "isset",
          "fopen",
          "fwrite",
          "fclose",
          "htmlspecialchars",
          "file_get_contents",
          "isset",
          "rmdir",
          "unlink",
          "scandir",
          "is_dir",
          "is_writable",
          "is_readable",
          "perms",
          "is_writable",
          "is_readable",
          "is_file",
          "filesize",
          "round",
          "round",
          "is_writable",
          "is_readable",
          "perms",
          "is_writable",
          "is_readable",
          "fileperms"
        ],
        "ms": {
          "file": {
            "size": 10143.0
          },
          "text": {
            "tab_count": 3.0,
            "digit_ratio": 0.05,
            "space_count": 2097.0,
            "total_lines": 301.0,
            "char_entropy": 5.05,
            "mixed_indent": true,
            "unique_chars": 89.0,
            "import_density": 15.95,
            "lines_over_200": 1.0,
            "string_density": 1.31,
            "avg_line_length": 32.7,
            "max_line_length": 202.0,
            "empty_line_ratio": 0.04,
            "last_line_length": 31.0,
            "long_token_count": 1.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.24,
            "most_common_ratio": 0.06,
            "identifier_density": 0.73,
            "line_length_stddev": 26.77,
            "normalized_import_count": 2.77,
            "normalized_string_count": 22.65,
            "repeated_char_sequences": 36.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.06,
            "trailing_whitespace_lines": 2.0,
            "imports_to_functions_ratio": 48.0,
            "strings_to_functions_ratio": 393.0,
            "suspicious_identifier_ratio": 0.04,
            "normalized_unique_identifiers": 5.59,
            "identifiers_to_functions_ratio": 46.0
          },
          "imports": {
            "total": 48.0,
            "unique_modules": 30.0,
            "third_party_count": 48.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 393.0,
            "avg_length": 27.62,
            "max_length": 1321.0,
            "avg_entropy": 2.1,
            "email_count": 2.0,
            "total_bytes": 10854.0,
            "entropy_stddev": 1.48,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {
            "chars": 107.0,
            "lines": 11.0,
            "total": 11.0,
            "to_code_ratio": 0.04
          },
          "functions": {
            "total": 1.0,
            "avg_name_length": 5.0,
            "no_params_count": 1.0,
            "avg_length_lines": 52.0,
            "max_length_lines": 52.0,
            "min_length_lines": 52.0,
            "density_per_100_lines": 0.33,
            "code_in_functions_ratio": 0.17
          },
          "identifiers": {
            "total": 220.0,
            "avg_length": 6.8,
            "max_length": 20.0,
            "min_length": 1.0,
            "avg_entropy": 2.29,
            "reuse_ratio": 0.21,
            "unique_count": 46.0,
            "length_stddev": 4.2,
            "sequential_names": 2.0,
            "single_char_count": 2.0,
            "single_char_ratio": 0.04,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.02,
            "all_lowercase_ratio": 0.93,
            "all_uppercase_ratio": 0.07,
            "underscore_prefix_count": 3.0
          }
        },
        "ss": [
          [
            169,
            "\u003c!DOCTYPE HTML\u003e\n\u003cHTML\u003e\n\u003cHEAD\u003e\n\u003clink href=\"\" rel=\"stylesheet\" type=\"text/css\"\u003e\n\t\u003clink rel=\"shortcut icon\" href=\"http://tommiespor"
          ],
          [
            170,
            "\u003c!DOCTYPE HTML\u003e\n\u003cHTML\u003e\n\u003cHEAD\u003e\n\u003clink href=\"\" rel=\"stylesheet\" type=\"text/css\"\u003e\n\t\u003clink rel=\"shortcut icon\" href=\"http://tommiespor"
          ],
          [
            1509,
            "path"
          ],
          [
            1510,
            "path"
          ],
          [
            1538,
            "path"
          ],
          [
            1539,
            "path"
          ],
          [
            1601,
            "\\\\"
          ],
          [
            1606,
            "/"
          ],
          [
            1607,
            "/"
          ],
          [
            1635,
            "/"
          ],
          [
            1636,
            "/"
          ],
          [
            1742,
            "\u003ca href=\"?path=/\"\u003e/\u003c/a\u003e"
          ],
          [
            1743,
            "\u003ca href=\"?path=/\"\u003e/\u003c/a\u003e"
          ],
          [
            1831,
            "\u003ca href=\"?path="
          ],
          [
            1832,
            "\u003ca href=\"?path="
          ],
          [
            1891,
            "$paths[$i]"
          ],
          [
            1932,
            "/"
          ],
          [
            1933,
            "/"
          ],
          [
            1952,
            "\"\u003e"
          ],
          [
            1953,
            "\u003e"
          ],
          [
            1962,
            "\u003c/a\u003e/"
          ],
          [
            1963,
            "\u003c/a\u003e/"
          ],
          [
            1978,
            "\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e"
          ],
          [
            1979,
            "\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e"
          ],
          [
            2017,
            "file"
          ],
          [
            2018,
            "file"
          ],
          [
            2048,
            "file"
          ],
          [
            2049,
            "file"
          ],
          [
            2056,
            "tmp_name"
          ],
          [
            2057,
            "tmp_name"
          ],
          [
            2074,
            "/"
          ],
          [
            2075,
            "/"
          ],
          [
            2086,
            "file"
          ],
          [
            2087,
            "file"
          ],
          [
            2094,
            "name"
          ],
          [
            2095,
            "name"
          ],
          [
            2118,
            "\u003cfont color=\"green\"\u003eFile Upload Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2119,
            "\u003cfont color=\"green\"\u003eFile Upload Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2196,
            "\u003cfont color=\"red\"\u003eFile Upload Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2197,
            "\u003cfont color=\"red\"\u003eFile Upload Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2262,
            "\u003cb\u003e\u003cbr\u003e"
          ],
          [
            2263,
            "\u003cb\u003e\u003cbr\u003e"
          ],
          [
            2284,
            "\u003cbr\u003e\u003c/b\u003e"
          ],
          [
            2285,
            "\u003cbr\u003e\u003c/b\u003e"
          ],
          [
            2301,
            "\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\nUpload File : \u003cinput type=\"file\" name=\"file\" /\u003e\n\u003cinput type=\"submit\" value=\"u"
          ],
          [
            2302,
            "\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\nUpload File : \u003cinput type=\"file\" name=\"file\" /\u003e\n\u003cinput type=\"submit\" value=\"u"
          ],
          [
            2476,
            "filesrc"
          ],
          [
            2477,
            "filesrc"
          ],
          [
            2499,
            "\u003ctr\u003e\u003ctd\u003eCurrent File : "
          ],
          [
            2500,
            "\u003ctr\u003e\u003ctd\u003eCurrent File : "
          ],
          [
            2541,
            "filesrc"
          ],
          [
            2542,
            "filesrc"
          ],
          [
            2562,
            "\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e"
          ],
          [
            2563,
            "\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e"
          ],
          [
            2599,
            "\u003cpre\u003e"
          ],
          [
            2600,
            "\u003cpre\u003e"
          ],
          [
            2648,
            "filesrc"
          ],
          [
            2649,
            "filesrc"
          ],
          [
            2661,
            "\u003c/pre\u003e"
          ],
          [
            2662,
            "\u003c/pre\u003e"
          ],
          [
            2692,
            "option"
          ],
          [
            2693,
            "option"
          ],
          [
            2713,
            "opt"
          ],
          [
            2714,
            "opt"
          ],
          [
            2723,
            "delete"
          ],
          [
            2724,
            "delete"
          ],
          [
            2743,
            "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e"
          ],
          [
            2744,
            "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e"
          ],
          [
            2775,
            "path"
          ],
          [
            2776,
            "path"
          ],
          [
            2783,
            "\u003cbr /\u003e\u003cbr /\u003e"
          ],
          [
            2784,
            "\u003cbr /\u003e\u003cbr /\u003e"
          ],
          [
            2813,
            "opt"
          ],
          [
            2814,
            "opt"
          ],
          [
            2823,
            "chmod"
          ],
          [
            2824,
            "chmod"
          ],
          [
            2857,
            "perm"
          ],
          [
            2858,
            "perm"
          ],
          [
            2896,
            "path"
          ],
          [
            2897,
            "path"
          ],
          [
            2911,
            "perm"
          ],
          [
            2912,
            "perm"
          ],
          [
            2943,
            "\u003cfont color=\"green\"\u003eChange Permission Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2944,
            "\u003cfont color=\"green\"\u003eChange Permission Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3043,
            "\u003cfont color=\"red\"\u003eChange Permission Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3044,
            "\u003cfont color=\"red\"\u003eChange Permission Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3139,
            "\u003cform method=\"POST\"\u003e\n        Permission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=\""
          ],
          [
            3140,
            "\u003cform method=\"POST\"\u003e\n        Permission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value="
          ],
          [
            3246,
            "%o"
          ],
          [
            3247,
            "%o"
          ],
          [
            3269,
            "path"
          ],
          [
            3270,
            "path"
          ],
          [
            3284,
            "\" /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value=\""
          ],
          [
            3285,
            " /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value="
          ],
          [
            3347,
            "path"
          ],
          [
            3348,
            "path"
          ],
          [
            3355,
            "\"\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e"
          ],
          [
            3356,
            "\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e"
          ],
          [
            3494,
            "opt"
          ],
          [
            3495,
            "opt"
          ],
          [
            3504,
            "rename"
          ],
          [
            3505,
            "rename"
          ],
          [
            3539,
            "newname"
          ],
          [
            3540,
            "newname"
          ],
          [
            3582,
            "path"
          ],
          [
            3583,
            "path"
          ],
          [
            3596,
            "/"
          ],
          [
            3597,
            "/"
          ],
          [
            3607,
            "newname"
          ],
          [
            3608,
            "newname"
          ],
          [
            3642,
            "\u003cfont color=\"green\"\u003eChange Name Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3643,
            "\u003cfont color=\"green\"\u003eChange Name Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3736,
            "\u003cfont color=\"red\"\u003eChange Name Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3737,
            "\u003cfont color=\"red\"\u003eChange Name Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3822,
            "name"
          ],
          [
            3823,
            "name"
          ],
          [
            3839,
            "newname"
          ],
          [
            3840,
            "newname"
          ],
          [
            3874,
            "\u003cform method=\"POST\"\u003e\n        New Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=\""
          ],
          [
            3875,
            "\u003cform method=\"POST\"\u003e\n        New Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value="
          ],
          [
            3975,
            "name"
          ],
          [
            3976,
            "name"
          ],
          [
            3983,
            "\" /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value=\""
          ],
          [
            3984,
            " /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value="
          ],
          [
            4046,
            "path"
          ],
          [
            4047,
            "path"
          ],
          [
            4054,
            "\"\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e"
          ],
          [
            4055,
            "\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e"
          ],
          [
            4194,
            "opt"
          ],
          [
            4195,
            "opt"
          ],
          [
            4204,
            "edit"
          ],
          [
            4205,
            "edit"
          ],
          [
            4237,
            "src"
          ],
          [
            4238,
            "src"
          ],
          [
            4278,
            "path"
          ],
          [
            4279,
            "path"
          ],
          [
            4286,
            "w"
          ],
          [
            4287,
            "w"
          ],
          [
            4325,
            "src"
          ],
          [
            4326,
            "src"
          ],
          [
            4356,
            "\u003cfont color=\"green\"\u003eEdit File Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            4357,
            "\u003cfont color=\"green\"\u003eEdit File Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            4448,
            "\u003cfont color=\"red\"\u003eEdit File Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            4449,
            "\u003cfont color=\"red\"\u003eEdit File Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            4561,
            "\u003cform method=\"POST\"\u003e\n        \u003ctextarea cols=80 rows=20 name=\"src\"\u003e"
          ],
          [
            4562,
            "\u003cform method=\"POST\"\u003e\n        \u003ctextarea cols=80 rows=20 name=\"src\"\u003e"
          ],
          [
            4672,
            "path"
          ],
          [
            4673,
            "path"
          ],
          [
            4682,
            "\u003c/textarea\u003e\u003cbr /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value=\""
          ],
          [
            4683,
            "\u003c/textarea\u003e\u003cbr /\u003e\n        \u003cinput type=\"hidden\" name=\"path\" value="
          ],
          [
            4758,
            "path"
          ],
          [
            4759,
            "path"
          ],
          [
            4766,
            "\"\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e"
          ],
          [
            4767,
            "\u003e\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\n        \u003c/form\u003e"
          ],
          [
            4900,
            "\u003c/center\u003e"
          ],
          [
            4901,
            "\u003c/center\u003e"
          ],
          [
            4929,
            "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e"
          ],
          [
            4930,
            "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e"
          ],
          [
            4974,
            "option"
          ],
          [
            4975,
            "option"
          ],
          [
            4995,
            "opt"
          ],
          [
            4996,
            "opt"
          ],
          [
            5005,
            "delete"
          ],
          [
            5006,
            "delete"
          ],
          [
            5034,
            "type"
          ],
          [
            5035,
            "type"
          ],
          [
            5045,
            "dir"
          ],
          [
            5046,
            "dir"
          ],
          [
            5081,
            "path"
          ],
          [
            5082,
            "path"
          ],
          [
            5113,
            "\u003cfont color=\"green\"\u003eDelete Dir Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5114,
            "\u003cfont color=\"green\"\u003eDelete Dir Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5206,
            "\u003cfont color=\"red\"\u003eDelete Dir Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5207,
            "\u003cfont color=\"red\"\u003eDelete Dir Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5295,
            "type"
          ],
          [
            5296,
            "type"
          ],
          [
            5306,
            "file"
          ],
          [
            5307,
            "file"
          ],
          [
            5344,
            "path"
          ],
          [
            5345,
            "path"
          ],
          [
            5376,
            "\u003cfont color=\"green\"\u003eDelete File Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5377,
            "\u003cfont color=\"green\"\u003eDelete File Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5470,
            "\u003cfont color=\"red\"\u003eDelete File Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5471,
            "\u003cfont color=\"red\"\u003eDelete File Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5562,
            "\u003c/center\u003e"
          ],
          [
            5563,
            "\u003c/center\u003e"
          ],
          [
            5615,
            "\u003cdiv id=\"content\"\u003e\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\n    \u003ctr class=\"first\"\u003e\n        \u003c"
          ],
          [
            5616,
            "\u003cdiv id=\"content\"\u003e\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\n    \u003ctr class=\"first\"\u003e\n        \u003c"
          ],
          [
            5964,
            "$path/$dir"
          ],
          [
            5970,
            "/"
          ],
          [
            5989,
            "."
          ],
          [
            5990,
            "."
          ],
          [
            6004,
            ".."
          ],
          [
            6005,
            ".."
          ],
          [
            6033,
            "\u003ctr\u003e\n        \u003ctd\u003e\u003ca href=\\\"?path=$path/$dir\\\"\u003e$dir\u003c/a\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e--\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e"
          ],
          [
            6034,
            "\u003ctr\u003e\n        \u003ctd\u003e\u003ca href="
          ],
          [
            6061,
            "?path="
          ],
          [
            6072,
            "/"
          ],
          [
            6079,
            "\u003e"
          ],
          [
            6084,
            "\u003c/a\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e--\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e"
          ],
          [
            6177,
            "$path/$dir"
          ],
          [
            6183,
            "/"
          ],
          [
            6197,
            "\u003cfont color=\"green\"\u003e"
          ],
          [
            6198,
            "\u003cfont color=\"green\"\u003e"
          ],
          [
            6249,
            "$path/$dir"
          ],
          [
            6255,
            "/"
          ],
          [
            6269,
            "\u003cfont color=\"red\"\u003e"
          ],
          [
            6270,
            "\u003cfont color=\"red\"\u003e"
          ],
          [
            6310,
            "$path/$dir"
          ],
          [
            6316,
            "/"
          ],
          [
            6348,
            "$path/$dir"
          ],
          [
            6354,
            "/"
          ],
          [
            6378,
            "$path/$dir"
          ],
          [
            6384,
            "/"
          ],
          [
            6398,
            "\u003c/font\u003e"
          ],
          [
            6399,
            "\u003c/font\u003e"
          ],
          [
            6431,
            "\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method=\\\"POST\\\" action=\\\"?option\u0026path=$path\\\"\u003e\n        \u003cselect name=\\\"opt\\\"\u003e\n\t    \u003copti"
          ],
          [
            6432,
            "\u003c/center\u003e\u003c/td\u003e\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method="
          ],
          [
            6482,
            "POST"
          ],
          [
            6488,
            " action="
          ],
          [
            6498,
            "?option\u0026path="
          ],
          [
            6518,
            "\u003e\n        \u003cselect name="
          ],
          [
            6543,
            "opt"
          ],
          [
            6548,
            "\u003e\n\t    \u003coption value="
          ],
          [
            6573,
            "\u003e\u003c/option\u003e\n        \u003coption value="
          ],
          [
            6608,
            "delete"
          ],
          [
            6616,
            "\u003eDelete\u003c/option\u003e\n        \u003coption value="
          ],
          [
            6657,
            "chmod"
          ],
          [
            6664,
            "\u003eChmod\u003c/option\u003e\n        \u003coption value="
          ],
          [
            6704,
            "rename"
          ],
          [
            6712,
            "\u003eRename\u003c/option\u003e\n        \u003c/select\u003e\n        \u003cinput type="
          ],
          [
            6769,
            "hidden"
          ],
          [
            6777,
            " name="
          ],
          [
            6785,
            "type"
          ],
          [
            6791,
            " value="
          ],
          [
            6800,
            "dir"
          ],
          [
            6805,
            "\u003e\n        \u003cinput type="
          ],
          [
            6829,
            "hidden"
          ],
          [
            6837,
            " name="
          ],
          [
            6845,
            "name"
          ],
          [
            6851,
            " value="
          ],
          [
            6866,
            "\u003e\n        \u003cinput type="
          ],
          [
            6890,
            "hidden"
          ],
          [
            6898,
            " name="
          ],
          [
            6906,
            "path"
          ],
          [
            6912,
            " value="
          ],
          [
            6926,
            "/"
          ],
          [
            6933,
            "\u003e\n        \u003cinput type="
          ],
          [
            6957,
            "submit"
          ],
          [
            6965,
            " value="
          ],
          [
            6974,
            "\u003e"
          ],
          [
            6977,
            " /\u003e\n        \u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\n        \u003c/tr\u003e"
          ],
          [
            7042,
            "\u003ctr class=\"first\"\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003c/tr\u003e"
          ],
          [
            7043,
            "\u003ctr class=\"first\"\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003c/tr\u003e"
          ],
          [
            7157,
            "$path/$file"
          ],
          [
            7163,
            "/"
          ]
        ],
        "sz": 10143,
        "ts": [
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 1321.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1485",
            "c": 0.8500000238418579,
            "d": "Targets source code directory",
            "e": [
              "\"src\""
            ],
            "i": "objectives/impact/wipe/disk/mass-delete::target-src",
            "l": 1
          },
          {
            "c": 0.7599999904632568,
            "d": "Regex component marker",
            "e": [
              "directory"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PHP rmdir function symbol",
            "e": [
              "rmdir"
            ],
            "i": "micro-behaviors/fs/delete/directory::php-rmdir",
            "l": 3
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "method="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "enctype attribute",
            "e": [
              "enctype="
            ],
            "i": "micro-behaviors/communications/http/post::enctype-attr",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "\u003cfont color=\"red\"\u003eFile Upload Error.\u003c/font\u003e\u003cbr /\u003e",
              "\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\nUpload File : \u003cinput type=\"file\" name=\"file\" /\u003e\n\u003cinput type=\"submit\" value=\"u",
              "\u003cfont color=\"green\"\u003eFile Upload Done.\u003c/font\u003e\u003cbr /\u003e"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.699999988079071,
            "d": "HTTP POST method",
            "e": [
              "\"POST\""
            ],
            "i": "micro-behaviors/communications/http/post::post",
            "l": 1,
            "m": "C0002"
          },
          {
            "c": 0.8500000238418579,
            "d": "Removes PHP script execution time limit",
            "e": [
              "set_time_limit(0)"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 301.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Detects PHP copy file recreation call",
            "e": [
              "copy"
            ],
            "i": "objectives/impact/infect/script::php-copy-call",
            "l": 1
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "fopen("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_GET parameter access",
            "e": [
              "$_GET["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-get",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "scandir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP GET parameter access ($_GET)",
            "e": [
              "$_GET"
            ],
            "i": "micro-behaviors/communications/http/request/params::get-dup",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "File upload access ($_FILES)",
            "e": [
              "$_FILES"
            ],
            "i": "micro-behaviors/communications/http/request/params::files",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Detects PHP rename file recreation call",
            "e": [
              "rename"
            ],
            "i": "objectives/impact/infect/script::php-rename-call",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Disables error reporting (error_reporting(0))",
            "e": [
              "error_reporting(0)"
            ],
            "i": "micro-behaviors/os/stdio::error-reporting-off",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Writes data to an open file",
            "e": [
              "fwrite"
            ],
            "i": "micro-behaviors/fs/write/file/direct::fwrite",
            "l": 3,
            "m": "C0052"
          },
          {
            "c": 1.0,
            "d": "PHP scandir function symbol",
            "e": [
              "scandir"
            ],
            "i": "micro-behaviors/fs/enumerate/directory::php-scandir",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "PHP unlink function symbol",
            "e": [
              "unlink"
            ],
            "i": "micro-behaviors/fs/delete/file::php-unlink",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_POST parameter access",
            "e": [
              "$_POST["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-post",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8199999928474426,
            "d": "Detects overwrite-mode file open",
            "e": [
              "fopen($_POST['path'],'w'"
            ],
            "i": "objectives/impact/infect/script::php-overwrite-file-mode",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "URL parameter fetched and executed",
            "e": [
              "htmlspecialchars(file_get_contents($_POST['path']))",
              "htmlspecialchars(file_get_contents($_GET['filesrc']))",
              "file_get_contents($_GET['filesrc'])",
              "fopen($_POST['path'],'w')",
              "file_get_contents($_POST['path'])"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP POST parameter access ($_POST)",
            "e": [
              "$_POST"
            ],
            "i": "micro-behaviors/communications/http/request/params::post-dup",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 1.0,
            "d": "Inequality check in WordPress user list",
            "e": [
              "!="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1222",
            "c": 0.699999988079071,
            "d": "Changes file permissions via chmod()",
            "e": [
              "chmod"
            ],
            "i": "micro-behaviors/fs/chmod/modify::chmod-call",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8500000238418579,
            "d": "PHP request superglobal access",
            "e": [
              "$_POST"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call",
            "l": 3,
            "m": "B0030"
          },
          {
            "c": 0.699999988079071,
            "d": "Remove execution time limit",
            "e": [
              "set_time_limit"
            ],
            "i": "micro-behaviors/process/control/signal::set-time-limit",
            "l": 3
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "multipart/form-data content type",
            "e": [
              "multipart/form-data"
            ],
            "i": "micro-behaviors/communications/http/post::multipart-form",
            "l": 1,
            "m": "C0002"
          },
          {
            "c": 0.699999988079071,
            "d": "AJAX request handler pattern",
            "e": [
              "$_GET['path']",
              "$_POST['path']",
              "$_POST[$key]",
              "$_GET['option']",
              "$_POST['opt']",
              "$_GET['filesrc']",
              "$_POST['perm']"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1070.004",
            "c": 1.0,
            "d": "Recursive directory cleanup in PHP",
            "e": [
              "unlink",
              "scandir",
              "rmdir"
            ],
            "i": "objectives/evasion/self-delete/scripts::php-recursive-delete",
            "l": 4
          },
          {
            "a": "T1566.002",
            "c": 0.8500000238418579,
            "d": "PHP script writing POST data to local file",
            "e": [
              "$_POST"
            ],
            "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration",
            "l": 4,
            "m": "B0030"
          }
        ],
        "sha": "b1d52f4f34c894c07acf535b7911188c248056b41036c37053bcec93c92e1304",
        "path": "content-post.php",
        "type": "php"
      }
    ],
    "tv": "bef72"
  }
}