{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999707937240601, "class": 2 } ], "prob": 0.9999708, "class": 2, "models": [ { "m": "az", "prob": 0.9994741, "class": 2 }, { "m": "az/scripts", "prob": 0.99996364, "class": 2 }, { "m": "az/php", "prob": 0.9999708, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T22:41:35Z" }, "path": "b5ba14c406bcbd90bb28174d4efc996e", "raw": { "v": "4", "fs": [ { "f": "K₂O₁₂(C₁₆As₅Ca₄Dy₃Er₂AlXe₆CoEuILa₂S₄)H₇(Db₁₁Po₈Cm₈CrF₈Os₅U)Md₄(PaPt₂)Th₃", "k": { "source.imports[0]": "WSOsetcookie", "source.imports[1]": "WSOstripslashes", "source.imports[2]": "addcslashes", "source.imports[3]": "addslashes", "source.imports[4]": "apache_get_modules", "source.imports[5]": "array_map", "source.imports[6]": "array_merge", "source.imports[7]": "array_unique", "source.imports[8]": "base64_decode", "source.imports[9]": "basename", "source.strings[0]": "\n var charset_ = ", "source.strings[1]": "\n\u003c/div\u003e\n\u003ctable class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'\u003e\n\t\u003ctr\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit='g(null,this.c.value,", "source.strings[2]": "\n\u003c/div\u003e\n\u003ctable class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'\u003e\n\t\u003ctr\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit='g(null,this.c.value,\\\"\\\");return false;'\u003e\u003cspan\u003eChange dir:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=c value=", "source.strings[3]": " !important; }\nspan{ font-weight: bolder; }\nh1{ border-left:5px solid ", "source.strings[4]": " ) \u003cspan\u003eGroup:\u003c/span\u003e ", "source.strings[5]": " )\u003cbr\u003e", "source.strings[6]": " - WSO ", "source.strings[7]": " \u003c/span\u003e", "source.strings[8]": " \u003ca href=", "source.strings[9]": " \u003ca href=\"", "source.has_imports": true, "source.imports[10]": "bindec", "source.imports[11]": "call_user_func", "source.imports[12]": "ceil", "source.imports[13]": "cf", "source.imports[14]": "chdir", "source.imports[15]": "chmod", "source.imports[16]": "chr", "source.imports[17]": "class_exists", "source.imports[18]": "clearstatcache", "source.imports[19]": "closedir", "source.imports[20]": "copy", "source.imports[21]": "copy_paste", "source.imports[22]": "count", "source.imports[23]": "date", "source.imports[24]": "decbin", "source.imports[25]": "dechex", "source.imports[26]": "define", "source.imports[27]": "deleteDir", "source.imports[28]": "die", "source.imports[29]": "disk_total_space", "source.imports[30]": "diskfreespace", "source.imports[31]": "each", "source.imports[32]": "empty", "source.imports[33]": "error_reporting", "source.imports[34]": "escapeshellarg", "source.imports[35]": "eval", "source.imports[36]": "exec", "source.imports[37]": "explode", "source.imports[38]": "fclose", "source.imports[39]": "feof", "source.imports[40]": "file", "source.imports[41]": "file_exists", "source.imports[42]": "file_get_contents", "source.imports[43]": "fileatime", "source.imports[44]": "filectime", "source.imports[45]": "filegroup", "source.imports[46]": "filemtime", "source.imports[47]": "fileowner", "source.imports[48]": "fileperms", "source.imports[49]": "filesize", "source.imports[50]": "filetype", "source.imports[51]": "fopen", "source.imports[52]": "fread", "source.imports[53]": "ftp_close", "source.imports[54]": "ftp_connect", "source.imports[55]": "ftp_login", "source.imports[56]": "func_get_arg", "source.imports[57]": "func_num_args", "source.imports[58]": "function_exists", "source.imports[59]": "fwrite", "source.imports[60]": "get_current_user", "source.imports[61]": "get_magic_quotes_gpc", "source.imports[62]": "getcwd", "source.imports[63]": "getenv", "source.imports[64]": "getmygid", "source.imports[65]": "getmyuid", "source.imports[66]": "glob", "source.imports[67]": "header", "source.imports[68]": "hexdec", "source.imports[69]": "highlight_file", "source.imports[70]": "htmlspecialchars", "source.imports[71]": "iconv", "source.imports[72]": "implode", "source.imports[73]": "in_array", "source.imports[74]": "ini_get", "source.imports[75]": "ini_set", "source.imports[76]": "is_array", "source.imports[77]": "is_dir", "source.imports[78]": "is_file", "source.imports[79]": "is_int", "source.imports[80]": "is_link", "source.imports[81]": "is_numeric", "source.imports[82]": "is_readable", "source.imports[83]": "is_resource", "source.imports[84]": "is_writable", "source.imports[85]": "isset", "source.imports[86]": "join", "source.imports[87]": "md5", "source.imports[88]": "mime_content_type", "source.imports[89]": "mkdir", "source.imports[90]": "move_uploaded_file", "source.imports[91]": "mysql_close", "source.imports[92]": "mysql_connect", "source.imports[93]": "mysql_error", "source.imports[94]": "mysql_fetch_array", "source.imports[95]": "mysql_fetch_assoc", "source.imports[96]": "mysql_get_client_info", "source.imports[97]": "mysql_query", "source.imports[98]": "mysql_real_escape_string", "source.imports[99]": "mysql_select_db", "source.strings[10]": " \u003ca href=# onclick=\"g(", "source.strings[11]": " \u003ca href=# onclick=\"g(\\'FilesMan\\',\\", "source.strings[12]": " \u003ca href=# onclick=\"g(\\'Php\\',null,\\'\\',\\'info\\')\"\u003e[ phpinfo ]\u003c/a\u003e \u003cspan\u003eDatetime:\u003c/span\u003e ", "source.strings[13]": " \u003cfont color='green'\u003e(Writeable)\u003c/font\u003e", "source.strings[14]": " \u003cfont color=red\u003e(Not writable)\u003c/font\u003e", "source.strings[15]": " \u003cspan\u003eFree:\u003c/span\u003e ", "source.strings[16]": " \u003cspan\u003eSafe mode:\u003c/span\u003e ", "source.strings[17]": " ]\u003c/a\u003e ", "source.strings[18]": " target=_blank\u003e[exploit-db.com]\u003c/a\u003e\u003c/nobr\u003e\u003cbr\u003e", "source.strings[19]": "\" target=_blank\u003e[exploit-db.com]\u003c/a\u003e\u003c/nobr\u003e\u003cbr\u003e", "source.strings[20]": "%\"\u003e[ \u003ca href=\"#\" onclick=\"g(", "source.strings[21]": "%\"\u003e[ \u003ca href=\"#\" onclick=\"g(\\", "source.strings[22]": "%)\u003cbr\u003e", "source.strings[23]": ")\"\u003e[ home ]\u003c/a\u003e\u003cbr\u003e", "source.strings[24]": ")\"\u003e[ phpinfo ]\u003c/a\u003e \u003cspan\u003eDatetime:\u003c/span\u003e ", "source.strings[25]": ");return false;'\u003e\u003cspan\u003eChange dir:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=c value=", "source.strings[26]": ", 'm');\n\t\t\t\tvar arr=reg.exec(req.responseText);\n\t\t\t\teval(arr[2].substr(0, arr[1]));\n\t\t\t} else alert('Request error!');\n\t}\n\u003c/script\u003e\n\u003chead\u003e\u003cbody\u003e\u003cdiv style='position:absolute;width:100%;background-color:#444;top:0;left:0;'\u003e\n\u003cform method=post name=mf style='display:none;'\u003e\n\u003cinput type=hidden name=a\u003e\n\u003cinput type=hidden name=c\u003e\n\u003cinput type=hidden name=p1\u003e\n\u003cinput type=hidden name=p2\u003e\n\u003cinput type=hidden name=p3\u003e\n\u003cinput type=hidden name=charset\u003e\n\u003c/form\u003e", "source.strings[27]": ", params);\n\t}\n\tfunction sr(url, params) {\n\t\tif (window.XMLHttpRequest)\n\t\t\treq = new XMLHttpRequest();\n\t\telse if (window.ActiveXObject)\n\t\t\treq = new ActiveXObject('Microsoft.XMLHTTP');\n if (req) {\n req.onreadystatechange = processReqChange;\n req.open('POST', url, true);\n req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');\n req.send(params);\n }\n\t}\n\tfunction processReqChange() {\n\t\tif( (req.readyState == 4) )\n\t\t\tif(req.status == 200) {\n\t\t\t\tvar reg = new RegExp(", "source.strings[28]": ", params);\n\t}\n\tfunction sr(url, params) {\n\t\tif (window.XMLHttpRequest)\n\t\t\treq = new XMLHttpRequest();\n\t\telse if (window.ActiveXObject)\n\t\t\treq = new ActiveXObject('Microsoft.XMLHTTP');\n if (req) {\n req.onreadystatechange = processReqChange;\n req.open('POST', url, true);\n req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');\n req.send(params);\n }\n\t}\n\tfunction processReqChange() {\n\t\tif( (req.readyState == 4) )\n\t\t\tif(req.status == 200) {\n\t\t\t\tvar reg = new RegExp(\\\"(\\\\\\\\d+)([\\\\\\\\S\\\\\\\\s]*)\\\", 'm');\n\t\t\t\tvar arr=reg.exec(req.responseText);\n\t\t\t\teval(arr[2].substr(0, arr[1]));\n\t\t\t} else alert('Request error!');\n\t}\n\u003c/script\u003e\n\u003chead\u003e\u003cbody\u003e\u003cdiv style='position:absolute;width:100%;background-color:#444;top:0;left:0;'\u003e\n\u003cform method=post name=mf style='display:none;'\u003e\n\u003cinput type=hidden name=a\u003e\n\u003cinput type=hidden name=c\u003e\n\u003cinput type=hidden name=p1\u003e\n\u003cinput type=hidden name=p2\u003e\n\u003cinput type=hidden name=p3\u003e\n\u003cinput type=hidden name=charset\u003e\n\u003c/form\u003e", "source.strings[29]": ",null,", "source.strings[30]": "/\\')\"\u003e[ ", "source.strings[31]": "1410fb244fdf8252429fcaba7415a3ea", "source.strings[32]": ";\n var a_ = ", "source.strings[33]": ";\n var d = document;\n\tfunction set(a,c,p1,p2,p3,charset) {\n\t\tif(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;\n\t\tif(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;\n\t\tif(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;\n\t\tif(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;\n\t\tif(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;\n\t\tif(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;\n\t}\n\tfunction g(a,c,p1,p2,p3,charset) {\n\t\tset(a,c,p1,p2,p3,charset);\n\t\td.mf.submit();\n\t}\n\tfunction a(a,c,p1,p2,p3,charset) {\n\t\tset(a,c,p1,p2,p3,charset);\n\t\tvar params = 'ajax=true';\n\t\tfor(i=0;i\u003cd.mf.elements.length;i++)\n\t\t\tparams += '\u0026'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);\n\t\tsr(", "source.strings[34]": ";\n var p1_ = ", "source.strings[35]": ";\n var p2_ = ", "source.strings[36]": ";\n var p3_ = ", "source.strings[37]": "; font: 9pt Monospace,'Courier New'; }\nform{ margin:0px; }\n#toolsTbl{ text-align:center; }\n.toolsInp{ width: 300px }\n.main th{text-align:left;background-color:#5e5e5e;}\n.main tr:hover{background-color:#5e5e5e}\n.l1{background-color:#444}\n.l2{background-color:#333}\npre{font-family:Courier,Monospace;}\n\u003c/style\u003e\n\u003cscript\u003e\n var c_ = ", "source.strings[38]": ";padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }\ndiv.content{ padding: 5px;margin-left:5px;background-color:#333; }\na{ text-decoration:none; }\na:hover{ text-decoration:underline; }\n.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }\n.bigarea{ width:100%;height:300px; }\ninput,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid ", "source.strings[39]": "\u003c/a\u003e ]\u003c/th\u003e", "source.strings[40]": "\u003c/font\u003e", "source.strings[41]": "\u003c/nobr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e", "source.strings[42]": "\u003c/optgroup\u003e\u003c/select\u003e\u003cbr\u003e\u003cspan\u003eServer IP:\u003c/span\u003e\u003cbr\u003e", "source.strings[43]": "\u003c/option\u003e", "source.strings[44]": "\u003c/pre\u003e", "source.strings[45]": "\u003c/span\u003e\u003c/td\u003e", "source.strings[46]": "\u003c/title\u003e\n\u003cstyle\u003e\nbody{background-color:#444;color:#e1e1e1;}\nbody,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }\ntable.info{ color:#fff;background-color:#222; }\nspan,h1,a{ color: ", "source.strings[47]": "\u003c/title\u003e\n\u003cstyle\u003e\nbody{background-color:#444;color:#e1e1e1;}\nbody,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }\ntable.info{ color:#fff;background-color:#222; }\nspan,h1,a{ color: $color !important; }\nspan{ font-weight: bolder; }\nh1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }\ndiv.content{ padding: 5px;margin-left:5px;background-color:#333; }\na{ text-decoration:none; }\na:hover{ text-decoration:underline; }\n.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }\n.bigarea{ width:100%;height:300px; }\ninput,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }\nform{ margin:0px; }\n#toolsTbl{ text-align:center; }\n.toolsInp{ width: 300px }\n.main th{text-align:left;background-color:#5e5e5e;}\n.main tr:hover{background-color:#5e5e5e}\n.l1{background-color:#444}\n.l2{background-color:#333}\npre{font-family:Courier,Monospace;}\n\u003c/style\u003e\n\u003cscript\u003e\n var c_ = ", "source.strings[48]": "\u003c/tr\u003e\u003c/table\u003e\u003cdiv style=\"margin:5\"\u003e", "source.strings[49]": "\u003ca href=\"#\" onclick=\"g(", "source.strings[50]": "\u003ca href=\"#\" onclick=\"g(\\'FilesMan\\',\\", "source.strings[51]": "\u003ca href='#' onclick='g(", "source.strings[52]": "\u003ca href='#' onclick='g(\\\"FilesMan\\\",\\", "source.strings[53]": "\u003cbr\u003e\u003cinput class='toolsInp' type=file name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003cbr \u003e\u003c/td\u003e\n\t\u003c/tr\u003e\u003c/table\u003e\u003c/div\u003e\u003c/body\u003e\u003c/html\u003e", "source.strings[54]": "\u003cbr\u003e\u003cinput class='toolsInp' type=text name=d\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit=", "source.strings[55]": "\u003cbr\u003e\u003cinput class='toolsInp' type=text name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\u003c/tr\u003e\u003ctr\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit=", "source.strings[56]": "\u003cbr\u003e\u003cspan\u003eClient IP:\u003c/span\u003e\u003cbr\u003e", "source.strings[57]": "\u003cbr\u003eDrives:", "source.strings[58]": "\u003cfont color=#25ff00\u003e", "source.strings[59]": "\u003cfont color=#FF0000\u003e", "source.strings[60]": "\u003cfont color=green\u003e\u003cb\u003eOFF\u003c/b\u003e\u003c/font\u003e", "source.strings[61]": "\u003cfont color=red\u003eON\u003c/font\u003e", "source.strings[62]": "\u003cfont color=white\u003e", "source.strings[63]": "\u003ch1\u003eServer security information\u003c/h1\u003e\u003cdiv class=content\u003e", "source.strings[64]": "\u003chtml\u003e\u003chead\u003e\u003cmeta http-equiv='Content-Type' content='text/html; charset=", "source.strings[65]": "\u003coption value=", "source.strings[66]": "\u003coption value=\"", "source.strings[67]": "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e", "source.strings[68]": "\u003cpre class=ml1\u003e", "source.strings[69]": "\u003cspan\u003e", "source.strings[70]": "\u003ctable class=info cellpadding=3 cellspacing=0 width=100%\u003e\u003ctr\u003e\u003ctd width=1\u003e\u003cspan\u003eUname:\u003cbr\u003eUser:\u003cbr\u003ePhp:\u003cbr\u003eHdd:\u003cbr\u003eCwd:", "source.strings[71]": "\u003ctable style=\"border-top:2px solid #333;\" cellpadding=3 cellspacing=0 width=100%\u003e\u003ctr\u003e", "source.strings[72]": "\u003ctd width=1 align=right\u003e\u003cnobr\u003e\u003cselect onchange=\"g(null,null,null,null,null,this.value)\"\u003e\u003coptgroup label=\"Page charset\"\u003e", "source.strings[73]": "\u003ctd\u003e\u003cnobr\u003e", "source.strings[74]": "\u003cth width=", "source.strings[75]": "\u003cth width=\"", "source.strings[76]": "\u003e\n\t\t\u003cinput type=hidden name=p1 value='uploadFile'\u003e\n\t\t\u003cinput type=hidden name=charset value=", "source.strings[77]": "\u003e\n\t\t\u003cspan\u003eUpload file:\u003c/span\u003e", "source.strings[78]": "\u003e\n\t\t\u003cspan\u003eUpload file:\u003c/span\u003e$is_writable\u003cbr\u003e\u003cinput class='toolsInp' type=file name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003cbr \u003e\u003c/td\u003e\n\t\u003c/tr\u003e\u003c/table\u003e\u003c/div\u003e\u003c/body\u003e\u003c/html\u003e", "source.strings[79]": "\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit=", "source.strings[80]": "\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit=\\\"g('FilesTools',null,this.f.value);return false;\\\"\u003e\u003cspan\u003eRead file:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\u003c/tr\u003e\u003ctr\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit=\\\"g('FilesMan',null,'mkdir',this.d.value);return false;\\\"\u003e\u003cspan\u003eMake dir:\u003c/span\u003e$is_writable\u003cbr\u003e\u003cinput class='toolsInp' type=text name=d\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit=\\\"g('FilesTools',null,this.f.value,'mkfile');return false;\\\"\u003e\u003cspan\u003eMake file:\u003c/span\u003e$is_writable\u003cbr\u003e\u003cinput class='toolsInp' type=text name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\u003c/tr\u003e\u003ctr\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit=\\\"g('Console',null,this.c.value);return false;\\\"\u003e\u003cspan\u003eExecute:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=c value=''\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\t\u003ctd\u003e\u003cform method='post' ENCTYPE='multipart/form-data'\u003e\n\t\t\u003cinput type=hidden name=a value='FilesMAn'\u003e\n\t\t\u003cinput type=hidden name=c value=", "source.strings[81]": "\u003e\u003cspan\u003eExecute:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=c value=''\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\t\u003ctd\u003e\u003cform method='post' ENCTYPE='multipart/form-data'\u003e\n\t\t\u003cinput type=hidden name=a value='FilesMAn'\u003e\n\t\t\u003cinput type=hidden name=c value=", "source.strings[82]": "\u003e\u003cspan\u003eMake dir:\u003c/span\u003e", "source.strings[83]": "\u003e\u003cspan\u003eMake file:\u003c/span\u003e", "source.strings[84]": "\u003e\u003cspan\u003eRead file:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\n\t\u003c/tr\u003e\u003ctr\u003e\n\t\t\u003ctd\u003e\u003cform onsubmit=", "source.strings[85]": "\u003e\u003ctitle\u003e", "source.strings[86]": "ARP Table", "source.strings[87]": "Bruteforce", "source.strings[88]": "Console", "source.strings[89]": "Disabled PHP Functions", "source.strings[90]": "FilesMan", "source.strings[91]": "Find *config*.php in current dir", "source.strings[92]": "Find index.php in current dir", "source.strings[93]": "Google", "source.strings[94]": "HTTP/1.0 404 Not Found", "source.strings[95]": "HTTP_HOST", "source.strings[96]": "HTTP_USER_AGENT", "source.strings[97]": "IP Configuration", "source.strings[98]": "KOI8-R", "source.strings[99]": "KOI8-U", "source.functions[0]": "DbClass", "source.functions[1]": "WSOsetcookie", "source.functions[2]": "WSOstripslashes", "source.functions[3]": "actionBruteforce", "source.functions[4]": "actionConsole", "source.functions[5]": "actionFilesMan", "source.functions[6]": "actionFilesTools", "source.functions[7]": "actionLogout", "source.functions[8]": "actionNetwork", "source.functions[9]": "actionPhp", "source.imports[100]": "mysql_set_charset", "source.imports[101]": "nl2br", "source.imports[102]": "ob_get_clean", "source.imports[103]": "ob_start", "source.imports[104]": "opendir", "source.imports[105]": "ord", "source.imports[106]": "passthru", "source.imports[107]": "pclose", "source.imports[108]": "pg_close", "source.imports[109]": "pg_connect", "source.imports[110]": "pg_fetch_assoc", "source.imports[111]": "pg_last_error", "source.imports[112]": "pg_query", "source.imports[113]": "pg_set_client_encoding", "source.imports[114]": "php_uname", "source.imports[115]": "phpinfo", "source.imports[116]": "phpversion", "source.imports[117]": "popen", "source.imports[118]": "posix_getegid", "source.imports[119]": "posix_geteuid", "source.imports[120]": "posix_getgrgid", "source.imports[121]": "posix_getpwuid", "source.imports[122]": "pow", "source.imports[123]": "preg_match", "source.imports[124]": "preg_replace", "source.imports[125]": "range", "source.imports[126]": "readdir", "source.imports[127]": "readlink", "source.imports[128]": "realpath", "source.imports[129]": "rename", "source.imports[130]": "reset", "source.imports[131]": "rmdir", "source.imports[132]": "scandir", "source.imports[133]": "serialize", "source.imports[134]": "set_magic_quotes_runtime", "source.imports[135]": "set_time_limit", "source.imports[136]": "setcookie", "source.imports[137]": "shell_exec", "source.imports[138]": "sleep", "source.imports[139]": "sprintf", "source.imports[140]": "strLen", "source.imports[141]": "str_replace", "source.imports[142]": "strcmp", "source.imports[143]": "stripslashes", "source.imports[144]": "strlen", "source.imports[145]": "strpos", "source.imports[146]": "strtolower", "source.imports[147]": "strtotime", "source.imports[148]": "strtoupper", "source.imports[149]": "substr", "source.imports[150]": "system", "source.imports[151]": "time", "source.imports[152]": "touch", "source.imports[153]": "trim", "source.imports[154]": "unlink", "source.imports[155]": "unserialize", "source.imports[156]": "urldecode", "source.imports[157]": "urlencode", "source.imports[158]": "usort", "source.imports[159]": "wsoBruteForce", "source.imports[160]": "wsoEx", "source.imports[161]": "wsoFooter", "source.imports[162]": "wsoHeader", "source.imports[163]": "wsoLogin", "source.imports[164]": "wsoPerms", "source.imports[165]": "wsoPermsColor", "source.imports[166]": "wsoRecursiveGlob", "source.imports[167]": "wsoScandir", "source.imports[168]": "wsoSecParam", "source.imports[169]": "wsoViewSize", "source.imports[170]": "wsoWhich", "source.strings[100]": "Linux Kernel ", "source.strings[101]": "List Directory", "source.strings[102]": "List dir", "source.strings[103]": "Loaded Apache modules", "source.strings[104]": "Locate", "source.strings[105]": "Logout", "source.strings[106]": "MSNBot", "source.strings[107]": "Network", "source.strings[108]": "Open base dir", "source.strings[109]": "REMOTE_ADDR", "source.strings[110]": "REQUEST_URI", "source.strings[111]": "Rambler", "source.strings[112]": "SERVER_ADDR", "source.strings[113]": "SERVER_SOFTWARE", "source.strings[114]": "Sec. Info", "source.strings[115]": "SecInfo", "source.strings[116]": "Self remove", "source.strings[117]": "SelfRemove", "source.strings[118]": "Server software", "source.strings[119]": "Show active connections", "source.strings[120]": "Show computers", "source.strings[121]": "Show running services", "source.strings[122]": "String tools", "source.strings[123]": "StringTools", "source.strings[124]": "User accounts", "source.strings[125]": "WSO_VERSION", "source.strings[126]": "WSOstripslashes", "source.strings[127]": "Windows-1251", "source.strings[128]": "Y-m-d H:i:s", "source.strings[129]": "Yandex", "source.strings[130]": "\\',\\'\\',\\'\\',\\'\\')\"\u003e[ home ]\u003c/a\u003e\u003cbr\u003e", "source.strings[131]": "\\',null,\\'\\',\\'\\',\\'\\')\"\u003e", "source.strings[132]": "apache_get_modules", "source.strings[133]": "arp -a", "source.strings[134]": "auth_pass", "source.strings[135]": "charset", "source.strings[136]": "config*", "source.strings[137]": "default_charset", "source.strings[138]": "dir /s /w /b *config*.php", "source.strings[139]": "dir /s /w /b index.php", "source.strings[140]": "disable_functions", "source.strings[141]": "error_log", "source.strings[142]": "find . -perm -2 -ls", "source.strings[143]": "find . -type f -name ", "source.strings[144]": "find . -type f -name .bash_history", "source.strings[145]": "find . -type f -name .fetchmailrc", "source.strings[146]": "find . -type f -name .htpasswd", "source.strings[147]": "find . -type f -name \\\"config*\\", "source.strings[148]": "find . -type f -name service.pwd", "source.strings[149]": "find . -type f -perm -02000 -ls", "source.strings[150]": "find . -type f -perm -04000 -ls", "source.strings[151]": "find .bash_history files in current dir", "source.strings[152]": "find .fetchmailrc files in current dir", "source.strings[153]": "find .htpasswd files in current dir", "source.strings[154]": "find / -perm -2 -ls", "source.strings[155]": "find / -type f -name ", "source.strings[156]": "find / -type f -name .bash_history", "source.strings[157]": "find / -type f -name .fetchmailrc", "source.strings[158]": "find / -type f -name .htpasswd", "source.strings[159]": "find / -type f -name \\\"config*\\", "source.strings[160]": "find / -type f -name config.inc.php", "source.strings[161]": "find / -type f -name service.pwd", "source.strings[162]": "find / -type f -perm -02000 -ls", "source.strings[163]": "find / -type f -perm -04000 -ls", "source.strings[164]": "find all .bash_history files", "source.strings[165]": "find all .fetchmailrc files", "source.strings[166]": "find all .htpasswd files", "source.strings[167]": "find all service.pwd files", "source.strings[168]": "find all sgid files", "source.strings[169]": "find all suid files", "source.strings[170]": "find all writable folders and files", "source.strings[171]": "find all writable folders and files in current dir", "source.strings[172]": "find config* files", "source.strings[173]": "find config* files in current dir", "source.strings[174]": "find config.inc.php files", "source.strings[175]": "find service.pwd files in current dir", "source.strings[176]": "find sgid files in current dir", "source.strings[177]": "find suid files in current dir", "source.strings[178]": "g('Console',null,this.c.value);return false;", "source.strings[179]": "g('FilesMan',null,'mkdir',this.d.value);return false;", "source.strings[180]": "g('FilesTools',null,this.f.value);return false;", "source.strings[181]": "g('FilesTools',null,this.f.value,'mkfile');return false;", "source.strings[182]": "home_cwd", "source.strings[183]": "http://exploit-db.com/search/?action=search\u0026filter_description=", "source.strings[184]": "ia_archiver", "source.strings[185]": "ipconfig /all", "source.strings[186]": "list file attributes on a Linux second extended file system", "source.strings[187]": "locate '.bash_history", "source.strings[188]": "locate '.conf", "source.strings[189]": "locate '.fetchmailrc", "source.strings[190]": "locate '.htpasswd", "source.strings[191]": "locate '.mysql_history", "source.strings[192]": "locate '.pwd", "source.strings[193]": "locate '.sql", "source.strings[194]": "locate .bash_history files", "source.strings[195]": "locate .conf files", "source.strings[196]": "locate .fetchmailrc files", "source.strings[197]": "locate .htpasswd files", "source.strings[198]": "locate .mysql_history files", "source.strings[199]": "locate .pwd files", "source.strings[200]": "locate .sql files", "source.strings[201]": "locate admin.php", "source.strings[202]": "locate admin.php files", "source.strings[203]": "locate backup", "source.strings[204]": "locate backup files", "source.strings[205]": "locate cfg.php", "source.strings[206]": "locate cfg.php files", "source.strings[207]": "locate conf.php", "source.strings[208]": "locate conf.php files", "source.strings[209]": "locate config", "source.strings[210]": "locate config* files ", "source.strings[211]": "locate config.dat", "source.strings[212]": "locate config.dat files", "source.strings[213]": "locate config.default.php", "source.strings[214]": "locate config.default.php files", "source.strings[215]": "locate config.inc", "source.strings[216]": "locate config.inc files", "source.strings[217]": "locate config.inc.php", "source.strings[218]": "locate config.php", "source.strings[219]": "locate config.php files", "source.strings[220]": "locate dump", "source.strings[221]": "locate dump files", "source.strings[222]": "locate httpd.conf", "source.strings[223]": "locate httpd.conf files", "source.strings[224]": "locate my.conf", "source.strings[225]": "locate my.conf files", "source.strings[226]": "locate priv", "source.strings[227]": "locate priv files", "source.strings[228]": "locate proftpd.conf", "source.strings[229]": "locate proftpd.conf files", "source.strings[230]": "locate psybnc.conf", "source.strings[231]": "locate psybnc.conf files", "source.strings[232]": "locate vhosts.conf", "source.strings[233]": "locate vhosts.conf files", "source.strings[234]": "log_errors", "source.strings[235]": "ls -lha", "source.strings[236]": "lsattr -va", "source.strings[237]": "max_execution_time", "source.strings[238]": "net start", "source.strings[239]": "net user", "source.strings[240]": "net view", "source.strings[241]": "netstat -an", "source.strings[242]": "netstat -an | grep -i listen", "source.strings[243]": "passthru", "source.strings[244]": "posix_getegid", "source.strings[245]": "posix_getgrgid", "source.strings[246]": "posix_getpwuid", "source.strings[247]": "process status", "source.strings[248]": "ps aux", "source.strings[249]": "safe_mode", "source.strings[250]": "scandir", "source.strings[251]": "selected", "source.strings[252]": "shell_exec", "source.strings[253]": "show opened ports", "source.strings[254]": "system", "source.strings[255]": "which ", "source.functions[10]": "actionRC", "source.functions[11]": "actionSecInfo", "source.functions[12]": "actionSelfRemove", "source.functions[13]": "actionSql", "source.functions[14]": "actionStringTools", "source.functions[15]": "ascii2hex", "source.functions[16]": "binhex", "source.functions[17]": "cf", "source.functions[18]": "connect", "source.functions[19]": "copy_paste", "source.functions[20]": "deleteDir", "source.functions[21]": "dump", "source.functions[22]": "error", "source.functions[23]": "fetch", "source.functions[24]": "full_urlencode", "source.functions[25]": "hex2ascii", "source.functions[26]": "hex2bin", "source.functions[27]": "listDbs", "source.functions[28]": "listTables", "source.functions[29]": "loadFile", "source.functions[30]": "move_paste", "source.functions[31]": "posix_getgrgid", "source.functions[32]": "posix_getpwuid", "source.functions[33]": "query", "source.functions[34]": "selectdb", "source.functions[35]": "setCharset", "source.functions[36]": "wsoBruteForce", "source.functions[37]": "wsoCmp", "source.functions[38]": "wsoEx", "source.functions[39]": "wsoFooter", "source.functions[40]": "wsoHeader", "source.functions[41]": "wsoLogin", "source.functions[42]": "wsoPerms", "source.functions[43]": "wsoPermsColor", "source.functions[44]": "wsoRecursiveGlob", "source.functions[45]": "wsoScandir", "source.functions[46]": "wsoSecParam", "source.functions[47]": "wsoViewSize", "source.functions[48]": "wsoWhich" }, "x": 1043, "id": 0, "is": [ "empty", "preg_match", "implode", "header", "ini_set", "ini_set", "ini_set", "set_time_limit", "set_magic_quotes_runtime", "define", "get_magic_quotes_gpc", "is_array", "array_map", "stripslashes", "WSOstripslashes", "WSOstripslashes", "die", "setcookie", "empty", "isset", "md5", "WSOsetcookie", "md5", "isset", "md5", "md5", "wsoLogin", "strtolower", "substr", "ini_get", "error_reporting", "ini_get", "getcwd", "isset", "chdir", "getcwd", "str_replace", "str_replace", "strlen", "isset", "md5", "md5", "empty", "htmlspecialchars", "htmlspecialchars", "htmlspecialchars", "strpos", "htmlspecialchars", "strpos", "htmlspecialchars", "strpos", "htmlspecialchars", "addslashes", "diskfreespace", "disk_total_space", "php_uname", "php_uname", "strpos", "urlencode", "substr", "urlencode", "substr", "function_exists", "get_current_user", "getmyuid", "getmygid", "posix_getpwuid", "posix_geteuid", "posix_getgrgid", "posix_getegid", "explode", "count", "empty", "count", "range", "is_dir", "substr", "php_uname", "phpversion", "date", "wsoViewSize", "wsoViewSize", "wsoPermsColor", "is_writable", "htmlspecialchars", "isset", "function_exists", "strpos", "function_exists", "strpos", "function_exists", "exec", "join", "function_exists", "ob_start", "passthru", "ob_get_clean", "function_exists", "ob_start", "system", "ob_get_clean", "function_exists", "shell_exec", "is_resource", "popen", "feof", "fread", "pclose", "is_int", "sprintf", "sprintf", "sprintf", "sprintf", "is_readable", "wsoPerms", "fileperms", "is_writable", "wsoPerms", "fileperms", "wsoPerms", "fileperms", "function_exists", "scandir", "opendir", "readdir", "wsoEx", "empty", "wsoHeader", "trim", "strpos", "wsoSecParam", "getenv", "function_exists", "wsoSecParam", "implode", "apache_get_modules", "wsoSecParam", "wsoSecParam", "ini_get", "wsoSecParam", "ini_get", "wsoSecParam", "ini_get", "wsoSecParam", "function_exists", "function_exists", "mysql_get_client_info", "function_exists", "function_exists", "function_exists", "wsoSecParam", "implode", "wsoSecParam", "is_readable", "wsoSecParam", "is_readable", "wsoSecParam", "file_get_contents", "wsoSecParam", "file_get_contents", "wsoWhich", "wsoSecParam", "implode", "wsoWhich", "wsoSecParam", "implode", "wsoWhich", "wsoSecParam", "implode", "wsoSecParam", "wsoEx", "wsoSecParam", "file_get_contents", "isset", "is_numeric", "is_numeric", "posix_getpwuid", "join", "wsoSecParam", "wsoSecParam", "wsoEx", "wsoSecParam", "wsoEx", "wsoSecParam", "wsoEx", "wsoFooter", "isset", "WSOsetcookie", "md5", "ob_start", "eval", "addcslashes", "htmlspecialchars", "ob_get_clean", "strlen", "empty", "empty", "WSOsetcookie", "md5", "wsoHeader", "isset", "ob_start", "phpinfo", "ob_get_clean", "preg_replace", "str_replace", "empty", "htmlspecialchars", "md5", "empty", "empty", "ob_start", "eval", "htmlspecialchars", "ob_get_clean", "wsoFooter", "empty", "unserialize", "empty", "move_uploaded_file", "mkdir", "substr", "opendir", "readdir", "basename", "basename", "filetype", "deleteDir", "unlink", "closedir", "rmdir", "is_array", "urldecode", "is_dir", "deleteDir", "unlink", "is_dir", "mkdir", "opendir", "readdir", "copy_paste", "is_file", "copy", "copy_paste", "is_dir", "mkdir", "opendir", "readdir", "copy_paste", "is_file", "copy", "rename", "class_exists", "chdir", "is_file", "is_dir", "realpath", "chdir", "class_exists", "chdir", "array_map", "wsoEx", "escapeshellarg", "implode", "chdir", "setcookie", "time", "empty", "WSOsetcookie", "WSOsetcookie", "serialize", "WSOsetcookie", "wsoHeader", "wsoScandir", "isset", "wsoFooter", "empty", "preg_match", "count", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "date", "filemtime", "wsoPermsColor", "filesize", "fileowner", "filegroup", "is_file", "array_merge", "is_link", "array_merge", "readlink", "is_dir", "array_merge", "strcmp", "strtolower", "strtolower", "usort", "usort", "array_merge", "urlencode", "urlencode", "htmlspecialchars", "empty", "htmlspecialchars", "wsoViewSize", "urlencode", "urlencode", "urlencode", "urlencode", "urlencode", "htmlspecialchars", "isset", "class_exists", "empty", "count", "empty", "count", "date", "wsoFooter", "function_exists", "decbin", "hexdec", "function_exists", "dechex", "bindec", "function_exists", "strLen", "chr", "hexdec", "function_exists", "strlen", "sprintf", "ord", "strtoupper", "function_exists", "strlen", "dechex", "ord", "strtoupper", "isset", "WSOsetcookie", "md5", "ob_start", "in_array", "addcslashes", "htmlspecialchars", "ob_get_clean", "strlen", "empty", "empty", "WSOsetcookie", "md5", "wsoHeader", "htmlspecialchars", "md5", "empty", "htmlspecialchars", "empty", "empty", "in_array", "htmlspecialchars", "htmlspecialchars", "substr", "array_unique", "array_merge", "glob", "glob", "is_array", "count", "is_dir", "wsoRecursiveGlob", "empty", "strpos", "file_get_contents", "urlencode", "htmlspecialchars", "wsoRecursiveGlob", "wsoFooter", "isset", "urldecode", "is_file", "is_readable", "ob_start", "header", "basename", "function_exists", "mime_content_type", "header", "header", "fopen", "feof", "fread", "fclose", "file_exists", "fopen", "fclose", "wsoHeader", "file_exists", "wsoFooter", "posix_getpwuid", "fileowner", "fileowner", "filegroup", "posix_getgrgid", "filegroup", "htmlspecialchars", "basename", "is_file", "wsoViewSize", "filesize", "wsoPermsColor", "date", "filectime", "date", "fileatime", "date", "filemtime", "empty", "is_file", "urlencode", "strtolower", "strtolower", "fopen", "feof", "htmlspecialchars", "fread", "fclose", "is_readable", "highlight_file", "str_replace", "empty", "strlen", "pow", "strlen", "chmod", "clearstatcache", "urlencode", "substr", "sprintf", "fileperms", "is_writable", "empty", "filemtime", "substr", "fopen", "fwrite", "fclose", "touch", "urlencode", "fopen", "feof", "htmlspecialchars", "fread", "fclose", "file_get_contents", "strlen", "sprintf", "ord", "ord", "sprintf", "htmlspecialchars", "empty", "rename", "die", "urlencode", "urlencode", "htmlspecialchars", "empty", "strtotime", "touch", "clearstatcache", "urlencode", "date", "filemtime", "wsoFooter", "empty", "empty", "WSOsetcookie", "md5", "empty", "WSOsetcookie", "md5", "isset", "WSOsetcookie", "md5", "ob_start", "iconv", "addcslashes", "wsoEx", "preg_match", "chdir", "getcwd", "ob_get_clean", "strlen", "empty", "WSOsetcookie", "md5", "wsoHeader", "htmlspecialchars", "htmlspecialchars", "md5", "md5", "htmlspecialchars", "wsoEx", "wsoFooter", "setcookie", "md5", "time", "die", "unlink", "preg_replace", "die", "wsoHeader", "wsoFooter", "wsoHeader", "isset", "htmlspecialchars", "htmlspecialchars", "ftp_connect", "ftp_login", "ftp_close", "mysql_connect", "mysql_close", "pg_connect", "pg_close", "explode", "file", "is_array", "explode", "wsoBruteForce", "htmlspecialchars", "htmlspecialchars", "strlen", "wsoBruteForce", "htmlspecialchars", "file", "is_array", "trim", "wsoBruteForce", "wsoFooter", "mysql_connect", "explode", "pg_connect", "mysql_select_db", "mysql_query", "pg_query", "func_num_args", "func_get_arg", "mysql_fetch_assoc", "pg_fetch_assoc", "mysql_error", "pg_last_error", "function_exists", "mysql_set_charset", "pg_set_client_encoding", "addslashes", "addslashes", "implode", "mysql_fetch_array", "fwrite", "is_int", "mysql_real_escape_string", "implode", "implode", "implode", "fwrite", "fwrite", "addslashes", "implode", "implode", "fwrite", "ob_start", "header", "header", "fopen", "fclose", "die", "wsoHeader", "isset", "isset", "each", "addslashes", "isset", "each", "ceil", "reset", "nl2br", "wsoFooter", "wsoHeader", "isset", "fopen", "function_exists", "fwrite", "base64_decode", "fclose", "cf", "wsoEx", "sleep", "wsoEx", "unlink", "cf", "wsoEx", "sleep", "wsoEx", "unlink", "wsoFooter", "php_uname", "phpversion", "ini_get", "serialize", "eval", "isset", "function_exists", "function_exists", "call_user_func" ], "ms": { "file": { "size": 66108.0 }, "text": { "tab_count": 3135.0, "digit_ratio": 0.04, "space_count": 7406.0, "total_lines": 1522.0, "char_entropy": 5.51, "mixed_indent": true, "unique_chars": 96.0, "escape_density": 0.0, "import_density": 40.6, "lines_over_200": 30.0, "lines_over_500": 5.0, "string_density": 1.97, "avg_line_length": 42.43, "max_line_length": 785.0, "empty_line_ratio": 0.03, "last_line_length": 5.0, "long_token_count": 14.0, "most_common_char": "e", "whitespace_ratio": 0.18, "most_common_ratio": 0.05, "identifier_density": 1.42, "line_length_stddev": 57.53, "octal_escape_count": 3.0, "encoded_string_ratio": 0.0, "normalized_import_count": 15.84, "normalized_string_count": 76.77, "repeated_char_sequences": 161.0, "suspicious_string_ratio": 0.03, "max_inline_whitespace_run": 2.0, "normalized_function_count": 1.31, "trailing_whitespace_lines": 3.0, "imports_to_functions_ratio": 12.12, "strings_to_functions_ratio": 58.73, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 30.46, "identifiers_to_functions_ratio": 6.31 }, "imports": { "total": 618.0, "unique_modules": 171.0, "third_party_count": 618.0, "third_party_ratio": 1.0 }, "strings": { "total": 2995.0, "url_count": 2.0, "avg_length": 19.21, "max_length": 1020.0, "path_count": 42.0, "avg_entropy": 2.32, "hex_strings": 2.0, "sql_strings": 23.0, "total_bytes": 57519.0, "entropy_stddev": 1.33, "base64_candidates": 6.0, "very_long_strings": 2.0, "high_entropy_count": 19.0, "shell_command_strings": 48.0, "embedded_code_candidates": 33.0 }, "comments": {}, "functions": { "total": 51.0, "one_liners": 7.0, "length_stddev": 59.54, "over_100_lines": 4.0, "avg_name_length": 10.12, "no_params_count": 51.0, "avg_length_lines": 31.98, "max_length_lines": 341.0, "min_length_lines": 1.0, "avg_nesting_depth": 0.51, "max_nesting_depth": 1.0, "high_entropy_names": 3.0, "density_per_100_lines": 3.35, "code_in_functions_ratio": 1.07 }, "identifiers": { "total": 2161.0, "avg_length": 8.01, "max_length": 26.0, "min_length": 1.0, "avg_entropy": 2.44, "reuse_ratio": 0.15, "unique_count": 322.0, "length_stddev": 4.67, "has_digit_ratio": 0.02, "sequential_names": 18.0, "single_char_count": 18.0, "single_char_ratio": 0.06, "high_entropy_count": 14.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.81, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 1.0, "double_underscore_count": 1.0, "underscore_prefix_count": 5.0 } }, "ss": [ [ 19, "1410fb244fdf8252429fcaba7415a3ea" ], [ 20, "1410fb244fdf8252429fcaba7415a3ea" ], [ 64, "#df5" ], [ 65, "#df5" ], [ 90, "FilesMan" ], [ 91, "FilesMan" ], [ 147, "Windows-1251" ], [ 148, "Windows-1251" ], [ 183, "HTTP_USER_AGENT" ], [ 184, "HTTP_USER_AGENT" ], [ 230, "Google" ], [ 231, "Google" ], [ 240, "Slurp" ], [ 241, "Slurp" ], [ 249, "MSNBot" ], [ 250, "MSNBot" ], [ 259, "ia_archiver" ], [ 260, "ia_archiver" ], [ 274, "Yandex" ], [ 275, "Yandex" ], [ 284, "Rambler" ], [ 285, "Rambler" ], [ 314, "/" ], [ 315, "/" ], [ 328, "|" ], [ 329, "|" ], [ 348, "/i" ], [ 349, "/i" ], [ 363, "HTTP_USER_AGENT" ], [ 364, "HTTP_USER_AGENT" ], [ 401, "HTTP/1.0 404 Not Found" ], [ 402, "HTTP/1.0 404 Not Found" ], [ 460, "error_log" ], [ 461, "error_log" ], [ 488, "log_errors" ], [ 489, "log_errors" ], [ 514, "max_execution_time" ], [ 515, "max_execution_time" ], [ 597, "WSO_VERSION" ], [ 598, "WSO_VERSION" ], [ 612, "2.5" ], [ 613, "2.5" ], [ 724, "WSOstripslashes" ], [ 725, "WSOstripslashes" ], [ 885, "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], [ 886, "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], [ 1139, "pass" ], [ 1140, "pass" ], [ 1163, "pass" ], [ 1164, "pass" ], [ 1222, "HTTP_HOST" ], [ 1223, "HTTP_HOST" ], [ 1288, "HTTP_HOST" ], [ 1289, "HTTP_HOST" ], [ 1330, "HTTP_HOST" ], [ 1331, "HTTP_HOST" ], [ 1421, "win" ], [ 1422, "win" ], [ 1435, "win" ], [ 1436, "win" ], [ 1454, "nix" ], [ 1455, "nix" ], [ 1484, "safe_mode" ], [ 1485, "safe_mode" ], [ 1569, "disable_functions" ], [ 1570, "disable_functions" ], [ 1630, "c" ], [ 1631, "c" ], [ 1652, "c" ], [ 1653, "c" ], [ 1687, "win" ], [ 1688, "win" ], [ 1721, "\\\\" ], [ 1727, "/" ], [ 1728, "/" ], [ 1764, "\\\\" ], [ 1770, "/" ], [ 1771, "/" ], [ 1811, "/" ], [ 1812, "/" ], [ 1825, "/" ], [ 1826, "/" ], [ 1863, "HTTP_HOST" ], [ 1864, "HTTP_HOST" ], [ 1879, "ajax" ], [ 1880, "ajax" ], [ 1915, "HTTP_HOST" ], [ 1916, "HTTP_HOST" ], [ 1931, "ajax" ], [ 1932, "ajax" ], [ 1977, "win" ], [ 1978, "win" ], [ 2005, "List Directory" ], [ 2006, "List Directory" ], [ 2025, "dir" ], [ 2026, "dir" ], [ 2037, "Find index.php in current dir" ], [ 2038, "Find index.php in current dir" ], [ 2072, "dir /s /w /b index.php" ], [ 2073, "dir /s /w /b index.php" ], [ 2103, "Find *config*.php in current dir" ], [ 2104, "Find *config*.php in current dir" ], [ 2141, "dir /s /w /b *config*.php" ], [ 2142, "dir /s /w /b *config*.php" ], [ 2175, "Show active connections" ], [ 2176, "Show active connections" ], [ 2204, "netstat -an" ], [ 2205, "netstat -an" ], [ 2224, "Show running services" ], [ 2225, "Show running services" ], [ 2251, "net start" ], [ 2252, "net start" ], [ 2269, "User accounts" ], [ 2270, "User accounts" ], [ 2288, "net user" ], [ 2289, "net user" ], [ 2305, "Show computers" ], [ 2306, "Show computers" ], [ 2325, "net view" ], [ 2326, "net view" ], [ 2339, "ARP Table" ], [ 2340, "ARP Table" ], [ 2354, "arp -a" ], [ 2355, "arp -a" ], [ 2366, "IP Configuration" ], [ 2367, "IP Configuration" ], [ 2388, "ipconfig /all" ], [ 2389, "ipconfig /all" ], [ 2436, "List dir" ], [ 2437, "List dir" ], [ 2450, "ls -lha" ], [ 2451, "ls -lha" ], [ 2463, "list file attributes on a Linux second extended file system" ], [ 2464, "list file attributes on a Linux second extended file system" ], [ 2528, "lsattr -va" ], [ 2529, "lsattr -va" ], [ 2546, "show opened ports" ], [ 2547, "show opened ports" ], [ 2569, "netstat -an | grep -i listen" ], [ 2570, "netstat -an | grep -i listen" ], [ 2609, "process status" ], [ 2610, "process status" ], [ 2629, "ps aux" ], [ 2630, "ps aux" ], [ 2641, "Find" ], [ 2642, "Find" ], [ 2659, "find all suid files" ], [ 2660, "find all suid files" ], [ 2684, "find / -type f -perm -04000 -ls" ], [ 2685, "find / -type f -perm -04000 -ls" ], [ 2723, "find suid files in current dir" ], [ 2724, "find suid files in current dir" ], [ 2759, "find . -type f -perm -04000 -ls" ], [ 2760, "find . -type f -perm -04000 -ls" ], [ 2798, "find all sgid files" ], [ 2799, "find all sgid files" ], [ 2823, "find / -type f -perm -02000 -ls" ], [ 2824, "find / -type f -perm -02000 -ls" ], [ 2862, "find sgid files in current dir" ], [ 2863, "find sgid files in current dir" ], [ 2898, "find . -type f -perm -02000 -ls" ], [ 2899, "find . -type f -perm -02000 -ls" ], [ 2937, "find config.inc.php files" ], [ 2938, "find config.inc.php files" ], [ 2968, "find / -type f -name config.inc.php" ], [ 2969, "find / -type f -name config.inc.php" ], [ 3011, "find config* files" ], [ 3012, "find config* files" ], [ 3035, "find / -type f -name \\\"config*\\" ], [ 3036, "find / -type f -name " ], [ 3059, "config*" ], [ 3075, "find config* files in current dir" ], [ 3076, "find config* files in current dir" ], [ 3114, "find . -type f -name \\\"config*\\" ], [ 3115, "find . -type f -name " ], [ 3138, "config*" ], [ 3154, "find all writable folders and files" ], [ 3155, "find all writable folders and files" ], [ 3195, "find / -perm -2 -ls" ], [ 3196, "find / -perm -2 -ls" ], [ 3222, "find all writable folders and files in current dir" ], [ 3223, "find all writable folders and files in current dir" ], [ 3278, "find . -perm -2 -ls" ], [ 3279, "find . -perm -2 -ls" ], [ 3305, "find all service.pwd files" ], [ 3306, "find all service.pwd files" ], [ 3337, "find / -type f -name service.pwd" ], [ 3338, "find / -type f -name service.pwd" ], [ 3377, "find service.pwd files in current dir" ], [ 3378, "find service.pwd files in current dir" ], [ 3420, "find . -type f -name service.pwd" ], [ 3421, "find . -type f -name service.pwd" ], [ 3460, "find all .htpasswd files" ], [ 3461, "find all .htpasswd files" ], [ 3490, "find / -type f -name .htpasswd" ], [ 3491, "find / -type f -name .htpasswd" ], [ 3528, "find .htpasswd files in current dir" ], [ 3529, "find .htpasswd files in current dir" ], [ 3569, "find . -type f -name .htpasswd" ], [ 3570, "find . -type f -name .htpasswd" ], [ 3607, "find all .bash_history files" ], [ 3608, "find all .bash_history files" ], [ 3641, "find / -type f -name .bash_history" ], [ 3642, "find / -type f -name .bash_history" ], [ 3683, "find .bash_history files in current dir" ], [ 3684, "find .bash_history files in current dir" ], [ 3728, "find . -type f -name .bash_history" ], [ 3729, "find . -type f -name .bash_history" ], [ 3770, "find all .fetchmailrc files" ], [ 3771, "find all .fetchmailrc files" ], [ 3803, "find / -type f -name .fetchmailrc" ], [ 3804, "find / -type f -name .fetchmailrc" ], [ 3844, "find .fetchmailrc files in current dir" ], [ 3845, "find .fetchmailrc files in current dir" ], [ 3888, "find . -type f -name .fetchmailrc" ], [ 3889, "find . -type f -name .fetchmailrc" ], [ 3927, "Locate" ], [ 3928, "Locate" ], [ 3947, "locate httpd.conf files" ], [ 3948, "locate httpd.conf files" ], [ 3976, "locate httpd.conf" ], [ 3977, "locate httpd.conf" ], [ 3999, "locate vhosts.conf files" ], [ 4000, "locate vhosts.conf files" ], [ 4029, "locate vhosts.conf" ], [ 4030, "locate vhosts.conf" ], [ 4053, "locate proftpd.conf files" ], [ 4054, "locate proftpd.conf files" ], [ 4084, "locate proftpd.conf" ], [ 4085, "locate proftpd.conf" ], [ 4109, "locate psybnc.conf files" ], [ 4110, "locate psybnc.conf files" ], [ 4139, "locate psybnc.conf" ], [ 4140, "locate psybnc.conf" ], [ 4163, "locate my.conf files" ], [ 4164, "locate my.conf files" ], [ 4189, "locate my.conf" ], [ 4190, "locate my.conf" ], [ 4209, "locate admin.php files" ], [ 4210, "locate admin.php files" ], [ 4236, "locate admin.php" ], [ 4237, "locate admin.php" ], [ 4258, "locate cfg.php files" ], [ 4259, "locate cfg.php files" ], [ 4284, "locate cfg.php" ], [ 4285, "locate cfg.php" ], [ 4304, "locate conf.php files" ], [ 4305, "locate conf.php files" ], [ 4331, "locate conf.php" ], [ 4332, "locate conf.php" ], [ 4352, "locate config.dat files" ], [ 4353, "locate config.dat files" ], [ 4381, "locate config.dat" ], [ 4382, "locate config.dat" ], [ 4404, "locate config.php files" ], [ 4405, "locate config.php files" ] ], "sz": 66108, "ts": [ { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads open_basedir setting", "e": [ "ini_get('open_basedir" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-open-basedir", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "Base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via exec()", "e": [ "exec" ], "i": "micro-behaviors/process/create/shell/lang::exec-dup", "l": 3, "m": "E1059" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 1020.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 0.8999999761581421, "d": "netstat -an command", "e": [ "netstat -an" ], "i": "micro-behaviors/os/network/status::netstat-an", "l": 3 }, { "c": 0.8500000238418579, "d": "MIME octet-stream content type", "e": [ "application/octet-stream" ], "i": "micro-behaviors/communications/email/mime::mime-octet-stream", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "c": 0.800000011920929, "d": "Resolve GID to group (posix_getgrgid)", "e": [ "posix_getgrgid", "posix_getgrgid" ], "i": "micro-behaviors/os/group/lookup::posix-getgrgid", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "\"configuration\" doc-context token", "e": [ "IP Configuration" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11746", "l": 1 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via shell_exec()", "e": [ "shell_exec" ], "i": "micro-behaviors/process/create/shell/lang::shell-exec", "l": 3, "m": "E1059" }, { "c": 0.8500000238418579, "d": "PHP mysql query execution APIs", "e": [ "mysql_query" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-query", "l": 3 }, { "c": 0.8399999737739563, "d": "CSV attachment filename response", "e": [ "Content-Disposition: attachment; filename" ], "i": "micro-behaviors/data/format/csv/http-telemetry::csv-attachment-filename", "l": 1 }, { "c": 0.30000001192092896, "d": "stdout string reference", "e": [ "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e" ], "i": "micro-behaviors/process/fd/stdio::stdout-string", "l": 2 }, { "c": 0.800000011920929, "d": "PHP mysql_select_db database selection", "e": [ "mysql_select_db" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-select-db", "l": 3 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Process open via popen()", "e": [ "popen" ], "i": "micro-behaviors/process/create/shell/lang::popen", "l": 3, "m": "E1059" }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via iterators in PHP", "e": [ "RecursiveDirectoryIterator" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-iterator", "l": 2 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "c": 1.0, "d": "exploit-db.com domain", "e": [ "exploit-db.com" ], "i": "micro-behaviors/data/text/security/threat-intel::exploit-db-domain", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "netstat -an" ], "i": "objectives/command-and-control/backdoor/webshell/recon::recon-command-panel--rx-11", "l": 1, "m": "B0030" }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "a": "T1082", "c": 0.699999988079071, "d": "Gets effective UID of current process", "e": [ "posix_geteuid" ], "i": "objectives/discovery/system/fingerprint/info::posix-geteuid", "l": 3, "m": "E1082" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "/etc/passwd" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-6", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('exec" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-1", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 18.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "https://hashcracking.ru/index.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "'POST'" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "a": "T1059.004", "c": 0.8500000238418579, "d": "Shell stderr redirected to stdout", "e": [ " 2\u003e\u00261" ], "i": "micro-behaviors/process/create/shell/lang::shell-stderr-redirect", "l": 3, "m": "E1059" }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chead\u003e", "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[WSOsetcookie, WSOstripslashes, addcslashes, addslashes, apache_get_modules, array_map, array_merge, array_unique, base64_decode" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "d": "INSERT INTO SQL keyword", "e": [ "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 3 }, { "a": "T1082", "d": "Windows ipconfig command", "e": [ "ipconfig /all" ], "i": "objectives/discovery/system/fingerprint/os::windows-ipconfig", "l": 3, "m": "B0012" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses PHP_OS constant (OS detection)", "e": [ "PHP_OS" ], "i": "objectives/discovery/system/fingerprint/info::php-os-constant", "l": 3, "m": "E1082" }, { "c": 0.8399999737739563, "d": "\"password\" doc-context token", "e": [ "host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname", "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e", " password=", "\n\u003ch1\u003eSql browser\u003c/h1\u003e\u003cdiv class=content\u003e\n\u003cform name='sf' method='post' onsubmit='fs(this);'\u003e\u003ctable cellpadding='2' cellspacing='" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "a": "T1059.006", "c": 0.75, "d": "Perl script execution", "e": [ "perl /tmp/bp.pl" ], "i": "objectives/execution/interpreter/script/download::perl-execute", "l": 3, "m": "C0059" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".mysql_history" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-8", "l": 1, "m": "B0030" }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval() call with direct user input", "e": [ "eval", "$_POST['p1']" ], "i": "micro-behaviors/process/interpreter/eval::eval-user-input", "l": 4, "m": "E1059" }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account postgres", "e": [ "postgres" ], "i": "objectives/lateral-movement/brute-force/password::service-account-postgres", "l": 1, "m": "E1110" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('safe_mode" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "SHOW schema administration queries", "e": [ "SHOW CREATE TABLE", "SHOW TABLES" ], "i": "micro-behaviors/data/db/conn/mysql::mysql-show-admin-sql", "l": 3 }, { "c": 1.0, "d": "PHP rmdir function symbol", "e": [ "rmdir" ], "i": "micro-behaviors/fs/delete/directory::php-rmdir", "l": 3 }, { "c": 0.75, "d": "PHP MySQL UTF8 charset selection", "e": [ "mysql_set_charset" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-set-charset", "l": 3 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "WSO webshell version marker", "e": [ "WSO_VERSION" ], "i": "well-known/malware/webshell/family::wso-version", "l": 4, "m": "B0030" }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "c": 0.699999988079071, "d": "PHP object serialization", "e": [ "serialize" ], "i": "micro-behaviors/data/serialize/object::serialize", "l": 3 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT datname FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 3 }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.8199999928474426, "d": "fopen() with w/x/c overwrite mode", "e": [ "fopen($_POST['p1'], 'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "c": 0.8999999761581421, "d": "passthru fallback function name", "e": [ "passthru" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-passthru-name", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 785.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "application/x-www-form-urlencoded content type", "e": [ "application/x-www-form-urlencoded" ], "i": "micro-behaviors/communications/http/post::url-encoded-content-type", "l": 1, "m": "C0002" }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads safe_mode setting", "e": [ "ini_get('safe_mode" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8199999928474426, "d": "Content-Disposition download response", "e": [ "Content-Disposition: attachment; filename" ], "i": "objectives/command-and-control/backdoor/webshell/stager::content-disposition-download", "l": 1 }, { "c": 0.4000000059604645, "d": "exploit keyword", "e": [ "exploit" ], "i": "micro-behaviors/data/text/keywords/lexicon::exploit", "l": 1 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.8999999761581421, "d": "system fallback function name", "e": [ "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-system-name", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 32.00", "text.total_lines = 1522.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Moves uploaded PHP file", "e": [ "move_uploaded_file" ], "i": "micro-behaviors/fs/write/file/direct::move-uploaded-file", "l": 3, "m": "C0052" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.8399999737739563, "d": "\"password\" string-literal token", "e": [ " password=", "host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname", "\n\u003ch1\u003eSql browser\u003c/h1\u003e\u003cdiv class=content\u003e\n\u003cform name='sf' method='post' onsubmit='fs(this);'\u003e\u003ctable cellpadding='2' cellspacing='", "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "escapeshellarg" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster-cond-0--inline-16595", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "\"upload\" string-literal token", "e": [ "uploadFile", "Can't upload file!", "\u003e\n\t\t\u003cspan\u003eUpload file:\u003c/span\u003e$is_writable\u003cbr\u003e\u003cinput class='toolsInp' type=file name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003cbr ", "\u003e\n\t\t\u003cspan\u003eUpload file:\u003c/span\u003e", "\u003e\n\t\t\u003cinput type=hidden name=p1 value='uploadFile'\u003e\n\t\t\u003cinput type=hidden name=charset value=" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "c": 0.8999999761581421, "d": "shell_exec fallback function name", "e": [ "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-shell-exec-name", "l": 1, "m": "B0030" }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "c": 0.800000011920929, "d": "PHP copy() symbol", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "Scandir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "a": "T1027.010", "c": 0.9300000071525574, "d": "chr(hexdec(...)) custom hex decoder (obfuscation)", "e": [ "chr(hexdec(" ], "i": "objectives/anti-static/obfuscation/encoding/hex::hexdec-chr-decode", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "c": 0.30000001192092896, "d": "stderr string reference", "e": [ "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e", "stderr_to_out" ], "i": "micro-behaviors/process/fd/stdio::stderr-string", "l": 2 }, { "c": 0.8500000238418579, "d": "PHP mysql_connect database handle", "e": [ "mysql_connect" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-connect", "l": 3 }, { "c": 0.75, "d": "Hardcoded localhost network host", "e": [ "localhost" ], "i": "micro-behaviors/communications/ip/literal::localhost-source", "l": 2 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via passthru()", "e": [ "passthru" ], "i": "micro-behaviors/process/create/shell/lang::passthru", "l": 3, "m": "E1059" }, { "c": 0.699999988079071, "d": "\"directory\" path-target noun", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory", "l": 1 }, { "c": 0.8399999737739563, "d": "\"account\" doc-context token", "e": [ "User accounts", "Account Settings", "net accounts", "User Accounts" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11753", "l": 1 }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "c": 0.800000011920929, "d": "PHP rename() symbol", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-rename-call", "l": 1 }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('passthru" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-2", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Error-suppressed unserialize call", "e": [ "@unserialize(" ], "i": "micro-behaviors/data/serialize/object::error-suppressed-unserialize", "l": 4 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@ini_set('log_errors',0)", "@set_magic_quotes_runtime(0)", "@$_POST['p3']", "@$_POST['charset']", "@chdir($_POST['c'])", "@$_POST['a']", "@getcwd()", "@ini_set('error_log',NULL)", "@ini_get('disable_functions')", "@$_POST['p2']", "@set_time_limit(0)", "@ini_set('max_execution_time',0)", "@$_POST['p1']", "@ini_get('safe_mode')", "@define('WSO_VERSION', '2.5')" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 51.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.9200000166893005, "d": "HOST URL component identifier", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "MIME attachment disposition", "e": [ "Content-Disposition: attachment" ], "i": "micro-behaviors/communications/email/mime::mime-content-disposition", "l": 1 }, { "d": "Redirect to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::redirect-dev-null", "l": 2 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "find . -type f" ], "i": "objectives/command-and-control/backdoor/webshell/recon::recon-command-panel--rx-13", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST[...] superglobal access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".bash_history" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-7", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.6499999761581421, "d": "serialize/unserialize for object serialization", "e": [ "unserialize(" ], "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call", "l": 2, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "c": 0.8999999761581421, "d": "HTTP/1.0 protocol version", "e": [ "HTTP/1.0 404 Not Found" ], "i": "micro-behaviors/communications/http/protocol::http-1-0-header", "l": 2 }, { "a": "T1505.003", "c": 0.949999988079071, "d": "FilesMan webshell family", "e": [ "FilesMan" ], "i": "well-known/malware/webshell/family::filesman", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "User input used as function (GET/POST/REQUEST)", "e": [ "htmlspecialchars($_POST['p1']($_POST['p2']))", "$_POST['p1']($_POST['p2'])" ], "i": "objectives/command-and-control/backdoor/webshell/obf-dispatch::dynamic-user-input-call-1", "l": 4, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads disable_functions setting", "e": [ "ini_get('disable_functions" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-disable-functions", "l": 4, "m": "B0032" }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "a": "T1071.001", "c": 0.6499999761581421, "d": "httpd.conf configuration file", "e": [ "httpd.conf" ], "i": "micro-behaviors/communications/http/server/listener::httpd-conf-path", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "HTTP Cookie access ($_COOKIE)", "e": [ "$_COOKIE" ], "i": "micro-behaviors/communications/http/request/params::cookie", "l": 3 }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "fopen($_POST['p1'],\"w\")", "file_get_contents($_POST['p1'])", "fopen($_POST['file'], 'w')", "fopen($_POST['p1'], \"r\")", "fopen($_POST['p1'], 'w')", "fopen($_POST['p1'], 'r')", "strpos(file_get_contents($item), $_POST['p2'])" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "c": 0.800000011920929, "d": "unserialize from $_COOKIE", "e": [ "unserialize($_COOKIE" ], "i": "micro-behaviors/data/serialize/object::unserialize-cookie", "l": 4 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1059", "c": 0.6499999761581421, "d": "PHP object deserialization call", "e": [ "unserialize" ], "i": "micro-behaviors/data/serialize/object::unserialize", "l": 3, "m": "E1059" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('disable_functions" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-2", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Shell executes /tmp path directly", "e": [ " /tmp/bp.pl " ], "i": "micro-behaviors/data/text/dropper::executes-tmp-file", "l": 3 }, { "d": "CREATE TABLE SQL keyword", "e": [ "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-create-table", "l": 3 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Architecture keyed encoded blob value", "e": [ "\"1410fb244fdf8252429fcaba7415a3ea\"" ], "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value", "l": 1, "m": "B0032" }, { "a": "T1217", "c": 0.4000000059604645, "d": "Yandex browser name", "e": [ "Yandex" ], "i": "objectives/discovery/host/browser::yandex-name", "l": 3 }, { "a": "T1486", "c": 0.4000000059604645, "d": "rename( function", "e": [ "rename(" ], "i": "objectives/impact/ransom/tactics::rename-fn", "l": 1 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "ia_archiver" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-4", "l": 1 }, { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "d": "Sets HTTP cookie via setcookie()", "e": [ "setcookie" ], "i": "micro-behaviors/communications/http/cookies::setcookie-call", "l": 3 }, { "a": "T1110", "c": 0.8500000238418579, "d": "Brute force attack reference", "e": [ "Bruteforce" ], "i": "objectives/discovery/network/scan/port::brute-force-ref", "l": 4, "m": "E1046" }, { "a": "T1033", "c": 0.800000011920929, "d": "/etc/passwd user database", "e": [ "/etc/passwd" ], "i": "micro-behaviors/fs/path/config/accounts::etc-passwd", "l": 2 }, { "c": 0.8999999761581421, "d": "/etc/shadow password file access", "e": [ "/etc/shadow" ], "i": "micro-behaviors/os/privilege/paths::etc-shadow", "l": 3 }, { "a": "T1046", "c": 0.6000000238418579, "d": "FTP port number (21)", "e": [ "connect($ip, $port?$port:21" ], "i": "objectives/discovery/network/scan/port::port-number-ftp", "l": 1, "m": "E1046" }, { "c": 0.699999988079071, "d": "perl interpreter keyword (beyond shebang)", "e": [ "perl" ], "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "l": 3 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches alt exec functions", "e": [ "passthru($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-alt", "l": 3, "m": "E1059" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches core exec functions", "e": [ "exec($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-core", "l": 3, "m": "E1059" }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "a": "T1059.004", "c": 0.6000000238418579, "d": "References /bin/sh (Bourne shell)", "e": [ "\u003ch1\u003eNetwork tools\u003c/h1\u003e\u003cdiv class=content\u003e\n\t\u003cform name='nfp' onSubmit=\\\"g(null,null,'bpp',this.port.value);return false;\\\"\u003e\n\t\u003cspa", "\u003e\n\t\u003cspan\u003eBind port to /bin/sh [perl]\u003c/span\u003e\u003cbr/\u003e\n\tPort: \u003cinput type='text' name='port' value='31337'\u003e \u003cinput type=submit value='" ], "i": "micro-behaviors/process/create/shell/invoke::bin-sh", "l": 3, "m": "E1059.004" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Windows platform detection marker", "e": [ "Windows-1251" ], "i": "objectives/discovery/system/fingerprint/os::os-check-windows", "l": 2, "m": "B0012" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "a": "T1071.001", "d": "listen() socket call", "e": [ "listen" ], "i": "micro-behaviors/communications/http/server/listener::listen-keyword", "l": 3, "m": "C0002" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lO", "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRy" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "XMLHttpRequest" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-word", "l": 3 }, { "c": 0.8999999761581421, "d": "netstat command", "e": [ "netstat" ], "i": "micro-behaviors/os/network/status::netstat", "l": 3 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password name=pass" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "c": 0.699999988079071, "d": "python interpreter keyword (beyond shebang)", "e": [ "python" ], "i": "micro-behaviors/process/interpreter/python::python-keyword", "l": 3 }, { "c": 0.800000011920929, "d": "Hardcoded loopback IPv4 address", "e": [ "\"127.0.0.1\"" ], "i": "micro-behaviors/communications/ip/literal::loopback-ipv4-source", "l": 2 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Linux platform detection marker", "e": [ "list file attributes on a Linux second extended file system", "Linux", "Linux Kernel " ], "i": "objectives/discovery/system/fingerprint/os::os-check-linux", "l": 2, "m": "B0012" }, { "a": "T1552", "c": 0.949999988079071, "d": "Multiple credential files in config directories", "e": [ "/etc/passwd', @is_readable('/etc/passwd" ], "i": "objectives/credential-access/files/config::credential-files-config", "l": 4 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account mysql", "e": [ "mysql" ], "i": "objectives/lateral-movement/brute-force/password::service-account-mysql", "l": 1, "m": "E1110" }, { "c": 0.800000011920929, "d": "Combined stdout+stderr redirect to /dev/null", "e": [ "\u003e/dev/null 2\u003e\u00261" ], "i": "micro-behaviors/os/console/io::null-redirect-stdout-stderr", "l": 3 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['c']", "$_POST['p1']", "$_POST['p3']", "$_POST['pass']", "$_POST['a']", "$_POST['charset']", "$_POST['p2']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "c": 0.949999988079071, "d": "Falls back through multiple PHP execution functions", "e": [ "system", "passthru" ], "i": "objectives/command-and-control/backdoor/webshell/exec::php-execution-fallback-chain", "l": 4, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PHP MySQL administration surface", "e": [ "SHOW TABLES", "mysql_query", "mysql_connect", "SHOW CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-admin-surface", "l": 3 }, { "d": "SQL statement keywords", "e": [ "CREATE TABLE", "SELECT datname FROM", "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 3 }, { "a": "T1562.001", "c": 0.800000011920929, "d": "Reads multiple PHP security restrictions", "e": [ "ini_get('safe_mode", "ini_get('disable_functions", "ini_get('open_basedir" ], "i": "objectives/evasion/security-bypass/runtime::security-restriction-probe", "l": 4, "m": "B0032" }, { "a": "T1070.004", "c": 1.0, "d": "Recursive directory cleanup in PHP", "e": [ "rmdir", "unlink", "scandir" ], "i": "objectives/evasion/self-delete/scripts::php-recursive-delete", "l": 4 }, { "c": 0.4000000059604645, "d": "Multiple standard I/O references", "e": [ "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e", "stderr_to_out" ], "i": "micro-behaviors/process/fd/stdio::stdio-refs", "l": 2 }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "Payload includes file management features (upload, list, delete)", "e": [ "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRy", "scandir", "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lO", "move_uploaded_file", "unlink" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-file-manager-payload", "l": 4 }, { "c": 0.800000011920929, "d": "Account configuration file access", "e": [ "/etc/passwd", "/etc/shadow" ], "i": "micro-behaviors/fs/path/config/accounts::account-files", "l": 3 }, { "c": 0.8500000238418579, "d": "Logic to identify search engine crawlers", "e": [ "ia_archiver", "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::crawler-identification", "l": 3 }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "Stealthy file manager stager (uses error suppression)", "e": [ "@ini_get('safe_mode')", "@$_POST['p3']", "@define('WSO_VERSION', '2.5')", "@$_POST['p2']", "@$_POST['a']", "@ini_set('log_errors',0)", "@ini_get('disable_functions')", "@set_magic_quotes_runtime(0)", "@getcwd()", "@$_POST['p1']", "@chdir($_POST['c'])", "@$_POST['charset']", "@ini_set('error_log',NULL)", "@ini_set('max_execution_time',0)", "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-stealthy-file-manager-stager", "l": 5 }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP administrative webshell UI", "e": [ "netstat -an", ".mysql_history", "ini_get('safe_mode", "ini_get('disable_functions", ".bash_history", "find . -type f", "/etc/passwd" ], "i": "objectives/command-and-control/backdoor/webshell/ui::php-admin-webshell-ui", "l": 5, "m": "B0030" }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "c": 0.9200000166893005, "d": "PHP unlink near file recreate", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-unlink-recreate-pattern", "l": 1 }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "a": "T1071.001", "c": 0.75, "d": "XMLHttpRequest network client creation", "e": [ "new XMLHttpRequest()" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-new", "l": 3, "m": "C0002" }, { "c": 1.0, "d": "ActiveXObject string presence", "e": [ "ActiveXObject" ], "i": "micro-behaviors/process/interpreter/jscript::activex-object", "l": 3 }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "none" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::hidden-zero-iframe--rx-7", "l": 1 }, { "c": 0.949999988079071, "d": "Network primitive in flatted-shaped file", "e": [ "XMLHttpRequest" ], "i": "well-known/lib/flatted::flatted-tamper-network", "l": 1 }, { "a": "T1059", "c": 0.800000011920929, "d": "child_process exec reference", "e": [ "exec(" ], "i": "objectives/command-and-control/reverse-shell/socket::exec-function", "l": 1 }, { "c": 1.0, "d": "DOM or CSS size property", "e": [ "width" ], "i": "micro-behaviors/ui/window/manage/dom::size-prop", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "ClickFix copy-paste action word", "e": [ "open" ], "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "ActiveXObject instantiation call", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/interpreter/script/wsh::activexobject-call", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "WebSocket sends data to peer", "e": [ ".send(" ], "i": "micro-behaviors/communications/websocket/server::websocket-send", "l": 3, "m": "C0002" }, { "c": 1.0, "d": "ADODB.Stream Open method call", "e": [ ".open(" ], "i": "micro-behaviors/fs/write/stream::adodb-open", "l": 1 }, { "c": 0.9200000166893005, "d": "\"lica\" fragment of split Shell.Application", "e": [ "lica" ], "i": "objectives/execution/interpreter/scripting/host::shell-application-split-join--rx-5", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Content-Type" ], "i": "objectives/supply-chain/recon-exfil/npm::npm-profile-json-post--rx-21", "l": 1 }, { "a": "T1202", "c": 0.800000011920929, "d": "new ActiveXObject pattern", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/activex/com::activex-object-create-literal", "l": 3, "m": "E1243" }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "error" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-3", "l": 1 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "send" ], "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12", "l": 1 }, { "c": 0.9200000166893005, "d": "\"crip\" fragment of split WScript.Shell", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "a": "T1555", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "encoded" ], "i": "objectives/credential-access/wallet/solana::solana-secretkey-json-field--rx-11", "l": 1 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "XMLHTTP status 200 check", "e": [ "req.status == 200" ], "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-status-200-check", "l": 1 }, { "c": 1.0, "d": "Regex component marker", "e": [ "onreadystatechange = processReqChange;", "d = document;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "display" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::hidden-zero-iframe--rx-2", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.50", "text.string_density = 0.30", "text.string_density = 0.44" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "b5ba14c406bcbd90bb28174d4efc996e##plain@0x1e1f", "b5ba14c406bcbd90bb28174d4efc996e##plain@0x1b26", "b5ba14c406bcbd90bb28174d4efc996e##plain@0x1e20", "b5ba14c406bcbd90bb28174d4efc996e##plain@0x1b25" ], "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k", "l": 1 }, { "c": 0.699999988079071, "d": "eval() function call (raw)", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::js-eval-raw", "l": 3 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "eval() with call expression argument", "e": [ "eval", "arr[2].substr(0, arr[1])" ], "i": "objectives/execution/interpreter/eval/dynamic::eval-call-expression-arg", "l": 3 }, { "c": 1.0, "d": "Tiny XMLHTTP fragment (variant 2)", "e": [ ".XMLHT" ], "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2", "l": 1 }, { "c": 0.699999988079071, "d": "Access to HTTP response body (.responseText)", "e": [ ".responseText" ], "i": "micro-behaviors/communications/http/client/response-body::response-text", "l": 3 }, { "a": "T1059.007", "c": 0.9399999976158142, "d": "eval() executing transformed code", "e": [ "arr[2].substr(0, arr[1])", "eval", "eval" ], "i": "objectives/execution/interpreter/eval/dynamic::eval-transformed-code", "l": 3 }, { "c": 1.0, "d": "javascript code embedded in string", "e": [ "Detected javascript at offset 0x1e1f", "Detected javascript at offset 0x1b26", "Detected javascript at offset 0x1e20", "Detected javascript at offset 0x1b25" ], "i": "metadata/lang/embedded::javascript", "l": 2 }, { "a": "T1056", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "value" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-8", "l": 1 }, { "c": 0.699999988079071, "d": "URL-encodes data via encodeURIComponent", "e": [ "encodeURIComponent" ], "i": "micro-behaviors/data/encode/url::encode-uri-component-call", "l": 2 }, { "a": "T1056", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "document" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5", "l": 1 }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for(i=0;i\u003cd.mf.elements.length;i++)\n\t\t\tparams += '\u0026'+d.mf.elements[i].name+'='+encodeURIComponent(d...." ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ "\tfor(" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 18.00", "text.total_lines = 20.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "a": "T1539", "c": 0.8199999928474426, "d": "Programmatically submits form", "e": [ ".submit(" ], "i": "objectives/collection/stealer/browser::dom-submit-call", "l": 1 }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "a": "T1041", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "post" ], "i": "objectives/exfiltration/http/upload::system-data-post-platform--rx-8", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Low comment line count", "e": [ "comments.lines = 0.00" ], "i": "objectives/anti-static/obfuscation/tools/signature::low-comment-line-count", "l": 1, "m": "E1014" }, { "a": "T1195.002", "c": 0.6499999761581421, "d": "Small Python wrapper module", "e": [ "text.total_lines = 15.00" ], "i": "objectives/supply-chain/impersonation/deprecated::small-python-wrapper", "l": 1 }, { "c": 0.949999988079071, "d": "Few generated table functions", "e": [ "functions.total = 0.00" ], "i": "metadata/lang/source::windows-def-function-table", "l": 1 }, { "a": "T1059", "c": 0.4000000059604645, "d": "eval() call (Python)", "e": [ "eval" ], "i": "objectives/execution/interpreter/eval/invoke::eval-call-python", "l": 3, "m": "E1059" }, { "c": 1.0, "d": "python code embedded in string", "e": [ "Detected python at offset 0x205b" ], "i": "metadata/lang/embedded::python", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "#!/usr/bin/perl $SHELL=\"/bin/sh -i\"; i \u003cbase64\u003e", "#!/usr/bin/perl use Socket; $iaddr=ine \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Detects the WSO webshells", "e": [ "gcc','lcc','cc','ld','make','php", "(($p \u0026 0x0008) ? (($p \u0026 0x0400)", "set(a,c,p1,p2,p3,charset)", "$_COOKIE[md5($_SERVER['HTTP_HOST'])." ], "i": "third_party/Sekoia/Webshell/Wso/Webshell/Strings", "l": 5 }, { "c": 0.8999999761581421, "d": "Web Shell - file r57142.php", "e": [ "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" ], "i": "third_party/SigBase/Webshell/PHP/R57142", "l": 5 }, { "c": 0.8999999761581421, "d": "Web Shell - from files wso2.5.1.php, wso2.5.php, wso2.php", "e": [ "$opt_charsets .= '\u003coption value=\"'.$item.'\" '.($_POST['charset']==$item?'selec", ".'\u003c/td\u003e\u003ctd\u003e\u003ca href=\"#\" onclick=\"g(\\'FilesTools\\',null,\\''.urlencode($f['na" ], "i": "third_party/SigBase/Webshell/Wso2/5/1/Wso2/5/Wso2", "l": 5 }, { "c": 0.8999999761581421, "d": "Semi-Auto-generated - from files multiple_php_webshells", "e": [ "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0", "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI" ], "i": "third_party/SigBase/Multiple/Php/Webshells", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings", "e": [ "\u003c?php", "_POST[", "\u003c?", "addslashes", "escapeshellarg" ], "i": "third_party/SigBase/EXT/WEBSHELL/PHP/Generic", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell containing base64 encoded payload", "e": [ "BvcGVu", "\u003c?php", "leGVj", "\u003c?", "N5c3Rlb", "base64_decode", "leGVjd" ], "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads", "l": 5 }, { "c": 0.8999999761581421, "d": "Generic PHP webshell which uses any eval/exec function in the same line with user input", "e": [ "eval($_POST" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Eval", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "$cwd[strlen($", "\u003c?php", "\u003c?", "$_POST['p1']($", "eval(", "$_COOKIE[md5($", "ase6" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "Webshell which sends eval/assert via GET", "e": [ "$_POST['p1']($_POST[" ], "i": "third_party/SigBase/WEBSHELL/PHP/Function/Via/Get", "l": 5 }, { "c": 0.8999999761581421, "d": "Webshell FilesMan", "e": [ "\u003c128 bytes\u003e", "\u003c126 bytes\u003e" ], "i": "third_party/JPCERT/filesman/webshell_filesman_base64", "l": 4 } ], "sha": "dd0d839cbc8f871ca147019e548c8a2bc1a00c4587d6926cf84520b54d50ff4e", "path": "b5ba14c406bcbd90bb28174d4efc996e", "type": "php" } ], "tv": "87c42" } }