1634 lines
71 KiB
PHP
1634 lines
71 KiB
PHP
<?php
|
|
/* Moved to the README.md*/
|
|
|
|
$version = "v4.0.3";
|
|
$released = "May/17";
|
|
$author = "Malin Cenusa";
|
|
$mail = "malin.cenusa@lunarpages.com";
|
|
$ip = "84.124.94.176";
|
|
$error = "Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 54 bytes)";
|
|
|
|
?>
|
|
|
|
<html>
|
|
<head>
|
|
<title>..:: Global Account Maintenance Tool ::.. <?php print_r($version); ?> released <?php print_r($released); ?> - by <?php print_r($author); ?> [ <?php print_r($mail); ?> ]</title>
|
|
<link rel="stylesheet" type="text/css" href="http://fonts.googleapis.com/css?family=Poiret One|Play" media="screen">
|
|
<!-- <link rel="stylesheet" type="text/css" href="css/style.css"> -->
|
|
</head>
|
|
|
|
<body>
|
|
<div id="menu">
|
|
<h3>..:: Global Account Maintenance Tool ::.. <?php print_r($version); ?> released <?php print_r($released); ?> - by <?php print_r($author); ?> [ <?php print_r($mail); ?> ]</h3>
|
|
<div align="right" ><a href="?run=remove" style="color: #000000; background-color:#00ff00; font-size: 18px;">REMOVE SCRIPT</a></div><br /><hr>
|
|
|
|
<table style="border-spacing:0; width:100%; ">
|
|
<tr>
|
|
<td width="25%">
|
|
<span style="background-color:#00ff00; font-family: 'Play', Helvetica, Arial, serif; font-size: 16px; ">..:: MALWARE AUDIT ::..</span><br />
|
|
<ul>
|
|
<li><a href="?run=infection" style="color: #ff0000;">Known PHPShell Scan</a></li>
|
|
<li><a href="?run=scanme" style="color: #ff0000;">Known Malware Scan</a></li>
|
|
<li><a href="?run=checkexif" style="color: #ff0000;">Scan JPEG EXIF Data</b></a></li>
|
|
<li><a href="?run=iframe" style="color: #ff0000;">malicious IFRAME scan</a></li>
|
|
<li><a href="?run=checklarge" style="color: #ff0000;">Check Files With Large Lines</b></a></li>
|
|
<li><a href="?run=newscan" style="color: #ff0000;">Database String Scanner</a></li>
|
|
<li><a href="?run=findbot" style="color: #ff0000;">Run Findbot.PL</a></li>
|
|
<li><a href="?run=insecplug" style="color: #ff0000;">Insecure WP plugins</a></li>
|
|
<li><a href="?run=custom" style="color: #ff0000;">Custom string scanner</b></a></li>
|
|
</ul>
|
|
</td>
|
|
|
|
<td width="25%">
|
|
<span style="background-color:#00ff00; font-family: 'Play', Helvetica, Arial, serif; font-size: 16px; ">..:: SOP ::..</span><br />
|
|
<ul>
|
|
<li><a href="?run=version" style="color: #ff0000;">Get a list of installed scripts and their versions</a></li>
|
|
<li><a href="?run=addsec" style="color: #ff0000;">Secure .htaccess and php.ini</a></li>
|
|
<li><a href="?run=securetemps" style="color: #ff0000;">Secure Temporary/Images</a></li>
|
|
<li><a href="?run=fixperms" style="color: #ff0000;">Fix File and Folder Permissions</a></li>
|
|
<li><a href="?run=pwds" style="color: #ff0000;">Check password security</a></li>
|
|
<li><a href="?run=optim" style="color: #ff0000;">MySQL DB Optimization</a></li>
|
|
<li><a href="?run=cleanupl" style="color: #ff0000;">Cleanup (error logs, .suspected, zero byte files)</a></li>
|
|
</ul>
|
|
</td>
|
|
|
|
<td width="25%">
|
|
<span style="background-color:#00ff00; font-family: 'Play', Helvetica, Arial, serif; font-size: 16px; ">..:: CLEANER ::..</span><br />
|
|
<ul>
|
|
<li><a href="?run=cleanPL" style="color: #ff0000;">Clean.PL</b></a></li>
|
|
<li><a href="?run=cleanPHP" style="color: #ff0000;">Clean.PHP</a></li>
|
|
<li><a href="?run=cleanexif" style="color: #ff0000;">Clean EXIF</a></li>
|
|
<li><a href="?run=cleangravity" style="color: #ff0000;">Clean Gravity Forms Exploit</a></li>
|
|
|
|
</ul>
|
|
</td>
|
|
|
|
<td width="25%">
|
|
<span style="background-color:#00ff00; font-family: 'Play', Helvetica, Arial, serif; font-size: 16px; ">..:: MySQL ::..</span><br />
|
|
<ul>
|
|
<li><a href="?run=prefix" style="color: #ff0000;">Change Table Prefix</a></li>
|
|
<li><a href="?run=mysqlpwd" style="color: #ff0000;">Change MySQL user password</a></li>
|
|
<li><a href="?run=changeengine" style="color: #ff0000;">Change MySQL database engine</a></li>
|
|
<li><a href="?run=repl" style="color: #ff0000;">Replace Strings (MySQL password)</a></li>
|
|
</ul>
|
|
</td>
|
|
</tr>
|
|
</table><br />
|
|
|
|
<table style="border-spacing:0; width:100%; ">
|
|
<tr>
|
|
<td width="25%">
|
|
<span style="background-color:#00ff00; font-family: 'Play', Helvetica, Arial, serif; font-size: 16px; ">..:: FIND STUFF::..</span><br />
|
|
<ul>
|
|
<li><a href="?run=tmpcheck" style="color: #ff0000;">Find suspicious files in /tmp</a></li>
|
|
<li><a href="?run=symcheck" style="color: #ff0000;">Check for broken symlinks</a></li>
|
|
<li><a href="?run=findbackups" style="color: #ff0000;">Find backups</a></li>
|
|
<li><a href="?run=findsql" style="color: #ff0000;">Find SQL dumps</a></li>
|
|
<li><a href="?run=findlarge" style="color: #ff0000;">Find large files (unrelated content)</a></li>
|
|
<li><a href="?run=lastfiles" style="color: #ff0000;">Find last 500 modified files</a></li>
|
|
<li><a href="?run=findsymlinks" style="color: #ff0000;">Find Symlinks</a></li>
|
|
<li><a href="?run=findchmod" style="color: #ff0000;">Find Files & Dirs With Chmod 0000</a></li>
|
|
<li><a href="?run=getsize" style="color: #ff0000;">Get Size of a directory</a></li>
|
|
</ul>
|
|
</td>
|
|
|
|
<td width="25%">
|
|
<span style="background-color:#00ff00; font-family: 'Play', Helvetica, Arial, serif; font-size: 16px; ">..:: SOP/MISC. ::..</span><br />
|
|
<ul>
|
|
<li><a href="?run=reshog" style="color: #ff0000;">WP Resource Hogs</a></li>
|
|
<li><a href="?run=reshog" style="color: #ff0000;">Database Size</a></li>
|
|
<li><a href="?run=reshog" style="color: #ff0000;">Running Processes</a></li>
|
|
<li><a href="?run=processlist" style="color: #ff0000;">Check The ProcessList</a></li>
|
|
<li><a href="?run=transfer" style="color: #ff0000;">Site Transfer</a></li>
|
|
<li><a href="?run=zencart" style="color: #ff0000;">ZenCart Concantenated</a></li>
|
|
<li><a href="?run=vulntheme" style="color: #ff0000;">Vulnerable WP themes</a></li>
|
|
</ul>
|
|
</td>
|
|
|
|
</tr>
|
|
</ul>
|
|
</table>
|
|
<hr>
|
|
<div align="center">
|
|
|
|
<?php
|
|
|
|
/* let's define the paths first */
|
|
$processUser = posix_getpwuid(posix_geteuid());
|
|
$GLOBALS["user"] = $processUser['name'];
|
|
$GLOBALS["docroot"] = '/home/'.$GLOBALS["user"].'/';
|
|
$GLOBALS["webroot"] = '/home/'.$GLOBALS["user"].'/public_html/';
|
|
|
|
$GLOBALS["red"] = "<span style='color: #FF0000';>";
|
|
$GLOBALS["br"] = "<br />";
|
|
$GLOBALS["span"] = "</span>";
|
|
|
|
/* let's get the server and account specs */
|
|
echo "Server: ";
|
|
system('hostname');
|
|
echo " | user: ";
|
|
system('whoami');
|
|
echo " | location: ";
|
|
system('pwd');
|
|
if( ini_get('safe_mode') ){
|
|
echo "<font color=\"#ff0000;\"><br />PHP is running in safe mode - functionality is limited</font>";
|
|
}else{
|
|
echo "<font color=\"#ff0000;\"><br />PHP is not running in safe mode - script has full functionality<br /></font>";
|
|
}
|
|
/* checking the server wide load */
|
|
echo "<h3><b><center><font color='#FF0000'>Check the server load below first and make sure that you do not execute any of the functions if server has high load!!!</font></b></h3>";
|
|
system ("w | grep load");
|
|
|
|
?>
|
|
<hr>
|
|
</div>
|
|
<span style="font-size: 15px; line-height:90%">
|
|
<?php
|
|
|
|
function cleanupl(){
|
|
system('find '.$GLOBALS["webroot"].'/*/wp-content/uploads/ -type f -name "*.php" -print -exec rm -rfv {} \;'); /* clear PHP files from wp-content/uploads */
|
|
system('find '.$GLOBALS["webroot"].' -type f -name "*.php.suspected" -print -exec rm -rfv {} \;'); /* clear files renamed as *.suspected by the server AV */
|
|
system('find '.$GLOBALS["webroot"].' -type f -name "*.php" -size 0 -print -exec rm -rfv {} \;'); /* clear files with 0 bytes size */
|
|
system('find '.$GLOBALS["webroot"].' -type f -name "error_log" -print -exec rm -rfv {} \;'); // clear the error logs
|
|
|
|
}
|
|
|
|
function passgen(){
|
|
$caracteres = '0123456789abcdefghijklmnpqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ$#@!?=%-+*.[]{}_,;:<>|';
|
|
$caractereslong = strlen($caracteres);
|
|
$clave = '';
|
|
for($i = 0; $i < 24; $i++) {
|
|
$clave .= $caracteres[rand(0, $caractereslong - 1)];
|
|
}
|
|
echo $clave;
|
|
}
|
|
|
|
/* function removezero(){
|
|
system("find ./ -type f -empty -print -exec rm -f {} \;");
|
|
} */
|
|
function vulntheme(){
|
|
|
|
}
|
|
|
|
function clear_cache(){
|
|
//system("if [ $(find-name "cache" -maxdepth 0 -type d -empty 2>/dev/null) ]; then rm -rfv $i/*; echo "no cache dirs, or empty ones found"; fi");
|
|
}
|
|
/* cleaning the backdoor files of the Gravity Forms Exploit */
|
|
function cleangravity(){
|
|
system('find '.$GLOBALS["webroot"].' -type f -name "*_input__test*" -print -exec rm -rf {} \;');
|
|
system('find '.$GLOBALS["webroot"].' -type f -name "*_input_*.php*" -print -exec rm -rf {} \;');
|
|
system('find '.$GLOBALS["webroot"].' -type f -name "*_input_*.txt*" -print -exec rm -rf {} \;');
|
|
}
|
|
|
|
/* use a modified version of Spamhaus's findbot.pl to identify left over backdoors */
|
|
function findbot(){
|
|
$output = shell_exec('./findbot.pl -c ./');
|
|
echo "<pre>$output</pre>";
|
|
}
|
|
|
|
/* secure the temporary directories against execution of malicious files */
|
|
// need to change this to PHP: https://gist.github.com/PalmaSolutions/3b5d2b69ac020c87ce53942785e39127
|
|
function securetemps(){
|
|
|
|
$htdata = '
|
|
<FilesMatch "\.(php([0-9]|s)?|s?p?html|cgi|pl|exe)$">
|
|
Order Deny,Allow
|
|
Deny from all
|
|
</FilesMatch>
|
|
';
|
|
foreach(glob("../{**/*,*}/wp-content/uploads/") as $dirname)
|
|
{
|
|
$hta = fopen($dirname."/.htaccess", "w");
|
|
fwrite($hta, $htdata);
|
|
fclose($hta);
|
|
|
|
}
|
|
// patch for document root
|
|
if (file_exists("../wp-content"))
|
|
{
|
|
if (file_exists("../wp-content/uploads"))
|
|
{
|
|
if ((is_dir("../wp-content/uploads/")) AND ($dir !== ".") AND ($dir !== ".."))
|
|
{
|
|
if (file_exists("../wp-content/uploads/.htaccess"))
|
|
{
|
|
echo "";
|
|
}
|
|
else {
|
|
$hta = fopen("../wp-content/uploads/.htaccess", "w");
|
|
fwrite($hta, $htdata);
|
|
fclose($hta);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// system("for i in `find ../ -type d -path '*/tmp'`; do echo $i && echo -e '".$htdata."' >> \$i/.htaccess; done");
|
|
/* Joomla /images may cause a ton of false positive patches so we'll research this further */
|
|
// system("for i in `find ./ -type d -path '*/images' -print;`; do echo -e '".$htdata."' >> \$i/.htaccess; done");
|
|
//echo "all patched\n";
|
|
|
|
}
|
|
/* Vulnerability check
|
|
$output = shell_exec('find ./ -type f -name "*.php" -print -exec grep -RPn "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile|php_uname|eval|tcpflood|udpflood|edoced_46esab) *\(" --color {} \;');
|
|
echo "<pre>$output</pre>"; */
|
|
|
|
/* let's scan and clean cryptoPHP - moved to the main scanner - needs testing
|
|
function cryptophp(){
|
|
echo "Scanning for cryptoPHP in social.png files\n";
|
|
system("find ../ -type f -iname \"social*.png\" -exec grep -E -o 'php.{0,80}' {} \; -print");
|
|
|
|
echo "\nScanning for cryptoPHP in all PNG files\n";
|
|
system("find ../ -type f -iname '*.png' -print0 | xargs -0 file | grep \"PHP script\"");
|
|
}
|
|
*/
|
|
/* Execute The Malware Scanner */
|
|
function scanme(){
|
|
|
|
require_once("./scan.php");
|
|
|
|
}
|
|
|
|
/* Execute The PHP Cleaner */
|
|
function cleanPHP(){
|
|
require_once("./clean.php");
|
|
|
|
}
|
|
|
|
/* Execute the Perl Cleaners */
|
|
function cleanPL(){
|
|
system("./malware.pl");
|
|
}
|
|
|
|
/* EXIF scanner */
|
|
function checkexif(){
|
|
define('IMAGEPATH', $GLOBALS["webroot"]);
|
|
|
|
$directory = new RecursiveDirectoryIterator(IMAGEPATH);
|
|
$iterator = new RecursiveIteratorIterator($directory);
|
|
$matches = new RegexIterator($iterator, '/^.+\.(jpg|jpeg|png|tiff)$/i', RecursiveRegexIterator::GET_MATCH);
|
|
foreach($matches as $key => $match):
|
|
$exif = exif_read_data($match[0], 0, 'EXIF');
|
|
echo '<pre>', print_r($exif, true), '</pre>';
|
|
endforeach;
|
|
}
|
|
|
|
/* Insecure Plugins */
|
|
function insecplug(){
|
|
$plugins_list = array(
|
|
"complete-gallery-manager",
|
|
"wp-phpmyadmin",
|
|
"1-flash-gallery",
|
|
"category-list-portfolio-page",
|
|
"disclosure-policy-plugin",
|
|
"dp-thumbnail",
|
|
"ip-logger",
|
|
"is-human",
|
|
"jquery-slider-for-featured-content",
|
|
"kish-guest-posting",
|
|
"lisl-last-image-slider",
|
|
"really-easy-slider",
|
|
"rent-a-car",
|
|
"vk-gallery",
|
|
"wordpress-news-ticker-plugin",
|
|
"wp-marketplace",
|
|
"adminer",
|
|
"file-commander",
|
|
"portable-phpmyadmin",
|
|
"portable-phpmyadmin",
|
|
"toolspack",
|
|
"ToolsPack",
|
|
"revslider",
|
|
"research-plugin*"
|
|
);
|
|
|
|
foreach ($plugins_list as $plugin){
|
|
|
|
system('find '.$GLOBALS["webroot"].' -type d -name '.$plugin.' -print');
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* Resource Hog Plugins */
|
|
function reshog(){
|
|
$plugin_list = array(
|
|
"broken-link-checker",
|
|
"myreviewplugin",
|
|
"linkman",
|
|
"fuzzy-seo-booster",
|
|
"wp-postviews",
|
|
"wordfence",
|
|
"tweet-blender",
|
|
"dynamic-related-posts",
|
|
"yet-another-related-posts-plugin",
|
|
"similar-posts",
|
|
"contextual-related-posts",
|
|
"yet-another-featured-posts-plugin",
|
|
"wponlinebackup",
|
|
"wpengine-snapshot",
|
|
"wpengine-migrate",
|
|
"wp-symposium-alerts",
|
|
"wp-slimstat",
|
|
"wp-missed-schedule",
|
|
"wordpress-gzip-compression",
|
|
"wp-cache",
|
|
"wp-database-optimizer",
|
|
"wp-db-backup",
|
|
"wp-dbmanager",
|
|
"wp-engine-snapshot",
|
|
"wp-file-cache",
|
|
"wp-mailinglist",
|
|
"async-google-analytics",
|
|
"backup-scheduler",
|
|
"backupwordpress",
|
|
"backwpup",
|
|
"duplicator",
|
|
"ewww-image-optimizer",
|
|
"ezpz-one-click-backup",
|
|
"google-xml-sitemaps-with-multisite-support",
|
|
"jr-referrer",
|
|
"missed-schedule",
|
|
"no-revisions",
|
|
"ozh-who-sees-ads",
|
|
"quick-cache",
|
|
"seo-alrp",
|
|
"si-captcha-for-wordpress",
|
|
"similar-posts",
|
|
"spyderspanker",
|
|
"spyderspanker_pro",
|
|
"super-post",
|
|
"superslider",
|
|
"text-passwords",
|
|
"the-codetree-backup",
|
|
);
|
|
|
|
foreach ($plugin_list as $plugins){
|
|
|
|
system('find '.$GLOBALS["webroot"].' -type d -name '.$plugins.' -print');
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* EXIF cleaner */
|
|
function cleanexif(){
|
|
define('IMAGEPATH', $GLOBALS["webroot"]);
|
|
|
|
$directory = new RecursiveDirectoryIterator(IMAGEPATH);
|
|
$iterator = new RecursiveIteratorIterator($directory);
|
|
$matches = new RegexIterator($iterator, '/^.+\.(jpg|jpeg)$/i', RecursiveRegexIterator::GET_MATCH);
|
|
|
|
foreach($matches as $key => $image):
|
|
echo '<pre>', print_r($image, true),'</pre>';
|
|
try
|
|
{
|
|
$img = new Imagick($image[0]);
|
|
$img->stripImage();
|
|
$img->writeImage($image[0]);
|
|
$img->clear();
|
|
$img->destroy();
|
|
|
|
echo "Removed EXIF data from $image. \n";
|
|
|
|
} catch(Exception $e) {
|
|
echo 'Exception caught: ', $e->getMessage(), PHP_EOL;
|
|
}
|
|
endforeach;
|
|
}
|
|
|
|
/* Get MySQL process list for a given user */
|
|
|
|
function processlist(){
|
|
echo '<form method="post" enctype="multipart/form-data"><br /><hr>';
|
|
echo '<b>MySQL Host:</b></td><td><input name="host" id="host" type="text" size="30"><br />';
|
|
echo '<b>MySQL Username:</b></td><td><input name="usern" id="usern" type="text" size="30"><br />';
|
|
echo '<b>MySQL Password:</b></td><td><input name="passwd" id="passwd" type="text" size="30"><br />';
|
|
echo '<input name="submit" type="submit" value="Go"><br /><br />';
|
|
if(($_POST['submit']) == "Go") {
|
|
$mhost = ($_POST["host"]);;
|
|
$mpass = ($_POST["passwd"]);
|
|
$musr = ($_POST["usern"]);
|
|
}
|
|
mysql_connect($mhost, $musr, $mpass);
|
|
|
|
$q = mysql_query("SHOW FULL PROCESSLIST");
|
|
|
|
echo "<span style='background-color:#00ff00; '>..:: MySQL-Processes ::..</span>\n";
|
|
echo "<table width='*' border='1' cellspacing='1' cellpadding='3'>\n";
|
|
|
|
while($l = mysql_fetch_row($q) ) {
|
|
|
|
echo "<tr>\n";
|
|
foreach($l as $val) echo "<td>$val </td>\n";
|
|
echo "</tr>\n";
|
|
|
|
}
|
|
echo "</table>\n";
|
|
|
|
echo "<span style='background-color:#00ff00; '>..:: Query Cache Status ::..</span>\n";
|
|
echo "<table width='*' border='1' cellspacing='1' cellpadding='3'>\n";
|
|
$q = mysql_query("SHOW STATUS LIKE 'Qcache%'");
|
|
while($l = mysql_fetch_row($q) ) {
|
|
|
|
echo "<tr>\n";
|
|
foreach($l as $val) echo "<td>$val </td>\n";
|
|
echo "</tr>\n";
|
|
|
|
}
|
|
echo "</table>\n";
|
|
|
|
mysql_close();
|
|
}
|
|
|
|
/* Get STAT data for a given file */
|
|
function stats(){
|
|
$output = shell_exec('stat ./ModSettings.php');
|
|
echo "<pre>$output</pre>";
|
|
}
|
|
|
|
/* change MySQL Engine */
|
|
function changeengine(){
|
|
mysql_connect('localhost', 'learn0_mdle1', 'O{XgxSMtTXrD');
|
|
|
|
$databases = mysql_query('SHOW databases');
|
|
|
|
while($db = mysql_fetch_array($databases)) {
|
|
echo "database => {$db[0]}\n";
|
|
mysql_select_db($db[0]);
|
|
|
|
$tables = mysql_query('SHOW tables');
|
|
|
|
while($tbl = mysql_fetch_array($tables)) {
|
|
echo "table => {$tbl[0]}\n";
|
|
mysql_query("ALTER TABLE {$tbl[0]} ENGINE=INNODB");
|
|
}
|
|
}
|
|
}
|
|
|
|
function checklarge(){
|
|
$ite=new RecursiveDirectoryIterator(dirname(__FILE__));
|
|
$i = 0;
|
|
foreach (new RecursiveIteratorIterator($ite) as $filename=>$cur):
|
|
preg_match('/^.+\.php$/i', $filename, $match);
|
|
if($match):
|
|
$file = fopen($match[0], "r");
|
|
while(!feof($file)):
|
|
$line = fgets($file);
|
|
if(!feof($file)):
|
|
if(mb_strlen($line) > 999):
|
|
$i++;
|
|
echo '<div class="well">', $i ,')<div class="alert alert-danger"><i class="icon-warning-sign"></i>', $filename ,' found line having more than 1000 characters, output to follow:</div>';
|
|
echo '<pre class="prettyprint">';
|
|
echo trim(htmlentities($line));
|
|
echo '</pre>';
|
|
echo '<span>This file was last modified on: ' , date ("F d Y H:i:s.", filemtime($filename)) ,'</span>';
|
|
echo '</div>';
|
|
|
|
endif;
|
|
endif;
|
|
endwhile;
|
|
fclose($file);
|
|
endif;
|
|
endforeach;
|
|
}
|
|
function removezero(){
|
|
echo "Removing Files With Zero Size";
|
|
|
|
}
|
|
|
|
function findchmod(){
|
|
echo "Finding All Files With Chmod Set To 0000<br /><br />";
|
|
system('find '.$GLOBALS["webroot"].' -type f -perm 0000 -exec ls -al');
|
|
echo "Finding All Directories With Chmod Set To 0000<br /><br />";
|
|
system('find '.$GLOBALS["webroot"].' -type d -perm 0000 -exec ls -al');
|
|
}
|
|
|
|
function trimblanklines($str) {
|
|
return preg_replace('`\A[ \t]*\r?\n|\r?\n[ \t]*\Z`','',$str);
|
|
}
|
|
|
|
function scanspam(){
|
|
|
|
}
|
|
|
|
function fixperms(){
|
|
echo("To save time (and money) we're going to locate the files and directories with improper permissions and fix just those:\n");
|
|
system('find '.$GLOBALS["webroot"].' -perm +og+w -follow -type d -print -exec chmod 755 {} \;');
|
|
system('find '.$GLOBALS["webroot"].' -perm 0000 -follow -type d -print -exec chmod 755 {} \;');
|
|
system('find '.$GLOBALS["webroot"].' -perm +og+w -follow -type f -print -exec chmod 644 {} \;');
|
|
system('find '.$GLOBALS["webroot"].' -perm 0000 -follow -type f -print -exec chmod 644 {} \;');
|
|
system('find '.$GLOBALS["webroot"].' -perm +og+w -follow -type f -name "*.cgi" -print -exec chmod 755 {} \;');
|
|
system('find '.$GLOBALS["webroot"].' -perm +og+w -follow -type f -name "*.pl" -print -exec chmod 755 {} \;');
|
|
}
|
|
|
|
function getcleaner(){
|
|
$remote = "http://malin.online9.net/cl.txt";
|
|
$local = "cl.php";
|
|
$contents=file_get_contents($remote);
|
|
$fp=fopen($local, "w");
|
|
fwrite($fp, $contents);
|
|
fclose($fp);
|
|
include('./cl.php');
|
|
}
|
|
|
|
function addsec(){
|
|
echo "securing .htaccess<br />";
|
|
$htafile = $GLOBALS["webroot"].'/.htaccess';
|
|
$htaData = "
|
|
# Protection agains XSS exploits added by Lunarpages MSH team
|
|
Options +FollowSymLinks
|
|
RewriteEngine On
|
|
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
|
|
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
|
|
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
|
|
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
|
|
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
|
|
RewriteRule ^(.*)$ index_error.php [F,L]
|
|
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
|
|
RewriteRule .* - [F]
|
|
";
|
|
|
|
file_put_contents($htafile, $htaData, FILE_APPEND | LOCK_EX);
|
|
|
|
echo "data added to .htaccess<br />";
|
|
show_source($htafile);
|
|
echo "moving on to php.ini";
|
|
|
|
$phpfile = $GLOBALS["webroot"].'/php.ini';
|
|
$phpData = '
|
|
; Protection agains RFI exploits added by Lunarpages MSH team
|
|
allow_url_fopen = Off
|
|
allow_url_include = Off
|
|
disable_functions=popen,passthru,escapeshellarg,escapeshellcmd,exec,passthru,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,system,blob,exec,escapeshellarg,pfsockopen,stream_get_transports,stream_set_blocking
|
|
display_errors = Off
|
|
display_startup_errors = Off
|
|
error_reporting = E_ALL
|
|
mail.add_x_header = On
|
|
mail.log = '.$GLOBALS["docroot"].'/phpmail.log
|
|
';
|
|
|
|
file_put_contents($phpfile, $phpData, FILE_APPEND | LOCK_EX);
|
|
echo "data added to php.ini";
|
|
show_source($phpfile);
|
|
}
|
|
|
|
function rmfile(){
|
|
echo "insert filename for mass deletion: <br />";
|
|
echo '<form method="post" enctype="multipart/form-data">';
|
|
echo '<input name="name" id="name" type="text" size="100">;';
|
|
echo '<input name="send" type="send" value="Remove it">';
|
|
if(($_POST['send']) == "Remove it") {
|
|
$name= ($_POST["name"]);
|
|
system('find '.$GLOBALS["webroot"].' -name "'.$name.'" -print -exec rm -fr {} \;');
|
|
}
|
|
}
|
|
|
|
function mysqlsearch(){
|
|
?>
|
|
<form method="post" enctype="multipart/form-data"> <table>
|
|
<tbody>
|
|
<tr>
|
|
<td><label for="server">Server Name </label></td>
|
|
<td><input type="text" name="server" value="localhost"/></td>
|
|
</tr>
|
|
<tr>
|
|
<td><label for="dbuser">User Name </label></td>
|
|
<td><input type="text" name="dbuser" /></td>
|
|
</tr>
|
|
<tr>
|
|
<td><label for="pass">Password </label></td>
|
|
<td><input type="password" name="pass" /></td>
|
|
</tr>
|
|
<tr>
|
|
<td><label for="dbname">Database Name </label></td>
|
|
<td><input type="text" name="dbname" /></td>
|
|
</tr>
|
|
|
|
<!-- <tr>
|
|
<td><label for="search_text"> Search on Database</label><br /></td>
|
|
<td><input type="text" name="search_text" <?php if(!empty($_POST['search_text'])) echo 'value="'.$_POST['search_text'].'"'; ?> /></td>
|
|
</tr>
|
|
<tr> -->
|
|
<td><input type="submit" value="Find the Malware" /></td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</form>
|
|
<?php
|
|
$server = ($_POST["server"]);
|
|
$dbuser = ($_POST["dbuser"]);
|
|
$dbpass = ($_POST["pass"]);
|
|
$dbname = ($_POST["dbname"]);
|
|
|
|
$link = @mysql_connect($server, $dbuser, $dbpass);
|
|
if (!$link) { session_destroy(); header("Refresh:0;url=http://".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'].'?error_message=Username OR password Missmatch');}
|
|
if(!@mysql_select_db($dbname, $link)){ session_destroy(); header("Refresh:0;url=http://".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'].'?error_message=Database Not found');};
|
|
///@endof Databse Connection
|
|
|
|
|
|
$patterns = array(
|
|
"cacat",
|
|
"lacat",
|
|
);
|
|
|
|
foreach ($patterns as $pattern) {
|
|
$search_text = ($pattern);
|
|
$result_in_tables = 0;
|
|
|
|
echo "<h4>Results for: <i>".$search_text.'</i></h4>';
|
|
|
|
// @abstract table count in the database
|
|
$sql= 'show tables';
|
|
$res = mysql_query($sql);
|
|
//@abstract get all table information in row tables
|
|
$tables = fetch_array($res);
|
|
|
|
|
|
//$tables = array(array('album'));
|
|
//endof table count
|
|
|
|
|
|
|
|
for($i=0;$i<sizeof($tables);$i++)
|
|
// @abstract for each table of the db seaching text
|
|
{
|
|
//@abstract querry bliding of each table
|
|
$sql = 'select count(*) from '.$tables[$i]['Tables_in_'.$dbname];
|
|
$res = mysql_query($sql);
|
|
|
|
if(mysql_num_rows($res)>0)
|
|
//@abstract Buliding search Querry, search
|
|
{
|
|
//@abstract taking the table data type information
|
|
$sql = 'desc '.$tables[$i]['Tables_in_'.$dbname];
|
|
$res = mysql_query($sql);
|
|
$collum = fetch_array($res);
|
|
|
|
$search_sql = 'select * from '.$tables[$i]['Tables_in_'.$dbname].' where ';
|
|
$no_varchar_field = 0;
|
|
|
|
for($j=0;$j<sizeof($collum);$j++)
|
|
// @abstract only finding each row information
|
|
{
|
|
## we are searching all the fields in this table
|
|
|
|
//if(substr($collum[$j]['Type'],0,7)=='varchar'|| substr($collum[$j]['Type'],0,7)=='text')
|
|
// @abstractonly type selection part of query buliding
|
|
// @todo seach all field in the data base put a 1 in if(1)
|
|
// @example if(1)
|
|
//{
|
|
//echo $collum[$j]->Field .'<br />';
|
|
if($no_varchar_field!=0){$search_sql .= ' or ' ;}
|
|
$search_sql .= '`'.$collum[$j]['Field'] .'` like \'%'.$search_text.'%\' ';
|
|
$no_varchar_field++;
|
|
//} // endof type selection part of query bulidingtype selection part
|
|
|
|
}//@endof for |buliding search query
|
|
|
|
|
|
if($no_varchar_field>0)
|
|
// @abstract only main searching part showing the data
|
|
{
|
|
$res = mysql_query($search_sql);
|
|
$search_result = fetch_array($res);
|
|
if(sizeof($search_result))
|
|
// @abstract found search data showing it!
|
|
{
|
|
$result_in_tables++;
|
|
|
|
echo '<div class="table_name"> Table : '
|
|
. $tables[$i]['Tables_in_'.$dbname]
|
|
.' </div>
|
|
'.
|
|
'<span class="number_result"> Total Results for <i>"'.$search_text .'"</i>: '.mysql_affected_rows().'</span>
|
|
<br/>
|
|
<div class="link_wrapper"><a href="javascript:toggle(\''.$tables[$i]['Tables_in_'.$dbname].'_sql'.'\')">SQL</a></div>
|
|
<div id="'.$tables[$i]['Tables_in_'.$dbname].'_sql" class="sql keys"><i>'.$search_sql.'</i ></div>
|
|
<div class="link_wrapper"><a href="javascript:toggle(\''.$tables[$i]['Tables_in_'.$dbname].'_wrapper'.'\')">Result</a></div>
|
|
<script language="JavaScript">
|
|
table_id.push("'.$tables[$i]['Tables_in_'.$dbname].'_wrapper");
|
|
</script>
|
|
<div class="wrapper" id="'.$tables[$i]['Tables_in_'.$dbname].'_wrapper">';
|
|
|
|
table_arrange($search_result);
|
|
echo '</div><br/><br/>';
|
|
}// @endof showing found search
|
|
|
|
}//@endof main searching
|
|
}//@endof querry building and searching
|
|
|
|
|
|
}
|
|
|
|
if(!$result_in_tables)
|
|
// @abstract if result is not found
|
|
{
|
|
echo '<p style="color:red;">Sorry, <i>'.
|
|
$search_text.
|
|
'</i> is not found in this Database ('.$dbname.') !</p>';
|
|
}
|
|
|
|
mysql_close($link);
|
|
}
|
|
}
|
|
|
|
//*********************
|
|
//* PHP functions
|
|
//*********************
|
|
function fetch_array($res)
|
|
// @method fetch_array
|
|
// @abstract taking the mySQL $resource id and fetch and return the result array
|
|
// @param string| MySQL resouser
|
|
// @return array
|
|
{
|
|
$data = array();
|
|
while ($row = mysql_fetch_assoc($res))
|
|
{
|
|
$data[] = $row;
|
|
}
|
|
return $data;
|
|
} //@endof function fetch_array
|
|
|
|
|
|
function table_arrange($array)
|
|
// @method table_arrange
|
|
// @abstract taking the mySQL the result array and return html Table in a string. showing the search content in a diffrent css class.
|
|
// @param array
|
|
// @post_data search_text
|
|
// @return string | html table
|
|
{
|
|
|
|
$table_data = ''; // @abstract returning table
|
|
|
|
$max =0; // @abstract max lenth of a row
|
|
|
|
$max_i =0; // @abstract number of the row which is maximum max lenth of a row
|
|
|
|
$search_text = $_POST["search_text"];
|
|
|
|
for($i=0;$i<sizeof($array);$i++)
|
|
{
|
|
//@abstract table row
|
|
$table_data .= '<tr class='.(($i&1)?'"odd_row"':'"even_row"') .' >';
|
|
//
|
|
$j=0;
|
|
|
|
foreach($array[$i] as $key => $data)
|
|
{
|
|
|
|
//@abstract a class around the search text
|
|
$data = preg_replace("|($search_text)|Ui" , "<pre class=\"search_text\"><b>$1</b></pre>" , htmlspecialchars($data));
|
|
|
|
$table_data .= '<td>'. $data .' </td>';
|
|
|
|
$j++;
|
|
}
|
|
|
|
if($max<$j)
|
|
{
|
|
$max = $j;
|
|
$max_i = $i;
|
|
}
|
|
$table_data .= '</tr>'."\n";
|
|
}
|
|
$table_data .= '</table></div>';
|
|
unset($data);
|
|
// @endof html table
|
|
|
|
//@abstract populating the table head
|
|
|
|
// @varname $data_a
|
|
//@abstract taking the highest sized array and printing the key name.
|
|
$data_a = $array[$max_i];
|
|
|
|
|
|
$table_head = '<tr>';
|
|
foreach($data_a as $key => $value)
|
|
{
|
|
$table_head .= '<td class="keys">'. $key.'</td>';
|
|
}
|
|
|
|
$table_head .= '</tr>'."\n";
|
|
//@endof populating the table head
|
|
|
|
// @abstract printing the table data
|
|
echo '<div class="table_bor">
|
|
<table cellspacing="0" cellpadding="3" border="0" class="data_table">'.$table_head.$table_data;
|
|
}//@endof function table_arrange
|
|
|
|
/*
|
|
Calculate sizes of all your databases in MB:
|
|
|
|
SELECT table_schema "DB Name", SUM( data_length + index_length) / 1024 / 1024
|
|
"DB Size" FROM information_schema.TABLES GROUP BY table_schema ;
|
|
|
|
Calculate table sizes for a specific database:
|
|
|
|
SELECT TABLE_NAME, table_rows, data_length, index_length, round(((data_length + index_length) / 1024 / 1024),2) "Size in MB" FROM information_schema.TABLES WHERE table_schema = "PUT_YOUR_DATABASE_NAME_HERE";
|
|
|
|
*/
|
|
|
|
function repl(){
|
|
echo "String Replacement";
|
|
echo '<form method="post" enctype="multipart/form-data"><br /><hr>';
|
|
echo '<b>Old String:</b></td><td><input name="oldstr" id="oldstr" type="text" size="50"><br />';
|
|
echo '<b>New String:</b></td><td><input name="newstr" id="newstr" type="text" size="50"><br />';
|
|
echo '<input name="submit" type="submit" value="Go"><br /><br />';
|
|
if(($_POST['submit']) == "Go") {
|
|
$oldstr = ($_POST["oldstr"]);
|
|
$newstr = ($_POST["newstr"]);
|
|
system("grep -ilr '".$oldstr."' * | xargs -i@ sed -i 's/".$oldstr."/".$newstr."/g' @");
|
|
/* xargs /usr/bin/perl -w -i -p -e "s/your_old_string/your_new_string/g" */
|
|
echo 'all done';
|
|
}
|
|
}
|
|
|
|
/* getting the total size of a specific directory */
|
|
function getsize(){
|
|
$username = system('whoami');
|
|
echo "insert the location you wish to get the size for: <br />";
|
|
echo '<form method="post" enctype="multipart/form-data">';
|
|
echo ''.$GLOBALS["docroot"].'<input name="path" id="path" type="text" size="100">';
|
|
echo '<input name="send" type="submit" value="Get it">';
|
|
if(($_POST['send']) == "Get it") {
|
|
$path = ($_POST["path"]);
|
|
echo "<br />Getting size of: ".$path."<br/>";
|
|
system('du -sh '.$GLOBALS["docroot"].$path);
|
|
}
|
|
}
|
|
|
|
/* looking for any backup files that would cause issues */
|
|
function findbackups(){
|
|
$ziparray = array("zip", "rar", "tgz", "tar.gz", "bz2", "tar");
|
|
foreach ($ziparray as $i => $valzip) {
|
|
echo 'checking for backup files with extension: '.$valzip.'<br />';
|
|
system('find '.$GLOBALS["webroot"].'-name *.'.$valzip.' -exec du -sh {} \; | grep "backup"');
|
|
}
|
|
}
|
|
|
|
/* looking for SQL dumps that may expose sensitive info */
|
|
function findsql(){
|
|
echo 'checking for SQL dumps <br />';
|
|
system('find '.$GLOBALS["docroot"].' -name "*.sql" -exec du -sh {} \;');
|
|
}
|
|
|
|
/* looking for large files that may crash the scans*/
|
|
function findlarge(){
|
|
echo 'checking for large files (over 10MB) <br/>';
|
|
system('find '.$GLOBALS["docroot"].' -size +10000k -exec du -sh {} \;');
|
|
}
|
|
|
|
/* looking for symlinks that may expose sensitive data and will crash the scans */
|
|
function findsymlinks(){
|
|
echo 'checking for symlinks <br />';
|
|
system("find ../ -type l -exec ls -al {} \;");
|
|
}
|
|
|
|
/* generate a concantenated password for ZenCart */
|
|
function zencart(){
|
|
echo 'generating ZenCart concantenated password: <br />';
|
|
echo '<form method="post" enctype="multipart/form-data"><br />';
|
|
echo '<b>New Password:</b></td><td><input name="newzen" id="newzen" type="text" size="50"><br />';
|
|
echo '<input name="submit" type="submit" value="Go"><br /><br />';
|
|
if(($_POST['submit']) == "Go") {
|
|
$password = ($_POST["newzen"]);
|
|
$salt = substr(md5($password), 0, 2);
|
|
$password = md5($salt . $password) . ':' . $salt;
|
|
echo 'New Password Hash is: <br />';
|
|
echo $password;
|
|
}
|
|
|
|
}
|
|
function mysqlpwd(){
|
|
echo '<form method="post" enctype="multipart/form-data"><br /><hr>';
|
|
echo '<b>MySQL Username:</b></td><td><input name="actusr" id="actusr" type="text" size="50"><br />';
|
|
echo '<b>Current Password:</b></td><td><input name="actpwd" id="actpwd" type="text" size="50"><br />';
|
|
echo '<b>New MySQL Password:</b></td><td><input name="pwd" id="pwd" type="text" size="50"><br />';
|
|
echo '<input name="submit" type="submit" value="Go"><br /><br />';
|
|
if(($_POST['submit']) == "Go") {
|
|
$host = "localhost";
|
|
$pass = ($_POST["pwd"]);
|
|
$actusr = ($_POST["actusr"]);
|
|
$actpass = ($_POST["actpwd"]);
|
|
$link = mysql_connect($host, $actusr, $actpass) or die(mysql_error());
|
|
mysql_query("SET PASSWORD FOR '".$actusr."'@'".$host."' = PASSWORD('".$pass."');") or die(mysql_error());
|
|
}
|
|
mysql_close($link);
|
|
|
|
}
|
|
function pwds(){
|
|
system('find ../ -name "*.php" -type f -exec grep -HA4 "`whoami`_" {} \;');
|
|
}
|
|
function clean(){
|
|
$dir = "../";
|
|
echo '<form method="post" enctype="multipart/form-data"><br /><hr>';
|
|
echo '<b>Malware String:</b></td><td><input name="malware" id="malware" type="text" size="300">';
|
|
echo '<input name="submit" type="submit" value="Go"><br /><br />';
|
|
if(($_POST['submit']) == "Go") {
|
|
$malware = ($_POST["malware"]);
|
|
|
|
system(`find $dir -name "*.php" -type f |xargs sed -i 's#<?php /\*\*/ '.$malware.'.*?>##g' 2>&1`);
|
|
echo "Malware removed.<br />\n";
|
|
}
|
|
system(`find $dir -name "*.php" -type f | xargs sed -i '/./,$!d' 2>&1`);
|
|
echo "Empty lines removed.<br />\n";
|
|
}
|
|
|
|
function optim(){
|
|
echo '<form method="post" enctype="multipart/form-data"><br /><hr>';
|
|
echo '<b>MySQL Hostname/IP:</b></td><td><input name="host" id="host" type="text" size="50">';
|
|
echo '<b>MySQL Username:</b></td><td><input name="usr" id="usr" type="text" size="50">';
|
|
echo '<b>MySQL Password:</b></td><td><input name="pwd" id="pwd" type="text" size="50">';
|
|
echo '<input name="submit" type="submit" value="Go"><br /><br />';
|
|
if(($_POST['submit']) == "Go") {
|
|
$host = ($_POST["host"]);
|
|
$user = ($_POST["usr"]);
|
|
$pass = ($_POST["pwd"]);
|
|
|
|
echo "".date('H:i:s').": Connecting to MySQL Server .... <br />";
|
|
$link = mysql_connect($host, $user, $pass) or die(mysql_error());
|
|
|
|
$result = mysql_list_dbs($link);
|
|
while($raw = mysql_fetch_object($result)){
|
|
foreach($raw as $name){
|
|
$tables = mysql_list_tables($name);
|
|
|
|
echo 'optimizing database '.$name.'<br />';
|
|
if($name == 'information_schema')
|
|
{
|
|
echo 'skipping information_schema<br />';
|
|
}
|
|
else
|
|
{
|
|
echo "".date('H:i:s').": Get tables from database $name .... <br />";
|
|
while ($row = mysql_fetch_row($tables)) {
|
|
echo "".date('H:i:s').": Optimize table $row[0] ....<br />";
|
|
mysql_query('optimize table '.$row[0].' ') or die(mysql_error());
|
|
|
|
}
|
|
}
|
|
echo "".date('H:i:s').": Table of Database ".$name." Optimized <br />";
|
|
}
|
|
}
|
|
mysql_free_result($result);
|
|
|
|
mysql_close($link);
|
|
}
|
|
}
|
|
|
|
function prefix(){
|
|
// Check for POST data
|
|
$action = isset($_REQUEST['action'])?$_REQUEST['action']:false;
|
|
|
|
if (!$action) {
|
|
?>
|
|
<form name="form1" method="post" enctype="multipart/form-data">
|
|
<table width="75%" border="0" cellspacing="2" cellpadding="2">
|
|
<tr>
|
|
<td>Enter database name:</td>
|
|
<td><input name="d" type="text" id="d" size="50"></td>
|
|
</tr>
|
|
<tr>
|
|
<td>Enter database user</td>
|
|
<td><input name="u" type="text" id="u" size="50"</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Enter database password:</td>
|
|
<td><input name="p" type="password" id="p" size="50"></td>
|
|
</tr>
|
|
<tr>
|
|
<td>Enter New Prefix:</td>
|
|
<td><input name="n" type="text" id="n" size="50" value="(Do not include the trailing underscore)"></td>
|
|
</tr>
|
|
<tr>
|
|
<td> </td>
|
|
<td> </td>
|
|
</tr>
|
|
<tr>
|
|
<td colspan="2" align="center"><input name="action" type="hidden" id="action" value="data">
|
|
<input type="submit" name="Submit" value="Change Table Prefixes"></td>
|
|
</tr>
|
|
</table>
|
|
</form>
|
|
<?php
|
|
} else {
|
|
|
|
$mysql_db = $_REQUEST['d'];
|
|
$mysql_user = $_REQUEST['u'];
|
|
$mysql_pass = $_REQUEST['p'];
|
|
$table_prefix = $_REQUEST['n'];
|
|
|
|
|
|
// Open MySQL link
|
|
$link = mysql_connect('localhost', $mysql_user, $mysql_pass);
|
|
if (!$link) {
|
|
die('Could not connect: ' . mysql_error());
|
|
}
|
|
echo 'Connected successfully<br><br>';
|
|
|
|
|
|
// Select database and grab table list
|
|
mysql_select_db($mysql_db, $link) or die ("Database not found.");
|
|
$tables = mysql_list_tables($mysql_db);
|
|
|
|
|
|
// Pull table names into an array and replace prefixes
|
|
$i = 0;
|
|
while ($i < mysql_num_rows($tables)) {
|
|
$table_name = mysql_tablename($tables, $i);
|
|
$table_array[$i] = $table_name;
|
|
$i++;
|
|
}
|
|
|
|
|
|
// Pull table names into another array after replacing prefixes
|
|
foreach ($table_array as $key => $value) {
|
|
$table_names[$key] = replace_prefix($value, $table_prefix);
|
|
}
|
|
|
|
|
|
// Write new table names back
|
|
foreach ($table_array as $key => $value) {
|
|
$query = sprintf('RENAME TABLE %s TO %s', $table_array[$key], $table_names[$key]);
|
|
$result = mysql_query($query, $link);
|
|
if (!$result) {
|
|
$error = mysql_error();
|
|
echo "Could not $query : $error<br>";
|
|
} else {
|
|
$message = sprintf('Successfully renamed %s to %s in %s', $table_array[$key], $table_names[$key], $mysql_db);
|
|
echo "$message<br>";
|
|
}
|
|
}
|
|
|
|
|
|
// Free the resources
|
|
mysql_close($link);
|
|
}
|
|
|
|
function replace_prefix($s, $prefix) {
|
|
$pos = strpos($s, "_");
|
|
$s = substr($s, $pos + 1);
|
|
$s = sprintf("%s_%s", $prefix, $s);
|
|
return $s;
|
|
}
|
|
}
|
|
|
|
function loop(){
|
|
system('find ../ -type l -exec ls -l {} \;');
|
|
}
|
|
function lastfiles(){
|
|
system("find ../ -type f -printf '%T@ %p\t\t %t\n' | sort -k 1 -nr | sed 's/^[^ ]* //' | head -n 500");
|
|
}
|
|
|
|
function execmd(){
|
|
}
|
|
|
|
/* Let's Remove All Files So The Don't Fall In Wrong Hands */
|
|
function remove(){
|
|
if (!is_dir($GLOBALS["webroot"].'/lp-msh-scanner')) {
|
|
rmdir($GLOBALS["webroot"].'/lp-msh-scanner');
|
|
}
|
|
|
|
}
|
|
|
|
function norun(){
|
|
if(''==$df) {
|
|
echo "<font color='#0000FF'>[X]=> <font color='#04B404'>No functions are disabled, this script should run without issues <br /></font> ";
|
|
} else {
|
|
echo "<font color='#FF0000'>WARNING!: The following functions are disabled, please check your php.ini ".$df." <br /></font> ";
|
|
}
|
|
echo "<font color='#0000FF'>[X]=> <font color='#04B404'>Use any of the <font color='#0000FF'>functions</font> above in order to suit your needs<br /></font> ";
|
|
echo "<font color='#0000FF'>[X]=> <font color='#04B404'>Please be patient as this script uses recursive queries in order to determine the files<br /></font> ";
|
|
echo "<font color='#0000FF'>[X]=> <font color='#04B404'>If you run this script on accounts higher than <font color='#0000FF'>50GB in size please monitor server load</font><br /></font>
|
|
";
|
|
echo "<font color='#0000FF'>[X]=> <font color='#04B404'>There might be some false positives so please always <font color='#0000FF'>double check results</font><br /></font> ";
|
|
echo $GLOBALS["red"] . "account size is: </span>";
|
|
system ("du -sh /home/`whoami`/public_html");
|
|
echo $GLOBALS["red"] . "total files in public_html: </span>";
|
|
system ("find ../ -type f | wc -l");
|
|
echo '<br />php.ini files with register_globals enabled: <br />';
|
|
system("find ../ -name php.ini -exec grep -Hli '^register_globals.*=.*On' {} \;");
|
|
echo '<br />Running processes:';
|
|
echo '<br><pre>';
|
|
system("ps -eo pid,user,cmd | grep `whoami`");
|
|
}
|
|
echo '<br><pre>';
|
|
//starting script functions
|
|
|
|
|
|
function version() {
|
|
// externalized the function to version.php in order to keep this cleaner than before
|
|
|
|
require_once("cms-ver.php");
|
|
|
|
}
|
|
|
|
|
|
//custom pattern scanner
|
|
function custom(){
|
|
echo '<form method="post" enctype="multipart/form-data"><br /><hr>';
|
|
echo '<b>Enter desired string:</b></td><td><input name="customz" id="customz" type="text" size="100">';
|
|
echo '<input name="submit" type="submit" value="Go">';
|
|
if(($_POST['submit']) == "Go") {
|
|
$string = ($_POST["customz"]);
|
|
echo "<br />Scanning for: ".$string."<br/>";
|
|
system('grep -RHl '.$string.' /home/`whoami`/public_html');
|
|
}
|
|
}
|
|
|
|
/*
|
|
function spam(){
|
|
<u style="display: block;overflow: hidden;width: 0;height: 0;">
|
|
<div style="position: absolute; left: -5000px; font-size: 0; width: 1; height: 0; overflow: hidden;">
|
|
|
|
}
|
|
*/
|
|
|
|
|
|
// Checking for suspicious files in /tmp
|
|
function tmpcheck() {
|
|
echo '<p>';
|
|
echo '<h4><b><u>Suspicious files in /tmp:</h4></b></u>';
|
|
echo '<br><pre>';
|
|
system("ls -al /tmp/ | grep `whoami` | grep -v sess_");
|
|
}
|
|
|
|
|
|
// check broken symlinks
|
|
function symcheck() {
|
|
echo '</pre></p><p>';
|
|
echo 'Broken symlinks:';
|
|
echo '<br><pre>';
|
|
system("for i in `find ../ -type l`; do [ -e $i ] || echo $i is broken; done");
|
|
}
|
|
|
|
// Searching for malicious php shells
|
|
function infection(){
|
|
echo '</pre></p><p>';
|
|
echo 'Let`s find if there is a malicious base64 infection:<br />';
|
|
|
|
function parse_dir( $dir ) {
|
|
global $shell_definitions;
|
|
global $generic;
|
|
global $settings;
|
|
|
|
$dh = dir( $dir );
|
|
|
|
while( $entry = $dh -> read( ) )
|
|
{
|
|
if( $entry == '.' ||
|
|
$entry == '..' ||
|
|
@filesize( $dir . '/' . $entry ) > $settings[ 'SIZE_LIMIT' ] ||
|
|
$entry === basename( $_SERVER[ 'PHP_SELF' ] ) )
|
|
continue;
|
|
|
|
if( @is_dir( $dir . '/' . $entry ) )
|
|
$dirs[] = $dir . '/' . $entry;
|
|
|
|
if( @filesize( $dir . '/' . $entry ) > 0 )
|
|
{
|
|
$h = fopen( $dir . '/' . $entry, 'r' );
|
|
$cnt = fread( $h, @filesize( $dir . '/' . $entry ) );
|
|
fclose( $h );
|
|
|
|
if( $settings[ 'USE_DEFINITIONS' ] )
|
|
{
|
|
for( $i = 0; $i < count( $shell_definitions ); $i++ )
|
|
{
|
|
foreach( $shell_definitions[ $i ] as $key => $el )
|
|
{
|
|
if( $key == 'id' )
|
|
{
|
|
$id = $el;
|
|
continue;
|
|
}
|
|
if( strpos( strtolower( $cnt ), strtolower( base64_decode( $el ) ) ) !== FALSE )
|
|
{
|
|
$site = $dir . '/' . $entry;
|
|
@$shfound .= '<br />Probabile shell [' . $id . ']: <b> <a href='.$site.' target="_blank">' . $dir . '/' . $entry .
|
|
'</a></b><br />';
|
|
$end = true;
|
|
break;
|
|
}
|
|
}
|
|
if( @$end )
|
|
{
|
|
$end = false;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
else
|
|
if( strpos( strtolower( $cnt ), $generic ) !== FALSE )
|
|
$shfound .= 'Probabile shell [generica]: <b>' . $dir . '/' . $entry . '</b><br />';
|
|
}
|
|
}
|
|
$dh -> close( );
|
|
|
|
if( strlen( @$shfound ) > 0 )
|
|
{
|
|
echo '<b>Directory: ' .$dir . '</b>';
|
|
echo $shfound;
|
|
}
|
|
|
|
if( count( @$dirs ) <= 0 ) return;
|
|
|
|
foreach( $dirs as $dir )
|
|
parse_dir( $dir );
|
|
}
|
|
}
|
|
|
|
if (isset($_GET['run'])) $linkchoice=$_GET['run'];
|
|
else $linkchoice='';
|
|
|
|
switch($linkchoice){
|
|
|
|
case 'removezero' :
|
|
removezero();
|
|
break;
|
|
|
|
case 'findchmod' :
|
|
findchmod();
|
|
break;
|
|
|
|
case 'optim' :
|
|
optim();
|
|
break;
|
|
|
|
case 'addsec' :
|
|
addsec();
|
|
break;
|
|
|
|
case 'getcleaner' :
|
|
getcleaner();
|
|
break;
|
|
|
|
case 'tmpcheck' :
|
|
tmpcheck();
|
|
break;
|
|
|
|
case 'prefix' :
|
|
prefix();
|
|
break;
|
|
|
|
case 'symcheck' :
|
|
symcheck();
|
|
break;
|
|
|
|
case 'infection' :
|
|
infection();
|
|
break;
|
|
|
|
case 'pwds' :
|
|
pwds();
|
|
break;
|
|
|
|
case 'mailing' :
|
|
mailing();
|
|
break;
|
|
|
|
case 'mysqlsearch' :
|
|
mysqlsearch();
|
|
break;
|
|
|
|
case 'remove' :
|
|
remove();
|
|
break;
|
|
|
|
case 'clean' :
|
|
clean();
|
|
break;
|
|
|
|
case 'loop' :
|
|
loop();
|
|
break;
|
|
|
|
case 'otherinfect' :
|
|
otherinfect();
|
|
break;
|
|
|
|
case 'hta' :
|
|
hta();
|
|
break;
|
|
|
|
case 'version' :
|
|
version();
|
|
break;
|
|
|
|
case 'checkexif' :
|
|
checkexif();
|
|
break;
|
|
|
|
case 'transfer' :
|
|
transfer();
|
|
break;
|
|
|
|
case 'cleanexif' :
|
|
cleanexif();
|
|
break;
|
|
|
|
case 'custom' :
|
|
custom();
|
|
break;
|
|
|
|
case 'iframe' :
|
|
iframe();
|
|
break;
|
|
|
|
case 'lastfiles' :
|
|
lastfiles();
|
|
break;
|
|
|
|
case 'execcmd' :
|
|
execcmd();
|
|
break;
|
|
|
|
case 'mysqlpwd' :
|
|
mysqlpwd();
|
|
break;
|
|
|
|
case 'findbackups' :
|
|
findbackups();
|
|
break;
|
|
|
|
case 'findlarge' :
|
|
findlarge();
|
|
break;
|
|
|
|
case 'findsql' :
|
|
findsql();
|
|
break;
|
|
|
|
case 'findsymlinks' :
|
|
findsymlinks();
|
|
break;
|
|
|
|
case 'zencart' :
|
|
zencart();
|
|
break;
|
|
|
|
case 'getsize' :
|
|
getsize();
|
|
break;
|
|
|
|
case 'repl' :
|
|
repl();
|
|
break;
|
|
|
|
case 'fixperms' :
|
|
fixperms();
|
|
break;
|
|
|
|
case 'checklarge' :
|
|
checklarge();
|
|
break;
|
|
|
|
case 'processlist' :
|
|
processlist();
|
|
break;
|
|
|
|
case 'scanme' :
|
|
scanme();
|
|
break;
|
|
|
|
case 'cleanPHP' :
|
|
cleanPHP();
|
|
break;
|
|
|
|
case 'securetemps' :
|
|
securetemps();
|
|
break;
|
|
|
|
case 'cleanPL' :
|
|
cleanPL();
|
|
break;
|
|
|
|
case 'insecplug' :
|
|
insecplug();
|
|
break;
|
|
|
|
case 'reshog' :
|
|
reshog();
|
|
break;
|
|
|
|
case 'findbot' :
|
|
findbot();
|
|
break;
|
|
|
|
case 'cleangravity' :
|
|
cleangravity();
|
|
break;
|
|
|
|
case 'cleanupl' :
|
|
cleanupl();
|
|
break;
|
|
|
|
default :
|
|
norun();
|
|
echo 'no function chosen. please pick a function from the menu above';
|
|
|
|
}
|
|
|
|
$settings = array (
|
|
'BASE_DIR' => $GLOBALS["webroot"],
|
|
'USE_DEFINITIONS' => true,
|
|
'SIZE_LIMIT' => ( 1024 * 1024 ) //size limit set to 1mb
|
|
);
|
|
|
|
$shell_definitions = array (
|
|
array( 'id' => 'Database', 'def1' => 'cGhwTXlBZG1pbiBTUUwgRHVtcA==', 'def2' => 'cGhwQkIgQmFja3VwIFNjcmlwdA==', 'def3' => 'VkFMVUVTKCIxIiwi' ),
|
|
array( 'id' => 'Ciro1992Shell', 'def1' =>
|
|
'JHRleHRbMV0gPSAifCBTYWZlIG1vZGUgPSAiOw0KJHRleHRbMl0gPSAiT24iOw0KJHRleHRbM10gPSAiT2ZmIjsNCiR0ZXh0WzRdID0gIk1hZ2ljcyBRdW90ZXMgPSAiOw0KJHRleHRbNV0gPSAiIHwgIjsNCiR0ZXh0WzZdID0gIk15U3FsID0gIjsNCiR0ZXh0WzddID0gIkhkZCBMaWJlcm8gOiAi',
|
|
'def2' => 'JHRleHRbMzZdID0gIi46Oi4gUG93ZXJlZCBieSBDaXJvMTk5MiAtIEJsYWNrIE1pbGl0aWEgVGVhbQ==' ),
|
|
array( 'id' => 'Ka_uShell', 'def1' => 'PHRpdGxlPktBX3VTaGVsbCAwLjEuNjwvdGl0bGU+', 'def2' =>
|
|
'Ly8gTWVudQ0KZWNobyAiDQp8PGEgaHJlZj0kc2VsZj9hYz1zaGVsbD5TaGVsbDwvYT58DQp8PGEgaHJlZj0kc2VsZj9hYz11cGxvYWQ+RmlsZSBVcGxvYWQ8L2E+fA0KfDxhIGhyZWY9JHNlbGY/YWM9dG9vbHM+VG9vbHM8L2E+fA0KfDxhIGhyZWY9JHNlbGY/YWM9ZXZhbD5QSFAgRXZhbCBDb2RlPC9hPnwNCnw8YSBocmVmPSRzZWxmP2FjPXdob2lzPldob2lzPC9hPnwNCjxicj48YnI+PGJyPjxwcmU+Ijs='
|
|
),
|
|
array( 'id' => 'DxShell', 'def1' => 'aWYgKGhlYWRlcnNfc2VudCgpKSAkRFhHTE9CQUxTSElUPXRydWU7IGVsc2UgJERYR0xPQkFMU0hJVD1GQUxTRTs=', 'def2' =>
|
|
'aWYgKCEoJGRpcl9wdHI9b3BlbmRpcigkX0dFVFsnZHhkaXInXSkpKSBkaWUoRHhFcnJvcignVW5hYmxlIHRvIG9wZW4gZGlyIGZvciByZWFkaW5nLiBQZXJtcz8uLi4nKSk7' ),
|
|
array( 'id' => 'Crystal', 'def1' =>
|
|
'aWYgKCRhY3QgPT0gImFib3V0Iikge2VjaG8gIjxjZW50ZXI+PGI+Q29kaW5nIGJ5Ojxicj48YnI+U3VwZXItQ3J5c3RhbDxicj4mPGJyPk1vaGFqZXIyMjxicj4tLS0tLTxicj5UaGFua3MgPGJyPlRyWWFHIFRlYW0gPGJyPiBBcmFiU2VjdXJpdHlDZW50ZXIgVGVhbSA8YnI+Q1JZU1RBTC1IIFZlcnNpb246MCBCZXRhIHBocHNoZWxsIGNvZGU8YnI+U2F1ZGkgQXJhYmljICA8L2E+LjwvYj4iO30=',
|
|
'def2' => 'aWYoZW1wdHkoJF9QT1NUWydNb2hhamVyMjInXSkpew==' ),
|
|
array( 'id' => 'Antichat', 'def1' => 'PHRkPjxhIGhyZWY9IiMiIG9uY2xpY2s9ImRvY3VtZW50LnJlcXMuYWN0aW9uLnZhbHVlPSdzaGVsbCc7IGRvY3VtZW50LnJlcXMuc3VibWl0KCk7Ij58IFNoZWxsIDwvYT48L3RkPg==',
|
|
'def2' =>
|
|
'PHRhYmxlIHN0eWxlPSJCT1JERVItQ09MTEFQU0U6IGNvbGxhcHNlIiBjZWxsU3BhY2luZz0wIGJvcmRlckNvbG9yRGFyaz0jNjY2NjY2IGNlbGxQYWRkaW5nPTUgd2lkdGg9IjEwMCUiIGJnQ29sb3I9IzMzMzMzMyBib3JkZXJDb2xvckxpZ2h0PSNjMGMwYzAgYm9yZGVyPTE+'
|
|
),
|
|
array( 'id' => 'Arabic', 'def1' => 'dHJ5YWcucGhwIC0gaHR0cDovL3dXdy50cnlhZy5jT20=', 'def2' => 'ZXhpdCgiPGI+PGEgaHJlZj1odHRwOi8vd1d3LnRyeWFnLmNPbT50cnlhZy10ZWFtPC9hPg==' ),
|
|
array( 'id' => 'ZipShell', 'def1' => 'WmlwU2hlbGwgVjEuMSBQcml2YXRlIEVkaXRvbiBbR1JFWS1IQVQtSEFDS0lOR10=', 'def2' =>
|
|
'JHRoaXMtPl9fZXJyb3IoJ2NyZWF0aW9uJywnVW5rbm93biBtZXRob2Q6IDx1PicuJHR5cGUuJzwvdT4uIFVzZSBjb25zdGFudHMgPGI+U1pJUF9EVU1QPC9iPiBvcg==' ),
|
|
array( 'id' => 's101', 'def1' => 'ZWNobyAiRWxlbmNvIGNhbXBpIHByZXNlbnRpIG5lbGxhIFRhYmVsbGE6PGI+ICR0YWI8L2I+IDxicj4iOw==', 'def2' => 'czEwMSBJbnRlcmFtZW50ZSBjcmVhdGEgZGEgU29yYTEwMQ=='
|
|
),
|
|
array( 'id' => '0-Day_Script', 'def1' => 'PGhlYWQ+PHRpdGxlPlBvd2VyZWQgQnkgI1NjYW4tWDwvdGl0bGU+PC9oZWFkPg==', 'def2' =>
|
|
'PGhlYUJ5IFRoaXMgc2NyaXB0IHlvdSBjYW4ganVtcCBpbiB0aGUgKFNhZmUgTW9kZT1PTik=' ),
|
|
array( 'id' => 'nefastica', 'def1' => 'TjNmYTV0MWNBIFNoM2xs', 'def2' => 'ZnVuY3Rpb24gaXNfb3duZXIoKXsNCiRjb29raWUgPSAkX0NPT0tJRVsnY29va2llX25hbWUnXTs=' ),
|
|
array( 'id' => 'k0tw', 'def1' => 'UDBzdCBNM3RoMGQgcDB3NGgh', 'def2' => 'ISEtIFdoMTczIGg0NyByMHggLSEh', 'def3' => 'azB0dyBzaDNsbCBieSBLaU5nT2ZUaEV3T3JMZA==' ),
|
|
array( 'id' => 'dc3', 'def1' => 'U2hlbGwgd3JpdHRlbiBieSBCbDBvZDNy', 'def2' =>
|
|
'IlIwbEdPRGxoRkFBVUFMTUlBQUQvQUFDQUFJQUFBTURBd0g5L2YvOEFBUC8vL3dBQUFQLy8vd0FBQUFBQUFBQUFBQUFBQUFBQUFBQUEiLiANCiJBQUFBQUNINUJBRUFBQWdBTEFBQUFBQVVBQlFBQUFST0VNbEpxNzA0VXlHT3ZrTGhmVlU0a3BPSlNweDVuRjlZaUN0TGYwU3VIN3B1Ii4gDQoiRVlPZ2NCZ2t3QWlHcEhLWnpCMkp4QURBU1FGQ2lkUUpzTWZkR3FzREpuT1FsWFRQMzhwcnpXYlgzcWdJQURzPSIsIA0KImV4dF93cmkiPT4gDQoiUjBsR09EbGhFQUFRQURNQUFDSDVCQUVBQUFnQUxBQUFBQUFRQUJBQWcvLy8vd0FBQUlDQWdNREF3SUNBQUFBQWdBQUEvLy8vQUFBQSIuIA0KIkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQVJSVU1oSmtiMEM2SzJIdUVpUmNkc0FmS0V4a2tEZ0JvVnhzdHdBQXlwZHVvYW8iLiANCiJhNFNYVDBjNEJGMHJVaEZBRUFRUUk5ZG1lYlJFVzh5WEM2TngyUUk3THJZYnRwSlpOc3hnelc2bkxkcTQ5aElCQURzPSIsIA0KInNtYWxsX2RpciI9Pg=='
|
|
),
|
|
array( 'id' => 'Backdoor', 'def1' => 'PGEgaHJlZj0iPD9waHAgZWNobyAkX1NFUlZFUlsnUEhQX1NFTEYnXTsgPz4/ZGlyPSI+', 'def2' => 'c2lyaXVzX2JsYWNr' ),
|
|
array( 'id' => 'n3tShell', 'def1' => 'TjN0c2hleGl0KCk7', 'def2' => 'RW1wM3JvciBVbmRldGVjdGFibGU=' ),
|
|
array( 'id' => 'Nexen', 'def1' => 'TmV4cGwwcmVyIFNoZWxs', 'def2' => 'aWYgKCRfUE9TVFsnbW9kZSddID09ICJ1cGxvYWR6Iikgew==' ),
|
|
array( 'id' => '33rd', 'def1' => 'MzNyZCBTaGVsbA==', 'def2' => 'Ynk6Z3IzM24=' ),
|
|
array( 'id' => 'c99', 'def1' => 'Yzk5c2g=', 'def2' => 'T0RoVDJDOU43YkJmYm5uRE50bXYwVURsdjVZRDltdmFHWEk4WFl4bg==' ),
|
|
array( 'id' => 'r57-2', 'def1' => 'TUFYNjY2QGlyYW5zdGFycy5jb20=', 'def2' =>
|
|
'QXsgdGV4dC1kZWNvcmF0aW9uOm5vbmU7IGNvbG9yOm5hdnk7IGZvbnQtc2l6ZTogMTJweCB9DQoNCiAgICBib2R5IHsgZm9udC1zaXplOiAxMnB4OyANCg0KICAgICAgICAgICBmb250LWZhbWlseTogYXJpYWwsIGhlbHZldGljYTsNCg0KICAgICAgICAgICAgc2Nyb2xsYmFyLXdpZHRoOiA1Ow0KDQogICAgICAgICAgICBzY3JvbGxiYXItaGVpZ2h0OiA1Ow0KDQogICAgICAgICAgICBzY3JvbGxiYXItZmFjZS1jb2xvcjogd2hpdGU7DQoNCiAgICAgICAgICAgIHNjcm9sbGJhci1zaGFkb3ctY29sb3I6IHNpbHZlcjsNCg0KICAgICAgICAgICAgc2Nyb2xsYmFyLWhpZ2hsaWdodC1jb2xvcjogd2hpdGU7DQoNCiAgICAgICAgICAgIHNjcm9sbGJhci0zZGxpZ2h0LWNvbG9yOnNpbHZlcjsNCg0KICAgICAgICAgICAgc2Nyb2xsYmFyLWRhcmtzaGFkb3ctY29sb3I6IHNpbHZlcjsNCg0KICAgICAgICAgICAgc2Nyb2xsYmFyLXRyYWNrLWNvbG9yOiB3aGl0ZTsNCg0KICAgICAgICAgICAgc2Nyb2xsYmFyLWFycm93LWNvbG9yOiBibGFjazsNCg0KICAgIH0='
|
|
),
|
|
array( 'id' => 'Uploader', 'def1' => 'JF9GSUxFU1snbWlvZmlsZSddWyd0bXBfbmFtZSddOw==', 'def2' => 'aWYgKG1vdmVfdXBsb2FkZWRfZmlsZSg=' ),
|
|
array( 'id' => 'Cod3rz', 'def1' =>
|
|
'PHRkPjxiPkZpbGUgTmFtZTo8L2I+PC90ZD48dGQ+PGI+VHlwZTo8L2I+PC90ZD48dGQgd2lkdGg9MTUlPjxiPlNpemU6PC9iPjwvdGQ+PHRkIHdpZHRoPTEwJT48Yj5QZXJtczo8L2I+PC90ZD4kbGlzdGY8L2ZvbnQ+', 'def2' =>
|
|
'RGV2aWxzIE5pZ2h0IENyZXc=', 'def3' => 'LSBDb2Qzcno8L3RpdGxlPg==' ),
|
|
array( 'id' => 'r57', 'def1' => 'cjU3c2g=', 'def2' => 'SXlFdmRYTnlMMkpwYmk5d1pYSnNEUXAxYzJVZw==' ),
|
|
array( 'id' => 'Fire-Crash', 'def1' => 'PHRpdGxlPkZpUmUtQ3JBc0g8L3RpdGxlPg==', 'def2' =>
|
|
'JGRpciA9ICIuIjsNCiRvcGVuID0gb3BlbmRpcigkZGlyKTsNCiRyZWFkID0gcmVhZGRpcigkb3Blbik7DQplY2hvICJMaXN0IEZpbGVzOiA8YnI+PGJyIjsNCndoaWxlICgkcmVhZCA9IHJlYWRkaXIoJG9wZW4pKQ0Kew0KZWNobyAiPGEgaHJlZj0kcmVhZD4kcmVhZDwvYT48YnI+Ijs='
|
|
),
|
|
array( 'id' => 'Root Shell', 'def1' => 'Um9vdFNo', 'def2' => 'PHA+PGZvbnQgZmFjZT0iV2ViZGluZ3MiIHNpemU9IjYiIGNvbG9yPSIjMDBGRjAwIj4hPC9mb250Pjxicj4=' ),
|
|
array( 'id' => 'Fatal_Shell', 'def1' => 'RmFUYUwgU2hlbGw=', 'def2' => 'RmFUYUxTaGVMTA==' ),
|
|
array( 'id' => 'KA-uShell', 'def1' => 'S0FfdVNoZWxs', 'def2' => 'QXV0aG9yOiBLQWRvdA==' ),
|
|
array( 'id' => 'GFS Shell', 'def1' => 'R0ZTIFdlYi1TaGVsbA==', 'def2' => 'STJsdVkyeDFaR1VnUEhOMFpHbHZMbWcrRFFvamFXNWpiSFZrWlNBOGMzUnlhVzVuTG1nK0RRb2phVzVqYkhWa1o=', 'def3' =>
|
|
'WENJN0RRb05Dbk4xWWlCd2NtVm1hWGdnZXcwS0lHMTVJQ1J1YjNjZ1BTQnNiMk5oYkhScGI=' ),
|
|
array( 'id' => 'Defacing Tool Pro', 'def1' => 'cjN2M25nNG5zIDpQ', 'def2' => 'RFRvb2wgUHJv' ),
|
|
array( 'id' => 'Private Arabic Shell', 'def1' => 'aHR0cDovL3dXdy50cnlhZy5jT20=', 'def2' => 'dHJ5YWdAdHJ5YWcuY29t', 'def3' => '0JfQsdCe0L3Ql9Ch0JfQmg==' ),
|
|
array( 'id' => 'Bk-Code Shell', 'def1' => 'QmstQ29kZSBzaGVsbA==', 'def2' => 'QXJhYi1TZWNyZXRzLVRlYW0=' ),
|
|
array( 'id' => 'SnIpEr_SA Shell', 'def1' => 'U25JcEVyX1NB', 'def2' => 'M2FzZmgubmU=' ),
|
|
array( 'id' => 'Fileman', 'def1' => 'RmlsM21hbg==' ),
|
|
array( 'id' => 'Ajax/PHP Command Shell', 'def1' => 'PGJyPg0KPGI+PGZvbnQgc2l6ZT0zPkFqYXgvUEhQIENvbW1hbmQgU2hlbGw8L2I+PC9mb250Pjxicj5ieSBJcm9uZmlzdA0KPGJyPg0K', 'def2' =>
|
|
'ICAgIGFqYXhSZXF1ZXN0Lm9ucmVhZHlzdGF0ZWNoYW5nZSA9IGZ1bmN0aW9uKCl7DQogICAgICAgIGlmKGFqYXhSZXF1ZXN0LnJlYWR5U3RhdGUgPT0gNCl7DQogICAgICAgIG91dHB1dGNtZCA9ICI8cHJlPiIgICsgb3V0cHV0Y21kICsgYWpheFJlcXVlc3QucmVzcG9uc2VUZXh0ICsiPC9wcmU+IjsNCg0K'
|
|
),
|
|
array( 'id' => 'Anti Chat', 'def1' => 'JHBhc3N3b3JkPSdyMDB0JzsNCiRhdXRoPTE7DQokdmVyc2lvbj0ndmVyc2lvbiAxLjMgYnkgR3JpbmF5JzsNCg0KDQo=', 'def2' =>
|
|
'ZWNobyAiPC90YWJsZT4iOw0KfX19DQoNCmlmKCRhY3Rpb249PSJ2aWV3ZXIiKXsNCnNjYW5kaXJlKCRkaXIpOw0KfQ0KLy9lbmQgdmlld2VyIEZTDQoNCg0KDQo=' ),
|
|
array( 'id' => 'Ayyildiz Tim | AYT | Shell v 2.1 Biz', 'def1' =>
|
|
'PHRpdGxlPkhBQ0tFRCBCWSBBWVlJTERJWiCZPC90aXRsZT4NCjxTVFlMRSBUWVBFPSJ0ZXh0L2NzcyI+DQo8IS0tDQoNCmJvZHkgeyANCnNjcm9sbGJhci0zZC1saWdodC1jb2xvciA6ICM0MDQwNDA7DQoNCg0KDQo=', 'def2' =>
|
|
'PGNlbnRlcj48Zm9udCBjb2xvcj0icmVkIiBzaXplPSIxMCIgZmFjZT0iSW1wcmludCBNVCBTaGFkb3ciPg0KIDwvZm9udD4NCg==' ),
|
|
array( 'id' => 'azrail 1.0 by C-W-M', 'def1' =>
|
|
'aWYgKCRvcD09J3BocGluZm8nKXsNCiRmb25rX2thcCA9IGdldF9jZmdfdmFyKCJmb25rc2l5b25sYXL9X2thcGF0Iik7DQogICAgICAgIGVjaG8gJHBocGluZm89KCFlcmVnaSgicGhwaW5mbyIsJGZvbmtfa2FwYXQpKSA/IHBocGluZm8oKSA6ICI8Y2VudGVyPnBocGluZm8oKSBLb211dHUgx2Fs/f5t/XlpaWk8L2NlbnRlcj4iOw0KICAgICAgICBleGl0Ow0KfQ0K',
|
|
'def2' => 'ICAgICAgPGhlYWQ+DQogICAgICAgICAgICAgPHRpdGxlPmF6cmFpbCAxLjAgYnkgQy1XLU08L3RpdGxlPg0KICAgICAgPC9oZWFkPg0KDQo=' ),
|
|
array( 'id' => 'Ajax/PHP Command Shell', 'def1' => 'PGJyPg0KPGI+PGZvbnQgc2l6ZT0zPkFqYXgvUEhQIENvbW1hbmQgU2hlbGw8L2I+PC9mb250Pjxicj5ieSBJcm9uZmlzdA0KPGJyPg0K', 'def2' =>
|
|
'ICAgIGFqYXhSZXF1ZXN0Lm9ucmVhZHlzdGF0ZWNoYW5nZSA9IGZ1bmN0aW9uKCl7DQogICAgICAgIGlmKGFqYXhSZXF1ZXN0LnJlYWR5U3RhdGUgPT0gNCl7DQogICAgICAgIG91dHB1dGNtZCA9ICI8cHJlPiIgICsgb3V0cHV0Y21kICsgYWpheFJlcXVlc3QucmVzcG9uc2VUZXh0ICsiPC9wcmU+IjsNCg0K'
|
|
),
|
|
array( 'id' => 'Backup script on server', 'def1' =>
|
|
'JGZ0cGNvbm5lY3QgPSAibmNmdHBwdXQgLXUgJGZ0cF91c2VyX25hbWUgLXAgJGZ0cF91c2VyX3Bhc3MgLWQgZGVic2VuZGVyX2Z0cGxvZy5sb2cgLWUgZGJzZW5kZXJfZnRwbG9nMi5sb2cgLWEgLUUgLVYgJGZ0cF9zZXJ2ZXIgJGZ0cF9wYXRoICRmaWxlbmFtZTIiOw0Kc2hlbGxfZXhlYygkZnRwY29ubmVjdCk7DQo=',
|
|
'def2' =>
|
|
'JG1lc3NhZ2UgPSAiVGhpcyBpcyBhIG11bHRpLXBhcnQgbWVzc2FnZSBpbiBNSU1FIGZvcm1hdC5cblxuIi4iLS17JG1pbWVfYm91bmRhcnl9XG4iIC4iQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluOyBjaGFyc2V0PVwiaXNvLTg4NTktMVwiXG4iIC4iQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzogN2JpdFxuXG4iIC4='
|
|
),
|
|
array( 'id' => 'rgod shell', 'def1' => 'ZUp6c3ZXMlBxa3IzTi9oK2t2a084KzUvSi85a0FxaDliWk5KSm8wQ2lvSk5RUlZTYnlZb25rWXBsTjF0Ky9UcFo2MnF3c2JkdmEvSGM5K1pTVQ==', 'def2' =>
|
|
'LS0gRG8gbm90IERpc3RpYnV0ZSBUaGlzIHNoZWxsDQotLSBEbyBub3QgU2VsbCBUaGlzIHNoZWxsDQotLSBEbyBub3QgZ2l2ZSBpdCBldmVuIHRvIHlvdXIgbW90aGVyDQotLSBieSByZ29kIA==' ),
|
|
array( 'id' => 'Symlink User Bypass', 'def1' =>
|
|
'PGZvcm0gc3R5bGU9ImJvcmRlcjogNHB4IHJpZGdlICNGRkZGRkYiPg0KPHAgYWxpZ249ImNlbnRlciIgZGlyPSJydGwiPjxmb250IGNvbG9yPSIjRkYwMDAwIj48c3BhbiBsYW5nPSJhci1zYSI+PGI+DQombmJzcDsgLT1bU3ltbGluayBUb29scyB0byBieXBhc3MgdXNlcl1WLjMgPS0NCjwvYj4NCg==',
|
|
'def2' =>
|
|
'ICA8Zm9udCBjb2xvcj0iI0ZGRkZGRiI+by0tLVs8L2ZvbnQ+IDxmb250IGNvbG9yPSIjRkYwMDAwIj5EZXZlbG9wZXIgYnkgU25JcEVyX1NBCSBTeW1saW5rIFVzZXIgQnlwYXNzIDwvZm9udD4gPGZvbnQgY29sb3I9IiNGRkZGRkYiPnw8L2ZvbnQ+IDxhIGhyZWY9aHR0cDovL3NuaXBlci1zYS5jb20+aHR0cDovL3NuaXBlci1zYS5jb208L2E+DQogIDxmb250IGNvbG9yPSIjRkZGRkZGIj58PC9mb250PiA8Zm9udCBjb2xvcj0iI0ZGMDAwMCI+DQo='
|
|
),
|
|
array( 'id' => 'C100 Yarakam Modified Shell', 'def1' =>
|
|
'aWYgKCFlbXB0eSgkdW5zZXRfc3VybCkpIHtzZXRjb29raWUoImsxcjRfc3VybCIpOyAkc3VybCA9ICIiO30NCmVsc2VpZiAoIWVtcHR5KCRzZXRfc3VybCkpIHskc3VybCA9ICRzZXRfc3VybDsgc2V0Y29va2llKCJrMXI0X3N1cmwiLCRzdXJsKTt9DQplbHNlIHskc3VybCA9ICRfUkVRVUVTVFsiazFyNF9zdXJsIl07IC8vU2V0IHRoaXMgY29va2llIGZvciBtYW51YWwgU1VSTA0KfQ0KDQo=',
|
|
'def2' => 'aWYgKCRzdXJsX2F1dG9maWxsX2luY2x1ZGUgYW5kICEkX1JFUVVFU1RbImsxcjRfc3VybCJdKSANCg0KDQo=' ),
|
|
array( 'id' => 'c99shell v. 1.0 pre-release build', 'def1' => 'Zi8vSzhvbytJeUgwejNpOHNwWEdEblpDVW5uWFQ=', 'def2' =>
|
|
'bEpmY3U3bUIydkJuSURHTkZGRnpEbVROdzNtSU9aWlB2MndHakRzZ2cyWHFHYk90L2ROc2xILysvLys5ZS8vS1k2ays2ZA0K' ),
|
|
array( 'id' => 'N3tShell Emp3ror Undetectable (C99)', 'def1' =>
|
|
'JHNhZmVtb2RlX2Rpc2tldHRlcyA9IGFycmF5KCJhIik7IC8vIFRoaXMgdmFyaWFibGUgZm9yIGRpc2FibGluZyBkaXNrZXR0LWVycm9ycy4NCiAvLyBhcnJheSAoaT0+e2xldHRlcn0gLi4uKTsgc3RyaW5nIHtsZXR0ZXJ9IC0gbGV0dGVyIG9mIGEgZHJpdmUNCi8vJHNhZmVtb2RlX2Rpc2tldHRlcyA9IHJhbmdlKCJhIiwieiIpOw0KJGhleGR1bXBfbGluZXMgPSA4Oy8vIGxpbmVzIGluIGhleCBwcmV2aWV3IGZpbGUNCiRoZXhkdW1wX3Jvd3MgPSAyNDsvLyAxNiwgMjQgb3IgMzIgYnl0ZXMgaW4gb25lIGxpbmUNCg=='
|
|
),
|
|
array( 'id' => 'C99 Saldiri.org version', 'def1' => 'aWYgKCFmdW5jdGlvbl9leGlzdHMoImsxcjRfYnVmZl9wcmVwYXJlIikpDQp7DQpmdW5jdGlvbiBrMXI0X2J1ZmZfcHJlcGFyZSgpDQo='),
|
|
array( 'id' => 'CGI Telnet', 'def1' => 'c3ViIFJlYWRQYXJzZQ0Kew0KICAgICAgICBsb2NhbCAoKmluKSA9IEBfIGlmIEBfOw0KICAgICAgICBsb2NhbCAoJGksICRsb2MsICRrZXksICR2YWwpOw0KDQoNCg=='),
|
|
array( 'id' => 'CTT Shell', 'def1' =>
|
|
'aWYgKCRhY3QgPT0gImZ0cHF1aWNrYnJ1dGUiKQ0Kew0KIGVjaG8gIjxiPkZ0cCBRdWljayBicnV0ZTo8L2I+PGJyPiI7DQogaWYgKCR3aW4pIHtlY2hvICJUaGlzIGZ1bmN0aW9ucyBub3Qgd29yayBpbiBXaW5kb3dzITxicj48YnI+Ijt9DQogZWxzZQ0KIHsNCiAgZnVuY3Rpb24gY3RmdHBicnV0ZWNoZWNrKCRob3N0LCRwb3J0LCR0aW1lb3V0LCRsb2dpbiwkcGFzcywkc2gsJGZxYl9vbmx5d2l0aHNoKQ0KICB7DQppZiAoJGZxYl9vbmx5d2l0aHNoKQ0KDQo='),
|
|
array( 'id' => 'Cyber Shell', 'def1' =>
|
|
'PGNlbnRlcj4uOkN5YmVyIFNoZWxsICh2IDEuMCk6Ljxicj5Db3B5cmlnaHQgqSA8YSBocmVmPSJodHRwOi8vd3d3LmN5YmVybG9yZHMubmV0IiB0YXJnZXQ9Il9ibGFuayI+Q3liZXIgTG9yZHMgQ29tbXVuaXR5PC9hPiwgMjAwMi0yMDA2PC9jZW50ZXI+'),
|
|
array( 'id' => 'Dive Shell', 'def1' => 'LypFbXBlcm9yIEhhY2tpbmcgVEVBTSAqLw0KICBzZXNzaW9uX3N0YXJ0KCk7DQo='),
|
|
array( 'id' => 'DTool Pro Shell', 'def1' =>
|
|
'aWYoaXNzZXQoJGNoZGlyKSkgQGNoZGlyKCRjaGRpcik7DQpmdW5jdGlvbiBzYWZlbW9kZSgkd2hhdCl7ZWNobyAiVGhpcyBzZXJ2ZXIgaXMgaW4gc2FmZW1vZGUuIFRyeSB0byB1c2UgRFRvb2wgaW4gU2FmZW1vZGUuIjt9DQo='),
|
|
array( 'id' => 'Erne Safe Mode Bypass Shell', 'def1' =>
|
|
'PHRyPjx0ZD48Y2VudGVyPjxmb250IHNpemU9IjQiIGNvbG9yPSIjRkZGRkZGIj48c3BhbiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjogIzAwMDAwMCI+RXJOZSBTYWZlIE1vZGUgQnlwYXNzIEZvciBCaXlvU2VjdXJpdHkuTmV0PC9zcGFuPg0K'),
|
|
array( 'id' => 'GFS Shell', 'def1' => 'R0ZTIFdlYi1TaGVsbA0KKi8NCmVycm9yX3JlcG9ydGluZygwKTsNCmlmKCRfUE9TVFsnYl9kb3duJ10pew0K'),
|
|
array( 'id' => 'GNY Shell', 'def1' =>
|
|
'Ly93NGNrMW5nIFNoZWxsDQppZiAoIWZ1bmN0aW9uX2V4aXN0cygnbXlzaGVsbGV4ZWMnKSkNCnsNCmlmKGlzX2NhbGxhYmxlKCdwb3BlbicpKXsNCmZ1bmN0aW9uIG15c2hlbGxleGVjKCRjb21tYW5kKSB7DQoNCg=='),
|
|
array( 'id' => 'H4NTU Shell', 'def1' =>
|
|
'PD9waHANCmVjaG8gIjxwPjxmb250IHNpemU9MiBmYWNlPVZlcmRhbmE+PGI+VGhpcyBJcyBUaGUgU2VydmVyIEluZm9ybWF0aW9uPC9iPjwvZm9udD48L3A+IjsNCj8+DQoNCg0KDQo='),
|
|
array( 'id' => 'Heykir Shell', 'def1' =>
|
|
'ICRjb2Rlcj0iVGhlX0JlS2lSICAmICBUaVQgICYgUnVzbGFuICI7DQogJHN0cmluZyA9ICFlbXB0eSgkX1BPU1RbJ3N0cmluZyddKSA/ICRfUE9TVFsnc3RyaW5nJ10gOiAwOw0KICRzd2l0Y2ggPSAhZW1wdHkoJF9QT1NUWydzd2l0Y2gnXSkgPyAkX1BPU1RbJ3N3aXRjaCddIDogMDsNCg=='),
|
|
array( 'id' => 'iMHaP FTP Shell', 'def1' =>
|
|
'PEJPRFk+PElNRyBzdHlsZT0iV0lEVEg6IDMwNnB4OyBIRUlHSFQ6IDc2cHgiIGhlaWdodD0xMDAgDQpzcmM9Imh0dHA6Ly93d3cubmV0dGVraWFkcmVzLmNvbS9pbWhhYmlybGlnaS5qcGciIHdpZHRoPTI4Mj48L0JPRFk+DQo8YnI+PENlbnRlcj5TVSBBTiA8QSBocmVmPSJodHRwOi8vd3d3LmltaGFiaXJsaWdpLmNvbSI+aU1IYUJpUkxpR2k8L0E+IEhVRFVUTEFSSU5EQSBCVUxVTk1BS1RBU0lOSVouISE8L0NlbnRlcj4NCg0K'),
|
|
array( 'id' => 'Iron Shell', 'def1' =>
|
|
'cHJpbnQgIjxmb3JtIGFjdGlvbj1cIiIuJG1lLiI/cD1ldmFsXCIgbWV0aG9kPVBPU1Q+DQoNCgkJCQk8dGV4dGFyZWEgY29scz02MCByb3dzPTEwIG5hbWU9XCJldmFsXCI+IjsNCg0KCQkJCWlmKGlzc2V0KCRfUE9TVFsnZXZhbCddKSkNCg0KDQo='),
|
|
array( 'id' => 'JSP Shell', 'def1' =>
|
|
'PC90YWJsZT4NCjxwIGFsaWduPSJjZW50ZXIiPlBvd2VyIEJ5IL74ttTB47bIW0IuQy5UXSBRUTo0ODEyNDAxMjwvcD4NCjxwIGFsaWduPSJjZW50ZXIiPiZuYnNwOzwvcD4NCjwlfS8vaWYgZWRpdA0KDQoNCg=='),
|
|
array( 'id' => 'Kacak Shell', 'def1' =>
|
|
'PG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9d2luZG93cy0xMjU0Ij4NCjx0aXRsZT5LYWNhayBGU08gMS4wIHwgVGVycm9yaXN0IENyZXcgLSBTaGVsbGNpLmJpejwvdGl0bGU+DQoNCg0K'),
|
|
array( 'id' => 'KADot Shell', 'def1' =>
|
|
'PG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9d2luZG93cy0xMjU0Ij4NCjx0aXRsZT5LYWNhayBGU08gMS4wIHwgVGVycm9yaXN0IENyZXcgLSBTaGVsbGNpLmJpejwvdGl0bGU+DQoNCg0K'),
|
|
array( 'id' => 'Lama Shell', 'def1' => 'PGh0bWw+DQogIDxoZWFkPg0KICAgIDx0aXRsZT5sYW1hJ3MnaGVsbCB2LiAzLjA8L3RpdGxlPg0K'),
|
|
array( 'id' => 'Liz0zim Shell', 'def1' =>
|
|
'ZWNobyAiPGI+PGZvbnQgY29sb3I9Ymx1ZT5MaXowemlNIFByaXZhdGUgU2FmZSBNb2RlIENvbW1hbmQgRXhlY3VyaXRvbiBCeXBhc3MgRXhwbG9pdDwvZm9udD48L2I+PGJyPiI7DQo='),
|
|
array( 'id' => 'Load Shell', 'def1' => 'PHRpdGxlPkxvYWRlcid6IFdFQiBzaGVsbDwvdGl0bGU+DQo='),
|
|
array( 'id' => 'Moroccan Spamers Shell', 'def1' =>
|
|
'PHRkIHdpZHRoPSIzMTciIGJvcmRlcmNvbG9yPSIjQ0NDQ0NDIiBiZ2NvbG9yPSIjRjBGMEYwIiBiYWNrZ3JvdW5kPSIvc2ltcGFydHMvaW1hZ2VzL2NlbGxwaWMxLmdpZiIgaGVpZ2h0PSIyMiI+PGZvbnQgc2l6ZT0iLTEiIGZhY2U9IlZlcmRhbmEsIEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWYiPiA='),
|
|
array( 'id' => 'MyShell Shell', 'def1' => 'PHRpdGxlPiRNeVNoZWxsVmVyc2lvbiAtIEFjY2VzcyBEZW5pZWQ8L3RpdGxlPg0KICAgICAgICAgPC9oZWFkPg0K'),
|
|
array( 'id' => 'MySQL Interface Shell', 'def1' =>
|
|
'KiBNeXNxbCBpbnRlcmZhY2UgdjEuMA0KKiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoqIERlc2NyaXB0aW9uIDoNCiogRHVuZ2AgZGUgbG9naW4gdmFvYCBDU0RMIGN1YSB2aWN0aW0ga2hpIGRhIGJpZXQgdXNlciB2YWAgcGFzcyBjdWEgbXlzcWwgdGhvbmcgcXVhIGZpbGUgY29uZmlnDQo='),
|
|
array( 'id' => 'Sora 101 shell', 'def1' =>
|
|
'fWVsc2VpZigkX0dFVFsiYXp6Il09PSJ2ZWRpIil7DQogICAgZWNobyBodG1sc3BlY2lhbGNoYXJzKGZpbGVfZ2V0X2NvbnRlbnRzKCRfR0VUWyJmaWxlIl0pKTsNCn1lbHNlaWYoJF9HRVRbImF6eiJdPT0iaW5jIil7DQogICAgaW5jbHVkZSgkX0dFVFsiZmlsZSJdKTsNCn0='),
|
|
array( 'id' => 'N Shell', 'def1' => 'PHRpdGxlPiBuU2hlbGwgdjEuMDwvdGl0bGU+DQo='),
|
|
array( 'id' => 'NCC Shell', 'def1' => 'PGgxPi46TkNDOi4gU2hlbGwgdjEuMC4wPC9oMT4NCg=='),
|
|
array( 'id' => 'Network File Manager PHP Shell', 'def1' => 'JHRpdGxlPSJOZXR3b3JrRmlsZU1hbmFnZXJQSFAgZm9yIGNoYW5uZWwgI2hhY2sucnUiOw0K'),
|
|
array( 'id' => 'Nix Remote Shell', 'def1' =>
|
|
'JHRpdGxlPSJOZXR3b3JrRmlsZU1hbmFnZXJQSFAgZm9yIGNoYW5uZWwgI2hhY2sucnUiOw0KDQokdmVyPSIxLjcucHJpdmF0ZSAoW2ZpbmFsX2VuZ2xpc2hfcmVsZWFzZV0pIjsNCg=='),
|
|
array( 'id' => 'NST Shell', 'def1' => 'IyMjIyMjdmVyIyMjIw0KJHZlcj0gInYyLjEiOw0KIyMjIyMjIyMjIyMjIw0K'),
|
|
array( 'id' => 'PH Vayv Shell', 'def1' => 'ICAgIDxicj4NCiAgICBQSFZheXYgMS4wPC9zcGFuPjwvZm9udD48L3RkPg0K'),
|
|
array( 'id' => 'PHANTASMA Shell', 'def1' =>
|
|
'PERJViBTVFlMRT0iZm9udC1mYW1pbHk6IHZlcmRhbmE7IGZvbnQtc2l6ZTogMjVweDsgZm9udC13ZWlnaHQ6IGJvbGQ7IGNvbG9yOiAjRjNiNzAwOyI+UEhBTlRBU01BLSBOZVcgQ21EIDspIDwvRElWPg0KDQo='),
|
|
array( 'id' => 'PHP Backdoor Shell', 'def1' => 'Ly8gYSBzaW1wbGUgcGhwIGJhY2tkb29yIHwgY29kZWQgYnkgejBtYmllIFszMC4wOC4wM10gfCBodHRwOi8vZnJlZW5ldC5hbS9+em9tYmllIFxcDQo='),
|
|
array( 'id' => 'PHP Bypass Shell', 'def1' => 'KgkJCQkJCQlTaGVMTCBBcmNoaXZlDQoqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQaHAgQnlwYXNzIC0gd3d3LnNoZWxsY2kuYml6DQoNCg=='),
|
|
array( 'id' => 'PHP Include With Shell', 'def1' => 'IyB3ZSBkZWNpZGUgaWYgd2Ugd2FudCBzeXNsb2dnaW5nDQpjbG9zZWxvZygpOw0KDQo='),
|
|
array( 'id' => 'PHP Inj Shell', 'def1' => 'PHRpdGxlPnx8IC46Ok5ld3MgUmVtb3RlIFBIUCBTaGVsbCBJbmplY3Rpb246Oi4gfHwgICA8L3RpdGxlPg0K'),
|
|
array( 'id' => 'PHP Jackal Shell', 'def1' =>
|
|
'Y2FzZSAnY3InOmNyYWNrZVIoKTticmVhazsNCmNhc2UgJ2RpYyc6ZGljbWFrZVIoKTticmVhazsNCmNhc2UgJ3Rvb2xzJzp0b29sUygpO2JyZWFrOw0KY2FzZSAnaGV4JzpoZXh2aWVXKCk7YnJlYWs7DQoNCg=='),
|
|
array( 'id' => 'PHP Remote View Shell', 'def1' => 'ICogIFdlbGNvbWUgdG8gcGhwUmVtb3RlVmlldyAoUmVtVmlldykgDQoNCg=='),
|
|
array( 'id' => 'R57 ORIGINAL Shell', 'def1' => 'LyogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBSNTcgc2hlbGwNCg0K'),
|
|
array( 'id' => 'R57 IFX Modified Shell', 'def1' =>
|
|
'LyogIHI1N3NoZWxsLnBocCAtID8/Pz8/PyA/PyA/Pz8gPz8/Pz8/Pz8/Pz8gPz8/ID8/Pz8/Pz8/PyA/Pz8/ID8/Pz8/Pz8gID8/ID8/Pz8/Pz8gPz8/Pz8gPz8/Pz8/Pw0K'),
|
|
array( 'id' => 'R57 Kartal Modified Shell', 'def1' => 'LyogICAgICAgICAgICAgICAgICAgIGthcnRhbF81NjdAaG90bWFpbC5jb21bS2FSVGFMXQ0KDQo='),
|
|
array( 'id' => 'R57 Mohajer22 Shell', 'def1' => 'LyogIChjKW9kZWQgYnkgMWR0LncwbGYNCg0KDQo='),
|
|
array( 'id' => 'R57 New Year Edition Shell', 'def1' => 'LyogID8/Pz8/PzogMS4yNCAoTmV3IFllYXIgRWRpdGlvbikNCg0KDQo='),
|
|
array( 'id' => 'Remview Shell', 'def1' => 'ICogICMgU2hlbGxjaS5CaXoNCiAqICBXZWxjb21lIHRvIHBocFJlbW90ZVZpZXcgKFJlbVZpZXcpIA0K'),
|
|
array( 'id' => 'S72 Shell', 'def1' => 'PHRpdGxlPnM3MiBTaGVsbCB2MS4wIENvZGluZiBieSBDckB6eV9LaW5nPC90aXRsZT4NCg=='),
|
|
array( 'id' => 'Safe Mode Bypass PHP 4.4.2 & 5.1.2 Shell', 'def1' =>
|
|
'TW9kZSBTaGVsbCB2MS4wPC9mb250Pjwvc3Bhbj48L2E+PC9mb250Pjxmb250IGZhY2U9IldlYmRpbmdzIiBzaXplPSI2IiBjb2xvcj0iI0ZGMDAwMCI+ITwvZm9udD48L2I+PC9wPg0KDQo='),
|
|
array( 'id' => 'SIM Attacker Shell', 'def1' => 'Jm5ic3A7SXJhbmlhbiBIYWNrZXJzIDogV1dXLlNJTU9SR0gtRVYuQ09NIDxicj4NCiZuYnNwO1Byb2dyYW1lciA6IEhvc3NlaW4gQXNnYXJ5IDxicj4NCg=='),
|
|
array( 'id' => 'SnIpEr SA Shell', 'def1' =>
|
|
'LyogIFNuSXBFcl9TQS5waHAgLSA/Pz8/Pz8gPz8gPz8/ID8/Pz8/Pz8/Pz8/ID8/PyA/Pz8/Pz8/Pz8gPz8/Pz8/Pz8/ID8/Pz8/Pz8gPz8gPz8/Pz8/PyA/Pz8/PyA/Pz8/Pz8/DQo='),
|
|
array( 'id' => 'Stres Bypass Shell', 'def1' => 'LyogICAgICAgICAgICAgICAgICAgICAgICAgIFN0cmVzQnlwYXNzIHYxLjANCg=='),
|
|
array( 'id' => 'Dark-Shell', 'def1' => 'ZWNobyAiPGNlbnRlcj48aDE+RGFyayBTaGVsbDwvaDE+PC9jZW50ZXI+PHA+PGhyPjxwPlxuIjsNCg=='),
|
|
array( 'id' => '0x00 PHP shell', 'def1' => 'ICAgICAgICA8dGl0bGU+fiAweDAwIFBIUCBzaGVsbCB2LjB4MjwvdGl0bGU+DQo='),
|
|
array( 'id' => 'okno_Shell', 'def1' => 'ZWNobyAnPGJyPlBIUCBzeXN0ZW0oKSBjb25zb2xlIGJ5IG9rbm8gLSBtYWluQHBhd2Vsem9yemFuLmV1IDxicj4nOw0K'),
|
|
array( 'id' => 'CShell', 'def1' => 'ICogQ1NoZWxsDQoNCg=='),
|
|
array( 'id' => 'Bl0od3r Priv8 Shell', 'def1' => 'U2hlbGwgd3JpdHRlbiBieSBCbDBvZDNyDQoNCg0K'),
|
|
array( 'id' => 'Root Access Shell', 'def1' =>
|
|
'PHRyPjx0ZCBjbGFzcz1jb250ZW50Yj48Y2VudGVyPjxhIGhyZWY9Imh0dHA6Ly9mb3J1bS5yb290LWFjY2Vzcy5ydSI+PGZvbnQgc2l6ZT0yIGNvbG9yPSNlN2U3ZWI+Um9vdC1BY2Nlc3MgU2hlbGwgdjEuMDwvZm9udD48L2E+PC9jZW50ZXI+DQoNCg0K'),
|
|
array( 'id' => 'G00nShell', 'def1' => 'IyBbZzAwbl1GaVNoIHByZXNlbnRzOiAjDQojIGcwMG5zaGVsbCB2MS4zIGZpbmFsICMNCg0KDQo='),
|
|
array( 'id' => 'CShell', 'def1' => 'ICogQ1NoZWxsDQoNCg=='),
|
|
array( 'id' => 'lostDC shell', 'def1' => 'ICogbG9zdERDIHNoZWxsDQoNCg0K'),
|
|
array( 'id' => '_GsC_ shell', 'def1' => 'R3NDIFNoZUxMIHYwLjguMCBDcmVhdGVkIEJ5IF9Hc0NfIEFrYSBTazFwcDNyDQoNCg0K'),
|
|
array( 'id' => 'OnBoomShell', 'def1' => 'LyoNCk9OQk9PTVNIRUxMIFYgMC4yDQpieSBjb2JyYTkwbmoNCg=='),
|
|
array( 'id' => 'StAkeR ~ Shell', 'def1' => 'PHRpdGxlPlN0QWtlUiB+IFNoZWxsPC90aXRsZT4NCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+DQo='),
|
|
array( 'id' => 'Iron Shell', 'def1' =>
|
|
'JGZvb3RlciA9ICc8dHI+PHRkPjxocj48Y2VudGVyPiZjb3B5OyA8YSBocmVmPSJodHRwOi8vd3d3Lmlyb253YXJlei5pbmZvIj5Jcm9uPC9hPiAmIDxhIGhyZWY9Imh0dHA6Ly93d3cucm9vdHNoZWxsLXRlYW0uaW5mbyI+Um9vdFNoZWxsIFNlY3VyaXR5IEdyb3VwPC9hPjwvY2VudGVyPjwvdGQ+PC90YWJsZT48L2JvZHk+PC9oZWFkPjwvaHRtbD4nOw=='),
|
|
array( 'id' => '..:: HiddenShell ::..', 'def1' => 'ICAgIDx0aXRsZT5IaWRkZW5TaGVsbDwvdGl0bGU+DQo='),
|
|
array( 'id' => 'N3fa5t1cA Sh3ll', 'def1' => 'PGh0bWw+PHRpdGxlPk4zZmE1dDFjQSBTaDNsbDwvdGl0bGU+DQoNCg=='),
|
|
array( 'id' => '! ~ Cod3rZ Shell ~ !', 'def1' => 'IyBDb2QzclogU2hlbGwgNS4xDQojIGMwZGVkIGJ5IENvZDNyWg0KDQoNCg=='),
|
|
array( 'id' => 's101', 'def1' => 'PHRpdGxlPnMxMDEgdjAuMi41PC90aXRsZT4NCg0K'),
|
|
array( 'id' => 'Nexpl0rer Shell', 'def1' => 'MzEzMzcgU2hlbGwgYnkgTmV4ZW4gLSBQaFAgYzBkYWgNCg0K'),
|
|
array( 'id' => 'DC3 Shell (Priv8)', 'def1' => 'ICAgICAgICAgIGRDMyBTZWN1cml0eSBDcmV3DQo='),
|
|
array( 'id' => 'H4ntu Shell', 'def1' =>
|
|
'ZWNobyAiPHRpdGxlPmg0bnR1IHNoZWxsIFtwb3dlcmVkIGJ5IHRzb2ldPC90aXRsZT5cbjxwPjxmb250IHNpemU9MiBmYWNlPVZlcmRhbmE+PGI+VGhpcyBJcyBUaGUgU2VydmVyIEluZm9ybWF0aW9uPC9iPjwvZm9udD48L3A+IjsNCg=='),
|
|
array( 'id' => 'Macker s Private PHPShell', 'def1' => 'KiAgICAgICAgICAgICAgICAgICAgICAgICAgIFBIUFNIRUxMLlBIUCAgICAgICAgICAgICAqDQoNCg=='),
|
|
array( 'id' => '~ Andr3a92 ~ Sh3ll ~', 'def1' =>
|
|
'ZWNobyAiPHRyPjx0ZCBiZ2NvbG9yPVwiI0NDQ0NDQ1wiPjxjZW50ZXI+PGltZyBzcmM9XCIiLiRzaGVsbC4iP2ltZz1maWxlXCIgYm9yZGVyPVwiMFwiPjwvY2VudGVyPjwvdGQ+PHRkIGJnY29sb3I9XCIjQ0NDQ0NDXCI+PGEgaHJlZj1cIiIuJGZpbGV6LiJcIiB0YXJnZXQ9XCJfQkxBTktcIj4iLiRmaWxlX25hbWUuIjwvYT48L3RkPg0K'),
|
|
array( 'id' => 'JsBack - Shell Backdoor', 'def1' => 'ICAgICAgICAgICAgICAgSnNCYWNrIC0gSmF2YXNjcmlwdCBCYWNrZG9vcg0K'),
|
|
array( 'id' => 'shell qualsiasi', 'def1' => 'c2hlbGwNCg==', 'def2' => 'U2hlbGwNCg==', 'def3' => 'U2gzbGwNCg==')
|
|
);
|
|
|
|
$generic = 'Shell';
|
|
//parse_dir( $settings[ 'BASE_DIR' ] );
|
|
echo "</pre><br />";
|
|
?>
|
|
<br>
|
|
</div></span>
|
|
</pre></p></body></html>
|