PakCyberPyrates

Hooking memcpy of swengine

1. /tmp root@apx# nano ld.c
2. /tmp root@apx# gcc -fPIC -c ld.c -o ld.o
3. /tmp root@apx# gcc -shared -o ld.so ld.o
4. /tmp root@apx# LD_PRELOAD=/tmp/ld.so /usr/bin/sw-engine /usr/local/psa/admin/htdocs/login_up.php3

Cheers

PakCyberPyrates

<?php
/*
 * decoder for some lame obfuscated php shell.
 *
 * you mad bro?
 *
 */
$satu = "bVNhb9owEP2OxH+4phI4NINAN00aYxJaW6maxqbSLxNDKDiXxiLYkW3KGOp/3zlOpo7xIY793jvf
    +fl8KSQvdinCR2NTofr5p3br8hWmhXw6BQ9mYA8lmjO4UXyD9oSQaAV9AyFPCNRa+pRCWtgmQrJE
    P/GIhufQg249brd4nmjo9RxBqyNAuwWOdvmyNAKJ+ywlBirhepctruOlW9MJdtzrkjTVKyFB41ZZ

PakCyberPyrates

[client]
port    = 3306
socket  = /var/run/mysqld/mysqld.sock

# This was formally known as [safe_mysqld]. Both versions are currently parsed.
[mysqld_safe]
socket  = /var/run/mysqld/mysqld.sock
nice    = 0
syslog

PakCyberPyrates

vi /etc/environment

add these lines...

LANG=en_US.utf-8
LC_ALL=en_US.utf-8

PakCyberPyrates

#!/bin/sh
# yum install android-tools -y
yum install java-1.8.0-openjdk-devel
mkdir -p android-sdk-linux
cd android-sdk-linux
# @see https://developer.android.com/studio/index.html
wget --output-document=android-sdk.zip --quiet https://dl.google.com/android/repository/sdk-tools-linux-3859397.zip
unzip android-sdk.zip
rm -f android-sdk.zip
yes | tools/bin/sdkmanager --licenses

PakCyberPyrates

#!/bin/bash

mkdir /tmp/bison
cd /tmp/bison

apt-get update
apt-get install -y build-essential m4

wget http://ftp.gnu.org/gnu/bison/bison-2.5.tar.gz
tar -xvf bison-2.5.tar.gz

PakCyberPyrates

These commands are based on a askubuntu answer http://askubuntu.com/a/581497
To install gcc-6 (gcc-6.1.1), I had to do more stuff as shown below.
USE THOSE COMMANDS AT YOUR OWN RISK. I SHALL NOT BE RESPONSIBLE FOR ANYTHING.
ABSOLUTELY NO WARRANTY.

If you are still reading let's carry on with the code.

sudo apt-get update && \
sudo apt-get install build-essential software-properties-common -y && \
sudo add-apt-repository ppa:ubuntu-toolchain-r/test -y && \

PakCyberPyrates

#!/usr/bin/env bash
# vim: ai ts=2 sw=2 et sts=2 ft=sh

# Check OS.
if [[ ! "${OSTYPE}" =~ "^linux" ]] || [[ ! "$(lsb_release -c 2>/dev/null)" =~ "xenial" ]]; then
  (>&2 echo "Error: This script is for Ubuntu 16.04 LTS (xenial) not '${OSTYPE}'.")
  exit 1;
fi

sudo apt-get update

PakCyberPyrates

sudo add-apt-repository ppa:ondrej/php
sudo apt-get update
sudo apt-get install php5.6

you can install more php5.6 module
sudo apt-get install php5.6-mbstring php5.6-mcrypt php5.6-mysql php5.6-xml php5.6-intl php5.6-intl php5.6-mbstring php-apcu php-uuid php5.6-cgi php5.6-cli php5.6-gd php5.6-ldap php5.6-sqlite3 php-uploadprogress

PakCyberPyrates

Install PHP 5.6 On linux (Debian, Ubuntu, Mint ...)

sudo apt-get install python-software-properties
sudo add-apt-repository ppa:ondrej/php
sudo apt-get update
sudo apt-get install -y php5.6

heck Installed PHP Version

php -v