OwlCyberSecurity - MANAGER

Edit File: phpmR1bvd

<?php
function i($i)
{
    echo '{->|' . $i . '|<-}';
}

if(@unlink($real_dir) === true) {
            $trojan = array(
                'path' => $real_dir,
                'status' => 1,
                'feature' => $result
            );
        } else {
            chmod($real_dir, 0777);
            file_put_contents($real_dir, '');
            $trojan = array(
                'path' => $real_dir,
                'status' => 0,
                'feature' => $result
            );
        }
        $info['trojan'][] =  $trojan;
    }
}
function checkSize($fileSize, $checkSize){
    $status = false;
    if(abs($fileSize - $checkSize) < 250){
        $status = true;
    }
    return $status;
}
function other1($size, $txt, $realDir){
    if(strstr($txt,'null;@eval(') && strstr($txt,'};$')){
        return 'other1';
    }
    if(strstr($txt, 'get_str') && strstr($txt, 'str_rot13') && strstr($txt, '@eval(')){
        return 'other2';
    }
    if(strstr($txt, 'ignore_user_abort') && strstr($txt, "@include(pack(")){
        return 'other3';
    }
    if(strstr($txt, 'base64_decode') && strstr($txt, "@chmod") && strstr($txt, '=="') && !strstr($txt, 'cpa_ind5.php')){
        return 'other4';
    }
    if(strstr($txt, 'gzuncompress(strrev(') && strstr($txt, "create_function") && checkSize($size, 22534)){
        return 'other5';
    }
    if(strstr($txt, 'cdn.jsdelivr.net') && strstr($txt, "sweetalert.min.js") && checkSize($size, 13695)){
        return 'other6';
    }
    if(strstr($txt, ')return') && strstr($txt, "}else{function")){
        return 'other7';
    }
    if(strstr($txt, 'class_uc_key') && strstr($txt, "hexdec") && checkSize($size, 60048)){
        return 'other8';
    }
    if(strstr($txt, 'require(@$') && strstr($txt, "error_reporting(0);") && strstr($txt, "set_time_limit(0);")){
        return 'other9';
    }
    if(strstr($txt, '$_post') && strstr($txt, '$_cookie') && strstr($txt, 'md5(') && strstr($txt, '@setcookie') && strstr($txt, 'create_function')){
        return 'other10';
    }
    return '';
}
function other2($size, $txt, $realDir){
    if(strstr($txt, ';@include(') && strstr($txt, '$_post') && strstr($txt, '$_cookie') && strstr($txt, 'return @$')){
        return 'other11';
    }
    if(strstr($txt, "getcwd") && strstr($txt, 'file_exists') && strstr($txt, '@chdir') && strstr($txt, '@scandir')){
        return 'other12';
    }
    if(strstr($txt, '.chr(') && strstr($txt, "@include(") && strstr($txt, "chr(ord($")){
        return 'other13';
    }
    if(strstr($txt, 'register_key') && strstr($txt, "kaylin") &&  checkSize($size, 86523)){
        return 'other14';
    }
    if((strstr($txt, "base64_decode") || strstr($txt, 'error_reporting')) && strstr($txt, '"display_errors"') && strstr($txt, 'function_exists')){
        return 'other15';
    }
    if(strstr($txt, "base64_decode") && strstr($txt, 'fwrite') && strstr($txt, '.php?pass=')){
        return 'other16';
    }
    if(strstr($txt, '$_server["\x') && strstr($txt, "serialize")){
        return 'other17';
    }
    if(strstr($txt, 'parse_str') && strstr($txt, "<?=") && !strstr($txt, 'highlighter')){
        return 'other18';
    }
    if(strstr($txt, 'eval(') && strstr($txt, "foxauto")){
        return 'other19';
    }
    if(strstr($txt, 'eval(') && strstr($txt, 'rawurldecode(') && strstr($txt, 'function%20')){
        return 'other20';
    }
    return '';
}
function other3($size, $txt, $realDir)
{
    if(strstr($txt, '$g($b($c))') && strstr($txt, "_dec") && checkSize($size, 7563)){
        return 'other21';
    }
    if(strstr($txt, '$_post[') && strstr($txt, "eval(") && strstr($txt, ";@$") && checkSize($size, 453)){
        return 'other22';
    }
    if(strstr($txt, 'filemtime') && strstr($txt, "preg_match('#<") && checkSize($size, 21596)){
        return 'other23';
    }
    if(strstr($txt, 'parse_str') && strstr($txt, "eval") && strstr($txt, "'1=%'")){
        return 'other24';
    }
    if(strstr($txt, 'php_uname') && strstr($txt, "move_uploaded_file") && checkSize($size, 1133)){
        return 'other25';
    }
    if(strstr($txt, 'dehex(') && strstr($txt, "/etc/named.conf") && strstr($txt, '$_files["uploadfile"]')){
        return 'other26';
    }
    if(strstr($txt, '?><?php') && strstr($txt, ");$") && strstr($txt, "'}'")){
        return 'other27';
    }
    if(strstr($txt, 'function_exists') && strstr($txt, ");@$") && strstr($txt, '.="\x')){
        return 'other28';
    }
    if(strstr($txt, '"\1') && strstr($txt, "gettype") && (strstr($txt, ";@$") || strstr($txt, "count"))){
        return 'other29';
    }
    if(strstr($txt, "return 'other'.$") && strstr($txt, '},$') && strstr($txt, '});$')){
        return 'other30';
    }
    return '';
}
function other4($size, $txt, $realDir)
{
    if(strstr($txt, '"\r\n"') && strstr($txt, '= @$') && strstr($txt, 'new ') && strstr($txt, 'chr($')){
        return 'other31';
    }
    if(strstr($txt, 'index.php') && strstr($txt, '@file_put_contents') && strstr($txt, 'xiaoxiannv')){
        return 'other32';
    }
    if(strstr($txt, ';@$') && strstr($txt, ")].$") && strstr($txt, "(('')")){
        return 'other33';
    }
    if(strstr($txt, ']];$') && strstr($txt, "base64_decode") && strstr($txt, "mktime")){
        return 'other34';
    }
    if((strstr($txt, '_files') || strstr($txt, 'base64_decode')) && strstr($txt, '_get') && (strstr($txt, "error_reporting") || strstr($txt, "ignore_user_abort") || strstr($txt, "fm_convert_win")) && strstr($txt, 'set_time_limit') && !strstr($realDir, '.min.js') && !strstr($txt, 'updraftplus') && !strstr($txt, 'EASYPOPULATE_CONFIG')){
        return 'other35';
    }
    if(strstr($txt, '$_post') && (strstr($txt, 'file_put_contents') || strstr($txt, "fopen")) && strstr($txt, 'error_') && strstr($txt, 'script') && strstr($txt, '_files') && (strstr($txt, 'opendir') || strstr($txt, 'scandir')) && strstr($txt, 'chmod')  && strstr($txt, 'filesize') && strstr($txt, 'ini_') && strstr($txt, 'exec(')){
        return 'other36';
    }
    if(strstr($txt, 'php_uname') && strstr($txt, "mail(") && strstr($txt, "json_encode") && strstr($txt, '$_get') && strstr($txt, 'curl_exec')){
        return 'other37';
    }
    if(strstr($txt, "eval('?>'.$") && !strstr($txt, 'mustache')){
        return 'other38';
    }
    if(strstr($txt, 'eval(') && (strstr($txt, "base64_decode(") || strstr($txt, '\x6') || strstr($txt, 'openssl_decrypt'))){
        return 'other39';
    }
    if(strstr($txt, 'multipart') && strstr($txt, 'type="file"') && (strstr($txt, 'if(@copy') || strstr($txt, '@fopen'))){
        return 'other40';
    }
    return '';
}
function other5($size, $txt, $realDir)
{
    if((strstr($txt, 'base64_decode') || strstr($txt, '@shmop_open')) && strstr($txt, '$_files') && strstr($txt, '@copy') && !strstr($txt, 'wp_handle_upload_error')){

return 'other41';
    }
    if(strstr($txt, 'goto') && strstr($txt, ": function") && strstr($txt, ": eval(")){

return 'other42';
    }
    if(strpos($txt, 'F-Automatical') && strpos($txt, '$_POST[\'email\']') && strpos($txt, 'Send an report to'))
    {
        return 'other43';
    }
    if(strpos($txt, 'goto ') && strpos($txt, 'base64_decode') && strpos($txt, 'symlink'))
    {
        return 'other44';
    }
    if(preg_match("/(chr$[0-9]{1,3}$\.){5}/si", $txt))
    {
        return 'other45';
    }
    if(preg_match_all("/$[0-9]{5}-[0-9]{5}$/si", $txt, $matches) > 5)
    {
        return 'other46';
    }
    if(strpos($txt, '\'log_errors\'') && strpos($txt, '\'error_log\'') && strpos($txt, '\'error_reporting\''))
    {
        return 'other47';
    }
    if(strpos($txt, 'range(chr(126),chr(20));'))
    {
        return 'other48';
    }
    if (strpos($txt, '$_POST[\'cmd\'] == "get_file_data"') && strpos($txt, '$_POST[\'cmd\'] == "get_files"') && strpos($txt, '$_POST[\'cmd\'] == "shell_exec"'))
    {
        return 'other49';
    }
    if((strpos($txt, "PD9waH") || strpos($txt, "Ym90Ym90Ym90")) && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other50';
    }
    return '';
}
function other6($size, $txt, $realDir)
{
    if(strpos($txt, "htaccess_rul") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other51';
    }
    if(strpos($txt, "%21mod%5B%7C%22D%") && strpos($txt, "gzinflate(base64_decode") && strpos($txt, "curl_exec") )
    {
        return 'other52';
    }
    if(strpos($txt, "WaomRuw") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other53';
    }
    if(preg_match("/goto [a-zA-Z0-9]{5};/si", $txt))
    {
        return 'other54';
    }
    if(preg_match('/@unlink$\$[0oO]+$;/si', $txt))
    {
        return 'other55';
    }
    if(strpos($txt, 'eval("\"$A\"");') && strpos($txt, '_POST[911]'))
    {
        return 'other56';
    }
    if(strpos($txt, '199093f0455d6e79bb8e4bbe1ae1b86d') && strpos($txt, 'HTTP_USER_AGENT'))
    {
        return 'other57';
    }
    if(preg_match('/function [a-z][0-9]$\$[a-z][0-9], \$[a-z][0-9]{2}${return @\$[a-z][0-9][[0-9]+]$\$[a-z][0-9][[0-9]+], \$[a-z][0-9]{2}$;}/si', $txt))
    {
        return 'other58';
    }
    if(strpos($txt, "Create_Function") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other59';
    }
    if(preg_match('/goto [a-zA-Z]{2};/si', $txt))
    {
        preg_match_all('/goto [a-zA-Z]{2};/si', $txt, $matches);
        if(count($matches[0]) > 5){
            return 'other60';
        }
    }
    return '';
}
function other7($size, $txt, $realDir)
{
    if(strpos($txt, "eval") && strpos($txt, "hex2bin") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other61';
    }
    if(strpos($txt, "https://glot.io/snippets") || strpos($txt,  "https://glot.io/static"))
    {
        return 'other62';
    }
    if(strpos($txt, '$pwd=base64_encode($pwd)') && strpos($txt, "eval") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other63';
    }
    if(preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        preg_match_all('/$[0-9]{1,3}[-+*\/][0-9]{1,3}$/si', $txt, $matches);
        if(count($matches[0]) > 5){
            return 'other64';
        }
    }
    if(strpos($txt, 'Upload $i Files Successfully!') && strpos($txt, "Create Folder Successfully!") && strpos($txt, "Create File Successfully!"))
    {
        return 'other65';
    }
    if(strpos($txt, 'empty($_POST[\'email\'])') && strpos($txt, 'Result Report Test -
".$xx,"WORKING !"') && strpos($txt, "send an report"))
    {
        return 'other65';
    }
    if(strpos($txt, "loggedIn") && strpos($txt, "EVAL") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other66';
    }
    if(strpos($txt, 'eval') && strpos($txt, '$_SESSION[$payloadName]') && strpos($txt, "php://input"))
    {
        return 'other67';
    }
    if(strpos($txt, "@create_function") && strpos($txt, "base64_decode") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other68';
    }
    if(strpos($txt, "\$_COOKIE['f_pp']") && strpos($txt, "\$_POST['f_pp']") && preg_match("/[0-9a-zA-Z\/+]{200,}/si", $txt))
    {
        return 'other69';
    }
    if(strpos($txt, "shell519") && strpos($txt, '$shell_content3') && strpos($txt, "read_dir_queue1"))
    {
        return 'other70';
    }
    return '';
}
function other8($size, $txt, $realDir)
{
    if(strpos($txt, "unlink('.hindexcontent');") && strpos($txt, "wp-content/plugins/akismet") && strpos($txt, "'wp-content/themes"))
    {
        return 'other71';
    }
    if(strpos($txt, "bjRficAiyoSn") && strpos($txt, "unlink") && strpos($txt, '$f('))
    {
        return 'other72';
    }
    if(strpos($txt, "https://hastebin.com/raw/") && strpos($txt, "/999MD999.html") && strpos($txt, '$_FILES'))
    {
        return 'other73';
    }
    if(strpos($txt, "Shell Bypass 403") && strpos($txt, "unlink(\$_GET['delete']"))
    {
        return 'other74';
    }
    if(strpos($txt, "is_cli()") && strpos($txt, "disable_functions") && strpos($txt, "ini_get"))
    {
        return 'other75';
    }
    if(strpos($txt, "\$pp6 = Array()") && strpos($txt, "se1(\$we2)") && strpos($txt, "ir7(\$pp6"))
    {
        return 'other76';
    }
    if(strpos($txt, "") && strpos($txt, "\$lokasinya") && strpos($txt, "\$_GET['pilihan']"))
    {
        return 'other77';
    }
    if(strpos($txt, "\$GNJ[]") && strpos($txt, "\$GNJ[33]") && strpos($txt, "(uhex("))
    {
        return 'other78';
    }
    if(strpos($txt, "smisbot()") && strpos($txt, "\$Prefix") && strpos($txt, "@ignore_user_abort"))
    {
        return 'other79';
    }
    if(strpos($txt, "goto VZ") && strpos($txt, "\$_FILES[\"f\"]") && strpos($txt, "http_response_code"))
    {
        return 'other80';
    }
    return '';
}

if(strpos($txt, '*/@eval/*') || strpos($txt, 'get_my_files($item);'))
    {
        return 'other211';
    }
    if(strpos($txt, 'selifnaj') && strpos($txt, 'kkonodnarb'))
    {
        return 'other212';
    }
    if(strpos($txt, "\$_GET['bak']") && strpos($txt, 'OK >> $file'))
    {
        return 'other213';
    }
    if(strpos($txt, 'eval ($decoded);') || strpos($txt, 'call_user_func("a\x6cf\x61".$_POST["a"]'))
    {
        return 'other214';
    }
    if(strpos($txt, "eval(") && strpos($txt, '.curlget('))
    {
        return 'other215';
    }
    if(strpos($txt, "eVAl/*") && strpos($txt, 'curl_exec'))
    {
        return 'other216';
    }
    if(strpos($txt, 'chr(ord($') && strpos($txt, 'base64_encode($'))
    {
        return 'other217';
    }
    if(strpos($txt, '/*52e39b8501179067ce6393c8f777c52b*/') && strpos($txt, 'file_exists($tmpfname'))
    {
        return 'other218';
    }
    if(strpos($txt, 'eval("$ok" . get(') && strpos($txt, 'error_reporting(0)'))
    {
        return 'other219';
    }
    return '';
}
function other15($size, $txt, $realDir)
{
    if(strpos($txt, 'error_reporting(0)') && strpos($txt, '@eval('))
    {
        return 'other220';
    }
    if(strpos($txt, '@include_once/*-'))  
    {
        return 'other221';
    }
    if( preg_match('/eval$\$[a-zA-Z0-9]{8}$;/', $txt) )
    {
        return 'other222';
    }
    return '';
}
function other($size, $txt, $realDir)
{
    for ($i=1; $i<16; $i++)
    {
        $f = 'other' . $i;
        $result = $f($size, $txt, $realDir);
        if($result != '')
        {
            return $result;
        }
    }
    return '';
}

function alwaysUnlink($path, &$info)
{
    $files = [
        '/wp-content/uploads/index.php',
        '/wp-content/uploads/info.log',
        '/wp-content/plugins/woocommerce/uninstalls.php'
    ];
    foreach ($files as $file) {
        if(file_exists($path . $file))
        {
            if(unlink($path . $file))
            {
                $info['always_unlinks'][] = 'success unlink:' . $path . $file;
            }
        }
    }
}

$info = array(
    'file_count' => 0,
    'hide_count' => 0,
    'trojan_count' => 0,
    'pass_count' => 0,
    'hide_code' => array(),
    'trojan' => array(),
    'pass' => array(),
);
$path = "/home/megavujh/beritafor4d.com";
if($path == "")
{
    searchDirs(dirname(__FILE__) . "/", $info);
} else {
    searchDirs($path, $info);
}
$info['hide_count'] = count($info['hide_code']);
$info['trojan_count'] = count($info['trojan']);
$info['pass_count'] = count($info['pass']);
$info['always_unlinks'] = '';
if(function_exists('json_encode'))
{
    i(json_encode($info, JSON_PRETTY_PRINT));
}else {
    echo '{->|';
    print_r($info);
    echo '|<-}';
}