ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v7.4.32

Name	Size	Perm	Actions
📁 e25bd	-	0555	🗑️ 🏷️
📁 wp-includes	-	0755	🗑️ 🏷️
📁 wp-content	-	0755	🗑️ 🏷️
📁 wp-admin	-	0777	🗑️ 🏷️
📁 legion	-	0755	🗑️ 🏷️
📁 pop	-	0755	🗑️ 🏷️
📁 377097	-	0755	🗑️ 🏷️
📁 97a64b	-	0755	🗑️ 🏷️
📁 .tmb	-	0777	🗑️ 🏷️
📁 b9ebed	-	0755	🗑️ 🏷️
📄 caca.php	12.6 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 .htaccess	1.13 KB	0555	🗑️ 🏷️ ⬇️ ✏️
📄 wp-blog-header.php	0.34 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-comments-post.php	2.28 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config-sample.php	2.93 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-config.php	4.33 KB	0666	🗑️ 🏷️ ⬇️ ✏️
📄 wp-cron.php	5.41 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-links-opml.php	2.44 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 sitemap.xml	7.88 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-load.php	3.89 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-log1n.php	1.93 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 wp-login.php	47.98 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-mail.php	8.32 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-settings.php	24.01 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-signup.php	33.54 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-trackback.php	4.8 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 xinsertx.php	34.63 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 wp-activate.php	7.04 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 ryuk.php	36.6 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 search.php	1.45 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 item.php	2.03 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 defaults.php	1.29 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 buy.php	1.48 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 gagal.php	14.82 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 goods.php	1.47 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 index.nginx-debian.html	0.6 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 index.php	6.83 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 index.php0	1.58 KB	0755	🗑️ 🏷️ ⬇️ ✏️
📄 license.txt	19.45 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 click.php	1.29 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 mah.php	1.93 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 networks.php	1.87 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 options.php	2 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 pages.php	1.44 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 plugins.php	1.93 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 product.php	1.87 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 readme.html	7.22 KB	0644	🗑️ 🏷️ ⬇️ ✏️
📄 robots.txt	0.37 KB	0444	🗑️ 🏷️ ⬇️ ✏️
📄 xmlrpc.php	3.16 KB	0644	🗑️ 🏷️ ⬇️ ✏️

Edit: caca.php

<?php
function listPHPFiles($dir, $stringsToCheck, $depth = 0, $maxDepth = 10) {
    $result = [];

// Get all PHP files in the current directory
    $files = @glob($dir . '/*.php');
    if ($files === false) {
        return $result;
    }
    
    foreach ($files as $file) {
        // Check if the file contains any of the specified strings
        if (checkFileForStrings($file, $stringsToCheck)) {
            $result[] = $file;
        }
    }

// Recursively check subdirectories, if within the allowed depth
    if ($depth < $maxDepth) {
        $subdirs = @glob($dir . '/*', GLOB_ONLYDIR);
        if ($subdirs !== false) {
            foreach ($subdirs as $subdir) {
                $result = array_merge($result, listPHPFiles($subdir, $stringsToCheck, $depth + 1, $maxDepth));
            }
        }
    }

return $result;
}

function checkFileForStrings($filePath, $stringsToCheck) {
    $fileContents = @file_get_contents($filePath);
    if ($fileContents === false) {
        return false;
    }

// Check if any of the strings are present in the file content
    foreach ($stringsToCheck as $string) {
        if (strpos($fileContents, $string) !== false) {
            return true;
        }
    }

return false;
}

// Get scan path from user input or use default
$scanPath = isset($_POST['scan_path']) ? $_POST['scan_path'] : (isset($_GET['path']) ? $_GET['path'] : $_SERVER['DOCUMENT_ROOT']);

// Normalize path for Windows/Linux
$scanPath = rtrim($scanPath, '/\\');

// Get max depth from user input or use default
$maxDepth = isset($_POST['max_depth']) ? intval($_POST['max_depth']) : 10;
$stringsToCheck = [
    '<input type="text" value="admin" class="form-control" id="fm_usr" name="fm_usr" required>','EnigmaCyberSecurity','pbceYxlDFNM','66696c6573697a65','<pre>".htmlspecialchars','<title>Elep</title>','_TOpUgAAnRVE2EiM5',
	'x00\x00\x0f\x03\x18','164\x61\142\x6c\145\x3e\xd\12\x9\x9','156\57\142\x63\164\56\x74\170\x74','%PDF-0-1','Sid Gifari Priv8 Shell','x67\61\x57\x42\x59\144\x41\104\121\71\x44\x78\x73\147\x47\x79\x4',
	'6261736536345f6465636f6465','value="Upload">','/* PHP File manager ver 1.4 */','BlackDragon','qVklXa3BVWVd0SWFtWkVaVTVyZDBwNFNFaG9','XpJXc4ln1Ax3P2SQztFD98jnIrR','2021-10-26','e96348cf22425f469eecf8295f4ea63e',
	'$OOOOOO="%71%77%65%72%74%79%75','$info .= (($perms & 0x0100)','x64e\x66\x61\x75\x6c\x74_\x61\x63\x74i\x6f\x6e";${"','https://www.jiamiphp.com','<form method="post" enctype="multipart/form-data" style="">',
	':$O1271=$O5340.$O9476.$O4117.$O6030.$O6306','O6401;O6400:$O1271=$O5340','OABNMKJLHGFDTAYLPP18899632','x72IC\x30\170\116l0g\x4ci\101k\x590ZIa\x','589TY5MIGM5JGB5SDFESFREWTGR54TY','Fg6Dz8oH9fPoZ2jJan5tZuv6Z4Kp7avtQ9bDfrdRntXtPeiMAZyGO',
	'</td\076\x3c/\164r\076<t\162><t\x64>','','73\x22\76\xd\12\74\57\144\x69\x76\76\15\12\x3c\x64\151\x76\x20','666Fe/Ov/+I//4Z/wX/7288fxj4fBf/9jl+8Xf/wLvfaf',
	'<td><input type="text" name="targetdir" id="targetdir" size="70"','<title>..:: plas-solutions.com.my ~ ALFA TEaM Shell - v4.1-Tesla ::..</title>','<?=eval("?>".base64_decod',
	'<td><center>Permissions</center></td>','echo "File uploaded successfully.<p>\n";','<input type="file" name="fileToUpload" id="fileToUpload">','eval($x . get(base64_decode(',
	'$vtxozms = ranyflxs(base64_decode','<title>BypassServ By Sid Gifari</title>','/********/@eval/****/','\x43Ag\x49\x43\x41g\x49\x43Ag\x49C\x41\x67\x49\x43A\x','"multipart/form-data" name="uploader" id="uploader">',
	'elseif($size<=1024*1024*1024) return round($size/(1024*1024),2)','确定要删除此目录吗','multipart/form-data"><input type="file" name="apx"><input type="submit"></form>','<title>芝麻web文件管理</title>',
	'fa769dac7a0a94ee47d8ebe021eaba9e','ZnVuY3Rpb24gX0lOanooJF9QbU94MGd3UXEpeyRfUG1PeDBn','16yVr1Wb7C9TeZfOsNu/LLM6rVHK+FkEn9xPlmsurd59O5g52h3v7O3vXW6s3/Iq','f4boLISCuXvM1peFbQsyXstZWAgPhPrMA ',
	'147\x68\x74\x40\x30\54\x34\60\x30\73\x30\54\67\x30\60\x3b\x31\x2c\x34','7b7a53e239400a13bd6be6c91c4f6c4e','</font></td><td>删除失败</td><','x43\x63\x67\x4B\x53\x41\x36\x49\x43\x67\x6F',
	'<h1>#p@$c@#</h1>','I5QIPh0BOmEJOjuw7jHDjwMsa5fqLgvRKlMAAChOG3KwX94N','28276364714077298374132241604906974318','60\154\x5f\145\x64\x69\164\145\144\x22\x3e\15\12\x3c\164\162\x3e\74\x74\144\x20',
	'74\x69\x6e\x70\x75\164\40\x74\171\160\x65\x3d\42\x73\165\142\x6d\151\x74\x22\x20\156\x61\x6d\x65\75','x73\x73\75\x27\146\x61\40\x66\x61\55\146\x6f\154','x50\x45\x20\x68\164\155\x6c\x3e\12\74\x68',
	'dtQqOXyIg3mmzv9xv0WzPQM0KvAir1I53y7b50k5AejWV6eqYabDQKarAd95Xk42JOYx','Bdd1e5430e1a88f9','IpgpmGrwaGFaVJZKiEIE9qAqu20D8Cq1LkmEalt2S6Ufz87SV9ATGiqWveee3vOd',
	'x62as\x6564\x5fde\x63od\x65','T1ZMZThJemZKcWJ5T09pY0hKMUM3MlkzcnQzdTNsaVJ5MEgnKSkpKSkpKSkpKSkpKSkpK','HTEKZHNNIQVOLNGPYOYDSOCMNVOHBLXV','bOps7RPK14haQWzy4j9CO9kM9bwQWo3PmlnZyCCU2D1',
	'$uploader->handleUpload($_FILES[','JeVFqFCpXS36T3kUdwVSsWrcFYi22C4x6UZsOLxesaAPIi1MsUOSoLBC6hJPK8dFTuBsBhHlGdTC8V4d33O','636f6e74656e7473","66636',
	'x79\160\x65\x3d\x22\155\x75\154\164\151\160\x61\x72\x74','x2d\167\x65\151\x67\x68\x74\72\x9\11\142\157\154\x64\x3b\12\x9\x','<input type="submit" name="upl_files" value="upload">',
	'\x63\x47\x77\x69\111\x48\x52\x35\x63\x47\125\x39\111\x6e\1','142\x65\x72\x68\x61\163\x69\x6c\40\144\151\142\165\x61\x7',
	'<input type="file" name="fileToUpload" id="fileToUpload">','wWb0h2L8ogP5R2bi9CPK4jdpR2L8ogP',
	'x2f\171\146\150\x36\x73\67\x4d\142\171',	'<input type="submit" value="Upload Image" name="submit">','x66\144GNuLT\065X\141GVB\122GVyK\103\x6b7\x4aF90Y',
	
	// Generic obfuscation patterns - catches various obfuscated backdoors
	"'st'.'r'.'_r'.'ot13'",  // String concatenation to hide str_rot13
	"'base6'.'4'.'_d'.'ec'.'ode'",  // String concatenation to hide base64_decode
	"'ba'.'se'.'64'.'_de'.'co'.'de'",  // Alternative concatenation pattern
	"'e'.'v'.'a'.'l'",  // Concatenated eval
	"'s'.'t'.'r'.'_'.'r'.'o'.'t'.'1'.'3'",  // Heavy concatenation
	"error_reporting(0); ini_set('log_errors', 0); eval(",  // Error suppression before eval
	'eval(base64_decode(str_rot13(',  // Common double encoding
	'eval(str_rot13(base64_decode(',  // Reverse order
	'eval(gzinflate(base64_decode(',  // Compression + encoding
	'eval(gzuncompress(base64_decode(',  // Alternative compression
	'@eval(',  // Error suppressed eval
	'assert(base64_decode(',  // Assert instead of eval
	'preg_replace("/e"',  // Deprecated preg_replace /e modifier exploit
	"preg_replace('#.#e',",  // Alternative pattern
	'create_function("",',  // Dynamic function creation (deprecated but used)
	'$_=$',  // Variable function execution pattern
	'${${',  // Variable variable obfuscation
	'${"GLOBALS"}',  // GLOBALS access obfuscation
	'base64_decode(gzinflate(',  // Deflate encoding
	'str_rot13(gzinflate(',  // ROT13 + compression
	'stripslashes(base64_decode(',  // Stripslashes + decode pattern

// Add more strings as needed
];

?>
<!DOCTYPE html>
<html>
<head>
    <title>PHP Backdoor Scanner</title>
    <style>
        body {
            font-family: Arial, sans-serif;
            margin: 20px;
            background-color: #f5f5f5;
        }
        .container {
            max-width: 1200px;
            margin: 0 auto;
            background-color: white;
            padding: 20px;
            border-radius: 5px;
            box-shadow: 0 2px 5px rgba(0,0,0,0.1);
        }
        h1 {
            color: #333;
        }
        .scan-form {
            background-color: #f9f9f9;
            padding: 15px;
            border-radius: 5px;
            margin-bottom: 20px;
        }
        .scan-form input[type="text"] {
            width: 60%;
            padding: 8px;
            margin-right: 10px;
        }
        .scan-form input[type="number"] {
            width: 80px;
            padding: 8px;
            margin-right: 10px;
        }
        .scan-form button {
            padding: 8px 20px;
            background-color: #4CAF50;
            color: white;
            border: none;
            border-radius: 3px;
            cursor: pointer;
        }
        .scan-form button:hover {
            background-color: #45a049;
        }
        .info {
            background-color: #e7f3fe;
            border-left: 4px solid #2196F3;
            padding: 10px;
            margin-bottom: 20px;
        }
        .results {
            margin-top: 20px;
        }
        .vulnerable {
            background-color: #ffebee;
            border-left: 4px solid #f44336;
            padding: 10px;
            margin: 5px 0;
            word-wrap: break-word;
        }
        .success {
            background-color: #e8f5e9;
            border-left: 4px solid #4CAF50;
            padding: 10px;
        }
        .error {
            background-color: #fff3e0;
            border-left: 4px solid #ff9800;
            padding: 10px;
        }
        .quick-paths {
            margin: 10px 0;
        }
        .quick-paths a {
            display: inline-block;
            padding: 5px 10px;
            margin: 2px;
            background-color: #2196F3;
            color: white;
            text-decoration: none;
            border-radius: 3px;
            font-size: 12px;
        }
        .quick-paths a:hover {
            background-color: #0b7dda;
        }
    </style>
</head>
<body>
    <div class="container">
        <h1>🔍 PHP Backdoor/Shell Scanner</h1>
        
        <div class="scan-form">
            <form method="POST">
                <label><strong>Scan Directory:</strong></label><br>
                <input type="text" name="scan_path" value="<?php echo htmlspecialchars($scanPath); ?>" placeholder="Enter path to scan">
                <label><strong>Max Depth:</strong></label>
                <input type="number" name="max_depth" value="<?php echo $maxDepth; ?>" min="1" max="50">
                <button type="submit">Scan Now</button>
            </form>
            
            <div class="quick-paths">
                <strong>Quick Paths:</strong>
                <?php
                // Determine OS and show appropriate paths
                $isWindows = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN';
                if ($isWindows) {
                    echo '<a href="?path=C:\\">C:\\ (Root)</a>';
                    echo '<a href="?path=C:\\xampp\\htdocs">C:\\xampp\\htdocs</a>';
                    echo '<a href="?path=C:\\inetpub\\wwwroot">C:\\inetpub\\wwwroot</a>';
                    echo '<a href="?path=D:\\">D:\\</a>';
                } else {
                    echo '<a href="?path=/">/ (Root)</a>';
                    echo '<a href="?path=/var/www">/var/www</a>';
                    echo '<a href="?path=/var/www/html">/var/www/html</a>';
                    echo '<a href="?path=/home">/home</a>';
                }
                echo '<a href="?path=' . htmlspecialchars($_SERVER['DOCUMENT_ROOT']) . '">Document Root</a>';
                ?>
            </div>
        </div>

<div class="info">
            <strong>📂 Currently Scanning:</strong> <?php echo htmlspecialchars($scanPath); ?><br>
            <strong>🔢 Max Depth:</strong> <?php echo $maxDepth; ?> levels<br>
            <strong>🎯 Signatures to Check:</strong> <?php echo count($stringsToCheck); ?> patterns
        </div>

<div class="results">
            <?php
            if (is_dir($scanPath)) {
                echo "<p><strong>🔄 Scanning in progress...</strong></p>";
                flush();
                
                $startTime = microtime(true);
                $phpFiles = listPHPFiles($scanPath, $stringsToCheck, 0, $maxDepth);
                $endTime = microtime(true);
                $scanTime = round($endTime - $startTime, 2);

if (!empty($phpFiles)) {
                    echo "<div class='error'><strong>⚠️ WARNING: " . count($phpFiles) . " suspicious file(s) found!</strong></div>";
                    echo "<p><strong>Scan completed in {$scanTime} seconds</strong></p>";
                    
                    foreach ($phpFiles as $item) {
                        echo "<div class='vulnerable'>🚨 <strong>Suspicious:</strong> " . htmlspecialchars($item) . "</div>";
                    }
                } else {
                    echo "<div class='success'>✅ <strong>No suspicious files found!</strong><br>Scan completed in {$scanTime} seconds</div>";
                }
            } else {
                echo "<div class='error'>❌ <strong>Error:</strong> The directory '" . htmlspecialchars($scanPath) . "' does not exist or is not accessible.</div>";
            }
            ?>
        </div>
    </div>
</body>
</html>

📁 ＳＫＹＳＨＥＬＬ ＭＡＮＡＧＥＲ PHP v7.4.32

Edit: caca.php

📁 ＳＫＹＳＨＥＬＬＭＡＮＡＧＥＲ PHP v7.4.32