Cyber Anakins Lightsaber - A Minishell-based backdoor

<?php


function _mail_escape($str)
{
   return '=?UTF-8?B?'.base64_encode($str)."?=";
}

function _mail_escape_callback($match)
{
	return _mail_escape($match[1])."<".$match[2].">";
}

function _ready_mail_fromto($str)
{
	return preg_replace_callback("/(.*)\s*<(.*)>/","_mail_escape_callback",$str);
}



function SendMailTo($mailto,$mail_from,$mail_subject,$message,$format_html,$attach=null)
{
	//$mail_subject = Win1251ToUTF8($mail_subject);
	//$message = Win1251ToUTF8($message);

    $headers ="MIME-Version: 1.0\n";
	$headers.="From: "._ready_mail_fromto($mail_from)."\n";
	//$headers.="To: "._ready_mail_fromto($mailto)."\n";
	$headers.="Subject: "._mail_escape($mail_subject)."\n";


	if ($attach && count($attach)>0)
	{
		$headers.="Content-Type: multipart/mixed;\n\tboundary=\"----=_NextPart_111.0\"\n";
		if ($format_html)
			$message="This is multipart message\n\n------=_NextPart_111.0\nContent-Type: text/html; charset=UTF-8\n\n$message";
		else
			$message="This is multipart message\n\n------=_NextPart_111.0\nContent-Type: text/plain; charset=UTF-8\n\n$message";

		for($i=0;$i<count($attach);$i++)
		{
			$message.="\n\n------=_NextPart_111.0\n";
			$message.="Content-Type: ".$attach[$i][0].";\n\tname=\"".$attach[$i][1]."\"\nContent-Transfer-Encoding: base64\nContent-Disposition: attachment;\n\tfilename=\"".$attach[$i][1]."\"\n\n";
			$message.=chunk_split(base64_encode($attach[$i][2]));
		}
		$message.="\n\n------=_NextPart_111.0--\n";

	}
	else
	{
		if ($format_html)
			$headers.="Content-Type: text/html; charset=UTF-8\n";
		else
			$headers.="Content-Type: text/plain; charset=UTF-8\n";
	}

   	mail($mailto,_mail_escape($mail_subject),$message,$headers);
	//return winsendmail($mail_from, $mailto, $headers . "\n". $message);
}

?>