Cyber Anakins Lightsaber - A Minishell-based backdoor

<?php
require("design.php");


if (isset($_GET['s']))
{
	function SearchInFile($file, $searchMask)
	{
		$url = "https://xn--80abaeoqbbrbgf8aea5a2a2z.xn--p1ai/$file";
		
		$f = @fopen($url,"r");
		if (!$f) return;
		$body = "";
		while(!feof($f))
		{
			$body .= fread($f, 64000);
		}
		fclose($f);

		$url = "https://библиотекикоролёва.рф/$file";

		$header = "";
		if (preg_match("|<h1[^>]*>(.*)</h1>|",$body,$g))
		{
			$header = preg_replace("|<[^>]+>[\w\W]*</[^>]+>|","", $g[1]).":";
		}

		$body = preg_replace("/[\r\n]/", " ", $body);
		$body = preg_replace("/<style>.*?<\/style>/", "", $body);
		$body = preg_replace("/<script>.*?<\/script>/", "", $body);
		$body = preg_replace("/.*class=mainColumn>/", "", $body);
		$body = preg_replace("/<div id=middleColumn.*$/", "", $body);
		$body = preg_replace("/<td[^>]+class=rightColumn.*/", "", $body);
		$body = preg_replace("/<td[^>]+class=footer.*/", "", $body);
		$body = preg_replace("/<[^>]+>/", "", $body);


		if (preg_match($searchMask, $body, $g))
		{
			$text = $g[1];
			if (strlen($text) > 200) $text = substr($text, 0,200);
			print "<li style='margin-bottom:10'><b>$header</b>...$text....<br><a href='$url'>$url</a></li>\n";
			return true;
		}
		return false;
	}

	function SearchInForum($search)
	{
		$mysql = mysqlopen();

		
		$words = preg_split("/\s+/",$search);

		$sql = "";

		foreach($words as $word)
		{
			if ($sql!="") $sql.=" OR ";
			$word = mysqli_escape_string($mysql, $word);
			$sql.="(`subject` like '%$word%') OR (`text` like '%$word%')";
		}

		$result = mysqli_query($mysql, "SELECT `id`,`parent` FROM libForum WHERE $sql");
		if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
		$res = false;
		while($row = mysqli_fetch_row($result))
		{
			$id= $row[0];
			$parent = $row[1];
			if ($parent!=0) $id = $parent;
			$res = true;

			$url = "forum.php?msg=$id#msg";
			print "<li style='margin-bottom:10'><b>Форум</b><br><a href='$url'>$url</a></li>\n";
		}
		mysqli_free_result($result);
		return $res;
	}


	function SearchInEvents($search)
	{
		$mysql = mysqlopen();

		
		$words = preg_split("/\s+/",$search);

		$sql = "";

		foreach($words as $word)
		{
			if ($sql!="") $sql.=" OR ";
			$word = mysqli_escape_string($mysql, $word);
			$sql.="(`title` like '%$word%') OR (`desc` like '%$word%')";
		}

		$result = mysqli_query($mysql, "SELECT `title`,(MONTH(`date`)-1) + YEAR(`date`) * 12 as `monthinx` FROM libEvents WHERE $sql");
		if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
		$res = false;
		while($row = mysqli_fetch_row($result))
		{
			$minx= $row[1];
			$title = _html_($row[0]);
			$res = true;

			$url = "events.php?monthinx=$minx#$minx";
			print "<li style='margin-bottom:10'><b>События:</b> $title<br><a href='$url'>$url</a></li>\n";
		}
		mysqli_free_result($result);
		return $res;
	}


	function SearchInVideos($search)
	{
		$mysql = mysqlopen();

		
		$words = preg_split("/\s+/",$search);

		$sql = "";

		foreach($words as $word)
		{
			if ($sql!="") $sql.=" OR ";
			$word = mysqli_escape_string($mysql, $word);
			$sql.="(`name` like '%$word%') OR (`desc` like '%$word%')";
		}

		$result = mysqli_query($mysql, "SELECT `id`,`name`,(MONTH(`date`)-1) + YEAR(`date`) * 12 as `monthinx` FROM libVideos WHERE $sql");
		if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
		$res = false;
		while($row = mysqli_fetch_assoc($result))
		{
			$v = $row['id'];
			$minx= $row['monthinx'];
			$title = _html_($row['name']);
			$res = true;

			$url = "video.php?month_inx=$minx#v$v";
			print "<li style='margin-bottom:10'><b>Видео:</b> $title<br><a href='$url'>$url</a></li>\n";
		}
		mysqli_free_result($result);
		return $res;
	}

	function SearchInNews($host, $searchMask)
	{
		$mysql = mysqlopen();

		$newsPerPage = 30;
		$count = 0;
		$result = mysqli_query($mysql, "SELECT COUNT(*) FROM libNews");
		if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
		if ($row = mysqli_fetch_row($result)) $count = $row[0];
		mysqli_free_result($result);


		$res = false;
		for($start=0; $start < $count; $start+=$newsPerPage)
		{
			if (SearchInFile("$host/news.php?start=$start", $searchMask)) $res = true;
		}


		return $res;
	}




	$search = trim($_GET['s']);
	if ($search!="")
	{
		require("sitemap.php");

		$search = trim(preg_replace("/[^\d\w]+/u",' ',$search));


		$searchMask = "/(".preg_replace("/\s+/",".{1,100}", $search).")/ui";
		$files = getSiteMap();
		$host = GetSiteURL();

		print "<ol style='font-size:16px'>\n";

		$found = false;
		foreach($files as $file)
		{
			if (preg_match("/video\.php/",$file))
			{
				if (SearchInVideos($search)) $found = true;
			}
			else
			if ($file == "forum.php")
			{
				if (SearchInForum($search)) $found = true;
			}
			else
			if ($file == "news.php")
			{
				if (SearchInNews($host, $searchMask)) $found = true;
			}
			else
			if ($file == "events.php")
			{
				if (SearchInEvents($search)) $found = true;
			}
			else
			{
				if (SearchInFile($file, $searchMask)) $found = true;
			}	
		}
		print "</ol>\n";

		if (!$found) print "<center>Ничего не найдено</center>";
	}
	else
		print "<center>Ничего не найдено</center>";

	exit(0);
}





$search = trim(_GET_('search'));

TOP(-1);

LEFTCOLUMN();
CHANNELS();
MAINCOLUMN();
?>


<h1>Результаты поиска</h1>
<div id=results><center><img src='formular/waiting.gif' width=128 height=128></center></div>

<script>
sendXHR('search.php?s=<?php print urlencode($search); ?>',null,
	function(response)
	{
		document.getElementById('results').innerHTML = response;	
	},
	function(error)
	{
		document.getElementById('results').innerHTML = '<center>Ошибка поиска</center>';
		errorBox(error);
	},
	null, 30000);
</script>

<br><br>
<hr>
<br>
<center>[ <a href='findbooks.php?search=<?php print urlencode($search); ?>'>Поиск книг</a> ]</center>
<Br><br>

<?php

MIDDLECOLUMN2();
print "<center><table><tr><td>";
ACTUALLINKS('actualLinksH');
print "</tr></td></table></center>";
FAQ();


MIDDLECOLUMN();
CHANNELS("channelBlockH");
RIGHTCOLUMN();

ACTUALLINKS();
FAQ();

BOTTOM(); ?>