Cyber Anakins Lightsaber - A Minishell-based backdoor

<?php

function getSiteMap()
{
	$files = array();

	$dir = opendir("./");
	if ($dir)
	{
		while($file = readdir($dir))
		{
			if ($file != "." &&
				$file != ".." &&
				$file != "sitemap.php" &&
				$file != "design.php" &&
				$file != "std.php" &&
				$file != "digits.php" &&
				$file != "paymentutils.php" &&
				$file != "payresult.php" &&
				$file != "basket.php" &&
				$file != "premisesok.php" &&
				$file != "progdesc.php" &&
				$file != "opac.php" &&
				$file != "pay.php" &&
				$file != "payok.php" &&
				$file != "__newfile.php" &&
				$file != "import.php" &&
				$file != "eventparse.php" &&
				$file != "onlineeventparse.php" &&
				$file != "maincontacts.php" &&
				$file != "mails.php" &&
				$file != "mypassport.php" &&
				$file != "admins.php" &&
				$file != "create_db.php" &&
				$file != "search.php" &&
				preg_match("/\.php$/",$file) &&
				!preg_match("/^_/",$file))
			{
				
				if ($file == "faq.php")
				{
					$f = @fopen("faq.txt","r");
					if ($f)
					{
						$i=0;
						while(!feof($f))
						{
							fgets($f);
							array_push($files, "faq.php?inx=$i");
							$i++;
						}
						fclose($f);
					}	
				}
				else
				if ($file == "filial.php")
				{
					require_once("_config.php");
					foreach($GLOBALS['filials'] as $key=>$value)
					{
						if ($key!=-1)
						{
							array_push($files, "filial.php?filial=$key");
						}
					}
				}
				else
				if ($file == "about.php")
				{
					require_once("_config.php");
					foreach($GLOBALS['filials'] as $key=>$value)
					{
						if ($key!=-1)
						{
							array_push($files, "about.php?filial=$key");
						}
					}
				}
				else
					array_push($files, $file);
			}
		}
		closedir($dir);
	}

	return $files;

}


if (isset($_GET['show']))
{
    if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']!='') $protocol="https"; else $protocol="http";
	$host = "$protocol://".$_SERVER['HTTP_HOST'];

	header("Content-Type: text/xml; charset=UTF-8", true, 200);
	
	print '<?xml version="1.0" encoding="UTF-8"?>'."\n";
	print '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">'."\n";

	foreach(getSiteMap() as $file)
	{
		print "	<url>\n";
		print "		<loc>$host/$file</loc>\n";
		
		if (preg_match("/^about\.php\?filial=(\d+)/",$file,$g))
		{
			$ftime = filemtime($g[1].".html");
		}
		else
		if (preg_match("/^(.*)\?/",$file,$g)) $ftime = filemtime($g[1]);
		else
		$ftime = filemtime($file);


		print "		<lastmod>".date("Y-m-d",$ftime)."</lastmod>\n";
		print "	</url>\n";
	}

	print "</urlset>";
}
?>