EVERY C99 / C99.PHP SHELL IS BACKDOORED (A.K.A. FREE SHELLS FOR EVERYONE!)

最新推荐文章于 2023-03-02 17:11:57 发布

cnbird2008

最新推荐文章于 2023-03-02 17:11:57 发布

阅读量1.2k

点赞数

http://thehackerblog.com/every-c99-php-shell-is-backdoored-aka-free-shells/

Earlier I made a post calling out the wrong people for backdooring the C99.php shell hosted on r57.gen.tr. They look to possibly be only exploiting an already existing vulnerability in the C99 shell. The truth is the C99 shell is just plain backdoored. I’d apologize but the JavaScript tracking on their distributed shells is still pretty sketchy so I have a feeling they are aware of the backdoor.

For those who missed it, the C99 shell has a backdoor due to a vulnerability in the use of theextract() command.

The vulnerable lines:

 
         1 
       
         2 
       
         3 
       
         4 
       
         5 
       
         6 
       
         7 
       
         8 
       
         9 
       
         10 
       
         11 
       
         12 
       
         13 
       
         14 
       
         15 
       
         16 
       
        //Highlight-code colors 
       
        $ 
        highlight_background 
          
        = 
         " 
        #c0c0c0"; 
       
        $ 
        highlight_bg 
                  
        = 
         " 
        #FFFFFF"; 
       
        $ 
        highlight_comment 
             
        = 
         " 
        #6A6A6A"; 
       
        $ 
        highlight_default 
             
        = 
         " 
        #0000BB"; 
       
        $ 
        highlight_html 
                
        = 
         " 
        #1300FF"; 
       
        $ 
        highlight_keyword 
             
        = 
         " 
        #007700"; 
       
        $ 
        highlight_string 
              
        = 
         " 
        #000000"; 
       
        @ 
        $ 
        f 
          
        = 
          
        $ 
        _REQUEST 
        [" 
        f" 
        ] 
        ; 
       
        < 
        strong 
        > 
        @ 
        extract 
        ( 
        $ 
        _REQUEST 
        [" 
        c99shcook" 
        ] 
        ) 
        ; 
        < 
        / 
        strong 
        > 
       
        //END CONFIGURATION 
       
        // \/ Next code isn't for editing \/ 
       
        $ 
        tmp 
          
        = 
          
        array 
        ( 
        ) 
        ;

This line allows you to overwrite any variable using an array:

 
         1 
       
        @ 
        extract 
        ( 
        $ 
        _REQUEST 
        [" 
        c99shcook" 
        ] 
        ) 
        ;

Which is weirdly right over this code:

 
   
 
 
  
         1 
       

         2 
       

         3 
       

         4 
       

         5 
       

         6 
       

         7 
       

         8 
       

         9 
       

         10 
       

         11 
       

         12 
       

         13 
       

         14 
       

         15 
       
 
        if 
          
        ( 
        $ 
        login 
        ) 
          
        { 
       
 
             
        if 
          
        ( 
        empty 
        ( 
        $ 
        md5_pass 
        ) 
        ) 
          
        { 
       
 
                 
        $ 
        md5_pass 
          
        = 
          
        md5 
        ( 
        $ 
        pass 
        ) 
        ; 
       
 
             
        } 
       
 
             
        if 
          
        ( 
        ( 
        $ 
        _SERVER 
        [" 
        PHP_AUTH 
        _USER" 
        ] 
          
        != 
          
        $ 
        login 
        ) 
          
        or 
          
        ( 
        md5 
        ( 
        $ 
        _SERVER 
        [" 
        PHP_AUTH 
        _PW" 
        ] 
        ) 
          
        != 
          
        $ 
        md5_pass 
        ) 
        ) 
          
        { 
       
 
                 
        if 
          
        ( 
        $ 
        login_txt 
          
        === 
          
        false 
        ) 
          
        { 
       
 
                     
        $ 
        login_txt 
          
        = 
         "" 
        ; 
       
 
                 
        } 
          
        elseif 
          
        ( 
        empty 
        ( 
        $ 
        login_txt 
        ) 
        ) 
          
        { 
       
 
                     
        $ 
        login_txt 
          
        = 
          
        strip_tags 
        ( 
        ereg_replace 
        (" 
        & 
        amp 
        ; 
        nbsp 
        ; 
        | 
        & 
        lt 
        ; 
        br 
        & 
        gt 
        ;" 
        , 
         " 
         " 
        , 
          
        $ 
        donated_html 
        ) 
        ) 
        ; 
       
 
                 
        } 
       
 
                 
        header 
        (" 
        WWW 
        - 
        Authenticate 
        : 
          
        Basic  
        realm 
        = 
        \" 
        c99shell 
         " 
          
        . 
          
        $ 
        shver 
          
        . 
         " 
        : 
         " 
          
        . 
          
        $ 
        login 
        _txt 
          
        . 
         " 
        \"" 
        ) 
        ; 
       
 
                 
        header 
        (" 
        HTTP 
        / 
        1.0 
          
        401 
          
        Unauthorized" 
        ) 
        ; 
       
 
                 
        exit 
        ( 
        $ 
        accessdeniedmess 
        ) 
        ; 
       
 
             
        } 
       
 
        } 
       
 
 