+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.ly/Forum-Hacking-Tools)
+--- Thread: snodew2, PHP root reverse shell backdoor (/Thread-snodew2-PHP-root-reverse-shell-backdoor)
snodew2, PHP root reverse shell backdoor - tranquil - 04-26-2020
3 years ago, i released https://github.com/mempodippy/snodew & when i released this, vlany ( https://github.com/mempodippy/vlany ) was my main focus at the time.
both were designed with each other in mind. snodew depended on vlany however when it came to remaining undetectable, hidden & maintaining backdoor access.
there were/are a lot of issues with both projects.
so my most recent release, snodew2, aims to fix a lot of the issues that its original presented.
you can view it & install it from here: https://github.com/naworkcaj/snodew2
here are some example images of an installation
result of successful installation:
Spoiler:
visiting newly created & hidden php script:
Spoiler:
getting the reverse shell from the kitted box:
Spoiler:
enjoy,
feedback appreciated
pce
RE: snodew2, PHP root reverse shell backdoor - mothered - 04-26-2020
Very Impressive Indeed, and quite damaging for someone with malicious Intent.
Did you write this entirely on your own?
RE: snodew2, PHP root reverse shell backdoor - tranquil - 04-26-2020
(04-26-2020, 09:42 AM)mothered Wrote: Very Impressive Indeed, and quite damaging for someone with malicious Intent.
Did you write this entirely on your own?
yeah, i did. albeit i used some code from my previous projects, and in creating this, discovered more that i could add to my current rootkit project, i.e. only breaking ss if there's a hidden port being used at the time of the calling process being launched.
i'm not sure what else i can add to it... but i don't want to add too much to this. my main focus really, in this project, is security i guess, when it comes to the iswww() function. since in the previous iteration of this project i believe it was quite easy to 'pretend' to be the target service user so that you can see all of the hidden rootkit files.
i was thinking of using one of those public web shells with fully fledged ui, for the php script... but idk. i think those are pretty lame, but my argument against that atm is that they're accessible. maybe i could have a host of scripts to choose from, at some point. that's an idea for me to note down somewhere.
additionally, i need to look a bit more into how the services write their access logs. i've hooked write() so that it breaks itself upon detecting the php script's filename in its buf, but that's all i've done in an effort to prevent log writing when viewing the php script on the server after installation. kinda sucky, as far as 'anti-logging' goes.
RE: snodew2, PHP root reverse shell backdoor - mothered - 04-26-2020
(04-26-2020, 09:52 AM)tranquil Wrote:(04-26-2020, 09:42 AM)mothered Wrote: Very Impressive Indeed, and quite damaging for someone with malicious Intent.
Did you write this entirely on your own?
yeah, i did. albeit i used some code from my previous projects, and in creating this, discovered more that i could add to my current rootkit project, i.e. only breaking ss if there's a hidden port being used at the time of the calling process being launched.
i'm not sure what else i can add to it... but i don't want to add too much to this. my main focus really, in this project, is security i guess, when it comes to the iswww() function. since in the previous iteration of this project i believe it was quite easy to 'pretend' to be the target service user so that you can see all of the hidden rootkit files.
i was thinking of using one of those public web shells with fully fledged ui, for the php script... but idk. i think those are pretty lame, but my argument against that atm is that they're accessible. maybe i could have a host of scripts to choose from, at some point. that's an idea for me to note down somewhere.
additionally, i need to look a bit more into how the services write their access logs. i've hooked write() so that it breaks itself upon detecting the php script's filename in its buf, but that's all i've done in an effort to prevent log writing when viewing the php script on the server after installation. kinda sucky, as far as 'anti-logging' goes.
Excellent work. I've given you a few green apples for your effort.
I'm planning to delve Into the script this week.
RE: snodew2, PHP root reverse shell backdoor - tranquil - 04-26-2020
(04-26-2020, 09:59 AM)mothered Wrote:(04-26-2020, 09:52 AM)tranquil Wrote:(04-26-2020, 09:42 AM)mothered Wrote: Very Impressive Indeed, and quite damaging for someone with malicious Intent.
Did you write this entirely on your own?
yeah, i did. albeit i used some code from my previous projects, and in creating this, discovered more that i could add to my current rootkit project, i.e. only breaking ss if there's a hidden port being used at the time of the calling process being launched.
i'm not sure what else i can add to it... but i don't want to add too much to this. my main focus really, in this project, is security i guess, when it comes to the iswww() function. since in the previous iteration of this project i believe it was quite easy to 'pretend' to be the target service user so that you can see all of the hidden rootkit files.
i was thinking of using one of those public web shells with fully fledged ui, for the php script... but idk. i think those are pretty lame, but my argument against that atm is that they're accessible. maybe i could have a host of scripts to choose from, at some point. that's an idea for me to note down somewhere.
additionally, i need to look a bit more into how the services write their access logs. i've hooked write() so that it breaks itself upon detecting the php script's filename in its buf, but that's all i've done in an effort to prevent log writing when viewing the php script on the server after installation. kinda sucky, as far as 'anti-logging' goes.
Excellent work. I've given you a few green apples for your effort.
I'm planning to delve Into the script this week.
there isn't much to the php script itself. i used to be fairly knowledgeable when it came to working with php, but i'm more or less clueless when it comes to it now. i know the ins and outs, but know nothing about standard functions or variables. unless i'm looking it up on the man pages lmao.
if you should have any suggestions or feedback of any kind, don't hesitate to give me a message, i'd love to hear it.
RE: snodew2, PHP root reverse shell backdoor - mothered - 04-26-2020
(04-26-2020, 10:51 AM)tranquil Wrote:(04-26-2020, 09:59 AM)mothered Wrote:(04-26-2020, 09:52 AM)tranquil Wrote: yeah, i did. albeit i used some code from my previous projects, and in creating this, discovered more that i could add to my current rootkit project, i.e. only breaking ss if there's a hidden port being used at the time of the calling process being launched.
i'm not sure what else i can add to it... but i don't want to add too much to this. my main focus really, in this project, is security i guess, when it comes to the iswww() function. since in the previous iteration of this project i believe it was quite easy to 'pretend' to be the target service user so that you can see all of the hidden rootkit files.
i was thinking of using one of those public web shells with fully fledged ui, for the php script... but idk. i think those are pretty lame, but my argument against that atm is that they're accessible. maybe i could have a host of scripts to choose from, at some point. that's an idea for me to note down somewhere.
additionally, i need to look a bit more into how the services write their access logs. i've hooked write() so that it breaks itself upon detecting the php script's filename in its buf, but that's all i've done in an effort to prevent log writing when viewing the php script on the server after installation. kinda sucky, as far as 'anti-logging' goes.
Excellent work. I've given you a few green apples for your effort.
I'm planning to delve Into the script this week.
there isn't much to the php script itself. i used to be fairly knowledgeable when it came to working with php, but i'm more or less clueless when it comes to it now. i know the ins and outs, but know nothing about standard functions or variables. unless i'm looking it up on the man pages lmao.
if you should have any suggestions or feedback of any kind, don't hesitate to give me a message, i'd love to hear it.
No worries at all.
Juggling between work commitments and personal computing tasks, I'll endeavor to check It out this week.
RE: snodew2, PHP root reverse shell backdoor - tranquil - 04-28-2020
shameful self-bump, but i've added a fair amount of work recently to this project.
the reverse shell that snodew2 came with is no longer just a shitty non-interactive reverse shell. there are now 3 options of shell to choose from.
on top of that, considering the point above, snodew2's reverse shell can now support encryption by SSL! @mothered i thought this might interest you a lil.
RE: snodew2, PHP root reverse shell backdoor - mothered - 04-28-2020
(04-28-2020, 12:59 PM)tranquil Wrote: @mothered i thought this might interest you a lil.
I certainly am Interested.
I'm quite busy with work commitments this week, but will check It out on the weekend.
Thanks for quoting me.