In the beginning (php shells)

In a galaxy far, far away….

I probably should have written this before the previous post but hey, if George Lucas can do it with Star Wars then I think I can wangle it on a blog post or two. Not that I’m comparing myself to old Mr. Lucas or anything….

So…PHP shells.

I have to thank Barry Irwin (@barryirwin) for most of the samples I now have in my collection. I had come across various shells in my ramblings around the Internet but it’s only while working on various phishing cases (I used to work for a large financial) that I came into a much wider variety.

The basic premise behind a PHP shell is to give a remote attacker a certain degree of control over a victim web server. There seem to be two common ways to “get shell” on a web server.

1. Compromised FTP credentials
2. A really crappy version of Joomla/WordPress/Pick your favourite CMS
3. Remote file include vulnerabilities (see #2)

So if you see things like this in your web server log files, start worrying:

But we’re getting a little ahead of ourselves. We know a PHP shell is for remotely “controlling” a web server but what is it in detail ?

Most of the shells I have come across are a single PHP file, usually under 200Kb in size. The file is then interpreted by the web server as a PHP file giving the attacker functions such as (but by no means limited to):

• Uploading file
• Changing permissions on exiting files
• A simple “command line” to run commands on
• A simple but effective file browser

The interface will look something like this:

As you can see the interface is pretty intuitive and gives loads of useful information about the target machine.

By simply clicking on a few buttons or typing the odd command, you can execute commands and create directories and files to your hearts content. But there’s a catch !! (It’s not a very big catch at the end of the day). You can only execute commands etc. with the privileges of the user that the web server is running as (usually apache/www-data/vpsserveruseraccount).

However, that’s not going to stop the attacker running netcat (which is on just about ever version of *nix out there) on a high port (above 1024) and making a shell available on the local server. From there it’s trivial to escalate privileges from nobody to root. But that’s a story for another day.

Some of the more malicious shells include things like backdoors coded in C or Perl which drop a little backdoor onto the system. This will either allow the attacker to connect directly to a port running a basic shell or sorts, or failing that, a reverse shell out to a server that is under the attackers control.

More malicious “plugins” include things like:

• FTP/SSH brute forcers
• MySQL / Database frontends

You’re only really limited by what you can code in PHP…

Obfuscation

Another trend that I’ve seen in a few of the more “31337″ shells is the use of obfuscation within the code. What happens is that instead of a plain old PHP file, they will use the built in functions within PHP to obfuscate the code contained within. All this is at the end of the day are simple gzip or base64 encodings of the code (or a fun combination of the two). I’m not entirely sure why this happens. It can’t be for IDS evasion as the code is still interpreted and sent in the clear. It may be for server side anti-virus evasion, but this seems unlikely as well. If anyone knows the reasoning behind this, please get in touch…

Here’s an example of some of the obfuscation I’ve seen…

Decoding these samples is fairly straight forward so I won’t bore you with the details here again

So, to wrap it all up, we have a simple PHP file that somehow lands up on a web server, giving the attacker a very easy to use interface to “manage” a web server. In my experience, I’ve only really seen these shells in use with phishing sites. One has to ask if it’s all part of the fraud ecosystem and if so, how it all fits together…but that’s a story for the sequel…or prequel perhaps…I don’t know…I don’t have a decent Jar-Jar character to ruin it all with…

Google, spammers and a malicious PDF

Launch Action type

Get z0nbi to Brucon

Ok..here’s my little plea for help

I’m hoping to go to Brucon this year due to a fluff with $airline previously. This was all going well, flights booked, travel from London to Brussels kind of planned, only one last thing to sort out…the ticket.

Now I thought it was going to be easy to pay for the Brucon ticket. Simply walk into $bank, say “I’d like to pay money into this bank account please” and it’s done. Alas because of fraud in our beloved country, I need an invoice as proof of said conference. Alas Brucon doesn’t provide invoices for the basic ticket which I have bought (mostly because I’m broke and can’t afford the business ticket). So I have no way to pay for $ticket.

So, this is my plea to anyone going to #Brucon who currently resides somewhere where it’s not a pain in the ass to pay the Brucon organizers:

1. Can I paypal you the fee of 150Euro for the ticket and you purchase the ticket on my behalf ?

2. Can you purchase said ticket for me and I will pay you le cash when I get to Belgium ?
(beers will be purchased as an extra “thanks for being awesome to a lonely .za hacker)

I know it’s a lot to ask but I really want to get across to Brucon this year…

If you’re keen to help out, please get hold of me…

Thanks

@z0nbi

WMIC, the other OTHER white meat.

So while I’m busy with the PDF article I’ve been writing and researching for the last couple of days I thought I’d chuck this out there.

WMIC or Windows Management Instrumentation Command-line was introduced with Windows XP and the Windows 2003 server family of operating systems.
What this allows a user to do is run various system admin commands from the command line. The kicker here is that not only can they be run on the local machine but with the /node switch, you can run commands on remote machines. While you can argue that you can do similar things with psexec, I am not here to argue. That and you have to download psexec..WMIC comes with Windows…woot !

So what exactly can you do with WMIC ?

The list is only really limited by your imagination and knowledge of WMIC and it’s various switches. The one main problem is that the documentation is fairly thin on the ground. Ed Skoudis has a really great webcast called Essential Windows Command-Line Kung Fu for Info Sec Pros which you can check out HERE…

Other than that and a fairly large amount of Googling, I’ve come up with this not altogether complete list of coolness:

Installed Applications –
wmic product list brief

List installed Patches –
wmic qfe list

List local drives –
wmic logicaldisk get caption,description,providername

Examine Auto Start Processes –
wmic /node: /user: startup list full

Find who is logged on to a computer –
wmic /node: /user: ComputerSystem Get UserName

Local user accounts –
wmic /node: /user: useraccount list full

Local group accounts –
wmic group list

OS summary –
wmic os get name, servicepackmajorversion

List printers –
wmic printer list status

Kill a process –
WMIC PROCESS where name=’evil.exe’ delete

NIC and IP address in use –
wmic nicconfig where IPEnabled=’true’

Change NIC to DHCP –
wmic /node:machinename nicconfig where Index=1 call EnableDHCP

Get shares –
wmic share list brief

Get processes that aren’t running from %WINDOWS% –
wmic PROCESS WHERE “NOT ExecutablePath LIKE ‘%Windows%’” GET ExecutablePath

Some of these can be very useful, especially when you’re running an assessment. I know there are a bunch more out there but I leave it to you
to find them. Mostly because I now wake up screaming Google at night and I need a break. If you find anything particularly neat, please hit me up and I’ll add it to my list.

Someone should really create a Wiki for Info-Sec stuff…just throwing that out there

Peas…

PHP Shells: Obfuscation

So I’ve been doing some work on phishing sites of late and what usually accompanies a phishing site are the tools the hackers/crackers have used to “admin” the site. What usually happens (and feel free to correct me if I’m wrong) is a site will get compromised through sql injection/remote file include/local file include/$x and a “shell” will be loaded onto the web root somewhere. Of the samples I’ve found most are of the C99 or R57 variety with the odd “special” sample every now and again.

It’s the custom “special” samples as well as the more modified C99 samples that seem to have a little more “added” to them but that’s a story for another time. Let’s just say that you
wouldn’t want to a. have them running on your site or b. run them on a public facing “testing” server as they tend to be a little more mouthy than most of the vanilla PHP shells I’ve found.

But the whole point of this post is to explore the obfuscation being used in some of the samples. Way back when (not too long ago really), the shells I found were just plain old PHP scripts which allowed remote admin “access” to the server they were running on. Plain and (fairly) simple really. Upload the script and get the web server to run it and you had a fairly rudimentary shell on the server.

Lately though the shells have been obfuscating either pieces of their code or their entire code base, hiding their true nature. Now I thought this may have been to hide from things like WAFs or server side script checks but would that really work if the code is being parsed when the attacker reads the page in question ? I don’t think so…

Most of the samples I’ve found use either gzip compression or base64 encoding or a fun combination of the two to get the job done. Mostly this is because both methods are built into PHP or take very little work to get installed on most modern web servers. The resulting PHP code looks something like this:

As can be seen in this sample (truncated of course) the attackers have used a combination of gzip and base64 to hide their code. It’s fairly clear that someone looking at this code would really know what’s going on. I’d hazard a guess that even a trained “web developer” would look at this and go “wow..they’re compressing their code, it must be good stuff” and be on their merry little way. Or perhaps that’s just me being cynical…

All of the other samples I have are just variations of this theme…

So Jim, would you like to see what’s behind curtain number pwn ?

I’ve always been a fan of running code of malicious intent within virtual machines just to see what it does. This isn’t really possible or fun in this case. But @barryirwin did make a very good point in that it’s only a matter of time before a more malicious attackers leaves a fun little logic bomb in their PHP code that “explodes” unless it’s run under the right circumstances (Apache web server with PHP etc…). Still, how do we get to that obfuscated code ? It’s something I’ve been messing around with and I believe I’ve come right with. If you don’t think so, please let me know…I’d love some input on this one…

So let’s take the example code of:

PHP

eval(base64_decode(“CmVjaG8gIjwhLS0gdGhlIGJ1bm55IGlzIHJ1…
…

/PHP

What I’ve done is this…

PHP

$myFile = “myplaintext.txt”;

$fh = fopen($myFile, ‘w’) or die(“can’t open file”); # open that file for writing

$data = base64_decode(“CmVjaG8gIjwhLS0gdGhlIGJ1bm55IGlzIHJ1… # note the slight change from eval to $data

fwrite($fh, $data); # write decoded data out to my file handler variable

fclose($fh); # close file / clean up

/PHP

I then run this modified file through the PHP command line parser like so:

/usr/bin/php leetshell.php

What this does is leave me with a plain text file “myplaintext.txt” in the same working directory which should then be the decoded PHP script file. I can then look through this script file for other goodies like backdoors etc…

Fairly simple yes ? If there is a better/safer way of doing this, please let me know…

Hopefully this post has shed a little light on a fairly simple topic. PHP shells are still pretty prolific, certainly in the research I’ve been doing. With the prevalence of LAMP/WAMP stacks out there, as well as dodgy copies of Joomla/WordPress/$CMS I don’t seem them going away any time soon.

A big thanks to Barry Irwin/@barryirwin for pointers/you’re an idiot/sample files …