In the beginning (php shells)

In a galaxy far, far away….

I probably should have written this before the previous post but hey, if George Lucas can do it with Star Wars then I think I can wangle it on a blog post or two. Not that I’m comparing myself to old Mr. Lucas or anything….

So…PHP shells.

I have to thank Barry Irwin (@barryirwin) for most of the samples I now have in my collection. I had come across various shells in my ramblings around the Internet but it’s only while working on various phishing cases (I used to work for a large financial) that I came into a much wider variety.

The basic premise behind a PHP shell is to give a remote attacker a certain degree of control over a victim web server. There seem to be two common ways to “get shell” on a web server.

1. Compromised FTP credentials
2. A really crappy version of Joomla/WordPress/Pick your favourite CMS
3. Remote file include vulnerabilities (see #2)

So if you see things like this in your web server log files, start worrying:

But we’re getting a little ahead of ourselves. We know a PHP shell is for remotely “controlling” a web server but what is it in detail ?

Most of the shells I have come across are a single PHP file, usually under 200Kb in size. The file is then interpreted by the web server as a PHP file giving the attacker functions such as (but by no means limited to):

• Uploading file
• Changing permissions on exiting files
• A simple “command line” to run commands on
• A simple but effective file browser

The interface will look something like this:

As you can see the interface is pretty intuitive and gives loads of useful information about the target machine.

By simply clicking on a few buttons or typing the odd command, you can execute commands and create directories and files to your hearts content. But there’s a catch !! (It’s not a very big catch at the end of the day). You can only execute commands etc. with the privileges of the user that the web server is running as (usually apache/www-data/vpsserveruseraccount).

However, that’s not going to stop the attacker running netcat (which is on just about ever version of *nix out there) on a high port (above 1024) and making a shell available on the local server. From there it’s trivial to escalate privileges from nobody to root. But that’s a story for another day.

Some of the more malicious shells include things like backdoors coded in C or Perl which drop a little backdoor onto the system. This will either allow the attacker to connect directly to a port running a basic shell or sorts, or failing that, a reverse shell out to a server that is under the attackers control.

More malicious “plugins” include things like:

• FTP/SSH brute forcers
• MySQL / Database frontends

You’re only really limited by what you can code in PHP…

Obfuscation

Another trend that I’ve seen in a few of the more “31337″ shells is the use of obfuscation within the code. What happens is that instead of a plain old PHP file, they will use the built in functions within PHP to obfuscate the code contained within. All this is at the end of the day are simple gzip or base64 encodings of the code (or a fun combination of the two). I’m not entirely sure why this happens. It can’t be for IDS evasion as the code is still interpreted and sent in the clear. It may be for server side anti-virus evasion, but this seems unlikely as well. If anyone knows the reasoning behind this, please get in touch…

Here’s an example of some of the obfuscation I’ve seen…

Decoding these samples is fairly straight forward so I won’t bore you with the details here again

So, to wrap it all up, we have a simple PHP file that somehow lands up on a web server, giving the attacker a very easy to use interface to “manage” a web server. In my experience, I’ve only really seen these shells in use with phishing sites. One has to ask if it’s all part of the fraud ecosystem and if so, how it all fits together…but that’s a story for the sequel…or prequel perhaps…I don’t know…I don’t have a decent Jar-Jar character to ruin it all with…

Google, spammers and a malicious PDF

Launch Action type

Blue hair dryers and Scareware.

start part 1/3

#include disclaimer.h

I am by no means an expert at this sort of thing. Nor am I very good at it. This post is just about what I found today and some of the steps I took in my investigation of the problem. If you see where I have gone wrong or spot a mistake, please let me know. It’s the only way I learn.

background

Someone was doing some research on a famous designer named Dieter Rams. In particular there was a blue hair dryer that caught said someones eye. This is mostly because his search terms brought the hair dryer to the number one result in Google Image Search. So wanting to know more about the hair dryer the user clicked on the image. It went steadily downhill from there.

javascript

The image result to him to a blog post which has the photo, along with some hidden javascript in the page source which looked a little like so:

Embedded Javascript

Unfortunately that little piece of the puzzle seems to be completely missing as it’s since been removed from the site. I am also a little confused as to how it got there in the first place. It wasn’t in a comment, nor was it an upload. My only thought is that it’s an existing link to a site which has since been compromised and is hosting malicious javascript…

the scan.

The first time I followed the link to the “Blue Hair Dryer of Doom” ™ I was redirected to pcmedicalbilling.com which then proceeded to tell me my machine was infected and needed to be scanned. I believe the redirection was handled by the above Javascript but without having the original source it’s hard to say. The scary thing about this is that I checked with Google and F-Secure and both said the link was good. It was only toward the end of the day that it finally got marked as malicious.

So upon loading the page you will get presented with a neat little warning claiming shenanigans afoot on your PC. I love the fact that my browser now knows when my PC is infected with malware. Great work Safari !

Warning !

This will then kick off into a “scan” of your machine where it will find enough infections of various flavours to warrant you downloading something to deal with the problem.

Scanning your machine for infection

Here you can see your machine is truly infected and in desparate need of some software assisted cleansing.

Oh no..I'm infected....

And what do you know ? They have just the application to help you out with this…

Help is on the way

Looking at the “scan” results page you can see how easily it would dupe Joe Bloggs. It’s pretty convincing. What bothers me most about this incident is that while the search terms may have been fairly specific to the user, who’s to say that this doesn’t happen much more often. There was no dodgy links being followed, no search for pornography, just a guy trying to do research for his job…

so we have an executable

We now have an executable downloaded to our machine. I haven’t had the time to reverse engineer it yet. Mostly because I haven’t had the chance to learn reverse engineering of PE files. Yet. There was a lot more code involved here. Some very interesting javascript which was fairly obfuscated. I will be posting about this once I have had the time to sit down and analyze the code. Look out for the follow up in the next couple of days…

end of part 1/3