Concerned About Your Business Cyber Security?

(877) 321--7374

When Bad Guys are Pwning Bad Guys…, (Fri, May 12th)

A few months ago, I wrote a diary about webshells[1] and the numerous interesting features they offer. Theyre plenty of web shells available, there are easy to find and install. They are usually delivered as one big obfuscated (read: Base64, ROT13 encoded and gzip width:801px” />

Im pretty sure that some people are using web shells as a remote administration tool. Is it really a good idea? Not sure When we install a software on our computer, one of the recommendations is to check the hash of the files/archives with the one provided by the developer to be sure that the software has not been altered by any means. It could be a good idea to make the same with web shells!

While preparing a presentation about web shells and testing some of them in a lab, I found a specific version of the RC-Shell (v2.0.2011.0827) that started to generatesuspicious traffic. Almost at the same time, I was contacted by one of our readers that reported to me the same behaviour. He did some analysis on his side and the conclusion was thatthe web shell was backdoored! The PHP code contains anarray of Base64 encoded images which are icons used to identify the file types. In the backdoored version, the unknown padding:5px 10px”>
$images = array(
small_unk = iVBORw0KGgoAAAANSU …,
unknown = iVBORw0KGgoAAAANSU …

MD5 (unknown.png) = 1470521de78ef3d0795f83ea7af7c6ad

If you have a look at the picture metadata, you will see that the unknown width:800px” />

Multiple functions have been added to the web shell to deploy the backdoor. padding:5px 10px”>
function z8t($i, $o)//run backdoor
{
$r = @create_function($o, return @ . z7v($o, 0) .
}

Note: I found different versions of the web shell with different function names.

The decoding of the PNG image comment and the installation of the backdoor is available here[3]. The code of the backdoor is located here[4]. Basically, it collects juicy information (local PHP variables and details about the web shell and phone home via two channels:

  • SMTP is used to drop an email to peterlegere51@yahoo[.]com
  • HTTP is used to post the same data to padding:5px 10px”>
    To: peterlegere51@yahoo.com
    Subject: Linux|http://shiva/lab/VW4Zy8Yg.php?
    X-PHP-Originating-Script: 1000:VW4Zy8Yg.php(830) : runtime-created function(1) : eval()d code
    Message-Id: 20170509202418.BE96124112C@shiva .NET CLR
    SERVER_NAME=xxxxxx
    SERVER_ADDR=192.168.254.8
    SERVER_PORT=80
    HTTP_REFERER=http://shiva/lab/
    PHP_SELF=/lab/VW4Zy8Yg.php
    REQUEST_URI=/lab/VW4Zy8Yg.php
    SCRIPT_NAME=/lab/VW4Zy8Yg.php
    SCRIPT_FILENAME=/var/www/lab/VW4Zy8Yg.php
    REMOTE_ADDR=192.168.254.11

    So, be warned when you download and use tools from unknown or unreliable sources. Even underground tools can be backdoored!

    [1]https://isc.sans.edu/forums/diary/The+Power+of+Web+Shells/21257
    [2]http://entropymine.com/jason/tweakpng/
    [3]https://gist.github.com/anonymous/319ef7124affebec67ebc56bc83cbe87
    [4]https://pastebin.com/bgj7aH9u

    Xavier Mertens (@xme)
    ISC Handler – Freelance Security Consultant
    PGP Key

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Ready For ASuperheroI.T. Solution?

Real Time Web Analytics