4 ms·

Is this a real trojan found in the wild, or something they came up with to show how sneaky trojans could be?

• ben1040 13y ago
  I've seen remote execution backdoors like this in a compromised Joomla site before (at least w/r/t the code snippet that actually does the execution), so I would not be in the least surprised if someone was clever enough to use the copyright file as a place to sneak it in. I saw one attacker drop the same backdoor php file in a dozen different locations, in hopes that the site owner would just remove the one in particular that was showing up in their logs and none of the others.
  • mrhazel 13y ago
    The most interesting shells I've seen have been done via the htaccess file. Here is an example: https://github.com/wireghoul/htshells/blob/master/shell/mod_php.shell.htaccess https://github.com/wireghoul/htshells/blob/master/shell/mod_...
    • matiasb 13y ago
      Nice .htaccess thing
• ctb_mg 13y ago
  Perhaps I can't read, but it seems the article is really lacking with a source for where this was found.
• wbl 13y ago
  Sneaky? That's not sneaky at all. The presence of eval is a great big flashing sign saying "Backdoor here!". Why on earth does the copyright file have code in it? Sneaky is the infamous sys_wait4() backdoor in the Linux source, or using open($filename) in perl, or letting someone pass in a debugging filename that you treat as a relative path without realpath().
• daviddede 13y ago
  It was found in the wild.