10 ms·
Every C99.php shell is backdoored
- gnyman 12y agoI have only every seen the c99.php shell used by script kiddies which utilizes some well known php vulnerability and uploads this as the control point. It would be cool if somebody wrote an automated script which would seek out these c99 and try to identify those which are used on hacked sites. It could then use this to get access and remove this script and fix the original exploit. Using exploits to help people is of course a can or worms but I like the idea of good hackers helping everyone.
- tomkwok 12y ago>> "a can or worms" There's a typo ... and I'm afraid "bad hackers" react even more quickly, so I'm hoping "good hackers" can hurry ... but watch out! Don't mess things up and cause a disaster :O
- cmgreen 12y agoPlease don't do this. Max Butler did that to DNS in 1998 with patching bind (plus a backdoor). He went to prison 18 months. Then coming back out, he ended up doing carding and back to prison. http://www.securityfocus.com/news/203 http://www.securityfocus.com/news/203 http://en.wikipedia.org/wiki/Max_Butler#FBI_investigation.2C_guilty_plea.2C_and_sentencing http://en.wikipedia.org/wiki/Max_Butler#FBI_investigation.2C...
- danielweber 12y agoFixing a broken BIND and then installing a backdoor is a much different kettle of fish than just writing a worm that fixes the bug and then walks away. That said, I would agree completely that it's very legally dangerous. If it's not yours, don't mess with it! As an academic matter, I think such a worm could end up being socially useful, if there are enough compromised machines and the people running them are sufficiently incompetent and those machines are being used against other people and you can be sure that your fix doesn't break something else and the machines just won't get re-compromised again next week. That's too many conditional clauses for me, but maybe someone else feels like taking one for the team. Legally: again, don't do it. It's not yours.
- astrodust 12y agoWhy would anyone who's not completely insane install anything like C99 in the first place? Not only is the idea completely nuts, but all Google produces for C99shell is how it's used in backdoor tools. Surprises: Zero.
- scintill76 12y agoApparently it's mostly used by script kiddies who compromise someone else's server and install it.
- mbrzuzy 12y agoThis is exactly what it's used for.
- danielweber 12y agoWell, I hope someone tells them their backdoor has been compromised.
- macNchz 12y agoIndeed, in years of writing PHP I only know of C99 because I found endless copies of it squirreled away, obfuscated, appended to other files, base64 encoded, and/or masquerading as jpg files after one of our servers was compromised.
- Arnor 12y agoIt's also useful when your PITA sys admin won't give you SSH but also hasn't taken any precautions against exec. Of course, the better solution is to leave ASAP...
- rplnt 12y agoWhy would anyone who's not completely insane use anything like php in the first place? There are always reasons, sometimes valid reasons, to do insane things.
- lucastx 12y agoI've used it in the past so I could run commands on a server, when the administrator only gave me FTP access. Uploading PHP files with system() calls works too, but C99 is much easier to use. But yes, I only came to know it when I was a stupid defacer teen. Shame on me.
- barbs 12y agoCached version: http://webcache.googleusercontent.com/search?q=cache:http://thehackerblog.com/every-c99-php-shell-is-backdoored-aka-free-shells/ http://webcache.googleusercontent.com/search?q=cache:http://...
- drivingmenuts 12y agoA tool that's pretty much only useful for hacking is backdoored? Heaven forbid! How is this even news?
- Udo 12y agoIn all my years of writing PHP code I have yet to find a legitimate use case for extract() - PHP should have gotten rid of it generations ago.
- kijin 12y agoIt's not terribly bad if you use it inside a function or method. Creating global variables is what causes all the issues, but then again, if you're handling global variables, you're asking for trouble anyway. What's really bad about extract() is that the default behavior is to overwrite existing variables. This is just a recipe for disaster, no less than the infamous register_globals. I once wrote a framework where the controller would pass variables to the view as $view->currentUser and the template would access it as $currentUser instead of the more verbose $this->currentUser. This was implemented with extract(), but I went to great lengths to make sure that the scope was clean. PHP probably ain't gonna get rid of extract() any time soon, but at least they should change the default to EXTR_SKIP.
- adamors 12y agoFrameworks tend to use it, to create variables in a view that were sent from a controller. For similar usecases it also makes sense (you want a bunch of variables created from an associative array).
- zapt02 12y agoWordpress shortcodes, to extract variables from an array into local scope. Works great and even lets you set default values easily.
- p4bl0 12y agoI agree with you, but here the problem is not the extract() call as everyone here seems to imply. The security problem lies in the fact that the authentication code is conditionally called depending on user input. if ($login) { … } is not less safe than if ($_POST['c99shcook']['login']) { … } would have been.
- 4mnt 12y ago
- kijin 12y agoThe whole thing is a backdoor. Backdoor in a backdoor? Surprise! Of course it's backdoors all the way down ;) But of course, script kiddies aren't particularly good at securing the servers they pwned, are they? [1] A couple of months ago, I wrote QADE [2] for fun, a "quick and dirty" PHP-based text editor and webshell for editing files and running commands remotely. I deliberately failed to implement any authentication-related feature, because I didn't want to give an illusion of security. A secure webshell is an oxymoron. [1] https://blog.avast.com/2014/06/09/are-hackers-passwords-stronger-than-regular-passwords/ https://blog.avast.com/2014/06/09/are-hackers-passwords-stro... [2] https://github.com/kijin/qade https://github.com/kijin/qade
- leni536 12y agoWhat about putting it behind https and use basic http auth? If it's only for you you can always have a self signed certificate.
- kijin 12y agoThat's exactly what I do with my own installation of QADE on my dev box. The README on GitHub recommends others to do the same, since it's pretty much the only way to make QADE secure.
- pogue 12y agoI think the trouble is now, if this was just released, is that you can easily google for c99.php and find vulnerable servers with this file hosted on it, from pre-existing backdoors/phishing hosts, or what have you, and this allows anyone and everyone to use it, not just the original person who placed the backdoor. Which, I suppose, kind of enhances the problem exponentially. As far as I'm concerned though, Google and Firefox's malware checker engines should blacklist any domain that has the c99.php file located on it and block their webbrowsers from connecting to it in the first place. Of course - correct me if I'm wrong here.
- drunkcatsdgaf 12y agoactually, google is pretty far ahead of this. trying searching allinurl:c99.php, most of the returns are actually about the script.
- mmaunder 12y agoThe only reason you have C99 on your server is because you've already been hacked. Its' one of the oldest shells used for backdooring a hacked site - you rarely see it anymore because there are much better shells now.
- dutchbrit 12y agoI'm actually disgusted to see how many people use extract in bad ways! As some others here have mentioned, I've never found a legitamate reason to use extract - and the php documentation clearly mentioned not to use it on input data. Example: https://github.com/search?l=PHP&p=1&q=extract%28%24_GET%29%3B&ref=advsearch&type=Code https://github.com/search?l=PHP&p=1&q=extract%28%24_GET%29%3... Yuck...
- norswap 12y agoGot confused for a minute. Why the hell call your shell after a C language standard? Also, the term "shell" is terribly overloaded nowadays.
- nodesocket 12y agoFounder of https://commando.io https://commando.io. It is utterly frightening that anybody would consider using c99. If you're interested in a parallel SSH web-based interface, check us out. Commando.io does not provide an interactive shell, but instead operates through pre-defined scripts we called recipes (written in shell, bash, perl, python, ruby, go, or node.js). Recipes are fully versioned, and we keep a full audit trail of all executions run on your infrastructure.
- mahouse 12y agoAre you recommending us to use your software on servers that we compromise?
- nodesocket 12y agoAbsolutely not, recommending Commando.io for anybody looking for a web-based SSH interface for servers they rightfully manage.
- gamed 12y ago;)
- meowface 12y agoPeople are messing with you because C99 is used almost exclusively by script kiddies as a web shell into servers they compromise. Almost no one has ever used it as an actual administration shell for their own servers.
- fl0wenol 12y agoOr we could, you know, use SSH (and sudo if we were so inclined). I don't think anyone uses a PHP shell willingly unless they're trying to do something they shouldn't.
- cstrat 12y agoAfter reading these comments I am intrigued. Whenever I have used PHP I pretty much always run extract three times: extract($_GET, EXTR_PREFIX_ALL|EXTR_REFS, 'gVar'); extract($_POST, EXTR_PREFIX_ALL|EXTR_REFS, 'pVar'); extract($_COOKIE, EXTR_PREFIX_ALL|EXTR_REFS, 'cVar'); It makes working with get/post/cookies much easier. All variables are extracted with a prefix... so: http://www.yyy.com/script.php?hello=world http://www.yyy.com/script.php?hello=world Results with: $gVar_hello being the variables holding 'world'. Is this poor form? I previously used: `import_request_variables` - but thats been sidelined.
- TimWolla 12y agoWhy is using $gVar_hello easier than $_GET['hello']? Also $_GET and friends have the benefit of being super global.
- cstrat 12y agoIt is easier to use in strings, `$blah = "hi $gVar_hello"` rather than $blah = "hi {$_GET['hello']}";`. Not that it is a massive deal... I guess I just got in the habit when I was younger. Like I said, I always used import_request_variables (with various prefixes). ---- But back to my question - is it bad to use like I have?
- thaumaturgy 12y agoWell, like most coding bad practices, plenty of which I'm guilty of too, it's fine until it's not -- and then it's really bad. I can't immediately think of a practical way to make a problem out of that. But, you're making a couple of bets here: you're betting that there never will be a problem with it, and you're betting that the rules in PHP won't change in the future. All those folks that relied on magic_quotes already got boned by that second bet. So, no, I wouldn't do it that way, but I wouldn't criticize you for it either.
- cstrat 12y agohaha yeah that is true, when they said import_request_variables was being removed I was so close to just forgetting the idea of doing what I am doing.
- jacquesm 12y agothis is pretty bad: https://www.google.com/search?client=ubuntu&channel=fs&q=allinurl%3Ac99.php&ie=utf-8&oe=utf-8 https://www.google.com/search?client=ubuntu&channel=fs&q=all...
- fanssex 12y agoIs this a joke?
- nnnnni 12y agoSo... what's the best way to tell if C99 is "installed" on your server(s)? grep -Ri c99 /path/to/htdocs would be my guess
- mkarr 12y agoThere are thousands of variations of C99 used by various 'hackers'. Many of which are obfuscated (base64, gzip, other more obscure encodings). Generally, searching for a combination of 'base64_decode', 'gzdecode', and 'eval' will find a great deal of them. Others may require more manual inspection. Just searching for 'eval' alone tends to find a lot. There are a few tools floating about that try to use a more signature-based approach to searching, and clamav has some signatures for the shells, but they can be hit-and-miss, as the obfuscation often changes.
- leigh_t 12y ago> due to a vulnerability in the extract() command No. This is due to insane usage of the extract() function. Not a vulnerability with the function itself. You can pass user-supplied input directly to plenty of other functions which have equally idiotic outcomes, it doesn't mean that they have vulnerabilities, it means the author is a liability.
- mandatory 12y agoRight, didn't mean that in the original post - obviously this is how the function is designed to work. Fixed up the wording to clarify.
- Jach 12y agoI thought everyone knew this already ~10 years ago...
- whalesalad 12y agoI just deployed a lot of these for fun on Heroku. Really interesting stuff. http://php-c99.herokuapp.com/ http://php-c99.herokuapp.com/
- laurent123456 12y agoIs the C99.php shell any popular? This is such a classic exploit of `extract()` that it seems like very amateurish job. If they even use this function at all I imagine the rest of the script is not that secure either.