7 ms·

Why would anyone who's not completely insane install anything like C99 in the first place? Not only is the idea completely nuts, but all Google produces for C9

Why would anyone who's not completely insane install anything like C99 in the first place? Not only is the idea completely nuts, but all Google produces for C99shell is how it's used in backdoor tools. Surprises: Zero.

scintill76 12y ago
Apparently it's mostly used by script kiddies who compromise someone else's server and install it.
- mbrzuzy 12y ago
  This is exactly what it's used for.
- danielweber 12y ago
  Well, I hope someone tells them their backdoor has been compromised.
- macNchz 12y ago
  Indeed, in years of writing PHP I only know of C99 because I found endless copies of it squirreled away, obfuscated, appended to other files, base64 encoded, and/or masquerading as jpg files after one of our servers was compromised.
- Arnor 12y ago
  It's also useful when your PITA sys admin won't give you SSH but also hasn't taken any precautions against exec. Of course, the better solution is to leave ASAP...
rplnt 12y ago
Why would anyone who's not completely insane use anything like php in the first place? There are always reasons, sometimes valid reasons, to do insane things.
lucastx 12y ago
I've used it in the past so I could run commands on a server, when the administrator only gave me FTP access. Uploading PHP files with system() calls works too, but C99 is much easier to use. But yes, I only came to know it when I was a stupid defacer teen. Shame on me.
- astrodust 12y ago
  If the only tool you have is FTP then either you're an attacker with a single set of compromised credentials, or a legitimate user forced to act like one.
  - lucastx 12y ago
    Maybe I live in a place where technology (and security practices, specifically) goes forward later than Silicon Valley? (Answer: yes)
aaron695 12y ago
What should people use? C99shell is easy to use and common. Why is it nuts?? You're using it for quick and easy defacements and compromises. This is a numbers game often from people with low skill levels. I see no issues here at all. If your defacements were getting quickly taken back by another crew it might be an issue, but I've seen no evidence of this happening. Just because there's a security issue it's not the end of the world. Risk management still comes into it. Easy to use = more defacements. Might have a hole, well is there evidence we are losing enough defacements to justify the retraining of the crew and added costs? And more importantly, be agile. Defacements getting retaken over at unacceptable levels, just move to a different product.

scintill76 12y ago

Apparently it's mostly used by script kiddies who compromise someone else's server and install it.

mbrzuzy 12y ago
This is exactly what it's used for.
danielweber 12y ago
Well, I hope someone tells them their backdoor has been compromised.
macNchz 12y ago
Indeed, in years of writing PHP I only know of C99 because I found endless copies of it squirreled away, obfuscated, appended to other files, base64 encoded, and/or masquerading as jpg files after one of our servers was compromised.
Arnor 12y ago
It's also useful when your PITA sys admin won't give you SSH but also hasn't taken any precautions against exec. Of course, the better solution is to leave ASAP...

rplnt 12y ago

Why would anyone who's not completely insane use anything like php in the first place? There are always reasons, sometimes valid reasons, to do insane things.

lucastx 12y ago

I've used it in the past so I could run commands on a server, when the administrator only gave me FTP access. Uploading PHP files with system() calls works too, but C99 is much easier to use. But yes, I only came to know it when I was a stupid defacer teen. Shame on me.

astrodust 12y ago
If the only tool you have is FTP then either you're an attacker with a single set of compromised credentials, or a legitimate user forced to act like one.
- lucastx 12y ago
  Maybe I live in a place where technology (and security practices, specifically) goes forward later than Silicon Valley? (Answer: yes)

aaron695 12y ago

What should people use? C99shell is easy to use and common. Why is it nuts?? You're using it for quick and easy defacements and compromises. This is a numbers game often from people with low skill levels. I see no issues here at all. If your defacements were getting quickly taken back by another crew it might be an issue, but I've seen no evidence of this happening. Just because there's a security issue it's not the end of the world. Risk management still comes into it. Easy to use = more defacements. Might have a hole, well is there evidence we are losing enough defacements to justify the retraining of the crew and added costs? And more importantly, be agile. Defacements getting retaken over at unacceptable levels, just move to a different product.