{"id":3197,"date":"2010-09-06T00:01:35","date_gmt":"2010-09-06T07:01:35","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=3197"},"modified":"2018-01-30T12:34:33","modified_gmt":"2018-01-30T19:34:33","slug":"php-backdoor-has-another-backdoor-inside","status":"publish","type":"post","link":"https://www.webroot.com/blog/2010\/09\/06\/php-backdoor-has-another-backdoor-inside\/","title":{"rendered":"PHP Backdoor Has Another Backdoor Inside"},"content":{"rendered":"

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"\"<\/a>Is there no honor among thieves anymore?<\/p>\n

The other day I was looking at a remote access Trojan written in the PHP scripting language. The bot loads into memory on a victim’s computer when an unsuspecting user, for example, stumbles upon an iframe pointing to the PHP script embedded in a Web page. The code is\u00a0 nicely appointed with such desirable features as the ability to execute shell commands on the host server, send a flood of data packets at another computer, and scan remote computers.<\/p>\n

Once loaded into a victim’s browser, the bot connects to, and is capable of executing commands issued by, a botnet server–until the victim reboots their computer. But for most users, that’s probably long enough. If an attacker can execute commands on an infected user’s computer, installing more Trojans is just child’s play.<\/p>\n

But someone appears to have embedded a surprise into this PHP backdoor: It’s another <\/em>backdoor within the backdoor.<\/p>\n

<\/p>\n

I’m not even going to try to understand why whoever is distributing the bot’s source code chose to name the Web domain where they’d store a Trojan getemgirlfriday.com<\/em>. Perhaps a closet Howard Hawks or Rosalind Russell fan<\/a> camps out among the malcode community. Wonderful, in a loathsome sort of way. All I know is, someone’s bugged this bug with another bug.<\/p>\n

\"\"<\/a><\/p>\n

The second chunk of code, invoked during the PHP bot’s loading routine, looks to many like a blob of base64-encoded garbage. But to a security researcher, the presence of an unexpected, obfuscated code section screams hidden goodies here<\/em>.<\/p>\n

\"\"<\/a><\/p>\n

Decoding base64-encoded text is not exactly difficult. Down near the end of the bot’s code, there’s this blob of data, set into the variable $dc_source.<\/p>\n

\"\"<\/a><\/p>\n

Once decoded, the meaning of $dc_source becomes clear. The bot writes out the decoded commands into a Perl script then executes them.\u00a0 The commands instruct the bot to connect elsewhere. Were I the criminally minded type to use such a bot, I’m not sure I’d be particularly happy to discover the “Data Cha0s Connect Back Backdoor” on my server. I suppose that’s why the page hosting the code offers the following overblown expression of gratitude from the group distributing the code:<\/p>\n

\"\"<\/a><\/p>\n

Go get ’em, Hildy<\/a>. Happy Labor Day, everyone else.<\/p>\n

\"\"<\/a><\/p>\n

\"wordpress<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Is there no honor among thieves anymore? The other day I was looking at a remote access Trojan written in the PHP scripting language. The bot loads into memory on a victim’s computer when an unsuspecting user, for example, stumbles upon an iframe pointing to the PHP script embedded in a Web page. The code […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[7799,7265,7947,5137,7945,3453,3769,7949,7951,4199,3919,5951,6163,4681,3895,4397,4143,3471,6623,4313],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3197"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=3197"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3197\/revisions"}],"predecessor-version":[{"id":23824,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3197\/revisions\/23824"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=3197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=3197"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=3197"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=3197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}