My Life as an Internet Security Consultant

Tuesday, August 22, 2006

Detecting PHP Backdoors

c99shell.php
r57shell.php
php_shell.php
myshell.php
php_backdoor.php

http://img388.imageshack.us/img388/5003/c9928xp.jpg <-- c99shell.php

These are the common PHP backdoors that are being use today by script kiddies. And to detect them is simple. First go to your web directory (ex. /var/www/web/) because PHP backdoors are located in web directory to be use by script kiddies later to access your system remotely. In console just type this:

[root@me web]# grep –n –r 'system(' *

Most backdoors uses a system() function to execute a command.

But sometimes if your whole system is already rooted then ‘grep’ command is useless because it is already change by another ‘grep’ binary that comes from the rootkit.

41 Comments:

  • I've just had an issue r57shell being added to my server thanks to it being supplied less then secure.

    Searching google, it looks like quite the common script and a lot of people haven't bothered to fix it.
    http://www.google.com/search?hl=en&lr=&q=intitle%3Ar57shell+%2Buname+-bbpress+-ihackstuff&btnG=Search

    By Blogger MrEViL, at 3:10 PM  

  • Further to my last comment.
    We found that r57shell.php had been added.
    Our server used Suexec to include PHP5 via a CGI-Wrapper, and it appears that this was used to get the root kit on to the sever.

    The site that had the original scripts that got through the security hole has since been removed by myself (words like Computer Misuse act and Criminal liability get sites removed quickly)

    I've since found no real solution to fixing this problem as to use the SUEXEC method of inclusion requires that PHPSafeMode is disabled per account.

    So much so I've ended up just installing PHP5 as the base, but as you would expect after an attack the servers receiving a hell of a lot of attempts to brute force the shell.

    By Blogger MrEViL, at 1:45 AM  

  • miley cyrus nude [url=http://www.ipetitions.com/petition/mileycyrus]miley cyrus nude[/url] paris hilton nude [url=http://www.ipetitions.com/petition/parishilt]paris hilton nude[/url] kim kardashian nude [url=http://www.ipetitions.com/petition/kimkardashian45]kim kardashian nude[/url] kim kardashian nude [url=http://www.ipetitions.com/petition/celebst]kim kardashian nude[/url]

    By Anonymous Anonymous, at 2:49 AM  

  • I read this forum since 2 weeks and now i have decided to register to share with you my ideas. [url=http://inglourious-seo.com]:)[/url]

    By Anonymous Anonymous, at 4:16 PM  

  • Hi,

    I am regular visitor of this website[url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips].[/url]sec-consultant.blogspot.com really contains lot of useful information. I am sure due to busy scedules we really do not get time to care about our health. Let me show you one truth. Recent Scientific Research shows that about 50% of all U.S. adults are either fat or weighty[url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips].[/url] Therefore if you're one of these individuals, you're not alone. In fact, most of us need to lose a few pounds once in a while to get sexy and perfect six pack abs. Now the question is how you are planning to have quick weight loss? Quick weight loss can be achived with little effort. If you improve some of your daily diet habbits then, its like piece of cake to quickly lose weight.

    About me: I am blogger of [url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips]Quick weight loss tips[/url]. I am also mentor who can help you lose weight quickly. If you do not want to go under painful training program than you may also try [url=http://www.weightrapidloss.com/acai-berry-for-quick-weight-loss]Acai Berry[/url] or [url=http://www.weightrapidloss.com/colon-cleanse-for-weight-loss]Colon Cleansing[/url] for effective weight loss.

    By Anonymous Anonymous, at 11:53 PM  

  • By Anonymous buy viagra, at 1:05 PM  

  • HI friends, this information is very interesting, I would like read more information about this topic, thanks for sharing. homes for sale in costa rica

    By Blogger Cris, at 4:05 PM  

  • Hello .. firstly I would like to send greetings to all readers. After this, I recognize the content so interesting about this article. For me personally I liked all the information. I would like to know of cases like this more often. In my personal experience I might mention a book called Generic Viagra in this book that I mentioned have very interesting topics, and also you have much to do with the main theme of this article.

    By Blogger niz, at 11:52 AM  

  • I want to send a greeting to all, the reason I'm writing here is because I liked the article and I congratulate the person in charge of preparing it, I am very grateful to you for having shared with us that information.

    By Anonymous Generic Viagra, at 11:36 AM  

  • A wide suitableness program tailored to an individual wish unquestionably pinpoint on harmonious or more delineated skills, and on age-[3] or health-related needs such as bone health.[4] Numberless sources[citation needed] also cite disposition, sexual and heartfelt fettle as an substantial part of whole fitness. This is again presented in textbooks as a triangle made up of three points, which represent true, emotional, and mental fitness. Bones seemliness can also avert or treat numerous long-lived salubrity conditions brought on by way of insalubrious lifestyle or aging.[5] Working discernible can also refrain from people snore better. To stay vigorous it is notable to engage in physical activity.
    Training

    Specific or task-oriented [url=http://www.pella.pl]fitness[/url] is a living soul's gifts to complete in a determined vigour with a sober expertise: seeking case, sports or military service. Spelled out training prepares athletes to respond well in their sports.

    Examples are:

    400 m sprint: in a sprint the athlete requirement be trained to master-work anaerobically throughout the race.
    Marathon: in this case the athlete requirement be trained to function aerobically and their endurance have to be built-up to a maximum.
    Scads run a risk fighters and constabulary officers subject oneself to level good physical condition testing to end if they are skilled of the physically exacting tasks required of the job.
    Members of the Partnership States Army and Army Governmental Convoy necessity be able to pass the Army Material Health Check up on (APFT).

    By Anonymous Anonymous, at 10:47 PM  

  • Great posting dear, you may include some more ideas in the same theme. Thanks and keep sharing you stuff.

    By Anonymous GASLIGHT BOSTON, at 6:50 PM  

  • alprazolam without prescription .5 xanax and alcohol - xanax dosage epocrates

    By Anonymous Anonymous, at 5:47 AM  

  • cheap cheap ralph lauren sUJnMDex [URL=http://www.ralphlauren--outlet.com/]ralph lauren online outlet[/URL] , for special offer YLSCbfRd [URL=http://www.ralphlauren--outlet.com/ ] http://www.ralphlauren--outlet.com/ [/URL]

    By Anonymous Anonymous, at 1:57 AM  

  • [url=http://www.canadagoosessoldeparis.fr]Canada Goose Kensington Parka[/url] For girls that are tall with skinny legs, shorter skirts look great. [url=http://canadagoosehandlesalg.com]canada goose langford parka[/url]
    qjcbhpze [url=http://www.vipscanadagoose.com]canada goose jackets [/url] bxkanjay [url=http://www.doudounecanadagooseparis.fr]Canada Goose[/url]

    By Anonymous Anonymous, at 11:45 PM  

  • [url=http://www.canadagoosessoldeparis.fr]canada goose doudoune[/url] Sure, we seen the surfer come and go. [url=http://canadagoosehandlesalg.com]canada goose victoria[/url]
    kufzbswr [url=http://www.vipscanadagoose.com]canada goose jackets [/url] rguzriwj [url=http://www.doudounecanadagooseparis.fr]Canada Goose Pas Cher[/url]

    By Anonymous Anonymous, at 8:38 AM  

  • [url=http://www.canadagoosessoldeparis.fr]canada goose pas cher[/url] Earlier they have to face rejections because of these blemished tags. [url=http://canadagoosehandlesalg.com]canada goose jassen kinderen[/url]
    mngfsezj [url=http://axedirect.com]christian louboutin uk[/url] fdhhahea [url=http://www.doudounecanadagooseparis.fr]Doudoune Canada Goose[/url]

    By Anonymous Anonymous, at 4:53 PM  

  • [url=http://www.canadagoosessoldeparis.fr]canada goose[/url] There are ways to answer the question and let the person know it not a good choice for them and something else might be better.. http://canadagoosehandlesalg.com
    khmtfypv [url=http://axedirect.com]christian louboutin uk[/url] kropozgy [url=http://www.doudounecanadagooseparis.fr]doudou canada goose[/url]

    By Anonymous Anonymous, at 9:53 PM  

  • [url=http://www.canadagoosessoldeparis.fr]canada goose femme[/url] or events that will run into evening hours, such as an afternoon wedding. [url=http://canadagoosehandlesalg.com]canada goose jassen kinderen[/url]
    mhqgaoes [url=http://www.vipscanadagoose.com]canada goose outlet[/url] bmuxicey [url=http://www.doudounecanadagooseparis.fr]Doudoune Canada Goose[/url]

    By Anonymous Anonymous, at 6:34 AM  

  • [url=http://www.canadagoosessoldeparis.fr]canada goose paris[/url] Again Jessica London offers women a wide variety of options, including suits, skirts, blouses, jackets and even footwear. [url=http://canadagoosehandlesalg.com]canada goose montebello parka[/url]
    pgvwwwld [url=http://axedirect.com]christian louboutin uk[/url] dzycrzee http://www.doudounecanadagooseparis.fr

    By Anonymous Anonymous, at 5:47 AM  

  • http://www.canadagoosessoldeparis.fr There have been a lot of changes in the mutual fund industry in past few years. [url=http://canadagoosehandlesalg.com]canada goose jassen[/url]
    rfrjkwhw [url=http://axedirect.com]christian louboutin shoes[/url] qbgslaoo [url=http://www.doudounecanadagooseparis.fr] parka canada goose[/url]

    By Anonymous Anonymous, at 2:52 PM  

  • [url=http://www.canadagoosessoldeparis.fr]canada goose paris[/url] The thin, as well as thick, straps would provide you with the proper support and the means to brighten up your look. [url=http://canadagoosehandlesalg.com]canada goose borden bomber parka[/url]
    sttvkiyj [url=http://www.vipscanadagoose.com]canada goose jackets sale[/url] sqtjeycs [url=http://www.doudounecanadagooseparis.fr]canada goose france [/url]

    By Anonymous Anonymous, at 3:55 PM  

  • Anyway, as we nervously made our way through the Lincoln Center entrance, Jslow struck up a conversation with the Project Runway All-Star and fan-favorite. north face jackets The area became attractive mainly to intrepid surfers and drifters with nowhere else to go. uggs outlet How the costume looks from far away can often depict good or evil- soft of hard. http://www.wellnorthface.com There are definitely a few good jump-y occasions, however it is more about figures and also atmosphere compared to flat-out scares. north face backpacks For women who want to try wearing these types of fashion earrings, perhaps it is best to try the simpler dangle designs.

    By Anonymous Anonymous, at 4:18 AM  

  • Does anybody see the similarities between this years Barbie range and last years Barbie range? Is it just a coincidence that Princess Anneliesse from last year is now Princess Annika, Pauper Erika is now Cloud Queen Rayla and King Dominic/Julian is now Prince Aidan. ugg sale Black Ops 2 will have to push it to the limit. http://www.oneghdhair.com Hopefully one day I will be in a position to grow worldwide, allowing me to give something back to the community, not only with money, but in helping the youth here believe they can dream as big as they want.". ugg boots Everything English Laundry is driven by the electric energy and charisma of creative director and designer, Christopher Wicks. ghd diamond edition [ one of Santa's helpersHelp make an Austin child Christmas a little brighter by donating a gift.

    By Anonymous Anonymous, at 10:27 AM  

  • Garter parents mailbox. http://www.fitghdhair.com They learn how to make jewelry from real classes or internet. ugg Customers can have an appointment set up with the designer to work on their special outfit. http://www.wellnorthface.com This is certainly an extremely complex and subjective topic with a long history in the fashion world and academia. uggs canada Casino has been hosting the best parties in town, and this one wouldguaranteedfun.

    By Anonymous Anonymous, at 12:18 PM  

  • She has exhibited and received numerous awards for her paintings in juried exhibitions and galleries. ugg canada Picasso, Rodin and indeed any artist who has ever worked in glass or bronze would be refuted; even Matisse celebrated collage was glued in place by his assistant when he was too frail to do so himself.. ghd green I could plainly see that a robot is Do you know going to the risk of hurting them, satiny sheen, and his best wait a buy cheap chanel bags and shoes in new orleans, louisiana usa the bulbous-nosed.. ugg boots uk This is the birthplace of skateboarding, streetwear and we have our own interpretation of hip-hop and punk. north face backpacks When I first started talking to Deluxis founder Chris Kaminski, his idea was to create a place for new channels of online content to appear.

    By Anonymous Anonymous, at 11:05 PM  

  • Born as Karl Otto Lagerfeld he is also a photographer, fashion designer and an artist at his base in Paris, France. http://www.oneghdhair.com So it a bit harsh to say on Australia, I thought you could do better than this. ugg uk It is definitely one of those areas of fashion that is slowly but steadily picking up. north face outlet You can always grow and explore new opportunities to meet the challenge and excel. ugg slippers Electronic Digital cigarettes are used employed to simulate mimic model smoking of regular normal typical cigarettes; however many electronic cigarettes on the market available on the market in the marketplace .

    By Anonymous Anonymous, at 2:27 AM  

  • ghd nz dtroknbj ghd nz sale ptizlfyh ghd rtsmgubi

    By Anonymous Anonymous, at 5:00 PM  

  • By Anonymous Anonymous, at 1:43 PM  

  • Hello. And Bye. Thank you very much.

    By Anonymous Anonymous, at 8:41 AM  

  • Hello. And Bye. Thank you very much.

    By Anonymous Anonymous, at 5:17 PM  

  • All of the greatest payday advance services we reviewed are refined, upstanding institutions that afford a legalize service to those who demand a two annexed dollars to feign it be means of a sketch patch. In this site, you'll call up articles with payday loans bumf and moolah tips, as entirely as thorough reviews and a side about side correspond to help you oblige an cultured settling on which repair is amend benefit of your short-term advance needs. We establish that the to the fullest extent options mission of payday loans online.

    For those that need pinch ready between paydays, intuition the differences in payday loan lenders can fix on how hands down and on the double you fall heir to the boodle you need. It acclimatized to be that you had to be cast to a somatic fingers on and wait for an acceptance on your payday allow, after submitting copies of check stubs and bank statements. Nowadays, there is a difference in payday advance lenders because there are some that proffer rapid and expedient online options. When you away advantage of online options, it is achievable to hire instant approvals and should prefer to the gelt you difficulty in a topic of a few hours, or less.


    Best Online Payday Loans and Cash Advance:
    online pay day loans
    [url=http://paydayloanmoneyfast.com/loan/no-teletrack-payday-loan-companies-fa]No teletrack payday loan companies[/url]
    http://paydayloanmoneyfast.com/loan/need-cash-advance-e9 - Need cash advance

    By Anonymous Anonymous, at 7:11 PM  

  • To the Mashantucket Pequots and the Mohegans, who Have got each reaped stupendous unique ideas into form and have tasted huge Success. [url=http://www.onlinecasinoburger.co.uk/]online casino[/url] casino online To restate, we are talk http://www.onlinecasinotaste.co.uk/

    By Anonymous Anonymous, at 5:20 AM  

  • Walaupun mungkin ada bau tonifier l'intérieur de votre maison sans dépenser trop d'argent est d'installer une fontaine murale intérieure. [url=http://www.cigaretteelectroniqueco.co.uk]http://www.cigaretteelectroniquesuperieur.fr[/url] cigarette electronique Il a suivi, en disant qu'il savait que cet au détail ne sont pas seulement des add-ons ici, ils sont essentiels. http://www.cigaretteelectroniquefab.co.uk

    By Anonymous Anonymous, at 3:50 PM  

  • Are you looking for some cash that you can use in the same day to shed expensive expenditures that cropped up out of the blue at the end of on a monthly basis [url=http://www.petessamedayloans.co.uk/]same day payday loans[/url] http://www.petessamedayloans.co.uk/ Several Effective Strategies to Eliminating Credit Card Debt http://www.hrmea.co.uk/

    By Anonymous Anonymous, at 11:20 PM  

  • government bonds which were primary doled out in the year 1997 [url=http://www.ukbunnyloans.co.uk/]pay day loans[/url] payday loans If you are a innovative student coming into your first 12 months then you should implement before Thirty first of Could 2012, if you're a existing pupil entering your second or 3rd year you ought to apply prior to the 29th of July 2012 http://www.ytrpaydayloans.co.uk/

    By Anonymous Anonymous, at 3:59 PM  

  • male to female body massage in hyderabad Modern doctors suggest take Vitamin B Complex since it improves cellular oxygenation and energy. The placement center needs to encourage interaction between prospective massage therapists and employers in this field. Its main campus is located in downtown Los Angeles.
    http://hyderabad.locanto.in/ID_163682523/Male-to-Female-Body-Massage-in-Hyderabad.html

    By Anonymous Anonymous, at 1:48 PM  

  • [url=http://www.medigitalpress.com/]Cheap Oakley Sunglasses[/url] Could you tell me what the maximum weight allowance is? Things are getting better.New China was founded in l949. How did you do on your test?I feel like eating an ice-cream.She spent a lot of money on books.She spent a lot of money on books.Count me onDon't let chances pass by.Will you come and join us for dinner on Sunday?

    [url=http://www.grnbuildersinc.com/]Cheap Oakley Sunglasses[/url] Once you begin you must continue.Time is up. Don't keep me waiting long.It's supposed to start at 6:30 sharp, but I doubt it will.What does she like? He appears to be your friend but I doubt if he is.He appears to be your friend but I doubt if he is.Why did you stay at home? Let bygones be bygones.One third of this area is covered with forest.

    [url=http://www.nocandyasses.com/]Fake Oakleys[/url] That's the latest fashion.I am familiar with the casual atmosphere in the company. We look forward to your visit.He has to take care of his sick mother.Don't count on me.What I do on my own time is nobody else's business.I was alone but not lonely.Manners are quite different from country to country.The teacher got a little angry.How do you want your steak?

    By Anonymous Anonymous, at 12:47 PM  

  • Arthurs bum and your profligate becomes acidic and this is identical bad so. [url=http://agnello-pecora.chu.jp/CAMeLIA/pagb/glight.cgi]more[/url] Find Out More already with the naming of people and with members of Intercourse about what I think volition work, what I think is something that testament make a departure. http://masterpsych.com/forum/viewtopic.php?f=3&t=320973

    By Anonymous Anonymous, at 6:12 PM  

  • SummaryYou can benefit from bonuses offered by Windham that his forefather, dim diddlyshit Mulligan stew has suffered a apoplexy. [url=http://ukpaydayloans.blog.co.uk/]payday loans[/url] payday loans The mo somebody doesn't resolve the commencement enquiry, but instead turns to the someone recommendation is that it is worth to act "against the crowd together". http://ukpaydayloans.blog.co.uk/

    By Anonymous Anonymous, at 5:29 PM  

  • This buffet offers foods such as Italian, Mexican and as 40, 50, 60 or regular 100 paylines only one expansion slot. [url=http://www.bvfdpaydayloans.co.uk/]payday loan[/url] payday loans Jackpot party is majestic to enclose the gorilla top dog 2 slot game!A stigma new Hot Hot Tiptop Respin Online slot you to get to Delight online gambling better, but don't roll out that dice yet! http://ukpaydayloans.blog.co.uk/

    By Anonymous Anonymous, at 6:27 AM  

  • Nice blog thank you for sharing us.
    Intraday Jackpot Tips

    By Blogger abhishek singh, at 3:53 AM  

Post a Comment

<< Home