PHP Shell code - Revision history

192.168.110.1 at 18:57, 14 September 2022

2022-09-14T18:57:37Z

← Older revision		Revision as of 18:57, 14 September 2022
Line 46:		Line 46:
	PHP		PHP

	Cyber chef		Cyber chef https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)XOR(%7B'option':'UTF8','string':'4696bd9a'%7D,'Standard',false)Zlib_Inflate(0,0,'Adaptive',false,false)&input=VEtveS95b3hjYXA5ZW03K1R0SnJLWDhFRFljcUtvMVZmZ2VJQmxOVURpa0dBd2dIS1ZZUFV3SjRkSHRSVUE2QU5qWUgwbTc5

	===Flag===		===Flag===

Exf at 18:56, 14 September 2022

2022-09-14T18:56:33Z

← Older revision		Revision as of 18:56, 14 September 2022
Line 23:		Line 23:
	I manually looked through the top php shell file provided and noticed that there was an attempt to hide functions in the file. By sorting them out, I found out how the server and the attacker were working.		I manually looked through the top php shell file provided and noticed that there was an attempt to hide functions in the file. By sorting them out, I found out how the server and the attacker were working.

	So the attacker has sent the following command to a specific file: "chdir('/var/www/html');@error_reporting(0);@system('cat flag.txt 2>&1');" which he first compresses into a gz package, then performs XOR encryption and converts this to base64. Around this, the attacker wraps an additional identification code to activate the program.		So the attacker has sent the following command to a specific file: <code>chdir('/var/www/html');@error_reporting(0);@system('cat flag.txt 2>&1');</code> which he first compresses into a gz package, then performs XOR encryption and converts this to base64. Around this, the attacker wraps an additional identification code to activate the program.

	The subtlety of this attack is the use of the eval command, which runs the given command and therefore returns the output of the command executed using the previous encryption method.		The subtlety of this attack is the use of the eval command, which runs the given command and therefore returns the output of the command executed using the previous encryption method.

Exf at 18:56, 14 September 2022

2022-09-14T18:56:13Z

← Older revision		Revision as of 18:56, 14 September 2022
Line 2:		Line 2:
	[[File:Php-shell.PNG\|thumb\|Cyber cheff with flag]]		[[File:Php-shell.PNG\|thumb\|Cyber cheff with flag]]
	[[File:Wireshark-l.PNG\|thumb\|Wireshark packets]]		[[File:Wireshark-l.PNG\|thumb\|Wireshark packets]]
			[[File:Wireshark-packet.PNG\|thumb\|Wireshark packet inspection]]

	===Description===		===Description===

Exf at 18:55, 14 September 2022

2022-09-14T18:55:55Z

← Older revision		Revision as of 18:55, 14 September 2022
Line 1:		Line 1:
	[[File:Php-shell-explaned.PNG\|thumb\|PHP Reverse shell file with comments]]		[[File:Php-shell-explaned.PNG\|thumb\|PHP Reverse shell file with comments]]
	[[File:Php-shell.PNG\|thumb\|Cyber cheff with flag]]		[[File:Php-shell.PNG\|thumb\|Cyber cheff with flag]]
			[[File:Wireshark-l.PNG\|thumb\|Wireshark packets]]

	===Description===		===Description===

Exf at 18:52, 14 September 2022

2022-09-14T18:52:50Z

← Older revision		Revision as of 18:52, 14 September 2022
Line 1:		Line 1:
	[[File:Php-shell-explaned.PNG\|thumb\|PHP Reverse shell file with comments]]		[[File:Php-shell-explaned.PNG\|thumb\|PHP Reverse shell file with comments]]
			[[File:Php-shell.PNG\|thumb\|Cyber cheff with flag]]

	===Description===		===Description===

Exf at 18:51, 14 September 2022

2022-09-14T18:51:55Z

← Older revision		Revision as of 18:51, 14 September 2022
Line 1:		Line 1:
			[[File:Php-shell-explaned.PNG\|thumb\|PHP Reverse shell file with comments]]

	===Description===		===Description===
	You have to investigate recent attack on your web server.		You have to investigate recent attack on your web server.

192.168.110.1 at 18:49, 14 September 2022

2022-09-14T18:49:42Z

← Older revision		Revision as of 18:49, 14 September 2022
Line 35:		Line 35:

	===Tools===		===Tools===
	unphp.net		[https://Unphp.net unphp.net]

	Wireshark		Wireshark
Line 41:		Line 41:
	PHP		PHP

	~~Cyberchef~~		Cyber chef

	===Flag===		===Flag===

192.168.110.1 at 18:49, 14 September 2022

2022-09-14T18:49:06Z

← Older revision		Revision as of 18:49, 14 September 2022
Line 44:		Line 44:

	===Flag===		===Flag===
			<code>fb148ca92d484070b5446b3233eef174</code>
	===Links===		===Links===
	*[[CTF Challenges \| Back to CTF Challenges page]]		*[[CTF Challenges \| Back to CTF Challenges page]]

192.168.110.1 at 18:48, 14 September 2022

2022-09-14T18:48:48Z

@@ Line 16: / Line 16: @@
 ===Solution===
 ===Tools===
 ===Flag===

192.168.110.1: /* Description */

2022-09-14T12:42:28Z

Description

@@ Line 1: / Line 1: @@
 ===Description===
 ===Question===
 ===Solution===