Forest Global Training Partners

Cyber Risks · Cisco Talos

PHP-CGI Leads To C99 Shell

Summary: Cisco Talos reviewed a scan against the PHP-CGI vulnerability that used crafted index.php parameters to enable remote file inclusion and pull down a file called info3.txt, which contained only a PHP echo of the string 830ad4ea3b311795d5a615b9e5fdbb9a. A related file, info2.txt, carried Base64-encoded code identified as c99shell.php v.1.0 beta, the C99 Shell backdoor, and Talos wrote SID 23016 to match the encoded 'c99shell.php v' string, SID 23018 for 'eval(base64_decode(', and SID 23017 for a distinctive string in the exploit author's comments.

What's compelling: The C99 Shell gives an attacker easy web-interface control of any box that gets popped, and Talos notes that searching for 'eval(base64_decode(' returns pages of hits on hacked web sites and nothing on legitimate use - a generic indicator that can catch attacks you have no specific signature for.

Read the original at Cisco Talos ↗

Topics
Malware
Related