PHP EXIF Backdoors generator using custom shellcode

[Andrei]

PHPEB is a small tool that generates and stores obfuscated shellcode in user specified EXIF handlers. The backdoor is divided into two parts. The first part is a mix of the exif_read_data function to read the image headers and the preg_replace function to execute the content and the second is the real payload obfuscated in EXIF a JPG/TIFF file headers.

Both functions are harmless by themselves. Exif_read_data is commonly used to read images and preg_replace to replace the content of strings. However, preg_replace has a hidden and tricky option where if you pass the “/e” modifier it will execute the content (eval), instead of just searching/replacing.

Another interesting point is that the image that we generate still loads and works properly.

Started from Sucuri Research.

If you have any other cool ideas for obfuscating the shellcode, feel free to commit.

https://github.com/CCSIR/PHP-EXIF-Backdoors-generator-using-custom-shellcode

[Andrei]

Ha, nu stiam de preg_replace_callback. Ar putea zapaci AV-urile (gen Sucuri) ce se bazeaza pe white/black listing. Da, dar frumusetea in toata faza asta e ca ar trebui sa faci debugging pentru a vedea ca valoarea din preg_replace e o expresie regulata cu /e. Daca nu faci asta, sunt aproape sigur ca vor genera FA-uri.

Da, sunt constient de acest lucru, dar pana la urma uneltele automatizate forteaza deciziile in cazul celor care ar trebui sa ne fereasca de asa ceva.

Mersi de comentariu, daca mai cunosti astfel de functii "utile", da-mi de stire.