1
1
# PHP OPcache Override
2
2
3
- This project contains the demo website and the tools presented in the following blog post :
3
+ This project contains the demo website and the tools presented in the following blog post :
4
4
http://blog.gosecure.ca/2016/04/27/binary-webshell-through-opcache-in-php-7
5
5
6
6
## 010 Editor Template
7
7
8
- This template parses OPcache files generated by a 32bit platform.
8
+ This template parses OPcache files generated by a 32bit platform.
9
9
10
10
- Download [ 010 editor] ( http://www.sweetscape.com/010editor/ )
11
11
- ` Templates ` -> ` Open Template... ` Select OPCACHE_x86.bt
@@ -14,7 +14,7 @@ This template parses OPcache files generated by a 32bit platform.
14
14
15
15
## Python System ID Scraper
16
16
17
- This tool lets you extract the ` system_id ` of a ` phpinfo() ` page.
17
+ This tool lets you extract the ` system_id ` of a ` phpinfo() ` page.
18
18
Simply pass a filename or a URL.
19
19
20
20
$ ./system_id_scraper.py info.html
@@ -32,26 +32,26 @@ You can display it as a syntax tree (-t) or pseudocode (-c).
32
32
Simply pass a display option and an OPcache file.
33
33
34
34
$ ./opcache_disassembler.py -c malware.php.bin
35
-
35
+
36
36
#0 $280 = FETCH_IS('_GET', None);
37
37
#1 ~0 = ISSET_ISEMPTY_DIM_OBJ($280, 'test');
38
38
#2 JMPZ(~408, ->5);
39
39
#3 ECHO('success', None);
40
40
...
41
41
42
42
43
- ## OPcache Malware Detect
43
+ ## OPcache Malware Hunter
44
44
This tool helps detect malware hidden in OPcache files by searching specific keywords in the file's opcodes.
45
45
46
- Pass an OPcache file or directory and the detector will recursively go through all the ` .php.bin ` files.
46
+ Pass an OPcache file or directory and the hunter will recursively go through all the ` .php.bin ` files.
47
47
48
- $ ./opcache_malware_detect .py malware.php.bin
48
+ $ ./opcache_malware_hunt .py malware.php.bin
49
49
Checking malware.php.bin
50
- Found potentially dangerous keyword 'preg_replace'.
51
- Found potentially dangerous keyword 'str_rot13'.
50
+ Found potentially dangerous keyword 'preg_replace'.
51
+ Found potentially dangerous keyword 'str_rot13'.
52
52
53
53
## Demo
54
- To setup the demo, run the following two commands :
54
+ To setup the demo, run the following two commands :
55
55
56
56
sudo ./setup.sh
57
57
php -S 127.0.0.1:8080 -c php.ini
0 commit comments