PHP OPcache Override
This project contains the demo website and the tools presented in the following blog posts :
- HackFest presentation: slides and video
- http://gosecure.net/2016/04/27/binary-webshell-through-opcache-in-php-7/
- http://gosecure.net/2016/05/26/detecting-hidden-backdoors-in-php-opcache/
010 Editor Template
These templates parse OPcache files generated by a 32 and 64 bit platform.
- Download 010 editor
Templates->Open Template...Select OPCACHE_x86.bt or OPCACHE_x86_64.bt- Open your OPcache file
- Press
F5
Python System ID Scraper
This tool lets you extract the system_id of a phpinfo() page.
Simply pass a filename or a URL.
$ ./system_id_scraper.py info.html
PHP version : 7.0.4-7ubuntu2
Zend Extension ID : API320151012,NTS
Zend Bin ID : BIN_SIZEOF_CHAR48888
Assuming x86_64 architecture
------------
System ID : 81d80d78c6ef96b89afaadc7ffc5d7ea
OPcache Disassembler
This tool lets you disassemble an OPcache file.
You can display it as a syntax tree (-t) or pseudocode (-c) on both 32 and 64 bit platforms. Simply pass a display option, the architecture to use and an OPcache file.
$ ./opcache_disassembler.py -c -a64 malware.php.bin
#0 $280 = FETCH_IS('_GET', None);
#1 ~0 = ISSET_ISEMPTY_DIM_OBJ($280, 'test');
#2 JMPZ(~408, ->5);
#3 ECHO('success', None);
...
OPcache Malware Hunter
This tool helps detect malware hidden in OPcache files by looking for manipulated OPcache files. It compiles its own version of the source code, compares the compiled file with the current cache file and checks for differences. You must run this tool on the same system as the one where the cache files have been compiled originally.
OPcache malware hunter requires four parameters :
- The location of the cache folder
- The architecture of the system (32 or 64 bit)
- The system_id
- The php.ini file used
In the situation where a potentially infected cache file is found, OPcache Malware Hunter will generate an HTML report in the filesystem showing the differences between the source code and the infected cache file.
$ ./opcache_malware_hunt.py /tmp/cache -a64 2d3b19863f4c71f9a3adda4c957752e2 /etc/php/7.0/cli/php.ini
Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/payload.php.bin
Parsing hunt_opcache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/payload.php.bin
Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-config.php.bin
Parsing hunt_opcache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-config.php.bin
Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-load.php.bin
...
Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/index.php.bin
Parsing hunt_opcache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/index.php.bin
Parsing /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-includes/pomo/translations.php.bin
Parsing hunt_opcache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/wp-includes/pomo/translations.php.bin
Potentially infected files :
- /tmp/cache/2d3b19863f4c71f9a3adda4c957752e2/home/vagrant/wordpress/index.php.bin
Main page of generated report :
A typical report page :
Demo
To setup the demo, run the following two commands :
sudo ./setup.sh
php -S 127.0.0.1:8080 -c php.ini
Note that on some Linux based systems, the opcache subsystem is compiled out of
the PHP core and must be dynamically loaded. This can be performed by adding
the following statement under the [PHP] directive:
zend_extension=opcache.so
Dockerized setup
Due to construct 2.9's API breakage, I created a docker container to run this project using construct 2.8. To use:
docker build -t opcache_analysis .
docker run -it --rm opcache_analysis sh
Then inside the busybox shell of the container you can use the tools, for example:
python ./analysis_tools/opcache_disassembler.py -c -a64 index.php.bin