Question

So, what is this? I haven’t really experienced too much as far as “hacking” goes. I’ve dealt and solved most problems with PHP applications and I understand about 70% of this code.

But here is what I found, a Web Shell by Boff?

My code.

Answer 1

It is hard to say, but generally to exploit something like this there is a loop hole in an include / require which is including a $_GET or $_POST variable that is not being filtered / checked.

IE:

include($_GET['page'] . '.php');

Which some people did / do to lessen the code, however, anyone could inject a URL here and it could write a new file etc.

To fix:

$page = !empty($_GET['page'])?$_GET['page']:index;

$whiteList = array('index', 'home');

if (!in_array($page, $whiteList)) {
    $page = 'index';
}

include($page . '.php');

But yea, this is just one way. I am sure there are many other methods as well.