PHP 8.1.0-dev BACKDOOR Hack (Easy RCE)

Jump in to the Snyk Capture the Flag 101 Workshop on September 14th at 11:00am ET: j-h.io/snyk-ctf101
Help the channel grow with a Like, Comment, & Subscribe!
❤️ Support ➡ j-h.io/patreon ↔ j-h.io/paypal ↔ j-h.io/buymeacoffee
Check out the affiliates below for more free or discounted learning!
🖥️ Zero-Point Security ➡ Certified Red Team Operator j-h.io/crto
💻Zero-Point Security ➡ C2 Development with C# j-h.io/c2dev
🐜Zero2Automated ➡ Ultimate Malware Reverse Engineering j-h.io/zero2auto
🐜Zero2Automated ➡ MISP & Malware Sandbox j-h.io/zero2auto-sandbox
⛳Point3 ESCALATE ➡ Top-Notch Capture the Flag Training j-h.io/escalate
👨🏻‍💻7aSecurity ➡ Hacking Courses & Pentesting j-h.io/7asecurity
📗Humble Bundle ➡ j-h.io/humblebundle
🐶Snyk ➡ j-h.io/snyk
🤹‍♀️SkillShare ➡ j-h.io/skillshare
🌎Follow me! ➡ j-h.io/discord ↔ j-h.io/twitter ↔ j-h.io/linkedin ↔ j-h.io/instagram ↔ j-h.io/tiktok
📧Contact me! (I may be very slow to respond or completely unable to)
🤝Sponsorship Inquiries ➡ j-h.io/sponsorship
🚩 CTF Hosting Requests ➡ j-h.io/ctf
🎤 Speaking Requests ➡ j-h.io/speaking
💥 Malware Submission ➡ j-h.io/malware
❓ Everything Else ➡ j-h.io/etc

[@_JohnHammond]

Ps, HUGE THANKS to Snyk for sponsoring this video ! Snyk is putting together their next Capture the Flag 101 workshop! If you are new to CTF challenges and want some extra guidance on how to cut through binary exploitation or web security tasks, jump into their free online session on September 14th at 11am EDT! j-h.io/snyk-ctf101 click the link plz click it CLICK THE LINK j-h.io/snyk-ctf101 click click click

[@nighthawk5305]

Click a posted link, enter "Name", "Company E-Mail", "Company Name" and "Job Title" to register..... Not comfortable with that.

[@link_safe]

@@nighthawk5305 It's designed for businesses and companies.

[@Fl0kii_]

I could watch John explaining Python code for the rest of my life!

[@caiovinicius8448]

It's a good idea.

[@nikhilsuryanarayanan2133]

😂nice

[@Propertymagnet_boy]

why?

[@spiegelbestseller9853]

Me too

[@jasonb2221]

Thanks John, your way of teaching, explaining while you're working on the fly is awesome! Really teaches us how to think and react while troubleshooting.

[@michaelwerkov3438]

Its fun how i know nothing about hacking but when he explains things it makes perfect sense

[@dayanjihuzefa1827]

Your channel is best source to learn Cybr security 👍

[@zanidd]

Thank you -John- Kevin!

[@analyzec137]

Glad to hear about the snyk ctf webinar John.... can’t wait XD

[@Zerback]

Great content John! Thanks for all your shared knowledge as usual!

[@ponan0053]

Could you do a video on how you make these challenges? like the thought process and steps behind it? I think thatd be awesome

[@daleryanaldover6545]

I just remembered when I first CTF like experience with Kirshbaum. They have a challenge for job applicants and successfully doing the challenge grants them a chance for an interview. I failed the interview tho but it was a fun experience nonetheless.

[@kaas12]

You never disappoint, thanks John!

[@anthonylamoreaux1282]

Love your videos! Thank you for all that you do.

[@gabe_owner]

I thought all the comments here were from bots at first, since the sponsorship happened right out of the gate and they were all so positive. Entertaining and engaging video, though. I might try some CTF myself, since I’ve never done anything related to cybersecurity.

[@jimo8486]

this is the only ad sponsor i would watch

[@caiubyfreitas]

Look, I'm not into security but I could not pass this video. Very interesting and made easy to understand some Linux command lines and strategies to find problems. Thanks!

[@mrobvious6112]

Its crazy how simple it is to understand python ven though I barely learned python Not really as simple but getting use to how it works makes it simple enough to understand...

[@GeorgeWulfers_88]

Awesome! :) Great video as always.

[@RedLabProduzioni]

Thanks John for teaching me 👾

[@huzifaahmed1426]

I learn alot from you man 💚

[@bs12wrblimitedsti38]

I just got my A+, Net+, Sec+ and man there’s SOOO much more to learn haha maybe I’ll under more with time but 80% of the video I know. Just now I have to figure out how to implement everything I learned. Hands on is WAY better for me! Thank you for what you do hopefully one day I will be kind of close to on your level of knowledge.

[@flaviomoreira01]

The more you know the more there is to know. Do you think it is good idea to get CEH cert has my first cert?

[@johnpathe]

@@flaviomoreira01 yes

[@Smithy957]

@@flaviomoreira01 the OSCP is so much better than the CEH

[@flaviomoreira01]

@@Smithy957 I have heard that it is harder to get it, but what is the requirement?

[@flaviomoreira01]

@@zebbybobebby But in terms of reputation, would you agree that CEH is more advanced?

[@renatofreirefilho]

Obrigado, sempre ótimos conteúdos!

[@nelaina]

Thank you John. Do you think the snyk ctf webinar is good for an absolute beginner? No ctf experience (aside from your channel), and just starting to learn python, cybersec, etc...thanks.

[@TheHaircutFish]

Awesome vid John!!!

[@mohammedbahamid8759]

It would really be awesome if you could make a video on how to create a CTF challenge based on the vulnerabilities on Exploit DB. The way to navigate through exploit DB, the thinking process, etc...

[@khaleedmayas]

+1

[@danielghani3903]

Thank you for the video suggestions .I will go through one by one

[@moustafakashen3610]

Love your content Mr. Hammond

[@sdafasfF]

Real cool man! Although I completed the box within 3 minutes X3

[@frosecold]

Hey John, I've been using rustscan lately and i really like it, is. Slot faster and can be complemented with nmap for full scans but is much faster. I wonder why you don't use it?

[@joaoverde7742]

I loved the office reference :D

[@JoakimKanon]

May I suggest backing off from the mic, or getting a pop filter? Your P’s are pretty brutal on headphones. Great video, anyways. 😍

[@aquaforgegames6207]

I've always wanted to get into whitehat hacking and this is the best video I've seen so far about it. You're amazing

[@djones0105]

thanks, John!

[@MrsCyImsofly]

Thank you John

[@huzifaahmed1426]

The Greatest man in this feild ❤❤❤

[@DEADCODE_]

you know what john i love you

[@0xm3m]

Can you make a video on Creating vulnerable machines for hacking platforms in depth, and that can be in series?

[@elisansabimana6200]

Thanks for the video.

[@christophermarshall8712]

This is why I never upgrade to a version of PHP when it first comes out. I always stay one or two behind if I can to make sure if any severe vulnerabilities like this come out they are fixed before they can affect me.

[@ALD7MI2011]

I learned alot thanks

[@CageTheTurtle]

what up KEVIN!!

[@caiovinicius8448]

Very interesting.

[@kekeke7815]

Hey, I just wanted to check briesofty if there is a way for to import a new soft into the program, for example softs or sotNice tutorialng that

[@0xmkay]

Pls was the workshop session recorded cos I missed it

[@Terszel]

Think I remember when this backdoor went up, wasn't it a big thing?

[@badbgp]

Zerodium ~ Zero Diem ~ Zero Day

[@themasterofdisastr1226]

Last year, this exploit was featured in HackTheBox when it was quite new. You had to understand a chinese Blog post to get the shell back then

[@brian.-_393i3.-_]

Thanks!

[@cartoonchannel5584]

You are best ;) Thank You !!!!!!!!!!!!!!!!

[@WanderlustVisual5]

Good stuff

[@Freeak6]

One thing I don't understand is why root user in container has root privileges in host filesystem? These shouldn't be treated as different users? To me, users in containers shouldn't 'communicate' with users in host. Why is it the case? Thanks :)

[@branisgreat]

The hair in front of his face the entire time man lmao

[@gauthamgamer1214]

nice one

[@guilherme5094]

Thanks.

[@mathesonstep]

Can you do a video on setting up a VM for doing these challenges, I have wanted to do these challenges for a while but want to ensure I am being as safe as possible as I have heard you are all connecting to the same VPN network I want to ensure my vm is as isolated as possible, I was thinking putting my vm behind a virtualized pfSense and blocking access to my network from that pfSense firewall. Am I overthinking this or should I really dedicate one vm and virtual network setup to just CTF challenges?

[@eandudley8415]

Just throw up a kali machine on VMware.

[@georgehammond867]

what is proc in Linux directories? and why does its size be 140 TB ,, which system uses that huge amount of memory in the tera bytes?

[@judylyons177]

Sorry, not on this subject. Any advice of how to get rid of Instant Memo? It is messing my tablet up. Tried numerous ways to uninstall, can't. Force stop, clear cache doesn't even slow it down. I can't find any info on it.

[@wcrb15]

Whoa that seems really bad. Gonna have to go do some more research on that user agentt situation

[@animesubber7136]

Whats with the thumbnail lol John Hammond Breaking bad XD

[@plooshdev]

nice

[@ihsankurniawan3591]

how do you know what to search? what if i cannot tell if PHP 8.1.0-dev is the keyword?

What I'm really struck by is that it was _planted_, by a security firm that sells exploits no less... wow

[@dopy8418]

What's with the marvin villain thumbnail ?

[@diegocracker]

Show thanks obrigado

[@sdafasfF]

Every happened to the Ubuntu install?

[@12346798Mann]

The webpage looks like an appseed template

[@michaelwerkov3438]

What is verbosity in this context?

[@onen0zednine753]

so who caught the 'Kevin/ Office' refence at the beginning?

[@BuddyWazzup]

yeah!!! "Why use more words when less do trick?" 🤣🤣🤣🤣🤣🤣

[@onen0zednine753]

@@BuddyWazzup

[@jaypatel-gr9st]

Apache tomcat 8.5.58 vuln ??

[@jaume748]

Why I got rickrolled ?¿? I only wanted to do the workshop

[@khaleedmayas]

anyone tried to get rev shell on the machine or could ?

[@aqsajimmy2803]

did u already create an exploite sir ?

[@soniablanche5672]

I don't get it, why would you intentionally add a backdoor to php.

[@Freeak6]

It was made by an attacker who compromised git php's servers. So the attacker will have a backdoor on all servers that run this version of php (so possibly millions of servers if the attack had not been detected).

[@InsaneRecords997]

Watching on sep 27 lol

[@azatecas]

to all php devs, jump ship while you still can

[@chris7010_1]

Astra Linux users can take the hack me challenge.

[@FidelEmilioSusanaJimenez]

👽😍😍😍

[@LiEnby]

LOL'd at this ahaha if you dont provide the "zerodium" at the start of the string it just says "REMOVETHIS: Sold to zerodium in 2017"

[@fdgmedd]

Gj :)

[@kevinwong_2016]

Look for mobile malware please

[@pathfinder750]

Agent-T

[@juneilquilana5159]

❤️❤️❤️👏👏👍

[@rebelsdeveloper367]

hmm..

[@SB-qm5wg]

php had a backdoor built in. WTF!?

[@Freeak6]

It was a dev version, and from what they showed, it has been caught before going into production.

[@omari4m]

as a php programmer , feeling so sad

[@unknown_3293]

mp4 mp3 files backdoor

[@abhishek24506]

Php is still important??

[@sipintarpatrick]

why not

[@HTWwpzIuqaObMt]

Trying to be funny?

[@JustinMylo]

@@HTWwpzIuqaObMt it is funny

[@henrym5034]

Wordpress.

[@_Omni]

Yes it is

[@masdadmin]

Please laugh a bit so I can see if you sound like Seth Rogen.

[@thispacifist9004]

John your having a laugh arent you with this? I like watching your videos because you are informative. You said at the beginning this was an easy challenge, yet you copy and pasted someone else's code.

[@hanomedia]

*I feel pity for Php Evangelists*

[@MrGeekGamer]

I dropped PHP 19 years ago, because I was awful then and it's still awful now. Stop using PHP.

[@tutorialsacc7314]

no its not

[@MrGeekGamer]

@@tutorialsacc7314 I won't argue with you, because you're clearly an idiot if you're simping for PHP in 2022.

[@cirklare]

I told you PHP is very vulnerable language Also php 5.3 has RCE exploit Another php vulnerability PHP CGI argument injection

[@toifel]

PHP 5.3 is older than KZbin and this backdoor is using a "-dev" build which no sane person would ever use in production. I'm not even using PHP, but you obviously don't have any clue what you're even talking about.

[@whetfaartz6685]

@@toifel lol you didn't have to do him like that

[@tagKnife]

still using nmap rather then zmap. 2000 called they want their shell script kiddies back.

[@alezad57121]

this is good, enjoyment.exe 😊

[@wolfmafia5621]

Ah man tryhackme is so fun. Thanks you for developing some fun challenges for us.