PHP 8.1.0-dev BACKDOOR Hack (Easy RCE)

  Рет қаралды 135,271

John Hammond

John Hammond

Жыл бұрын

Jump in to the Snyk Capture the Flag 101 Workshop on September 14th at 11:00am ET: j-h.io/snyk-ctf101
Help the channel grow with a Like, Comment, & Subscribe!
❤️ Support ➡ j-h.io/patreon ↔ j-h.io/paypal ↔ j-h.io/buymeacoffee
Check out the affiliates below for more free or discounted learning!
🖥️ Zero-Point Security ➡ Certified Red Team Operator j-h.io/crto
💻Zero-Point Security ➡ C2 Development with C# j-h.io/c2dev
🐜Zero2Automated ➡ Ultimate Malware Reverse Engineering j-h.io/zero2auto
🐜Zero2Automated ➡ MISP & Malware Sandbox j-h.io/zero2auto-sandbox
⛳Point3 ESCALATE ➡ Top-Notch Capture the Flag Training j-h.io/escalate
👨🏻‍💻7aSecurity ➡ Hacking Courses & Pentesting j-h.io/7asecurity
📗Humble Bundle ➡ j-h.io/humblebundle
🐶Snyk ➡ j-h.io/snyk
🤹‍♀️SkillShare ➡ j-h.io/skillshare
🌎Follow me! ➡ j-h.io/discord ↔ j-h.io/twitter ↔ j-h.io/linkedin ↔ j-h.io/instagram ↔ j-h.io/tiktok
📧Contact me! (I may be very slow to respond or completely unable to)
🤝Sponsorship Inquiries ➡ j-h.io/sponsorship
🚩 CTF Hosting Requests ➡ j-h.io/ctf
🎤 Speaking Requests ➡ j-h.io/speaking
💥 Malware Submission ➡ j-h.io/malware
❓ Everything Else ➡ j-h.io/etc

Пікірлер: 134
@_JohnHammond
@_JohnHammond Жыл бұрын
Ps, HUGE THANKS to Snyk for sponsoring this video ! Snyk is putting together their next Capture the Flag 101 workshop! If you are new to CTF challenges and want some extra guidance on how to cut through binary exploitation or web security tasks, jump into their free online session on September 14th at 11am EDT! j-h.io/snyk-ctf101 click the link plz click it CLICK THE LINK j-h.io/snyk-ctf101 click click click
@nighthawk5305
@nighthawk5305 Жыл бұрын
Click a posted link, enter "Name", "Company E-Mail", "Company Name" and "Job Title" to register..... Not comfortable with that.
@link_safe
@link_safe Жыл бұрын
@@nighthawk5305 It's designed for businesses and companies.
@Fl0kii_
@Fl0kii_ Жыл бұрын
I could watch John explaining Python code for the rest of my life!
@caiovinicius8448
@caiovinicius8448 Жыл бұрын
It's a good idea.
@nikhilsuryanarayanan2133
@nikhilsuryanarayanan2133 Жыл бұрын
😂nice
@Propertymagnet_boy
@Propertymagnet_boy Жыл бұрын
why?
@spiegelbestseller9853
@spiegelbestseller9853 Жыл бұрын
Me too
@jasonb2221
@jasonb2221 Жыл бұрын
Thanks John, your way of teaching, explaining while you're working on the fly is awesome! Really teaches us how to think and react while troubleshooting.
@Zerback
@Zerback Жыл бұрын
Great content John! Thanks for all your shared knowledge as usual!
@michaelwerkov3438
@michaelwerkov3438 Жыл бұрын
Its fun how i know nothing about hacking but when he explains things it makes perfect sense
@dayanjihuzefa1827
@dayanjihuzefa1827 Жыл бұрын
Your channel is best source to learn Cybr security 👍
@analyzec137
@analyzec137 Жыл бұрын
Glad to hear about the snyk ctf webinar John.... can’t wait XD
@kaas12
@kaas12 Жыл бұрын
You never disappoint, thanks John!
@zanidd
@zanidd Жыл бұрын
Thank you -John- Kevin!
@daleryanaldover6545
@daleryanaldover6545 Жыл бұрын
I just remembered when I first CTF like experience with Kirshbaum. They have a challenge for job applicants and successfully doing the challenge grants them a chance for an interview. I failed the interview tho but it was a fun experience nonetheless.
@anthonylamoreaux1282
@anthonylamoreaux1282 Жыл бұрын
Love your videos! Thank you for all that you do.
@ponan0053
@ponan0053 Жыл бұрын
Could you do a video on how you make these challenges? like the thought process and steps behind it? I think thatd be awesome
@mrobvious6112
@mrobvious6112 Жыл бұрын
Its crazy how simple it is to understand python ven though I barely learned python Not really as simple but getting use to how it works makes it simple enough to understand...
@danielghani3903
@danielghani3903 Жыл бұрын
Thank you for the video suggestions .I will go through one by one
@renatofreirefilho
@renatofreirefilho Жыл бұрын
Obrigado, sempre ótimos conteúdos!
@huzifaahmed1426
@huzifaahmed1426 Жыл бұрын
I learn alot from you man 💚
@jimo8486
@jimo8486 Жыл бұрын
this is the only ad sponsor i would watch
@huzifaahmed1426
@huzifaahmed1426 Жыл бұрын
The Greatest man in this feild ❤❤❤
@GeorgeWulfers_88
@GeorgeWulfers_88 Жыл бұрын
Awesome! :) Great video as always.
@gabe_owner
@gabe_owner Жыл бұрын
I thought all the comments here were from bots at first, since the sponsorship happened right out of the gate and they were all so positive. Entertaining and engaging video, though. I might try some CTF myself, since I’ve never done anything related to cybersecurity.
@RedLabProduzioni
@RedLabProduzioni Жыл бұрын
Thanks John for teaching me 👾
@caiubyfreitas
@caiubyfreitas Жыл бұрын
Look, I'm not into security but I could not pass this video. Very interesting and made easy to understand some Linux command lines and strategies to find problems. Thanks!
@moustafakashen3610
@moustafakashen3610 Жыл бұрын
Love your content Mr. Hammond
@TheHaircutFish
@TheHaircutFish Жыл бұрын
Awesome vid John!!!
@MrsCyImsofly
@MrsCyImsofly Жыл бұрын
Thank you John
@djones0105
@djones0105 Жыл бұрын
thanks, John!
@bs12wrblimitedsti38
@bs12wrblimitedsti38 Жыл бұрын
I just got my A+, Net+, Sec+ and man there’s SOOO much more to learn haha maybe I’ll under more with time but 80% of the video I know. Just now I have to figure out how to implement everything I learned. Hands on is WAY better for me! Thank you for what you do hopefully one day I will be kind of close to on your level of knowledge.
@flaviomoreira01
@flaviomoreira01 Жыл бұрын
The more you know the more there is to know. Do you think it is good idea to get CEH cert has my first cert?
@johnpathe
@johnpathe Жыл бұрын
@@flaviomoreira01 yes
@Smithy957
@Smithy957 Жыл бұрын
@@flaviomoreira01 the OSCP is so much better than the CEH
@flaviomoreira01
@flaviomoreira01 Жыл бұрын
@@Smithy957 I have heard that it is harder to get it, but what is the requirement?
@flaviomoreira01
@flaviomoreira01 Жыл бұрын
@@zebbybobebby But in terms of reputation, would you agree that CEH is more advanced?
@joaoverde7742
@joaoverde7742 Жыл бұрын
I loved the office reference :D
@sdafasfF
@sdafasfF Жыл бұрын
Real cool man! Although I completed the box within 3 minutes X3
@DEADCODE_
@DEADCODE_ Жыл бұрын
you know what john i love you
@mohammedbahamid8759
@mohammedbahamid8759 Жыл бұрын
It would really be awesome if you could make a video on how to create a CTF challenge based on the vulnerabilities on Exploit DB. The way to navigate through exploit DB, the thinking process, etc...
@khaleedmayas
@khaleedmayas 11 ай бұрын
+1
@frosecold
@frosecold Жыл бұрын
Hey John, I've been using rustscan lately and i really like it, is. Slot faster and can be complemented with nmap for full scans but is much faster. I wonder why you don't use it?
@elisansabimana6200
@elisansabimana6200 Жыл бұрын
Thanks for the video.
@JoakimKanon
@JoakimKanon Жыл бұрын
May I suggest backing off from the mic, or getting a pop filter? Your P’s are pretty brutal on headphones. Great video, anyways. 😍
@aquaforgegames6207
@aquaforgegames6207 Жыл бұрын
I've always wanted to get into whitehat hacking and this is the best video I've seen so far about it. You're amazing
@ALD7MI2011
@ALD7MI2011 Жыл бұрын
I learned alot thanks
@nelaina
@nelaina Жыл бұрын
Thank you John. Do you think the snyk ctf webinar is good for an absolute beginner? No ctf experience (aside from your channel), and just starting to learn python, cybersec, etc...thanks.
@brian.-_393i3.-_
@brian.-_393i3.-_ Жыл бұрын
Thanks!
@caiovinicius8448
@caiovinicius8448 Жыл бұрын
Very interesting.
@cartoonchannel5584
@cartoonchannel5584 Жыл бұрын
You are best ;) Thank You !!!!!!!!!!!!!!!!
@WanderlustVisual5
@WanderlustVisual5 Жыл бұрын
Good stuff
@0xm3m
@0xm3m Жыл бұрын
Can you make a video on Creating vulnerable machines for hacking platforms in depth, and that can be in series?
@guilherme5094
@guilherme5094 Жыл бұрын
Thanks.
@kekeke7815
@kekeke7815 Жыл бұрын
Hey, I just wanted to check briesofty if there is a way for to import a new soft into the program, for example softs or sotNice tutorialng that
@0xmkay
@0xmkay Жыл бұрын
Pls was the workshop session recorded cos I missed it
@plooshdev
@plooshdev Жыл бұрын
nice
@themasterofdisastr1226
@themasterofdisastr1226 Жыл бұрын
Last year, this exploit was featured in HackTheBox when it was quite new. You had to understand a chinese Blog post to get the shell back then
@gauthamgamer1214
@gauthamgamer1214 Жыл бұрын
nice one
@CageTheTurtle
@CageTheTurtle Жыл бұрын
what up KEVIN!!
@christophermarshall8712
@christophermarshall8712 10 ай бұрын
This is why I never upgrade to a version of PHP when it first comes out. I always stay one or two behind if I can to make sure if any severe vulnerabilities like this come out they are fixed before they can affect me.
@badbgp
@badbgp Жыл бұрын
Zerodium ~ Zero Diem ~ Zero Day
@fdgmedd
@fdgmedd Жыл бұрын
Gj :)
@FidelEmilioSusanaJimenez
@FidelEmilioSusanaJimenez Жыл бұрын
👽😍😍😍
@georgehammond867
@georgehammond867 Жыл бұрын
what is proc in Linux directories? and why does its size be 140 TB ,, which system uses that huge amount of memory in the tera bytes?
@Terszel
@Terszel Жыл бұрын
Think I remember when this backdoor went up, wasn't it a big thing?
@branisgreat
@branisgreat Жыл бұрын
The hair in front of his face the entire time man lmao
@diegocracker
@diegocracker Жыл бұрын
Show thanks obrigado
@wcrb15
@wcrb15 Жыл бұрын
Whoa that seems really bad. Gonna have to go do some more research on that user agentt situation
@lincolnschoolpreservation3574
@lincolnschoolpreservation3574 Жыл бұрын
Huh😟😖. I recognize everything on screen n what u say. the operational word recognize i don't understand any of it. But thanks for posting, idk how this channel came into my feed, algorithms rights ha, maybe it's because i did my 1st hack but have no idea how i did it. Ur right about the trial n error, more to learn. my brain hurts,
@sdafasfF
@sdafasfF Жыл бұрын
Every happened to the Ubuntu install?
@juneilquilana5159
@juneilquilana5159 Жыл бұрын
❤️❤️❤️👏👏👍
@mathesonstep
@mathesonstep Жыл бұрын
Can you do a video on setting up a VM for doing these challenges, I have wanted to do these challenges for a while but want to ensure I am being as safe as possible as I have heard you are all connecting to the same VPN network I want to ensure my vm is as isolated as possible, I was thinking putting my vm behind a virtualized pfSense and blocking access to my network from that pfSense firewall. Am I overthinking this or should I really dedicate one vm and virtual network setup to just CTF challenges?
@eandudley8415
@eandudley8415 Жыл бұрын
Just throw up a kali machine on VMware.
@Freeak6
@Freeak6 Жыл бұрын
One thing I don't understand is why root user in container has root privileges in host filesystem? These shouldn't be treated as different users? To me, users in containers shouldn't 'communicate' with users in host. Why is it the case? Thanks :)
@animesubber7136
@animesubber7136 Жыл бұрын
Whats with the thumbnail lol John Hammond Breaking bad XD
@dopy8418
@dopy8418 Жыл бұрын
What's with the marvin villain thumbnail ?
@judylyons177
@judylyons177 Жыл бұрын
Sorry, not on this subject. Any advice of how to get rid of Instant Memo? It is messing my tablet up. Tried numerous ways to uninstall, can't. Force stop, clear cache doesn't even slow it down. I can't find any info on it.
@khaleedmayas
@khaleedmayas 11 ай бұрын
anyone tried to get rev shell on the machine or could ?
@michaelwerkov3438
@michaelwerkov3438 Жыл бұрын
What is verbosity in this context?
@jaypatel-gr9st
@jaypatel-gr9st Жыл бұрын
Apache tomcat 8.5.58 vuln ??
@12346798Mann
@12346798Mann Жыл бұрын
The webpage looks like an appseed template
@ihsankurniawan3591
@ihsankurniawan3591 Жыл бұрын
how do you know what to search? what if i cannot tell if PHP 8.1.0-dev is the keyword?
@EricDubeA
@EricDubeA Жыл бұрын
What I'm really struck by is that it was _planted_, by a security firm that sells exploits no less... wow
@aqsajimmy2803
@aqsajimmy2803 Жыл бұрын
did u already create an exploite sir ?
@InsaneRecords997
@InsaneRecords997 Жыл бұрын
Watching on sep 27 lol
@onen0zednine753
@onen0zednine753 Жыл бұрын
so who caught the 'Kevin/ Office' refence at the beginning?
@BuddyWazzup
@BuddyWazzup Жыл бұрын
yeah!!! "Why use more words when less do trick?" 🤣🤣🤣🤣🤣🤣
@onen0zednine753
@onen0zednine753 Жыл бұрын
@@BuddyWazzup
@jaume748
@jaume748 Жыл бұрын
Why I got rickrolled ?¿? I only wanted to do the workshop
@pathfinder750
@pathfinder750 Жыл бұрын
Agent-T
@LiEnby
@LiEnby Жыл бұрын
LOL'd at this ahaha if you dont provide the "zerodium" at the start of the string it just says "REMOVETHIS: Sold to zerodium in 2017"
@soniablanche5672
@soniablanche5672 Жыл бұрын
I don't get it, why would you intentionally add a backdoor to php.
@Freeak6
@Freeak6 Жыл бұрын
It was made by an attacker who compromised git php's servers. So the attacker will have a backdoor on all servers that run this version of php (so possibly millions of servers if the attack had not been detected).
@azatecas
@azatecas Жыл бұрын
to all php devs, jump ship while you still can
@kevinwong_2016
@kevinwong_2016 Жыл бұрын
Look for mobile malware please
@rebelsdeveloper367
@rebelsdeveloper367 Жыл бұрын
hmm..
@unknown_3293
@unknown_3293 Жыл бұрын
mp4 mp3 files backdoor
@SB-qm5wg
@SB-qm5wg Жыл бұрын
php had a backdoor built in. WTF!?
@Freeak6
@Freeak6 Жыл бұрын
It was a dev version, and from what they showed, it has been caught before going into production.
@omari4m
@omari4m Жыл бұрын
as a php programmer , feeling so sad
@qilibth
@qilibth Жыл бұрын
Please laugh a bit so I can see if you sound like Seth Rogen.
@hanomedia
@hanomedia Жыл бұрын
*I feel pity for Php Evangelists*
@thispacifist9004
@thispacifist9004 Жыл бұрын
John your having a laugh arent you with this? I like watching your videos because you are informative. You said at the beginning this was an easy challenge, yet you copy and pasted someone else's code.
@abhishek24506
@abhishek24506 Жыл бұрын
Php is still important??
@sipintarpatrick2937
@sipintarpatrick2937 Жыл бұрын
why not
@HTWwpzIuqaObMt
@HTWwpzIuqaObMt Жыл бұрын
Trying to be funny?
@JustinMylo
@JustinMylo Жыл бұрын
@@HTWwpzIuqaObMt it is funny
@henrym5034
@henrym5034 Жыл бұрын
Wordpress.
@_Omni
@_Omni Жыл бұрын
Yes it is
@MrGeekGamer
@MrGeekGamer Жыл бұрын
I dropped PHP 19 years ago, because I was awful then and it's still awful now. Stop using PHP.
@tutorialsacc7314
@tutorialsacc7314 Жыл бұрын
no its not
@MrGeekGamer
@MrGeekGamer Жыл бұрын
@@tutorialsacc7314 I won't argue with you, because you're clearly an idiot if you're simping for PHP in 2022.
@cirklare
@cirklare Жыл бұрын
I told you PHP is very vulnerable language Also php 5.3 has RCE exploit Another php vulnerability PHP CGI argument injection
@toifel
@toifel Жыл бұрын
PHP 5.3 is older than KZfaq and this backdoor is using a "-dev" build which no sane person would ever use in production. I'm not even using PHP, but you obviously don't have any clue what you're even talking about.
@whetfaartz6685
@whetfaartz6685 Жыл бұрын
@@toifel lol you didn't have to do him like that
@tagKnife
@tagKnife Жыл бұрын
still using nmap rather then zmap. 2000 called they want their shell script kiddies back.
@alezad57121
@alezad57121 Жыл бұрын
this is good, enjoyment.exe 😊
@wolfmafia5621
@wolfmafia5621 Жыл бұрын
Ah man tryhackme is so fun. Thanks you for developing some fun challenges for us.
How Hackers Move Through Networks (with Ligolo)
20:01
John Hammond
Рет қаралды 247 М.
MAJOR EXPLOIT: This GIF can Backdoor any Android Phone (sort of)
12:00
Não pode Comprar Tudo 5
00:29
DUDU e CAROL
Рет қаралды 80 МЛН
Kitten has a slime in her diaper?! 🙀 #cat #kitten #cute
00:28
蜘蛛侠这操作也太坏了吧#蜘蛛侠#超人#超凡蜘蛛
00:47
超凡蜘蛛
Рет қаралды 39 МЛН
Зомби Апокалипсис  часть 1 🤯#shorts
00:29
INNA SERG
Рет қаралды 4,4 МЛН
Hack like Mr Robot // WiFi, Bluetooth and Scada hacking
45:23
David Bombal
Рет қаралды 2,1 МЛН
PHP Data Exfiltration - Leaking Sensitive Filenames
26:21
John Hammond
Рет қаралды 55 М.
The Beginner's Guide to Blind XSS (Cross-Site Scripting)
21:21
Hack With SMS | SMS Spoofing like Mr. Robot!
11:32
zSecurity
Рет қаралды 910 М.
I Played HackTheBox For 30 Days - Here's What I Learned
10:23
Grant Collins
Рет қаралды 281 М.
How do hackers hide themselves? - staying anonymous online
11:55
Grant Collins
Рет қаралды 1,3 МЛН
I shouldn’t have kept the $1,000,000 computer
28:05
Linus Tech Tips
Рет қаралды 965 М.
How to Hack Passwords Using Hydra!
7:34
CyberFlow
Рет қаралды 36 М.
Advanced Local and Remote File Inclusion - PHP Wrappers
11:19
Netsec Explained
Рет қаралды 8 М.
Flipper Zero: Hottest Hacking Device?
10:01
David Bombal
Рет қаралды 7 МЛН
Não pode Comprar Tudo 5
00:29
DUDU e CAROL
Рет қаралды 80 МЛН