************************************************************* ************************************************************* ************ *********** ************ Server -> Client Communtication for *********** ************ Preprocessor languages (PHP) *********** ************ by Second Part To Hell/[rRlf] *********** ************ *********** ************************************************************* ************************************************************* Index: ****** 0) Intro Words 1) The idea (Theory) 2) The code 3) Last Words 0) Intro Words A 'Preprocessor language' is a web-based language, which has been done to run on a server, and only on the server. The results by the executed web-based preprocessor script (like PHP) file will be transfered to the Webpage, which can be seen by the user. That means, the user will never see the code of that script. As a result, the script can not harm the user in any way, because it is executed on the server, (and only there) and just the results are send to the user. This has been also written in VirusBulletin March/2001 in an article by Denis Zenlin & Mike Pavlushchik called 'PHP go the Script Viruses'. The article deals with the PHP.Pirus (29a#5) and PHP.NewWorld and the common PHP problem. A very important statement of the article: '... and it does not have the ability to spread to other Web sites or PCs of the visitors who view an HTML page containing a malicious PHP script. This last case is not possible simply because a user receives a pure HTML page with absolutely no script inside from the PHP processor...' Well, that's not true at all, which I will prove in this article. :) 1) The idea (Theory) It is very true that the PHP code is executed on the server, and just on the server. And it returns just the pure HTML code. That made me think about that topic more intensive. Finally I got an idea: If the PHP script returns a HTML code, and HTML codes could contain '';$nl.$nl; ?> - - - - - - - - - - - - - [ server-client.php ] - - - - - - - - - - - - - 3) Last Words This technique is a prove that PHP can affect the user (client), even many people denied it. Beside of the problem that PHP is not that secure, the technique is very dangerous because there are NO warnings, the script just works without any messange, and the user don't even recognize it. It would be able to make a fully virus with this technique, which infects the users HD, and (s)he would not recognize it. Therefore such a creature could be easiely get in the wild. That result makes me happy, because two new things has been discovered. I hope I gave you with that article some help or maybe new ideas for your next viruses... - - - - - - - - - - - - - - - Second Part To Hell/[rRlf] www.spth.de.vu spth@priest.com written from november 2004 Austria - - - - - - - - - - - - - - -