OpCompiler

How to use Zend OPCache functions to protect your PHP code.

Introduction

Up to PHP5.3 I used to encode PHP files with the BCompiler. Inspired by Bencoder I have built my own scripts to encode and deploy. Now with PHP7.0 is possible again to achieve similar behavior.

Requirements

PHP7.0+

Setup

Create a directory called /var/www/opcache_files or whatever name.

Create a file called /var/www/opcache_files/blacklist.txt, here is possible to specify files to be ignored. See details. Ensure OPCache is installed and enabled.

$ sudo phpenmod opcache
$ sudo php -m

Open php.ini in your text editor and enable the use of files in opcache section. See below example.

$ sudo nano /etc/php/7.2/mods-available/opcache.ini

Put the following lines.

opcache.blacklist_filename = /var/www/opcache_files/blacklist.txt
opcache.file_cache = /var/www/opcache_files
opcache.file_cache_only = 1
opcache.validate_timestamps = 0
opcache.enable_cli = 1

The Code

<?php
$file = "/var/www/info.php";

$uid = posix_getuid();
if ($uid) die("Must be root\n");

//We need to execute command as user www-data
$www_data = posix_getpwnam("www-data");
posix_setuid((int)$www_data["uid"]);

//Invalidate with force parameter
opcache_invalidate($file, true);

//Compile 
opcache_compile_file($file);

Seems like enabling file_cache_only will disable the opcache_compile_file function, see. So run the code with the following command to avoid that bug.

#php -d opcache.file_cache_only=0 encode_file.php

Donate

to 17PHL7Rw9rHujmRHkkPQGspLQ7rsDFV574

References

• BCompiler
• Bencoder
• Binary Webshell Through OPcache in PHP 7