Non-alphanumeric Backdoors
blog.sucuri.net
blog.sucuri.net
@$_[]=@!+_ apache_child_terminate assert base64_decode bzopen chgrp chmod chown copy create_function curl_exec curl_multi_exec edoced_46esab eval exec exif_imagetype exif_read_data exif_thumbnail extract fclose file file_exists file_get_contents file_put_contents fileatime filectime filegroup fileinode filemtime fileowner fileperms filesize filetype fopen fsockopen ftp_get ftp_nb_get ftp_nb_put ftp_put get_meta_tags getimagesize glob gzfile gzopen hash_file hash_hmac_file hash_update_file highlight_file image2wbmp imagecreatefromgif imagecreatefromjpeg imagecreatefrompng imagecreatefromwbmp imagecreatefromxbm imagecreatefromxpm imagegd imagegd2 imagegif imagejpeg imagepng imagewbmp imagexbm ini_set iptcembed is_dir is_executable is_file is_link is_readable is_uploaded_file is_writable is_writeable lchgrp lchown link linkinfo lstat mail md5_file mkdir move_uploaded_file parse_ini_file parse_str passthru pathinfo pcntl_exec pfsockopen php_strip_whitespace phpinfo popen posix_kill posix_mkfifo posix_setpgid posix_setsid posix_setuid preg_replace proc_close proc_nice proc_open proc_terminate putenv python_eval read_exif_data readfile readgzfile readlink realpath rename rmdir sha1_file shell_exec show_source stat str_replace symlink system tcpflood tempnam tmpfile touch udpflood unlink
find . -name "*.php" -exec printf "PHP found, you're probably owned: " \; -print -quit
Sorry, I know that "PHP is insecure" jokes are overdone, but that enormous blacklist that you have to find vulnerabilities seemed like it could be simplified a bit.PHP is a programming language - it would be a pretty useless programming language that can't do anything.
Go read that list - they are all useful functions. You would be hard pressed to make a usable language without them.
ಠ_ಠ is a valid javascript identifier.
Sneaky-wise, hypervisor/system management processor/other embedded stuff (SMBus, BIOS/EFI, etc) are persistent, and really quite tricky to be sure you're rid of. Disk controllers, and especially network controllers could be very effective since there are a vast number of ways of getting something down a network/into a file remotely.
Sneaky exfiltration/comms could include some of the EMI TEMPEST-style attacks if you can get close enough. For bonus points, if you can get line-of-sight, optical TEMPEST[2] using status LEDs is just about plausible.
[1] http://www.cs.columbia.edu/~mikepo/papers/gpukeylogger.euros...
[2] http://rootsecure.net/content/downloads/pdf/optical_tempest_...
These characters should trigger an alarm if caught by eye in a source file.