Why would an attacker use eval as part of a payload?

Question

Now don't get me wrong, there are already other questions like this. But I'm looking into more of how an attack could actually be done.

---

Instance A: A hacker gains access to a web server / hosting. They make changes to files so that instead of the original code, malicious code will run.

Ok, so I think scenario has many obvious problems. Even if a hacker somehow managed to get into a server, why would they use eval() of all things when they have the entire code at their disposal, it would probably make more sense just to run malicious code on the server and modify the existing code anyway.

---

Instance B: A hacker gains access to an consumer's device, uses a saved password to log into the victim's account and proceeds to execute malicious code.

In this instance, eval() wouldn't make much sense, because they have the account already. Either use the interface (say transferring money from the victim to the hacker), or just execute code in the DevTools?

---

Instance C: A hacker uploads malicious code to a public forum site (like SQL Injection). When a user opens this site, the tags <script></script> are inserted into the DOM rather than plain text.

Well as a general security measure, shouldn't all code be validated both on the client and on the server to make sure that code isn't being entered? Additionally, it's already a good practice to pass in data as plain text on client pages. This is just to raise the point that validation is important, not that eval() would be used. Because validation before any eval() is always important, so even if they used code as a string passed into eval() instead of inserting the code into the DOM using script tags, the code shouldn't even reach the database because the server should have validation anyway.

---

So in conclusion, I can't think of a scenario where eval() would be the best play for a hacker, as if they had access to that, I would assume that they would take better methods at their disposal (like modifying source and DevTools) rather than using eval().

Answer 1

The way I understand it, eval is often used because it allows flexibility, to run whatever code the attacker wants. It's part of their "web shell", their way to interact with infected servers. I guess eval is just one of the quickest and most flexible ways to interact with an infected machine and make it execute the attacker's code.

// very simple example: in practice often you will also find
// obfuscation, base64 encoding, compression, POST instead of GET, etc.
$command = $_GET['foobar123'];
eval($command);

// request that will likely execute any PHP code on any server
https://www.example.com/index.php?foobar123=code_to_execute_here

Other access methods are probably not that flexible. For example, suppose the attacker has admin accounts in several infected CMS's. Only using their admin account, to run their malicious code they would have to install a malicious extension, and each extension should be coded specifically for each CMS type (WordPress, Joomla, Drupal, etc.). So it looks like it's hard to find a quicker and more flexible method than eval (or similar functions like exec, etc.).