Well, there are a few things to think about here.
Which options do the server administrator have to detect the backdoor?
The most common way would be to use an Anti Virus and search for the file using different techniques, like checking the checksum and so on.
Another way is to simply search for newly created files, or files that just don't belong (They would normally look for strange files in their image and upload folders)
To counter this in a simple manner, I would make a backdoor and then NOT share it with the whole world as the creators of the normal C99 and R59 shells did.
And then the backdoor has to be placed somewhere where it wont raise any suspicion (as in NOT the two folders I just mentioned).
One clever way, if you have write access, is to hide the backdoor in a file that already exists in the system.
Let's say that they have a CMS installed (Joomla for example), then hiding the backdoor code in a file that already exists, will make it a lot less likely to be detected (provided you have kept the code to yourself for as long as possible so that AV companies wont add it to their definition files).
I suggest the method to hide it, would be to just put an if statement at the beginning of the file that checks a get parameter called "stgId" (or something else the file is not likely to use), and then have a function at the END of the file with a common name like "hashStringContentTrimmer" (not common maybe, but still less suspicious than "thisIsAnEvilFunction"). And then of course, if the get parameter is set, the function is called (the function would contain all your backdoor code).
Some coders would also encrypt or encode the code somehow so that it can't be read, and yes that's a pretty good idea.
But personally I like to be sneaky and a bit subtle "the other way around", by doing LESS strange things to hide it, and more things to just make it look as normal as possible.
I use the same principle when writing malware in C for different Operating system, that if I don't touch any system files, and just try to focus on the user files (passwords and such), my malware is less likely to be detected, especially since most anti virus software will always try to protect the system resources that need admin privileges, so if you just stay away from them, you can survive longer.
So yeah, to sum it all up,
just act normal ...
. Hope my year works out well.....
